Live video of House SOPA hearing - <AUTHOR> http://judiciary.house.gov/hearings/mark_12152011.html

<comment><USER2> Wow, it's only being made worse. Bob Goodlatte (R-VA), from what I can tell, is adding the payment processing blockage suggestion from Google in the last hearing, without removing any of the terrible, terrible components already in it.

The entire speech, too, was full of equivocation and mass confusion: sawdust breaks have exactly NOTHING to do with SOPA. Equivocating on physical goods and digital goods, when it comes to safety, is asinine.

Edit: HOLY HELL. Melvin Watt (D-NC) just said almost exactly: "A free and open internet is not unduly compromised by these changes to stop theft and piracy online." . . . "Trusting private rights-holders against foreign infringing sites will allow us to stop the compromise of US citizens and the influx of compromised goods." . . . "We need to be just as aggressive on the internet as we are with brick-and-mortar stores." . . . "This bill allows us to get into the internet." . . . "My perspective, as an old country boy, we need parallels on the virtual world to what we have in the real world." YOU ALREADY HAVE THEM!!!

Zoe Lofgren (D-CA) is up: please save us. YAY! "The integrity of the Internet is very much at risk." . . . "Especially disturbing given that today is the anniversary of the First Amendment." "The internet is not lawless. Breaking the law can already be punished, just like the physical world. But we have shut down illegal conduct at the source. The government has never tried to use the network itself to prevent illegal conduct . . . This will be historic, and not in a good way. Once the government has a taste of this power...expanding it will be irresistible. The US Government has never tried to monitor mail to prevent some sort of illegal content from being sent." Support this congresswoman!

Jim Sensenbrenner (R-WI) reminding us all that NOBODY was qualified to comment on DNSSEC issues. Good scenarios, including phishing-style attacks mimicking SOPA-takedown-esque redirects.

Howard Berman (D-CA) argues that "we can't stop the foreigners from stealing" argument. But that's always been the case, whether physical or otherwise. We can't stop a foreign company from making, say, fake Nike clothes and selling them in South Africa. You _can_ work with foreign governments to shut them down according to their own laws. And once again, Zoe Lofgren nails it in her response: "This is the beginning of the balkanization of the internet."

Chaffetz (R-UT) says, "Let's get some nerds in the room." "How can you support a bill that will dramatically change how the internet works without understanding what it does?"

Alright, back to work. But this doesn't seem like SOPA's being fixed in ways that are important.

<comment><USER3> _"Let's get some nerds in the room"_

Now that's a disruptive thought. :-(

<comment><USER4> > _"Let's get some nerds in the room"_

Was that a direct quote? I'm Canadian, which means that I have no impact on this legislation whatsoever. I can't email my congress(wo)man, threaten to vote for the other guy, throw money behind a better candidate, etc. All I can do is sit back and hope that somehow you yanks'll take care of it, so therefore I try not to pay too close attention to this since it depresses the hell out of me. As such, I wasn't watching the proceedings today and don't know if that's a direct quote or not.

If it is, then I find that comment extremely disturbing. The reason being that Congress, being made up mostly of old people largely out of touch with technology (senate.gov lists the average age of members to be 56.7 years in the House and 62.2 years in the Senate[1]), they should be looking to the younger generation in general, and experts in technology specifically, to help them make informed decisions. Calling these people "nerds" seems incredibly derisive and shows a general lack of respect for the very people that can best help them.

It's appalling.

[1] <https://www.senate.gov/reference/resources/pdf/R41647.pdf>

<comment><USER5> Just to let you know, that is a quotation, but it wasn't meant in the derisive manner (as you decided to interpret it). On the contrary, the reasonable members of the House understand they need more technical people to weigh-in and are pushing for another hearing with such people present.

</comment></comment></comment></comment><comment><USER6> Mr Chaffetz is my new hero. More politicians should raise the issue of people not having a clue what they're on about. Even better, raising it eloquently.

<comment><USER7> "If we can't get the definition of domestic internet site right then we're not ready for prime time." Chaffetz

</comment></comment><comment><USER8> I want some questions answered by the proponents, lobbyists and Congresscritters backing this thing:

1\. Why do you need to avoid due process? The lack of oversight (by the courts) is what makes this like censorship in China, Iran, etc. With SOPA, all anyone need do is _claim_ copyright infringement against some web site and it gets shut down and blacklisted-- correct or not, the targeted site owner is censored off the internet and cut off from their income simply because someone pointed a finger. That's bullying, plain and simple, and it's unacceptable.

2\. What punishment is included for abuse of this lack of process? Without punishment, corporations can censor competitors, politicians can censor opponents, governments can censor citizens simply by alleging infringement against them.

</comment><comment><USER9> I've been sitting in a hotel lobby for literally 24 hours over the last two days. There have been two different news stations playing this entire time. I have heard news coverage of all sorts of topics, but nothing discussing SOPA.

In fact, the only thing I've seen was an ad (presumably by the MPAA or RIAA) saying that piracy costs jobs, concluding with the phrase "Stop Online Piracy." How is it possible that neither of these stations even mentioned SOPA? Is there really that little public interest in the topic? They're talking about apple cider recipes right now.

<comment><USER10> The news stations are owned by media conglomerates that back SOPA. There is an obvious conflict of interest at play here.

</comment></comment><comment><USER11> Wow, a guy admitted that he doesn't know if he wants to use modern technology, yet he's expected to make an informed decision about this. We're pretty fucked.

I rage-quit watching the video after about 2 minutes.

<comment><USER12> You can't expect every congressperson to be an expert on every bill they vote on. That is why they have assistants; to research the matter and brief the congressperson on it. Frequently their opinion will also be heavily influenced by lobbyists, rather than their own knowledge of the subject.

<comment><USER13> Except that doesn't normally happen... with technology bills, anyway. Or their assistants do not have the proper expertise or foresight.

</comment></comment></comment><comment><USER14> Mr. Chaffetz is kicking ass pointing out that they have not taken into account any of the technical issues. "It's like performing surgery without a doctor." "Bring in the nerds."

</comment><comment><USER15> This saddens me. I just saw Polis attempt to grant an exemption for University run DNSs (something already in place for businesses). The amendment was rebutted with a meaningful argument. Then I watched 20 minutes of completely mislead arguments such as people thinking like this would mean universities could freely violate copyright, post copyrighted material without legal consequences, and anybody at a university is immune from prosecution when downloading copyrighted material. It was eventually voted down. Ugh, clueless people...

</comment><comment><USER16> I honestly wonder how many people in that room actually:

1) Understand what this girl is saying,

2) Understand what they are about to vote on,

3) Deserve to vote at all

God bless America!

<comment><USER17> She's barely comprehensible and monotonous besides. Nobody in that room is listening to her anymore. All three people in the frame behind her are looking at a screen.

Ridiculous.

<comment><USER14> My understanding was that her reading could have been avoided if a member who opposed the bill removed their objection. Basically, this was a way to stall progress on the bill and nothing more. No one was meant to really listen, I think.

On an unrelated note, today I discovered I definitely do not have the patience for congress.

</comment></comment></comment><comment><USER18> "If you don't know what DNSSEC is, you don't know what you're doing."

Truer words...

</comment><comment><USER7> Stream Address: mms://a1481.l6576439480.c65764.n.lm.akamaistream.net/D/1481/65764/v0001/reflector:39480 Video Codec: WMV3 Audio Codec: WMA2

<comment><USER19> I had some difficulty getting this to work on the Mac with either VLC or Quicktime/Flip4Mac. I ended up getting it to work using mplayer.

</comment></comment><comment><USER20> How ironic that the Internet could be saved from censorship (SOPA) thanks to the fear of cyber-terrorism (the DNSSEC issue).

</comment><comment><USER21> The only appropriate response to this is a message prominently placed on Google, Facebook, Youtube, eBay, Amazon, Yahoo and a Wikipedia blackout.

</comment><comment><USER22> Watching this makes me realize that we don't need new regulations... we need new leaders... leaders who can compete and are knowledgeable on a global scale.

<comment><USER23> No such thing can exist in a world of seven billion people. If your model of government requires that, it is doomed to absolute failure. The correct answer is to decentralize more and reduce our need for "leaders" in general.

</comment></comment><comment><USER24> Why should we obey physical boundaries? Internet should be for people across national borders. If anything, we should establish our own government for the Internet that actually knows and understands what they're talking about.

</comment><comment><USER7> "Lets bring the nerds in and get this right" -- awesome

</comment><comment><USER14> Something that pro-members of this panel seems to miss is that it requires the creation of a mechanism to enforce the provisions of this bill, and that mechanism can be abused far beyond the scope of this particular bill.

</comment><comment><USER25> Justin.TV link:

<http://www.justin.tv/unearthed365#/w/2248548160>

<comment> the-cakeboss For anyone else looking for an online alternative:

<http://keepthewebopen.com/sopa>

</comment></comment><comment><USER26> Quick, someone file a copyright complaint against the broadcast and get it shut down! We can't risk public knowledge of this hearing, er, I mean, _IP infringement_ , getting out!

</comment><comment><USER27> In watching the live stream there is some young-ish woman speaking so fast in order to get through the particular amendment she is (I'm assuming) required to read verbatim, and in such a monotonic tone, that I can't understand the reason for doing so. The people listening surely can't be retaining what it is that she is saying. It would be much more prudent if (gosh forbid) everybody involved had done their homework, read up on the appropriate amendments prior to this hearing, and came prepared to discuss and debate merits. Ya know...kinda like what we all had to do growing up. Do your homework. BTW, there's a woman furiously typing away on a blackberry with an iPad in her hand and a man on an iPad who are both on camera directly behind this woman speaking. I rest my case your honor.

<comment><USER28> Is this your first time watching congress? Yes, shes required to read it, all you've really said is that its silly for her to do so, which it is. But its a formality and they'll normally move to have her STFU. In this case its a procedural runarund. Like a quorum in the senate, nobody actually cares that everyones there, and if they did care so much about attendance they'd have a better way to take it.

They did their homework beforehand, otherwise the chamber would be empty, like always.

<comment><USER27> When I have watched hearings in the past it has been to listen to debates (most of which wind up being read verbatim from a piece of paper), but the language used is more natural than that of a proposed bill/amendment.

As for doing their homework, from the events surrounding SOPA which have taken place to date and in reading the list of amendments to be discussed, I don't believe these JC members - save for a few like Lofgren, Polis, Sensenbrenner, Chaffetz - have done their homework.

Two of the most important amendments over the next two days: * performing a study on the impact of any bill prior to its enactment (why this isn't a part of judiciary procedure escapes me) * an expiry on the provision of the bill after 5 years, which I think is a wonderful idea.

</comment></comment></comment><comment><USER29> Holy F___ what a bunch of idiots. Chaffetz , Lofgren and Polis seem to be the only ones who gets this. We are totally screwed if this moves forward. DMCA made worse.

</comment><comment><USER30> I am a n00b to politics but why is that girl speaking so furiously? No one is/can understand that. They should do some debate. That seems to be useless.

<comment><USER7> it's a matter of course to read the amended bill into record before they proceed. everyone sitting there is presumed to have already been familiarized with the textual revisions

<comment><USER30> Then why not simply insert the document in the "record". That is precious time being wasted.

</comment></comment></comment><comment><USER31> If you're on a Mac, it seems that Chrome probably won't work. Open up Safari and click on the video stream link ([http://mfile.akamai.com/65764/live/reflector:39480.asx?bkup=...](http://mfile.akamai.com/65764/live/reflector:39480.asx?bkup=39655&prop=n)) For me VLC opened the stream then. You could probably directly open it in VLC as well, but that isn't what I did.

</comment><comment><USER32> This shit makes me want to be put into stasis. Wake me up when sanity returns to this world.

</comment><comment><USER33> We're discussing the live hearing in ##SOPA on freenode. Beware, there are redditors ;)

<comment><USER34> From someone who just joined - if you're looking for real discussion, don't bother. It's mostly insults and memes.

</comment></comment><comment><USER35> Are there any sites out there keeping track of how Congressional reps will vote? I just got a letter from my Senator saying she supports SOPA (and turns out is a sponsor of the bill). Gillibrand-NY

</comment><comment><USER36> What technology do I need to watch this video on a mac?

<comment><USER33> Getting windows media components for quicktime helped me.

[http://www.microsoft.com/download/en/details.aspx?displaylan...](http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=9442)

<comment><USER36> Thank you. Argg requires a silverlight install too. I'll bite the bullet

</comment></comment></comment><comment><USER37> Issa is pretty impressive. Considering he's Republican - even more so.

Also big thumbs up for Polis, Lofgren, Chaffetz.

<comment><USER37> Representative Polis just submitted for the hearing record the lyrics of the song "Internet is for porn". :)

<comment><USER37> Lofgren just pulled out ACTA. Big plus for her.

</comment></comment></comment><comment><USER38> We will need a medium to discover what sites cant be visited so we can reproduce the blocked sites over the black-market under-the-table internet. A place where we can read about opinions and objectives that have not been approved by the riaa and mpaa for public showing.

Our internet is turning into fox news, with talking points, narratives, brainwashing and censorship. Not on my watch!

Do a google search for fox news sopa. Guess how many articles reporting on some of the most important legislation on the Earth today? I saw zero. corruption meter reading 100.

Who is up for rioting if this passes?

<comment><USER39> I'm not up for rioting. I'm up for creating an back channel that the government doesn't know about, though.

(Think about all the other things that are illegal, like growing certain plants and crossing the street when the light is red. The laws are just there to oppress people that the government wants to oppress, and we'll never change that. One more thought crime on my rap sheet isn't going to make a difference.)

</comment></comment><comment><USER40> When will this be voted on?

<comment><USER7> Looks like today... [http://www.dailypaul.com/193200/breaking-news-sopa-being- vot...](http://www.dailypaul.com/193200/breaking-news-sopa-being-voted-on- today-today-also-bill-of-rights-money-bomb-for-karen-kwiatkowski-sopas- primary-challeng)

<comment><USER14> At the beginning of the session, the chairman stated that he expects the meeting to continue into tomorrow.

<comment><USER7> We can only hope...</comment></comment></comment></comment>


Specifying a PGP client that your grandmother could use - <AUTHOR> http://davidnoel.ca/specifying-a-pgp-client-that-your-grandmother-could-use/

<comment><USER2> The key management and signing needs to be fluid so that people can use their gpg on multiple boxes with minimal effort. I'm a big supporter of the idea of crypto but it has never had enough critical mass amongst my peers to be functional. This article does have some good insight into the problem. There are a lot of seamless peer to peer encryption apps but none of them are independent of a service provider in the way gpg could be and any good solution should.</comment>


Introducing 300m range Eddystone beacon suited for outdoor-indoor application - <AUTHOR> https://store.beaconstac.com/ <comment><AUTHOR> We at Beaconstac do not want marketers and business owners to restrict their beacon use cases to 100 meters!

This beacon hardware broadcast notifications in the range of 300m and have a battery life of more than 2 years. What hasn't changed at all is that these beacons still work out-of-the-box without a developer's effort.</comment>


Why we love Mozilla Persona - <AUTHOR> http://blog.zonino.co.uk/why-we-love-mozilla-persona-and-why-you-should-too/ <comment><USER2> _Persona vouches for you when you sign in. Really neat, no more password leaking._

The important thing here is that as Persona protocol (BrowserID)'s creator, Mozilla really really wants someone else (potentially _YOU_ the user) to run the Identity Bridge. Currently Mozilla does this for non-Gmail and non-Yahoo users too boost adoption. So when you sign up you are asked to give a new password on sign up. If you are paranoid, you should of course give a new password instead the one you use for your email (which I assume may be reused for multiple accounts...)

But being able to authenticate yourself on your own is what makes Persona useful.

 __edit __: at realworld crypto, this was given as a talk. This is Google 's possible direction.

[http://www.ietf.org/proceedings/81/slides/tls-1.pdf](http://www.ietf.org/proceedings/81/slides/tls-1.pdf)

</comment><comment><USER3> Biggest problem I have with Persona is one of it's main selling points; if you log in to one place you're logged into all the places. That may sound great, but it really isn't. It means that you can log out of a site because you don't want people sharing your machine to have access to it. You then log into a different, lower-security site. Instantly that first site is accessible again.

I wrote a whole thing on Persona a while back ( [http://lepidllama.net/blog/trying-out-mozilla-persona- browse...](http://lepidllama.net/blog/trying-out-mozilla-persona-browserid/) ) but that ended up being the killer for me. It might be fine for activities like posting comments on a blog, but any site which stores or presents some aspect of who am I to the world needs to be a bit more secure than that!

</comment><comment><USER4> I love Persona! I created a demo MVC3 application using Persona for authentication and its fantastic from a developers perspective.

[https://github.com/sergiotapia/ASP.Net-MVC3-Persona- Demo](https://github.com/sergiotapia/ASP.Net-MVC3-Persona-Demo)

Authentication is simple to implement and you don't worry about user password protection.

I'm surprised interest has died down for the project given how easy it is to use. Maybe Mozilla should market it more?

</comment><comment><USER5> How many people here know BrowserID/Mozilla Persona was based on the [http://swiftlogin.com](http://swiftlogin.com) project? [http://www.youtube.com/watch?v=dGQYHOzLMUk](http://www.youtube.com/watch?v=dGQYHOzLMUk)

</comment><comment><USER6> We use it at Mighty Spring ([http://www.mightyspring.com](http://www.mightyspring.com)) and it's pretty good! The documentation around backend setup is a bit confusing and doesn't cover some corner cases (like testing on dev servers) but with enough hacking you can get it to work. The front end plugin I went with ([https://github.com/altryne/browserID- jQuery](https://github.com/altryne/browserID-jQuery)) needed a bit of tweaking (to both the code and docs, which was submitted to them), but other than that, relatively easy setup.

Our site is uniquely targeted at developers, so I felt that using Persona as a login option was only natural.

</comment><comment><USER7> Last time I looked into persona, it was essentially unusable for my usage - there's no reasonable way to use a different email address to sign up for every site. I like to know who leaked my email address when I start getting spammed.

Edit: looks like they _may_ have have fixed it: [http://support.mozilla.org/en-US/kb/how-do-i-manage-my- perso...](http://support.mozilla.org/en-US/kb/how-do-i-manage-my-persona- account#w_how-do-i-add-another-email-address-to-my-persona-account)

Though I'm not sure if it remains usable with hundreds of email addresses.

<comment><USER8> That's one of the things I needed too, so I built this (sorry for posting it so much here): [https://www.persowna.net/](https://www.persowna.net/)

You can add your domain as a catch-all, so you can authenticate with email@example.com and it will use a single account to authenticate. Services will still see your custom email address, but you only need one password.

</comment></comment><comment><USER9> If there is one company I can trust my data with, it's Mozilla.

<comment><USER10> It's funny that the few entities we'd be more inclined to trust are the ones that go out of their way to make sure we don't _have_ to trust them: Firefox Sync does client-side encryption so you don't have to trust the server, Persona does authentication via an identity provider so you don't have to trust persona.org...

<comment><USER9> I didn't mean persona when I said trusting with my data. I am just saying if ever I could trust a company with my data, it would be Mozilla (shows how much I trust them).

</comment></comment></comment><comment><USER11> If you're like me and this is the first time you're hearing about this, and want to know more about the implementation, check the bottom of this page:

[https://developer.mozilla.org/en- US/Persona?redirectlocale=e...](https://developer.mozilla.org/en- US/Persona?redirectlocale=en-US&redirectslug=Persona)

Edit: I've checked out the login process in the linked site, and it works well, but the popup window U/I seems like it's ripe for phishing attempts. It would be very easy to replicate the look of that window and fool people into thinking they're using Persona when they're not.

</comment><comment><USER12> I guess this is just a sign that I am getting crotchety, but headlines like this just anger me:

 _Why we love /like X, And why you should, too_

My immediate reaction is always something along the lines of, don't presume to tell me why I should like anything. Tell me why _you_ like it, and be done with it.

<comment><USER13> Your anger is misplaced. They did do exactly that.

</comment></comment><comment><USER14> I use it for [http://www.4four.org](http://www.4four.org) and really like it.

The one small complaint I would have is that it would be great if (after initial setup) the login process was a bit faster. It should be quicker than the old-school username and password IMHO, but with the animations and latency on authentication it all seems to feel a bit sluggish. Especially as the cookie for it expires frequently - which is a bit shit for users of a forum where you're normally signed in until you decide otherwise.

This is still in my minor complaint box because I suspect there's tweaks I could do which I haven't had time to explore yet.

<comment><USER8> The site cookie doesn't have much to do with the Persona bridge cookie. For example, for my sites, I expire users after a month, so they don't have to log in more frequently than that.

Persona never comes into it, unless they manually log out.

</comment></comment><comment><USER15> The FIDO alliance is the other major industry standard that is being started. [http://www.fidoalliance.org/](http://www.fidoalliance.org/)

</comment><comment><USER16> Persona is _awesome_. I use it on all my sites.

But it also proof that being awesome not only is not good enough to be successful, but simply doesn't matter. The user is not interested in a solution that is awesome, but one that doesn't scare him. And a big ugly third-party popup is as scary as stuff on the web gets these days.

Remember Ogg Vorbis?

<comment><USER17> Vorbis ended up being very successful in some niches - audio for games springs to mind.

Persona might find its own niche, even if it never completely displaces Facebook user authentication on the web.

<comment><USER18> And Spotify uses it too - it just is not very visible [https://support.spotify.com/uk/learn- more/faq/#!/article/Wha...](https://support.spotify.com/uk/learn- more/faq/#!/article/What-bitrate-does-Spotify-use-for-streaming)

</comment></comment></comment><comment><USER19> On of my biggest problems with Persona (and why I stopped using it almost exclusively) is that the popup dialog is badly designed. For instance it has email and password as two consecutive fields which confuses my password manager greatly with different accounts. Secondly does it not work at all for me on mobile devices.

</comment><comment><USER20> The UK government is about to launch an Identity assurance scheme where different providers (Post Office etc) check your drivers license then give you an account hw in is then oauth'able

in short Facebook logins but with actual real names that like governments can trust

just saying that this might be the start of what usually happens to private companies colonising what turns out to be a public good

</comment><comment><USER21> I've been using Persona as my sole login mechanism on [http://letscodejavascript.com](http://letscodejavascript.com) for over a year. I _want_ to love it, but I don't.

The goals behind Persona are excellent: strong privacy protection and relieving website operators of cumbersome and error-prone authentication management. I love the idea. It's why I implemented Persona on my site.

The execution of Persona has been a bit wobbly. Logins are critical infrastructure and it doesn't feel like Mozilla is approaching Persona from that perspective. The team has been _fantastic_ (thanks, callahad) but when things go wrong, it can take a long time for them to get resolved. Meanwhile, I'm left scrambling for a workaround.

An example: when the Yahoo bridge was implemented, it broke Persona for everyone who used a Yahoo alias [1]. A nasty break that returned a non-helpful error message. Something that serious merits an immediate rollback, in my opinion--but instead, it was left in place for several weeks until a interim solution was rolled out. The interim solution has some fairly serious UX problems, but the full solution has been open for 10 months now [2].

I want to love Persona, and I can't really afford the time required to do my own authentication, but it scares me that I'm so dependent on it.

[1] [https://github.com/mozilla/persona-yahoo- bridge/issues/178](https://github.com/mozilla/persona-yahoo-bridge/issues/178)

[2] [https://github.com/mozilla/persona-yahoo- bridge/issues/201](https://github.com/mozilla/persona-yahoo-bridge/issues/201)

<comment><USER22>
      > ...I can't really afford the time required to do my own
      > authentication...

Just curious: What does your perfect solution look like?

<comment><USER21> Perfect solution? It works like it was custom-built for my site, is as easy and predictable to implement as Persona's `get()` API, and of course has excellent security, privacy, and operations.

I would have been willing to pay for such a thing had it existed when I started. It would have needed to be proven, though, because I worry about longevity. The exact price isn't so important, within reason; say, less than $100/mo. At the higher end of that range, I'd expect it to have some serious word-of-mouth gushing.

</comment></comment></comment><comment><USER23> Here is one of the reasons why I personally believe in and feel we really need persona: [https://news.ycombinator.com/item?id=7133965](https://news.ycombinator.com/item?id=7133965)

</comment><comment><USER24> We used Persona for [http://bit.ly/blibonline](http://bit.ly/blibonline) \- and one of the problems we faced was that we would have liked the registration process to let our users tell us the name / icon (avatar), which was missing in Persona then. Any news on the timeline for these additions to Persona? (OpenID gives those two elements from registration/usage)

<comment><USER8> I think the preferred way to implement this is with an interstitial after the login, and then they can be changed from the settings page, as usual.

</comment></comment><comment> workhere-io Shameless plug: I've made some code examples of how to integrate Persona with your site: [https://github.com/workhere- io/personaexamples](https://github.com/workhere-io/personaexamples). The examples are for Python (Flask) and PHP.

</comment><comment><USER25> I use Persona and I wish more websites supported it.

</comment><comment><USER26> I really like the idea of Persona, and it's very easy to integrate with your own site. However, it's still a bit unreliable. For example, clicking on the zonino login button just opened a mostly-blank page for me (white on the left, light grey on the right, with a pointy arrow in the middle; a bar at the bottom says "Mozilla Person...", but no way to log in.

If I do "F10 -> View -> Page Style -> No Style" I see various boxes, but it's not obvious how to proceed. I entered my email into the top-most box and tried clicking the "next", "sign in" and "OK" buttons, but none of them responded (there's also "continue", but that's greyed out). I think I had the same problem when I tried it last year.

Probably just some browser plugin issue, but would be nice if it were easier to debug... Works in Chromium though.

<comment> vertex-four Do you use NoScript? Persona is heavily Javascript-reliant.

<comment><USER26> OK, I finally figured this out. The persona tab is replacing the web-page. So, to log in:

1\. open _two_ copies of the page

2\. click the "Sign In" button on both

3\. a working Persona sign in appears in the first tab

</comment></comment></comment><comment><USER27> "We're sorry, but your browser is not currently supported." \--Persona, from Safari on iPad, iOS 7.

<comment><USER28> ...What? That's just bizarre. I tried the Persona signup form just now on a site and I had to enter my email address, pick a Google account, and it was done. Pretty much like any other OAuth signup, so I don't see why Safari in iOS wouldn't be supported.

<comment><USER27> I had private mode enabled. Works with private mode disabled.

</comment></comment></comment><comment><USER29> Persona is an elegant, powerful idea that is 100% in the users interest. I dearly want to see it gain traction. Kudos for disseminating your enthusiasm.

<comment><USER30> Here's a crazy simple way to implement Persona authentication for your Apache- deployed apps/sites:

[https://github.com/mozilla/mod_authnz_persona](https://github.com/mozilla/mod_authnz_persona)

(I know Apache may not be that popular with the HN crowd anymore, but I don't currently have the time to dive into nginx and do the same for it. Nevertheless, if anyone wants to do that, I'd be happy to answer questions and provide pointers into the Apache code.)

<comment><USER8> Oh wow, that's fantastic! I would love an nginx module that did this, although wishes don't go far.

<comment><USER31> You may try [https://github.com/wrr/wwwhisper](https://github.com/wrr/wwwhisper), although unlike the apache module, wwwhisper runs as a separate service (Django) that nginx communicates with using auth_request module.

<comment><USER8> Looks nice, thank you!

</comment></comment></comment></comment></comment><comment><USER32> I don't get why persona needs its own branding... Nobody knows what persona is. It should say login with Firefox. Did fb create a new brand for its login system? No it's just login with fb, same with literally every login service except freaking persona. Use your most popular brand instead of forcing all developers to evangelize a new brand. That's just not going to freaking work.

<comment><USER31> "login with your email" is IMO the most adequate wording

<comment><USER33> This may sound paradoxical, but Persona has nothing to do with actual email. Well, except for Mozilla-provided fallback/compatibility authenticator that, indeed, uses actual email.

It just a protocol that - oversimplifying things - allows a certain server (identified by domain name) to issue you a certificate that says that you have a name associated with that server.

It's usually an email, but can be anything that could be represented as (name, domain) pair by concatenating those with "@" character. For example, XMPP ID, forum nickname or system account.

<comment><USER34> That is true, however "login with your email" will be understood by The Average Internet User. Any discourse on login identifiers, domains, xmpp, certificates, et al will just scare them. That's a non-starter.

We use "login with your email".

</comment></comment></comment></comment><comment><USER35> We don't know your password. Google doesn't know you're signing in to Zonino... mozilla knows ;)

<comment><USER36> As someone else pointed out, Mozilla won't have to know once the protocol is more supported. Currently they're acting as a transitionary bridge, not a required element.

Also, iirc, Google doesn't have to know where you're signing in either. I'll have to double check that part.

<comment><USER8> The identity provider/bridge doesn't know either. They sign an assertion, so they know that you want to log in _somewhere_ once, but not where or when.

</comment></comment></comment><comment><USER37> > We think that Persona is a great attempt at improving usability, security > and privacy...

We use Persona and love it. However, I wouldn't trust Persona for securing sensitive information. There seems to be no password requirements (at least when I checked months ago.)

<comment><USER8> That's incorrect, the identity provider is not specified by the protocol. Each user can use whatever IdP they want, with arbitrary password requirements.

I built my own IdP that has 2-factor auth, for example: [https://www.persowna.net/](https://www.persowna.net/)

<comment><USER37> It's possible to implement an identity provider, sure. But that doesn't change the fact that there are no password requirements using Mozilla's default provider. Poor default design.

Btw, your service sounds very nice for those interested in securing a domain, but I was a little surprised by the pricing. Nearly as much as a Google Apps license itself.

</comment></comment></comment><comment><USER38> Sounds great. I need an e-mail provider that implements the protocol? Are there any? How can I implement it on my self-hosted e-mail?

<comment><USER39> Not necessarily. If the email provider doesn't implement the protocol, it will send you an email to verify when you log in.

Thanks to Identity Bridging on the Mozilla Identity Provider, Persona can also use the APIs of supported providers to verify your identity: it can verify a Gmail address by connecting with your Google Account, and has something similar for Yahoo! Mail as well.

<comment><USER38> Ah, I kind of understand... Thanks for your help :)

</comment></comment></comment><comment><USER40> Yet another OpenID/OAuth/Whatever? Another SPOF.

Give me separate logins and KeePass any day.

<comment><USER30> The protocol itself doesn't come with an SPOF. Only the transitional current implementation, required for bootstrapping purposes, does require the JavaScript shim hosted by Mozilla. In the future, at least Firefox itself (on desktop, Android, and Firefox OS) will come with built-in support.

And, quite importantly, running your own identity provider (which is another SPOF in many systems) is pretty straightforward and well-defined in the Persona ecosystem.

<comment><USER41> If Identity Provider goes down, it is a SPOF for the account, but the same is with FB/Twitter login

<comment><USER42> In Persona, the Identity Provider is not involved in each login, it just signs a temporary certificate which can be re-used by the browser, so as long as the downtime is under a few hours, the user shouldn't have much of a problem.

<comment><USER33> And if the Identity Provider's gone for a prolonged period now you've lost your identity with (almost) no means of recovery. Mostly, because, while you might believed the contrary, you didn't ever own your "own" identity in this scheme.

That's exactly what SPOF is.

</comment></comment></comment></comment></comment><comment><USER43> What happens to my account if Persona dies or is temporarily down? Does that mean that I'm locked out?

<comment><USER8> Nothing depends on Persona. For example, see [https://persowna.net/](https://persowna.net/), which I wrote and which you can use with your own domain for authentication. You can also install your own ID provider on your site and not rely on any third party.

<comment><USER33> And if "your" domain is suspended, revoked or just expired?

You don't own a domain, you only temporarily lease it from a registrar. Just like with the email account with an email provider.

<comment><USER8> Yep, and that doesn't stop us from relying on email for our identity.

<comment><USER33> I doubt if it's true. From my experience, email is usually used only as a credential, not an identity.

Some cloud evangelists try really hard to change that, though.

</comment></comment></comment></comment></comment><comment><USER36> But, this doesn't solve the issue that you're still trusting someone else with your secret (your password).

We need to move towards protocols like SRP[0] in general so that no matter where I'm logging in, noöne has my password.

[0]: [http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol](http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol)

EDIT: As ubernostrum points out, Persona is solving a different problem than SRP does. However, one of the reasons different identities (username/password combinations) are encouraged currently is because providers can't be trusted with the secret of your password.

<comment><USER44> _this doesn 't solve the issue that you're still trusting someone else with your secret (your password)_

If you run your own identity provider, you are only trusting yourself with your secret.

Also, nothing about Persona _requires_ password-based authentication -- you can use any mechanism you like to authenticate to your identity provider.

<comment><USER45> The problem I have with that is that I haven't found decent identity providers last time I checked.

Without some decent/proven implementations I'm hesitant to use it. I don't quite like using Mozilla's service (mostly not because of trust, it just feels half-assed not to go the extra mile and is considered an intermediate workaround/solution even by Mozilla, as far as I know). Without decent options to self host I guess I could implement it myself - but that's a big step.

So .. although I'm a fan of the concept, I'm still not using Persona anywhere.

<comment><USER30> Have a look at mine:

[https://bitbucket.org/djc/persona-totp](https://bitbucket.org/djc/persona- totp)

It's less than 150 LOC of Python code (plus some HTML templates and a few basic tests).

<comment><USER45> Will do, thanks a lot. Since my infrastructure box is mostly python based (radicale, for example) this might fit in nicely.

</comment></comment></comment></comment></comment><comment><USER46> So what happens when my Person account gets compromised?

I'll stick to my many accounts / many passwords approach, I think.

<comment><USER47> Use 2 factor auth to mitigate that? To me that seems safer than having 100s of different accounts with no support for 2 auth.

<comment><USER46> 2FA is a nice add one but not a panacea.

Any account will be compromised - it's only a matter of time. When that happens, it's best (as recent articles in Wired, Ars Technica and others demonstrate) to have a broad account "ecosystem".

<comment><USER47> Hm, interesting. I see your point.

What about Facebook/Google/Twitter Sign In buttons - do you think Persona is an improvement over those?

<comment><USER41> technically - yes, it frees me from being part of (google/fb/twitter... whatever network is trendy now) and still sign in, practically,at the present moment, no - only geeks know about it

Edit/update: if compromised, you loose all linked accounts, however, with google/fb/.... it is the same, but this is less leaky to 3rd party, if this comes as default login, then we would have only a dozen of logins (persona/email, + important accounts, e.g. banking something similar... ), not ~100 of them, thus resetting 100 passwords is just 1 action

</comment></comment></comment></comment></comment><comment><USER48> This doesn't work with JS disabled, with no indication that it doesn't work as intended (it just bounces the visitor back and forth between 2 pages).

Persona is very convenient for users, but it would be more secure to not trust a 3rd party.

<comment><USER49> My understanding of the technology is that the endgame for persona is that you don't have to trust a third party. Instead, the authentication will be provided by the browser itself (the protocol behind Persona is called Browser ID). The current implementation is just a shim until browsers provide support for it natively.

<comment><USER8> The authentication will actually be provided by your identity provider (which will usually, but not necessarily, be your email provider).

<comment><USER49> Did they give up on the in-browser stuff? Or did I just get the plan completely wrong then?

<comment><USER8> If I recall correctly, the in-browser stuff is just a UI for selecting your email address and contacting your identity provider.

<comment><USER50> I wouln't say "just". It solves an important problem, the fact that the site you are logging in could have a javascript keylogger to read the password you are going to enter.

<comment><USER8> Oh, certainly, I meant "just" as in "just the client-side part of the protocol".

</comment></comment></comment></comment></comment></comment></comment><comment><USER51> In principle, Persona is great. Not storing passwords is awesome, a non- FB/Google/Twitter identity option is important.

I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site ([http://www.sixquestions.co](http://www.sixquestions.co)) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our next-worst performer (Twitter), and half the rate of our best performer (Facebook). For all the concerns people have with authorizing Facebook/Twitter access, that is (in my view) offset by the alien-ness of Persona's login flow. We've heard from lots of users that logging in with Persona is unusual and they thought they were doing something wrong because they'd never seen anything like that.

So, as much as I believe in Persona, I'm about to deploy a change that removes it entirely. It adds a lot of surface area to our testing and future development, but if it means we lose fewer users in their signup flow, it will be worth it.

<comment><USER52> Here's an example: I just failed to login to Zonino myself.

I enter in the Gmail address that I use for registrations and other junk. I get the message: "Accounts don't match. You are currently signed into Google as [my normal Gmail address]. ... Force Google logout?" Forget that. I'm not interested in logging out of Gmail. Logging out of #1, into #2, out of #2 and back into #1 is more work that simple registration. I expect that I'm not the only person with this problem. I hope a solution can be found, because it would be really helpful.

<comment><USER53> Gah. We still need to switch from OpenID to OAuth for our GMail bridge; OpenID doesn't allow us to tell Google what address we're trying to authenticate. Sorry!

<comment><USER8> Need any help with that/is there a ticket?

<comment><USER54> I found this: [https://github.com/mozilla/persona-gmail- bridge/pull/114](https://github.com/mozilla/persona-gmail-bridge/pull/114)</comment></comment></comment></comment></comment>


ColdFusion Railo deployment in Jelastic, a user review - <AUTHOR> http://blog.jelastic.com/2012/05/15/coldfusion-railo-deployment-in-jelastic/ <comment><USER2> Very cool. Looking forward to trying it.</comment>


Session Management Using Express, MongoDB (node-mongolian) and NodeJS. - <AUTHOR> https://gist.github.com/dvideby0/284f5589d0a53250ffd1

<comment><AUTHOR> I am definitely open to any comments on how to improve upon this simple gist to use for a template</comment>


The Two-Liner – The Elevator Pitch of #StartupPR - <AUTHOR> http://www.onboardly.com/startup-pr/the-two-liner-the-elevator-pitch-of-startuppr/

<comment><USER2> Unfortunately, I find their two liner really weak.

"What do we do? We offer content marketing and PR strategy for startups. How do we do it? We offer a startup-focused three month process that gets our customers noticed, secures early user traction and acquires new customers. "

Just boiling your business down to two lines, doesn't make it interesting or understood. I have no interest in what this company does after hearing the two-liner because they told me what they do, not what they can do for me, and I think that is a big difference.

It's also just a bunch of buzzwords. Advice I got from a friend long ago was to speak as you would to a friend. You'd (hopefully) never speak to a friend in the terms used above. Don't fill yourself with self-importance by using what you think are big terms, make it simple and make it interesting, and like the article states, make it short.</comment>


The Mixtape Project - <AUTHOR> http://themixtapeproj.com <comment><USER2> I got this error. Hmmm...can't reach this page Make sure you've got the right web address: [http://themixtapeproj.com](http://themixtapeproj.com)

</comment><comment><AUTHOR> Just launched our site The Mixtape Project. Open source project looking for some users and feedback.</comment>


Hound: A service that comments on Ruby style violations in GitHub pull requests - <AUTHOR> http://robots.thoughtbot.com/introducing-hound

<comment><USER2> Can someone shed some light on the reason why we're still bothering with "line is too long" in 2014?

I mean I'm not talking 300 characters-long lines here that's ridiculous, but the idea that a line with 90 characters is "too long" because some arbitrary limit in the width of certain terminal emulators back in the days was fixed at whatever number of columns seems really backwards.

So yeah, I'm open too any sane explanation of the why that is actually good practice beyond what I perceive as severe cargo culting.

<comment><USER3> It goes farther back than terminal emulators. the old IBM punchcards physically only had room for 80 characters.

I'm with you, though. 80 characters is _really_ short, especially if you are indented more than a few stops. It also discourages descriptive variable/method names, which harms readability of code far more than slightly longer lines.

<comment><USER4> I like to indent two characters per level of indentation. If the indentation uses braces, I indent one for the brace and one more for the code.

</comment></comment></comment><comment><USER5> I have always liked the idea of these bots roaming github, looking for bugs to fix and code that could be improved. But, it almost always ends up annoying somehow. Either the change is a false positive, the bot doesn't understand the project structure, or the bot just spams changes. Software development has too many unwritten rules and social interactions for a bot to just send PRs and comments.

Perhaps another type of communication, other than issues, PRs, and comments, is needed just for bots. I would tolerate my projects being scanned, if I could separate the human and bot communication streams. (And, block bots when they don't work as expected.)

<comment><USER6> You can tune Hound (and Rubocop) to your liking:

[https://houndci.com/configuration](https://houndci.com/configuration)

> the change is a false positive

I've been using Hound on about a dozen projects the last few months and haven't seen false positives. We built it atop Rubocop, which has been pretty well-vetted.

> Software development has too many unwritten rules and social interactions > for a bot

We've limited our guidelines to a subset that should almost always be "no argument, my bad, fixed in [SHA hash]." However, it comments instead of failing the build or mechanically changing the code because that the human should make the final decision about whether to make the change.

</comment></comment><comment><USER7> I love this. On just about any team I have worked on, whenever a fresh PR comes in everyone goes through it picking out style guide violations. It's tedious, annoying and sometimes arbitrary if the team doesn't have a solid style guide in place. Hound will let us get right to reviewing what matters: the code itself.

Up next: I would love a Unix utility I could filter my uncommitted diff through and get style guide violations before I even upload to GitHub. Use git for everything, baby.

<comment><USER8> This exists and is what Hound is built on. Rubocop runs lint checks against your Ruby code: [https://github.com/bbatsov/rubocop/](https://github.com/bbatsov/rubocop/) . The Emacs integration is great; it highlights failures in place. Hound looks interesting, but having Emacs/Vim integration gives you a tighter feedback loop, so you don't have to wait until Pull Request time to discover these issues.

<comment><USER9> RuboCop is great, but one benefit of Hound is it only checks code that has changed. Retroactively enforcing code style is usually a bad idea.

</comment></comment></comment><comment><USER10> [https://github.com/bbatsov/rubocop](https://github.com/bbatsov/rubocop) FTW. Integrate it into your test suite and you can see your mistakes before you push up a change for your team to see.

<comment><USER11> There is also a guard plugin for immediate feedback: [https://github.com/yujinakayama/guard- rubocop](https://github.com/yujinakayama/guard-rubocop)

Rubocop can even correct some style errors automatically now!

<comment><USER12> Hound is built on Rubocop

</comment></comment></comment><comment><USER13> Take a look at [https://github.com/mmozuras/pronto](https://github.com/mmozuras/pronto) \- does the same, has many adapters.

<comment><USER14> Hounds looks easier than pronto. Just turn it on for a repo and it does it's thing. With pronto looks like I have to configure it, then run commands (could make it part of default rake task, is suppose).

<comment><USER13> Yes, we run pronto when our Jenkins builds GitHub pull requests, so we get all those comments along with peer code reviews. And no separate web app is necessary.

</comment></comment></comment><comment><USER15> One thing I've liked with hound is that when it comes up with what I'd consider a "false positive," such as a line with a url that can't be split, I can just reply inline to explain why that couldn't change. This pull has a lot of examples of that: [https://github.com/thoughtbot/griddler/pull/119](https://github.com/thoughtbot/griddler/pull/119)

<comment><USER16> It's hilarious how houndci acts like some stubborn human, responding to complaints with the exact same suggestion.

<comment><USER15> Yeah, that happens if you force push.

<comment><USER9> That's not good. I opened an issue on GitHub.

[https://github.com/thoughtbot/hound/issues/182](https://github.com/thoughtbot/hound/issues/182)

</comment></comment></comment></comment><comment><USER17> The marketing site needs some work. There's no details about pricing that I can find and no information about configuring your own rules (I had to read the source code to see if that was possible). I am not going to sign up with GitHub to see either of those things, they need to be public.

<comment><USER14> It's a free service right now. We'll be taking all the suggestions and improving it as we go.

<comment><USER17> The announcement blog post implies otherwise:

> It places the focus value not on our super-secret-source-code but on our > handling of the hosting, _billing_ , and maintenance of that source code.

<comment><USER9> Sorry if it wasn't clear in the post but we do plan on charging for Hound in some way.

"We intend to charge in the near future to ensure Hound is sustainable, but public projects will continue to be free."

<comment><USER17> I don't expect this to be free. My point is that pricing should be clearly stated on the landing page for the product. You should have a pricing link or header, even if it just says "free for now, we're working on pricing".

<comment><USER9> Got it, thanks for the input.

</comment></comment></comment></comment></comment></comment><comment><USER18> This is really cool. Sure, similar tools have existed for a while, but Hound looks far simpler to setup and use than previous tools.

However, it would be nice to have this optionally run on every commit rather than only on pull requests. For my own personal projects, I obviously don't submit pull requests to myself, but I would like to have Hound double-check my code for me.

<comment><USER19> Not sure it should be obvious you don't. Pull requests are especially well- suited for a team environment, but using PRs in a solo project can still give a higher level of structure to the progression of your code. Gives you an opportunity to explain why you're doing what you're doing.

<comment><USER20> You can also accomplish this without pull requests by writing good messages in your merge commits like you would in a pull request description.

</comment></comment></comment><comment><USER21> This is great. Is it possible to use this as a rake task? I think it would be better to have team members run this locally just like they would run a test suite, make sure everything is up to par, and then open a PR. This would keep the communication stream in the PR nice and clean, focused only on code implementation.

<comment><USER10> [https://github.com/bbatsov/rubocop](https://github.com/bbatsov/rubocop)

</comment></comment><comment><USER22> This is a great product. I was working on a product when a new developer joined and started writing Ruby like he was writing in PHP, ignoring all of the programming language's idioms. What was worse was that with every commit where his code was "cleaned up", he'd put them back in!

<comment><USER9> Glad you like it!

</comment></comment><comment><USER23> Not sure I'd want to give this site Github access: [http://filippo.io/Heartbleed/#houndci.com](http://filippo.io/Heartbleed/#houndci.com)

<comment><USER9> Read the FAQ, this is expected when the server has been patched as long as the site is responding.

<comment><USER23> It was giving me a "houndci.com IS VULNERABLE." 45 mins ago.

[http://l.ew.is/shared/houndci.com_IS_VULNERABLE.png](http://l.ew.is/shared/houndci.com_IS_VULNERABLE.png)

<comment><USER9> Is that still the case? I'm seeing a timeout when I run the test.

[https://www.dropbox.com/s/txlzh5jzrt30afs/Screenshot%202014-...](https://www.dropbox.com/s/txlzh5jzrt30afs/Screenshot%202014-04-09%2015.13.37.png)

Again, we have reissued our certificates and installed them since the servers were patched.

</comment></comment></comment></comment><comment><USER24> I hate those github bots. Just use rubocop and run it in your CI.

<comment><USER9> Hound is opt-in, it won't ever add itself to your repo and start commenting.</comment></comment>


Alibaba's first smart car is up for pre-order right now - <AUTHOR> https://www.engadget.com/2016/07/06/alibaba-smart-car-iot-pre-order/ <comment><USER2> It's apparently branded under the Roewe marque (a premium brand of SAIC)

[http://www.cnbc.com/2016/07/05/alibaba-saic-motor-launch- int...](http://www.cnbc.com/2016/07/05/alibaba-saic-motor-launch-internet-car- roewe-rx5-suv-with-yunos-operating-system.html)

We have plenty of SAIC minivans here in Uruguay, and they seem to work ok, no idea about their reliability though.

</comment><comment><USER3> And yes, it is an SUV</comment>


Show HN: Contacts finds email addresses - <AUTHOR> http://contactsanalytics.com/

<comment><USER2> Is this actually email address scraping as a service? This is going to be used to enable spam. Any email sent to an address acquired from this service will be, by definition, unsolicited. Thus, if the email is in any way bulk (and honestly, what will the addresses returned from your service be used for, if not for sending substantively identical content to multiple people?), then the email fits the commonly-accepted definition of spam[1]. This is not OK, and will only make things more difficult for people who do legitimate, consent- based, email marketing.

I'm glad you're respecting robots.txt, but please say what your bot's user agent string is, so site administrators can block specifically your bot.

I'm loathe to be so negative on a "Show HN" post, but I strongly believe that this business is disreputable and that businesses of this type cause harm to the Internet. There may be value in finding blogs/bloggers matching specific queries; perhaps take email addresses out of the equation?

[1] [http://www.spamhaus.org/consumer/definition/](http://www.spamhaus.org/consumer/definition/)

Edited to add: just yesterday I received an email from someone I don't know asking me to try out his "weather API." The same email was clearly sent to a lot of different people, and it was sent to an address I have posted on websites, so it must have been scraped. I suspect the sender didn't think his email was spam, since he didn't try to hide his identity or use a bot net to send it. But being unsolicited and bulk, it was spam. It was sent via Mandrill so I reported it to Mandrill's abuse team; most people would probably just mark it as spam, harming the reputation of Mandrill's mail servers, thus making it more difficult for Mandrill to be used for legitimate email sending. I have a feeling "blogger outreach" would follow a similar pattern as this.

<comment><USER3> Would you consider it spam if someone manually went to a site, found their contact information, and sent them an email by hand? It appears to fit the same definition as "unsolicited", and yet, that is one of the purposes of a business placing their email address on their website.

I work in b2b software, where it's common for sales and marketing people to use publicly posted contact information for outreach (both buying and selling products). IMO, the formal definition of spam as "unsolicited commercial email" is somewhat broken in b2b spheres -- it feels a lot like "it's spam if I publish my information and you send me something that I don't want." The problem is the "something I don't want" is only determined after the fact.

<comment><USER2> The definition is not "unsolicited commercial email", it's "unsolicited and bulk." In your example, if you send the same email to every address you collect by hand, it would be spam. But if you send a different email to each recipient, actually making it relevant to the recipient's identity, then it is not spam[1]. (You're likely to get a much better response rate too!)

If the OP's service wasn't focused on email addresses, and instead enabled the user to research similar blogs and tailor an individual outreach to each one, then it would not be a spam enabler.

[1] Edited to add: this is per the definition from Spamhaus. According to lutusp's comment below, the legal definition in CAN-SPAM is different. IANAL.

<comment><USER4> > But if you send a different email to each recipient, actually making it > relevant to the recipient's identity, then it is not spam.

Don't mislead your readers on legal issues. If the e-mail is unsolicited and doesn't contain an opt-out link, in most cases it meets the legal definition of spam and violates the Can-Spam Act.

<comment><USER5> Not a lawyer so don't count this as advice but as far as I know, there's no requirement under can-spam to provide an opt out link, just that you make it clear they can opt out (e.g. by replying). [1][2]

That's a big difference if you're using database's such as the OP to find contacts to email personally and individually but in a commercial context.

I might be missing something with can-spam though?

[1] [http://www.business.ftc.gov/documents/bus61-can-spam-act- com...](http://www.business.ftc.gov/documents/bus61-can-spam-act-compliance- guide-business) [2] [http://en.wikipedia.org/wiki/CAN- SPAM_Act_of_2003](http://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003)

<comment><USER4> > Not a lawyer so don't count this as advice but as far as I know, there's no > requirement under can-spam to provide an opt out link

Source: [http://www.fcc.gov/guides/spam-unwanted-text-messages-and- em...](http://www.fcc.gov/guides/spam-unwanted-text-messages-and-email)

Quote: "Opt-Out – _The email must provide_ easily-accessible, legitimate, and free ways for you to reject future messages from that sender"

Not "allude to", not "hint at", not "suggest." The law requires that the sender's email message _provide_ an opt-out method.

> just that you make it clear they can opt out (e.g. by replying).

Absolutely false and universally discouraged -- _never reply_ to a spam e-mail.

> That's a big difference if you're using database's such as the OP to find > contacts to email personally and individually but in a commercial context.

Spam is spam, and it is clearly defined in the law. The reason for spamming the victims is irrelevant.

> I might be missing something with can-spam though?

I'll say.

<comment><USER3> I would consider saying "please reply to this message to unsubscribe" easily accessible, legitimate, and free.

I think spam is more complex than just saying "spam is spam". Especially in b2b (see the other comment about pharmaceutical reps).

There is a factor that includes relevance (negative correlation with spam). Another factor is automation versus doing it by hand. Another factor is the intent of the person who publishes their email. Another factor is whether the sender stops sending messages once requested. Another factor is the existence of a previous relationship.

Anyhow, I have one more question: can any message that is sent without automation (i.e., I type the message specifically to a recipient) be considered spam?

<comment><USER4> > I would consider saying "please reply to this message to unsubscribe" easily > accessible, legitimate, and free.

You're missing the point that by replying, the recipient establishes a relationship with the spammer -- he confirms that his is a working e-mail address, and he invites more mailings to that address. This is why security professionals warn to never reply to a spam e-mail.

"Don't Reply to Spam - Spam Control Tip":

[http://www.hoax-slayer.com/don't-reply-spam.html](http://www.hoax- slayer.com/don't-reply-spam.html)

"Don't Respond to Spam: Here's Why":

[http://www.pcmag.com/article2/0,2817,2376031,00.asp](http://www.pcmag.com/article2/0,2817,2376031,00.asp)

> I think spam is more complex than just saying "spam is spam".

It's very clearly defined, so there's no mystery about it. That's why I say it that way.

> Anyhow, I have one more question: can any message that is sent without > automation (i.e., I type the message specifically to a recipient) be > considered spam?

Yes, of course it can. Why? Because if that were accepted, spammers would hire poor third-world people to type out spam messages at one cent per message or less. Therefore, any unsolicited e-mail, meaning sent to someone who hasn't invited it, is spam.

<comment><USER6> "You're missing the point that by replying, the recipient establishes a relationship with the spammer -- he confirms that his is a working e-mail address, and he invites more mailings to that address. This is why security professionals warn to never reply to a spam e-mail."

Can you describe an opt-out mechanism that doesn't provide a spammer with exactly that same piece of "working email address" information?

If they're sketchy enough that they'd mis-use an "unsubscribe me" email as an "invitation to more mailings", surely clicking an "opt out" link would be treated the same?

(Personally, I'm happy to click opt out links for mail that's arrived by dedicated mass-mailing companies like MailChimp or Campaign Monitor - they've got a strong business case to not annoy email recipients, and although I as a Campaign Monitor user can easily generate a list of email addresses that have opted out of any of my mailing lists, if I were to abuse that list via Campaign Monitor, they'd shut me down pretty quickly)

<comment><USER4> > Can you describe an opt-out mechanism that doesn't provide a spammer with > exactly that same piece of "working email address" information?

An opt-out link carries only the email address, not the entire email header, so it conveys the absolute minimum information (and it can be visited independently of the email, by copying the link out of the email). Also, visiting an opt-out page is different than replying to an email for some complex legal reasons.

If a spammer ignores an opt-out request delivered to a Web page, he is in a very different position than if he replies to an e-mail sent by someone who doesn't know to avoid replying to a spam mailing.

The bottom line is that a spammer can say, "they emailed me, then I replied to what I thought was a customer's email." And this has been tried countless times. With an opt-out link, this dodge is removed.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I don't understand your plan selection. "analyzing max. 600 phrases/mo" What does this mean? I get to query your database 600 times? I get 600 phrases which weren't in your database? I get analytic s/statistics on them?

If these e-mails aren't guaranteed to be "100%" useful, and seem not to be hand-selected or have any human element involved, this just seems to be payment for a mail crawler. It looks a bit too much for me like a spam enabler.

And as abcd_f already mentioned, the recurring payment may be a mistake. As a start-up, I wouldn't subscribe for more than my "launch" month (s).

Hope it helps, best of luck!

<comment><AUTHOR> Ok, thanks for comment. I will think about that.

</comment></comment><comment><USER8> The concept is technically interesting, but I don't want my e-mail address to be harvested by third parties and sold for marketing purposes. I am not a lawyer, but in the EU (which is where I assume you are located) data privacy regulations require the user to consent to the use of their private data. The sites you collect the information from supposedly have permission to process private information by means of their privacy policy and relationship with the user; which as a third party, you don't have. One could argue the data is already public; but since the user can not consent – you have no relation to the user – you are going to find yourself in muddy legal waters, especially trying to base a business on that data.

</comment><comment><USER9> Very nice concept indeed. The How it Works section is a kind of a bummer. No real info on how the selection of blogs is done or how they results are ranked. Also I find the color scheme makes text very hard to read.

</comment><comment><USER10> I don't find this useful at all. I can easily get similar results searching for emails in Google. In fact, this service is probably best for people who don't know how to use Google at all.

If I wanted to find emails of Paleo bloggers, I'd just search for: paleo blogger "@gmail.com"

Also, good luck scraping Google if that's what you're doing. Even a few hundred proxies won't be enough after awhile as they're doing a very good job blocking scrapers.

</comment><comment><USER11> This is presumably to be used during PR stints and, given the $20 price point, this isn't aimed at PR agencies, but smaller companies. As such, a one-time fee would be a _far_ more sensible option.

I realize that you have bought into the service hype and now probably dreaming of recurrent revenue and lingering subscriptions, but in your case it's really trying to fit a square peg in round hole.

<comment><USER12> I think you're pretty spot on. A PR agency might pay 10x times this, but for a one off use by a startup or SMB a monthly charge doesn't make sense. Maybe offer pre-paid credits as well?

</comment></comment><comment><USER13> Give me a free trial and I dont get how it works from the how it works section. Just figured it's a scrapper of some sort.. looks cool.

</comment><comment><USER14> "For every e-mail we show you where we have found it - this way you can check if this is good contact or not."

Adding a comma after "For every e-mail" will make this sentence much more clear.

</comment><comment><USER15> How can I, as an individual (or perhaps a company) opt out? I'm sure some people would benefit from this service, but as others pointed out, I do not want my emails being harvested.

</comment><comment><USER16> Looks awesome - good luck :)

<comment><AUTHOR> thank you :)

</comment></comment><comment><USER17> Hey this is pretty cool! I'll find this useful soon.</comment>


Ask HN: small startups, what do you use for health insurance?  - <AUTHOR>

Do you use an HSA, or pay pricey premiums? I live in NYC, and (for me and my wife, who may try to start a family next year) am looking at plans of about $1.5-2K a month (assuming a child/children). As a couple only, it's about $1,300 a month. =/ What would you guys recommend in a situation like mine? <comment><USER2> This is an important question, it's the kind of thing that needs to be on an FAQ somewhere. Here is the info that I've collected in the last couple of months (US-centric, sorry):

relevant YC posts/articles:

<http://news.ycombinator.com/item?id=2247560>

<http://news.ycombinator.com/item?id=2851224>

links from the comments, or elsewhere:

<https://be.freelancersunion.org/benefits/> (you probably want to look this up, since they provide discounted health insurance plans for people in and around NYC)

<http://www.nase.org/Membership/OptionalBenefits.aspx> (smaller benefits, not full covereage, for people across the US)

<http://www.anthem.com> (For people in California - a sufficiently high deductible introduces risk but can drop your deductible to around $150-200 or less; mine is $108)

If you have a pre-existing condition, then you might find a plan through your state: [http://www.healthcare.gov/law/features/choices/pre- existing-...](http://www.healthcare.gov/law/features/choices/pre-existing- condition-insurance-plan/index.html) (is this an outcome of Obama's Affordable Care Act?)

deciding whether/how to claim this on taxes (I haven't quite fully understood this, though):

<http://www.irs.gov/newsroom/article/0,,id=220839,00.html>

<http://www.irs.gov/newsroom/article/0,,id=223666,00.html>

[http://www.usatoday.com/money/perfi/columnist/block/2011-04-...](http://www.usatoday.com/money/perfi/columnist/block/2011-04-04-tax- breaks-for-self-employed.htm)

advice via Reuters, FWIW: [http://blogs.reuters.com/small- business/2010/12/06/health-in...](http://blogs.reuters.com/small- business/2010/12/06/health-insurance-advice-for-entrepreneurs/)

<comment><USER3> In CA, pre-Obama, an Insurer cannot deny an employee based on a pre-existing condition. I believe, The Health Care Act made that standard across the U.S. Some people with pre-existing conditions in CA used to form husband-wife companies to employ themselves and get Insurance.

</comment></comment><comment><USER4> For reasons unbeknownst to me, NY is one of the most expensive locations in the US for health insurance. My wife and I are both healthy and have been able to buy good insurance with reasonable deductions for around $250 / month total in CA, CO, and OR. But I can't find anything in NY for less than 4x-6x that much. I find it hard to believe that the cost of care in NY is that much higher than in CA, so I'm assuming that some kind of moronic government meddling designed to keep insurance affordable has once again resulted in screwing over the people it was supposed to help.

EDIT: While not an unbiased source, this article indicates that my assumption above is exactly right: [http://reason.com/blog/2011/06/01/new-york-states- highly-reg...](http://reason.com/blog/2011/06/01/new-york-states-highly- regulat)

<comment><USER5> Unfortunately, the article doesn't answer the question of why NY had starkly higher insurance premiums before those two rules were implemented in 2009. I was purchasing insurance in NY in 2002-2005 and premiums were 3-4 times what they are in other states. This was before 2009, and partially before Timothy's law, and all that.

I think, perhaps, the fact that NY has such comprehensive support at the low end of the income distribution, through medicaid, family health plus, healthy NY, etc., causes all of those young, healthy but lower-income people to drop out of the market for insurance. This leaves higher-income and older people in the self-insured and employer-sponsored pools, driving up the base rates.

In any event, a study by the Manhattan Institute, as referenced by the article, isn't very trustworthy. It would be very hard for them to release a study that said anything different, which to me means that there is inherent bias.

</comment></comment><comment><USER6> There is no cut dried answer in USA. Parameters to review: * what is your (you/wife/family history) current health? * what is your current list of medications and will they even be covered by an insurance plan you like? * how much risk do you want to carry (less premium, higher deductible) vs the insurance plan (higher premium, lower deductible )? * where you live. Certain regions will have higher premiums. * family vs single. * how close can you predict your health expenses into the future year?

Options to consider * alumni associations, affinity groups, clubs etc. may offer health plans * talk with an insurance broker. Yes, a real live person, as they will be knowledgeable about the current market and any issues with specific carriers and plans. They usually are free to talk with and obtain quotes from.

If you can do it, get a high deductible insurance plan with an HSA for the years in which you are not having a baby. HSA contributions get some tax deduction status and those unspent HSA dollars can be carried in to the future. My CPA says HSA contusions are a good way to save for long term future medical expenses.

For the plan year you get pregnant, aim to understand the total costs and can an HSA / high deductible plan fit your finances. Will you be comfortable taking on the out of pocket expenses (the high deductible part) and continue making contributions to the HSA?

Will/can your wife work for a company that can offer health insurance?

Getting a plan in place is something that will take 2 to 6 weeks to get ini place so don't wait too long.

Now for the bigger question: do you have disability insurance and life insurance also in place?

Fyi, COBRA will most likely be more expensive than any plan you can get at the family level.

Hope this helps:)

<comment><AUTHOR> thanks! i have talked to a broker, and he pointed out several different options - all somewhat pricey unfortunately. as i expected, he viewed HSA's as a generally inferior option, thought that was a bit unclear why (i recall perhaps something to do about ease of reimbursement/coverage). not sure if that's actually true.

> If you can do it, get a high deductible insurance plan with an HSA for the > years in which you are not having a baby.

this seems like a good strategy. why not just use an HSA exclusively? is it due to risk of complications/cost during pregnancy? or do pregnancy costs likely come close or exceed premiums of a traditional plan anyhow?

> Fyi, COBRA will most likely be more expensive than any plan you can get at > the family level.

why is that? my wife is looking to quit soon, and is coming from a fairly large organization. and it seems like the cobra, group-negotiated rates are slightly better than the family rates i'm trying to negotiate on my own. just my own experience.

<comment><USER6> COBRA payments for health care are what the company paid for your healthcare, not just your portion. I worked at a large Fortune 500, my monthly premium was (2006) about $150 a month. COBRA was $985 a month. Personally purchased Family insurance plan was $300 month (though hard to compare these plans for their benefits, just the dollars). Yes, if the large company did a great job in negotiating, super, it may be lower than individual plans.

Having a baby has some uncertainty; is the baby growing fine, is the mother doing well, how will the birth go, what about the first year, etc. That is why I suggest looking at the total costs, the mother's health, and what financially you are willing to take on up front with an HSA. Sorry I do not have a clear path for making a decision.

HSA: there are two parts to this. The high deductible healthcare plan and the HSA account admin. For a healthcare charges up to your high deductible you would pay for it with your HSA debit card or electronic check. The amount still gets sent in to the insurance company so they can record it.

Once your deductible is reached then healthcare costs would still be sent to the insurance company, and based on coverage, the insurance would pay its part and any remainder would be paid by you, with your HSA account.

Any reimbursements issues would be with the insurance plan, hopefully not with the HSA.

</comment></comment></comment><comment><USER7> The Danish state.

Glad to see that I get something for my high taxrate.

<comment><USER8> I tend to think that socialized medicine is a great cost hedge for the individual citizen (ie even in Scandinavia we do pay for health care, so it's not 100% free like some people believe, but the cost is predictable and it can't ever get sky-high like in the US).

I think one downside to it is that it's hard to do anything out of the ordinary (ie some new drug or method or whatever) because health care is seen as a standardized gov't service. For customization, you still need privatized medicine.

Or am I wrong on this? I don't have a lot of insight into the health care system, honestly.

<comment><USER8> _I tend to think that socialized medicine is a great cost hedge_

Of course, for this to work, there has to be a lot, possibly the majority, of super-payers who pay more into the health care system via their taxes than they receive back.

So, Scandi style health care can in a way be seen as a government-enforced mandatory health insurance, except that unemployed people get it for (almost) free.

Then again, a huge socialized health care system might have better economies of scale (or they might be worse). Also, let's not forget that people can go to medical school for free in Scandinavia, which is bound to have some kind of effect.

<comment><USER9> "Of course, for this to work, there has to be a lot, possibly the majority, of super-payers who pay more into the health care system via their taxes than they receive back."

Yes... but, this is also true for for-profit non-socialized health care insurance.

</comment></comment></comment></comment><comment><USER10> Not sure about NYC, but I have been looking at starting my own business in Maryland and have been researching the situation. Here is what I found:

I can purchase my own high deductible plan at about 300 per month. This would be for me, my wife, and three children. Family deductible would be 10000. We are all healthy and I have the cash in the bank to cover a 10000 emergency. If I wanted no deductible it would cost about 1200 per month.

When purchasing insurance yourself, you may need to purchase separate maternity coverage, and you may need to wait several months after starting maternity coverage to get pregnant. Otherwise prenatal care and delivery would not be covered, although the hospital stay and baby care would be.

Not sure if New York has this, but Maryland has a special small business insurance pool. It allows small businesses to buy employee coverage cheap. If there are a few people involved this could be the way to go. Going this route would require talking to an insurance broker.

Good luck. Wish you the best of luck with the new family if you go that route. I have three children and it was the best decision ever.

</comment><comment><USER11> $2k/mo seems expensive even for comprehensive plans imho unless you have some conditions that bump it up. We're relatively healthy, two small boys, and opted for catastrophic/HSA option. Then we put the savings from the premiums into the HSA. I've found even with the routine visits for the kids and whatnot we still pay less than we would going with comprehensive. And worse comes to worse our total out of pocket is the same regardless. Point being, if you don't see the doc much, HSA makes sense. One nice thing is that our provider pays 100% of flu shots and routine health checkups which is all I use it for anyway.

That said... if you're starting a family... pregnancy (and RX) are usually (ever?) covered. So you might not have a choice.

As a small business, if it's just you and your wife (and your dependents) you can deduct the premiums though...

<comment><AUTHOR> Thanks for the info - that's helpful.

> That said... if you're starting a family... pregnancy (and RX) are usually > (ever?) covered. So you might not have a choice.

HSA's do seem to make sense, but the pregnancy and any potential complications were my main concern. It seemed from initial research that for this scenario, and regular plan seemed like the best option, unless you had a different experience? Perhaps use a typical plan initially, then switch to HSA's later assuming health is ok?

</comment></comment><comment><USER12> NYC provides a list of insurance options here:

<http://nyc.gov/hilink>

Some of the lowest-cost options are offered through Freelancers Union:

<https://be.freelancersunion.org/benefits/>

</comment><comment><USER6> One last item: you will have to shop each year. Was on Anthem for several years and then they raised their rates 30%, so shopped for a new plan. That worked well for two years and then that insurance company ran into financial trouble (in to receivership) so went back to Anthem at about the same price (ironic).

</comment><comment><USER3> We are in California. Over the years of our business we have gone from Blue Cross/Anthem to now being with Kaiser- at one point we had a carve out plan where we had both. However, it always makes sense to go through a Broker who knows all the ins and outs each Insurer and its plan. The broker commission is paid by the Insurer not you directly. I believe the broker receives more when you add more employees to the plan - so they are invested in your growth. For our Company, the Company pays the first $200 of the plans monthly premium, the rest comes out of the employee paycheck, pre-tax. For employees 20-29, the premium plans range from $150-400. For 30-39 and Employee+Spouse or Family they go up to $300-1000. The employee can pick any plan that is offered (HSA, HMO, PPO, hybrids).

<comment><USER3> The monthly contribution amount is determined by company policy. It can be a $ amount or %. It just needs to be stated in policy and applied consistently to all employees.

</comment></comment><comment><USER13> We're a small team of three (25, 28, 28) and the company pays for each person's individual plan with Anthem Blue Cross rather than a group plan which was more expensive for essentially the same coverage. It's about $200 per person per month.

<comment><USER14> Be careful with that, since individual insurance can and will drop you when things go south. A group plan protects employees from that although rates will go way up if someone has a major health issue of some kind.

</comment></comment><comment><USER15> I just went through this process. For my team of four, we went with an Anthem Blue Cross PPO,.allowed us to provide health coverage for a remote worker in a different state. My recommendation is to find a good insurance agent who can help you choose. We went with Brad @ <http://www.allpointe-is.com> in San Francisco. He was really helpful. In case you are wondering, using an insurance agent does not cost any extra.

</comment><comment><USER16> Back in 2009-10 my small firm used to pay about $1300 for a family (spouses + kids) in CA. This was for an HSA plan with United HealthCare and we did a considerable amount of research before deciding on this plan (not the cheapest, not the most expensive). I'm not sure if this is the same in NY, but I would max out your HSA account before getting pregnant for an efficient tax use of that type of account.

</comment><comment><USER17> Sounds to me like this is an area ripe for disruption. Next YC semester should include a startup that sells health insurance to its peers...

<comment><USER18> Unless you have some way to get around the adverse-selection issue, I don't see how opt-in insurance for small companies is a problem a startup can solve.

</comment></comment><comment><USER19> Some friends on mine have a StartUp house. Their health plan is a cabinet filled with multi vitamins. [https://photos-2.dropbox.com/i/xl/n5zv5xdPSpq4KSJXVNr5YuYb0l...](https://photos-2.dropbox.com/i/xl/n5zv5xdPSpq4KSJXVNr5YuYb0lPdQRS0HnJqqqmoudk/4723630/1323644400/40831a5/IMG_20111023_001730.jpg)</comment>


Show HN: The fastest way to Base64 in the browser - <AUTHOR> https://github.com/superhuman/fast64 <comment><USER2> Interesting, been using base64-url, is there benchmarks somewhere you have posted?</comment>


3 Big Reason to use a Mobile PaaS: Versioning, Security, Push - <AUTHOR> http://joyeur.com/2011/11/09/partner-post-stackmob-says-if-you-arent-using-a-paas-for-your-mobile-apps-youre-missing-out/

<comment><USER2> Versioning is definitely a royal pain in mobile apps where the API calls are changing so quickly. I'd love to see some more stuff on how StackMob handles that in subsequent posts.

<comment><AUTHOR> Great idea. We are working on that blog post as we speak!</comment></comment>


1000-year-old mystery solved:Unlocking the molecular structure for medieval blue - <AUTHOR> https://advances.sciencemag.org/content/6/16/eaaz7772 <comment><USER2> P. Nabais, J. Oliveira, F. Pina, N. Teixeira, V. de Freitas, N. F. Brás, A. Clemente, M. Rangel, A. M. S.

>The molecular structure of the medieval watercolor known as folium has finally been solved in the 21st century. The interdisciplinary approach taken was the key

>following medieval instructions

>multi-analytical characterization of its structure was made using HPLC-DAD- MS, GC-MS, NMR (1H, 13C, COSY, HSQC, HMBC, INADEQUATE), and computational studies.

Sometimes that's what it takes to build some momentum with technical innovations over a millennium.

But then you can come up with conclusions like this:

>In conclusion, chrozophoridin was used in ancient times to make a beautiful blue dye for painting, and it is neither an anthocyanin — found in many blue flowers and fruits — nor indigo, the most stable natural blue dye. It turns out to be in a class of its own. Thus, we believe that this will be not our final word on this amazing plant and its story and that further discoveries will follow soon.

I like that last part,

>this will be not our final word

>further discoveries will follow soon.

That's the kind of confidence and momentum too few workers will ever achieve, and in this case looks scientifically legitimate to me.</comment>