Adobe Spyware Reveals Again the Price of DRM: Your Privacy and Security - <AUTHOR> https://www.eff.org/deeplinks/2014/10/adobe-spyware-reveals-again-price-drm-your-privacy-and-security <comment><USER2> > As our friend Cory Doctorow has been explaining for years, DRM for books is > dangerous for readers, authors and publishers alike.

Richard Stallman explained it a decade earlier in a piece worth reviewing now and then -- [https://www.gnu.org/philosophy/right-to- read.html](https://www.gnu.org/philosophy/right-to-read.html).

<comment><USER3> Except, even if Stallman didn't realize this, the story is mostly about state violence ("you could go to prison for many years for letting someone else read your books", "free operating systems ... were they illegal") where DRM is used as a tool to control and monitor people.

DRM itself is not good or bad. As everything else, it can be abused, as Sony and Adobe showed us, or can be used for good (or neutral), for example, to allow indie shareware developers to let us try their software before purchasing a little registration code (I know, not free software, but let's not start this debate for now).

It's a logical error to say that DRM itself is evil when some of the instances of it are evil.

DRM is a "smart contract", a protocol for enforcing a contract without laws or violence. When you read that a person goes to prison for breaking DRM, realize that it has nothing to do with DRM, it's about state using violence to protect a failed smart contract, which is the opposite of the purpose of such smart contract.

<comment><USER4> > It's a logical error to say that DRM itself is evil when some of the > instances of it are evil.

All of the instances of DRM are evil, because all of the instances of DRM'ed stuff prevents practical and unlimited sharing.

In the digital world, any limitations on copying bits are akin to virtual restraints and locking information away. It prevents you from doing anything else than what the golden prison allows.

<comment><USER5> > In the digital world, any limitations on copying bits are akin to virtual > restraints and locking information away.

Jennifer Lawrence might disagree with your laissez faire attitude.

<comment><USER4> I'd argue that Jennifer Lawrence's sensitive bits shouldn't have been given to someone else (Apple) in the first place.

<comment><USER6> I assume you store all your money under the mattress? We all store "sensitive bits" (information) with others.

<comment><USER7> Sure. But there's not much to complaint about when those 3rd parties f __* up, if you used them voluntarily...

<comment><USER6> I think you've just invalidated contract law wholesale.

<comment><USER7> Is that even valid when the contract is nothing more than a ToS that everybody agrees on without reading and most probably not enforceable in court?

<comment><USER8> I side with icebraining here.

The statement "there's not much to complaint about when those 3rd parties f* up, if you used them voluntarily." taken in general can refer to pretty much everything we encounter in everyday life. There are lot of implicit contracts made, and breaking some of them could be recognized in court (there's the concept of acting in bad faith).

In this particular case, JenLaw et al. have all the rights to be mad at Apple because of the broken ToS/implicit contract that said "this is my data, it's only backed up and will not be shown to third parties". Whether or not they have shown _practical wisdom_ by using the service is a whole another matter.

That's basically the crux of disagreements around the "victim blaming" concept. People confuse two different things here - morality of whether something should be done, and the probability it will happen in practice. If I get mugged under the bridge in the middle of the night, I'm not morally at fault for being mugged (it's something that shouldn't be done), but I also haven't shown practical wisdom by going alone at night under the bridge in dangerous area (by doing so I increased the probability it will happen to me).

<comment><USER9> As far as I remember though, the "breach" was not on Apple's part but on the victims who chose weak passwords; can we blame Apple for this ? Except maybe for a lack of forceful education ?

The original sentence becomes "Jennifer Lawrence shouldn't have stored sensitive information externally without using a minimum of good security measures" in this vision.

<comment><USER8> > _As far as I remember though, the "breach" was not on Apple's part but on > the victims who chose weak passwords; can we blame Apple for this? Except > maybe for a lack of forceful education?_

In this case I guess we can blame Apple only for the "lack of forceful education"/crappy security ideas (security questions in 21th century, really?).

There is one funny thing about the Fappening - there was this movie[0] released few months ago, that featured a couple making a sex tape that ends up accidentally distributed to their extended families and friends thanks to iPads and cloud backup. The best line from the trailer:

        - It went up! It went up to the cloud!
        - And you can't get it down from the cloud?
        - NOBODY UNDERSTANDS THE CLOUD! It's a fucking mystery!

Call it a prophecy.

[0] - [http://www.imdb.com/title/tt1956620/](http://www.imdb.com/title/tt1956620/)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> God love the EFF, but they're using this as a platform to talk about one of their favorite hobby horses, and that's kind of obscuring the problem. Read the original article in which this was discovered -- this has nothing to do with DRM.

[http://the-digital-reader.com/2014/10/06/adobe-spying-users-...](http://the- digital-reader.com/2014/10/06/adobe-spying-users-collecting-data-ebook- libraries/)

Adobe is collecting data about _every ebook on your system,_ regardless of whether it's using DRM and even regardless of whether it's even being managed by the Adobe Digital Edition reader. (And for an added security bonus, they're sending it in plain text.) If you install and launch the new version of ADE, it's going to do this whether or not every single ebook you have on your system is DRM-free.

This is certainly an electronic privacy issue, but it's _not_ a DRM issue just because Adobe Digital Editions supports Adobe DRM, and the EFF's headline is a little disingenuous. Adobe's rationale for this collection is indeed claimed to be related to licensing, but the biggest problem is how wide a net they're casting and how intrusive this information is -- ironically enough, if it was only sending this information about DRM-encumbered books, it'd arguably be much less of a scandal. (Although the fifty-eight people in the world using Adobe DRM would still have every right to be pissed.)

<comment><USER11> Since Adobe is not selling books, how do they benefit from parsing this data? If not for DRM-style tactics?

Are they selling it to third parties? Unless this is the case, then I'd say their obsession with DRM and rights management is the primary issue. Without of course discrediting that digital surveillance is the new standard.

<comment><USER10> As I said (well, quoted), it _is_ for licensing -- Adobe is apparently trying to support some kind of "metered licensing," in which you might pay by how long you keep a book out or even by how far you read in it. Is that the same as DRM? In practice, mostly, since it's hard to see how that particular scheme would work without DRM. (But licensing is not the same as DRM, right? I buy a lot of DRM-free tech books, but that doesn't give me license to put those books up for free on my web site.)

But I'd nonetheless argue that the primary issue is _not_ that Adobe is implementing new licensing schemes of dubious value. It's that Adobe implemented them in an exceedingly invasive way. I don't use Adobe Digital Editions unless I absolutely have to, but until now that's been because the software is awful, not because it's philosophically objectionable.

I'd also argue that it may not be entirely fair to describe Adobe as "obsessed with rights management"; they're providing a platform for publishers, and using DRM -- or not -- is the publishers' choice. The chances are high that the "metered licensing" concept was borne of publisher request, not an Adobe plan to make everyone's life difficult. Making everyone's life difficult is just Adobe's standard execution plan.

</comment></comment></comment><comment><USER12> One can only hope this blows up for Adobe the same way that Sony's music rootkit did. The sooner companies understand that DRM is a universally hated technology, the sooner we can all move on.

<comment><USER13> Don't you think they already know that?

Abolishing DRM will require new breed of company. Only a few can still be profitable without it (Mozilla, anyone?). Those who can't should also be abolished together with DRM as outdated and obsolete (especially the worst offenders like Amazon or Adobe).

<comment><USER14> The publisher chooses to add DRM on Kindle books. Amazon doesn't require it; it's a checkbox in the publishing portal.

There are plenty of Kindle books that have no DRM.

<comment><USER15> Amazon chooses to offer that option. They're big enough now that they could get away with, for instance, charging a larger fee to publishers who apply DRM, or reducing their fee iff you don't apply DRM.

<comment><USER12> Amazon has no reason to do that. Their mission there is to serve their publishers, and if the publishers want to DRM it up, that's on them.

<comment><USER15> Amazon has the same reason to do that that Apple did when dropping DRM from the iTunes music store.

And no, Amazon's mission is not to serve their publishers, because their publishers aren't the ones giving them giant piles of money. Their publishers give them products to sell; their customers give them money for those products. Amazon's mission is to get as much from their _customers_ as possible. Whether they can get more from their customers with or without DRM is a reasonable question, but the publishers only come into it if there's a belief that a significant number of publishers would leave.

<comment><USER16> That's not really true.

Apple faced two pressures which forced them to drop DRM from their music store: (1) Amazon MP3 who used lack of DRM as a point of differentiation over Apple and (2) the threat of regulatory action in Europe due to lack of interoperability.

Amazon today is in the same position in terms of ebooks as Apple was with music at the time - it uses DRM to lock customers into its hardware product, in turn driving further purchases towards its own store. This may or may not be a revenue-maximising strategy for them but it certainly looks like a market share-maximising strategy. Apple is also in a similar position again trying to drive purchases to its own store.

At the same time, regulatory action on competition has been more focused on contractual terms and price collusion/fixing than on interoperability; regulators will probably want to wait a while after sorting that mess out to observe whether they see competition acting effectively or not before addressing interoperability in ebooks.

For the same pressures and reasons to cause DRM to be dropped from ebooks, I think it will take an outside competitor (probably a new entrant) without a significant stake in hardware AND with substantial buying power to break this cycle. I can't think of an obvious candidate to do this today but perhaps I'm missing one.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> I play pirated copies of games I bought and own on steam because I don't want steam to know how many hours I play my games, when I play them, from what place etc. I consider that is not anyone's business.

Adobe's spyware isn't that different from what gamers have accepted with Steam unfortunately. Will book readers accept it, the way gamers did, or will they fight back? Unlike video games, there are alternatives, that are still popular (buying books on paper). I don't ever intend on spending any $ on a drm'd book when I can have it on paper for the same price without DRM.

<comment> k-mcgrady >> "I play pirated copies of games I bought and own on steam because I don't want steam to know how many hours I play my games, when I play them, from what place etc. I consider that is not anyone's business."

Just a hypothetical:

If the developer was giving you a discount on Steam because they could collect this information would you still buy it from Steam and then pirate it (getting the discount but not providing the information) or would you pay full price somewhere else? Not judging, just curious.

<comment><USER17> I buy games because I support the developers. I've spent full price money online on games that could've been bought for cheaper in physical form (amazon.fr is almost always cheaper than steam prices actually unless Steam is going through a sale. Regular prices on steam are always more expensive than getting the box delivered at your door). So, no. I wouldn't trade my privacy for cheaper prices, since the one reason that makes me "honest" and buy games in the first place is spending my money on things I like. I bought all the classic RPG I liked, and already owned in physical forms, on gog.com, just to show an interest in what I saw as a dying genre. Plus the fact that they are the only gaming platform that is DRM-free. Then I supported the kickstarter renaissance (Wasteland, Torment etc).

I've put my steam profile on private, but if you could see it, you would see almost no game past 1hour of play because I never play games from steam. I only buy them on steam, then I download a copy that will not violate my privacy. Because for as long as I breath I will not let anyone intrude on my privacy. Also, when given the choice between steam and gog, I obviously chose gog.com.

<comment><USER18> It doesn't make sense. On one hand you're against violating your privacy. But on the other hand you are still supporting financially the very same developers who are OK with such violations when they offer their games through Steam. You're still increasing their Steam sales numbers, so obviously they will continue to publish their future content on this platform.

> I only buy them on steam, then I download a copy that will not violate my > privacy.

There's a third choice - don't buy the games that violate your privacy and don't play them. You've pointed out great ways to support developers that don't violate privacy (GOG.com, Kickstarter) - why not stick only to these? Unless, your urge to play a video game is bigger than your integrity.

<comment><USER17> > There's a third choice - don't buy the games that violate your privacy and > don't play them. You've pointed out great ways to support developers that > don't violate privacy (GOG.com, Kickstarter) - why not stick only to these? > Unless, your urge to play a video game is bigger than your integrity.

I support these options when they are available. But when you have a certain taste for specific niche of games, sometimes there is no alternative. Kickstarter has managed to bring back the classic top down, turn based party RPGs, which is fantastic, but I haven't seen any developer try to bring genres like RPG sandbox (ala Skyrim) or grid based, turn based dungeon crawlers (MMXL, which has one of the most annoying DRM, is the first game to be released in the genre in decades) to Kickstarter yet.

Sure, I'm making a dent on my integrity by buying these games but I don't see it as a great evil as long as we're still able to fight against privacy- invading schemes. If that option was no longer there, I would stop playing these games. I also feel that the developers deserve the support, they aren't responsible for the publishers requirements. I don't wish for them to go out of business, I'm optimistic that the growing success of Kickstarter and gog as a platform might change their mind in the long term, I don't think it's all black & white where we either support kickstarter or support DRM published games.

I'll remind you that many of the current great kickstarter developers come from a classic DRM supporting background. Obsidian, for example. Their last RPG, Fallout New Vegas, depended on Steam as their DRM. They saw the success of kickstarter, started their own project on it (Pillars of Eternity), succeeded in crowdfunding it and might end up relying more often on crowdfunding their games in the future. Pillars of Eternity will be DRM-free.

Now the question is, do you think it would've been better if no one had bought their games before? You think it would have been better if they had gone out of business? I do not believe so. PoE exists today because Obsidian could afford to build itself as a studio and recruit some of the best developers of the genre.

Showing support for crowdfunding, buying games on gog.com will help these developers free themselves from the shackles of the bad publishers. Boycotting developers that are still kept in shackles will not do anything but destroy their livelihood. Particularly as publishers are very likely to blame piracy when the games don't sell well.

The fact that a lot of pre-established developers are turning to crowdfunding bodes well for the future in my mind.

<comment><USER18> > But when you have a certain taste for specific niche of games, sometimes > there is no alternative.

There absolutely is. You can just not play. Video games aren't an essential commodity; they are a luxury.

Just because I need to edit a photo using a Spot Healing Brush and I don't like cloud-based subscription doesn't mean I get to pirate Photoshop.

> I also feel that the developers deserve the support, they aren't responsible > for the publishers requirements. [...] Now the question is, do you think it > would've been better if no one had bought their games before? You think it > would have been better if they had gone out of business? I do not believe > so. PoE exists today because Obsidian could afford to build itself as a > studio and recruit some of the best developers of the genre.

Except there are independent developers who succeeded without the need of going through classic big-house publishers: Mojang (before their acquisition by Microsoft) and Grinding Gear Games are two popular examples. Both of them did so with their first games. They built their reputation from scratch - nobody bought their games "before" because there were no such games.

And yes, there's nothing wrong with going out of business if you're doing a bad job and somebody else can do it better.

> Boycotting developers that are still kept in shackles will not do anything > but destroy their livelihood.

On the other hand, it will promote the livelihood of those developers who took risk and published their games independently. It also isn't black and white where we either support old studios or they go bust and there are no more new games whatsoever.

One more thing. It might be a long shot, but if you're interested in grid- and turn-based RPGs, maybe give Dofus or Wakfu a shot. I'm saying it's a long shot because a) they are MMORPGs; b) they are subscription-based; c) they look cartoonish, almost anime-like. But they can get surprisingly complex and fascinating plus they are refreshing takes on seemingly played-out fantasy role-playing genre. They weren't on Kickstarter because they were developed by an indie French company for 10 years.

<comment><USER17> > Just because I need to edit a photo using a Spot Healing Brush and I don't > like cloud-based subscription doesn't mean I get to pirate Photoshop.

The comparison is disingenuous, I buy all the games I play at their full price, some games I've even bought twice (all the classics available on gog with the DRM removed).

> Except there are independent developers who succeeded without the need of > going through classic big-house publishers: Mojang (before their acquisition > by Microsoft) and Grinding Gear Games are two popular examples. Both of them > did so with their first games. They built their reputation from scratch - > nobody bought their games "before" because there were no such games.

Sure, but not all types of games can be made with a small and inexperienced team. Something like Minecraft, which is mostly procedural content, or a diablo like cannot be compared to a lengthy RPG.

> And yes, there's nothing wrong with going out of business if you're doing a > bad job and somebody else can do it better.

If they made a good game, and all that's bad about it is the drm scheme, is that really a "bad job"?

> One more thing. It might be a long shot, but if you're interested in grid- > and turn-based RPGs, maybe give Dofus or Wakfu a shot. I'm saying it's a > long shot because a) they are MMORPGs; b) they are subscription-based; c) > they look cartoonish, almost anime-like. But they can get surprisingly > complex and fascinating plus they are refreshing takes on seemingly played- > out fantasy role-playing genre. They weren't on Kickstarter because they > were developed by an indie French company for 10 years.

Unfortunately, I'm pretty averse toward MMOs in general, I don't like games over which I have no control, that could be shutdown at any moment, or change in a way I might not like in a patch (as MMO have a high tendency to constantly go through rebalance, skill changes etc). I don't mind the anime- like stuff when the gameplay is good though, although I'll always feel games would be better without it. I don't mind buying and playing games on console platforms like the 3DS when I know that at some point in the future they will be emulated and thus ensure the long term archiving and playability of the games, so I've had experience with games like Etrian Odyssey IV, which have bad (in my opinion) graphic style, but classic gameplay that has been long forgotten on the PC. I like big dungeon mazes and having to draw my own maps, it's a nice throwback to the era of games like Wizardry and older Might&Magic. The closest to that in the world of indies on PC is Grimrock, but the combat is real time and pretty badly done, consisting of a mumbo jumbo dance where you step back and forth in a hit and run fashion.

Overall, I'm willing to compromise with DRM, as long as there's a way, be it in the present (like with most PC games) or in the future (like 3DS games) to eliminate it. This is also why I didn't buy into the newer generations of consoles, with Moore's law more or less coming at an end, I don't think we'll ever be able to emulate Playstation 3 games, for example, at a decent speed. Current handhelds, while not being emulated yet, are still within the realm of possibility. For home consoles, CPU just aren't progressing fast enough, single core performance seems like it'll reach a standstill soon and it already takes a high end CPU to fully emulate something like the PS2, nevermind thinking about something like the Cell.

I don't play a lot of games, but those I do play and enjoy tend to be games I enjoy revisiting decades later. For that matter, I'm currently replaying Wizardry 6 as I'm in a heavy dungeon crawling mood. This is also partly why, to me, it is important for the possibility of getting rid of DRMs to exist.

Other than not liking MMOs, I do have a varied taste in RPGs. I can go from games like Wizardry, to gridbased/tactical RPGs like Jagged Alliance 2 and Fire Emblem, to sandboxes like Skyrim. RPGs are pretty much the only genre of games I play.

<comment><USER18> > The comparison is disingenuous

I disagree. I can always pay the monthly subscription equivalent of the old standalone license and then just torrent the DRM- and cloud-free version of Photoshop. The developer still technically gets paid, but I'm under no illusion that my actions are in any way justified.

> a diablo like cannot be compared to a lengthy RPG.

I tried to look up how "lengthy" this game exactly is going to be and I'm not content with my results. "Our goal is to make it as long as possible with the funding that we get from Kickstarter" is as bland response as it can get. And from the look of it Pillars won't have a decent voice acting. Path of Exile does, not only main characters taunts, but also NPC dialogs and environmental lore (journals, statues, inscriptions, etc.). Recently, they released an expansion pack which added more story and fully voiced NPCs. In my book this "Diablo-like" can hold candle to a "lengthy RPG" just fine.

I really hope Pillars succeeds, but I'm going to hold my judgement until it's fully released.

> If they made a good game, and all that's bad about it is the drm scheme, is > that really a "bad job"?

Apparently it is, since it's such a deal-breaker for you and you actively seek DRM-free games. And it's ok, because user experience is extremely important. Even if the gameplay is good, technical obstacles which won't let players enjoy the game will absolutely ruin its opinion. It was especially evident with always-online games that had problems during the launch (Diablo III, SimCity).

> Unfortunately, I'm pretty averse toward MMOs in general (...)

Ah, well. They're not for everyone. I'm not a big fan of them myself; I prefer to go at my own pace and often end up playing them like in a single-player mode.

Interesting point with emulation; I haven't considered that.

> Other than not liking MMOs, I do have a varied taste in RPGs.

What about roguelikes? Again, they might not be for everyone, but I had tons of fun with classics like Nethack and ADOM.

<comment><USER17> > I disagree. I can always pay the monthly subscription equivalent of the old > standalone license and then just torrent the DRM- and cloud-free version of > Photoshop. The developer still technically gets paid, but I'm under no > illusion that my actions are in any way justified.

I am not looking for justifications. I am passionate about what I like, and what is essentially cultural content, rather than a tool. I don't see games the way I look at software, I see no need to "preserve" software. I do see a need for open formats, supporting interoperable standards etc though. But I really don't care if an old version of photoshop, or whatever, stopped working in a few decades. I'll still want to be able to run my favorite classics. I don't want a world where the things I bought and greatly enjoyed might stop working at some point. I am not looking for a moral justification or law or whatever. I don't care. It is just something I am passionate about. I buy the games not because the law requires me to do so, I buy them because I love them, because I want to support the developers, even if I don't like the DRM.

> I tried to look up how "lengthy" this game exactly is going to be and I'm > not content with my results. "Our goal is to make it as long as possible > with the funding that we get from Kickstarter" is as bland response as it > can get. And from the look of it Pillars won't have a decent voice acting. > Path of Exile does, not only main characters taunts, but also NPC dialogs > and environmental lore (journals, statues, inscriptions, etc.). Recently, > they released an expansion pack which added more story and fully voiced > NPCs. In my book this "Diablo-like" can hold candle to a "lengthy RPG" just > fine.

Do you have any experience with branching storyline content ? RPGs like PoE are extremely difficult to do well because we're talking about a particular flavour of RPG, that of "Choice&Consequence", where you can have an impact on the storyline, the way you handle quests, the way the world react to your actions etc. PoE comes from the Fallout/Arcanum/Mask of the Betrayer lineage of RPG when it comes to that kind of content. All these games tend to have as a side effect a certain amount of bugs despite all the testing and Q/A that goes through, it's inherent to the genre and both Fallout and Arcanum are still getting new fan patches to this day, which is a testament to the complexity involved. I have never seen a game with a certain amount of branching that wasn't overly complex to handle. What games like Fallout/New Vegas/Arcanum did with branching simply does not compare to what happens in games like modern Bioware stuff, or Bethesda. The epilogue details all the actions, and the consequences they brought, to all the places you visited, the characters you interacted with etc. The games have a lot of reactivity. The number of variables to keep a track of is overwhelming. This isn't like games where the gameplay doesn't go beyond monster bashing.

Things like voice acting are honestly not in my list of priority in a game, any game. Voice acting doesn't add complexity in development either, it requires more funds to be spent on actors, funds I'd prefer to see being spent on more quests, more branching complexity, more testing and polishing.

> What about roguelikes? Again, they might not be for everyone, but I had tons > of fun with classics like Nethack and ADOM.

Nethack is a favorite of mine but I don't have any experience with ADOM. A lot of great RPGs subgenres to go through and too little time.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Where does the DRM part come into play? The description sounds like it could be applied to just about any automatic sync-your-progress-across-devices feature, which is a hugely desirable feature IMO (my Kindle would be worth a huge amount less without it, since books almost always take multiple reading sessions to finish), and it's also very useful for movies/TV...

<comment><USER20> Well, one reason: because if we had the freedom to use any ebook reader we wanted, then we wouldn't have to rely on Adobe spyware. DRM prevents that.

</comment></comment><comment><USER21> > Second, sending this information in plain text undermines decades of efforts > by libraries and bookstores to protect the privacy of their patrons and > customers.

Someone needs to sue Adobe over this. That way we can stop such future invasions of privacy from DRMed machines in the future.

Also, Microsoft will do much of the same with Windows 10, collecting data not just on ebooks, but _any_ file you might open, and even characters you may type. Digital Editions is one app. Windows 10 is a whole OS, which makes the whole thing a lot scarier:

[http://www.theinquirer.net/inquirer/news/2373838/microsofts-...](http://www.theinquirer.net/inquirer/news/2373838/microsofts- windows-10-preview-has-permission-to-watch-your-every-move)

<comment><USER22> sans file monitoring (though windows has been offering to send heuristics and file signatures though windows defender for a while now)

isn't that stuff that most already have signed away on? iOS's autocorrection for their keyboard, and cloud processing for siri? and same for android's TTS, STT engines (both are cloud-based by default if I'm not mistaken)? (and the google keyboard)

without asking the user to agree to such things, microsoft can't enter the mobile device arena to the same degree as competitors

<comment> k-mcgrady >> "iOS's autocorrection for their keyboard"

I'm pretty sure nothing you type leaves the device on iOS unless you give permission (which you can do with third party keyboards).

</comment></comment></comment><comment><USER23> Processor-level support for DRM will make future cases more interesting, [https://www.virusbtn.com/virusbulletin/archive/2014/01/vb201...](https://www.virusbtn.com/virusbulletin/archive/2014/01/vb201401-SGX)

 _" If software and hardware could be 'sealed' in some way to prevent an attacker from examining data in main memory, even if the attacker had administrator level privileges on the machine, not only could the confidentiality and integrity of data in the cloud be protected, but the algorithms and design of cloud hosted applications could also be hidden from prying eyes."_

<comment><USER24> _the device ID, which is a 128-bit unique number tied to the processor._

15 years ago Intel tried this, and there was enough opposition that they removed the feature in later models: [http://en.wikipedia.org/wiki/Pentium_III#Controversy_about_p...](http://en.wikipedia.org/wiki/Pentium_III#Controversy_about_privacy_issues)

When SGX gets implemented in a future processor, will the users once again fight strongly against it, or will they submissively accept it without resistance, looking only at the claimed "security benefits"? I really hope it'll be the former.

Reading the rest of that article and the linked Intel documents just... gives me a very bad feeling about the direction things are heading.

<comment><USER23> Devil is in the details, e.g. in all processors or optional? Can hardware owners set root keys? How will enclaves interact with client Hyper-v, Yosemite OS X hypervisor, html5 drm, open-source virtualization & crypto, etc.

<comment><USER25> Protecting content from users is a failed game. This kind of protection is useless. At the very least, they need to decrypt information before it passed through our eyes and ears - that's the weak link in the chain.

<comment><USER26> I think the weak link in the chain is only _after_ decryption, but _before_ uncompression (for lossy formats, so books excluded). See, for example, [1] and [2], where the authors look at randomness and entropy measures of I/O to find where the decrypted-but-compressed buffers are.

[1] [http://moyix.blogspot.de/2014/07/breaking-spotify-drm- with-p...](http://moyix.blogspot.de/2014/07/breaking-spotify-drm-with- panda.html)

[2] [https://www.usenix.org/node/182951](https://www.usenix.org/node/182951)

</comment></comment></comment></comment></comment><comment><USER27> Fortunately Kindle DRM is so trivial to remove. I wish it had none but at least I know my books are mine forever and my reading habits are not being actively tracked if I use free non-Amazon ebook software.

Amazon seems to turn a blind eye to it, probably because so few readers can be bothered using de-drm software.

<comment><USER28> I learned to de-DRM my Amazon books due to the concerns of their licencing. Now I can put them on my phone and listen to the books with TTS. The kindle App for Android doesn't have the feature...

<comment><USER29> if the kindle app for ios is the same it does, highlight speech and tap the speaker icon at the bottom right

</comment></comment></comment><comment><USER30> Adobe is taking a pummeling this week. This news is nicely timed for the launch week of Affinity Designer, a serious competitor to Illustrator on the Mac App Store for casual and not-so-casual users who don't use Adobe products heavily enough to justify the cost of a monthly subscription. I tried it yesterday and was ready to cancel my Creative Cloud single-app subscription after about 20 minutes of experimentation. It's more than sufficient for my vector graphic needs as an indie developer.

<comment><USER31> Yup, I'm stoked on Affinity Designer. It also nicely promotes Serif software as an alternative to the Creative Suite. Serif has a lot of educational customers and casual users and probably would have more if people knew about them and their prices. I'm going to revisit their stuff. It's been about 10 years since I checked out their page layout program. But Affinity is fantastic. They put in a lot of great ideas into it in the UI. Xara on Windows and Affinity on Mac will be my go-to apps for vector drawing. Illustrator for me is basically just an app for conversion to make sure a file is ready to share. I hate working in it, clunky app.

<comment><USER32> There are also loads of great serif fonts. I've been using them for a while now. It's really great to see them moving into software.

</comment></comment></comment><comment><USER33> I could be wrong, but it seems to me that DRM is useless. People who like to pirate will pirate, no matter what safeguards you put in place, it's been proven over and over. It's just a nuisance for people who want to obtain media legally. If I paid for something, why can't I use it on any device I own with any software? It makes the purchase so much more valuable.

</comment><comment><USER34> Given the scale of incompetence required to have your 'spyware' transmitting common and expected book data and metadata in plaintext, I have to say we should employ Hanlon's Razor here, and not attribute to malice what can adequately be explained by stupidity.

That said, there's probably a little malice in there, too. And either way, this is probably a crippling blow to this branch of Adobe.

<comment><USER35> When a drunk driver crashes into somebody, we do not care that they had no ill intent. Why should it matter here?

Sufficiently advanced incompetence might as well be malice.

</comment></comment><comment><USER36> We do what we must

Because

We can</comment>


Google will require proof of identity from all advertisers - <AUTHOR> https://www.nytimes.com/2020/04/23/business/media/google-advertising.html <comment><USER2> Every time I sign up for a service using our company card, with our company address and company email I feel like I'm pretty open about who the buyer is.

Wouldn't a some kind of certified bank card be an even better proof of corporate identity than a copy of someones ID?

IDs needs to be verified against articles of incorporation. For larger companies it will definitely be a hassle to get the CFO to submit their proof of identity for a purchase that is normally delegated way down in the organisation.

<comment><USER3> Okay. Let's say I set up another web site and insist upon these documents. Now I can impersonate you.

How long until we see people signing up for Google ads using someone else's passport, W9 and what not?

This won't last very long.

<comment><USER4> > Now I can impersonate you.

Or you could just use Edward Snowden's passport, or any of the other thousands of people's IDs that have been compromised.

[https://www.theverge.com/2014/2/24/5441386/ethical- hacking-o...](https://www.theverge.com/2014/2/24/5441386/ethical-hacking- organization-website-defaced-with-snowden-passport)

</comment></comment></comment><comment><USER5> This wasn't the case already? I could have run a controversial ad to ruin someone's name?

<comment><USER6> You could have. And that would have been a crime.

But contrary to popular opinion, tech companies are not a branch of the police force. So they have no obligation to help the police prosecute people without a warrant.

<comment><USER7> >So they have no _legal_ obligation to help the police prosecute people without a warrant.

FTFY. They may not have a legal obligation to help prevent or prosecute crimes, but there is definitely a moral obligation to not knowingly allow your product to become an easy accessory to crime. Lots of tech companies abdicate that moral responsibility.

<comment><USER8> Some propose that but in practice that requirement isn't sane. Carmakers can't stop their cars from being used to run people down and the [[ [https://en.m.wikipedia.org/wiki/Evil_bit](https://en.m.wikipedia.org/wiki/Evil_bit) Evil Bit]] was a joke. Many downright reject the "permission first/absolutr safety" standard as harmful and impossible.

<comment><USER9> > Carmakers can't stop their cars from being used to run people down

The technology definitely exists to limit this, and many car companies already offer such safety features.

</comment></comment></comment></comment></comment><comment><USER10> >The names of the companies or people behind ads, as well as their countries of origin, will begin appearing on Google ads this summer, starting with several thousand advertisers a month in the United States before expanding worldwide. The measure, which could take years to implement, is designed as a defense against businesses and individuals who misrepresent themselves in paid online promotions, Google said.

lol so a tiny crypto exchange can req. ID docs but a huge trillion dollar company will take years>

<comment><USER11> A tiny crypto exchange is probably in a position where they can easily get existing employees to manually verify the documents without a significant impact on their business.

In addition to needing to verify orders of magnitude more entities, google likely has many layers of both human and technical abstraction to deal with.

<comment><USER12> This isn't new technology by any stretch of the imagination. Banks have been required to do some version of this since the 70s. I wouldn't buy this excuse coming from the management and technology clusterfuck that is Wells Fargo and I certainly wouldn't buy it from Google.

<comment><USER13> Yet there has never been a global bank that supports verifying identities in almost every country.

<comment><USER12> Every bank in the US supports verifying identities in every country whether or not they have global operations. Your friendly neighborhood credit union can verify foreign identities. The only exception might be for individuals/entities in places like North Korea or Syria where it doesn't make sense to bother with individual verification because their location alone prohibits an account.

</comment></comment></comment></comment></comment><comment><USER14> Previously discussed: [https://news.ycombinator.com/item?id=22955606](https://news.ycombinator.com/item?id=22955606)

</comment><comment><USER15> This will probably be about as effective as requiring ID cards has been to combat underage drinking.

<comment><USER16> This is like "Know Your Customer" (KYC) rules required by banks and financial companies. So many online providers ask for it, and it's so stupidly easy to bypass through stolen documents it's meaningless. I've even seen customers setup booths where they pay people in slums for their documents and go through a "live" KYC in-app process to generate more accounts.

Security Theater, just like everything.

<comment><USER17> What's your argument for why it's security theater in the context of banks?

It would be an obvious self-serving thing to say, for anyone opposed to similar regulation in other industries, but is it true?

Saying a system isn't perfect isn't the same as saying it has little effect overall.

If the banking system wasn't well controlled, why would people complain so bitterly and frequently about the effect of sanctions?

</comment></comment></comment><comment><USER18> I bet this isn't going to help. Scams and misleading ads will persist.

</comment><comment><USER19> How will google verify this proof of identity?

</comment><comment><USER20> Congratulations, you just created a secondary market

</comment><comment><USER21> Good time to buy some Facebook stock then.

</comment><comment><USER22> Add your name, address, signature, hair/eye color, picture, and dob to Google's database. When will this stop

</comment><comment><USER23> This is Google shifting legal responsibility from itself so it can run political ads without legal actions etc.

</comment><comment><USER24> Prediction: It'll be surprisingly difficult for Mom and Pop to provide sufficient proof of identity and surprisingly easy for mega corporations to do so. There will be a way to report suspected abusers that heavily skews in this direction. It'll basically be like IP enforcement on YouTube.

<comment><USER25> Not likely, but the problem requires context that Google isn't going to share.

In the past few years we've seen bad actors basically automate their process. They expect to be banned. They spin up an account, run scams and malware, get blacklisted, rinse and repeat with a new domain, account, and just enough changes to beat the automated filters within an hour later.

What this does is add a ton of friction to that game. It doesn't even have to be perfect to make a huge difference, it just needs to be difficult to rotate at scale.

</comment></comment><comment><USER26> The government shouldn't lean on a company to throw barriers in the way of speech. I really don't care what people want to pay to say, even if it is the horrible "fake news" which some seem to think is a new invention.

Why does anyone need to know who paid for all advertising?

<comment><USER27> Yea I kind of agree. The antidote to fake news should be an educated population, not banning fake news.

<comment><USER28> We already have an educated population.

<comment><USER29> It that were true "math class is tough" Barbie would never have existed.

<comment><USER28> That's not a problem with education, people are just stupid.

</comment></comment></comment></comment></comment><comment><USER30> There's only one sure way to eliminate fraud in advertising: stop advertising. Google is attempting to make it more difficult for malefactors to use its systems, but this disregards the fact that advertising is not a socially beneficial activity and all advertising is an attempt to psychologically manipulate the public.

Therefore, a harm reduction justification is insufficient as it presumes there is some benefit worth the harms being introduced. In fact, there is no benefit and Google is only reducing harm slightly.

<comment><USER31> > the fact that advertising is not a socially beneficial activity and all > advertising is an attempt to psychologically manipulate the public

That's not a fact, that's your opinion. Advertising is a form of communication and like most communication, the person originating the communication often has a goal or desired outcome in mind. That you or me might not like their goals or the message that they communicate doesn't mean that no one finds it valuable, nor does it mean that we should ban all communication.

<comment><USER32> > Advertising is a form of communication and like most communication, the > person originating the communication often has a goal or desired outcome in > mind.

So what? It's still "an attempt to psychologically manipulate the public". Advertising is adversarial, it's _fundamentally_ bullshit.

Leela : Didn't you have ads in the 21st century?"

Fry : Well sure, but not in our dreams. Only on TV and radio, and in magazines, and movies, and at ball games... and on buses and milk cartons and t-shirts, and bananas and written on the sky. But not in dreams, no siree.

How is that "a socially beneficial activity"?

<comment><USER33> > So what? It's still "an attempt to psychologically manipulate the public". > Advertising is adversarial

So is what you just wrote. Should we ban discussion on HN because it is (or can be) adversarial?

<comment><USER34> HN has balanced discussions because of the voting system, moderators (banning voting rings and spammers) and that anyone can voice their counter-arguments.

Advertising on the other hand is one-sided. If there was a universal ad platform where people could vote on ads (where overly negative feedback would get the ad taken down) and comment below them then it wouldn't be that much of a problem.

Finally HN is something you choose to participate in in your own time. Advertising doesn't give you a choice on whether you want to see it.

<comment><USER33> > Advertising on the other hand is one-sided.

Most ad platforms allow anyone to submit an add. Most add platforms are moderated.

> Advertising doesn't give you a choice on whether you want to see it.

Of course it does. When I'm reading a book I don't see advertisements. They aren't beamed into my brain, they're the price of admission for certain services I gain value from

<comment><USER34> > Most ad platforms allow anyone to submit an add

I can submit another ad but I can't make it appear right below the previous ad I would like to "comment" on.

> Most add platforms are moderated

What about fake technical support numbers, or the variety of scams/quack products on Facebook that make impossible claims and prey on the vulnerable/stupid?

> When I'm reading a book I don't see advertisements

When I take public transport I see ads regardless. Same applies to a lot of services that are near-essential nowadays. Certain _government agencies_ sell your details to spam operations (also a certain form of advertising) and you can't opt out. Most commercial products include spyware which track you and rat you out to ad platforms regardless of whether you even see any ads directly.

<comment><USER33> So should we ban restaraunts from having signs out front?

<comment><USER34> As far as I know most locations have rules on what a sign can look like and what it can do. I don't think it would be legal to have a sign with a powerful strobe lamp, one that shoots lasers in people's eyes to attract their attention or one that blasts loud music (which would be the equivalent of flashy, distracting ads that we see on the web).

Also with a restaurant sign there's a business behind it with someone that can be held accountable for it. If you see an obvious scam or a fraudulent service advertised you can complain to them or the authorities and get it shut down. With online ads they can be purchased either completely anonymously (maybe even with a stolen credit card) or by a shell company somewhere on the other side of the world where you would have no recourse.

<comment><USER33> > As far as I know most locations have rules on what a sign can look like and > what it can do. I don't think it would be legal to have a sign with a > powerful strobe lamp, one that shoots lasers in people's eyes to attract > their attention or one that blasts loud music

Most ad groups have regulations on what ads can and cannot do.

> With online ads they can be purchased either completely anonymously (maybe > even with a stolen credit card) or by a shell company somewhere on the other > side of the world where you would have no recourse.

Check the thread you're in. It's about an ad network addressing this specific problem.

<comment><USER34> > Most ad groups have regulations on what ads can and cannot do.

How do you explain Facebook ads for scams that claim price X but actually hammer your payment cards with multiple X * 10 charges until it declines? A friend got caught by that, we ended up doing a chargeback but Facebook didn't get punished in any way despite their complicity in this fraud.

How do you explain tech support scam ads?

How do you explain "chumboxes" like Outbrain/Taboola as in here: [https://www.theawl.com/2015/06/a-complete-taxonomy-of- intern...](https://www.theawl.com/2015/06/a-complete-taxonomy-of-internet- chum/) (the image URLs are broken, you need to manually get the image's URLs, change the protocol to HTTPS and open the resulting link to see them).

Maybe some ad groups have internal regulations, but I as a user have no control of which ad networks I'm exposed to. On the other hand, in the street, _all_ businesses have to comply with local laws and given that I don't see scam tech support banners or credit card scams advertised on storefronts I guess the laws are working, and if they aren't, laws can be amended if there's enough public support for it (some locations completely banned billboards for example).

> Check the thread you're in. It's about an ad network addressing this > specific problem.

"Google will suspend the accounts of advertisers that do not provide proof of identity, including W9 forms, passports and other personal identification and business incorporation files"

Seems like a pretty low bar to clear with either forged documents (again, someone already breaking the law with scam or spam ads isn't going to be deterred by this), paying vulnerable people in a slum for scans of their passports or just using a string of shell companies to muddy the trail.

<comment><USER33> Fraud is a hard problem. It's fairly easy to find individual examples of malfeasance, the relevant question is what percentage of online ads are scams, compared to ads in other media.

I'll also note that you're now no longer arguing that advertisements are unethical, but that online advertisements are unethical, and not because they're "an attempt to psychologically manipulate the public" as was originally stated, or even because, as you originally claimed "Advertising doesn't give you a choice on whether you want to see it."

We've moved the goalposts quite a bit. And I'm not interested in an in the weeds argument about the challenges of online fraud prevention. It won't be fruitful for anyone. I've proven my original point: you don't line online advertisements (and that's OK!), but you also don't have a clear reason that they're uniquely different than any other form of advertising, and you don't believe that advertising, in general, is unethical.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Internal value representation in PHP 7, part 1 - <AUTHOR> http://nikic.github.io/2015/05/05/Internal-value-representation-in-PHP-7-part-1.html

<comment><USER2> Seeing the very large amounts of alignment padding really makes me wonder if aligning data structures (and CPUs that require it) is an increasingly obolescent practice; it wastes space, making less useful data fit in the caches, and as far as I can tell was only necessary because some CPU designers wanted to save the - comparatively tiny relative to the cache - bit of logic to extract the right set of bytes from the cache line and bring in another one if the access spans two of them.

[http://lemire.me/blog/archives/2012/05/31/data-alignment- for...](http://lemire.me/blog/archives/2012/05/31/data-alignment-for-speed- myth-or-reality/)

I know that you can arrange structures in an attempt to minimise any padding, like what's been done here, but that doesn't always work out so perhaps it would've been better to pack everything together.

<comment><USER3> x86 CPUs have always been forgiving of unaligned access. So while modern x86 CPUs might have resolved this performance issue, if you ever want to run your software on ARM, for example, you're still going to have to align everything.

<comment><USER4> FWIW, since ARMv6 unaligned access has been supported on ARM.

</comment></comment></comment><comment><USER5> There is another reason for moving type tags outside of allocated blocks, albeit possibly not very relevant to PHP; for some local variables, type tags can be removed by constant propagation altogether.

<comment><USER6> Unboxed variables is a possibility some people have thought about, and I think HHVM does it. Given PHP 7'a parameter type hints it might be practical to do. Though a problem would be that if you strip off the type tag, you have to add it back again whenever you pass the value anywhere.</comment></comment>


Issuu - Glorify Your Documents - <AUTHOR> http://chacha102.com/2009/02/15/issuu-glorify-your-documents/

<comment><USER2> "Think of of Docstoc and Scribd the Wal-Mart of documents and Issuu the IKEA of documents. They both have products that are useful, but IKEA has the higher quality."

I don't think you really want to equate yourself with IKEA on quality...

<comment><USER3> yeah, that's exactly what I was thinking.

That's like saying, "It's not as bad as it could be (Wal-Mart), but it's still pretty marginal."

</comment></comment><comment><USER4> Issuu has the ugliest hover-over title bar I've ever seen. I should not see the entire page sink down based on a hover. A click, maybe: not a hover.

I'm not impressed. It's not tight at all. The page feels loose and sloppy.

</comment><comment><USER5> Don't really like the fact that I have to click on the arrows on the menu bar to get the options, would be more intuitive with display on hoovering.

Otherwise a neat page, great job on the design.

</comment><comment><USER6> you might want to check your spelling of 'Tim Berners-Lee' on this page: <http://issuu.com/holdenpage/docs/web20>

<comment><AUTHOR> was a quick document i put together for the purposes of this article, probably lots of inaccurate things in it :) lol

Thanks for pointing it out though and thanks for commenting</comment></comment>


Mercury Vortex in a Magnetic Field - <AUTHOR> https://www.youtube.com/watch?v=bSIzyk5Mjko <comment><USER2> Neat demonstration.

I believe Faradays first motor was a magnet and wire suspended over a cup of mercury to act as a conductor.

There is also a telescope that uses a spinning vat of mercury to form a reflector.

Vintage mercury vapor rectifiers are really neat to watch.

[https://youtu.be/5ftCS5wwiPY](https://youtu.be/5ftCS5wwiPY)

Had fun playing with mercury as a kid; say what you will. Still have my 1 pound container of it.</comment>


Show HN: FantasyPollster – "DraftKings for Political Elections" - <AUTHOR> https://fantasypollster.com <comment><USER2> > We offer fun, predictive, skill-based competitions with static entry fees > and static prizes.

Have you run that by a lawyer?

<comment><AUTHOR> Yes, we have! Our games are in compliance with the Unlawful Internet Gambling Enforcement Act of 2006.

Notice that our games have static entry fees, static numbers of participants, and static rewards. The game for each state is based on the accumulated statistics from each precinct of the state.

For those who are curious, this is the exception of the law under which we fall:

(ix) participation in any fantasy or simulation sports game or educational game or contest in which (if the game or contest involves a team or teams) no fantasy or simulation sports team is based on the current membership of an actual team that is a member of an amateur or professional sports organiza- tion (as those terms are defined in section 3701 of title 28) and that meets the following conditions:

(I) All prizes and awards offered to winning participants are established and made known to the participants in advance of the game or contest and their value is not determined by the number of participants or the amount of any fees paid by those participants.

(II) All winning outcomes reflect the relative knowledge and skill of the participants and are determined predominantly by accumulated statis- tical results of the performance of individuals (ath- letes in the case of sports events) in multiple real- world sporting or other events.

(III) No winning outcome is based—

''(aa) on the score, point-spread, or any performance or performances of any single real-world team or any combination of such teams; or ''(bb) solely on any single performance of an individual athlete in any single real-world sporting or other event.

([https://www.gpo.gov/fdsys/pkg/STATUTE-120/pdf/STATUTE-120-Pg...](https://www.gpo.gov/fdsys/pkg/STATUTE-120/pdf/STATUTE-120-Pg1884.pdf))

<comment><USER3> Just make sure you have an over night bag ready ;)

Prediction market have been declared illegal in the US.

UIGEA carve out is specifically restricted to sports and scoring related simulation (guess who lobbied for it).

This is regardless of various state-specific laws, as well as the current daily-league legal battle.

Any futures trading is also regulated by the CFTC

<comment><AUTHOR> Haha I hope it doesn't come to that. In the excerpt above, it states "participation in any fantasy or simulation sports game or educational game or contest". There are also other non-sports related fantasy websites such as Celebrity Fantasy Draft which have won awards from the Fantasy Sports Trade Association. We, and our lawyer, did not think that this violated the law.

As mentioned in other comments, we do not allow players to "cash out" if they are from states in which fantasy is banned. This is similar to what DraftKings and FanDuel do.

Does that address your concern?</comment></comment></comment></comment>


MIT's recently developed autonomous, robotic helicopter - <AUTHOR> http://www.engadget.com/2009/10/16/mit-takes-the-wrappers-off-autonomous-robotic-helicopter-with-i/

<comment><USER2> Wow. But, I was hoping this would occur _after_ my lifetime. Excellent feat, but it's now quaint how the obvious future use (wholesale surveillance) isn't listed as an application. They always state a motive of searching for children and assisting the elderly. I don't want to doubt anyone's sincere desire to produce helpful technology; but, in these cases, it's irresponsible to sidestep such an important issue.

<http://en.wikipedia.org/wiki/Rover_%28The_Prisoner%29></comment>


AskHN: ideas on final year project related to networking security ? - <AUTHOR>

i want to do a final year project related to network security . any ideas which are feasible? <comment><USER2> You have to be more specific than that. These days information security is a huge field. Network security is a misnomer since almost no one works on "network security", which is about protocols not applications / operating systems.

I'd suggest being more specific about what sort of project you're interested in. Will you be doing original research on the size of botnets (you and everyone else in the world); maybe write a tool for something, I'd suggest writing a real webapp security assessment tool. I hate doing web app assessments. Another thing that would be really useful would be collaborative information sharing during a pen test (I've put a lot of thought into this one and could give you more pointers)...

If you want to play it safe, just write another fuzzer. Everyone writes fuzzers. Or you could write some VoIP security tools.

</comment><comment><USER3> Implement SSH. The world needs a good (free, minimalist, and secure) SSH implementation.

</comment><comment><USER4> Network Behaviour Anomaly Detection & Deep Packet Inspection are two very hot fields with tons of open space for improvement and experimentation. Both of these are extremely general/vague, but just throwing ideas.

</comment><comment><USER5> In this Social networking era of web 2.0, I would suggest to look into the data security (Privacy data) and its impact of sharing your privacy data across social networks like facebook, twitter, orkut etc......</comment>


The email I received from Google in 2007 when they wanted to buy Zlio   - <AUTHOR> http://www.berrebi.org/2012/11/07/the-email-i-received-from-google-in-2007-when-they-wanted-to-buy-zlio/ <comment><USER2> Some of these comments confuse me. What do you expect an m&a email to read like? Having been through a bunch of acquisitions, that email is par for the course, especially for a (presumably) smaller acquisition. You have an internal product sponsor who asks for basic financial info, asks for a price, has clearly laid out next steps and the process, and wants to start immediately. All positive for a first step. Some of the best corp dev guys I know have the worst grammar and email manners and to focus on that as a weakness is ridiculous...as long as they can approve a wire transfer, who cares? Some people are Youtube and have Eric layering sweet sugary syrup on their Pancakes whilst they discuss the beautiful synergies of a monster deal, but most of the time, the startup CEO is hustling it across the finish line.

</comment><comment><USER3> > "For the little story, Zlio, became blacklisted/sandboxed by Google 6 months > after…. It killed the company…"

This is only speculation, but it looks like zlio.com was sandboxed/blacklisted because of rampant spamming. 4 out of the top 5 referring domains are porn sites (about 150k links).

Source: [http://ahrefs.com/site- explorer/refdomains/subdomains/zlio.c...](http://ahrefs.com/site- explorer/refdomains/subdomains/zlio.com)

<comment><USER4> took a quick look, aren't those backlinks to subdomains? No idea what the product/service does but it appears subdomains are the main spam links, not the root.. So perhaps they were duped by spammers creating subdomains

<comment><USER5> It is a create your own store product. People would have simply been making a store and then using software to spam their links everywhere. I think sub domains are usually treated as separate domains though?

<comment><USER6> They are separate for user generated subdomains. [http://www.seomoz.org/blog/understanding-root-domains- subdom...](http://www.seomoz.org/blog/understanding-root-domains-subdomains- vs-subfolders-microsites)

It is possible that on that fateful day, Google noticed zlio is user generated sub domains, and lost power.

<comment><USER4> technically you could still suffer from that.

subdomains are treated as separate domains, right

If all the subdomains had links back to zilo (say the header or footer), it starts to look like a huge link farm, or a bunch of satellite sites. It's actually pretty dangerous. But disavow is here, right? hah

</comment></comment></comment></comment></comment><comment><USER7> What an awful email. Reads like a lazy VC associate trying to do as little work as possible to pass along metrics to higher ups.

<comment><USER8> It's amazing how even when buying a company, people can't be bothered to use proper capitalization or even spell out the word "please". Wow.

I must have slept through the English class where they told me this was OK.

<comment><USER9> I think it's a power thing because they're manoeuvring for negotiation.

Translation: "I can't be bothered to spell because you're teensy and I have another $1B to spend today on companies 100x bigger than yours. Make with the paperwork chop chop."

Then, confirmation: "Give me your mobile so I can call you any time I feel like to make you jump, because you're the bitch now."

<comment><USER8> Yeah. My reply to that message would have been "I only give my mobile phone number to friends. Please use my office line between the hours of 9 AM and 5 PM EST."

But honestly, a lot of people seem to like doing business deals while walking around with their cell phones, so perhaps this is not actually a power play.

</comment></comment></comment></comment><comment><USER10> They wanted financials and a valuation range? And then deep communications about technical challenges and workarounds? Reminds me that one of the nice things about owning a company is you can tell people to go away.

</comment><comment><USER11> Social eCommerce Site Zlio Joins the Deadpool: [http://techcrunch.com/2011/08/19/social-ecommerce-site- zlio-...](http://techcrunch.com/2011/08/19/social-ecommerce-site-zlio-joins- the-deadpool/)

<comment><USER5> This is why I wouldn't touch SEO as a consultant. They ended up getting sued, despite little chance probably they could fix their issues without massive internal changes to the service. I guess the SEO company overpromised.

<comment><USER6> Referencement appears to be a black-hat-SEO French company: <http://m.pinterest.com/visual3d/referencement-seo-smo/>

I didn't realize, France has UK-style libel laws, where complaining about getting ripped off is punishable?

</comment></comment></comment><comment><USER12> Why is it now trendy to publish private mail like this? Is there really that much public benefit to be had?

<comment><USER6> For a washed up has-been startup founder looking for catharsis or another 15 minutes of fame? Sure.

<comment><USER13> Clearly you don't know Jeremie.

His best work has yet to be done.

<comment><USER14> I'm not sure if you're trolling but this, comically, adds nothing.

</comment></comment></comment></comment><comment><USER15> Looks like they also got banned from selling on Amazon too... <http://techcrunch.com/2007/05/21/zlio-banned-from-amazon/>

</comment><comment><USER16> I always used to wonder about the contents of the first mail when an acquisition offer is made. Sad if all read like this! I hope not.

</comment><comment><USER17> Of course I don't know what the terms were, but if you're in a position to decide to take on (more?) VC or sell to Google I'm inclined to say going with the latter is the better choice.

If you're a great visionary you'll have another chance not too far down the road to show the world again. If your good fortune hitched a ride with lady luck to some extent, then shamelessly cashing out your personal bubble is also a smart thing to do.

<comment><USER18> Did you read the article? Google took longer than 30 days to close the deal, and their term sheet with Mangrove was about to expire.

He had no choice but to accept the VC funding.

<comment><USER17> Sure, I read this: "After waiting for it 30 days, we decided to accept the Mangrove investment proposal." That sounds like a choice was made.

My main point is for those going forward: unless the equity you stand to convert into your own personal wealth is insignificant to you, an exit can't really stop your career for long but it also just might be the only chance you get.

Maybe the Google deal wasn't a sure thing but whether or not they could pay was not a question.

<comment><USER19> If Google wanted them enough they could still purchase after the additional VC. They'd just need to pay more.

</comment></comment></comment></comment><comment><USER20> I love Jeremie's life principle which got him through the Google sandboxing/blackballing and company failure after passing on the acquisition:

"Everything that happens in your life is for your own good", "Every challenge makes you stronger"... "All he said was, don't worry, good things will happen after this tough experience"

\--<http://www.tumblr.com/tagged/ilan-abehassera></comment>


Ask HN: How do you implement authentication in your REST API? - <AUTHOR>

I'm creating a web service that I want to expose as a REST API so that developers are able to create apps for it. I want them to be able to create/manage user accounts and authenticate using API. How will you handle this? OAuth or something else? <comment><USER2> Well, I've got something similar that I've implemented client side certs on - works well for our case, which is a private api where new clients are vetted before they get to use the api.

</comment><comment><USER3> I used https. Encrypted secrets go over the wire. Easier than OAuth for the programmer, as long as you can spare the overhead for the SSL handshakes.

</comment><comment><USER4> In node.js I use everyauth library - it has support for many oAuth providers.</comment>


Ask HN: What does it take to be a YC single founder? - <AUTHOR>

I'm strongly considering applying to YC's summer funding cycle, and I was wondering what the HN community could tell me about what "makes" a Y Combinator application. What are Paul Graham and the other investors at YC looking for in people?
I'm a 17-year old college student (graduated high school in 2011), and I've been programming since I was very young. I've always been interested in computers, and I released an iPhone when I was 15, which was a great experience. My job at another startup (which I joined in September of this year) has also gone very well.
I'm just wondering if my age, and/or lack of experience, would disqualify me for consideration as a YC applicant. My hope is that my passion for software engineering and technology will make me a more attractive candidate.
Thank you very much for any input you can offer me. <comment><USER2> Forgive me if I'm wrong, but doesn't the idea of acquihire preclude the possibility of single founders? Companies want to buy whole teams who presumably can build a product, not just single founders. Again, I could be wrong but from what I've seen the deal is to form a nucleus of founders for the purpose of extracting investment from investors or selling the whole team to a big corp. If this is the case, you want to have to strongest nucleus you can put together.

As far as experience level... In my experience with startups, there is a need to have people fill spots as investors are paraded through, and in this case, the younger the better. I say this kind of tongue-in-cheek, but if you enroll in some math classes and play into the prodigy role you will be doing yourself a service if you want to go this route.

If you're a single founder focused on building a product, why not build the product then use that a nucleus to build a team. I get the impression that incubators are for people who want to build a team and then build a product.

</comment><comment><USER3> Personally, I think you kids are too young and inexperienced. You say you have experience, you say you can "do" things. Prove it. Make something ship it, market it, charge for it. Whatever it is, just do it. There is no substitute for proof.

I'd even advocate for you to work for a start-up as an early employee. That way you can watch, learn and observe and pick up some experience because there's a lot to learn.

The key to being successful, let alone a successful single founder is having a solid understanding of who you are, what you are or aren't capable of, how you see the world, and how you want to make an impact. Some people call it mettle. You might think that you have it all down, unless it's been tested, you just don't know and you'll be always be second guessing yourself. I just don't think you get that unless you've fully entered the "real life".

This all goes back to my first point. If you had belief, you would already be doing it instead of searching for validation here. It sounds harsh but I understand your angst. Trust me it becomes managable with time.

<comment><AUTHOR> I am working at a startup currently.

However, I'm not "searching for validation" here, I was asking specific questions the Y Combinator funding cycle.

I'm also unsure of what you describe as my "angst"- I am not anxious or fearful of this process. Just merely inquisitive as to the nature of how it works.

</comment></comment><comment><USER4> If you tell us the general field your startup falls under, it'll be easier to attract the attention of potential cofounders interested in your kind of startup. The more specific you get the easier it will be, but it's probably not a great idea to get super specific unless you're talking with potential investors.

</comment><comment><USER5> Archio, as a 19 year old in a similar situation (and wondering the same thing!), I was wondering where roughly you're based? I'm from the UK and looking for a co-founder, yet don't know anyone interested in startups.

<comment><AUTHOR> I'm in New Jersey (United States). Looks like we are in the same boat! I'd love to apply with a co-founder but I also don't know anyone that's remotely interested.

If you want to talk, feel free to send me an email (the address is in my profile).

<comment><USER6> Hey Archio I sent you an e-mail.

</comment></comment></comment><comment><USER7> If any of you are from the UK there's a large community of young founders. Checkout my event <http://tomorrowsweb.co.uk>

</comment><comment><USER8> Hey, I'm a class of '10 high school student hopefully not too far away. Wouldn't mind talking about sometime (email is on my profile).

</comment><comment><USER9> I'm also from 17y web developer, in almost same situation. If you are interested, can you leave me a contact?</comment>


How to Make Your Own Beauty Products from Scratch - <AUTHOR> http://www.good.is/post/how-to-make-your-own-beauty-products-from-scratch/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+good/lbvp+(GOOD+Main+RSS+Feed)

<comment><USER2> blog spam. It's not like this hasn't been covered in countless websites, magazine articles and books.</comment>


1668 Adwords clicks, 5 app installs. Is Adwords broken? - <AUTHOR>

We've been running an Adwords campaign for our free iPhone app Stocks+ using Adwords banners on the display network.
On 1668 clicks, we have had only 5 installs, for a $19.05 cost per install.
Any thoughts on what might explain this? We have thought about the following:
- massive click fraud - inconsistencies between our banner and app. But we have tried to be honest about we are selling.
- misclicks
Either way, this Adwords seems to be broken for driving app installs.
App link: https://itunes.apple.com/us/app/stocks+-alerts-real-time-stock/id667161120?mt=8
Adwords stats: http://equitiva.com/downloads/Adwords2.png
Sample Banner: http://equitiva.com/downloads/ad.gif
Any advice would be much appreciated! <comment><USER2> 443018 impressions with a click through of 0.37% leading to a 0.29% install conversion rate would be awful be most apps... but you're targeting a tiny niche market - "people with money to buy shares who want a 'free' app to track their portfolio" are going to be incredibly rare. People who bother to track their shares tend to own a lot of them, so a $20 app isn't a problem. Plus, iPhones come with a stock tracking app installed, albeit a bad one, so you've got to get past that too.

I'd hazard a guess that your banner ad is actually very good and is attracting lots of attention, but the product isn't something many people want, hence lots of clicks but few installs. Maybe CPC marketing was a poor choice.

<comment><AUTHOR> Thanks! Why though would people click on the ad which is clearly about stocks, if they don't want a stocks app?

It's difficult for me to understand this.

</comment></comment><comment><USER3> I can't give a profound ad-expert explanation, but when I land on an app, my decision to install it or not depends on the reviews/ratings. Your app has only 2 reviews visible (I can't confirm they are the only reviews) with 4 and 5 stars. Really not bad, but unless a review clearly says it's better than bloomberg, stockwatch and whatever, I would still classify your app as just another one. AND, this is also a big point, human inertia is also a factor, if somebody already use a stock app, the tendency is to stick with what they already know. But you're really on the right track, as you're getting their attention. Maybe you're just missing a deal-maker somewhere, an intangible...

<comment><AUTHOR> Hey Paul, thanks for the feedback!

Yeah, agree on the deal-maker. Maybe we can tweak the app copy to see if that improves the downloads.

Also, we have a lot of reviews (250+), but since we just updated the app, the ratings don't carry over.

<comment><AUTHOR> P.S. but even before this update, with 250+ ratings visible, there wasn't really a noticeable difference in installs.</comment></comment></comment>


On the Emotion of Users in App Review - <AUTHOR> https://medium.com/@mrtnsd/so-you-created-the-best-app-ever-27699b191f23#.om2wcotzp <comment><USER2> A slightly related note is that UI's are trending "dumber". More and more apps and websites I see are adding all this padding around things creating wasted space.

Once upon a time, someone figured out cramping everything together looked bad so they started adding more and more padding. Now it feels like I'm being treated like an infant who couldn't handle that many words on the screen and needs these playful distracting colors everywhere.

It seems like the power users that prefer denser interfaces are being ignored. And now, the users are starting to catch on that even though at first glance these apps are prettier they reduce productivity by showing less information, reducing features that confuse users, hiding buttons away, and having non- discoverable gestures.

I would love to see this dataset aimed at the switching of UIs to material design. A fair number of my apps have made the switch, and I've always been disappointed by the results.

<comment><USER3> It's funny I feel the same way. For instance, there has been a huge movement in EComm web applications to make checkouts more of a wizard flow. I always liked it when everything was on one page and I could just tab through forms, and not click on 10 next buttons.

I get that it lowers the amount of customer service issues with checkout because it can baby people through the process. They are missing the other side of the problem though, which is, it most definitely slows down the checkout process for people that know what they are doing. Also with the advent of auto fill utils it seems like a backwards approach or at least something that we will reverse once people become more familiar with auto fill capabilities.

</comment></comment><comment> et-al Wow, I'm glad they brought up the iOS Gmail app redesign as an example. It took the Gmail team 7-8 releases over a 3 month period to finally restore functionality, but the app is still a user experience eyesore despite all the praise for Material Design. If you're changing the color scheme of an app people use every day, don't make it BRIGHT RED. Otherwise you receive reactions like this:

[https://productforums.google.com/forum/#!topic/gmail/V5muFb9...](https://productforums.google.com/forum/#!topic/gmail/V5muFb9W5bA)

If anyone is looking for an alternative, I'd recommend AirMail, or try using Charles Proxy and forcing iTunes to download Gmail 4.4 (the softwareVersionExternalIdentifier you'll want is 815948715).

</comment><comment><USER4> Interesting, but after you said "we processed 7+ million app reviews" I was really expecting deeper insights.

This is a super exciting data set and I hope you can get more out of it: is it actually worth it to prioritize the features people are asking for? how long does it take to recover from a drop, can this be modeled somehow? how come some apps receive inconsistent emotion? etc

<comment><AUTHOR> Thanks for your comment, MasterScrat. These are good points, actually our results are preliminary. As we consider this topic to be helpful for developers, we aim to further analyze the data.

I would be very happy to receive more replies like yours to come up with new ideas and different perspectives on how to look at the data, and to prioritize which questions to answer.

<comment><USER5> \- I assume sentiment and star ratings are strongly correlated, but are there cases where these deviate?

\- Is there any seasonality to review volume and/or sentiment (day of week, time of month/year/etc) that holds across many apps?

\- Are there interesting differences in sentiment mean+variance by app category? For example, are utility app reviews more polarized than games?

<comment><USER4> > \- I assume sentiment and star ratings are strongly correlated, but are > there cases where these deviate?

> \- Are there interesting differences in sentiment mean+variance by app > category? For example, are utility app reviews more polarized than games?

These are answered in the white paper: [https://arxiv.org/pdf/1703.02256.pdf](https://arxiv.org/pdf/1703.02256.pdf)

</comment></comment></comment></comment><comment><USER6> The obvious point they should have learned from this data is to not change the UI unnecessarily. Sadly, they missed the elephant in the room.

<comment><USER7> jwz nailed this a ways back:

 _The Firefox UI is a moving target. It is under constant "improvement", which means "change" which means every few months I'm forced to upgrade it and shit has moved around and I need to re-learn how to do a task that I was happily doing before. This does not often happen with Safari. Their UI has been remarkably stable for many, many years._

 _The constantly-changing Firefox UI is by design. They believe that user- experience bugs are just like all other bugs, and you can manage them in the same way: toss them into Bugzilla and "more eyes make all bugs shallow", etc. (Google takes this even further: all of their UI decisions are made statistically.) Apple doesn't believe that, and they develop their UI in dictatorial secrecy._

 _Here 's a 50-minute talk by Alex Faaborg, Principal Designer at Mozilla, about how they do UI and why they think they should do it that way. It's interesting._

 _Maybe the Firefox team is right, and you can develop a better UI that way. Well, they haven 't yet proved this, because Apple's UI is better._

 _Look, in the case of all other software, I believe strongly in "release early, release often". Hell, I damned near invented it. But I think history has proven that UI is different than software. The Firefox crew believe otherwise. Good for them, and we'll see._

 _Meanwhile, I 'm going to use the app whose UI works best, not the app whose development methodology most fits my political preconceptions._

If you read the soure, note that Jamie plays games with HN referrers. You may want to copy/paste this instead, hence the non-link.

        https://www.jwz.org/blog/2012/04/why-i-use-safari-instead-of-firefox/

</comment></comment><comment><USER8> Title is incorrect and nonsensical. Should be reviews rather than review, as per the article.</comment>


Vox Media Acquires New York Magazine - <AUTHOR> https://www.nytimes.com/2019/09/24/business/media/vox-buys-nymag.html <comment><USER2> Both NYMag and Vox claim/seek to license their CMS to third parties to offset the sunk costs they've dumped into developing them.

NYMag's is named "Clay" and counts golf.com and radio.com as customers: [https://clay.nymag.com/](https://clay.nymag.com/)

Vox's is called "Chorus" and they claim to have 350 sites but they don't care to name them: [https://getchorus.voxmedia.com/](https://getchorus.voxmedia.com/)

Both are getting absolutely creamed in the market by WaPo's ARC: [https://www.arcpublishing.com/](https://www.arcpublishing.com/) (and of course Wordpress)

So it stands to reason that at least one of these two CMS's is going to eat the other. Most likely Chorus eating Clay, vox's set of properties and traffic is 6-8x larger than nymag's (by comscore uniques) so its less work to keep it.

<comment><USER3> Doubtful. If Clay has commercial customers then there's every reason not to drop support.

<comment><USER4> Wouldn't there be motive to move Clay's customers to Chorus, to cut down on engineering costs of supporting two entirely different CMSs?

<comment><USER3> That sounds like an absolute nightmare of a migration.

</comment></comment></comment></comment><comment><USER5> > Neither company would disclose the value of the deal.

I'm going to go ahead and assume this was less of a "buy" and more of a "took on their debt in exchange for their assets" kind of situation

</comment><comment><USER4> > "No one had to do this," Pamela Wasserstein, the chief executive of New York > Media, said on Tuesday. "It's a brilliant, in our view, opportunity, so > that's why we leaned into it. It's not out of need. It's out of ambition."

If it was such a great opportunity and not out of need, why wouldn't they disclose the value of the sale?

</comment><comment><USER6> It'll be interesting to see where this goes. Vox Media has built up some really good brands and I'd hate to see this drag them down. Odd that they aren't folding related publications, as they're definitely going to have some competing internal publications until they do. Makes sense for the employees though, probably, to retain their own editorial style on each side of things

</comment><comment><USER7> It's wild that Vox is an amateur baseball blog that mushroomed into a billion- dollar media conglomerate.

<comment><USER8> You must be thinking of FiveThirtyEight.

<comment><USER9> No. What became Vox was founded as an Oakland Athletics blog.

</comment></comment></comment><comment><USER10> Throw back to when people were saying unionizing will kill vox.</comment>


Tektosyne 6.3 for Swing Released - <AUTHOR> https://news.kynosarges.org/2019/04/10/tektosyne-6-3-for-swing-released/ <comment><AUTHOR> This is honestly a very inconsequential release as far as the project is concerned. But after JavaFX got split off from the general Java SE distribution following Java 11, it's simply no longer acceptable for some small GUI application like the demo suite here to require JavaFX. Require tens of MB from a third-party site to run the demo app, or rewrite in Swing? Unfortunately, despite Swing's relative inferiority the choice is clear.</comment>