Google's Future: What The Search Engine Will Look Like In Next 20 Years - <AUTHOR> http://www.techieapps.com/googles-future-what-the-search-engine-will-look-like-in-next-20-years/ After Twenty years, Google won't just provide you with what you are searching for but it could know what you desire before you know it yourself. That's according to Marissa Mayer, Google's 20th hire and the company's vice president of maps and location services. <comment><USER2> _"Can we predict what restaurants you'll like when you're in a new city? It may not be that you search for pizza, but we know you tend to like pizza places, or you tend to like more casual, loungey bars, so we can suggest things."_

Thanks Google for helping me stay the same forever. Just what I needed a search engine for.

 _"I actually think most people don't want Google to answer their questions. They want Google to tell them what they should be doing next," Schmidt said_

And you would be totally wrong to think that. Searching for things doesn't work nearly well enough for Google to move on to useless suggestions that extrapolate my current behavior in a completely uncreative way.

They are simply on the wrong track.

<comment><USER3> _Thanks Google for helping me stay the same forever. Just what I needed a search engine for._

So you'd rather be pushed in the direction of becoming the "average consumer"?

<comment><USER4> I would say that helping him stay the same forever would make him be an "average consumer".

<comment><USER3> Not really true. If he's a vegetarian and most people aren't, he's not becoming more average by seeing vegetarian restaurants ranked above steakhouses. He's just getting results that he's more likely to find useful. (Try asking your vegan friends if they want a steak for dinner tonight. Do that every day. See if they get annoyed at all.)

Same goes for programming language. If you're programming Java and are googling for the Iterables library, you probably don't want to see the C# version. And if you always click Java results in preference to C# results, it makes sense to not clutter the top couple of results with C# information. You never use them, after all.

(Imagine the kind of advice you'd get from friends if they didn't know you. It wouldn't be very useful; you might as well ask a random stranger.)

Google is just a computer program whose config file you edit by using the Internet. Not all that scary.

<comment><USER4> What you say is true, in that context. I guess it depends on what the group is we're talking about when we're talking what "average" is. He could become an "average" consumer in the context of a vegetarian; always eating what every other vegetarian is eating because he's never offered an alternative.

As for your example with the programming languages, I would find it annoying if it only always displayed results for what it "thinks" I'm looking for. I'd rather define what language I need the information for. Otherwise, if I get accustomed to the system then it would impede me from researching a new language because I'll have to go on a crusade to convince it that I do indeed want information about a new subject. Then it learns my new subject but what if I want to go back to getting information about the old subject? Now I have to convince it that, yes, I do want the information I wanted before that I didn't want later that I want again now.

At least give us the option to turn it off.

I don't know where you got scary from though.

<comment><USER3> Google reverses your solution. By default, you use less words to get what it thinks you want. If you type more words, you get what you actually want. So 99% of the time, I get the Java results. If I want a Ruby result, I type "ruby" in the query dialog and now all the results are relevant.

Most people are not power users and only type a single word into the search box. Learning means that Google gives even novice users great results.

<comment><USER4> No, you repeated my solution. I stated I would rather it be that I have to type in "ruby", just as you state. You are ignoring what I said about getting accustomed to the system and forgetting to put in the "ruby" part. Then I have to repeat the search. Then Google suddenly thinks I'm a ruby developer. Then I have to convince it yet again for another example. It never ends.

Google trying to learn what it "thinks" people want creates the filter bubble, which is the point of the discussion. It will not always give the most relevant result on the topic but what it "thinks" is the most relevant to you; but it could be wrong, a lot.

Plus, has anybody discussed how this stuff might affect traffic for websites in general? If Google is sending different people with the same search query to completely different websites then being the most relevant on a topic might not be as helpful anymore.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> This is why I do not particularly like last.fm.

I play a couple of metalcore band's and soon enough the only recommendations I get are 2 a penny metalcore bands. Yes, these bands are similar to what I want to listen to but how about some variance?

What Mayer is talking about sounds dangerous. I have a habit of looking for pizza places so this is what Google would prioritise.. I do not want this. It seems like it will skew search results.

I want Google to answer my questions and help guide me into asking the right questions to get the answers I am looking for. Beyond that.. i'm good.. I don't need anything else.

Sometimes I feel Google forgets its search is just that... search. An application to find things. It doesn't need to be anything more.

</comment><comment><USER6> 20 years from now we'll be finding things using technology we've never thought of, that was made by someone we've never heard of.

<comment><USER4> Also consider the idea that Google may not exist in 20 years.

</comment></comment><comment><USER7> The main problem I see with this is how unimaginative it really is. The things they talk about Google can basically do right now.

</comment><comment><USER8> >> _"I actually think most people don't want Google to answer their questions. They want Google to tell them what they should be doing next,"_

How convenient that they have millions of clients paying them to advertise their stuff to do/buy.

Google, can you please suggest a better search engine that is not full of it?

Can you please not show me a local retail clothing store as the first result of the query _'scala'_?

Can you please stop mixing your business strategy with the actual fucking search results?!?!

Anyway, don't even mind me google, I'm on DuckDuckGo now.

</comment><comment><USER9> 20 years is like 200 years in internet-time.

Computers gets faster and cheaper. Eventually everyone affords their own Search-Engine. Flavored to their own personal needs, with 100% privacy, and with higher search-quality.

Spoiler alert! Google Search dies.

<comment><USER10> You mean this one?

<http://www.yacy.de/en/>

<comment><USER11> YaCy is a fanatic idea. I encourage people to watch the FSCONS video. Unfortunately YaCy will need a lot more momentum, developer interest and people using it to become useful imho.

</comment></comment></comment><comment><USER4> I thought of a question from one of the threads I'm in for this article. If Google is sending different people with the same search query to different pages doesn't that reduce the value of being highly relevant on a topic?

</comment><comment><USER4> Why, at the time I typed this, is every comment on that article comments from this thread? Most seem to have the same usernames but some are different. But every one of the comments seem a copy and paste from here.

</comment><comment><USER12> I've never been a good Google user, never looked at their ads, always used noscript to block them on other sites, and often searched for obscure, little known information on a multitude of subjects. Google used to be immensely helpful, but has become less so recently. Searching for somewhat obscure information now brings up many commercial results which have nothing to do with my search, which, BTW, is often considered to be a typo. In the few times I've searched for consumer goods, most results were for outlets that do not ship to my country, so useless. But I guess I can't complain, they're not making any money out of me, and I'm using them for free.

<comment><USER3> Google is not giving you bad results to punish you for blocking ads.

The reason why Google is trying to learn more about you is to solve the exact problem you mention above. The Internet is getting bigger and bigger ever year, and the average cross section of the Internet is becoming less relevant to specific users. That's why signals like your search history or your friends' Google+ posts are useful; they can narrow down the infinite torrent of results to something that's useful to you specifically. This may be a little creepy but there's not much else you can do other than to build an index of the Internet yourself and tweak the ranking algorithm to suit your preferences.

Google gets a lot of press for collecting your personal information, but every site on the Internet does it. Go through your browsing history and figure out how to ask the sites you visited to delete your IP address, cookie hash, and user agent from their access.log. Pretty difficult.

(I'm not completely understanding why it's Google specifically that you care about making sure doesn't have your personal information. Is the imagined scenario that someday the government is going to officially hate people that meet profile X, raid Google's servers to get user profiles, mine the data to find people that meet profile X, and then hunt them down and lock them in a concentration camp? If you meet profile X and the government wants to lock you up for it, won't they eventually get you without Google's data?)

</comment></comment><comment><USER10> When software tries to be smart, it always fails. If software tries to be a leverage-tool for the users smartness, it works.

Google is on the wrong track.

</comment><comment><USER13> "I actually think most people don't want Google to answer their questions. They want Google to tell them what they should be doing next," Schmidt said in an interview with the Wall Street Journal that sparked criticism from privacy advocates."

At least they're (sort of) upfront about it. That is advertising's _exact_ task, to tell you what to do. What thing to buy. What destination to buy. What service to buy. And that does seem to be what people want, because most of us sit on the couch every night watching a box tell us what to do and what to buy.

Think of all the things Google might be telling you to do. Virtually all of them will involve cash changing hands. Google will never tell you to go for a walk or play with your kid.</comment>


Social Login Buttons Aren't Worth It - <AUTHOR> https://blog.mailchimp.com/social-login-buttons-arent-worth-it/ <comment><USER2> Interesting, but MailChimp didn't start with these social media login options, did they? So the low percentage of people using those to sign in probably means that most of those people registered after they were in place?

Also, regarding the CEO's email and the confusion of so many options on the homepage, that's merely a design issue. Those buttons don't need to take up so much room or be so bold. They could simply be links with tiny corresponding icons underneath the default login form. Taking those options away would be a detriment to both current users of those methods and future users who prefer the quick registration process it provides.

The argument thereafter that these logins could easily dissipate and are therefore unreliable is solved the same way SoundCloud does it; allow the user to set a username and password separate from their social networking account in their settings. The only problem with the SoundCloud method, at least at the time I did it, was that in order for it to activate, you had to reset your password. As far as the security point is concerned, that's a risk the user takes and another benefit to having both site-specific credentials and the social media tie-in.

<comment><USER3> > _"Interesting, but MailChimp didn't start with these social media login > options, did they? So the low percentage of people using those to sign in > probably means that most of those people registered after they were in > place?"_

That was my exact first thought after reading. How can they accurately judge the usefulness of the buttons if (for all we know) hardly any of the users created an account that way from the get go.

I would like to see how those same stats stack up to the amount of people that DO have a log using Facebook or Twitter with them. That would be much more relevant on the accuracy of the buttons "worth."

Or maybe, you can never really accurately get that data at this point since it was never there in the beginning. The data will always be skew, to some extent.

<comment><USER4> Yep. There isn't anything very scientific about how he came up with this conclusion.

It would be better to try a study in which you give half the users the social network login, and half the users the regular login, and track their activity.

</comment></comment></comment><comment><USER5> There's another element of this that, to this day, I don't fully understand: Companies subverting their brands and actually promoting facebook.

What do I mean by this? The other day we were watching TV and a Charmin ad comes in. At the end of the ad they actually say "go to facebook.com/charmin"

What? They have a perfectly good and highly recognizable brand. And, they happen to have a great URL: charmin.com. Why send traffic to Facebook and diminish or even completely fail to promote your own bran?

OK, the other question might be: Who is visiting a Facebook page for toilet paper. The point is that I've seen this many, many times from all kinds of companies.

Maybe someone can explain? Maybe this is just sheep following sheep off the cliff?

<comment><USER6> _"Who is visiting a Facebook page for toilet paper."_

Well, 300,000 people LIKE it so something is going on.

Based on what little I've done in the social realm and what I've heard from SM consultants, these thoughts are in play:

\- "Every brand has a Facebook page so we need one"

\- "Our website is just pages and all we can do it update copy"

\- "On Facebook we can distribute coupons, run contests, and get people to interact."

<comment><USER7> How exactly can #3 not be accomplished on Brand X's website?

People can then post said coupons and contests to FB, where they can interact with each other, using Facebook, instead of Brand X's website.

Why does Brand X need the interaction to happen on their site? It's not like FB is some magical land of coupons and contests that could not have been offered before.

EDIT: Also, why on earth do 300,000 people like a TOILET PAPER page? Is TP really THAT incredible? What business value comes from 300K likes on FB?

<comment><USER6> First, I don't disagree with anything you said. I just was trying to demonstrate how non-hackers and marketing types think.

To be honest, I think they see Facebook as almost an "end-around" to having to deal with internal IT/web folks.

</comment></comment></comment></comment><comment><USER8> The way I read this, it's about the CEO overriding the decision based on aesthetic reasons.

Personally I'd much rather log in with Google in this case, which means there would need to be three buttons: Twitter, Facebook, and Google. I'm sympathetic to the "nascar-ization" argument, but I also believe your customers are smart enough to process at least as many options as there are in their wallet for providing identity.

Perhaps the best solution is even more minimal: no login options at all! Let the browser auto-generate credentials and a unique password on your behalf, then automatically use that to log you in every time it sees that website.

[http://www.codinghorror.com/blog/2011/09/cutting-the- gordian...](http://www.codinghorror.com/blog/2011/09/cutting-the-gordian-knot- of-web-identity.html)

<comment><USER9> I think some distinction should be made in the different types of websites out there. Social logins may be fine for social type sites but Mailchimp is ostensibly more business oriented, except for maybe a niche of bloggers or social media types whose personal/social identities are interchangeable with their professional identities, I think the majority of users out there would want to keep their personal and business credentials separate.

I can understand why the CEO would not want to blur the lines between the professional persona and the social one, after all if in Twitter and Facebook the users are the product and not the customer that could lead me, a Mailchimp customer, wondering how Mailchimp perceives me as well.

<comment><USER10> > I think the majority of users out there would want to keep their personal > and business credentials separate.

Yup. Luckily it's pretty easy to maintain one set of online credentials for business activities and another for personal ones.

</comment></comment></comment><comment><USER11> I think the bigger point has nothing to do with social buttons or login UX.

Test your changes independently, and make incremental changes

They thought social buttons improved login success. They didn't. An unconnected copy change improved login success. If you test these things independently, you'll get much better insight into what makes a difference.

<comment><USER12> > Test your changes independently, and make incremental changes

That was my take-away as well. I'm prone to accumulating a list of changes that I'd like to make to my site and then, when _change fever_ strikes, I do them all in unison. When something goes wrong (or right), it's impossible to tell which change had what effect. It's a hard habit to break.

</comment></comment><comment><USER13> All the comments below (ha I hope!) are arguing for Mozilla persona

* I want to use email as username

* limit the number of possible ways to login (no NASCAR)

* I want to keep personal and business logins seperate

* don't slap competitor logos all over my pages (CEO quite right there)

this however all begs the question how do I move accounts to a new login?

Few sites (stackoverflow is a shining exception) allow you to associate more than one login with one account. And fewer give different settings by login (admin, power user etc)

we have been lulled by oauth and openid into thinking we have just to authenticate me, rather than authorise a role - and few sites have concepts ofanything other than one role == one set of privileges == one login.

There is a reckoning coming - it is when these sites need to provide fine grained control, as businesses run on them full time, we shall discover why ACLs exist, and what chmod is for. It's going to be painful. But then it's better for mailchimp to take the pain in a couple of years than not be there at all

now go install persona. And allow me to associate more than one login with one account

</comment><comment><USER14> So I like a lot of the analysis in this article, but couldn't help taking issue with some of it. Here are some thoughts that came to mind. Worth noting that I work on security / spam fighting at Facebook, but these are solely my personal opinions.

"Social login buttons put security in someone else's hands" You're damn right they do! I argue that in 99.9% of cases that's a great thing, for 3 reasons:

1\. Facebook invests significant resources in both keeping bad guys out (we have been able to dramatically reduce large-scale phishing with a number of updates to our login security systems) and ensuring everyone else can get into their accounts easily. I can only speak for us, but I assume Twitter spends a lot of time on this as well. I imagine it'd be tough for a startup to keep up with the 10-20 people we have working on this problem at any given time.

2\. It's incredibly difficult to build a password system that is both easy to use and secure. There's an almost endless ever changing list to make sure you're hashing and salting properly, don't have SQL injection flaws, implement robust rate-limiting without allowing DoS, etc. We've all seen many people screw it up in recent years. One of the largest benefits of Facebook Connect for startups is the ability to leverage our investment in these systems, without having to invest the significant time we have spent iterating on them.

3\. We've spent a lot of time working on every aspect of login, so that startups don't have to. Your job is to build whatever technology differentiates you from your competitors, and make it worlds better than theirs. Any time you spend pfutzing with password hashing, building a better password recovery flow, or arguing about how to fail when people type in the wrong password is time you could better spend making a truly wonderful product. Unless you're trying to build a startup that helps people login, any time spent on this is better spent elsewhere.

<comment><USER15> 1\. True, but irrelevant.

2\. It is very easy. SQL injection etc. isn't something you magically get rid of because you use a facebook login...

The reason so many get this wrong is because they don't even try. And if you don't even try you won't get any other aspect of security right and outsourcing your logins isn't going to solve any of that. If you have to outsource this to facebook, the moment you get big you will, _guaranteed_ , have issues with DoS, rate-limiting, SQL injection etc. for everything but the login. Which honestly isn't much of an advantage (sure, leaking your password database is bad press - but if you have the slightest bit of salting it might even turn out to be somewhat good - after all, your little startup apparently had way better security than sony and 99% of everyone elses leaked databases). If salted passwords is the only thing valuable in your database you are in serious trouble anyway.

3\. Since building your own login is so easy and hardly even a fraction of anything worth doing with your startup, outsourcing it completely is just ludicrous.

If you can't even salt your passwords right maybe this web-thing isn't your thing after all, or maybe you should outsource everything...

Point is that _exclusively_ relying on facebook (or whatever) login is that it is downright fraudulent and also signals that you are lazy and don't care the slightest about your users. It is that easy, you can't get away from that.

Offer a facebook login alongside your own solution (if you think it's worth the hassle implementing facebook connect/whatever), even if 99% of the users choose facebook the fact that there is an alternative is guaranteed to make them feel better about using facebook in the first place. If you don't think that is worth it, your site most likely isn't worth even trying either...

As from the user point of view, if you really think it is worth it (probably isn't): Just create fake facebook account(s).

<comment><USER14> 1\. What's irrelevant about having robust and constantly-evolving phishing detection, and optimized flows for getting people back into their accounts? Both of these are important in a high-quality login system IMO.

2\. You're right that a lot of folks fail to even try for security, but I disagree that outsourcing password management to facebook won't help them. If they get popped and have no passwords, all that leaks is the information specific to their site. If they get popped and have passwords, then in addition all those users' passwords (which they likely share with other sites) are now in the open. The damage has spread beyond the one clowny site and screwed over those users' experiences on wherever they shared passwords. We actually invest a fair amount of time in automated systems that look for leaked password dumps from such sites and help clean up users whose leaked passwords match their Facebook ones.

Also, even in cases where people did things more-right, it's still incredibly damaging. Look at LinkedIn (who was hashed but not salted) or Gawker (who was hashed and salted, albeit poorly).

3\. I guess I didn't convey this very well, but my point was that building your own login system is _difficult_. Getting everything right to ensure it's secure is actually pretty difficult, and requires constant attention if you're under any kind of targeted attack.

As for making fake Facebook accounts... please don't do that. You'll just open yourself to a bunch of headaches, as we're pretty aggressive with removing fake accounts from the site.

<comment><USER16> Facebook has big target problems and fortunately has big target defence resources. That doesn't make it right for everybody.

1\. If you are small people won't be using your brand as the bait in anything other than spear-phishing when your phishing detection won't work. Emails and password resets are pretty easy. If you need it twilio makes SMS resets pretty easy too but in most cases that is probably overkill.

2\. There probably is some benefit here.

3\. There are fairly simple and clear best practices that are reasonable for most sites. Most people aren't under targeted attack although they should put a reasonable amount of effort into a reasonable defensive system.

Facebook integration (or other 3rd party login) also brings additional risks as they become a potential attack vector. This may seem unlikely unless you consider the possibility of staff, contractors or app developers finding a way in.

</comment></comment></comment></comment><comment><USER17> I think he buried the lede: Social login buttons can hurt brands.

This'll date me, but I'm still amazed that so many companies eagerly slap other company's logos on everything they do. Even if it's just a blog post.

This page is a case in point: Facebook's brand appears four times. Twitter's appears a dozen times (more because of the comments). Mailchimp? Just once.

</comment><comment><USER18> Social login is a shadow issue here - like a sheet over a chair, the little buttons are obscuring a larger issue:

 _Mailchimp found that clarifying login error messages reduced login failures by 66%!!_

The rest of the story is a coincidental tale about the CEO trying to pull a "Jobs" by thinking he knew what his customers wanted better than they did. The social media buttons only had an effect on 3.4% of their users, a small group compared to the reduction in failed logins. By making the social login buttons the main point of their blog article, they hide this valuable tidbit.

<comment><USER19> Amen. The clarified login error message finding is way more interesting than the vague platitudes on branding and security.

No one will get rid of their social buttons solely on the basis of this post, but hopefully many people will now work on improving their error messages after reading this.

<comment><USER20> > The clarified login error message finding is way more interesting than the > vague platitudes on branding and security

The part about security isn't platitudes. Not displaying informative messages in response to failed logins is a security orthodoxy, something you are almost always told is a compulsary practise if you care about security. So a very key part of the story here is that they abandoned this standard security practise as a tradeoff in favor of usability. Whether this ever bites them or to what extent is something we may never know the answer to. So we have been told the good outcome of their tradeoff and not the bad side. It sounds to me like it was worth it, but I wouldn't like every web service to jump on this uncritically.

<comment><USER19> Sorry, I meant the security of relying on the services in general, not of exposing that someone has an account with you. Obviously, that's a serious security consideration, and each service should weigh the costs and the benefits.

In this case, it seems like they are already exposing it with the account checker, so making this change didn't open up any new vulnerabilities.

</comment></comment></comment></comment><comment><USER21> We've always found that by replacing "username" with "email address" makes logging in a lot easier. Most users already know their email address. By using a username thats one more thing they have to remember.

<comment><USER22> Using an email address instead of a username is SO HUGE of a usability win. I can't stand when companies don't do this.

My email address is going to be unique. I don't have to pick one of the few standard usernames I use and hope that it's available. I know my email address will be.

Have you ever been to a site that says username, but really wants an email address? It's absolutely infuriating.

<comment><USER23> I struggle with this. I acknowledge all your points, but it doesn't cover the usecases of: 1\. Changing ISP and getting a new email address. This is really common. 2\. Having multiple addresses (work/home, etc). Also see #1

This breaks password resets and creates a "I want to change my credentials" flow that doesn't exist with usernames. It is especially complicated as emails to the old address won't work/are not accessible.

Most companies want to keep track customers over their lifetime and not have them create a new account when they change ISP/job.

If you want to see an example of this not working at all well, see Apple IDs. The pain surrounding them, purchases, @me.com, @mac.com, changing countries and the attached purchases is inspirational in its depth and breadth.

</comment></comment></comment><comment><USER24> I've grown to seriously hate OAuth as a login mechanism. It's great for connecting accounts for integration, but I've been burned by it as a login.

On one of my previous projects, Twitter was the only allowed login method. After some complaints, we implemented an email-based login and reduced the bounce rate by over 50%.

Another anecdote: whenever my Asana session expires, I always struggle to remember which Google account I registered with or if I used email. The worst part of their flow is that if you're wrong, a new account is created and you login to a blank slate. It takes forever to find the log out button to try again too.

</comment><comment><USER25> At the bottom of this article, there are "Sign in With FB/Twitter" buttons.

<comment><USER26> To their defense (in the comments): "Yeah, it's a valid point. We're using a plugin on our blog called Social that we built with the folks at Crowd Favorite because we saw our blog comments heading to Facebook and Twitter. For blog comments, we're willing to suffer the social logins so people can talk to us in the channels they're accustomed. The blog is at the heart of our community, and communities gather in social spaces. But logging into or signing up for the app is another use case all together. That's where we feel like we're giving up too much control. That's what we're trying to spark a conversation around with this post."

</comment></comment><comment><USER27> > But after some further consideration, we decided that it was a false risk, > as the username reminder form already tells you if a username exists [...]

Alright so this security hole already existed in their system elsewhere. After raising the issue that this type of message leaks data, which is a completely valid concern, they dropped it because they were already leaking that data elsewhere? It isn't like email based account reset/reminder forms have to leak the existence of an email within the system, a fact they just gloss right over.

For a system that stores quite a lot of very sensitive data it is surprising to see them knowingly keep such a hole open. I understand the desire to smooth out the user experience but this honestly seems more driven by the desire to not field customer support requests for what feels like a "stupid issue".

I'm not currently a MailChimp customer but I used to be and before reading this I would have chosen to use them again if the need was there. Please don't compromise the security of customers for convenience.

<comment><USER28> In what way does people being able to find out you have a mailchimp account cause a problem for you? Are you concerned someone is going to threaten to go public with this shocking information if you don't pay them off?

</comment></comment><comment><USER29> I joined mailchimp ~7 months ago after Jason (thisweekin.com) pleaded viewers to check it out so i signed up for the free trial (2000 subscribers free no credit card).

I'm amazed by everything that they do. Elegant api and ux that "you get" from the get-go. It is a huge problem to solve and i'm now engaging with 1100 subscribers.

Now i want to pay ($30/m) but they don't accept paypal - the service i use to pay for everything since i'm a digital vendor. There are companies in the U.S that don't understand that alot of foreigners do business solely with paypal. There are those who dig it though(Elance, Envato, Odesk)

mailchimp take the leap! eeee

<comment><USER30> Couldn't you just get a debit card for your paypal account then? [https://cms.paypal.com/cgi-bin/marketingweb?cmd=_render- cont...](https://cms.paypal.com/cgi-bin/marketingweb?cmd=_render- content&content_ID=marketing_us/debit_card)

<comment><USER29> "Sorry, you're not eligible for the PayPal Debit MasterCard®. This may be because you live outside the United States"

</comment></comment></comment><comment><USER31> few things don't add up here.

1\. they added the social buttons late in the game, and are surprised about 4% of users are using the social buttons. what if that 4% was compromised entirely of users who registered since you added the buttons? that would be a totally different ballgame.

2\. the problem they were trying to solve was login errors. that's not the problem facebook and twitter sign in solve. therefor it seems fallacious to say "they aren't worth it" when you're not even considering the standard use case.

</comment><comment><USER10> I love being able to log in using an OpenID provider rather than creating an account.

Because it's one less !$@%!@$! password to remember. Or it's one less $@&%!@$ hassle adapting my password creation formula to a new site's password requirements. Or it's one less place where my don't-care-use-it-everywhere username/password key is stored, perhaps @$2( _! in the clear. Or perhaps it's just one less time I have to type in a @$@(%^!_ username and password. Or @*($&%! create one.

<comment><USER32> I agree. But unfortunately, OpenID can magnify the problem for some people. For example, my girlfriend has at least 4 different Stack Overflow accounts because she can never remember which OpenID provider she used, so she keeps accidentally creating new ones.

<comment><USER33> Yeah, that happens to me to. I need there to be a system that says "We've never seen that ID before! Do you want to link it to some other account?"

Which means _maybe_ you should have a separate button for "I want to create an account here" and "I want to log in again here". I know that's heretical to the OpenID community, but I usually know whether or not I have _some_ account on a site, but I usually don't know whether I typed in my openID url or hit the Google button.

</comment></comment></comment><comment><USER34> For me the most important bit in that was the last line.

"Is it worth it? Nope, it's _not to us_." (my emphasis)

Not all businesses are the same. B2B businesses like MailChimp usually don't see major increases in value through third party auth. They're providing serious value. People will go to the effort regardless.

With a casual use B2C site removing even the tiniest piece of friction in the login process can mean the difference between a purchase and people just going away.

It depends. This is why we test shit :-)

(Also - unrelated to this - is that the "login" bit is often not where the biggest win for third-part auth is. It's in reducing friction in registration. I've seen high single digit percentage improvements in abandonment of registration for some B2C sites due to getting profile info from twitter/linkedin/etc. cutting the time it takes to setup accounts fully. Lifetime value also increased since profile info was generally better from those sources which was an important part of users getting value out of the system, and so the business getting value out of those users).

[edit: also - they seem to be looking at total numbers, rather than doing any kind of cohort analysis on the folk using twitter/facebook/whatever... which may well lead to different conclusions]

<comment><USER35> "The "login" bit is often not where the biggest win for third-part auth is. It's in reducing friction in registration."

Yes, which makes it particularly annoying when a website advertizes sign-up via social network only to immediately follow this sign-up with its own registration form, making the social network signup stage an _additional_ stage in signing up, rather than a substitute.

</comment></comment><comment><USER36> I am probably in a minority but for me, my Facebook and gmail is more valuable than almost all other accounts. When I see a site that forces me to sign up using Facebook or a google account, I usually hit back. Why? Because in my mind I'm giving access to my entire Facebook to a bunch of guys I know little about. I'm not as fearful that these guys are evil and may directly harm me. I'm more fearful they will post something to my timeline or that they may repost say my public posts for SEO etc.

This is one reason I am extremely pissed at instagram. Instagram as a product gives you a sense of privacy because it provides very limited ways to access your photos. You can't just goto instagram.com, login and begin browsing. On the other hand, few people realize that your instagram pictures are public by default and there are dozens of sites which using instagram's API(I'm guessing) are republishing our photos without even your knowledge.

<comment><USER33> Facebook nowadays asks you to confirm the permissions you're granting to another site, and if you give timeline-post permissions, then it asks what privacy level the posts should be. I always mark "Private: nobody but me can see those posts." Problem solved.

</comment></comment><comment><USER37> I see this as two problems. 1\. Too many options. They even mentioned it "Did I log in with Facebook or Google or Twitter or what."

2\. Having both social & native logon.

You could actually solve both by either 1. Only using native logon. or 2. Picking one (maybe 2) social logins.

I went with #2. Granted it was on a small test site, but the trade off of managing customer logins sucks. I'd rather have google get busted for getting hacked than for my little SQL DB getting attacked.

The way I look at it, I have time to write code and secure it to the best of my ability. However, Google and other social logins have whole teams that can manage security and keep up to date with the latest technology etc.

So there is more to social logins than the actual act of logging in. And some of the problems listed aren't really with social logins, but rather with a particular implementation.

</comment><comment><USER38> The actual point of this article is "Social login buttons aren't worth it... for Mailchimp".

Obviously a business-focused company is going to have less people logging in with Facebook than a consumer-focused company.

People shouldn't write generalizing blog posts unless they have some understanding of proper experimental design.

</comment><comment><USER39> One thing that has been really interested about the discussion of social logins has been the re-emerging critical outlook on online identity. I think that social logins are a double-edged sword, where they give us the ability to easily connect with sites for which our social identity is relevant or for which setting up a whole new custom identity is unnecessary. One the other hand, the obvious drawback is the implicit promotion of the social network as the de facto identity standard, which is dangerous and totalitarian (Facebook owns who you are, sort of).

I think the simple value for social login is context. There's an obvious overuse case and a useful use case.

</comment><comment><USER40> I think telling people that just their password was wrong was a bad move. The author argues that this is not a security risk because the "username reminder form already tells you if a username exists". However, this simply displays a further security issue. I don't have the link handy, but there was just a (really good) article the other day here on Hacker News about why you should not reveal whether the email address is necessarily associated with a username or password in these kinds of forms (always just give the same generic "we will send it if it exists" message).

<comment><USER41> Yes, both of these UI features would reveal the fact that this username or email already exists.

But isn't it impossible _not_ to reveal it on the signup page anyway? You want users to have unique usernames (or emails acting as usernames), therefore the signup form has to tell them if it has been already taken.

My suggestion would be to tell users if the username or email is unknown right away - and perhaps add a captcha if they are trying out too many different usernames.

<comment><USER40> You can use the same strategy there too: in the signup page, it can just say "a confirmation email has been sent to your email". In the event that the email is already known, the email will say "someone else has tried to sign up with your email -- if this was you click here to change your password". This way, the attacker will never know if the email genuinely resulted in a new account or not.

<comment><USER28> And you have absolutely terrible usability and tons of people fail to go through the signup process. So you gained imaginary security that doesn't actually do anything, and lost users. For most sites, that isn't a good tradeoff. I don't care if everyone knows I have a mailchimp account. How is it a security concern that people can find that out? If you are running some kind of freaky porn site it matters, but for 90% of sites it doesn't.

<comment><USER40> What is the issue with email verification for SIGNUP? This is pretty standard practice as it is. Eventually you need to contact the user, so better to make sure the email is correct from the beginning. If not, I could for example sign up for mail chimp with your email then proceed to send a bunch of people lude spam, leading to mail chimp then sending you angry emails. Even if they use it appropriately, if you later ever want a mail chimp account it will tell you you already have one, leading to true confusion.

<comment><USER28> There is nothing wrong with email verification. There is something wrong with hiding what is going on from the user. If you try to "secure" your site from people finding out if a particular email is registered, you end up with a massive increase in login failures, which was the point being made. You also make it so that when I say "I forgot my password" and fill in the wrong email address, I am sitting and waiting for a password reset email that never comes. Every portion of the account handling process is made significantly worse by trying to hide account info, and there is absolutely no benefit to doing so.

</comment></comment></comment></comment></comment></comment><comment><USER42> What about having a generic "Third Party Login" button drop down? On a click, a drop down appears with the different login options. This makes the options available to users, but lets the main brand shine.

</comment><comment><USER43> The problem isn't that social login buttons harm your brand or look ugly, it is that by using social logins you are working to expand the social networks user base and not your own.

Online companies are largely valued by the size of their userbase and by working to build Fb or twitter's userbase rather than your own, you are sacrificing the value you add to your own company for the sake of the social network that a user signs in with.

</comment><comment><USER44> As others pointed out, I believe the 3.4% was simply down to social logins introduced much later. When I fist signed-up for mailchimp ages ago, the only option was creating a new user account.

I think the article dismisses one huge benefit to federated logins:

* ease of use for users - instead of choosing a username, entering all the customer information, verifying the email address etc, choosing a password, you can sign in with one or two clicks.

</comment><comment><USER45> I never use a Facebook or third-party login, if I can help it. Why would I want to tie my real identity to some site I'm opting to _try_ for the first time? I might want to integrate an account to Facebook if the service provided some phenomenal value to me for doing so and the service had gained my trust. But providing my Facebook information to an unknown entity is far more intrusive than providing an email.

</comment><comment><USER46> This is exactly why Persona really needs to be adopted more and succeed. I'm tired of creating new accounts all the time and Persona solves this issue.

<comment><USER47> I'm really happy to see that Aarron's post highlights how important copy is to your success. It's super dull and tedious to get it right, but amazingly effective when done well. The post also confirms my suspicion that the highly secure "username and/or password is invalid" is a costly tradeoff.

Glad to see Persona mentioned in this thread. Full disclosure, I'm the UX Designer for Persona.

A couple of questions I have for MailChimp

* Why use usernames at all? They're a necessary evil for things like forums where users don't want to expose their real names. They are a major contributor to login failures. Email as the unique identifier is much easier to remember.

* How much pain did Mailchimp have to endure to migrate the user account that had been created via Facebook and Twitter? What copy did you use to explain? How many users did you lose?

* Would you consider implementing Persona? ;)

I do want to add a +1 to the concerns other folks have expressed about mixing the context of a personal Facebook account with a professional service like MailChimp. I see in my research one of the main concerns users have about using Sign in with Facebook is that they're unsure what will show up on their wall. Social sign in isn't right for either professional services or on the opposite side, anything that is socially questionable, like a gambling site.

</comment></comment><comment><USER48> Posted earlier too: <http://news.ycombinator.com/item?id=4602425>

</comment><comment><USER49> Increasingly there are going to be people like me who don't trust Facebook, Google, Twitter, etc... enough to have an account (or, at least, a real one) with them. So using them for logging in somewhere else isn't helpful.

ONLY being able to use them to log in somewhere else is obviously a reason to never sign up with that "somewhere else" site altogether.

<comment><USER50> And that's not even taking into account that the random dragging in of resources from these places allows them to track which of their users visit which other sites.

</comment></comment><comment><USER51> One thing that jumped out at me with the "better" error messages, is that it makes it that much more hackable - if I can hit the service and find valid usernames, I can then try to get into those.

If you have a catch-all error message, it's much harder to guess the username/password combo.

<comment><USER52> That argument is actually adressed in the post: "The engineering team, ever mindful of security, argued that being generic about username and password errors makes it harder for bad guys to guess usernames by pounding the form with random words or email addresses. But after some further consideration, we decided that it was a false risk, as the username reminder form already tells you if a username exists, and is not a significant security risk for the bajilions of sites that have them".

</comment></comment><comment><USER53> While I'm disinclined to take UX tips from MailChimp, there are at least two good situations to use 3rd party registration/login: 1) when you're getting more out of it than simple reg/login and 2) mobile.

</comment><comment><USER54> Social Login buttons are liked by some users (about 30% from our research [1]) and have the added benefit of giving extra biographical data / friends graphs / etc. Some services need that extra data for sharing features etc.

We run a service that makes it simple to add Email&Password style login, or Social login to your site: <http://www.dailycred.com>

[1] [http://dailycred.tumblr.com/post/30602034530/surprise- people...](http://dailycred.tumblr.com/post/30602034530/surprise-people-hate- being-forced-to-use-facebook)

</comment><comment><USER55> Wow, they dramatically simplified the login form. Here's what I get at the moment:

<http://i.imgur.com/LExHd.png>

</comment><comment><USER56> Finally, someone has the guts to say, that failed logins should tell the user, what is wrong: username or password

</comment><comment><USER57> Anybody have any data on whether using social login buttons on landing pages increases/decreases conversion?

</comment><comment><USER58> I wonder what Pinterest's numbers on this are.</comment>


The Rock Taking on Trump's Leadership and Praising Black Lives Matter - <AUTHOR> https://www.youtube.com/watch?v=ojNLPx25GCg <comment><USER2> We unfortunately know where he is. He's only thinking of himself.</comment>


Unraveling Google's Product Strategy - <AUTHOR> http://katsenblog.com/post/58721533658/unraveling-googles-product-strategy

<comment><USER2> Reminded me of a good post a while ago on TechCrunch: [http://techcrunch.com/2011/03/25/search-googles-castle- moat/](http://techcrunch.com/2011/03/25/search-googles-castle-moat/)</comment>


Ask HN: Is World War III imminent? - <AUTHOR>

I have recently read Niall Ferguson's "War of the World", which gives a new history of the 20th century. One that was one long 100-year war spanning from set up for WWI which led to WWII which led to Cold War.
He argues that the same types of thinking and scenarios are unfolding once again in the 21st century, "Three things seem to me necessary to explain the extreme violence of the 20th century. ... These may be summarized as ethnic conflict, economic volatility and empires in decline."
This is a very serious question of mine and would like to hear any thoughts, speculations, etc on the matter.
A quick review of the book: http://www.nytimes.com/2006/11/12/books/review/Montefiore.t.html?pagewanted=all <comment><USER2> I think as the world becomes more connected (in terms of trade, culture, the internet, etc), the probability of a world-war increases. Violence/war itself seem to be an inherent characteristic of our species. Although the per-capita amount of violent acts in the world may be decreasing, there are still large systematic shifts in power that can happen as a result of our highly structured and connected networks of economy, culture, and information. In other words (and I sincerely hope I am wrong), the probability of another world-war is only increasing. However, this highly connectedness exposes a world dichotomy in general philosophy of leadership, religion, and politics. Hopefully the spread of information through the internet will allow this dichotomy to become less of a problem. Answering the question of predictability is much more difficult.

</comment><comment><USER3> _extreme violence of the 20th century_

Maybe he should read Steven Pinker's new book, The Better Angels of Our Nature: Why Violence Has Declined.

[http://www.amazon.com/The-Better-Angels-Nature- ebook/dp/B005...](http://www.amazon.com/The-Better-Angels-Nature- ebook/dp/B0052REUW0/ref=tmm_kin_title_0?ie=UTF8&m=AG56TWVU5XWC2)

Here's a discussion of the main point of that book:

<http://www.samharris.org/blog/item/qa-with-steven-pinker/>

Any amount of violence of one human being against another is deplorable, but the most recent century of human history is characterized by how remarkably little violence it has had compared to any previous human century since hunter-gatherer bands turned into tribes and then nation-states.

<comment><USER4> One could argue that violence by more organized societies is worse. I mean, there's no way a loosely organized band of hunter-gatherers could come up with an Atomic Bomb. Nor could they fight a World War.

</comment></comment><comment><USER4> If the economy keeps going down, we could be. Bad economic times have a tendency to put extremists in power. Do you think it's a coincidence that Hitler rose to power during the great depression?

</comment><comment><USER5> Won't happen, at least not without a sea-change in defensive technology. The new ingredient in the mix is nuclear weapons. Any victory in all-out war these days is going to be Pyrrhic, and the people in charge realize that. Otherwise WW III would have been fought in the 1950s.

</comment><comment><USER6> Well it's not imminent at this moment. Although it's possible, I personally believe that a conflict of the scale of the WW2 is less probable now. There will be relatively smaller conflicts throughout the century.

</comment><comment><USER7> When the oil runs out.

<comment><USER8> It'll be tough for the world to power it's armies when that happens.

<comment><USER7> Why don't you go back in time and tell that to Napoleon. And Genghis Khan.</comment></comment></comment>


Lamplight and Shadow: Patrick Modiano's Novels - <AUTHOR> https://www.theparisreview.org/blog/2017/02/24/lamplight-and-shadow/ <comment><USER2> I read "Missing Person" recently and enjoyed it (it has a much better title in French: Rue des Boutiques Obscures).

It reminded me of a little of Leo Malet's novels, which also feature an antihero detective and a political undercurrent, although it's a little tougher.

The amnesiac main character also reminded me, weirdly, of William Hjortsberg's fantastic pulp novel Falling Angel (today best known via Alan Parker's the film adaptation, Angel Heart), although that novel's plot goes into a rather different direction.</comment>


In Detroit a $6.5M loan fund threw FICO scores out, the results promising - <AUTHOR> http://www.businessinsider.com/jpmorgan-chase-detroit-entrepreneurs-of-color-fund-2017-8 <comment><USER2> Credit scores are loose proxies for a conscientiousness score (which is why they correlate with all sorts of useful stuff like likelihood you're going to wreck an apartment, get in a motorcycle accident, or abscond with the till). However there is ample psychological research indicating that you can locally boost conscientiousness with a variety of techniques, mostly involving continual follow up, breaking compliance into small steps, and reminding of the benefits of compliance via frequent positive reinforcement. (It's fair then to ask if this really counts as "conscientiousness" per se given that level of intervention, or a more abstract measure of task completion).

It seems like this fund is using this to its profit. Good for them. It does almost seem, given that level of investment in the actual enterprise, like equity or some sort of hybrid instrument better represents the risk of the investor & the amount of effort they're putting into seeing the ventures succeed.

(Incidentally, this pretty solidly mirrors the approach to high-risk students of basically saturating them with life coaching, which seems to work pretty well as long as you can actually invest that level of resources continuously).

</comment><comment><USER3> A credit forum has back-engineered chunks of the scoring algorithm via experiments run by members.

Your fico score is sensitive to net credit usage (quite reasonable), but also very sensitive to the usage on _any individual card_. eg Say you have a fico score around 800, $100k in total credit, and are using $1-2k for transactional spending that month. However, you still have an old credit card with a limit of $300, on which you charge $151. Maybe it's a gas card. Now you have an individual card reporting more than 50% utilization (but still a trivial amount of usage compared to your income and net credit.) Your score will take a 60 plus point hit.

You will also take a hit if you don't have an installment loan. Hence people find banks that allow you to prepay loans, take out $2k loans, then prepay them down to the minimum balance the bank will allow; say $1/month for the next 59 months. This can also bump your score 20-40 points.

Things like this, and their long fight against disclosing fico scores (and in particular, _all_ your fico scores -- you have at least three relevant fico scores per credit reporting agency: the old 04-ish versions used for mortgages; fico08, commonly used for credit cards; and car ficos) can have enormous impacts on eg the cost of a mortgage. Fico is an ugly combination of stupid and/or evil.

<comment><USER4> This whole post is incorrect. I have been monitoring (really micromanaging) my credit closely for ~5+ years and none of which you say is accurate in my experience and your numbers sound completely made up.

60 plus point hit from someone otherwise creditworthy? No, just no. I had ~$120,000 in revolving credit. I opened up a new card with an $8,000 limit and maxed it out so 99% utilization hit my report on one card. My credit score only dropped about 20-30 points and it mostly recovered in about 3 months even though I was only been paying the minimum 1% balance. (I was riding the interest free period).

Don't think your $300 limit example is very realistic. Credit limits are only ~$300 on customers without a credit history or one with poor credit. Companies typically will automatically up the credit limit as high risk customers become more creditworthy. Nobody with $100,000 in revolving credit has such a low credit limit on an individual card (and even if they did, it would be as simple as asking for an increase, as a $300 credit limit on a card you plan on actually using is totally infeasible)

Old versions of FICO are not typically used for mortgages, don't know where you got that "information" from. I got a mortgage last year and FICO 8 was used. I got 3 quotes and all lenders used FICO 8. (this information was disclosed to me)

I didn't have any installment loans for many years and I was not penalized. My FICO 8 score was 750+ every single month for years with only two credit cards as my history. As long as you have a strong credit history installment loans mean nothing over revolving accounts. Maybe you'll get a 20-40 point increase from opening a new installment account, but that would likely come with opening up a new revolving account as well. Furthermore, everything I've read about FICO 8 says closed accounts count the same as open accounts for FICO 8 so taking out a loan and paying it off the next day counts the same as taking out a loan and paying it off over several years.

FICO is neither stupid or evil, its totally rational from the lender's perspective. I'm trusting there was some actual number crunching that went into these algorithms. Lenders, landlords, and insurance companies wouldn't use it if it wasn't working for them. Is it unfair to some populations? Yes, I don't think that is disputed, HOWEVER, it's "obvious" from a layman's perspective that someone who has used credit wisely is less risk then someone whose never used credit. The unintended side effect is punishing people who don't have a use for credit. Credit cards are becoming more important though for everyday life, I once saw someone get turned away from renting a car because he only had a debit card and no credit card.

<comment><USER3> Here's one of many posts discussing the version of fico scores used for mortgages [http://www.doughroller.net/credit/which-fico-scores-do- mortg...](http://www.doughroller.net/credit/which-fico-scores-do-mortgage- lenders-use/)

Googling will get you dozens more. Maybe you found one fico8 lender; good for you. More likely, you have no idea at all what you're talking about. Further, experiments mentioned above (you can find on creditboards or r/churning) were replicated across many people, not just one.

<comment><USER4> I don't have any idea what I am talking about? Every single pre-approval I got (3 different companies) sent me a dead tree paper disclosure in the snail mail that showed all 3 of my credit scores for each credit bureau, when they were pulled (month/year) and the algorithm used to calculate them (it was FICO 8 - I pay attention to these things). Perhaps they use a different score when actually underwriting but my pre-approvals used FICO 8.

Yes, there's plenty of people giving misinformation on the internet. You're giving very _specific numbers_ out of thin air that are ridiculously inaccurate from my personal experience.

(BTW, there's a back door way to get your credit report as many times a year as you'd like rather than just annually)

</comment></comment></comment></comment><comment><USER5> "The fund does away with a focus on FICO scores, helps prep companies ahead of receiving a loan, and provides ongoing support."

So they've rediscovered "knowing and helping your customers", instead of just seeing them as a number spit out by a computer. Awesome!

<comment><USER2> I would be _extremely_ annoyed if my mortgage or credit card company actually tried to foist some advise on me.

<comment><USER6> this is silicon valley. Every investor you meet tries to give you advice on how to run your company and live your life, even if 99% aren't going to invest in you.

<comment><USER7> I don't think that's limited to SV.

Investors/advisors with free advice are abundant.

Just remember it's worth what you paid for it 99% of the time.

</comment></comment></comment></comment><comment><USER8> They managed to help 40 businesses. Could this kind of system scale up to 4 million credit card customers for example?

<comment><USER9> More properly, they hand picked 40 businesses that later came out as being successful/capable of repaying the loan.

We don't have data to know if 40, 400 or 4000 businesses applied and then only 40 were financed or if all the 40 that applied were successful.

In other words, one may be reliable even if he/she has a bad credit record (along the established though most probably unfair current ratings), but the fact that these ratings are flawed doesn't mean that everyone with a bad credit record is reliable.

It is likely that there is a "gray zone" of people that do not satisfy the criteria of the current system credit ratings while still being good re- payers.

All in all this seems a lot more similar to VC funding than to "traditional" credit.

</comment></comment><comment><USER4> Fluff piece with misleading headline.

These are all new loans (they have only been issuing them for less than 2 years). I don't think we can conclude anything about those loans until they are actually paid down significantly.

Also this isn't really lending as much as it is financial accounting assistance. It's more or less similar to hiring an accounting professional who also brings capital. It sounds like they are additionally helping with management of the business as well. It's obvious that businesses that receive this sort of assistance are going to do fairly well, especially because we can presume their business plans were screened for viability beforehand. It's my very unscientific opinion that businesses usually fail due to either a non- viable business plan or mismanagement (and they often go hand-in-hand).

</comment><comment><USER10> >"I'm an African-American single mom, so I knew a bank wasn't going to give me a loan, no matter my credit score," Gaines said.

I don't have the life experience to comment on this, but my intuition says "business is business". Is that true? No matter the credit score?

</comment><comment><USER11> From the article :

"

"A lot of this is just putting numbers into some sort of algorithm, and if you're above you're good to go, and if you're below you're not," Heredia-Lopez said.

"

Does not seem like an astute understanding of credit risk. I would not be confident in the sustainability of this initiative.

</comment><comment><USER12> What was the underwriting criteria? What percentage of the loan applications got accepted? It looks they were looking to back entrepreneurs of color, but the criteria beyond that look unclear. Were there specific criteria, or was it just at the whim of the loan officer?

</comment><comment><USER13> This reads like an advertisement</comment>


Anonymous goes after Sony, makes it personal... very personal - <AUTHOR> http://arstechnica.com/tech-policy/news/2011/04/anonymous-goes-after-sony-makes-it-personal-very-personal.ars <comment><USER2> Isn't this exactly the type of information that Sony was seeking on George Hotz (geohot), as well as anybody who even _visited_ his website?

</comment><comment><USER3> Not specifically related to this article but Id like to give Ars major props for following all of the recent Anonymous actions so throughly. Their articles on HBGary were fantastic and they seem to be keeping up well.

</comment><comment><USER4> "I quarrel not with far-off foes, but with those who, near at home, co-operate with, and do the bidding of, those far away, and without whom the latter would be harmless." ~Thoreau

Before condemning I'll wait to see what is done with this information. If someone dies, that'll be the end of it, but don't freak out over pizza deliveries. I've been waiting for Anon to start endorsing violence, so far they haven't.

</comment><comment><USER5> It's very interesting to see folks rediscover what we always knew: there's a big difference between a group with a purpose and standards and a mob.

It used to be that geography contained a lot of mob-like behavior. You might be mad at the guy who lived in the nearby castle, but there were only so many villagers you could round up. And some of those liked the guy, some didn't want trouble, some didn't like your plan, etc.

Now the internet lets us find the most emotional people possible about a particular topic and put them all together in one "place". Then people can feed off each's other anger, saying and doing more and more preposterous things in order to impress the group. Information that might challenge the groupspeak is discarded. "Acts of valor" the group commit are spread far and wide, drawing in more members, thereby creating a feedback cycle which encourages more and more dramatic acts.

The thing is: _the issue doesn't matter_. The larger story isn't about Sony, or Anonymous, or any one particular issue. It's about how governments are going to be able to consistently function when the world is breaking up into thousands of little angry groups like this.

I have no idea how this is going to play out, or how many kids and families of corporation execs are going to suffer because of things they cannot control. But there will be a backlash. It's building, and I'm concerned that when it happens we are going to see governments step in and take control in ways that are as equally terrible. </doomsaying>

<comment><USER6> You may be exaggerating. I visited the #opsony room, and at one point they were broadcasting how many LOICs were in operation. Millions? Thousands? No. <100\. Less than 100 people in this mob of internet justice. And fewer still doing more nefarious stuff like stalking down execs.

<comment><USER5> Yes, I am purposely overstating and glossing over certain details, mainly because I'm attempting to extrapolate.

Thanks for pointing that out, though. Perhaps if we're lucky (?) tools to monitor and control mobs will evolve faster than tools to communicate and collaborate securely.

Anonymous is working at the basest level of security -- just drop by and jump in. I imagine what we'll see soon, what we see already in organized crime, is a combination of better ways of vetting while still integrating to the wider net in order to attract new recruits. As they say in the movies, the night is still young. If we get something with the moral foundation of wikileaks, the activitst appeal of Anonymous, the secure communication system of Tor, and the virality of Facebook? We're going to have problems (once again, I'm overstating for effect)

Having said all of that, even if it's only 100 people, and even if it's always 100 people are less, that's a problem. Smaller groups that fly under the radar are more problematic than large noisy ones. How many people did it take to dump all the secure embassy traffic of the United States government?

<comment><USER7> > If we get something with the moral foundation of wikileaks, the activitst > appeal of Anonymous, the secure communication system of Tor, and the > virality of Facebook? We're going to have problems

 _We_ are not going to have problems. Governments and corporations who want to take away our rights are going to have problems.

<comment><USER8> It's all fun and games until you discover that you're working for today's bad guys, your address is posted up, and there are cocks drawn on your face on Encyclopedia Dramatica.

</comment></comment></comment></comment></comment><comment><USER9> Before the internet, people were comfortable releasing small amounts of personal data - and so they still release small amounts of personal data (to a florist, into the garbage).

One of the issues here is that a few of these pieces of data are like Primary Keys: home address, ssn etc: once you grab these you open up so much else, and there's not too many alternatives to these keys (for those times you actually need them).

<comment><USER10> SSN (and possibly home address) are not just primary keys, but super-keys in that they are primary keys across systems and datasets (in general).

They may not be immutable as a primary key suggests, but are very hard/costly to change, so the difference is moot.

Another reason to not give out your superkeys to anyone who doesn't need it.

Finally, though in general I'm in favor of privacy, with the complete lack of corporate accountability, I support the intention behind Anonymous's actions.

</comment></comment><comment><USER6> I dont think this is representative. There have been comparisons made between Anonymous's DDoS and sit-ins. But there was also a more antisocial and violent part of the civil rights movement as well.

</comment><comment><USER11> Last night I watched "The Next Day", a teaser film for the inevitable Tron 3. In it there's a Banksy-type group of hackers called "Flynn Lives" who commit acts of sabotage and mischief specifically against ENCOM. I thought to myself, "That's silly, how could there be an underground activist organization that focuses its efforts on undermining a tech company that, while big and vaguely sinister, doesn't actually seem to have committed any actual evil?"

Oh, 4chan, you've proved me wrong again.

<comment><USER12> Sony has sued to shut down geohot and obtain the IP addresses of all visitors. They obtained a TRO that prevents him from distributing information about the exploit and which hands his hardware over to Sony. That's more than vaguely sinister, and is arguably an actual evil.

<comment><USER13> Yes. If there is any tech company that is 'evil' at the moment it's Sony. I don't agree with every action that Anonymous does, but honestly I hope Sony gets their due like HBGary did.

</comment></comment></comment><comment><USER14> On one side, I think it's great that "important" people who make major decisions take personal responsibilities, instead of hiding behind corporate/government entities;

On the other side, this sort of hack-attack could easily go out of hand: what do we do if someone uses this sort of technique for malicious intents?

<comment><USER10> What if? I'm sure this is already being done, and probably sponsored by governments/corporations.

Just because we get visibility into this sort of attack doesn't make it any easier or legal to do.

</comment></comment><comment><USER15> Ahem, they tried to censor Stringer's personal information but they left the ZIP+9. You can get at least the address of the apartment block from that.

</comment><comment><USER16> This is the kind of stuff I think will cause more damage, than do any good. Yeah ordering pizza's is funny, but when you start digging into someones family, I think it goes over the line. This is something criminal thugs would do. This isn't going to do their cause's PR any good at all, which perhaps I'm wrong, that their goal is to help support the "little guy" against the "big powers", to accomplish that, its best to get the support of the people, to expose corruption, not threaten people like this. Which, when this goes to national news, its going to look really bad. Not to mention, this is stalker grade stuff, which that freaks me out for some reason, I imagine socially dysfunctional people, looking for some attention sitting around thinking, Anonymous is doing it, people like them, I know... I'm going to go do something completely insane so people will like me. These sort of tactics can easily blow up in their faces, perception of the people is everything these days, stuff like this can make it real easy to look really bad.

</comment><comment><USER17> It reminds me of Fight Club a little.

</comment><comment><USER18> This is not cool - harrasing the man's wife, investigating the "schools their children attend".

If you need to go after Sony the cooporation or the CEO, do so when they assume that role, but stay away from family and personal business.

</comment><comment><USER19> I am for trying to poke at someone, but to me the line is drawn at family and kids. Anonymous themselves might not do it, but lets say they make information about the kids public and some weird psycho uses that in a bad way. Just takes one incident involving a child and the public out lash could be severe.

</comment><comment><USER20> Public information + Social Engineering + Willpower = Zero Privacy

</comment><comment><USER21> My only complaint about Anonymous is... Who watches the watchmen?

<comment><USER22> State intel and law enforcement agencies.

<comment><USER23> This doesn't answer the question.

<comment><USER22> So state intel and law enforcement agencies don't watch groups like Anon?

<comment><USER23> No, but who watches them?

<comment><USER22> Foreign state intel. ;)

</comment></comment></comment></comment></comment></comment><comment><USER24> Ok, now we're talking lulz. Tracking people's children? All's fair, I guess.

But taking down the PlayStation Network, well...that's over the line.

> "Anonymous is not attacking the PSN at this time," said the document. > "Sony's official position is that the PSN is undergoing maintenance. We > realize that targeting the PSN is not a good idea. We have therefore > temporarily suspended our action, until a method is found that will not > severely impact Sony customers. Anonymous is on your side, standing up for > your rights. We are not aiming to attack customers of Sony. This attack is > aimed solely at Sony, and we will try our best to not affect the gamers, as > this would defeat the purpose of our actions. If we did inconvenience users, > please know that this was not our goal."

</comment><comment><USER25> Where are these chats between anonymous taking place? How are people getting the chat logs? I haven't seen anyone talk about this.

</comment><comment><USER26> I think personal attacks like that degrade whatever credibility they gain by fighting for the little guy. Granted people have been prank-ordering pizza's to other people's houses since waaaaay before the Intarwebz, but I'm sure our generation of news-addicted alarmists will send up the flag saying this is why we should give away all of our privacy and freedoms so the government can protect us from bored teenagers.

<comment><USER27> For me this isn't an issue of privacy as much as its an issue of decency. If they released the bank records of these executives and said "these guys are loaded so why are they suing some kid" I wouldn't have a problem with that.

But once you graduate to involving their families you cross a line.

The only thing that can be accomplished by releasing the names and addresses of someone's spouse and children is to put them in harms way. That harm might just be getting yelled at but it could be much worse. Which puts this act into the category of "threatening someone's family"

As someone who agrees with Anonymous on the facts I would only support a small fine for violating someone's privacy. But for involving their family I would support and encourage local governments to send the members of this subsect to jail

<comment><USER28> I don't agree with Anonymous's tactics, but look at it from their perspective: Corporate executives don't scare easily. What level of threat would convince Sony to change its policy?

<comment><USER29> You're missing the point - trying to change a companies policies at the price of being decent human beings is worse than whatever offense Sony committed.

<comment><USER30> > worse than whatever offense Sony committed

This gives the impression that you're making a claim about something you don't have much specific knowledge of. Or that you're absolutely sure that Sony is incapable of offenses larger than a certain magnitude.

</comment></comment></comment></comment></comment><comment><USER31> apparently the "kids" are older than geohot</comment>


Game of Thrones S8E3 Is a Major Disappointment - <AUTHOR> https://medium.com/1-one-infinity/game-of-thrones-is-a-major-disappointment-eb27c15c7b17 <comment><USER2> I clicked looking forward to a strong analysis of this, as is bound to happen in the coming days since there are tons of invested people ready to analyze the way the show has (at least ostensibly) failed to live up to even its own lore. But this opinion is kind of a mess and needs some copy editing at minimum.

For a better time via short questionnaire-style takes from members of The Ringer staff, try: [https://www.theringer.com/game-of- thrones/2019/4/29/18522411...](https://www.theringer.com/game-of- thrones/2019/4/29/18522411/game-of-thrones-season-8-episode-3-exit-survey)

</comment><comment><USER3> You can say that again</comment>


Ask HN: Can I see your rig? - <AUTHOR> Get your geek hat on and show off your rigs; computers, servers, devices preferably use imgur. Also, at least short summary of what's in the picture(s) models preferred :-) <comment><USER2> I think there are two types of people. Those who still fetishize hardware, and the rest of us who just care about the product created by the hardware. A carpenter (I don't speak from experience, merely from analogy) is probably more proud to show off something he's made than the tools he used to make it.

<comment><USER3> HN is full of people talking about how they work, what tools they use, what their processes are. Your hardware setup is a component of that, so it seems valid to ask about it. I don't feel it is fair to act like you are superior to people who "still fetishize" it.

Of course people are more proud of their results. And we see plenty of that on here every day. This was a simple question to see people's systems, not an implication that it was more important than other aspects of the work people do.

(And BTW, the guys who I know who do carpentry and masonry work absolutely have some tools they like to show off.)

</comment></comment><comment><USER4> [http://i.imgur.com/n1aP1Dw.jpg](http://i.imgur.com/n1aP1Dw.jpg) (home)

Nothing exotic, i5-2500K, 32GB RAM, ATI HD69502GB, 120GB SSD, 1TB spinning rust, runs Xubuntu 14.04.

Screens are 2xX23LED and the ubiquitous Dell 2412M

Laptop is a Dell Vostro 3750 upgraded to 16Gb RAM.

i5-2430 (I think I forget) running Xubuntu 14.04

[http://i.imgur.com/WbSUsxK.jpg](http://i.imgur.com/WbSUsxK.jpg) (work)

i5-3570K, 32GB RAM, ATIHD7something I forget, 120GB SSD, 1TB spinning rust, runs Xubuntu 14.04

Screens are 3xDell 2412M

Keyboards are the truly exceptional Microsoft Natural Ergonomic Keyboard 4000

<comment><USER5> Why no mousepad ? :o

<comment><USER4> Both are Laser mice, simply not needed :)

</comment></comment></comment><comment><USER6> I get obsessed about rigs once every few months and spend a few days browsing:

[http://reddit.com/r/battlestations](http://reddit.com/r/battlestations)

[http://reddit.com/r/macsetups](http://reddit.com/r/macsetups)

:)

<comment><USER7> I tend to stop looking when I see one like this: [https://i.imgur.com/EzWOJvI.jpg](https://i.imgur.com/EzWOJvI.jpg)

<comment><USER8> I just pause to admire it, make some mental notes, and brainstorm a development of my own. Where did you find this? I would like to contact the owner

<comment><USER7> It's the 4th highest rated post in r/battlestations

[https://www.reddit.com/r/battlestations/top/](https://www.reddit.com/r/battlestations/top/)

</comment></comment></comment></comment><comment><USER9> I never saw the appeal of watercooled PCs with windows and lights, but found myself with a huge amount of time of my hands due to a serious injury that took me out of work. I decided to indulge myself one time before the idea of building such a thing is obsolete.

Here are some pics, it's a work in progress - [https://imgur.com/a/WWsna#0](https://imgur.com/a/WWsna#0)

The case is a Case Labs Mercury S8 with a custom powder coat. It allows the motherboard to sit horizontally. The graphics cards are Nvidia GTX 980s with custom made waterblocks. There are large radiators concealed in the top and the bottom of the case. The two round, red things you see in the pictures are Laing D5 water pumps. The 'Midnight Express' theme is inspired by the film and the music of Giorgio Moroder. A number of parts have been laser engraved with the artwork. Everything is controlled and monitored by an independent microcontroller (Aqua Computers Aquaero 6, you'll see it in the pictures.)

Ongoing build log is here - [http://www.overclock.net/t/1529623/build-log- midnight-expres...](http://www.overclock.net/t/1529623/build-log-midnight- express-mercury-s8)

</comment><comment><USER10> Mine: [http://urza.cc/pc2013/](http://urza.cc/pc2013/)

<comment><USER11> That's pretty cool!

I love the idea of completely silent computer, but sadly, I don't think it's compatible with performance or gaming. Though now I wonder if there's GPU that can be turned off completely when not in use and use integrated one. Kinda like Optimus, but for desktop.

(also, czc has been cheaper than alza for years)

<comment><USER12> External GPUs can't come soon enough...

Frankly, most current generation laptops are more than powerful enough for most of the things I do. Adding a GTX 750 TI level GPU would probably be enough to cover the rest of my use cases (light 1080p gaming).

<comment><USER13> [http://www.banggood.com/EXP-GDC-Laptop-External-PCI-E- Graphi...](http://www.banggood.com/EXP-GDC-Laptop-External-PCI-E-Graphics- Card-p-934367.html)

(i have not tried this)

<comment><USER12> Haha interesting find.

Although I'd prefer something a bit more mainstream. Maybe a USB Type-C based solution?

</comment></comment></comment></comment></comment><comment><USER14> This is my 2009 vintage Acer netbook running Lubuntu: [http://i.imgur.com/xU1IhRY.jpg](http://i.imgur.com/xU1IhRY.jpg)

<comment><AUTHOR> Looks like Aspire One, I have the red one running XFCE 4.12 on Arch Linux for SecureSkype (AUR) :-)

</comment></comment><comment><USER15> [https://plus.google.com/u/0/+SeanMcBeth/posts/24Sf5t1YUU6?pi...](https://plus.google.com/u/0/+SeanMcBeth/posts/24Sf5t1YUU6?pid=6139066049594513874&oid=100282968888030008096)

The tower is a home-built deal that is getting a tad old. At the time I built it, the Intel i5-2550k was a good processor, and 8GB or RAM was on the excessive end of the scale. The GPU is a GeForce GTX 570, which was also top of the line at the time. So yeah, it's getting a weeee long in the tooth for some of the stuff I'm doing (I'm sure you can see the Oculus strap on top of the tower).

Ancient Microsoft natural keyboard. They flattened the wave design in future iterations so I never bought another one. I switch between this and a Unicomp.

The display is the Acer T232HL, which is a really nice, 1080p, 10-point-touch LCD that doesn't cost an arm and a leg. Also has integral speakers, which is nice, because otherwise I only have headphones connected to the thing.

Yep, this is my livingroom. I'm a freelance software developer. This is my office. I also rent space from [http://cove.is](http://cove.is). If you're in the DC area, check them out, they are cool.

</comment><comment><USER16> A few weeks back I read a comment on HN about the RIPE Atlas project. It sounded fun (and I wanted a free probe!) so I sent off an application. Completely forgot about it after that until on Monday, out of the blue, a package from the Netherlands turned up with a tiny probe in it :)

It's now happily running on my desk: [http://imgur.com/XA9UwTy](http://imgur.com/XA9UwTy)

<comment><USER17> The old (original?) ones are even smaller. [https://imgur.com/mKBqksU](https://imgur.com/mKBqksU) (Standard business card included for reference)

Unfortunately, mine stopped working a few weeks ago. Originally started using it in July 2011.

<comment><USER16> Nice! Was that also a re-branded TP-LINK device? Any idea what model?

<comment><USER17> I knew that question was coming.

It's a Lantronix XPort Pro: [http://www.lantronix.com/device- networking/embedded-device-s...](http://www.lantronix.com/device- networking/embedded-device-servers/xport-pro.html)

RIPE Atlas also has some code on github: [https://github.com/RIPE-Atlas- Community](https://github.com/RIPE-Atlas-Community)

</comment></comment></comment></comment><comment><USER18> It seems to me that as a professional, I am rewarded for maintaining the smallest differentiation in my rig from bone stock hardware and software configurations. The more that is different about my setup, the more time I spend debugging and symlinking includes when something doesn't compile etc.

Maybe this is a sign that I'm not doing enough "cutting edge" work.

<comment><USER19> This is definitely true at the office, but at home, a very quiet Hack Pro in a Fractal Design case with a GTX970 provides a very solid box that I just can't complain about.

</comment></comment><comment><USER20> Paid 100$ for a used Chromebook ARM, running crouton. Cheap, silent, x86-free.

<comment><AUTHOR> Do you have any pix of it or at least model ?

</comment></comment><comment><USER21> Not without dinner first.

<comment><AUTHOR> Please start a new thread "Ask HN: What do you eat for dinner ?" instead :-)

</comment></comment><comment><USER22> I have this one. Like it? [http://i.imgur.com/Ybznz.jpg](http://i.imgur.com/Ybznz.jpg)

<comment><USER23> Holy shit you must be rich!

<comment><USER22> To be honest, i lied. Its actually one of my fathers company ;)

<comment><AUTHOR> Must be running Windows 10 on it.

</comment></comment></comment></comment><comment><USER12> My dream setup once I get my own place would include, among other things, a 4K 40"\+ TV as the main monitor, on a slightly lower platform behind a hybrid standing desk + treadmill combo (don't ask me how this is going to be physically possible... still working out the details in my dreams), with a nice view of the ocean as the backdrop instead of a boring blank wall. ;D

</comment><comment><USER24> [http://www.michevan.id.au/content/sit-stand- desk/](http://www.michevan.id.au/content/sit-stand-desk/)

Motorised sit/stand desk with three 24" monitors. I mostly work remotely from home, so this is my home/work/office space where I spend far too much time. Run ArchLinux with KDE as my desktop.

</comment><comment><USER25> Use to have dedicated servers (at Hetzner and Webair), but switched to digitalocean. Have an old thin server laying around, pentium 4, was thinking about doing something with it, but it makes so much damn noise. For day to day use, I'm using a MacBook Air (2012 model), still very happy with it.</comment>