Reasons to blog even if nobody ever reads it - <AUTHOR> http://www.businessesgrow.com/2010/11/07/ten-reasons-to-blog-even-if-nobody-reads-it/

<comment><USER2> No offense, but I think all these are BS, and if no one is reading or linking to you, they're unlikely to apply. Blogging so that you might manage to get five people using improbable search terms to find your site is a waste of time.

But you still should blog if no one reads it for the reasons some other commenters have alluded to: to develop your own mind. That's essentially why I blog: [http://jseliger.com/2010/09/27/signaling-status-blogging- aca...](http://jseliger.com/2010/09/27/signaling-status-blogging-academia-and- ideas/) and read other people's blogs.

That, and so I have a repository of already expressed ideas I can leave in the comments sections of other blogs and HN, so I don't have to reinvent the answer every time.

<comment><USER3> I've definitely found this helps for developing ideas. I think what first prodded me into doing it was realizing that much of my interesting thinking was coming in making long posts on forums (Slashdot, HN, various other places). Nothing wrong with that really; discussion catalyzes thinking, and "writing a reply to a comment" has less activation energy than "writing an essay".

But I eventually realized that my writing output had this weird gap. On the one hand, I had 6+ page academic papers, all official and published and whatever and listed on my publications page. On the other hand, I had literally tens of thousands of comments scattered across the internet, one to a few paragraphs each, with no real way of pointing to them or even finding a comment again myself. Writing blog posts fills a nice gap. They can be somewhat longer and digress from the immediate conversation that spawned the ideas, and I have something to point to in the future (and find myself).

The other thing I do now is keep a text file of comments I've posted that seem worth finding again (as opposed to ephemeral discussion), with the URL of my comment and some notes on what else I might want to say on that. Has only sort of worked out so far, because like any "list of things I might want to do someday" they mostly don't get expanded into blog posts, but it feels like a step up in organization.

</comment></comment><comment><USER4> I was expecting something more along the lines of: articulating your thoughts and discoveries benefits you personally. That's why I blog. Nobody ever reads my programming blog - although I do have 14 followers on my old-house blog.

You could write stuff on paper - God knows I've filled a few reams in my lifetime - but a blog will be easily found even if you're on vacation. I really like blogging my notes.

</comment><comment><USER5> I really like Steve Yegge's take on this topic: [http://sites.google.com/site/steveyegge2/you-should-write- bl...](http://sites.google.com/site/steveyegge2/you-should-write-blogs)

" _So your fear is justified: practically nobody will read your blog. Unless it's good. Even then, it'll be a very long time before lots of people have read it. Don't worry, though. If you put in the effort, and you write honestly, people will eventually find their way there.

...

I never advertised my blog, and to this day I have no idea how so many people found out about it, let alone why they read it. I certainly haven't made any effort to try to please people. My blog isn't "about" anything, and although there are various running themes, I haven't tried to stick to any particular subject. And I'm horribly inconsistent in my tone, posting regularity, writing quality, and so on. But I'm really just writing for fun, and even if everyone stops reading my blog, I'll still be happy with what I'm writing._"

</comment><comment><USER6> Almost everyone one of those requires that someone actually read the blog, so the title is completely wrong.

<comment><USER7> Yeah, I think they meant "follows it on a regular basis".

</comment></comment><comment><USER8> Ok, honestly what does this title want to convey? If I knew my blog posts are not being read and I still want to keep writing, I might as well start writing offline and not blog. That will be my two bits in saving world resources!

</comment><comment><USER9> If you need to do a better job communicating about your field, writing can help.

If you already are incredible at communicating in your field, you probably won't remain unread for long assuming your field has media relevance.</comment>


US sanctions lock Iranian gamers out of World of Warcraft - <AUTHOR> http://www.washingtonpost.com/business/technology/us-sanctions-lock-iranian-gamers-out-of-fantasy-role-playing-adventure-world-of-warcraft/2012/08/28/203aeea2-f171-11e1-b74c-84ed55e0300b_story.html

<comment><USER2> This seems completely bass-ackwards. If we want to get Iranians to "come to the light" that is US policy, one of the best ways to do that is to actually have them interacting positively with people in the United States.

Furthermore, while I can (sort of) understand not having US money filter into Iran, I can't understand why there is any problem with Iranian money filtering into the US. Every dollar out of Iran is a dollar less the regime has to "fight" its idealogical war.

There are days I get really tired of the letter of the law being the only possible interpretation. When I sympathize with my Iranian brethren trying to get into a raid because their gear is sucky blue crap, it becomes one of those days.

<comment><USER3> Trying to legally define what is and is not a valid financial transaction coming in and out of Iran is a fool's errand. There's these things called commodity markets, and most everything is a commodity (more or less liquid) that can be bought and sold. Including WoW accounts, WoW gold, etc. If you wanted to launder, say, oil revenues into completely respectable US financial holdings....

And just think: due to these new restrictions, many Iranian players could get into a whole new world of encryption, non-Iranian VPNs, non-Iranian bank accounts, etc., etc. Which could have very positive political ramifications for the US down the line.

Say what you will about America or Germany or whomever in the western world, but I can still write here "Obama is an idiot" or "Merkel is a crook" or "The American Government should be destroyed, the Constitution should be abolished, and the ancient Corinthian Oligarchy should be enacted in its stead" or whatever and still sleep like a babe without any fear of repercussions.

It's far from a perfect freedom, but it's better than the alternative.

<comment><USER4> On your sleep: good for you because I can't --> [http://www.animalnewyork.com/2012/the-department-of- homeland...](http://www.animalnewyork.com/2012/the-department-of-homeland- security-is-searching-your-facebook-and-twitter-for-these-words/)

There are reports the TSA stopped UK citizens because of tweets mentioning some phrases you did just then. [http://www.schneier.com/blog/archives/2012/01/british_touris...](http://www.schneier.com/blog/archives/2012/01/british_tourist.html)

Sorry about any possible disturbed sleep.

<comment><USER3> Over 24 hours and haven't been arrested yet. Muhahaha. No one ever expects the Corinthians.

The UK tweet thing was a crazy overreaction, yes.

In all honesty though... wouldn't you be kinda surprised if law enforcement wasn't monitoring social media? Not looking for the super secret terrorist cell mind you, who probably would refrain from tweeting before their grand operation. But looking for the bat-shit loon who decides to use whatever hater theory is au courant as pretext for their batshit loontastic ideas. E.g., shoebombers.

What citizens/journalists should be vigorously investigating is not whether the social media monitoring is happening (cause it is), but whether those Personally Identifiable Information rules are reasonable, whether they are being followed, and just how many people are on the terrorist/drug (i.e., the "perpetual wars" (/eyeroll) we are fighting) lists, how reasonable are the names on those lists, etc., etc.

<comment><USER4> > how reasonable are the names on those lists

Moxie Marlinspike & Jake Appelbaum used to get the 'special treatment' at airports that often involves detainment and interviews with more than just TSA officers. As far as I can discern, their crime was writing software and knowing a bit about cryptography.

Obviously Law Enforcement always monitors things to enforce the law. However, the volume of information that is kept and retained is what the worry is. I can't think of a historical example of a country with very extensive domestic surveillance that has not trampled on peoples rights. If you can, I'd like to know.

</comment></comment></comment></comment></comment><comment><USER5> I wonder if anyone realizes just how severe a provocation it is to cut off a WoW player cold turkey like that.

Seems like a pretty strange sanction though. Hopefully Iranians aren't paying for Twitter access.

Such a strange world we live in these days.

</comment><comment><USER6> "A post to Blizzard's message board by a company employee also noted that rules meant Iranian players would not be getting refunds.".

Isn't that the same as stealing? They are taking money in exchange for an service they do not provide.

<comment><USER7> There's probably something buried in the terms of use that they'll claim allows for this very sort of scenario. If these players lived in North America, they _might_ be able to find a legal remedy, but they're in Iran.

</comment></comment><comment><USER8> Two things of note:

1) This isn't a result of US law changing. This is a result of Blizzard responding to an already-existing law which probably wasn't intended to have this particular effect.

2) Blizzard could potentially do some real good for the world (and get some good PR in the process.) I hope they have some sort of maneuver up their sleeve other than just cutting off Iranian players.

</comment><comment><USER9> In other news, Iranian economy booms as US sanctions lock Iranian gamers out of World of Warcraft...

<comment><USER10> Or youth on the streets protesting their government, after not being able to escape anymore into a fantasy world

</comment></comment><comment><USER11> Ass move from the US government aside, what baffles me here is how uncivil Blizzard can be.

I mean, could it really have hurt to say "we are very sorry, but we were forced into it"?

</comment><comment><USER12> Does this also mean that they can't play Diablo 3?

</comment><comment><USER13> I thought this was an onion article

I was dissapoint</comment>


Chalk of Champions [video] - <AUTHOR> https://vimeo.com/333758769 <comment><USER2> I use this in my office (well, the Korean replication that's still sold). I firmly believe that good chalk on an enameled steel chalkboard is far superior to a whiteboard: it always erases cleanly, the ink never runs out, it writes with high contrast, and it's immensely satisfying to write with. The only downside is chalk dust.

By contrast, the cheap chalk the department buys for us is terrible. It squeaks, it snaps, it refuses to erase cleanly. And our conference room whiteboard markers are always dried up and don't write clearly.

I have yet to turn into an illicit chalk dealer, though.

<comment><USER3> > good chalk on an enameled steel chalkboard

Try a real slate chalkboard sometime. It's amazing. (But not as easy to slide up and down as the metal versions.)

</comment></comment><comment><USER4> This feels like part 1 of a 3 part series. In Part 2, we must visit Japan to learn about how it came to be and why it went out of business. And in Part 3, we go to S.Korea. We learn about the company thats producing chalk from the purchased recipe.

<comment><USER5> The Japanese company went under because the owner was too old to carry on. Nice to see that someone else is taking it up.

<comment><USER4> That is pretty amazing. He didn't pass it on to anyone... no underlings to continue the effort.

</comment></comment></comment><comment><USER6> The successor, Umajirushi DC Chalk, is available here from JetPens (San Jose, USA), $1.80 for 6 sticks, or 30¢ per stick (also available in a 72 pack like shown in the video)

[https://www.jetpens.com/Umajirushi-DC- Chalk/ct/3774](https://www.jetpens.com/Umajirushi-DC-Chalk/ct/3774)

"The two well-established chalk makers Umajirushi and Hagoromo worked together to develop this chalk."

Thinking a six-pack might make a nice no-reason gift, to friends' kids or my local baker or church who uses a chalkboard, I just placed an order.

</comment><comment><USER7> One day someone woke up and said "wow, those k cups are an environmental disaster"... I wonder if a similar thing will happen with dry erase markers. As a professor, I go through far more dry erase markers than chalk... When I am done with chalk there is just dust. Not sure if those dry things recycle, but no one I know puts them in the recycle bin.

Also, there are very, very good chalks at jetpens from Japan still being made.

</comment><comment><USER8> I made loads of drawings with this chalk, it's all true: [https://drawings.rey.sc.jas.life/groups/blackboard](https://drawings.rey.sc.jas.life/groups/blackboard)

<comment><USER9> Please make more. These are great :)

<comment><USER8> ty

</comment></comment></comment><comment><USER10> Here's an interview with the company's founder: [https://asia.nikkei.com/Business/Companies/Hagoromo- presiden...](https://asia.nikkei.com/Business/Companies/Hagoromo-president- explains-why-he-closed-down-his-beloved-chalk-business)

</comment><comment><USER11> I've considered buying a chalkboard for my home office, does anyone have a good recommendation for what brand to buy?

</comment><comment><USER12> So, I guess mathematicians hoarding original Hagoromo chalk now have to stop before they write down a theorem on the blackboard and ask themselves: is it chalk-worthy? [0]

[0] [https://www.youtube.com/watch?v=kUkZdWnBTt0](https://www.youtube.com/watch?v=kUkZdWnBTt0)

<comment><USER13> I can't believe I watched a 5½ minute video to get this joke, but it was worth it. I also learnt about a new contraception method. I love HN.

</comment></comment><comment><USER14> When I graduated I bought my PhD advisor two boxes. It's great stuff. But beyond how dense and smooth it is, _particularly good_ is the colored chalk. Most colored chalk doesn't erase well. Hagoromo erases completely, easily.

</comment><comment><USER15> Can someone recommend a good chalkboard to accompany the chalk that you could fit on your lap? Maybe 3 foot by 3 foot?

<comment><USER16> 36" is about the maximum width that can fit, but 24" is about the maximum depth; after that it tips off your lap. For many people 18-22 is realistic.

Something this size: [https://m.staples.com/Flipside-Chalk- Board-24-x-36-Black/pro...](https://m.staples.com/Flipside-Chalk- Board-24-x-36-Black/product_138982)</comment></comment>


Show HN: Chrome extension for team convos and knowledge sharing on any webpage - <AUTHOR> https://chrome.google.com/webstore/detail/inverse/hfmfahehhpglkhfkbenipfcdcgglaclb <comment><AUTHOR> Hi HN,

Happy to share Inverse, a Chrome extension that empowers teams to have conversations and share knowledge on any webpage. Unlike email or chat applications like Slack or Teams, where information is siloed inside each app, Inverse lives alongside you in the browser so you can view and take part in discussions without leaving your current tab. These discussions are tied to specific URLs, so you can create a common thread that connects related pages, like a document, ticket, design, or dashboard.

Any feedback or comments are much appreciated!

</comment><comment><USER2> Not sure if you heard of [https://web.hypothes.is/](https://web.hypothes.is/)

Hypothesis came to mind when I saw this product and it would be helpful in your description describe how its different.

Also I primarily use firefox and if the use case is to share conversations with people I think it should support more browsers than just chrome.</comment>


My Most Important C++ Aha Moments (2006) - <AUTHOR> http://www.artima.com/cppsource/top_cpp_aha_moments.html <comment><USER2> > Visitor lets you define a new operation without changing the classes of the > elements on which it operates.

Yes, but that's not the real point. You can do that in other ways. Creating a new std::algorithm does that, for example.

The real purpose is letting one function be polymorphic in multiple directions. This is called multiple dispatch. Some languages support this as a built-in feature, but C++ doesn't, so a couple different design patterns were invented to fill in this gap. The Visitor pattern is the most popular and is probably the easiest to work with.

[https://en.wikipedia.org/wiki/Multiple_dispatch](https://en.wikipedia.org/wiki/Multiple_dispatch)

That is, it lets you do this:

        polymorphicOnThis->doSomething(alsoPolymorphicOnThis);

That is, for each permutation of the two types (polymorphicOnThis and alsoPolymorphicOnThis), you can define new specific behavior.

<comment><USER3> You _can_ use visitor to implement multiple dispatch, but that's not it's "real" point. The real point, as stated, is to allow polymorphic methods that aren't defined directly on the class.

I've seen a lot of implementations of the visitor pattern, and almost all of them used it for single dispatch.

<comment><USER4> You are right.

The Visitor Pattern doesn't _provide_ multiple dispatch.

The Visitor Pattern _relies_ on multiple dispatch, and so it provides a form of it _to itself_.

The Visitor Pattern doesn't go away in a language with multiple dispatch; its boiler plate code is just reduced.

What the Visitor Pattern is about is to bring together the benefits that arise from a cluster of ideas: first class functions, and generic functions.

In the Common Lisp object system, OOP functions are "generic functions" which stand alone and are not tied to classes. If we have a "frobosity" method and a list of objects, we can map that list easily to get every object's frobosity: (mapcar 'frobosity objlist). That is to say, we have visited each object in objlist. Each object has effectively "accepted" a "visit" from the frobosity function.

Now what we might want is instead of using generic function, to use a "funcallable object". let's use mapc instead of mapcar, since we don't need to collect the results into a list. The visitor-object itself can do something useful along those lines:

      (mapc visitor-object objlist)

This object carries state and can do useful things, like inquire each object about its frobosity and add them together.

since we don't have funcallable objects standard Lisp we can borrow the dispatch kernel of the Visitor Pattern:

      (mapc (lambda (list-obj) (accept visitor-object list-obj)) objlist)

I.e. we use a method called accept and then curry it with a lambda to simulate visitor-object being funcallable. This lambda is just _using_ double dispatch, just like the Visitor Pattern _uses_ its two-dispatch simulation of double dispatch.

If we have that real double dispatch, it's just more convenient to write the rest of this cruft. It's just a simple, linear bunch of definitions like:

      (defmethod accept ((visitor this-class) (obj that-class))
         ;; handle this-class + that-class combination
        )

The double dispatch itself isn't the point of the pattern. The point is to use an object as a function which is mapped over some other objects, and that object does something useful: accumulates some information, pretty-prints, translates the structure to something else, etc.

</comment></comment></comment><comment><USER2> > Realizing that C++'s "special" member functions may be declared private

Don't do this anymore! Just delete them:

        MyClass& operator=(const MyClass&) = delete;

Private-really-means-deleted was a cool and very useful trick before C++11. So useful, that it was a shame to require secret knowledge and aha moments to use. So they just made it a normal feature of the language. There's also a way to explicitly use the default implementation:

        MyClass& operator=(const MyClass&) = default;

<comment><USER4> Alternative view: if you must use C++, stick to nothing later than C++2003.

Anyway, declaring a constructor " = delete" isn't the same thing as making it private. If it's private, the code in your class scope can still use it. If you can't trust your class private code to do things correctly, then you're screwed; go join IT and write backup shell scripts. So basically this "= delete" is just another ear growing out of the elbow of C++.

<comment><USER5> The reason for testing and static typing is that you can't trust yourself to be perfect. I want to declare that I won't do things that don't make sense, so the tools will tell me if I do them unintentionally.

<comment><USER4> In 1998 C++, we can solve the problem of how to make a class non-copyable, even to code that is in its class scope.

We can create a dummy class which has a private copy constructor that is not implemented:

      class noncopyable {
      private:
        noncopyable(const noncopyable &);
      };

then simply make this a data member of a class that you don't wish to be copyable:

      class whatever {
      private:
        noncopyable nc;
      };

The default copy constructor generated by the C++ compiler performs a member- for-member copy, which involves copying nc. That is not possible, so in effect that copy constructor is defeated, not unlike by "= delete".

Alternatively use inheritance to mix this in as a trait:

      class whatever : private noncopyable {
        // ...
      };

</comment></comment></comment></comment><comment><USER6> I love C and Objective-C. I can't stand C++.

Is that common among programmers?

<comment><USER7> It's easy to dislike or hate C++ due to its immense complexity, and programmers like to be able to keep simple abstractions in their head so they can concentrate their energies on their problem domain without worrying about language confusion. With C and many other languages, this is possible as they are smaller languages. C++ on the other hand: is there any language with widespread use that is so deep and complex? However, there are undeniable conveniences to C++ (safety, a good library, much more -- especially functional-style programming with lambdas now) that can speed up your work process, and if you can accept that you will never know the entire language and can just use those bits that make things easier, it is possible to have a healthy relationship with the language. And it offers tremendous room to grow as you get more and more comfortable with it. Few languages allow you to just keep diving in deeper and deeper as you desire, while still letting you get to work right away without being a master. Even template metaprogramming alone is gigantic area of ongoing research -- the stuff you can do with it is mind- bending and unavailable in nearly all other languages. Templates are, after all, one of very very few wholly functional, immutable languages out there. And template instantiation is the underlying force behind many of the modern features like lambdas that allow you to access that power without actually knowing templates well. It's a powerful language for which you must accept its character flaws in return for its abilities.

It's doesn't hurt either that the libraries available in C++ are really cool.

<comment><USER8> > safety

Um, no. C++ can be safer than C (which is an incredibly low bar) but only if you carefully constrain yourself to certain subsets of the language, which is why the web is chock-a-block with byzantine "C++ coding standards" documents describing all the rules you have to follow in order to avoid shooting yourself in the foot.

<comment><USER4> Indeed that not only you have to follow, everyone else on the project has to follow, as well as every newcomer and every piece of third-party code that is brought in.

"Avoid the parts you don't like" works best for one programmer working alone.

<comment><USER9> I had an instructor once that insisted on having a single exit point for all loops. "Never use break or continue or return from a loop." The argument was that understanding control flow is more complex when you don't have to deal with these things.

However, those things exist in the language. You can't just pretend nobody is going to use them, because there might be very good reasons to use them, especially in an imperative context.

(Though I suppose if you're grading 100 projects, such a rule might make it easier to get the code structured the same everywhere.)

<comment><USER4> In the world outside of that instructor's classroom, there are coding conventions which forbid certain things, with excellent reasons for doing so.

Back when ISO C++ was still staffed by people with useful ideas, they invented various more specialized, safer casts that refuse to do "off topic" conversions. These replace the "(type) expr" C casting notation.

A C++ coding convention document can cheerfully forbid C style casts; there isn't any reason to use them.

</comment></comment></comment></comment></comment></comment><comment><USER10> Yep the beauty (and maybe curse) of C++ iterators is that they are a faithful abstraction of pointers.

<comment><USER11> some people would argue that pointers themselves are a type of iterator

<comment><USER12> I would argu those people are terribly wrong, as pointers serve more purposes than iteration

</comment></comment></comment><comment><USER13> My most important C++ Aha moment was in 1995 when I wrote my first lines of Java and realized that it was possible to write OO code without having to fight the compiler every step of the way.

<comment><USER14> My Aha moment was in 2008 when I saw a java program consume 400+mb of RAM for a _text editor_. Then if you clicked on too many things, it crashed under its own weight (eclipse).

"But it has _garbage collection_ " they said. "You dont have to worry about pesky _memory managment_ , the language has an _intelligent VM_ that handles it _for you_!".

</comment></comment><comment><USER4> That was 2006. Myer's most impressive "Aha moment" w.r.t. C++ came last December, eclipsing the others:

[http://scottmeyers.blogspot.ca/2015/12/good-to- go.html](http://scottmeyers.blogspot.ca/2015/12/good-to-go.html)</comment>


Apple warns of risks from German law to open up mobile payments - <AUTHOR> https://www.reuters.com/article/us-apple-germany-apple-pay/apple-warns-of-risks-from-german-law-to-open-up-mobile-payments-idUSKBN1XP16M <comment><USER2> The EU has been making some good moves in opening up the payment services industry through regulation. The biggest example is the PSD2 regulations passed in 2015[1]. Among many other things, this law requires banks in the EU to expose APIs into their systems, that allow third parties to make transfers to and from the bank's accounts, only subject to proper customer authentication and AML compliance. This essentially lets third parties build universal payment services on top of existing banking infrastructure.

> The law highlights the growing desire in Germany for tighter regulation of > U.S. technology companies.

No, this highlights that the EU is willing and able to regulate markets to keep them open to all participants.

Looking forward to laws opening up this sector even more.

[1] [https://en.wikipedia.org/wiki/Payment_Services_Directive#Rev...](https://en.wikipedia.org/wiki/Payment_Services_Directive#Revised_Directive_on_Payment_Services_\(PSD2\))

<comment><USER3> Yes, PSD2 is good, but I'm wondering why they didn't go further and mandate something like UK's Open Banking.

The difference is that currently in EU banks are forced to expose a banking API, but every bank can have their own API. While in UK there is one API standard that banks are supposed to allow to be used.

So writing an app for EU one has to deal with tens (if not hundreds) of bank- specific implementations while in UK one is all that's needed.

<comment><USER4> The real result of this is aggregators appearing, which present a unified interface to all banks, hiding the implementation details under their own interface. i.e [https://www.neonomics.io/](https://www.neonomics.io/)

</comment></comment></comment><comment><USER5> Apple could've probably easily prevented this if they had allowed banking payment apps from the beginning, like Google did.

Without an exclusive payment system, they would just be a payment alternative that would be way more user friendly than their competitors and everything would be dandy. I'd even consider it to be a reason to buy an iPhone, given their super simple UX flow compared to even the most user friendly bank apps.

I hope not just Germany, but also the EU will take action against companies like Apple. These exclusive networks that serve no purpose other than vendor lock-in are a lose-lose scenario for customers and even the most rabid Apple fans should see how shitty their behaviour is.

They've made their bed and now they will have to lie in it. Good on Germany for taking action.

<comment><USER6> I've seen the mess that banking apps on Android made. Not supporting certain phone models despite having NFC, needing a special SIM-card for the secure element, horrible UX. Multi-bank support meant switching between apps before payment. It's better now but far from perfect.

The benefit of the Apple Wallet for customers is having all your cards in one app, available from the lock screen. The benefit to the bank is that they don't have to make an app, they just need the back-end integration with Apple Pay.

<comment><USER7> >The benefit of the Apple Wallet for customers is having all your cards in one app, available from the lock screen. The benefit to the bank is that they don't have to make an app, they just need the back-end integration with Apple Pay.

I don't understand this. If you can just add a credit card or a bank account via direct debit then why does Apple Pay require cooperation from banks at all? The primary reason why those banks want their own app is because Apple doesn't want to integrate them into Apple Pay.

<comment><USER8> There are additional privacy layers in the system, such that every time you make a purchase, a temporary card number is generated and used, rather than your actual card number. This is beneficial as it prevents the retailer from tracking your purchases, but requires interactive participation from the bank, which needs to map that number to your actual card number in real time. As part of the onboarding process when you enroll a card, your bank must confirm the enrollment to ensure this process can take place.

It seems to be part of a multi-step key exchange mechanism [0] mediated by Apple but stored locally at either end, ensuring that Apple does not retain your card details at any step of the process. Of course, without bank participation, there aren't two parties to actually mediate _between_.

[0]: [https://support.apple.com/en-us/HT203027](https://support.apple.com/en- us/HT203027)

<comment><USER9> "Every time you make a purchase, a temporary card number is generated and used"

This is a common misconception. Every device receives a unique DAN, but when multiple transactions happen across time using the same device, the merchant will receive the same DAN.

This allows individual devices to easily be invalidated by the issuer, but it doesn't really provide much privacy benefit from, say, merchants aggregating personal information based on your purchasing patterns.

</comment></comment></comment></comment></comment><comment><USER10> Of course the monopolist is warning against having to allow competition to their market. Nothing to see there.

If Apple Pay is so much better than what the banks offer (which it probably is), then there's no issue, people will continue demanding and using it. It will force Apple to improve their product over what the banks can do constantly and that's how we customers win.

<comment><USER11> I think the problem here is that Apple wants payments on the iPhone to be secure, easy and private. If they gave banks full access to the api, they would do what's in their best interest (reusing CCs numbers accross vendors, making it harder to use more beneficial cards, less transparency). This would mean that paying on iPhone would be considered harder or more inconvenient then using a card because many consumers don't know the difference between Apple Pay and their bank app's payment system. It would also mean that fewer banks adopt Apple Pay, which is already not that great in many countries.

I'm honest not sure if opening up the system would be a net benefit. There are certainly advantages to keeping it closed but we also miss many great opportunities with NFC because of that. I would expect Apple to open it up eventually, when users become used to using Apple Pay and expecting the same convinces from their bank app

<comment><USER12> > Apple wants payments on the iPhone to be secure, easy and private.

I don't trust apple for that more than I trust my bank anyway.

<comment><USER13> > I don't trust apple for that more than I trust my bank anyway.

Having worked for many banks, I'd advise you to reconsider that position.

</comment></comment></comment></comment><comment><USER14> >> We are surprised at how suddenly this legislation was introduced,

Meanwhile we, the Apple clients are surprised why it took so long to pass this legislation. I still wonder why nothing is done against the appstore/google lock-in.

</comment><comment><USER15> I don't see anything good coming out of this law, honestly. I've read some other commenters saying that Apple doesn't want to talk to small banks, but I find that to be the complete opposite of my experience.

Here in Portugal, only one bank supports Apple Pay, _and_ it's a small one (apart from N26/Revolut, the online ones). None of the bigger banks support it. Instead, they all support a national app that uses QR codes on iOS and NFC/QR on Android for payments (but its UX is much worse, even on Android where it uses NFC, and has a load of other problems - since it's properietary it doesn't work internationally, etc.). Of course, there is no Google Pay support at all here, and I blame the fact that NFC payments are supported on their own app. There's even less incentive for them to support Google Pay at all, and that's exactly what happened. I'm afraid that Apple Pay would be dropped if Apple was forced to open up NFC for payments.

</comment><comment><USER16> Does anyone know which law it is and can post an English translations? Feels like this HN thread will be too vacuous if we don't know what we're discussing.

<comment><USER17> [http://dip21.bundestag.de/dip21/btd/19/151/1915163.pdf](http://dip21.bundestag.de/dip21/btd/19/151/1915163.pdf) from page 77, § 58a. IANAL but it looks like it matches the summary from the article pretty well. There are some exceptions, like if you can _prove_ that opening it up would weaken the security. But it's rather clearly tailored to apply to Apple Pay.

Here's a lightly touched-up translation courtesy of deepl.com -- not sure if the references made it intact (and pretty sure the legalese didn't), but it's using "clause" to refer to the numbered sub-paragraph things:

 _§ 58a: Access to technical infrastructure services in connection with the provision of payment services or the conduct of electronic money business

(1) An enterprise which contributes to the provision of payment services or the operation of electronic money business in Germany through technical infrastructure services (system enterprise) shall be obliged, upon request of a payment service provider within the meaning of § 1 Clause 1 sentence 1 numbers 1 to 3 or of an electronic money issuer within the meaning of § 1 Clause 2 sentence 1 numbers 1 or 2, to make these technical infrastructure services available without delay and subject to reasonable fees and reasonable conditions of access. The provision within the meaning of sentence 1 must be designed in such a way that the requesting enterprise can provide or operate its payment services or electronic money transactions without hindrance.

(2) Clause 1 shall not apply if, at the time of the request, the system operator is not a company whose technical infrastructure services are used by more than 10 payment service providers within the meaning of § 1 Clause 1 Sentence 1 Nos. 1 to 3 or e-money issuers within the meaning of § 1 Clause 2 Sentence 1 Nos. 1 or 2 or which has more than 2 million registered users.

(3) In exceptional cases, the system operator shall not be obligated in accordance with Clause 1 if there are objectively justified reasons for refusing to make the service available. These are particularly present if the system enterprise can prove that the security and integrity of the technical infrastructure services is specifically endangered by the provision. The rejection must be comprehensibly justified.

(4) If a system enterprise culpably infringes clause 1, it shall be obliged to compensate the inquiring enterprise for the resulting damage. The ordinary legal process is given.

(5) The duties and responsibilities of the cartel authorities under the Act against Restraints of Competition shall remain unaffected._

<comment><USER16> Thank you!

</comment></comment></comment><comment><USER18> I'm not sure I understand this law. My Apple Pay already hooks up to my finance company's Mastercard and my bank's Visa. Who is getting access to compete for service under this law? The banks? Some other payment processors? Would it just be somebody else hooking up my credit card instead of Apple?

<comment><USER19> Apple takes quite a huge amount from each payment (~10% I heard) so if you could hook up the same credit card using e.g. Google Pay, the bank would pay only e.g. 5% (I made that number up) per transaction.

Consumers don't see it, so this competition on iOS would benefit mostly banks if you think only about costs, but there is another side to this.

If my bank doesn't support Apple Pay, but supports Google Pay, then I can't use my iPhone to do payments because Apple prohibits Google Pay to access NFC.

<comment><USER20> > 10% per payment

that'd be ludicrous. I found a source that says 0.15% which is way more reasonable: [https://www.macrumors.com/2014/09/12/more-apple-pay- details/](https://www.macrumors.com/2014/09/12/more-apple-pay-details/)

<comment><USER18> I'm amazed when people assert stuff that is ludicrous on the face of it. Places that have signs that say "no Amex" because it's 1% more fees are also implementing Apple Pay ...

</comment></comment></comment></comment><comment><USER21> Thank you, Germany.

I love the EU and it's countries more and more for every news article like this.

<comment><USER22> What do you like about this regulation? What do you see being implemented in practice and how will it change the customer experience? I seriously don't see the advantage.

<comment><USER23> In order to implement Apple Pay in a country, a bank needs to beg Apple. And it looks like Apple doesn't care about smaller banks and small countries at all. For example, in NL they allowed only a few biggest banks to implement Apple Pay.

<comment><USER24> Apple wants every bank. The discrimination comes from the payment processors — it's likely that those payment processors who handle transactions for the local banks don't care about the smaller banks. For example, FirstData in the US drove and facilitated adoption — it wasn't the banks that reached out to Apple or vice versa. It's fun to say something like "a bank needs to beg Apple," but that is just not based in any sort of fact. Instead your comment attempts to paint a picture that big, bad Apple is mean to little banks when the truth is far more complex and has little to do with Apple and everything to do with payment processors. It's also very likely your small bank doesn't want to pay the 15 basis points on credit or the 3 basis points for debit.

But saying Apple doesn't care about smaller banks — that's just a lie. Some of the smallest banks all across the US are using Apple Pay. It's possible and probable that your bank just does want to offer Apple Pay.

Here is an interesting article from 2015 about banks and Apple Pay: [https://www.bankdirector.com/issues/technology/becoming- an-a...](https://www.bankdirector.com/issues/technology/becoming-an-apple-pay- bank-should-you-do-it/)

Please note the lack of "begging" involved in the process discussed in the article linked above.

</comment></comment></comment></comment><comment><USER25> Having sat in on some PSD2 fintech 'opportunity' presentations, I'm without doubt that, while well intentioned, the brave new world of 'open banking' regulation will be hell for consumers and a windfall for the least scrupulous in the fintech sector.

</comment><comment><USER26> If Apple has to open their infrastructure then there needs to be reciprocity. I want Apple Pay. I don't want Wal-Mart pay, Starbucks pay, CurrentC, ...

</comment><comment><USER6> What would stop Apple from disabling NFC inside the German borders? Germans use cash for most payments, so they wouldn't lose too many customers.

</comment><comment><USER27> Sounds like this is just the Payment Service Directive ? Someone at APPLE must have slept while on the wheel for years.

</comment><comment><AUTHOR> I would not be surprised if instead of complying, Apple would just disable ApplePay for Germany altogether.

</comment><comment><USER28> I'm not against a law like this in principle, at least I don't have an instinctive aversion, but it seems a mistake to ram it through without any consultation or a proper review by technical and financial experts. And by that I don't just mean industry insiders, but security researchers, etc.

<comment><USER29> > without any consultation or a proper review by technical and financial > experts

Nah, that would just have opened the door for more lobbyism. Apple seems to have strongly worked against this law, seems like even the US ambassador was involved [0, about half way on the first page]. Looks like somebody hit a very sweet spot and an easy cash cow for Apple.

We need more open markets for processes like this. It's just fine that Apple has to open up.

[0]: [https://www.heise.de/newsticker/meldung/Lex-Apple-Pay- Bundes...](https://www.heise.de/newsticker/meldung/Lex-Apple-Pay-Bundestag- bestimmt-offene-Schnittstellen-fuer-Bezahldienste-4586773.html)

<comment><USER28> So you can guarantee there are no security or privacy compromises in doing this?

<comment><USER30> What Apple is forced to allow now is already practice with Android phones. So we are really not talking about something new and risky, this is well- established technology.

<comment><USER18> We don't know how NFC is implemented on iOS. It could be tightly bound with the iOS Secure Enclave and then it's NOT "well-established technology" since Android uses different architecture(s).

<comment><USER30> The law has a provision for this case, but I highly doubt there is a technical reason for not opening NFC on iOS.

<comment><USER18> Yeah, this would definitely be a "show your work" situation if Apple said it wasn't possible.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> Due to an anti-money laundering law? This sounds exactly like PSD2...

</comment><comment><USER32> A motion Passed quickly late at night that doesn't seem at all odd.

Given that Angle Merkal wanted it pulled (for good reasons) sounds like this was bounced though by either the greens or maybe by conservatives with input from the German backing sector

</comment><comment><USER33> Hi guys

</comment><comment><USER34> Apple's complaints were predictable. If we let them, they'll also argue that hair loss or bad weather endanger the security of financial transactions.</comment>


The average color of the New York City sky, updated every 5 minutes. - <AUTHOR> http://nskyc.com/

<comment><USER2> A clever idea, however his data source is irrevocably corrupted by the auto exposure and auto white balance of his webcam. The result is, sadly, more influenced by the algorithms in his camera than the sky itself.

Notice how there's some outrageous and short-lived tones during sunrise and sunset -- that's the white balance jumping around (Possibly an automatic saturation gain too?)

Then notice how the brightness doesn't peak and fall during the day, instead jumping quickly from darkness to "full" brightness with frequent dramatic shifts far greater than reality would allow. That's because the moving cloud cover is triggering the auto exposure to jump around incessantly.

The ideal fix would be to replace the webcam with a digital camera capable of tethered shooting and fully manual operation. You'd fix the shutter, aperture and ISO values to a level that minimizes clipping, set the white balance to daylight, and point the camera in a direction least likely to be in the sun's path (in the southern hemisphere, that's south).

In order to capture the dynamic range fully, you could allow the camera to automatically choose the shutter speed, then compensate in the algorithm by reading the shutter speed from the EXIF data.

That said, full points for the idea, and for a great web app to visualize the data!

<comment><USER3> Some webcams have manual settings, I know mine does. Just enabling those should get you 90% of the way of a tethered digital camera, "all that remains" is getting sufficient dynamic range and fixing the curves/compensating for human perception.

<comment><USER2> Many cheap/consumer devices let you disable _some_ automatic adjustment, but rarely do they let you disable everything. For example, I've seen webcams that can fix the white balance but have automatic saturation adjustment that can't be turned off.

The cheap option that comes to mind would be an old and/or second hand Canon PowerShot capable of running CHDK firmware. Ask friends and family; you'd probably be able to score one free from a dusty cupboard draw.

</comment></comment></comment><comment><USER4> The average color of the Seattle sky, updated every 5 minutes: #DDDDDD

<comment><USER5> #DEDEDE every now and then when a Boeing plane flies over the camera.

</comment></comment><comment><USER6> I always wanted to make a wall-sized version of this with really bright LEDs-- kind of like a light therapy box, but programmed with the full progression of color and brightness of various locations and seasons around the world - summer in NYC, Paris in the springtime, New England in the winter, LA on a non-smoggy day, etc., with options for real-time data feeds, too.

So you could feel like you were in the best location in the world on the best day of the year. Or just synchronize your work/sleep schedule with some other timezone.

Small versions as nice gifts, big custom versions for the luxury/institutional market. Chumby app. Wall mounted LCD/LED and/or LED dome projection.

Any hardware hackers feel like pairing up? I'm a short flight from Shenzhen. ;)

<comment><USER7> You could definitely sell these I reckon.

</comment></comment><comment><USER8> If the size of each block was reduced to a few pixels square you could fit an entire year in a single image (4 pixels * 12 * 24 = 1152 wide, 365 * 4 = 1460 high) - which might be nice way of visualizing what the weather is like in a location.

<comment><USER2> If you were making the blocks that small, I'd make the axis meaningful and go 365 blocks across -- one column for each day of the year -- then midnight to midnight from top to bottom.

This would be a great visualization of daylight quantity and quality over the year.

<comment><AUTHOR> A similar visualization to what you're talking about is an old project by Lee Byron: <http://www.leebyron.com/what/daylight/>

<comment><USER8> Yeah - that's similar to what I had in mind, I don't know if making it bigger would show the effects of weather more.

What those do show is:

\- The huge variations in day length due to latitude

\- How those of us in higher latitudes spend in the gloaming - my favourite time of day

</comment></comment></comment></comment><comment><USER9> Clever idea - I think it would be even better with some thinner lines (either vertical or horizontal) like <http://moviebarcode.tumblr.com/>

This would more closely match the progression of time, instead of making rows of squares.

</comment><comment><USER10> Brilliant idea! The site is a little slow, so in case it didn't work for you first time, mouse over each panel to see the actual photo that was used for the avg color calculation.

I'm often looking for color inspiration, so will use this. Would be amazing to have this for Colorado skies, especially as the sun sets over the Rockies.

</comment><comment><USER11> It would be pretty cool if he it make his could available on github so others could do the same at their cities.

<comment><USER12> I looked around. and found this <http://jsfiddle.net/xLF38/>

Hope it's helpful.

a bug fix:

`document.body.style.backgroundColor = 'rgb('+rgb.r+','+rgb.b+','+rgb.g+')';`

should be

`document.body.style.backgroundColor = 'rgb('+rgb.r+','+rgb.g+','+rgb.b+')'; `

<comment><USER13> Weirdly on that demo it derived an average color of green even though the pic looked to be 80% blue.

<comment><USER12> hence the fix.

</comment></comment></comment></comment><comment><USER14> I'd love for a way to interface with this site. Perhaps something that let's me get the current color and update my website's background color with it.

</comment><comment><USER15> Great idea. Its already gone viral :) It might be better if you provide thin strips of each color rather than whole thumbnails as it can more accurately tell hows the skys colors is changing

</comment><comment><USER16> Pretty cool. Might base my next color palette off of this.

</comment><comment><USER17> No API?

</comment><comment><USER18> That looks terribly depressing to me. Just saying.

</comment><comment><USER19> Should totally add thumbnails. The mouseover would be more convenient for users and bandwidth costs would be lower.

<comment><USER19> Or maybe they already are thumbnails, and the site is suffering from the Hacker News effect... =o

</comment></comment><comment><USER20> At which color balance though?

If it's auto color balance, it's completely useless.

</comment><comment><USER21> Interesting. Not sure why this on the front page unless I'm missing something very important, but interesting

<comment><USER22> I like it because it is different (Inspiring maybe?), and it is someone's hacky project. Maybe a bit simple, but fits in IMO.</comment></comment>


HTML/CSS/DOM book recommendations? - <AUTHOR>

Hello.  I'm beginning to look into web design/programming and am looking for recommendations of good books that introduce the client side of the web (i.e. HTML/CSS/DOM).  I've been playing around with the Django framework but I feel like I need some exposure to basic layout design to further my work.
Thanks,
David <comment><USER2> For introduction to HTML, CSS, JavaScript, HTML DOM, I recommend you visiting the site <http://www.w3schools.com/> .

Respectively, you might want to read: Learn HTML, Learn CSS, Learn JavaScript and Learn HTML DOM.

For reference, when I want to remember or search for some specific tag, I'm used to go to <http://htmlhelp.com/reference/html40/> .

And I highly recommend you, when you're a little advanced in your learning, to periodically access Web Devout: <http://www.webdevout.net/> . There you can find tables containing browser compatibility elements for HTML, CSS, JavaScript, DOM, articles, really interesting stuff.

Another awesome website I'm used to access, mostly for JavaScript clarifications and techniques: <http://www.quirksmode.org/>

I think these resources are 95% what I use when I need to figure out something regarding HTML/CSS/JavaScript/DOM and browsers compatibility.

</comment><comment><AUTHOR> Thanks aaco. These resources should definitely get me started. Much appreciated!

</comment><comment><USER3> I've always been a fan of the Friends of Ed books.</comment>


Grindr Shares Personal Information With Third-Parties - <AUTHOR> https://github.com/SINTEF-9012/grindr-privacy-leaks <comment><USER2> Even within its confines, Grindr's data are rich for blackmail. (Consider: images and messages sent and received within 100 feet of Capitol Hill.) It was recently acquired by an offshore billionaire [1].

[1] [https://www.bloomberg.com/news/articles/2016-01-12/china- tec...](https://www.bloomberg.com/news/articles/2016-01-12/china-tech- billionaire-buys-control-of-us-gay-dating-app-grindr)

<comment><USER3> Yikes. Combine this with the Chinese OPM hack, where extremely personal data for most government employees with security clearance has been stolen, and they have a blackmail goldmine on their hands.

[https://en.wikipedia.org/wiki/Office_of_Personnel_Management...](https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach)

They can verify what has been reported on sf-86 vs what might be found from this service. Any affairs or issues not reported are ripe for blackmail. Possibilities are endless as they say.

<comment><USER4> Why is this a blackmail goldmine? I am ignorant of Grindr, but what I have heard it is basically Tinder but for gay men. Would Tinder be blackmail data? It's hook ups and relationships, dating, etc, no?

<comment><USER3> > but what I have heard it is basically Tinder but for gay men. Would Tinder > be blackmail data? It's hook ups and relationships, dating, etc, no?

Absolutely when cross-referenced with information from OPM database. Employee with TS/SCI clearance working on a <military project X> hasn't reported reported his gay affairs (that his wife might not know about even). The Chinese find out, approach him and make him an offer "Look buddy, how 'bout we become friends. You just tell us what you know and we'll give you some money and most importantly keep quiet about your meeting with your secret partner on such and such dates or places?"

<comment><USER5> And that's why lack of blackmailability is one of the biggies on clearance applications.

Or, "Lets not become friends. You can tell my wife. She thought it'd be fun to do that!" aaaaand so much for that blackmail. And just don't forget to tell the security officer that someone tried funny shit.

<comment><USER3> Normally yeah, nothing wrong with the lifestyle as long as it is declared and is known and no fear of it being exposed. Except that the Chinese got their hands on the OPM database so they tell what is declared there and what isn't. If they didn't disclose these things there, they'd still hopefully run to the security officer and report but they might be think again since they'd be in hot water as well for lying before.

</comment></comment></comment></comment></comment></comment><comment><USER6> It might be worth making another post to highlight an additional concern: this repository itself appears to leak profile images of many Grindr users. The raw-data folder includes nearly 14,000 files, including many ads and scripts, but also thumbnails of many user profiles. This file[1] for example, once you strip out the HTTP headers, is a JPEG that shows the legs and gym socks of one user. This one [2] shows a user's bare torso.

I would link to others, but most of the ones that I've found include clear views of users' faces, sometimes clothed and sometimes shirtless. In some cases it looks like the photos were taken in their homes. It's ironic that in exposing Grindr's mishandling of users' personal data, this party appears to have mishandled personal data themselves.

[1]: [https://github.com/SINTEF-9012/grindr-privacy- leaks/blob/mas...](https://github.com/SINTEF-9012/grindr-privacy- leaks/blob/master/raw-data/raw/2992_s.txt)

[2]: [https://github.com/SINTEF-9012/grindr-privacy- leaks/blob/mas...](https://github.com/SINTEF-9012/grindr-privacy- leaks/blob/master/raw-data/raw/3006_s.txt)

<comment><USER7> Since SINTEF is based in Norway, it's certainly possible that my profile picture is somewhere in there, and that really pisses me off. I'm out and have no problem with people knowing that I'm gay, but I shouldn't have to deal with "researchers" pulling this type of crap.

<comment><USER8> Are you happier with teens in Slovakia pulling this type of crap? If it isn't locked down someone has already scraped it and saved it forever. That you don't see most of the data being stored about you means nothing.

Just another data-point explaining why in 10 years you got pulled off that Emirates plane in a layover in Dubai and were never seen from again.

<comment><USER7> To me that's the slippery slope argument.

Sure, someone else could have done it already, or could be doing it right now. But SINTEF is supposed to be reputable research organization, and I think it's more than acceptable to expect them to properly handle any data they gather.

Grindr faces significant hurdles in improving security and complying with GDPR, and we do need to hold them to account, but that does not absolve SINTEF of their responsibilities either.

</comment></comment></comment></comment><comment><USER9> If you are using Grindr on Android, install and use NetGuard.

[https://play.google.com/store/apps/details?id=eu.faircode.ne...](https://play.google.com/store/apps/details?id=eu.faircode.netguard&hl=en_GB)

[https://github.com/M66B/NetGuard](https://github.com/M66B/NetGuard)

NetGuard is an open source local VPN that allows you to block DNS lookups to prevent calls to 3rd parties, and it does not require root access.

Calls to all of the 3rd parties mentioned are blockable. Grindr does not need many domains to be operational to work, just their own domains (.grindr.com on 443, grindr.mobi on 443) and a couple of Google static domains like csi.gstatic.com on 443 .

Of course this does not prevent Grindr from rolling up the data and sharing that with 3rd parties, but the linked analysis suggests that this is all via the app making calls rather than the company selling it in bulk.

<comment><USER10> AFWall is a pretty user-friendly and configurable firewall. Let's you easily block apps from accessing the web.

[https://github.com/ukanth/afwall](https://github.com/ukanth/afwall)

<comment><USER11> AFWall requires root, while NetGuard doesn't. Important distinction now that rooting affects ability to use features like Google Pay, Netflix (offline download), etc.

<comment><USER12> Rooted phone, no google services, and netflix downloads are just fine.

<comment><USER11> SafetyNet is a cat and mouse game. A lot of people don't have the patience for it.

<comment><USER13> I've been running Magisk since maybe August or September last year and I have not had a single issue with safetynet.

I have netflix installed (after rooting) without issue, and I use Android/Google pay practically every day along with another app that requires safetyNet without any issue at all.

</comment></comment></comment></comment></comment></comment><comment><USER14> So vending HIV status is a straight up HIPAA violation, I'm fairly sure that's been found to be the case over and over again -- it doesn't matter what your business is, health information is covered by HIPAA.

That's 250k per violation fine, and leaking status positive or negative is a violation. And every person, and every time they pass that information to every "partner" is a distinct violation.

<comment><USER15> via [https://www.hhs.gov/hipaa/for-professionals/security/laws- re...](https://www.hhs.gov/hipaa/for-professionals/security/laws- regulations/index.html)

"The Security Rule applies to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with a transaction for which the Secretary of HHS has adopted standards under HIPAA (the "covered entities") and to their business associates."

via [https://www.hhs.gov/hipaa/for- professionals/privacy/index.ht...](https://www.hhs.gov/hipaa/for- professionals/privacy/index.html)

"The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically."

in what circumstances has HIPAA been found to apply to businesses other than those?

<comment> your-nanny It applies to researchers.

</comment></comment></comment><comment><USER16> Does anyone have any information on how Scruff handles that information? Also, does HIPAA say anything about technology companies outside of the medical field's data that may voluntarily collect HIV status?

<comment><USER17> CEO of SCRUFF here, and daily reader of HN. We have not, do not, and would not share this information with third parties.

The data that we share with our third-party ad providers is:

\- Your location (so you can get those local car dealer ads)

\- Your gender

\- Your age

\- The targeting keyword "gay"

We currently use AdMob and MoPub to provide our network advertising.

More broadly, this kind of information is never something we would share. We know the sensitivity of HIV status, and know that it has been used to discriminate against our community in the past. When we do take money from direct advertisers (full-screen ads shown at launch), we make sure that they are promoting relevant and beneficial products for our community, and the ads they place are serviced 100% in-app and come with no extra data nor api calls.

Ultimately, our business model is based on subscriptions, which means we are successful when we make software that people love to use. We don't spend our days trying to squeeze a marginal penny out of some remainder-bin ad unit by trading personal data of our users. Instead, we spend our time focused on how to make an excellent product, that works reliably, is free of spambots and harassment, and connects gay guys with each other and the global gay community.

<comment><USER18> How granular is the location data you share, on the scale from postcode to lat/lon?

<comment><USER17> For these third-party ad networks, they accept a lat/lng, so we (and I suspect most apps) just pass in a value obtained from the device.

That said, upon further reflection, a local advertiser could surely get enough targeting information with a much, much less precise value...we'll look into making this change in a future release.

<comment><USER19> Weigh that privacy consideration against the value of CPGs looking to spend shopper marketing advertising dollars in-store, just sayin'...

</comment></comment></comment></comment></comment><comment><USER20> I'd be interested to see how Scruff/Jack'd/etc stacks up. My guess is Scruff does better (it has always been a better designed/developed app) but I understand why they focused only on Grindr as it does have the largest market share (admittedly a guess).

Grindr has never been exactly a bastion of good programming... Their app has always been subpar at best with infrequent updates, months/year long bugs, terrible UI/Navigation, lack of features that could be coded up in a weeks time that would GREATLY improve the experience (Message archival/hiding), and I could go on. It would be one thing if they features were relegated to the paid version (Grindr Xtra) but the only really big feature for Xtra is push notifications for when you get a new message.

All of this is to say the fact they are using HTTP to talk to these analytics/ad companies doesn't shock me at all. My bet is they haven't updated the libraries for these services in forever (which wouldn't be too hard to investigate).

As for HIV status getting sent it really depends on the service. They are not subject to HIPAA (even if you wish they were) so they can do this and I'm sure for targeting ads it makes sense. No need to waste ad dollars on "Get tested for HIV" for people who already know they are positive. As someone in this community and knows the orgs that pay for some of these ads are severely underfunded I have hard time saying this isn't important to make sure your ad dollars go as far as they can.

Lastly for people saying "just don't enter your status" you clearly don't understand this community, I'm sorry. But people who are positive face a HUGE stigma. Chatting on Grindr/Scruff is already an emotionally draining experience in a lot of cases, I don't you all want the details but let's just say failed conversations (for most people at least) don't exactly fill you with confidence/self-worth (yes there is a whole other discussion to be had there I'm sure). So waiting until you start a conversation to tell someone you are positive (instead of it being in your profile) is going to lead to even more failed conversations. If I were positive I think I'd trade my status away to analytics/ad companies in exchange for not having to talk to people who aren't interested in the first place. I'm saying that as a white male living in the US so depending on your situation you may disagree.

<comment><USER7> Grindr has the largest share of users by far. I suspect SCRUFF is #2, both because it is almost as old, but also because they clearly skew towards a different segment of the community. I assume that Jack'd and Hornet are more popular in certain geographical areas.

But I agree with pretty much everything you say, except for wanting to emphasis that getting people to enter their status is crucial in helping to normalize regular testing, safe sex practices, and allowing HIV+ individuals to be open members of the community.

<comment><USER20> It's kind of funny, and while this wasn't always the case until I educated myself on it, but I trust/feel safer with people who are positive more than those who aren't in some ways. Having sex with something who is positive but undetectable (even unprotected) is better than having sex with someone who doesn't know their status. Even putting HIV aside people who are positive are being tested much more regularly than the general public. Similarly to people on PrEP as they are required to get tested (only for HIV but I know a number of people who also take the opportunity to get tested for other things) every 3 months.

</comment></comment></comment><comment><USER21> A bit unrelated, but imagine how much data has Tinder collected, if Cambridge Analytica could do that much with just a comparatively unpopular quiz app.

<comment><USER22> The quiz app wasn't the real data source though was it? People who want to take the quiz have to press "yes" on a menu that vaguely mentions "We need your friends list" and things like that, and those permissions were used to harvest the data as far as I understood, not the quiz itself.

<comment><USER23> Yes, the quiz was the bait to get to the real prize, your friends list and their info, likes, etc.

However, your answers to a different Facebook quiz in 2014 were scrutinized by Cambridge Analytica, who were looking for the "dark triad" of personality traits, scouting for sociopaths:

[https://mobile.twitter.com/carolecadwalla/status/97590547206...](https://mobile.twitter.com/carolecadwalla/status/975905472069988352?lang=en)

</comment></comment></comment><comment><USER24> We need a new business model for social media, one which actually serves the customer instead of trying to lure them into productizing themselves.

<comment><USER25> So you're going to pay to use it right? If this imaginary product managed to get 1% of Facebook to hand over their credit card. That would be the most wildly successful pay to use application in existence. Will never happen. Social Media sites rely on mass adoption, among those who refuse to pay for just about anything.

<comment><USER26> Just as some people pay for fastmail I am pretty sure there'd be some people paying an entrance fee to a social network.

Wasn't the social network of last week, vero, supposed to be like that ?

<comment><USER27> Network effects are brutally hard to overcome.

[https://www.digitaltrends.com/social-media/app-net-shut- down...](https://www.digitaltrends.com/social-media/app-net-shut-down/)

<comment><USER28> It's not network effects. It's hostile copyright and network access law. There's no reason that you shouldn't be able to interact with the content streams from both Twitter and App.Net at the same time, for example, except that our legal system allows the dominant company to sue the scrappy upstart into oblivion if they begin to do so. This is not theoretical; small companies are destroyed frequently by BigCo breaking out the lawyers for supposed violations of the CFAA and the Copyright Act.

This sorry legal situation has completely obliterated meaningful competition in the online space, and we are letting them get away with it when we just hand-wave that it's because of "network effects". There's no reason that YoungSiteA shouldn't be able to act as a user agent on my behalf to access and reskin OldSiteB. If it could, the negative impact of switching providers would be small.

</comment></comment></comment></comment></comment><comment><USER29> For what it's worth, the most private data here is shared to analytics companies for Grindr's only analytical use. My guess is that Grindr's agreement with Apptimize and Localytics asks for the strictest possible protection of that data. If anyone at Apptimize or Localytics has access to that data, I'd be incredibly surprised.

This sort of deal isn't the same as sharing the HIV status to Google or Facebook so that advertisers can target or exclude that user information for the purposes of advertising.

For people who think this is still wrong, I'm curious what their pragmatic alternative is. How else are app developers supposed to analyze their app performance? The open source, self-hosted pickings are slim. (I can only think of Piwik, which in my experience has a dated feature set and severe performance issues.) Not everyone can afford to perform their own product analysis. Using a third-party analytics saas is kind of the only way to go and seems like a reasonable tradeoff of security for product visibility.

<comment><USER30> They have the option of not sending HIV status to any third party.

<comment><USER31> What is the privacy distinction between a third party with a contractual agreement and an employee with a contractual agreement?

Remember that Russian intelligence got a spy hired by Microsoft: [https://www.theguardian.com/technology/2010/jul/14/russian-s...](https://www.theguardian.com/technology/2010/jul/14/russian- spy-worked-for-microsoft) Will your interview questions find a foreign spy, or someone who isn't even a spy but is interested in looking at private data for personal amusement?

<comment><USER32> What?

How about _" lets just not spend medically sensitive information to third party services"_

<comment><USER31> That seems reasonable, but can we also say, let's not send medically sensiive information to every employee at the first party?

</comment></comment></comment></comment></comment><comment><USER33> I used to be a data engineer at an ad tech company, Blis. A huge proportion of the GPS data we relied upon for retargeting and enrichment of the bids came from Grindr, but even so we almost never bid on traffic from them, the brands we worked with were opposed to being associated with that app. So we benefited a lot from Grindr data without giving much back.

</comment><comment><USER34> Grindr has health-related datas and share it... And I guess that they have some european customers, right? Might be a really nice case for GDPR in 2 months !!! :-)

</comment><comment><USER35> It's also 100% owned now by a Chinese software company, so might as well assume everything you share there is visible to the Chinese gov't while you're at it.

</comment><comment><USER36> It's scary that it doesn't surprise me anymore.

Especially _social networks_ are considered most lucrative in terms of targeted marketing and data mining, and it's obvious why. Social networking remains a big deal, it's almost mandatory to have some social networking footprint online, or else you miss out on social life. Why is it still OK to trade data distilled from social media accounts? It's not! One of the many reasons and implications are in that article.

Is independent social media possible? How to fund basic service infrastructure if not by running online ads, or trading user data? Is decentralized social media feasible, and who maintains a decentralized service if it is?

EDIT: If an app developer wants to analyze how the app performs, why share most intimate user data with third parties, Facebook being one of them?

<comment><USER37> > How to fund basic service infrastructure if not by running online ads, or > trading user data?

Subscriptions, combined with community awareness advertisements showing where users' money is going to (and where it is _not_ going to) and why it benefits them.

<comment><USER36> Yes, that's usually how it works with Netflix, Spotify and similar single- purpose services. But social media? If you take social network as a single- purpose service then there is no need for several or dozens of different similar services, because it wouldn't make sense as a social network, if you cannot interconnect them.

Suppose you pay a subscription for one social network, you'll need to pay also for the other one, to get connected to people on that other social network! It needs to be one big single social network and everyone pays for one subscription. Anything else doesn't make sense, but a single social platform as a network is unthinkable. So, basically, subscription doesn't make sense for social networking.

<comment><USER38> I don't understand your point here. Just like people pay separate subscription fees for Netflix and Hulu, which essentially provide the same service with different content, why wouldn't people pay separate subscription fees for Twitter and Facebook, if it were an option to avoid ads?

<comment><USER36> Because, in the end it would cost a fortune? Imagine that, most people only pay for one _content provider_.

A social network is not a content provider, just a different kind of social network. If you cannot afford a subscription of some social network, you miss out. And that's not acceptable in terms of social life of a human being. Rich folks would be able to roam all networks, poor people wouldn't. So, if you only can afford some "cheap" networks, the whole thing ceases to make sense, as soon as you are barred from accessing other networks. Exclusiveness in social media is an oxymoron. See where this is going?

</comment></comment></comment></comment></comment><comment><USER39> I think we all agree on how stupid is to track all the little details (including positions, hiv status, etc...) for the only purpose of making money, but I would like to underline that there are only two reasons to not use https today. You're stupid or you're lazy.

Can't tell the worst, but I can tell that users should completely delete their Grindr account, now.

</comment><comment><USER40> Also, many mobile users name their device their whole name, effectively deanonymizing all their app usage for the massive ecosystem of marketing companies out there. Having worked in the mobile marketing industry I was shocked at how many people were doing this and probably had no idea this was the case.

<comment><USER41> Is that an iPhone thing?

I know it's not possible to set the hostname of your phone on most android phones but it's unique.

Of course with Android making build versions and etc. Available to devs and in the case of chrome to your user agent. You're pretty much identifible.

<comment><USER42> Oh, but it is possible. It's buried in the networking settings but there's a phone name option which is used for just about everything.

Although on my LG devices it defaults to the series name, for example G3 for an LG G3.

</comment></comment></comment><comment><USER43> This is deeply troubling. Anyone who uses Tinder or any other dating site should try requesting their data and realize that these services could likely label you a sexual deviant, racist or otherwise based on your swipes alone.

<comment><USER44> OkCupid may be even more dangerous in that regard. As far as I know they allow you to set ethnicity preferences.

<comment><USER45> Most dating services do. Why shouldn't they?

<comment><USER46> I think the reasoning is innocent, the problem is that if it gets leaked you have people (probably incorrectly) interpreting things using the data which is half the problem.

"Your ethnicity preference is white? You goddamn racist".

This gets worse when those interpreters are in a position of power.

</comment></comment></comment></comment><comment><USER47> 1) it's all in the terms of service. Idk why anybody is surprised. They own everything you enter into the app anywhere full stop.

2) it's not going anywhere. Its the gay Facebook. It has monopolized the market of an already vulnerable demographic so they can do whatever they want and still charge an extraordinary amount (almost $20 per month??) and provide no customer service.

The app doesn't even function as advertised (at least on Android). Push notifications and read receipts have been broken for years. Btw if you restrict the permissions of the app they permanently change your status to offline.

</comment><comment><USER48> I am shocked, truly shocked at this development. An app that collects user data and passes it on to third parties without users' consent? Unprecedented!

</comment><comment><USER49> I remember this paper on ad intelligence I read a few weeks ago: "Exploring ADINT: Using Ad Targeting for Surveillance on a Budget — or — How Alice Can Buy Ads to Track Bob".

[https://adint.cs.washington.edu/ADINT.pdf](https://adint.cs.washington.edu/ADINT.pdf)

</comment><comment><USER50> ISTM that "poz" "tribe" is largely equivalent to a positive HIV status?

If they're this sloppy when the client device is on one end of the connection, how sloppy are they once the data is on their end and we can't see what they're doing?

</comment><comment><USER51> These are 3rd party analytics firms and not any random companies. Both these firms have strong data protection processes and are very secure. From Grindr's perspective, they are probably looking for analytics for different segments of their users and send all data to Localytics who help them with this (vs. trying to build these internally).

Here is a thought. Do we think that the data is more secure with Grindr itself or with Localytics? I feel the answer might be the latter given data security means a lot to Localytics (as they provide analytics as a service to thousands of apps) vs. Grindr itself who may not go to the extent of Localytics to safefuard user info.

<comment><USER52> The data is already in Grindr's systems, this means it is ALSO at Localytics (and others). This is not as safe as if it was only in Grindr's own systems.

<comment><USER53> And any of these companies could be purchased by some other entity and change their data privacy policy.

<comment><USER51> This is not really true. These companies entire model is handling data and they charge their partners for it. It is not a free product. As such, going off and selling the data is not really going to happen.

<comment><USER53> Huh? That has nothing to do with what I said.

I said if any of these companies get acquired, the acquiring party can do whatever the hell they want with that data, previous privacy policy be-damned. This has already happened. A lot.

<comment><USER51> It really depends on how you as an entity who is supplying data to analytics firm have negotiated your contract with the analytics firm. Just saying an acquisition will completely negate all contracts before is incorrect.

Also, these agreements are between 2 companies (the company providing the data and the analytics firm which will show analytics on that data). There is no privacy policy per se in this case. It is all about contract negotiation on the rights you give to the analytics firm on how to share the data and what happens if they get acquired.

</comment></comment></comment></comment></comment></comment><comment><USER54> It's become clear over the last year there is a strong need for a data privacy regulatory agency in US government. I understand that regulation hampers growth, but the tech industry is mature and developed to the point that it's time to reel in "moving fast and breaking things" a bit.

<comment><USER55> > It's become clear over the last year there is a strong need for a data > privacy regulatory agency in US government.

I wouldn't trust a governmental regulatory agency to aggressively fulfill it's mission. My impression is that in general they're too much at the mercy of politicians.

I suspect a more effective strategy is to enact legislation that makes companies liable under civil law, with private citizens empowered to sue.

<comment><USER56> > I wouldn't trust a governmental agency to aggressively fulfill it's mission. > My impression is that in general they're too much at the mercy of > politicians.

I think this sort of attitude is a big problem - instead of throwing our hands up and deciding that regulatory agencies have always been and thus will always be toothless, we need to give said agencies more power to enable them to actually enforce the rules. Right now, companies regularly weigh the costs of compliance against the costs of non-compliance because to a multinational corporation, the usual fines and punishments just don't hurt that much.

Companies that break the law should regularly never, ever recover financially.

<comment><USER57> > Companies that break the law should regularly never, ever recover > financially.

Personally I would have this reworded to "Companies that regularly break the law should never, ever recover financially."

As much as I believe things are tilted too far in favor of companies these days, it is true that over-harsh regulation on business can be very bad — particularly when it becomes harder to start new businesses.

But I agree with your sentiment. To a large degree the government is as good as we make it.

<comment><USER58> This is an important point, I think. If our ultimate goal is to incentivise good practice, we have to deal with a range of problems from simple ignorance of good practice or what the law requires through to gross negligence or "wilful ignorance" situations. If you have a business that is acting in good faith but makes an error in judgement or isn't aware of some specific regulation, there is no sense taking a punitive stance. Obviously if their actions have caused damage to another party then compensation may be appropriate, but otherwise constructive engagement is likely to work best. On the other hand, if you have a business that is knowingly and deliberately acting in bad faith, there may be little point in being constructive, and the penalties need to be significant enough to force them to change (or their business to fail).

</comment></comment></comment></comment></comment><comment><USER59> Why wouldn't HIV status be protected by HIPAA?

<comment><USER23> HIPAA only covers health care providers who bill for services, such as a doctor's office or insurance. But there might be other laws that apply.

</comment></comment><comment><USER60> They also scrape your clipboard aggressively...

<comment><USER61> Source?

<comment><USER60> At least on iOS, proof by demonstration. Install the app, turn on clipboard sharing, copy something on your mac, then open the iOS app. You'll see the "Pasting from your Mac" dialog pop up pretty frequently.

</comment></comment></comment><comment><USER62> "Grindr's users may not be aware that they are sharing such data with them"

I believe that to be an understatement!

</comment><comment><USER63> I see they have some instructions there for how they did it. Any chance anyone could make a small instructive tutorial, so we can start replicating this process for other apps as well?

Then we can put everything in a giant repo and make it publicly accessible information.

</comment><comment><USER64> Looks like the repo got deleted. Can't find an arhive.org version either.

According to a friend, an article he saw earlier also got pulled. Are Grindr attempting to do some damage control?

</comment><comment><USER65> Image of the data structure.

[https://i.imgur.com/hstbZio.png](https://i.imgur.com/hstbZio.png)

</comment><comment><USER66> Does anyone actually find this surprising? It's fairly normal to send user data to third party analytics providers. If you want to know which, check your terms of service.

</comment><comment><USER67> "shares" sounds too friendly.

</comment><comment><USER68> Please don't use allcaps for emphasis in HN comments. This is in the site guidelines: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html).

<comment><USER32> fixed.

<comment><USER68> Great, thanks. I've detached this subthread from [https://news.ycombinator.com/item?id=16736341](https://news.ycombinator.com/item?id=16736341) and marked it off-topic.

</comment></comment></comment><comment><USER69> None of that data seems to be "private" according to Grindr's privacy policy: [https://www.grindr.com/privacy-policy](https://www.grindr.com/privacy-policy)

</comment><comment><USER70> So there's lots of talk about how we're going to regulate/manage data protection going forward but what are we going to do about the stuff that is already out there? I mean HIV status is a pretty toxic thing to just be floating around. It doesn't seem that we can even be sure who has this data and who doesn't.</comment>


Apple Should Kill Off the iPod Touch - <AUTHOR> http://vintagezen.com/2011/08/31/apple-should-kill-off-the-ipod-touch/ <comment><USER2> The writer doesn't get that the iPod Touch is a gateway product for kids who aren't allowed to own an iPhone. Every kid who gets one for Christmas will buy an iPhone in the future. In many ways the Touch is like their version of the Nintendo DS.</comment>


Tips to Supercharge Your Creative Productivity - <AUTHOR> https://creativemarket.com/blog/2013/04/01/7-tips-to-supercharge-your-creative-productivity/?preview=true&preview_id=3847&preview_nonce=d79b1df58a

<comment><USER2> LSD or psilocybin cubensis works pretty well...

</comment><comment><USER3> I never really understood mind maps after trying them a couple times. Can anyone explain why they are better than an outline format, or plain text?

I get that some people think visually (I'm more of an auditory learner/thinker), but it seems like mind maps make organization and prioritization harder, rather than easier.

<comment><USER4> When iam in meetings, i always doodle. Works pretty well. My mind flows and its something useful to capture it.</comment></comment>


Carl Sagan: We Humans Are Capable Of Greatness - <AUTHOR> http://www.youtube.com/watch?v=m6ugFcwsgpE

<comment><AUTHOR> I think with the number of negative stories on HN about how everything is going, we occasionally need to take a break and ponder something like this.</comment>


The idea behind dicts being ordered since python3.6 - <AUTHOR> https://mail.python.org/pipermail/python-dev/2012-December/123028.html <comment><AUTHOR> The mail is from 2010 but it was only implemented in 2016, I wonder why. Found the link in [https://github.com/python/cpython/blob/master/Objects/dictob...](https://github.com/python/cpython/blob/master/Objects/dictobject.c).</comment>


Matthew "The Oatmeal" Inman raised $20,000 for charity in 64 minutes - <AUTHOR> http://www.indiegogo.com/bearlovegood

<comment><USER2> The Oatmeal is plain awesomeness.

<comment><USER3> a motherf __*ing pterodactyl of awesomeness!

</comment></comment><comment><USER4> And counting .. !</comment>


Summary of MIT's Linear Algebra. Lecture 4: A=LU Matrix Factorization - <AUTHOR> http://www.catonmat.net/blog/mit-linear-algebra-part-four/

<comment><USER2> I've previously gone through this course as a linalg refresher, and I love it. Gil Strang is an amazing professor.

</comment><comment><USER3> If all the profs at MIT are as good as Starang I have yet another reason to regret not going there.</comment>


Google+ is now available with Google Apps - <AUTHOR> http://googleenterprise.blogspot.com/2011/10/google-is-now-available-with-google.html <comment><USER2> No way to join accounts, again. I can not understand why this kind of basic functionality is missing.

EDIT: Just to clarify, I mean there is now way to connect a Google Apps account to another Google account so that they can share certain services. I sort of understand why they think they don't need it for email, but having two separate G+ account is completely superfluous, thanks to the Circles system.

<comment><USER3> It's not like you can join two Facebook accounts you made with different emails either. That alone makes it clear that this is isn't "basic functionality".

<comment><USER2> I don't think that this is the same. I can not think of a reason why one should have two Facebook accounts, except for maintaining two complete separate sets of relations, for example for anonymity.

But having several Google accounts can happen much easier, for a variety of reasons. For example, I have used a GMail address for since my teen years. Turns out I don't actually like the format email@example.com anymore and would rather have something like firstname.lastname@example.com, but I'd still like to keep the GMail interface. Google Apps is wonderful for this, so I made an account there.

But I can not just ignore my old account, as I still get email sent to the address (I forward it) and I used the Google Talk functionality for my Jabber needs. Also, I bought my first Android apps with my old account, so they are linked to it. That means that I have to use my old account as the first one on any Android device, or I can't download my apps again.

What I would wish for is this: Have services that can be linked to any identifier/email, and shared between any number of them, so I could, for example, have two sets of email (one private, one business), but just one of GTalk, G+, Feedburner and Analytics.

I know that implementing this on top of the current system might be hard. I still think that this is the kind of functionality one can expect from a company like Google, and I would gladly pay for it.

</comment></comment></comment><comment><USER4> Congrats on Google getting it out this week. There was quite a bit of cynicism after the announcement last week.

I've been holding off joining until my personal Apps domain was enabled as I've still not finished migrating all my docs from Gmail yet - I didn't want any more loose ends.

<comment><USER5> Just wanted to echo the thoughts of mtkd. I have my own personal domain mostly because I want to maintain control of my own email address. I connected it to Google Apps (and am willing to pay for this feature), because Gmail is great.

But when Google rolls out a new service which doesn't have Apps support (which they do all the time), it's pretty frustrating. The irony is that if I _didn't_ use Apps, and instead hosted my domain myself, I'd have _better_ compatibility with Google products than when I do. Frustrating as hell, especially if you're paying for it.

I understand that they're stuck between vanity users (like me) and enterprise users, but these problems should be thought about more structurally and addressed beforehand.

</comment></comment><comment><USER6> Now if only they could get their multiple account sign-in feature polished. I use one Google account for Youtube, one for Google groups, and then my Apps account for email and plus. Why can't I set my preferred account for each service?

The day I went to Google.com and noticed I was signed in was the first sign of trouble. Why do I have to have my account used everywhere I go? I don't want you to log me in for searching when I check my email.

<comment><USER7> I would argue that you are probably the exception from the norm -- most users have only one account and would probably consider it a major inconvenience to have to log in multiple times across different Google properties.

<comment><USER8> Except they _do_ have a multiple-accounts feature, so obviously it's important enough to support explicitly. I also hate the way it works. I have to use different browsers to have it work without irritation.

Hmm. Maybe there's a plugin.

</comment></comment></comment><comment><USER9> Now that is has been turned on, I got to agree with saurik (<http://news.ycombinator.com/item?id=3132566>). It doesn't really make sense. Why would I want my social network profile attached to and controlled by my school or work? I remember a family member going through a difficult transition when he was laid off from a job he was working at for decades and no longer had access to just his email/contacts. If people use Google+ like Google wants them to, there is going to be even more important stuff held in accounts that the user doesn't really control.

Hangouts for Docs can be useful, I suppose, and I am glad those with custom domains are invited to the party, but it seems like an awkward fit.

<comment><AUTHOR> If you don't want your social profile controlled by your school or work, don't use your school or work email address as your login. I'm not sure that's even specific to Google+...

There's a reverse of that use case: a school or org may want to provide social networking to its users, specifically for that context, e.g. exchange of information within the institution.

<comment><USER10> > There's a reverse of that use case: a school or org may want to provide > social networking to its users, specifically for that context, e.g. exchange > of information within the institution.

Wow, that's actually really interesting. I hadn't thought of that angle before but I could see that happening.

</comment></comment></comment><comment><USER11> I'm a big fan of all Google products in general. People who understand the product anticipates it and are excited about it, like Google Wave for example. But sometimes it's less about the product than the way it is presented. Waves for example was presented as the end-all, stand alone collaborative tool. But when nobody understood it enough to use it the general public doesn't care about it. In the case of Google+ it is presented as a Facebook competitor in the social networking market. Everyone and their moms are already on Facebook so why would people want to update another profile and do more work. However, the advantage of Google+ is that it is backed by the Google infrastructure, which includes the established Gmail user base. Gmail already feels like a social networking product; you can easily chat with friends and new acquaintances, share events with other with Google Calendars, and use tons of Google Apps. The point is Google already is a social network. We don't need to be confused with a new product called Google+. It's social networking features should have just been revealed as a subset of Gmail. Many are already familiar with Gmail and new social networking features will draw more people to it.

<comment><USER12> Google+ was never presented as a Facebook competitor. They tried social networking with Gmail with Buzz and that failed miserably. I don't really know what the problem is. The uber bar is more than sufficient.

<comment><USER11> I never used Buzz. It just confused me when I saw the Buzz icon like when the 'mark as important icon' was new in Gmail. Maybe it would have worked if people can use the chat box to share content and do their status update. And then the feed can all paginate in one or more email maybe right above the first email in the inbox. People are all used to chat and checking their mail, maybe even naturally 'Buzz'. Don't really know too much about uber bar.

</comment></comment></comment><comment><USER13> Well, activated Picasa Web Albums, Google Chat and Google+ and it doesn't work. Maybe in a few days?

<comment><USER14> Mine got activated instantly, although I already had Picasa and Google Chat activated.

Make sure you actually saved the settings.

</comment></comment><comment><USER15> From the headline, I thought this might be an option to create a private network for your domain, like Google's internal version of Google+. This is nice, but that would be much more interesting.

</comment><comment><USER16> Curious to see how much this bumps the _active_ Google+ account numbers. Google claims about 40 million Apps users right now.

<comment><USER17> I'd guess not much. Most people who wanted to use G+ already signed up with a Gmail account. Unless you're counting one person maintaining personal and professional profiles as 2 active accounts...

</comment></comment><comment><USER18> I wish Google would just allow my normal Google account to be associated with a domain for Gmail...

</comment><comment><USER6> Can't sign in with Android app.

<comment><USER19> or the iOS app. I suspect updates will be rolling out in the next few days. This is life on the bleeding edge.

</comment></comment><comment><USER20> "Your Browser is no longer supported.

[http://www.google.com/support/plus/bin/answer.py?hl=en&p...](http://www.google.com/support/plus/bin/answer.py?hl=en&p=browser_support&answer=1347815) "

Now, I get this idiotic error since I don't use one of the major web browsers (FF, IE, Chrome, Safari).

I really hate the websites (such as read.amazon.com) that ignores the other webkit based web browsers (uzbl, luakit, surf...) with same capabilities with Chrome and Firefox. (I don't even compare them with IE!)

<comment><USER21> That's why we should use feature-detection instead of browser/version- detection for web development.

</comment></comment><comment><USER20> No way to login with the profile that I had created before Google banned Apps users. I'm still looking at my own profile as an anonymous visitor and only thing I can do is to create a new profile!

</comment><comment><USER14> I'm really happy for this news, thanks Google.

I was begging to feel a little left out.</comment>


HN - Insecure Password Practices - <AUTHOR>

HN passwords are sent over plain-text HTTP posts during logons and resets. Also, simple passwords such as '1234' are acceptable. As hackers and implementers who should have an interest in security isn't this a bad example to set... especially with all the recent password compromises and the endemic re-use of passwords?<p>Some wireshark pics here: http://imgur.com/a/69dcm <comment><USER2> Strong passwords and https are only needed when:

1) the data being accessed is important. 2) the user reuses credentials.

hopefully no one here is doing #2. and i certainly don't consider #1 to be true for me. if someone were to post as me... we'll that sucks but it isn't the end of the world.

<comment><AUTHOR> If they posted highly objectionable/obscene content as you, would that not harm your reputation? It's at least a possibility. Reputation is everything.

<comment><USER2> I'm not particularly worried about that.</comment></comment></comment>