Show HN: Moqups - Vectorial mockups with HTML5 and SVG - <AUTHOR> https://moqups.com/ <comment><USER2> As a huge Balsamiq user, I'm definitely pulling for you guys because I'm not completely happy with them.

The basic functionality is great, but having the ability to make clickable online demos where I could send links to people would be a killer feature that would make me switch very quickly.

Having said that, a few UX notes:

-You have incompletely applied the tab metaphor on the left-hand panel. For a while, I was trying to figure out why a label was a stencil but a paragraph was an image. At the very minimum, your "shaded" tab should extend under the other one to show that it applies to both columns.

-Categorizing your stencils, even a little bit, would help. Balsamiq screwed this up, and now they have a bunch of nonsensical categories (quick, what would you expect to find under media?)

-I would recommend grouping your stencils by things that tend to be used together. For example, form elements should be all together, mobile stuff too.

-I know you're not native, but the right-click context menu on Balsamiq is much better than putting the align/arrange/lock at the top of the screen. I use this stuff a lot, and the extra distance is a pain

-Also, I don't see the capability to have some sort of templates. That's definitely a must for any decent size project

/edit I just discovered the context menu (double delayed click is a good solution). Still think at least the lock button belongs on the menu and not at the top

<comment><USER3> Yes rapid online sharing of prototypes is increasingly crucial. Every tool I've used that does this has some clunky flaw. If this were combined with a quick shortlink based share tool it would quickly become my goto wireframe app

<comment><AUTHOR> Once you sign in and save the project, you can easily get the permalink of the project in the Share popover.

</comment></comment></comment><comment><USER4> Interesting tool! I'll definitely give this one a shot next time I'm mocking up. Having said that, if you need to explain something by saying "This is a bit tricky to master until you get a hold of it", that's probably because it's a bad idea.

It's confusing that you have "click" "click, then click" and "doubleclick" as three separate actions. They are too easy to mix up or accidentally activate. Why not take a page from Apple's design patterns and put a context-sensitive inspector panel on the right or top to hold things like fill, stroke, alignment etc. This is the way Omnigraffle, Illustrator, Keynote, Sketch etc. work and in my opinion it's a much more effective pattern than what you have now.

Impressive work. Hope to see more of this!

</comment><comment><USER5> Wow I can't fathom the amount of work that has gone into this project. Was the multi-line editor a challenge? I know SVG Edit has been struggling with this feature for some time.

<comment><AUTHOR> Pheeeew! Indeed. It was quite a challenge. After spending two months into building a custom text layout engine, we ended up throwing all the code out the window, mostly because the performance was terrible with more than a few hundred characters. Beside this, there were a gazillion other scenarios that we could not simply cover (kerning, spacing, i18n, ligatures, cross browser differences & so on).

We ended up using foreignObject for rendering text, with the compromise that we need to look for solutions to enable pure svg export. This is still a technical debt on our plate. A roundtrip solution that converts hybrid SVG into PostScript and then back into SVG may work... we'll see.

Either way, we'll start writing some technical articles on our blog, so others can take advantage of our findings (we really owe a LOT to the community)

<comment><USER6> That is awesome, thanks for sharing. I'm very interested, as I'm sure many others are, to hear about the tools you've used and the development process. Great app!

</comment></comment></comment><comment><USER7> After looking at Balsamiq I've been thinking something web based, free and built on HTML5 would be much better.

Congratulations on what you've built!

2 features I would like to see are permalinks to a 'moqup', to send to clients, and also it would be nice to be able to import Balsamiq XML files.

EDIT: Just spotted the share feature, looks great.

<comment><USER8> I love Balsamiq but hate flash. Hello Moqups!

</comment></comment><comment><USER9> Great looking app! What did you guys use as your IDE and what is your build process like? I'm currently in the process of transitioning a team from a thick client plugin architecture to HTML 5 and am interested in hearing from others how they have built impressive looking apps in Javascript and HTML.

<comment><AUTHOR> Thank you.

Some of us are using WebStorm/IntelliJ and others swear by Sublime Text. The SVG layout engine is custom built. The rest is pretty much vanilla Javascript with some JQuery. Feel free to ask us anything!

<comment><USER9> Are you using JSLint or Google's Closure Compiler to ensure code quality on the Javascript side?

<comment><AUTHOR> JSLint

</comment></comment></comment></comment><comment><USER10> Impressive!

Two comments:

\- Using f1 on chrome brings up the Chrome help page. You might want to make that another button.

\- It took me a while to realize that you're supposed to drag objects from the left, and not use the mouse to define where they should go. That lead me to accidentally select or move existing objects while attempting to place new objects with my mouse. I'm not sure how common my experience was and I'm not sure how to address it (or even that you should). But I figured you should still keep it in mind.

<comment><AUTHOR> Thank you!

\- We'll definitely investigate the F1 key issue. We have a broader bug that causes the whole app to stop responding to keyboard shortcuts if the browser window is not focused first.

\- Interesting, we'll look into also adding this behavior. It is indeed a common behavior, specially in diagramming software.

<comment><USER11> Also, on a Chromebook, F1 is actually the back button. If the back button isn't active (there's nowhere to go back) the moqup help works, but if the back button is active, it simply goes back.

</comment></comment></comment><comment><USER12> 1\. Will this be free forever or will it be bumped to a paid service?

2\. Any plans of supporting the iPad as a HTML5 app?

Really liking the interface while building mockups (already started building them!).

<comment><AUTHOR> 1\. We'll keep the main functionality free (with some reasonable limitations). We plan on adding some really cool collaboration and annotation/feedback features soon that we'll probably ask a buck or two for. 2\. Yes, Mobile is one of our top priorities, simply because the mockups look so gorgeous on the Retina display and it makes sense. There are some challenges we need to overcome though (performance is one). We can at least promise some great additions on the Viewer veeeery soon.

</comment></comment><comment><USER13> I teach a Skillshare class about UI/UX/Mockups/Wireframes for mobile apps and I recommend Moqups to my students as a quick and fast way to start working.

Thanks for a great product!

<comment><AUTHOR> We're humbled to hear about that. Moqups will always be free (including the premium features) for non profits/educational organizations. Please drop us a line at contact[@]moqups.com when you get the chance.

<comment><USER14> Do user groups count as a non profit or would that need to be more formal (as in a 501(c))?

<comment><AUTHOR> With all the honesty, we haven't decided yet.

Moqups will continue to be free in its simplest form, so feel free to enjoy it. After launching the premium features, we'll provide an application form and carefully analyze each application in order to determine if it's eligible for free use or not. Also, we'll make sure to provide more details about what is needed for qualifying in this program.

</comment></comment></comment></comment><comment><USER15> Seemed to actually function on an iPad. Nice work. The competitive positioning to Balsamiq is clear and well placed. How will you generate revenue if its free?

<comment><AUTHOR> We will offer other features like collaboration as part of our premium offer. Our main focus for now is to provide the best possible experience to our users.

Edit: Ipad works to some degree, but the app is definitely not yet optimized for a great touch experience. We're also working hard on fixing that.

<comment><USER15> I was simply using it on the iPad, but generally I can't imagine the iPad is great for mock up design (unless you do some really cool multi-touch things).

Generally, the use case for mock ups at least where I work (we use Balsamiq) is that everyone at least has a laptop.

I'd work on getting parity with Balsamiq, and focus on doing other things better. We use Balsamiq at work, and generally we have a lot of assets already in it (I know you are working on importing), but you'll need to unentrench their current user base.

Going on the freemium model will disrupt a lot of their income too. Right now balsamiq requires that you pay to use it even if you are not collaborating, but I'm sure you already knew that.

<comment><USER16> I use my iPad for almost all my initial mockup work. There are some great apps out there (iMockups, Mocking Pad, perhaps others). I find I'm more creative when sitting on the couch working on UI design than I am hunched over a desk. The apps do a pretty good job enabling pixel adjustments in a touch environment.

</comment></comment></comment></comment><comment><USER17> Looks very similar to <https://gomockingbird.com/> which has been around for a while.

<comment><USER18> Mockingbird looked great, but it hasn't been updated since 2010 as far as I'm aware.

</comment></comment><comment><USER19> Nice app. Do you mind sharing what technologies you use to power the app? e.g. any JavaScript libraries, frameworks, etc?

</comment><comment><USER20> I love it!

...but performance really suffers after just 50-100+ objects :(

So of course I'm compelled to ask the devs: Why not Canvas?

<comment><AUTHOR> We've selected SVG over Canvas for many reasons.

I'll try to elaborate a few:

\- With SVG we can easily draw very complex geometry, resulting in nice looking, configurable stencils, interactivity and many other features that would've required immense engineering efforts to achieve in pure Canvas backed up by heavy Javascript. This would've have reduced our creativity and ability to adapt fast moving forward. Creating new stencils and adapting to new UI trends is a breeze now. With Canvas, the situation would've been different and highly coupled in the back of the Javascript code.

\- SVG is resolution independent. While we haven't optimized Moqups for a full mobile experience YET, if you look at some mockups on any Hi-DPI (Retina) display, the experience is simply gorgeous. Printing is also a great addition, because you can virtually print huge sheets without loss of quality, making face to face collaboration great.

\- SVG is heavily used for precise visualizations and technical drawing in industrial engineering, outside its web roots. Not sure how to properly explain this - We just kind of wanted to pay some homage to these folks.

The learning curve for SVG was tremendous though, with many obstacles that made us cringe and almost and quit at points. This is mostly because SVG is such an underused technology nowadays and the documentation is still scarce. However, it was extremely fun and it's nice to see that SVG is becoming more and more relevant nowadays in the context of HTML5.

About performance: Despite the many optimizations we have done, we still have quite a few technical debts that, once fixed, will make Moqups even faster and behave well with a lot of objects. Beside this, Chrome and others are about to introduce hardware acceleration for the SVG layers soon, so all in all, more good news.

</comment></comment><comment><USER21> Are there any optimizations in the Chrome app version of this?

[https://chrome.google.com/webstore/detail/nlfbhphohgafllkjna...](https://chrome.google.com/webstore/detail/nlfbhphohgafllkjnakmdppmmkjfbnke?utm_source=chrome- ntp-icon)

<comment><AUTHOR> Not yet. We're planning Offline support, Google Drive, notifications and many others.

</comment></comment><comment><USER22> And I thought Balsamiq would never have a tough competitor! Great work, love it.

</comment><comment><USER23> Looks awesome!

Small UI bug I noticed, the icon in the Tail section for "top left" is the same as the one for "left top" (<http://cl.ly/340F1H030G1s3D2F2F2H>)

<comment><AUTHOR> Thank you. We've spotted that and already fixed it in our internal releases. We'll deploy a new build with many fixes soon.

</comment></comment><comment><USER24> Love it! You've got the 960 grid, how about some other common page template sizes that the UI can snap to, like iPhone, iPad. I'd also like to be able to go into that mode so I only see native (moqup style) controls as options..

I often want to bang out a layout so I know I've got UI / distribution of controls sorted and then know my general widths / positioning..

If the snapping as good, and I could export or easily grab the positioning / pixels that's something I'd pay a bit for..

Keep up the good work!!

<comment><AUTHOR> We're planning to add inner snapping to various device stencils (iPhone for now and others in the future), as well as polishing various interactions. We also get very enthusiastic when planning features like master pages, rulers, cotations and so on. Stay tuned!

</comment></comment><comment><USER25> Maybe it's just me, but I think apps like this need (NEED) to focus on tablets / touch screens if they really want to stand a chance.

Don't get me wrong. It's an impressive tool and I'm sure it will work for a lot of people. But there is nothing Moqups does that I myself can't do more quickly with pen and graph paper.

What I want is a intuitive experience for touch screens, instead of yet- another app that requires a bunch of clicking and dragging.

</comment><comment><USER26> Does not work: I just see the logo, nothing loads. In the developer console, I only see

GET <https://ssl.google-analytics.com/ga.js> <https://moqups.com/:26> (anonymous function) <https://moqups.com/:26> (anonymous function)

failing

(I block ssl.google-analytics.com with my hosts file)

</comment><comment><USER27> Beautiful!

1\. After registration, the next UI-view doesn't show up immediately.

2\. Adding more fonts and Social-media buttons. Even custom buttons too would be a great addition!

3\. I'm a paranoid person and there are many like me. Please convince me strongly, How secure is it to keep someone's Idea in your Back-end servers?

4\. Finally on long-term look for Building a platform and community around! May be you can bring Front-end designers to hire them straightaway.

</comment><comment><USER28> I just used this to make mockups for a small project and it was awesome.

There's still lots of little polish things you can do, but the functionality is almost completely there. Extremely useful.

You did a really good job picking the bits that were most important (at least to me) before launch. The attempts at this that I've seen before were just way too feature-poor to be useful.

Great work!

</comment><comment><USER29> Quick Feedback:

1\. Looks fantastic!

2\. Where's the pricing? Coming from the landing page, I could not find it. You should _really_ make this easy to spot.

<comment><AUTHOR> Moqups is free while in Beta. Additionally, the main use cases will always be free (with some reasonable limitations).

The premium features will revolve around collaboration, feedback, annotations and other things. When these are launched, we'll definitely make the pricing clear and visible for everyone.

<comment><USER29> Good to know - _place this information somewhere prominently on the landing page now!_ :)

I guess you haven't completely decided how your pricing is going to be, so I understand why you haven't published it yet, but seriously, you have buzz now, and people may not register today because they are unsure about the implications of it. Do not let that happen - give them at least the information you just posted.

Edit: It doesn't have to be super-prominent, but so that the missing information won't be an obstacle to registration.

</comment></comment></comment><comment><USER30> Nice. Even works somewhat on the iPad. Is it possible to have a different default font? Looks like comic sans now.

<comment><USER7> Much as I hate Comic Sans too, I think it does keep the emphasis on the layout rather than the design, a useful characteristic of a mock up.

</comment></comment><comment><USER31> Found out how to do something that just blew my mind:

you can make your screenshots linkable very easily by adding a button over the part of the page, linking it to another page and then sending it to the back behind the photo.

even if the button is behind your screengrab photo, it will still link.

just wanted to share that little tip

</comment><comment><USER32> You know, there are tons of other handwriting style fonts other than Comic Sans ...

<comment><AUTHOR> Thanks for the feedback. We're actually using Chalkboard, a close cousin of Comic Sans MS.

There is no need to stick to the default setting. Feel free to pick your favorite font style when you create a new project! Also, more advanced typography settings are also coming soon.

<comment><USER33> Seems like a poor choice for a font for the default page though, given how much comic sans ms is hated within the design community (end everyone else).

PS: Love the product, will be using it from now on!

<comment><USER34> To be fait, Comic Sans is mainly hated because it's used inappropriately so much. In this particular case, it seems like a pretty appropriate use (although I still find it ugly).

</comment></comment></comment></comment><comment><USER35> This looks awesome!

Are there any plans to expand to other mockups? I currently use Gliffy for my ER diagrams and Process Flows. This just seems much cleaner and would love a connector-type feature.

I'm gonna use this for my next mock-up most definitely!

</comment><comment><USER36> Looks real nice on Retina Mac.

<comment><AUTHOR> That was our goal. We'll be working hard to provide a smooth mobile experience soon :-)

</comment></comment><comment><USER37> As soon as you create reusable symbols across pages I will switch from balsamiq.

<comment><AUTHOR> This feature is on our short term roadmap. We just wanted to spend a bit more time to get it right from the beginning.

</comment></comment><comment><USER38> This was not obvious: I wanted to select many small items inside a large box, but I couldn't click-and-drag to select the small items without also selecting the large box. The solution was to lock the big box.

</comment><comment><USER39> wow it's great to see the mockup space seeing some real innovtion and competition. I've had my own head down for the last six months working on my own mockup software and I agree that HTML5 is the way to go. Being able to demo a design on a mobile device is a killer feature. Also it's so heartening to see such a robust and enthusiastic response from the HN crowd... makes me feel just that little bit more confident that mockup software is a good category to be targeting.

All the best. I look forward to seeing what else you lot come up with :)

</comment><comment><USER40> Awesome work, but I have one question that always plagued me... Maybe you can help with it. Why do all these mockup sites have the style of being drawn in a notebook?

<comment><USER41> It needs to look like that, otherwise your dumber clients start to complain that the site isn't in the right color, or the images are wrong. If it looks anything like a normal site and not a sketch it causes extreme headaches dealing with some customers.

</comment></comment><comment><USER42> Beautiful, clean, and smooth on Chrome (Win7).

Can you give any sort of idea of the development effort that went into this? (ie. # of programmers, time period from starting, etc.)

<comment><AUTHOR> Thank you. We're a completely bootstrapped startup (6 people). Moqups was created in our limited spare time for about a year where most of the time was spent on researching/optimizing the SVG engine and we really started to take it seriously in the last few months :-)

<comment><USER42> Wow. That makes it even more impressive, in my opinion. Looks better than most funded apps :)

</comment></comment></comment><comment><USER43> I like it a lot and wish I had your html/js chops. Quite intuitive too. I could quite easily sit at some cafe with a client and throw round ideas with this.

</comment><comment><USER44> Wow, great show HN! Works very smoothly on Mac OS 10.7/Chrome. I'll bookmark this and use this myself as well as send to colleagues for sure. nice work.

</comment><comment><USER45> Feels a bit laggy on my computer (linux+chrome) when dragging items around. But this looks really good! I might even start making mockups now.

<comment><AUTHOR> Sorry to hear that. We really love Linux users too! This may be related to some hardware acceleration issues.

Are you using the latest and greatest Chrome? Also, this performance degradation may occur if you have many many other tabs open.

If the problem persist, there is still good news: try enabling the "Live resize of objects" checkbox in the "Settings" popover.

<comment><USER45> If memory serves I'm on the canary/developer build (18.0.xxx). I think that's as latest as it gets, can't also say the greatest :)

<comment><USER46> PSA: Chromium in the Software Center is very old. The current stable version is 20.X. Download Chrome from Google.

</comment></comment></comment></comment><comment><USER47> This is fantastic. Blows Balsamiq out of the water.

</comment><comment><USER48> Absolutely wonderful.

But I _hate_ these merry fonts (the evil Comic Sans, and this one which I think is Chalkboard). Apart from that, perfect.

<comment><USER49> These fonts are used appropriately here I'd say. They're here to make sure the client knows it's not exactly how the finished product will look like.

EDIT: You can actually select the type of font that you want when creating a new project (Serif, Sans serif, or mono!) :)

</comment></comment><comment><USER50> I like it. So much nicer-looking than current Balsamiq.

Out of interest, what did you use to do mockups for this app? ;)

<comment><AUTHOR> Thank you!

Great question actually - Once we were able to use Moqups to mock up the remaining dialogs, we started joking about Mockup Inception - Moqception. Really weird feeling, but also nice :-)

</comment></comment><comment><USER51> So much comic sans!! Ahhhgg!!

In all seriousness, though, neat tool. It's kinda sluggish on the new iPad, though.

</comment><comment><USER52> My first thought: "Wow". My second thought: "How do I give these people access to my wallet?"

<comment><AUTHOR> Moqups is free while in Beta. Additionally, the main use cases will always be free (with some reasonable limitations). The premium features will revolve around collaboration, feedback, annotations and other things. When these are launched, we'll definitely make the pricing clear and visible for everyone.

</comment></comment><comment><USER53> please give option to change Comic Sans to soemthing else

<comment><AUTHOR> The sample project is using the handwritten style, but no worries: You can always select a different font style when creating new projects.

</comment></comment><comment><USER54> Nice app. But I think the name moqups is a "bad choice"

<comment><USER39> really? I think it's great! Picking a good domain name is hard and this one is memorable I think.

<comment><USER54> I personally feel you can't brand it and won't have any SEO benefit.

</comment></comment></comment><comment><USER55> Looks great - any plans on Google Drive integration?

<comment><AUTHOR> Yes. We've just launched the Chrome App store too <http://bit.ly/NUSGvH>. DropBox and Basecamp also high on our integration priorities.

</comment></comment><comment><USER56> Very impressive. Clearly lots of work. Good job.

</comment><comment><USER57> Is there a way to create templates?

<comment><AUTHOR> We plan on adding this feature very soon!

</comment></comment><comment><USER58> Pretty cool. I congratulate you.

</comment><comment><USER59> Impressive.

</comment><comment><USER60> awesome! what is this going to cost?

</comment><comment><USER61> nice tool!

<comment><AUTHOR> Thank you!

</comment></comment><comment><USER62> This article was submitted just six hours ago and it haves 275 points but is no longer in the front-page of HN, why? My only guess is that is because is not a YC Company.

<comment><USER63> As far as I recall, "Show HN" type posts get weighted down by the system. But more generally, it may have been flagged more times than the average post (though I wouldn't know why because it's awesome).</comment></comment>


Web Security at N26 - <AUTHOR> https://medium.com/insiden26/web-security-at-n26-d1b4644c32fb <comment><USER2> > "In practice, front-end encryption works like this: on start, the server > generates two keys, a public one which makes its way to the client in a > cookie, and a private one which stays on the server. In the browser, the > public key is used to encrypt a certain payload before sending it to the > server via a XHR request."

What's the point of that?

<comment><USER3> Yeah what's the point of not blind trust HTTPS? Close your eyes and pray to the mighty Gods and Queens when HTTPS fails either on server or on clients if they get infected with some kind of a malware and you get everything plain text.</comment></comment>


Against Little Free Libraries - <AUTHOR> https://www.citylab.com/navigator/2017/05/the-case-against-little-free-libraries/523533/ <comment><USER2> So the reason to be against these things that don't hurt anything is that the people putting them up may be virtual-signaling? so what?</comment>


Tracked Hovercraft - <AUTHOR> https://en.wikipedia.org/wiki/Tracked_Hovercraft <comment><USER2> Searching this page for " eel " or " eels " yields no results. Why?

Do the tracks increase or decrease the likelihood that a hovercraft will fill up with eels?</comment>


Show HN: Understanding the US Elections Through Twitter and Machine Learning - <AUTHOR> http://tarsier.monkeylearn.com/ <comment><AUTHOR> Hi HN!

For creating Tarsier, we used Tweepy for extracing tweets using the Twitter Public API, we used MonkeyLearn for analyzing the tweets and finally used Plotly for creating the visualizations.

You can see some of the insights we got by using Tarsier here: [https://blog.monkeylearn.com/donald-trump-vs-hillary- clinton...](https://blog.monkeylearn.com/donald-trump-vs-hillary-clinton- sentiment-analysis-twitter-mentions/)</comment>


Drone Maker Accused of Covering Up Bomb in Bag on Delta Flight - <AUTHOR> https://www.bloomberg.com/news/articles/2018-05-17/drone-maker-accused-of-covering-up-bomb-in-bag-on-delta-flight <comment><USER2> It is crazy to think of all the money spent on TSA that something like this could happen post-9/11 and post- failed shoe bomber. It shows that people and machines are still fallible.

I never hear about TSA thwarting terrorist attempts. Either they keep it under wraps or nobody is trying because they perceive the security to be too high. Or they get caught before they try. In any event, this incident seems like a careless mistake, but still scary nonetheless.

<comment><USER3> My cousin in the early 2000s worked for a R&D company who did some work on the early generation of sniffer machines that detected trace residue of explosives, and biological agents in airports. He had to go to a meeting and flew from Atlanta to boston with a prototype of the machine. He packed it in his carry on case along with his basic tool kit. When he got to security screening he realized that he also had vials of simulants for anthrax, sarain, various explosives, etc etc in that case. He gets into the security screening line and the TSA guy starts asking him all kinds of questions and he just knows he is about to get detained for the simulants which were not clearly marked as such. Instead the guy is like "You can't take that screw driver with you"

<comment><USER4> This was figured out in an Dept. Homeland Security "red team" test of the TSA a few years ago, where the TSA failed like 95%+ of the tests against them: [https://abcnews.go.com/US/exclusive-undercover-dhs-tests- fin...](https://abcnews.go.com/US/exclusive-undercover-dhs-tests-find- widespread-security-failures/story?id=31434881)

I think the TSA has switched strategies recently, and they've been improving since then. But ultimately, its not the "bag check" where the TSA catches goons, its the random more intense check that they do these days. And sure, going from 95% failure to 80% failure isn't much of an improvement, but its still going to change the calculus of an attacker. When you have a 20% chance of failure before you even board the airplane, that's an issue to your plans.

Furthermore, TSA includes air marshals and the Israeli-style "behavioral" cops who are scanning airports. These are the more successful cops at the job, and the ones we are relying upon for real.

I wouldn't discount the entirety of the TSA just because of the failures of the bag-check program. Again, US Air marshals (armed cops who sit on every aircraft secretly with plain-clothes) are under the TSA and I think the US Air Marshals contributes a LOT to our real security.

Unfortunately, the bag-check thing is mostly security theater, but at the same time, the more "serious" checks vs attackers are more hidden and less well known (as it should be). But security theater might be enough to discourage an attack, or at very least cause our enemies to focus on the bag-check (when our REAL security really lies with other programs). So its a useful distraction IMO. There's a bit of "wink-wink lets not talk about this" going on that you need to understand though.

<comment><USER5> > US Air marshals (armed cops who sit on every aircraft secretly with plain- > clothes)

Do they really sit on __every __flight?

<comment><USER6> No, but I had one sit next to me on a flight to Vegas once. It's a long story, first how we suspected and then when he admitted it as we got off the plane. They do exist though.

<comment><USER7> How did you suspect?... (And, who's the other person in the plural?)

<comment><USER6> Some friends and I were on the way to Vegas. We had a few drinks and I guess hit the limit they serve on a flight. We had been having a conversation with a guy next to us about small talk things, joking, wharever. This guy then looks at the stewardess and says "they're fine, and there is no need to cut them off". She then kept bringing drinks until we landed. At that point we started joking he was an air marshall, and he laughed it off.

Once we got in the terminal he kinda flashed his ankle holster and told us to have fun on our vacation. Also mentioned something along the lines that we had made a normally boring 5 hour flight entertaining.

I should add this was 10+ years ago.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> This "Switchblade® Tactical Missle System" advertised on AeroVironment's website is probably what they were transporting: [https://www.avinc.com/solutions/tactical-mission- systems](https://www.avinc.com/solutions/tactical-mission-systems)

They emphasize that it's "man-portable" and it's a "precision lethal payload" embedded onto a drone.

<comment><USER9> Browsing a marketing website for a missile system is a bit surreal.

<comment><USER8> It is! I find the writing fascinating...especially the overly aggro names like "Switchblade®" and the funny phrases like "man-portable delivery system", "warfighter", and "wave-off capability". (not sure what that last one means...)

It also seems like the URL actually has a typo? The page has the title "Tactical Missile Systems" but the URL is for "/tactical- _mission_ -systems"

<comment><USER10> Wave-off means that you can abort the missile strike post-launch if you realise you haven't identified your target correctly.

</comment></comment></comment></comment><comment><USER11> I feel like there's a pretty big thing left out of this article.

Why did they bring that on the plane?

</comment><comment><USER12> Upon reading the headline, there was one question in my mind -- and unfortunately, the article didn't answer it. To wit:

 _Why was the drone 'rigged with explosives' in the first place??!_

<comment><USER13>
      "By embedding a precision lethal payload into a remotely
      controlled, man-portable delivery system, Switchblade®
      provides warfighters with a valuable and more cost-
      effective alternative to existing airborne and land-based
      missile systems."

[https://www.avinc.com/solutions/tactical-mission- systems](https://www.avinc.com/solutions/tactical-mission-systems)

<comment><USER14> Is there a purpose for the military-technical jargon beyond sounding serious and sophisticated (and thus expensive)?

<comment><USER15> I'm not in that industry but if it's anything like other fields, I'd say this jargon has specific meaning to them.

<comment><USER16> If it's anything like it was ROTC, the jargon here is mainly to signal conformity.

</comment></comment></comment></comment></comment><comment><USER17> (Red Flag or Yellow Flag) This article was based on a report from Aurelius Value, about a case that was filed a month ago. Aurelius Value makes my spidey sense bullshit detector light the F up. The drone maker looks to be a solid company with a stock that is steadily growing, 1MM volume, and just had a 52 week high in the last week. If I were a unethical bastard with a mandate to manipulate a company's short term stock prices, this wouldn't be a bad target.

<comment><USER18> What does a company's stock performance have to do with the allegation under discussion?

<comment><USER19> They appear to be a research firm specializing in reporting on companies to which they own short positions.

If you go to read their articles at [http://www.aureliusvalue.com/](http://www.aureliusvalue.com/) you are immediately presented with a TOS that basically says as much. The TOS also makes some disclaimers that looks to be aimed at reducing the risk of them being held liable for spreading false/harmful information.

So given all this, It is only prudent to be skeptical.

<comment><USER18> "Appear"? The posted article outright identifies them as a short seller. I'm not disputing that someone may profit from the consequences of this allegation. I'm asking if we have reason to believe that the allegation itself is questionable, just because it may harm a company's stock performance. Did the short seller fabricate it or conspire with the plaintiff?

</comment></comment></comment></comment><comment><USER20> Happened in 2015 and now a short stock seller is attempting to manipulate the price of the stock by bringing the story out in public again.

<comment><USER18> "again"?

This incident was previously unreported. It only came to light because of a lawsuit filed by the terminated employee in April 18, 2018: [http://aureliusvalue.com/content/uploads/2018/05/AVAV- whistl...](http://aureliusvalue.com/content/uploads/2018/05/AVAV- whistleblower.pdf)

</comment></comment><comment><USER21> It's difficult to work up much sympathy for any armaments manufacturer who sells to the USA military. However, this "whistleblowing" didn't really accomplish much. It was a thoughtless mistake to bring the explosives on the plane, but there is no indication that it was SOP or that the company made any money by doing it.

In general, I believe it's customary to maintain secure storage at any location where explosives are used, and let professionals move the explosives around.

<comment><USER18> Are you arguing that the "whistleblowing" was not worthwhile or legitimate whistleblowing?

<comment><USER21> I don't think whistleblowing is "sacred", in the sense that anyone who disagrees with his boss and gets fired for it has an aspect of Edward Snowden. [0] Instead it's like most human activities: sometimes good, sometimes bad, occasionally pointless. It's clear that one shouldn't bring explosives on commercial flights or indeed on any motorized vehicle not designed for the purpose, but it's also against regulations to bring apple juice on commercial flights. A line must be drawn somewhere, and I'm all for armaments manufacturers going out of business, but let's do it the right way. In the long run this accomplishes nothing.

[0] To be clear, Snowden is a magnificent human. If punching a hundred plutocrats would get him out of his predicament I would do it tomorrow.

<comment><USER18> Are you under the impression that people in this thread have lionized the plaintiff as if he were Edward Snowden?

I'm having trouble following your reasoning here. Because this incident of whistleblowing didn't bring down the armaments industry, it is essentially worthless? Because the TSA can be stringent against mundane and otherwise safe carry-ons, that this means we shouldn't judge those who think it safe to bring undisclosed explosives in their carry-ons?

<comment><USER21> It's my impression that we're talking past each other, to some extent. The idea that there is a "proper" way to develop and market remote anonymous deathmurderbots (the evil purpose of which is well known) is so bizarre that it renders all other aspects of the discussion somewhat vague and insubstantial. If the point is that the Law should protect "bad" people as well as "good" people, then sure I agree. The way that things work in this dingy corner of America, however, is typically more arbitrary than that. It's difficult to take any story we get from this quarter at face value.

It is interesting, which threads inspire the sort of "policing" we see here. Is it so important that we all agree about things we cannot possibly know?</comment></comment></comment></comment></comment>


Startup Class Lecture 10 – Brian Chesky of AirBNB 10/23/14 - Functional Link - <AUTHOR> https://startupclass.co/lecture/83464/102314-company-culture-and-building-a-team-part-ibrbalfred-linb-iformer-coo-zappos-and-partner-sequoia-capital<comment>i

</comment><comment><AUTHOR> The original video link is awaiting approval: [http://startupclass.samaltman.com/courses/lec10/](http://startupclass.samaltman.com/courses/lec10/)

But some might thirst for knowledge more than approval...</comment>


The Story Behind Google's Interactive Les Paul Guitar Logo - <AUTHOR> http://www.rollingstone.com/culture/blogs/gear-up/the-story-behind-googles-interactive-les-paul-guitar-logo-20110610

<comment><USER2> I was hoping to hear why the pickup and bridge on the doodle looked the way it did - doesn't really look like Les Paul hardware to me. Does anyone know?</comment>


The sad state of SMTP encryption - <AUTHOR> https://blog.filippo.io/the-sad-state-of-smtp-encryption/ <comment><USER2> The article clarifies the issues that exist with SMTP encryption nicely.

Regarding the issue with certificates for the servers that the MX points to, I disagree with the author. If the MX for example.com points to mail.example.info, it implies that example.com trusting the handling of its mail to mail.example.info, therefore there is no issue with letting mail.example.info present its own certificate.

The article also suggests that DNSSEC with DANE will solve all issues with SMTP encryption.

However, DNSSEC is a crappy standard. It doesn't do encryption so a surveillant can still collect metadata; it has unsolved issues that facilitate amplification attacks, it's overly complex and has slow adoption. In fact, before DANE arrived on the scene, there was hardly a good reason to deploy it.

If we adopt DNSSEC now we'll be stuck with it (including its lack of privacy) pretty much forever. Instead, I suggest we work on more promising initiatives such as DNSCurve ([https://en.wikipedia.org/wiki/DNSCurve](https://en.wikipedia.org/wiki/DNSCurve))

<comment><USER3> > However, DNSSEC is a crappy standard. It doesn't do encryption so a > surveillant can still collect metadata;

To be fair, on-the-wire encryption is a problem orthogonal to that which DNSSEC is attempting to solve, which is integrity.

> it has unsolved issues that facilitate amplification attacks, it's overly > complex and has slow adoption. In fact, before DANE arrived on the scene, > there was hardly a good reason to deploy it.

Yup, DANE is essentially its killer app.

Any chance you could outline how you think it could be improved?

> If we adopt DNSSEC now we'll be stuck with it (including its lack of > privacy) pretty much forever. Instead, I suggest we work on more promising > initiatives such as DNSCurve > ([https://en.wikipedia.org/wiki/DNSCurve](https://en.wikipedia.org/wiki/DNSCurve))

I don't think the case. As I wrote, DNSSEC aims to solve the issue of integrity, not privacy. DNSCurve, or something like it, _should_ be deployed alongside DNSSEC, with the former giving you privacy, and the latter ensuring the integrity of the records. That way, even if the authoritative DNS server itself is compromised, you can know whether the data you're getting from it are OK or not. After all, it doesn't matter how good the pipe is if you're getting sludge rather than the clean water you expect through it.

The big problem is that people, whether they're DNSSEC or DNSCurve advocates, incorrectly put DNSSEC and DNSCurve in competition with each other, but this isn't even remotely the case. We ought to be using _both_.

<comment><USER2> DNSCurve also provides integrity. It cryptographically authenticates all DNS responses.

With DNSSEC yes, you can store signed data on a server without having to store the key on the same machine. It does make it even more complicated, however. With HTTPS, IMAPS, SMTPS etc we're also fine with storing the key on the server, why not with DNS?

If you're worried about the key being stolen you can always store it in a HSM to limit the damage of a server compromise.

</comment></comment></comment><comment><USER4> Awhile back I started requiring TLS for connections to my mail server. Not only is this not standards compliant from what I recall, but I've noticed a disturbing amount of other mail servers that apparently require plaintext connections. Most notable is password and college application information which couldn't be delivered to me because their mail servers refused to use TLS. The college in question was kind enough to look at their logs for me and see the issue, and ask me to disable TLS to receive the information. Of course this doesn't solve all the problems. Mail is still stored in plaintext, at least until I figure out a workable solution for that, and there's probably still the possibility of MITM attacks, but I feel at least requiring TLS is a step in the right direction. Until email is finally abolished, anyway.

<comment><USER5> You set yourself up to miss a fair bit of email that way. Most mail servers I work with use "opportunistic TLS": attempt TLS for outgoing mail; accept if offered for incoming mail; selectively enforce TLS on a per-domain basis for confidential communication to partner banks, law firms, financial firms.

Enforce TLS on your mail server and you're siloing yourself from a large part of the internet, and unless you're Gmail and your actions carry weight, others will simply stop emailing you after their mail keeps bouncing.

<comment><USER4> Indeed. It's my personal mail server, and I hate email enough so that receiving less email (for whatever reason) is not usually a concern of mine. More important than my dislike of email is organizations which refuse to send sensitive data over anything but plaintext.

</comment></comment></comment><comment><USER6> In fact (as the article admits), the encryption is fine and fully effective against a _passive_ attacker, the problem is that it's not much use against an active man-in-the-middle. But, that's not something anyone but a NSA or ISP can easily do between mailservers.

<comment><USER7> The problem is that most of my emails will end up on Gmail, Yahoo! or Hotmail. Since nearly no one uses PGP, the emails sit on a google, apple, yahoo, microsoft server in plain text for any ads or 'gov' company to see and analyze in bulk.

Until we 'solve' THIS problem, there's no point in discussing what happens in between IMHO.

<comment><USER8> Do you think that mail just sits around on "the gmail server" in plain text?

<comment><USER7> In plain text for any interested party, be it Google, China, the NSA, etc[1].

[1] [http://www.theguardian.com/world/2013/jun/06/us-tech- giants-...](http://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa- data)

</comment></comment></comment></comment><comment><USER9> Daniel J Bernstein, designer of DNSCurve, proposed some alternatives to SMTP.

[https://en.wikipedia.org/wiki/Quick_Mail_Transfer_Protocol](https://en.wikipedia.org/wiki/Quick_Mail_Transfer_Protocol)

[https://en.wikipedia.org/wiki/Internet_Mail_2000](https://en.wikipedia.org/wiki/Internet_Mail_2000)

</comment><comment><USER10> It's indeed not a nice situation, I'd love for my mailserver to insert a line into the message subject something like: 'TLS not used' when this is the case (or a plugin for Roundcube (Next?) that colors the subject, how cool would that be?). Just so I know and are aware of suspicious things. Enforcing TLS (and valid certs + strong encryption) is just not very practical yet, although it will definitely not affect mayor players' connectivity (Google, Apple, MS). Still, a lot of problems will arise, to see how many exactly, this is a rough indicator: [http://www.google.com/transparencyreport/saferemail/](http://www.google.com/transparencyreport/saferemail/)

I predict in my group of friends I can receive/sent from/to almost everyone if I would enfore TLS on my server. Except to/from that one guy that is savvy enough to have his own domain but hosts his email at a cheap, crappy provider.

<comment><USER11> A header would probably be more appropriate. Then any client could display it differently. The problem is that your mail server can only tell that the last leg of the connection was encrypted, not that all connections from the sender's client were all encrypted.

<comment><USER12> But isn't it that in practice most of the time this "last leg" is the only leg that crosses the internet? Most of the servers I see in the mail headers I receive are servers in the internal network of the sender. So IMHO transport encryption still is of real significance against passive attacks.

<comment><USER11> Actually the first leg (sender client to sender smtp server) is probably the most at risk of a mitm, as it often goes over wifi.

</comment></comment></comment></comment><comment><USER13> A thousand times yes.

PGP and SMIME is perfectly fine for high security scenarios (whistleblowing and such), in other words for the 0.000001% use case.

For the 99.9% use case, all that regular folks need is for the sending MX to verify that the recipient MX owns the domain before delivery.

PGP and SMIME with their key-signing parties, government-owned PKI et cetera, is either wild overkill or so utterly complex that it defeats the purpose for the 99.9% use case.

\---

That said, you are going to break some of my software with this.

Specifically a SMTP reverse proxy, that looks at the domain part of RCPT TO, and transparently forwards the SMTP connection to the correct customer's MX for processing.

It could easily be unbroken again - BUT that would require that Postfix get their software together and add SNI support to their TLS stack (like all? other MX software does).

\---

Implementation proposal:

1) Use RCPT domain-part for the SNI hostname.

2) Always try SMTPS port before SMTP port. Always try STARTTLS before plaintext.

3) Actually verify the certificate, duh.

4) Support a new EHLO header that mimics Strict-Transport-Security exactly.

<comment><USER14> Actually, even PGP is not fine for high security scenarios. For example, it doesn't encrypt headers, including the subject line, which I would say is just as important as an email's body.

<comment><USER15> Some people are trying to fix that: [https://modernpgp.org/memoryhole/](https://modernpgp.org/memoryhole/)

</comment></comment></comment><comment><USER16> Right now I am thinking a HSTS-like solution is the best idea for now, though I do wish for a DNSSEC2 eventually.

</comment><comment><USER17> Wow, that's an eye opener. Thanks for the write up.

</comment><comment><USER18> This article motivated me to at least create a self-signed certificate for my server.

<comment><USER3> One thing to keep in mind if you use Thunderbird is that their certificate verification library (Mozilla::PKIX) really, really hates self-signed certificates. So, if you're using a self-signed cert on your mailserver's submission port or to encrypt IMAP traffic, Thunderbird will simply fail to work.

Unfortunately, I know of no way around this. I just gave up and started using Claws in the meantime.

<comment><USER18> I only ever use my server to forward emails for certain addresses. No clients ever contact it.

</comment></comment></comment><comment><USER8> S/MIME also neatly solves the problem.

<comment><USER19> The problem is not encryption, S/MIME works well enough for that.

The problem is you don't have public keys for people you send to.

And there's not a reason for many to get the keys.

I wish I could say "I'll read your unencrypted email tomorrow" (and delay it from getting to my inbox).

<comment><USER2> S/MIME actually solves the key problem pretty nicely, every signed mail contains the certificate that is required to send an encrypted reply. Just start signing your mails.

<comment><USER20> That's just the TOFU/POP trust model, same as unverified SSH server keys. Doesn't help against persistent MITM.

<comment><USER21> Sure it does. The information in the certificate is signed (by the intermediate CA) and will contain a certificate chain that leads to a trusted CA and the email address and possibly even the subject's name will be encoded within the certificate. If you can trust the root CA, you can trust that the other party is who they say they are.

Then we get to argue whether NSA can get bogus valid certificates from the commercial CA's... Of course you could roll your own CA but then both parties need to trust it.

</comment></comment></comment></comment></comment><comment> mike-cardwell Also of relevance:

[https://www.mail-archive.com/dane- firstname.lastname@example.com/msg00142.htm...](https://www.mail-archive.com/dane- firstname.lastname@example.com/msg00142.html)

Comcast published TLSA records the other day. So when people like myself who have enabled TLSA in Postfix send email to Comcast users, the SMTP connection is guaranteed to be both encrypted, and the SSL cert validated.

</comment><comment><USER22> This article suggests that there's no point in having a valid SMTP cert. However, consider end-users' clients, which store the SMTP domain (i.e. don't do MX lookups) and connect to it directly. For mail to users on the same email network, this is the only non-local SMTP hop. Securing this connection also prevents anyone on the end-user's local network from MitMing.

</comment><comment><USER23> The author only mentioned STARTTLS as the way to secure SMTP. However, there are at least two other ways to do it:

* TLS Wraper

* Secure Tunnel

And Amazon Web Services Simple Email Service accepts all three approaches. Granted the latter two may not be supported by a lot of providers, but hey is that the same thing with browsers securities? We deprecate old MTAs and old versions of them progressively. Just my two cents.

</comment><comment><USER24> Can we setup a list of servers that definitely support SMTP STARTTLS. Don't accept a plain text connection with them.</comment>


San Francisco is now home to more dogs than children - <AUTHOR> https://airmail.news/issues/2019-11-2/marking-their-territory <comment><USER2> 15 years ago if you saw a baby carriage east of 7th Avenue, there was a dog in it. Schools were closed or closing.

Today, kids are everywhere. Riding the buses, at the playgrounds, in the movie theaters, regardless of the demographic numbers. It's nice to see.

</comment><comment><USER3> Given the demographic. Is this really surprising?</comment>


Uber Eliminates Forced Arbitration for Sexual Misconduct Claims - <AUTHOR> https://www.nytimes.com/2018/05/15/technology/uber-sex-misconduct.html <comment><USER2> A step in the right direction, but I still can't believe forced arbitration was ever a thing, especially in these cases.

Still haven't re-installed Uber in over a year, don't miss it at all.

It does make me wonder how many ToS I've agreed to with forced arbitration clauses written on page 84 in size six font.

<comment><USER3> "A step in the right direction"

What semi-decent human being inside Uber came up with this? How can people still work for this evil company?

<comment><USER4> > How can people still work for this evil company?

Uber has been doing a lot recently (i.e. as of about mid last year) to fix itself - things like better misconduct-handling process for employees, more frequent background checks for drivers, the implementation of tips, a top-down directive to permanently halt spying-related work in intelligence gathering, cooperating with authorities on the Tempe incident, etc.

Generally speaking, people aren't inherently evil and want to do the right thing. Uber's new leadership now does too. Uber moves fast and I think it's time to re-evaluate whether the data points backing your opinion are outdated.

<comment><USER5> _things like better misconduct-handling process for employees, more frequent background checks for drivers, the implementation of tips,_

Still not paying their taxes tho'. There's a shedload Of Employer's NI they owe us.

<comment><USER4> > Still not paying their taxes

Sorry, not familiar with this and googling isn't turning up anything. Is this the IRS's opinion or just your own?

<comment><USER6> "Employer's NI" means "employer's contribution to national insurance" \- a UK tax.

Here's one article: [https://www.theguardian.com/technology/2016/oct/28/uber- uk-t...](https://www.theguardian.com/technology/2016/oct/28/uber-uk-tribunal- self-employed-status)

There are many more.

<comment><USER7> They pay NIC on their employees, but not their driver partners. The driver partners like all contractors in the UK are responsible for paying their own NI. I don't see why the contracting company is responsible for enforcing tax law for its partners?

Self-employed people in the UK pay class 2 and class 4 NIC. Those that are class 2 pay £2.95/wk on earnings of £6,205+ per year. Those that are class 4 pay 9% on annual profits of from £8,424 to £46,350 per year. They pay 2% on profits over £46,350.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > Mr. West said the company struggled with the decision to commit to a safety > transparency report for its rides, because he knows that it will be > "disturbing" when the actual number of assaults that happen on Uber is > announced — in part because of the company's size and the ease with which > customers can report an incident.

This seems like the wrong attitude to have…

<comment><USER9> Not really, it's perfectly reasonable to fear overreactions from the public. They could even have the best number in the industry, but if the others don't publish and it sounds big, people will freak out.

<comment><USER10> Regardless of how the numbers compare, if they're bad, shouldn't it be the responsibility of the company to attempt to alleviate the problem (instead of just covering it up)?

I suppose they could technically do both, but not acknowledging problems of substantial magnitude could be considered endangerment. Like the mayor from Jaws.

<comment><USER11> What if the numbers are _not_ bad -- what if riding an Uber is safer than cab/bus/walking, but there's no way to know because the stats on cab/bus/walking are not known, so people wrongly assume they are lower than Uber's?

<comment><USER10> I just don't think the _possibility_ of a backlash (for defensible numbers, no less) justifies withholding information about personal safety. It's not like we're talking about sales figures, production stats, or other trivial things.

<comment><USER9> If people misread the numbers, for the reasons we've been talking, their reaction might put them in greater danger than currently.

</comment></comment></comment></comment></comment></comment><comment><USER12> I don't understand how "sexual assault" was part of this. That would fall under criminal law. So even if the victims couldn't sue Uber due to the ridiculous arbitration clause, the person committing the crime could still be arrested and go through the usual criminal justice process. Is that correct?

<comment><USER13> > That would fall under criminal law. So even if the victims couldn't sue Uber > due to the ridiculous arbitration clause, the person committing the crime > could still be arrested and go through the usual criminal justice process. > Is that correct?

Yep. Uber doesn't want to end up in court because they connected you with a rapist contractor. They'd end up getting sued and losing the emotional appeal to the jury, even if they hadn't been negligent in their process of connecting you with a "safe" driver by doing reasonable background checks.

<comment><USER14> This is about employment contracts, where the company can indeed be held liable if they didn't take steps to prevent it.

</comment></comment></comment><comment><USER15> You can sign away your right to trial. Can you sign away your right to not be enslaved? Can you sign away your future right to freedom of religion? After you are charged with a crime can you sign up for cruel and unusual punishment?

"Your honor the defendant signed up for cruel and unusual punishment as well as signing away the right to trial and ability to speak. HERE! is his signature (sorry) it is hard to read..."

<comment><USER16> I've downvoted you because:

Arbitration applies to civil suits. Criminal suits are not civil suits.

<comment><USER15> Plea bargains exist. The jails are filled with people that have not _gone_ through trial. (It is over %90). Criminals these days don't see a trial.

You can't be serious or even remotely correct. But yes, use your powerful downvote.

<comment><USER17> What? He's totally correct that arbitration only applies to civil suits. That has nothing to do with plea bargains, which are part of criminal suits, and don't involve someone losing their right to a trial.

<comment><USER15> Signing away trial, is the signing away trial. Criminal vs civil is irrelevant.

<comment><USER17> Deciding not to have a trial is not giving up your right to a trial any more than deciding not to vote in an election is giving up your right to vote. Choosing not to exercise a right is not giving up your right.

<comment><USER18> A system that says "Oh yes, you're entitled to a trial... But if we go to trial you're facing a minimum of eighteen years in person, instead of six months, also you're going to be held in prison anyway for six weeks, hope you don't lose your job" isn't giving you a "right to trial" in any meaningful sense and they know it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> It is possible that Uber decided to waive forced arbitration for sexual misconduct otherwise risk their whole arbitration policy being called into legality. This action might also indicate that sexual misconduct was systemic enough to risk challenging Uber's forced arbitration policies.

</comment><comment><USER20> Maybe I don't really get it (I'm not American), but why would victims sue Uber in the first place? It seems to make sense if they sue the sex offender (e.g. driver or passenger).

<comment><USER7> In America, you have the right to sue anyone for anything at any time. The plaintiff's lawyer may file a motion to dismiss or a judge may dismiss a case, but that doesn't stop anyone from trying to sue in the first place.

That being said, people sue companies because companies have money and companies are more likely to settle so they can go about focusing on their core business (which is not litigation except for patent trolls).

All this boils down to greed regardless what side you favor in this issue. Companies want to keep money they believe if rightfully theirs and individuals want to take money if they think they can get it. The fact that individuals are consistently lionized and companies are consistently is vilified is quite absurd.

</comment></comment><comment><USER21> I doubt lyft will follow suit. They have the same rate of incidents on their service with the ability to defend themselves as well (less screening, no human support #s, less emergency support systems than Uber).

<comment><USER22> Apparently they did follow suit, and quickly: [https://www.usatoday.com/story/tech/news/2018/05/15/uber- end...](https://www.usatoday.com/story/tech/news/2018/05/15/uber-ends- arbitration-sex-assault-claims-passengers-employees/610616002/)

</comment></comment><comment><USER23> Totally unthinkable in Europe.

</comment><comment><USER24> These arbitration clauses should be illegal to begin with. You shouldn't have to depend on the largess of a company to have access to the real legal system to resolve disputes with them.

It's screwed up that corporations now have access to something _like_ sovereign immunity [1]: the ability to not be sued in court by their customers or employees unless they consent to the suit.

[1] [https://en.wikipedia.org/wiki/Sovereign_immunity#United_Stat...](https://en.wikipedia.org/wiki/Sovereign_immunity#United_States)

<comment><USER25> This is true, _mandatory_ arbitration makes mockery of the legal system.

But... the whole arbitration thing is itself a reaction (in many cases^) to general suckness of the legal system which _is_ primitive, clunky, slow and often more trouble then the trouble it's trying to solve. It's wide open to abuse, and a lot of what we call law is in practice a mature "game" based on abuse of the legal system.

So, yep.. these should be ilegal. But we also need a legal system capable of functional resolution of these disputes fast, without abuses, mutual destruction stalemates and burdensome "costs" including eventualities such as "as an employer, you will always be in labour court no matter what."

That said, sexual harassment in the workplace is an "our vision of society" type of problem. There's a case for giving it it's own courts or _public_ dispute resolution frameworks.

Law really needs to evolve. We are not settling disputes between norman kings and saxon lords any more.

^sometimes it's just naked self interest. Ie, We will win more often in private arbitration, so let's write it into the contract and hope they don't notice or are not in a position to object .

<comment><USER26> > But... the whole arbitration thing is itself a reaction (in many cases^) to > general suckness of the legal system which is primitive, clunky, slow and > often more trouble then the trouble it's trying to solve. It's wide open to > abuse, and a lot of what we call law is in practice a mature "game" based on > abuse of the legal system.

Maybe. It's interesting to note that businesses still prefer court to arbitration in their disputes _with each other_. [https://www.nytimes.com/2008/10/06/business/06arbitrate.html](https://www.nytimes.com/2008/10/06/business/06arbitrate.html). And business-to-business arbitrations tend to have many of the procedures (and expense) of litigation--lawyers, briefing, hearings, etc. The biggest advantage is that arbitration can be lot faster, because the civil court system is so overloaded with cases.

<comment><USER27> > _And business-to-business arbitrations tend to have many of the procedures > (and expense) of litigation--lawyers, briefing, hearings, etc._

One respected scholar, Prof. Tom Stipanowich, suggests that this is because _lawyers_ have incentives to import familiar and expensive procedures from litigation (because they hate to lose and therefore want all the discovery and motion practice that they can get), and _arbitrators_ have incentives not to push back too hard against these lawyers (because lawyers can object to the appointment of an arbitrator, and so arbitrators don't want to develop a reputation among lawyers as "difficult"). [0]

[0] [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1297526](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1297526)

<comment><USER26> I suspect that's part of it too; in house counsel are surprisingly (or maybe not unsurprisingly) not big on change.

<comment><USER27> Agreed; it's a variation on "Nobody ever got fired for buying IBM." (I realize I'm dating myself.)

</comment></comment></comment></comment></comment></comment><comment><USER4> Off-topic question: what's HN's stance on paywalls? I've noticed a growing number of paywalled articles from various media outlets, and I'm not entirely sure people are even reading them before commenting here.

<comment><USER28> HN's stance is here

[https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

<comment><USER4> Thanks!

</comment></comment></comment><comment><USER14> It is entirely unconscionable that this was a thing to begin with. There is no justification whatsoever for compelling arbitration on these people, other than pure evil.</comment>


Show HN: LaunchNotice is the best way to broadcast a startup/side project launch - <AUTHOR> http://signup.launchnotice.com <comment><AUTHOR> Co-Founder here!

As developers, we launch our side projects on a variety of different platforms, including here on Hacker News, Product Hunt, Reddit and Indie Hackers, to name a few.

We've created LaunchNotice to help developers get more users to their startup and side project launches, no matter where you decide to launch. Launch Notice is a daily newsletter featuring interesting startups and side projects launching around the web.

Check it out, and let us know if you want your launch featured by emailing us at firstname.lastname@example.com or on Twitter @LaunchNotice.

<comment><USER2> _is the best way_. You might want to change this line till you get some traction. :)

<comment><AUTHOR> You are right, but "could one day be the best way" didn't have the same ring to it :)</comment></comment></comment>