What a rooftop grill says about your startup culture - <AUTHOR> https://www.lucidchart.com/blog/2013/05/09/what-a-rooftop-grill-says-about-your-startup-culture/

<comment><USER2> Never mind the workman's comp, I'd be more worried about zoning laws prohibiting open flame up there...

</comment><comment><USER3> Looks like theyre from boulder , colorado since you n eed to have requisite pictures of mountains

<comment><AUTHOR> Haha, close. We are actually in Salt Lake City. But yes, definite intentional inclusion of mountains. We actually had a business partner in town this week and he enjoyed some business on the ski slopes. And it isn't uncommon for a few employees to go missing on morning with fresh powder :)</comment></comment>


SemanticMerge is out Language-aware diff and merge tool - <AUTHOR> http://www.semanticmerge.com <comment><USER2> Amazing tool. Next thing: XML support! Imagine merging nibs the easy way... Mouthwatering.

<comment><AUTHOR> Thank you! :)

XML would be great to have, definitely... vote! [http://plasticscm.uservoice.com/forums/196398-mergebegins?fi...](http://plasticscm.uservoice.com/forums/196398-mergebegins?filter=top&page=1)</comment></comment>


PHP 5.3.10 release delivers a critical security fix - <AUTHOR> http://www.php.net/archive/2012.php#id2012-02-02-1

<comment><USER2> Found this related article: [http://thexploit.com/sec/critical-php-remote- vulnerability-i...](http://thexploit.com/sec/critical-php-remote- vulnerability-introduced-in-fix-for-php-hashtable-collision-dos/)

</comment><comment><USER3> Six of one, half a dozen of the other.

<http://news.php.net/php.internals/57655>

<comment><USER4> There's a giant disagreement on php-internals at the moment as to the nature of Suhosin. The core developers argue that time would be better spent working on the core itself instead, and Stefan does not agree with that.

The aforementioned post is Stefan's attempt to show why suhosin is needed.

(I disagree personally, and I think Stefan's attitude is less than productive to the entire discussion.)

<comment> X-Istence Seeing as how SuHoSin's patch/extension together stop this flaw from even being exploitable I would say SuHoSin is perfect. Even on PHP 5.3.9 my servers were never exploitable because I utilised the SuHoSin patch/extension with sane defaults.

I think any project that doesn't take "security" fixes into consideration, doesn't use code-review and lets developers that clearly have no business changing security sensitive code commit bad code could use a good safe-gaurd that fixes those issues.

Yes, the time could be spent working on the core itself, but clearly that won't stop people from committing stuff they shouldn't be committing without having a qualified security guy checking off on it, so that won't help me have a secure running PHP installation...

</comment></comment></comment><comment><USER5> Is it me or is PHP more lively these days? Critical updates are pushed immediately, they're fixing the broken tests, the community is more aggressive and there are interesting projects popping up. Feels like a spring cleaning.

</comment><comment><USER6> Work around this by using suhosin to restrict the variable count even more than PHP's limit.

Also your get/post size limit should be restricted anyway, the defaults are far too high.

<comment><USER7> We must do different kinds of sites, because I found that the defaults were too low - I had constant trouble with them till I increased them by like 1000 over what they were before.

<comment><USER6> You are passing more than 1000 variables per request?

Maybe some crazy, poorly written ajax, I dunno.

The default is 100 or 200, which might be low in some edge cases.

       suhosin.cookie.max_vars  (default 100)
       suhosin.get.max_vars   (default 100)
       suhosin.post.max_vars    (default 200)
       suhosin.request.max_vars   (default 200)

To avoid the apache bug, set them no higher than 999.

Oh do you mean my comment on GET length? Apache will happily pass PHP up to 8192 characters on a GET request which is insane and should not be allowed. Pass that much via post and restrict URLS to 1024 or less. Old IE won't go over 2k anyway.

<comment><USER7> Nope, not ajax, not crazy, and not poorly written.

Simply a large page where a client can easily and quickly updates prices on a large number of products. Each product has a number of fields, and there can be lots of products on the page (depending on the search parameters they chose).

</comment></comment></comment></comment><comment><USER8> Debian unstable packages has recently disabled suhosin patch by default

<http://lists.debian.org/debian-devel/2012/02/msg00079.html>

</comment><comment><USER9> It's already hit IUS, which is good. It just sucks since I just upgraded all of our development servers to 5.3.9 and we were just completing our tests to roll to production.

C'est la vie.

</comment><comment><USER10> Link to a PoC in JavaScript - anybody tested this? <https://gist.github.com/1725489>

<comment><USER11> Tested on one of my dedicated servers - definitely slows it down.

</comment></comment><comment><USER12> Anybody knows if it affects PHP 5.2.x?

<comment><USER13> Only if you backported the max_input_vars fix. (Or if your distro did it for you in case you don't do your own compiles.)</comment></comment>


Fakebook: A tool exploring the 2016 U.S. election Facebook ads bought by Russia - <AUTHOR> https://fathom.info/fakebook/ <comment><USER2> This doesn't really communicate anything. All the examples are something of this ad about americans liking cars was targeted to americans who like cars. I don't at all deny Russia meddling, but the website does a poor job at showing what they were trying to influence.

Example: This ad targeted people interested in same-sex marriage and 12 more.

We speak for all fellow members of LGBT community across the nation.

How is this influencing anything, all it does is advertise a group to people who would be interested in that group? They aren't stoking the flame or promoting racism/etc.

<comment><USER3> So the long standing rumor is that Russia influenced the US election through Facebook. Okay, fine.

You know what I want to hear about? The wealthy Americans who used Facebook to influence the US election. If Facebook can be used in this way, I think looking at what Russia did is interesting, but it's not the only story! The story is, people are subtly and quietly influincing our elections! Shouldn't we look closely at everyone who did that? Not solely the Russian bogeyman?

<comment><USER4> No, that's nice but it's a different issue. We already have plenty of inquiry into the influence of Americans with money on politics, with Citizens United and whatnot.

A hostile foreign government's operations to propagandize Americans about politics is important to analyze.

<comment><USER3> Call it a different issue, that's fine. But it's an issue I want to hear about! I haven't heard nearly the hand wringing over home grown control as I have over Russia.

<comment><USER4> I've seen plenty of concern over citizens United and the unfair influence of money in politics, so you might want to broaden your sources. Your posts remind me of basically what Trump is saying, that evil things that other countries do are fine because we are hypocrites, or other countries attacking us is okay because it's our fault we're vulnerable.

<comment><USER5> I've never heard Trump say this. I would be happy to read any sources or analysis which supports your claim.

Original: I've seen plenty of concern over citizens United and the unfair influence of money in politics, so you might want to broaden your sources. Your posts remind me of basically what Trump is saying, that evil things that other countries do are fine because we are hypocrites, or other countries attacking us is okay because it's our fault we're vulnerable.

<comment><USER4> "He's defended Putin's authoritarian rule ("he's a strong leader") and, when asked about the murder of Putin opponents, said the United States has murdered people, too — much as Putin asserted in his interview with Chris Wallace"

Supports my first point. From The Chicago Sun Times, with links: [https://chicago.suntimes.com/columnists/president-donald- tru...](https://chicago.suntimes.com/columnists/president-donald-trump-russia- vladimir-putin-robert-mueller/)

And to support my second point, here you go: [https://www.politico.com/story/2018/07/15/trump-russia- hack-...](https://www.politico.com/story/2018/07/15/trump-russia-hack- democrats-dnc-722228)

"The DNC should be ashamed of themselves for allowing themselves to be hacked. They had bad defenses, and they were able to be hacked," Trump said

Almost verbatim what I said, isn't it?

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I'm confused, none of these ads seem to be targeted at influencing the election. Is that the point?

<comment><USER7> I'll refer you to ashelmire's comment above.

[https://news.ycombinator.com/item?id=17546138](https://news.ycombinator.com/item?id=17546138)

TL;DR - The point of the Russian campaign is classic psyops[1]. Sow division, discord and disbelief in authorities and institutions.

One might well argue that the US was "primed" for such a campaign by the recent history of cynical manipulation of the public for political ends.

At this point, I find myself asking, "under what possible circumstances could the majority (irrespective of 'sides') ever regain trust in their elected officials?"

I can't come up with an answer. There is now sufficient disbelief that any attempts to regain trust would invariably come across as further attempts to manipulate.

If, like me, you believe that "democracy is the worst form of government, except for all the others", then this is pretty depressing.

[1] [https://www.corbettreport.com/psyops-101-an-introduction- to-...](https://www.corbettreport.com/psyops-101-an-introduction-to- psychological-operations/)

</comment></comment><comment><USER8> I think it's telling that tech people are very skeptical of the "$100k in facebook ads turned the election" narrative. Read the actual report from the DNI. Election counts weren't altered, the ads are nothing-burger. The hacks on mail systems were primarily done with spear-phishing, the same things businesses are caught with every day. My conclusion - phishing is the real story here of any consequence, if we want to "do something" it should be centered around better defense against this. That said, it's very interesting that Podesta's emails DID reveal collusion between the campaign and revolving- door political/media employees (CNN leaking debate questions to Hillary, etc). That's also a very significant story, and the more the narrative about Russia sucks all the oxygen out of the room, the less we're talking or even thinking about that kind of corrupt shit.

<comment><USER9> > I think it's telling that tech people are very skeptical of the "$100k in > facebook ads turned the election" narrative.

But...that narrative doesn't exist, it's a strawman.

No one that attributes any significant impact on the election to the Russian information warfare operation limits their description of the operation to $100K in Facebook ads. The Facebook _part_ of the operation involved ads designed (among other purposes) to draw audience to false-flag Pages, that then distributed non-ad propaganda which would be relayed by the followers of the group, who were dupes of the operation, including organizing meat-space events designed to foment conflict and draw conventional media attention. The $100K on ads wasn't the operation, it was an expenditure to recruit unwitting agents for the operation.

And that broader Facebook angle itself wasn't the whole operation, either, there was also the targeted hacking and information release aspect, as well as other channels through which influence was (or was attempted to be) exercised. Like the NRA.

<comment><USER10> > No one that attributes any significant impact on the election to the Russian > information warfare operation limits their description of the operation to > $100K in Facebook ads.

You are _technically_ correct. The $100k part of it is stripped out before the "Russian Facebook hacking to steal the election" is reported over and over in the media, absent of any details. And that is how the majority of the public is _absolutely_ certain of something, even though almost none of them know any of the details.

</comment></comment></comment><comment><USER11> I've looked through the Russian posts a few times, and to me it seems quite tame compared to the bitter, nasty, divisive rhetoric I hear sometimes from my fellow Americans. If this is the kind of thing that hurts our country, our own politicians are doing a far better job than the Russians.

<comment><USER12> Most of them are pretty tame but that's the point. It's something with a _slight_ slant to get people to engage then it's all about slowly isolating them and luring them a bit farther down the rabbit hole with crazier and crazier shared posts.

It'd be hard to recruit for a cult that starts with poison kool aid on day one.

<comment><USER11> Where can I see the "crazier and crazier shared posts"?

<comment><USER6> Thats what I came to see. Until I see this I call bullshit on the entire thing and seriously question the objectivity of those that push this theory. And thats not me being partisan thats just me being annoyed at the lack of real evidence being presented here.

</comment></comment></comment></comment><comment><USER13> Since getting results out of this seems to be a struggle, here's an article with some static pictures of the ads - and more interestingly with discussion of their ridiculously low user engagement rates.

[https://www.theregister.co.uk/2018/05/10/congress_russian_fa...](https://www.theregister.co.uk/2018/05/10/congress_russian_facebook_troll_ads/)

</comment><comment><USER14> I don't want to hijack or anything, but just want to also link to a project I did that also looked at these ads and lets you browse/categorize them interactively: [https://qunc.co/russia_facebook_project/](https://qunc.co/russia_facebook_project/)

<comment><USER15> Way better UI.

</comment></comment><comment><USER16> Does this work for anyone? Finding it pretty incomprehensible. Tried searching for 'hillary', top result is "Community of people who support our brave Police Officers. Back The Badge" ?

</comment><comment><USER17> In one of my old jobs, we used to test and run a lot of different news headlines or email titles with different messaging. We tracked and measured as much as we could.

The depth and breath of these ads almost feels like this might have as much been a research project as much as a process to impact the US elections or to create discontent among the voters.

I wish there was more info or better clustering on other filters on these ads like locations, age, etc. It would tell us how they were approaching this.

</comment><comment><USER18> This strikes me as more noise to add to the cacophony of nonsense that most Americans experience online. Please someone explain to me why these blurbs are somehow more signal than background noise.

<comment><USER19> [https://news.ycombinator.com/item?id=17547766](https://news.ycombinator.com/item?id=17547766)

</comment></comment><comment><USER20> It's really hard to see how these ads work without seeing which pages they link to.

</comment><comment><USER21> I live in a MA which is a solid blue state, I'm also not in a bubble and know many people who voted for Trump.

Not a single person voted for him because of ads. Not TV ads, not print ads, not radio ads, not internet ads, not beach banners towed behind a Cessna.

I know it's not a popular narrative, but no one was "fooled" into voting for Trump. They knew what they were voting for. Most of those people liked his anti-PC rhetoric. Which is why doubling down on PC is a bad strategy for Dems.

<comment><USER22> Agreed. I don't really care about Trump, but I voted third party again Clinton. However... doubling down on uberPC, calling people Nazis, saying "it's ok to be white" is white-supremacist talk, every day a new scandal... It's like these people are trying to get him re-elected.

</comment></comment><comment><USER23> The Media absolutely refuses to show this aspect of the meddling. That it was playing all-sides to encourage the same end result.

<comment><USER19> [https://news.ycombinator.com/item?id=17547766](https://news.ycombinator.com/item?id=17547766)

</comment></comment><comment><USER24> and Fakeblock is real.

</comment><comment><USER25> If they bought ads to slant an election what does this say about the people falling for it?

Also, this is just digital propaganda. The US gov. and media outlets do it too.

<comment><USER26> if someone shoots you what does that say about your ability to avoid danger and dodge bullets?

<comment><USER27> If it was under circumstances in which a typical person ought to have been able to avoid being shot, it would say a lot (not that that justifies the action of the shooter).

</comment></comment></comment><comment><USER28> So I'm confused. The media keeps repeating "Russia/Putin/The Kremlin interfered with/meddled with/hacked the 2016 election" (and has for about two full years now), but even though I feel like I've followed all this more closely than most Americans, the narrative is quite muddy and I don't understand what it is I'm supposed to believe.

First, I thought "the Russians" supposedly "hacked" Hillary Clinton's private email server. Or was it Podesta's email account? No, it was neither of those, Russia actually "compromised" some voting machines, maybe? Wait, wasn't there a series of stories, all from that same time period, about how "Russian hackers" managed to "break into but not quite gain control of" an Ameriacn hydroelectric dam, or something? Or perhaps none of that was true and maybe some "Russians" (the government? or not? who knows!) bought a bunch of Facebook ads--all far more innocuous than any of the rhetoric being spewed by Americans during the 2016 election season--for $10,000, and that is supposed to, uhm... have significantly swayed peoples' opinions such that they voted Trump into office? (Because if there's one thing I saw during 2016, it was vehemently anti-Trump people do a full 180 on their opinions! /s)

Until somebody does some actual reporting and breaks down the whole "Russia hacking/meddling with the election/our democracy" narrative in a way that not only I can understand, but the average American voter can understand, I see little choice but to believe that the entire thing is a confluence of several media-spun narratives that were repeated to us over and over until it was "common knowledge" that "Russia hacked the election" (whatever that means?) and/or "Russia meddled with our democracy" (whatever THAT means??).

Many of the accusations I see flying around social media and news sources sound incredibly dire, and something I should be freaking out about (not that anyone would have any ulterior motive to get myself and the rest of the American electorate to freak out about political matters, of course!)-- if that's the case, how is this information not yet out there in a clear, easily- understandable format for all to see?

If anyone wants to break down their understanding of the situation for me-- WITHOUT consulting any sources, just your own current internal understanding of the situation is--I'd be grateful, because this whole thing seems to be one of the least-clear political issues in recent memory, and it seems to me that certain political and media forces are just trying to scare everyone with vague, often contradictory claims that intentionally muddy the real underlying issues at play.

<comment><USER19> [https://news.ycombinator.com/item?id=17547766](https://news.ycombinator.com/item?id=17547766)

</comment></comment><comment><USER29> I find the irony in so many Americans being outraged at a foreign state influencing another state's elections to be deliciously intoxicating.

<comment><USER30> I think it's mostly redirecting dissatisfaction. Dems waaay underperformed and need to find a scapegoat rather than look internally and see why people switched.

But no, they rather blame others, be they foreign or even within the party: right now the Dems can't decide if they are 1980s Dems or 1920s Workers Partiers.

<comment><USER31> > why people switched.

If I remember correctly, it wasn't so much that many people switched parties, but that typical Democrat voter turnout was low, reflecting some amount of disillusionment.

Also, what you say about the Democrats' identity crisis seems to mirror what's been happening with Labour (the left party) in the UK.

<comment><USER32> >reflecting some amount of disillusionment

Disillusionment through propaganda and well-timed leaks of stolen documents by a foreign, hostile power.

<comment><USER30> Does the source of the leaks matter? Does it matter that it was Wikileaks, AccessHollywood, Guccifer? Either something is true or it isn't.

<comment><USER33> Absolutely the source matters as well as the contents.

You could ask yourself why the Russians penetrated the RNC but decided not to release any dirt. Perhaps you could ask yourself if this has any bearing on Trump's Russia stance? Could he be unable to admit meddling for fear of undermining his very legitimacy? As a result of this is the head of state feuding with the unanimous conclusion of his (+allies) intelligence agencies good for anyone? Who would that be?

This is why the source matters. Because things are always leaked with intent, and by missing that intent and being distracted by shiny talking points you're missing the whole story. Both matter, equally.

<comment><USER30> So let's say (presume) Russia has goods on Trump, and we all know they had at least some goods on Hillary. I think then it would be fair to presume they could get the goods on anyone. If that's the case, how can anyone do anything against this kind of adversary without someone saying "Ha, you're taking/not taking an action because Russia is in your pocket!" Or whatever.

<comment><USER32> > So let's say (presume) Russia has goods on Trump, and we all know they had > at least some goods on Hillary

Why do we have to "presume" they do about Trump and "know" they had some goods on Hillary?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER34> > Subway SquarePants

</comment><comment><USER35> Lots of techbros posting here missing the point. If you can't make sense of these groups and these ad buys, you're not familiar with Foundations of Geopolitics, which is assigned as a textbook in Russian military academies and was very well received there. The point of all of it is to encourage separation and discord along racial, ethnic, and political lines, and generally disrupt the American political process and international clout. Read a bit on that with some brief summaries [https://en.wikipedia.org/wiki/Foundations_of_Geopolitics](https://en.wikipedia.org/wiki/Foundations_of_Geopolitics)

>In the United States: Russia should use its special services within the borders of the United States to fuel instability and separatism, for instance, provoke "Afro-American racists". Russia should "introduce geopolitical disorder into internal American activity, encouraging all kinds of separatism and ethnic, social and racial conflicts, actively supporting all dissident movements – extremist, racist, and sectarian groups, thus destabilizing internal political processes in the U.S. It would also make sense simultaneously to support isolationist tendencies in American politics".

They've had _resounding_ success with this strategy thus far.

<comment><USER5> I don't see how calling people that disagree with you 'techbros' qualifies as either 'discussing in good faith' nor meeting the standards of hackernews.

<comment><USER35> Sure, sorry if that offended you, I'll refrain from using that here in the future. It's a shorthand for the people commenting here not adding anything to the discussion and projecting one aspect that I associate with the oft-derided "tech libertarian" culture - that is, that nothing every really happens, coupled with an unwillingness to dig deeper to find a deeper understanding of the issue at hand.

If you think the ~15 other posts here saying "I don't get it, these aren't election meddling" are adding more to the conversation than my comment because you were offended at the word, then I think perhaps you should continue reading the rest of it. Psyops is real, Russia does it, the US does it, and sowing dissent and funding extremist political groups in our country is a known part of Russia's global political strategy.

</comment></comment></comment><comment><USER36> It's a very nice looking tool, but hijacking scrolling is always a bad call.

<comment><USER37> With my small touchpad on my laptop, I was unable to even get past the first entry. Closed the tab instantly after that.

I'm sure the info was enlightening, but totally unreadable to me.

<comment> apk-d I'm guessing they optimized for mobile and forgot that desktop is still a thing. Works pretty decently on Firefox on my Android phone. I usually prefer text documents to "apps" that hijack scrolling but this one seemed usable enough for me (apart from search which is difficult to get to and fails to fetch any results).

</comment></comment></comment><comment><USER38> In the running for worst presentation ever. Most of this doesn't seem to even be rendering on Chrome/iOS and the parts that do render disappear as soon as I get them where I want them on the screen.</comment>


Ask HN: Do you think this is a good startup idea? - <AUTHOR> I'm working on ML model to classify NLP dataset. I'm thinking about online web app where a user would upload CSV file and possible labels. Back end would use ML to classify NLP texts into possible labels. Would you use service like this? Would you pay for it? If yes, how much? <comment><USER2> It's a good idea but you will run into the following issues:

* Your users won't have enough data

* Your users will have bad data

* Your users will have sensitive data that they can't upload

* Your model would need to be tweaked for best outcomes

<comment><USER3> Hahaha, this is all true. Cleaning the data will be very tricky.

</comment></comment><comment><USER3> I would use it. But only if it worked ;) My idea is that I want a model that will basically detect if my kid is whining or not. As a parent, I hate whining, but I also hate monitoring all the time for whining, and would love a robot to tell my kid "you're whining". If I could set up a smart speaker, or a raspberry pi, or a iphone or android app or something to just be listening all the time and tell my kid to use a normal voice, that would be awesome. So I would pay for it, but I wouldn't pay absurd amounts of money. I would want to test it out and see that it works. If it did, I would need an easy way to export the model into iOS/android and python. If I knew it was going to work, and I wasn't going to run into stupid problems (I get a model but I can't figure out how to run it unless I'm inside your web GUI or something for example), then I would pay a couple hundred dollars. If I didn't know if it was going to work or not, then I would probably only pay 20 or 30 dollars.

<comment> core-questions This is a hilarious idea. I would love a little robot that could tell whining apart from legitimate pain crying, because god knows toddlers do enough of both, and help discourage the former.

<comment><USER4> Beware second-order effects. I can see this going horribly wrong, raising a generation of believably-sounding whiney 'victims' suffering from whatever they imagine could get them something good.

<comment> core-questions Oh damn, so you mean they would be whining without me realizing it? And I would entertain them, not knowing I should shut them out like a child?

I think that's just the current world, friend.

</comment></comment></comment></comment><comment><USER5> This already exists and all the big cloud platforms have this: [https://cloud.google.com/natural- language/automl/docs/quicks...](https://cloud.google.com/natural- language/automl/docs/quickstart)

<comment><AUTHOR> This requires you to upload a labeled dataset. My idea was more of like you enter instances of text without label and ML model will label those texts for you.

</comment></comment><comment><USER6> It is a useful idea, but to be honest, it might not be a good startup idea.

if you want to raise vc money, the thing they care the most is the potential market size. this sounds like a niche market, so you will have to target big enterprise users, not hobbyists. big enterprise users can easily hire a data scientist team to build models, unless your solution is cheaper and flexible enough to handle their needs well. You will also need to take care of data security. And you need to have sales or you need to do sales.

if this is a bootstrap/indie hacker idea that doesn't need vc money, I still don't think it is a good idea. personally, I won't choose anything that requires a GPU infrastructure , it is too costly, and hence risky.

</comment><comment><USER7> I made the same online web app where a user uploads a CSV file and the back- end in uses ML to classify data and produce insights and charts automatically

Link: [https://www.youtube.com/watch?v=rVQOGRPiNJs](https://www.youtube.com/watch?v=rVQOGRPiNJs)

</comment><comment><USER8> SEOs would use this. Tailor it to SEO and I can get it in front of a lot of them

<comment><AUTHOR> That's really good to know. Why do SEOs use this? Would you be able to connect them with me?

</comment></comment><comment><USER9> do you know your potential users? ask them but not HN readers :)

</comment><comment><USER10> is it similar to monkeylearn.com</comment>


Making an Ancient Roman Murderer - <AUTHOR> https://www.laphamsquarterly.org/roundtable/making-ancient-roman-murderer <comment><USER2> According to wikipedia

The circumstances that surround Agrippina's death are uncertain due to historical contradictions and anti-Nero bias. All surviving stories of Agrippina's death contradict themselves and each other, and are generally fantastical.

[https://en.wikipedia.org/wiki/Agrippina_the_Younger](https://en.wikipedia.org/wiki/Agrippina_the_Younger)</comment>


Ask HN: Android development, revenue and compatibility - <AUTHOR>

I'm considering writing an app for Android. However, having read a number of blogs/articles it appears to be difficult to make much money from Android, although I haven't been able to find any hard revenue figures from anyone.
So, if you've done any Android development, have you made any money?
And how much of an issue is compatibility between different platforms?
Thanks <comment><USER2> Compatibility isn't much of an issue unless you are doing something low level with the NDK, or are using an API that has changed significantly between versions (most are fairly stable). Otherwise just follow the recommendations from the Android team for different screen sizes, etc.

I haven't released my app yet and it's going to be free initially anyway, so I don't have any direct observations on revenue.

<comment><AUTHOR> Thanks for the information - glad to hear you haven't found compatibility too much of a problem. I don't plan to do any low-level stuff that might cause a problem.

</comment></comment><comment><AUTHOR> Is anyone actually doing any Android development?

<comment><USER3> We're working on a sizable Android app over at <http://vodpod.com>. We're hoping to test it it in the next few weeks.

My impression, after two months, is that the architecture is solid. A good deal of thought has been given to privacy, information sharing, and interoperability. It's a very open platform, and I think that's a big strength. On the other hand, it's Java, and there is a lot of infrastructure required to accomplish simple tasks, such as moving to a new part of the app or displaying a notification. Perhaps that's my Ruby bias, though. :)

<comment><AUTHOR> Thanks for the response. It's good to hear your opinion is overall positive when building a large app.

Java isn't my favourite language/environment either, but I suppose it gets the job done.</comment></comment></comment>


SB 327 would prohibit North Carolinians from purchasing vehicles from Tesla - <AUTHOR> http://teslamotorsnc.com/the-issue/

<comment><USER2> Text of SB327:

[http://www.ncleg.net/Sessions/2013/Bills/Senate/HTML/S327v0....](http://www.ncleg.net/Sessions/2013/Bills/Senate/HTML/S327v0.html)</comment>


Ask:HN If x.com is $1.5M then how much x.net should be? - <AUTHOR>

I contacted owner of a particular x.com domain for which he/she asked for $1.5 million. It is beyond my reach. I see a domain registrar company is sitting on it's x.net version and asking for around $5k. How much should be the offer price? Thanks <comment><USER2> I'd walk away and get a .com that is closely related. If your name is a .net you're always going to have to remind people it's a .net in your logo and so forth like Authorize.net. If your product is an app I'd get a .co or append "app" to the .com

Now days .com's aren't as important as they once were.

Read how Marco Arment decided naming his app and his dealing with a squatter. ( [http://www.marco.org/2013/09/24/naming- overcast](http://www.marco.org/2013/09/24/naming-overcast) )

Also a recent thread about how a YC Co. acquired Experiment.com [https://news.ycombinator.com/item?id=7265540](https://news.ycombinator.com/item?id=7265540)

Good Luck

<comment><AUTHOR> You are right. It is the business or execution side of the business that matters. I got another domain very close to what I wanted with 3 extra letter(suffix) for few hundred dollars from a squatter.

54k for the domain is still higher(unless you have some angel money to throw at it). I'd use that money to bootstrap my project.

</comment></comment><comment><USER3> Most of the domain owners often ask for ridiculous prices and that domain certainly won't be worth even 5% of what he is asking for.

If you are looking to build a product/company, you want to avoid going with .net (specially if .com is owned by someone else who is looking to sell it at premium anyway)

My advice would be to go with some other name, as the domain registrar/parking companies also inflate the price by 3x-5x so the real price of the .net is probably 1k

<comment><AUTHOR> Yes, I agree.Thanks

</comment></comment><comment><USER4> Walk away. a .net for almost any word is not worth that much. Even computer.net or iphone.net isn't worth that much to me. I assume you don't got millions in reserve.

<comment><AUTHOR> .net version asking price is around 5k not in millions.

</comment></comment><comment><USER5> if a title like "whatsapp" which seems to have nothing to do with an sms service is sold for $19 bn, i'm sure domain names have nothing to do with company valuation.

choose "whatsx.com" instead :-)

<comment><AUTHOR> That seems to be a plausible suggestion. Thanks

</comment></comment><comment><USER6> X.com is owned by eBay? It's redirecting to [http://www.ebayinc.com/](http://www.ebayinc.com/)

<comment><AUTHOR> Well, it is not exactly x.com. I have put x.com for the sake of example.

</comment></comment><comment><USER7> Why so expensive?

<comment><AUTHOR> I believe the owner of the domain has kept it for >10 years. And with a very basic web 1.0 site. Anticipation?</comment></comment>


Why a Wasp Just Cut a Bee in Half (and Left with Its Rear End) - <AUTHOR> https://www.livescience.com/60757-wasp-slices-bee-in-half-video.html <comment><USER2> Eric the half a bee?

[https://en.wikipedia.org/wiki/Eric_the_Half-a- Bee](https://en.wikipedia.org/wiki/Eric_the_Half-a-Bee)</comment>


Browser Differences, Explained By Comic - <AUTHOR> http://thenextweb.com/shareables/2010/03/14/the-difference-between-firefox-safari/

<comment><USER2> With modern computer speeds and HD space, I've found 'which browser' to be a non-issue. Pick whichever primary browser works for you, switch to any other as needs arise. Chrome is my favorite (especially now that they've added extensions). IE is still around for those webapps that only work there (hooray corporate environment). Safari is around for those times Flash is being sucky in Chrome. Firefox still works best for me for dev work and debugging.

</comment><comment><AUTHOR> As a Mac user, I have Firefox, Chrome and Safari.

Firefox is too packed. But, I use Safari and that's what I'm comfortable with. Yet, to this day I can't explain why Safari...

</comment><comment><USER3> Now that Chrome Mac has extensions and bookmark synch, it's not just fast, it's awesome beyond words. I haven't even considered going back to Safari.

<comment><USER4> I'd be full time Chrome Mac if:

1\. 1Password extension was equivalent to the Safari version (it will get there, I hope)

2\. ChromeHelper didn't occasionally go _insane_ and eat CPU cycles like donuts. After quitting Chrome, mind you.

3\. I could open 50 tabs and start surfing immediately on my Macbook Air.

The last one is a big deal for me. I can open a 50+ tab folder on my Mac Pro in both Safari and Chrome and there is no noticeable difference.

On my Macbook Air (SSD, not half bad in general), opening 50+ tabs is fine in Safari and I can start going through them almost immediately. The same Chrome that works nicely on my Mac Pro chokes when I open those 50 tabs on my Macbook Air. Chokes hard, spikes CPU and pretty much becomes unresponsive for a good long while.

I'm really hoping Chrome on the Mac achieves the same performance as Safari. I'd switch full time in a heartbeat.

<comment><USER3> Safari is a dog for me. Nothing but beach balls on both my machines.</comment></comment></comment>


Four operating systems: One device. Chromebooks will be the universal laptop - <AUTHOR> https://www.idginsiderpro.com/article/3573644/four-operating-systems-one-device-how-the-chromebook-will-become-the-universal-laptop.html <comment><USER2> Pay walled and generally low quality source. It also looks like this announcement was made a few months ago, here's the Verge's article on it: [https://www.theverge.com/2020/7/31/21348963/google-chrome- os...](https://www.theverge.com/2020/7/31/21348963/google-chrome-os-windows- apps-chromebooks-features-interview)

<comment><USER3> > "The analogy I give is that yes, the world is all state of the art and Dolby > Atmos home theaters, but every once in a while you do have that old wedding > video on a VHS that you need to get to," says Cyrus Mistry, group product > manager for Chrome OS.

Certainly has a high opinion of web apps and a low opinion of traditional desktop apps.

<comment><USER4> Given that it already runs Android mobile apps and Linux desktop apps, I think he's referring primarily to _legacy_ desktop software.

</comment></comment></comment><comment><USER5> I realize what they are trying to say here, but the Chromebook really runs: Linux, Linux, Linux, and Windows. Maybe RMS was right to push for GNU/Linux as its own standalone OS?

<comment><USER6> A Mac laptop can run Linux, MacOS, and Windows. A future laptop will likely be able to also run iOS apps. If you are going to declare a universal laptop, it's hard to beat a Mac.

<comment><USER7> A future Macbook will likely be too locked down for anyone but the most dedicated hacker to run anything but Darwin on.

<comment><USER8> And when that happens, the people who need to will likely switch to something else.

</comment></comment></comment></comment><comment><USER9> I have just as many mixed feelings as in my first month of marriage. On one side: Convenience - Would save me having having to worry about my USB OS being up to date and if it will still work after the next one ; On the other: Safety - Can I trust that lot with my stuff?

</comment><comment><USER10> This seems weird to me — adding the cost of a Windows license to the already high cost of Chrome Enterprise management seems... more expensive. It's particularly weird since Chrome isn't aligned with Google Cloud organizationally. So who is selling this?

There's definitely a use case for ChromeOS in enterprises as a VDI/RemoteApp client as you can mostly use your existing Microsoft EA just like you would for a thin client. It's also great as a kiosk/line worker device as an alternative to iPads.

The only thing a can think of is this may enable places too small for an EA to virtualize apps... but at that scale isn't it just better to buy a windows laptop?

</comment><comment><USER11> I used a chromebook professionally for 4.5 years. Acer C720 with an i3, external monitor and keyboard. Did everything I needed, reliable and never had an issue. Chrome remote desktop stepped in when I needed something it couldn't handle. Google decided to quit issuing updates for it and I continued to use it.

Eventually, the battery began to swell, so it was time to move on. Looked around and there was nothing in the middle tier for chromebooks anymore that would match the C720s performance. It was either lower end or high upper end $s. Disappointing.

Using Windows 10 on a refurbed E6430 now. Still miss the chromebook lol

</comment><comment><USER12> A locked down laptop running things behind abstractions will never be a universal laptop.

Besides, such a frankenstein concoction will demand constant support keep up with the various apps from the different environments.

The whole webapp thing should have been a bulletpoint feature of a genuine full featured linux desktop implementation, not the main thing.

</comment><comment><USER13> Working from home I'm mostly just RDPing to a remote PC. Everything else is browser based.

I spend a few hours doing side projects and learning on a PC. Has anyone tried hiring remote desktops for this? It would make sense but they seem very expensive.

<comment><USER14> We had about 10 non-ICT end users testing RDP in the microsoft cloud or whatever, as a covid alternative for in-person laptops. They all hated it.

One common issue: Alt GR unreliability. It just stops working, and you have to log off and on again.

Another common complaint: slow graphics and artifacts, even on good internet connections.

</comment></comment><comment><USER15> I use an Acer Chromebook for casual Web browsing and watching news. I bought it to replace an iPad.

The Chromebook locks up consistently every couple of days. I wouldn't want to depend on it for business.

</comment><comment><USER16> You'd be surprised about developed countries still having shitty, flaky internet.

Also, no cell service while travelling due to spotty coverage, even in metropolitan areas. YMMV.

</comment><comment><USER17> MacOS isn't perfect but it does enough things well for me to consider a MacBook a truly universal laptop

</comment><comment><USER18> With Crouton and Wine, I have used windows apps directly on my x86 Chromebook more than 3 years ago.

</comment><comment><USER19> Chrome books are fantastic for the supposed class of users to naive to evaluate even the most basic properties of software.

For adults they're useless toys at best, and tools to extract and rent out power over individuals at worst.</comment>


Ask HN: Is anybody using PyPy interpreter for big data, or machine learning? - <AUTHOR> <comment><USER2> PyPy2.7 is very good for preprocessing tasks not delegated to C code. On one of them I got 2x speed improvement without code rewrite. For some reason PyPy3* is slower than CPython. It has less sense if we talk about using sklearn. Python here not doing any work, it just calls C-modules.</comment>


What is your recommended beginner's hacker training course? - <AUTHOR>

<comment><USER2> As others have said, start writing code, immediately. I mean right now. Like, this second. Stop reading right here. Open a programming tutorial website and start coding.

I mentioned ADUni above. It's a great way to spend part of your first six months of learning. I've been a hacker since I was eight (I went the Commodore 64 route someone else mentioned starting in 1981, but I don't recommend that path for anyone...Open Source and modern languages provide a far better learning experience...hell, I didn't see C until I got an Amiga in '88 and didn't see Scheme until I started using Linux in '95...there's never been a better time to learn software development), and I still found several things to learn from the coursework.

Find and download an Open Source project that does something you find interesting, and figure it out. Add a feature. A small one. Get it accepted by the developers. This will teach you a lot of skills you absolutely must have that aren't "programming": Revision control (because you'll need to work on the SVN or CVS or bzr or monotone version of the software in question), making patches (use "diff -u" for single-file changes or "diff -uNr" for whole directory changes), and communicating with other developers (you need a co- founder who is a stronger hacker than you, and you need for him or her to not be infuriated by the way you communicate with them...Open Source folks are generally happy to help if you're doing something useful for their project).

Notice I haven't mentioned any languages here. They're not irrelevant, but close to it. Some languages are better learning languages than others (Python, Ruby, PLT Scheme, which are all interactive and very clean), but if you can't see how to get started making something useful (almost) right away due to language choice, pick something else. All of the stuff you learn in the next few weeks is going to apply equally to pretty much all languages. If you do SICP, plus start working on some open source project (maybe in Ruby, Python, Perl, or PHP), you'll get to the meaty stuff right away.

Avoid hard problems (for now). Don't learn Java (you might make an exception for the ADUni Java courses--they teach programming and it just happens to use Java as the language, but it's way too easy to get mired in the minutiae of Java). Don't learn C. Don't learn Common Lisp. Don't learn edge cases in Perl or PHP (just the ones used in the Open Source projects you've picked to work on). Don't get bogged down reading standards documentation.

Do learn good tools. vim, emacs, or Eclipse. If you use a Mac, maybe TextMate. There is no other editor you should waste your time on, if you're in a hurry. Later on, you can flit between some of the others, if you feel dissatisfied with what you've landed on. Learn to use the UNIX command line tools, as you need them when you need them, to make yourself more productive. If ever you find yourself wishing there were an automated way to do something to several files (and you will), just remember that there is a UNIX tool that can do that for you (maybe sed, maybe awk, maybe perl, maybe grep, maybe diff, maybe patch), and set out to find what it is and how to use it. (Not using UNIX? mingw or Cygwin can help.)

Let me re-iterate something...if you're in a hurry, you must write a few lines of code today. Writing code is the single most useful thing you can do in learning to code.

Oh, yeah, for JavaScript, you cannot beat Douglas Crockford's awe-inspiring JavaScript videos at the Yahoo Developer Network.

<comment><USER3> s/DLT Scheme/PLT Scheme

<comment><USER2> Quite right. Thanks for noticing. Fixed.

</comment></comment></comment><comment><USER4> <http://ocw.mit.edu/OcwWeb/Electrical-Engineering-and-Computer- Science/6-171Fall2003/CourseHome/index.htm>

Philip Greenspun described this course as "how to build Amazon.com all by yourself"

the textbook is available on amazon here:

<http://www.amazon.com/exec/obidos/ASIN/0262511916/pgreenspun-20>

The curriculum is not language specific so you'll also need a book on Lisp, Ruby-on-Rails, IIS/ASP.NET, Apache/Tomcat/Java, or whatever is your choice of technology.

</comment><comment><USER5> Just start programming in anything really (except PHP, since you may learn some bad habits). Make something you want (i.e. it could be as simple as a greasemonkey script for FF/UserJS for Opera/GreaseMonkIE [or equivalent] for IE). Then try to see if you can program it in a better way and continue to refine it as much as you can.

Ultimately, you're going to learn that writing solid tests are equally, if not moreso, important as writing solid code. They help you determine the root problem, so I suggest just writing some code and learning how to properly test it. Also, test everything! I was coding a project and I think without a proper test suite (I made) and a debugger I would have never finished.

Professor Felleisen taught us a design recipe: <http://www.ccs.neu.edu/home/matthias/211-f06/Assignments/recipe.html> and it works really well, it ensures a structured and organized code that is easy to maintain down the road.

</comment><comment><USER6> I can't believe nobody suggested _why's awesome new beginner Ruby environment:

<http://hacketyhack.net/>

<comment><USER7> And there's also the poignant guide: <http://poignantguide.net/ruby/>

</comment></comment><comment><USER8> As much as I think SwellJoe has nailed the answer to this question, I can't help but think I disagree with the premise. If you've never coded before, I would suggest that you ask yourself a very difficult question - how do you know that you want to become a great hacker?

Now, I don't consider myself a great hacker (I honestly don't know how good I am, and I question anyone that would tell you otherwise), but I do believe I know a bit about how I learned and can offer some advice.

Follow your natural curiosity, step by step. That's it. If you have questions, answer them. If you wonder how is done, try to build it or create it yourself and find out - if you can't do it yet, pick off a smaller piece of the problem you're interested in. If there's some assertion in a field that you disagree with, try to prove it wrong, because either you'll learn that you're wrong (likely) or you'll contribute something to the field (unlikely, but possible). Either way you win.

But the key here is, just follow your curiosity _wherever_ it goes. It won't necessarily be towards becoming a hacker. If you find yourself delaying code that you know needs to be written in your plan to become a hacker by slacking off and reading up on organic chemistry all day, then that's not actually slacking off - that's telling you something.

I don't think there are many people on this planet that can truly be great at more than one thing. Feynman was, for instance, but I don't think I've ever met anyone in person. If you find yourself trying to become a hacker as a 'day job' but you do rocket science for fun, well, I'm sorry, but chances are you'd make a great rocket scientist but a lousy hacker and you're going against your own nature to try to become what you aren't.

But the key thing about simply following your curiosity is that you'll end up finding something that you are good at, you enjoy, and if you're at all smart you'll eventually become world class at it. If you are right about wanting to be a hacker, you will get there! You may have to have a day job while you figure out what you really want to become, but there are worse things.

Sorry, I'm ranting a bit... but I hope this helps.

</comment><comment><AUTHOR> What is the fastest way to learn "hacking" to a reasonable level such that you can apply for YC?

Of course, you need a product/idea to apply, but what will be the fastest way to acquire the necessary skill such that you can build a reasonably good product / to actualize your idea? Finding a hacker co-founder is a shortcut but it is not considered an answer here.

I want to have a full schedule, e.g. firstly read this book, finish all the exercise in it, then secondly you read a certain website, and so on, etc. Of course there will be no limit to learn, but I am asking for a minimum requirement. Something like a curriculum.

<comment><USER9> I'd start with the video lectures of SICP:

<http://swiss.csail.mit.edu/classes/6.001/abelson-sussman-lectures/>

After that you'd probably want to learn some web stuff like html, css and javascript. You can pick these up by looking at the sources of other peoples' pages, and by using w3schools:

<http://www.w3schools.com/>

Good luck!

<comment><USER10> As a second source (it's sometimes helpful to hear material from more than one perspective), UC Berkeley has some podcasts from a Scheme course which uses SICP:

<http://webcast.berkeley.edu/course_details.php?seriesid=1906978270>

I listened to a few of them a while back, just to check them out. Not bad, if you can ignore the lecturer's occasional side-trip into politics (well, it IS Berkeley).

</comment></comment></comment><comment><USER11> If you mean hacker in the traditional sense, I'm not so sure you can learn to be a hacker. It's an attitude of mind that makes you want to take things apart to see how they work, and then try to see if you can put them back together again better. If you have that mindset, play with a computer, and you'll learn enough on your own just by following what interests you. If you don't have that curious mindset, try to develop it; it's the hardest part of the hacker nature, but also one of the essential ones.

If you mean "competent programmer," then the best route that way is a _good_ computer science degree (which will teach you mainly theory) followed by a job programming (which will teach you how to apply the theory). Both the theory and the application of the theory are important; vocational-training computer courses that teach the application often omit the theory altogether.

Hackers can benefit from formal education, too. The important thing is understanding how things work, not that you discovered them on your own. Learning by reading and by observing is as valuable as learning by doing; and the computer world has an endless stream of good examples of what NOT to do.

</comment><comment><USER12> i think hacking is a state of mind, and not a learned skill.

hackers, entrepreneurs and artists have a certain "what if" personality that leads to a never ending quest to answer these questions, they are usually very personal questions of curiosity. The quest to see the result is often more fun than the result itself for these people, it's about the process of discovery and exploration, and not about the answer. A runner runs a marathon because it is ultimately fun to train for one, not because the need to go 26 miles. A hacker is the same way, we just find it fun to hack, to explore.

If you want to know what quests other hackers are on, you can always go to defcon in las vegas during the 1st weekend in august. Defcon is more like an art gallery of hacks, than it is a place to learn how to hack, that comes in from an inner desire.

</comment><comment><USER13> Academy X is San Francisco is good: <http://www.academyx.com/>

(This concept should be franchised.)

</comment><comment><USER14> the top ten courses first:

<http://www.lecturefox.com/computerscience/>

</comment><comment><USER15> Eric Raymond answered this question a while back:

<http://www.catb.org/~esr/faqs/hacker-howto.html>

It's not a quick process. It takes time to learn enough to do anything interesting with programming. A lot of time and dedication.

</comment><comment><USER16> TAKE CLASSES AT A COMMUNITY COLLEGE.

You might be able to teach yourself from a book, but that only works for a very few people (ususally those who are trying to learn a new language rather than someone with no experience). I tried to teach myself some SQL (with no database or programming experience), it didn't work. After 6hours/week for 4 weeks at school, I was doing ok. Heck that was 3 months ago, and it has tremendously helped me. Now, I am looking into a taking some java classes at a technical school. The classes are cheap and you will get more than the fundamentals in 2 months. The rest will come as you practice and work along side a developer on your project.

<comment><USER17> I personally volunteer to mentor anyone who is desperate enough to take this path.</comment></comment>


Auto Dealers, Startups Try Amazon-Style Ordering for Cars - <AUTHOR> https://www.wsj.com/articles/auto-dealers-startups-try-amazon-style-ordering-for-cars-11546174802 <comment><USER2> Buying a car is such a horrible and archaic process still.

I love this quote at the end...

"For the vast majority of dealerships, in-store sales will continue to be the main way they sell cars. Delivering cars to customers can get expensive, and dealers see a benefit in getting them in showrooms, where they can be induced to spend more for features and add-ons, like paint protection and extended warranties, "

That word "induced" made me laugh.

<comment><USER3> Carmax feels a lot like dealing with Saturn dealerships. No haggling. Fairly simple process. Low pressure. I'm never buying from a dealership again.

<comment><USER4> Carmax still only sells used cars, don't they?

I want a no-haggle dealer for new cars, especially if they sell economy cars like the Nissan Versa and Chevrolet Spark.

<comment><USER5> Honest question: why? Cars' rapid depreciation makes a gently used car a much better buy than a new one in just about all circumstances. And CarMax does thorough inspections and provides solid warranties for cars they sell, so you don't have to worry about "used" equaling "unreliable."

<comment><USER6> Asymmetric information. The buyer has no way of knowing whether the car was used gently, which results in market for lemons.

CarMax has no incentive to fail a car at inspection. They'd rather sell it to you and if it breaks, fix it under warranty. But for you a broken car might mean ruined vacation or road trip.

<comment><USER5> CarMax gives you a free history report on the life of the vehicle to date, including how many owners it's had, any accidents it's been involved in, any recalls it's been included in, registered odometer readings over the life of the car, and so forth. (Details here: [https://www.carmax.com/articles/free- vehicle-history-report-...](https://www.carmax.com/articles/free-vehicle- history-report-walk-through))

If you don't trust CarMax to give you an _accurate_ report, you can buy a separate one from a third party like Carfax ([https://www.carfax.com/vehicle- history-reports/](https://www.carfax.com/vehicle-history-reports/)) to confirm the details.

 _> CarMax has no incentive to fail a car at inspection. They'd rather sell it to you and if it breaks, fix it under warranty._

Any car you buy from CarMax can optionally be covered by their "MaxCare" extended warranty, which lets you choose a deductible and then obligates CarMax to pay the remaining cost of any repairs to the vehicle beyond that deductible. So if you set the deductible at, say, $250, and then you get the vehicle home and discover that the transmission is shot, the worst case scenario is you're out $250. CarMax eats the rest of the cost.

Car YouTuber Doug DeMuro bought a Range Rover from CarMax with this type of coverage a few years back. He paid $3,899 for the extended warranty, and CarMax ended up paying out $16,925 on warranty repairs over the six years he owned the car. More details here: [https://www.youtube.com/watch?v=E3jA55TJboA](https://www.youtube.com/watch?v=E3jA55TJboA)

<comment><USER6> If the previous owner only changed oil once (just before trading the car in), how would CarMax or Carfax know?

<comment><USER5> They would know it had missed a bunch of scheduled maintenance. They know how many miles are on the car, they know how many times it should have had its oil changed over that many miles. If the owner never brought it in for service, you can say _maybe_ they were just a gear-head and were changing the oil themselves in their garage. But there's lots of service tasks you can't do in your garage, so if the car missed lots of scheduled maintenance windows, that puts up a big red flag.

<comment><USER6> Typical lease is three years. In that timeframe there isn't a bunch of scheduled maintenance. You need to pass state inspection a couple of times, but apart from that there's normally nothing really to service yet.

From the carfax report the owner who did the oil changes on schedule with quality synthetic oil looks indistinguishable from the one who did nothing and drove the car like a rental. An you can't tell what's inside the engine block until you open it up.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I'll share my last car buying experience. We had done our homework and more or less knew within a couple within a couple of models, which car we wanted.

After going through the test drives and the stupid dance with a couple of dealerships, the process smoothed out.

I checked out a few regional dealers, and called 3 different ones for prices. 2 of them were willing to me prices over the phone. Great. I found another regional dealer which had this "amazon-style" process. I could configure the car I wanted on their website, and it showed me the price. It was the best of the 3 prices I was quoted, so I "placed my order".

I got an auto-responder email email saying that paperwork was on the way and salesperson would be in touch. The guy called to discuss the trade in process, and tell me how the paperwork would be handled. In about 3 days I had a new car, delivered to my house, having never set foot in a dealership. They even did the trade in estimate remotely (I took some photos and sent them in).

Hopefully that's the trend things move in the future. It was a breeze.

<comment><USER8> Related to this I have the "best-worst" idea for a business...

So everyone hates car dealerships. But we need to test drive vehicles (or physically look at them). Right now car demos are linked to buying, and therefore the dealership.

What if there was a business that ONLY did car demos? You go in, and there's a row of SUVs from all the major manufacturers.

This saves you from driving all over town for the different dealership, and because they aren't selling you vehicles it is a no-pressure situation.

I'd pay money for this. But people are cheap and I doubt it would work as a concept, unless buying cars online became the norm.

<comment><USER9> I thought this post was sarcasting and only halfway through I've realized that you're actually serious. Renting. It's a thing. You can rent cars for short periods.

<comment><USER10> Yeah but no one is doing a one day rental on the 4 cars they want to drive. Not to mention finding the exact make/model they are looking for.

<comment><USER11> If I'm interested in a car, I'll try and rent one for a few days on Turo. It's a great way to see what it's like to actually live with the car. I'm never buying without renting again.

</comment></comment></comment></comment></comment><comment><USER12> I work in auto finance for a lender. There are so many gimmicks used by a dealership to get a customer into a car with financing. A lot of it is the lenders too because they offer incentives like markup to the dealers. There is a lot that goes on behind the scenes as far as car market value, backend products like warranty and GAP, and dealer incentives from lenders. It is just too much to understand for the typical customer.

My recommendation is to research the car you want and understand the market value. Then get pre-approved financing through a trusted lender. This will leave a lot of the confusion out of the car buying experience.

<comment><USER13> OT question: why does a car with financing cost less (summing up all the monthly payments) than a car paid cash?

<comment><USER14> Manufacturer financing is weird. You might be eligible for some rebates only if you take manufacturer financing. The financing arm may be trying to get more loans on the books in general, or specifically good credit loans, or ? Strange incentives all around.

<comment><USER12> Great point. Manufacturers are interested in moving inventory. Not so much with making money on loans. So they will take a small margin or even a loss on the loan as long as it sells the car.

</comment></comment></comment></comment><comment><USER15> For those looking to buy a new car and have a Costco in your area, I highly recommend looking into their Auto Purchase program. They negotiated great pricing below invoicing. I did a ton of work shopping around for a new car just before Thanksgiving and I couldn't find a better price.

For reference the 2017 Toyota Highlander XLE AWD was $1700 under invoice.

<comment><USER16> Just know that the Costco price will always be higher than the price you could achieve by negotiating, simply because dealers pay Costco a referral fee for each sale made through the program.

It's great for getting quotes though.

<comment><USER17> Why do you think a dealer will sell you a car for X, just because Costco isn't taking Y commission?

</comment></comment></comment><comment><USER4> It's a shame that more dealerships aren't like this.

The traditional car dealership needs to go away. While companies like Carvana are great, the vast majority of car dealers are just engaging in rent-seeking behavior. These dealers exist solely so they can inject their own markup into the supply chain. They only continue to exist because their lobbyists have bribed state legislatures into passing laws that prohibit automakers from selling cars directly and blue laws that prohibit dealerships from being open on Sundays. Yes, most of the blue laws that are still on the books are the direct result of lobbying by car dealerships: small businesses are terrified that they're going to be replaced by corporate-owned dealerships that can afford to hire employees to staff their dealerships seven days a week, so they bribe lawmakers to pass anti-consumer laws that make it illegal for dealerships to be open seven days a week. Can't compete with a company that offers better service? Outlaw them! They are actively trying to drag the standard of living for the entire state all the way down to the lowest common denominator. Small businesses cause more externalities than they're worth.

We really need an aggressive push at the state level to overturn laws forbidding automakers selling cars and to overturn blue laws.

And while we're at it, let's get rid of the archaic third-world practice of haggling over car prices. We don't haggle over anything else, and it's an emotionally draining process that discriminates against people who don't have natural tendencies towards aggression. Honestly, I'm really disappointed Saturn and Scion went away, because they were the best hopes for dealership reform. And if we _are_ going to have dealers lobbying state legislatures for laws, then let's actually have them do something beneficial and make it illegal to buy or sell a new car for anything other than MSRP.

Carvana is great, but ideally the automakers should be selling cars directly and adopting every single one of Carvana's innovations for themselves. We'd all benefit if every automaker in the country moved to the Apple Store model.

No more blue laws. No more dealers extracting markup from an unnecessary step in the supply chain. No more haggling. No more lying to and hiding information from buyers. Online sales as a first-class citizen of the omnichannel.

<comment><USER18> > We don't haggle over anything else

On the contrary, almost all big ticket items are negotiated. It's just cars are the most frequently encountered big ticket item for the average person.

<comment><USER19> Exactly right. I negotiated _hard_ on both houses I bought and pretty regularly (as a percentage of transactions) negotiate on Craigslist or Ebay type purchases. I've negotiated salary at every job I've taken after my first one. Many (perhaps more than half) of my business contracts are also negotiated as well.

You don't _have_ to negotiate these things if you're willing to take the other side's initial offer; it's probably financially materially in your favor to not do that though...

</comment></comment></comment><comment><USER20> [https://outline.com/DjHJdV](https://outline.com/DjHJdV)

</comment><comment><USER21> I am curious to know how many other EV carmakers will be going direct to consumer. I know Tesla is doing it but they can't be the only one? I read about Rivian and Bollinger but i don't know if they are going D2C

</comment><comment><USER22> Can someone lift my european ignorance and tell me what's wrong with the dealers? How are they different from BestBuy, Target, etc - just essentially bringing the car to a showroom and selling it to you?

Why are dealers such a huge problem and who would buy such an expensive thing as a car without trying it first?

<comment><USER23> It is because a lot of dealers in US are dishonnest. For example they never honor the quote they themselves have given in email. They never tell the interest rate or car price they are offering. They always ask you what is your affordable monthly payment! After buying they push to extended warranty so much. You need to spend couple of hours just saying no. It is just a frustrating experience overall.

<comment><USER24> In Belgium, any price on email is valid in court.

Also, I have never seen issues like this here. The entire price has to be shown upfront and it's pretty boring actually.

Compared to the US, it seems great though

</comment></comment></comment><comment><USER25> It's been rather hard to find others who might have used Fair before ([https://www.fair.com](https://www.fair.com)) - or have an open opinion about it, short term leasing I guess would be best way to describe.

<comment><USER26> I've used Fair to lease a car. The entire experience has been a nightmare. Billing errors, really bad support, them losing records of giving me a car, charging me interest for not making a payment when their system had an error, their auto-pay system is broken, their mobile app not working, they forgot to register my car with the DMV, them not able to generate receipts for me, etc.

The idea is great, but have had a really bad experience so far. I hope the resolve these issues. We need more competition/innovation in the space.

<comment><USER27> Thanks for the honest feedback, Sahas. I'm a director of engineering at Fair, and we realize our ops and customer support need improvement (and we have directed significant resources in that regard).

I'm curious when you used us, as we have resolved most of those issues.

When trying to deconstruct the entirety of the car industry and re-invent it in an app, there are so many moving pieces and entrenched players.

For example, our partners on wall street (with whom we pledge the assets and finance them through securitization agreements require us to use third party servicers so that these cashflows would still be serviceable if we happen to go bankrupt. Thus, our recurring billing is still through them and these old school finance companies are not paragons of modern technology (to say the least).

We are moving a lot of this servicing and payments in house and focusing on core customer support experience as our top priorities for this year in order to ensure we can scale while providing an amazing experience.

I'd be interested in talking to you more about your experience. E-mail me.

</comment></comment></comment><comment><USER28> Yep, I work for Carnext.com, a spinoff of LeasePlan and we are doing this. Its very satisfying how hard everyone works to streamline the whole process from start of order to delivery of the car.

<comment><USER29> Is this like a Fair.com for europe? Any plans to come to the US with the service?

</comment></comment><comment><USER30> Anything would be an improvement.

I was looking into getting my first car recently. Narrowed it down to a few Honda models and walked into the SF Honda Dealership.

Never seen anywhere so incompetent in my life. When I asked about car features the guy would just Google "honda fit sunroof on ex?" where I could clearly see. I finally asked for a price and he came back with something 3.0x the market rate for the car ... When I asked why it was so high he said computer error nothing he could do.

So yeah, let's Amazon it up.

</comment><comment><USER31> Since I can't view the article can someone tell me what Amazon is doing in the title?

<comment><USER32> If you scroll down through the comments, by now someone would have posted an outline.com link that allows you to get around the paywall. That should get you to the article!

</comment></comment><comment><USER33> Article is paywalled so I'm just gonna assume my experience with Vroom is relevant.

The long and short of it is that Vroom sold me a car, promised delivery by a certain date, and missed it by about 3 weeks ostensibly because they noticed a variety of maintenance issues with the vehicle during "final conditioning". In addition to being almost a month late, the delivery driver was expecting to pick up the trade-in at the same time, despite the Vroom rep telling us more than once that they'd send a different driver for it within 3 days of delivery.

The process is online until you click "buy" and then everyone wants to spend just as much time with you on the phone as they would if you had walked into the dealer -- I spent most of the weekend on the phone. Their agents double as reps at a used car dealership in Houston and are frequently unavailable because they're out with an in-person client. It seems like someone goes out to the floor and drags them away from their physical customers when a Vroom customer calls in. Every time I sent an email about something, after an hour or so I'd get a reply asking me to call in to discuss.

Once you're finally done with all that, they overnight a stack of about 50 papers to sign and return. As soon as the return label is scanned, you're considered sold and they do everything they can to ignore and avoid you.

A few days after I finally got the car, I noticed a leak and took it to the dealer, where I paid to get it examined. Was informed that the water pump was going bad and would need replaced soon. I emailed Vroom about this while I was still within the return window, including a copy of the quote from the dealership, and they never replied. I didn't want to deal with the crap anymore, overall I was OK with the car, and the mechanical issues were non- urgent so I just let it go.

The only reason I don't 100% regret the transaction is because there were no local dealers that had the vehicle I ordered from Vroom in stock for the entire duration of the delayed shipment. I'm sure, however, that I would've had a better experience if I had just done eBay Motors or something. Buyer beware.

</comment><comment><USER34> Is there a way for people to learn to be good negotiators?

Below was my last negotiation. I think I did pretty well because I put a lot of research into it and had some background knowledge already. Most people won't have those luxuries, and I won't always be able to research or know everything before a negotiation. I would like to learn to be a better negotiator in general.

\---

I recently just bought a new vehicle. I found the VIN I wanted, called up the dealership and asked for the Internet Sales Manager's email address. Sent a very short email saying I'm ready to buy a 2019 MAKE/MODEL in City, State. The dealership's website shows VIN in stock, is it still available? And without incentives, what is their best offer on that vehicle?

I got an email with a number, it was very close to invoice, and replied when I would be there to take a look at the vehicle.

(Dealerships do need to make some profit to keep the lights on and pay salaries. Even if you pay invoice, the dealership still makes money on dealer holdbacks and dealer incentives. Additionally, you do not want the dealer to include customer incentives/rebates when giving you a quote, because that's money you'll be paying directly into the dealership's pocket otherwise. Agree on a price, then let the dealership know what incentives you're eligible for. Also check with your bank and organizations you're a member of for additional rebates, I got an additional $1000 just for being a member of my bank.)

The only tricks the dealership tried to play on me was the waiting game, and the dealership's protection package that they "already applied" for $1500. I told them to take it off or I walk. They came back at $500. I said the VIN etching is a $20 kit that only takes a few minutes to apply, we're already breathing 78% nitrogen, and I'll offer them $100 because the anti-theft lug nuts actually cost some money. I was immediately offered $150 with no window tint (the 4th and last part of the package which I guess they didn't really apply yet). Later the salesperson said he looked up their cost for the VIN etching and it was $68 because they had a third party do it for them. I looked up the cost of the OEM anti-theft lug nuts, and they were about the same, so $150 does seem like the dealer's cost on what I got.

I only realized after I took the vehicle home, that it didn't have the window sticker on it (illegal for the dealership not to display the Monroney Sticker). I did thoroughly inspect every part (including the engine compartment and undercarriage) of the vehicle and test all of the features to make sure they worked (and that the manufacturer didn't forget to install something - it's happened before), but somehow I overlooked that. I knew everything about the vehicle prior and got the PDF of the window sticker from the manufacturer.

<comment><USER35> >Is there a way for people to learn to be good negotiators?

Never Split the Difference by Chris Voss is the best book on negotiation I've ever read, and it's also pretty entertaining. I negotiate a lot at work, and that book helped me quite a bit. The negotiation style he advocates, aside from being effective, is also very personable. Which is great if you don't have the stomach for the (less effective) sleazy and aggressive styles.

<comment><USER34> Thank you for the recommendation. Does the book offer any suggestions on how to practice the ideas that might be presented to the reader?

I know there's a lot of books out there which admittedly I haven't really looked into, but my concern is that in the US, it would be hard for the average person to actually find an opportunity to negotiate.

<comment><USER35> Absolutely. The book is essentially about communication strategies, presented in a way that relates to negotiation. But the strategies are useful in so many contexts. We actually negotiate all the time, any time we're settling a difference of opinion, ask for something, have something asked of us, we usually end up negotiating. My girlfriend and I both use the strategies any time we 'argue' or disagree, because they're really just about communicating towards and amicable outcome.</comment></comment></comment></comment>


Show HN: Not just yet another remote job board - <AUTHOR> https://remoteclub.io <comment><AUTHOR> Hi,

to support many people locked in their houses and who lost their jobs I made a job board for remote jobs. Please don't think "Ugh, yet another remote job board" because mine is different:

\- It contains a lot of information about companies (year of founding, count of employees, headquarter location, and other things to check company reputation).

\- Users can recommend companies and write reviews for companies;

\- Users can subscribe by vacancies by categories or by companies they want to work in;

\- Companies can manage their profiles;

\- Candidates also can manage their profiles.

All of that is free. For companies and candidates.

I'd like to ask you for feedback. Welcome to [https://remoteclub.io](https://remoteclub.io)

</comment><comment><USER2> Simple, functional!

When trying to save settings, I guess the backend is validating Personal Profile Url for uniqueness and it fails [ Settings -> Personal Profile Url ]; but uniqueness must be checked in the context of a different user only!</comment>


The New Flowdock: a Mac App, New Design, Chat + Threading, Emoji… - <AUTHOR> http://blog.flowdock.com/2012/12/11/the-new-flowdock-a-mac-app-new-design-chat-threading-emoji/

<comment><USER2> I wish there were more screenshots of the App. I know you are pushing people to get started on the free trial and to actually experience the app but I really like to browse through all the various screens before diving in.

Looks like something I would consider dumping campfire for (campfire has never made me happy).

<comment><USER3> Thanks for the feedback, we'll be adding more of them, and blogging about individual features.

We actually have a Campfire importer in case you want to retain your chat history.

<comment><USER2> Thanks for reading the feedback :) Love that there is a campfire importer that we can import our chat history with!

</comment></comment></comment><comment><USER4> For someone who's not familiar with the app, I have to do a lot of decoding of your home page to figure out what exactly the product is and why I should be interested.

Your /tour "Features" page explains it much better:

"TEAM INBOX & CHAT Replace IRC, IM or Skype chat with Flowdock."

That's something I can quickly parse and immediately understand.

I also echo the sentiment that more screenshots (hopefully with call- outs/highlights) would probably help out.

<comment><USER5> Agreed, I went to click on the image of the chatroom on the homepage thinking it would zoom in on it, and instead I'm taken to a page with even fewer images.

</comment></comment><comment><USER6> This is a welcome change.

The previous design looked a bit rushed and the icons looked straight out of the 90s.

</comment><comment><USER7> Great job with the new design and especially the support for 1-to-1 messages!

</comment><comment><USER3> Thanks for the post! We've been working on this new release for a while, hoping to get lots of feedback from HN.

</comment><comment><USER8> You should be able to put flows into categories and make subflows.</comment>


Google Cloud Connect Now a Reality: Productivity Multiplier - <AUTHOR> http://www.productivitybits.com/productivity-multiplier-google-cloud-connect-now-a-reality Microsoft Office in sweet, dream-like harmony with Google Docs! <comment><AUTHOR> I love the fact that I can use my Microsoft Word (I use v. 2010) and can just sync it to my Google Docs account. The most obvious benefit is: BACKUP! Awesome!</comment>


Luxembourg Becomes First Country to Make All Public Transit Free - <AUTHOR> https://www.archdaily.com/908252/luxembourg-becomes-first-country-to-make-all-public-transit-free <comment><USER2> There's also Estonia: [https://news.ycombinator.com/item?id=19897702](https://news.ycombinator.com/item?id=19897702)</comment>


Google blocks Twitpic over alleged malware - <AUTHOR> http://thenextweb.com/google/2012/12/30/google-blocks-twitpic-over-alleged-malware-causing-chrome-to-deny-access-to-some-twitter-pages/

<comment><USER3> I posted this in another related submission-

We're trying to sort it out but there isn't really any information provided by Google/Chrome to go on. The best "details" they have show that Twitpic has 0 pages with Malware.

Crazy how some automated process at Google can kill an entire site just like that.

<comment><USER4> > Crazy how some automated process at Google can kill an entire site just like > that.

Google bases its entire company around automated processes. Sites are made and killed by Google's automated processes every day. If you want to ask Google about it you will be talking to yet another automated process.

<comment><USER5> Let's be realistic. Although this is the case for most sites, I doubt twitpic is going to end up talking to an automated process.

</comment></comment></comment><comment><USER6> Looks like yet another "malvertising" situation.

The Google Safebrowsing report [1] appears fairly ambiguous though:

"Site is listed as suspicious - visiting this web site may harm your computer (...)"

"Of the 12029 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-12-30, and _suspicious content was never found_ on this site within the past 90 days."

[1] [http://safebrowsing.clients.google.com/safebrowsing/diagnost...](http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Ftwitpic.com%2F&client=googlechrome&hl=en- US)

<comment><USER7> > Looks like yet another "malvertising" situation.

And that's all the same to end users. When will the web evolve past these pests?

<comment><USER8> They're working on it <http://www.adsintegrityalliance.org/> :-)

</comment></comment></comment><comment><USER9> I'm not sure this qualifies as news as this same thing has happened to other large sites from time to time.

What likely happened is that one of the 3rd party advertisers on Twitpic delivered ads that contain something classified as malware thus resulting in the entire Twitpic site getting blacklisted.

</comment><comment><USER10> It's not googles job to police the Internet. I, and many others, have been subjected to googles safe browsing malware flag without due cause. This is unacceptable and google overstepping its position.

I am beginning to hope that someone takes google to task and reigns in thier power over the Internet community. No company should have the ability to practically shut down websites at will.

<comment><USER11> When I worked at Google I got to hear a number of "My friends site is being accused of hosting malware but I know these guys they don't do that!" and almost without exception, what had happened was that someone had compromised the web server, downloaded the images, re-compressed them with an image based exploit (sometimes changing them from gif to jpg in the process) and put them back on the site. To Grandma and her friends the site hadn't changed in years, except that now it was doing a drive by injection of malware.

I don't doubt for a minute that if someone figured out how to create a twitpic app that could inject malware into the images you shared, they would try really hard to get it on to your phone. How great a coup to have all eleventybillion followers check out your latest 'woah!' picture and spread the malware. Its a primo target.

I'm not defending Google here, I'm just saying that putting malware into images is a primary goal of any number of advanced persistent threat shops. Keep that in mind and make sure you keep an offline MD5 hash of every picture on your web site for validation.

<comment><USER12> If that's what's happening here, then the warning seems good for everyone.. except that the wording is defamatory.

Rather than accusing Twitpic of being "a known distributor of malware", it might be better if the message said something like "The site appears to be infected with malware. This warning will be remain in place until the malware has been removed."

</comment></comment></comment><comment><USER13> They blocked Twicsy today too, for using a pretty reputable ad network. It seems anti-competitive to me. Google knows it is an ad network that is causing the problems, they even pointed me to the supposedly malicious script. If they know that, they can just disable the ad network and send me a notice on Google Webmaster tools. They did neither, instead they block Twicsy for everyone and display a nasty message. It is ridiculous.

</comment><comment><USER14> Interestingly, if you try to load any page with Twitpic content embedded you get the same warning.

Try to load the founder's page on Twitter: <http://twitter.com/noaheverett>

"Danger: Malware Ahead! Google Chrome has blocked access to this page on twitter.com. Content from twitpic.com, a known malware distributor, has been inserted into this web page."

</comment><comment><USER15> I wonder if Google's malware warnings have ever been reviewed by lawyers. Because this entire feature smells like a lawsuit waiting to happen.

<comment><USER16> The closest analog would be antivirus software deciding your legitimate app was malware, but I can't find any lawsuits over that with some quick searching. Anyone remember one?

Punishing anti-malware software for false positives may feel like it could be warranted at times (at least in cases of anti-competitive actions or extreme incompetence), but it seems like it would set an extremely poor precedent. Even worse would be someone winning a case like "yes, there was malware, but you should have sent users though anyway."

Which kind of points to the reason why you probably won't see a case like this go far. Whether or not it's bad from the website's point of view, users chose to install a browser that blocks what it thinks are infected sites, and there's still the option (however small or hidden) to click through or disable the warning. There are also tools to figure out why you're blocked (I'm not sure about Microsoft or Opera's system, but I assume so), even if they can be annoyingly slow in internet time.

I don't think there's any more case than suing over a browser displaying a broken lock icon (or not loading a page at all) when you serve content over mixed secure and insecure connections, or warning that a self-signed certificate is untrusted and may be an attempt to hijack and redirect you.

<comment><USER12> Have you actually looked a twitter page that uses Twitpic? The text Chrome produces reads:

"Danger: Malware Ahead! Content from twitpic.com, _a known malware distributor_ has been inserted into this page. Visiting this page now is very likely to infect your computer with malware.

Malware is malicious software that causes things like identity theft, financial loss, and permanent file deletion."

If this turns out to be a false positive, it certainly looks as though Google has committed a serious act of libel against a competitor by claiming that they are known to be malicious and involved in crime. Furthermore they prevented millions of customers from reaching another competitor (and partner of the first competitor) in order to deliver this message.

There's no mention of the possibility of there being a false positive, or how the conclusion was reached, or the general rate of false positives, or the fact that it's Google's opinion.

The fact that we assume it's an automated detection system doesn't absolve Google of responsibility for what they are communicating and the damage it can do to their competitors reputations.

If it does turn out to be a false positive, will Google contact all the people who saw that message to inform them that they were wrong?

I hope it's not a false positive.

<comment><USER17> In the US libel requires a statement to have been made with malicious intent. Quite simply, this is in no way libel, nor should it be.

I'll take occasional minor shortlived inconveniences over security breaches anyday.

<comment><USER12> I doubt you'd consider it a "minor shortlived inconvenience" if Google informed millions of people that your business was a known distributor of malware.

Google can perfectly well block the malware without making such an accusatory statement. It's not a tradeoff, so I don't really know why you are defending them.

<comment><USER17> What would you'd reckon the accuracy of the algorithms are? I'd have thought the numbers probably justify the language.

Security is a tradeoff, if you do business on the web, deal with it.

<comment><USER12> Clearly you haven't thought this through.

Security is sometimes a trade-off but in this case there is no trade-off involved. Google can just as easily block the malware without the potentially defamatory language.

The accuracy of the algorithm is utterly irrelevant.

<comment><USER17> Rubbish. The trade-off in this case is that a more mealy-mouthed warning would lead to more people clicking through.

<comment><USER12> Nobody except you is suggesting a mealy-mouthed warning - that's a straw-man.

An accurate and informative statement like:

"Google's Scans detected malware <X>, which is known to do harm <Y> within the past <N> hours at <Z> percent of the pages operated by <COMPANY>. Google recommends that you do not click on this link until this warning is lifted. [Site owners click here for detailed information]"

...would be just as effective.

Scare tactics, especially those that might be laying blame incorrectly, simply breed ignorance, and ignorance is the enemy of security.

<comment><USER17> _it might be better if the message said something like "The site appears to be infected with malware.This warning will be remain in place until the malware has been removed."_

That's what you suggested, seems pretty mealy-mouthed to me.

<comment><USER12> Presumably you don't judge my second suggestion 'mealy mouthed' otherwise you'd have quoted that instead.

So even by your judgement of what is 'mealy mouthed', an effective and accurate warning is clearly possible. You might not have liked the wording of my first suggestion but that doesn't change the argument.

There is no valid trade-off that requires Google to use accusatory wording in order to protect people from malware. It would clearly be an improvement if their messages were more accurate.

<comment><USER17> There obviously is a trade-off between the strength of the language and the number of people who will click through.

The messages are accurate, Twitpic was unfortunately a distributor of malware. Here's a copy and paste of the current detailed report.

 _What happened when Google visited this site? Of the 12910 pages we tested on the site over the past 90 days, 31 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2013-01-01, and the last time suspicious content was found on this site was on 2012-12-30. Malicious software includes 13 trojan(s), 4 exploit(s). Successful infection resulted in an average of 8 new process(es) on the target machine.

Malicious software is hosted on 5 domain(s), including mpchester.info/, malatyuhr.com/, iloveeu.info/.

2 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including 2upmedia.com/, adexcite.com/.

This site was hosted on 3 network(s) including AS36351 (SOFTLAYER), AS15169 (Google Internet Backbone), AS31815 (MEDIATEMPLE).

Has this site acted as an intermediary resulting in further distribution of malware? Over the past 90 days, twitpic.com appeared to function as an intermediary for the infection of 1 site(s) including ow.ly/._

[http://safebrowsing.clients.google.com/safebrowsing/diagnost...](http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Ftwitpic.com%2F)

I'm not sure why you're placing the business interests of Twitpic over the safety of users, but I disagree with your attitude. I'm done here.

<comment><USER12> _There obviously is a trade-off between the strength of the language and the number of people who will click through._

Maybe, but I'm not arguing about the 'strength' of the language. I'm arguing about the accuracy of it.

 _The messages are accurate, Twitpic was unfortunately a distributor of malware. Here's a copy and paste of the current detailed report._

Actually, this report proves my point. Twitpic is implicated because ad networks they embed have distributed malware.

This is a perfectly good reason for warning people, but it is not justification for calling Twitpic "A known distributor of malware" - <USER2> statement which portrays Twitpic as an intentional agent in this.

If I called you "A known distributor of falsehoods", and my evidence was that you made a few mistakes on a math test, and mistyped the a URL in one of your postings, I imagine most people would consider that a misrepresentation, because the phrase "A known distributor" implies agency and intent.

Another analogy would be if a grocery store carried a batch of improperly pasteurized milk from that people got food poisoning from.

Calling the grocery store "A known poisoner" would be an obvious misrepresentation.

In just the same way, Twitpic is not "a known distributor" of malware.

 _I'm not sure why you're placing the business interests of Twitpic over the safety of users, but I disagree with your attitude._

You are simply misrepresenting my position. You keep making a false dichotomy, as though the users safety and accurate messaging are in conflict with one another. This is not true.

It is perfectly possible for Google to strongly state their opinion about the dangers of clicking through without misrepresenting twitpic.

I think that the communications of those in a position of power should be critiqued, and I think that misleading people 'for their own protection' is almost never justified and certainly shouldn't be casually accepted as a necessary tradeoff.

I disagree with your attitude too, but I guess at least we know where we stand.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> I cannot even load tweetdeck at the moment as it seems to preload the images on the links thus showing the big red screen

</comment><comment><USER19> This is showing up in Firefox as well, since it uses "Google Safe Browsing" for information about suspicious sites.

</comment><comment><USER20> even Firefox now warns its users <http://browserfame.com/1049/chrome-twitpic- malware-warning>

<comment><USER19> That's because both Firefox and Chrome use the same source of information about potentially dangerous sites. It doesn't make Twitpic.com more suspicious.

</comment></comment><comment><USER21> I'm happy to use a third party client to browse twitter...

<comment><USER22> While this gets you over this minor inconvenience , is it really worth the risk of exposure to malwares?

<comment><USER23> You're presuming right now that the detection is accurate and that, if it is, third-party Twitter clients would be susceptible to the same vectors.

You have an exposure risk every time you use the Web; managing that risk is part of what we do as users (and, to a greater degree, as professionals).

<comment><USER16> if you're ready to manage that risk (based on gut instinct that this is a false positive?), just click through. I don't see the issue there for users. The real issue is false positives from the website's point of view, since the vast majority of users won't click through by design.</comment></comment></comment></comment>


Facebook invites press to 'see what we're building' - <AUTHOR> http://www.theverge.com/2013/1/8/3852454/facebook-press-event-january-15

<comment><USER2> New phone?</comment>