How Does Facebook Know What's In My Amazon Shopping Cart? - <AUTHOR> http://thecodist.com/article/how_does_facebook_know_what_39_s_in_my_amazon_shopping_cart <comment><USER2> This is called ad retargeting -- the basic premise being that conversion rates are much higher for items the user has actually looked at in the past. Usually it's only supposed to show abandoned purchases, but sometimes it doesn't work and shows you stuff you already bought. I personally feel retargeting to be a bit too intrusive for my tastes but the conversion numbers are excellent, which is why this industry has boomed in recent years. It looks like your browser's incognito mode _can_ be useful for online gift shopping after all!

There are a few companies who do this like Criteo or Adroll, but I believe Amazon is using Triggit [1]. It looks like it's working for them: [http://marketingland.com/triggit-facebook- exchange-36-better...](http://marketingland.com/triggit-facebook- exchange-36-better-than-google-at-converting-retargeted-users-30462)

[1] [http://blog.triggit.com/amazon-chooses- triggit%E2%80%99s-dem...](http://blog.triggit.com/amazon-chooses- triggit%E2%80%99s-demand-side-platform-dsp-technology/)

</comment><comment><USER3> Retargeting typically uses Cookies, the scarier ones are Continuous Targeting, where Metadata is used to track you without cookies, or worse yet straight up user data sharing.

If you are John Smith of 1313 Mockingbird Lane no cookie is needed partners just share info about targeting.

Sometimes it is more general Someone at your IP shopped for an Xbox one, so you get ads for Xbox One. We see this at my office a lot. I shop for something, and the guys in the office start to see ads for it.

Then there is the really scary ones. Your referrer data comes along with a search from Google or where ever, the ad network uses that with your metadata, or user data to know what you searched for, now they store all of those to track where you live based on you doing things like "Near:1313 Mocking bird lane" from Google Maps, and they now have your physical address, (or they get it from somewhere you bought something). Now your paper mail gets "Current Resident" targeted Spam.

Go a step further. Your friend Bob plays Candy Crush on Facebook, the game gets all the friends of Bob and their cities. Using the data from above we now know you are friends with Bob. So we start sending you spam that uses Bob's last name in it, or We just plain send you spam that uses Bob's Full name.

As someone who has managed large online ad campaigns you don't want to know how much information I can buy about you. The NSA is not nearly as Scary as Google with regards to how much they know about you. And Google will sell that stuff to anyone with a big enough budget, with no care as to how we want to use that data.

<comment><USER4> A few key differences between the NSA and Google:

1) Google don't have the ability to take your life or limit your freedom.

2) Google maintains full control of your data. They will serve ads based on very specific criteria, but they're not going to give advertisers an Excel file with names and email addresses. That's bad for business.

<comment><USER5> Yeah, actually they will. It isn't in xls, it is typically in an XML format.

and since google provides the info to the NSA on demand does it matter which of them does the collection?

</comment></comment></comment><comment><USER6> Also, would like to add that Facebook does not know what's in your shopping cart. For all practical purposes, it's just an advert from Amazon (using retargeting).

</comment><comment><USER7> "This could be embarrassing if you ordered a gift for someone who then saw it on the screen."

This happened to me! Luckily the other person didn't realize there was anything special about that ad.

I don't get these ads though - I looked at a product and either decided to get it or not. Why are you still showing it to me? I'm done with that product.

<comment><USER8> Wow! This is unfortunate because that person has now been primed for that gift. If it's a fairly obscure product that it was possible they hadn't heard of, then they may not be as surprised upon receiving it, and either way if they are able to remember they saw it while you were browsing facebook, they may be less convinced of the genuineness of the gift, thinking you just clicked on whatever ad jumped out at you rather than using your creativity to select something.

<comment><USER8> Even worse, if it's an obscure product that suits their taste, there's a chance they could decide to order it after seeing that ad!

</comment></comment></comment><comment><USER9> Ad retargeting. Happens all the time.

[http://www.perfectaudience.com/](http://www.perfectaudience.com/) [http://www.adroll.com/](http://www.adroll.com/)

</comment><comment><USER10> I'd be much less annoyed by this tactic if the retargeted ads didn't gang up on you like a platoon of Belarusian KGB agents.

</comment><comment><USER11> Almost same thing happened with me today morning. I live in India and I was planning to buy a laptop cooler. So I opened homeshop18.com (a popular e-commerce site) and found the desired product there. I added it to the shopping cart. Facebook was open in another tab. Some time later I closed the homeshop18 website and continue to browse the Facebook. Later I found the first advert on the right hand side was exactly the same product on homeshop18 that I had earlier added to the cart.

I use different emails for Facebook and HomeShop18 website. So I guess this creepy thing has something to do with the Facebook's cookies. I think FB's cookies keep track of the other websites that we visit.

Anyway, I've decided to use "Self-Destructing cookies" addon on Firefox and remind myself to close facebook before opening any other website.

</comment><comment><USER12> A more recent trend is to use several points of data assumed to be unique to a user, in place of cookies. Your IP address, browser, UserAgent string, screen dimensions, fonts, other factors, when combined together via simple hashing, usually provide a unique identifier. This unique identifier can now be stored at a data provider and a profile can be built against you. This approach breaks down when there are people are sharing the same computer, browse from offices with similarly configured machines, or even upgrade their system. But it's still very valuable information, and with so much money in play it'll only get more sophisticated. [http://www.bluekai.com/audience-data- marketplace.php](http://www.bluekai.com/audience-data-marketplace.php)

</comment><comment><USER13> Are people seriously unaware of this? Retargeting is so common it's like posting about Google adding ads to your search results.

<comment><USER14> The poster seems to be asking how it's possible technically, i.e. how it's implemented.

</comment></comment><comment><USER15> That creepy thing is called "ads retargeting".

</comment><comment><USER16> Although this does sound like a case of ad retargeting (as a number of other commentators have mentioned), it's worth being aware of the 'data brokerage' industry, which may or may not become more closely linked with advertising in the future.

Essentially, with so many institutions collecting and storing (even fairly anonymous) profile/intent data (browsed this page, purchased these items), there's an ability and motivation to have back-channels between data-driven advertisers; buying and selling user data to inform each other's targeting.

Retargeting pushes the user experience in this direction while being arguably more benign; it is a little more transparent and simple to understand than data sharing.

<comment><USER17> This actually goes much further than you realize. There are companies buying credit card purchase data and plugging it into a Data Management Platform along with billions of data points a day and using that to buy their ad inventory from the real time ad exchanges. Were talking about mapping a purchase in a store back to a banner ad impression online.

I know of atleast one company actively doing this, and I am sure there are hundreds others.

<comment><USER16> Thanks Dave - I didn't know the function of a DMP (or the acronym), so that's an interesting thing to learn about. Sounds like there are some real-time data auction houses for advert targeting as well, which is interesting.

I expect the volumes and retention of this kind of data are fairly unregulated at the moment? I certainly haven't heard anything consistent as a consumer about how this data is collected/used (also bearing in mind international considerations in many cases)

</comment></comment></comment><comment><USER18> This might also be custom audience targeting. [https://developers.facebook.com/docs/reference/ads- api/custo...](https://developers.facebook.com/docs/reference/ads-api/custom- audience-targeting/)

</comment><comment><USER19> My guess is retargeting via AdRoll or something that Facebook uses for their ads platform.

</comment><comment><USER20> Before anyone grabs their pitchforks and condemns ad-retargetng, the question has to be asked. How much did the OP pay to use Facebook as a social platform? With that said...

There is nothing nefarious here. This is standard internet marketing efforts.

<comment><USER21> OP wasn't neccesarily suggestiong anything nefarious, but was curious about the technical details of how this is done -- as are many of us.

Can anyone give a basic technical explanation of how ad retargetting works, of how the information on what you looked at on Amazon makes it to wherever it is that controls what ads you see on facebook?

<comment><USER22> Basically it works like this:

On amazon up they put an image or other code on their page that generates a random id and stores it in a cookie.

When you're on Facebook the id is passed back to Amazon which can generate an ad based on your history.

It works because the resource loaded on fb and amazon originates from the same domain. Eg. 3rdpartyretargettingadnetwork.com

<comment><USER23> For more detailed information: [https://developers.facebook.com/docs/reference/ads- api/rtb/#...](https://developers.facebook.com/docs/reference/ads- api/rtb/#cookie_matching)

<comment><USER21> thank you, this is super interesting.

</comment></comment></comment></comment></comment><comment><USER24> I'm more surprised that after all this time the poster only now notices retargeting ads. The web is littered with them. This one is running on Facebook's own exchange.

</comment><comment><USER25> This is exactly why I buy my gifts using an incognito window for researching gifts. Otherwise I'd go to Facebook or Fark and the sidebar would have exactly what I was looking at.

</comment><comment><USER26> [http://en.wikipedia.org/wiki/Behavioral_retargeting](http://en.wikipedia.org/wiki/Behavioral_retargeting)

</comment><comment><USER27> This smells like it would be illegal in the EU. I have no idea about ads because I AdBlock... does anyone see this technique used in the EU?

<comment><USER28> google does it a lot. Try visiting the adwords page for your local google franchise and you'll be getting ads for a 100€ coupon at 25€ everywhere.

</comment></comment><comment><USER29> if you click on the x in the top right corner of the ad, theres an about this ad link that will give you details on who generated that advertisement.

[http://www.mikeonads.com/2010/02/22/rtb-part-iii-cookies- use...](http://www.mikeonads.com/2010/02/22/rtb-part-iii-cookies-user-data/) this describes roughly how they identify you.

</comment><comment><USER30> I was wondering the exact same thing today</comment>


Hello WebXR a VR Demo from Mozilla to Celebrate the WebXR 1.0 Spec - <AUTHOR> https://mixedreality.mozilla.org/hello-webxr/ <comment><USER2> Our team made it. Ask us anything.</comment>


Fox News Gets Hacked - <AUTHOR> http://i.imgur.com/Uc0oN2p.png

<comment><USER2> Looks a lot more like dummy text making it to prod.</comment>


Y Combinator-backed Humble Bundle sells $1.8M worth of indie games - <AUTHOR> http://venturebeat.com/2010/12/27/humble-bundle-sale-ends/ <comment><USER2> I'm a big fan and modest (but above-average! :D ) supporter of these Humble Bundles, but it's hard for me to imagine that the potential upside on this is big enough to warrant a YC investment.

I suppose time will tell; either way I'll be happy to see the next bundle.

<comment><USER3> If you can sell more than a million dollars of digital goods _twice_ , I like your chances at finding a scalable model. The solution space is multidimensional but I think lots of the options in it win. (e.g. Dump the tip, charge developers 30%, do it weekly, optimize aggressively, etc.)

<comment><USER4> I disagree, this is more milliondollarhomepage than anything else. Sure, they could make money like the way Steam do (<http://store.steampowered.com>) but not with this specific model. There is legs in the bundle model, but I don't think it requires any investment... it's a 0 capital start up, they've made their name so when they approach other indie developers they can work based on their name alone.

I would however seriously hope they don't do what you're suggesting (weekly) the idea has very limited usage, there are a finite number of games out there and a finite amount of interest, this works based on the publicity ("Viral marketing") and not just the idea. Take a look at appsumo for an idea, their bundles are crap now (compared to what I as an "early adopter" got accustomed to) and most lost interest.

This is not an idea to milk.

<comment><USER5> Time will tell either way. I suspect the end result of this will be different then either of you have envisioned. All that can be said today is that the experiment is by any measure reasonably successful and there is potential there to go bigger in some capacity.

</comment></comment></comment></comment><comment><USER6> I'm kinda surprised to see that $5,555.55 anonymous contribution. 4chan comments aside, I guess it's just someone feeling generous? I know that the purchaser can indicate the amount to go to charity, but I'm under the impression that this is not tax deductible. Can anyone confirm this?

Edit (added): Thinking more on this, I wonder if the Humble Bundle folks actually get the tax benefit of the donations.

<comment><USER7> They have/had a 'top donators' box on the donation page. I saw one entry that was #1 for at least a little while of $1,000, and it was advertisement. I thought that was pretty clever, and generally beneficial for everyone.

<comment><USER8> Thanks :)

We got quite a few customers from that, plus donations to good causes, and some game developers.

Thanks, Ben (Site5)

</comment></comment></comment><comment><USER9> It was awesome to see indie games getting into the hands of people who they usually wouldn't appeal to.

The best thing though was to see those like Notch and others give back to the community that gave so much to them.

</comment><comment><USER10> Cool to see Riot Games dev team as a top contributor. We built some multiplayer technology for their League of Legends game back in 06-07 when it was called something else and deep in pre-alpha development. Our company went bankrupt but it was a great learning experience and our influence remains in the production release.

</comment><comment><USER11> Um, what? Since when was Wolfire games, the guys behind the humble indie bundle, backed by Y-combinator? This is the first time I've ever heard of this association.

</comment><comment><USER12> Anyone know how they drove so much traffic toward their bundle? Did they have partners that took a revenue share?

<comment><USER13> It's an interesting idea and a good deal with a charity angle; it got coverage on blogs and forums, and spread around like links do.

<comment><USER14> Penny Arcade talked about it several times since one of the charities was Child's Play. That targeted traffic is worth it's weight in gold.

<comment><USER15> Very true! I know this for a fact: [http://blog.aisleten.com/2009/01/28/linked-from-penny- arcade...](http://blog.aisleten.com/2009/01/28/linked-from-penny-arcade-pa- day-2009/)

</comment></comment></comment></comment><comment><USER16> Disruption does not always have to be a new technology, it can also be a new business model. Fantastic.

</comment><comment><USER17> Why did someone pay 6k for this? Or am I reading the page wrong?</comment>


Chrome limits off-store extension installs - <AUTHOR> https://code.google.com/p/chromium/issues/detail?id=128748 <comment><USER2> I thought I explained the reasoning on the bug, but I can give it another go. Users are being tricked into installing malicious extensions, and thus getting compromised in significant numbers (Facebook "like" selling is a major target). We have continuously improving measures in the WebStore to catch malicious extensions, and the volume there is very low. However, we don't have a way of catching malicious off-store extensions. So, the best solution is to disallow other sources by default, and provide technically inclined users and enterprise administrators with the ability to add trusted sources.

This is basically the same model that every Linux distro uses, so I'm not sure what the complaints are about. I'm also surprised Firefox hasn't proposed something similar, since I'm told they're seeing the same trend.

<comment><USER3> The complaints are about a major change occurring with little warning.

For context, I've spent the last 2 months working on an extension that asks users to install from our site during signup. Making them install through the Web Store will increase confusion (why am I no longer on CoolWebsite.com?) and hurt conversion rates.

<comment><USER2> Chrome has supported inline extension installation for a few versions now: [https://developers.google.com/chrome/web- store/docs/inline_i...](https://developers.google.com/chrome/web- store/docs/inline_installation)

That should address any user confusion, while still hosting the extension in the WebStore. It also saves the hosting bandwidth and guarantees that your extension updates over a pinned SSL channel, which protects your users in case your key is ever compromised.

<comment><USER3> Thank you, I hadn't come across this yet. This should mitigate the changes to the user flow.

</comment></comment></comment></comment><comment><USER4> This nicely illustrates the difference between merely being "open source" (Chromium) and being developed in the open (Firefox). At the very least a decision of this magnitude would have been discussed in the community BEFORE being merged in any sane openly governed project.

<comment><USER2> I don't know why you're claiming this wasn't developed openly. The bugs are all public (the first was filed ~2 years ago); the code is checked into the public tree and has been enabled on canary for almost a month. It wasn't a heavy-handed or rash change, and the impact on both users and developers is minimal.

<comment><USER5> For those of us that have already-deployed off-store extensions in the wild, what options do we have for migrating our users to the new, Webstore-powered versions? Or will their extensions just silently stop updating (or, worse, working altogether)? If it's the latter, your claim that this change will have minimal impact on developers and users is patently false, since you'll be breaking currently-released and -deployed applications that used to work and met the previously-documented requirements, with no warning whatsoever. Further, the suggestion that this is justified because it was committed to a public repository is absurd: are all developers of Chrome applications supposed to follow every single commit to Chromium's repo to ensure that our extensions won't break? What happened to Chrome's supposed immunity to breaking extensions with new releases, which you claimed made your extension model superior to Firefox's?

<comment><USER2> This change adds a few extra steps for an off-store install, unless the user or administrator configures things otherwise. That's it; updates and existing installations aren't affected at all. The details are very clear if you read the discussion or a few of the comments in the bug.

</comment></comment></comment></comment><comment><USER6> This is a pretty big change to bring in without warning. It would be nice if extensions could be signed but not on the store. I have extensions for internal business apps, they make no sense on the store but having a techy installation process is a big hassle. Google could even host the code (and have the ability to revoke), I just want a way to have "private" extensions that only only delivered to who I want.

<comment><USER7> From the discussion: "In order to install off-store extensions, the user must download them to a directory and drag them onto chrome://extensions/.". Is this not a viable solution for your use case?

<comment><USER8> For one thing, this can't be done without a mouse to drag-and-drop with. This limits the extension of off-store extensions to those who can use a mouse, which is an accessibility issue. Are handicapped users or keyboard-only users just thrown to the wayside these days?

<comment><USER7> I was specifically asking about jonknee's use case, I never claimed that this would be an ideal solution for every other possible scenario. That said, your request to have a mouse-free way to install extensions is totally sensible, and I would be surprised and disappointed if they did not think of alternate ways to do that (perhaps using the command-line).

</comment></comment></comment></comment><comment><USER9> I have no issues with the process, but only concerned with the way this change was made. The issue keeps referring to <https://code.google.com/p/chromium/issues/detail?id=55584> for "details", but there is nothing there except statements asserting how much of a "big problem" this is.

I think this is a bigger problem with large open source projects in general where implementors are oblivious to which functionalities developers cherish and value. Any change in such features would require a more thorough explanation.

<comment><AUTHOR> It may be an issue of having multiple channels of communication, and the bug tracker is only one of them.

For example, though I work for Mozilla, I'm not terribly good at keeping up with the mailing lists, so every so often something pops up in Bugzilla (which I read more frequently) that seems to have come out of nowhere.

And of course stuff happens in our IRC channels that never makes it to a bug; same with internal emails. There's a lot of effort involved in making sure your communication is clear and accessible when you have several different modes of it.

<comment><USER9> This is very similar to issues in W3C specifications. I just think a bug tracker should be the primary reference material to track discussions around a specific bug. I wish there was a way to link to IRC channel discussion around this bug and otherwise if possible.

But nevertheless, I think it would be better if implementors summarize discussions outside of the bug tracker into the issue itself.

</comment></comment></comment><comment><USER10> Was there some new law of nature added in the last few years that says as soon as any app platform takes the lead its vendor must begin restricting the distribution channels available to 3rd party developers?

Wouldn't it be awesome if Microsoft and Apple forbade competing walled gardens (such as Chrome) from running apps on their operating systems?

<comment><USER2> What? The only thing changing here is a default configuration value that actually gives users and administrators more control. This isn't like iOS or Windows RT, where you have to download an exploit and void your warranty to install software from a third-party source.

<comment><USER8> If I want to distribute an extension that users want but Google won't allow, such as a pornography browsing extension (disallowed by the CWS policies [1]), there's a HUGE change from an end user's viewpoint. I am FORCED to host it elsewhere.

Installing an extension from the CWS is as simple as clicking the CWS Install button and accepting the security/permissions warning. Currently, installing an extension from a third-party site is as simple as clicking the site's Install button and accepting the security and permissions warnings. To the end user, these are practically the same experience, and only one extension method must be learned.

After this change, the end user will have to learn that extensions are powered by files, that only .crx files are extensions, that a .crx file must be downloaded to install an extension (but only manually if the extension is hosted somewhere other than the CWS), and that they must drag-and-drop a previously downloaded .crx file to a Google Chrome or Chromium tab that has a specific settings page open.

This is confusing, and necessitates that a user learn two different workflows to accomplish the same task from different sources. This turns non-CWS extensions into second-class citizens, and it's not as simple as enabling inline installation [2] if your extension would go against Google's policies.

[1]: [https://developers.google.com/chrome/web- store/program_polic...](https://developers.google.com/chrome/web- store/program_policies)

[2]: [https://developers.google.com/chrome/web- store/docs/inline_i...](https://developers.google.com/chrome/web- store/docs/inline_installation)

<comment><USER11> I don't know that drag and drop will work either. I am working in Canary right now and the drag and drop raises the exact same denial message as the off site install.

</comment></comment></comment></comment><comment><USER12> This change is being made without any buy-in from the community, ostensibly for security reasons. I'm skeptical, given the inherent incentives involved.

</comment><comment><USER13> All the latest malware that I see spreading on facebook came from Chrome extensions. Users don't care, they click and install stuff. Then the extension, which can interact with any page, can spam walls and comments on facebook.

</comment><comment><USER14> Unfortunately Google's policy doesn't cause only malicious extensions to be removed from their web store. For instance, All Mangas Reader, a combined reader and management tool for online manga sites, was removed from the store for "copyright infringement", although it's the sites that are hosting the mangas doing the infringement and not the extension. Additionally, the copyright problem does not apply to all jurisdictions where the store is accessible. ChromedBird, a Twitter client extension, was also removed because Google didn't like that it contained the "chrome" string (at least this problem was easily alleviated by changing the name to SilverBird).

As long as it's still possible to install non-webstore extensions I'll learn to live with that restrictions as it's not an activity I perform often in the first place.

</comment><comment><USER15> I publish an extension, Textcelerator (<https://textcelerator.com>) off-store. This is the first I'm hearing about this, and it would completely the sign-up flow for my extension. (My extension _is_ in the Chrome store, but my landing page doesn't link there.)

Fortunately, it seems this only affects the head versions for now, not the version regular users get on a new install (I just tried it) or an autoupdate, so I have some time to switch links around and make it work. However, I really think there needs to be some sort of deprecation before this is rolled out, probably in the form of a warning on download if Developer mode is enabled, backported to versions 19 and 20.

<comment><USER11> Its mentioned further down in the comments, but if youre on the Chrome Store already, you can use Inline Installation. This allows you to use roughly the same flow you use now.

[https://developers.google.com/chrome/web- store/docs/inline_i...](https://developers.google.com/chrome/web- store/docs/inline_installation)

</comment></comment><comment><USER11> I have an extension on the Chrome Store, but I also distribute it via bundling and bundling requires an executable. For the bundle, I use the registry method found here: [http://code.google.com/chrome/extensions/external_extensions...](http://code.google.com/chrome/extensions/external_extensions.html)

Will this method still work?

I originally had the exe simply open a window to our Chrome store listing, but the friction was ridiculous. We would get about 5 installs for roughly every 100 we were paying for.

</comment><comment><USER16> Yay, another "lets enforce our products to end users" on the cover of "security".

Can't wait for Google to remove the checkbox on every Android for "allow 3rd party software install", cause you know, it has to come from Google Play else it's OMG dangerous, and all the users are dumb and check the checkbox and install random apks. And look there's a nice illusion of choice, you need a procedure so complex that almost no one will be willing to do it (and thus you're forced into Google Play).

For security. /trustworthy.

<comment><USER17> What? This is the _same_ as the Android feature. External installs are blocked by default and the user can change that setting and acknowledge the security risk.

</comment></comment><comment><USER18> I think restricting access in this way will slow the growth of browser extensions/addons as platforms for launching full-fledged web services and apps.

I see more and more web apps relying on extensions for a core part of their functionality, and this is only going to hurt them.

For installing non Web Store extensions, I would rather see an extra warning message or notification, rather than a protracted process that many users wont be able to figure out. Extensions are good, but not if they're hard to install.

</comment><comment><USER19> But what happens if someone complains about my extension and Google decides to pull it from the store?

<comment><USER8> It happened to me. I am the developer of a joke extension [1] that got reported for abuse one too many times, and Google took my developer account off the Web Store, then they sent me an email about it [2], stating that it was breaking a policy that it simply wasn't.

I replied to them explaining the situation [3], and they reinstated my developer account (and that extension) within 4 days [4]. Still, if they had "carefully reviewed" my case and decided against me, I may have had my primary source of income (developing Chrome extensions) taken away from me because of a joke extension.

[1]: [https://chrome.google.com/webstore/detail/gnbchcphjnmbmknnoe...](https://chrome.google.com/webstore/detail/gnbchcphjnmbmknnoefjdfiginagghbk)

[2]: <https://gist.github.com/514ae4d858027303bc95#file_email.txt>

[3]: <https://gist.github.com/514ae4d858027303bc95#file_reply.txt>

[4]: [https://gist.github.com/514ae4d858027303bc95#file_response.t...](https://gist.github.com/514ae4d858027303bc95#file_response.txt)

<comment><USER13> it remembers be about the "I'm rich" iPhone app that was selling for 999 usd. I'm very curious to hear if any user has bought your app.

<comment><USER8> No, nobody has purchased that app. A few people have purchased a $5 recipe app that I made, but nobody has purchased the $999 joke app. If they did, I'd feel really bad and offer them a refund.

</comment></comment></comment></comment><comment><USER20> Such a shame that this appstore mentality is becoming the norm.</comment>


Ask HN: Is there a good dock replacement for OS X? - <AUTHOR> I have been using a mac for years, but the dock has never grown on me. A quick searched turns up UBar. For those who use it, what do you like about it? Did you try any others? <comment><USER2> Just hit "command space" and start typing the application name you want to start. then "return" to start it. I stopped using the doc many years ago to launch. Occasionally its useful for dragging files into an editor or such.

There was an app called "quick silver" [https://qsapp.com](https://qsapp.com) was a similar keyboard launcher.

</comment><comment><USER3> HyperDock. Not really a complete Dock replacement, but it improves Dock functionality where it matters and integrates with macOS seamlessly. Screenshots on their website are quite dated, but it works with macOS Mojave without any problem.

</comment><comment><USER4> What makes the standard one not enough?

<comment><AUTHOR> Icons can be removed from the dock when the window is open.

If windows minimize into their icon and you have more than 1 instance open, then clicking on the icon opens the last instance open. It should give you an option - or better yet duplicate the icon

Generally, it works for launching apps. Not window management.

<comment><USER5> The expose feature is supposed to be used for that. I had a hard time adjusting from Windows for a while, cause I kept going to the dock to do window management. It got a bit better when I started using the three finger swipe up and down (only this app's windows). I still use the dock more than I should due to habit though.</comment></comment></comment>


Soviet Santa - <AUTHOR> https://www.atlasobscura.com/articles/soviet-santa <comment><USER2> Even though we're behind Europe in religiosity and far behind the US, Orthodox Christianity was alive and well here after the fall of the SU, and Christmas and Easter are variously observed. It's rather notable that despite the Bolsheviks' no-nonsense and literal approach to eradicating religion, Christianity and the church have survived the Soviet era pretty well. One reason for this is said to be that in the ramp-up to the Great Patriotic War, the government dropped the anti-religious rhetoric and adopted instead the position of 'unite and defend your motherland and the people'.

Add to this the fact that in the 70s and likely later, people were still migrating from rural villages to the cities, with the whole baggage of inherited religiosity and mishmash of folk beliefs. My grandmother put in plenty of time in prayer each day. Icons or whole arrangements of them are a feature in many homes, cars and sometimes, more rarely, offices. And I still receive messages from my parents each year, commemorating birth and then the resurrection of Christ. Folk culture doesn't tend to follow an official doctrine, as exemplified by troves of Soviet jokes—and is also not big on ideological clarity, so many didn't see a problem in subscribing to both socialism and Christianity, along with crystal healing, magical powers of thought and a bouquet of other fringe beliefs.

In the 90s, my home city already had a bunch of churches including at least one large temple, and one or two monasteries—and I don't think they popped up recently.

Notably also, even Bolsheviks preserved old and unassuming Karelian wooden churches, recognizing them as architectural and cultural monuments—while demolishing some huge temples in Moscow. Like the Kondopoga church, built in 1774 and which somebody burned down in August of 2018: [https://commons.wikimedia.org/wiki/Category:Church_of_the_Do...](https://commons.wikimedia.org/wiki/Category:Church_of_the_Dormition_of_the_Theotokos_\(Kondopoga\))

[https://en.wikipedia.org/wiki/Dormition_Church,_Kondopoga](https://en.wikipedia.org/wiki/Dormition_Church,_Kondopoga)

<comment><USER3> It's just my opinion, but it's not uncommon. I believe Blaise Pascal (the brilliant French mathematician) got it right when he said "There is a God- shaped vacuum in the heart of each man which cannot be satisfied by any created thing....."

For this reason, I doubt religion will ever die. It will be with us always.

<comment><USER4> I'd wager that most atheists assume that God is very much a "created thing", which makes that quote feel pretty awkward.

<comment><USER2> I vaguely heard some theories that in the absence of better explanations, humans gravitate to attributing weird phenomenons to divine will. Not sure if this is in any way scientific. Inventing forest spirits seems to come pretty naturally by anthropomorphizing a variety of things, but I guess it gets complicated when dealing with lightning and such, and the deities evolve accordingly.

Afaik neuroscience also can induce 'divine' experience by applying current in a proper place.

</comment></comment></comment></comment><comment><USER5> As a Russian, can confirm this article is quite accurate - my family only ever celebrates New Years, it's the same as Christmas is usually in the West, and Ded Moroz is totally a thing.

<comment><USER6> How do you pronounce Ded Moroz in an anglophone way? I noticed you used "Dez" instead of Ded.

<comment><USER7> That's a typo.

The pronunciation is close to "dee-yet mah-ross"

<comment><USER8> Yep, we called him "Dedek Mraz" in the balkans which also literaly translates into Grandfather Frost.

(Although we did celebrate christmas since the anti-religion clampdown wasn't that aggressive in Yugoslavia.)

<comment><USER9> Mraz, sounds like мразь, not a very good word :))

<comment><USER10> The word literally means "something that causes chills" so it's not that different from slavic "mraz". It just had been used exclusively in a figurative meaning to describe something that is so disgusting that it makes one shake.

</comment></comment></comment></comment></comment></comment><comment><USER11> Correct artice and being from ex communist country even after more than 25 years I certainly have issues celebrating christmas. "They were able to celebrate Christmas, but they had never done it before." most resonates with me. Makes me realize the importance of traditions and how fragile they are.

<comment><USER12> You do? We (Russian Americans in the US) celebrate two Christmases and two New Years, both by the "new" calendar (Dec 25/Jan 1) and by the old (Jan 7 Christmas, Jan 13 "Old" New Year). Because, as they say in Russia, "there's no reason not to drink".

<comment><USER13> Serbians also still celebrate Christmas and New Years according to the old Julian calendar. In a few thousand years they really will have Christmas in July.

<comment><USER14> It moves 3 days forward versus the Gregorian calendar every 400 years. So about 24,000 years (a little less) to hit July

<comment><USER15> Think positive: it's just another reason to drink in July in 400 years.

<comment><USER12> It shows that you're not an Eastern European. There they need a reason to stay sober. Drinking is the natural state, hence the lower life expectancy.

</comment></comment></comment></comment></comment></comment><comment><USER16> We also had "Ded Moroz" in communist Romania, translated to "Moș Gerilă".

It was imported due to the soviet occupation after WWII and the subsequent adoption of communism. The word Christmas was censored in 1948. In the 80s our beloved supreme leader wanted to associate those presents with the state instead of Moș Gerilă, so things got a little weird with the state propaganda.

After the revolution in 1989 we changed the holiday to the Christmas in the Gregorian calendar and Santa Claus, translated as "Moș Crăciun" (Father Christmas).

</comment><comment><USER17> We still don't know who was Ded Moroz's son or daughter though.

<comment><USER9> Снегурочка. But she is probably granddaughter

<comment><USER18> Shes not related to Ded Moroz. If anything shes depicted as his wife

<comment><USER9> Wtf, she is always with him on performances and helping him. And check wiki, she is his granddaughter. She is too young relatively to him))

</comment></comment></comment></comment><comment><USER19> > Santa Claus is one of several manifestations of a particular wintertime > character, probably originating with the pagan, pre-Christian Germanic and > Norse god Odin.

No, 'Santa Slaus' is a distortion of st. nicholas, to which people may or may not have ascribed characteristics of previous 'wintertime characters', as attested to by the further examples of: Sinterklaas, Mikulás, which are both actually not distinct entities, but both 'St Nicholas' in their respective languages. One can make some anthropological case that these are 'manifestations', but in the case of 'Santa Klaus', the core 'identity' is still a 'nicholas figure' to which people may or may not have ascribed other attributes. Lineage and conceptual transactions are important here, esp. since this makes a less appealing narrative to spin, when one is trying to downplay the second-ranked feast day in the official state religion of an empire that viewed itself as the direct and legitimate successor of imperial christian rome.

e.g:

"It wasn't really a festival exactly, but more of a somber religious holiday marked by fasting and long church services in Old Church Slavonic"

This is what feast days (aka 'festivals') _are_ in orthodoxy. Followed by a 'feast'. So yes, it was a festival, "exactly".

Christmas was a major day of important significance in imperial russia, and Fr. Frost was directly promoted as a secular replacement for St. Nicholas, because soviet-style communists are militantly athiest and hostilly anti- religion. The very fact that this figure exists is a testimonial to the need to provide a 'foil' for the people to accept his removal, rather than just some casual 'cultural shift' to a different 'winter character manifestation'.

As for people 'forgetting how to celebrate christmas' during soviet times, please recall (whether positively or negatively) that Mr. Putin's mother had him baptized in secret from his communist father and he makes pilgrimages to monasteries regularly. The current high place of the church in russian society did not just originate in some ideological vaccum, many never gave up in the face of overt and militant religious hostility.

</comment><comment><USER20> I live in Poland. Before 89 when my country was occupied by Russia, "Soviet Santa" was forced here to replace Santa Clous. It was one of many things that was made to erase Christianity and replace it with atheism and communism. Fake Christmas, fake Santa, zero beliefs. I was young back than but i felt its shallow and dark. So for me Soviet Santa is a symbol of the occupation and Russian tyrrany Poland was under until 89...

<comment> c-smile Could you elaborate on "Poland was occupied by Russia"?

Let's put alone that in 89 it was USSR so Russia, Ukraine, Belorussia, etc. all together.

In any case there were no Russian troops stationed in Poland. Quite opposite, Poland and its army was one of leading members of Warsaw Pact (the name, sic!).

So what does "occupation" mean in your statement?

<comment><USER19> Not OP, but see Hungary '56 and Czechoslovakia '68 for what happens to 'leading warsaw pact members' who decide they want to deviate from the soviet party line.

<comment><USER21> Yes, we should be so sad that fascist uprisings threatening to exterminate the poor, disabled and non-native were instead defeated with help from friendly socialist countries.

Not all protests, uprisings and revolutions are good. Look at their class character and composition.

<comment><USER19> a) Thread context was communist poland being a vassal of the USSR, whose policy was subordinate to the CPSU. These examples highlight that policy was not in fact independent in these countries, and, when significant deviation occured, soviet military invasion was a consequence. Whether the uprisings / deviations are good or bad is secondary to this point.

b) As for 'facism': show me the 'facism' in the key documents:

HU: [https://en.wikipedia.org/wiki/Demands_of_Hungarian_Revolutio...](https://en.wikipedia.org/wiki/Demands_of_Hungarian_Revolutionaries_of_1956)

CS: [https://en.wikipedia.org/wiki/Socialism_with_a_human_face](https://en.wikipedia.org/wiki/Socialism_with_a_human_face)

(yes, wikipedia scholarship, better sources welcome)

while I have no doubt that facists would piggy-back on to any anti-communist movement to seize a moment of opportunity, framing either of these as 'facist' at their core is at best poor analysis. Even hard-core bolsheviks would differentiate betwean 'bourgeois-democratic reactionaries' and 'facists' since being clear in distinction is necessary for proper argument/strategy.

</comment></comment></comment></comment></comment><comment><USER22> Gosh, this website is one of the worst cookie consent implementation with the oath familly...</comment>


Ask HN: Review my new e-commerce model: self-serve group discounts - <AUTHOR>

Dear HN,
Today, I'm launching "Buckits", a new e-commerce business model that I think you'll find interesting.  Hoping to get some feedback on the concept side and on the business / implementation side.  (Also trying to figure out how to best explain this concept to less-technical viewers!)
We are launching a new e-commerce model where groups of customers can pool together to receive discounts.  A "Buckit" takes the simple idea of a group discount and augments it for the modern Web.  Anyone can create a Buckit, or join one that already exists. The more people who sign up for a Buckit, the less everyone pays for his or her own item. The final price each Buckit member pays for their itemis based on the number of people in the Buckit, and the amount keeps going down as more people join.  This model lets people take advantage of their social networks (online and offline) to spread the word about a cool product and save money at the same time.
NerdKits is launching this today and applying this to the educational kits we've sold online since 2007, but we're also interested in applying the concept to other e-commerce areas where there's a "social or network utility" to a product: event tickets, multiplayer video games, etc.
For more information, we have a 2-minute video demo:
http://www.youtube.com/watch?v=B4vVhaUj8r0
Our live website:
http://www.nerdkits.com/buckits/
Plus this morning's press release with more details:
http://www.prweb.com/releases/2010/02/prweb3632034.htm <comment><USER2> I understand where it can become a bit cumbersome to explain to non techies. I would agree with the point above that the explanation does not to be as overblown as it is. Just get the key concept out: 1) Want to buy something, but pay less? 2) Invite your friends and if a few of you buy it, everyone will save.

The specific dynamics of how things work do not need to be in the pitch. Good luck!

P.S. I've been working on something in this space. Coming at it from a different angle, though. Hopefully I will be able to have something to show in the next couple of months.

</comment><comment><USER3> Yeah, I get it. Personally, I am an avid skier, and I'd love to use this product to get together with fellow skiers/snowboarders and take advantage of existing steep discounts in group lift tickets.

</comment><comment><USER4> I've seen this trend popping up a lot lately. Pooling buying power among individuals to get discounts _up_ the supply chain. It makes great sense.

I think there is a lot of potential here because it is only at a certain scale that some ideas become profitable or even implementable. In the old days, some investors got together and created companies at great risk in order to see if there is a market for a product.

Taking these group buying systems to one more level, people who _want_ a particular product can pool their resources in order to get the product _developed_. I don't think Venture Capital sees the threat from models like this.

Imagine the CNC market that is getting a lot of buzz for enabling them to be built at home. If you create a company where when 100 CNC products are ordered, then everyone is charged, ALL the parts are ordered and constructed, perhaps in part by one such already existing CNC -- _created_ just this way.

This model enables the consumer of the product to be the _investor_ in the product. Models like this eliminate the need for venture capital in a lot of spaces with currently large barriers to entry.

EDIT: Yep, here's another example, right on the front page of HN. <http://news.ycombinator.com/item?id=1149207>

<comment><AUTHOR> We're taking a slightly different angle, in that the individual customers each have a better experience with the product when it's done together.

What you're mentioning, in terms of pooling resources toward getting a product developed, is also a really neat application. But it adds another layer of uncertainty (i.e. can the developer actually deliver on what's being promised?), so we're starting out with a product that exists and already extremely well-received by its target audience, and applying the model there. If we can prove that consumers understand the model for an already-existing product, then we (or others) can push into the not-yet-developed product area.

</comment></comment><comment><USER5> This idea is very useful for shop owners too. We have realised not the customers are coming to your shop anymore but you'll have to go to their space (like Facebook)

Future is about customer driven shops: they define what they want at what price they want. Shops will be the clients of these groups serving them with lower margins at highest quality.

So the question of the business model shifts to shop owners how they can afford to operate in such (hostile) environment

</comment><comment><AUTHOR> 2-minute video demo: <http://www.youtube.com/watch?v=B4vVhaUj8r0>

Our live website: <http://www.nerdkits.com/buckits/>

Plus this morning's press release with more details: <http://www.prweb.com/releases/2010/02/prweb3632034.htm>

</comment><comment><USER6> Group buys happen a lot of the (Audi) Quattro World forums for example.

A member comes up with an idea, runs it past a vendor, and posts a notice - say, group buy for 10 sets of wheels. People respond by placing pre-orders with the vendor. Once the minimum is reached they turn into orders at the pre- arranged discount and shipped out.

Could even be a generic service to facilitate these kinds of deals through arbitrary small vendors.

</comment><comment><USER7> Some people might remember letsbuyit.com from the late nineties and early noughties. If I remember correctly it had the exact same idea. The site seems to be still up with the same brand, but it seems to have become some sort of "shopping community" without the group buying feature. You might want to find out what happened to them.

</comment><comment><USER8> It's a nice and simple enough idea that has a chance at doing well. The girl in the video is talking way too fast. I know there's a lot of content but the idea is simple enough that she does not need to blow through everything.

<comment><AUTHOR> Thanks, glad to know that it's an understandable idea. We did have a 2-minute time limit on the video (per PayPal's rules for the developer competition -- see <https://www.x.com/community/ppx/devchallenge/lp> ). But perhaps it is too fast.</comment></comment>


Back to the front of the pack: Ars reviews Firefox 4 - <AUTHOR> http://arstechnica.com/open-source/reviews/2011/03/ars-reviews-firefox-4.ars <comment><USER2> I love the app tab concept. Just wish the favicon would update and tell me when new mail has arrived.

<comment><USER3> Chrome has had that for over a year (nearly two years?) now.

<comment><USER4> Whenever somebody says that they love something about firefox 4 are you going to reply like that?

Congrats on chrome, but berfore they did it there already was tab mix plus and faviconize extensions which had this concept.

Yeah, everybody copies the good stuff, that's what good about competition. Don't be mean and ironic with useless information on other people's positive comments.

Both are great software, there is no need to fight over and be always looking for the fight

<comment><USER3> It wasn't meant like that. The comment acted as if it was something new, it's not that hard to read it that way. "I hope this takes off" definitely makes it sound as if it's a brand new feature just coming out or something.

It wasn't meant even half as maliciously as you read into it.

</comment></comment></comment></comment><comment><USER5> This update is really very nice. I prefer Chrome over Firefox, but I can't live without Firebug. I know Chrome developer tools are nice and workable but Firebug just seems better to me somehow, may just be familiarity.

I've stuck it out with Firefox for a long time so I could continue using my beloved Firebug, but with this new version instead of feeling tethered to an unwieldy behemoth I feel happy in my browser.

Congrats to the Firefox team.

</comment><comment><USER6> I had to wait until the end of the article to see that FF4 is still one monolithic process. Everything else aside, that means I still have to restart it occasionally to get memory back. And the tab-of-death problem remains.

<comment><USER7> They do have Flash isolated, which has solved my main "tab of death" issue. However, I'm probably not a good example here, because I haven't had FF crash in months, at least. I honestly can't remember when it did last crash, except that the only ones I can think of involved Flash.

</comment></comment><comment><USER8> I've been really happy with Chrome after using Firefox for a long time. I couldn't bear one more Adobe Flash Plugin crash. Has any Chrome user here switched over to Firefox 4 and been pleased with it?

<comment><USER9> If you'd have read the article to the end you would have seen that Firefox now isolates browser plugins so they don't take down the browser with them.

<comment><USER10> With the addition of the FlashBlock plugin (<http://flashblock.mozdev.org/>) the chance of those crashes happening drops significantly.

<comment><USER11> This can be done without a plugin in Chrome. Simply go to about:flags and enable the Click to Play plugins option. This enables an extra option in the prefs under Content Settings IIRC, that allows you to force any, all, or specific plugins to behave this way. Godsend.

</comment></comment></comment></comment><comment><USER12> I'm still debating on whether to use Firefox 4. Both Safari and Chrome seem to exhibit "lock ups" while opening a few tabs or while loading content. Maybe others have experience the same thing?

<comment><USER13> Not being snarky, but instead of debating, why don't you try (or "force yourself") to use FF4 for a full day or two before making a decision?

<comment><USER12> When I say debating I mean picking the least annoying one after having used all of them at their current version for a few days.

</comment></comment></comment><comment><USER10> I am surprised to see that a restart of the browser is still required to enable / disable extensions and themes in the new FireFox 4.

Is this the case with Chrome as well?

<comment><USER14> Firefox has also other type of extensions. Jetpack extensions ( <https://jetpack.mozillalabs.com/> ) which don't require restarts. And there are also "mini themes", called Personas ( <http://www.getpersonas.com/en-US/> ) which don't require restarts.

</comment></comment><comment><USER15> Hmm, "New window" (or option N) doesn't work if the current focus is on a window on my second monitor. Very annoying since that's my browsing screen.

<comment><USER16> Just tried that here and I can't replicate (10.6.6).

<comment><USER15> I'm on 10.6.7, perhaps that's why. It is consistent on two Mac Pro's I tried with dual screens, so it should be easy to replicate.

</comment></comment></comment><comment><USER17> I am seeing many things copied from Chrome. Reading the article top to bottom:

-Tabs above the address bar

-1 button for stop/refresh

-single star button for bookmarks

-transient status bar

-manage extensions in a tab

-pinning tabs

Tab groups, awesome bar, sync, and the privacy features do look awesome though. Will try them out for a while.

</comment><comment><USER18> The photo at the start of the article is of a Red Panda, <http://en.wikipedia.org/wiki/Red_panda>, not a fox (of any kind).

<comment><USER19> that is supposed to be the meaning of "firefox" [http://www.mozilla.org/projects/firefox/firefox-name- faq.htm...](http://www.mozilla.org/projects/firefox/firefox-name-faq.html)

<comment><USER18> I stand corrected. I guess Fire Panda does not have the same ring to it.

</comment></comment></comment><comment><USER20> It's still the slowest.. Proper tests here [http://uk.gizmodo.com/5784454/browser-speed-tests- firefox-4-...](http://uk.gizmodo.com/5784454/browser-speed-tests- firefox-4-internet-explorer-9-chrome-11-and-more)

From what I saw in the arstech article, the graphics are somewhere between bulkly ie8, and super clean Opera. Has any FF user used another browser properly and gone back for something other than extensions? It really does seem to suck from what I see. And now Opera and Safari have a lot of good extensions, FF should be dying out, but it probably won't.

<comment><USER20> Yey I got downvoted for a link to a test, and a possibly-too-modern but realistic view.</comment></comment>


RSA hit by targeted attacks, SecurID 2-factor auth possibly compromised - <AUTHOR> http://www.rsa.com/node.aspx?id=3872 <comment><USER2> For those who, like me, wondering how SecurID might be affected by attacks on their servers, from Wikipedia:

"""

The RSA SecurID authentication mechanism consists of a "token"—a piece of hardware (e.g. a token or USB) or software (e.g. a "soft token" for a computer, PDA or cell phone)—assigned to a computer user that generates an authentication code at fixed intervals (usually 30 or 60 seconds) using a built-in clock and the card's factory-encoded random key (known as the "seed" and often provided as an ASCII file). The seed is different for each token, and is loaded into the corresponding RSA SecurID server (RSA Authentication Manager, formerly ACE/Server) as the tokens are purchased.

"""

<http://en.wikipedia.org/wiki/SecurID>

</comment><comment><USER3> The money quote is:

 _While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers, this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack._

To me that sounds a lot stronger than "the thieves took the SecureID implementation plans and could theoretically build a 'soft' SecureID. Your long, random, hard-to-guess seed still protects you."

To me, what Coviello is saying is don't worry the thieves haven't stolen some secret 0-day that would provide them immediate access through your RSA kit. But they did get something that will make the RSA part of your 2-Factor authentication scheme null and void.

<comment><USER4> The algorithm necessary to build a software SecurID was leaked long ago.

This sounds like they could well have stolen copies of some customers seeds, which would reduce the RSA authentication from two-factor to one-factor.

<comment><USER5> correct me if im wrong, but iirc that second factor is a 4 digit number you pick at your first login.

<comment><USER4> The second factor is called a "PIN" in the RSA documentation, but the details can be configured by the administrator in a particular deployment. The administrator can set an allowed length range (with minimum and maximum between 4 and 8), and can choose to allow alphanumeric "PIN"s.

RSA's recommendation is for alphanumeric PINs of at least 6 characters.

Note also that a small number of tries with an incorrect PIN but correct tokencode will lock the account as "token stolen".

</comment></comment></comment></comment><comment><USER6> I worked there 10 years ago and if I remember correctly, the system that generated seed files wasn't on the network. They wanted an "air gap" just for this reason.

And yes - the method for SecurID was long ago known - just read the patent.

</comment><comment><USER7> I am wondering if this is another case where vulnerabilities in Adobe products were used to strategically infiltrate an organization. Here's hoping for more information soon.

Edit: I referenced Adobe specifically because of their recent security announcements. HN Discussion: <http://news.ycombinator.com/item?id=2328928>

Edit 2: "Another case" in the post implies there are multiple cases. I was thinking specifically of the prominent Google/China hack in which attackers first got access inside the networks of google and "more than 30 companies" based on vulnerabilities in Acrobat Reader. Source: <http://www.wired.com/threatlevel/2010/01/google-hack-attack/>

<comment><USER8> I'm sorry but you can't just throw a name out there like that! They didn't say anything at all that could possibly implicate Adobe. Are you just speculating idly or where did you come up with Adobe?

<comment><USER7> I apologize -- I should have cited recent events as the reason I brought up Adobe specifically. I did think I worded it in a way that made it clear I was speculating, but I see now I should have been much more specific.

Yesterday Adobe released a very serious advisory for Flash Player: [http://blogs.adobe.com/psirt/2011/03/security-advisory- for-a...](http://blogs.adobe.com/psirt/2011/03/security-advisory-for-adobe- flash-player-adobe-reader-and-acrobat-apsa11-01.html) <http://news.ycombinator.com/item?id=2328928>

And I was thinking of the highest-profile hacking case I can remember, when Google was infiltrated primarily by vulnerabilities in Adobe software. If I recall correctly, maliciously crafted PDFs were e-mailed to staff with cleverly engineered "From" addresses and subjects. For example, an employee received an e-mail from their boss's e-mail address.

<comment><USER9> Operation Aurora was an Internet Explorer vulnerability, not an Adobe vulnerability.

<comment><USER10> It was both.

If you read the various news reports closely, you'll see one vector was the 0-day IE vulnerability, another was malicious payloads in PDFs.

The headlines haven't helped.

[http://www.computerworld.com/s/article/9144844/Hackers_used_...](http://www.computerworld.com/s/article/9144844/Hackers_used_IE_zero_day_not_PDF_in_China_Google_attacks)

"Hackers exploited an unpatched vulnerability in Microsoft's Internet Explorer (IE) browser to break into ___some_ __of the firms targeted in a widespread attack that compromised Google's and Adobe's corporate networks"

"Google and Adobe, the only two companies to have stepped forward thus far to acknowledge the attacks, were hacked using malicious PDF files that exploited a zero-day vulnerability in Adobe's popular Reader software"

</comment></comment></comment></comment></comment><comment><USER11> "could potentially be used to reduce the effectiveness of a current two-factor authentication implementation"

What could this be? Initialization settings?

<comment><USER12> makes me wonder what they've been holding back from customers and pen testers? Obscurity shouldn't be part of the strength of the solution.

<comment><USER11> I've never set one up. There's an RSA encryption cabinet in our datacenter at work, it has red rope around it like a nightclub line and a sign that says no non RSA certified personnel. I imagine anyone who knows what it might be can't confirm what would be useful.

<comment><USER13> _There's an RSA encryption cabinet in our datacenter at work, it has red rope around it like a nightclub line and a sign that says no non RSA certified personnel._

Almost as effective as the ssh banner that says "Unauthorized use is prohibited."

Security through hoping people won't step over a rope is no security at all.

<comment><USER14> It's my understanding that such login banners are used to provide support for prosecution efforts, should someone break in and claim they did not know that access by random people was prohibited.

I would hope nobody thinks such warning messages are an adequate substitute for human-based and technology-based security measures, any more than wearing garlic cloves or putting up "no guns allowed" signs are replacements for being wary of vampires and armed criminals.

<comment><USER15> Yes, there was a case in which a system had "Welcome to XXX" as a banner, and their attempts to prosecute a cracker failed because of this.

<comment><USER13> That's going to need a citation.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> And here's the rather useless security advisory:

[http://www.sec.gov/Archives/edgar/data/790070/00011931251107...](http://www.sec.gov/Archives/edgar/data/790070/000119312511070159/dex992.htm)

With helpful tips like (paraphrasing) "don't use facebook on your critical systems" and "only give people the rights they need."

</comment><comment><USER12> A thief broke in to our house and stole some special blueprints from a safe in the drawing room. We don't think they took any cash or gadgets from other parts of the house, but we have so much lying around who can tell?

</comment><comment><USER17> "Advanced Persistent Threat (APT)", gimme a break

Too much corpspeak, not enough real information.

<comment><USER18> According to MSNBC, that is PC-speak for the Chinese. [http://www.msnbc.msn.com/id/42152645/ns/technology_and_scien...](http://www.msnbc.msn.com/id/42152645/ns/technology_and_science- security/)

</comment></comment><comment><USER5> i have set up rsa auth systems. would it surprise anyone to know that sometimes vulnerabilities are purposefully included because its easier or allows you to keep some old insecure app working? securid is not some golden impermeable shield. it just helps stop a few attack vectors.

</comment><comment><USER19> It appears as though the data stolen _might_ include RSA seeds. I thought I'd explain what this means for some of the people here not familiar with SecurID.

The seed is used a random key for the token and is used to generate a string of random numbers periodically to use. This is called a one-time pad as you use the numbers in combination with a pass code (PIN) in order to log in. In theory you won't use the same code twice although in practice you can as long as the token number is valid (normally a few seconds).

So this provides you with two 'factors' for authentication - something you have (the token number) and something you know (the PIN).

If you know the seed for a token you can simulate a token [1](or put it on a real one) and use it. Where the token is being used in conjunction with a PIN (probably the majority of use cases) you'd need to know the PIN.

The PIN is between 4 and 8 alphanumeric characters in length, but most people use a 4 digit number (possibly as it's called a PIN and people associated it with bank numbers, I don't know).

Now imagine the scenario, you want to break into PG's VPN and he uses SecurID but you have his seed and you've synced up with his token, but you don't know his PIN. You can take a guess that it's a 4 digit PIN (as is common) and that means a maximum of 10,000 authentication attempts. Using a tool like IKECrack[2] you can brute force about 18,000 guesses with a P3-700, so it becomes quite easy to target an organisation that way.

Likewise you can start brute forcing two factor auth on Citrix servers as well to great extent.

The great thing about all this (from an attacker's perspective) is that people don't change their PINs. Why change one factor when the other is so infallible?

But what if you have a more complex PIN? Well, that 62^8 possible combinations for an 8 character alphanumeric PIN. Let's break this down:

62^8 == 2.18340106 × 10^14 combinations

62^8 / 18 000 = 1.21300059 × 10^10 seconds

62^8 / 18 000 / 60 = 202,166,764 minutes

62^8 / 18 000 / 60 / 60 = 3 369 446.07 hours

62^8 / 18 000 / 60 / 60 / 24 = 140,393 machine days

That's for a P3-700, modern computers will be considerably more powerful, although at some point the limitations of the machine at the other end kicks in.

Bottom line - 4 digit PIN and you're screwed. 8 character alphanumeric PIN and you're probably alright.

[1] - <http://seclists.org/bugtraq/2000/Dec/459> [2] - <http://ikecrack.sourceforge.net/></comment>


Removing people from complex backgrounds in real time using TensorFlow.js - <AUTHOR> https://github.com/jasonmayes/Real-Time-Person-Removal/blob/master/README.md <comment><USER2> Discussed at length two days ago: [https://news.ycombinator.com/item?id=22353596](https://news.ycombinator.com/item?id=22353596)</comment>


A 25kB RPG for your wristwatch - <AUTHOR> http://www.gamasutra.com/blogs/DavidCDrake/20150330/239932/PebbleQuest_25kB_of_Awesome.php <comment><USER2>
      For example, rand() % 10 consumes slightly more memory (eight bytes more, to be precise)
      than rand() % 8.

I'm assuming this is because the latter takes fewer instructions to perform?</comment>


Astronomers predict bombardment from asteroids and comets in planetary system - <AUTHOR> https://phys.org/news/2020-05-astronomers-bombardment-asteroids-comets-planetary.html <comment><AUTHOR> Link to paper: [https://arxiv.org/abs/2005.13562](https://arxiv.org/abs/2005.13562)</comment>


Intuition is wrong, unless these conditions are met - <AUTHOR> https://www.thinkadvisor.com/2018/11/16/daniel-kahneman-do-not-trust-your-intuition-even-f/ <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=18570797](https://news.ycombinator.com/item?id=18570797)

</comment><comment><USER3> 1\. Regularity (predictability) 2\. Practice 3\. Immediate feedback

i.e. conditions for learning

<comment><USER4> Learning is more general than that, because you can learn by thinking carefully even when feedback is delayed. Likewise, you can learn without practice, for example when you learn why a theorem is true you don't need to repeat the epiphany many times.

The only thing it has in common is the regularity condition because no matter how much you learn, if the system is not possible to predict then there is nothing to learn in the first place.

</comment></comment><comment><USER5> So... This is just like, his own intuition, isn't it? I mean, maybe there are savants out there who know things with great accuracy without familiarity, practice, or feedback. As a general claim it seems weak.

I'll go further and say the vast majority of human knowledge is produced by intuition. For example, the scientific method relies on inductive leaps made based on drawing on repeated observations. This method cannot yield knowledge without intuition; Einstein sits in a room and ponders the Michaelson-Morley experiment, then comes up with his model of relativity. What brings him to that point? How does the previous knowledge yield a new supposition? It emerges ex nihilo from his stupendous brain.

Of course the nice thing about intuition is we can later validate it in other ways and shore it up. We dont just have to skate along believing our raw hunches. But without the ability to just dream it up we would be left with very little real knowledge to work with.

<comment><USER6> Uhm, no, but funny. Your intuition that Dr. Kahneman's general claim about intuition is weak, is way off, but humorously apropos.

This is not just his own intuition. Daniel Kahneman is a Nobel prize winning psychologist principally responsible for inventing an entirely new field of social psychology called Behavioral Economics, which is based largely on how humans misapply intuition.

Working with Amos Tversky, with whom he shares the Nobel prize, and others, Daniel Kahneman did extensive research demonstrating just how our intuition is wrong. You can read more about it in his book "Thinking, Fast and Slow".

Experiment after experiment show that most people's intuition is generally wrong, outside of very specific contexts as the article discusses. They also show that people are resistant to intuitive contradictions and use their intellect to create arguments to justify their flawed intuition, rather than accept their intuition was wrong when confronted with new information. In other words not only are intuitions often wrong, but wrong intuitions are sticky and very difficult to correct.

Now my question to you is, do you feel any resistance to changing your initial intuition despite this new information?

<comment><USER5> No. I know who Kahneman is and realized after a moment's thought that my initial response was wrong; probably based on an impulse to reject any authority. I tossed off the comment just before going to bed, immediately reconsidered and tried to delete it but could not. I left it as is figuring the responses would be interesting. That intuition, at least, was correct.

</comment></comment></comment><comment><USER7> Those are basically the conditions for training a neural network: regularity (there is a pattern that can be learned), repetition, and feedback.

</comment><comment><USER8> Whatever theory you come up with for when intuition is right or wrong, it seems to me that this theory is itself validated (rightly or wrongly) by intuition. That we adopt the ideas that we intuitively prefer is inevitable and not inconsistent with rationality and empirical evidence. The latter are themselves clusters of philosophical ideas which _we prefer_.

</comment><comment><USER9> I have a trust-but-verify relationship with my feelings.</comment>


America's Diet, Too Sweet by the Spoonful - <AUTHOR> http://www.nytimes.com/2009/02/10/health/nutrition/10brod.html?ref=science <comment><USER2> "Although much fuss has been raised about high-fructose corn syrup, when it comes to calories and weight gain, it makes no difference if the sweetener was derived from corn, sugar cane, beets or fruit juice concentrate."

This is subtly wrong, but I think it's important that people understand why. Yes, the calories from HFCS are the same calories from sucrose or fruit sugars. However, you body's reaction is different. See this paper for an idea of the kinds of differences that can be observed: [http://www.ncbi.nlm.nih.gov/pubmed/19064538?ordinalpos=2&...](http://www.ncbi.nlm.nih.gov/pubmed/19064538?ordinalpos=2&itool=EntrezSystem2.PEntrez.Pubmed.Pubmed_ResultsPanel.Pubmed_DefaultReportPanel.Pubmed_RVDocSum)

<comment><USER3> I think the point is that the benefits you get by replacing HFCS with sugar are minor, while the benefits you get by replacing soda with water are huge.

</comment></comment><comment><USER4> High sugar is bad. But one of it's effects this article didn't mention is inflammation. That's something we've studied for a while but have only relatively recently linked to diet:

[https://www.health.harvard.edu/fhg/updates/What-you-eat- can-...](https://www.health.harvard.edu/fhg/updates/What-you-eat-can-fuel-or- cool-inflammation-a-key-driver-of-heart-disease-diabetes-and-other-chronic- conditions.shtml)

High inflammation is also linked to heart disease, stroke, diabetes, alzheimer, some cancers, parkinson's and more.

Note: I don't agree with a few recommendations in the article.

<comment><USER4> I'm contradicting Harvard Med. Knowing that, I didn't want to go on a paper hunt this afternoon. I hate to make hifalutin' claims and not back them up.

But here's the quick version: While fruits are a better source of sugar, in excess they're bad too. Too much sugar, how ever is comes, is linked to higher GL and inflammation. When eating fruits and vegetables, I choose the low sugar/high water weight variety. You want to maximize the high vitamin/antioxidant/phytochemicals ones, as with any food.

That's the minor disagreement. But the majors ones are with carbs and fats.

Carbohydrates are complex sugars. They're broken down into the simpler forms, but they're same forms that the original article describes as bad when excessive. What I dislike the most about them is effect on insulin resistance, inflammation and leptin levels.

Where I differ here is what the macronutrient balance should be. I think high carbs, brown or white, isn't good for you. Don't get wrong you need them but the amount depends of lifestyle factors. I get most of my carbs from oats and in trace amounts in the rest of what I eat.

The other disagreement is with fat. We're finding out that fats aren't entirely bad in all cases, even saturated fat. It depends on the form they come in. High heat just kills in particular. It's the main reason trans fats are bad actually.

But this is true for all foods. How they're cooked, or if they're cooked at all, determines how healthy they are for you. It's well known that heat and light for instance can kill nutrients in many foods.

Macronutrients balance shouldn't be separate from lifestyle. A high fat, middle protein, lower carb may make sense depending on who it is.

</comment></comment><comment><USER5> Pre-late 1800s per-capita Sugar consumption: 1 lb/person Today: 150+ lb/person

The paradigm-busting, pivotal event in the late 1800s - the invention and introduction of Coca-Cola

</comment><comment><USER6> It seemed to be well researched and well written. This is not omg-all-the- acorns-are-missing article.

<comment><USER4> Fair point. I didn't intend to mean it was mostly wrong. But based on some papers I've reading, it seemed behind the latest stuff in a few parts.

Incidentally, I live next to Harvard Med so I suppose I could go ask.

</comment></comment><comment><USER7> I'm sorry (and please don't kill me!), but... how is this Hacker News?</comment>


WPA cracked in 15 minutes. - <AUTHOR> http://www.pcworld.com/article/153396/.html?tk=rss_news

<comment><USER2> I already switched to using OpenVPN over an otherwise unencrypted Wi-Fi network a while back. Obviously the unencrypted network is entirely separate from the rest of the LAN and only the OpenVPN server is listening on it. Getting all my hardware to play nice with WPA was getting very fiddly, and it even seems a little faster doing the encryption entirely in software. Plus, I have more faith in the OpenVPN guys than the people who seem to be unable to release a new standard within a couple of _years_.

<comment><USER3> It's also a lot easier to segregate traffic this way. Once you're coming in via openvpn, the traffic is on a completely different interface and IP range, making automatic/transparent proxying a breeze and firewall/iptables setup really straight forward.

<comment><USER2> Absolutely. It definitely beats going with your average access point's default of bridging wifi to your LAN, though it does make your wiring slightly more complicated. I use two separate VLANs actually, one for the unprotected wifi access points and one for the actual LAN traffic. You have to watch out that you use high-quality VLAN-capable switches, however, as some of the cheaper ones fall over and supply the world with your protected packets if you fill up their MAC address table with spoofed packets... which is of course easy to do via an unprotected access point. That kind of thing might stil DoS you with a good switch, but it shouldn't open up your network.

</comment></comment></comment><comment><USER4> Woof, can we fix this once and for all? Changing protocols every couple years is exhausting.

<comment><USER2> Realistically, I don't see a way other than strong, SSL-style crypto with private keys and AP certificates. I'd like to see a crypto expert analyse and write about RADIUS-authenticated WPA2 in a way us mortals can understand. My understanding is that it should be safe, but I'd like to hear about it from someone like Schneier. A lot of APs actually support RADIUS, but you do still need to set up your own RADIUS server somewhere on the network. I guess the open-source firmware available for some APs could help here.

My current OpenVPN solution is actually pretty user-friendly - it doesn't "magically" connect as soon as my AP comes into range, but it is just one click to start. It's almost certainly possible to run the script from the event directly. The nice thing is that you can implement this _now_ , and OpenVPN runs on Linux, OSX, Windows, probably the BSDs too.

I also have an OpenVPN server that's accessible from the internet, which is handy to use from public wifi. I realise that it's not end-to-end encryption, but having my cookies etc. available to everyone around is just a little too scary.

<comment><USER5> Of course, Schneier runs his wireless open, so he doesn't have this problem.

[http://www.schneier.com/blog/archives/2008/01/my_open_wirele...](http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html)

<comment><USER2> With the US legal situation that might be feasible, but in some countries you can get yourself into pretty deep trouble. From what I remember, German law in particular makes this a really bad idea. (aside from the fact that cease-and- desists _cost money_ in Germany) Austrian law is often quite close to the German counterpart so I'm not going to risk it, even though I strongly doubt anyone would try to leech my wifi around here. (mine is the only wifi signal I can detect, and we get about one car per hour on our road, so not exactly _where it's at_ )

EDIT: I'm no lawyer, and it's been a while since I read the articles on the topic, but the issue was effectively that you fall into one of two categories operating an open AP:

\- you get treated as an ISP. In that case I think you need to establish some kind of (implied or explicit) contractual relationship with your "customers" (paying or not) and are subject to various regulations. Hardly feasible.

\- everything your "users" do is your responsibility.

I misremembered some of this stuff, and there are no doubt various subtleties I didn't go into. The subject was covered in various articles in the popular German c't magazine. <http://www.heise.de/ct/>

</comment></comment></comment></comment><comment><USER6> "Partial crack". "They have not, however, managed to crack the encryption keys used to secure data that goes from the PC to the router in this particular attack."

Is that a trivial next step, or is the headline misleading?

<comment><USER2> I'm not 100% sure on how WPA works, but I think the crack allows you to log onto the protected network and exchange data with everyone else on the network. However, it doesn't allow you to sniff traffic that isn't headed your way. For example, Alice is using her laptop to load data from Bob's PC, which is attached to the access point. Eve cracks the AP's WPA passphrase and logs onto the network. She can initiate traffic to Alice and Bob's machine, but she can't see the data they're exchanging because individual wifi users' encryption is negotiated separately.

</comment></comment><comment><USER7> I thought WPA had been cracked a while ago. Am I mistaken?

<comment><USER2> I think this is the same crack, they're just ramping up the hype slowly, as publicity for whatever conference at which the details will be presented. Like lots of the high-profile "OMG h4x" stories this year. :-/

<comment><USER8> Yup your correct. The WPA crack has been about for a while.

The older WPA algo's can be broken totally given time (mostly to collect a LOT of data - something like 4 to 20 million packets sometimes).

We couple a small laptop used for collections & injection (to generate data) with our cracking cluster back at our office. Given about 3 or 4 days of activity on a WPA network it is usually possible to get in :)

<comment><USER9> Is that with a dictionary password and a "top 1000" ssid as a salt, using CoWPAtty rainbow tables? Or a full brute-force of the pre-AES WPA?

<comment><USER8> In terms of coWPAtty: we are work on high level corporate networks that are usually immune to that kind of attack.

We use full on brute force rainbow tables with some custom ideas / programs (obv can't share much of that). In it's simplest form we have 8 file servers, 1000 nodes and 2 head servers. 150+TB's of rainbow tables. Basically we combine the shortcut of rainbow tables with intelligent analysis of the packets and the brute force of the cluster.

For WPA we use some of our own techniques to intelligently make use of the data that gets sent back. Usually we can start to work on the data after 1 day of collection and it can be possibly 2 more days before it is cracked (depending on the other work running on the cluster)

Currently we have 2 specialists employed who are working with me to find ways to break the time down further (with great success) and I am also currently testing and cycling up another 9,000 nodes to add into the cluster.

By early next year we hope to be able to turn up at a location and crack WPA networks in a days work :)

In terms of economy it is not great (working on that) as your looking at about £5-8,000 outlay just to break in - but for speed I _believe_ it is unmatched.

Bear in mind ofc this is not representative of what a hacker could do. The rainbow tables (for all our decryption not just WPA) have taken 8yrs to make so far (on around 5000 nodes) and we still have about 2yrs more work to do on them. What this article talks about is a shortcut technique but ultimately I dont beleive it will lead to an inherent weakness which can bypass the need for our type of attack. But what it will be useful for is forcing the network to generate traffic :)

Hopefully sometime next year we should be read to deploy our full AES attack - but that (based on current testing) is going to require a LOT of nodes (possibly pushing 25,0000).</comment></comment></comment></comment></comment>


JS Comparison Table - <AUTHOR> https://dorey.github.io/JavaScript-Equality-Table/ <comment><USER2> The better link: [https://dorey.github.io/JavaScript-Equality- Table/unified/](https://dorey.github.io/JavaScript-Equality-Table/unified/)</comment>


Here's to You Mr(s) Arrington, Goodbye and Good Luck Startups - <AUTHOR> http://updates.blognation.com/2007/12/13/heres-to-you-mrs-arrington-goodbye-and-good-luck-startups/ <comment><USER2> I read one or two kb of that and skimmed the rest and I gained zero bits of information.

As far as I can see, this doesn't meet the criterion that Hacker News articles should be "interesting", even for a wide definition of "interesting". Please, let's not turn this into "Web 2.0 Gossip News".

<comment><USER3> dont vote it up then. this is how social news works.

<comment><USER4> If only we had down vote for articles.

</comment></comment></comment><comment><USER5> Seems like a bad soap opera... Reads like a bad soap opera... Lesson, skip what seems like a soap opera.

<comment><USER6> Yeah, this crap belongs on Valleywag.

</comment></comment><comment><USER7> First thought: yeah, needless drama, blah blah.

Second though: reminds me of what my parents told me in high school... "be nice". Sounds like someone got on someone's bad side. Is business really so stressful that it's impossible for everyone to get along without catfights?

</comment><comment><USER8> HereaEURXs to YOU Sam Sethi, Goodbye and Good Luck as an EMPLOYEE

If you can't stand the heat, stay out of the kitchen.

Its yet another sour grapes tale of an employee trying to be a smart-ass with his ex-employer and getting creamed in the process...are you kidding me: 'Well the matter has now been reported to Scotland YardaEURXs Internet Crime Unit : Case Number: LC986409807 and the IC3.'

But agreed: Soap Opera value +1 News.YC -1 ( But I can't vote it down... )</comment>


HackerEngine: A payment-ready Rails app with Bootstrap, Stripe, and KISSmetrics - <AUTHOR> http://www.hackerengine.com

<comment><USER2> This is a flat-out rip off. All three of those tools can plug into any Rails app pretty easily:

Bootstrap: <https://github.com/seyhunak/twitter-bootstrap-rails>

Stripe: <http://railscasts.com/episodes/288-billing-with-stripe>

KISSmetrics: <http://support.kissmetrics.com/apis/ruby-specific>

If you can't manage to set these things up on your own save your money because you shouldn't be bothering to build a Rails app in the first place.

<comment><USER3> _This is a flat-out rip off. All three of those tools can plug into any Rails app pretty easily ..._

It's true that these are all relatively easy to integrate, but why hate on fellow hackers for packaging and selling their solution?

If you really want to make the point that it's a ripoff, do the work to replicate it as a boilerplate project and release it for free.

<comment><USER4> Yea, why hate on people who take advantage of and mislead uninformed newcomers to the Rails community by selling them existing free software that is trivial to set up, all the while passing it off as their own?

Maybe because some people believe in honest businesses, and not ripping off end users for a quick buck. I say mislead and rip of, because the site is presented as if the work done is novel, when it is not. Why is it that links to the libraries used are conveniently omitted? Shouldn't Bootstrap, Stripe, and KISSmetrics' codebases be linked somewhere so that users can see what it is they are getting, if they want to do it themselves?

That said, I think I will take you up on that replicating challenge. You are certainly right that someone should undercut the market before they make any undeserved money off the work of others.

<comment><USER3> First, let me say that I know nothing about the authors. I'm just arguing the principle here.

 _Yea, why hate on people who take advantage of and mislead uninformed newcomers to the Rails community by selling them existing free software that is trivial to set up, all the while passing it off as their own?_

Hmm ... I didn't get the impression that they had written Bootstrap, Stripe, or Kissmetrics. Clearly what they're selling is a tested Rails app that integrates the Stripe and Kissmetrics API libraries and provides a baseline UI based off Bootstrap.

 _Maybe because some people believe in honest businesses, and not ripping off end users for a quick buck._

That's where this gets destructive. Just because it's not worth the price to you doesn't mean that these people are running a dishonest, rip-off business. You ought not attack people's ethics because you don't like the value proposition of their business.

Moreover, your argument is predicated on the idea that time is worth nothing. Back in my consulting days, even if the integration of all of these things at production quality would take only one billable hour (which, incidentally, it wouldn't), the $149 would save me money.

Maybe you're a faster developer than I am or maybe you just don't bill enough. Either way, just because the price isn't justified for you, doesn't mean it couldn't be a lifesaver for someone else. Certainly doesn't mean the business is dishonest.

 _That said, I think I will take you up on that replicating challenge._

Awesome.

</comment></comment></comment></comment><comment><USER5> \- What's the licensing look like? Can I buy it once & use it on every project?

\- When you say "a UI", what are we talking about above & beyond what Bootstrap gives me?

\- Since it's a stock app, and not an engine/gem, how am I going to easily merge back in your bugfixes?

\- Is this just for a one-time purchase? What kind of support do you have for recurring billing?

Looking at what you've laid out so far, I'd probably be billing ~2-3 hours for it, so the pricing sorta lines up there, assuming it supports multiple recurring subscription plans, gives me a decent reporting interface, coupon codes, all the nice things that Stripe gives for me out of the box.

As somebody who's built this a number of times before for clients, both before & after the Stripe era, there was definitely a recoil when I saw the price.

Part of my recoil can probably be attributed to having inherited a RailsKitted-project in the past.

<comment><AUTHOR> Thanks for your questions!

You can buy it once and use it as many times as you like.

"UI" refers to a landing page and checkout form that we pre-built and include with the app. We didn't do a good job of making that clear, and that's something we want to improve on the sales pages.

Your question about bugfixes is an excellent one. Eventually, we'll be moving this to an engine/gem, but for now you'd have to make manual changes. This is far from ideal, so we're planning on fixing it.

This is just for one time purchases. We'd like to add support for recurring billing at some point, but it's not planned for the immediate future.

Thanks for your feedback on the price. As this is at MVP stage right now, everything can possibly change, including that.

</comment></comment><comment><USER6> I'm rather curious as to what the "comprehensive test suite" includes. If I were to write something like this, it seems like it would take nothing more than installing the various gems on a basic rails app, and adding a little glue code to integrate bootstrap. Or am I missing something?

<comment><AUTHOR> Good question.

I've got good coverage with unit tests and cucumber features.

The tests do things like bang on the credit card form in a bunch of ways and make sure things work correctly. The integration tests actually hit Stripe's test servers to ensure that payment processing is working correctly.

</comment></comment><comment><USER7> add Devise and i'll give you $4.99 for the whole thing.

<comment><USER8> Yeah, add Devise and I'll buy it actually

</comment></comment><comment><AUTHOR> Hey all, I'm one of the authors of HackerEngine. I'm happy to answer any questions you have and would love your feedback.

Thanks!

<comment><USER9> FYI, I'm getting a security warning:

"This is probably not the site you are looking for! You attempted to reach www.hackerengine.com, but instead you actually reached a server identifying itself as *.heroku.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of www.hackerengine.com. You should not proceed."

<comment><USER10> I'm getting one, too:

        This Connection is Untrusted

        You have asked Firefox to connect securely to www.hackerengine.com, but we
        can't confirm that your connection is secure.</comment></comment></comment>


Show HN: Fastest, Simplest, Fully-Fledged ORM in Go, Supports PostgreSQL and MySQL - <AUTHOR> http://github.com/vattle/sqlboiler <comment><AUTHOR> Benchmarks can be found at the bottom of the readme for anyone interested, we've benched against the big names:

GORM, GORP, XORM and SQLX.</comment>


Face masks could raise pollution risks - <AUTHOR> https://www.nature.com/articles/d41586-019-02938-1 <comment><USER2> I think it's a stretcher to say those could raise risks.

I doubt anyone wearing one of those believes they are filtering out anything more than dust, but wherever there's traffic dust will be thicker on a dry day and that dust gets contaminated from pollutants too, but that wasn't even mentioned.

The real stretch comes in the assumption that "They have the potential to lull people into a false sense of security, encouraging them to spend more time outside in dirty air."

That's bullshit. If one is wearing a mask they're more likely to be very aware of the problem with sucking in polluted and dusty air and also more likely to avoid it as much as possible. The obvious proof of that would be they're wearing a mask.

And it's pretty easy to see when they're getting worn out. Despite what they say about not being able to filter gases they still filter out a lot of junk and turn from bright white to nasty light yellow/brown pretty quickly so it'd be easy to spot people wearing over used ones but we don't see much of that. And that is something that would stand out to me but I don't recall ever seeing a photo where that was obvious.

Finally, I was one of the very few people among all those I worked with at manufacturing products in an industrial environment that was diligent about wearing respirators and dust masks. The greater risks come from not wearing them when and where you should.

<comment><AUTHOR> Not quite bullshit, I think. Even in Singapore, which has been hit by transnational haze several times (due to plant burning in neighboring Indonesia), people still are not aware that there is a proper way to wear face masks, or even the right type of masks to get. Here's an example article about it recently [1]

[1] [https://www.straitstimes.com/singapore/health/should- surgica...](https://www.straitstimes.com/singapore/health/should-surgical- masks-be-worn-inside-out)

<comment><USER2> I can understand those concerns. People I worked with used to give me some guff about always wearing a respirator when, really, they should have been too.

You really should be able to figure out pretty quickly all on your own if you need one and if it's working or not. But... you're right, and my own experience mentioned above confirms that.</comment></comment></comment>


Ask HN: What technology to use for a small business with web and mobile clients - <AUTHOR> Trying to build a small service with web frontend and mobile app client. It will require account management, optional billing, not much structural data, no strong transactional requirement. What tech stack is easy to start with? <comment><USER2> Whatever stack you are already familiar with.

For a more in-depth answer you might need to provide more details. For example, are the mobile clients requiring native application functionality, or is a mobile (or responsive) web app good enough. If they require native functionality, are they on a particular platform, or is it a mix.</comment>


Feral Hosting is back online and accepting new signups - <AUTHOR> https://www.feralhosting.com/pricing <comment><AUTHOR> The pricing page is where the homepage redirects now, and is the source of the most relevant information.

Unfortunately the homepage adjustments for the pricing page have hidden the info about what happened to Feral. That can be found here: [https://www.feralhosting.com/roadmap/reason](https://www.feralhosting.com/roadmap/reason)</comment>


Type Anything - <AUTHOR> https://richardrahl.sarahah.com/ <comment><AUTHOR> So far:

"Machine learning AI got future"

"Hello!! Nice to meet you."

"Havz a nice day"

I like the spelling on that last one. I think I havz to use it to spice up my typing life.

</comment><comment><AUTHOR> "pls"

"Do the thing."

"sdfsfasf sdf sdf"

"Hello"

"Hope this helps:)"</comment>