Facebook's Download-Your-Data Tool Is Incomplete - <AUTHOR> https://privacyinternational.org/long-read/3372/no-facebooks-not-telling-you-everything <comment><USER2> This is a topic that I'm intimately familiar with, thanks to a bizarre set of circumstances (and a ton of reverse engineering). Story above, technical details below:

Part 1:

A couple years ago, I noticed that the number of photos I was tagged in kept going up and down, as a couple of people I knew would disable their accounts occasionally, and re-enable them a couple weeks later.

I manually the images from them, but wanted a way to automatically scrape any images I was tagged in, so I wouldn't need to do this manually.

I got myself a Facebook Graph API key and created a sample app with full account permissions, only to discover that Facebook won't let you export photos you're tagged in (that you didn't take). The numbers the API reports are wrong, and there's no indication that it's being purposely redacted.

As a result, I wrote a tool that crawls a profile given a set of authenticated cookies, and essentially clicks the download link automatically on every photo. This worked decently well for a couple years, and continues to work to this day.

Part 2:

I had some spare time on my hands in December 2019, and wanted to write a tool to browse chat logs from across a variety of services (Facebook Chat, Hangouts, SMS), such that you'd be able to click a name and see a chronological discussion, regardless of what service it was on. I downloaded the Facebook data dump, figuring that was the easiest way to get access to my Messenger data.

The Messenger dump revealed a few things that surprised me: * The character encoding is messed up, and requires decoding as Latin1, then re-encoding as UTF-8

* Some messages are straight up missing, despite being in the UI. The dump is supposed to include attachments (images are included), but is missing audio messages / voice snippets, presumably among others.

* If a user has deleted their Facebook account, the username will appear solely as 'Facebook User', so now you need to figure out who you were actually talking to. Some conversations were very obvious, but others involved wasting a ton of time on and involved dumb techniques (like finding Adium logs of the same chat from an old computer).

To identify certain conversations, I started scrolling back through certain Facebook posts (which I wrote), to figure out who had been at certain events with me (to narrow things down). I read a bunch of comment threads that didn't appear to make much sense to me, until I realized that anyone who deletes their account also has their comments removed, so basically all old comment threads are somewhat nonsensical if anyone in the conversation has since deleted their account. For comparison, deleting a reddit account changes the ownership of a comment/post to [deleted], which seems much more appropriate.

Presumably wall posts (including happy birthday messages) from people who have since deleted their accounts are also removed, which is exceedingly shitty - if someone sends you a greeting card and then dies several years later, it's not like the post office comes to your house to take your cards back in the middle of the night.

Part 3:

Because of this, I figured that the only way to mitigate future data loss on Facebook is to consistently archive things. Since the 'download your data' tool is basically useless, I started work on a tool that scrapes the site and "decompiles" pages into raw directed graph DB rows, which can be re-rendered into a new version of the site. It features a reasonably complete implementation of Facebook's TAO ([https://www.facebook.com/notes/facebook- engineering/tao-the-...](https://www.facebook.com/notes/facebook- engineering/tao-the-power-of-the-graph/10151525983993920)) on top of PostgreSQL, and works decently well - notably, it also maintains things like proper links to profiles and stores all assets offline.

Writing a bug-compatible "decompiler"/"recompiler" taught me several things about how the site works (or rather, doesn't). Here's a small list of errata I've discovered along the way:

* Objects can have multiple FBIDs

* FBIDs can contain comments/reactions

* Since there may exist multiple FBIDs for a given object, it's quite common for multiple comment threads to exist for a given item, such that commenters on one don't see the responses on the other (and vice versa). Several of my friends have confirmed finding disjointed discussions on their posts after discovering this bug.

* Facebook has several types of deprecated reactions that they store in the DB, which cannot traditionally be viewed from the site anymore. Sucks to be you if you reacted to something that way.

* Certain objects can get lost in their UI, with no easy way to find them. Uploading a photo in a post will put it in your Timeline Photos album, but uploading a photo as a comment to someone else's post will basically make it impossible to find again.

* The number of reactions/comments on a given post is often wrong - this isn't the traditional bug due to eventual consistency, but rather is due to not adjusting the counts for items when a person deletes their account. To a certain degree, this will show you how many people that interacted on something have departed the site.

<comment><USER3> Please stop this. This is a huge violation of your friend's privacy. Just because a friend has shared something with you on facebook doesn't mean they expect it to be in someone's personal cambridge analytica forever.

<comment><USER2> I'd be curious to hear from other people with similar viewpoints, but I personally disagree. Cambridge Analytica was bad because it was a third party receiving data from others, and those people had zero reason to think that their data would ever be shared with a third party. In this case, all of the data I've obtained is either public, or was explicitly shared with me by those people in the first place. If you're arguing that I shouldn't be able to hold data that someone else wants removed, then I'd ask at what point we should be deleting your memories of events that someone else wants repressed.

To be clear, if I want to create the equivalent of a data-hoarder bunker, I don't think there's anything wrong with that. I do, however, agree that sharing things with people that couldn't see it themselves (expanding the original audience) isn't something anyone should ever do. I'd also like to point out that once someone removes something from Facebook (or any other service, for that matter), the authenticity of copies of that information is now debatable - I could scrape a bunch of stuff and show people, but you have no way of proving whether or not that information is authentic. For all you know, my script makes any posts%5 super racist.

<comment><USER3> People post on facebook assuming the privacy model of facebook, where _they_ have _revokable_ control of who sees what they share. What do you think your friends would say if you told them you're keeping a personal copy of their photos even if they try to delete them?

<comment><USER2> I've actually shown this project to several people with varying degrees of technical knowledge. The technical people have generally already considered the privacy implications of what they've shared on the internet, fully expecting most things to become public thanks to crappy code/policies. They're usually more interested in what a rewrite of TAO looks like, or how you decompile rendered frontend code back into accessible JSON.

As for the less technical people, they tend to be significantly more annoyed at Facebook when I tell them that their old comment threads / messages are likely incoherent junk.

</comment></comment></comment></comment></comment><comment><USER4> This is a semantics argument. Facebook considers "your data" things you uploaded to Facebook intentionally.

They do not consider "things people learned about you by watching you" or "things people said about you" your data, they consider it their (the watchers or speaker) data.

It's not all that different from how photography laws work in different countries. If someone takes a picture of you, is it their picture, or your picture?

EDIT: Im in agreement this doesn't match up with GDPR. Outside of Europe, facebook can treat "Your Data" differently, and the button can function differently in different places.

<comment><USER5> This is disingenuous.

If Alice wrote on Bob's wall, it should be a part of both Alice's and Bob's takeout. Similarly, if I am tagged in a photo, it should be a part of my takeout. Imagine if my email provider (Google Gmail) said you can only takeout the emails in your sent folder.

In fact, I'd argue if Alice has made their contact information (email, phone number, physical address) visible to Bob, it should be a part of Bob's takeout. Including Alice's location history (provided Alice shared it with Bob) would probably be pushing it a little but only because it becomes difficult to argue for people with whom too many people share data with but anything that Bob is explicitly and manually tagged and is visible to Bob on Facebook in should definitely be a part of Bob's download.

Facebook can't have it both ways: you can't make it easy (by default) to share and still use the data as a moat.

<comment><USER6> as basch said, that's not how copyright works in photography. If you're tagged in a photo as a subject of that photo, it is _not_ your photo, and if you take a copy of it then that's a breach of copyright. It belongs to the photographer.

Our expectations don't match with actual law here.

<comment><USER7> We're not talking about copyright, though - we're taking about privacy rights, and - even if we discard compelling fair use arguments - everyone who uses Facebook gives them a license to distribute the photos they upload to the site to others for various reasons. Copyright law doesn't really come into play, and of course much data involved here isn't even copyrightable.

<comment><USER4> its an analogy, im not bringing up copyright law as something that impacts the situation, its an illustration of a similar concept.

Some countries treat photography as copyright as the priority, others let privacy law take precedent.

</comment></comment></comment></comment></comment><comment><USER8> They have also made a very insidious change to their /ads/preferences page within the past month or two:

1\. Entries on the list of companies that have uploaded your contact information to Facebook cannot be blocked by simply clicking an 'x' on their name. You must click for "View Controls" and then click on two additional buttons to not allow them to target (or exclude) you.

2\. The list is in RANDOM order (as far as I, a user, can tell)

3\. There is no ability to distinguish between blocked and unblocked entries from the main page. Users must click into each entry to check the status.

4\. New entries are not highlighted or indicated in any way. Because of this, and combined with facts 2 & 3, users must now re-check each entry manually in order to be sure they are catching any new entries that arise.

I get new entries on a near-weekly basis despite now (but not in the past) using a dedicated Facebook-only email address and removing my phone number and all other identifying information from the site. Facebook is maintaining a shadow profile on me which includes data I scrubbed from my account and profile over a year ago, and they are still matching advertisers to my profile based on the scrubbed data. That scrubbed data DOES NOT appear in the "download your information" tool, either.

<comment><USER9> Lots of dark patterns in these interfaces. The Google one has an incredible amount of white space and drop downs to obscure content.

<comment><USER10> Are you talking about adssettings.google.com? That site is pretty good, it shows what it thinks you're interested in and turning them off is click -> turn off; plus the topics you've already turned off aren't part of the list of things it's currently targeting.

</comment></comment></comment><comment><USER11> SayIt's comment is very relevant so I'm sharing it here:

> _These companies are like online governments. They have a great deal of > influence over very many persons, and can affect their lives substantially. > But they are not democracies. They are totalitarian, with one person at the > head of the company able to make many powerful decisions unilaterally, if he > wishes. [...] Giving you some control over your data does not change the > fact that these are essentially digital dictatorships._

From: [https://www.schneier.com/blog/archives/2020/03/facebooks_dow...](https://www.schneier.com/blog/archives/2020/03/facebooks_downl.html#c6806851)

<comment><USER12> granted, but could you imagine not having one person at the head of the company? What a sh*tshow that'd be.

</comment></comment><comment><USER13> Original link [https://privacyinternational.org/long-read/3372/no- facebooks...](https://privacyinternational.org/long-read/3372/no-facebooks- not-telling-you-everything)

<comment><USER14> Changed to that from [https://www.schneier.com/blog/archives/2020/03/facebooks_dow...](https://www.schneier.com/blog/archives/2020/03/facebooks_downl.html). Thanks!

</comment></comment><comment><USER15> Does anyone know of tools that make it easier to browse and analyze the data downloaded from Facebook or Google (offline)? For example visualizing the location timeline, statistical analysis etc. This is something I have been looking for for a while. Both as a tool to analyze my behavior, and to better understand and communicate to others how much these companies know about us.

<comment><USER16> I've been building tools for this at [https://github.com/dogsheep](https://github.com/dogsheep)

The unifying idea is to convert data dumps from these kinds of companies into SQLite databases, then query and visualize them using [https://github.com/simonw/datasette](https://github.com/simonw/datasette) and [https://github.com/simonw/datasette- vega](https://github.com/simonw/datasette-vega)

</comment></comment><comment><USER17> After downloading my data, I've begun to worry not only that they know too much, but that what they 'know' about me is quite wrong.

<comment><USER11> > but that what they 'know' about me is quite wrong.

Isn't that a good thing?

<comment><USER18> When it's innocuous, such as Google thinking I'm interested in _women's_ fashion and showing me ads for women's clothing sites since I've indicated an interest in fashionable clothing, it's not a bad thing(this is actually what happens!). But imagine if Google's profile of me indicated an interest in something dark like fascism or racism, and they sold that data on which later resulted in me losing job opportunities or credit. That would be a really bad thing, because their highly inaccurate algorithm had a negative impact on my life.

The slippery slope is slippery because there are a lot of downward steps, not because there's one big step. Companies already buy your credit score and financials before deciding whether to hire you. Imagine if they bought your entire Google profile and used that too? It's about as accurate as a personality test and there's no way to dispute it.

It's worse than Social Credit Scores because Google doesn't even admit they have these profiles of you, yet they sell the data as accurate.

<comment><USER19> Do you believe that Google or Facebook sells personalized profiles of the form "jschwartzi is interested in tacos"?

Because that isn't how these companies work.

<comment><USER11> They might not right now, but they certainly could start doing so literally any day.

Also they can be compelled to legally hand over such data by governments.

Or it could be leaked due to a security vulnerability or rogue employee.

</comment></comment></comment></comment></comment><comment><USER20> And they do not comply with GDPR: [https://ruben.verborgh.org/facebook/#history](https://ruben.verborgh.org/facebook/#history)

<comment><USER21> That is both hilariously written and quite frustrating to read. Thank you for your perseverance and writing it up!

Is there an RSS feed or mailing list where updates are pushed to?</comment></comment>


At Amazon, the Bathroom is an Extension of the Office (2015) - <AUTHOR> https://motherboard.vice.com/en_us/article/mgbzbx/at-amazon-employees-treat-the-bathroom-as-an-extension-of-the-office <comment><USER2> For what it's worth, I was there for nearly 3 years (including when this article was written) and never saw that kind of bathroom behaviour. People seemed to follow the general unwritten rules. Conversations were rare, and where they did happen, the usual idle chatter that happens anywhere, while at the sink or waiting for a toilet to be available.

I _was_ there during one of the peaks in staff/toilet ratios. After getting rid of all of the 2 - 3 person offices and replacing it all with open plan office, and then packing us in even tighter (What they referred to as "high density" seating arrangements), actually getting to use a toilet was an extremely frustrating experience. With such a prominent gender bias, the male bathroom was constantly occupied, and a now infamous "toilet ticket" was cut ([https://www.geekwire.com/2015/amazon-employees-biggest- compl...](https://www.geekwire.com/2015/amazon-employees-biggest-complaint- not-enough-mens-bathrooms-for-all-the-dudes/)).

Eventually they relented, and as new office floor space was opened up in new buildings, they agreed to reduce staff density and set a more practical staff:toilet ratio, along with adding in an additional toilet on every floor.

side note: What would have really helped was if staff weren't selfishly spending 5-10 minutes sitting on the toilet browsing the internet or playing games on their phones. It rarely takes that long to do the necessary.

<comment><USER3> > the male bathroom was constantly occupied

I'm always surprised by this. Why not have unisex bathrooms? In most companies, I have worked the bathrooms are just one toilet and sink. That way anyone can use it.

> What would have really helped was if staff weren't selfishly spending 5-10 > minutes sitting on the toilet browsing the internet or playing games on > their phones.

I can't agree with that. Without actually knowing for sure (I will guess that you weren't looking at other people while they poo), you are blaming employees for the lack of toilets. But in the rest of your description, it looks like it's clearly the company that failed to offer the most basic needs. Timing your team workers bathroom times doesn't look like a good approach to solve the problem.

<comment><USER4> > In most companies, I have worked the bathrooms are just one toilet and sink. > That way anyone can use it.

it cost more this way?

All the companies I worked at in Chicago prime real state I can think of had gendered bathrooms, at least monthly. Common setup was 2 stalls 2 urinals and 2 sinks for the men (and I assume either 3 or 4 stalls for the ladies, depending on how tight they packed it).

My guess it would take the same space to make 2 single use bathrooms as a single bathroom with 2 stalls / 2 urinals / 2 sinks. The throughput of a 2 stall / 2 urinal bathroom for men would be about triple the single bathroom setup, depending on your exact pee to poop ratio.

And when you are counting dollars and cents, if a decision can save you from having another 600 square feet of bathroom space (at say $300 a squarefoot a year in lease), it can add up to some decent chunk of change (at perhaps the cost of some sanity).

<comment><USER5> By that rationale we should replace urinals with troughs & remove stall walls.

The model that makes the most sense to me is unisex small single rooms surrounding a set of sinks that can be shared. As long as you have kick plates on the doors you get similar size constraints, better privacy & queueing theory kicks in.

</comment></comment></comment></comment><comment><USER6> Suddenly various AWS services start making sense,

\- EBS : Elastic Bathroom Stalls

\- ACL : Active Coding in Loo

\- API Gateway : Always Poop Interactively ...

\- IoT : Inconvenient Office Toilets

The article is full of instances like :

> The most horrifying moment of my employment at Amazon was the time I was > using the toilet and a coworker began talking from the stall next to me. He > asked me why I had not responded to his very pressing email [...] What email > could be so important that it could not wait five minutes for me to use the > bathroom?

> ... He began tapping on the wall between our stalls ...

> I regularly saw people bring their laptops into the bathroom, where they > would sit on the toilet and write code

> I heard people take phone calls while mid-business

<comment><USER7> Why would anyone put up with that sort of madness? If my employer can't even let me shit in peace, I don't want to work for them. It's not like programming jobs are scarce...

<comment><USER4> Sounds like it was coworkers not the boss. And if you quit every job with an awful coworker, I am not sure you would have many jobs left ;)

<comment><USER7> Bosses tend to create (or encourage) this kind of behaviour. This is either an infrastructure or a management issue. If there aren't enough toilets, your infra sucks. If you need to discuss work while taking a dump, management sucks.

<comment><USER4> Sure, culture is part of this. But just an annoying guy talking to you in the crapper? Maybe can't blame that one...

</comment></comment></comment></comment></comment><comment><USER8> My friends who works at Amazon a while back this is 2009 and between that and now they've been saying don't work for Amazon. I kept in touch with the freshmen and such since I was president of ACM.

It also affect my spending habit on Amazon too.

Jeff Bezos have been quoted Kindness is a choice but the things I've read especially the warehouse condition is right. Kindness is a choice and it seems like Amazon chose to not to be kind.

I'm glad they're trying to fix their culture but sheesh. The article mentioned about competitiveness. He makes it out as if it is some cut throat thing. If I have a family do I need more undue stress from competition while worry about my kids and family needs? I mean do I need to suck up and watch my back from co workers on top of everything? That's a terrible place to work for.

Even if it's not necessary so that I have cut throat coworkers, I still have to compete against them while doing my job. That's insane. At least with Government some branches such as FDA you get raises base on the papers you publishes IIRC, you don't need to hurt people or compete against your peers.

</comment><comment><USER9> There was one company I worked at that, for whatever reason, people thought that the bathroom was a good place to have a phone call. Simple fix; when someone would start a phone call I would flush, and keep flushing every time they talked to make sure the person on the other end could hear it. I usually only took a few flushed for people to get the hint.

</comment><comment><USER10> After nytimes articles, Amazon seriously has started improving its culture. Managers though still have same mindset of treating employees as replaceable resources. This is one instance after the article came out. My pregnant friend one day sent an email that she would be WFH as she isn't feeling well. Manager replied back that this is not acceptable and you should give a week of notice for your plans.

This might be okay in other fields, but in tech WFH is considered a perk and companies don't care as long as you do your work.

<comment><USER11> Minimum notices for WFH days baffles me.

I can understand making it a policy to limit WFH days to a very minimum, but the idea of a notice period for WFH makes no sense to me.

It makes people more unproductive then they really have to be.

<comment><USER12> I've made the choice to never work for a company that doesn't let me work from home whenever I want.

</comment></comment></comment><comment><USER13> I've been with Amazon for four years and have never once seen or heard of someone taking their laptop to the bathroom. I have difficulty believing that's true.

He's right about not enough bathrooms, though. It's _really_ fucking annoying.

<comment><USER14> As a counterpoint, I worked there for 6 years until 2013, and I saw it happen a few times at the SLU campus.

</comment></comment><comment><USER15> Okay it's kind of silly to still conduct business in the restroom but why do people freak out when someone speaks in the restroom? Like, relax. Take it easy.

</comment><comment><USER16> I'm curious to know what team/organization the OP was from. Because of how massive Amazon is, every team interacts with each other differently. For example, the org that houses Amazon Go is much more high stress, and I can imagine this happening there v/s a team working on building internal systems. I've been at Amazon for 5 years now, and have never experienced whatever the post said. I have, however, been in the uncomfortable situation where a colleague has tried to talk to me in the urinal about things outside of work.

Funny read though :)

</comment><comment><USER17> I work for AWS since 2014 and I am in a building that arguably has highest density compared to other Amazon buildings. I have not seen a single instance of what the author describes, on tens of floors except that during peak times one may have to go to the next floor to find an empty stall. Specifically -- 1\. I have not seen anyone take laptops to the stalls 2\. No conversations in the bathroom, at most a Hi when washing your hands or a 'excuse me' at the door. Definitely no cross-talk across stalls. 3\. No one is using bathrooms as a meeting place or a place for long conversations.

Since last year, there are also unisex bathrooms on each floor. While I am here, might as well dispel some other myths. Occasional WFH is the norm, not an exception. I haven't seen people work long hours as a norm. Most people come in between 9-10:30 and leave between 5-6:30pm. Some come in earlier and some later. Almost everyone I know is driven by their own passion for their work, customer obsession, immense learning opportunity, do things that have never been done before, increasing stock value and increase in their own market value, to name a few.</comment>


Accept donations on your site instantly - <AUTHOR> https://open.tilt.com/donations <comment><USER2> 2.9% + $0.30 hardly qualifies as "lowest fees". Interchange Pricing Plus on a Authorize.net reseller charges 0.10% + $0.30 for comparison.

I'm pretty sure 2.9% + $0.30 is standard.

<comment><USER3> That's very standard, yes. It's pretty much what everyone charges, it's so standard even Authorize.net charges that for merchant payment processing.

The interchange pricing plus fee is just that isn't it, a fee plus the interchange fee? Comparing a partial fee to a full fee doesn't seem fair, or I'm missing something.

So yes, 2.9% + 30c is pretty standard. Don't really know of any exception (apart from native digital currencies. Bitpay does Saas payment processing at 0% fees for example).

<comment><USER4> PayPal: 1.4% + 30p (GBP)

The fees are not standard, they are more than DOUBLE what PayPal charge registered non-profits.

[https://www.paypal.com/uk/charity/](https://www.paypal.com/uk/charity/)

I run a UK CASC (Community Amateur Sports Club) which is registered as a non- profit with HMRC and whose articles of association with Companies House require us to be structured in such a way that we are a non-profit (obligations to invest all profits in the promotion of sport).

Even as this type of entity we are eligible and receive the PayPal charity rates.

The donations by Tilt may work for groups that are not actually legal non- profit entities, but for any group that is a non-profit the fees are excessively high.

The reality is, our donations and contributions are usually fairly predictable. So we work to maximise how much we get from that revenue, by choosing the lowest fees and claiming back Gift Aid (CASCs can do this).

PayPal works really well for us, and with the fees being half what competitors offer I'm not even looking to change.

<comment><USER3> I was referring to basic payment processing, where the standard is 2.9% + 30c, not special rates for non-profits (which are sometimes as low as 0%).

There is no real standard fee for non-profits, it varies between the normal fee, a discount fee (as you have) or no fee at all.

</comment></comment></comment></comment><comment><USER5> Neat. Anything to reduce friction; a lot of people in the nonprofit world don't seem to grasp the importance of making it easy to donate the way that for-profits seem to grasp it.

</comment><comment><USER6> On two of the non-profits I've worked on, we had trouble with donation fraud. At the time, a few years ago, it was a huge problem. Donation fraud happened to a sizable percentage of non-profits and charity organizations, and it particularly harmed the small, all-volunteer groups which lacked the resources/skills to deal with it. Basically, criminals would target charities with bogus donations as a way to test their stolen credit cards. As you might imagine with all the charge-backs and uncertainty, this caused a lot of problems and headaches for the charities.

I'm sure you probably can't give much detail on your risk management and fraud detection measures, but has the donation fraud problem been more or less solved?

<comment><USER7> It's obvious, but fraud has definitely been an issue with all the simple Bitcoin donation buttons/GUIs that have popped up in the last year or so.

<comment><USER3> No it hasn't. Bitcoin is a push system of payment, creditcards are a pull system of payment. Bitcoin payments use cryptography on a non-proprietary ledger secured by proof of work of hundreds of millions of dollars of computing power (meaning once the payment is done, there is no central party to reverse it like say Paypal could reverse payments on their proprietary Paypal ledger, and unless you have a computer from the 22nd century, you won't be able to reverse the transaction).

In other words, it's an entirely different system of payments. No clue what type of fraud you're referring to, but the fraud explained in the post you replied to does not apply to bitcoin.

If due to lack of punctuation you mean something different, i.e. that CC fraud is so rampant that everyone is switching to bitcoin donations and that they've been popping up everywhere because of that, I doubt that that's been the key driving factor, although it surely is part of the equation.

In any case I don't really know what you meant to say :-/

</comment></comment></comment><comment><USER8> Cool idea! I think there are a few things on the usability side that you could do to make it even better:

* Lock the body when you open the modal by setting overflow: hidden. That will prevent people from scrolling around accidentally while filling out the form.

* This is related to the first point, but you should probably position: fixed the modal

* Make the label for the monthly donation clickable - people shouldn't have to find the little check box!

* Lighten the .iframe-subheader-text as it can be pretty low contrast when the background is white

* Add some subtle animations to the open and closing of the modal. It feels very jarring right now.

<comment><USER9> Lock the body of a site by default? I can see when I'm scrolling.

Position fixed? What about when the modal content is longer than than the scroll area?

There are animations for me on mobile. :)

<comment><USER8> If you make the black overlay container position fixed and the window itself normal, you can have the modal scroll within the context of the black overlay. Facebook uses this same method and it's significantly nicer!

<comment><USER9> Ah, of course, understood.

</comment></comment></comment></comment><comment><USER10> I assume "Make this a monthly donation" can be cancelled via a link that you send to the donator's email? Maybe that should be mentioned to assure the user they can easily cancel monthly payments.

<comment><USER11> Yep! There's a link at the bottom of every email receipt for recurring billing donations to cancel the recurring charge.

I totally agree that adding some text to the effect of "you may cancel at any time" would be perfect -- we'll get that in there!

</comment></comment><comment><USER12> I've handled the fundraising site for an alumni organization for several years. One thing we find essential is displaying "progress" by plugging into our templates the amount raised so far by each different campaign. On the API page [https://github.com/Crowdtilt/crowdtilt-api-spec/#get- campaig...](https://github.com/Crowdtilt/crowdtilt-api-spec/#get-campaign) this appears to be a simple ajax call. And you don't have to touch paypal. Well done!

</comment><comment><USER13> One of the non-profits I work with receives a significant portion of donations via ACH so something like this would not be considered regardless of how simple it is to use or how elegant the design may be.

Are there any plans to accept donations via ACH in the future?

<comment><USER14> Yes, there are - though credit card giving is the preferred online giving method (by far), PayPal, ACH, and bitcoin will be implemented (probably in that order) soon.

Tilt.com is still where we spend about 90% of our resources, but our suite of enterprise tools for professional crowdfunding and fundraising (open.tilt.com) has been a big area of growth since we started launching the tools this year -- and additional payment methods have been a frequent request on all products there.

</comment></comment><comment><USER15> The central part of that service is a modal dialog... which does not look very good: [https://i.imgur.com/iaxmLis.png](https://i.imgur.com/iaxmLis.png)

(I have scrolled a bit with my mouse wheel to reach that state)

<comment><USER14> Unlike most modals, you can customize the look and feel to your heart's content. You can also implement as an iframe to give you further control over the user experience (including adding other info fields) for donors.

<comment><USER15> A better job should have been done for the modal that is trying to sell you the product itself, I guess.

<comment><USER16> The modal design is purely subjective. I think they did a fine job. It's great for the purpose, because it's uncluttered, has clear prompts, and has useful placeholders. IMHO, anything else would just be fluff that gets in the way of the UX.

<comment><USER15> Do you think the secondary scrollbar (which is not even vertically centered), the Times New Roman and the cut off text is fine?

<comment><USER16> I missed those the first time around, because my gaze was focused on the form and it's container. You're right, that should be addressed. I would imagine addressing the scroll bar issue would resolve the cut off text as well. It looks like something that wasn't a priority for roll-out, because it doesn't really affect UX so much, but I do think it's something that needs to be fixed in the next release.

</comment></comment></comment></comment></comment></comment><comment><USER17> Congrats, Tilt team! This is absolutely needed. The previous product I worked on was used by a lot of non-profits for crowdfunding and it just shows how necessary something like this is.

<comment><USER18> Thank you very much. The need is certainly there, and we are happy to address it.

</comment></comment><comment><USER19> Cool idea, but it would be nice if it automated Paypal, Amazon, Bitcoin and/or Google as well. I think that asking for a Credit Card can be a barrier to getting donations.

<comment><USER14> Paypal will be added soon, but adding PayPal (and Amazon + other payment options) limits the ability for us to enable recurring donations for the org/cause/charity, which has become a significant capital raise mechanism for non profits in the last few years. That checkbox is one of the most well received features that is right out of the box.

<comment><USER20> I thought paypal does recurring donations? Anyhow, for bitcoin, look into Coinbase's recurring payment options. I don't think it should be a problem.

<comment><USER5> I'd guess that for all but a very small subset of nonprofits there is pretty much zero interest in Bitcoin because pretty much no one would like to donate to them using it.

<comment><USER3> There's actually been loads of both small and prominent organisations accepting bitcoin. Save the Children, American Red Cross, EFF, Greenpeace, Hal Finney's ALS fund, Mozilla, Wikipedia etc etc.

If you look at the Humble Bundle for example, Linux users consistently outdonate windows users in voluntary transactions every single time. Bitcoin is a bit like that, too, both because of the type of crowd and because people are eager to spend and use bitcoin and to support charitable organisations that participate in the bitcoin ecosystem.

Lastly, it's an interesting angle because payment processing costs 0% for charities, yet the payout is in dollars, euros or a bunch of other currencies including bitcoin (just like for any other business btw if you use Bitpay)

It very much seems like charity is one of bitcoin's biggest usecases at the moment. Not saying it's the best thing ever, but we shouldn't discount it as there being no interest and no charitable bitcoin users.

<comment><USER5> > It very much seems like charity is one of bitcoin's biggest usecases at the > moment. Not saying it's the best thing ever, but we shouldn't discount it as > there being no interest and no charitable bitcoin users.

But that's not really the question; the question is if there are enough to justify the development effort and, especially, to justify prioritizing that over other options like PayPal.

<comment><USER21> The development effort of integrating Bitcoin is nearly zero with payment processors like Bitpay/Coinbase.

<comment><USER5> Maybe so, but near-zero is not zero, especially when you have to offer support for a commercial product.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> Monthly donations are a great feature, but one of the things we see often (I'm a non-profit development (that's our neologism for fundraising) manager) is the desire to have payment installations. That is, not necessarily a standard monthly donation, but $1k over ten payments (monthly and then ending) or $1k over four payments (quarterly and then ending). Is support for pledges like these in the works?

</comment><comment><USER23> Claim on this website: "Accept donations on your site instantly, from all cards and countries".

Truth is: in Germany the prefered way for paying on the internet is Lastschrift (direct debit). Paying with credit card is not very popular and credit cards aren't that common in Germany.

To put it harshly in other words: the statement on the website above is simply fraudulent. I can't pay with my EC card by direct debit.

<comment><USER24> It is accurate that you can pay from all cards and countries if you take their meaning to be logoed cards (Mastercard, Visa, Discover, American Express, etc). Nearly all debit cards in the US support one of those standard payment systems, so you can use them everywhere regardless of whether a specific store supports debit cards. It sounds like Lastschrift isn't logoed with one of those, so a store can only support Lastschrift if they _specifically_ support Lastschrift by connecting with one of those payment processors. As such, it isn't supported by most US or worldwide websites unless those sites have taken specific steps to support it. Several countries have setups like that where there is a specific proprietary payment system that is only supported within their country and thus not supported in most websites outside of their country. We can hardly fault them for that.

</comment></comment><comment><USER25> Two-step authentication must for credit cards in India

[http://www.thehindu.com/business/Industry/twostep- authentica...](http://www.thehindu.com/business/Industry/twostep- authentication-must-for-credit-cards-rbi/article6345330.ece)

</comment><comment><USER26> What exactly is the benefit of this vs. PayPal's Donate Now button?

It may be more than 2 lines of code but I don't really care anyway since I'm just cutting & pasting it from PayPal's site...

</comment><comment><USER27> Does this work outside the US?

<comment><USER28> you can only collect money with an US or Canada bank account but you can donate/send money with any bank card

> Currently, if you want to collect funds from a tilt, you need to have a > valid US or Canadian bank account.

</comment></comment><comment><USER7> wet blanket alert: a modal form with credit card inputs has been done many times before. What is instant or new about this? Kudos for yet another checkout, payment button code snippet?

<comment><USER14> Hi there. Thanks for the comment, and it's a valid question if you've never tried to implement current options for donations -- I'd be happy to address each example you're talking about when you say "what's new about this" (eg, stripe checkout, great for payments checkout - but isn't copy and paste, requires server code, isn't customizable, doesn't enable recurring donations, doesn't provide automated tax-deductible receipts, doesn't allow for adding additional fields for addl info collection...).

It turns out that accepting payments vs accepting donations for a cause, charity, political campaign, personal project, etc actually ends up having a different set of needs. And with online giving growing at the rate we see it to growing, a simple / powerful way for any site to collect donations, optimized for conversion on any device, with two lines of code is something we think our customers will find useful.

<comment><USER7> hi jjb123, thanks for the thoughtful reply. Yes I can see how payments vs. donations are different. I didn't mean to say what you did isn't useful. I'm a developer too so I can appreciate what it took to make your thing a reality. I guess I'm just saying you don't make the difference clear to the user. The only difference I see with Stripe's is Tilt's monthly donation checkbox. I guess investigating further, you differentiate with Stripe in making your modal for the non-developer. Still a layperson will have to inject two lines of code, but then they don't have to do all the customization by writing more code and can instead use Tilt's GUI.

TL;DR; It would be good to make it more clear to the end user what's new about this. Perhaps a better title for this HN post is "Accept donations on your site without writing code". The word "instantly" obviously never can be true and seems like overhype.

</comment></comment></comment><comment><USER29> WePay.com used to have a Donate button that as I recall was pretty much exactly this. They dropped that, along with their invoicing services, a little over a year ago. Any reasons you think this will get better traction?</comment>


Ask HN: What's up with Google Appengine? - <AUTHOR>

Are people actually using it? I get the feeling it never really took off, it's certainly no competition for AWS & Co. But it being free hosting and all, I would have expected more action. I would have expected someone to make a Wordpress clone that one could then host for free on there, etc. Am I missing something? <comment><USER2> _Are people actually using it?_

I quit my job betting on it.

You could actually build pretty decent services over GAE, while remaining within the free quota, if you can be efficient with resources. Billing rates are affordable too.

I am currently working on an ad-supported CRM (<http://crm.ifreetools.com>) and online application builder (<http://creator.ifreetools.com>) over Google App Engine. Both are multi-tenant apps and iFreeTools Creator is probably the only online app builder which enables building customizable apps online over Google App Engine.

The platform does have its restrictions, primarily to enable apps to scale well. If one can get comfortable with working within those restrictions, it gets easier.

 _Wordpress clone_

You should try out Bloggart : <http://github.com/Arachnid/bloggart>

..and its accompanying posts, aiming to also introduce developers to the GAE platform : [http://blog.notdot.net/2009/10/Writing-a-blog-system-on- App-...](http://blog.notdot.net/2009/10/Writing-a-blog-system-on-App-Engine)

<comment><USER3> The CRM tool looks really nice.

</comment></comment><comment><USER4> AppEngine is being used, but I would bet not nearly to the degree that AWS is. One thing that Google could do right away is to offer a (hopefully reasonable) monthly fee to keep instances active - loading request times are a bummer and it takes some effort to keep them reasonable (e.g., use Python, or use Java without JDO or anything that takes a while to initialize).

Some things are great with AppEngine: admin web app, ease of deployment, and being able to write Wave robots easily.

For long loading request times, it would be great to pay perhaps $5 to $10 a month for always keeping one instance active.

<comment><USER3> You would think the biggest, most successful data infrastructure company on the planet could figure out a way to keep warm JVM's running at a reasonable price.

</comment></comment><comment><USER5> Used if for a year and then dropped it. They could make it work if 1) your code was portable 2) they had an actual admin team you could talk to in realtime 3) they dumped a handful of silly limitations.

Not a bad choice for a free CDN though. I still use it for that.

</comment><comment><USER6> Heroku happened.

</comment><comment><USER7> Frequent outages and "write to datastore" errors made me sad. (This was in 2009, don't know whether these issues have been fixed, but I won't be going back.)

</comment><comment><USER8> I know some people use it as a web proxy :P

<comment><USER9> E.g. <https://proxy1china.appspot.com></comment></comment>


Dear Packaging, I Hate You - <AUTHOR> https://medium.com/@BoltVC/dear-packaging-i-hate-you-6608dceefe8b <comment><USER3> Totally disagree with this article. Talking about startup resource constraints while illustrating with the products of the biggest, most successful company in the world is more than a little disingenuous.

Focusing on a great user experience _includes_ focusing on the packaging. The experience should be totally seamless. For an upscale/luxury consumer goods company (like Apple), shoddy packaging is _expensive_ \- far more expensive than the luxury packaging whose costs the author decries. If I want a mediocre experience, I'll go to HP or Asus or something. A continuously delightful user experience buys customer loyalty. The thoughtfulness of good packaging engenders trust.

If I see bad packaging, I trust the the attention to detail less for the company that made the product. If they don't care about the box, they won't care about the buttons, or the software, or the color correctness, or any of the thousands of other details that make a consumer product. Then I stop shopping for quality, and start shopping for a price point and feature list.

When Apple argues that they have the best products in the world, they can point right to their packaging - they have the best packaging in the world. Best in every way.

Is this good logic for a startup? Of course not! No startup has Apple's resources. A startup has to focus on ONE thing. But Apple has to focus on ALL things.

<comment><USER4> Apple _used_ to have the best packaging in the world, but lately it's been my opinion that they've lost sight of making the packaging functionally nice and are simply focusing on making it nice _looking_. Case in point, the incident last year where the guy first in line at the Apple store for his iPhone on release day struggled with opening the box and ended up launching his new phone onto the sidewalk in front of a news crew. Incidentally, I watched a friend do _exactly_ the same thing the very next day. And recently, a friend and I both bought some particular apple accessory and separately commented on how difficult it was to figure out how to get it out of the box.

<comment><USER5> Agree++ The iPhone 6 Packaging was terrible. Way too easy to drop the phone since it was in a really shallow groove right at the top.

<comment><USER6> Motorola used a similar packaging for the Moto X. Ironically, the cheaper Moto G packaging uses simple deeper cardboard folds and thus is a lot more 'secure'. See: [http://imgur.com/XTNbTr7](http://imgur.com/XTNbTr7)

      "Being rich demands fine motor skills."
        -- a high end smartphone owner

<comment><USER5> Or if motor skills are lacking, future iCracked customer, Disclosure: I work for iCracked (YCW12).

</comment></comment></comment></comment></comment><comment><USER7> Generally, I agree. I feel like I'm wasting my money when I unwrap something with overly "beautiful" packaging. It's a tiny fraction of my experience, I've already bought it at this point and figuring out all the nested little components hidden away and all the custom printing is just adding to the price with expensive trash.

I know it's heresy, but I hate Apple packaging for exactly this reason. Startups seeking to emulate wasteful and expensive packaging are convincing me they're more concerned with image than substance.

<comment><USER8> I haven't opened a recent Apple product, but they tend to have _less_ packaging than a comparable device from many other brands.

</comment></comment><comment><USER9> Every time this topic pops up, I'm reminded of the scene from Continuum (I checked it out recently, it's in the third episode of the first season). There, a time traveller from the future buys a bluetooth headset and reflects on the 'ridiculous amount of packaging for something so small'. "No wonder you had a trash problem [in 20th century]".

(I recommend the show strongly, btw. While often more "fi" than "sci", it has an extremely good discussion of the interaction between people, government and private interests. In the show's universe, corporations have bailed out the failing government and formed a Corporate Congress...).

</comment><comment><USER10> I thought this was going to a humorous article about wrap rage, which is a pretty interesting topic. This article sounded a bit whiny to me - "I can't compete with Apple's packaging! Waah!" I don't think anyone expects a startup's packaging to be at the level of Apple, so I'm not sure the topic is all that valid.

</comment><comment><USER11> I might be alone in this, but I have an alternative problem with really nice packaging... The "don't waste stuff" mentality my parents instilled in me makes it really hard to throw the stuff out. I often find when I'm moving, and downsizing stuff, I'll have ignored an empty product box because it was too nice to toss when I started using the product.. the product of which, I may have long since given up on.

As a result, sometimes I feel like I'm hoarding the crap, as if it's a necessity later if I want to sell it, or I'm gonna make some warranty claim on it?

</comment><comment><USER12> Packaging = Marketing. It's expensive, but it makes your product seem better to the end user. Yes, Apple has more money to spend on marketing, and your small startup can't compete on that front.

</comment><comment><USER13> One of the best unboxing experiences I had with a device was the Amazon Kindle.

Simple, minimal waste (a big factor for me), and already preprogrammed to my Amazon account.

</comment><comment><USER14> I think the author focuses too much on outlier examples (Apple, Oculus).

Great packaging and branding has a serious impact for companies today than previous years. More people sell online then ever before (shopify, etsy, etc) and there's no longer that brick-n-mortar experience you typically go through when buying your products in a physical shop. You buy online now and then that item is shipped to you.

In many ways, the packaging IS the brick-n-mortar experience for customers when they receive your product. No one gets excited about seeing a generic brown box on their doorstep. They get excited about the fact it has Amazon Prime printed on the side with the branded tape. "Yes! My what-you-call-it just arrived!".

This is the same experience that companies like Bonobos, Birchbox, Naturebox, Teespring, etc deliver. Its branded extremely well and they all care very much about delivering an extension of their brand to someones doorstep. In the case of a lot of subscription box companies, the products inside are relatively cheap to source. A large cost IS the packaging because they are delivering on an experience.

Try the World's box is fucking amazing (www.trytheworld.com). It feels good opening and seeing what's in store for you this month. I'm sure the products inside cost next to nothing, but its not just about that.

The author seems to make a case that Apple spends way too much on packaging (not surprising considering Steve Jobs cared about every detail inside and out). Then he uses Oculus as an example of really generic packaging that people go amazeballs for. Uh, yea we're talking about a 1 in a million type product that sold for billions, and did you see their DK1 packaging? It came in a freaking suitcase basically.

I think these are both pretty outlier cases, and the norm is that great packaging can really polish a company and expand their brand and product.

This is what we care about deeply at Pakible (www.pakible.com), the company I founded to help any company make beautiful packaging for their brands.

Yes, typically it takes a long time to create packaging and is very costly, and that part I will admit is true. But that is also one of the things we are changing about the industry with Pakible. To not have to worry about the construction, sourcing it, designing it. We help people do that so they can focus on the rest of their business.

</comment><comment><USER15> In addition to cost we have significant waste. A young designer named Aaron Mickelson created a 'packaging-less' product line that was consumed as part of the product itself. Certainly, there are going to be practical concerns - <USER2> it's not a bad direction to be turning our focus.

[http://design-milk.com/aaron-mickelson-redesigns-consumer- pa...](http://design-milk.com/aaron-mickelson-redesigns-consumer-packaging- eliminate-waste/)

<comment><USER8> Those are all really nice designs. The only criticism I have is with the final one.

Some bagged tea (Celestial Seasonings, etc.) is already available in superior packaging. They use a single unwaxed carboard box for all bags. None of the bags have string or paper, making them completely compostable.

</comment></comment><comment><USER16> Is it just me or is this a stealth commercial for Pencil?

<comment><USER17> Doubtful. From what a quick scan on Crunchbase says, Bolt did not make any investments in FiftyThree (the makers of Pencil) nor do they share investors.

Bolt has however made a number of investments in hardware companies that gained traction through crowdfunding. This is the audience.

Not all of these companies were founded by people with backgrounds in this space, so the model they resort to when looking for "nice" is to emulate Apple. FiftyThree is a former Microsoft industrial design team so they had knowledge of how to make any kind of packaging. They serve as a great goal post for Bolt to point to as an alternative example of "nice" _that 's not one of their own investments._ The implication here is that they are not self- promoting.

</comment></comment><comment><USER18> Here I was ready to agree on the poor state of language specific package managers...

</comment><comment><USER19> The author is implying that startups are Cargo-culting great design by merely copying high end packaging but not ensuring their product is actually excellent and useful.

I agree to an extent, but really why not both. A great product should be a FIRST priority, then a great on boarding experience should follow just after.

But maybe, just maybe -- focus on making that onboarding experience as minimal as possible, not full of needless packaging and long animated videos.

</comment><comment><USER20> I like how they show the DK2 as boring. I got the DK1, and it came in a hard plastic case with custom foam cutout. That thing had to be fairly expensive...

</comment><comment><USER21> Reminds me a lot of their previous article: [https://medium.com/@BoltVC/no- you-cant-manufacture-that-like...](https://medium.com/@BoltVC/no-you-cant- manufacture-that-like-apple-does-93bea02a3bbf)

That one had a lot less anger, and just suggested that you should not compete with Apple in their areas of expertise, which would probably be a good idea in the field of packaging as well.

</comment><comment><USER22> Packaging is the real world analogue of an app icon. Your product has to grab and retain my attention within two seconds for me to give it any consideration at all. Does Apple packaging have that effect? You bet it does! Do nicely packaged Kickstarters pique my curiosity more than cardbord-box prototypes? Yes, by far.

Appearances matter quite a bit, I'm afraid.

</comment><comment><USER23> The worst thing about Apple packaging is the environmental impact. There is no need for so much plastic. I know they could design a recycled cardboard insert which would achieve the same design sensibilities and be a selling point to environmentally conscious consumers. STOP POISONING THE EARTH AND OCEANS!

<comment><USER24> Apple's packaging does not necessarily optimize for recyclable materials (though they do, sometimes). More importantly, they optimize for space efficiency.

The last few generations of iMac come in a box that is sloped on one edge, whereas they used to be a standard rectangular prism. This unusual reduction in size allows them to tessellate the boxes in shipping and fit significantly more boxes on each airplane. This saves the company millions (literally millions of dollars from a seemingly-minor packaging change!) and also reduces the amount of jet fuel being burned to ship them around the world. Everyone wins, environment included.

But yes, it is also true that your lightning cables come wrapped in a little plastic thing. It would be nice to choose a more biodegradable material for that sort of thing.

</comment></comment><comment><USER25> why not a real example of a small company spending too much on packaging? hard to make an argument without one.</comment>


"A revolutionary company has to think bigger." - <AUTHOR> http://www.alleyinsider.com/2008/4/justin_tv_no_advertising_wanted_just_a_top_secret_transaction_system_

<comment><USER2> The potential of implementing a C2C and C2B transaction system over streaming video (especially live) are pretty incredible.

Concerts, sports, niche live events... Once the system is ironed out you're adding an extra revenue stream to anything you plan. Build this into a set-top box and you've got streaming video's killer app.

<comment><USER3> I have to agree. If they can solve the pay per view concept for niche live events, they'll make money. If they can make partnering with live bands, seminar presenters, etc. seamless and profitable for both parties, it could be a big market.

<comment><USER2> A deal with LiveNation alone would cover most of their expenses.

</comment></comment></comment><comment><USER4> Camgirls + live streaming + chat requests + payment transaction...</comment>


X to Close – The origins of the use of [x] in UI design - <AUTHOR> https://medium.com/re-form/x-to-close-417936dfc0dc

<comment><USER2> Previous submission here, with 194 comments: [https://news.ycombinator.com/item?id=8171340](https://news.ycombinator.com/item?id=8171340)</comment>


Ask HN: Annoying Part of your work you'd love to deligate? - <AUTHOR>

an Avid HN reader here. I am pursuing an idea related to virtual assistance. For that, I want to understand what kind of daily (boaring?) work you have to do and you wish you could deligate if you had a virtual assistant. the work may be irregular (once in a week/month or once in a while) but it is so annoying/boring that you simply don't want to do if somebody can do it for you. The only criterion is that the work can be done virtually. Thanks! <comment><USER2> Phone calls and meetings...

<comment><AUTHOR> what kind of phone calls? business enquiries? Support?

</comment></comment><comment><USER3> I could use help with my spelling.

<comment><AUTHOR> Let me understand. if you write much and frequently, then spell check is sure a time-consuming task. Is that so?</comment></comment>


Ask HN: Are download accelerators still a thing? - <AUTHOR> Hello,
I was wondering if people still use download accelerators. Reason for asking is that I am working from China and 99% of the time I use a VPN. The connection is flaky most of the time and when downloading large files, a single hiccup (TCP reset) or when changing VPN locations is enough to break the download. I remember back in the days of dialup (I feel like this some days) you could pause a download and resume it effortlessly using a third party accelerators. A quick google search shows many dodgy chrome plugins or programs.. Any recommendations for Linux, Mac?
Thanks! <comment><USER2> On Firefox, I'm using DownThemAll. It has lots of features, including bandwidth throttling, downloading from multiple mirrors at once, checksumming, pausing etc.

<comment><USER3> I've also been using DownThemAll for a very long time, it does an excellent job and is one of the main reasons I still have Firefox installed at all.

</comment></comment><comment><USER4> Free download manager has worked flawlessly for years for me. Not sure how it works on Mac tho, but worth giving a try.

[http://www.freedownloadmanager.org/download.htm](http://www.freedownloadmanager.org/download.htm)

</comment><comment><USER5> I would look into using aria2, a CLI download utility. It has a '-c' or '-continue' flag to resume a partial download.

</comment><comment><USER6> Not a gui program, but for Linux, I always love just using wget. Works great, and very powerful.

</comment><comment><USER7> Try axel which is a drop-in replacement for curl but has the features of a download accelerator.</comment>


What is currently the best personal cloud application? - <AUTHOR>

In light of the recent privacy scandals, I'm going to be setting up a personal cloud at home. I've seen a couple frameworks already (ownCloud being the best looking), but would like to get the community's opinion on the "best" one out there.
Best can mean several things:
- Secure in its implementation,
- Open source (can't assume that I trust the people who have made it),
- Has all the basic features (file browser/streaming, email, contact, etc.),
- Is visually pleasing.
Any ideas? When I choose a piece of software, I'll be writing a detailed tutorial on getting it set up on Ubuntu and securing it before it goes online. <comment><USER2> Hopefully ownCloud 5 is better than 4. Large file uploads basically don't work with ownCloud 4.

<comment><USER3> I agree, Owncloud is getting quite mature. Combined with a Raspberry Pi and BitTorrent Sync ([http://blog.bittorrent.com/2013/05/23/how-i-created-my- own-p...](http://blog.bittorrent.com/2013/05/23/how-i-created-my-own-personal- cloud-using-bittorrent-sync-owncloud-and-raspberry-pi/)), you got yourself well started...</comment></comment>


Dopamine primes the brain for enhanced vigilance - <AUTHOR> http://news.mit.edu/2018/dopamine-brain-vigilance-anxiety-1107 <comment><USER2> I can't understand why no reference was made to ADHD, am I missing something, or was it the case that the journalist didn't think to mention it?</comment>


Ask HN: Help with PGP ported to PHP - <AUTHOR>

I have a working port of PGP written in pure PHP which currently supports encryption only.  I am not the original author of this port, but I took it on because I thought it was a great piece of code for the PHP community.  I have made a few tweaks here and there but there seem to be some issues appearing that I have not been able to solve.  If anybody with C experience and possibly some experience with encryption would be willing to jump it it would be great.  The port is at https://github.com/jasonhinkle/php-gpg  Thank you! <comment><USER2> Why wouldn't one instead use [http://php.net/manual/en/ref.gnupg.php](http://php.net/manual/en/ref.gnupg.php) ?</comment>


Show HN: Curated news and opinion articles, that you would have never read - <AUTHOR> https://thecounterpart.co/ <comment><USER2> But… who selects these pieces and how?

<comment><AUTHOR> Fair question. As it stands, there are 2 of us collecting and curating the pieces from what we consider some of the better liberal and conservative opinion sources.

We're trying to maintain the quality and integrity of the articles by limiting the number of newsletters we send out to one a fortnight.

It's possible in the future we'll open it up to readers to submit insightful articles for others to read. The curated newsletter is step one to gauge interest in such a product.</comment></comment>


A great screener question for a tech interview - what's wrong with this paper? - <AUTHOR> http://pdos.csail.mit.edu/scigen/

<comment><USER2> I had heard of SCIgen before but had never bothered to actually look at any of the papers it generated. After briefly scanning the "Rooter" paper (which was accepted, albeit as a non-reviewed paper) I still can't imagine how someone could get past that title, or barring that, the first sentence of the abstract. It really is just nonsense.</comment>


A clean notepad in HTML & CSS - <AUTHOR> http://marcgayle.com/2010/09/27/a-notepad-in-html-css/ <comment><USER2> It's just a table with some pretty standard css and a graphic or 2. I thought this was going to be an app that remade a standard notepad app in html and had decent features.

Color me unimpressed.

<comment><USER3> Ha indeed... Started clicking around on it expecting to edit text, or turn a page, or SOMETHING... Started looking for javascript errors thinking Safari had crapped the bed, as it is prone to do from time to time.

 _sigh_

Post things like this once they get interesting. ;)

</comment></comment><comment><USER4> I think it looks slightly wrong because most people don't write between the lines, they align the baseline of the letters with the bottom line.

</comment><comment><USER5> Several years ago, I did a website for a Poet who works on a manual typewriter using sheets of lined paper ripped from a notebook. I as tasked with recreating the visual feeling of the pages in HTML/CSS, including the fact that texted would be deleted by overtyping "X"'s

Take a look: <http://agiginprint.com/poessays/sonoran-hushings/>

</comment><comment><USER6> Here is another typography solution for Baseline Grid Typography <http://www.allapis.com/emastic/typography.html> from Emastic CSS Framework <http://code.google.com/p/emastic/></comment>


Why talk markets when they are actually individuals? - <AUTHOR> https://www.linkedin.com/today/post/article/20140614070252-44477394-why-talk-markets-when-they-are-individuals?published=t

<comment><AUTHOR> Sadly, despite these positives, the social media handles of several companies are on an automation mode. People automate tweeting, schedule Facebook posts at regular intervals to ensure 24*7 availability and more importantly for search optimization. (Google search matters a lot, I know!)

Isn't it important for you to humanize your interactions? Whether it's a product or service, it's a service to humanity at the end of the day. Of course, not missing out on profitability from a business standpoint.

So when it looks and feels like you, when you are a trusted source and not like an automated blabber – then you are on the spot and valued.

Making 20 automated tweets/posts doesn't help but on the other hand, if you have 5 sensible interactions, you have made justice to your day on social media.</comment>


Node.js explained by Ryan Dahl - <AUTHOR> http://jsconf.eu/2009/video_nodejs_by_ryan_dahl.html

<comment><USER2> Great video.

Just a warning to any viewers: I think it might be a bit out of date now. I don't think node has promises anymore and I think they also have blocking and non-blocking versions for most operations (meaning callbacks are optional).

</comment><comment><USER3> It is an interesting video.

Quick summary: Node.js is a program/api written in C that lets you write asynchronous servers in javascript. All IO is done through event loops and callbacks.

If you are interested in the efficiency/architecture of server programs then this is worth watching.

</comment><comment><USER4> kind of sucks that the video player doesn't work on the iPad.

<comment><USER5> sucks that it's a video and there's no text transcript. whichever brilliant team of computer scientists gets a speech product out will win lots of money

<comment><USER6> the sad thing is that that product will only work for english :)

on one way, recognizing (and translating the subtitles to english) other languages would be more important because most people already know english...

<comment><USER5> dude the way i see it is there are already APIs available, so once someone gets sound->text, you can already break down video->sound, and you can translate text_inEnglish to text_inSwahili ..

<comment><USER6> there's "english sound" -> text.. what i meant is that perhaps "chinese sound" -> text or something would be more useful fost most people around here</comment></comment></comment></comment></comment>


We Strongly Support Drone Remote ID. But Not Like This - <AUTHOR> https://content.dji.com/we-strongly-support-drone-remote-id-but-not-like-this/ <comment><AUTHOR> One key take away is that all DIY drones will be illegal to fly the way people use drones today if the proposed FAA Remote ID rules goes into effect -- I think this is excessive regulatory overreach. The DJI post is excellent. Further reading here: [https://fpvfc.org/remote-id-talking- points](https://fpvfc.org/remote-id-talking-points)</comment>


Notes on Intel Microcode Updates - <AUTHOR> http://inertiawar.com/microcode/

<comment><USER2> It's amazing how much someone can determine about a "secure" system by poking at it, doing differential attacks, and timing attacks. Anyone trying to build something secure should take warning from this, especially since there are much, much more determined attackers.

As someone reverse-engineering the Z-80, I find this article interesting. Maybe 35 years from now, someone will post a full analysis of how this Intel chip processes microcode internally, answering all the questions raised by this article. It will be very interesting to find out if there's anything malicious in any microcode patches. Are there checksums of the microcode so you can make sure you're not getting "special" microcode updates?

Reply to mrb: I expect 90% of the purpose of the signature is to protect against untested or corrupted updates getting installed. (It would be a support nightmare if people installed microcode with errors.) Protecting against deliberate attacks is probably secondary; I doubt you could do a nontrivial attack without inside help.

<comment><USER3> Fortunately, microcode updates are not persistent across boots.

<comment><USER4> And how do we know that is really the case? It could be partially persistent and you'd never know it.

<comment><USER3> To do that it would require some type of persistent memory on the CPU itself. You could open the chip and look for memory of this type, it requires certain special features to operate, and they're somewhat easy to pick out of a chip shot.

There's also an engineering reason to avoid doing this: persistent memory cells based on silicon have a limited number of write cycles.

</comment></comment></comment></comment><comment><USER5> I find analysis like this thoroughly fascinating. I wonder if the handful of Intel engineers who presumably crafted this would ever stumble into this post. Would they be impressed, or alarmed that someone is probing such a crucial mechanism?

<comment><USER6> Having talked with some Intel engineers about their microcode, they consider it a company secret that protects trade secrets about how their processors function and wouldn't say much of anything about it.

I suspect they would be slightly impressed that someone was able to find out as much as they did, but I don't think they would be overly surprised. I also suspect they would also be satisfied that this doesn't disclose anything sensitive about the _contents_ of the microcode updates and just found out some information about the mechanism.

They definitely wouldn't be surprised that someone was probing microcode updates. A lot of us have asked them about it and they know people are interested about what's going on inside those blobs.

> I wonder if the handful of Intel engineers who presumably crafted this would > ever stumble into this post.

They almost certainly will if they haven't already.

<comment><USER7> Yup, a lot of folks at the office enjoy skimming hacker news, ars technica etc. The number of people capable of actually signing microcode even in a company of 100,000+ is pretty darn small though.

You'd actually be surprised about how much effort goes into hardening things against attacks like those these days (timing attacks, differential power analysis etc). There's a lot of interesting work around on the best ways of mitigating those risks.

</comment></comment></comment><comment><USER8> I wonder what is the attack scenario that the RSA signature of the microcode is supposed to protect? An attacker flashing a microcode that introduces specially-crafted bugs in certain instructions, in order to create backdoors?

<comment><USER9> Bricking your $3000 CPU?

<comment><USER8> Microcode updates are volatile. Rebooting cancels them.

<comment><USER10> Bad drivers included with the original 8.1 preview builds had a habit of permanently bricking mobile 700 series gpus - I'm sure you could do the same with a microcode update! Imagine setting the default voltage to 5v and multiplier to something crazy high, and disabling thermal cutoff - unless you happen to be dumping LN2 on your cpu at the time, it's probably not going to survive!

<comment><USER6> Microcode updates shouldn't effect the thermal integrity of the processor.

Microcode updates update a specific part of the processor that does a specific thing, i.e. the translation between the input ISA and the processor's native microcode instruction set, it's not supposed to be a wholesale update of processor parameters. (But we don't know enough about the structure of microcode updates to be certain. But I think you're barking up the wrong tree here and likely should read up on how Intel processors actually use microcode.)

You certainly can brick a CPU by updating parameters like that, but you wouldn't typically update parameters like that via a microcode update.

<comment><USER11> My microcode experience is some years ago, and nothing nearly as complicated as modern Intel stuff, but depending on just what you can control, you might be able to induce excessive thermal gradients by working some bits flat out and disabling/not dispatching to others. I don't know if the effect would be anything like significant enough to cause damage, although I have seen an excellent project using thermal regional heating to "fingerprint" cores post- fab. I think that required some (but not excessive) physical layout constraints as well.

<comment><USER6> Modern Intel chips will automatically adjust their clocking if they detect that they're suffering thermal stress. Further, I'm not sure whether microcode has that level of control over dispatch. Especially given the trace cache design of Intel chips, it seems very unlikely that scheduling information would be encoded into the microcode instead of dynamically decided during the out of order execution.

Don't get me wrong, I'm not saying it isn't possible to affect the chip's thermal profile in any way via a microcode update, I'm simply saying it's not the simplest way to do it and I doubt that Intel protects their microcode as fiercely as they do because of thermal concerns.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Can somebody explain what extra security they gained by using an RSA-based signature as opposed to a straight-up HMAC (with the secret key burned into the CPU)?

<comment><USER13> This way all the CPUs out there contain the information required to verify an update, but not the information required to create a verifiable update. If there was a secret key burned into the CPU, you can be sure that it would eventually be discovered.

<comment><USER12> Maybe I'm missing something: the public key is present in the microcode update blob (according to the article), and CPU itself must have corresponding private key within it. The sender uses the public key to sign, the receiver uses the private key to verify.

If we stipulate that info burned into the CPU isn't secure against extraction, then an attacker can get the private key. Obviously, he can obtain the public key much more easily from then update blob.

And now they can generate malicious updates.

The security of even the RSA system seems to rest on the difficulty of extracting the private key from the CPU.

Am I missing something?

<comment><USER13> You do not sign with a public key; you sign with a private key and verify with a public key.

The presence of a public key within the update itself indicates that that public key must somehow be authenticated by the CPU. Two possible options are that the public key itself is signed by a master key, and the "master" public key is embedded within the CPU; or that the cryptographic hashes of all valid public keys are directly embedded within the CPU. The point of the second option would be to save area on the CPU die (a 256 bit hash can be saved in place of a 2048 bit public key).

<comment><USER12> Thanks, I think I understand now. The chip verifies the update using the public key present in the blob. But before doing so, it checks the public key against some whitelist of valid public keys.

The private key used to sign the blob is never present on the chip. Interesting. Seems pretty secure to me, and more secure than a straight-up HMAC.

Thanks for answering my questions. I know a little about symmetric crypto, and your explanation has been very useful to expand my knowledge.

</comment></comment></comment></comment></comment><comment><USER14> Some previous discussion on this: [https://news.ycombinator.com/item?id=5485035](https://news.ycombinator.com/item?id=5485035)

Also: [https://news.ycombinator.com/item?id=5351672](https://news.ycombinator.com/item?id=5351672)

</comment><comment><USER15> The NSA probably got the private key so they can reprogram your CPU.

<comment><USER16> I would be quite impressed if NSA had the ability to write microcode updates themselves. I'd imagine they are not exactly trivial and require intimate knowledge of the actual silicon.

<comment><USER15> You just need 1 mole inside Intel. I've been to multiple large corps, there are no secrets once you are in.

Plus, NSA has the capability to reverse engineer chips at the physical level.

<comment><USER17> Donning tinfoil hat, NSA is just one part of USG. USG is one of hundreds of countries, zillions of criminal enterprises that would like to get intel's private keys and μcode format.

Given that intel is a large company the odds favor one/more external actors having access.

There's really no way to know without some sort of way for IDS to check μcode. Never going to happen due to the blackbox nature of closed, proprietary systems.

<comment><USER18> Or we could all just realize that for the time and effort of trying to write a backdoor into a general purpose CPU, which would need huge amounts of memory to be remotely capable of keeping track of code execution and to correctly make an OS remotely exploitable (you know, involving the network stack, probably TCP/IP and other things) rather then just crashing it...that it easier just to email someone an executable saying "I love you.exe" and wait for them to run it.

This is looking through the microscope to determine whether a forest is on fire.

<comment><USER15> Denying the truth won't make the problem go away.</comment></comment></comment></comment></comment></comment>


FedEx Office Joins the Breezy Partner Network - <AUTHOR> http://blog.breezy.com/fedex-office-joins-the-breezy-partner-network

<comment><AUTHOR> Team Breezy is very excited about this as we've been working for a long time to make this happen.

See the FedEx press release here - <http://news.van.fedex.com/node/18308>

</comment><comment><USER2> Go team Breezy! This is HUGE!</comment>


Ask HN: What is the best affordable programmable drone? - <AUTHOR>

What would you recommend as a reasonably priced (sub 150$) quad-copter/drone, that has a camera, the ability to be programmed (so that I can process video/write my own stability algorithms for it), and reasonable flying time?
In the event nothing fits that price point, any pointers on what the state of the art is?
Thanks! <comment><USER2> The CrazyFlie meets almost all of your criteria except for the camera part. [http://www.bitcraze.se/](http://www.bitcraze.se/) It's completely open and some users have managed to attach tiny cameras to theirs: [http://forum.bitcraze.se/viewtopic.php?f=6&t=427](http://forum.bitcraze.se/viewtopic.php?f=6&t=427)

</comment><comment><USER3> I don't think you're going to be able to do all that for < $150. Here's a pretty good website for that sort of stuff. [http://diydrones.com/](http://diydrones.com/)

</comment><comment><USER4> USD 150 is tight if you want to bring a half-decent camera up. You can buy cute little quads for as little as USD16, but the firmware for these things is always closed. Same with the DJI Phantoms and their Chinese clones.

What you're looking for is a flight controller with open source firmware. You have several options for this, but Arducopter and MultiWii are the most common. I prefer arducopters, but it's more of a 'PC versus Mac' debate: there are upsides and downsides to both, and in the end, both do a pretty good job. They're basically Arduino sketches loaded on an ATMEGA, so customizing it is pretty straightforward.

I would highly recommend building it yourself, not buying a ready-made quad. It's cheaper in the long run, (search 'DJI phantom replacement parts' for instance), more fun and you'll learn more. I don't think you can write a decent stability algorithm without knowing exactly what your hardware does. One word of 'warning' though: the people behind Arducopter/MultiWii really know what they're doing. If you're expecting to write a better stability algorithm than the current ones, well, you're in for quite a challenge. Having said that, if you choose to contribute to the open source projects: power to you!

For about USD250 you can assemble a decent quad that's: \- Fun to fly \- Has replaceable parts (a necessity, you WILL crash) \- Is upgradeable (GPS for instance, or better ESC's, better motors, etc.) \- Has an open source flight controller

You should be able to make one yourself for this amount. Take for instance a nice 250 size FPV quad: \- ARF-kit: USD 100,- (Frame, motors, escs, wires, etc.) \- HKPilot (APM based) flight controller: USD 71,- \- Transmitter/Receiver: USD 54,- \- Keychain camera \- Ass. propellers (buy spares. You WILL crash!) \- Batteries (3-cell lipo) and charger

Kit: [http://www.hobbyking.com/hobbyking/store/__52863__HobbyKing_...](http://www.hobbyking.com/hobbyking/store/__52863__HobbyKing_Spec_FPV250_V2_Quad_Copter_ARF_Combo_Kit_Mini_Sized_FPV_Multi_Rotor_ARF_.html)

Flight controller: [http://www.hobbyking.com/hobbyking/store/__51498__HobbyKing_...](http://www.hobbyking.com/hobbyking/store/__51498__HobbyKing_HKPilot_Mega_Mini_Flight_Controller_and_Autopilot_with_Leads.html)

Transmitter/receiver: [http://www.hobbyking.com/hobbyking/store/__8992__Turnigy_9X_...](http://www.hobbyking.com/hobbyking/store/__8992__Turnigy_9X_9Ch_Transmitter_w_Module_8ch_Receiver_Mode_2_v2_Firmware_.html)

Regarding flight times: I have a slightly bigger quad (350 size). With gopro attached it weighs in about 1150 grams, and I get about 6-7 minutes of flying time with a 3-cell 2200mah lipo. I'm always experimenting on improving flight times, and I think I can squeeze a couple of minutes more out of it with a little tweaking. OTOH, 3-cell lipos are less than 15 bucks so I always bring 3 or 4 of them with me.

A couple of extra words if you're new to flying quads: \- Start off with a light, cheap microquad. For instance the Cheerson CX-10. At 20 bucks it'll cost less than a wrecked frame and 2 props, and it will teach you how to fly these things. Plus, they're light so there's no damage when you crash them.

\- Please, please be careful with the larger quads. Don't fly over people, don't fly over buildings, roads, etc. Not only is this dangerous, (+2 lbs travelling at 40mph with spinning blades...) you're ruining the hobby for everybody else when things go wrong. Same goes for cameras strapped to your quad: respect privacy.

\- I've said it before but here it goes again: You. Will. Crash. Don't think 'I'll be extra careful' or (in my case) 'I'm a seasoned RC pilot, I think I'm able to fly this thing without crashing': you're wrong. I promise. You will crash, and you will break stuff. Not the end of the world, but get some spare props and a frame if you can.

\- I've had nothing but excellent experiences with Chinese webshops like dx.com, banggood.com or miniinthebox.com. Sure, quality is less than European brands like Graupner, but it'll work. Your first car probably wasn't a brand new Audi, but a banged up '89 civic, right? It'll get the job done just fine.

One last thing: I don't know if you have a wife/husband, but be prepared to spend a lot of time tinkering. It's an addictive hobby, I can tell you...

<comment><AUTHOR> One quick question - would you also know of drone simulators that offer the ability to test out flight control algorithms?

<comment><USER4> Not that I'm aware of... but when I try out new PID-settings I tie my quad to four pieces of string, tied to four bricks. Kind of low tech, but does the trick.

A flight controller in its most basic form isn't extremely complicated. It takes input from a gyroscope and distributes more power to the lower side. You can easily make a testing environment with the frame and motors, so without props attached.

Also, the APM mission planner software has a setup tool that takes input from both the transmitter and the flight controller. Maybe you can find a way to make that work for you.

The multirotor forum and the rcgroups.com forum have tons of resources about multirotors. Also, feel free to drop me a line if you have any questions. I'm by no means an expert, though!

<comment><AUTHOR> Thank you!

I just pinged you on twitter, but I thought I'd ask - would you know of any small copters like the cheerson cx10 that support customizable firmware?</comment></comment></comment></comment>


Ash HN: Suggestions for Good Resources for Investing - <AUTHOR> I would love to understand economics and build knowledge around investing. Please suggest some good resources around economics and investing (stocks, companies etc.) <comment><USER2> A reasonably sound place to start for investing as an individual is the Bogleheads wiki: [https://www.bogleheads.org/wiki/Main_Page](https://www.bogleheads.org/wiki/Main_Page) The general Bogleheads approach isn't to try to estimate value of individual stocks or sectors of the economy, basic idea is passive investment: buy & hold index funds to get diversified exposure to market returns, then minimise costs by avoiding funds with high management fees. Bernstein's [http://www.efficientfrontier.com/](http://www.efficientfrontier.com/) is good reading, from perspective of individual investor.

If on the other hand you want to learn about how to estimate value of companies (this will probably will not have a good return on time or money invested for an individual compared to low effort passive investment approach) one place to start reading is [http://pages.stern.nyu.edu/~adamodar/](http://pages.stern.nyu.edu/~adamodar/) & [http://aswathdamodaran.blogspot.com/](http://aswathdamodaran.blogspot.com/)

<comment><USER3> +1. Bogleheads Wiki is a goldmine of sound investing principles and personal finance. Also highly recommend their books reading list: [https://www.bogleheads.org/wiki/Books:_recommendations_and_r...](https://www.bogleheads.org/wiki/Books:_recommendations_and_reviews)

</comment></comment><comment><USER4> I have found [Wealthfront]([https://blog.wealthfront.com](https://blog.wealthfront.com)) to have a lot of good resources on their blog. And Robinhood has a nice section on [intro to economics]([https://learn.robinhood.com](https://learn.robinhood.com)) which is public.

</comment><comment><USER5> You might want to have a look at this thread posted a few weeks ago: [https://news.ycombinator.com/item?id=23052066](https://news.ycombinator.com/item?id=23052066)

<comment><USER6> I was going to say, we covered this recently.

</comment></comment><comment><USER7> Easy mode - Buy a ETF that represents the S&P 500.

Mode I plan to use with my kids - I have just picked up a great book, I have read the first 3 chapters. 'Warren Buffett's 3 Favorite Books: A guide to The Intelligent Investor, Security Analysis, and The Wealth of Nations'

The author is trying to condense the 3 books into an easy to read book. So far I find it wonderful.

</comment><comment><USER8> Get your hands on the CFA course material or for an introductory text read "Corporate Finance" by Berk and DeMarzo

</comment><comment><USER9> Buy and hold

</comment><comment><USER10> Most actively managed funds do not beat the index. For the average investor who doesn't have more than a couple of hours every week to figure out their investment strategy, just invest in indices. If you're in the US - the Nasdaq Composite or S&P 500. If you're in India, the Nifty 50 or Nifty 100. You can do this through ETFs.

However, it is not recommended you invest only in equity. Market crashes can result in your wealth eroding by 30-50% as seen recently and back in 2008. While it does recover in the long run, it is impossible to say how long a bear market will last which means your money will be locked in for quite some time. Further, your returns may not outperform inflation in a shorter time-frame. Also, if you have an emergency, the money is no longer liquid.

It is highly advisable to diversify your investment across asset classes. Having gold & fixed income (debt) in your portfolio will help protect during adverse market conditions and grow at a modest rate during bull markets. An example is this product which is available to investors in India: [https://www.smallcase.com/smallcase/SCAW_0001](https://www.smallcase.com/smallcase/SCAW_0001). It is only an example to show you how asset allocation helps protect against market volatility/crashes.

I would highly recommend you read about portfolio construction using the core- satellite methodology. [https://www.vanguard.co.uk/documents/adv/literature/client_m...](https://www.vanguard.co.uk/documents/adv/literature/client_material/core- satellite-investing-guide.pdf)

It would be wise to create an emergency fund for anywhere between 6-12 months as a separate thing.

Once you're more confident, start exploring niche indices; there are many ETFs. For example, the Bessemer Emerging Cloud Index has performed extremely well since March. An astute investor would have realized that people locked-in and working remotely would result in an increase in productivity apps, video content consumption etc. These rely on cloud platforms for hosting and delivery. One would have invested in it and made some pretty good returns. An investment on March 1st would be up 21% compared with 4% in Nasdaq Composite.

But this requires you to keep an eye on what's happening in the world and being able to interpret it. There aren't shortcuts to this.

But to get started with, you can start learning about the basics of business & economics. This might help: [https://learn.tickertape.in/](https://learn.tickertape.in/)

A very comprehensive resource for learning about investing can be found here: [https://zerodha.com/varsity/](https://zerodha.com/varsity/) (there's a lot of modules on trading, ignore if you don't want to trade. Do modules 1, 3 & 11).

Happy learning :).</comment>


Would Nikon Image Authenticated images be acceptable in a court of law? - <AUTHOR> http://forums.dpreview.com/forums/read.asp?forum=1000&message=18665523

<comment><USER2> This is an interesting topic, here's what I came up with after a bit of googling:

1\. The Nikon Authenticated Image system probably uses a hardware key. I couldn't find info on the official nikon site, but according to this guy it does ( [http://blogs.verisign.com/websecurity/2008/07/drowning_in_di...](http://blogs.verisign.com/websecurity/2008/07/drowning_in_disinformation.php) )

2\. According to another site, an established secure chain of custody for images with severely restricted write permissions is usually sufficient: [http://www.crime-scene- investigator.net/admissibilityofdigit...](http://www.crime-scene- investigator.net/admissibilityofdigital.html)

FWIW I know an LAPD crime scene photographer and they're shooting digital.</comment>


Google's Les Paul doodle guitar cost companies $268 million in lost productivity - <AUTHOR> http://www.extremetech.com/internet/24846-how-much-did-les-paul-doodle-cost

<comment><USER2> Well of course this is just theoretical, it would be true only if an employee worked and was effective 100% of the time, which is almost never the case. Employees have segments of good high energy work and other segments of rest, and this might have been the latter. In fact I think this doodle made some employees work more motivated after playing with it, specially in the IT world.

</comment><comment><USER3> Similar submission from a week ago - many comments:

<http://news.ycombinator.com/item?id=2642320>

</comment><comment><USER4> Imagine how many trillions of dollars using Facebook for the past few years must have cost companies.</comment>


My month with chemtrails conspiracy theorists - <AUTHOR> https://www.theguardian.com/environment/2017/may/22/california-conspiracy-theorist-farmers-chemtrails <comment><USER2> Summary: Many believers in chemtrails don't fit the common stereotypes. For example, the main believer profiled in the article is a 54-year old farmer who supports Donald Trump, describes herself as "media illiterate" and learned about the conspiracy theories on Facebook. Wait, that's _exactly_ the common stereotype? Well, the author hopes your mind will be blown by the fact that this farmer, um, lives in California or something.</comment>