ShowHN: AlreadyHN, a bookmarklet that checks if the current page is on HN - <AUTHOR> http://elias.kg/post/15568386753/alreadyhn <comment><USER2> If you're using Chrome, this extension works great to let you know about pages being on HN:

[https://chrome.google.com/webstore/detail/njdndkhkelkeepcnmo...](https://chrome.google.com/webstore/detail/njdndkhkelkeepcnmookckfhleebcokl)

<comment><USER3> I'm pleased to see that this extension sends only the hashed URL to its server, so you're not giving away your full browsing history in real time:

        var url_hash = hex_md5(tab.url);
        xhr.open("GET", "http://hnd.mfairley.com/" + url_hash, true);

[https://github.com/michaelfairley/hnd- client/blob/master/bac...](https://github.com/michaelfairley/hnd- client/blob/master/background.html)

<comment><USER4> Awesome for security. In order for this to work, the server-side has to keep a record of every single URL posted to HN, to be able to do a lookup of the hash. It's crawling the "/newest" page [1] once a minute [2]. Not sure how he handles situations where the worker goes down (do those posts just not get indexed?).

[1] [https://github.com/michaelfairley/hnd- server/blob/master/upd...](https://github.com/michaelfairley/hnd- server/blob/master/update.rb)

[2] [https://github.com/michaelfairley/hnd- server/blob/master/app...](https://github.com/michaelfairley/hnd- server/blob/master/app.rb#L14)

</comment></comment></comment><comment><USER5> A while ago, I posted a bookmarklet called Hacker Panel that actually shows HN comments for the current page. Do check that out too!

<http://news.ycombinator.com/item?id=2915367>

<comment><USER6> That sounds really good. Will definitely check it out

Shameless plug: is is my last bookmarklet for HN: <http://christopherdebeer.github.com/hnCommentWatcher/>

Update: I was a bit let down that you just show the HN page in an iframe, nd dont actually restyle the comments in a user friendly way like in a side bar for the site (which i think would be brilliant)

<comment><USER5> The thing is, I wanted to give the user complete HN commenting functionality, and have the comments look like regular HN comments too. So I figured that sourcing the actual comments page would be the best, since you get to use it just like you would if you visited HN directly.

</comment></comment></comment><comment><USER7> I wonder how I earn a living doing what I do, and have never heard the word "bookmarklet". Reading the definition I know what they are, I've just never heard the term until now.

One nice thing about HN is that I can admit to such things because of the anonymity. It sure is an embarrassing feeling.

<comment><USER8> I saw the XML icons on websites for years before paying attention to what they meant (RSS feed) and what you could do with it (feedreaders, etc.)

We as a profession suck. It's not a criticism, just a statement of fact. We're in the stone ages. The interfaces my fellow programmers create are hard to discover, hard to understand, hard to use. And then I try to create interfaces and end up perpetrating the same crimes in my turn.

</comment></comment><comment><USER9> Nice. I'm often conflicted over whether to bookmark the actual page or the HN comments. Sometimes the comments are so valuable, I'll bookmark them instead, since I can always get to the page in question from the comments. This provides a nice alternative. Thanks.

<comment><USER10> I always just bookmark the comments, or a link to a particularly valuable comment, instead of the actual page for the same reasons.

I have a separate folder for the actual pages that I link with their corresponding HN bookmarks using Firefox's tagging feature. It makes it easy to find and load up both pages.

</comment></comment><comment><USER11> Added a fork, use it if you like, that checks to see if you are already on the Hacker News site, and if so, redirects you to the first page. Not sure why you would be checking it on Hacker News, but seemed like it should know that and response accordingly. Feel free to ignore or close the request if deemed useless.

</comment><comment><USER12> "Simply drag the following link to your browser's bookmarks bar:"

I can't. I'm on FF 8.0, and the link doesn't seem to be a normal link, so dragging it ends up as a selection.

Indeed, it's not a normal link:

        AlreadyHN

<comment><USER13> Right click on the link and select "Bookmark This Link"

<comment><USER12> Thanks, but that option doesn't appear. I can do that in Chrome, which gives me a URL for the a element, so I'm guessing the link is dynamically created (for whatever reason) and that's not playing nice on my install of Firefox.

</comment></comment></comment><comment><USER14> I use a chrome extension. Shows you a orange bar on the left that slides out with comments.

[https://chrome.google.com/webstore/detail/hhedbplnihmkekhgma...](https://chrome.google.com/webstore/detail/hhedbplnihmkekhgmaoikgfbkjjaocnl)

<comment><USER15> and sends your full browsing history in real time to thriftdb.com!

The extension in the first comment does not.

</comment></comment><comment><USER16> Why does this load JQuery for nothing but a simple JSONP request?

</comment><comment><USER17> Removed confirmations, added page title. <http://pastebin.com/ySr5PnKu>

</comment><comment><USER18> Is there a public database of HN links (rather than multiple people crawling PG's server)?

</comment><comment><USER19> doesn't HN do that already? or is that only for exact match links?

<comment><AUTHOR> It is only for exact matching links.

<comment><USER20> So HN already does this and it does it exactly the right way: if you submit something which already exists, it upvotes it instead of resubmitting it, which is exactly what you want.

If you want to submit a link (or upvote it) anyway, what is the added value of this bookmarklet?

<comment><USER21> Who wants to copy and paste a link into the submit page on hacker news, then get the message that it already exists when they can click this little bookmarklet.

I like it, good job!

<comment><USER22> Or just use the bookmarklet from the submit page...

<comment><USER21> Yeah, that works too, but this bookmarklet adds onto that by not only submitting it, but also takes you to the comments in case it already exists.

It's like saying "why use powered windows, when hand cranks work just fine"

</comment></comment></comment></comment></comment></comment><comment><USER23> Wow, thats really nifty, thanks for making it!

</comment><comment><USER24> any idea why gethoneybadger.com doesn't get detected with this when it was posted on HN just a week back?

</comment><comment><USER25> whoa! great bookmarklet. very useful indeed. how long did this take you to make?

<comment><AUTHOR> Thanks! Since this is only a fun project the script took about 2 evenings of (casual) coding.</comment></comment>


Introducing the ALIAS Record - <AUTHOR> http://blog.dnsimple.com/introducing-the-alias-record/

<comment><USER2> "We're still working out some of the details of ALIAS records, but we do feel that they are a very useful addition to the records supported by DNSimple"

Guys, have you heard of writing an RFC? Other people might like this too, and have contributions to the detail.

<comment><USER3> It seems like this is a provisioning trick, rather than an actual DNS record. None of this "ALIAS" records ends up in a zone, or in a DNS packet; rather it is some option on a web interface that presumably never comes near the actual DNS because it is provisioned as something else.

I'm curious, if you point such an ALIAS to a service that dynamically returns different IP addresses based on location; what this service is going to do.

<comment><USER4> Right now it would resolve to the location of whichever of our name servers handled the request. Theoretically we could pass through the original requestor's IP address, but we don't right now.

<comment><USER5> Seems like that would make caching the results substantially harder on your side.

So, a small limitation is that this shouldn't be used in front of a geo dns. Fortunately, it's still a great choice for the other 99% of sites.

</comment></comment></comment></comment><comment><USER6> They should refer to this as a feature of their platform, not a record type.

</comment><comment><USER7> This seems very similar to the Amazon Route 53 Alias record which I've found quite useful for pointing to ELB instances:

[http://aws.amazon.com/route53/faqs/#Supported_DNS_record_typ...](http://aws.amazon.com/route53/faqs/#Supported_DNS_record_types)

<comment><USER4> The Amazon Alias record provided both the inspiration and the name. :-)

</comment></comment><comment><USER8> CNAMEs wont work for their use case, but it seems like DNAMEs might. However DNAMEs work at the (sub)domain level to alias a series of records, not just one.

<comment><USER4> We considered DNAME records, however a DNAME only redirects subdomains:

      Unlike a CNAME RR, a DNAME RR redirects DNS names subordinate to its owner name; the owner name of a DNAME is not redirected itself.

Thus for this to work for a second-level domain the redirection would have to occur at the top-level domain. In essence the behavior is not what is needed for this particular problem.

</comment></comment><comment><USER9> Dont PTR records already have this functionality

<comment><USER4> A domain could indeed have multiple PTR records and they can exist with other records for a name, however for PTR records to be used for the purpose of aliasing there would need to be some sort of additional processing in resolvers. If I were to write an RFC then PTR records might be a good place to start. Alternatively I think NAPTR records could be used as well.</comment></comment>


Ack - grep with highlighting and much more - <AUTHOR> http://betterthangrep.com/why-ack/

<comment><USER2> Use it all the time. Love it.</comment>


Nobel-winning economist Shiller calls Bitcoin a fad - <AUTHOR> https://www.cnbc.com/2017/10/16/nobel-winning-economist-shiller-calls-bitcoin-a-fad.html <comment><USER2> He also called gold a fad:

> "I think gold is a bubble, but it's always been a bubble," hedged Shiller. > "It has some industrial uses, but it basically it's like a fad that's lasted > thousands of years."

In other words, he's changed the definition of the word "fad".

<comment><USER3> This is the issue I have with all the bitcoin 'counter arguments'. They all revolve around tulip mania/fad status, yet a good number of the detractors admit to and acknowledge that the gold standard is no different.

If nothing else, Bitcoin is a media war. All the hype/nay-saying is revolving around non-stories and buzzwords.

Just because Bitcoin/cryptocurrencies are a fad doesn't make them automatic failures. They are most certainly a fad, the question is if this fad will remain or wash away.</comment></comment>


Netflix removes Community episode due to "blackface" - <AUTHOR> https://www.cheatsheet.com/entertainment/community-why-netflix-just-pulled-the-advanced-dungeons-and-dragons-episode.html/ <comment><USER2> It brings up the question about what is OK to laugh about again. The series as a whole makes jokes on the absurdity of racism (especially the seasons with Pierce, who's character is old and out of touch, being the butt of the joke and often condemned by the rest of the group for racist or anti-feminist points of view.)

If I remember correctly, the DnD episode has blackface on Ken Jeungs character Chang as he wants to play a Dark Elf, followed by the group chastising him? Might be wrong on that part.

</comment><comment><USER3> "Advanced DnD" is probably one of the best episodes out there, shame they pulled it.

Also, to echo some other comments here, Community gets plenty of its humour from racism towards black people.

* Pierce thinks Shirley is Troy's mum because they're both black

* Shirley thinks Troy can't swim to which he replies "uh, I can swim, racist"

* Pierce's Halloween story where Troy + Abed play some stereotypical hood characters which Pierce defeats by punching them with his penis.

* Pierce assumes Shirley's ex-husband is a waiter because he's black.

Community also makes fun of other races:

* It implies there's no difference between Chinese and Koreans (Chang goes "Oh, like there's a difference?")

* Pierce's dad wears a wig made out of pure ivory due to wanting to maintain "true follicular purity". Regular wigs are "made from the hair of godless Orientals".

* "Swedish dogs! Your blood is tainted by generations of race-mixing with Laplanders. You're basically Finns".

* Shirley casually says about Arabs: "They're not as understanding as Christians. You could get your head cut off with a salami sword."

* [https://i.kinja-img.com/gawker-media/image/upload/iubycnhccu...](https://i.kinja-img.com/gawker-media/image/upload/iubycnhccu0it3wa9yoc.mp4)

Community also has (plenty of) gay jokes. They also make fun of Fat Neil and body shame him to the point of tears. They also have a romantic subplot involving Jeff a 40yo lawyer and Annie an 18yo student. They also constantly make fun of the Dean's sexuality.

Community makes fun of so many minorities and has lots of racy jokes, why is Chang cosplaying a Dark Elf reason to pull an episode?

I mean, I get Netflix are trying to cover their ass, but it seems counterproductive and sends the wrong message.

</comment><comment><USER4> Removing this episode raises some good questions about what people are allowed to talk about.

In my estimation having someone play "a dark elf" isn't the same as blackface. Within acting blackface would be using a non black actor with exaggerated makeup to portray a cartoon version of their interpretation of a black person or culture.

On the other hand I find it ironic that it's among the most liberal of industries where the issue is most visible.

It reminds me that episode of the original Star Trek where a race of aliens is of human appearance but half their bodies are black and the other half white. It's a commentary on race, is that blackface?

</comment><comment><USER5> I understand the problem with blackface when you do it in a way to make fun of black culture. But the war against blackface in any artistic expression seems to me neither to be about fighting racism or anything productive or substantial. It just seem like an assertion of power by a movement.

</comment><comment><USER6> Did Donald Glover leave the show because he was a token character?

<comment><USER3> Are you referencing some obscure in-joke?

I know Tina Fey name drops Glover in 30Rock (where Glover worked as a writer for a while). She references him as "that black kid on Community".

If you're honestly asking, no, he wasn't even a token character. The Community group has always been really diverse, which is where most of the comedy comes from.

</comment></comment><comment><USER7> The whole series is full of racist jokes from racist characters, it is a bit strange that they pull the episode with the least racist joke on it.

</comment><comment><USER8> Incredible at what speed we are actively destroying our society.</comment>


Quick, cheap to make and loved by police–facial recognition apps are on the rise - <AUTHOR> https://www.theguardian.com/technology/commentisfree/2020/jan/25/facial-recognition-apps-are-on-the-rise <comment><USER2> I wonder what happens when we start aiming them at police officers, so that we can identify them in every social media post and security video they show up in. How many of their neighbors have Ring video cameras that share videos so easily?</comment>


Ask HN: What is your CS tutor salary? - <AUTHOR> I'm wondering how much the best online tutors for CS/software can make. Looking through Wyzant, I see people charging $200/hour, with one Google engineer charging $500/hour. If you have credentials from top companies and top schools, is several hundred dollars per hour realistic? How much time do you have to put in to get to this point? Do you tutor via a platform, or independently?<p>This seems like an amazing job to do remotely, or as a side hustle while in school, etc. I feel like there must be a catch I don't see — what is it? <comment><USER2> I wonder who is the client for a $500/hour tutoring. The only thing that comes to mind is some kid of very rich parents, who would be served equally well by a $25/h tutor, but just has money to burn. Other than that, assuming the $500/h tutor is some principal eng. with unique knowledge and experience, I could see his knowledge being worth that much in a short-term consulting deal, but not for tutoring (a couple of conversations can set up back $5000, I don't think engineers are willing to spend that much money on self-improvement with no guaranteed returns).

</comment><comment><USER3> The going rate for a student tutor at my university was between $20 and $30 per hour.

> I feel like there must be a catch I don't see — what is it?

If you're worth several hundreds of dollars per hour as a tutor, you're probably worth more actually developing software.

<comment><USER4> Never underestimate the wealth of a rich and lazy CS undergrad's parents.</comment></comment>


How to Leave GoDaddy.com in 10 easy steps - <AUTHOR> http://www.good.is/post/how-to-leave-godaddy-com/ <comment><USER2> It leaves out that you have to unsubscribe of any additional services such as domainsbyproxy in order to transfer.</comment>


Agility Robotics Raises $8M for Commercial Bipedal Robots - <AUTHOR> https://spectrum.ieee.org/automaton/robotics/industrial-robots/agility-robotics-raises-8-million-for-commercial-bipedal-robots <comment><USER2> When Jonathan Hurst (one of the cofounders) was getting his PhD, his lab was next to mine. We got to (had to) listen to his enormous jumping leg bounce for hours on end. At that point it was mounted on boom attached to a center pivot and the robot wore a circle through the carpet.

It's so cool to see how far this project has come.

<comment><USER3> Haha that's amazing

</comment></comment><comment><USER4> unfortunately they seem to have ignored statics and dynamics in the design of cassie, which means the control system will be leaned on more heavily to keep the robot balanced.

for example, the knees don't seem to passively lock like ours, which means it will have to use energy to just stand up. and lacking good dynamics is probably why we don't see it run (the control problem gets way harder).

(my masters was in locomotion biomechanics)

<comment><USER5> Also, I doin't see the advantage of bipedalism for robots. We can build a 4 legged robot that still has arms, and dogs can go pretty much anywhere that humans go. Quadrupedalism is much more stable (and hexapods are almost trivially so, but I think a robot with 6 legs is more likely to freak people out).

<comment><USER4> yes, bipedalism is inherently harder. a tripod would probably be the optimal legged robot. inherently statically stable but fewer corner cases for both static and dynamic stability than even a quadruped. the odd number of legs makes control a little harder though.

the cool thing about hexapods is that walking is basically using two sets of tripods in alternating fashion (e.g., cockroaches do this at slow speeds). as speed increases, they remove legs that touch the ground, going from hexapod, to quadruped, to biped at the highest speeds.

<comment><USER5> I hadn't thought about tripods, since they are (largely?) absent in nature. Do you have examples of what a tripod walking or running stride would look like?

<comment><USER4> i vaguely remember it being mentioned in something i read long ago. i think it'd be 1-2-3-1-2-3 for walking and (1,2)-3-(1,2)-3 for running or even 1-2-1-2 (bipedal) for the fastest running.

</comment></comment></comment></comment></comment><comment><USER6> Are walking robots required for package delivery and/or working around humans? Seems like a difficult solution to the easier part of a problem thats difficult for other reasons like SLAM, etc

<comment><USER7> Stairs come to mind.

<comment><USER8> Buildings are designed around the movement abilities of humans. Having a robot that is able to function with similar abilities makes sense. Robots are meant to adapt to us, not us to them.

What I've always thought is how people will perceive walking around robots. Scenes from Star Wars comes to mind. Will robots need their own service corridors in order to not scare people?

</comment></comment></comment><comment><USER9> They have several videos on their YouTube page if you want to see one in action:

[https://www.youtube.com/channel/UCN-StetwWuVYf- MU2_NVj4A](https://www.youtube.com/channel/UCN-StetwWuVYf-MU2_NVj4A)

<comment><USER10> That's ridiculous but this one [1] has a bit of a scary thing to it, with the two bots walking towards you in the beginning…

[1] [https://www.youtube.com/watch?v=DS18SeuMqtA](https://www.youtube.com/watch?v=DS18SeuMqtA)

EDIT: Ah, probably because I was listening without sound. The music makes it less menacing (clever them).

<comment><USER5> Someone needs to remix that with a menacing soundtrack (The shark's theme from Jaws or maybe Orf's "O Fortuna." I'm open to other suggestions).

[edit] Adding foley of menacing clanking sounds on each step and robotic whirs is a bonus.

</comment></comment></comment><comment><USER11> I can just imagine the insurance and rates of theft of these things. Super cool concept, but just like drones, I imagine a bipedal robot would would be too easy to break/steal without much real consequence.

<comment><USER12> I mean, if you are brave enough to steal something that is likely highly tracked not to mention has the ability to kick your ass...

</comment></comment><comment><USER13> three systems problems I'd like to see addressed, from simple to complex.

1) Getting stuck. I can imagine multiple situations where the environment changing leads to "stuck" situations.

2) Need to be aware of surroundings on par with human beings. No stepping on dogs or small children when walking up your front steps to drop off the mail.

3) human interaction: the "last 100 feet" is usually "my front porch and lawn". Ownership, control, and navigating human interactions are real issues there.

</comment><comment><USER14> They look like walking pants.

<comment><USER15> I'd imagine having very little weight above the hips would make the whole bipedal walking problem a fair bit simpler.

</comment></comment><comment><USER16> So excited about this! Not convinced that "Cassie" actually fits a market need, but that remains to be seen. Certainly it's the best-executed biped design to date.

</comment><comment><USER17> Probably not enough money. It took $120 million to get to Boston Dynamics' Big Dog.

<comment><USER18> Boston Dynamics' Big Dog was built in 2005 [1], I'd imagine the cost today would be dramatically lower, no?

[1] [https://en.wikipedia.org/wiki/BigDog](https://en.wikipedia.org/wiki/BigDog)

</comment></comment><comment><USER19> It remembers the Robocop's robots.

</comment><comment><USER20> HL-2 Begins.</comment>


Hacking Slack using postMessage and WebSocket-reconnect to steal your token - <AUTHOR> https://labs.detectify.com/2017/02/28/hacking-slack-using-postmessage-and-websocket-reconnect-to-steal-your-precious-token <comment><USER2> One of the best vuln write-ups I've read in a while, in that it steps you through how the initial entrypoint was found, and the steps needed to turn that into a dangerous exploit.

I think what really makes this writeup worth the read is the insight it shows into the thought process of identifying an interesting bug and weaponizing it. Thanks Frans!

<comment><USER3> Thanks a lot! I had a lot of fun doing it and I really wanted to get every step of the process out there, so that was some really nice feedback :)

</comment></comment><comment><USER4> The mitigation creating an a element seems a little bit awkward:

        if (!TS.utility.calls.verifyOriginUrl(evt.origin)) {
          return
        }
        ...
        verifyOriginUrl: function(originHref) {
                var a = document.createElement("a");
                a.href = originHref;
                return a.hostname == window.location.hostname
        },

Is there a JS API for getting the host name from an origin, or is creating DOM elements the way to do this?

<comment><USER5> There's a URL interface [0] in Web API, but unsupported in IE 11 [1].

[0] [https://developer.mozilla.org/en/docs/Web/API/URL](https://developer.mozilla.org/en/docs/Web/API/URL)

[1] [http://caniuse.com/#search=URL](http://caniuse.com/#search=URL)

<comment><USER6> Be careful with createElement('a') in IE. If the URL contains credentials (username or username and password), it'll throw a security exception.

[https://support.microsoft.com/en-us/help/834489/internet- exp...](https://support.microsoft.com/en-us/help/834489/internet-explorer- does-not-support-user-names-and-passwords-in-web-site-addresses-http-or-https- urls)

</comment></comment></comment><comment><USER7> Just out of curiosity, how long did it take for you to come up with this PoC? From the initial notice that something might be exploitable until you sent the email to slack?

Your post makes it look so easy, but it would surely take weeks for me to figure out all these things.

<comment><USER3> It's a common pitfall and easy to look for. The stuff I spent most time with regarding this specific issue was finding the proper event that did something bad.

</comment></comment><comment><USER8> Exposing onmessage wasn't the best idea. Instead it should be something more restrictive with origin check built in.

addMessageListener("[https://*.slack.com"](https://*.slack.com"), function(data){})

</comment><comment><USER9> Kudos to Slack for the quick fix! I've also been pleasantly surprised by their response times for bug reports, and even feature requests.

Wonder if their support team is proportionately larger than most startups, or if "10x Support Agents" are a thing?</comment>


Ask HN: What is the preferred payment provider for micropayments? - <AUTHOR>

I have been working on a new web application that will be accepting micropayments (typically a $1) and I am not sure which payment provider to go with. It looks like in most cases my $1 profit is being stripped of 30 cents or more depending on the provider. I know Paypal has been the de facto standard, but has anyone faired out well with Google or Amazon? <comment><USER2> I don't like Paypal but you can't beat the price: [https://merchant.paypal.com/cgi- bin/marketingweb?cmd=_render...](https://merchant.paypal.com/cgi- bin/marketingweb?cmd=_render-content&content_ID=merchant/wp_pro&nav=2.1.1)

Click on 'Pricing' then scroll down and expand 'Micropayments'

It's 5% + $0.05. So for your $1 in revenue only $0.10 is taken by Paypal.

<comment><USER3> Seconded : But they really don't emphasize the possibility in their main materials.

The way I found to get on the program is to apply for the standard account, and then apply for the change to micropayments. In my case, they didn't tell me whether I was approved, the only way I could see that is by looking at their take on transactions.

So far, it's working great.

</comment></comment><comment><USER4> <http://news.ycombinator.com/item?id=2033180> referred to this a while back.

centipaid.com talked about having a scaleable micropayment solution.

However, almost any solution requires one to have money 'in the system' and earn/spend the micropayments, and pay a fee to take it out or put money in. There are a number of other providers that do this through stored value Mastercards, etc, but, those fees sometimes become prohibitive.

The way I've seen a number of companies handle micropayments was to keep the money in the system, but, you couldn't get it released without earning $25 which kept administrative costs to a minimum. You had to fund the account, but, if you didn't spend it all, you couldn't get it back. Facebook credits work in a similar manner - one purchases $x of credits, then can spend those coins on various apps.

</comment><comment><AUTHOR> I also want to mention that I see Paypal and Amazon accounting for this, but they are doing it in a way that it hurts you to use it on all transactions over $10-12. In my case this could happen if someone did bulk buying. How would you model this out in a test environment, so you kind of knew what to expect?

<comment><USER5> Use the micropayment apis for products under the micropayment structure ceiling. Then use other apis, non micropayments, for transactions over a certain limit. Amazon FPS switches for you.

Paypal Micropayments [https://www.paypalobjects.com/IntegrationCenter/ic_micropaym...](https://www.paypalobjects.com/IntegrationCenter/ic_micropayments.html)

Amazon FPS (automatically switches between micro rates and larger purchases) <http://aws.amazon.com/fps/>

Under pricing: _2.9% + $0.30 for credit card for transactions above $10 and 5%+$0.05 for credit card for transactions below $10._

<comment><AUTHOR> I wasn't aware of the Amazon FPS. I am going to check this out and see how difficult it is to implement it. I guess the thing with using Amazon is whether people have more amazon accounts than paypal.

<comment><USER5> I would use Amazon and Paypal. While Amazon FPS scales to micro/regular payment for you, the Paypal link above mentions opening one micropayment and one regular paypal account and switching manually between. Both are allowed to get the best rate and it is worthwhile if you sell from .99 past $10+.

</comment></comment></comment></comment><comment><USER6> Definitely PayPal. Not only should you be able to get 5% + 5c, it also is just rolling out a much better UX for digital goods and more importantly has 200+ miliion ready to pay.

</comment><comment><USER7> Have you looked at companies like Social Gold which provide micropayment ecosystems for online games ?

<comment><AUTHOR> I just took a look at this and I like the concept. I kind of wonder if my game falls in line with their model though. Users would essentially buy tokens on my app and then use them which could result in a reward. So they are buying a service for a small fee.

It seems like social gold is more focusing on assisting a community or a large virtual world. I don't have that, but I do see they also identify it as useful for services. I guess I need to look more into it. I think what I will do is release my beta to HN and ask what they think I should go with. Ultimately some form of payment will be required, but I am not sure if I am approaching it in the best way.</comment></comment>


Cloudflare still refuses to support basic 2FA (2012) - <AUTHOR> https://blog.cloudflare.com/choosing-a-two-factor-authentication-system/ <comment><USER2> The requirement to use Authy is one of the most annoying things about using Cloudflare. The app exists on my phone only for use with Cloudflare.

<comment><AUTHOR> In my case, I don't have a device that Authy supports. I can't use 2FA at all because Cloudflare wanted to buddy up with another cloud product.</comment></comment>


Assume a can opener - <AUTHOR> https://en.wikipedia.org/wiki/Assume_a_can_opener <comment><USER2> On the topic of the apriorisms in economics:

Exponential Economist Meets Finite Physicist: [https://dothemath.ucsd.edu/2012/04/economist-meets- physicist...](https://dothemath.ucsd.edu/2012/04/economist-meets-physicist/)

A Lost Century In Economics: Three Theories Of Banking [https://www.sciencedirect.com/science/article/pii/S105752191...](https://www.sciencedirect.com/science/article/pii/S1057521915001477) (Results re-affirmed by several central banks after publishing)

Sonnenschein–Mantel–Debreu theorem (microeconomic rationality assumptions have no equivalent macroeconomic implications) [https://en.m.wikipedia.org/wiki/Sonnenschein–Mantel–Debreu_t...](https://en.m.wikipedia.org/wiki/Sonnenschein–Mantel–Debreu_theorem)

</comment><comment><USER3> Interesting. I guess it's the economist's version of the physicist's spherical cow. Sadly, I suppose the computer scientist's version would be something like "assume infinite memory/time/etc." which is not nearly as catchy.

<comment><USER4> The PL theorist says "assuming a sufficiently smart compiler..."

</comment></comment><comment><USER5> It's the same thing coming from anti-freedom folks trying to take guns away from law-abiding Americans.

"Assume we make it illegal to have guns, then there will be no crime or school tragedies yeepee!"</comment>


Show HN: Gifting Bitcoins without losing sleep over security - <AUTHOR> https://blog.blockonomics.co/gifting-bitcoins-without-losing-sleep-over-security-1f6eb72a5f0b <comment><USER2> I think you could do this with Ethereum without any service holding your coins, a smart contracts that would allow a person with the right key to redeem the coins.

</comment><comment><USER3> Great thing.</comment>


Ask HN: Next steps for professional translation startup - <AUTHOR>

<comment></comment><comment>---
Site description
</comment><comment></comment><comment>---
Linguaquote was created to provide a platform for quality Language Service Providers (LSPs – both freelance and agency) to present themselves and be compared in terms of expertise, location and price in a quick to use interface with no registration.
The LSPs displayed have all been pre-approved by national translation associations, higher education, translation specific qualifications and finally vetted on-site to ensure that only established professionals are displayed to buyers.
This is not the case on other platforms, even the largest of these, and it should remove a lot of the doubt and uncertainty in sourcing translation. Just pick your linguist with the matching expertise (aerospace, financial, legal, medical etc. etc.) and budget level or location and make a start.
For multi-language projects I will create a new user role for buyers to save their project details and store their files in their dashboard, if they'd rather register and do so. As it stands quotes are generated on an individual language by language basis.
</comment><comment></comment><comment></comment><comment></comment><comment>----
https://www.linguaquote.com
</comment><comment></comment><comment></comment><comment></comment><comment>----
Despite being a long-time tinkerer, I'm no designer or coder (as you'll see!) and I've put this together with Drupal (6), a custom module and lots of contributed modules as a 'solo founder'. Bootstrapped is the name of the game.
I've 150 free users since launching earlier in the year, and now I'm looking to move out of MVP mode. I've got a D7 version in the works (removes need for custom module, all handled by CCK, if you're into Drupal) and will incorporate the above-mentioned project management dashboard for buyers.
Now, I don't want perfection-paralysis or feature-creep to set in, of course, before a wider roll-out, and I know enterprise plan users will mainly want a decent amount of leads coming in rather than project management tools, but I still tend to think that it would help justify the spend if users could manage multilingual projects. It would have the added benefit of retaining and staying in contact with buyers through their accounts.
Should I hold back on marketing and sales until this new version is complete? Or would my MVP be enough to continue testing reactions and feedback?
</comment><comment></comment><comment>-----
Other information
</comment><comment></comment><comment>-----
- I've been blogging semi-regularly on relevant topics to try to improve search traffic and create a voice, but with few backlinks that's not kicking in yet (several months in) – I'm only sharing links online to the translation community
- This translation community is very wary of overly commercial startups, as more unscrupulous sites have managed to damage the industry's reputation in the past (and present…), so convincing linguists that I'm 'on their side' (I'm a translator too!), trying to make the industry more accessible to buyers and less dominated by the large agencies with marketing budgets like pirate treasure hordes, is an uphill struggle
- As they are so wary of commoditization and profiteering (possibly in part because it's such an academic profession), retweeting/sharing is rare if I post from the Linguaquote account, but more common if I post under my personal account
- But the site was well received by the mailing list of the UK's largest translation association
- A recent Adwords experiment didn't go brilliantly, probably meaning I need to work on my Adwords campaigns, conversion processes, or raising awareness of the utility of the site – a targeted mail campaign might help with this?
- My top-end pricing tier is based on patio11's 'don't leave money on the table' idea from his podcast with Amy Hoy [1], but perhaps I'd find this price hard to justify to buyers at present (even if one sale a month would cover that cost with ease)
Your questions and comments are very welcome; how's it looking, and what next?
[1] www.kalzumeus.com/2012/05/18/kalzumeus-podcast-ep-2-with-amy-hoy-pricing-products-and-passion/ </comment><comment><AUTHOR> OK. Over a week passed, the post inspired no particular comments. The few upvotes at least show minor interest. For future reference the post was of course too long, basically, and poses no particular question.

But it has had a positive effect for myself; namely that it forced a rethink of some of the fundamentals of the startup.

The new goals that have emerged are:

\- Rebuild in D7 to better use the Drupal framework (much simpler to control for us non-pro coders, regardless of lack of flexibility) and to offer more value to users

\- Work harder on specific 'traction actions', as highlighted in G. Weinberg's recent post[1] on the subject

\- Re-work the UX to include more interactivity and 'interest'

\- And more... (blog post to come)

[1] [http://www.gabrielweinberg.com/blog/2012/07/traction- mistake...](http://www.gabrielweinberg.com/blog/2012/07/traction- mistakes.html)

</comment><comment><AUTHOR> Clickable: <https://www.linguaquote.com></comment>


What software that turns Obama white can (and can't) tell us about AI bias - <AUTHOR> https://www.theverge.com/21298762/face-depixelizer-ai-machine-learning-tool-pulse-stylegan-obama-bias <comment><USER2> It's not a AI bias problem, it's a dataset problem. The issue isn't the algorithm neither are they selling this as a de-facto accurate Business software. You can take it and train the neural nets with whatever dataset you like.

<comment><USER3> > It's not a AI bias problem, it's a dataset problem

I would argue that it's beside the point. The argument is that the ML systems we generate now and are looking to use for real world systems have biases in them. For example, you do not want a lender auditing system used by banks to incorporate features that end up being proxies for race because the data you used to generate it was biased [1].

[1] [https://news.cornell.edu/stories/2019/01/study-ai-may- mask-r...](https://news.cornell.edu/stories/2019/01/study-ai-may-mask-racial- disparities-credit-lending)

</comment></comment><comment><USER4> I really don't see the problem.

White men are the largest demographic of the US, so nueral networks will have a bias towards them. It really isn't that complicated.

<comment><USER5> > White men are the largest demographic of the US

That is super unlikely, considering that women are born slightly more often then males and women live longer.

<comment><USER6> The sex ratio at birth is actually slightly biased towards men, it takes a few decades to even out. Globally, there are also more men than women, but that's partly due to China and India being artificial outliers, in most countries, women outnumber men.</comment></comment></comment>


Ask HN: Which cities outside the Bay Area would you move to? - <AUTHOR> I am a 35 year old software engineer currently living in San Francisco. I've lived here for the past 10 years and have loved each of those years. However I've reached a point where I would like to move to a more affordable city: one that allows me to lead a more balanced life than what I'm living today.
I've seen occasional HN comments where a few folks have chimed in about alternate cities to the ones in the Bay Area. While I understand that the Bay area provides the most interesting and challenging tech jobs, I'm ready and willing to forgo all that at this point in my life.
So, I'd like to ask folks for their insight about cities in the US/Canada that have a good set of tech opportunities and in their point of view affords them a high quality of life. <comment><USER2> Austin.

I got a call years ago from a recruiter to go work at Apple Retail Software Engineering, through their contract-to-hire process. I lived and worked in Cupertino for about six months, but it was clear things weren't working out. When the contract ended, I was very relieved that I could move back to Austin.

If they had made me an offer to convert, they would have had to pay me north of $250k/year in order to afford to live anywhere remotely close to the office and make it worthwhile. At that time, rent for a small 1BR apartment was well north of $2k/month, and that is much higher than my monthly mortgage payment here in Austin for a 4BR/3BA house in a very nice neighborhood.

<comment><AUTHOR> Thanks! I have heard that Austin is becoming a gateway from Silicon Valley, do you think prices for apartments/houses are still reasonable?

</comment></comment><comment><USER3> Portland, Seattle, Austin, or Atlanta. Currently live in Nashville and it has been a great move for me and the family. Nashville always has a number of tech jobs available especially within the many healthcare businesses. It is home to a number of corporate headquarters and is always attracting new businesses. It is very affordable and has a lot of entertainment whether you like music, sports, the arts, etc. Another plus is TN boasts NO state income tax.

<comment><AUTHOR> I've been looking at Nashville, I loved visiting there! I'm glad to know you like living there!

<comment><USER3> It is really nice although the humidity is awful. Job opportunities are plentiful and we are within a days Drive of Atlanta, the beach, Louisiville if you like horse races and have many annual events such as the Steeplechase, etc. TPAC is great if you enjoy plays and of course we have the Titans and the Predators if you like sports events. College football is huge here so you can get your fill of football or basketball as well. Downtown is host to weekly music events during the summer and we have a lot of festivals throughout the year and of course we have Fan Fair annually if you like country music. We also have 13 universities/colleges if you are seeking higher education. and you can live in Nashville or in the surrounding counties with anywhere from a 30 minute to one hour commute time if you drive to work during the typical business hours.

Not to sound like an advertisement but it really is a great place to live and work. Cost of living is very reasonable but we do have one of the highest sales tax rates in the nation (just shy of 10%) but our property taxes are very low and again, no state income tax.

</comment></comment></comment><comment><USER4> Portland, Austin, Boulder/Denver, Victoria, Edmonton, Saskatoon. "Good set of tech opportunities" is always relative and based on opinion, but these lower cost, high quality life cities do have some tech opportunities based on my experiences and info I have come across.

</comment><comment><USER5> sacramento, ca

boulder/fort collins, co</comment>


New SSA Back End for the Go Compiler (2015) - <AUTHOR> https://docs.google.com/document/d/1szwabPJJc4J-igUZU4ZKprOrNRNJug2JPD8OYi3i1K0/edit <comment><USER2> I find it somewhat ironic that most mainstream compilers now transform imperative code into a functional language in order to reason about the code.

<comment><USER3> And then your CPU does it again! After all that work, your compiler outputs a totally ordered stream of instructions; then the CPU tries to figure out data dependencies in hardware and execute instructions out of order and in parallel.

It seems as though C-like imperative languages and x86 are baked in forever... but the _world_ is actually parallel.

<comment><USER4> I've recently been thinking that we are looking at a situation analogous to the one Ben Franklin was in when he identified the two types of electrical charge as "positive" or "negative" pressure in the "electrical fluid" \- he took a guess, which happened to be wrong, and ever since we have been stuck describing a surplus of electrons as "negative" and a deficit as "positive". This is no obstacle for the experienced but will remain an eternal hangup for beginners.

By analogy, of course, I am suggesting that the Church model of computation might have served us better as a foundation than the Turing model has done, since it seems that everything's turning up lambdas as the technology S-curve for silicon computers continues to flatten out.

<comment><USER3> I don't really agree... One reason is that computing models don't say anything useful about I/O, which we need in real computers. Turing machines have a straightforward extension to incorporate I/O -- execute it as a side effect at a given step.

In contrast, the Church model doesn't really have any notion of time, so it's not clear how to reason about I/O. What evaluation order is used?

In terms of computation, they're of course equivalent, so you can execute the Church model on the Turing-like machines (or more specifically a Von Neumann architecture). So maybe that was the right "choice" (if there ever was one).

There was an entire movement around dataflow processors AND dataflow languages in the 80's, where the instruction sets were not totally ordered (e.g. SISAL was single assignment). But these didn't fare well in the market.

Closer to the ground, there is a pattern of "throwing away information at interfaces" in computing. Interfaces like x86, C, Unix, etc. get solidified by evolutionary forces. The cost of that modularity is global inefficiency.

Another good example of that is the Java code gen architecture. People say "static types in Java code let you generated better code!" Well, no. The Java compiler throws out all the type information, generating Java byte code, which is dynamically typed. Then the JIT takes the byte code and has to re-infer all the type invariants to generate machine code.

<comment><USER5> > _There was an entire movement around dataflow processors AND dataflow > languages in the 80 's, where the instruction sets were not totally ordered > (e.g. SISAL was single assignment). But these didn't fare well in the > market._

My understanding is that the dataflow architectures didn't fare well for technical reasons. The instruction-level parallelism they worked with turned out to be too fine-grained, i.e. the cost of scheduling was greater than the win of parallelism for many programs, especially normal sequential programs that still need to be fast. This led to research in coarse-grained dataflow, but it doesn't seem that much has come of that.

[https://www.cs.ucf.edu/~dcm/Teaching/COT4810-Fall%202012/Lit...](https://www.cs.ucf.edu/~dcm/Teaching/COT4810-Fall%202012/Literature/DataFlowProgrammingLanguages.pdf)

</comment></comment></comment></comment></comment><comment><USER6> Previous discussion: [https://news.ycombinator.com/item?id=9099744](https://news.ycombinator.com/item?id=9099744)

</comment><comment><USER7> i do wonder why they didn't go with llvm...

<comment><USER8> It's answered in the post:

 _A common question that comes up is "why not just convert to the IR of {llvm,gcc,...} and go from there?" I think there are 3 major reasons:

\- Compiler speed. I intend our SSA IR, and the optimizer passes implemented on top of that IR, to be fast by design. We'll aim for linear-time algorithms wherever possible. The backends of other possible compilers weren't really designed with fast compile speed in mind.

\- Runtime information. The runtime needs accurate maps of stack frames for both GC and stack copying, something that is not available from standard backends today.

\- An additional dependence. Do we want a {llvm,gcc,...} backend as a prerequisite for building Go? (Note that this would only be an issue for those developing Go, not those writing Go programs.)

I'm happy to be convinced otherwise - maybe we should throw our effort into getting frame maps out of {llvm,gcc,...} and figuring out how to configure the backend (e.g. which optimizations to turn on) to make it compile quickly._

<comment><USER9> Note, for the record, none of these are correct except for the last one:

1\. LLVM's SSA based compiler currently uses more linear time algorithms than Go's SSA backend (IE phi placement, etc), and in more places. So yeah. While parts of LLVM definitely could be sped up ( _particularly the backend_ ), it was _originally_ designed with fast compile speed in mind, just like go! Given how many years it's taken so far, you easily could have gotten the same thing out of LLVM. Would it have been more work? Probably, but not much. Are the other reasons not to do it? Yes. But the idea that their compiler is somehow the only one designed with fast compile time in mind is, honestly, pretty arrogant

2\. Stack maps have been supported for quite a while, and statepoint support now exists and is used by real people in real places.

But i'll also just point out he's never actually asked, or talked to the LLVM folks about it (search the mailing list, see if you can find any mail about it).

Note: I honestly don't care whether they write their own compiler or not. I suspect it's better for them to do it because of the community they want to build, because of how much control they want over their toolchain, etc.

But i'm not a fan of saying "someone else's infrastructure sucks, so we are doing it", when

1\. That's not the real reason as far as i can tell

2\. People are using, in production, the very things they claim don't exist (and they've been told this, it turns out)

3\. Answers about linear time algorithms are honestly just BS.

<comment><USER10> Is "Stack maps" the same as "segmented stacks" that Mr Cox refers to?

<comment><USER9> Segmented stacks are basically what safestack offers, and that is also something llvm does :)

<comment><USER11> No it's not. Segmented stacks are a way of allocating smaller stack segments that are linked together with pointers and kept in the heap and is a means of implementing coroutines. Safestack is more complicated and it segregates the stack into 2 parts to prevent stack buffer overflow attacks.

</comment></comment></comment></comment></comment></comment><comment><USER12> I was wondering what SSA meant, I think I'm right in saying this is the correct wikipedia page: [https://en.wikipedia.org/wiki/Static_single_assignment_form](https://en.wikipedia.org/wiki/Static_single_assignment_form)

<comment><USER13> Yes. SSA intermediate representations are now common in compilers. Many will have been exposed to SSA via LLVM.

</comment></comment><comment><USER14> > Just as an experiment I cleaned up the runtime function mapaccess1_fast64 by > hand in assembly and made it 29% smaller and with a speed improvement too > small to measure.

This doesn't sound very exciting.

</comment><comment><USER15> Why was the Go compiler not based on SSA form originally? Isn't that kind of an embarrassment? All industrial compilers I'm aware of completed their transition to SSA ~15 years ago ... it seems bizarre that a compiler for a language started in 2009 wouldn't have been that way from the start.

<comment><USER16> Alternative viewpoint: go has also accomplished a lot of its goals for years without needing this. It could reasonably be viewed as a premature optimization.

<comment><USER15> It's a pretty big architectural change to any compiler, and when _all_ other major compilers have paid that refactoring cost, it's very strange to want to go through the transition pain instead of just doing SSA up front like LLVM did.</comment></comment></comment>


Using Rust to generate Mercurial short-hash collisions - <AUTHOR> http://www.jandemooij.nl/blog/2015/05/05/using-rust-to-generate-mercurial-short-hash-collisions/

<comment><AUTHOR> Heh, and he submitted a bug report about it:

[http://bz.selenic.com/show_bug.cgi?id=4649](http://bz.selenic.com/show_bug.cgi?id=4649)

I'm not quite sure what to do about this, because it takes about 10 million commits before such collisions are likely to happen naturally, and it was a conscious computation from the early Mercurial days that, "12 displayed hash characters ought to be enough for everyone" (paraphrased).

It's not exactly a new revelation that this is a problem. It's even less of a problem when most of the time you use tags, bookmarks, or revsets to refer to commits, and like he says in the report, fixing this could incur a small performance penalty while hg computes what the shortest unique prefix is on a large repo.

</comment><comment><USER2> Why is it noteworthy that it was done using rust?

<comment><USER3> Other than being a task that's inherently CPU-bound, not much. There's been a lot of Mozillians itching to have any excuse to play with Rust lately. :P</comment></comment>


The Hackers Russia-Proofing Germany's Elections - happy-go-lucky https://www.bloomberg.com/news/features/2017-06-27/the-chaos-computer-club-is-fighting-to-save-democracy <comment><AUTHOR> Why would elections have to involve machines, nevermind computers?

I have studied, worked with and spent free time with computers a lot, for many decades, and I think I know quite a lot more about them than the average parliament member or other representatives. I have also worked as a volunteer at a voting place so I know at least partially how voting works, and which safeguard processes it includes.

I do not find computers useful for the voting process. I find them very detrimental to trust, and practically impossible to safeguard for voting. I strongly oppose using computers in anything in the critical path related to voting.

<comment><USER2> Paper ballots are just as easy to manipulate. Computers+blockchain should be the future of voting. Verifiable votes are something that paper ballots will always lack, and the computers could bring that to the table. However, this would make vote buying so much easier, so it probably wouldn't work for most developing countries.

<comment><USER3> Paper votes are difficult to manipulate _on a massive scale_.

You can stuff some ballot boxes and turn a polling station. But to do the same across the country to rig the election? At this point your country probably has worse problems and they won't even bother counting votes, but announce wholly fabricated numbers.

With electronic voting, it becomes trivially easy for a single hacker to falsify the entire election in one fell swoop.

<comment><USER2> >on a massive scale.

Usually you can't to manipulate elections "on a massive" scale to win, regardless of the format of the ballot. If the polls are 50/30 and the 30 ends up winning the elections, it will always be too obvious. Elections are usually stolen on the margins, look at most apparently-rigged-but-not-obviously elections in history.

>At this point your country probably has worse problems and they won't even bother counting ballots, but announce wholly fabricated numbers.

And yes, usually, when an election rigging scandal comes up, the country has more serious problems than vote manipulation.

>With electronic voting, it becomes trivially easy for a single hacker to falsify the entire election in one fell swoop.

But yes, I wouldn't say "trivially easy", but yeah, a lone wolf would never be able to falsify paper vote elections.

</comment></comment></comment></comment><comment><USER4> God, that headline ("The Hackers Russia-Proofing Germany's Elections"). Has it been ever conclusively proven that Russia hacked any election? Or is it just repeating unwarranted accusations in a form as if they were already facts?

<comment><USER5> Yeah. The evidence is pretty overwhelming at this point:

[http://www.cnn.com/2016/12/26/us/2016-presidential- campaign-...](http://www.cnn.com/2016/12/26/us/2016-presidential-campaign- hacking-fast-facts/index.html)

The fact that Reality Leigh Winner is being charged with leaking classified information on the Russian government's phishing-attack on computers at an American voting machine company confirms that leak was valid. Then last week a DHS official said the Russian government was targeting voting systems in 21 states. And these two things happened just this month. The evidence has been mounting for over a year now.

<comment><USER6> To me it seems disingenuous to call that "election hacking".

"Election hacking" conjures images of manipulating voting machines, but what Russia did based on that link you provided was simply find unsavory things the DNC has done in order to bring negative PR to the party.

<comment><USER7> > _To me it seems disingenuous to call that "election hacking"._

Really, you've never heard of social engineering/hacking? [https://en.wikipedia.org/wiki/Social_hacking](https://en.wikipedia.org/wiki/Social_hacking)

<comment><USER8> If I broke the pin on your smartphone and obtained evidence of infidelity on your part and gave it to your wife, did I hack your marriage?

<comment><USER9> You hacked his phone. You influenced his wife.

<comment><USER6> Wife hacking?

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> The strange thing is I've not heard any substantial allegations of "hacking" in the UK's recent snap election. Possibly it was called with too short notice for any to be organised. The other possible conclusion is that the British government is doing too good a job at weakening itself for the Russians to risk interfering...

(There is an allegation that a large chunk of Saudi money was given to the DUP, now coalition minor partners: [http://www.independent.co.uk/news/uk/politics/election- dup-b...](http://www.independent.co.uk/news/uk/politics/election-dup-brexit- donations-saudi-arabia-tale-tories-theresa-may-a7782681.html) )

<comment><USER11> The article is very interesting but seemed to stop short of finishing off the journalism that was started. Interestingly no link between Saudi money and the DUP was actually established at all. Not that there probably isn't hidden connections.

</comment></comment><comment><USER12> Unfortunately, the headline with "Russia" in it distracts everyone. I almost didn't click through to the article, and was pleasantly surprised that it is not at all about Russia or election hacking, but about the Chaos Computer Club and its standing in society and the institutions.

</comment><comment><USER13> > Said Linus Neumann

Given that name how could he not be hacker.

</comment><comment><USER14> I guess Russia-Proofing is a bit click-baity.

I mean, unless they are really only focussing on attacks by Russia. What I think helps a lot is awareness and preventing human error (taking the phishing bait).

</comment><comment><USER15> Is there anything like the CCC in the U.S.?

</comment><comment><USER16> Pencil and paper is pretty hard to hack.. social engineering in the other hand..

<comment><USER17> Social engineering... also called election campaigns?

<comment><USER18> I didn't realize foreign powers running massive botnets on Facebook and Twitter to share fake news stories was considered an 'election campaign'.

<comment><USER19> It's more than that. Advertising is legal as long as it's not libel.

Hacking into machines that store voter data isn't legal.

[https://www.bloomberg.com/news/articles/2017-06-13/russian-b...](https://www.bloomberg.com/news/articles/2017-06-13/russian- breach-of-39-states-threatens-future-u-s-elections)

<comment><USER20> But it is helpful for voter targeting, especially when you pass that information onto republicans who offer to buy it. Also helpful is targeting swing state databases and deleting the voter registrations of people who you think would vote against your candidate.</comment></comment></comment></comment></comment>


Ask HN: My startup is in a WeWork. What should we expect? - <AUTHOR> We rent half a floor in a WeWork in NYC. We recently priced out a move to a traditional lease. With the uncertainty about where we'll be in 5 years, we came to the conclusion that staying in WeWork is the best thing for at least the next 18 months.<p>With all the drama around WeWork's S-1, I find myself wondering what the possible outcomes might be... your thoughts? <comment><USER2> > I find myself wondering what the possible outcomes might be... your > thoughts?

Per the S-1, they have sufficient revenue ($1.5 billion in 1H2019, or very roughly $3 billion annually[1]) and capital ($2.9 billion in cash & equivalents) to service the leases and location operations ($1.3 billion in 1H2019) for the near future, if not indefinitely. Even including SG&A, it's still fairly close to cashflow breakeven (roughly $3.0 vs $3.8 billion annually) given their revenue growth rate.

What they don't have is enough capital to continue expanding - building out new locations and paying leases before they generate revenue - as fast without raising more capital, or to service the leases if customers defected. But as an exiting customer, that's not a big deal for you.

Basically, at least for the next year or two, I think it's likely that nothing will change. Beyond that, it'll depend on their plans to raise more capital and to address locations which aren't at operating profitability.

Once they figure out a strategy, the locations at highest risk of closing would be those with the lowest occupancy rates, which probably opened in 2019. They'd need to buy out or renegotiate the lease (from a fairly weak negotiating position) to do that, though. As long as revenue continues to grow, I think it's more likely they'd stop opening new locations or raise capital on bad terms rather than paying to close existing locations.

tl;dr: little or nothing is likely to change in the next year or two. If your location is more than half full, nothing is likely to change unless a recession occurs and revenue drops (which was also a risk before their valuation reset).

[1]: "It took us more than seven years to achieve $1 billion of run-rate revenue, but only one additional year to reach $2 billion of run-rate revenue and just six months to reach $3 billion of run-rate revenue." (S-1 page 3). Their run rate is probably higher than $3b right now.

<comment><AUTHOR> Thanks so much for this thoughtful and well-argued answer. I really appreciate it.

</comment></comment><comment><USER3> I've considered getting a WeWork space...but haven't yet for myself.

But I totally wonder how it will affect all those startups and independent people.</comment>


Ask HN: What book can you recommend to train ones memory? - <AUTHOR> I am wondering if you can recommend a book to train your memory. It would be good if it covers multiple strategies/ways to achieve that and action items to train it. <comment><USER2> Take a look at the Mentat wiki.[1] It has lots of really great articles on memory aids and techniques.

[1] - [http://www.ludism.org/mentat](http://www.ludism.org/mentat)

</comment><comment><USER3> Moonwalking with Einstein by Joshua Foer</comment>


Report: Tesla using behavior cloning/supervised imitation learning for Autopilot - <AUTHOR> https://www.theinformation.com/articles/what-makes-teslas-autopilot-different <comment><AUTHOR> Key excerpt:

"Tesla's cars collect so much camera and other sensor data as they drive around, even when Autopilot isn't turned on, that the Autopilot team can examine what traditional human driving looks like in various driving scenarios and mimic it, said the person familiar with the system. It uses this information as an additional factor to plan how a car will drive in specific situations—for example, how to steer a curve on a road or avoid an object. Such an approach has its limits, of course: behavior cloning, as the method is sometimes called…

But Tesla's engineers believe that by putting enough data from good human driving through a neural network, that network can learn how to directly predict the correct steering, braking and acceleration in most situations. "You don't need anything else" to teach the system how to drive autonomously, said a person who has been involved with the team. They envision a future in which humans won't need to write code to tell the car what to do when it encounters a particular scenario; it will know what to do on its own."

In this context, behavior cloning (or behavioral cloning) most likely means supervised imitation learning. That means training a neural network on a dataset of world states labelled with drivers' actions. After training on these state/action pairs, the neural network attempts to predict the correct action for each state it encounters. (Detailed explanation: [https://arxiv.org/abs/1701.06699](https://arxiv.org/abs/1701.06699))

Here's a great visualization of how Tesla currently sees world states: [https://youtu.be/qgBBTDu1rzk](https://youtu.be/qgBBTDu1rzk)

Waymo did a small-scale experiment with supervised imitation learning, which they wrote about here: [https://link.medium.com/D5XORBIgQT](https://link.medium.com/D5XORBIgQT) They also published a paper: [https://arxiv.org/abs/1812.03079](https://arxiv.org/abs/1812.03079)

What do machine learning people think of this approach?</comment>


Ask HN: Is there a way to retrieve the questions I ask Siri on my Homepod? - <AUTHOR> I would like to see the queries I ask 'Siri' on Homepod. Is there a way to access them, like Google's My Activity? <comment><USER2> Unfortunately, there's no way to do it currently. How do you like using your homePod ? What are somethings that you like / dislike about it ?</comment>


Life and Death of the American Arcade - <AUTHOR> https://www.theverge.com/2013/1/16/3740422/the-life-and-death-of-the-american-arcade-for-amusement-only <comment><AUTHOR> I grew up playing Asteroids, Missile Command, and Space Invaders - but pinball was always more interesting because of its lack of predictability. Even good players couldn't perfectly master it.</comment>


CloudFlare now includes SSL with every paid plan - <AUTHOR> http://blog.cloudflare.com/easiest-ssl-ever-now-included-automatically-w

<comment><USER2> Sounds great to me. Especially if you need to support SSL with a limited range of IP addresses.

Can anyone comment on the security repercussions on using the 'flexible SSL' mode, e.g. traffic is SSL between the user and cloudflare, but non-SSL between cloudflare and your server.

I guess I would not trust that for sending credit card details, but works to prevent simple session hijacking.</comment>


The Art of Lisp & Writing - <AUTHOR> http://www.dreamsongs.com/ArtOfLisp.html

<comment><USER2> The site was down for me. Here's a google cache link: [http://webcache.googleusercontent.com/search?q=cache:ImsGeKm...](http://webcache.googleusercontent.com/search?q=cache:ImsGeKmnPowJ:dreamsongs.com/ArtOfLisp.html+&cd=1&hl=en&ct=clnk&gl=ca)

</comment><comment><USER3> One of the distinguishing features of Lisp is that people write love songs about it.

</comment><comment><USER4> Some comments from a couple years ago: <http://news.ycombinator.com/item?id=1238542>

</comment><comment><USER5> This article articulates so many principles I have come to believe in but have considered to be inexpressible. There is a LOT of insight here.</comment>


WhatsApp eyes lending feature in India as Amazon rolls out Pay Later - <AUTHOR> https://techcrunch.com/2020/04/28/whatsapp-eyes-credit-feature-for-users-in-india/ <comment><USER2> I was already immensely concerned over the cognitive hold on millions of Indians by WhatsApp, financial data and debt makes it even worse.

When all it takes is a single forward from your WhatsApp uncle/aunty to undo all the rationale induced in the vulnerable members of the family to protect them against COVID-19, it should be treated the same way as a security vulnerability on a platform is treated; only in this case the vulnerability is limited attention/cognitive biases of the users, nevertheless it's the platform which enables it to be exploited.

I appreciate the steps taken by WhatsApp to limit fake news & misinformation such as limiting forwards; but it is certainly not enough. They need to implement aggressive detection, reporting and banning mechanisms for those who spread even a single misinformation/fake news.

I don't think it's the Engineering effort which stops them from doing that.

<comment><USER3> > They need to implement aggressive detection, reporting and banning > mechanisms for those who spread even a single misinformation/fake news.

Two issues with this:

1\. This is simply not a realistic standard in India, a nation which lacks the basic level of education of many Western nations. While this is true of a few people in most nations, and while many citizens can't be bothered to check, it helps if some at least have the background knowledge to do their own fact- checking rather than just taking the word of one person over another.

2\. The "who decides" problem, best illustrated by yesterday's removal of the medical opinion of two front-line doctors from you tube because it "contradicted WHO recommendations". One man's "fake news" is another man's "front-line reporting".

<comment><USER2> >This is simply not a realistic standard in India, a nation which lacks the basic level of education of many Western nations

2016 US elections showed western education doesn't help much in defending against misinformation campaign.

I'm not denying that filtering fake news is going to hard, but when people are getting killed directly as a result of fake news from a platform[1], democratic process are undermined by misinformation campaigns, everything which needs to be done should be done.

As for YouTube moderation policies, at least there are some policies which we can debate upon.

[1][https://en.m.wikipedia.org/wiki/Indian_WhatsApp_lynchings](https://en.m.wikipedia.org/wiki/Indian_WhatsApp_lynchings)

<comment><USER4> > 2016 US elections showed western education doesn't help much in defending > against misinformation campaign.

How exactly did they show this?

<comment><USER5> Now I'm somewhat curious whether you don't consider misinformation to have played a role in those elections or whether you don't consider the U.S. an example of western education.

<comment><USER4> Show some evidence that the misinformation actually had a significant effect. I know it's been widely discussed, but I haven't seen any significant efforts to quantify the impact.

</comment></comment></comment></comment></comment></comment><comment><USER6> We had a post in HN about some random App doing this two weeks ago or so.. The author's where whining because they were plugged from the stores.

The guys sent SMS to everyone in your contact list if you didn't pay. LOL

</comment><comment><USER7> Interesting. WhatsApp currently has no business model. No ads. The app is free. This can be an interesting area to charge users some real money. In India, WhatsApp is already huge -- 400 million users -- so they have a reach that is unparalleled in the world's second largest internet market. And largest open market.

<comment><USER8> WhatsApp's main business model is to infer relationships and social graphs on behalf of Facebook, since people trust WhatsApp with access to their contacts even though they might not trust Facebook.

<comment><USER9> I am in this group and recently my phone had problems. Moved to an older phone that was within the house. Decided not to give WhatsApp access to my contacts. The same is now basically as good as useless. I can't start a conversation with anyone unless I am replying to a previously shared with message. There is just no way you can input a contact into the message which is certainly a clever way of inferring the social graph. Well, now I am just about to give in to them.

<comment> green-bottle [https://api.whatsapp.com/send?phone=<PhoneNumber>](https://api.whatsapp.com/send?phone=<PhoneNumber>)

I use this link which will open in WhatsApp by default to send a WhatsApp message to someone who is not in my Contacts and don't want to add to my Contacts just to send a WhatsApp message.

It will be a pain in the arse to use for all your contacts and probably not worth the effort as if you use WhatsApp regularly (for an Indian there's no way around it) you will have sent a message to almost everyone on your contact list at least once and Facebook will know about it rendering the whole thing pointless.

<comment><USER10> Maybe someone can make an entirely offline app doing this, to allow you to WhatsApp your contacts?

</comment></comment></comment></comment></comment><comment><USER11> I think it is pretty smart idea. Facebook has recently bought a 10% stake in India's large Telco , JIO. Speaking of risk, Jio is very (horribly) efficient in invading cutomer's privacy as they are datamining literally everything and also oushing in-your-face-advertizing-inserts. Facebook is also equally (horribly) efficient in data mining. So using this data from millions of consumers, they could lower the risk of default. The current default rate for microfinance in India is 2.9%. ( [https://www.equifax.co.in/about- equifax/press-releases/-/blo...](https://www.equifax.co.in/about- equifax/press-releases/-/blogs/the-microfinance-sector-in-india-now-has-a- default-rate-of-2-9-/) ) . They could easily reduce this rate using this data. So yeah -- tihs will be really profitable.

<comment><USER12> Not to mention that Jio, the mobile data network, is owned by the richest man in India (1).

The investment was a strategic one too, Facebook could leverage this relationship with Jio (reliance) to keep mining data.

Edit: here's a fantastic thread on the relationship between FB and Jio.

[https://twitter.com/iramneek/status/1253305972233105409](https://twitter.com/iramneek/status/1253305972233105409)

(1) [https://en.wikipedia.org/wiki/Mukesh_Ambani](https://en.wikipedia.org/wiki/Mukesh_Ambani)

</comment></comment><comment><USER13> Someone should come up with a lending service where they lend you money and you never have to pay back. Instead they make a profit by collecting funding from investors. I think such a service would be very popular.

<comment><USER14> I want to frame this comment and gift it to those whom deserve it most.

</comment></comment><comment><USER15> > But the local payments body has removed most of the fees they could levy on > banks and merchants to make money. The move has resulted in firms exploring > other financial services, such as credit and insurance and target merchants > to make money.

Ah, unintended side effects that leave citizens worse off at work once again...

Loans could be fine if done properly but the idea of tons of financial tech companies being forced to push loans hard in order to offer their original and far more stable business model swept from beneath their feet is worrying.

<comment><USER10> How does that leave citizens worse off? Removing charges from payment makes that comission go to citizens, small businesses and away from the pocket of big corporations. The fact that big business can't make money by charging for payment is not worrying. If the credit offering are not good for citizens, regulations will fix that. Government shouldn't allow everything in the fear that big business will do something even worse.

<comment><USER15> _Of course_ the citizens will like that its "free" but that doesn't make the costs of operating the financial networks also suddenly free.

Nor is it guaranteed the loans will be feasible enough business to cover expenses for the primary financial networks... Let alone covering any sort of customer service, help fighting fraud and theft, or to invest in expansion to new markets, or improving their software products, cover their own banking fees and insurance risks, pay their workers a decent salary, etc, etc.

The government basically limited access to a potentially massive marketplace that would do wonders for the wider economy, increasing efficacy and benefiting local business (India's economy is terribly inefficient and littered with rules that change every region), and instead of charging for the actual service they are providing they will be forced to push a bunch of debt onto the communities that they don't need (or some other shady monetization strategy like selling data and advertisements or other stuff that may even hurt the original business).

This will also likely further limit the market to a monopoly as it requires massive scale to get the <1% who might have loans, so they can get good enough deals with the banks to lower their own fees to have survivable margins. On top of the main business expenses.

Monopolies are famous for being extremely anti-consumer but still surviving with little competition because they are the only ones big enough to navigate the countless legal, regulatory, and technical hoops required.

Destroying the most basic business model... Even before the companies get off the ground (article says the gov still only granted access to a million customers) sounds like a terrible idea.

Who knows how much the fees could have declined from competition alone? Or whether anyone will even continue investing in it if no model exists.

Just saying the government can write even more rules around the debt will make all problems go away is very naive. Unless your end game is gambling all the pieces will come together before it all crashes or the government running it themselves and/or let taxpayers cover the losses?

<comment><USER10> Every single bank in India offers the exact same free payment service (UPI based, which these big co apps are also using, identical in functionality), and that is free just like other bank based free payments. So even if all the bigcos leave India payment market, it won't make any difference at all.

>and instead of charging for the actual service they are providing they will be forced to push a bunch of debt onto the communities that they don't need

This is an absolutely ridiculous argument. Your argument boils down to "Government shouldn't stop bigco from doing anything bad, as then they will be forced to do even more shadier stuff".

>Destroying the most basic business model... Even before the companies get off the ground (article says the gov still only granted access to a million customers) sounds like a terrible idea.

This argument is wrong. First of all, WhatsApp was not granted access to all customers because they said they weren't ready to interoperate with others, i.e, whatsapp users couldn't pay google pay users. A fundamental requirement of UPI is interoperability, so regardless of which app you use, you can pay anyone on any app. This can be avoided if you are in testing stage, like WhatsApp was, but then your acesss is not to all customers.

> Who knows how much the fees could have declined from competition alone? Or > whether anyone will even continue investing in it if no model exists.

The fees are zero via any bank app. I don't see how a bigco can ever offer lower fees than the providing bank.

</comment></comment></comment></comment><comment><USER16> I've been keeping an eye on services After Pay in Australia for years. I often thought about rolling it out in Nepal and other developing countries and then I stopped. I came to the conclusion that there is an even greater amount of risk in countries where such credit is not normally available, a huge lack of capital for most people and families is the norm and decided that this would be a predatory practice. So I stayed away.

With everything happening right now, it's incredibly irresponsible for such a product to be released in a market that is unprepared to deal with the consequences.

Starvation for many families who would avail of this service is a fact. Many have come out and said that they will probably starve long before they contract any virus. Scary stuff. Shame on Amazon and shame on Facebook!

<comment><USER17> You're saying that an entire country doesn't deserve a new credit service because of a lack of existing credit services in that country.

1\. You're ignoring middle class and well-off people in those countries. 2\. Access to credit is important for developing economies. 3\. Access to credit doesn't imply predatory lending, that's a separate problem in how the creditor runs their business.

<comment><USER16> I'm not ignoring them at all.

I know that this service will be abused by those who need quick access to capital and it will ruin many of their lives. I don't support payday lending either, doesn't mean that it's illegal but it sure is unethical to charge high interest rates on low sums.

<comment><USER18> Amazon has said this is rolling out (only) to "eligible customers", so it may be restricted to the middle class.

The people that are facing starvation are not Amazon customers in the first place; they are mostly migrant labour that doesn't have a fixed address, or they live in remote areas where Amazon does not deliver.

Also, we don't know what the interest rates are, as yet.

</comment></comment></comment></comment><comment><USER19> As an Indian, I'm more scared with FB now getting our financial data.

<comment><USER20> I've said it before, I'll say it again. And I mean it only 40% facetiously.

Facebook + Jio = Skynet.

<comment><USER21> Skynet from the movie? It was military AI. Not sure how these are related.

</comment></comment></comment><comment><USER22> The general risk profile of people is increasing due to job loss in the current pandemic. Is it a wise time to launch a money lending feature right now?

I'm a noob at economics so please ELI5.

<comment><USER23> If I were an investor I'd be worried... from a humanity point of view, I'm cheering this, in the developing world the governments aren't helping enough (some would argue, "It's the same in the developed world!") and day-wagers are probably going to starve to death[1]. A sudden line of credit would be a boon to help them survive.

But since a capitalist came up with this, it would not surprise me if the loan terms are horrendous and basically means they will be loansharks with slaves trying to pay off the loan in the future.

[1] [https://www.theguardian.com/world/2020/apr/04/i-just-want- to...](https://www.theguardian.com/world/2020/apr/04/i-just-want-to-go-home- the-desperate-millions-hit-by-modis-brutal-lockdown)

<comment><USER16> >> day-wagers are probably going to starve to death[1]. A sudden line of credit would be a boon to help them survive.

If day wagers stay out of work how can they possibly earn the money or interest required to pay the short term loan? Most day wagers have already exhausted their savings. Debt on top of debt usually means starvation in these countries.

<comment><USER23> Well, a humane billionaire would just set very low interest and repayment terms of "when you can". In the end it would just be no different to charity. I wonder what's better, donating to the Indian version of food banks, or giving them money so they can buy food.

There are (were?) already microcredit websites where people in the developing world place loan requests like "I need a $500 loan to start a little shop", and a bit like Kickstarter, you can give them the loan, but also you accept this shop idea might not work and they would default on their loans -- and the site tells you this, so from your point of view the loan would become charity.

</comment></comment></comment></comment><comment><USER24> The headline is actually: "WhatsApp eyes lending feature in India as Amazon rolls out Pay Later to tens of thousands of customers"

Not sure whether this should be amended?

<comment><USER25> It probably didn't fit in the character limit and needs a bit of editing.

<comment><USER7> Yeah, not the fault of the person who submitted the story, which is fairly informative. I'm assuming one of the moderators would fix it when they see it.

<comment><USER24> Yup, never meant this to come across as assigning a 'fault', was just pointing it out, as I was interested in the headline and then suddenly it stopped ;)

</comment></comment></comment></comment><comment><USER26> How much companies have actually lost in these schemes? Flipkart has been doing it for years now.

</comment><comment><USER27> What happens if people don't pay ?

Do they fly in people with guns from California ?

The problem was never access to credit, but access to high income jobs.

<comment><USER28> They hand it over to a local debt collector agency or whatever the local procedures are. Maybe they call the bank and take it out of the persons next pay check.

I disagree that it is a jobs issue. It is a legal issue and what procedures exist for these situations.

</comment></comment><comment><USER13> The idea of lending in our current financial system is stupid. Just stupid.

It's like investing in a business except with almost all of the downside if they do poorly and very limited upside if they do well. It's a deceptive economic tool for social control, that's all it is.

The economy would be way better off if we just illegalized lending. Especially lending by banks.

<comment><USER29> How would you be able to afford a mortgage?

<comment><USER13> I'm a millenial. I already can't afford a mortgage. How will that change anything?

But if they ban lending, it would cut demand to buy properties and would cause a price crash. Then within 5 years, I would be able to buy a house with cash.</comment></comment></comment>


Trump's immigration crackdown could sink US home prices - <AUTHOR> https://www.bloomberg.com/news/articles/2017-02-22/why-trump-s-immigration-crackdown-could-sink-u-s-home-prices <comment><USER2> Perhaps it won't get near the last mortage bubble, but it would have some interesting consequences on the economy...</comment>


Show HN: Ybin – private pastebin - <AUTHOR> http://zx.rs/7/ybin---paste-data-privately/ <comment><USER2> Direct link - [http://ybin.me](http://ybin.me)

this is nice, but it needs syntax coloring and a way to edit+repost.

There's something wrong with your dropdown menus in Safari - [http://imgur.com/0pF4Dy8](http://imgur.com/0pF4Dy8)

<comment><AUTHOR> Hey. Thanks for the feedback. I've just implemented a way to edit+repost. About syntax highlighting, it'll be implemented in the following days. I'll check out the dropdown menus as well.</comment></comment>


How orchestrated are the images used in Gmail's new look comparison? - <AUTHOR> https://mail.google.com/mail/help/intl/en/newlook_sizes.html

<comment><AUTHOR> What I mean is, who is firstname.lastname@example.com, is he a real person? Their official demo account? A random quantification of the average Joe?</comment>