Spreadable is shutting down (a few months after launching) - <AUTHOR> http://spreadable.com/shutting-down/index.html

<comment><USER2> Any idea why?</comment>


Over $109bn wiped off Facebook's market cap after growth shock - <AUTHOR> https://www.theguardian.com/technology/2018/jul/26/facebook-market-cap-falls-109bn-dollars-after-growth-shock <comment><USER2> This company has more revenue than a company which feed 1 percent population daily. Go figure.

</comment><comment><USER3> For context, here is $fb stock for the past 12 months [1] [https://i.imgur.com/R0NwgSb.png](https://i.imgur.com/R0NwgSb.png)

They've fallen and recovered from way more than that (edit: not) this year.

1: [https://www.google.com/search?q=%24fb&oq=%24fb&aqs=chrome.0....](https://www.google.com/search?q=%24fb&oq=%24fb&aqs=chrome.0.69i59j0j69i65l2j0l2.1051j0j7&sourceid=chrome&ie=UTF-8)

<comment><USER4> None of the drops in that chart are even remotely comparable. Even the local maximum to the 52 week low over the course of months is smaller so hardly "way more". Its the largest drop in market cap in a single day ever, so its pretty uncharted territory whether a company can recover or not.

<comment><USER5> can recover or not? are you kidding me? lol

<comment><USER6> It was an open question, after the 2000 crash, whether MSFT would recover. It took until 2016 to do that.

It was an open question whether EK could recover. We all know how that ended.

</comment></comment></comment></comment><comment><USER7> it's still higher than recent low set after the Cambridge incident. The subsequent runup thereafter was quite aggressive as if the incident never even took place.

</comment><comment><USER8> Maybe someday we will all realize that daily fluctuations in a company's market cap don't matter.

Just because something happened doesn't make it news.</comment>


Ask HN: Do you start an LLC when launching a side-project? - <AUTHOR> If you do, do you use a LLC creation website, or do you do the paperwork yourself and list yourself as the registered agent. If not, what do you do instead to shield yourself from liability? <comment><USER2> Note that it requires more then just creating an LLC if you're really trying to do it for protection. The LLC really needs to have its own finances, equipment, etc, or a lawyer can "pierce" it in court.

</comment><comment><USER3> If it's generating cash-flow of any sort - yes. But I don't do that beforehand. Too many unfinished projects. I have once and I feel like I just wasted money. Won't do it again unless I'll have reasons to believe I might get in legal trouble. For most side-projects that seems pretty unlikely.

</comment><comment><USER4> I have used Harvard Business Services (www.delawareinc.com) in connection with forming and maintaining several Delaware LLCs. They seem to provide good service and convenience. Remember, in addition to formation, you will need to maintain an in-state registered agent, pay franchise taxes, occasionally perhaps pull down a certificate of good standing, etc. I don't know that the do-it-yourself route is the best. On the other hand, when I practiced corporate law in a previous life, we used a higher-end corporation service company that was substantially more expensive. So I felt I took a reasonable cost solution that was easy to manage for a side project. Note: Nothing here is legal advice; I am not a representative of or compensated by Harvard Business Services. Just my opinion ... YMMV

<comment><USER5> Wouldn't it be worth forming the LLC in a state that doesn't have ongoing fees and forms?

</comment></comment><comment><USER6> I have a single LLC that owns all my side projects. I used an agent to register the company a while back but I don't know there is much more value than doing it over a website</comment>


Top 10 Largest Databases in the World - <AUTHOR> http://www.businessintelligencelowdown.com/2007/02/top_10_largest_.html? <comment><USER2> Cool article, but that Library of Congress size of 20TB can't be right. I'm working with a 25TB warehouse now and it's not considered all that huge.</comment>


The best unknown activist investment of 2009 - <AUTHOR> http://greenbackd.com/2009/10/09/the-best-unknown-activist-investment-of-2009/

<comment><USER2> _What about the liability?...He contained the liability to his investment vehicle, Australian Style Investments. The A$4.5M was paid to an another entity of Bolton's, Australian Style Holdings, to quarantine it from the $120M liability in Australian Style Investments._

I thought it was a great story until here. This just seems totally unethical. Am I missing something?

Certainly I can't just evade the liability of a risky short sale (for example) by making the trade through a shell corporation?

<comment><USER3> You're right. Something is off here. That seems like moving all the cash from one company to another and letting the first go bankrupt without the latter assuming liability.

What stops this happening more often?

<comment><USER4> Corporate law.

<comment><USER3> Care to be more specific? What happens normally that failed to happen here & why.

<comment><USER4> The law is different from country to country, and I am not sure about the law or the facts of the case here. But the person that controls a corporation usually has a fiduciary duty to the corporation and usually cannot merely give away the assets of the corporation.

Here the corporation had an asset (voting rights) that got sold, but the proceeds of the sale did not come back to the original corporation selling the asset but went to a completely different corporation. Depending on how this was done this may be improper.

What usually happens in this case is that someone that is a creditor of the corporation sues to get the money back. However, here the creditor did not sue because it seems like they were able to get their money from another source as explained in the other posts in this discussion.

BTW none of this is legal advice :).

</comment></comment></comment></comment></comment><comment><USER5> Now -THAT- is a hack. Bravo.

As for this quote:

 _He's just ruined his corporate life forever._

I'd say he's just cemented himself as an incredible strategist that will be fairly in demand!

<comment><USER6> He made millions, but he didn't generate any wealth, he just worked the system. _I_ won't say Bravo.

<comment><USER5> That's why I called it a hack. Fundamentally, it's not much different to gambling with an advantage - there were certainly a lot of opportunities for him to lose.

I don't think this called for a suspension of ethics, rather more of a disregard for the establishment.

Look, legally exploiting a flawed system to produce a net benefit for oneself isn't fundamentally evil. In fact, in this situation it seems (fortunately) that his actions eventually bailed out a whole lot of small-time investors.

<comment><USER7> What about using the other investors to blackmail management and then selling out these investors when management paid him off? When someone is this smart, the responsibility to be good is even more pressing and the condemnation for being bad should be more loud. And yes, I am judging.

</comment></comment></comment></comment><comment><USER8> When I was 27 I would have found offensive to be called "a 27-year-old". Which age range do you need to belong to to be taken seriously?

Because if he had been 67, he would also be referred to with a dismissive "a 67-year-old".

<comment><USER9> He had, what, 10 man-years of experience at this sort of thing, at most? His opposition had what sounds like a man-millenium of experience, and he made A$5M off of them.

<comment><USER10> The "skill is proportional to experience" idea always puzzles me, especially in fields like finance and software where differences in productivity are measured in orders of magnitude. The most effective investors and programmers easily have 100x greater maximum productivity than the median.

<comment><USER11> _The most effective investors and programmers easily have 100x greater productivity than the median._

I have a hard time believing that for programmers. 10x maybe, not 100x. If this were true, they should be making tremendously more than median programmers. When was the last time you heard about a software engineer employee making over $1m, let alone $10m?

<comment><USER10> _> software engineer employee making over $1m_

Employers don't have any incentive to pay an especially effective programmer at whatever his "market rate" actually is. They just need to pay enough to fill their position with someone skilled, and there's plenty of programmers who'll take the near-guarantee of $MaxSalary/yr and live happily. ("After you've got enough to settle down and buy hardware whenever you need it, what else do you need?") If you want to realize your full "fair market value" (which is just a convenient theoretical fiction anyway), you need to take matters into your own hands.

I also don't think there's a consistent 100x variation in overall productivity/output, but maybe something more like _maximum_ productivity (and edited the grandparent post). If you have a super-productive employee it's going to be hard to "fully saturate the pipeline" since any one single project isn't going to constantly require that level of work, and you can't just have him hop project to project within the company since there's a learning curve each time.

I originally picked up the "programmer productivity varies a lot" meme from one of PG's essays, but have since seen it in industry: <http://paulgraham.com/gh.html>

<comment><USER3> If the value a select few brought to a company was > $10m, and this was widely known, they would bid up the price. Of course employers don't have an incentive to pay above market rate, that's almost a tautology. That is what market rate means. However, if there was so much value to be had, market rate would rise.

<comment><USER10> You seem to have misunderstood what I was talking about. I didn't contravene you at all.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> And the Australian securities authorities need to do some serious soul searching as to why a guy with a mere $47,000 in his pocket was allowed to purchase securities that leave him with a A$94mln liability - without even having the money at hand.

>"The reasons for creating such a security are beyond the scope of this post, but suffice it to say that stapled securities offer certain tax benefits."

And are those "stapled units" another byzantine financial product designed to work around an even more byzantine tax system? I am curious if such financial products would even make sense in a fair, flat tax system.

<comment><USER13> I put it down to a limitation of the Aussie (and other) stock exchanges. The shares had dropped to $0.01, when their true value was negative, given the stapled obligations that they carried. Bolton should have been paid to take on the debt in the first place.

A whole lot of other people apparently made the same transaction unwittingly, without reading the fine print, as it were. The sellers of the $0.01 shares were paid a peppercorn and washed their hands of the debt.

I reckon this is a problem for the regulators. Once the shares dropped below the value of the remaining obligations (give or take) a fairer price would be negative. Alternatively, trading should be suspended because there's a fair argument that the company is insolvent at that point.

Instead, this fact was hidden behind a little "complexity" and inadequate rules.

Bolton just took advantage of a broken situation.

<comment><USER14> The stock exchange can take plenty of actions against a stock and from a lay perspective it sounds like they should have.

</comment></comment></comment><comment><AUTHOR> A good background article on him: <http://thebigchair.com.au/news/insight/nick-bolton>

"Bolton studied economics and mechanical engineering at Melbourne University. "I don't think I completed one unit in engineering, but I did well at economics," he says. At the same time, Bolton made money from an investment in Melbourne IT, which had a monopoly on internet and website domain names in Australia. With deregulation of that market looming, Bolton saw an opportunity.

"I started Bottle Domains at the age of 19 and became a competitor to Melbourne IT." He timed his investment well. By the following year, Bottle was an established player, and Bolton dropped out of uni to run his new business from his St Kilda flat.

He claims to have made his first million before his 21st birthday, but "it's never been about the money," says Bolton. "I live reasonably conservatively; even my clothes are not overtly expensive. I might be wearing a $1000 jacket, but with a $20 pair of shoes. I'm not driven by price in terms of what I acquire." "

</comment><comment><USER15> Can someone clarify? He bought 19.9% of the voting shares, called for a meeting to dissolve the trust (what is the trust? Is the trust the same thing as BrisConnections?), then sold his shares to someone who wanted to ensure that BrisConnections continued to exist?

Tricky and smart, but what is the value that BrisConnections holds and to which other people want access? Is it just the two upcoming installments that investors owe?

<comment><AUTHOR> BrisConnections was developing a toll road, but the actual tollroad development assets were held in the trust for tax reasons.

If the trust were to be dissolved as the development was in process, it would have killed the project. That's why his particular stake had so much value because it would help stave off the dissolution.

Investors would owe the 2 upcoming installments. So he was going to owe $48M and another $48M for the next two installments. That's one of the incentives they too would have had for dissolving the project since the ones who picked up shares at $0.001 would also owe that money.

<comment><USER15> Much thanks, that really clarifies the situation, but it also inspires further questions.

So people purchasing shares were theoretically providing the investment funds to complete the toll road, and as a result of that risk, would have access to the profits of the toll road in proportion to their investment, correct?

So BrisConnections doesn't want to see the fund dissolved because it loses all the capital represented by the $.001 investors by virtue of still owing $2, and Thiess John Holland wanted to maintain the entity that owed them a contract for building part of the road?

</comment></comment></comment><comment><USER16> He's not so good with keeping my credit card details though:

[http://www.theage.com.au/business/bolton-loses-his-bottle- ov...](http://www.theage.com.au/business/bolton-loses-his-bottle-over-hacked- client-details-20090415-a736.html)

</comment><comment><USER17> Gordon Gekko approves.

</comment><comment><USER18> I don't get the 'ultimate posterboy for the much-maligned Generation Y' comment... A financial sharks a new thing? Or are these people just sheltered by rose-colored glasses that they use to read their history books?

If he was a Baby Boomer, would we see comments like "ultimate posterboy for the much-maligned Baby Boomer generation?" I really wish people with their 'get off my lawn' comments would crawl back under their rocks.

</comment><comment><USER19> He doesn't sound like a likeable guy, but that is besides the point.

His actions did demonstrate the pitfalls of "stapled units" to Australia. Shame should be on the people who created this instrument. Any time you have a security created to manipulate tax code, it is ripe for abuse.

</comment><comment><USER20> He sounds to me like a predatory, sociopathic parasite. Perfect for Wall Street! :)

</comment><comment><USER21> That bloke showed those toll thieves how to do business.

These guys are doing a lot of monkey business and some times it blows in your face, get over it!!!!</comment>


How Intellectuals Talk - <AUTHOR> http://mattmaroon.com/2010/11/24/how-intellectuals-talk/

<comment><USER2> I agree with that sentiment for a lot of topics (especially the more "soup-du- jour" ones), but I do find that people do still contribute positively to topics related to the "Silicon Valley hacker" lifestyle, be it entrepreneurial tips, or just where to get good tea.

To be honest, I don't think I've ever felt that HN was a place to have intellectual discussions about various topics, as he puts it. I'd imagine that a community needs to have a certain level of expertise on a topic to have a meaningful discussion on it, and it seems a bit disingenuous to think that HN somehow has that level of expertise for everything under the "intellectual" sun.

For that sort of discussion, I find that commenting on good ol' blogs from field experts (when they're talking about their fields) is usually more productive.

<comment><USER3> An 'expert' and an 'intellectual' are different things. As a gathering of experts on startup and tech-related topics, HN is unmatched; people are very nice and volunteer lots of information. This is perhaps the upside of "nerdy" that Matt did not mention in his article. But I agree with him that HN is not intellectual. When the topic of discussion is beyond the expertise of almost anyone, the only way to make progress is to apply a certain amount of intellectualism -- to be tentative, questioning, critical, contemplative, _nuanced_. For a definition of intellect, I have always relied on Richard Hofstadter's formula, in _Anti-Intellectualism in American Life_ :

Intellect [...] is the critical, creative, and contemplative side of mind. Whereas intelligence seeks to grasp, manipulate, re-order, adjust, intellect examines, ponders, wonders, theorizes, criticizes, imagines. Intelligence will seize the immediate meaning in a situation and evaluate it. Intellect evaluates evaluations, and looks for the meanings of situations as a whole. Intelligence can be praised as a quality in animals; intellect, being a unique manifestation of human dignity, is both praised and assailed as a quality in men. (Chapter 2, Section 1)

<comment><USER2> >> As a gathering of experts on startup and tech-related topics, HN is unmatched

Agreed. When people say co-founding is like a marriage, I think it's not much of a stretch to say that start-ups and hacking in general are a way of life. That's why I worded it as "lifestyle discussions".

One could say that intellectuals are similar to hackers in that both take interest in nuances of complex things, but imo, hacker culture is more individualistic ("let me do my thing") whereas intellectualism is more of conversational ("hey, here's another thing to ponder").

<comment><USER3> Point taken. Hackers are nuanced when it comes to their expertise, so nuance is not really the difference between hackers and intellectuals. If pressed I'd say that the hacking trait is biased toward exploiting knowledge, whereas the intellectual trait is biased toward understanding (or integrating knowledge, if you will). The ideal hacker is also an intellectual generalist, but really all you need to be a hacker is some expertise. Outside of that expertise, the typical hacker either avoids having opinions, or has prefabbed ones -- they aren't very different than the general population.

</comment></comment></comment></comment><comment><USER4> I have noticed that the influx of new users around each YC application deadline coincides with a slew of less intellectual topics. I have assumed this is b/c not all founders (or aspiring founders) are particularly intellectual.

Sometimes intellectual pursuits in a business context lead to excessive yak shaving. Some of the most capable entrepreneurs I know don't have a stomach for the kind of intellectual banter that Matt idealizes (and I very much enjoy).

In the lulls between YC application deadlines, HN shines. Everyone is busy working on their project and people are more likely to speak from passion, insight, etc., than out of the competitive, aspirational mindset that they feel after getting accepted or rejected from YC (or dreading/awaiting one of the two).

</comment><comment><USER5> An indepth intellectual discussion may be rare offline and its even rarer on forums. The very nature of message board conversation tends to make you partisan and cut out the niceties and "I agree but.." and "but what do you think about.." like phrases. What makes forums different from face2face conversation is that it makes us assertive rather than perceptive, but as a side effect, a purpose does get served . that of increasing variety and diversity of thought rather than depth.</comment>


Next for Nest: A Smoke Detector - <AUTHOR> http://jessicalessin.com/2013/09/24/exclusive-next-for-nest-a-smoke-detector/ <comment><USER2> Smoke detectors are literally invisible to the average house dweller 99.99% of the time, and the 0.01% of the time where they are "activated", they do their job just fine.

The thermostat was a brilliant entry point into a potential multibillion dollar home automation business for Nest, but I don't get why a smoke detector would be step 2.

Any ideas?

>Nest launched its $249 thermostat almost two years ago and has long brainstormed other things to build, including the smoke detector and potentially a door lock.

A door lock, on the other hand, would be great. A friend of mine has replaced his traditional apartment lock with a pinpad, and it's quite fantastic. He can set temporary passcodes for guests, never has to worry about his keys, etc.

<comment><USER3> It's an intriguing, albeit risky move. Existing smoke detectors are pretty ugly with bad UI. There is little to no competition for the 'high end' retail market. With that said, current smoke detectors can be had for $10-20 bucks, and my guess is Nest will charge significantly more than that. Of course they can add a number of extra sensors/functionality to justify the costs. A CO sensor would be a good addition, maybe motion sensor (for security), temperature sensors (to provide more granular feedback to the thermostat), and maybe some other sensors to monitor indoor air quality (VOC's, radon). I am sure there are a few other things that can be thrown into the device to make it more useful (wifi repeater?).

All things considered, this is a pretty genius move. In the push to create 'smart homes' most of the attention has been on lighting, kitchen appliances, and entertainment systems. But one thing that has always bugged me was how do you get a refrigerator at the back of the house to communicate seamlessly with the wireless router in the front if the signal doesn't reach that far. I was thinking that mesh networking would play a big part, but even in an appliance saturated home, there could still be some dead spots. Well, smart smoke detectors might solve that, as they are in almost every room in the house! One issue I can forsee is that not all homes have hard-wired smoke detectors (which means power would be an issue, thus limiting what they can do with it).

EDIT: Seems like everyone is focusing on the UI comment. While I think that that is still an issue, I think the more exciting possibility is that a 'smart detector' could also provide nodes for a mesh network (or something similar), essentially providing a communication layer for appliances/devices in the home. If they go this route and they succeed, they could put themselves in a really good position competitively, as they would 'own' the networking layer.

<comment><USER4> What UI? You plug them in and, you hope, never think about them again except to change the batteries once every couple years. Why would I want a better relationship with my smoke detector? It's there to detect something that virtually never happens.

<comment><USER5> That's if things go well. But when they don't, smoke detectors are incredibly frustrating. They'll beep randomly and you won't know which one is doing it. They'll start blinking red and you won't know why. Or they'll go off in the middle of the night for no good reason. Maybe I just need higher quality smoke detectors.

I have 2 features that I'd love to see in a smoke detector:

1) notify me when the battery level is low so I don't have to think about it 2) allow me to snooze the smoke detector for 15 / 30 minutes if I end up smoking up the kitchen

</comment></comment></comment></comment><comment><USER6> There's one reason to have a Nest smoke detector: it would have a thermostat.

The reason I haven't bought a Nest is because the device only takes temperatures from one place in my house, which just happens to be a place that has a +/\- 5 degree temperature change from either end of the house on a good day.

If the device also gets the temp, a Nest would be far more effective at keeping a house comfortable and saving energy. I'd also worry less about my toddler daughter being alone in a bedroom on an cool night that is usually much cooler than my own (first world parent problems).

<comment><USER7> Yeah but does it really help the average home? If you have one thermostat in your house more temperature data doesn't really help, it can only set one temperature for the whole house.

If you have a multi-zone house then yeah, your bottom floor and top floor could be set to multiple temperatures, but those houses typically have 2 thermostats already and if you're using 2 Nests for that they already talk to each other to make that efficient.

It would be cool to be able to wire up individual ceiling fans or something to the Nest and then use the fire detectors to figure out which rooms are running too hot/cold and fire off fans individually to normalize the temperature.

<comment><USER5> There's one example where I think targeting a specific room would help even without multi-zone. At night I only really care about the temperature in the bedroom, which is a lot smaller and in my experience cools faster than the living room (which is where my Nest is currently). If it could figure out that my bedroom is already at a comfortable temperature at night and not bother with the temperature in the living room, that might be interesting.

</comment></comment></comment><comment><USER8> I remember listening to an episode of This American Life many years ago on the subject of the saying "build a better mousetrap and the world will beat a path to your door". The long and the short of it was that that particular saying was untrue because there is no market for a better mousetrap. The $1.00 mousetraps work just fine, and though they're not perfect, anything better won't be better enough to justify the additional expense.

I feel precisely this way about smoke detectors. I recently bought a house, and the first two things I did were: a) purchase a nest (which I love) and install it, and b) go to Home Depot, pay $50 for 4 new well-rated smoke detectors, and install them. Are they ugly? Sure, although the fact that every interior space in every developed nation on the planet has them tends to take the edge off. Do they occasionally false alarm when We're cooking something? Sure, it has happened once or twice.

Neither of the above are justification for me to spend more than $10-15 on a smoke detector. It would have to do something truly marvelous to be worth even $30 a unit for me. The thermostat was worth the extra money to me because it's cool and saves me a bit of money and I wanted to give my money to a company that was doing right by the energy consumer. I will withhold judgement on the smoke alarm until I see one, but the exuberance around here for it seems premature to me.

Also, if my house burns down, I will already get a smartphone alert in the form of a phone call from my neighbors.

</comment><comment><USER9> My feeling is that manufacturing a set of relays that interface with today's existing wired smoke detectors and CO detectors would make a lot more sense. Added complexity will almost always make these devices harder to use and less reliable.

Keep the existing devices and make a gadget that uses wifi (optionally ethernet or a mesh network? a cell modem?) and relies on the signal old school 3-wire or 4-wire smoke detectors already put out. With a three-wire system, for example, you could put one relay in and get a cell warning for the entire system or put a relay on each alarm and get zone-specific alarms.

The trouble is that the sorts of people thinking about these things want to rope the customer into a proprietary system instead of just sending them an email or SMS with the cheapest possible equipment.

</comment><comment><USER10> The idea of a smoke detector which also detects carbon monoxide seems brilliant, except that smoke rises and carbon monoxide sinks, so either you place the device in the middle of the wall (and lose out on early warning) or it becomes useful for one and useless for the other.

<comment><USER11> One would think that CO produced by combustion would rise before it fell.

<comment><USER8> You are both right, in a way, in that neither particularly matters: [http://www.newton.dep.anl.gov/askasci/chem03/chem03364.htm](http://www.newton.dep.anl.gov/askasci/chem03/chem03364.htm)

"As would have been predicted by the Second Law of Thermodynamics, CO infused anywhere within the chamber diffused until it was of equal concentration throughout. Mixing would be even faster in the home environment, with drafts due to motion or temperature. It would be reasonable to place a residential CO alarm at any height within the room."

</comment></comment></comment><comment><USER12> Maybe it will finally make use of Nest's unused Zigbee radio ([https://community.nest.com/ideas/1115](https://community.nest.com/ideas/1115))

</comment><comment><USER13> A cartoon comes to mind of somebody staring at a chart of the increasing smoke in their house while the fire starts to eat away their computer screen.

I'd like to have that on a dashboard, too - smoke levels in the building. Very comforting most of the time.

(Sorry for the humor - I am sure they have thought of some worthwhile use cases).

</comment><comment><USER14> Good. The Nest is hands-down my favorite piece of infrastructure I've purchased. It's easy to use, looks great, and saved me money over what I had before. Hopefully I can buy lots of new products from Nest Labs to replace the ugly outdated crap around my house over the next decade.

</comment><comment><USER15> I think the smoke detector is a safe bet for the Nest. Like the page says, the "connected home" is starting to be something we see emerging; the issue is, what needs to be 'connected'?

There aren't really a lot of areas that benefit from home automation, but a smoke detector is at least in the right ballpark. It will still be a few years before anyone tries to come out with a 'smart refrigerator/pantry' (the logistics are a nightmare alone).

Aside from lighting/smoke/AC, where else is there to go in home automation. The least touched market is home irrigation, but even has already started to be explored.

Like I said, the smoke detector is a good step in the right direction. Not a bold and wild innovation; a more simplistic approach as they tread forward.

</comment><comment><USER16> Well, their non-failsafe thermostat could let your house freeze and pipes burst, if it happens to fail when you are away. So now they're going to take another reliable basic home item and make it complicated and unreliable?

</comment><comment><USER17> Is this a satire piece?</comment>


Verizon launches new 'unlimited' plan - <AUTHOR> https://www.theverge.com/2018/6/14/17463290/verizon-above-unlimited-plan-announced-price-details <comment><USER2> I still don't understand why we haven't disallowed the use of the term "unlimited" in data plan marketing. As much as no sane person should ever pull this many gigs on a cell phone line, any plan that has throttling isn't, arguably, unlimited, and shouldn't be marketed as such.</comment>


Ask HN: I have H1B visa, should I be worried - <AUTHOR> Considering how many ppl have been laid off, even with a valid visa ,think h1b holders will become the easy targets right from our neighbors who lost the job (not related to h1b) to politicians.<p>Will one day someone sign an executive order and send us back home? <comment><USER2> There was a recent AMA from an immigration attorney. Perhaps some of the comments may be helpful [https://news.ycombinator.com/item?id=22769789](https://news.ycombinator.com/item?id=22769789)

</comment><comment><USER3> Speculation:

As far as individual acts that's hard to gauge but IMO in the US we don't have a great deal of folks doing that sort of thing, not at scale.

As far as government action, the real risk is the POTUS taking unilateral action, and he's unpredictable but also prone to a lot of talk followed by no action.

Congress has been pretty passive on that topic and I doubt is likely to do much for now.

</comment><comment><USER4> yes</comment>


Show HN: Teevox – Twitch Multistream Player,made in Static HTML, React, Firebase - <AUTHOR> https://teevox.com/hn <comment><AUTHOR> Hey everyone, I got fed up with having to juggle around multiple tabs each with a different stream and manually muting them. I spent the past 2 months working on a website that hopefully solves this problem.

This was my first foray into React. After having been developing on Ruby / Node on Heroku, making a pure frontend static app was refreshing.

Here are some of the features:

\- Very, very fast. A lot happening under the hood with video to make the swaps near instant. I had to play around with GPU acceleration and CSS transforms to manipulate the streams.

\- Load three streams simultaneously, when you swap out the primary stream, the other two streams are muted automatically.

\- A powerful compact stream browser accessible to your left. I've tried to make it so you can scan a whole lot of streams at once to pick out the most interesting ones.

\- Auto-refreshing stream list. Hopefully you won't even notice it reloading. It's always kept up to date to minimize any offline streamers and catch your favorite streamers coming online.

\- Drag and drop streams into screens, click on screens to promote them to the primary. A lot of small miscellaneous things that hopefully make Teevox more intuitive.

\- Auto bandwidth optimization, when you select a very high quality stream (ex: Source), instead of switching all three to high quality, it'll only do it for the primary stream. When you swap out for another primary stream, it will seamlessly transition into the proper quality.

The best part was the static HTML portion that allows it to load almost instantly without any preprocessing necessary. Let me know what you think!

<comment><USER2> Woah, I used Teevox years ago when I watched a lot of Starcraft. I thought it was discontinued, or am I thinking of a different similar service?

<comment><AUTHOR> Good to have you back! It's the same guy :)

<comment><USER3> > I spent the past 2 months working on a website that hopefully solves this > problem.

What's the relationship between this page and the page I tried in 2011?

</comment></comment></comment></comment><comment><USER4> Looks good but I've been using [http://multitwitch.tv/](http://multitwitch.tv/) ( [https://github.com/bhamrick/multitwitch](https://github.com/bhamrick/multitwitch) ) for a while with no issues.

Also, the drag and drop doesn't work for me -- when I drag and drop, the stream doesn't open, the item just stays where I "dropped", and as you can see from the screenshot [1], it stays there (and during one of the drag and drops it also selected some text and couldn't get it to unselect).

Why not just make it to where people click on the items in the sidebar to automatically go into slot 1, 2, then 3?

[1]: [http://thumbsnap.com/i/VWKtad3j.png?0120](http://thumbsnap.com/i/VWKtad3j.png?0120)

<comment><USER5> Just as a historical note, teevox actually predates multitwitch. It used to be called WarpPrism, and was intended for streaming SC2 events. It fell out of favor circa 2 years ago, after some big changes at twitch broke a bunch of its features.

[https://www.reddit.com/r/warpprism](https://www.reddit.com/r/warpprism) [https://www.reddit.com/r/teevox](https://www.reddit.com/r/teevox)

</comment></comment><comment><USER6> Works well for me! Great work.

It would be nice if the URL updated to reflect which videos were being streamed, and which layout you were in, that would make configs more copy- paste-able. One of hte great features of multitwitch.tv is that it's easy to craft/copy-paste a URL that leads directly to both games.

<comment><AUTHOR> Ahh you mean like pushstate into the addressbar. That's a great idea. One of the issues has been losing the streams you were watching upon refresh

<comment><USER6> Yep! It's one of the things Ember is (or should be) best known for. The whole "don't break the web" tirade.

React-router should be able to handle it (you said you were using react, wasn't sure if it was in conjunction with react-router), but the documentation that describes the updating patterns of the URL isn't so easy to find... This might help though:

[https://github.com/rackt/react- router/issues/266](https://github.com/rackt/react-router/issues/266) (Issue from someone trying to change URL without triggering re-route, might help with saving params to URL).

I was thinking that rather than how multitwitch does it (which is multitwitch.tv/<stream1>/<stream2> or something like that), you might want to pass the streams as query string params (ex. "&1=<stream1>").... But then again, you could just use their style. Also it might be smart to selected layout type.

</comment></comment></comment><comment><USER7> Whoa! Haven't seen Teevox in a long time. I'm also building a website using React that uses the Twitch API. How did you get access to their streams without violating TOS? I found their endpoints and proxy them to deal with CORS but I feel like I'm breaking some rules.

</comment><comment><USER8> I remember this from way back when it was called WarpPrism, and hosted at WarpPrism.com. I had it bookmarked and used it to watch SC2 streams all the time.

Great to see that it's still in active development!

</comment><comment><USER9> Please don't take this the wrong way, but why would I want to watch 3 streams at once?

I imaging that this is supposed to be similar to a sportscast that multi-boxes games occurring at the same time. The issue I find is that the control isn't automated, so I'd have to actually be paying attention to all three to see which is most deserving of my attention at the moment.

I suppose that there are certain games in which multi-boxing is useful, but none of the ones I watch would have much benefit. What are the games you stream that benefit from a setup like this?

Also, you're serving all of the images over HTTP.

<comment><USER10> The other 2 stream might be boring at the moment(streamer afk, in a game queue, etc)

</comment></comment><comment><USER11> awesome! my company would be able to use this if it:

\- supported more streaming platforms (azubu, hitbox, mlg, etc)

\- supported more than 3 streams (currently we use [http://multitwitch.tv/](http://multitwitch.tv/))

<comment><AUTHOR> That's awesome! Is the player for consumers? A white-labelled player?

<comment><USER11> we use it internally- we have a team of editors watching esports 24/7 to keep our schedules and scores up to date ([http://abiosgaming.com](http://abiosgaming.com))

</comment></comment></comment><comment><USER12> Nicely done !

Is there a chance I can look into a github repo for an under the hood look ?

</comment><comment><USER13> Doesn't work for me. Safari 9, no Flash.

<comment><USER14> Twitch player is flash.

<comment><USER13> Just No. They use HLS, which can be viewed native in Safari. On every other site embedding works in HTML5 and obviously it also works on the Twitch site.

</comment></comment></comment><comment><USER15> Wow, feels really snappy. Well done :)</comment>


Show HN: Search for any iOS App's Keywords with AppMind.co - <AUTHOR> http://www.appmind.co

<comment><USER2> What do you guys think?</comment>


Ask HN: How secure is Firebase? - <AUTHOR> Hello everyone,
I am front-end developer and now looking to work with Firebase, because it looks like an easy way to implement backend system for me.
After I played with the sample code a little bit, I am not quite sure about how secure it is. Anyone can basically grab my API Key and start adding a new account to my Firebase project. While it's true we can add authorized domains to prevent a call from other domains. "localhost" is in the default authorized domain and I can't find a way to remove it.
If I miss something, please kindly let me know :) I would love to hear your opinion about Firebase.
I think Firebase looks promising (pricing is nice, too) and would like to work with it in the future.
<comment>----- EDIT
With regard to the "localhost" domain, my friend who is GDE said it will only allow access via "firebase serve" which require me to login first.
We will test and report back :) </comment><comment><USER2> Just tested, you still need to login.</comment>


How Airlines don't care about privacy: Case Study Emirates.com - <AUTHOR> https://medium.com/@konarkmodi/how-airlines-dont-care-about-your-privacy-case-study-emirates-com-6271b3b8474b <comment><USER2> I oftentimes reach for my 'call the regulator' button when I read these articles. Whats odd is how many people say "god no..." as if there was some consequential downside to using the very government entity we created (in law) to make corporate entities "do the right thing" when they don't appear to want to do it voluntarily.

So.. here we go. Explain to me, why we don't want to enact law to require (through regulation) this practice to cease.

<comment><USER3> I'm waiting for someone to state "when you're not paying for something, you are the product", except in this case, you are paying for something, yet you're still the product.

This is just...disgusting.

<comment><USER4> This is why we should stop quoting that all the time.

Just because you are paying for a product does not prevent your data from being sold or used in unethical ways.

<comment><USER5> The quote is not wrong. If you aren't paying for something, then 100% of the time you are the product. If you are paying for something, then <100% of the time you are also the product.

<comment><USER4> I don't pay for wikipedia (actually I do via donations and edits but that's not the point) but I don't see anything bad about their BM.

<comment><USER6> But Wikipedia is run by a non-profit organization...

<comment><USER7> I'd say the more direct response is that with Wikipedia there is no product, in that sense of the word.

<comment><USER8> There most certainly IS a product! The only way I can imagine that you came to believe there wasn't is that you were confused by the fact that they give their product away.

Does Encyclopedia Britannica's website "britannica.com" have a product? Is Encarta a product? Of course they are, and so is Wikipedia, unless BY DEFINITION you exclude any "product" not exchanged for money from the definition of "product". And by that definition, the second can of beans I got at the grocery store on a buy-one-get-one-free sale wasn't a product -- which I feel demolishes the usefulness of the term.

<comment><USER7> It's something that's produced, but not something sold (like Encarta). Accordingly you're right that it is a product.

In the informal sense in which we talk about users "being the product" I'd call it not quite right, since there's nothing sold. The user doesn't have to worry as much about ulterior motives.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I had a coworker who was flying to Morocco (I forget what airline). He called me over to his desk at some point to show me the screen as he was picking out his seat. By each occupied seat was a headshot of the passenger, pulled from what I assume was their Facebook profile.

It was amazingly creepy.

<comment><USER10> Sounds like KLM: [https://www.klm.com/travel/us_en/prepare_for_travel/on_board...](https://www.klm.com/travel/us_en/prepare_for_travel/on_board/your_seat_on_board/meet_and_seat.htm)

This is on a strictly opt-in basis. I guess it's an interesting alternative to Tinder if you're going to be stuck on a plane. (Disclaimer: I've never tried it myself)

<comment><USER11> Apparently on Virgin Airlines there are _chat rooms_ on the planes. Those have only two practical use cases: dating, and trolling: [https://twitter.com/KrangTNelson/status/959907806622121984](https://twitter.com/KrangTNelson/status/959907806622121984)

<comment><USER12> One practical use is talking to people you're on a flight with but not say next to. I can't say I'd be a regular user of that feature, but I do find myself on flights like that from time to time.

<comment><USER13> If you're all online anyway, wouldn't you already know how to reach those people?

<comment><USER14> That's IF you all pay extra for in-flight WiFi, and assuming the plane's network link is working. (Many planes' WiFi use a cellular-based network link that has occasional dead spots. Satellite linking is only available on newer planes.)

Whereas seat-to-seat chat is free and relatively reliable.

</comment></comment></comment></comment></comment></comment><comment><USER15> From my experience the travel industry are the worst offenders of data security. I remember making booking on booking.com and not having to pay for my booking, and I wondered how hotels can confirm bookings, when I went to check in at the hotel I asked this question to the front desk staff, and they simply told me "oh we get a fax or email from the OTA of your credit card information". You can imagine the look on my face when that happened.

Here I am building my online business using tokens with pci dss compliant payment gateway and all these businesses out there don't even care.

My lesson learned then was these industries will do anything to make it more convenient for the travelers to book, even compromise on security.

<comment><USER16> Sending credit cards via FAX to be printed out is not only OK with PCI DSS, it's recommended. The reason companies like Booking.com do this is because the credit card companies wanted it this way.

<comment><USER17> I remember having a chat with a small guesthouse owner a few years ago, he showed me what the OTA sent through to them which was clear copy text of the booking along with all the credit card details. The big online OTA would directly charge the customer 15% deposit if I remember correctly which they banked as their commission - kind of clever removing the big remittance headache. It was then down the hotel to directly capture the remaining balance and enforce the cancellation rules. He explained that if customers don't turn up he takes the credit card details down to the road to a small independent unrelated travel agency which attempts to hit the card and charges him 10% for privilege, he says it's about 50/50 weather the card authorizes. I think this still happens.

<comment><USER16> This definitely still happens, but I think implicit in your post and this thread in general is the unstated statement "...and this is a horrible state of affairs that shouldn't persist for even one more day!".

Ultimately it's the credit card companies that regulate this playing field, and up to a certain point they're happy to make a large trade-off between security & convenience, because they can work the security issues into their processing fees.

Credit card companies aren't dumb, of course they know that small Mom & Pop hotels are going to have horrible security practices when it comes to credit cards. They also know that any security issues are going to be contained to the customers of that establishment.

This is why PCI puts a huge amount compliance burden on companies such as payment processors and travel agencies that process a lot of credit cards, but by-and-large ignore small players.

The hotelier you described and his method of ad-hoc charging credit cards with a 10% fee at some unrelated business is surely in violation of some PCI rule(s), but that's going to be a matter between his customers and his bank, not all customers of the travel agency and Visa/MasterCard.

</comment></comment></comment></comment><comment><USER18> If you look at [https://track.emirates.email](https://track.emirates.email) you will see that it isn't emirates either, but a service provided by Mandrill, an add-on for MailChimp, and the cert is valid for [https://mandrillapp.com](https://mandrillapp.com). Surely they could have figured out how to use SNI.

The fact that your mail client / embedded browser takes you happily to sites with broken certs, giving them a tracking token (and in this case, total access to your booking) is also quite a problem.

<comment><AUTHOR> Exactly, the fact that the url does not have any expiry (apart from the end of booking), the email providers in this case Mailchimp would also have access to the same.

For the case why browser did not redirect the broken cert, that is because the link sent in the email was over http.

<comment><USER18> I tested going to a https link via gmail. On desktop chrome, it immediately opens the link (and hence passes the link parameters). On mobile it pops up a privacy error, "Attackers might be trying to steal your information" (NET::ERR_CERT_COMMON_NAME_INVALID), which is certainly the right thing to do. Still have to try it on Office365 and Outlook.

<comment><AUTHOR> Strange, I always encounter `NET::ERR_CERT_COMMON_NAME_INVALID` even on Gmail with Chrome. What's your test setup?

<comment><USER18> Doh, you're right. I looked at the site earlier and forgot to click on the red triangle and click "re-enable warnings". Mea culpa.

I checked firefox and it works correctly too.

</comment></comment></comment></comment></comment><comment><USER19> I mean - after Equifax got away with leaking SSNs, Names, Addresses with DoBs of all 142M Americans - this is seriously nothing. At this point, I have become apathetic on these privacy related issues as nothing will be done.

<comment><USER20> All 142m Americans?

<comment><USER21> Yes: [https://www.reuters.com/article/us-equifax-breach/equifax- fa...](https://www.reuters.com/article/us-equifax-breach/equifax-failed-to- patch-security-vulnerability-in-march-former-ceo-idUSKCN1C71VY)

<comment><USER20> "Yes" isn't a valid answer to the question. There are a lot more than 142 million US citizens.

</comment></comment></comment></comment><comment><USER22> Yet another reason blocking ads is a must. But not just blocking ads, trackers as well. I use uMatrix and uBlock origin. Unfortunately this does nothing to deal with the aforementioned redirect chain. I suppose maybe this means it is time to go back to the telephone and flight agencies.

<comment><AUTHOR> Some of the tracking protection tools might help, but not all for exactly the reasons you mentioned. However, you can enforce some settings in Firefox and Firefox based browsers to control referrer leakage in control. But it does break few websites. I can recommend taking a look at : [https://wiki.mozilla.org/Security/Referrer](https://wiki.mozilla.org/Security/Referrer) and see what suits your need.

<comment><USER22> I wonder if enabling referrer trimming by default on common browsers would force people willing to use tracking to reconsider their practices. Like everything (it seems) it is always a game of cat and mouse, and the best way to make it harder for trackers is to make sure the targets keep moving.

</comment></comment></comment><comment><USER23> Its funny to be reading this just a week after noticing this.

Every airline uses some sort of a contractor or a shared piece of software for online checkins. You can tell by the formed URI fragments and the JSON being sent back and forth.

Its all trash. I wanted to work on a business that unified all check-ins under single company. I do not think however, it is reasonable given that all of these airlines have the process, as shit as it is, for a reason.

<comment><USER24> That's not quite right. They all (mostly) do checkin with some combinination of PNR identifier, and last/first name. There's no actual collusion though. Just coincidental settling on the same minimum need.

They isn't much in common across airlines as far as the actual code goes, though. Beyond that they all use some limited set of CRS providers, like Galileo, Sabre, Amadeus, etc. That is to say, there's some common code, but it's pretty far down the stack, and only common across a few carriers.

One example: [https://www.nytimes.com/2017/09/28/business/airport-check- in...](https://www.nytimes.com/2017/09/28/business/airport-check-in- computer.html)

Hit several carriers, but not all by a long stretch.

</comment></comment><comment><USER25> That's pretty bad, but frankly he could have communicated better to Emirates. If I was working as first line support and received that message with _" omg do you know you are sharing fields a, b and c to partners. And maybe you are sharing with x, y and z also?"_, without any technical details at all, I would also give a canned response, tag it as tinfoil hat and throw it into the junk.

<comment><USER26> Exactly. Twitter isn't the medium to report this sort of problem. Ask for an email address for security vulnerabilities, and send it there.

<comment><AUTHOR> That was the first question I asked on Twitter support, to which they replied, I can report the issues here. [https://cdn- images-1.medium.com/max/1600/1*VvnWUPs8xnWRtH92M...](https://cdn- images-1.medium.com/max/1600/1*VvnWUPs8xnWRtH92MJ5MWA.png)

Again, I am more than happy to report it proper channels. I understand the reasons of ethically reporting such issues.

I would really appreciate it, can you help me find correct channel even now for Emirates, Lufthansa, KLM, Air-France ?

</comment></comment></comment><comment><USER27> In line with the age-old advice on how sausages are made, here's my advice: don't ever inspect the data leaving a mobile device.

– Just as I was about to add this comment, I remembered how it's not limited to mobile devices anymore.

(Thankfully with certificate pinning and integrity checking you may be spared of the risk of ever finding out what your apps actually do. Remember: only weirdos and terrorists tinker.)

<comment><USER18> Certificate pinning is going away: [http://www.zdnet.com/article/google- chrome-is-backing-away-f...](http://www.zdnet.com/article/google-chrome-is- backing-away-from-public-key-pinning-and-heres-why/)

I think we can be confident that sites that don't even use CSP won't be implementing Expect-CT any time.

<comment><USER28> HPKP is what the article you posted to is referring to, and probably will go away completely.

However, profiling the public key of the site a mobile app connects to and erroring out if it is compromised to prevent MitM attacks is called 'certificate pinning' for mobile apps but is not related to the HPKP pinning of browsers. A reference for certificate pinning: [https://blog.netspi.com/certificate-pinning-in-a-mobile- appl...](https://blog.netspi.com/certificate-pinning-in-a-mobile-application/)

<comment><USER18> It seems grandiose to call that 'certificate pinning' when it is just hard coding, e.g. a self-signed CA cert or (worse) a particular server cert.

Makes me suspect that a lot of client side validation is happening with mobile apps.

</comment></comment></comment></comment><comment><USER29> These magic URLs that can log you in automatically, generally ought to necessitate a very high degree of paranoia from whoever is implementing them. In this case the single point of failure seems like the leaky referrer, which ought to have been noticed as part of the aforementioned paranoia.

I guess the problem here is that from an overall experience POV you want users to be able to get to their booking from their email without having to go back and forth to figure out their booking reference number and type it in.

Even as an advanced user sometimes there is very little you can do to protect against this. In a lot of cases, blocking trackers is also a flaky solution because sometimes custom event tracking takes place as part of a JS event, and the event fails horribly due to the library not being loaded thanks to your blocker, and as a result the event doesn't do what it's supposed to, and you can't use the interface.

For mobile users, blockers are either not easy to install, or exist on some fringe browser that is untested, and breaks the UI.

I wonder if it is possible to measure or guess how many humans have access to your booking in such cases. Some part of the sysadmin team at each of those tracking companies, maybe product leads, customer support?

<comment><USER30> Installing uBlock Origin on mobile Firefox is trivial.

<comment><USER31> You will still hit the same problems they described for some sites. Because some JS has been blocked by your blocker, certain websites will have buttons that just don't work. This is frustrating when those buttons are key things like 'buy' or 'confirm'.

<comment><USER32> Then those sites do not deserve your business

<comment><USER29> I agree with the sentiment but it's not always possible.

In the case of airlines, sometimes you have no choice but to go with a particular carrier because there is no other carrier who will take you to your destination with seats available that meet your schedule.

You also wouldn't know of these practices until much after you have already paid for your ticket, by which time your booking is already in the hands of a few hundred other "trusted third party" employees.

</comment></comment></comment></comment></comment><comment><USER33> Emirates.com has changed a lot in the 18 years since I last worked on it. But I can see how this might have come about.

Each 3rd party add-on is probably required by marketing in one form or another (analytics, social sharing, partner data, advertising, ). And possibly development has been done just thinking about how to do something, rather than if they should be doing something. We don't know what the gatekeepers have managed to prevent getting deployed...

Part of how I see my role is to always to have a product-owner sanity-check hat on. But at the end of the day, it's the people with the wallets who decide what gets included in their outcome, even if it's against the recommendations of experts.

Commercial reality sometimes trumps common sense.

<comment><USER34> Absolutely agree with you, having been a digital marketer and later Product Manager for an Airline, I realized the ill-effects of mindlessly using tools to "crack" the secret sauce of heightened UX and hence increased revenue stream. Would I do it today? No. Would a CMO push for third party trackers? Hell, Yes. The onus lies on CTO to evaluate products, third party tools against a checklist that also covers User-Data protection as one of the bullet points.

</comment></comment><comment><USER35> Hmm, no mention of luggage tags or boarding passes? Your luggage tag usually has your last name and your booking code. Those 2 bits of information are enough to login to your flight details, including your passport information. They are also on your boarding pass, also coded on the barcode, which people sometimes post online, it can also be photographed from a distance with a good enough camera.

<comment><USER36> FTA: Every single passenger's info is readable by a list of 20+ domains that are not Emirates.

That's quite different from having to put physical eyeballs on a luggage tag.

</comment></comment><comment><USER37> Airlines don't care about privacy, security, user experience, prices... There are many things you don't have to care about when competition is low and barriers to entry are incredibly high.

As an aside, turns out 9/10 decoy bombs and bladed weapons are smuggled onboard with no problems in tests. All the security theatre and voodoo rituals requiring passengers to switch off all electronic devices for no actual reasons and it's still trivial to hijack a plane.

<comment><USER38> Airlines aren't responsible for security. The rules are specified by the IATA and national agencies and security is either handled by a government department (e.g. TSA) or by the airport itself.

Also, switching off electronic devices has nothing to do with security. The apparent reason is that it can cause issues with navigation, as was theorised after a plane crash in the 90's. Most flights these days don't even require you to turn your electronics off, or even put it in airplane mode.

I'm fairly sure the reason that they made you turn your electronics off wasn't even for the plane, but rather to ensure that you pay attention to the safety briefing.

<comment><USER39> It's not just that. It's the airlines' means for complying with a specific federal law as well.

[https://www.law.cornell.edu/cfr/text/14/91.21](https://www.law.cornell.edu/cfr/text/14/91.21)

The reason that different airlines have different rules, is that their OpSpecs have different (and sometimes evolving) treatment on portable electronic devices, which is their way, as operators, of complying with § 91.21

(shared because I suspect some will find it interesting in a random-trivia sort of way, not because I'm arguing against your post)

<comment><USER40> Yes, and I would add some (hopefully) "common sense" consideration.

IF you were a captain, responsible for a several millions dollar aircraft and for hundreds of lives, AND IF there was a teeny-tiny, extremely low probability that using a phone (or computer or other electronic device) could cause a disaster, including the possibility of a suicide act of sabotage, how would you implement in practice the Federal Rule you cited?

1) Kindly ask the passengers to have the devices switched off.

2) Seize each and every such device before boarding, and X-ray/scan each and every passengers to be 100% sure that they don't carry with them one (hidden).

<comment><USER39> #1 clearly, or perhaps switched off below 10K feet MSL.

Try #2 and you find yourself unemployed as a captain. Try it as an airline and you find yourself without passengers and shortly, without an airline.

Airlines and aviation authorities balance safety, cost, and convenience all the time. ETOPS is a good example of that balance evolving. ETOPS-240 would have been unthinkable at the start of the jet age.

</comment></comment></comment></comment></comment><comment><USER41> This should not be a surpise. Most business types don't give a shit about anything but money. Community, social, environment, or any other negative externaliaities. They just don't care. They're after and bound to "feduciary" responsiblity. (Short term reward and ignoring long term consequences)

I realize that was a moral high horse: I'm curious about how you can reward people for positive long term growth.

<comment><USER42> It turns out that people in general buy airline tickets based almost exclusively on price. Airlines are actually showing very long term thinking given that they have very high capital costs and need to make those investments pay off in the very long run. People are rewarded in the long term with profit because they have built a business that their customers want to patronize.

Even as a very technically savvy person I am not sure I would stop flying an airline because of this. While I agree these are awful practices would I be willing to do an extra hop with an airline that had better security? Nope. So while I sympathize with the article if Emirates was my main airline I would probably still fly them. It turns out many companies suck at securing their customers data. If that is important to their customers they will be reward/punished accordingly.

Ironically this is one of the reasons I prefer to buy things online through Amazon and why I think they have 50% market share. They are a trusted counterparty to my transactions and I would rather buy something through them than a small companies website.

<comment><USER43> > It turns out that people in general buy airline tickets based almost > exclusively on price

> They are a trusted counterparty

This is interesting, and I agree. But while I'm a big fan of quality and think there's many cases where not buying the cheapest is a good more in general, I find it hard to justify with airlines.

The quality varies wildly now, and reward programs are getting more and more meaningless - often they're even pointless because you simply can't fly to that airport with a carrier in your airline alliance, or they offer a way more inconvenient flight.

Sometimes, business class is only marginally better than economy (same seats, more legroom), but you couldn't tell from the cost. There are only very few airlines where business class is consistent. Why do I need to know what type of plane it is to know what business class seating is going to look like? The difference between business and first class is similarly vague. Sometimes it's worlds apart, others it's a slightly larger screen.

So why take the chance for airlines that aren't Singapore/Thai/ANA (to name my favourites)? Just buy the cheapest flight, brave it, and take some unpaid vacation and maybe a massage with the money you saved to make up for the horrible experience.

The only constant is flying sucks, and will suck a lot more if you can't avoid the USA. (Although the major US airports are such a shitshow that paying more to arrive/depart at a smaller airport could be worth it time-wise.)

</comment></comment></comment><comment><USER44> Although I completely agree with the article, I think it's putting the bar a bit too low to expect individual privacy from a UAE based company, when they have little regard for even the basics of Human Rights[1].

[1]: [https://en.wikipedia.org/wiki/Human_rights_in_the_United_Ara...](https://en.wikipedia.org/wiki/Human_rights_in_the_United_Arab_Emirates)

<comment><USER45> Ok, how about Paypal?

[https://twitter.com/Adys/status/943346017608585216](https://twitter.com/Adys/status/943346017608585216)

<comment><USER32> PayPal is an awful company. If they went out of business tomorrow the world would be a better place.

<comment><USER46> [https://news.ycombinator.com/item?id=16279017](https://news.ycombinator.com/item?id=16279017)

</comment></comment></comment></comment><comment><USER47> Nothing will happen until a malicious party ends up cancelling an entire flight's worth of passengers and it starts costing them serious money and reputation.

It's a sad state of affairs when there is no ethical way to correct certain grossly unethical business practices.

<comment><USER48> > malicious party

Which one? Google, Twitter, Facebook, Microsoft, Yahoo, Crazy Egg, Criteo or NSA listening on the wire?

My apologies if you disagree, but I feel that the article is borderline alarmist and I believe is written in the worst possible tone to communicate the problem.

Yup, there is a shitton of analytics products. Yes, PII is leaked and this needs to be fixed. But, no, it's not like listed parties (BTW, of which ek.aero is Emirates' own domain) are immediate threats. However, yes, this is quite severe as there are many scenarios when the data would eventually land in the wrong hands. E.g. if it would not considered sensitive PII anymore but treated as "just some analytics/statistics".

Basically, he should have patiently communicated that despite the trust in big analytic companies, private personal information still gets sent to them (mostly indirectly - in form of session links), and this may lead to accidental security leaks. Like, for example, some subcontractor having access to "only" analytics would technically have access to much more data than they are expected to have.

The article fails to do this and instead screams what's essentially boils down to "Google Analytics sees a link to the page with my passport details!". Color me surprised the support reply was not helpful at all.

<comment><USER49> You missed the part where it's unencrypted HTTP traffic. So, any 'malicious party' sitting at a café with free wifi.

<comment><USER48> So did the message to the support, screenshotted in the article.

And it's not just "any party sitting at a cafe". It specifically requires that this malicious party is sitting in the same cafe, present (physically or remotely) at the moment the site is accessed. So it's more likely to be an airport's WiFi network - which is much more probably place where an unsuspecting traveler may access such page. Hunting for a cafe with someone buying tickets from a specific airline is probably too complicated to pay off, unless the attack is personal.

Anyway, I don't argue this is all very bad. It is. What I want to say is that the problem was communicated in a very poor way. And even this follow-up blog article is so light on details, a person without some security knowledge would quite likely shrug it off with an impression it's some tinfoil-hatter screaming at analytics trackers.

</comment></comment></comment></comment><comment><USER50> One funny thing is that Emirates makes it look like they do care about security by implementing a surprisingly onerous Captcha requirement before Skywards login. I usually get it wrong a couple of times before I can get to my account -- lots of 6s that might be Gs, partially obfuscated 8s that might be 3s, etc.

</comment><comment><USER51> It's technical incompetence. Emirates is a fantastic airline that treats people very well. Of course this doesn't have anything to with well engineered IT systems.

<comment><AUTHOR> Failure to accept and acknowledge these issues needs to be sorted out.Unless these issues are treated as a technical priority, organisations will have a huge impact on service delivery issues sooner or later.

</comment></comment><comment><USER52> Browsers need to take a hardline stance on external content and stop allowing pages to load anything whatsoever from external domains. But they won't, becuase one of them is Google.

<comment><USER53> So in addition to explaining to your parents what an SSL cert is you want to explain to them which domains should be whitelisted and which shouldn't?

<comment><USER52> What does this have to do with my comment?

</comment></comment></comment><comment><USER54> Has anyone heard of an exploit that sets people's flights to use the attackers frequent flyer number, thus collecting their miles?

<comment><USER55> No, because in most cases the program requires the passenger's name to match the FF account name.

<comment><USER56> a lot of FF programmes allow transferring of miles

</comment></comment></comment><comment><USER57> i wonder how GDPR will affect this sort of issue.

<comment><USER58> In this case, the airline would have to get explicit consent for sharing the user's personal data with third parties. So at the very least, it will increase transparency. Post-GDPR, in the event of negligence, organizations like [https://noyb.eu/](https://noyb.eu/) will become more relevant as mediums for collective action in the form of class action suits.

EDIT: (Addendum) - The user would also have the right to ask the first party (airline) to "require" third parties it has shared personal data with, to delete them. Enforcing this however, will be hard.

</comment></comment><comment><USER59> it raises a larger question in the industry such as what kind of internal protection do companies such as "Amadeus IT Group" have in place to prevent employees from sifting through passengers etix[¹] booking data?

I had the opportunity to witness a data-scientist being able to tap into life itinerary data-stream, set up listeners and filter out anything they liked.

¹ [https://en.wikipedia.org/wiki/Etix](https://en.wikipedia.org/wiki/Etix)

<comment><USER34> Having worked with Amadeus IT products for airlines, I can tell you this - they are the most regressive "IT" products available in the world.

</comment></comment><comment><USER60> How does one see what redirects you are being sent through?

Can someone explain how I'd see all those issues that he mentioned? Just through Inspector in Firefox, or other tools?

<comment><AUTHOR> Inspect element is a good place to start. I would suggest the following approach:

1\. Open a new tab. 2\. Right click inspect element and check the option to preserve logs. 3\. Copy and paste the link which you want to check, 4\. Preserve log will keep all the re-directions.

and you can then inspect what the website is upto.

There are more tools, which help you debug traffic outside browser like [https://mitmproxy.org](https://mitmproxy.org), Wireshark etc, but I think Inspect Element should be enough to help you reproduce the scenarios mentioned in the article.

</comment></comment><comment><USER61> airlines regularly transmit PNR info to third parties with no crypto at all, sadly, it is their default industry standard.

[https://en.wikipedia.org/wiki/Passenger_name_record](https://en.wikipedia.org/wiki/Passenger_name_record)

the entire airline industry runs on software that is about 25-30 years behind the state of the art.

</comment><comment><AUTHOR> Updates:

\- March 6th, 2018:

Emirates responded with a standard statement.

Excerpt: "The depiction in Mr Modi's article as to what data is being shared, or customer choice in 'opting out' is inaccurate."

Here is my response: [https://news.ycombinator.com/item?id=16532591](https://news.ycombinator.com/item?id=16532591)

</comment><comment><USER62> I can easily see how this happened - Product deems that requiring a login for that page is too high a barrier and bad for business. Engineering thinks that "it ain't so bad" since said links have a difficult to guess uuid; but of course forgot about or didn't consider all the trackers that Marketing setup.

</comment><comment><USER63> How do Expedia, Travelocity, etc. compare with airline booking sites?

<comment><AUTHOR> Lot of the e-commerce sites are bound to similar leaks. I remember reporting similar issues to MakeMytrip.com, Expedia last year, MakeMyTrip.com was prompt enough to fix these issues. Sadly, never go any response from Expedia so not sure if they fixed the issues or not.

</comment></comment><comment><USER64> To what degree can products like Privacy Badger, and uBlock, help with this sort of invasion?

</comment><comment><USER65> > This issue is not only limited to Emirates, a lot of airlines like > Lufthansa, KLM (last checked on October 2017) suffer from the same issues.

Still, god bless Emirates. Hands down, best airline.

<comment><USER66> One story of my life: I was scheduled for a flight Singapore -> Frankfurt and wanted to avoid sitting next to a colleague. Asked at check-in the lady who was sitting next to me and got the names without hesitation. On the flight back from Frankfurt, I could not confirm the names due to privacy laws. I suppose it is a question of awareness and local practices.

</comment></comment><comment><USER67> What is the definition of privacy?</comment>


7 Recurring Revenue Recipes for Freelancers - <AUTHOR> http://ryancastillo.org/7-recipes-recurring-revenue/

<comment><USER2> How to generate recurring revenue:

Step one, buy his book

Step two, write your own book

Step three, list your book for sell on hacker news

<comment><AUTHOR> I get what you're saying. HN is known as a place to generate traffic for your product. After all, that's why I posted it here.</comment></comment>


Millions of Binaries Later: A Look into Linux Hardening in the Wild - <AUTHOR> https://capsule8.com/blog/millions-of-binaries-later-a-look-into-linux-hardening-in-the-wild/ <comment><USER3> I'm actually surprised that Mac, Windows, and Linux are not way more locked down by default by now.

We see the problem on Android and iOS often have binaries doing bad things (spying if not worse). Often it's not the app developer themselves it's some library they included.

Then we have stay Steam users (maybe that's mostly Windows) but basically every game they download could be installing anything, reading anything. Root kit, key logger, network monitor, sending your private keys somewhere, reading your email database, downloading your documents. There is absolutely nothing stopping that at the moment except trust. A few games have already been caught spying by using 3rd party libraries.

Mac has appeared (not a security expert) to have gotten slightly better as of Mojave. Several folders in ~/Library are not readable by default and permission is given per App. (type ls ~/Library/Mail).

But basically I think I'd like things to be way more locked down by default (with of course ways to open it up per app). I'd like to be able to run an app (not just an App store app but any app) and be relatively sure it can't do anything bad. That includes command line apps. I wish every app was run in a sandbox. I'd like to able to run any app or script and know it's not uploading ~/.ssh/id_rsa for example.

<comment><USER4> > I'd like to be able to run an app (not just an App store app but any app) > and be relatively sure it can't do anything bad.

Mac application sandboxing is independent of the App Store. There's no reason third parties can't ship applications from their own websites that use the sandbox.

The reason that many don't is that the sandbox tends to be so restrictive to even common and reasonable tasks that it often makes the UI noticeably worse.

<comment><USER3> Apps opting in to security is an oxymoronic idea

I get the restrictions are severe. I think work should be done to fix that rather than give up and just have everything be massively insecure by default.

</comment></comment></comment><comment><USER5> Odd that Fedora isn't even mentioned at all-- at least in the past it has been one of the first to adopt mitigation techniques distribution wide.

</comment><comment><USER6> I'll take advantage of this thread to ask a related question : do you consider address sanitizers (ASAN) should be applied to harden binaries (on release builds) ? It indeed has a cost but can detect and crash on use after free or out of bounds access. Would you think the price can be worth it in certain cases ?

<comment><USER7> I asked that question myself before[1], and others, too [2].

But the answer is a clear no. Read this explanation [3] on oss-security where someone lays out in detail in which ways ASAN _creates_ security problems.

It ultimately is just not built as a protection mechansim, but as a debugging tool. While you'd catch some bugs (UAFs, Buffer overreads), you introduce others.

Maybe there could be a "like asan but designed for production" tool. I think Softbound-CETS was trying to go in that direction, but never became production ready and is as far as I know no longer developed. But right now such a tool does not exist.

Though however what absolutely should be done: Every C/C++-written tool should be tested with ASAN. This doesn't happen (not a single Linux distro uses ASAN testing as a default practice before adding packages), and this is very sad. (I know this because I still find major packages that have ASAN-findable bugs exposed by their own test suite.)

[1] [https://blog.hboeck.de/archives/879-Safer-use-of-C-code- runn...](https://blog.hboeck.de/archives/879-Safer-use-of-C-code-running- Gentoo-with-Address-Sanitizer.html)

[2] [https://scarybeastsecurity.blogspot.com/2014/09/using- asan-a...](https://scarybeastsecurity.blogspot.com/2014/09/using-asan-as- protection.html)

[3] [https://www.openwall.com/lists/oss- security/2016/02/17/9](https://www.openwall.com/lists/oss- security/2016/02/17/9)

<comment><USER8> Although having a Linux kernel is an implementation detail on Android, and they might as well replace it by something else tomorrow, it is probably the only use case where the Linux kernel gets deployed in the wild with most security knobs turned on.

SELinux, seccomp, CFI, libc with FORTIFY, forced initialization of kernel data structures, ASAN as required testing, ...

[https://source.android.com/devices/tech/debug/fuzz- sanitize](https://source.android.com/devices/tech/debug/fuzz-sanitize)

[https://source.android.com/security](https://source.android.com/security)

And it might very well be the only OS stack following up Solaris and iOS footsteps, regarding using hardware memory tagging to tame C.

<comment><USER6> That could be read as : even the most secure Linux environment currently and what could be seen as security best practice ( which your post helpfully enumerates ) requires asan for testing _only_.

<comment><USER8> Yep, which is kind of ironic given the security jokes against other platforms, which I am also to blame on my zealotry days.

At least it reached the point that now more kernel devs are willing to accept the old grsecurity improvements.

</comment></comment></comment></comment></comment><comment><USER9> This is an excellent article with a lot of original research instead of the typical security guides that I see that are pretty much copy paste jobs (look up anything about Apache HTTPD for a very good example of that).

A couple of things about Linux security that really hinder ppl / I don't think are promoted enough:

\- People forget to secure VIM. Even if you've secured everything, very easy to use the built in mini-shell in VIM to move to the actual shell.

\- Look at / focus on your SSH key fingerprints. These things matter. I didn't pay attention to these things nearly as much as I should have the first two years of my career, but it's so easy to just intercept your request, grab your private key, and then just pass you on to your regular server _without you even knowing_.

\- Please please secure your web servers. The default configuration can be very difficult to argue is secure, e.g. the fact that every web server reveals out of the box the exact semver of the Apache/Nginx or the lack of automatic HTTPS redirection that would be useful for 90% of modern deployments. Check out Caddy which helps with some of this.

<comment><USER10> Your private key is not sent to the ssh server. They could do something else nasty like collect keystrokes from your session on the fake server though.

<comment><USER11> More specifically:

Out of the box your SSH client will only use its private key to prove that it knows the key (it signs a message specific to the SSH connection) during login.

I think this is properly designed so that a bad guy can't live proxy it - <USER2> the bad guy gives a victim parameters the bad guy can decrypt those don't match on a real server; if they use the real parameters they're no longer able to read the session so why bother.

For environments where you want proxy behaviour (e.g. "jumpboxes") you can tell the client to volunteer to sign on behalf of further clients down the chain. Bad guys could use that but they still don't get the actual key so they must conduct any attack live, and clients could tell you about or even ask you to explicitly authorise every such request.</comment></comment></comment>


Amazon confirms it has dropped device encryption support for its Fire Tablets - <AUTHOR> http://techcrunch.com/2016/03/04/amazon-confirms-it-has-dropped-device-encryption-for-its-fire-tablets/ <comment><USER2> Yesterday's discussion here: [https://news.ycombinator.com/item?id=11218427](https://news.ycombinator.com/item?id=11218427)

</comment><comment><USER3> Full disk encryption isn't really that much of a big deal for the average user on a lot of modern mobile SoCs. The messaging of this is a lot worse than the security implication in practice.

Full disk encryption doesn't protect you against most 'normal' security attacks like privilege escalation, because once an attacker has gained that privilege they can read any data off the mounted encrypted file-system.

The way FDE works is that you're encrypting the blocks stored on the physical storage eMMC[1], so if someone gets their hands on your device and physically tampers with it, in theory, with enough skill and fiddly soldering and wiring to an SD card adapter you could access the data.

However, many SoCs stack the eMMC on top of the application processor directly, look up package on package or "POP". This means you can't even access any pins to wire up an adapter without "extremely" specialized equipment. We're talking about slicing a layer off the chip package without damaging it.

[1]I've left out physical SDcards because until recently there was no facility to encrypt you data in a cross platform compatible way on these devices. Android treats SDcards as plain unencryted FAT/exFAT storage by default anyway.

</comment><comment><USER4> Hopefully the market reacts accordingly.

It can be hard to gauge public opinion from the HN echo chamber, but the apple case is causing national awareness of this important issue. The real question is: will consumers make decisions in the next 6, 12, 24 months based on the information they hear about these devices? I'd like to say yes, but i suspect the answer is no.

<comment><USER5> Fire tablets are $50 devices tied to Amazon accounts that people buy so their children can watch videos on a borderline-disposable device.

Tell me where encryption fits into that use case.

<comment><USER6> Whereever the user wants it to. You're essentially saying the users of those tablets shouldn't be able to protect them just because you can't see a usecase beyond "only children are using it".

<comment><USER5> There are lots of other tablets. The Fire Tablet team has a finite amount of developer time to build features for their target users. Encryption is clearly not a feature they feel it's worth working on.

With security features it's probably better to drop them rather than implement them poorly.

<comment><USER7> FireOS is a heavily skinned Android. That's it. Supporting it is free as FDE is built into Android.

As someone else said, this is probably becauase their hardware is somewhat lacklustre (it's a $50 tablet, after all) and therefore the performance hit was hurting the end user experience to an unacceptable level.

</comment></comment></comment></comment></comment><comment><USER8> Meh. For me this is such a non-issue. While very privacy-conscious in general, since my very bad experience with an encrypted backup drive, a lost password/passphrase, and losing 2 years of data/photos as a result, I've cooled on full-device encryption.

Sure, it's preventable, and it was my own stupid fault, but I bet it happens to a lot of people and it caused them, and Amazon, more heartache than the added level of 'security' encryption would provide. "What do you mean, you can't retrieve my data? You made this thing! Can't you reset the password?"

<comment><USER9> This isn't a bad point. It's also worth noting that as a whole android hasn't been the most secure, and fde only works while the phone is off or storage is unmounted which may be important for some but most average users don't really ever turn the devices off. So if you're running fde and you get a stage fright driveby, it's fornaught.

Making a device more secure when it's off has marginal utility to most customers that aren't on hacker news. And those customers probably don't outweigh the support issues associated with FDE for everyone.

</comment></comment><comment><USER10> Meanwhile (I posted 3hrs ago but it got no traction)

[https://news.ycombinator.com/item?id=11223185](https://news.ycombinator.com/item?id=11223185) [http://www.thelocal.fr/20160304/french-mps-back-fines-for- ap...](http://www.thelocal.fr/20160304/french-mps-back-fines-for-apple-unless- it-unlocks-phones)

> French parliamentary deputies, defying government wishes, on Thursday voted > in favour of penalising smartphone makers who fail to cooperate in terrorism > inquiries

</comment><comment><USER11> > Claiming users weren't using the encryption feature, and therefore that > encryption is unnecessary, is of course a disingenuous argument on Amazon's > part. Users also hate using strong passwords — is Amazon going to encourage > users to ditch those too?

I think it's TechCrunch that's being disingenuous here. Disk encryption is a feature, and has performance, maintenance and UX costs, unlike allowing strong passwords.

</comment><comment><USER12> Since this is now front page and last night's thread on this has fallen off, I'll repost what I said there, supporting the theory that encryption might actually have been turned off for performance:

People unfamiliar with full-device encryption on Android devices need to be aware of the following: until Marshmallow, it was _SLOW_. It was so bad that while Google recommended turning on encryption by default on Lollipop, they had to back off of the recommendation because full-disk encryption made the devices run like crap. [0] The reason suspected for this is that up to and including Lollipop, Android handsets did not support hardware-backed encryption/decryption, which meant it all had to be done in software.[1] This had the end result of putting huge overhead onto the device once FDE was turned on, and over time its performance would continue to degrade. Anecdotally, I tried encrypting my HTC One M7 a few years ago when it was my daily driver, and I eventually I had to factory wipe the damn thing to turn it off. The overhead with encryption on got _so_ bad that I would periodically turn on the screen, and it would take so long for the phone to respond that the auto-idle would turn the screen back off before I was even presented with a lockscreen!

The M7's specs were top shelf in 2013. Given the limited specs of Amazon's cheaper tablets, I would not be surprised if encrypting them could slow them down further to the point of being unusable.

[0] [http://www.androidpolice.com/2014/11/20/anandtech-posts- side...](http://www.androidpolice.com/2014/11/20/anandtech-posts-side-by-side- nand-performance-for-nexus-6-encrypted-vs-unencrypted-its-not-pretty/) [1] [http://www.androidpolice.com/2014/11/20/anandtech-posts- side...](http://www.androidpolice.com/2014/11/20/anandtech-posts-side..).

EDIT: Removed the aside, since I was mistaken that the Kindle reader OS's were affected.

<comment><USER13> What I find quite strange is why no Android device seems to use a dedicated hardware encryption module to reduce overhead like iPhones have had since the 3GS. Even security-focused devices like the Blackphone are crippled by the lack of crypto acceleration ([http://arstechnica.com/gadgets/2015/09/paranoid- android-redu...](http://arstechnica.com/gadgets/2015/09/paranoid-android- redux-going-dark-with-silent-circles-blackphone-2/)). In comparison, iDevices are screaming fast even when fully encrypted (take a look at the storage numbers here [http://www.anandtech.com/show/9686/the-apple- iphone-6s-and-i...](http://www.anandtech.com/show/9686/the-apple- iphone-6s-and-iphone-6s-plus-review/7)).

<comment><USER14> Is there a source to confirm iPhone is equipped with HSM? One theory is the low-end devices want to reduce cost, and furthermore, Android devices are manufactured and sold by more than one company. But you can argue the weakest will eventually participate or die.

<comment><USER15> There are more details on the HSM in the iOS security guide here. [https://www.apple.com/business/docs/iOS_Security_Guide.pdf](https://www.apple.com/business/docs/iOS_Security_Guide.pdf)

<comment><USER14> This is HSM on the iPhone itself, or on the cloud side?

<comment><USER16> The phone itself. All of the encryption is done in hardware, not just for performance, but for resistance against physical attacks. The dedicated processor is nothing short of Fort-Knox-like if that paper is to be believed fully.</comment></comment></comment></comment></comment></comment>


Official launch of the Top 100 Australian Web 2.0 Applications - <AUTHOR> http://rossdawsonblog.com/weblog/archives/2008/06/official_launch.html <comment><USER2> It's great to see some Aussie startups!

I'll have to go pick up a copy of the BRW magazine. Thanks for the link. :D</comment>


X.com - <AUTHOR> http://x.com <comment><USER2> A great throwback to the nicer and simpler web of the 90s that so many of us grew up loving. Informative, no-nonsense content, fast loading even on a 28kbps modem, no BS tracking and analytics and ads and popups.

<comment><USER3> I just finished a project where I tried to fulfill those ideals, but it still comes in at around 200kb.

</comment></comment><comment><USER4> [https://en.wikipedia.org/wiki/X.com](https://en.wikipedia.org/wiki/X.com)

</comment><comment><USER5> There are two validation errors in the source! [https://validator.w3.org/check?uri=http%3A%2F%2Fx.com%2F&cha...](https://validator.w3.org/check?uri=http%3A%2F%2Fx.com%2F&charset=%28detect+automatically%29&doctype=Inline&group=0)

</comment><comment><USER6> Interesting header:

> Vary:User-Agent

Maybe it's a clue to hidden content...

<comment><USER7> Vary: User-Agent header, caching servers should consider the user agent when deciding whether to serve the page from cache. [1]

[1] [https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Va...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Vary)

</comment></comment><comment><USER8> super fast load times.

<comment><USER9> ( ͡° ͜ʖ ͡°)

</comment></comment><comment><USER10> Best thing I've ever seen on HN.

</comment><comment><USER11> See also [http://www.something.com/](http://www.something.com/)

<comment><USER12> That was quite a something...

</comment></comment><comment><USER13> Didn't this used to be owned by PayPal?

<comment><USER13> ooh

From Wikipedia: On July 5, 2017 Elon Musk repurchased the domain name X.com from PayPal.[5][6] On 14 July 2017, Musk announced the "launch of x.com" on Twitter.[7] When the page launch it consisted of a blank white page with one "x" in the top left corner.[8]

<comment><USER14> Someone on Twitter suggested he use x.com as his Alphabet type of holding company, and he agreed that might be the best idea for it.

<comment><USER15> Sounded [0] more like a suggestion to use it as a list of companies he's involved in, not a company by itself...

[0]: [https://twitter.com/jondaily83/status/884689301002362880](https://twitter.com/jondaily83/status/884689301002362880)

</comment></comment></comment></comment><comment><USER16> It seems there's an open opportunity: single letter domain names see only very limited use.

I've just scanned through, and only x.com, q.com, and z.com resolved. q.com redirects to a centurylink setup page, and z.com is a japanese media group.

</comment><comment><USER17> This piece is interesting. Reminds me of a little of endless.horse from a couple years back.

[https://news.ycombinator.com/item?id=9558687](https://news.ycombinator.com/item?id=9558687)

</comment><comment><USER18> Money well spent.

</comment><comment><USER19> This was the name of Elon Musk's banking startup which later merged with PayPal. Elon acquired the domain recently, though we don't know what he will use it for.

</comment><comment><USER20> Why's Elon using godaddy

<comment><USER21> Damn good point. Seems like the ideals don't match up.

</comment></comment><comment><USER22> Chrome no likey the SSL cert

</comment><comment><USER23> X marks the spot.

</comment><comment><USER24> Rhishi?</comment>


Basic Mach-O binary parser - <AUTHOR> https://github.com/afrighetto/Mach-O/blob/master/main.c <comment><USER2> HN is funny sometimes. A 50-line C file that reads a Mach-O header hits the front page, but last week my new tool for reading ELF/Mach-O binaries and showing size profiles didn't. ([http://blog.reverberate.org/2016/11/07/introducing-bloaty- mc...](http://blog.reverberate.org/2016/11/07/introducing-bloaty- mcbloatface.html)) Oh well, c'est la vie. :)

FWIW, here is the ELF parser from Bloaty; I'm happy with how it turned out (the first 400 lines are the ELF parser): [https://github.com/google/bloaty/blob/master/src/elf.cc](https://github.com/google/bloaty/blob/master/src/elf.cc)

<comment><AUTHOR> Surely I'm gonna look on it :)

</comment></comment><comment><USER3> This is a bit of an odd link. The linked file doesn't really do much of anything -- just opens it and checks to make sure the magic number is valid, essentially. The actual file reader is at [https://github.com/afrighetto/Mach-O/blob/master/parser/mach...](https://github.com/afrighetto/Mach-O/blob/master/parser/mach-o.c)

<comment><AUTHOR> Yeah, problem is I messed up with links.</comment></comment>