Ask HN: % of Free to Paid? - <AUTHOR> Who wants to "open the kimono" a little on their SaaS experience? :) For the good of all, naturally.
I'm looking for info on people's experiences of free:paid account ratios. Not just traffic:signup of paid accounts rates, but over time (after signups).
Give to get: Freckle (http://letsfreckle.com) has a fairly typical conversion rate for signup - between 1 and 4%, on any given day, heavily dependent on the source/type of traffic. Overall, 7.8% of all our accounts are paid accounts.
I'd also love any posts, essays, etc., that you know that discuss this rate. I haven't had much luck googling.
EDIT: Made my intro more compelling ;) <comment><USER2> I can give a couple of answers here, so I will. All numbers are expressed as "percent of free trial accounts which turn into sales", and ignore sales of my desktop software to folks who never sign up for the online version. (That makes up about 25% of my sales these days, declining fairly rapidly as customers get more used to web apps and I keep exiling the downloads further and further into Siberia because their conversion rates suck.)

BCC converts 2.1% of trial accounts into sales, which in my business model are one-offs.

That is the consolidated conversion rate and I rag on that metric regularly, because it mixes high-volume low-conversion user acquisition strategies with low-volume high-conversion strategies.

I just got done with (finally) building first touch conversion tracking yesterday.

Consider a user who Googles for [cub scout bingo cards], clicks the organic result, signs up for my free trial, comes back a day later via [bingo card creator] and clicks the AdWords ad, then converts. Google Analytics and the vast majority of tracking systems would score this as a win for AdWords. I'd like to be able to track it back to the win for organic SEO. So I built a way to do that. But I don't have good data on that yet, aside from one conversion which was literally the above example.

However, I have other ways of torturing the data to get at its secrets. For example, my Halloween promotions (high volume, reaches way outside of my core customer segments) converted at a rate of 1.3%, just among web app users (which works out to several thousand in sales... and it would have been better without that pesky "Ah whoopsie the signup button vanished in IE" bug).

On the other hand, organic searchers coming for e.g. Spring bingo cards who sign up for the trial convert at 3.4%. Sadly for me, they number less than a tenth of the Halloween deluge.

Looking at uber-niche organic search folks as a group, my conversion rate is better than 5%.

P.S. The "canonical" post on this subject, and the source of a lot of myths we have to kill in our industry, is the "SXSW Web App autopsy" from a few years back, featuring our friends at Wufoo among others. Google it, you'll find it easily.

<comment><AUTHOR> Thanks! Love the detail. I'll respond in time... our backend system doesn't (yet) help track where customers come from, when they upgrade from Free to Paid, and actually, not even how many upgrade as opposed to signing up as paid initially. Which I know is dumb. :)

In terms of where traffic comes from, though, we also see a huge difference. Search traffic has the second highest signup conversion rate of nearly 4.5%. We rank very well for several keywords, and quite a few people seem to search for us by name, too. Indicating more WoM.

The traffic source with highest conversion rate (5.8%) is one very targeted micro-banner on a specific blog I bought with BuySellAds, but it's not free and it's not as much traffic as search :)

By the way… I think I maybe was unclear. My 7.8% is talking about the percentage of the body of accounts. E.g., of all the accounts we have right now, how many are paying?

EDIT: Clarity.

<comment><USER2> Your definitions and my definitions are the same, I think.

Both turn out to be P / (F + P), for P = "accounts currently paying" and F = "accounts currently free".

P.S. You use Rails, right? If you're interested I'll blog on the code for this -- it is under 25 lines for the stupidest thing that will possibly work.

<comment><AUTHOR> Yep, we do. I always welcome more blog posts :D For me, I don't have time to do the design/marketing/'vision thing'/cust service AND code, so I'm leaving the code to my partners. I suspect he already has a plan but it hasn't been implemented yet.

Maybe I can hit him over the head with free code ;)

</comment></comment></comment></comment><comment><USER3> 7.8% is incredible. Based on my experience, I think 1-2% is benchmark.

But really it depends on how widely your service is known, and to what extent it appeals to the mass market. Make either of those variables higher, and you'll get a ton more free users, and quite a few more paying users, but your %age will be worse.

Bottom line: looking at your traffic, I'd focus on getting yourself better known and getting more users, rather than converting the people already coming to your site.

<comment><USER4> I took the time to visit the website and he says, 7.8% is the ratio paid/free of the current accounts they have, _but_ there is a _but_ , they are not offering a free lifetime account. So, this is why the ratio is high as the people who just wanted to try will get their account removed after 30 days.

In fact, this ratio _may_ only increase with the time for such offers as the number of paid customers will increase over time but the number of new signups _may_ start to plateau.

</comment></comment><comment><USER5> I have a small golf handicap tracker (<http://www.forescoregolfstats.com>) with a limited free account and then a one-time paid upgrade that lifts those limitations.

As of right now, my free signups are converting to paid at 11.65% and that's about 1% below the average over the last year or so.

Caveat: My sample size here is very small. I've don't next to zero advertising for this site. Still, with the number of free alternatives that have sprung up since I built this thing, I think that percentage is pretty good.

</comment><comment><USER6> We recently asked the same question of a number of startups as we wanted to write an article on it, but struggled to get enough to share. I can tell you one big name SAAS product (one you would all know) admitted they converted 2% of traffic into paid accounts. For the record they had a 30 day free trial as their freemium offer.

If you want our data, check out our post we wrote recently here:

[http://www.eventarc.com/posts/2010/05/18/conversion- statisti...](http://www.eventarc.com/posts/2010/05/18/conversion-statistics- rodents-of-unusual-size-and-the-finest-swordsman-that-ever-lived/)

</comment><comment><USER7> _[drops kimono ... lights candle]_

At NextProof (nextproof.com), we have 4 paid plans and a free plan. Right now, our ratio is 61% free plans and 39% paid plans.

The ratio was much higher until I changed the layout of our pricing page (<http://www.nextproof.com/pricing/>). I used to give the free plan details equal weight ... once we buried it, our ratio moved quite a bit in our favor (our overall conversions dropped a bit, of course).

As for traffic, our rate of conversions/total visitors is 2%. I suspect this isn't a good number, however, because the site includes our help pages. We convert 4% of organic google searches. We also convert about 1.5% of clicks on the small footer of each client's site.

It's also worth noting that we do a lot of cross-promotion with our main product and we offer a discount code to clients who use both. That might be why our ratio is not standard.

One more thing–our "free" plans have no monthly fee, but we still take a % of any transactions they make (we are a 3rd party payment aggregator). So, we still make some money from them.

Hope that's somewhat helpful ... I can answer more questions if you'd like.

<comment><USER8> I had to look at that page for 5 minutes before I could locate your free plan. Why don't you try removing it altogether? May be an A/B test?

</comment></comment><comment><USER9> For reference, Spotify has approx. 3.5% paying users: [http://www.wired.com/epicenter/2010/01/spotify- hits-250k-pai...](http://www.wired.com/epicenter/2010/01/spotify- hits-250k-paid-subscribers-us-rollout-still-unknown/)

Might be that changes now when they modified their portfolio.

</comment><comment><USER10> Aside from a few testing and promotional accounts, 100% of Tarsnap users are paying.

I've never really understood the desire to attract non-paying customers, personally...

<comment><USER11> Since our service largely about sharing what our tool helps a user create, free users plaster links around the internet. They don't use much resources except bug reports and suggestions (I've let 300 accumulate over the last month), but they provide us with a big insight into what we need to do in order to be top notch. Additionally, since we are all about helping people map/find bike rides, free users increase the amount of rides in our database, which give value to the paying users.

I agree though, I want to keep their features very limited in order to push people towards paid accounts. It's hard to offer a recreational site (mapping bike rides), which doesn't propose to save people money (it's not a business site), without giving them a free trial.

</comment></comment><comment><USER12> You don't offer any free accounts, besides the free 30-day trial. Right?

In the absence of any long-term free accounts, doesn't your low percent of paid accounts to free accounts mean that you're seeing rapidly increasing growth? Or are you including expired accounts?

It would seem that roughly between 6.8% and 3.8% of your accounts are "stored" from more than a month ago, and between 1% and 4% of your accounts are from new signups. Splitting the difference, I get 2.5% from new accounts and 4.3% from old accounts. Now, that sounds like pretty fast growth, or high turnover. I'm curious how many people allow the first payment to go through, but wind up giving up on accurately tracking time (it's often hard to start work habits) and quitting.

I've had a job at a SaaS company, that had a 30-day trial, and no free option. I remember a larger % of paid accounts to total active accounts. I'm pretty sure it was over 20%. Growth was a bit slow, though. The cancellation mechanism was also different. The trial signup didn't require a credit card (bad idea, since one feature allowed customers to send custom emails), so people didn't have to do anything to cancel within a month. People did have to talk to customer service to cancel once they started paying, though. I think, especially with the email at the end of the trial, before they get charge, that your cancellation mechanism is much more ethical, because you let people quit painlessly (except for the pain of giving up on tracking time). :)

<comment><AUTHOR> We have free accounts, Ben!

They are severely limited, though, and I'm trying to decide what to do with them -- improve them, or not. I don't think they give a real idea of what Freckle is like because they are so limited. But I'm toying with the idea of getting rid of them altogether, now.

So, I don't believe our turnover is very high and the numbers are trending quite rapidly upwards.

But the whole "we do have free accounts" thing definitely makes your math incorrect :)

</comment></comment><comment><USER11> Right now we do not have paid accounts, but are accepting user donations. I am counting donors as people that will signup for a paid account which is obviously a big under-estimation of what I believe our true percent of paid accounts will be.

Out of 11143 total accounts, I have 179 donors in PayPal, which is 1.6% 'paying' users.

We also receives checks in the mail from bike groups occasionally (random $100-200 checks in the mail are nice!) so I would guess that brings us to around 200-220 donors total, or just under 2%.

<comment><USER13> What is your impression of the mountain bike community in general? do they like spending money?

I'm thinking about writing an iPhone app for WA state mountain bikers with trail info, but there is only so many of them (e.g. 2300 registered here <http://evergreenmtb.org/>) and I wonder how many would actually pay for apps.

<comment><USER11> Well, think of it this way: how many of the 10,000 or so active mountain bikers in washington have an iphone, and how many that do bother taking it with them on a trail? My guess is many mountain bikers that would spend money on the sport already know the trails they like to ride, or participate in online communities to find new ones. Not sure how much market there is for an iphone app to do it.

Our service doesn't have much for mountain bikers (yet), so I don't have any numbers to share. This week I am building out better tracking/identification of riders, so should be able to get better insight into how different types of riders interact/value our service.

</comment></comment></comment><comment><USER8> Here are stats for Evernote:

1.8% of users (6% of active users) have converted to premium users.

[http://ryanspoon.com/blog/2010/03/26/evernote-freemium- busin...](http://ryanspoon.com/blog/2010/03/26/evernote-freemium-business- model/)

[http://mobile.venturebeat.com/2010/03/26/freemium-summit- eve...](http://mobile.venturebeat.com/2010/03/26/freemium-summit-evernote- shares-the-insider-secrets-of-free-apps/)

</comment><comment><USER14> I just ran the numbers for S3stat, and it looks like we get almost exactly 25% of our Free Trial users converting to paid at the end of their 30 days.

We don't have any form of free plan other than that 30 day trial, so that might explain why the conversion rate is a bit better than other posters here. People know before they sign up that it's going to cost them money if they decide to stick around.

</comment><comment><USER15> I made a similar post recently asking for feedback on my app's conversion funnel (<http://news.ycombinator.com/item?id=1354179>). My preliminary results showed a 1.6% conversion rate, which from what I gather, is fairly normal. I think with some better A/B testing, I should be able to improve that number.

</comment><comment><USER4> My product is project management and code hosting a kind of GoogleCode for your projects with private/public projects. You can get a 10MB storage (good also for private projects) for free and 1GB and up for money. Here are my latest stats (a mix of Google Analytics and my own tracking) for the last month:

\- Conversion rate to free or trial offer: 3.56% (GA)

\- Conversion rate for visitor having seen the plans page: 11% (Own tracking)

\- Ratio paid/free offer counting all the forges: 2%

\- Ratio paid/free offer counting only active forges: ~15% (it is hard to define sharply an (in)active forge)

The conversion rate for the hosting in my case is not that good because the product is also available as GPL software. You get both GPL+SaaS and the GPL conversion rate is 30% for the non bouncing visits.

You will soon get all the sales figures etc. directly on the website here: <http://www.indefero.net> Your question is just 5 days too early as I started yesterday to write all the details down. I will update my comment later not to force you to visit my site.

</comment><comment><USER16> Depends on the market.

my figures: 1:10 visitor -> user, 1:2000 user to paying members retention on average 6 months.

</comment><comment><USER17> I'll add something to consider:

Look at your % paid not only compared to total users.

Compare it to:

1\. Last 30 days active.

2\. Last 90 days active.

3\. Last 180 days active.

Since free users dip off more typically than paid users comparing total paid to total users doesn't really make sense. It's better to look at it in terms of active.

<comment><USER11> Great idea, I've done it here for our service:

      1) 200 / 4189 = 4.8%
      2) 200 / 6922 = 2.9%
      3) 200 / 8974 = 2.2%

And since we are starting to grow decently, I did users more active than 2 weeks ago: 200 / 2671 = 7.5%

</comment></comment><comment><USER18> My photostre.am doesn't charge customers yet, but of the 160 users it currently has, some 55% already pay for a Pro Account at Flickr. Not bad, eh?

Signup conversions are equally good but that's because they mostly come via the Flickr App Garden.

</comment><comment><USER19> The highest I've seen was 20%, the lowest I've seen was about 0.01%. Partially depends on your market, partially depends on your traffic volume (so you can iterate on tests) and focus. Really you should be asking about the whole funnel and looking at NPV vs CPA or ROI or payback period, depending on your financial and funding picture. I consult on this type of stuff for a living while I'm bootstrapping my startup. I'd try sell to you but I already have one of your competitors as a client so I don't think that would be a good idea. :)

</comment><comment><USER20> I don't have a SAAS solution, but I do have a mobile application, which has a 10% paid accounts upgrade. I have about 60K on the free version and 6k on the paid version.

</comment><comment><USER21> I think an extension of this is: how do we convert free to paid...?

My thoughts were for my own SaaS application was to: \- offer free account to "get a listing" \- upgrading to a paid account gives ridiculous service/benefit \- a commission is paid to the person two converts that free to paid member

I haven't launched yet, but looking at a 33% conversion ratio of free to paid.

But this seems pretty basic and lame. Anyone else have suggestions?

</comment><comment><USER22> We actually haven't seen any conversions yet on <http://twoschedule.com>. It's only been online for a month or so, but we have a fair amount of users and I expected to see more than that. I imagine it's because people are looking for more of an incentive to upgrade.

</comment><comment><USER23> Can't remember signup percentage, but on Feed Digest 2005-2006ish, about 5% of free users became paid users. At the time I understood this was "pretty good", though not stellar.

</comment><comment><AUTHOR> Reasons I want to know this information (and maybe you do too):

* to know where I stand

* to help me decide if I should put more emphasis on the signup/upgrade process, or not

* to encourage other people to talk about this stuff (since it's so hard to find), to demystify it as a business

<comment><USER11> My guess is offering a more comprehensive free account will get you more signups, which could increase the amount that convert to paying, however personally I am extremely unlikely to throw down money without getting a good taste of what I am buying.

You say you have very basic free accounts: do those free accounts tease the users into becoming a paid account holder? Meaning, I signup and use your service and notice 'oh wow, they offer ___', only to click the button and be upsold? I think the tease/upsell could be extremely effective, if your service presents itself as excellent and comprehensive.

On the other hand, just because you increase revenue doesn't mean you are more profitable. How much extra time do you allot to supporting free accounts? Will they be more of a drag than it's worth?

</comment></comment><comment><AUTHOR> OK, the few posts I've found:

[http://news.buzzgain.com/the-metrics-we-track-and-report- exa...](http://news.buzzgain.com/the-metrics-we-track-and-report-example-for- freemium-products/)

[http://sixteenventures.com/blog/the-reality-of-freemium- in-s...](http://sixteenventures.com/blog/the-reality-of-freemium-in-saas.html)

Mite is SaaS, no free accounts at all: [http://blog.yo.lk/en/2010/03/08/facts- and-figures-the-first-...](http://blog.yo.lk/en/2010/03/08/facts-and-figures- the-first-20-months-of-our-small-saas-start-up-going-for-premium-only-instead- of-freemium)</comment>


Issue with TLS-SNI-01 and Shared Hosting Infrastructure - <AUTHOR> https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996 <comment><AUTHOR> > _At this time, we believe that the issue can be addressed by having certain > services providers implement stronger controls for domains hosted on their > infrastructure._

Requiring unrelated third-parties to take specific action(s) to prevent Let's Encrypt from incorrectly issuing certificates doesn't sound like a valid solution to this issue.

What about the shared hosting providers that are "affected" that decide to do nothing to "fix" this?

<comment><USER2> In specific answer to your second question, Let's Encrypt intends to blacklist IPs for those providers from using tls-sni-01 proof of control.

Now, requiring unrelated third-parties to take action is (perhaps unfortunately) nothing new for DV. Back in the day lots of the web mail providers got bitten because some CA would decide that, say, receipt of email to firstname.lastname@example.com is proof of control of example.com, so you just sign up for web mail and say you want the email address ssl- certificate-officer and bingo you get a certificate for a few bucks. This was exploited over and over.

Even today, the Ten Blessed Methods let a CA choose any email address you listed in WHOIS (fair enough, don't list anybody else's address in WHOIS) _or_ any of 'admin', 'administrator', 'webmaster', 'hostmaster', or 'postmaster'.

So when you build a web mail system you need to explicitly blacklist those five email addresses even if you would never need an account named "webmaster" or "admin", if you fail to take this specific action anybody can get certificates for your domain by talking to any of the commercial CAs that use a method complying with 188.8.131.52.4.

Let's Encrypt already disabled a feature of http-01 validation before going live to avoid needing bulk web hosts and CDNs to make a sensible configuration choice, because surveys suggested that lots of them had left insecure default choices enabled.

Or another email example (again thus not affecting Let's Encrypt): Lots of companies purchased anti-phishing systems that scan all incoming email to check for dodgy links. These systems typically dereference all the links, check what they find and quarantine suspicious emails. Several CAs had systems which sent an email saying "Just click here to authorize issuance". The anti- phishing system follows the link, now it's clicked, anyone could get a certificate for these domains because the anti-phishing system would "authorize" anything they requested...

Now, all these are historical rather than current examples, but they do illustrate that "requiring unrelated parties to take specific actions" won't be new or unique to Let's Encrypt.

<comment><USER3> > _" Let's Encrypt already disabled a feature of http-01 validation before > going live"_

I'm curious what this was. Can you elaborate or point me somewhere I can read about that?

<comment><USER2> Sure, http-01 as defined originally has a flag for whether to do the validation with plaintext HTTP on port 80 (as today) or using HTTPS on port 443.

Now, suppose [http://no-ssl.customer1.example/](http://no- ssl.customer1.example/) is a site Customer 1 is running on a bulk host, and it doesn't have SSL. We (the attacker) ask Let's Encrypt for an HTTPS version of the http-01 validation for this name no-ssl.customer1.example

A DNS lookup of no-ssl.customer1.example gives Let's Encrypt the IP address of the bulk hosting server. They connect to port 443 of that address, and they do SNI and say they expect to talk to no-ssl.customer1.example, then they do an HTTP request with Host: no-ssl.customer1.example and a GET for the relevant .well-known/acme-challenge/ file - what happens?

A common default configuration of web servers used by bulk hosters says if anything doesn't match, let's use a "default" such as the first (often alphabetically first) named virtual host to serve the answers. No error, just assume that must be what the request was really for.

Since there is no SSL version of no-ssl.customer1.example, the server drops through to this default, and the web server offers the certificate and content for aaaaa.attacker.example which we, the attacker have prepared. This includes the ACME answer file, Let's Encrypt is satisfied we have "control" over no- ssl.customer1.example and grants us a certificate we clearly shouldn't have.

Apache and nginx both do this by default. Lots of bulk hosts are set up to use them without a configuration that prevents this happening, and they didn't seem to be in any hurry to fix it.

So, Let's Encrypt disabled this feature for their production release.

<comment><USER3> Thanks for expanding. That's interesting. So they disabled http-01 over TLS [0]. Two questions:

1\. Isn't the default virtual host practice still a problem even without TLS/SNI? Apache chooses a default virtual host on port 80 in the same way. Is that "acceptable" simply because it's more common for the default port 80 virtual host to be controlled by the hosting provider? That's not as robust as one would hope.

2\. Wouldn't http-01 over TLS be made safe if the certificate was required to be valid for the domain being challenged? Granted, there's a TLS chicken and egg problem there, but that's beside the point.

[0] [https://tools.ietf.org/html/draft-ietf-acme- acme-09#section-...](https://tools.ietf.org/html/draft-ietf-acme- acme-09#section-8.3)

</comment></comment></comment></comment></comment><comment><USER4> _Over the next 48 hours we will be building a list of vulnerable providers and their associated IP addresses. Our tentative plan, once the list is completed, is to re-enable the TLS-SNI-01 challenge type with vulnerable providers blocked from using it._

This is a terrible solution.

You're assuming you can scour the internet and find every shared hosting provider affected, and add them to a list. And then you're also going to keep that list updated. That's crazy.. an impossible task.

So after this is done, Let's Encrypt will continue issuing certificates improperly on any shared hosting providers that didn't get added to this list. Attackers just need to find a provider and check a list now.

I'm actually kind of appalled that this is what you've come up with.

<comment><USER5> I think this issue can be described as a form of confused deputy problem.

Is not the real solution to have the confused deputies stop acting in a confused manner?

If this issue were confined to a handful of small hosting companies almost no one uses, then I don't think this would be described as a problem with Let's Encrypt - it would be described as a problem with those hosting companies.

The only party that can truly fix the issue of the incorrect user being granted access (directly or indirectly) to a domain pointed at shared infrastructure is the operator of that infrastructure.

<comment><USER6> I came here to say this. What's more, the spec was agreed upon, in relatively public forums, with a voice from the community. Crappy shared hosting providers are going to mostly ignore their customers and perpetuate insecure scenarios while they continue to bill exorbitant rates that exploit the customers' ignorance or inertia. That has been the case for some time, and will continue to be the case, this is just another symptom.

<comment><USER4> _What 's more, the spec was agreed upon, in relatively public forums, with a voice from the community._

It was agreed upon and no one caught this issue. Now we know the issue.

There's nothing wrong with using a protocol you think is correct. There is something wrong with using a protocol you know is incorrect, but continue to use it anyway.

The entire internet should not be required from now to forever to workaround LE's mistake. LE should fix their protocol.

And worse, this protocol isn't even needed for LE. They could remove it, and everyone could use one of the two others that are secure, and LE would be just fine, and everyone -- even those crappy shared hosting providers -- would be perfectly secure.

LE created this issue all by itself, and is capable of fixing it all by itself. LE should do that.

<comment><USER5> LE "created" this issue in the sense that they were the first to formalize an implementable specification for automated verification of authorized domain name use.

In comparison to the prior relatively unspecified approach to verification, it's still an improvement.

"The last person who touched needs to take ownership over anything anyone can blame on the change" is the management style which leads to enterprise IT being unable to get anything done. Because at that point, the safest thing is to never change anything - regardless of how bad things currently are.

Sometimes the world changes, and other parts of the technology ecosystem need to adapt.

[Editing to add since I can't reply to you]: The fundamental "flaw" here is that it's possible for people to get self-signed certificates served for domains where they haven't validated ownership of the domain.

Hosting companies can't be simply adjusting their routing tables for anyone who asks. If you are pointing a domain name at an IP address which will accept routes from any untrusted party, that's simply not a secure situation.

A _signed_ certificate might be good evidence of some authority for a domain, but a self-signed certificate used in a challenge process most assuredly is not.

</comment></comment></comment></comment></comment><comment><USER7> I can create "773c7d.13445a.acme.invalid" in almost all shared hosting control panels I have access to.

When I send an HTTP request with Host: 773c7d.13445a.acme.invalid, the server responds with a file from ~/domains/773c7d.13445a.acme.invalid/public_html or a similar directory available through my FTP account.

When I connect using openssl s_client ... -servername 773c7d.13445a.acme.invalid, the server sends a certificate configured for 773c7d.13445a.acme.invalid in my control panel.

Is this a problem for Let's Encrypt? Doesn't Let's Encrypt's verification require creating files with random names in [http://example.com/.well- known/acme-challenge](http://example.com/.well-known/acme-challenge) where example.com is the certificate's common name?

<comment><USER8> > Is this a problem for Let's Encrypt? Doesn't Let's Encrypt's verification > require creating files with random names in [http://example.com/.well- > known/acme-challenge](http://example.com/.well-known/acme-challenge) where > example.com is the certificate's common name?

That applies to the http-01 challenge. The tls-sni-01 challenge works solely based on the returned certificate. If the SAN value in the certificate matches the SNI value sent by the validation server, the challenge succeeds.

Would you mind sharing which control panel you tested this with?

<comment><USER7> DirectAdmin, the most popular webhosting control panel in my country.

In my opinion this is not a bug because when I need to test a website, I often create an invalid hostname on the server and add the server's IP address to my computer's /etc/hosts. When I need HTTPS, I upload a certificate for the test hostname signed by my private CA.

<comment><USER8> Thanks. I signed up for the first shared web hosting provider I could find that uses DirectAdmin and was able to reproduce this. I'll bring this up in the relevant thread on mozilla.dev.security.policy, this is definitely concerning.

</comment></comment></comment></comment><comment><USER9> Ultimately, if you're attempting to prove hostname control, it would seem fundamentally incorrect to make a request with a Host header or SNI hostname set to anything other than the hostname requested for issuance.

I don't really understand why this didn't come up while considering the protocol initially.

Why aren't we using ALPN for this?

(ALPN is used to negotiate HTTP/2 without prior knowledge of the server's capability - [https://en.wikipedia.org/wiki/Application- Layer_Protocol_Neg...](https://en.wikipedia.org/wiki/Application- Layer_Protocol_Negotiation))

<comment><USER10> > it would seem fundamentally incorrect to make a request with a Host header > or SNI hostname set to anything other than the hostname requested for > issuance.

Pondering why they'd do it the way it is right now, my best guess would be that it allows you to get a LetsEncrypt certificate while still having a valid certificate from another CA. For example, example.com currently has a Symantec certificate that is soon going to be invalidated, and I want to swap over to an LE cert with 0 downtime.

<comment><USER9> You could still do that! Just accept LE's requests with the existing Symantec cert and respond as needed.

Or use the DNS challenge.

Or use something like ALPN instead.

<comment><USER10> How would LE do SNI validation using the Symantec cert though? I can't add anything to it without invalidating it. My understanding is that that's why they do the .acme.invalid SNI responses; so that the server can respond with a self-signed cert that's not going to interfere with anything else.

DNS and ALPN are both great solution, but here's why neither of them work all that well in my specific circumstances, but TLS-SNI works awesome.

\- I can provision VMs at will, but I don't personally have access to DNS. To get a DNS record added, I need to submit a change request. I haven't done the DNS challenge, and I'm not sure if a new TXT record gets generated when you renew a cert or if it's static after initial creation, but either way, DNS very much adds a painful manual step to cert provisioning here.

\- ALPN would be great, if it were baked into the default Centos Apache :). That, I suspect, would be a long time coming...

Right now I generally just use HTTP validation, because I've worked out a pattern that generally works pretty good. I set up an Apache rule that auto- redirects all traffic from http to https anyway; I just add a condition to it so that /.well-known/ gets served off the filesystem before redirecting everything else.

<comment><USER9> I don't see why you couldn't do the HTTP validation, but over the existing HTTPS cert you have, without having to accept non-TLS connections.

To be honest, I just don't think the SNI challenge has any place here. Although I totally recognise it is an easier option where you're more restricted, the fundamental security concerns are more important.

<comment><USER10> Your sibling comment suggests that the LetsEncrypt verifier would potentially follow a redirect HTTPS, which I'm going to have to experiment with today because it'd keep things simpler here.

Best I know, currently HTTP validation is required to happen on port 80. And that works awesome for bootstrapping; on a new install, you don't need to provision a fake self-signed cert to be able to request a real one. If it can happen over HTTP or HTTPS, that would be amazing.

<comment><USER9> It seems... very strange that it doesn't allow the use of port 443/HTTPS with a self-signed cert. It's exactly the same thing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> [Copying my comment from [https://news.ycombinator.com/item?id=16112237](https://news.ycombinator.com/item?id=16112237)]

Unfortunately, this means that Traefik's default Let's Encrypt integration (without setting a DNS provider) does not work anymore. Although the logs now say "could not find solver for: http-01", they actually use tls-sni-01.

<comment><USER9> The entire Golang autocert functionality relies on this - which presumably Traefik is using

<comment><USER12> Through a twist of fate, I was looking into this over the weekend, and you're correct about Traefik.

</comment></comment></comment><comment><USER2> My _guess_ at this point is that there's a bunch of scary corner cases with the behaviour that makes this possible so that if your bulk host or CDN does this you need to be _very_ careful even if Let's Encrypt abolishes tls-sni family proofs of control. If I'm right, fixing this is pretty urgent for anyone with untrusted users sharing an IP address.

It looks very much as if affected hosts/CDNs are letting any customer impersonate any other customer with the only caveats being that you've got to get in first and you need the victim customer to make the config change that causes this to be useful.

Suppose I am victim.example, I have a contract with Funky Jim's Hosting, and I have configured *.clowns.victim.example to go to a server at Funky Jim's but I've only every bothered setting up www.clowns.victim.example, images.clown.victim.example and js.clowns.victim.example in Funky Jim's config system. I use HTTPS, so the valuable Clown Login tokens available on www.clowns.victim.example are protected - aren't they?

Some loser, let's call her Sad Carol buys a basic account from Funky Jim, and tells Funky Jim they want to add a new site, busted.clowns.victim.example. Funky Jim OKs it, because that's "harmless" right? No need for Carol to prove to Jim that she owns it, if not why would it matter? But wait, actually busted.clowns.victim.example matches my wildcard DNS entry, it goes to the right server and serves up Carol's site - now Sad Carol can get all my bloody Clown Login cookies sent to "her" web site just by injecting "her" site into an ad inventory or whatever.

<comment><USER13> An excellent example of a plausible attack scenario.

Having said that, I think what we're all dying to know is what was it, initially, that made Carol so sad?

And, indeed, was it that same sadness which stagnated, fermented, and evolved into the obvious hatred and antisocial behaviors that she exhibits here?

</comment></comment><comment><USER14> See also: [https://news.ycombinator.com/item?id=16112237](https://news.ycombinator.com/item?id=16112237)

</comment><comment><USER15> does this mean you can collide legitimate certificates on these hosting providers? like someone is hosting www.foo.com can I upload a www.foo.com certificate then it will choose which cert to use based on some random factors. or maybe it only works on names that haven't been uploaded so i can block someone from uploading certificates for a future domain they might want to use.

<comment><USER16> Maybe, but that is a different issue.

If as a hosting provider I have accounts for foo.com and bar.com, I certainly need to make sure to never reply to requests for foo.com with data from the account bar.com.

But I might still allow the account bar.com to upload a certificate that includes bar.com www.bar.com bar.io getbar.com or any other domain name even if those are not registered in my platform.

So what if bar.io is actually not owned by the same person as bar.com? The DNS for bar.io does not point to my platform, no real user will connect to me.

If an attacker is also able to change the DNS for bar.io (say by an MITM attack in a public wifi) it is of no real consequence that he uses my platform. He could just as well respond with an IP completely of his own and do everything himself. That is why we have SSL in the first place.

<comment><USER15> so if someone has www.foo.com registered with a provider (but has wildcard DNS pointing *.foo.com to the provider) would it be possible for someone who has another domain bar.com to upload a cert that would be used for x.foo.com. because even though no content would be served from bar.com that is kind of a weird situation.

like i think the way ACME tls-sni works is broken because it should be using the DNS hierarchy to make the SNI request [maybe something like: 773c7d.13445a.acme.foo.com] but maybe some providers are still broken even with this fix because they let people upload certs with names that belong to other clients.

</comment></comment></comment><comment><USER17> > At this time, we believe that the issue can be addressed by having certain > services providers implement stronger controls for domains hosted on their > infrastructure.

Is DigitalOcean one of these service providers that need to implement stronger controls?

</comment><comment> mh-cx Does this basically say, that letsencrypt will no longer work in a virtual hosting setup?

What about existing certs? Can they at least be renewed when they expire?

<comment><USER18> Let's Encrypt works just fine in a virtual hosting setup using the http-01 or dns-01 challenges. In fact, all (shared/virtual hosting) users in my company automatically get certificates this way.

<comment><USER19> Is there a way to tell whether I am using http-01, dns-01 or TLS-SNI-01? I'm using the letsencrypt nginx module.

<comment><USER20> Seems to use tls-sni-01. This is my guess by looking at the certbot-nginx source directory: [https://github.com/certbot/certbot/tree/b1826d657ffc7c278041...](https://github.com/certbot/certbot/tree/b1826d657ffc7c278041cc0c8e14dc2ba23f95e3/certbot- nginx/certbot_nginx)

<comment><USER21> That's correct.

Certbot can use different plugins for validating the name and for installing the certificate.

You can configure HTTP-01 to work and use "certbot -a webroot -i nginx -w /path/to/whatever -d example.com -d www.example.com".

[https://community.letsencrypt.org/t/solution-client-with- the...](https://community.letsencrypt.org/t/solution-client-with-the- currently-selected-authenticator-does-not-support-any-combination-of- challenges-that-will-satisfy-the-ca/49983)

</comment></comment></comment></comment></comment><comment><USER22> This is not specifically a vulnerability in TLS-SNI-01 - more like a major misconfiguration by the shared hosting provider, to share ACME secrets.

I guess TLS-SNI-01 does share part of the blame for making this possible in the first place.

It would be great if TLS-SNI-01 could be salvaged, for all the binaries out there - but i don't think a blacklist is a great long-term solution. How about a strict one IP = one domain lockdown until you can prove that you don't share challenges? i.e. negative responses.

EDIT: See reply

<comment><USER4> I disagree. It's a fatal flaw in TLS-SNI-01/02\. Here's why:

All of the information required to solve the challenge is in the attackers control. SAN-A and SAN-B (in v02) are known by the attacker. And no action or information from the target domain is required to solve the challenge.

Every shared hosting provider and CDN that lets you pick a domain and upload a custom certificate can be used to solve the challenge.

Your solution of restricting it to ip = one domain just reduces the vulnerable sites to sites that don't use LE and are on a shared provider. (Also note, if the provider does not implement LE.. then they are vulnerable to this attack against all of the customers.. with your solution: 1 customer for each IP owned by the service)

As long as SNI is part of the TLS standard, it is incorrect to assume IP = domain ownership.

<comment><USER22> You're right. Thanks for clarifying.

</comment></comment></comment><comment><USER4> How does TLS-SNI-02 fix this issue?

...

Edit: I've removed most of my post here... This was already acknowledged in the article. 02 is vulnerable also.

<comment><USER13> I think the only fix is to create TLS-SNI-03 in which the only dnsName component in the self-signed certificate is a well known child of the domain label to be validated.

Validating www.abc.com, SNI and dnsName is well-known-acme-pki.www.abc.com and the certificate should have some other parameter stuffed with a challenge response that is defined to be a challenge response calculated over the inputs of a random token provided to the requestor by the CA and the account key of the requestor.</comment></comment>


Apple Blocks Microsoft's XCloud on iOS - <AUTHOR> https://www.eurogamer.net/articles/2020-08-07-apple-blocks-project-xcloud-on-ios <comment><AUTHOR> I find it ironic that Microsoft is the victim of a company using its operating system to stifle competition.</comment>


How Do Designers Choose Typefaces? - <AUTHOR> http://www.slate.com/blogs/quora/2014/02/21/what_criteria_do_designers_use_to_choose_a_typeface.html

<comment><USER2> This is a fascinating question; which the article _completely_ fails to answer. Besides fluffy common-sense tips like being aware of what message a font sends and not using what was fashionable twenty years ago, the only concrete advice is:

"Serifed type is often used for long copy, like books and magazines. This is because the serifs make the characters more recognizable and the text easy to read in bulk at small sizes. Serif body copy usually pairs well with sans- serif display type. There are mountains of exceptions, but you have to understand the rules before you can effectively break them."

 _Everyone_ knows the serif-for-body-text, sans-for-headings "rule". What we need to know is the next step: what are those exceptions, what motivates them, when do they apply? Why _specifically_ do you choose, say, Baskerville over Stone Print?

By not answering any of these questions, the author gives them impression that he doesn't know the answers.

Does anyone? Because articles like this just reinforce the impression that type choice is a religion that its priests make mysterious for their own job- security. I really want to believe that there's a science in there.

<comment><USER3> I just registered to reply to your post. I am a designer with a couple of decades experience. There are of course design 'rules' but there is just as much intuition and familiarity.

If I can make an analogy, it may help explain the process of choosing typefaces for a project. I really hope this doesn't come across as pretentious nonsense, as anyone can learn about type, but it really is mainly down to experience and a desire to learn:

So let's say your job is to choose the songs that appear on film soundtracks. You need to be aware of the mood, era and style of the film, and choose compositions to match. Now due to the nature of your job, you will be more aware than the average person of music around you - you are constantly conscious of it around you in your day to day life, as well as researching the history of specific songs and tunes, in your own time, purely for pleasure.

So you'll have built up a mental database of knowledge. For a specific film you could include a popular song that many people are aware of, or you could choose something more obscure, but more appropriate. You might choose a selection of songs by the same artist, or tunes from the same record label, or all songs played in the same key. Simply having more knowledge means you have these options.

There could be a set of rules written for choosing music - 'In a tense scene, use this type of tune', and that would be fine, but it really is one of those things where experience over time, and an enthusiasm, is more valuable than just going by the book.

Bringing it back to type, it's a case of knowing about the moods generated by each typeface. From day to day I am constantly aware of the typefaces used on shop signs, TV and film credits, newspapers and posters; but I also know what fonts would have been used in the same circumstances in 1979, or 1962, or 1890 (although not so much on TV then).

So I've probably not done anything at all to dispel your idea of 'priests of a mysterious religion', but I'd personally compare it more to a hobby or pastime, which, if you're lucky, you can get paid to do.

<comment><USER4> Brilliant analogy Thos - i was an art director and creative director last century and you nailed it. I'd add that good vintage typographical signage goes for ridiculous prices these days because of their evocativeness and balanced design. Graphic design is very analogous to creating music also, and picking appropriate tonal colors...

</comment></comment></comment><comment><USER5> Interesting post, but please don't preface submission titles with "Show HN:", especially if it's not some personal project.</comment>


Postmortem of Game Programming with Digital Mars' D Programming Language (2008) - <AUTHOR> https://www.gamedev.net/resources/_/technical/game-programming/a-postmortem-of-game-programming-with-digital-m-r2451 <comment><USER2> Lots of random 'Æ' and 'ö' characters strewn throughout the article... Did anyone proof read this?

<comment><AUTHOR> I think it got mangled during one of their site upgrades in the past decade.</comment></comment>


In Aging Singapore, 65-Year-Olds Are Learning How to Code - <AUTHOR> https://www.bloomberg.com/news/articles/2019-09-13/in-aging-singapore-65-year-olds-learn-how-to-program-software <comment><USER2> As a Singaporean, this is another "feel good" article about Singapore that cherry picks anecdotal examples to paint a false image.

<comment><USER3> Could you elaborate? What's the true image?

<comment><USER4> The true image is that 65-year-olds are not learning how to code.

<comment><USER5> > The true image is that 65-year-olds are not learning how to code.

The true image is that _most_ 65-year-olds are not learning how to code.

<comment><USER6> If just one leant to code at 65 this is so great to hear about.

<comment><USER7> My uncle in his 60's returned to the university to get an advanced degree in vulcanology.

<comment><USER8> Several people do it, like several people do matchstick Eiffel Towers or have a crocodile as a pet.

It's still rare, and in no way anything statistically significant to write home about, nor the "way out" for the serious problem of old people forced to work.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> When I worked in Singapore, it was heartbreaking to see how the elderly were forced to take low paying positions clearing tables and being servers at McDonald's. Not because it's "bad" work or anything, but because in their aging years they were forced to due to a social service system that failed them.

This is obviously a fluff piece that tries to promote the resilience and motivation of the aging population, yet just highlights how bad things are since people have to work til they die.

<comment><USER10> How has the system "failed them?"

<comment><USER8> In the European sense, that if you're 70+ and you're forced to working still after a lifetime of work (even if you had blown every penny of your old salaries on hookers and blow), then the pension system is bad and anybody who approves of it should feel bad -- you wouldn't understand!

<comment><USER10> I clearly don't. It's inexplicable to me why able-bodied people in a country with a birth rate below replacement rate since 1977 should expect to be able to stop working. It doesn't matter how you structure the retirement system, the math doesn't work.

<comment><USER11> > It's inexplicable to me why able-bodied people

That's the problem. Very few people can still work at that age. To be more specific, there are more or less two types of labor: physical and mental (cognitive).

Very few people can do 40 hours of physical labor when they get to be 65 years old. If they've been working physical labor, their body is beaten and used for the years of abuse. They literally are no longer physically capable, not to mention the significant pain they're in from working a life of physical labor. If they've not worked a life of physical labor, then very few have the physical ability to start doing so when they're 65. Yes, if they've been fortunate enough to have top-notch medical care, good exercise habits, good genetics, and good luck, they may be able to do physical labor for 5-10 years, and then what? Also, a failure of any of those 4 can destroy you suitability for labor. Also, if they've had good medical care and the privilege to maintain a rigorous exercise regime, they likely have enough money for retirement.

In terms of mental labor, first of all, what percentage of the population is capable of skilled cognitive labor, like programming? Also, even among the minority of the population that is suited for such work, some people start losing a significant amount of mental acuity by they time they're 65-70.

In short, any society that fails to care for its elderly has failed, period. Yes, these folks have no choice but to try to get by as best they can, but it's a societal failure.

Surprised that any reasonable person would disagree.

<comment><USER10> My parents are past 65, and my mom is still easily able to spend a full day taking care of our 1 year old, and my dad spent the last few weeks cutting down trees on his property. (They spent the first 40 years of their life in Bangladesh, so your point about healthcare probably isn't correct either.) Only a small fraction of people work hard physical labor that someone 65-75 could not do. And of course some people won't be able to do even a normal service job, but you don't need everyone to keep working, just most people.

As to the societal failure—its a self-engineered one. Maybe some day we'll have robots doing all the work, but we're not there yet. Singapore's GDP per capita is $90,000 per working person. Enough where you can have a functional retirement system, but not so much that doubling the number of retirees per worker won't seriously be painful.

<comment><USER12> here we go... anecdotal evidence starting with "my such and such can do such and such" so it must be true for most people. I am 38 and last year I tried doing dish duty in a kitchen just for the heck of it and my back couldn't take more than 4 hours at a time.

<comment><USER13> Isn't this thread fragment all anecdotes & unsupported generalisations, on both 'sides'?

<comment><USER8> If you mean we only provide actual experience from society, and not statistics and what some expert said, in a topic that's not about stats, then yes.

<comment><USER13> You are reacting, not responding.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> The title says that 65-year-olds are learning how to code, yet the article itself only mentions one example. It does not provide more data, except about the decline of productivity and the aging population.

A 65-year-old learning how to code is still probably very unusual.

</comment><comment><USER14> Translation: Singapore's government is failing its elderly generation. A very small percentage are able to keep working and supporting themselves for a few more months / years by learning how to program, in probably the most basic sense. Everyone else is unable to find work but unable to receive retirement benefits that they've paid for during their working years in taxes. This circumstance is due to either corruption or ineptitude, or both.

This will probably be a more prominent story in the US soon as well. Save your money as best you can and don't count on governments to fulfill their promises.

When I was growing up, the retirement age in the US was 65. Now it's 66 and will soon be 67. By the time I retire, it will probably be higher. It's blamed on the population living longer, yet the average lifespan has been decreasing recently. The government failed (or ignored) the fairly obvious result of modern medicine making people live longer and did not plan for it, and continues to not plan for it other than cutting benefits. How many 66 year old programmers do you know?

<comment><USER15> Let's make sure social security is around forever, and available for those that actually need it. We can slightly increase taxes and slightly reduce benefits for wealthy people to keep social security working basically forever. I'm fortunate to be a highly compensated engineer. If I'm making say $250k a year, I could pay a little bit more in taxes to help the system be sustainable, and also more likely to be there if I do need it.

Taxes for this benefit are capped at $8,240 or 6.2% of salary up to $132,900 [1]. The reason taxes are capped is because benefits are capped. My company could pay a bit more in payroll taxes and they wouldn't care, they'd love to hire 5 more experienced and well compensated engineers like me. There's a similar issue on social security wages - let's say I accumulate $5 million in assets at retirement, I'm going to be earning a pretty good amount of income even when not working, so you could reduce my social security (maybe via extra taxes?). People grumble about that money, "it's mine, I paid for it my whole career" \- and you did pay for it in taxes. But things like social security also serve as a crucial part of our weaker societal safety net in America. I want it to be there for people that need it.

I probably won't need it in retirement, but most people will. If I do lose all my money, or say I wasn't as lucky in my life and was hurt or not able to accumulate so much wealth, I want it to be there - for me and others.

[1] [https://smartasset.com/retirement/social-security-tax- limit](https://smartasset.com/retirement/social-security-tax-limit)

<comment><USER16> >If I'm making say $250k a year, I could pay a little bit more in taxes to help the system be sustainable, and also more likely to be there if I do need it.

I'm all for helping those in need and having a safety net, but I don't think what you're advocating for is a realistic solution. Social security is in trouble because it was mismanaged - increasing taxes to offset the burden of mismanagement is a half solution, and likely only a temporary fix. Social security (as well as a multitude of other things) is in its current state because we Americans lack the necessary systems/skills/policies to manage it properly.

<comment><USER17> How is it mismanaged?

<comment><USER16> -On track to be insolvent by 2034

-Costs already exceed income for trust funds

-Costs will exceed income by 2020 for the entire program

-The OASDI tax rate has been increased 20+ times since Social Security's inception in order to keep the program viable.

Add an inability to even recognize mismanagement.

<comment><USER15> These things all come because our elected american representatives how not put more money into it. For my entire life every year there has been a report that they needed to put a bit more in and although there have been small amounts it has never been enough added. Calling this mismanagement of the program is not accurate because it suggests that the money was somehow lost or misinvested by the leaders of the program somehow. The senators and representatives in congress didn't put the right amount of money in it to match the payouts they set.

</comment></comment></comment></comment></comment></comment><comment><USER18> Why does a 65 year old person still have to make a long term investment into their career? Isn't that person going to retire in their 70s or earlier?

<comment><USER19> That's the issue at hand. Singapore's economy can't support retirement in the way you think about it from your country.

<comment><USER20> Why can't Singapore's economy support it? Isn't Singapore richer than almost every country that does have some form of public pensions?

</comment></comment></comment><comment><USER21> I know many comments were about how the article was a cherry picked example, but I was still glad the example seemed to be a useful one.

Honestly, I think even _most programmers_ would benefit from refreshers on how to automate large parts of their workflow (I myself wish I was much more of a sed/awk guru than I am), and how to use the command line and the standard command line tools to get things done.

Not to be too harsh but I think it's unrealistic to expect more than a tiny percentage of people who are very late in their careers to learn to be true programmers, but I think most people could learn bot-like automation tools to improve their productivity.

</comment><comment><USER22> >> _Valerie Yeong-Tan, who's worked for 47 years at Singapore Telecommunications Ltd., is one such example._

Give this woman her pension already.

Learning to code cause you want to at 65 is very different from having to....

</comment><comment><USER23> I'm rather hoping to forget how to code at age 65.

</comment><comment><USER24> In Asia and Latin America, children support their parents as they age. The West created this dream of individualism where each person had to become entirely self-sufficient through their savings and investments (employer managed or not). It's not surprising that it is more fragile.

<comment><USER25> Singapore is part of Asia, and has a majority ethnically Chinese population, what does the west have to do with this?

<comment><USER24> West-ernization.

</comment></comment></comment><comment><USER26> I see Americans are now exporting Hustler Porn to Asia.

</comment><comment><USER27> This is the sort of thing that belongs on [https://www.reddit.com/r/SelfAwarewolves/](https://www.reddit.com/r/SelfAwarewolves/)

</comment><comment><USER28> >Now she uses her new-found skills to automate work processes like doing reports, drafting budgets and other repetitive tasks, saving her hours in her day.

lol i have been using computers for along time and i still have not done that yet. Rather than lots of repetitive tasks it seems i have to focus on a few tasks that require precision and cannot be automated. Very seldom can i recall ever being in a situation where i would spend hours doing something that could be automated. Also trying to code a program to automate the task would take longer than doing the task. I think i can recall one time 2 months ago needing to check 70 accounts and doing it by hand which took a half hour was way faster than trying to spend hours trying to code a program to do it.

<comment><USER29> Automation doesn't need to be end to end. Consider a case if you need to do an aggregation with pdfs, simple script to read and pull the data points is pretty trivial. You will still need to type the results by hand in excel (for example), but that « automation » just reduced the effort it'd take otherwise.

<comment><USER30> Huh?

        pdftotext
        massage with grep, tr, sed, awk, sort, uniq, etc
        paste into Calc or Excel (or some SQL first)</comment></comment></comment>


What's happened to HackerNewsBot? - <AUTHOR> https://twitter.com/hackernewsbot/ Why has it died? <comment><AUTHOR> Anyone got any idea?</comment>


Regression and extraction - <AUTHOR> http://37signals.com/svn/posts/3325-regression-and-extraction <comment><USER2> All valid points.

I do suspect, though, that "the ones who came before" noticed this years ago. Things are worse (re: patents and app stores), but the idea of the industry slowly taking a turn for the worst while nobody notices are not new concerns.

I'd love to hear someone who's been programming for 40 years comment on this. I don't even know who to ask...

<comment><USER3> I'd love to hear from someone who's been programming for 40 years too.

Until then, here's a jpg (<http://i53.tinypic.com/2janfrd.jpg>)

> _"This is the computer industry as it used to be: people sharing ideas and > solutions without the greed and grit with associated with today's corporate > driven, litigation-laced, industry"_

(Second column, near the bottom)

That was written over 20 years ago.

<comment><USER4> I love that Compuserve is $11.75 an HOUR, and the description of online chatting as a "CB Simulator".

<comment><USER2> I would pay for a way to use my iphone as a CB while on the road. I had a CB in college and it was really great to have while on road trips.

I'd love to be able to open an app on my phone and ask the nearest semi driver what the traffic deal is, or where the "bears in the caves taking pictures" are ;-)

</comment></comment></comment></comment><comment><USER5> In addition, a larger and larger portion of a nation's GDP is now taken up by the financial industry which has gone from primarily allocating capital to businesses, to primarily using high frequency, algorithmic, and derivatives- based trading to extract wealth from the economy.

The other of the U.S.'s greatest problems, healthcare, has more to do with entrenched interests and inertia of doctor education and salaries, and a middleman-based payment system preventing the formation of a actual, competitive market (except for, for example, lasik, one of the few procedures that's gotten both cheaper and better over time).

Patents, too, are inertia, political leaders having a record number of years in incumbency, settling into staleness and nobody willing to make bold changes, think them up, or even listen to people who have.

</comment><comment><USER6> The longest-lasting businesses in history are small to mid-sized - at most a few hundred employees - and they are (unsurprisingly) all in timeless, age-old industries. ( <http://en.wikipedia.org/wiki/List_of_oldest_companies> ) The huge British East Indias of the world become entangled with government and rise and fall at the whims of politics.

This makes me believe there's some kind of definable relationship between money extracted, business size, business lifecycle, and benefit to society. A startup with ambitions of being very big, profitable and influential is declaring that it wants to lead civilization in a certain way. But if it achieves size and profit by simply decreasing benefits and increasing extraction, it's actually a corrupting force; post-hoc charity can't change that.

And in technology, every wave of new possibilities pulls a few corruptors along for the ride, in part because we don't always know at the outset whether they're ultimately a good or bad force. As well, the really long-term influences often appear to lie dormant for a long time... ideas from academia take forever to be used in industry, and broad demographic changes in usage can take a decade.

</comment><comment><USER7> I agree with David's general thesis and the items on the list except for the App Stores.

Naturally government-oriented influences like the patent system and regulations are monopolistic. Net neutrality is monopolistic because the backbone infrastructure is in the hands of a relative few number of infrastructure owners. Often, where you live determines the connection to your house and that's a monopoly often enforced by municipal contracts.

App Stores are the only item on his list that are not quite monopolistic in nature. As such, new competitors can come along at any time to unseat App Stores that are failing to provide enough value to consumers.

<comment><USER8> Yes, that's the black and white market vs government worldview. The App Store thing turns this black and white thinking on its head. It is oligopolistic from a practical standpoint, for people making and distributing of mobile applications.

<comment><USER7> Is my worldview artificial or somehow contrived? If I REALLY don't like my phone's app store, I can switch phones. If I don't like my government's policies, I have to move to a new country.

Don't pay Apple and you don't get an iPhone. Don't pay the Govt and you go to jail. Jailbreak an iPhone, breaking Apple's terms and conditions and they won't service your phone. Break the Patriot Act's Gag Rules and you're squirreled away to PMITA prison.

If Apple makes stupid decision after stupid decision, they lose their dominance. If they are too reckless with their finances, they lose their business and possibly go to Jail. If Govt is reckless with its finances it just points at corporate scapegoats and raises taxes. No one goes to jail and this last election shows that no one will even be held accountable by the mostly ignorant voting public.

It's not like I'm making up the basis of this worldview out of thin air. Have you seen what's happening in Southern Europe? Turn on world news (from networks outside of the USA), open a browser, wake up...

</comment></comment></comment><comment><USER9> Before he listed the threats, I immediately thought "App stores" due to my recent debacle with Apple. Bam, there it was listed. Great article.

</comment><comment><USER10> _Net neutrality: Imagine if you had to enter separate agreements with every ISP in the world to get full-speed access to all your potential customers. Only the established elite would be able to navigate such shark-infested waters._

\-- sounds like FB promoted posts?</comment>


Uber Cuts Fares in 48 Cities, Raising Some Concern Among Drivers - <AUTHOR> http://bits.blogs.nytimes.com/2015/01/09/uber-cuts-fares-in-48-cities-raising-some-concern-among-drivers/?_r=1 <comment><USER2> There is nothing that prevents Uber/Lyft from being a race to the bottom re driver revenue. I think that should've been obvious to anyone looking at the model from the beginning.

One of the first questions is to ask about a business is whether there are any barriers to competition. In the case of Uber or Lyft, they have network effects but the drivers themselves have no barrier.

Years ago some Subway franchisees sued Subway because they were selling franchises right across the street from existing franchises. Same issue. There will always be more drivers, Uber/Lyft control the rate, so no limit to how far drivers can be squeezed.

<comment><USER3> But one of the biggest complaints about taxis is the artificial scarcity of medallions driving up prices. How would Uber creating an artificial scarcity of drivers (to drive up prices) be any different?

<comment><USER4> I once talked to a taxi driver (who didn't own the medallion), who said he paid the owner $1,500 per month to drive for him. Plus the cost of his car, gas, and high insurance. He had to earn $3,000 per month just to break even.

Taxi drivers never made a lot of money, even in the old system. But at least the system protected them to a degree by limiting competition. Now there is no protection. It's a free market. Anyone with a Toyota Yaris can fire up Uber-X and compete during the busy couple of hours of the night. It will be a race to the bottom for driver incomes, for sure.

<comment><USER5> Except in the Uber/Lyft scenario, we see no $1500/month deadweight loss going to an economic rent.

There's also no reason to presuppose that personal transportation _SHOULD_ provide a livelihood. The goal of companies like Uber/Lyft is to take advantage of the currently wasted extra carrying capacity in personal vehicles. There's no reason to expect a priori that the value of extra capacity is enough to provide an income.

The goal of these companies is to provide cheaper transportation to those without cars, not to provide a living for those with cars. If less money overall is spent on transportation (which is >90% means to an end, excepting joyriding and competition), which is the case when currently excess capacity is utilized, and consumers also spend less (and consequently capital tied up in personal vehicles), then more capital and income is available for other goods and services.

Obviously, any major paradigm shift in the provision of a good or service will cause some level of upset for those accustomed to the current paradigm, but that does not make the shift a negative one. Further, attempts to ease the transition only draw out the period where we operate in a lossy manner.

In another manner of speaking, when I heard of Uber and Lyft, I did not think that I could quit my day job since I have a car, nor would I have decided to go buy a car if I didn't have one for the purpose of earning income. I did think that they could be a valuable way to defray a portion of my already sunk cost of owning a vehicle. If I hadn't owned a vehicle, these services may have lowered the marginal cost of acquiring a vehicle enough that I could now reasonably afford one.

In both of the above lines of reasoning (currently owning or deciding to purchase), they are not a means of supporting myself, but a means of sharing some of my costs with others who are willing to pay. A car still costs money, but by renting space in it, I can lower the cost.

Think of it more akin to AirBnB - if I own an apartment with an extra room, I don't expect to pay my whole rent with AirBnB-ing out the extra room, but I certainly expect to pay part of my rent out of it. The only difference is that Uber/Lyft rent room in a car.

<comment><USER4> I don't disagree with you. There's no inherent "right" to earn a living as a taxi driver. A driver chooses to enter that "market" with their service, knowing how it works in advance.

But the $1500 rent real taxis pay to medallion holders is now going to Uber. This disruption really just replaced one middleman with another and switched to a per-ride model instead of flat rate monthly.

The increased insurance cost (I heard it was double normal insurance rates) will go away, since most people will not tell their insurance companies they are using their car for business. That means insurance rates will go up for all of us over time as accident and claim rates go up.

All I'm saying, I guess, is it will clearly lead to a reduction in driver incomes overall. I can't see how this business model can lead to them making more. The average wage will be below minimum wage, because how can it not be?

<comment><USER5> First, I'm going to use the term "taxi service" below and I'd like to clarify that I mean this in a very general sense - paid transportation in vehicle classes that would normally be used for private transport, whether provided by a firm or individual, and facilitated by any means. I don't think we disagree based on the tone of your post, but this is for other potential readers. Please let me know if you do disagree.

In this case taxi service need not be supplied by full-time taxi drivers, which is a central point to most of my thinking on this matter. Taxi service can be provided in any quantity (subject to the limits of time and space, obviously) by any individual with a car. A person may provide taxi service once in their life or dozens of times a day.

Second, I will refer to Uber below for simplicity, but I intend my argument to apply to all similar services that exist (Lyft so far as I know) and may come into existence as competitors.

In the status quo the number of medallions is a rough approximation of the limit of taxi services. I think we can agree that the current number of medallions currently limits the supply of taxi services (the supply curve is shifting toward the origin because cost of entry is higher than in the complete absence of medallions or equivalents), and therefore raises the equilibrium price of taxi services. Currently the medallion represents an economic rent (regardless of who owns the medallion a rent is being collected).

In the future state (this is a very general future state - anything where the current limit imposed by medallions is weakened or removed entirely and at least some of the rent that exists in the status quo is transformed into revenue for Uber) the situation is improved. The revenue collected by Uber is not an economic rent, but rather a transactional cost.

First, the cost structure is different - a transactional cost is marginal, whereas the medallion rent (this is specific to a medallion, not all economic rents in general) is either not marginal or marginal at a much coarser granularity. If I rent a medallion on a monthly basis, then I am deciding whether it is worth it to me to drive a taxi for another month. With a transactional cost, I decide whether it is worth it to me to provide one more trip of taxi service. This allows someone who might just pick up people on their normal commute (this is just an example that I find easy to discuss, not the entire basis of my argument) to provide taxi service. Right here we see an increase in supply of taxi services. Our first order analysis should lead us to expect that this increased supply should lead to downward pressure on the cost of taxi service.

Second, the transactional cost is incurred by a competitive firm (currently one competitor in Lyft (that I know of), but even nonexistent competitors can provide pressure[0]). If a competitor can provide a similar service to Uber (matching willing drivers to willing passengers) at a lower cost, then the transactional cost will be driven downward and since there is clear competition in this case among drivers, the cost to end users will ultimately be driven down[1]. In this case, even if we accept your equivalence of Uber's profits and the current economic rent of medallions (note: I do not accept this equivalence, which I think the rest of my post makes clear) the $/ride of this money will decrease, resulting in a net gain.

I have not yet addressed your points about insurance, but first I would like to conclude my current line of reasoning by addressing your fourth paragraph.

You discuss driver incomes and wages, with a comparison to minimum wage. I do not believe the connotation of these terms is in alignment with what is made possible by the service Uber offers in matching casual drivers with occupants. I believe the innovation of Uber is just a re-realization (with some obvious improvements) of the jitney service of the early 1900s. I discuss this concept in more detail in another post[2] with a link to a very interesting history of the trend[3]. In brief summary, ride-sharing is a distributed casual endeavor. A useful metaphor may be Folding@Home - a service that utilizes excess capacity of capital with a significant sunk cost component. I do not think it is accurate to talk about someone's income or wage for something that is not their job. It is not strictly false to do so, since the terms are technically general, but they carry the connotation of employment and I do not think we face a model of employment. We don't talk about someone's wage when they host AirBnB guests. We do not talk about the average person's Craigslist furniture income. My position is that we should view ride-share as analogous to these two examples, rather than as analogous to the current status quo of taxi driver as occupation.

Finally, with regards to insurance, Uber provides insurance to its drivers which is primary to their personal auto insurance[4]. I do not believe your statements regarding insurance are factual or I am misunderstanding your reasoning. I would also like to understand why you expect accident rates and insurance claims to increase. I can think of numerous lines of reasoning, but I'd like to understand yours.

[0] Pressure from potential entrants can force a firm to act as if it had competitors. This idea is not strictly necessary for my argument, so I have removed its exposition. Even if you do not accept this line of reasoning my argument stands since there is no clear monopoly in providing services similar to Uber. So long as a competitor may enter a market, an incumbent firm faces competitive pressure. To wit, if Uber were the only firm in the market, there is currently no large barrier preventing a competitor from creating a similar service and offering a lower price. (There are costs to entry which provide some barrier, but cost of entry does not prevent all competition - there is a nuance that I'll not delve into here about capturing monopoly rents in proportion to the natural cost of entry to the market - it alters but does not destroy the line of reasoning presented.) If Uber wishes to maintain its singular position in market, it cannot sustain monopoly pricing. To do so, it would have to restrict its own supply to raise prices. Since prices would be above equilibrium, competitors would have incentive to enter the market an collect a portion of that monopoly rent. Upon entry of a competitor, we naturally see competitive behavior. If Uber wishes to maintain its singular market position, it must act as if it has competitors, else it will gain competitors. This process would keep prices in line. Monopoly rents are only regularly collected by regulated industries. We could argue causality there, but that is a different conversation and this post is plenty long.

[1] I suggest that competition among drivers would lower the price to consumers. This is not exactly true, since as we both know Uber sets the price, collects the payment, and pays the driver. What I actually mean is that since in the future state there is no artificial limit on the number of drivers, the natural consequence is for price to consumers to fall. Uber wants more customers, so they will lower the cost to their customers. There is an equilibrium to be found among driver remuneration and customer cost. I think we both agree that the trend would be downward for driver pay.

[2] [https://news.ycombinator.com/item?id=8875663](https://news.ycombinator.com/item?id=8875663)

[3] [http://www.jstor.org/discover/724795?sid=21105612783593&uid=...](http://www.jstor.org/discover/724795?sid=21105612783593&uid=3739256&uid=2488599363&uid=3&uid=70&uid=60&uid=2134&uid=3739664&uid=2&uid=2488599353)

[4] [http://blog.uber.com/ridesharinginsurance](http://blog.uber.com/ridesharinginsurance)

</comment></comment></comment></comment></comment></comment><comment><USER6> In a 30 MPG car, the drop in gas from $3 to $2 is a 3 cent difference per mile. UberX charges from $1.50 to $2 or so per mile.

So gas price seems like a red herring to me.

</comment><comment><USER7> The price cutting makes me _more_ reluctant to use car services...and I realize I'm speaking from a position of privilege here in which I can say that I have enough expendable income to not be against paying a little more for the drivers. I feel that the wage is already so low that it's impossible not to feel guilty using them, what with all the other costs they have to deal with. I try to be as conscientious of a user as I can be: I'll watch the app and only request a ride if a driver is fewer than 3 minutes away from me. And if I have a driver take me from somewhere busy on a busy night to a more secluded area (thus denying him/her the easier fares in the busy area), I'll usually tip.

The car services are already such an improvement (in terms of technology) over taxi services that I'm happy to pay for the convenience. And I'm getting less and less enthusiastic about funding a race to the bottom, nevermind the impact it has on customer service.

<comment><USER8> Last year, I had several Uber Black drivers in a row complaining about how unfair the rating system was or how their employer was unfairly requiring them to accept UberX requests even though they had a livery. Uber threw a decent black car service under the bus to save a shitty ride-sharing business that it is almost certain to get undercut out of. And now they are treating their Uber Black drivers like UberX drivers and it ruins the experience consistently.

<comment><USER8> So you can guess my reaction when their recruiters come knocking...

</comment></comment></comment><comment><USER9> Lower gas prices in most UberX cars is barely going to matter.

They really do need to replace casual car use/ownership, but I think rather than continually drop effective wages for their drivers, they need to focus on how good a deal it already is. (compare to mileage on your car, fuel, parking time, parking cost, Parking location)

<comment><USER10> Except it's really not that good of a deal in most places Uber is active. There's no amount of spin that will make spending $40+ on transportation to and from the bar be less than parking fees, gas, and mileage. All that totals up to $20 max. If I'm bar-hopping, forget it.

You're cutting out certain sources of overhead but introducing others, specifically a driver and the organization managing that driver. Uber has to find a way to cut costs to the bone because humans are more expensive than machines and resources and that's not going to change anytime soon.

It's even worse for commuting, because you'd have to be working for a real a-hole if you're paying parking fees at work. Uber estimates that it costs $16-22 one way for my commute. $32-40 is pretty steep to get to and from work.

They have a long way to go before I'd be able to replace my car with Uber.

<comment><USER11> >because you'd have to be working for a real a-hole if you're paying parking fees at work

It depends. It's pretty common in a large city not to have parking included. (And, in fact, I know of at least one city that doesn't allow employers to provide free parking.)

But your basic point is entirely correct. Driving or taking commuter rail into a large city may cost $20 per day or so but then Uber/taxi is going to cost more as well. For the vast majority of people, you can't replace a personal car with a taxi for anything like the same price. It's only practical at the margins; i.e. you only marginally need a car anyway.

</comment></comment></comment><comment><USER12> The quality of Uber/Lyft drivers and the service in general has plummeted so much lately that I've just switched back to local car services. I just had a nice conversation with a car service driver, who also does Uber, and he said he prefers the car service over Uber because they pay better and only uses Uber when he isn't getting anything else but the pay has dropped over the past year pretty significantly for him whereas when he had started it was pretty good. That's an anecdote so take it for what you will but I just don't see how lowering prices further helps anyone out long term.

<comment><USER13> Because there is an entire generation of driver now weaned on Uber. They're all over London: guys who got a foot onto the driving ladder and know no other way. They take what they're given.

The disaffected professionals are probably the ones who bitch and gripe about money compared to the old days. Uber is now trying to swallow up huge amounts of market share by creating mammoth demand which will presumably lead to more drivers (who haven't been weaned on better-paying services).

</comment></comment><comment><USER14> If Uber drivers haven't figured out yet that the company's goals are to create a huge workforce of barely-employed "contractors" who each earn just barely enough to survive (probably have negative earnings in the long run, when car depreciation is factored in - Uber knows that humans undervalue the car depreciation and don't take it into account when figuring their profits and losses), then I don't know what to tell them. They should figure that out.

<comment><USER15> Yep. Uber apparently pays $1.50 per mile before its various surcharges [1], while the standard reimbursement rate for depreciation is $0.575 [2]. So employees, er, I mean "contractors" make less than $1/mi. Include the mileage driving between fares and the time waiting for a new fare, and I'll bet many drivers are below minimum wage. But that's what "disruption" looks like.

[1] [http://drivingforuber.com/?page_id=20](http://drivingforuber.com/?page_id=20)

[2] [http://www.gsa.gov/portal/content/100715](http://www.gsa.gov/portal/content/100715)

<comment><USER16> Most commenting here didn't read or take into account this part:

> To reassure drivers worried about lower fares, Uber said it would guarantee > a minimum fare per hour for drivers in these cities.

<comment><USER15> > of $12 to $24 per hour

$12/hr is okay pay for sitting in a parked car, but it's below minimum wage if you drive more than about 8 miles per hour, and below _no_ wage if you drive more than about 21.

</comment></comment></comment></comment><comment><USER17> I would be happy to pay more, Uber is already very cheap but I've noticed the quality of drivers and cars has gone down lately.

That, or create another service tier like Uber XL but for better cars instead of bigger cars.

<comment><USER18> The types of Uber cars available varies depending on the city. If available, choose BLACK CAR if you want a better car. In NYC we have uberT, uberX and BLACK CAR (and sometimes RUSH, for deliveries). Inside those major categories are subs; uberX has uberX, uberXL, CAR SEAT. BLACK CAR has BLACK CAR and SUV.

<comment><USER6> I think people just want a decent car, not a luxury car. A $20k car from the last five years is perfectly sufficient. Uber Black is overkill for them, and the price is around 2.5x of UberX.

<comment><USER19> Also, in a lot of cases, I find that the customer gets upgraded anyway (at least in off-peak times).

Many, many times I have ordered a regular "black car", and been picked up by a big SUV (Escalade or Suburban). Likewise, a lot of times I have ordered Uber X and been picked up by a luxury car and sometimes an SUV (Audi Q5, etc).

<comment><USER6> Yeah, we did UberX in Seattle and got picked up by a BMW 5-series. I don't think it was Black, but certainly better than expected.

<comment><USER18> True--while most Uber vehicles are black, it's not a requirement according to a few drivers I've queried. The BLACK category indicates a luxury vehicle for which a BMW 5 would certainly qualify.

</comment></comment></comment></comment></comment></comment><comment><USER20> In my experience local car services (taxis) or a combo of public transport and taxi have always been cheaper.

Uber rides to downtown back to my house ~$100-150, Taxi ~$75-125, MARTA/Taxi combo ~$40-75. I hope to see the prices decrease for Uber.

The things that Uber really has going for it that I absolutely hate about Taxis are getting the price up front and knowing when the driver is going to be there. Taxi's will never update you to say if they are coming or not and many times I have been left out in the cold waiting for taxis that never comes.

<comment><USER21> Do your taxi prices include the tip? And did you price out the MARTA/Uber combo?

<comment><USER20> No tips are included. The only reason I didn't price out the Uber/Marta is because I personally haven't tried it yet.

The station I go to usually has 1 or 2 taxis waiting so I haven't needed an Uber.

Good Suggestion!

</comment></comment></comment><comment><USER22> When gasoline is down 30% or more, those savings should go towards growth and competitive pricing. Uber seems to understand this, but the drivers complain. My how things always seem to come full circle -- before we know it, Ubers will be rude, yapping on their phone in unknown languages, and the cars will have torn upholstery and reek of incense.

<comment><USER23> > before we know it, Ubers will be rude, yapping on their phone in unknown > languages, and the cars will have torn upholstery and reek of incense

I understand that you mean to say that you expect the quality of Uber rides to drop, but can you do so in a way that doesn't draw upon negative stereotypes of other ethnicities?

<comment><USER24> Eh, ethnicity wasn't mentioned. You took that leap yourself ;)

<comment><USER25> If "unknown languages" and imagery of incense isn't racially coded I'm not sure what is. The statement was plainly racist, whether it was intentional or not.

</comment></comment></comment></comment><comment><USER26> Instead of lowering the base fare why don't they introduce the opposite of "surge pricing" and sometimes delight riders to offset the times they upset them with surge pricing?

</comment><comment><USER27> Something tells me there's a lot more Surge Pricing in our futures. And just when you thought the modifiers were high enough, or that surge hours already have become any-waking-hours...

Rather than the bait and switch, why not just raise the price rather than feign at lowering it? Kill the lie that the Surge Pricing brand has become. Just be honest.

<comment><USER28> This must depend on the city or your typical usage. I'm not a daily Uber user here in NYC (I commute by subway as most sane people do), but I'm not an infrequent user either (particularly on weekends or evenings with my family). I haven't paid surge since February 2014 (apparently on Valentine's Day), and I can't remember the last time I saw surge pricing, although it looks like twice I paid more and used regular Uber instead of UberX because there weren't enough UberXs available and I was in a hurry for appointments.

I don't see any reason to see surge pricing as "bait and switch," although I'd be open to seeing some actual data that backs this up.

<comment><USER29> I don't see it as bait-and-switch, either. Uber makes it clear when the ride you're considering will be subject to surge pricing, and it's very easy to abandon the reservation at that stage. I can't think of a time (in NYC) that I've seen surge pricing and been surprised, it's always been during inclement weather or peak times (e.g., Valentine's Day, New Year's Eve).

<comment><USER6> Yeah, I've seen what happens to taxis when there is no surge pricing. The dispatchers don't even pick up the phone if you call for a pickup, because there's enough business that they don't want to waste a taxi's time driving to pick you up. Not exactly an improvement.

</comment></comment></comment></comment><comment><USER30> Does anyone know what's the percentage cut? The article (and all of the comments) don't seem to say anything about that.

<comment><USER31> I received an email notification from Uber that the fare for my most used route is dropping 46%. My normally route is only about $8, so it might be a best case scenario.

<comment><USER4> Ouch. Well, I hope your rides per hour increase 4X to make up for it.

</comment></comment></comment><comment><USER32> Uber and other similar type of taxi dispatching apps are facing new government regulations in countries like Singapore and India after the rape case involving an Uber driver in India last year.

It will be interesting to see what happens next.</comment>