General Assembly sells to Adecco for $413M - <AUTHOR> https://techcrunch.com/2018/04/15/new-yorks-programming-ed-tech-startup-general-assembly-sells-to-adecco-for-413-million/ <comment><USER2> I witnessed the quality of education provided in the areas of design and product management and I wasn't impressed. To me GA felt like a predatory business that provided a very superficial veneer of legitimacy to extremely unqualified candidates. The good ones going in would be well served by the networking but people that didn't know anything about the field would crash and burn at their first contact with the reality of the industry.

I'm not one of those people hung up on traditional college education, I got my degree mostly studying by myself and always found most of what my college offered useless, so I'm not coming from the angle of "you need an x year college degree for this...".

I realize this is an harsh opinion but it's not cool to get north of $10k from people that need a job and tell them "we'll make you a designer in 3 months", that just doesn't happen.

<comment><USER3> Predatory indeed. I know of many people who were previously working service industry jobs, saved up the $10k for a GA course with the promise that they'll be making $150k/yr in ~12 weeks.

I've personally interviewed around 25 GA grads, and the result was pretty much the same with all of them - "great, you now know what you don't know, and have about a year of self-directed learning followed by a year of on the job experience before being employable in a role above an internship.

It's actually pretty heartbreaking when you talk them and get a sense for how much they were oversold.

<comment><USER4> Disclaimer - taught GA part-time courses (data science)

My heart goes out to those people, and I'm guessing Web Development Immersive students?

I always described GA's programs as a multiplier in that your outcome is going to be weighted by your experience going in. And for the most part I felt GA managed that expectation fairly well for most of its immersive programs - except Web Development.

In WDI I would see students who had no background in CS, design, etc. hoping to go from no experience to a full-stack developer position in 12 weeks. With a broad curriculum that iirc was starting with html/css fundamentals and working through Rails/Node/... maybe Angular? I felt it was giving them a base to start learning on their own, but not enough to immediately start working except for the very-top students (who likely had some sort of helpful background coming in).

I do believe GA is at its core a good organization that wants to see its students succeed (can't say enough good things about the career coaching / placement staff aka "outcomes"). But I can see how with a lot of competition in that space, the sell may have gotten stronger than what the product supports - and that's 100% on GA to address.

<comment><USER3> I saw this equally across the UX, WebDev, and product management immersive graduates.

I don't doubt that GA started with good intentions, but it seems clear that they got caught in the typical startup trap where they get 'forced' to prioritize investors over users as their target audience.

<comment><USER2> Now I'm genuinely curious to know who you are :) You can contact me via my profile.

</comment></comment></comment></comment></comment><comment><USER5> "Over time, General Assembly became less of a consumer facing business and transitioned into one that was serving primarily business clients — which means access to Adecco Group's over 100,000 businesses is a big boon to the company's continued expansion plans."

I thought this was interesting. Anyone know more about the services General Assembly was offering to businesses? I guess there is more money and less risk associated with this market. Going after the public / the bootcamp model means you run into accreditation laws surrounding educational institutions and you have to do more work (e.g. tracking placement rates).

<comment><USER6> I know Booz Allen Hamilton launched a company-wide initiative with General Assembly for a data science course [1]. From my limited understanding of the content, I believe it is aimed at providing a very rudimentary introduction to the field for the more businessy/consultant types. And to demonstrate that BAH is "data-driven".

[1] [https://www.boozallen.com/s/insight/thought- leadership/accel...](https://www.boozallen.com/s/insight/thought- leadership/accelerating-data-science.html)

<comment><USER7> BAH is a leech on the federal government. I'm not even sure what they do, other than sucking $M in project management costs while providing nothing.

<comment><USER8> I support this - it's money that's not going to the military. Every government contract signed, every middle manager given a raise, signifies, in a final sense, a theft from those who would bomb and are not armed, those who would kill and have no weapons.

</comment></comment></comment></comment><comment><USER9> 4 times revenues is pretty good for a company like that. Lots of physical presence required, a ton of handholding so it doesn't scale nearly as well as your typical 'SaaS' or other software company. Well executed and well negotiated.

<comment><USER10> I don't think it is that good taking into account that $ 120 million were invested in GA. Investors look for bigger multipliers.

<comment><USER9> Investors are usually pretty savvy of what they invest in and I'm fairly sure they knew that they weren't going to see much more than 3 x revenues on this deal. And depending on how early they entered their multiples may have been a lot higher (with correspondingly longer times before their payday came).

The last round in 2015 was 70 million, that's a pretty good pay-off for 3 years, the one before that was 35 million in 2014, still a very good ROI.

Investors look for bigger multipliers when the risks are higher, a company like this is as start-up investments come reasonably low risk, it is essentially a middle ground between a consultancy business and a scalable proposition and as a result of that the returns are also in the middle.

Investors looking for bigger multipliers would have to be content with taking bigger risks as well.

<comment><USER11> The $70m round in 2015 was likely for 10-20% equity, meaning a valuation between 350m and 700m. With that in mind, it's virtually no gain or possibly a loss.

The article actually mentioned a latest valuation iirc that said the last round investors had ~no positive return.

I agree with the evaluation of risk, though.

<comment><USER12> The Axios article[1] is better because it notes that later investors had preferential terms ("preference stack"). It's also says the post-money valuation was around $440m.

It's hard to know what they got back, but since the preference stack is noted I'd guess they made between 120% and 150%. There's no real way to know though - but we can tell they made their money back because the sale went though.

Also, A D round isn't looking for huge returns. They probably would have been outstandingly happy with 3x, so 1.2x is fine for them.

[1] [https://www.axios.com/general- assembly-1523667905-ce940016-1...](https://www.axios.com/general- assembly-1523667905-ce940016-11d9-4380-bdd3-d46ef18898f7.html)

<comment><USER9> Exactly. It's very hard to make any definitive statements about this without knowing all the deal terms and those will most likely never become public.

</comment></comment></comment></comment></comment></comment><comment><USER13> Is it safe to say the bootcamp boom is over? For a while, it seemed like everyone and their cousin was starting a bootcamp, trying to cash in on the gold rush. Now, most of the biggest ones I know of (GA, Flatiron, Dev Bootcamp (RIP)) have been gobbled up.

<comment><USER14> Seems like it. But you have some new models - like Lambda School - that are showing a lot of promise

<comment><USER15> Co-founder of Lambda School here.

The problem with the bootcamp gold rush is and has always been the business model. You have a few major variables:

1\. How much can a person pay you?

2\. How many people can you fit in a classroom?

3\. How long can the classes be while still maintaining a profit margin?

Based on those constraints bootcamps try to teach as much as possible. Within those constraints bootcamps found one model that worked and cloned it hundreds of times: A bunch of people in a classroom for 12 weeks paying $10-15k each. Some will try to chop off a couple weeks, some charge $18k instead of $10k, but it's fundamentally the same.

 _Every single bootcamp_ recognizes that this is not a great way to train engineers. 12 weeks simply isn't enough. But there's enough of a shortage or engineering talent that bootcamps could get away with it for a while.

Sure, in an ideal world you would actually train the students based on what they need to make hiring companies happy, but change any of the variables in the above equation and the whole business model falls apart. If you want to make the classes 2x the length you'd have to charge 2x the price, and can you get large numbers of people to pay $25-40k out of pocket? Not a chance.

We had to really start from first principles, and start with a new business model, which changes everything else.

The main thing we wanted was incentives aligned with our students; so we started from, "What if we didn't get paid unless students get a job?" That forced us to change everything else. I actually thought it might not be possible for a while.

I don't consider Lambda School to be a code bootcamp. We're six or seven months long full-time, which is 2.5x the length of a code bootcamp, plus a month of pre-course work. A few graduates have applied to Lambda School after having paid another school $15k and haven't even been able to pass our prep work.

I think we're on the _short_ end of what a solid engineering education should be. But we have enough time to teach true fundamentals, our students don't just write JavaScript, but also Python and C, they have an apprenticeship where they ship real projects that make real money on real teams, and they actually learn to think and write real code, not just pump out quick apps then struggle when confronted with anything new.

We can be flexible on class size so long as we keep a good teacher:student ratios because we're entirely online (which, by the way, is actually a superior learning experience to offline). We can pick the best students regardless of financial ability because our pool of potential students isn't limited to people with 20k in their pockets that can move to San Francisco. We actually have _more_ support for students, because our instructors scale across classes when they're not teaching, and we can do some tricky financial stuff on the backend to make sure students are guaranteed a job before they pay.

All of that combined lets us open up a promise, which is what really matters for students at the end of the day - attend for free until you get hired.

I think we'll see massive consolidation in the bootcamp space in coming months, and it's already started (Dev Bootcamp, Iron Yard, Bloc, Viking Code School, and more have either been acquired or closed). That's very healthy, and frankly there are some sleazy bootcamps that only exist because of marketing. You could wipe the bottom 80% of bootcamps off the face of the earth and it would probably be a net positive for everyone. I think we'll get there in the next 3-4 years.

<comment><USER16> Cofounder of Hack Reactor here.

Austen is hella right about his thesis: bootcamps are not getting enough students across the finish line right now. They need higher admissions bars, more classroom hours, and/or other good ideas. Hack Reactor is (imo) one of the high-water marks of this line of thinking. Lambda and Holberton are others.

I think he's miscast the three variables though -- partly because he's got a bit of a dog in the race. (As I do -- "we're not a bootcamp" is something many bootcamp founders, yours truly included, have said.) Anyway here's another perspective on the matter:

#1 is mostly right -- bootcamps are limited in price, and this is a huge constraint. It's wrong in an important way: it should be "How much can I charge before a student picks another bootcamp". This problem gets easier, but doesn't go away, if a bootcamp uses a deferred-tuition model. Evidence for my formulation here: App Academy and Hack Reactor have the same kinds of student outcomes problems, because we're both facing the same demon, which is the low- cost bootcamp that prevents us from charging more and spending more on product quality.

Austen's #2 and #3 are both about specific ways to tweak the bootcamp's expense : quality ratio. This is an interesting topic that goes really deep, and I think Austen's reduction is (honestly) pretty heavy on the marketing content. If I were to boil it into two bullets it'd go like this.

#2 "Can you run a good program, online or offline, that isn't classroom- based." Here, by "classroom" I mean "15-40 students and teachers that know each other personally", and it can and does happen online. (Viking Code School, and Hack Reactor Remote, do online/classroom-based programs.) Classroom programs are very challenging to operate: they introduce discrete start dates, fill rate problems, etc. But it's hard to reproduce the quality of a classroom-based program in eg a mentor-driven or community-driven program. I think the answer here will be "kind of", and hybrid classroom-like programs will win.

#3 "Can you get students to pay $10k+ for an online program". Online can be better than offline -- Hack Reactor Remote is our top-performing campus right now. However, few people want to buy it, despite the fact that it doesn't involve moving to SF. Perhaps Lambda has figured something out here -- I don't know about their growth numbers. I hear Thinkful has. Generally, I think the bootcamp space will mostly become hybrid online/offline. I bet half of Lambda's students are in SF, they meet up in person already, and Lambda does or will facilitate/market this.

My #2 and #3 are also poor formulations of the fundamental challenge here -- the quality : cost ratio. For instance, my favorite recent innovation in the bootcamp space (evidenced by Holberton, and maybe Lambda?) is to offset tuition costs and increase grad expertise by bundling an internship and taking a bite of internship income. This doesn't pertain to my #2 or #3 (or Austen's) but it's a way to solve the top-line problem Austen mentioned.

Anyway, TLDR: another bootcamp founder agrees with Austen's thesis; quibbles on details in ways you might find interesting.

<comment><USER15> You're wrong about many things but I don't want to correct you because then that would give away some aspects of why Lambda is working so well :)

Much respect!

</comment></comment></comment></comment></comment><comment><USER17> I hope this doesn't result in some form of debt peonage temp work, but having worked some Adecco jobs when I was younger, I wouldn't put it past them. In my experience, they were mostly recruiting for jobs in really toxic workplaces that couldn't otherwise attract talent, and that were described as "temp-to- hire," but that never worked out that way. They would get rid of people once they had pushed them to the limit of contracting laws or if you in anyway complained about/reported anything at your job site.

I could easily see this devolving into some kind of debt-based H1B system, where they drastically overprice a bootcamp education that they give for "free" to desperate jobseekers, and then use to lock them into underpaid roles at bad workplaces that can't recruit technical talent without this kind of predatory leverage.

</comment><comment><USER18> After watching someone go through their training, I'm not very impressed. They also enormously inflate their job placement statistics by giving graduates a difficult set of hoops to continually keep jumping through in order to be counted at all. For example, miss posting a blog one week, poof!, you're no longer counted in their placement statistics.

</comment><comment><USER19> It seems cheap to me. I did some digital marketing course there. The classes are more on the basic side but certainly a good intro for some basics in programming and digital business.

</comment><comment><USER12> Note that this isn't cheap because training doesn't scale like software businesses. That means the revenue multiple is lower than for a software company.

<comment><USER20> I feel like we have not cracked the code on how to use software to automate teaching yet. Not sure why: NLP, complex representation of understanding, dynamic edition of video content, monitoring someone's attention… All those are there and have been for a while.

<comment><USER13> As a former teacher, I find this very amusing. There's a lot more to it than uploading raw info into receptive brains. As a current software engineer, I think it's probably a lot more likely we'll automate parts of my current career.

<comment><USER21> Also a teacher-turned-dev, and I completely agree. Teaching is such a labor- intensive, poorly-understood process that the idea of effectively automating it anytime soon is ridiculous. We still don't really have any consistent metric that measures what a "good" teacher is - if you can't even _kinda_ measure performance in an accurate and consistent way, how on earth is the process going to be automated effectively?

</comment></comment></comment></comment><comment><USER22> Is it just me or did they sell for pretty cheap? Congrats either way!

<comment><USER5> The article said they had revenue of 100M. Training generally doesn't lead to recurring revenue, so a huge multiplier is not justified. Doesn't seem too cheap to me.

<comment><USER23> B2B training should be recurring, large companies hire new classes of entry- level workers every year.

<comment><USER24> But that's not as "sticky" as software. If you decide to cut costs next year on training because its non-essential, the revenue gets slashed. If I still need to procure stuff, I'm not going to shut off my procurement software to cut costs.

<comment><USER23> On the flip-side, if cost-cutting becomes important, a company may decide to invest in current employees skills in lieu of hiring new external employees. Any software that isn't mission-critical faces high risk in a cost-cutting environment.

</comment></comment></comment></comment></comment><comment><USER25> Surprised it wasn't WeWork</comment>


What does it take to be a developer? - <AUTHOR> http://vimvq1987.com/2016/05/what-does-it-take-to-be-a-developer/ <comment><USER2> Link is broken.

<comment><AUTHOR> It's fixed now</comment></comment>


Ask HN: Feedback on a friend's SEO tool - <AUTHOR>

I've been advising the guys at Pear Analytics and helped convince them to throw away the 1.0 product because it was simply too complicated.
They've gone back to a simple SEO tool that gives you actionable items to resolve. Feedback?
www.pearanalytics.com <comment><USER2> \- Make it clear that an email address is optional for a report. I almost left the page right away before deciding to try it out with the email field blank.

\- Merge "Things you need to work on" and "full report". Put errors/suggestions on top.

\- Auto-expand the top most report field or make it more obvious that those are links.

\- Add re-analyze site button. Typing the URL in over and over again is tedious.

\- "You have too many meta keywords." It says I have more than 10 phrases but I only have 9. Off by 1 in the code?

\- Change "domain is too new" to yellow instead of red since there's nothing that can be done about it.

\- "Good! You your page has a meta description." has a broken img link in the report text. Ditto with "This page has a title tag."

\- "The CSS on this page isn't valid." The only invalid part is foo-border- radius. I think that's typical.

Pretty useful. Caught that my HTML wasn't valid anymore due to some changes I made recently.

It also convinced me to add a sitemap to my site even though it's only a 1 page weather webapp.

<comment><USER3> Thanks a ton for the feedback Jolan, I've deployed some of your suggestions.

We've marked the reason why we need the email address, if it let you see the report without an email address, it's a bug :).. we'll fix it.

I've merged the work on and full reports together.

We're looking into the too many meta keywords issue, I'll fix that soon it's not a off by one issue, but I'm calculating words, instead of phrases.

We're working on display issues :). I'm a former sysadmin who's now doing UI :)

I need to get the images to show up in the copy better.

We're running your CSS against Jigsaw and just outputting the result.

One of the things that's on the way is "importance", so that the list of things to fix is displayed in order of importance. This would mean the css errors would be fairly low on the list.

<comment><USER2> > We've marked the reason why we need the email address, if it let you see the > report without an email address, it's a bug :).. we'll fix it.

I really wouldn't do that but it's not my choice to make :)

> I've merged the work on and full reports together.

I saw that. Makes it a ton better.

> We're running your CSS against Jigsaw and just outputting the result.

I figured as much. Not a big deal. It might be nice to include the link in the report.

One thing you might want to consider is building the report in real time rather than doing the status bar and then asking the user to click for the report.

You can do something like the following w/jQuery:

      $.ajax({
        url: '/api/v1/',
        data: { cmd: "report_getdata", id: reportid },
        timeout: 5000,
        success: function(data) {
          // remove everything but the table header
          $("#reportinfo").find("tr:gt(0)").remove();
          var obj = jQuery.parseJSON(data);
          jQuery.each(obj, function(i, ddata) {
              $("#reportinfo").last().append("
JSON report data row
");
          });
        }
      });

<comment><USER3> You're reading my mind :).

On each report item I'm going to have a "re-check" button so you can make a change and just analyze that one part. Shouldn't be too hard to make the report in real time.

</comment></comment></comment></comment><comment><USER4> 1) I know they don't _need_ my email in order to analyze my site, so I am immediately suspicious. There is no checkbox for agreement with a privacy policy, nor is there language stating I will never be spammed, etc. Thus, I did not try the demo.

2) If they really do demand my email address to try their service, they should let me see a screenshot, at least, so I can get a sense of whether or not I want to risk giving them my email address.

I think that this errs on the side of giving too little information to make an informed choice about wanting to use their service. There are many sites that will, without requiring an email address, do some basic SEO analysis for me. Without knowing what their site does, I was not enthusiastic enough to actually try their product.

<comment><USER3> Hi Carbocation, Great feedback, I really appreciate it. We're using the email address so you can come back later and view reports you've run in the past. I've changed the copy a little to make that clear.

I'm still new to layout/jquery etc so I'll have the screenshot up in a few hours based on the feedback of other posters.

<comment><USER4> Great! Also, I didn't mean for my negativity to be personally directed, but I did want to give you the full 'benefit' of my as-negative-as-possible interpretation of uncertainty. It's great that you're iterating so quickly, by the way!

<comment><USER3> I didn't take it personally :). We're small and don't have a proper QA / userbase to test against. I really appreciate it :)

</comment></comment></comment></comment><comment><USER5> Seems to come up with an error if you accidentally put white space in front of the URL. Otherwise looks like a useful tool.

<comment><USER3> Hey Stoney, Just fixed that bug :). Wasn't trimming properly :)

<comment><USER5> That was quick!

Was it a deliberate design decision to make it easy to access other people's reports (by just changing the number in the URL)? Obviously anybody could run any website through the tool, so there's not really anything private about it, but it still feels kind of weird. I've just had a fun 5 minutes seeing what everyone else has been running through it, which I'm not sure they'd all be happy about.

Possibly you could use a long random string instead?

<comment><USER3> MVP FTW! :)

But, seriously I did think about using some hash or form of uuid, but long term plan is to let people make accounts.. for trending, and alerts..

but first, we're working on accuracy, then speed, and then usability.

<comment><USER6> Is it the final product? what's your revenue model? the new version is too simplistic to charge money for, I think. have u considered making an academic version of your tool and selling it to schools and universities (can be used in classes dealing with web design/programming, rest is up to your imagination) An online social network, revolving around your tool is also an option. And I am missing the overall page score; good that you did away with the rest.</comment></comment></comment></comment></comment>


Payments Gateway Provider Braintree Going International - <AUTHOR> http://techcrunch.com/2012/06/05/accel-backed-payments-gateway-provider-braintree-goes-international-with-expansion-into-30-new-countries/ <comment><USER2> The list of countries isn't linkable (it's a div on [https://www.braintreepayments.com/tour/international#countri...](https://www.braintreepayments.com/tour/international#countries_list))

So here is the list: Australia, Austria, Belgium, Bulgaria, Canada, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Turkey, United Kingdom

<comment><USER3> I wouldn't call it international since it only supports a handful of counties. If you really want international go with 2checkout and moneybookers.

</comment></comment><comment><USER4> I'm glad to see that Stripe has lit such a fire under their competitors. I'm new to the payment gateway scene—can anyone with experience give a comparison of Stripe vs Braintree's APIs?

<comment><USER5> I've not used Stripe, but I've used Braintree for a while. Braintree is an older company, and it seems to have a bigger, lower level API. Stripe's is much higher level, and looks like it could be both simpler and easier to use. This is probably not just because of age, but also because Stripe wraps and owns your merchant account (it looks like), while Braintree works with a merchant account, exposing many more technical details of the payments process (thus making you manage them).

Braintree's API, while REST underneath, is only supported at the library level and they have more languages supported for this reason than Stripe (Including mobile specific APIs). Obviously this makes it much easier to support newer, hipper languages with Stripe - just write your own wrapper to the REST API.

Most of the big features seem to be supported on both platforms, one off and reoccurring payments, token based transactions, etc.

<comment><USER6> Started to use Stripe recently for a project and have used Braintree extensively for work. Your comparison is spot on.

There are some small differences such as, Stripe can send credit card details through AJAX to their servers so they are never sent to yours. Whereas Braintree uses Javascript encryption to do it, so the encrypted values are sent to your server. But I haven't seen anything that only Braintree supports yet.

Tradeoff with Stripe is that while you get a much simpler API, it (likely) will cost you more than Braintree depending on scale and what cards are commonly used.

<comment><USER7> Besides client side (javascript) encryption, Braintree supports Transparent Redirect (<https://www.braintreepayments.com/developers/api-overview>) which lets you post data directly to Braintree.

The nice part of sending the data to your servers with client side encryption is that you can do validation before sending to the payment gateway. For example, if you want to ensure everyone enters a cardholder name, you can validate the non-encrypted fields before eating the cost of calling a payment gateway.

You can do some of these validations in javascript, but javascript is error- prone (firebug) and not as flexible (have access to a lot more data server side).

</comment></comment></comment></comment><comment><USER8> Hugely disappointed that India is not among the countries Braintree is expanding to. People in other areas(like europe) have at least one half decent payment gateway provider. In India we have NONE.

This is the biggest payment gateway in India - <http://www.ccavenue.com/content/pricing.jsp> they charge 3-7% and they suck. API docs suck, payments get timed out etc. There is an annual "maintenance" charge!

Developers (and users) are really fed up with the low quality of payment providers in India. - have a look at these

<http://hackerstreet.in/item?id=9565>

<http://hackerstreet.in/item?id=14592>

<http://hackerstreet.in/item?id=6727>

<comment><USER9> The problem with India is that the indian government is broken (or is at least percived to be broken) outside of India. I wouldn't risk my customers money there -- too much corruption.

I doubt it will ever be available in Nigeria either, nor most of Africa.

<comment><USER8> I don't know how to respond to this :). It is so widely off the mark that I can only shake my head in surprise. A huge number of MNC's dominate certain sectors of the economy. India is one of the top destinations for FDI in the world. See - <http://unctad.org/en/docs/diaeia20104_en.pdf>. Equating India to Nigeria .. Sheesh.. I don't know whether you were trolling or serious!

<comment><USER10> I don't think FDI is a very good indication for the challenges that a consumer payment processing company might encounter in India, especially in relation to their product.

<comment><USER8> Point was there are lot of International companies successfully doing business in India. What do you think are the challenges consumer payment processing company might encounter in India, especially in relation to their product?

<comment><USER10> I think the regulatory environment for setting up a business, obtaining licenses, etc is somewhat orthogonal to how local laws and enforcement deal with (not only per letter of the law, but enforcement) fraud, spam, phishing, chargebacks, et al. I don't mean to profess complete familiarity with the matter here, but it's just one area where Braintree's difficulty is not coupled directly to the amount of FDI. My naive understanding is that at this time that these kinds of issues (such as enforcement of contracts with small entities) are still somewhat in the wild-west phase in India.

But as other posters have noticed, it does look like there is an emphasis on the EU and members of the Commonwealth. So it may just be down to the number of very distinct regulatory regimes Braintree was comfortable dealing with at the time, so this could be much speculation about nothing.

</comment></comment></comment></comment></comment></comment><comment><USER11> There is justice in this world after all :)

I was hoping for Stripe to go international soon but Braintree seems like a good alternative for all of us who don't want to wait any longer (and are reluctant to use Paypal)

<comment><USER12> The race is on for Stripe. I know many Canadians who really want Stripe, but at the end of the day whichever company pulls it off first wins.

</comment></comment><comment><USER13> I really like Stripe, but Braintree is a great company too. I think both companies are pulling the industry forward.

I would still seriously consider setting up a US business in most cases, since it makes everything else easier, if you want to take investment, enter the us market, etc.

</comment><comment><USER14> It'd be nice if they also handled ACH transactions from checking accounts.

<comment><USER15> I noticed in the article on Braintree's blog they mention "Support for local, non-credit card payment methods will be added in the coming year" ... so hopefully.</comment></comment>


The iPhone Could Be The Ultimate Study Machine - <AUTHOR> http://www.techcrunch.com/2009/01/17/the-iphone-could-be-the-ultimate-study-machine/ <comment><USER2> >"Many of these [education] apps [from smaller publishers] seem to work well, but they may be overtaken once the aforementioned "trusted names" start establishing a larger presence."

really? i bet if the non-brand name apps are done well and stick through the effort of making a name for themselves they could still compete.

what do ya'll think?

<comment><USER3> Big textbook publishers have a lot of pull in the education industry. They can spread the adoption of resources (including iPhone apps I'm sure) much faster than small, indie players who don't have the connections.

I'm not saying you're wrong, just that it's an uphill battle in some cases.

<comment><USER4> _They can spread the adoption of resources (including iPhone apps I'm sure) much faster than small, indie players who don't have the connections._

Luckily, they're not that clueful about the Internet, primarily because it does not fit into their business models.

Houghton Mifflin and Scholastic both sell significant amounts of bingo cards, on dead tree, through retail stores and catalog sales. (Or they did last time I checked.) These two companies have 8 digit marketing budgets, massive connections, and industry clout.

Now I don't want to toot my own horn too much, but if you were to, say, Google "[pick a subject] bingo cards" right now, you probably would not see Scholastic on the first page. Nobody at Scholastic just slapped themselves on the head this morning and said "Oh, effity, we didn't have a Martin Luther King Day bingo activity today. That was a missed opportunity!"... but I just did!

</comment></comment></comment><comment><USER5> A nation of ophthalmologists tents its fingers.

<comment><USER6> It's entirely unproven that reading small text or reading in a dimly lit room hurts your eyesight.

<comment><USER7> [http://books.google.com/books?id=7qPIva6qrVgC&pg=PA562&#...</a>

<comment><USER6> <http://jeromekahn123.tripod.com/kooks/id5.html> <http://www.grandtimes.com/eyes.html> <http://my- healths.blogspot.com/2008/10/five-eye-myths.html> [http://www.everydayhealth.com/vision-center/the-healthy- eye/...](http://www.everydayhealth.com/vision-center/the-healthy- eye/tips/common-eye-myths-dispelled.aspx)

</comment></comment></comment></comment><comment><USER4> I don't know about it being ultimate study machine, but I predict the buddy of mine who just repackaged his language learning software for the iPhone is going to make a mint:

<http://www.declan-software.com/blog/>

Serious study of foreign languages skews towards college students and young professionals in the US, and the overlap between them and iPhone users is probably pretty substantial. Plus I think given the socio-political aspirational goals of many Mac users, I think it could be a good fit.

To phrase this a little more politely than Stuff White People Like did, there are a lot of people who think it is important that they are educated and cosmopolitan enough to learn a foreign language. They also tend to overlap quite a bit with Mac users.

</comment><comment><USER8> My 7yo daughter is totally hooked on Mighty Math. Standing in line (zoo, store, whatever), other kids are almost cartoonishly leaning over her shoulder to play along.

It may be evil, but the realy game changer was when I started experimenting with paying her for right answers: $1.00 for ten out of ten right the first time, $.25 for 7 out of ten right the first time, or $.01 for each one right less than 7.

Am I destroying my child's humanity through pay-for-performance? If so, how?

</comment><comment><USER9> I always figured that the main demographic of iPhone users would be those with a tidy amount of spare cash, which students aren't exactly famous for having.

<comment><USER10> Students are a main demographic of video games. Just b/c your customer base doesn't have tons of cash doesn't mean you cannot make tons of money off of them.

Plus the most people I see w/ iPhones are college students and 20 somethings.

</comment></comment><comment><USER11> Why only the iPhone is mentioned? What about Rim, Android and even MS? Nokia actually added a category in their latest challenge for e-learning system they should be included too...

I was involved in such an attempt to break that market and it wasn't easy. Its like the social mobile applications. everyone are saying that its a billion dollar market but no one got a clue how to generate good cash out of it.</comment>


I Don't Really Believe in "Work-Life Balance" - <AUTHOR> https://thinkgrowth.org/i-dont-really-believe-in-work-life-balance-5b2c7b23098c <comment><USER2> Yikes. Well, I really do believe in it.</comment>


Google Says It Mistakenly Collected Data on Web Usage - <AUTHOR> http://online.wsj.com/article/SB10001424052748703460404575244763621501220.html <comment><USER2> So like, how exactly did this accidentally happen? It's not like skynet's running those vans and just decided to sniff the traffic of open wifi nets it passed. <cliche>power corrupts and...</cliche>

<comment> X-Istence The code was compiled with -DDEBUG and instead of recompiling without it was put on the vans driving around.

Honest mistake, they are owning up to it, and removing the data. The amount of data that they could have picked up while moving around driving is very little and it is available to anyone with a wifi antenna and some time to drive around. I'd be less worried about Google than about the kid a couple doors down that just found out about nmap, wireshark and kismet.

<comment><USER2> Either I skimmed that article very poorly or you have some inside information on this... I may be slightly paranoid but I am always skeptical about stuff like this. I could imagine a lot of useful pieces of information that could be gleaned, like a geocoded map of where people are ACTUALLY using google and for what... I don't really know, it just gives me a little bit of a funny feeling

<comment> X-Istence The guy asked how exactly did this happen, I was speculating. I am in no way associated with google, and a quick Google of my username would have figured that.

From the quick skimming of the articles I did I saw several mentions on different places of debug versions. It is very plausible.

You may be paranoid, but if you had read any of the articles you would have seen that the cars channel hop 5 channels a second, and that they are constantly driving. All they are looking for is beacon information sent out by access points. Apparently this also captured a couple of packets of actual data that was not discarded by the computers in the Google cars because of a debug build (from what I have read, again that might be pure speculation, but makes sense).

That won't be enough time to even figure out if the user is using Google or not. Go grab an wifi antenna, a wireless networking card, your favourite Linux distribution and go wardriving. You will pick up the same information that Google picked up. Now, if from the small samples you did get you can determine where people are using Google and for what and can make it valid research, good on you, but I doubt you will get much more than the occasional URL, and if you are lucky that URL is a Google URL.

<comment><USER2> You're assuming that this business about debug modes and the cars channel hopping so quickly is not a cover story. There's no way for us to know that. My theory was that given a bunch of interesting data and no way to see what they were really doing, there's no telling what was really going on.

<comment> X-Istence Sure, but if all of us are walking around with tinfoil hats on, looking over our backs for the men in black suits, all of the time we wouldn't get much done now would we?

Also, once again, the channel hopping is fairly normal for a wifi wardriving setup, feel free to go test this theory on your own, as well as go driving down the road at 25 - 50 Mph and get anything but a few packets of data from the wireless networks you do come across where the owners at the moment you are driving by are using their wireless, and data is being transmitted in clear text.

<comment><USER2> and if all of us accepted the stories of the corporate and government Powers then they could do whatever they like. There's an awfully big gulf between being skeptical of official stories and being so paranoid that it interferes with productivity.

I'm certainly not interested enough to test any of this stuff... but my thought was OK, could they intercept GET requests to URLs off of google.com and that gives query strings etc? Even 100 URL+GEOCODE per hour would be win.

I'd certainly be tempted to try it if they were my vans, if for no other reason than to see if it was possible.

I'm doubting that the range is 25-50mph in residential zones btw.

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> "on web usage". What a joke.

<comment><USER4> Yes, it's obvious they simply saved all the unencrypted packets they were able to get. If your your e-mail server didn't have encrypted communication, they saved your mails and your passwords. And yes, anybody else could have done that with your unsecured WiFi packets. The difference here is the large scale of collection and the power of the collector. The chance for misuse would be mostly by having it in wrong hands, but there's already immense amount of data on Google that would be of the same nature. If you use them you better trust them. My much bigger worries are that people don't see problem in sites like Facebook asking the passwords of your e-mail accounts to "connect you with your friends." And people do this gladly!

<comment><USER3> The Wifi channel was changing 5 times per second. The microscopic fragments they got weren't usable. The tiny possibility that you were sending sensitive data, multiplied times the tiny possibility that it wasn't SSL, multiplied times the very small possibility that it was grabbing enough information to get a full frame, let alone a handshake seems very unlikely.

If Google had this massive mountain of my personal traffic lying around, I think they'd have a hard time "accidentally" stockpiling all of it.

I was mostly mocking the word choice anyway. "Web Usage". The worst allegation is that they logged actual packets or traffic, which I still find unlikely. I _did_ find it interesting that that particular part of the detail was left out of Google's otherwise very informative blog post about this incident.

<comment><USER5> 802.11g network can broadcast 33.75Mb during 5 seconds. That's quite a few e-mails.

<comment><USER3> "5 times per second"

and

"The tiny possibility that you were sending sensitive data, multiplied times the tiny possibility that it wasn't SSL, multiplied times the very small possibility that it was grabbing enough information to get a full frame, let alone a handshake seems very unlikely."</comment></comment></comment></comment></comment>


Skyfall and Solace vulnerabilities – A follow up on Meltdown and Spectre? - <AUTHOR> https://medium.com/@velmu/skyfall-and-solace-vulnerabilities-a-follow-up-on-meltdown-and-spectre-75bd9c07d6dc?source=linkShare-87350e1fddab-1516293029 <comment><USER2> So the register says it's a hoax because their chip contacts won't confirm it. However, those chip contacts are probably a little grouchy about the last coordinated boondoggle, so I doubt they would admit to or deny anything at this time.

<comment><USER3> I'd be more inclined to believe 'hoax' if that's what the chip contacts said. But a 'refuse to confirm'? No telling.</comment></comment>


Saudi Arabia Passes New Law That Declares Atheists "Terrorists" - <AUTHOR> http://www.dailymail.co.uk/news/article-2594139/Saudi-Arabia-declares-atheists-terrorists-new-laws.html

<comment><AUTHOR> _> Saudi Arabia has officially identified atheists as terrorists in sweeping new laws that threaten up to 20 years in prison for almost any criticism of the government or Islam... the law also applies to any Saudi citizen or a foreigner residing in the kingdom that 'calls for atheist thought in any form or calls into question the fundamentals of the Islamic religion on which this country is based.'_

iOS developers can do the following:

1\. Visit [https://itunesconnect.apple.com](https://itunesconnect.apple.com)

2\. Click 'Manage your apps'

3\. Select your app

4\. Click the blue button 'Rights and Pricing'

5\. Click the link 'specific territories'

6\. Deselect the checkbox marked 'Saudi Arabia'

7\. Click 'Save'

I'd like to hear a good reason why we, as individuals, should not boycott the country and deny them access to the goods and services we create.

<comment><USER2> The way you "change" a country is not through isolation, but through allowing it access to your culture. This is happening right now in North Korea with people smuggling American movies and shows, which teach them about what liberty means, and it has happened many times in the past in communist countries, too.

<comment><USER3> Saudi Arabia is becoming more, not less, Islamic as time goes by. The problem is not a lack of access to enlightenment ideas, it is an explicit rejection of them in favor of religion.

Consider Boko Haram as another example - the name means "Western education is sinful". Clearly they _have_ been exposed to Western ideas, and don't want a bar of them.</comment></comment></comment>


Don't Let Metrics Undermine Your Business - <AUTHOR> https://hbr.org/2019/09/dont-let-metrics-undermine-your-business <comment><USER2> I work as a data scientist on an extremely data driven team at an extremely data driven company, and I couldn't agree more strongly. Everyone I work with would agree too. "Numbers aren't everything!" says the person whose job it is to deal with business problems via numbers.

But this advice is so hard to implement. It's like the whole null hypothesis p-value debacle going on in academic publishing right now. Sure we can agree it's no good, but there's no _standard_ alternative.

Standards are powerful. They break lots of ties. All else equal, if you have a hunch and I have a measurement tied to objective reality, people will side with me. Nobody ever got fired for choosing Java. Nobody ever got fired for doing the thing that made The Metrics go up.

It's so reassuring to just say "We still disagree, so let's just test it." We're submitting our dispute to adjudication via Science by resolving via The Metrics! It's much harder to be objective without these kinds of numbers, and I like being objective! I want the scientific method to tell me I did the right thing and I'm a good person.

Because without that, when we're trying to figure out what to do, it's just us, you know? It feels like guessing, and that's hard.

<comment><USER3> This is a recipe for mediocrity. Great things are created by people following their gut, not their metrics.

Jobs didn't have a data scientist telling him to make the iPhone. A data scientist would have told Notch to make a Call of Duty clone instead of Minecraft. There was no data scientist behind Gates, Warren, Zuckerberg, Musk, or anyone of their ilk.

Looking back in history, some great discoveries and inventions were held back because the "data" said it wasn't possible. Everybody thought ulcers were caused by stress and bad food, then Barry Marshall came along and _literally trusted his gut_ by eating a bunch of bacteria to prove that's how ulcers were formed.

At best, data science helps you squeeze a couple extra bucks from someone else's ingenuity. Once Jobs died, the data scientists got their hands on the iPhone and chopped it up into different models. And it was the data scientists who made your Facebook feed ad-ridden junk. And at worst, data science is destroying our society. It's the data scientists who are driving this insane data vacuum that is plaguing the internet and our daily lives. You thwarted the 2016 election by weaponizing data against America. You did it again with brexit. No doubt you will be out in full force for every major political event for the next few decades, sullying the discourse of the electorate.

Bit of a rant... sorry. I hate this over-reliance on data and the smugness it's captors carry.

<comment><USER4> I would say it's a recipe for _continuation_ rather than _innovation_. You're unlikely to invent anything revolutionary just by looking at metrics, but you're also unlikely to keep a business going without them. It's easy to look at something like the iPhone and say, "metrics didn't invent that!" but metrics absolutely put millions of phones in the hands of customers, built an effective production and supply chain, optimized the whole experience, and turned Apple into a trillion dollar company. As with most things, there's a balance and a place for each.

<comment><USER3> I disagree that metrics helped Apple scale, but we'd have to wade in to a semantic debate to settle this.

When you have a killer idea, scaling is _obvious_ ; just do more. More people, more machines, more materials, etc. You don't need a number to tell you how much more to scale, because you always want the max anyways. Tim Cook was told there weren't enough CNC machines in the world to manufacture the unibody MacBook. So he bought the company that makes CNC machines. What's the point of metrics when you can shift the entire world to meet your needs? Great things are like that.

Metrics are for mediocre products and services. We use them in banking because people fucking hate the banking system and we have to pull teeth to get customers to spend money. McDonald's uses metrics to gauge how shitty they can make their beef without people noticing. Hollywood uses metrics to decide which movie franchise to reboot or make a sequel of. Metrics are a sign that you are done innovating and you are squeezing the sponge before someone else's innovation dethrones yours.

<comment><USER5> > You don't need a number to tell you how much more to scale, because you > always want the max anyways.

And you bankrupted the company building factories you didn't need, because iPhone demand has its limits.

</comment></comment></comment></comment></comment><comment><USER6> This article represents one of the problems I have with HBR and "business school" literature in general.

It's a rehash of tried and true principles that have been described numerous times before almost always without attribution to original sources.

What's wrong with that?

Well, for one the authors are passing off work that is clearly not their own. Fine, whatever, it's a b-school publication, nobody takes their intellectual output seriously anyways.

But the more important problem is that you lose a sense of where this knowledge has come from, where it's been applied, how it's been applied, and other important context.

In other words, reading this article is basically a waste of time. It's better to stick to a handful of classic business texts (Drucker's a good place to start and yes, he goes over all the recommendations these authors make in Effective Executive). Reading Kaplan on the Balanced Scorecard is another good place to start.

<comment><USER7> > _But the more important problem is that you lose a sense of where this > knowledge has come from, where it 's been applied, how it's been applied, > and other important context._

Thank you for saying this!

A thought I have had in the past few years is "there's been nothing new in management since Drucker and Deming."

I go back and forth because some people have done a nice job of updating their ideas/applying them to modern disciplines, which is valuable.

However, what you said about where that knowledge has come from/been applied/how/context is sorely missing.

That these ideas are still not common knowledge leads to so many unnecessary mistakes.

</comment></comment><comment><USER8> Seems to me Surrogation is very similar to The Cobra Effect / Perverse Incentives ([https://www.geckoboard.com/learn/data- literacy/statistical-f...](https://www.geckoboard.com/learn/data- literacy/statistical-fallacies/cobra-effect/)) , or the McNamara fallacy: [https://www.geckoboard.com/learn/data- literacy/statistical-f...](https://www.geckoboard.com/learn/data- literacy/statistical-fallacies/mcnamara-fallacy/)

Both very real problems that have existed forever. The solution, as the article suggests, is not relying on just a single metric, and not losing sight of your wider strategy. There's a really good article on Reforge about the problems with the recent trend of a single "North Star Metric": [https://www.reforge.com/blog/north-star-metric- growth](https://www.reforge.com/blog/north-star-metric-growth). Stacey Barr's another thought leader on the subject: [https://www.staceybarr.com/measure- up/a-single-kpi-that-meas...](https://www.staceybarr.com/measure-up/a-single- kpi-that-measures-overall-business-performance/).

Metrics absolutely cannot replace strategy and vision. It needs to be a core value of the company that you'd rather do the right thing by the wider mission than drive a metric at any cost. Managers at every level need to live up to that. This is harder the bigger the company. It's one of the things OKRs, love or hate them, try and help with. Like with everything it's whether you comply with the spirit or the letter of the law. And whether people get rewarded for latter!

</comment><comment><USER9> It's interesting to ponder how a metric, through its design, is a psychological brain hack that trumps rational thought and common sense. Perhaps it's the gamification aspect that gets us?

An example I think everyone can relate to is in education where grading is a rich source of perverse incentives. In developing minds, no less. Yet the metric persists.

(Just to be clear, the alternative to grading is not no feedback, but personalized, situation-specific feedback. Freeing yourself from a bad metric can open doors.)

</comment><comment><USER10> This reminds me of Goodhart's Law: "When a measure becomes a target, it ceases to be a good measure."

It seems like in the case of employees at a company, just knowing that a parameter is being measured can result in it implicitly becoming a target even when there is no explicit focus on it (especially if it is the only or one of a small number of metrics that is discussed).

I have observed that in general most humans are very bad at considering the incentives created by rules and rewards they impose or seek to impose.

<comment><USER11> Goodhart's Law really only applies to measures that aren't measuring the actual figure of merit but a proxy that is incorrectly assumed to be inextricably tied to it.

This is very common, though, and a real problem associated with it is people pick proxies without clearly documenting (or even thinking through) what they want to measure, why they pick a particular proxy, and how the proxy might fall. As a result, people remote from the decision (including the original decision maker) tend to incautiously apply the proxy because they aren't even aware that it is not the actual figure of merit.

<comment><USER12> The point of the law is that virtually every measure is a proxy to some extent. Finding a measure that exactly matches what you really want to optimize is almost impossible.

</comment></comment></comment><comment><USER13> Metrics are great for optimizing your business not for deciding which one to build.

<comment><USER14> The problem talked about in the article is that it's not easy to express your optimization goals in terms of concrete metrics, and your optimization process will always optimize those metrics, not your real goals.

<comment><USER11> > The problem talked about in the article is that it's not easy to express > your optimization goals in terms of concrete metrics,

Largely, because what you are wanting to optimize is something like current value of the future income stream of the firm. So a proxy is taken, which inevitably has bias, and you need to understand why hat that big is likely to be a continuously sanity check your results for reason to think that you may being caught in that bias. Which you probably can't measure well (though maybe something has improved since you adopted the proxy), because if you could you'd have a better proxy to start with.

<comment><USER14> True, though I was thinking about something else still: unless you're a completely amoral alien mind, even your for-profit goals have some hidden value judgements and preferences attached. Those extra constraints are incredibly hard to capture as explicit goals and thus impossible to properly measure in a quantified way. So if you now turn the optimization knob up to 11 and just let it work for a while, you might be appalled by what it comes up with. Or if not you, the people on the receiving end of your optimizations definitely will.</comment></comment></comment></comment>


Show HN: Daily emails featuring the most insightful and popular posts from HN - <AUTHOR> https://gitlab.com/whacks/daily-reddit <comment><USER2> This is great. Thanks for sharing!</comment>


Ask HN: Pros and Cons of First Job Out of College at Small Company - <AUTHOR> What are the pros and cons of getting your first job out of college at a small company? Does that have any kind of negative impact on your future job prospects? Thank you! <comment><USER2> You're young. And because you're young, you should gather experience of a wide array of work situations. You'll learn from them all and that will make you more valuable.

For me, working at large corporations whose names are universally recognizable caused me to become technically lazy yet adept at socio-political maneuvering.

Small companies can be awesome. But not always. Sometimes they re horrible. But you usually get a chance to gain more varied experience than you will at BigCorp.

</comment><comment><USER3> Pros:

\- Possibly more educational

\- More face time with executives

\- Likely to be less rigid in structure, responsibilities, working style, etc.

\- Possibility to share in profits if company succeeds

\- Possibility to earn valuable stock options (though you should always treat stock as worth nothing if the company isn't cash-flow positive or doesn't have a thriving customer base)

Cons:

\- Less of a resume booster (in the eyes of some)

\- Potentially worse salary

\- Potentially more/harder work

\- Less opportunity to switch roles, offices, teams, etc.</comment>


Australia: Police reject social media campaign claiming arson caused fires - <AUTHOR> https://www.theage.com.au/national/victoria/victoria-police-rejects-social-media-campaign-claiming-arson-caused-fires-20200108-p53pwj.html <comment><USER2> It's really hard to believe that arson didn't cause at least part of the fires:

[https://www.cnn.com/2020/01/07/australia/australia-fires- pol...](https://www.cnn.com/2020/01/07/australia/australia-fires-police- action-trnd/index.html)

While it may not be 200, likes some sites have exaggerated, it's a nonzero number.</comment>


Fixing XSS on a bank website - A customer's saga - <AUTHOR> http://tech.bluesmoon.info/2011/01/fixing-xss-on-icicidirectcom.html <comment><USER2> I had some fun, fun times attempting to address a wide variety of security issues in code from a partner company at, well, let's call them a popular outsourcing destination. It involved, at one point, having to explain to my management why their least senior engineer needed the webcasting room so that he could explain XSS to the ISO-certified 20+ years of experience blah blah blah project leads over there. "This is not Severity: Cosmetic. It lets anyone expose our corporation to End Of The World Nightmare PR, because they get to [predictable consequence of compromise of system, punchline is 'people die']." "But only if they find out about it, right?"

That was a very, very long 2.5 years.

<comment><USER3> Might this popular outsourcing destination be the same one that ICICI Direct serves? :)

</comment></comment><comment><USER4> My current employer has asked me to forget about "SQL Injection `problems`" and told me to focus on the deadline. _sigh_

<comment><USER2> This came up in our engineering ethics class in college. Suppose you said "No, that is unethical / professional irresponsible / etc." or its effective-but- weasley younger brother "Please document that request in writing."?

<comment><USER4> Don't worry, I ignored his request. :)

</comment></comment></comment><comment><USER5> He is lucky the bank did not serve him with a lawsuit for "hacking".

<comment><USER6> Actually, the bank is lucky that they didn't get exploited by some kids in Russia and then get shut down by the government.

</comment></comment><comment><USER7> All in all, they seemed to have addressed it a lot better than I would have expected for a large company.

</comment><comment><USER8> > Although there are better ways to accomplish what you need to do, the > immediate way to fix this is to validate the errmsg parameter to make sure > it only contains safe values. This means that there should be no <, > &, " > or ' characters in this parameter.

No! XSS is an encoding failure. Don't try to solve it with sanitization. That leads to silly situations like users named O'Malley getting errors because you don't allow quotes in names.

Sanitization is for controlling the structure of data, like making sure names aren't a million characters long, or making sure all orders have at least one order line. It prevents situations that shouldn't be possible, that aren't _sane_. Get it?

"Encoding" means representing data in different ways, for instance so it can be stored/transported in a stream.

        Raw string: <>&"'
        XML-encoded: <>&"
        JSON-encoded: <>&\"'
        URL-encoded: %3C%3E%26%22'
        SQL-encoded: <>&"\'
        CSV-encoded: <>&""'

Same string, different representations. That's encoding.

<comment><USER9> encoding is a subset of sanitization

</comment></comment><comment><USER10> One of my clients is a Bank. I work occasionally on one of their intranet- sites-that's-actually-not-on-the-intranet-but-the-internet, and it has a password recovery procedure _written in plain text on the login screen_ and open to the most basic social engineering imaginable [Have to be careful what I say here. I'd love to describe just how easy it is, but I'd better not]

I've spoken to them and told them this is A Very Bad Thing, but they just brushed me off, so I wrote a pretty strongly worded email outlining how and why it was bad, but they just said [paraphrasing] "That's our procedure. people forget passwords all the time and we need to make it easy or they'll get upset"

The people in charge honestly seem to have no idea that people _from outside the company_ can see this site. I try and try, but now I just despair

<comment><USER6> Incidentally, I work at a bank, and to get access remotely you have to have a randomly-generated username, a random password, and a client-side certificate. The VPN software denies all outgoing connections except to port 80 (and the VPN port, I guess) when it is not active. When it is active, it makes all the network interfaces that aren't the VPN disappear (so you can't see your link- level network anymore). Then, it asks for your password every 24 hours.

Usually I find the commute to work less stressful.

But it does show you that some organizations do take data security seriously... perhaps too seriously. (The port blocking is just security theater. I can run whatever I want over port 80. But the random username / random password / client-side SSL certificate is excellent security.)

<comment><USER11> _But the random username / random password / client-side SSL certificate is excellent security._

The SSL certificate is, but not the random username. That's just a maintenance hassle. A username is not a secret - that's what the password is for. The random password isn't so great, either, because it pretty much forces you to write it down and then it just becomes a (poor) version of the SSL certificate. It should instead be a strong password that you can actually remember.

<comment><USER12> Most really secure VPNs I've used have use a SecurID[1] token and PIN, instead of a static password.

[1] <http://www.rsa.com/node.aspx?id=1156>

<comment><USER13> I've been using an extranet site recently that calls you, using Twilio or something I guess. They have my mobile phone number.

You enter your username and password on the web form and your phone rings a couple of seconds later. You are asked by a recording to type in your PIN. When you do, the HTTP request is completed and you are logged in.

It's very easy as a user, and seems quite secure. The username/password/PIN are all quite weak and easy to remember, but in conjunction with the phone call, it's fairly strong.

</comment></comment></comment></comment></comment><comment><USER14> I wouldn't be too quick to criticize ICICI on their fix. They did the right thing -- the quickest possible secure fix. Yes, input filtering is the "most right" fix, but speed is even more important in cases like this. It's quite likely that switching to a boolean significantly reduced the number of side effects. If they don't switch on input filtering in January some time, then we can start criticizing.</comment>


Charts that don't seem quite right, organ donation edition (2015) - <AUTHOR> https://jasoncollins.org/2015/02/11/charts-that-dont-seem-quite-right-organ-donation-edition/ <comment><USER2> I have _never_ understood the big deal about organ donation. The dead person no longer uses the liver or whatnot and has no opinion. The other 98% of the body will be discarded anyway so why not recycle?

<comment><USER3> Depending on how exactly you formalize that argument, it would go through just as well for necrophilia. Yet it's not true that people supporting opt-out organ donation implies they support opt-out necrophilia. So I think most people reject your argument.

<comment><USER2> Seems odd to bring up necrophilia, but in general, except for hygenic and crime investigation reasons, "abuse of a corpse" seems like a strange kind of law as well.

I certainly couldn't care less what people might do with my body once I'm dead. Burn it, bury it, ignore it, worship it -- whatever floats their boat.

</comment></comment></comment><comment><USER4> You are also not presented with a form to opt-in in Denmark, and you have to request a form in order to opt-in.

So the chart is exactly as is stated.

In opt-in countries you have to contact authorities to opt-in and in opt-out countries you have to contact authorities to opt-out.

The author has a moral position made clear early in the article, when saying that more than 99% "failed to opt-out".

No they didn't fail to do anything. They either chose not to, or did care enough about the subject matter to make a choice.

</comment><comment><USER5> I had a discussion with a French medical student concerning organ donation. She said that the type of death where organs can be donated (cerebral death if I remember right) is very uncommon (compared to cardiac arrest) so we did not have to worry about it (or needed to opt-out). In addition, like in the Austrian example, the relatives are consulted for their assent.

</comment><comment><USER6> In Ontario, Canada apparently 31% of people are registered as a donor [0]. In our case it's not opt-in or opt-out; everyone must answer yes or no when verbally asked this question upon renewal of their health card (comes up for renewal every 5 years on your birthday, required for government health benefits, virtually every citizen and permanent resident has one).

[0]: [https://www.beadonor.ca/scoreboard](https://www.beadonor.ca/scoreboard)</comment>


VIA release ARTiGO A1100 tiny desktop PC Kit - <AUTHOR> http://www.geek.com/articles/chips/via-release-artigo-a1100-pico-itx-kit-20100420/

<comment><USER2> Does the 1.2 ghz VIA Nano have enough "oomph" to decompress streaming video? With an HDMI port and at <$300 I can see one of these in my living room with my TV plugged into it for watching Hulu. With cable/satellite >$50 a month you'd pay it off pretty quick if you dropped paying for TV and stuck with Netflix and Hulu.

<comment><USER3> Media playback is offloaded to a "VX855 Media System Processor" which handles 1080p video.

<comment><USER4> I hope it has good Linux support.

</comment></comment></comment><comment><USER5> I'm still hoping for a return of the thin-client model, but with rich media. 99% of the time my desktop is running at 10% CPU load or less. When I want to do something that requires a lot of processing power, I usually log into a remote server with more than I'd like to stuff into a desktop. However, I do want enough power to watch video occasionally and manage graphical applications (such as simple photo editing) when necessary. A small system would also have the benefit of lower power usage, smaller footprint, and less noise.

The major thing that prevents me from switching to a tiny PC in the office is lack of dual-monitor support. Screen real-estate is something I just can't sacrifice.

In the long run, I look forward to a silent office instead of the constant noise of fans and hard disks.

</comment><comment><USER6> Portwell offers a system too.

[http://www.portwell.com/products/detail.asp?CUSTCHAR1=WEBS-1...](http://www.portwell.com/products/detail.asp?CUSTCHAR1=WEBS-1010)

<comment><USER7> Do you have any pricing on the Portwell system?

<comment><USER6> The Portwell site requires the user to request a quote which almost guarantees it's more than $199. I'm guessing somewhere in the $399 range but I could be wrong.

I bought a pico-itx board two years ago from Logic Supply with the intention of building an embedded robotics system. Cool stuff. Worked too. But the add- ons get pricey and it was difficult finding a case for it. Started to fab a case but ran out of time.

Logic Supply's price is still the same as it was two years ago.

<http://www.logicsupply.com/products/px10000g>

</comment></comment></comment><comment><USER8> I was just looking at this stuff this morning. This system looks a little better to me than the one featured. [http://www.newegg.com/Product/Product.aspx?Item=N82E16856119...](http://www.newegg.com/Product/Product.aspx?Item=N82E16856119016)</comment>


Reddit: Modern JavaScript developer workflow makes me sad - <AUTHOR> https://www.reddit.com/r/javascript/comments/5fphiw/modern_js_developer_workflow_makes_me_sad/ <comment><USER2> I think he means "modern software development makes me sad". Java is no better -- I've used projects built on Ant, Maven, Gradle, and now Bazel. All of them had problems like this. The only reason JavaScript seems different is because the "modernization" is more recent.</comment>


Ask HN: Where to Find Good iPhone App Developers? - <AUTHOR>

I'd like to hire someone to build an iPhone app.  Googling yields plenty of options, but I'm having difficulty separating the wheat from the chaff?<p>Any suggestions?  I'm interested in both (a) personal recommendations and (b) sites that aggregate/rate iphone app developers. <comment><USER2> It kind of depends on the size/complexity of the app you need built, and any special technologies it needs to use (sound or image processing, XMPP, etc).

My suggestion would be to search the AppStore for someone who's already built something vaguely similar, and see if they're open to building yours.

</comment><comment><USER3> I can give you a personal recommendation for a very good iPhone dev team/Mac OSX team who are currently looking for work (and can supply an independent reference customer).

<comment><USER3> Take a look here

<http://bertmcdowell.com/>

(lovely chap too)

</comment></comment><comment><USER4> Depends on what you want it to do! Give us some guidance here.

<comment><USER5> Agree. If you share more about what you're trying to develop, we can give you more guidance.</comment></comment>