The inception bar: a new phishing method - <AUTHOR> https://jameshfisher.com/2019/04/27/the-inception-bar-a-new-phishing-method/ <comment><USER2> "Ceci n'est pas un UI."

This _specific_ example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme), but it seems the trend toward un-customisability is just going to lead to this being even more easy to exploit.

Of course, mobile browsers hiding important information and being even more un-customisable makes this worse.

 _Well, even I, as the creator of the inception bar, found myself accidentally using it!_

When reading a product's documentation that has screenshots explaining how to do something, I've also accidentally tried to manipulate them instead of the actual dialogs. I'm sure others here have had similar experiences too.

<comment><USER3> In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

<comment><USER4> Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts.

Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message.

People will just assume they made a typo and continue as if nothing happened.

I've argued before for a genuine out-of-band independent display on machines which can only be written to by some very high privilege process.

<comment><USER5> That's why Windows can be set to require Ctrl+Alt+Del before login as it can't be intercepted by a fake login screen.

<comment><USER6> Similarly, the iPhone X requires double-pressing the power button to complete a purchase using Face ID. Previously, with Touch ID, the authentication action itself was also sufficient to establish intent (placing the finger on the sensor). But with Face ID, any app could just pop up the purchase window and Face ID would see your face.

Incidentally, this is why Face ID is strictly worse than Touch ID in my opinion.

<comment><USER7> how is it worse? touch id's serving as authentication and approval for payment was actually exploited as a scam. I don't see how this could be done with face id.

[https://www.wired.com/story/iphone-touch-id-scam- apps/](https://www.wired.com/story/iphone-touch-id-scam-apps/)

<comment><USER6> That's fair. I never encountered anything like that. In my experience Touch ID was faster, more reliable, and more versatile (e.g. able to be activated with the phone lying on a table without peering over it with my face).

<comment><USER8> I happen to be in a situation where I have a phone with Face ID and one with Touch ID.

Touch ID with wet or slightly dirty fingers are not good. I've been doing some gardening over Easter and Touch ID is barely working because my fingers are more rough than they normally are.

Face ID on the other hand, works just as expected. It doesn't work optimally if I'm lying down, but that's not a problem for me personally.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> With a little polishing this would be quite the "exploit" \- trap the user in your fake browser, actually load pages that are entered into the fake URL bar, replace content only on certain patterns...

The only solution here is a proper line of death [0]. It defeats the purpose of the LoD when it dynamically shrinks from user action.

[0]: [https://textslashplain.com/2017/01/14/the-line-of- death/](https://textslashplain.com/2017/01/14/the-line-of-death/)

<comment><USER10> Thanks. This is a great reference indeed!

The challenge is preserving ability for content to control all pixels; without it, the content ecosystem ends up developing single-purpose, generally crappy apps, which isn't necessarily a better thing either...

I'm not sure it is the only solution either - what about "secure attention key" type ways to get the system's attention (in this case the browser's), bypassing any content interception? For example, what if there was a key combo guaranteed to always bring in the browser UI, and typing that key combo was necessary before inputting any password field?

Alternatively, the reliance on browser password management could provide some security if it can be trusted to always work...

<comment><USER9> Those are some good ideas too - "only solution" was a bit hyperbolic - but I do think our options are limited, especially on mobile.

The Secure Attention Key is interesting, but would need the user to know you press it. And on mobile, it would probably need to be a dedicated button on the device, since I could just fake the on screen keyboard too.

Password manager auto-fill failing would clue a savvy user that something was wrong, but I suspect many would just assume it's a glitch and manually enter their credentials.

I saw an reply in another thread suggesting customizable browser background images for the UI bar, which a website would have no way of replicating. In my opinion that's probably the best approach, although it might mean throwing away the ability for sites to set the background color of the UI to match their theme (arguably losing nothing of value :).

<comment><USER11> With the use of gesture controls and swipe-up menus and "soft keys", etc, why not put in something like the "pie control" apps on Android, where the OS controls one part and the app controls another?

Consider a semi-configurable universal menu with a well defined access method, where you always can back out of the app, and in the case of browsers also have guaranteed access to switching tabs and accessing options, etc.

</comment></comment></comment></comment><comment><USER12> I happened to have 26 tabs while loading this, and spent a minute trying to figure out how the fake bar "knew" my open tab count

<comment><USER13> ... so how does it?

Edit: saw in another comment that it's hardcoded, so it was coincidence. That makes sense.

</comment></comment><comment><USER14> I can't help but think that this was made possible by the complete collapse in common UI standards. 'Apps' have stopped being OS-toolkit apps and moved onto the web, and of course each designer needs to have their own special on-brand widget style. This has leaked onto the few remaining desktop apps: Chrome rejects the standard Mac OS widgets and reimplements everything, from buttons to the print dialog. Spotify does its own thing. And lest we think Apple has much respect for UX, iTunes is a mess. I genuinely can't use it.

The result is that users have been trained not to expect consistent UI paradigms. Every UI is hunt-and-peck. And that paves the way for this kind of exploit.

<comment> dan-robertson I don't see what relation this rant has to the op. Surely the issue here is nothing to do with the ui displayed and more to do with the fact that it is possible to fake the browser ui. Even if chrome were using traditional controls on a desktop, one could imagine an exploit where clicking a malicious link puts the browser in full screen mode (most browsers only accept being put in full screen mode from event handlers for user interactions like clicking), and displays a fake browser ui inside.

This was anticipated and partly avoided by a reasonably large modal which pops up to tell you you're in full screen mode, and disappears after a few seconds.

Another similar exploit on desktop was to set the cursor of the page to be a very large image which would overlay the browser chrome and put some fake information there.

The issue on mobile could perhaps be reduced by having some amount of ui that doesn't go away (safari does this in portrait mode). Another help could be to not make the ui disappear (or make it reappear) when this kind of scrolling an iframe situation arises

</comment></comment><comment><USER15> Using Firefox for android: if I open the page and scroll down, the address bar becomes invisible and the hsbc bar shows up. If I keep scrolling down, I just see hsbc. The moment I scroll up, the original address bar is shown, and even if I keep scrolling down, the bar does not disappear.

Edit: it's happening kind of randomly. 1 time it happens, 3 times it doesn't...

<comment><USER16> Using Firefox Beta for Android v67.0b9, I see the hbsc address bar as a second address bar below the real one. It remains in place as I scroll, although a couple of times it disappeared.

Also this version wouldn't fool me because it says I have 26 tabs open. I'm used to the infinity symbol there!

<comment><USER15> I am using Firefox 66.0.2. (how could I forget to mention that!).

</comment></comment></comment><comment><USER17> There was a similar thing reported a few months ago relating to a fake Facebook social login popup.

[https://myki.com/blog/facebook-login-phishing- campaign/](https://myki.com/blog/facebook-login-phishing-campaign/)

It adds the browser elements to make it appear like a verified popup.

The only reason it was discovered was due to users complaining that the password manager did not auto-populate the form.

[https://news.ycombinator.com/item?id=19188386](https://news.ycombinator.com/item?id=19188386)

<comment><USER18> Back in the day you used to be able to get people to click a series of sharing dialogs with fake iframe overlays. People were abusing it to get insanely viral posts shared by millions.

</comment></comment><comment><USER19> This worked brilliantly on my Chime Android, and I'm quite surprised the scroll-jail trick worked too.

I suppose the author just wanted a quick PoC, but with enough work, one could mimic an interactive browser address bar, including the menu that with refresh, bookmark, etc and even the HTTPS padlock with security information. Browser UIs being designed in CSS itself, one could easily copy/paste from the browser itself.

</comment><comment><USER20> Interesting. iOS Safari seems to force the address bar to stay visible on this page.

<comment><USER21> Firefox for android keeps the bar there too.

<comment><USER22> Just to be clear, you're referring to real Firefox address bar (pointing to TFA), not the fake Chrome address bar (pointing to hsbc.com). So yes, in this case Firefox has (accidentally?) somewhat thwarted this attack vector.

<comment><USER23> It certainly looks accidental. It hides on scroll on other pages but this one causes it to half hide and then it pops back up again.

<comment><USER24> I noticed this as well. I'm wondering if FF is smart enough to always show it's own title bar if a CSS element is pinned to the top of the viewport? Gotta do more testing ...

</comment></comment></comment></comment></comment><comment><USER25> Whenever I'm looking at an iPhone screenshot someone posted on social media on my iPhone, I try to navigate using the buttons in the image. There ought to be a long German word for that experience.

<comment><USER26> Klickbarernavigationselementeillusion?

<comment><USER27> Benutzeroberflächenabbildungsverwechslungsgefahr

(user interface image confusion danger)

</comment></comment></comment><comment><USER28> Yahoo actually tried to do this in 2015 with an internal initiative called "Silver Search" to try and trick Firefox users into using their own yahoo- powered omnibux. I was fucking livid when I found out about it and complained.

<comment><USER28> omnibox _

</comment></comment><comment><USER3> I'm not doubting the concerns raised but the fake failed in many ways for me on my phone with the latest chrome. It didn't appear. Then when it did it appeared below the existing bar.

But I guess you just need it to work often enough.

<comment><USER29> It's like the fake "Allow Notification" dialogs on some sites. They look off to pretty much anyone paying attention, but their target market probably isn't people paying attention

<comment><USER30> What's the idea behind those? Do they just get permission before showing the real dialog, or is it more sinister than that?

<comment><USER29> It can be more sinister. Although I am sure the other answers are right in some circumstances, I was curious a while ago, so I actually clicked one.

Whether you click allow or deny, it shot off a network request to a third party domain. This lets the third party know your browser's user agent, and if they have an exploit for your browser they will send a payload that compromises the browser with the intent of installing an adware extension.

It failed to install on the machine I made for it (Ubuntu18/Chrome) but it did manage to navigate me to an advert from the click.

<comment><USER30> But any click can do that, right? No need for it to be a fake Allow/Deny prompt.

The best I can think of is that it does 2 things:

1\. Preserves the "true" allow/deny prompt for a time when the user will allow.

2\. Lulls the user into a sense of security. The page is nice and/or their browser will ask about anything the page tries to do.

<comment><USER29> My guess is something to do with needing to have a user prompt certain types of cross site javascript actions.

It also needs to seem legitimate so people click it but don't report it.

</comment></comment></comment></comment></comment></comment><comment><USER31> FYI this isn't occurring on chrome or safari on iOS. As soon as the fake bar appears the page stops scrolling normally - the scrolling inertia stops so that I can scroll but not "toss" the page, and the real address bar no longer hides. I wonder if this is a deliberate mitigation, or an accident?

<comment><USER32> This is because iOS browsers use WebKit and leverage the CSS `overflow- scrolling` attribute.

[https://developer.mozilla.org/en-US/docs/Web/CSS/-webkit- ove...](https://developer.mozilla.org/en-US/docs/Web/CSS/-webkit-overflow- scrolling)

</comment></comment><comment><USER33> I understand why this was a problem in 1995, but honestly, in 2019, with image recognition technology as advanced as it is now – _especially_ due to efforts by Google – why can't browsers detect this? Surely "does this rectangle look vaguely like a URL bar" is an easier problem to solve than "is this a photograph of a cat"?

Sure, image recognition is CPU intensive, but even just checking once every 5 seconds or so would be enough to prevent this sort of attack and pop up a big "you are being phished" warning. And 99.99% of what occupies that UI real estate looks sufficiently _unlike_ a search bar that a low-cost recognizer should be able to rule out phishing for normal sites fairly quickly.

What am I missing? Has this approach been tried and rejected? Is image recognition of fairly static, flat, 2D, geometric shapes actually far more CPU-intensive than I imagine?

<comment><USER34> MobileSafari has an interesting feature that your idea reminded me of: it tries to detect when a site using the Fullscreen API presents an iOS keyboard- lookalike through the location and frequency of your taps on that side of the screen. I've gotten the warning when doing something else and was impressed they thought of it.

<comment><USER33> Neat! That's an interesting way to detect phishing.

</comment></comment></comment><comment><USER35> "Make sure you've done a hard refresh of the page"

An inception bar could include a fake refresh button, no?

<comment><AUTHOR> Thanks, and yes! I was originally thinking "pull-to-refresh", but since your comment, I've enhanced the phishing with another trick: a large buffer at the top of the scroll jail, which prevents the user from reaching the top, and thus prevents the user from using "pull-to-refresh". Now, the only way I know to reliably get out of the page is to move to another app, then back to Chrome - this seems to cause it to re-display the true URL bar.

<comment><USER36> You can scroll down from the inception bar to display the browser bar again

</comment></comment></comment><comment><USER37> Related: [https://feross.org/html5-fullscreen-api- attack/](https://feross.org/html5-fullscreen-api-attack/)

<comment><USER38> FWIW, opening that link in mobile Safari shows a large "X" in the top left of the screen and trying to scroll sets of the "it looks like you're typing in fullscreeen" warning.

<comment><USER37> Mobile Safari? On which iOS version?

On mine (latest on iPhone 7 at the time of this writing) the site just says my browser doesn't support the full screen API.

<comment><USER38> MobileSafari on my iPad running iOS 12.3 (16F5139e).

</comment></comment></comment></comment><comment><USER39> A recent example that I've been seeing more and more is pages taking over some system keyboard shortcuts. I've seen pages taking over Command-F and using their own search interface instead of the browsers. I've found utilities for not messing with copy/paste, but is there a way to block pages with keyboard shortcuts in Chrome?

<comment><USER40> Hijacking CTRL-F drives me nuts!

I really think this should result in a permissions dialog from the browser.

</comment></comment><comment><USER41> Everything looks correct on chrome mobile. I don't ever see the HSBC bar, regardless of how I scroll.

<comment><USER41> After switching back to chrome, I could see the bar, but the scroll jail didn't work, so scrolling up showed the original page bar.

</comment></comment><comment><USER42> I recently helped someone install vlc. I googled VLC download (relying on Google) and then clicked through the clearly labelled download links. I accidentally must have clicked a link twice because two copies started downloading. The more recent one was finished so I literally started opening the executable. The only thing that stopped me was that it was called vlc- streaming or something, and the one next to it was still downloading, slowly. That's because it was a download triggered by vlc's ad partner. It wasn't VLC.

This wasn't some shady part of the Internet. I was livid.

If they had given it the same name, size, and approximate download speed as the file I was downloading, I would have had zero way to determine this. Everyone has accidentally started two downloads when they just wanted one copy.

Unreal that this could happen on an official site. (And that it basically tricked me.)

<comment><USER43> I'm convinced to use windows store or Choco to install stuff for this reason. Paint.net is practically impossible to download from their as infested site.

</comment></comment><comment><USER44> I didn't see it working on Chrome on my phone (chrome 73.0.3683.90, OnePlus 6)

Edit: does work with a refresh

<comment><USER45> Perhaps you have JavaScript disabled.

</comment></comment><comment><USER46> This sort of works on chrome Android, but the critical overflow:hidden trick does not prevent chrome from restoring the real address bar.

</comment><comment><USER47> Slightly OT, but it's HTTPS so it must be safe, right ?

It's an example of why the "HTTPS everywhere" push annoys me, it gives false sense of security. Security resources should be better spent.

Also, back on topic, Google should stop handing blindly the wheel to "Designers". Oversimplification instead of properly educating people lead to this crap.

<comment><USER48> HTTPS everywhere is a good thing. HTTPS was never about protecting against phishing, and has never protected you against phishing. There is no way to educate people about phishing, only way to protect against it is U2F. Education against phishing is not very effective, and only works short term.

<comment> yjftsjthsd-h Right, but it was pushed as "lock icon means secure" and end users don't distinguish threat models.

<comment><USER47> Exactly, and I disagree on education. People can and must be taught on security (not just phishing). But that also mean some standardization on the browser UI and not trying to make it "seamless" and "transparent". This exploit is the result of voluntarily blurring the lines between Traditional Apps and Web Apps. Well, the threat model being very different, it's not a good idea.

HTTPS is a part of a whole and pushing so hard make people (even tech savvy ones) focus too much on it. How many CTOs are happy with just putting HTTPS on their website so they can check the security checkbox ?

</comment></comment></comment></comment><comment><USER49> Looks like the "never redisplay the true url bar" trick didn't work for me on my mobile Chrome.

[https://imgur.com/a/Pjybovf](https://imgur.com/a/Pjybovf)

</comment><comment><USER50> This fake bar reminds me of a fake address bar that Google displays in an AMP viewer and efforts it takes to be able to replace URLs in an address bar instead of just letting the user visit the target site.

</comment><comment><USER51> When using firefox focus on android, the whole image is blocked from loading

</comment><comment><USER52> I like how 10 years back or today the answer to such pishing issues (then specifically tragetted to IE, now Chrome) is 'use Firefox'.

</comment><comment><USER53> The usability / security trade-off is difficult.

Another example where Chrome prefers usability over security is autofill, where a user can accidentally share more personal information than he/she wishes:

[https://medium.com/@stabbles/why-you-should-disable- autofill...](https://medium.com/@stabbles/why-you-should-disable-autofill- bf2e15c65b5c)

</comment><comment><USER54> Using Firefox Focus on Android and the bar doesn't show up at all. Re-enabled Chrome temporarily and the bar does show up, however.

</comment><comment><USER55> There is previous work on the matter: A fake Firefox XUL browser if I recall correctly (UI readdressing).

This attack is for sure nice and effective!

</comment><comment><USER56> I figured out something kinda like this but worse. I don't really know how to make it public though because it hits so many different pieces of software that I struggle to see how I could give enough warning to all of them. Thousands of entities, really.

If someone else has dealt with this please reach out I want to make it public in a safe way.

</comment><comment><USER57> I'll worry about this when I stop getting emails from my banks and credit card companies that look like cheesy phishing emails and ask me to click the link then login.

My point is that none of this stuff matters if major corporations continue to send out terrible emails that basically encourage consumers to engage in risky behavior.

</comment><comment><USER58> Reading this reminded me of the time in the 80s when I discovered hex editors and changed COMMAND.COM to reverse every DOS command. So to get a directory listing you had to type RID, COPY became YPOC, etc. The error message was !sdrawkcaB. I know I'm no hacker but everyone else thought I was.

</comment><comment><USER59> Perhaps a solution would be to allow the browser to share a "fingerprint" with specific websites. To make a trusted connection. The website would know if a trusted connection exists for the user and deny all login attempts coming from unauthorized fingerprints.

</comment><comment><USER60> Not using Chrome, and not having a padlock in the URL bar, and disabling non- ASCII URLs, fixes many of this problem.

Another possibility would be to display a "collapsed" address bar, so that you can see that it is not the actual bar, but rather is another one.

<comment><AUTHOR> IMO, the collapsed address bar is the most pragmatic fix to this issue. (The other fixes are options that users would have to opt in to, rather than being fixed at the source - i.e. Chrome.)

</comment></comment><comment><USER61> I tried to exploit the mobile browser hiding the address bar when scrolling to hide the address bar in a web game/app to get more screen real estate on mobile but most browsers make it very hard.

</comment><comment><USER62> The illusion is almost perfect. However, it breaks when you scroll back to the very top. The real address bar reappears on top amd stays there even when scrolling back down. This is with Chrome 73.

</comment><comment><USER63> I written in quick basic clone of novell network login screen and dumped passwords to a file. Got dozens of students passwords and did nothing with it... I was 13 years old...

</comment><comment><USER64> Doesn't scale well to small mobile devices (eg iPhone SE)

</comment><comment><USER65> If I scroll up high enough, I get both address bars. Then if I scroll back down both stay in place. The inception bar isn't clickable, ever.

On chrome 73.0.3683.90

</comment><comment><USER66> Wow, didn't even think it was possible to do this.

</comment><comment><USER67> Looks like they 'fixed' this in Chrome for mobile. The URL bar no longer disappears on his site (but it does on most other sites).

</comment><comment><USER68> The scroll jail is easily defeated by grabbing the fake address bar and pulling that down, rather than pulling down the main content area.

</comment><comment><USER69> By override the scroll behavior, it also makes the page feel very unnatural on an ipad (I think it's the inertia effect missing).

</comment><comment><USER70> Scary exploit! Would it also work using Element.scrollIntoView()? In such case it wouldn't even need user interaction.

</comment><comment><USER71> Totally fooled me, but pulling down on the fake 'inception' bar brings back Chrome's url bar. Neat trick.

</comment><comment><USER72> I'm surprised that nobody included "clicking on the url bar in order to modify it" as a mitigation.

<comment><AUTHOR> In principle, it's not a mitigation - I was just too lazy to forge an interactive URL bar! You could make one which acts just like the Chrome URL bar, but e.g. acts as a MITM.

<comment><USER73> At first I though you wouldn't be able to stay "in the middle" because you'd have to redirect to the typed address. You can't AJAX it in, because of CORS.

But you could go to your own host and have your server sit in the middle. The user wouldn't be logged in, since cookies wouldn't be sent. But maybe they would login through your proxy.

</comment></comment></comment><comment><USER74> Turns out if you lock the phone the actual address bar reappears after you unlock your phone

</comment><comment><USER75> Yuck. I have a custom UI on mobile so it's out of place to see white. I also just suffered from a bug causing images to half load (no idea why it seems new). In trying to get images to load I got the tab count portion loaded, I then immediately tried changing tabs ... With the fake button I just made show up.

</comment><comment><USER76> Doesn't seem to work with Firefox on Android but a nifty little trick for sure!

</comment><comment><USER77> It works with the desktop version too if you go full page (F11)

I did use chromium to test.

</comment><comment><USER78> A similar attack could be done with fake password manager UI elements.

<comment><USER49> I saw a proof of concept video of exactly this using LastPass.

</comment></comment><comment><USER79> I found a fix to this problem, on accident. I use Blokada apk on android (not the Google play store version, the good one, if that makes a difference) and when first visiting the page didn't see what the hell you were talking about, the inception url bar never showed up for me. So, when most things don't load or don't act as they're supposed to that is the first thing I go and do-- disable Blokada and reload. Once I did, then it showed up, (pretty cool little discovery btw, good job)

So tl/dr; Can be fixed by using ad+malware blocking host file, namely this one, [https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master...](https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master/Hosts/GoodbyeAds.txt) since it's the one I use and was using when I noticed this

<comment><USER79> Bumping this so it doesnt get lost...

</comment></comment><comment><USER80> Javascript is disabled by default in my mobile browser _shrugs_

</comment><comment><USER81> The scroll jail didnt work for my firefox for android latest stable.

<comment><USER82> The article indicates it's not supposed to. It's a quick and dirty proof of concept, working in one environment (Android/Chrome), with a screenshotted fake header. Just enough to prove the point.

</comment></comment><comment><USER83> Change your system font.

<comment><USER84> slightly related, js [limited] system available font detection: [https://gist.github.com/fijiwebdesign/3b0bf8e88ceef7518844](https://gist.github.com/fijiwebdesign/3b0bf8e88ceef7518844)

<comment><USER38> Safari has prevented websites from accessing nonstandard fonts as an anti- fingerprinting technique for a while now, so this script does not quite work for those.

</comment></comment></comment><comment><USER85> If I see 26 tabs open, I immediately know something is wrong.

</comment><comment><USER86> Huh naked browser doesn't even show the fake address bar

</comment><comment><USER87> This scroll jail shit is why I absolutely despise AMP pages.

</comment><comment><USER88> it was hard to reproduce this behaviour on Firefox mobile, but it did happen twice after multiples of scroll ups and downs.

so the question is, is it a common browser bug?

</comment><comment><USER89> I like how this is a trend now, fake popups, fake url bars.

Maybe _unique_ browser designs would help users.

</comment><comment><USER90> This is why chrome is a terrible choice - it disregards OS UI/UX choices.

</comment><comment><USER91> Poor Android users .. no blue bubbles and now this!

<comment><USER92> Security vulnerabilities are discovered across all platforms. Just recently did we find an eavesdropping vulnerability in iOS[0] that certainly qualifies as far more severe. Given how security issues can pop up for any platform, I don't think calling one group of users "poor" is prudent, or a nice thing to do.

[0]: [https://www.forbes.com/sites/daveywinder/2019/01/29/apple- co...](https://www.forbes.com/sites/daveywinder/2019/01/29/apple-confirms- iphone-facetime-eavesdropping-exploit-heres-what-to-do/#711ba821745b)

</comment></comment><comment><USER93> > when you visit this site on Chrome for mobile, and scroll a little way, the > page is able to display itself as hsbc.com:

I would like to test this out, but I'm not willing to install spyware. Can anyone confirm this?

</comment><comment><USER94> I guess this risk could be mitigated if the browser had recognition code running in the background for if the top of the screen was mimicking the search bar. I'm not fond of the idea that we put restrictions of fullscreen mode where it requires user approval when scrolling down or something of that sort.

</comment><comment><USER95> Well, people still believe that they will help a prince from Nigeria.

Also I've seem some old ladies believing that a younger soldier from US needs help taking money out of %some country%.

A fake address bar, with a fake "look, I'm safe" mark on it? Yes, it'll do it.

</comment><comment><USER96> Reading these comments initially got me sad. How many echoes of the article's theme - 'look at this flaw and how I exploited it'. At first I thought the author had cast a magical spell to bring out the dark side in us. But really, The initiative in us that is adversarial already exists and is simply suppressed. We go about all day acting 'civilized' while the animal in us paces nervously waiting for an opportunity to get out. And in the anonymity of the net, we let the animal out. How many of us would brag about these accomplishments to our children or to our boss at work?

But then I realized how honest every post was. How anonymity also encouraged 'free' speech. And remarkably how much data was shared. Before the net, when we couldn't be anonymous, we couched our meanings in bs and obfuscation. The 'bs' meter was a finely tuned process that you had to develop and run in the background to sort the chaff from a person's words. Now, comments are often accompanied by a github link where I can read and test the code that people brag about. Thank you internet</comment>


Ask HN: Essential Reading for Managers of Managers - <AUTHOR> There has been some great posts, discussions and recommendations over the years about being a Manager and all that entails.<p>For those who have continued on that path and become director/head of.../whatever title your org uses for that role which has you managing the managers, any essential wisdom or reading you would like to share? <comment><USER2> Managing Humans by rands [https://managinghumans.com/](https://managinghumans.com/)

There is not a better book on managing software engineers than this imo.

</comment><comment><USER3> Radical Candor by Kim Scott was the first book I was asked to read when I was promoted as manager. After that I went on to read High Output Management. Currently I am reading Rework by Jason Fried and David Heinemeier Hansson.

<comment><AUTHOR> Thank you.</comment></comment>


My site content got copied or why I no longer use a CC license - <AUTHOR> http://notebook.kulchenko.com/writing/my-site-content-got-copied

<comment><USER2> If they're already violating the license, why would they respect a more restrictive one?

<comment><AUTHOR> I can still file a request for copyright violation, but with a more restrictive license I don't need to argue about whether the placement of the attribution is an appropriate one or not.

<comment><USER3> As the copyright holder, the CC-BY licensing explicitly states "You must attribute the work in the manner specified by the author or licensor".

There's no argument. You decide if it's an appropriate attribution or not. If it's not, they're in violation of your copyright, period.

I agree with the parent that someone who is going to steal your content, is going to do it regardless of the license.

And, remember: if you don't actually register your works with the Copyright Office, you can't sue for damages. All you can do is get them to take it down.</comment></comment></comment>


UX brutalism - <AUTHOR> https://www.uxbrutalism.com/ <comment><USER2> This is funny, but I think also misses the point of Brutalism entirely.

Brutalist architecture is _functional_ first (but often beautiful, too). The examples of Brutalist web design almost entirely miss out on being functional by being hard to read, abstract (not merely containing abstract elements, but abstract at its core), and lacking in the clean hard lines commonly seen in Brutalism.

There are some examples in the linked gallery ([http://brutalistwebsites.com/](http://brutalistwebsites.com/)) that I think can be fairly compared to Brutalist architecture, but nowhere near the majority of them. Most are just ugly and gimmicky. Brutalism may have been ugly and gimmicky at times, but it wasn't the core motivating force for any Brutalist work of note.

<comment><USER3> Arguably, a major point of Brutalism is letting the essence of the materials come through rather than covering them up. In that sense, I think "Brutalist" web design would connote embracing things like hypertext, links, and hierarchical structure rather than building up the illusion that your website is some ethereal dance of pure unsullied UX. The infamous "Motherfucking Website" [1] might be the best-known example of deliberately showcasing this approach.

[1] [http://motherfuckingwebsite.com/](http://motherfuckingwebsite.com/)

<comment><USER4> I think that early web (say, pre-Web 2.0) was the epitome of Brutalist design. Because resources were limited, you had to make the most of what you had, leading to that no-nonsense, sparse style. I think it's beautiful, in its own way.

<comment> et-al That's an interesting idea. There's something very raw about those university.edu/department/~username pages that existed with the most basic of HTML--unstyled tables, blue anchor links, images only when you needed them, and almost no Yavascript.

That rawness, without too many attribute tags let alone CSS, _is_ brutalist.

<comment><USER5> Btw, the university pages you mention are still extremely common, at least in mathematics-related fields

<comment><USER6> When I'm searching for info on something, if I land on a page with no styling and no multimedia beyond hypertext and images, I know I've hit something good because it's almost certainly an academic's personal page!

</comment></comment></comment></comment></comment></comment><comment><USER7> Ironically enough, WaPo has an entire article about the brutalist trend in web-design, and the very first example they give is Hacker News.

[https://www.washingtonpost.com/news/the- intersect/wp/2016/05...](https://www.washingtonpost.com/news/the- intersect/wp/2016/05/09/the-hottest-trend-in-web-design-is-intentionally-ugly- unusable-sites/?utm_term=.91eae9d7140c)

<comment><USER8> Pretty sure HN is brutalism (along with CL, and possible even google). I don't imagine a designer was hired at all for the process.

<comment><USER9> It's funny - I accept HN as brutalism, but not poor design. (Though I doubt a designer was hired.)

The color scheme at HN is _superb_ for a website. #FFFFFF on #000000 is painful to look at, everyone knows that. But most sites have solved the problem with grey-on-white, or even grey-on-grey. It's hard to anyone to read and terrible for those with impaired vision. HN chose solid black on a darkened, but distinctively shaded background. That alone has my lasting gratitude.

</comment></comment></comment><comment><USER10> I like brutalist websites because they remind me of those weird passion projects you find on the web from time to time ...

Netochka Nezvanova [1]

Ted's Caving Page, with the story of his discovery in a local cave [2]

TempleOS [3]

Jon Bois' Future of Football [4]

They have the vibe of one person with a keyboard and a strange dream, and that's what I love about the web.

I feel weird about a UX design shop critiquing this aesthetic, because they're such different worlds, and I don't want the professionalized web shutting down the personal web. But maybe that's the point: web brutalism is a cool, freeing thing in projects that really are personal, but risks becoming selfish or self-indulgent when applied to the wrong project.

[1] [http://web.archive.org/web/20121023110850/http://www.salon.c...](http://web.archive.org/web/20121023110850/http://www.salon.com/2002/03/01/netochka/) [2] [http://www.angelfire.com/trek/caver/page1.html](http://www.angelfire.com/trek/caver/page1.html) [3] [http://www.templeos.org/](http://www.templeos.org/) [4] [https://www.sbnation.com/a/17776-football](https://www.sbnation.com/a/17776-football)

<comment><USER11> TempleOS is one of the strangest projects I've ever seen, and the creator is likely a schizophrenic, but I'm incredibly impressed that he managed to make what he did all on his own. I can't claim to have made a compiler from scratch while on the run from my own hallucinations

<comment><USER12> He is schizophrenic.

He used to run around on HN but he gets banned pretty quickly apparently. He might pop in.

</comment></comment></comment><comment><USER13> Heh, it took me a while to figure out that this class of design was called "brutalist" by the design folk. I had seen such designs before and wanted to make a similar themed webpage for my side project. I was frantically searching the web for "minimalist design", "black and white design", "newspaper/magazine like web design" etc.

Web link for those interested [https://discoverdev.io](https://discoverdev.io)

<comment> k-mcgrady Your site seems like a good example of the point of 'brutalist' web design. People seem to be getting hung up on brutalist architecture having shortcomings but in the discussions I've seen around 'brutalist' web design the focus seems to be on getting rid of the pointless background images/videos, the mountains of useless JS, and having a simpler web page that is clean, readable, very fast to load, and gets to the point.

<comment><USER13> Yeah! Made sure my page has zero JS. Don't add what you don't need :)

</comment></comment></comment><comment><USER14> What comes after brutalism in web design? romanticism? new-sincerity? Button labels like "I would appreciate it if you clicked me because I generate ad revenue".

<comment><USER15> > "I would appreciate it if you clicked me because I generate ad revenue"

This is very likely.

<comment><USER16> Years ago I had a website hosted on Altervista. They allowed ads from their network, but their ToS explicitly forbade adding text to your page that encouraged readers to click on ads.

Does Google have this too in their ToS?

<comment><USER17> Yea it explicitly says "Publishers may not ask others to click their ads" along with about 20 other related clauses.

</comment></comment></comment></comment><comment><USER18> Reddit or HN are best examples of Brutalism.

<comment><USER19> HN?

1) I have no clue who responded to me

2) I cannot even delete my comments while Paul Graham shouts about privacy from rooftops

HN is not even functional, let alone bruatalist. And the reason is simple- they will be shredded down because they know it's easy to say things than to do things.

<comment><USER20> You can easily see who responded to you by looking at your comments under your profile.

I can delete my comments... not sure why you wouldn't be able to.

I think HN is about as perfect a site for its purpose as I can think of. It's fast. It's fast on mobile. It's fast. It has really consistently interesting links. It has informed conversations that don't generally deteriorate into childish flamewars. It's hella fast.

<comment> squeaky-clean You actually can't delete your comments after an hour or so. Try going back through your profile and deleting any old comment.

<comment><USER21> And i kinda like it for it. Over at Reddit i have seen way too many that pop in, make some kind of comment, and then nuke either the comment or the whole account after a short while.

<comment> squeaky-clean Likewise, I hate googling for a discussion or review and finding a thread half filled with "This user has deleted their comments with a greasemonkey script..."

Besides, after an hour or so your comment is definitely already in Google and any HN crawlers, and probably on archive.org shortly after that.

</comment></comment></comment></comment></comment></comment><comment><USER22> It's interesting how the site really reminds me of the GUI design of late 80s early 90s professional software.

[http://www.guidebookgallery.org/screenshots/win203](http://www.guidebookgallery.org/screenshots/win203)

[http://www.guidebookgallery.org/screenshots/geosapple](http://www.guidebookgallery.org/screenshots/geosapple)

[http://toastytech.com/guis/gem11.html](http://toastytech.com/guis/gem11.html)

<comment><USER23> > It's interesting how the site really reminds me of the GUI design of late > 80s

Brutalism in America seemed to have begun its decline in the late 80s early 90s as well.

Not sure if this was intended by the creator but its an interesting parallel!

Also, the Brutalist resurgence is interesting. Its not just with the web, I see plenty of kickstarter projects and other sellers peddling brutalist artifacts.

<comment><USER21> I kinda recall running into a comment from a prominent game dev somewhere, manybe over at Filfre.net, talking about game development rebooting itself from the ground up every time new hardware capabilities came available.

Something about how each time new video hardware came available, the first few years of games would be more elaborate tech demos than actual deep games.

I wonder if something like that can be applied to computing in general. Just look at how we now throw the GPU at everything, because we can, rather than stop to ask if we should.

The Linux GUI for example is still riding the ripples of the wobbly windows and spinning cube that was Compiz. It may have looked good, but was as useful as wings on an elephant.

</comment></comment></comment><comment><USER24> I don't understand the need for this. Material Design is the pinnacle of human creation. Everything should be Material Design forever.

<comment><USER25> > pinnacle of human creation

That's wangernumb!

</comment></comment><comment><USER26> Brutalism is meant to expose the function in a "brute" way, not necessarily to hurt the eye (yet it does not care). Bad user design might be brutal, but not Brutalism.

I think "UX/WEB brutalism" should be based on the minimalism that has spread through the western style web, then taking away some of the beautifying/graphical elements, yet adding "brutally clear" navigation/interaction elements (and not hiding them in a hamburger menu, for example). It should be a pure focus on what is presented (from a content perspective) and how you can use it. Any form of beauty for beauty's sake (like nice background pictures, too much graphics, fancy effects...) should be avoided.

</comment><comment><USER27> You can see brutalism in a lot of late modernist graphic design, which to me is quite ironic seen as it is usually applied to architecture to be function first rather than "lets just make this look brutal" \- as with everything this comes down to the audience.

Brutalism among graphic design is (from my perspective) mainly targeted at the graphic design elite although when used digitally is targeted at the same as well as those who can see past the prettiness to achieve what they are looking to without any issues.

</comment><comment><USER28> what goe around comes around i guess. Myspace i feel was the epitome of ths so-called "brutalism". worked wonders for them in terms of product differentiation at a time when the first semblemnce of coherent UX design standards were appearing on the web.

its great for fringe underground magazines, gamers, music aficionados, and artists of all kinds.

personally i hope it trends as the general web has become mind numbingly boring / predictable as fuk.

</comment><comment><USER29> This sums it up perfectly: "framework for designing brutalist experiences that your design peers will love".

This style is made for other designers, not users. I often hit the back button because besides Bloomberg—after they tweaked it to be less extreme—brutalist websites are absolutely unusable and a nightmare to use. Also, they just seem broken and that reflect bad on the company.

Designers should design for users, not themselves.

</comment><comment><USER30> It's much better than the accessibility problems (animation, color) that are fundamentally baked into ideas like Material Design.

</comment><comment><USER31> I adore UX brutalism.

It's a weird paradox that I enjoy design, but at the same time feel that MOST (caps necessary here) of them are actually faff and pretentious. I keep coming back to brutalist style, as the one I feel the least uncomfortable with, and I'm so glad it's now officially recognised.

(Or maybe give it two years before I start complaining again.)

<comment><USER21> What was that saying about design again. That it is done not when nothing more can be added, but when nothing more can be taken away?

<comment><USER31> Design is also about self-expression of the designer, and solving problems by way of manufacturing experiences. Sometimes the two conflict at the cost of the other though.

</comment></comment></comment><comment><USER32> Most of the websites labeled as "brutalist" are actually extremely over designed and are made by very good graphic designers. They are "elite" bored/over with mainstream view of what is currently considered pretty and they try to push it further. It's about destroying conservative views.

It's like some sort of experimental technology. Design like this is needed because thats how inovation and new ideas come back to mainstream design. So it is not exactly for mainstream audience but for the second wave of designers liking those unusual ideas, taking pieces of it and putting it back into mainstream.

I guess it's same process as in music or in computer sciences.

The fact that for past few years this kind of design started to be popular among the "elite" means that in next few years we might start to see more websites like reddit and craigslist :)

</comment><comment><USER33> UX and UI brutalism meets in MetroUI/ModernUI of Win8/10, ugly as hell color schemes and designs. It reminds me of ugly brutalism/"modern architecture" that was so common in 1960s (prefab buildings).

The Win3x/9x/XP/Vista/7, iOS6 & current macOS/iOS, Android 5+ UI and UX are so nice.

</comment><comment><USER34> Way better than material

</comment><comment><USER35> Funny. I just ran across the Brutalist Framework the other day [http://www.brutalistframework.com/](http://www.brutalistframework.com/) I still can't tell if it is a joke or not.

<comment><USER4> It's either a joke or a gross misunderstanding of Brutalism. I mean, it uses JQuery, for crying out loud. That's not a slight against JQuery, per se, just saying that "Brutalism" would imply a use of raw materials in construction. To extend the metaphor, using JQuery would be like using wood over the bare concrete of a building to make things "better" for the user.

<comment><USER35> I'm inclined to think joke too because although a lot of people thing brutalist architecture is ugly, it is a specific type of ugly and this doesn't seem to fit. I'm not an expert though.

On the other hand there does seem to be a framework you can download which seems like a lot of work for a joke.

</comment></comment></comment><comment><USER36> Reminds me of a website that seems in this aesthetic, though I would categorize it as more "David Lynch-esque": [http://northernground.com/](http://northernground.com/)

</comment><comment><USER37> If only brutalism would have confined itself to website design, I would be satisfied.

</comment><comment><USER38> After a career of developing MVPs, this really clicks with me on a deep level. This site isn't it though. I do think websites and apps need to be built really fast and easily, but they still have to look better.

</comment><comment><USER39> I liked how the site gave me the feeling that it is like a learn startup type method of design.

I signed up for the newsletter to just see, and plenty of the previous content they make available seems intriguing.

</comment><comment> d--b The OP assimilates raw aesthetics with neglecting design.

Brutalism is as careful as design can be, only with as little aesthetic tricks as possible.

</comment><comment><USER40> > _The secret to great brutalist UX is contrast._

Said on a page with dark grey text on a light grey background.

</comment><comment><USER41> "UX brutalism is a relatively new concept, and we don't expect it to last too long."

</comment><comment><USER42> That website had 18 JS warnings on load :/ Isn't it supposed to be highly functional?

</comment><comment><USER43> If more sites looked like this we probably wouldn't need amp.

</comment><comment><USER44> Would you say [https://www.technologyreview.com/](https://www.technologyreview.com/) is brutalist design?

If so, I'd say it's one of my favourite brutalist websites!

</comment><comment><USER45> >The brutalist persona document aggregates all the assumptions you have about your users into a single place.

This can't be serious right? Assumptions? What about data & research?

<comment><USER46> _> Collecting user feedback as early as possible is crucial to finding flaws in your users._

I'm gonna go out on a limb and suggest that there is a possibility that it isn't serious.

</comment></comment><comment><USER41> This reminds me of Butt magazines aesthetic

</comment><comment><USER47> some (all?) of it isn't brutalism, it seems postmodernist.

</comment><comment><USER48> It would be nice if they used CSS for all the examples

</comment><comment><USER49> Regarding brutalism: I think Prince Charles said it best, "You have to give this much to the Luftwaffe. When it knocked down our buildings, it didn't replace them with anything more offensive than rubble."

</comment><comment><USER50> I can't think of anything I hate more.

<comment><USER51> Making things ugly on purpose and calling it a feature.

<comment><USER52> Trying to make things pretty and slick, but adding 20x to page weight and making the page nearly unusable. That's worse.</comment></comment></comment>


How to react to changing screen sizes - <AUTHOR> http://www.webdragon.com.au/main-site/welcome/how-to-react-to-changing-screen-sizes;storyId,8078

<comment><USER2> I've always been a minimalist desktop person. My wallpaper is usually just black with a few (non-standard) icons on it. I like keyboard shortcuts for everything. Mostly dark screen is also my preference. For me _information_ should be the light, no the other way around...

That also applies to browsers. While Firefox was not really good yet, I was going with AvantBrowser in compact mode. I almost never used a browser without the "small icons" option set. I do hate those toolbars every application wants to add to your browser. So, for me, using a direct, simple and minimal broswer window is always the best way to go. I also rarely maximize a browser window.

Regarding the screen size I believe the 1024 columns and many rows as the aspect ratio requires is a good choice currently. If you target audience will _certainly_ use smaller screens a more adaptive page sould be created. If that's not the case, users will be expecting to roll the page oftenly anyway. I read HN on my mobile (using Opera) and it adapts quite well.

<comment><AUTHOR> I've always used Chrome because it has the least browser chrome when maximised: tabs, address line with 4 icons, no status or frame or anything else.

If IE9 is refined to the point where it only has tabs, address bar and a few icons all in one row, it could be a winner from an interface perspective.

</comment></comment><comment><USER3> The move away from 1920x1280 to the shorter 1920x1080 is unfortunate because it forces more content below the "fold".</comment>


Crunchbase admits it may need to learn more about Creative Commons - <AUTHOR> http://techcrunch.com/2013/11/05/crunchbase-people-plus/ <comment><USER3> I was part of the team that created Crunchbase at Techcrunch and it is really sad to see what has happen, since the way People+ are using Crunchbase is exactly as intended with the design.

I can remember the specific conversation about picking CC-BY+A, it was because we wanted other apps to use the data, even if they were competing with us (and they were)

It also seems they have dumped the open API, previously you could just add '.js' to any page and get a JSON representation of it, no developer signup, no stupid API key, etc.

[http://api.crunchbase.com/v/1/company/facebook.js](http://api.crunchbase.com/v/1/company/facebook.js)

My impression now is that since the AOL acquisition Crunchbase has tried to retract a lot of its openness, which was a big reason for its success.

I think the key difference is that we saw Crunchbase as a free service to the startup community that would reinforce Techcrunch, while AOL see it as having a distinct and independent commercial value.

<comment><AUTHOR> Nik - good stuff. Was there ever a monetization plan when you were building it or was it always just always viewed as a complementary asset to TC as you highlight above?

Comment from TC article left by IronToby which is a great point:

"Sounds like they wanted people to contribute content for free while they're the only ones allowed to profit from it."

<comment><USER3> We incubated a few projects (Crunchbase, Crunchpad, Crunchies, Techcrunch40) and even acquired some (Inviteshare) - they were all developed with less or no emphasis on revenue or commercialization but to offer products/services to the startup community (eg. Techcrunch40 didn't charge startups to appear, Crunchbase was CC licensed and open, the Crunchpad was going to be sold at cost).

There was some upside for us, but in those first years the entirety of revenue was poured back into developing other projects (Crunchbase and Crunchpad were both 7-figure investments). The projects did help the brand, but likely not in any real ROI sense. I don't know how Crunchbase was valued in the acquisition, it likely wasn't, since the acquisition price was close to a market multiple on Techcrunch ad revenue alone.

They were all a lot of fun to work on, we had a great team of people, some excellent interns, developers and partners and it made working at Techcrunch all that more interesting (at many points we had more developers and people working on these projects than we did working on the main site). It was a philosophy of doing well while doing good.

The idea of Crunchbase was for it to be a co-op with other blogs, and that the writers would keep it updated while they wrote posts on each company. That didn't work because the other blogs saw it as a threat (a lot of them ended up signing with a commercial alternative that had raised $5M and spent a lot of that money signing up blogs as part of 'revenue guarantees').

The active decision was then made to make Crunchbase open. This is alluded to in some of the other comments in this thread, and that is if you develop the site as a commercial service then users have an expectation that the data is up to date, correct and deep. The alternative is an open platform, where users and other blogs are part of it - the argument that when Wikipedia has poor information users don't blame Wikipedia, they roll their sleeves up and fix it themselves. That was at the core of Crunchbase - not commercial, owned by users, therefor we wouldn't have to make the tradeoff of 'owning' it completely and having to invest extensively to keep the quality at a level expected of a full commercial service (although we did have almost a dozen people working on Crunchbase).

I don't think AOL have thought that through in the same way. You can't on one hand take advantage of the openness of user contributions, not keep the quality up with investment but at the same time expect to protect it as a commercial service. The only commercial ideas we had for Crunchbase were as additions, eg. custom reporting, research, etc. By design the platform was open, free, forkable and insulated from commercial acquisition.

That philosophy just came about naturally because of the group of people involved. There was a little skepticism, but it didn't take long for everybody to start throwing out ideas on making and keeping things as open as possible. It shouldn't surprise us that with an entirely new group of people (bar one, IIRC) and a new corporate parent that parts of it might be altered, but in reading Matt's response I can see that 95% of what was in place is still there, they were just caught out and mishandled this one case. Very strange to see now that Techcrunch and the EFF are on opposite sides of an argument, I hope they clear it up. We used to monitor implementations[0] and send an email requesting a link back or a logo, never had a problem with it - it definitely never reached the point where a lawyer would be drafting a C&D. I don't think we ever reached the point of having a clone or API user that we didn't get a along with.

[0] We setup a number of Crunchbase records that served as canaries - <USER2> company names (on domains we registered) that were only in Crunchbase. If we find those company names anywhere online, it would be a hint that somebody took the data. If they didn't cite the source, we would email them, and in almost all cases it was resolved amicably. We wanted nothing more than to enforce the 'attribute' part of CC+A. A big part of the reason why Crunchbase records rank so well in SERP pages (it is usually in the top 5-6 results when searching for a name of a startup) is because of the "free data, but link back" policy. It means crunchbase.com was always the canonical source for Crunchbase data.

</comment></comment></comment><comment><AUTHOR> I think the comments by Matt Kaufman (president of Crunchbase) about the damage that can be caused by "Crunchbase replicas" reflect the knowledge on AOL's part that Crunchbase is a potentially very interesting data asset. And so the reality is that they'll prob revisit rights to Crunchbase, and it'll go from very open to something less so (how far is the question). I would also guess that Crunchbase has a paid subscription offering in the works.

I would also speculate that People+ may be the first "offender" Crunchbase will target. Datafox.co, Mattermark, Inkwire.io might all find themselves in the crosshairs.

This also underscores a common mistake developers make which is creating on someone else's platform where the rules can and will change significantly especially when monetization becomes important. And it seems monetization is on Crunchbase's mind.

Update:

This post on the Crunchbase blog articulates that monetization is coming and that the above "offenders" may be hearing from AOL counsel soon.

[http://info.crunchbase.com/2013/11/05/crunchbase-people- and-...](http://info.crunchbase.com/2013/11/05/crunchbase-people-and-the-eff/)

"CrunchBase must remain open to anyone who wants to contribute, and retrieving that data for non-commercial benefit must remain open as well. That said, to invest in CrunchBase's constant improvement requires building a business around CrunchBase in a way that successfully takes into account our terms of service and our openness."

</comment><comment><USER4> How reliable is Crunchbase, anyway? In my experience, its frequently outdated and incorrect, but I don't search it often.

<comment><USER5> I've used it for a few projects. If you're using it as an only source, keep that caveat in mind, but it's a good starting point.

</comment></comment><comment><USER6> I love Crunchbase but I would have more sympathy for them if their long tail content was given a bit more maintenance love. If your content stagnates, you deserve competition. To be fair this takes effort, but how many young people would knock themselves out for a low paid or unpaid internship there to get this stuff done? It seems more like a lack of caring, although admittedly I'm an ignorant outsider.

</comment><comment><USER7> AOL are used to _doing_ the content exploiting, not being the ones having all the value extracted from their work.

</comment><comment><USER8> I've caught Crunchbase employees blatantly copying and pasting content from AngelList - which is not Creative Commons as far as I'm aware. I'm surprised they're up in arms over this.

<comment><USER5> AngelList is one of CrunchBase's partners, with syndication rights.

</comment></comment><comment><USER9> Sounds like Twitter -- "It's open, contribute all you want, until you want to get all of the data back out; Then you have to pay"</comment>


OpenALPR: Automatic License Plate Recognition Library - <AUTHOR> https://github.com/openalpr/openalpr <comment><USER2> > -c <country_code>, --country <country_code> Country code to identify (either > us for USA or eu for Europe). Default=us

Europe is not a country, it's a continent with multiples countries, each one with its own scheme for creating license plates.

Can't test it right now, but if you look for a Swiss, Belgian and French (old and new) license plate you'll see they have nothing in common.

<comment><USER3> "The common EU format of having a blue section on the extreme left with EU circle of stars and the country code was introduced by Council Regulation (EC) No 2411/98 of 3 November 1998[1] and entered into force on the 11 November 1998."

[https://en.wikipedia.org/wiki/Vehicle_registration_plates_of...](https://en.wikipedia.org/wiki/Vehicle_registration_plates_of_the_European_Union)

Maybe not all countries adopt the EU standard, but it makes sense that there is an "eu" mode.

<comment><USER4> Yes, that are common plates. But there are also special ones. Look at the personalized plates in austria.[https://en.wikipedia.org/wiki/Vehicle_registration_plates_of...](https://en.wikipedia.org/wiki/Vehicle_registration_plates_of_Austria)

<comment><USER3> As an Australian living in Japan all of those plates look remarkably similar. It wouldn't surprise me if all of them were covered under the 'eu' directive.

Of course, my point was simply that there _IS_ an EU rule, and therefore it makes sense to simply have an 'eu' mode that acts upon the rule even if it doesn't cover all EU plates.

<comment><USER4> My experience with other (commercial) NPR is, that it's better to narrow down your expected search results to those countries you are looking for. The whole EU would be too wide...

</comment></comment></comment></comment></comment><comment><USER5> There is a slight issue with this library in that it is "gimped" to one CPU. You can licence a multi-cpu version [http://www.openalpr.com/](http://www.openalpr.com/) but the open source one would be a lot cooler.

<comment><USER6> The license says its AGPLv3. Is there an additional restriction somewhere that prevents one from modifying the code to run on multiple CPUs?

<comment><USER7> No GPL version allows adding such restrictions.

</comment></comment></comment><comment><USER8> What is the best way to integrate this with a camera?

Is there any specific IPTV cam platform?

<comment><USER4> Most cameras offer a HTTP interface to acquire images. You can feed those to the LPR. Some LPR stacks offer recognition of license plates directly from video streams (MJPG, H.264).

</comment></comment><comment><USER9> It missed a G on my test image.

A very interesting project nonetheless.

</comment><comment><USER10> How does this work internally. Its not using a neural net is it?</comment>


How I learned to become a failure - <AUTHOR> https://medium.com/lets-make-things-1/f140cda815eb

<comment><USER2> A really easy way to get clients okay with the iterative failure model is to charge a fixed price. This takes the "hourly" nuance out of the deal and allows you to make the rapid failures with a much smaller "rolling eyes" client.

Of course, adapting this model puts more risk on you as the designer - however, if you get good at it, you can finish projects in a much smaller time frame and technically skyrocket your "hourly" rate.

This is how I would always approach clients - 1 price to get want you want, fuck ups are on me. And the reason I would word it like that is for one very PRIME reason:

Most clients don't understand the value of the iterative failure.

</comment><comment><USER3> "What designers need more than anything is an environment where it's safe to try things out."

Yep, except when you're a consultant/contractor/freelance. You can certainly spend the time, just don't expect to be compensated for it.

And therein lies the rub -- anyone willing to allow a designer to work in such a manner cares about design, and quite often isn't interested in outsourcing that to the lone-wolf. They may do that with a firm, or have their own in- house talent, but rare is the situation where a client is willing to accommodate perpetual iteration from a contractor while burning hours.

<comment><USER4> I also think that such consultant/contractor/freelancer is a rare find. Most I have crossed paths with are only focused on doing exactly what they are paid for. Very few ever go the extra mile. That's why I never have a problem getting work. My aim is to always do something extra. Even if its documenting the project properly (something that few ever do). I have only worked with a company that lets me go the extra mile. The one I'm currently at.

</comment></comment><comment><USER5> Like others have said, this is why I moved away from hourly rates and into project pricing. Taking the Clock off the table and being realistic about expectations has allowed for more freedom and experimentation.

*edit for a sloppy typo

<comment><USER6> In my experience if you sell it right people are fine with hourly pricing and an iterative model. "Quit whenever you want, we deliver usefully every time we bill you"

They want to see change as it happens, and eventually have that 'aha' moment where they realize they'd never have gotten from here to there if they hadn't gone through the middle part.</comment></comment>


Emacs and Common Lisp - <AUTHOR> http://tromey.com/blog/?p=709 <comment><USER2> Richard Stallman didn't want to use Common Lisp when he wrote GNU Emacs. The work on the Common Lisp definition started in 1982 and CLtL1 was released in 1984. Stallman started his work in 1984. Richard also knew the Emacs variant on the Lisp Machine. He did not want lexical binding (Common Lisp), he did not want object-oriented programming (Flavors on the Lisp Machine, later CLOS in Common Lisp) and he wanted a simple Lisp dialect based on Maclisp. He did not want to have a more modern Lisp dialect based on Maclisp, like Lisp Machine Lisp or Common Lisp.

There is a long standing advice, not to use the CL extension of Emacs Lisp.

The GNU project at one point wanted to settle on Guile/Scheme as its extension language - there was some talk to use it in Emacs - but it never really happened.

There was also a long discussion about using Common Lisp - it never happened.

What now happens is that Emacs Lisp gets changed a bit - for example by providing real lexical binding.

If the GNU Emacs project would use Common Lisp, the nature of the extension language changes. Less painful would be to use a Common Lisp variant with the feature set of CLtL1 + threads. ANSI CL with CLOS is a different thing.

Of all the many variants of Emacs (for example Hemlock in Common Lisp, CLimacs in Common Lisp, ...) none has the feature set and the multitude of extensions like GNU Emacs.

Still, multi-tasking in GNU Emacs would be useful...

</comment><comment><USER3> Previous discussion: <http://news.ycombinator.com/item?id=3433424>

<comment><USER4> Also relevant is this argument that a language with dynamic binding is well- suited to editor extensions.

<http://news.ycombinator.com/item?id=3279258>

</comment></comment><comment><USER5> The most interesting part is the discussion about Guile vs CL for GNU Emacs in the comments.

</comment><comment><USER6> I don't understand the performance argument. The core editing facilities of Emacs are written in C and I doubt how CL or Guile could outperform this. Maybe my perception of the work-distribution in Emacs is skewed: Is most of the work done in the core editing facilities or in the higher level elisp modules?

Some questions that remain: Is old elisp code going to benefit from a rebased Emacs: Is it going to be faster or maybe even slower? How should the longterm plan look? Is everybody supposed to port existing code to CL at some point or is old code going to be supported indefinitely?

<comment><USER2> Editing is a part of GNU Emacs. But it is also a Mail, News, whatever client. It comes with a million lines of Lisp code.

<comment><USER6> I'm perfectly aware of that. But a lot of that code ends up shuffling and moving stuff around in buffers and that ends up as work in the C modules. I don't think the distribution of work is as obvious as you make it sound but I'm prone to believe it. As I said: I'm unsure, if my assumptions are true.

</comment></comment></comment><comment><USER7> I would like to hear about the actual problems in the Elisp runtime. Does anyone remember a reference to an article that details the implementation of Elisp in more depth?

</comment><comment><USER8> I don't know LISP well enough to ponder how portable all the existing elisp code base would be portable to CL. Imho this could be the deciding factor between a permanent shift for emacs or a mere fork.

<comment><USER9> It's not portable. A compiler would have to be written, and it would not produce human-editable output. Emacs Lisp will be around forever, but that doesn't mean that it needs to run slowly or be the _only_ language with which to extend Emacs. (This is a Python 2 / Python 3 type of situation. Some programs can be automatically translated, but nobody really wants to maintain the result. A proper Python 3 port is the correct solution, using the automatic translation as the basis.)</comment></comment>


Stat of the week: 64% don't receive frequent recognition at work - <AUTHOR> http://blog.rypple.com/2010/10/64-dont-receive-frequent-recognition-at-work/

<comment><USER2> My first position during high school (1.5 yr fast food), only recieved feedback during promotions. Jumped to the Marines and recieved a mega-ton of feedback. Fastforward to now, I've been in my current technology position for a year-and-a-half and the only time I heard feedback for my work was when a promotion came. I recently took on some telecommute contract work saving a product from failure and I receieved quite a bit of positive feedback (phone have something to do with it?).

So yeah, sounds about right. I would attribute it to a lot of people in leadership positions not really having training as to the processes of actual leading people. They may know how to make a phenominal gantt chart, but most of all flounder when it comes to maintaining interpersonal relationships.

The bottom line is that you have direct influence into a persons attitude, good or bad. If you completely lash out against somebody, that will produce negative results. If you praise and talk about what you liked about something, that will be a motivational nudge. Find a good middle ground where you can provide feedback both good/bad for somebody. Feedback is hugely important otherwise the person is just lost/assuming their own way.

</comment><comment><USER3> Even worse, many manager-types tend to be hands-off when everything is going well but are quick to seize upon failures or shortcomings as they come up. This has the unfortunate side effect of encouraging employees to keep a low profile and not pursue anything risky or innovative. As innovation goes out the window, the company stagnates.

I've had too many managers go this route, which is why I always make a point to stop by coworkers' cubicles and thank them for their help or work on different projects.

<comment><USER4> I agree. In my experience there has been far too much emphasis on the negative, whilst taking the positive for granted.

Very interesting to note that praise and recognition are better motivators than financial incentives. Obvious once you think of it, but easy to lose sight of.

</comment></comment><comment><USER5> One of the biggest surprises about doing a startup is that there's no one whose job it is to be impressed if you work hard. I vaguely suspect that humans weren't designed for that, which is part of why startups are so stressful.

<comment><USER6> "I vaguely suspect that humans weren't designed for that"

I agree. People are quick to praise children for advancing in life, but care little for adults doing the same. The history of humanity is worrying more about your own fight for survival rather than praising other adults for theirs.

</comment></comment><comment><USER7> I feel good if the card reader at the door recognizes me!

</comment><comment><USER8> What time are YC apps due?

First thing that comes to mind reading this: _this could totally be a fairly easy but popular startup_

Base it on email to make it Posterous-easy. firstname.lastname@example.com sends an email to firstname.lastname@example.com and says "email@example.com did an aweosome job on her TPS reports. She rocks!" ... manager approves, praise can be redeemed for cash/products/paid vacation days ... morale goes up, retention goes up, productivity goes up. hr costs go down.

profit.

<comment><USER9> I don't think this would work too well. For me at least, praise in the form of small gifts is not that worthwhile. I would much rather get honest direct feedback in the form of a conversation than an email with a link to 20 dollars of at applebees. (I mean the giftcard would be nice but it would feel belittling without the personal interaction)

I think there's a joel spolsky article on inc.com about this, intrinsic vs. Extrinsic motivation.

<comment><USER8> Gifts aren't the end-game in my mind–sorry if I gave that impression.

I think the value is simply knowing that other people notice your work, trickling that praise up to management, and making it super-simple to submit such praise.

It would still be up to managers to look at the praise and do the right thing after.

<comment><USER9> yeah, ok.

However, if thats the case then it already is super simple to submit the praise...walk over to their desk/call them/ping them/email them...

<comment><USER10> But your super simple methods fail to further a culture of feedback. If there is a central place where all employees can see positive feedback given to each other, it encourages everyone to continue giving this short notes of encouragement/thanks which keeps morales high (hopefully).

I'm not sure if having a central repository of feedback is really what callmeed was getting at but it's what I've built with my small app so this was my line of thinking.

</comment></comment></comment></comment></comment><comment><USER11> A cliche says that getting recognition at work is more about the attitude rather than the work; but in my experience it is a mix of both. If the quality of work is good and you have let people know that you know that your work is good, recognition is not going anywhere. Unless people know that you totally respect yourself, they treat you like no-one.

</comment><comment><USER12> The original statistic was "36% of employees _frequently_ receive recognition at work". This does not mean the remaining 64% do not receive recognition. Furthermore, both the original report (Tower Watson), and this blog (Rypple), are incentivized to report the sicknesses of the workplace, as they happily sell the cures.

</comment><comment><USER13> I think 64% is a low number and a lot of people imagine that vague assurances are actually recognition.

I further think that this leads to the company not receiving feedback from it's staff except for the ultimate: quitting. So you have staff who don't want to talk about how you could make things better, who don't want to innovate, who don't rock the boat, and who then leave because you don't seem open to communication.

And in the worst example, the company then explains away their absence via a "Well, THEY didn't have the right Culture, did they?"

</comment><comment><USER14> I think this statistic is neither surprising nor problematic. Would you really expect more than 36% of the workforce to be frequently deserving of recognition? The job of management is not to give lip-service praise to all their employees.

<comment><USER15> I disagree -- if an employee is providing an indispensable contribution to the company, you need to be recognizing and praising them, or sooner or later they are going to stop contributing at a high level or jump to another opportunity.

And if an employee isn't providing an indispensable contribution, why are you still employing them? If _64%_ of your workforce isn't providing any value worth recognizing, your workforce is far too large.

</comment></comment><comment><USER16> This article received (10/19 9PM) 9/11 positive feedback comments (agreement/extrapolation etc).

Thats 81% - ahead of the curve!

</comment><comment><USER17> I rarely received feedback at previous jobs.

</comment><comment><USER18> Just had this happen yesterday. Spent the last month and a half working on <http://chow.com/tv>. The email that was sent out announcing the launch and the 2nd spot placement in the Google TV Spotlight gallery was "A big thanks to everyone who made this happen on such a tight schedule!" Some caveats, I didn't do the graphics design (two of our awesome designers worked on that) though I provided some early feedback and recommended a couple of changes based on actual implementation. However, I did the layout, operational code, and basically all of the testing. Not angry or anything, but getting a little name-drop would have been nice.</comment>