Nest was supposed to lead the next computing revolution. Its looking like a bust - <AUTHOR> http://www.vox.com/2016/4/7/11378904/nest-tony-fadell-struggling <comment><USER2> Honestly, the only stroke of genius at Nest wasn't the self-learning aspect of the thermostat, or the fact you could set pre-programmed times, or control it from your phone. There had been other products on the market that did this, albeit somewhat poorly.

I'm convinced it was the industrial design, of making something that normally is a beige box sexy and nice to look at. Something you put on your wall, that is a necessity is now a piece of high-tech artwork that you can admire.

This is evidenced by the fact their smoke alarms, if their "connected home" story were to hold true, haven't done nearly as well. People could care less if their smoke alarms are smart, because you rarely look at your ceiling. You often see your thermostat every day, with most being located on the wall when you walk into your house or apartment.

Evidence: I have many non-tech friends and family who own a nest. They do not use any of the advanced features, maybe rarely. They all say the same thing: they bought it because it looked cool and wanted a "finishing touch" on their house. Maybe did so after a kitchen remodel or something else they did to their house, indicating it was more an emotional purchase fueled by aesthetics and ego.

Based upon this, it is now unsurprising the hype hasn't scaled. The business was kind of a one hit wonder and it's not shocking the company is floundering.

</comment><comment><USER3> Nest, to me, was never about a computing revolution.

It was that someone was finally taking Apple-level industrial design and applying it to common household goods. That made me very excited, and happy to pay more for it. Finally, a common product was getting better aesthetically, rather than worse.

All the rest was noise, mainly for investors. Unfortunately, it appears that the noise may destroy what matters.

<comment><USER4> This would have happened a long time ago if Honeywell didn't have all the patents on good thermostat design. They have three lawsuits currently going on and have settled with Intellectual Ventures. [https://en.wikipedia.org/wiki/Nest_Labs#Litigation](https://en.wikipedia.org/wiki/Nest_Labs#Litigation) That's crazy expensive and it would put almost any other company out of business very quickly.

<comment><USER5> Wow - what Honeywell sells is "good thermostat design"? All those horrible buttons and opaque modes? There's lots of room for improvement.

<comment><USER6> That's the problem with modern patents. What you're seeing is their implementation of their patents. Another company might make a massively better design, but tread on their overly broad patent that is vaguely written for just that reason.

</comment></comment></comment></comment><comment><USER7> If anything, Nest is a comment about how growing a company via investments doesn't work. If Nest could focus on working out the technical issues without the investors breathing down their neck, I'm sure the product would do much better.

Not only that, but I already have a thermostat. It works _perfectly_. I've never said to myself, "Gee, I wish I could adjust my home temperature from work, I need an exact 23.5 degrees when I get home". It doesn't do enough for me to justify messing with my HVAC system, that whole "if it ain't broke, don't fix it" adage comes to mind.

<comment><USER8> And I bet your VCR never flashed 12:00, either. You are not a representative user.

There are hundreds of millions of families out there that have no idea how to program their thermostat beyond changing the current temperature, so they just leave it running all night and day, whether they're home or not.

The appeal of the Nest thermostat is _not_ so that control freaks can fine- tune the temperature at home while in an airplane. It's so that regular people can just have it installed and forget about it.

<comment><USER9> But wouldn't those people not able to program their current thermostat, for whatever reason, would have to be able to program their new fancier thermostat?

<comment><USER10> They don't scream this like they used to, but it's called the "Nest _Learning_ Thermostat". There's one control, a ring that you turn left for colder and right for hotter. Over about a week the thermostat takes your inputs combined with the weather and develops a schedule it thinks you'll find comfortable. As it misses, you override it (again, just turn the ring) and Nest learns and updates its schedule for you.

You can use the app or the website to input a specific schedule if you prefer, which is still simpler than 99% of conventional thermostats.

Anecdotally I just programmed my grandmother's thermostat for her and it took me -- a 30-something with deep technical experience -- way too long to figure it out (I even had to break out the manual). What if grandma could just turn the ring left or right and the thermostat would come up with a schedule for her, wouldn't that be better?

<comment><USER9> But isn't that just a small part of the Nest idea?

Wouldn't the same thing be accomplished by getting someone to do it for them? Much like your grandmother and you? You set it up for her, she likely has to rarely deal with it again. All Nest does is take you out of the equation but you work for free.

<comment><USER10> Except the next time I visited, her thermostat had messed up its program and it was set at 80 degrees. Whether it was a power outage and dead backup battery, or she somehow fiddled with it and messed it up herself, it was once again in a broken state.

I hate to invoke the overused phrase, but the nest thermostat Just Works™.

<comment><USER9> Could not the same things happen with a Nest?

<comment><USER10> Not really, because it continually adjusts its schedule for you depending on your manual inputs, is powered by the HVAC wires themselves (and charges a small backup battery that you never have to worry about), and if you really wanted to you could log into her account and fix the thermostat remotely if somehow she managed to really break things. If all you do is turn the ring right or left for colder and hotter, it'll do its thing just fine.

You could hop into the menus and.. forget the wifi password or something I guess?

One thing nest handles really well is "I'm feeling a little too cold/hot tonight and I'm going to adjust the temp". You walk up and twist the ring and you're done. You don't have to disable scheduled mode or enable override mode or anything like that. Twist and done. I have a feeling that's how grandma messed up her thermostat, she was feeling cold so she turned it up to 80 (lol) and then the thermostat said, ok I guess this is my life now. 80 degrees forever.

<comment><USER9> I hate that this sounds like I'm arguing, because I'm not. I just find this discussion interesting.

If the device learns over time from grandma turning the dial up and down, does that not create strange data for the device to figure out? Take your example, grandma is cold so she turns the temp up; does this count as a manual input? Does that not eventually create a problem? Much like the original thermostat but takes longer?

Although, the account thing is interesting. Can you set the schedule and then disable the manual interface to let grandma change all she wants with no changes?

<comment><USER10> Heh, no offense taken.

I don't know the internals of how nest deals with wild swings in manual inputs, but I haven't seen a problem. Although even if it results in a "nights are 80 degrees" situation, the rest of the day is unaffected so at worst it's still better than the other thermostat.

Yes, you can set a schedule and disable the physical interface.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Funny timing on this story. Just last night my Nest "froze" the heat on. Heat was set to 68, thermostat read 73 and the Nest was still running the furnace (and the screen was orange, indicating the heat is on). Had to power cycle the thing for it to stop running my furnace. Welcome to the future!

</comment><comment><USER12> Nest is product very few people want. Period. A thermostat is not difficult to operate and why would regular people introduce complication into their lives over something they think about as little as the thermostat? The IoT will only take off when someone can come up with a value proposition besides "isn't that cool?"

<comment><USER4> The Nest requires less interaction and less thinking than a normal thermostat or even a programmable thermostat.

<comment><USER13> But is it enough?

It took me maybe 10 minutes to set up my programmable thermostat, and I probably never need to touch it again.

It cost like $40. I just can't see spending $250 for something to save that 10 minutes. And that's assuming that the Nest actually takes zero setup. What if I have to dig into it because its internal logic is doing something weird?

<comment><USER14> There was an efficiency program that gave out programmable thermostats to average householders. When they evaluated the program they found that they actually made things worse, because no one knew how to use them properly.

<comment><USER12> It's not that most people couldn't figure out how to use those programmables right; it's that they didn't care enough (ie, see the benefit) to take the time necessary to learn it.

For people who do see the benefit (I am one of those as I programmed mine in ~ 10 minutes as well), it's much more time and money efficient to use the programmable that came with my house than it is to buy some $250 contraption, install it, sync it, then learn how to use it.

With gadgets, the world is divided into those who love them for their own sake, those who see enough utility in them to invest the added time/money (relative to lower tech alternatives) and those who do not care enough to use the alternates or the gadgets (ie, most of humanity).

</comment></comment></comment></comment></comment><comment><USER15> I have a Nest and if the cloud service went away and I couldn't control it from my phone anymore, I really wouldn't be sad. It's a feature I use maybe twice a year at most.

The Nest does look cool and has a much better interface for programming a schedule, but it is hardly revolutionary.

In particular, I've been disappointed that the "the Nest will know when you aren't home and automatically adjust!" feature never worked, although that's maybe not a surprise since it's basically magic.

But I got it for free, so I can't complain. It looks cooler than the old Thermostat I had and they send me an email every month telling me how I'm like the bestest person in the world for turning off the heat and opening the windows in the spring.

<comment><USER10> > _it is hardly revolutionary._

When it was released there was nothing like it. It's still the best DIY home thermostat imo. The installation is straight out of the Apple playbook, little included screwdriver and all. It looks both retro and futuristic. Turning the wheel to set the temperature is such a great interface.

Auto-away works really well for me, so being able to crank on the heat/a/c when I'm an hour away is huge. Huge. This sounds lazy, but I like being able to control the upstairs thermostat while I'm comfortably snuggled in watching a movie downstairs.

Monthly emailed energy reports help me pay attention without being too intrusive. It's also adapted to our family's usage really well (the "learning" part of the learning thermostat). I love not having to mess with it too much, although I understand that's not a Nest-specific feature.

Best of all, there's no monthly fee. I can't get behind Nest Cam because of their fee, but the Thermostat is buy-it-once (...so far).

What's so smart about it is that unlike other energy-saving improvements, you can use it in rentals too. My current nest was installed in my last rental, I just saved the old thermostat and took pics of how it was installed so I could put it back.

For me, its set-it-and-forget-it factor is massive, and that's what I prefer almost always. Since I'm the resident utility guy, the less I have to dork around with stuff other people use, the better - and Nest filled that role perfectly (incidentally: that's why my family has iphones and macbooks instead of android & windows/linux desktops, why I don't install Tomato on my routers, etc -- not because I think they're intrinsically better, but because I don't have to spend a bunch of time managing them).

Anyway, my point is I think the thermostat _was_ revolutionary -- essentially nobody was thinking about residential thermostats before Nest came along.

Their smoke detectors on the other hand... don't even get me started.

<comment><USER16> > Turning the wheel to set the temperature is such a great interface.

It doesn't get talked about as much anymore, but the scroll wheel on the original iPods really was a fantastic interface... it turned something obnoxious (tapping arrows to move through a really long list) into something easy and comfortable. I'm very glad the idea is still being used.

</comment></comment></comment><comment><USER17> It's a fascinating topic and there are many angles to discuss, but the one I would focus on is the acquisition issue.

One of the contradictions of capitalism is that a high-P/E and high-growth company like Google will inevitably close services and squash products that it acquires because it to maintain that high-P/E ratio they will be forced from time to time to get out of any businesses that can't sustain the great numbers that their core business can put up.

At the enterprise level, if I was tasked with vendor management with a company that was acquired by Google or Facebook I would probably call my sales rep right away and be like "you better post a performance bond" or "you better sign an escrow agreement for the source code" or "I talked with a sales rep at company B and he told me this and he told me this (what do you think about that?) and he told me this (what do you think about that?) and he told me this (what do you think about that?) (oh really?) and I would go on with that until he gives me at least a 15% discount or blows up at me and hangs up the phone."

If it was Microsoft I would feel the same way based on historical experience. Not so with IBM. They buy failing or market trailing companies that have something to do with "Watson" or "Cloud" \-- generally they don't get any better, but they suffer from at most benign neglect. Generally they did not make the cut or we moved to a competitor years ago, but as notorious as IBM is for discarding employees, it does try not to leave customers out in the cold.

<comment><USER16> > ...or "I talked with a sales rep at company B and he told me this and he > told me this (what do you think about that?) and he told me this (what do > you think about that?) and he told me this (what do you think about that?) > (oh really?) and I would go on with that until he gives me at least a 15% > discount or blows up at me and hangs up the phone."

What?

</comment></comment><comment><USER18> I think this article makes some good points. No matter how you spin it, most people just won't understand the appeal internet-connected, smart devices for the home. That's why the direct-to-consumer market isn't exactly the correct route to take, right now.

It works well with tech-savvy individuals, but that's a small subset of humanity. It's basic economics.

My company (ElectrIQ Power) is actually in the IoT space, and we've carefully assessed the market before even starting. Fortunately, for us, we're in a unique group where demand is currently small, but increasing at a very high rate. Our revenues are also far greater than would be possible if we were operating in a direct-to-consumer strategy.

</comment><comment><USER19> I replaced my existing "dumb" thermostat with a nest and it has certainly been worthwhile, both in terms of energy cost savings and in having a convenient, pleasant interface for temperature control.

I purchased the third party Skylark app and installed it on my phone and my wife's phone so that the nest goes into "away" mode only when we are both out of the house. I think the official Nest app also added similar functionality recently.

After this initial set up, and a week or so of "training" we haven't had to think about setting our thermostat. Our house is just magically at the correct temperature when we are there but our bill is lower than it was before we got it.

</comment><comment><USER20> The main takeaway from the article (they don't make this argument directly, but I'm inferring it) is that the main opportunity is for a cloud/services company to provide a standard and backbone services for all the individual appliance manufacturers to connect to. So we wouldn't be seeing a Nest washing machine, but rather an LG washing machine that connects to your (for example) Nest account.

This still leaves an opportunity for Alphabet (who knows better than them how to offer a free service and profit off the data?), but leaves Nest in a category similar to Nexus - a line of HW that demonstrates the value / usefulness of the services, but is not really a key profit center for the company. It's not bad, but it's not somewhere I personally would want to work.

</comment><comment><USER21> Nest is a pillar of the future. The future of ubiquitous surveillance. We track your online activities, we track your work and personal communications, we track whom your friends are, we track your whereabouts, we track your financial transactions.

The last battlefield is your home. You must have an always on device in your house that listens to your activity and conversations. Since you can turn off mobile phones and smart tvs [1], we need something better. Amazon has Alexa. Google has Nexus Player. Nest is the best, because shutting it down has unpleasant consequences.

[1] Your smart tv is probably smart enough to not really shut down and keep listening [wink wink].

<comment><USER22> We're already there as of >a year ago re: TV always listening to you: [http://money.cnn.com/2015/02/09/technology/security/samsung-...](http://money.cnn.com/2015/02/09/technology/security/samsung- smart-tv-privacy/)

</comment></comment><comment><USER23> Nest is a cool product, but it might be just slightly ahead of its time, by a hair. Maybe the future generation of homeowners will be adamant about having a high tech touchscreen interface for their HVAC system, but for most people I know, it isn't a problem they're compelled to pay for. As the saying goes, the existing solutions are generally "good enough". I think Nest is on to something, but I'd bet it's another 5-10 years before they start seeing real breakthrough success.

<comment><USER24> One of my good friends asked me to make a touchscreen interface for his car's HVAC system.. so there definitely are interested folks out there. :)

</comment></comment><comment><USER25> I'm really disappointed about what they did with Dropcam. The dropcam was such a great product that Nest basically destroyed by pushing out the core team, making the product worse (but hey, it's slimmer), and stagnating development. I believe we are missing out on great things that would've happened if Dropcam had stayed independent.

</comment><comment><USER26> It took them so long to produce a version capable of running common European systems (separate hot water), that I lost interest long back. They finally released something christmas last year.

The cock ups along the way didn't help either. Wouldn't touch them with a barge pole now.

Honeywell on the other hand seem to have smarter smart kit, and a decent reputation.

<comment><USER27> Honeywell's Evohome product is much smarter, you're right. As is Heat Genius. They are probably a slightly different market though, because have more capable systems, being able to do soft zoning. Also arguably, neither are quite as slick looking.

The trouble with Honeywell is that they should've been doing this stuff a decade ago.

Personally I think all these thermostats are just sticking plasters over the real problem: houses shouldn't leak heat nearly as much as they do. We know how to fix it, it's a technically solved problem, but regulation and government intervention just isn't keeping up.

<comment><USER28> >houses shouldn't leak heat nearly as much as they do. We know how to fix it, it's a technically solved problem, but regulation and government intervention just isn't keeping up.

The house I live in is almost 200 years old. What sort of regulation and government intervention do you have in mind? Should everyone with a house that's not up to the latest modern insulation standards be forced to undertake a major construction project to update all their walls and windows?

As with many things, the issue isn't with the technology and standards that exist today. It's with the large installed base that can't be just wished away.

<comment><USER26> The UK had, for a while, a reasonable approach to insulation. Historically, especially post-war, we had some terribly poor housing as far as thermal efficiency went.

The energy companies were required to provide free and discounted energy saving measures for their customers, to a certain value each year. This was as part of the overall carbon lowering measures.

They typcally provided loft and wall insulation, both of which could be done in a day. If you had solid walls it took a little longer and some properties weren't suitable.

For the vast majority it was quick, easy and cheap. No major construction required either for most.

<comment><USER28> When CFL bulbs were new (and pricey) there were a number of programs to sell those at discounted prices to consumers through the power companies. I've never heard of anything comparable wrt insulation although that doesn't mean there hasn't been such.

I've actually done a lot with my house when I've been having construction done anyway but there's no easy way to retrofit insulation into the existing walls. (Plaster lath etc.)

</comment></comment></comment></comment></comment><comment><USER29> When this thing started out, I remember reading Fadell saying that he would go around and have coffee with his colleagues in the valley, and tell them he was working on a thermostat. And as the story went, they were all incredulous that it could be a good idea. Maybe they were right after all.

</comment><comment><USER30> If, in an article of a former IoT enthusiast who now starts to understand the other side, most of the quotes and sub-headings sound like trivial common- sense, maybe that sheds some light on how solid the assumptions behind today's IoT actually are...

</comment><comment><USER31> "Nest" isn't a bust. "Post-Google" Nest is a bust. And the bigger issue is much, much bigger.

Google didn't acquire Nest to out of an altruistic desire to assist Nest to grow faster to fulfill their mission. Nest was acquired because Google was lazy and saw an opportunity to grow _Google 's_ revenue and data-base while at the same time getting a foothold in the nascent but exponentially growing IoT sector, instead of having to build something themselves and compete with Nest.

When I hear about the piles of cash that companies like Google and Apple are sitting on I often shudder to think of all the other "Nest" like companies out there that will be snatched up in the middle of a growth spurt like an organism infected with a virus that injects its own DNA in order to hijack the host organism's biological mechanisms in order to fulfill its own goal of self replication, often killing its host in the process.

Nest was born from Apple culture. The founders left Apple after having worked on the iPod and set out to build another beautiful product. They wanted to _build_ something. And the culture that informed them to make this decision, to take this path, was essential in the manner in which it played out. Acquisitions such as this, that aren't merely hands-off capital injections, by definition change the culture, goals, and products of the company acquired.

So, companies, like Google and Apple, that have massive, _massive_ stock-piles of cash have the luxury to, as a side-effect, at will, change the culture, goals, and products of just about any nascent company, and they most often do so for the purposes of furthering their bottom line, expanding their user base, and growing their data-base.

Everyone else (read: everyone that is not one of these handful of companies like Google and Apple) pays the price by losing out on all the beautiful things companies like Nest could have born into the world.

Because it's not just about products. Products are, in addition to being attempts to solve engineering problems, a piece of our culture, of our social technologies, of our shared experiences. Nest wasn't trying to "solve" thermostats. They wanted to improve the experience of being in your home, for many of us our most sacred or private space.

You can't "solve" everything, because not everything is a "problem".

People buy vases and then put them in the middle of a room with nothing to fill them, because they like the way it makes the space feel. There was no "vase" problem. And there is no "awkward silence between friends in a car ride" problem. That awkward silence is a miracle of a good relationship, when two people know, without saying anything, that something is being left unsaid, and that one of them has the chance to be brave and kind enough to, for the benefit of their friendship, make the unspoken spoken. But Spotify would like to suggest you play their "awkward silence" play-list.

Independent companies creating products they themselves want, and that they are not trying to push onto others, but that they'd love to share with the world, need to resist the urge to take that capital infusion or accept a buyout so they can have access to the network and infrastructure of some grand suitor. It's a deal with the devil almost every time.</comment>


Laser head mount display (Apple Inc. Patent) - <AUTHOR> http://www.macrumors.com/2008/04/17/apple-researching-laser-based-head-mounted-display/ If memory serves me right there was a article posted the other day about a company with a similar product only the box that was a the laser source was much larger than "belt wearable" <comment><AUTHOR> If memory serves me right there was a article posted the other day about a company with a similar product only the box that was a the laser source was much larger than "belt wearable" and the head gear was a HUD type monocle.

Does Apple actually have the tech to make this now or did some employee read about the other companies product and rush to patent a similar idea?</comment>


Why The UK Startup Scene Is Doomed - <AUTHOR> http://zachinglis.com/2011/why-the-uk-startup-scene-is-doomed/

<comment><USER4> Just to put a bit of nuance in this article. I am French living in Germany, I created 2 UK limited companies without putting a single foot in UK. I am banking with Barclays Wealth (the side of the business dealing with foreigners and very rich people) and have everything with them. They are simply excellent, you never ever touch a call center in India, always UK people in UK. No more than 30 seconds to wait on the phone for an inquiry and extremely polite.

And yes, this includes merchant account, accepting payment by card, Internet banking with a real security (smartcard), etc.

The thing is: you need to be extremely professional in the way you present your business to them. Follow their procedures, be polite on the phone, explain clearly your case. They are a business like you, when you have a good customer in front of you, not by money but simply because polite, patient etc. you always end up walking happily the last mile for her. Be the the nice customer and profit.

Edit: By the way, I got everything without a single deposit, only references from my personal banker and my company secretary banker.

<comment><USER5> So, how did you find out that the person talking to you was in UK, "Mr french staying in Germany"

<comment><USER6> They probably told him that their call centers are in the UK - it's seen as something customers generally much prefer.

e.g. For RBS

"At The Royal Bank of Scotland, all our call centres are based in the UK."

[http://www.rbs.co.uk/private/current- accounts/g2/switching.a...](http://www.rbs.co.uk/private/current- accounts/g2/switching.ashx)

</comment></comment></comment><comment><USER7> With all due respect and without being snarky, your steps are wrong. Try these ones:

1\. Register a business (Ltd, LLC, etc)

2\. Open a Business Bank Account

3\. Implement Paypal to get yourself up and running,

4\. Prove that there's a market for your product, people will pay for it, people will continue to pay for it, you don't have lots of chargebacks, you're capable of managing sensible customer relations, and generally are as small a risk as possible for any merchant account. As a bonus, this also validates your business plan before you invest too much time in irrelevant admin.

5\. Go and talk to your bank. And every other bank out there. Shop around, shop around, shop around.

(As an aside, read David Mytton's blog: [http://blog.boxedice.com/2009/05/20/taking-payments- online-m...](http://blog.boxedice.com/2009/05/20/taking-payments-online- merchant-account-payment-processor-fees/) )

6\. Profit!

EDIT: fixed formatting

<comment><USER8> I've used Paypal before and they've been nothing but hassle. Getting your money down from Paypal is often the hard part. The random freezes, and goodness knows what else.

<comment><USER7> I'm not advocating using them long term, I'm advocating using them to get yourself off the ground. There's no setup cost, and integration is fairly trivial.

It almost doesn't matter whether you can get your money down from Paypal. It matters whether you can persuade people to hand over their credit card. Not much point worrying about anything else until you can prove that, and paypal is a very cheap & easy way to manage that.

<comment><USER8> The reason we did not go for Paypal first was handling the transition from Paypal subscriptions to a different payment gateway would be a pain. We didn't want two sets of funds. Knowing possibly we would probably not get our hands on the Paypal funds for a good 5 months.

<comment><USER9> Using an "abstraction layer" like Recurly or Spreedly would solve this problem for you (although you would have to convince PayPal to accept payments without CVV numbers, which is an extra couple of hoops)

</comment></comment></comment></comment></comment><comment><USER10> Ignoring the completely unnecessary headline, I still think that this highlights the naivety prevalent among geeks in business.

Despite how your bank may appears in their own adverts (and this applies to all banks in the UK, as far as I can tell), they're still not run as service providers. They're not friendly by default, nor do they take a neutral point of view on you as a customer. Your relationship with your bank is just that, a relationship. You need to build it and work on it, on at least a monthly basis. You need to know your bank manager by name, the football team he supports, and the names of his children (side note: if your bank says they don't have bank managers, bullshit. Ask to speak to someone in their local business team. They still exist, under a different name).

You need to take him out for dinner, send him a card at Christmas, and above all make him believe in you as a business person and entrepreneur. I'm lucky to have a very trusting relationship, and mutual respect for the head of the business team at my local branch, and he's opened countless doors for me, expedited paperwork, and, yes, setup merchant accounts for me.

If you want to make money, you're not only a programmer, you're a business person. And successful business people network.

<comment><USER8> To be honest, I do network. I have access to plenty of business contacts in and outside of my family. (Thus the reason I asked my father to help. As his businesses are run through Lloyds.)

However, Cardnet is a separate entity to Lloyds technically and that's how they saw it.

I've recently come back to the UK from living abroad so I have been rebuilding contacts.

But you are correct; networking is incredibly important.

<comment><USER11> Is it possible the fact you were living abroad meant that you were a higher risk for the bank ?

I've heard plenty of people bitch about the pain to get a merchant account set up but it seems that the 50k thing is unusual.

</comment></comment></comment><comment><USER12> Ignoring the fact that setting up a merchant account is not a good way to get a startup going...

We have just had an identical problem with Lloyds:

\- It took ages to get the application sorted in the first place

\- They demanded changes to the TOS

\- Then we got "questions" about the business (selling our software online), which showed they had clearly not read one part of the description & business plan (the one they asked we write..)

\- Then the underwriter apparently decided that they couldn't risk it as they "had a policy of not underwriting software retailers" :S So back to square one on the progress...

\- Looking for a new underwriter took a month, and only happened because we spent a morning calling them constantly to ask if our business manager was out of his meeting yet or not...

\- Then everything went silent for a week. So we phone Barclays, had the forms and everything arranged within 3 more weeks and away we went.

The day after we went live the merchant agreement from Lloyds arrived by mail...

 _head_ _desk_

</comment><comment><USER13> Irish startup. Paypal don't even offer payments pro here even though their euro hq is in North Dublin.

For my MVP I did the following: I was reading HN, similar thread to this and one of the Stripe boys was giving his tuppence ha'penny - having read his contribution I emailed him for a beta invite (I have a US SSN and bank account). I was able to get payments running with active merchant in a very short time despite the fact I'm very inexperienced. No dealing with the disaster zone that is the Irish banking system, no paypal worries. For someone hacking together an MVP (me) it was a massive hurdle overcome with relative ease. Sadly I think Stripe require the ssn (it is/was possible to open a us bank account without), perhaps one of their reps could confirm this?

Agree with the UK poster it isn't easy doing startup stuff in this part of the old world, it certainly pays to have one foot in the States if you can manage it.

</comment><comment><USER14> _Register a business (Ltd, LLC, etc), Open a Business Bank Account, Open a Business Merchant Account, Sign Up For A Payment Gateway..._

Why do you need any of that to get started? You can trade as a sole trader, and use PayPal to take payments in the interim. Not ideal... but it does the job.

For merchant accounts, there are plenty of third parties that will do the job as well. Again, it's not ideal... but at least you get started.

* You just simply don't see the level of entrepreneurs in the UK as you do the US in my experience and I feel that is not helped with the bureaucracies.*

 _And with only a £3100 ($5000) deposit._

I highlight these quotes to illustrate the fact that there's still a problem: what if you don't have a $5,000 deposit? At that point, whether it's $50,000 or $5,000, it doesn't matter: you still have to use some ingenuity to succeed. The same ingenuity to doing things in a less than ideal manner at first - <USER2> that can be "fixed" soon enough if you start to succeed.

<comment><USER15> Another point is you don't need a business bank account to be a sole trader. The business bank account has fees attached to it, which is why a bank wants you to use it rather than the free alternative.

This makes it ideal if you want to 'bootstrap' some ideas to see if they are worthy of pursuing - without the pressure of investors, business plans etc. You don't even have to register with the tax people until a few months into a business.

</comment></comment><comment><USER11> What a good approach to take is simply to approach other businesses with models similar to yours and ask them who they use and get an introduction to their contact at the merchant account provider. If you're working with someone at the provider who's already familiar with your business type then things will move much faster.

If the person you're dealing with has never worked with a company that's does SaaS subscriptions before then naturally you're going to have more problems.

Chargify even lists specific contacts at BarclayCard and HSBC for people looking to setup merchant accounts that work with them, and because Chargify direct all of their users to specific contacts it means these individuals are extremely clued up about the SaaS business model and the process will be a lot less painful.

</comment><comment><USER16> UK startup here. We signed up a Barclays business account in about ~2 weeks and they were happy with a £100 deposit just so there was something in the account. Relatively straightforward. Paypal set up and seems to be working OK. Not sure why it all went wrong for you.

<comment><USER17> Having lived in the UK a few times and having to go through the process of bank accounts and stuff, and a lot of friends who did the same, the problem usually isn't the bank.

Its usually the case manager you get. My first account was with HSBC, I waltzed in filled the forms out. Walked out. My friend I travelled with came with me, got a different case manager ... took over 4 weeks and eventually moved to Ireland before his account was even opened.

The differing service you can get from one bank is amazing. Just take this example from a trip I took a few months ago.

I went to Thailand with 3 mates from the UK, all Llyods customers. One had a friend as his bank manager who OK'ed his for use in Thailand. He had no trouble at all.

Second guy OK'd his but he withdrew 20,000 baht in one transaction and his account was locked as he wasn't told there was a threshold. He had to ring help desk to unlock his account, it was fine after that.

Third guy didn't realise he had to OK the account, every time he used an ATM his account was locked. He would ring help desk every few days to unlock his account. It seemed he could only draw down 10,000 baht a week, if he tried a second transaction a few days later it would lock again.

No matter what he asked for they just unlocked his account and promised it would lock again. But we where there for a month, and he was always on the phone to the bank.

</comment></comment><comment><USER18> That's kind of a big claim based on your problems with "the process for receiving payments on a website". Although I don't disagree that the UK startup scene is fragmented and less of a force than it should be, I don't think the fault lies with not being able to accept a payment on your website.

Although I'll take your title as british humor and say the word "doomed" in a dark echoey room.

There are people working to build a startup culture over here (i.e. <http://www.startupbritain.org/>) and I think the solution lies a little bit before your step 1. So here are my 7 steps to prepend to your 7 steps:

        1. If you've successfully gone through building a startup, reach out to other startups in the UK and offer advice. Don't wait for Seedcamp to ask you to mentor, make yourself known and help out. Hell, no one's tweeting with #UKStUp so introduce yourself
        2. If you're trying to launch a startup in the UK, tell other startups that's what you're doing, so they can follow, and you them. Hell, no one's tweeting with #UKStUp so introduce yourself
        3. Be vocal about your failures.
        4. Be vocal about your successes.
        5. Organise or attend meetups in your area.
        6. Meet up with UK people at conf abroad.
        6.5. ...and probably some other stuff...
        7. Profit!

<comment><USER8> I whole heartedly agree. :) I do some of this as is but I need to get better at it.

<comment><USER18> great! If you know of any regular meetups, I'd be interested to hear.

<comment><USER11> Where are you ?

You can barely throw a stone in London without hitting a startup meetup, there are roughly 40-50 meetups/month these days.

<comment><USER18> Actually I'm based near Birmingham, but I'm only an hour from London. Where do you find out about these meetups?

edit: just saw you profile [http://blog.awesomezombie.com/2010/06/london- startup-event-g...](http://blog.awesomezombie.com/2010/06/london-startup- event-guide.html)

<comment><USER11> That's a bit dated now, the scene's moved on a lot in the last year. The best way to learn about events tends to be by following startup people on twitter.

But if you're not a twitter user there are a couple of people who do weekly emails about startup events in London:

Startup Digest London: <http://startupdigest.com/london-startup/>

London Silicon Roundabout (a meetup in it's own right but they also send out a weekly newsletter): <http://www.meetup.com/london-silicon-roundabout>

If you search meetup.com there's also a bunch of other startup events listed on there, including the monthly HN meetup.

</comment></comment></comment></comment></comment></comment><comment><USER19> I've had nothing but positive experiences from Barclays and HSBC (can't remember who handles card payments for my current company, but if not one of the above two then a third can be added to that list).

</comment><comment><USER20> It's true that UK banking system is totally wrong (which is interesting, considering that they invented modern banking). There are multiple regulations that make bankers life hard, most prominent being the anti-money-laundering regulation. Generally a completely useless regulation that doesn't protect the financial system in any way (but that's a different story). This system can be hacked though. Normally it will take a foreigner a couple weeks (if not months) to set up a business bank account. But if you will set up a personal account with that bank first, and follow up with setting up the business account later - no problems and instant service. Lesson learned - you need to know your way around, and there's plenty of people that will help you (other startups). You have to consider that London is the financial capital of the world (or used to be), hence the number of fraud and cheating is enormous. They need some ways to structure it, otherwise it would all collapse. Also, if opening a bank account is something that can kill the startup, please - <USER3> will you do when US competitors actually take notice of you?

</comment><comment><USER21> While the OP's frustration is understandable, I would say that this is simple example on why the UK startup scene is non-optimal. Allow me indulge in some over-generalization. (And for the record, I /have/ started a tech business in both the UK and USA.)

* A culture of over regulation. It's not just the UK govt that does this - you'll find most large businesses like the bank mentioned putting up roadblocks. * Concentration of talent in financial services. Investment banks pay alot of money for top talent. Heck, when I first moved there I was working for an investment bank and enjoy the cash and perks - I should have been doing my own startup but money in hand now is hard to turn down. * Expensive everything. I would say that you need at least 2X more cash to start a company in the UK than compared to 2nd-tier-startup-markets like Atlanta, where I currently live. Sure, you can economize in creative ways, but that takes you away from your core mission in a startup: to build awesome products/services.

</comment><comment><USER22> Wow, we had EXACTLY the same experience.

A lengthy process (about 3 months) to get signed up with Sage Pay only to be declined the merchant account (yet to give us a reason although they said they would tell us, that was 2 months ago).

We ended up settling on PayPal just to get started, not ideal for taking recurring payments, but quick, easy and better than nothing.

<comment><USER14> _A lengthy process (about 3 months) to get signed up with Sage Pay only to be declined the merchant account_

Did you give any other options a try, e.g. <http://www.paypoint.net/> ? Genuine curiosity :)

<comment><USER22> No, paypoint looks very good though.

</comment></comment></comment><comment><USER23> _I already had a business account with Lloyds so next I needed to apply for a Merchant Account [...] After jumping through some hoops they came to me with an offer that I could use their service if I give a deposit. [...] they asked me to put a deposit of £50,000 ($81,000.)_

I nearly choked right there; 50.000 pounds? What the hell? This is not right by any definition. No wonder the US steams ahead in the startup game.

What would really drive this post home though, would be the second half the author fast-forwards through. Understanding the technicalities and nitty- gritty details of setting up a startup as a European would be very interesting. Especially tax handling. Perhaps a Part II!

<comment><USER14> The UK is easy, honestly. If you want to form a LTD company, pay someone twenty pounds and it'll be ready within a few hours. Have a 20 minute meeting for you business account (I admit this might have changed - it was about five years ago and with Barclays), get everything set up within the following couple of weeks.

In the meantime, trade as a sole trader. Register with the taxman, phone up their _very_ helpful advice line for what numbers to fill in where. Job done.

Now Poland, on the other hand...

<comment><USER24> I didn't even have a meeting for my business account, everything was handled over the phone/online with 1 set of paperwork having to be sent out to me and back. The only thing they wanted to know was how much I expected to deposit a year and they insisted the first deposit be from a UK source (supposedly some anti-terror funds requirement).

</comment></comment></comment><comment><USER25> This is an amazing article. The level of dysfunction and inappropriate external control demanded in setting up payment processing was far beyond what I would have imagined was possible setting up a business outside North Korea.

</comment><comment><USER26> Did you ever consider going with WorldPay instead? That's what I did after seeing the ridiculous measures you need to go through to get a merchant account.

<comment><USER8> It was a possibility but I have not heard of enough people using it to have been sure if it was wrong or right for us. :)

<comment><USER27> Worldpay is used quite extensively. Frankly I think the interface is a little clunky compared with others but it works. Also SagePay do the merchant account side for you also these days and I know a few people who have received one with NO trading history. Frankly I believe the UK market is quite positive toward startups and I think its down to the individual to look at what the options are and do something for themselves instead of (just being honest) whining about the problems they've had

<comment><USER8> Honestly, I was going to go the SagePay route. However, they wanted the Lloyds Cardnet stuff in place first.

I'm whining about my problems because I know countless others have had the same issue. I want to incite discussion on what problems people should expect to face and how they can go about it. So others can learn.

<comment><USER27> When was this? SagePay USED to only work with people who had existing merchant accounts, but no longer. We have just had one of ours accepted for a new ltd company with no trading history. Provoking discussion is great and most things can be improved, however I think the term "doomed" is a little bit over the top. That being said, if you want any advice, get in touch and I'll give you some pointers

<comment><USER8> Oh. Doomed was taken out of context. I meant it in a light-hearted way. :)

However, I think we had the issue that Lloyds Cardnet wouldn't play nice with SagePay as it didn't do 3D-Secure. I could be wrong though.

And thank you for your offer. :)

</comment></comment></comment></comment></comment></comment><comment><USER28> I have been using <http://www.swreg.org/> (now part of Digital River) to handle all the billing and credit card payments for my downloadable software for about 10 years. I honestly wonder what the conditions are under which it doesn't make sense to outsource all this trouble to one of the many service providers.

</comment><comment><USER29> The steps should be:

1\. Find a helpful, competent accountant who deals with small businesses (because that's what you'll have at first - a small business) 2\. Tell the accountant the nature of your business 3\. Follow the accountant's advice.

I'm almost certain the accountant would have given you advice on a simpler path to getting a business bank account.

<comment><USER30> He could get a business bank account, it's a merchant account which is notoriously difficult to get without a long trading history in the UK

</comment></comment><comment><USER31> I think the title is wrong, but I would agree with the problems with Banks over here. They really REALLY need to get broken up and sorted out. It also doesn't help all the ridiculous red-tape that New Labour put in force at the behest of the US and anti-terrorism etc, none of which occurs in the US ironically enough. I know I lived in both countries.

</comment><comment><USER32> It's well known to any UK resident that the bank system here is broken, made for and run by the large corporate companies. They are not used to dealing with startups, and I have a feeling that they don't want to either..

</comment><comment><USER33> I always hear a strange sound when I read "doooooomed".

</comment><comment><USER34> No mention of Bitcoin? :)

</comment><comment><USER35> I do get his frustration with Barclays. They sent my wife a basket of flowers and a bottle of wine with a "sorry for your loss" card and closed my personal account.

Apparently something had broken somewhere leading to them assuming that I was deceased?!? I never did get a proper explanation.

That took a whole two weeks to get sorted out.

<comment><USER36> What happened to the money in the account they closed when you died?

<comment><USER35> It was transferred to an "internal account" which they keep for assets awaiting solicitors to approach them with respect to wills and inheritance. They stuck it all back in a new account without too much hassle after a couple of (very awkward and strange) phone calls and a visit to the branch to make sure I was indeed still alive and breathing.</comment></comment></comment>


Place as Filter - <AUTHOR> http://messageparty.tumblr.com/post/4238805089/place-as-filter

<comment><USER2> I like feeling smart about the places I know about, and I think it actually could be really interesting to put the tips/insights/thoughts inspired by/etc type of information you have about a place at the front of a service. Excited for this to come to SF!

</comment><comment><USER3> I can't wait for this to come to Boston. Eventually I'll probably use this to find good meals and secret items off the menu at restaurants.</comment>


Freedom Hosting sites compromised, founder arrested - <AUTHOR> http://www.twitlonger.com/show/n_1rlo0uu <comment><USER2> This whole post is a mess. Someone distributes an exploit via a popular hosting provider for onion sites (and it's curious why anyone with a serious interest in privacy would outsource onion site hosting anyway) and suddenly Tor is damaged? There's a link to a paper that claims people can do things you're not supposed to be able to do with onion sites, but I don't see how that's relevant -- this post is conflating at least a few things.

So here's what I can grok from it:

* "Freedom Hosting" founder has been arrested; presumably, many people were using "Freedom Hosting" to host onion sites (is this where "half of all Tor sites compromised" comes from?). No charges listed, article slightly hints at child pornography charges.

* Someone, presumably the FBI, has set up an exploit to be distributed through Freedom Hosting sites that will phone home and reveal your non-Tor IP address (solution: seven proxies). "Freedom Hosting" founder was probably coerced into allowing distribution of this exploit.

* Author claims that said exploit only affects Firefox >= 17 on Windows.

* There's a link to a paper about possible problems with hidden services, which is apparently not relevant to any of this other than the fact that there was just a shakedown on a big onion site provider.

I'm flagging this article because it is utterly incoherent and the headline is sensationalist. There is no evidence of a fundamental flaw in Tor being related to any of the events mentioned. Hopefully someone will write a comprehensible piece soon and put it out there.

<comment><USER3> How is it sensationalist? The headline was not that there is a vulnerability in TOR, but a vulnerability in "half of all TOR sites."

<comment><USER2> The headline implies that the "compromise" is an inherent failure in the protocol (or else how could "half" of all sites be infected?) instead of the reality that the hosting provider intentionally placed an exploit in all of their pages.

A better title may be like: "major .onion hosting service infiltrated by feds, all sites converted to honeypots; founder arrested". This does not imply any fundamental flaws in Tor itself or the technology in use, it does not falsely attribute a specific portion of .onion sites as infected, it does not communicate uncertainty into which sites are damaged (only sites hosted by Freedom Hosting were affected afawk), and it correctly reflects the events.

<comment><USER4> You're being bizarrely pedantic.

If the headline had read "half of all web sites compromised" I would never have it thought it was because of some underlying fault with HTTP.

<comment><USER2> Onion sites are (typically) accessed over HTTP, so the fact that I didn't think HTTP was flawed demonstrates that there's some misinterpretation here.

I'd suggest that _you 're_ the one being overly pedantic. "Protocol" doesn't necessarily have to refer to something explicitly labeled as a "protocol".

</comment></comment></comment></comment></comment><comment><USER5> They make note that the vulnerability used is only in Firefox 17--the current ESR (extended support release). What they do not mention is that the Tor Browser Bundle[1]--created so users can simply download one executable and feel protected by Tor--is based on this very release.

Among all internet users, Firefox 17 is probably rare, but among Tor users? My bet is that it owns a significantly higher chunk of the market.

[1] Tor Browser Bundle: [https://www.torproject.org/projects/torbrowser.html.en](https://www.torproject.org/projects/torbrowser.html.en)

<comment><USER2> The quote in the article claims that the exploit affects 17 _and higher_ , only on NT-based platforms.

Furthermore, Tor Browser Bundle disallows JavaScript by default, and one should be cautious while allowing execution of arbitrary client-side code whilst intent on keeping their direct IP address secret. You have to take at least a couple of steps to be affected by this bug.

EDIT: The author has updated the OP and now claims that he believes Firefox 17 is the _only_ affected version. His language is ambiguous such that it is unclear whether the exploit only affects Windows or if the code distributed by FH is simply not attempting to exploit any non-Windows environments (perhaps they were trying to get specific players).

<comment><USER6> TBB does not disallow javascript by default. In fact they recommend you do not disable javascript because it makes your browser fingerprint more traceable.

<comment><USER2> Checking on this now. I find it dubious, but possible. I haven't used the Tor Browser Bundle for quite a while, but last I recall they definitely had a mechanism to keep JavaScript from executing. It seems ridiculous that they wouldn't, given their long history of advocacy for NoScript et al. Will edit when done installing/checking.

EDIT: So it seems that NoScript _is_ installed as part of the package, but that scripts are enabled globally by default. I just experienced this with a fresh install. Here's the answer confirming it: [https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...](https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled) .

Personally I think that's a horrible compromise, and it's obviously something that's changed since last time I used it. This should be undone ASAP. Some education is required to use Tor properly even without considering things like JavaScript, so teaching someone to enable JS only when prudent should be fine to include as part of that educational package. It seems like there is some nefarious force at work here trying to trick people who really shouldn't be using Tor into using Tor. I know, for instance, that I had to stop several of my friends from using Tor after they heard about it from the news or whatever after the PRISM leaks. _Do NOT_ use Tor if you don't fully understand the implications, like that all data you send through it is going to be decrypted to plaintext at a random exit node that could be run by literally anyone with a modern computer and internet connection.

Fortunately, NoScript continues to warn pretty blatantly with a big red exclamation point that scripts should not be allowed globally, and an educated Tor user will automatically forbid all scripts despite the awful default, so this is probably only a problem for people who are just dinking around anyway.

<comment><USER6> [EDIT: edited typo, clarified what TAILS was] I had mentioned (split between a couple other posts) that even with JS enabled, Noscript will prevent many XSS/CSRF and clickjacking attempts, which has been explained to me as the reason for its inclusion. And That disabling Javascript actually makes you more fingerprintable because it's rare for browsers to do this.

I am guessing that the payload that article mentions s/he does not have included a Windows (or Windows Firefox)-specific exploit which bypassed the tor tunnel so that they could then match the cookie in and out of Tor to identify the traffic origin. Otherwise, just having the cookie through Tor would be pretty worthless.

Other people that could be dinged by this would be anybody usuing that specific version of Firefox, without Torbutton. Torbutton wipes cookies when you switch between Tor and not-Tor, but Torbutton as a separate tool has been discontinued and TBB promoted, because to be safe you really need to have a separate browser profile.

On Linux (not targeted by this exploit, but maybe someday) you could avoid this using an Apparmor/SeLinux profile that prevented TBB Firefox from even making a network connection that's not to the Tor tunnel, or possibly even prevent Firefox from knowing it's own IP. Dunno if something like this is even possible on Windows. For traveling, I currently have been experimenting with a VM with TBB and an apparmor profile, and an iptables rule to prevent ANY outside traffic, except Tor. It works but it's a pain in the ass and nobody could be expected to install all that shit. That's what they made TAILS (A bootable disc image with only Tor, saves nothing to your machine, contains no known exploitable extraneous apps) for, people could check that out. Even running TAILS in a VM would have prevented this, though they recommend for maximum security you burn it and boot it.

No sympathy for child pornographers, but obv. this could be used against anybody seeking anonymity.

<comment><USER7> >prevented TBB Firefox from even making a network connection that's not to the Tor tunnel, or possibly even prevent Firefox from knowing it's own IP. Dunno if something like this is even possible on Windows.

I don't currently use Tor, but I've thought about it and this is how I would do it. This can be done on windows using a virtual machine that disallows internet connections. Have the VM only able to network with the host OS, which is running the Tor app. That way the VM doesn't have an internet IP to leak, and if firefox itself is compromised there isn't anything on the VM that could give you away.

<comment><USER8> Whonix already does this.

<comment><USER7> Looks sweet. I'll check it out.

<comment><USER8> Be careful, I don't think it has received a great deal of peer review and the community doesn't seem to be large.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Europeans point of view: Am I the only one who feels that the US is taking over the Internet and all of our privacy with it?

<comment><USER10> It's not just that they're stealing everyone's privacy. They're acting like "it's foreigners, so we don't have to care" \- even the latests attempts to rein in NSA make no effort to cut back its international misbehavior.

Basically, I think most civilized people have been operating on the premise that democratic western states are behaving in a vaguely civilized way towards people in other such states. But it's clear that America at least is behaving like the purest sociopath, where "friends" just means "easier to manipulate". They are breaking the unspoken international social contract, and it is going to have worse repercussions than they yet understand.

<comment><USER11> > America

The American government, you mean.

<comment><USER12> For us foreigners, knowing that America has strong democratic roots, it is obvious (and worrying) that the majority of american citizens actually agree with that.

<comment><USER13> Well, can't blame the electorate this time: Obama is doing the opposite of what he always promised and got elected for.

<comment><USER14> That argument would be very convincing if Obama weren't elected twice. Fool me once, shame on you, fool me twice...

<comment><USER15> You make it sound like there was a viable alternative, like the other party in the two-party system wasn't being held to ransom by ultra-nationalists.

<comment><USER14> That's because it is exactly the situation. Nobody is "held ransom" by anybody. But voters that think like you - low-information voters that can vote for anybody provided that he is "our guy" because "their guy" is The Devil himself - are exactly the reason why it happens again and again. And will happen until the majority abandons such mentality - which I personally wouldn't expect happening any time soon.

<comment><USER15> Voters that think like me live in a multipolar democracy that currently has a minority government in power. It's a tacit weakness of the US system that there can only be two _viable_ parties. "If everyone changed and voted for a third person" is _not_ a retort, because it still requires everyone jumping on the same bandwagon to effect a win; it'll just be a different brand of wagon.

<comment><USER16> It's a two party system, but the two parties don't have to be the same ones that are their now.

I don't understand the "viable alternative" arguement. You are saying "I won't vote for who I really want to vote, because they'll never win, because everyone else won't vote for them" <\--- Is that what you mean? That seems self defeating.

...

<comment><USER15> If you had rapid iteration - elections every month - then a tertiary party would have something of a chance. As it stands, the iterations are so slow, that with FPTP voting, the two main parties will just move slightly to diminish the threat - the incumbent edifice carries on.

With preferential voting (or similar), you actually have the realistic probability of more than one party being in power. Here in Australia, the current government is formed from one major party, one minor party, and a couple of independents. It's not just 'mathematically possible', but a plausible outcome. That can't really happen with FPTP voting. Well, it can happen, but it's an oddity - see the current situation in the UK with the lib dems.

 _" I won't vote for who I really want to vote, because they'll never win, because everyone else won't vote for them"_

The problem here is that by voting for someone whom you slightly prefer, you split the vote in a FPTP system, making them both lose out to the third person you didn't want in. If 60% of the population want a left-wing candidate, and they're split evenly-ish, they'll still lose out to the single right-wing candidate who only has 40%. It sounds self-defeating on paper, but in real terms it's more like self-preservation.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> We should be clear that this isn't a vulnerability in the Tor software or network, but an (apparent) vulnerability in this unrelated "Freedom Hosting" company's site:

[https://blog.torproject.org/blog/hidden-services-current- eve...](https://blog.torproject.org/blog/hidden-services-current-events-and- freedom-hosting)

<comment><USER18> And possibly in Firefox (!), with some sort of JavaScript exploit. This is the most worrying part for me--does anyone have any info on what the payload does?

<comment><USER19> Doesn't have to do much. Once you execute pretty much any (non-sandboxed) code on a machine, you can bypass something like TOR easily. From this point, any network packet sent by the payload to the feds effectively de-anonymizes the user completely. Also, by including a tracking cookie in the JS, they can cross reference all user activity on the compromised websites with the newly discovered IP address.

<comment><USER20> > _Once you execute pretty much any (non-sandboxed) code on a machine, you can > bypass something like TOR easily. From this point, any network packet sent > by the payload to the feds effectively de-anonymizes the user completely._

One partial solution would be to run the Tor client on a physically separate machine which acts as a transparent proxy for your browsing/internet box, and blocks any direct contact with the public internet via iptables trickery. I dunno what the processing overhead of running tor client is, but in theory you might be able to do so on a router running openWRT or similar.

<comment><USER19> I actually use a setup that involves a bunch of VMs for pretty good separation. It's a bit of a complicated setup, so I won't elaborate here. The main thing about it, is that even if an attacker runs with root privs on the "anonymous" VM, they'll need a 0-day in the Virtualization engine itself to de-anonymize the machine. I make sure that the VMs are as isolated from the host machine as they can be, so the attack surface is indeed minimized to the VM engine itself. Some "VM busting" attacks did occur in the past, but I believe very few (if any) attacked the VM engine itself. Most used the wider attack surface provided by stuff like the "VMWare tools" API (which for "isolated" VMs should be disabled). Edit: come to think of it, I should probably write up my method and post it to HN at some point...

</comment></comment></comment></comment></comment><comment><USER21> Am I the only one who is f*cking tired of FBI and other violence based organizations using pedophilia as their excuse to raid and bust people ?

Think of the children! Yes .. a good front to make it so that they can just bust anything using SWAT forces.

Is pedophilia such a big problem? Really ? I would like to see one study about pedophilia and the problems it creates, instead of what the problems that NSA and FBI are facing when people start encrypting their traffic and we actually have some freedom of speech in some areas.

<comment><USER22> ...perhaps you could argue that there's nothing wrong with pedophilia _per se_ , but there is definitely something wrong with child abuse, and I shouldn't need to link you to a study to convince you of that.

By shutting down child pornography rings, police are preventing further abuse. How else would you propose they go about it?

<comment><USER23> _By shutting down child pornography rings, police are preventing further abuse._

Maybe, maybe not. Probably in some or even many cases, but certainly not all.

But, it also provides an unquestionable excuse to not care about "accidental" overreach or collateral damage. Someone's hosting something they don't like on a shared server? Guess what happens when they "discover" kiddie porn hosted by someone else on that same server?

</comment></comment></comment><comment><USER24> Previous discussion of arrest: [https://news.ycombinator.com/item?id=6154493](https://news.ycombinator.com/item?id=6154493)

Previous discussion of malicious Javascript: [https://news.ycombinator.com/item?id=6154246](https://news.ycombinator.com/item?id=6154246)

</comment><comment><USER25> > The JavaScript zero-day exploit that creates a unique cookie and sends a > request to a random server that basically fingerprints your browser in some > way, which is probably then correlated somewhere else since the cookie > doesn't get deleted. Presumably it reports the victim's IP back to the FBI.

"in some way", "probably", "presumably" = I have no idea what's going on.

<comment><USER26> It's more that we know very well that up to the transmission point, it creates a unique identifier. If we're following the most likely guess (that this is targeting distribution of Child Pornography), then it seems like a reasonable goal to simply identify and fingerprint Tor users.

That being said, there is always a point that this could be used for something else entirely, though. Compromising Tor mail is a lot less of a targeted attack.

</comment></comment><comment><USER27> A preliminar analysis of the 0day used:

[http://pastebin.mozilla.org/2777139](http://pastebin.mozilla.org/2777139)

 _edit_ : Maybe is a good idea to submit this link (or another related) to discuss about it in a new HN thread.

<comment><USER28> It's not really 0-day: since it only affects Firefox 17, it was apparently fixed long ago. But see this comment regarding why it may be of interest to lots of TOR users:

[https://news.ycombinator.com/item?id=6156779](https://news.ycombinator.com/item?id=6156779)

<comment><USER24> Firefox 17 is their most recent ESR release for enterprises that want a more stable platform, and at least in theory it's still receiving security updates.

</comment></comment></comment><comment><USER29> Here is real reason why little sisters force everything into browser. Because they care about security >:-)

People should stop using web/browsers for everything.

<comment><USER11> The idea of having JS enabled is directly at odds with a secure system, too. All TOR sites should have non-JS friendly interaction. There's really negligible benefit compared to exploits like the on in TFA.

<comment><USER30> I remember a bit over ten years ago, "javascript is annoying" was a mainstream position among hacker types. That seems to be long gone by now.

I guess hardware catching up with resource requirements took away one of the biggest reasons against it. And most people really embraced the web as more than a document platform. I think part of me still misses the old way of thinking about it.

<comment><USER11> I don't have any base issue with javascript; I think it's a wonderful way to build web applications. However, TOR and the dark net has entirely different considerations, and the cost of letting unvetted code run without asking you from a site you know nothing about is far, far greater. I wouldn't be surprised if just being on TOR would be convincing evidence for an unknowledgable jury, even if the site was about something legal but connotative (activism targeting the federal government, for example).

<comment><USER30> I see the first two sentences of your reply as inextricably linked and contradictory. You don't think it's the culture of it being acceptable to make sites that won't work without JS that is ultimately forcing the Tor folks to enable it? For instance, reading up on this subject I found this:

> Why is NoScript configured to allow JavaScript by default in the Tor Browser > Bundle? Isn't that unsafe?

> We configure NoScript to allow JavaScript by default in the Tor Browser > Bundle because many websites will not work with JavaScript disabled. Most > users would give up on Tor entirely if a website they want to use requires > JavaScript, ...

[https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...](https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled)

<comment><USER11> I see the purposes of the internet serving content-rich web apps and the purposes of TOR as different. They may have compatible protocols, but if GMail ran on TOR nobody would even use it. Why bother? It's slow and it's gonna leak information like a watering hose.

</comment></comment></comment></comment></comment></comment><comment><USER31> I'm afraid to comment out of fear being picked on? I didn't read the article very well(depressed about things, and what the Internet is morphing into), but didn't the U.S. federal government put money into TOR?

<comment><USER32> Take a news break for a few days, your health is important.

</comment></comment><comment><USER33> Since I've never been an .onion site user, I've not noticed any issues with my Tor connections to the "regular" net.

It's my understanding that one can host a .onion "hidden" site without having to go through any such provider as Freedom Hosting, so I don't see how my privacy is being affected by this situation.

</comment><comment><USER34> Uhm, so where exactly does the FBI/NSA come in?

As of now there is some guy stating that some hoster has been pwnd and uploaded some JS that expoloited something that might be FF17 that might have been shipped with the tor browser bundle.

Why exactly does he thing FBI/NSA is involved? If he has the exploit code why didn't he upload it?

Lots of conclusions based on assumptions. As of now I'd think it's more likely someone just pwnd the largest TOR hidden host provider, uploaded a sploit that will affect most of the users (tor browser bundle) and called it a day.

Sure there MIGHT be some GOV/whatever involvment. But wouldn't it be time to wait with such accusations until we got some actual proof? Not even uploading the alleged exploit doesn't really help his position.

I would think that since about 60% of TOR projects funding comes from the .gov[0], that they have an incencitive to keep it online. I could imagine they have some nodes for which they wouldn't want to reveal the physical location. I don't know warhead controllers or something. Of course that only works if the're are enough nodes involved so you can hide yourself. That's why _I think_ this might not have been a .gov action.

[0] [https://www.torproject.org/about/findoc/2012-TorProject- Annu...](https://www.torproject.org/about/findoc/2012-TorProject-Annual- Report.pdf)

<comment><USER11> TOR is also a great honeypot. There are no ways of validating a given node is not governmental, either.

<comment><USER35> There are no ways of validating _anything_ is not governmental.

<comment><USER11> Yes, but there are degrees of this, and TOR gives you nothing without the resources of the government.

<comment><USER35> The government is allowed to create fake identities and corporations, use private facilities and infrastructure, etc. in order to run sting operations against sophisticated criminals. That's exactly the sort of "real police work" they should be doing, rather than surveillance.

Where is there ever a "degree" of visibility as to whether something is a government honeypot?

</comment></comment></comment></comment></comment><comment><USER36> Anyone who was using Windows for TOR browsing was already asking for trouble. Anyone browsing outside a "sealed" VM setup such as Whonix was also asking for trouble.

<comment><USER37> Browsing in a VM doesn't help: the VM still has an IP address.

<comment><USER38> If you just run tor inside the VM, the above is true. If all the traffic out of the VM is routed through tor, then the IP address they will get is a tor (not clearnet) IP address. In order to get a clearnet IP address off a VM, you'll need to exploit the VM itself, a task clearly much harder than misusing javascript in a browser.

</comment></comment></comment><comment><USER39> I think there is a large insight to be had by all this.

State can and will use computer exploits in military and law enforcement. Like with PRISM, its no longer just the tinfoil - Its confirmed. The businesses model for a few companies are to hoard zero-day exploits, and sell it on the market. The military, police, "business intelligence" a.k.a industry spying, and criminals are their customers. In contrast to disease research, software virus research are not regulated or illegal, so both good and bad is the result. It is good when independent research find vulnerabilities in software we use, and less so when its hoarded and sold to be used against us.

</comment><comment><USER40> This has given us a pretty rare chance to look at a 0-day exploit being used in the wild by the US government. Has anyone traced the code enough to know how it works?

[http://pastebin.mozilla.org/2777139](http://pastebin.mozilla.org/2777139)

</comment><comment><USER41> I have a question for Tor users. Would such an exploit to the system encourage you to transition to similar darknet services such as I2P, or will you be sticking with Tor with greater caution?

</comment><comment><USER42> Anyone notice this:

>3\. Bitcoin and all crypto currenecies set to absolutely CRASH as a result since the feds can not completely control this currency as they please.

<comment><USER43> I wouldn't think too much of it. It could be a bit of wishful thinking, or an attempt to manipulate the price of Bitcoins by spreading rumors. Both are fairly popular among Bitcoin speculators.

</comment></comment><comment><USER44> I'm curious if the exploits would work with javascript enabled, but with noscript installed. This is default for the current TBB I think.

</comment><comment><USER45> What does it mean by "Half of Tor sites compromised". Was not it just "Freedom Hosting" which was compromised?

</comment><comment><USER46> I must yet again point to a company like Endgame Systems[1] as being a likely contractor for this service rendered for the FBI.

Some of Endgame's products used by the likes of the NSA: "There are even target packs for democratic countries in Europe and other U.S. allies. Maui (product names tend toward alluring warm-weather locales) is a package of 25 zero-day exploits that runs clients $2.5 million a year. The Cayman botnet- analytics package gets you access to a database of Internet addresses, organization names, and worm types for hundreds of millions of infected computers, and costs $1.5 million."

Exploiting an unknowable amount of users of a service as to hunt them. Using illegally harvested data from botnets, while others get hunted and prosecuted for coding them.

This tiered society where the legally immune can profit off acts that get others jailed. The market manipulation that comes with bribing companies for data access, the government giving less regulatory oversight to companies it has secret 'deals' with.

For the sake of society, economy, basic morality. It must end.

[1] [http://wiki.echelon2.org/wiki/Endgame_Systems](http://wiki.echelon2.org/wiki/Endgame_Systems)

<comment><USER47> "Exploiting an unknowable amount of users of a service as to hunt them. Using illegally harvested data from botnets, while others get hunted and prosecuted for coding them. This tiered society where the legally immune can profit off acts that get others jailed."

Not that I disagree with this sentiment, but how is this different from the fact the government is "legally immune" from using/possessing weapons and firearms that the average person can't possess or use?

<comment><USER48> It's more like the government hiring non-government forces that can then legally possess arms that other "non-affiliated" people (i.e. civilians) can't, and being given legal immunity for killing random people, some of which might turn out to be criminals. I.e. Batman, with a bit less moral compass.

<comment><USER49> Or even "Batman with a completely normal corporate moral compass – 100% focused on its primary goal – of 'increasing shareholder value'"…

</comment></comment></comment></comment><comment><USER50> Software that creates randomly TBs of fake email, voice (skype) and other communication daily to disrupt NSA. Possible? Helpful?

I.e. billions of emails created daily originating from millions of email accounts created daily that contain random words including the ones the NSA is looking for.

I mean, they went on the path of the least resistance with this whole PRISM thing. Kind of blatantly stupid approach of "just listen to everything". That can possibly be derailed by simple creating tons and tons of "everything" daily to feed their stupid programs.

<comment><USER51> Even if I don't see why you are saying it on this specific thread, it actually came to my mind few days ago. I think it is a good, simple idea. No technical difficulties, just spamming and make the whole thing unanalyzable.

</comment></comment><comment><USER52> You have to respect an effort like this.

</comment><comment><USER53> As a Catholic, I don't know what I hate most: child pornographics or the FBI.</comment>