Mixpanel Lays Off 18 Employees - <AUTHOR> http://techcrunch.com/2016/01/08/mixpanel-layoffs/ <comment><USER2> Hey everyone, I am one of the founders at Mixpanel. Layoffs were tough on us, we did over hire a bit, and wanted to make the company more lean. We are deeply sorry for those that are no longer part of Mixpanel - they were our friends and co-workers that we continue to miss.

I am happy to answer any questions that I can.

<comment><USER3> Should the preverbal hit the fan, would you open-source the code and have a paid support plan... should all else fails to monetize this?

Not sure why the down votes. I don't know the balance sheet of the company. Also lots of other companies like Aerospike open source their code and make money from support plans.

<comment><USER2> We aren't having trouble monetizing the business. Our revenue projections remain the same even though we let some staff go and we are doing fine on that end. Mixpanel isn't going anywhere if that's your concern. If anything, we are investing a lot more in engineering, product, and design to make our products a lot better for all you.

It's too early to say what we'd do in an outcome like that. I certainly wouldn't want to see everything we've built go to waste.

<comment><USER4> How are you investing a lot more if you let people go?

<comment><USER5> > He confirmed to TechCrunch that 18 people were laid off, mostly in sales.

From the original article

<comment><USER6> Which is odd. Sales people don't cost much. They either pay for themselves or they're let go quickly. They're not usually let go in a group like that. Usually engineers are cut early; they cost more. Not trying to pick a fight, I've just been through layoffs before and this is how the finance team always justifies their cuts.

<comment><USER7> If things are going bad, the engineers become assets for a potential aquisition. I've never seen engineers let go when things get dicey. Almost everyone else is let go first.

<comment><USER6> That's probably a sign of frothy (dare I say bubble?) times. The opposite is usually the case. Cut the engineers and outsource the work was the M.O. for a decade+.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> MixPanel has very generous free plan and many free users. Sales people were hired to try to convert free users into paying customers. Plan failed, sales people shown the door.

This is why companies need to think really hard about freemium model. In case of MixPanel, many of their free users keep adjusting so they send just enough data to stay under free plan. They are probably not going to be persuaded by sales people to pay.

<comment><USER9> If you are doing 25,000 of fewer events, you are probably not making much money.

<comment><USER10> That's not true.

When I looked at MixPanel we were already at more than 8 million page views per month and wanting to track more events than that.

But as we wanted to _try_ MixPanel, the best way was to start by sampling a small number of users and activities.

As our trial of the software progressed we found we got way more value out of sampling a smaller set that we could make sense of rather than measuring everything.

For us, MixPanel became one more tool in a wider toolset. We didn't see the value in jumping up to the paid level as we didn't feel it would replace all of the other tools.

<comment><USER11> Can you elaborate on the tools in a 'wider toolset'? I'm always eager to learn about new tools/services.

</comment></comment></comment></comment><comment><USER12> Mixpanel is a revolving door. It's only called layoffs because Suhail decided to fire many at once this time [https://www.glassdoor.com/Reviews/Mixpanel- Reviews-E406910.h...](https://www.glassdoor.com/Reviews/Mixpanel- Reviews-E406910.htm)

<comment><USER13> From a review posted on Nov 14, 2015:

> the CEO's three favorite things are talking about how much he likes to > drink, comparing himself to a gangster rapper, and a juvenile lack of self- > awareness

Based on his LinkedIn profile, he can't be older than 30 and has never held a real job. Why exactly is someone like this running a company that has raised $77M instead of working as a junior engineer?

<comment><USER14> Shhtttt don't ask, the YC president never held a real job but that doesn't stop him from talking like he knows everything from astrophysics to socioeconomic stuff either.

<comment><USER13> There's nothing fundamentally wrong with being young or not having ever held a real job. There are certainly great founders who have done an admirable job despite their youth and lack of work experience (Zuckerberg comes to mind), but they are few and far between. It's just that these sorts of complaints about juvenile behavior are entirely understandable when you consider the founder's profile.

And to be fair to sama, I haven't seen any comments from YC alumni about how he compares himself to a gangster rapper. However, the trend of VCs pontificating on Twitter about topics that they don't have a good grasp on is somewhat irritating. The only person who has truly demonstrated the ability to "go deep" on (multiple) extremely complicated subjects, and successfully put his time/money where his mouth is, is Elon Musk. And even he showed a typical lack of self-awareness in his younger days[0].

0: [https://www.youtube.com/watch?v=kSHUha9ABNY](https://www.youtube.com/watch?v=kSHUha9ABNY)

</comment></comment></comment></comment><comment><USER15> That's a worrying sign - sales are generally the last people to go - if you're under financial stress you generally need revenue and customers.

Unless they somehow believe they can pull off another Atlassian (who actually spend a ton of money on marketing, despite being seen as a "no salesperson" business) I'd say the $65m funding they received is going down the gurgler.

<comment><USER16> 'sales are generally the last people to go' \- generally where? In startups , especially engineering driven ones, shredding parts of sales team first is not un-heard of. Also, according to the CEO, they over-hired. Looks like they tried to expand more than they could handle. Doesn't seem like a worrying sign to me.

</comment></comment><comment><USER17> Source article: [http://venturebeat.com/2016/01/08/mixpanel- starts-2016-with-...](http://venturebeat.com/2016/01/08/mixpanel- starts-2016-with-layoffs-we-just-overhired/)

</comment><comment><USER18> I ran a free service for a long while... they should just dump the free service or at least not accept any more free customers. They will save a lot of money and since the customers don't transition up anyway it won't really affect their business. A business isn't a charity. I learned that the hard way!

</comment><comment><USER19> If it's mostly sales people, it is perfectly reasonable to think they are reassessing their outbound marketing efforts. For example, perhaps their sales channel produced poorer quality leads compared to organic or the type of product they were selling was low enough margin that the sales commission removed any profit they were getting.

</comment><comment><USER20> Mixpanel has a great product but suffers quite a bit from the curse of having a product everyone loves but nobody wants to pay for.

The layoffs are a likely a further materialization of their struggles to get people to pay for the product at the rate they were hoping.

There's a lot of competition in this space out there now. Mixpanel isn't as unique as it once was. There's also the elephant in the room of questioning how much of the revenue in this sector comes from other companies surviving only on VC cash (i.e. cat video site analyzing page traffic that shows ads for a toothpaste delivery iPhone app that analyzes its social media interactions with users that turn out to just be bots in some Russian guy's basement). Point being the rapid downturn in VC funding recently isn't exactly helping Mixpanel's revenue either.

</comment><comment><USER21> Wouldn't this negatively impact hiring in other depts like engineering in near future?

</comment><comment><USER22> I checked out mixpanel couple years ago and I couldn't get tied down to a service which didn't have a cheaper than a $150 plan. What if I find it very useful and then ran out of the free tier quota. That scenario was unacceptable and thus, we are not a client.

I already see other's comments in this thread of this very scenario. We dodged that bullet.

</comment><comment><USER23> Yahoo,Mixpanel,Instacart,Jawbone,Tango,Hotels tonight,Maker media ..

And so it begins ... ?

[http://techcrunch.com/2016/01/08/burn-slower-or- vaporize/](http://techcrunch.com/2016/01/08/burn-slower-or-vaporize/)

</comment><comment><USER24> Has anyone try both Gosquared and Mixpanel? How do they compare?

</comment><comment><USER25> The P isn't capitalized. It's Mixpanel.</comment>


GPS Accuracy Could Start Dropping in 2010 - <AUTHOR> http://db.tidbits.com/article/10276

<comment><USER2> Yesterday we had an article on what services you'd pay $5 a month for. I'd almost bet most people would pay $5 a month, maybe more, for GPS.

<comment><USER3> In that case, does the EU have a deal for you; they're planning to charge money for "enhanced" Galileo service.

</comment></comment><comment><USER4> The last sentence is crucial: there's no way the US Air Force would _ever_ let the GPS satellite network fail or lose accuracy.

<comment><USER5> Don't underestimate the lengths the Air Force will go to to screw with the Army.

<comment><USER6> It's not just the Army, Navy, and Marines that need GPS. The Air Force has smart bombs (JDAM) that are guided by GPS as well.</comment></comment></comment>


Too Much Things That You Want to Do? - <AUTHOR> http://freestylemind.com/too-much-things-you-want-to-do

<comment><USER2> I hate to be a picky grammarian, but I would really appreciate it if this person would learn the difference between countable and uncountable nouns.

[http://rwc.hunter.cuny.edu/reading-writing/on- line/countable...](http://rwc.hunter.cuny.edu/reading-writing/on- line/countable.html)

I beg (plead!) of the submitter to update this to read "Too Many Things That You Want To Do?" to prevent the regular wincing that results from reading the grammatically ugly version.

<comment><USER3> I thought the same, then saw you wrote first. It's not crass to believe that an author, wanting to express an idea, may not want to drive away an audience for the idea.

</comment></comment><comment><USER4> I didn't read this. I don't want to do too many things, but, even if I had to, I would rather start doing those things instead of reading a blog post about how to do too many things.

</comment><comment><USER5> *Many

<comment><AUTHOR> I wish I could edit the title. Sorry about that.

</comment></comment><comment><USER6> Polyphasic sleeping :)

</comment><comment><USER7> I like the general idea as I've been grappling with it, though I tend to approach it differently. I like to introduce one or two new habits or areas to focus on, do it for 2-4 weeks until I've got it down to a rhythm that can be done quickly without excess thinking about it, and then add new objectives.

I do think on what my top three outcomes for a week should be at the start of the week, and choose which of them needs to be worked on the next day, and then start the day putting 2-5 hours into that or until it's complete. At least, that's the theory, sometimes I "check just one thing" before heading on to most key stuff and then too often the entire day gets hosed. But when I start with most key objective or two, the day almost always goes well. Then I've got a list of general stuff I fill into the day - situps, vitamins, some deep breathing, very short meditating on my death bushido-style, respond to emails, write a letter to someone I'm out of touch, handle admin - I can fill that stuff around the edges whenever I can steal 5-10 minutes from my day. If I start with the most key, difficult objectives first the rest of the day tends to fall into line.</comment>


Show HN: The World's Finest Decaf Coffee - <AUTHOR> http://fivecupscoffee.com <comment><AUTHOR> Hey friends, my name is Jiri Sifalda and I am a web application architect with a passion for coffee. Last year, a few friends and I decided to embark on a journey to source the finest caffeine free coffee in world. On our way we discovered new methods for producing coffee and now, at last, we have an amazing product which we can't wait to share with you. We spent last year perfecting our coffee - from the initial harvesting of the coffee beans to designing our branding and packaging. I am happy to introduce to you the coffee we have launched - Five Cups Coffee. It is designed for people who share our love of coffee and who can't help but consume more than 5 five cups of coffee a day. We are sure that our product will please any discerning coffee connoisseur . We want everyone to be able to enjoy their coffee without worrying about the risk of having too much caffeine. Look forward to hearing your feedback!

xoxo</comment>


Ask HN: Is the Blackphone worth the price for its security features? - <AUTHOR>

My old clam-shell phone finally gave up the ghost after 10 years. I'm interested in buying the Blackphone (https://store.blackphone.ch/) for it's security features, but am wondering if it is secure at all in reality. Marketing is one thing, crypto is everything, so to speak. Any thoughts or good reviews of the product out there? Thanks. <comment><USER2> Just keep in mind that it's incredibly difficult to make anything a 100% secure. The Blackphone gets some interesting things right, but they have/had bugs too:

[http://arstechnica.com/security/2015/01/bug-in-ultra- secure-...](http://arstechnica.com/security/2015/01/bug-in-ultra-secure- blackphone-let-attackers-decrypt-texts-stalk-users/)

</comment><comment><USER3> I haven't been keeping up; where does Blackphone land on having a secure baseband? This always seemed like the most glaring security hole.

<comment><USER4> As far as I know there is no such thing, as baseband chips and firmwares are controlled by telcos and they won't allow anything unlicensed on their networks.

</comment></comment><comment><USER5> I actually bought one two weeks ago after my 6 years old smartphone died. I still haven't picked it up (shipped it to the US, getting there next week only), but it arrived at my friend's house with no problem. From all I read before making the purchase, it is a good phone, not hacker-proof though, as there is no such thing as a secure computer. But on the other hand, their development team has been extremely fast in patching bugs and pushing fixes.

Also, for those claiming that it is still uses insecure baseband chips and firmwares, the phone comes with Silent Circle suite apps which allows you to make end-to-end encrypted calls and messages, so even if you have a flawed baseband chip, it was built so you could have secure calls and messages through wifi, 3g or 4g, without worrying about the security vulnerabilities of those chips.

</comment><comment><USER6> It depends on what you mean by security:

-secure transmission of data between two points

-PGP

-secure web browsing

-staying anonymous to uncle sam

-staying anonymous on the web

I don't trust it. If anything the Blackphone is just one huge target / honeypot for the government.

With the proper hardware and software modifications, you can come close (if not better) to what the blackphone has to offer in an off the shelf rooted Android.

<comment><AUTHOR> I mean, nothing is secure in the end. Even Bruce Schnider talks about the degrees of security and your own personal tolerances. That said, I am not able to spend the time to do all the mods and hacks that a rooted android needs (grad school, surprisingly, takes a lot of time). With that in mind, would you still recommend the blackphone or a regualr phone? Thanks for the info though

</comment></comment><comment><USER7> The baseband processor is no doubt still a Qualcomm chip, whose makers are known to be cozy with governments.

</comment><comment><USER8> Honestly it's more marketing hype then security. While they do have some good applications they have had some bugs in their phones that really question the $700 price tag.

Most of the security apps will require that the other person has the same apps. I find that rarely will people use those apps.

</comment><comment><USER9> Do you know anyone else who has one/uses silent circle? on the communications side I'm not sure i know anyone with whom i could communicate "securely." The product seems to make a lot more sense when done as a corporate deployment...

</comment><comment><USER10> Nothing Secure, Always assume electronic/voice communication is public.

I would choose a better experience on an iPhone 6 and just accept nothing is secure.</comment>


LG made an 18-inch display you can roll up like a newspaper - <AUTHOR> http://www.theverge.com/2016/1/3/10706180/lg-rollable-display-flexible-screen-announced-ces-2016 <comment><USER2> A $50 color e-ink display (letter size) could replace newspapers and magazines. (The same goes for a flexible display.) Make it dust and water, and people will use it everywhere (bath, beach, restroom, etc.).

I wonder why Amazon hasn't updated their bigger Kindle DX for 6 years? Color e-ink displays that can play small videos at a good enough framerate exist for 3+ years, though no reader devices I know of make use of them.

<comment><USER3> >I wonder why Amazon hasn't updated their bigger Kindle DX for 6 years?

It didn't sell people didn't want it, it was way to big for most users, and way way too expensive (~400$ for the 3G version). People aren't going to pay iPad prices for an ereader of the same size, weight and these days almost the same battery life....

I love my kindle voyage but given the choice between a Kindle DX and an iPad air which costs almost the same most people would get an iPad and so would I.

<comment><USER2> > same battery life

The Kindle battery last for 1-2 months (book reading, it only consumes energy if you turn the page -> e-ink display!).

The iPad battery last for 1-7 days, depening what you do with it and how bright you set the IPS display.

Many own both an iPad as well as a Kindle - both have their advantages.

(edit: I meant WiFi-only Kindle)

<comment><USER4> not the 3g voyage, unfortunately. with mostly default settings (including auto-brightness on the screen), mine barely lasts a plane-ride across the country.

my partner's dx, on the other hand, had no problems whatsoever.

<comment><USER5> eInk achieves excellent battery life by being completely unpowered when the screen isn't changing. When you press the "next page" button, you're basically booting the whole device, having it render the next page, then shutting it off again. If you're using any sort of backlight (as "auto-brightness" suggests) then you won't get that benefit and I'm not surprised your battery life is more like that of a traditional tablet. The DX doesn't have a backlight so wouldn't have that problem. If you turn your backlight off then you should see similar results.

<comment><USER4> turn off backlight, turn off 3g, turn off touch, and turn off force feedback (i am not sure if turning off touch will actually render it to act like a dx).

</comment></comment></comment></comment></comment></comment><comment><USER6> I wonder if this will evolve into large flat screen tvs (50 inch plus) folding down when not in use (just like a portable projector screen). That would be a nice feature for those who don't like having a huge TV on display.

<comment><USER7> If you want a huge TV on the wall, but you don't want to look at it when it's off, you have a few existing choices:

\- put on a screensaver of art that you like

\- close the doors of a cabinet around it

\- roll down a screen in front of it

\- roll it into a closet

<comment><USER8> > put on a screensaver of art that you like

That's a great idea, although I wonder what the typical power consumption is of a big screen TV and how much it would cost to leave it on 16 hrs/day.

<comment> bjelkeman-again This commercial LG LED[1], suitable to be on 24/7 has a power reduction mode at 100 watt. Let's assume that works when it is in screensaver/art mode and it would use 2.4 kWh/day.

A Tesla model S can get 240 wh/km, so the energy use of the display would power an electric car for 10 km. so for a year then it would be the equivalent of moving an electric car 3650 km. I don't drive that much, but it is actually about half of my yearly driving averaged over the last 10 years. Personally I rather turn that screen off and power my next car with it.

Edit: just saw you said 16 hours. Well you can do the math. :)

[1] [http://www.lg.com/uk/commercial- display/lg-55XF2B](http://www.lg.com/uk/commercial-display/lg-55XF2B)

[2] [https://my.teslamotors.com/forum/forums/tracking-lowest- kwhk...](https://my.teslamotors.com/forum/forums/tracking-lowest-kwhkm-whm)

</comment></comment></comment></comment><comment><USER9> This is cool. Waiting on my flexible screen cell phone...

</comment><comment><USER10> is power consumption in something like this less than prior tech?

<comment><USER11> In theory it should be less. LCD's start with a white light, then attenuate it through red, green and blue filters. OLED's don't lose light to generate colour, they produce red, green and blue light directly, so all other factors being equal should have a significantly higher potential efficiency.

</comment></comment><comment><USER12> I remember it seeing in the "Human Edge" of Nat GEO 15 years ago.

</comment><comment><USER13> I am waiting for a display that can be rolled up like a toilet paper. That could make some threads really shitty...

</comment><comment><USER14> I keep hearing about stuff like this, but where's the market for it? Who wants to buy an expensive display that will likely get damaged very fast due to its flexibility ?

<comment><USER15> Getting mobility right is a big step forward.

The intermediary steps are not so financially rewarding or even interesting, but the end game is significant.

Durable, flexible screens allow a whole series of new technology.

Off the top of my head:

Imagine a laptop with a screen that seamlessly folds in four. For travelling work you use a quadrant, for office work or presentations you fold it out to full size.

Imagine a screen that folds around your arm like a cuff - perfect for leisure activities like cycling or diving, or work that requires both hands (an alternative to google glass style displays).

If you can make something durable and flexible, there are a lot of new things you can do that you currently can't.

<comment><USER3> >Imagine a laptop with a screen that seamlessly folds in four.

Flexibility isn't folding, you can't fold these displays that's one of the main issues with them they'll crease and then break.

>Imagine a screen that folds around your arm like a cuff - perfect for leisure activities like cycling or diving, or work that requires both hands (an alternative to google glass style displays).

A screen also fits in a pocket, there is no reason to put it on a cuff I like that Nokia demo like the next guy but come on... why would you replace your 4-6" display with a much smaller one? not to mention that a smart watch/wristband would work just as well. And if you want to curve a display around something that would fit your wrist you don't need a "flexible" display you can mold traditional TFT's also.

P.S. If I'm doing something with both hands the last thing i need is a display on my wrist distracting me ;)

>If you can make something durable and flexible, there are a lot of new things you can do that you currently can't.

Not really sure you can do quite a few neat things in a different way but hardly new things.

<comment><USER15> So - real life example where I personally would have benefited from wearable screens.

In another life I was a mailman using a bike.

To do that efficiently you steer the bike with one hand, keep the mail on a tray in front of the bike and deliver it with the other hand as you keep biking.

When I was doing a new area I needed to bring a map to know what way to go.

Having that map be interactive and visual would have been a real benefit to me - it was an A4 sheet that I needed to stop the bike to read. Audio wouldnt have been as good, as I was veering, slowing down and accelerating a lot so the directions would have been confusing. It's a situation where something strapped to my arm would have been a lot more effective - a paper map was too small to strap to the arm, but an interactive map would have been perfect.

Google glass, or a flexible screen would have both solved that situation for me.

<comment><USER3> Well in that case a normal screen attached to your bikes handle bar [https://www.google.com/search?q=bike+phone+holder](https://www.google.com/search?q=bike+phone+holder) would probably work better....</comment></comment></comment></comment></comment>


Did a murderer and a sex offender just save Oklahoma $20 million? - <AUTHOR> http://www.washingtonpost.com/blogs/govbeat/wp/2013/10/29/did-a-murderer-and-a-sex-offender-just-save-oklahoma-20-million/ <comment><USER2> There's a fine line between prisoner and slave.

[https://en.wikipedia.org/wiki/UNICOR](https://en.wikipedia.org/wiki/UNICOR) ->

 _Under current law, all physically able inmates who are not a security risk or have a health exception are required to work, either for UNICOR or at some other prison job. Inmates earn from US$0.23 per hour up to a maximum of US$1.15 per hour, and all inmates with court-ordered financial obligations must use at least 50% of this UNICOR income to satisfy those debts._

I think work and education/skills are key to being a healthy human. I just worry that prison labor could easily cross over from being rehabilitative to being exploitative.

<comment><USER3> >I just worry that prison labor could easily cross over from being rehabilitative to being exploitative.

I think we've already crossed that line. As far as I know, they don't do it directly, but prison lobbying groups have worked hard to increase the use of mandatory minimum sentences, make sentencing harsher, and keep the war on drugs going.

To me the line is where prisons go from making use of a labor pool that already exists, to actively trying to increase the size of that labor pool.

<comment><USER4> I see where you're coming from, but I disagree that the degree to which prisons campaign to increase the size of the prisoner labor pool is indicative of exploitation.

Imagine an hypothetical situation in which a prison teaches its occupants to code, pays them market wages, and turns a profit. If demand for programmers was high, this prison would be heavily incentivized to lobby for more prisoners, but you'd be hard-pressed to call the nature of the work "exploitative".

<comment><USER5> That can only work if, on average, prisoners in prisons are innately better at programming than programmers in offices. Otherwise there may not be a competitive advantage, there may even be a competitive disadvantage.

<comment><USER4> Maybe, but the point of my hypothetical isn't to prove that prisoners can be good programmers. It's to show that lobbying for more prisoners doesn't necessarily mean that you are exploiting said prisoners. It simply means they are helpful to you.

<comment><USER6> Any time you create an economic demand for more prisoners, you are exploiting _people_ some of whom are not prisoners _yet_.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm interested in the 2 different prices.

> _The software showed that Sysco, which supplies food to the state prison > system, was charging the state different prices for the same food item sent > to two different facilities,_

From the linked Oklahomian article:

> _"In some cases an exact same item might arrive at Lexington (Assessment and > Reception Center) and Harp at the same warehouse, and one has a different > price than the other," Murphey said._

Was that a deliberate underhand move by Sysco, or is it normal expected part of contracting the job out? Or is it even more mundane, and just a price break for ordering more?

It's nice to think that there's a prison where inmates are not just allowed to rot. Here's another story where inmates get to do challenging, rewarding work looking after inmates with dementia. Warning: It contains graphic accounts of horrible violence.

[http://www.nytimes.com/2012/02/26/health/dealing-with- dement...](http://www.nytimes.com/2012/02/26/health/dealing-with-dementia- among-aging-criminals.html?_r=2&hp=&pagewanted=all&)

<comment><USER8> _It 's nice to think that there's a prison where inmates are not just allowed to rot. _

That how our prisons should work. It may not satisfy a human being's need for retribution, but when did inflicting harm more than what's necessary to keep humans safe ever did for humanity?

Anytime you jail a human being, you're using up resources to feed them, shelter them, and protect them from dangerous human beings. That cost taxpayer money. Why not get something out of the condemned by fixing them and studying them and making them better so that the prison system will collapse because it's so effective at repairing? (Of course, there are human beings that may be unfixable, but the vast majority probably are)

<comment><USER9> > Why not get something out of the condemned by fixing them and studying them > and making them better

I understand your point--prisons can be rehabilitative or educational institutions rather than fulfilling a purely retributive function--but your language is setting off some alarm bells for me. We ought to shift from using the language of "fixing" people to helping people or, in many cases, fixing the system.

</comment></comment></comment><comment><USER10> just because they go to prison doesn't mean they have to stop contributing to society. There are probably a good number of such individuals that need the chance and encouragement. Idle minds serve no one

<comment><USER11> You're right of course, but we have to be careful about unintended(?) side effects. It's a very short road from prisoner development to the state having an unhealthy economic incentive to lock people up.

<comment><USER12> Are you talking to the militant hacker crowd?

Hey, aren't you? I do believe we call that a "draft".

[http://www.insightcrime.org/news-analysis/are-mexico-drug- ga...](http://www.insightcrime.org/news-analysis/are-mexico-drug-gangs- drafting-hackers)

[http://blogs.wsj.com/digits/2013/09/18/rsa-russian- speaking-...](http://blogs.wsj.com/digits/2013/09/18/rsa-russian-speaking- hackers-drafting-new-recruits/)

OR: An unhealthy economic incentive to release [made-for-prison] software onto the public writ large. (And if the software isn't sufficiently modular, what kind of unwanted surveillance comes "for free" – or "batteries includes"?)

A dialogue:

A: "What did you do in prison?"

B: "Started a hacker school that wrote the surveillance program which monitors this very traffic intersection."

A: "What were you in for?"

B: "Drunk driving; caused an accident."

A: "Does it see my concealed metals?"

B: "If you move fast enough. We had to make first launch!"

Will this tease out public opinion on "rehabilitation"? Or will it show how we really feel about "bootstrapping"?

</comment></comment></comment><comment><USER13> Interesting story. I say give these people resources to be productive and a certain number of hours a day. Let them own their own IP. The point of prison shouldn't be to punish, but to rehabilitate people, if possible, and if not, to keep other people safe from them. Either way, if people have the capability to contribute to society while behind bars, why not let them? (As other posters have noted, it's important to make sure the prison/industrial complex isn't being incentivized to increase prisoner count in all this, as they are today.)

</comment><comment><USER14> An actual sex offender or just someone caught up in some politician's moral panic?

At least "murderer" hasn't been hi-jacked. Yet.

<comment><USER15> They didn't actually name the person, so that is unknowable.

My uninformed impression however is that while many people may unjustly get the "sex offender" label (for example, somebody who got caught pissing in an alley behind a bar), the people who receive a "sex offender" label _and_ jail time skew towards the _" did something that actually has a victim"_ crowd.

<comment><USER16> Has a victim and doesn't have enough money to buy enough "justice" to keep them out of prison.

<comment><USER13> ...perhaps be fleeing to Europe and continuing their career in film?

</comment></comment></comment></comment><comment><USER17> Was this software vetted by security experts to make sure it wasn't being used behind the scenes for anything nefarious? Like say, exploitation of prison computer systems etc.?

</comment><comment><USER18> It all sounds good, until you get to the barcodes:

> "Prisoners each have a bar code they can scan, ..."

> "When an inmate's bar code is scanned, prison officials would be alerted > that they should receive a diabetic meal, or a Halal or Kosher meal."

<comment><USER7> I'm not quite sure what your point is?

</comment></comment><comment><USER19> I wonder if Oklahoma purchased license to use this software.

<comment><USER20> Purchased a license? I bet they own it.

<comment><USER19> It is a question how author law is set. But prisoner does not lose rights to own things.

</comment></comment></comment><comment><USER21> Where is the source? The taxpayers are paying their room and board, this software should be freely available on github.

Might even help with the auditing process.</comment>


Memory – Part 6: Optimizing the FIFO and Stack allocators - <AUTHOR> https://techtalk.intersec.com/2014/09/memory-part-6-optimizing-the-fifo-and-stack-allocators/ <comment><USER2> It's great to be able to make memory allocators faster, but it's also wise to consider the possibility that it's the applications that use them which are where the inefficiency is - and ironically it's the applications that do the most unnecessary allocation/deallocation that would benefit the most from a faster memory allocator.

To paraphrase a common adage, the most efficient way to allocate memory is to not do it at all. Probably helps with reducing the chance of use/free bugs too.

<comment><USER3> What would be an unnecessary allocation? A program generally does something with the allocated memory and at that point it becomes a necessary allocation.

Specifically, it makes a _lot of sense to optimize system_ allocators.

If you can't rely on fast system allocators you are inclined to recreate your own pools and arenas that allocate from malloc() and write all the management boilerplate yourself, with your own bugs on top. This also eats up your time that you would otherwise spend on writing your application. Oh yeah, you're also likely to end up slower than any of the recent allocators published since 2000's or so.

On the other hand, if the system has some modern slab-style allocator that is cache-aware and does automatic pooling of similarly sized objects, you get all that basically for free by calling malloc() and free() in a dumbfounded and "unnecessary" way, very much repeatedly. Well, the applications need to manage their memory somehow, hence the allocations and deallocations.

Optimizing the system memory allocator pays off as long as you never see the allocator hogging too many cycles in your profiler. If you can get away with lots of malloc(), free(), and whatnot because of a smart allocator that ideally turns those into bumping pointers merely then, _you win_.

Custom memory management is generally useful in some highly optimized loops where you just can't pay the cost of a random book-keeping round when calling malloc() or free(), or in cases where you can spend some to save some. Then you might want to manage your own pool so that you can guarantee there won't be operations other than O(1). Alternatively your program might benefit from a pattern where all the memory is allocated sequentially and never freed until at the very end of the operation. Processing one request or running one cycle of operation might examples.

<comment><USER4> A C++ program that copies arounds lots of temporary std::strings is an example of unnecessary allocations.

The thing about optimizing allocators is that you very quickly run out of ways to make them faster without a space tradeoff. Notice the first optimizations detailed in the article was to retain a 'free page' instead of returning it to the kernel: this speeds up allocation and deallocation, but increases memory usage. And if one makes it faster, why not two, or three, or fifty?

The same is true for that slab-style allocator. The basic idea is to separate memory into separate pools of different sizes, and only allocate from the pool for the given size. If that pool is full, enlarge it, even if other pools have enough space to satisfy the allocation. That's wasted memory!

So we have to balance speed against memory usage. The right balance is domain- specific: that Java app running on a monster server can afford to waste lots of memory to speed up allocations, while the allocator on my iPhone needs to be much more mindful of its space overhead.

</comment></comment></comment><comment><USER5> Interesting article. I checked out [http://intersec.com](http://intersec.com) to see what they do, but I got redirected to [https://www- preprod.intersec.com/en/](https://www-preprod.intersec.com/en/)

Seems a bit odd?</comment>


Makin' It Rain - How Raindrop Effects Work In 2D Games - <AUTHOR> http://bulletproofoutlaws.com/?p=264

<comment><USER2> To me, the biggest lesson I've learn from game programming tips and tricks was to not model the world exactly. Just model it enough to trick the eye. My first inclination was, "but of course you need the splats where the rain drop line ends! How would it make sense otherwise?" But it's not until you see the video that you get that, hey that worked well enough.

I imagine it's applicable to other realms of programming as well, like web programming. We should question if we really need something on the page, or if there's just some way to fake it or get away with doing less. Or same with scheduling notifications to be delivered. Does it really need to be real-time? Or can we just cheat a little since the tolerance is much higher?

<comment><USER3> _Or can we just cheat a little since the tolerance is much higher?_

Sure, we call this caching. Imagine you have a blog with comments. You can generate the page for each user when he wants it, and then it's a real view onto the data that you have available. Or, you can generate it once a second and just serve the stale version -- not much can happen in one second. Making that compromise is the difference between handling 10 requests a second and 10,000 requests a second. Almost always a good tradeoff.

(Doesn't NYTimes do this?)

<comment><USER4> I've noticed this on Reddit. When you submit a comment it's inserted into the page with a bit of JavaScript but when you refresh the page it's gone. Refresh the page again after a few seconds and it's there.

</comment></comment></comment><comment><USER5> Or you could use color cycling: <http://www.effectgames.com/demos/canvascycle/?sound=0> (choose 'Highland Ruins - Rain' and show the options to see the palette). Crazy in these modern times, of course.

<comment><USER6> Those color cycling demos are amazing. Unfortunately, color cycling has fallen out of practice both because it is too hard to teach artists and because the double-lookup-per-pixel is memory bandwidth intensive on modern hardware (old systems had dedicated hardware to support this).

</comment></comment><comment><USER7> haha awesome, you blew my server up. Upgrading now but it'll take a couple days they say.

Anyone reading: that's my game development blog, I'm starting an iPhone game dev studio and documenting the progress of starting it up and making the first game, day by day!

Check it out if you're interested in game dev and feel free to ask any questions!

\- Quickdraw

<comment><USER8> I'm very interested in iPhone game development. I'm working on a title for PC/Xbox based on the XNA framework and finding it fairly easy to use. Is there anything like that for the iPhone? Any good place to find a comparison of frameworks? I'm not averse to coding interactions by hand (trying to make a 2D RPG, not a platformer, so Torque isn't appropriate), but I can't make sense of the options.

<comment><USER9> Cocos2D is the most popular 2D iPhone game framework. An alternative, if you're used to the Flash/ActionScript way of doing things, is Sparrow. You may also find that if you're doing an action/physics game in the future, Box2D will inevitably be necessary.

If you're looking for a GUI as opposed to a programming API, in addition to the fine options above, my startup (<http://www.stencyl.com>) also does this and is based on Sparrow (and Flash for exporting to the web).

However, I'll be realistic and say that if you're making an RPG, you'll find it much easier to build it by hand.

<comment><USER10> Stencyl looks like a lot of fun, kudos! And am I right that some of the linked games have even managed to score themselves sponsorship?

<comment><USER9> Thanks! The Balls in Space game scored several sponsorships that have collectively gotten it into the 4 figures range, which is pretty good by Flash standards.

</comment></comment></comment></comment></comment><comment><USER11> Excessive use of font bolding in this article.

<comment><USER7> For people in a hurry. :) You can just skim the bold sections and get the important points of the post. I tend to write way more than anyone would really want to sit down and read haha

\- Quickdraw

<comment><USER11> Fair enough :)

</comment></comment></comment><comment><USER7> iamwil: "My first inclination was, "but of course you need the splats where the rain drop line ends! How would it make sense otherwise?""

Exactly, I think that's default programmer-logic. "If there's a drop, it must have a splat." I used to do some programming but I'm more of an artist than a progger so I figure writing about little artsy tricks like that might help other devs out. It can be rough trying to fit cool stuff onto tiny phones haha

Luc: I'm a pixel artist at heart so I love color cycling, but ya, appearing in front of another layer blows it up. Also these days I don't think iPhone games use palettes much...I know older cel phones needed them, but for iPhone I seem to be able to get away with just using big ol' .PNGs with no palettes (which rules, 'cause I can get anti-aliased edges).

\- Quickdraw

<comment><USER12> It's also interesting just from a project management point of view, or anyone doing a startup, imo. Good blog!

<comment><USER7> Thanks! I'm trying to cover the stuff that surrounds game dev, managing my time, keeping track of expenses, marketing the game, etc. 'cause I think that stuff gets glossed over a lot.

Like I'll be posting my financials for the month soon, even though I know they're going to be negative since my game isn't out yet haha But it's the principle of the thing, getting into the habit of keeping accurate records.

Glad you like the blog! I'm shooting for daily-esque updates so pop in again in a couple days!

\- Quickdraw

</comment></comment></comment><comment><AUTHOR> Welp, looks like I crashed their server...

Update: There it goes!</comment>


My thoughts on the Startup Visa bill - <AUTHOR> http://vinthanedar.com/2010/02/26/my-thoughts-on-the-startup-visa-bill-fail/

<comment><USER3> If you're a Chinese engineer that can create 4 jobs and generate $600,000 in revenue at a company you create in the US, you should be allowed to immigate regardless of whether a "qualified super angel investor" "sponsors" you. You should be able to immigrate regardless of whether you can purchase a postage stamp to request the visa. You should be able to immigrate regardless of whether you're willing to wear pants.

Immigration carve-outs, like this one which clearly targets VC-based companies, come with a raft of unintended consequences. Look at the massive abuses generated by the H1-B visa program, where employers use their untenably lopsided negotiating position to lower working conditions for everyone by cheating immigrants. Here, we've substituted VCs for employers, and given immigrants 2 arbitrary escape hatches (generate 5 jobs, generate $1MM in revenue).

This is the wrong path for immigration reform.

Anything you do to make it more fair makes it more gameable. Graham likes to point out that people like Ron Conway are excellent people indeed, who would never game the startup visa. Who cares? You've never heard of the people who you really have to worry about with this bill.

Anything you do to make it less gameable makes it less fair. VCs are compensated for their investments by investment returns when their companies are acquired or go public. We don't need to create a new form of compensation for them by giving them a feed of entrepreneurs who are beholden to them for their family's residency in the US.

Immigration reform is a hard problem. Immigration is broken. This problem is urgent. We should address it. But I think this bill is a terrible way to do it, and that it creates more harm than it ameliorates.

<comment><USER4> I agree, completely. What I'd say to the US government: take in talented people (without worrying too much about exactly how they are talented, such as preferring engineers or scientists), give them the same autonomy and freedom you'd give a US citizen, and let them choose their own path in life. Quit thinking you know what they should do, they know better than you do. They'll impress you in ways you didn't expect, and it'll be better than you expected.

Get rid of this H1B, startup visa crap.

I've had huge disagreements with other people on HN about immigration, mainly because I do believe in limits (I oppose unlimited immigration), and I think that emphasizing engineering instead of general diversity of talent is harmful. But almost everyone seems to agree that freedom and autonomy are preferable to a government mandated purpose and skill set.

<comment><USER5> I've had this discussion hundreds of times with talented foreigners (India, German, Polish, and Chinese just to name a few). They all have had the same generic complain "why can't I just live in this country... I'm talented enough".

I fully agree...but unfortunately for these people they are tied to larg-corp H1B visas which restrict their freedom to leave the company and create jobs elsewhere.

Here is the key issue...how do you decided who is talented and who is not? This would become a highly bureaucratic issue.

<comment><USER4> "Here is the key issue...how do you decided who is talented and who is not? This would become a highly bureaucratic issue."

I agree, and it makes me slightly uneasy when I say it. It does require what will ultimately be a bureaucratic judgement. I'm not sure there's a good alternative.

While I don't relish the idea of the government assuming this role, I'd still prefer it to Oracle's HR department, which is not (and probably should not be) accountable to me or any other member of the voting public. Guess it comes down to Churchill's statement "Democracy is the worst form of government, except for all those other forms that have been tried from time to time."

</comment></comment></comment></comment><comment><USER6> The startup visa bill smells like progress and I don't buy the idea that a small step in the right direction hinders efforts at more radical reform.

However, I would like to see a more entrepreneur-centric approach that makes the O1 and EB1 processes easier, rather than using the EB5 as a starting point. That would benefit a wider group of entrepreneurs, though not necessarily investors and it's the investors who seem to have the lobbying power to make change happen.

<comment><USER7> I just think the investors have more to gain. An individual foreign entrepreneur doesn't have the means to lobby the US gov't, and domestic entrepreneurs don't have this problem. Investors might benefit dozens or hundreds of times from this effort.

<comment><USER6> Whether or not investors gain more this is still also a win for a certain group of entrepreneurs and I can't see how it is harmful for others outside that group. Since investors are the ones doing the legwork to lobby for this it's natural that they're working for themselves too.

For the rest... one thing that surprised me was how much easier it seems for Australians to setup here than Brits like myself. I speculate that our own government could do a lot more to lobby on our behalf themselves but are more concerned by the (short termist) fear of a serious brain drain.

</comment></comment></comment><comment><USER8> It might be worth looking at all the foreign students that the U.S. attracts. I was born in Germany, did 2 years of high school in the U.S. and am about to finish college here, too.

I got a big scholarship ($20k per year), which is subsidized by American students. The U.S. educated me, gave me $80,000 and now there is no easy way for me to stay and contribute to society (taxes?)?

I agree with the author but I hope this bill will at least get people thinking about the screwed up immigration policy in this country.

<comment><USER5> I'm confused... what's screwed up with our country's policy? Correct me if I'm wrong but doesn't Germany have the same policies??? I've lived in Germany for a year of my life on a work visa from a large German corporation. They paid for me to live, work and contribute to the companies success in Germany (and throughout EMEA for the record). How would it be my right to just quit my job at this corporation and go start up another company just because my original corporation gave me the opportunity to live there.

Your contribution is to society is taxes?? Not sure I really follow you there.

<comment><USER9> Perhaps he means to pay back America by earning money and paying his way via taxes. Instead of taking all that education investment back home.

</comment></comment></comment><comment><USER10> I think the writer is spot-on with his criticisms.

Being involved with a startup is risky business. And the risk-return premium (since when did a _visa_ become a _reward_?) in the case of the startup visa is pathetic.

Overall, this startup visa is a pedestrian, half-hearted effort, at best.

A green card is a much better way to incentivise.

</comment><comment><USER11> Immigration is such a tough issue, especially in a recession. But I love the idea of the US being a magnet for the best and the brightest that start companies. Many countries use qualifying criteria such as education level or willingness to start a business as a way to gain permanent entry. We could do worse than to adopt such policies here.

<comment><AUTHOR> The criteria here is raising money. How is that better?

<comment><USER12> It's better because it moves the validation of the startup from USCIS, which is definitely not capable of this, to someone like an angel or VC.

What it seems to be saying is, if someone is willing to put a specified amount of money in the venture of an alien and hence prove to USCIS that there is some value in having these founders come to US, then US will give them Visa/permanent residency.

I do think that is a good idea.

Are there issues, sure, everything has issue. Name one perfect thing in the world. But this is definitely a step in the right direction.

<comment><AUTHOR> You're missing the point. Channeling energy to fixing what is ridiculously broken will likely yield better results. Where is the sense in creating another monster when you've got one in your front lawn?

</comment></comment></comment></comment><comment><AUTHOR> I'm interested in listening to what others think about the startup visa - <USER2> swept away by the hype surrounding it, but an intelligent discussion on it's true merits and shortcomings.

There is no question that there is a need to foster and grease the wheels of entrepreneurship.

<comment><USER7> Here's a shot.

Economic growth is mostly based on big factors but those are often controlled or influenced by a strikingly small number of people (like Henry Ford, William Shockley, Fred Terman, Carnegie, Sears, Rockefeller, Mittal, Napoleon, Franklin, Eli Lilly, etc). When it's winner-take-all (or -most), the country/city/state that hosts the winner benefits greatly. So stacking your odds to grow or attract these pivotal individuals is a valid economic strategy.

Even if you presume that low skilled immigrants are a drain on the economy (I think that's up for debate), how many would you trade to make sure that Elon Musk lived in your country? How about the Brin Family? etc, etc, etc. Smart, driven people around the world _want_ to come to America to live, work, and build companies because it's where they think they have the best chance of success. Losing even a handful of them could cause America to lose the fight for the next great industry, especially since China, India, and the EU are much more prosperous than they were for much of America's 20th century boom.

I don't think the Startup Visa is enough, but I think it's a concrete, feasible place to start.

<comment><AUTHOR> Did you read the blog post?</comment></comment></comment>


Google to Shut Down Their Chinese Operations April 2010 - <AUTHOR> http://webupon.com/search-engines/google-to-shut-down-their-chinese-operations-april-2010/ <comment><USER2> I have to say, I found the initial audio ad annoying when I opened this link into a background tab.

I don't mind ads too much if they don't distract me and I can skip them.</comment>


First Impressions Matter 26% of Apps Downloaded in 2010 Were Used Just Once - <AUTHOR> http://www.localytics.com/blog/post/first-impressions-matter-26-percent-of-apps-downloaded-used-just-once/

<comment><AUTHOR> First impressions definitely do matter … not just for mobile apps, but for webapps and standard websites as well. Hey, they matter for your social media profiles too; if someone's recent tweets or anything else aren't interesting/useful, I'm far less likely to follow them.</comment>


Scammers registering date-based domain names - <AUTHOR> https://shkspr.mobi/blog/2020/01/scammers-registering-date-based-domain-names/ <comment><USER2> > And that's the price we pay for anyone being able to buy their own domain > and run their own secure site.

No, that's the price we pay for using a name resolution system from the 80's (70's?) that was not built with trust validation in mind,decoupled from the infrastructure we use to establish domain ownership and authority. And also without user friendliness or of a layman's ability to independently validate authority in mind. e.g.: reverse order of hierarchy where in english you read left to right but dns has least authoritative/lowest level on the left and most authoritative on the right,why would I evaluate trust worthiness of site.com if 'secure' is evaluated first in secure.site.com (another example:google.com.site.info).

Cracked foundations make shaky buildings.

<comment><USER3> yes, very wrong conclusion. the author blames cheap domains and easy to get https. You could as well blame cheap computers, cheap internet access, cheap electricity.

Since that looked like an SMS, I would report it to your mobile provider, let them track who sent the message.

<comment><AUTHOR> I'm the author. I'm not blaming cheap domains. I'm saying that spam like this is a consequence of cheap domains.

The blame lies at the feet of the spammers.

And, I've worked for a couple of mobile providers. This spam was likely sent from a disposable pre-paid SIM. There's no realistic way to check who sent it.

<comment><USER4> So the phone/device IMEI is not recorded for the session?

Not that it would tell who sent it, but would allow to track if the same devices were used as part of ongoing campaign.

<comment><AUTHOR> The sending network may have a record of the IMEI, but I don't think the receiving one gets it.

But SMS sending devices are cheap and disposable. Sure, it's illegal to alter your IMEI in the UK - but if they're already committing one crime, I don't think that'll stop them.

</comment></comment></comment></comment></comment><comment><USER5> On the topic of trusting domains, big companies are not helping themselves. Lets use a big financial company as an example.

I recently got an email from them to check on a transaction that settled, the domain was:

[https://click.SOMECOMPANYNAMEHEREinvestments.com/](https://click.SOMECOMPANYNAMEHEREinvestments.com/)? ...

Their real domain is SOMECOMPANYNAMEHERE.COM but as you see they made a special domain just for email clicks. I thought at first this was a scam email, but then tried clicking and sorted out that it redirects to the real site and login.

But man you can't even easily trust real emails if you're paying attention, i dont know how regular people will defend against stuff like this.

<comment><USER6> This likely happens to prevent the primary domain from being blacklisted. Many companies including key ESPs will register multiple domains to combat potential spam listings and blacklists. It's possible they rotate through a number of similar domains to ensure if any are blocked they have backups available for use until those get unblocked.

</comment></comment><comment><USER7> There's been a lot of talk about the benefits of browsers showing URLs in a stylized way that makes it more obvious to the user what is the domain and what is not the domain.

I should have realized this earlier but: it's also important to have anything that displays clickable URLs (like a messaging app) to also style the URL to help it be more obvious what domain is being linked to.

The problem of better stylized URLs is so much bigger than browser URL bars that show where you are right now; it's also everywhere that _displays_ clickable URLs.

<comment><USER8> Does hacker news even do this?

[https://example.randomsite.phishyourbank.com/Jan3](https://example.randomsite.phishyourbank.com/Jan3)

<comment><USER9> Hacker news is probably one of the least important places to do this.

It has a high concentration of technical users, only supports public posts (where technical users will notice and comment on such urls), and has very active moderation.

Texting apps seem like the most important place to implement it... judging by the spam that I get.

<comment><USER8> That kind of attitude will put people off guard though. These things pop up in places where you least expect them. I agree it's less important than other places, but also would be nice for us to practice what we preach.

</comment></comment></comment></comment><comment><USER10> > Money and technical expertise used to be strong barriers to prevent people > from registering scam domains

That should not be, and should never have been considered the main line of defense against that.

This guy has it backwards. The problem is not that it's affordable or accessible. It's that there's no clear alternative to user vigilance to truly avoid these scams.

</comment><comment><USER11> Too bad domain names are generally written in the 'wrong' order. These issues would have been preventable if domain names were written the following way: [https://org.example.www/index.html](https://org.example.www/index.html)

The domain referenced would have been: [https://info.billing-update- jan02.uk.co.ee/](https://info.billing-update-jan02.uk.co.ee/) vs [https://uk.co.ee/billing-update-jan-02](https://uk.co.ee/billing-update- jan-02)

<comment><USER12> I don't see how this is any more informative to your average layman?

<comment><USER13> Look at these 2:

        https://ee.co.uk.billing-update-jan02.info
        https://ee.co.uk/billing-update-jan02.info

There's just a single character difference. The layperson will think they mean the same thing. Now look at these 2:

        https://info.billing-update-jan02.uk.co.ee
        https://uk.co.ee/billing-update-jan02.info

There's a big difference there. People can easily see something is abnormal.

<comment><USER11> The attacker wouldn't use that one in that case though.

        https://uk.co.ee/billing-update-jan02.info
        https://uk.co.ee-billing-update-jan02/info

Would be more likely.

Perhaps an animation showing both would help.

<comment><USER13> You're right, the benefit isn't really about character differences. In both cases users need to be taught that '-' isn't a divider and '.' is a divider. The benefit is that it would be easier to teach people to start on the left then search right than it is to teach people to start at the leftmost / (but not the ones in the scheme) then search left.

</comment></comment></comment></comment></comment><comment><USER14> Web-based phishing has become a game of speed. Domains are not expected to survive more than an hour (and few do), even with all kinds of countermeasures in place (browser / geo detection, destroy-after-first-use links, etc). Yet it's still economically viable to do. Companies offering blocking products like Google Safe Browsing have been forced to increase the frequency of their blacklist, up to the point where Google had to resort to checking suspicious URLs against their online database rather than a cached local index.

This is a classical arms-race and will only intensify. With domains that look generic enough and only serve malicious traffic when hit with the right URL, parameters, user-agent and geographical location, blocking will have to rely on sourcing these URLs directly from the targeted endpoints (e.g. SMS/WhatsApp/Email), rather than "crawling" or relying on users to report these. Another approach is to do some of the blocking locally, which of course means pushing the detection logic to the client and thus exposing the classification mechanism. Neither approach is sustainable long-term in my opinion.

<comment><USER15> It seems to me that a list of known good domains provided by a large browser vendor (Google) with extra treatment in the browser might be the most effective against phishing and other scams.

This could be sold as an add-on for a certificate, or something like that, with a just high enough barrier for proving authenticity. Known-good domains could then additional treatment, like a blue padlock or one with a star (ok, I'm not an icon designer).

Of course you can argue against it on a freedom basis, but I think for protecting vulnerable web users it'd be pretty useful.

<comment><USER16> Security measures like that becomes "Google abuses its monopoly to suppress competition" complaints that are frontpaged here every week.

</comment></comment></comment><comment><USER17> Wouldn't a soundex-like algorithm catch the similarity between the legit domain and a substring of the malicious one? An alert could be fired upon reception from any address resembling domains where online transactions or any other sensitive activities are involved.

</comment><comment><USER18> Looks like your typical Microsoft domain, e.g. [https://www.microsoftedgeinsider.com/](https://www.microsoftedgeinsider.com/)

<comment><USER19> I hate that companies do this. I get why they might do this to avoid red tape but it just piles on the phishing / scamming possibilities for people who dont know better.

<comment><USER20> I hate that Microsoft does it but I have heard that it enables cookie partitioning and other similar domain-based isolation.

<comment><USER19> Would subdomains not achieve this though?

<comment><USER20> I'm not completely sure, but I think some things are shared by eTLD+1.

<comment><USER21> You can make your domain effectively an eTLD by putting it on the Public Suffix List. This is what Google did with withgoogle.com . This means no cookies can be set on withgoogle.com . So hire.withgoogle.com is completely isolated from games.withgoogle.com (they are separate eTLD+1s).

[https://publicsuffix.org/list/public_suffix_list.dat](https://publicsuffix.org/list/public_suffix_list.dat)

<comment><USER19> Looks like they have hotmail, azure, and microsoft on there, and probably others.

> // Microsoft Corporation : [http://microsoft.com](http://microsoft.com) > // > Submitted by Justin Luk <firstname.lastname@example.com> > azurecontainer.io > > azurewebsites.net > azure-mobile.net > cloudapp.net

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> > Money and technical expertise used to be strong barriers to prevent people > from registering scam domains.

Cannot confirm. I registered my .de-Domain in 2005. That was 15 years ago. It wasn't that difficult, and quite cheap (imho 12€ for a year). So the tech barriers vanished a long time ago.

<comment><AUTHOR> .info domains can now be bought for around €1. If, like the scammers I mentioned, you're buying one for every day of the year, that's a several thousand Euro difference.

Spammers are in business. When certain costs fall, it makes their enterprise more profitable.

<comment><USER23> Why do they need date specific domain names?

<comment><USER24> They don't have to be date specific but they need fresh ones constantly. They get flagged as malicious quickly (within a day or so for large spam campaigns) so they need fresh ones that aren't flagged.

The date is sometimes used to confuse people when they're reading it so they think it's part of the URL and not the actual domain name.

</comment></comment></comment></comment><comment><USER25> I think the most practical solution here is to train users not to use domain names and de-emphasize them in the UI (and URLs more generally). Which I hate as much as anyone here, but if I'm going to give my parents advice on how not to fall for a scam, telling them "Google the name of the bank [or whatever] and click on that link" seems like the most secure path.

Once security keys become ubiquitous, they should also provide some protection. But right now setting up 2FA for every site they use is impractical.

</comment><comment><USER26> "By the time I'd fired up a VM to inspect it, major browsers were already blocking the site as suspicious."

The system sounds pretty safe to me, even with its warts.

</comment><comment><USER27> A lot of replies here are pointing at DNS being not trust-able, but let's back up a bit. This is only a problem because people are still clicking on unsolicited links they get in their E-mail. When you get an unsolicited phone call and the guy on the other end claims to be from your bank, do you give him your personal information and conduct whatever business he wants to conduct? Of course not! So why would you click through some random link you get in E-mail or text, regardless of how official it looks?

Users need to stop clicking on links they get out of the blue over E-mail, and legitimate companies need to stop sending links they expect customers to click, which encourages this risky behavior. Easy to say, but behavior is hard to change.

<comment><USER28> > Users need to stop clicking on links they get out of the blue over E-mail, > and legitimate companies need to stop sending links they expect customers to > click

I agree with the first part, but how is the second part supposed to work? We're using links to easier guide people in the "right" direction (depending on who "you" are, changes what "right" means), what could an alternative be?

So, a X just finished, and the user can now use it. In my notification to the user, how to guide them to that specific X?

<comment><USER27> I think the key is whether the E-mail is unsolicited. Request a password reset? The E-mail is solicited and expected. Just bought something from an online store? The receipt E-mail is solicited and expected. In these cases, users should not feel it's particularly risky to click the links, because they are currently interacting with the site.

On the other hand, "Hi! We noticed there is a scary-sounding problem with your account, please click here to fix it!" No legitimate company should be sending users something like this out of the blue, and users should be trained to immediately think fraud/scam when they receive this.

<comment><USER28> So you bring up a good example. Imagine something scary happened to the account, and the user needs to provide some additional details or fix something. How can I as a company inform the user about this and get them to fix this?

The incentive from the senders side is to get the person receiving it to do something. If that's good or bad, it's harder to say than draw a line in the middle. Currently, bunch of companies and other entities are finding the whole clickbait super useful, and it's only natural that bad actors take advantage of this. But who is the bad actor? Turns out a lot of them, but on different levels.

<comment><USER27> How would you do it if, instead of the E-mail address, you had the customer's phone number? You probably wouldn't call them out of the blue and ask them to do something, since that seems scammy. So why should a security-minded user treat an identical conversation over E-mail differently?

Is this need real though? I can't think of a legit example where out of nowhere (i.e. not in the context of some transaction I'm currently doing with them), a company would suddenly need me to fix something, do something for them, or provide them information.

</comment></comment></comment></comment></comment><comment><USER29> Apple could do some basic spam filtering on SMS messages directly on the device (ditto for Google on Android). Querying a domain reputation service will very quickly tell you whether a URL is a risky click.

At a bare minimum, show me a warning when an SMS comes through containing a risky URL. I just don't see why these giant companies with billions in profit can't connect the dots here.

<comment><USER30> Those giant companies already have connected the dots and have super aggressive spam filters for links. It's a testament to the volume of spam that's out there that so much still gets through.

SMS has the problem that since you don't have a spam folder filters have to be lenient because it's more of a problem when they get a false positive.

<comment><USER29> I'm not seeing the SMS filtering market being super lively these days. There was a burst back a decade ago when Cloudmark and AdaptiveMobile were selling solutions that bolted onto the SMSC infrastructure. But that investment petered out.

I am not aware of any device side filtering, which IMHO is where it should live.

</comment></comment></comment><comment><USER31> Quick fix for SMS app creators: when you highlight a link, accent the domain part of it, just like Firefox is doing in URL bar.

</comment><comment><USER32> This is a situation where EV certificates would be helpful. The cost and the fact that it generates somewhat of a paper trail would discourage scammers from getting them.

</comment><comment><USER33> This is probably a case where MFA with a Yubikey would help. AFAIK it would choke on the invalid hostname.

<comment><USER34> The site would just say "for added security, we are requesting your backup code this time."

<comment><USER35> That may be true, but it's an added opportunity to notice something is wrong. If and when people are used to U2F/Webauthn security, it'll feel very wrong to have to manually enter a code.

Although routing information isn't protected either way and is probably fundamentally unsafe.

</comment></comment></comment><comment><USER3> And by the way, what's with this cracked smartphone screen phenomenon?

<comment><USER36> Nothing. Smartphones are still very fragile. Eventually, pretty much everyone will crack their screen. Because usually the phone is perfectly usable with cracked glass, and because most smartphone designs are user-hostile, repairing the damage ranges from not economical to not possible in practice - so you see a lot of regular people walking around with cracked phones.

<comment><USER37> I've abused every single iPhone since the first one, only recently in the last couple of years putting a case on because they are too slippery now. Never had a single cracked screen, even dropping on pavement. You have to be quite unlucky to hit things just right.

<comment><USER38> Likewise here with a Samsung Galaxy S that lasted 8 years, without a case or cover. Plenty of dropping on all sorts of hard surfaces, no cracked screen. Some of the finish started smudging off on the back though. I have no idea what people are doing to cause such damage.

(Only ended up replacing that phone because it started just not picking up calls and texts for days at a time)

<comment><USER36> Well, my friend's S7 cracked itself overnight. My S4 cracked twice due to dropping it on the floor, both times I had the screen replacement. My current S7 fell frequently, but is still mostly intact. As far as I can tell, everyone in my immediate family cracked their smartphone at least once over past few years.

Beyond dropping, as far as I can tell, there are two other common causes of screen breakage. One, sitting on it (a lot of people carry their phones in their back pockets, which is something I cannot understand; beyond accidents, this makes them vulnerable to pickpocketing). Two, women sometimes crush their phones in their purses (especially when they are in hard covers that act as levers when an item gets between it and the cover).

</comment></comment></comment></comment></comment><comment><USER39> > Luckily, she's not with EE - because it's a pretty convincing text.

Not it's not. billing-jan-2020.info looks suspicious as hell. Recognizing domain names from url is very 101 Internet security.

<comment><AUTHOR> I suggest you go and talk to people outside your normal tech bubble. Recognising which parts of a URl mean what is tricky for most people.

Here's some examples I've collected of people clicking on links in suspicious texts:

[https://twitter.com/edent/status/1193147685370552322](https://twitter.com/edent/status/1193147685370552322) [https://twitter.com/edent/status/780317797855395841](https://twitter.com/edent/status/780317797855395841)

<comment><USER40> Just because it happens doesn't mean there's something wrong with the technology. This is the real-life equivalent of walking into a shop that's branded "AyeAye" when paying your "EE" bill.

There is nothing being exploited here like a display bug in the URL bar, TLS vulnerability, etc - it is completely obvious that you are not connecting to EE.co.uk and instead to some weird domain.

There's only so much we can do to fix stupid and natural selection (or in this case financial selection) can take care of the rest. Banks refunding every instance of fraud (even when the user is obviously at fault and failed for an obvious scam) don't help either as it means people still don't understand the importance of being vigilant and actually taking the time to learn some basics in order not to fall for these very obvious scams.

<comment><USER41> >Just because it happens doesn't mean there's something wrong with the technology. This is the real-life equivalent of walking into a shop that's branded "AyeAye" when paying your "EE" bill.

I would guess that if this scam was performed over snail mail it would have vastly higher success rates than SMS spam.

</comment></comment></comment></comment><comment><USER34> More interesting than these obvious scams are when your phone company sends you legitimate texts that look like scams. I got what I thought was something super scammy from Verizon and did a lot of investigation and eventually found out that it was them.

The TLDR is that apparently they send all their marketing texts from "+90 (007) 000 38 64". You can opt out on their website and now I don't get these anymore. It's nice. But sad that my $120 a month isn't enough money for them, and they have to text me at 3AM to get me to buy a new phone. (And sell my browsing data.)

</comment><comment><USER3> so what do you propose / want?

<comment><USER42> I think the article covers that in detail:

> Is there any way to stop this? No, not really. [...] There are no technical > gatekeepers to keep us safe. We have to rely on our own wits

He is pointing out that this a danger to be aware of, and that the only thing we can do is be careful not to fall for it

<comment><USER3> Yes, but that's obvious.

</comment></comment></comment><comment><USER23> I actually don't see how the date in the domain name is integral to this scam? Maybe someone can clarify it for me.

<comment><USER43> It is supposed to look like the path. It is supposed to look like [https://ee](https://ee)[.]co[.]uk/billing-jan-02.info

<comment><USER23> Is this what the URls look like normally? (not from UK so I would not know)

Why not just [https://ee.co.uk.billing.info/jan-02](https://ee.co.uk.billing.info/jan-02) ? I mean if someone does not notice it is a domain name and not path would they really notice where the info part is?

<comment><USER44> In addition to the sibling comments, there's also the problem of having an actual slash in your example, which may cause the mark to notice it and therefore notice the "missing" slash after the 'co.uk' part.

</comment></comment></comment></comment><comment><USER45> _If you 're stood up on a crowded train, with your phone screen cracked, would you notice that a . is where a / should be?_

If you do your payments in a crowded train while standing and using an outdated, broken Android phone, you're a dumbass who deserves to get ripped off.

</comment><comment><USER46> Domains are one area where I support more regulation. It should be harder to buy a domain in my opinion. Right now, it is way too easy. I am not even talking about domain hoarders.

The price can remain the same but whenever someone wants to purchase a domain, they need to go through an additional audit of some sort. Add more entry to barrier. Legit folks will be a little inconvenienced but it will help weed out the scammers a bit more. Yes I know dedicated scammers will still bypass at times but it will surely deter them. Thoughts ?

<comment><USER47> What would you audit to prevent scammers?

<comment><USER46> Haven't thought that far but I really think we need more controls over domain purchases.

</comment></comment></comment><comment><USER48> >It starts with [https://](https://) \- that means it's secure, right? Is .info even recognisable as Top Level Domain?

It's not his wife, it's him who needs to be protected.

<comment><USER43> He is speaking in the voice of a less tech savvy user to help the reader understand how this attack my fool people.</comment></comment>


NYC Space/Time Directory - <AUTHOR> http://spacetime.nypl.org/ <comment><USER2> So for anyone interested in this, I did my PhD thesis in computer vision on automatically reconstructing 3D models of cities as they change over time purely from historical and modern photos -- you can see my results for lower Manhattan (1928-2010) in these slides from CVPR 2010: [http://www.cc.gatech.edu/~phlosoft/files/schindler10cvpr_sli...](http://www.cc.gatech.edu/~phlosoft/files/schindler10cvpr_slides.pdf)

We were also able to estimate the date of historical photos fairly accurately by first incorporating them into a 3D reconstruction and then reasoning about the visibility of structures in the scene.

Some videos of the time-varying 3D point cloud here: [http://www.cc.gatech.edu/~phlosoft/](http://www.cc.gatech.edu/~phlosoft/)

That page also has an interactive demo of a unified 3D model of Atlanta from 1864 to the 2000s based purely on image-based reconstruction. Here's a photo of Atlanta from the civil war (1864) with a modern skyline rendered into it by projecting the reconstructed building geometry and textures from modern photos into the recovered camera position of the civil war era photo: [http://4d-cities.cc.gatech.edu/atlanta/img/atlanta1864_2008....](http://4d-cities.cc.gatech.edu/atlanta/img/atlanta1864_2008.jpg)

<comment><USER3> Really interesting! Could you further explain how you grouped points into buildings (as shown on slide 10)? I would imagine that different sections of the city have different distance thresholds, for instance. Were they determined by hand or automatically?

<comment><USER2> The distance threshold was determined by hand on a per scene basis, and then we find connected components in the graph of neighboring 3D points, so it's a bit of a hack, but there are two important things to note. First, we can get away with an overly permissive threshold because we also require that any two grouped points are also observed at the same time in at least N images -- meaning SIFT features were detected for both 3D points in the same image (so they therefore exist at the same point in time). This filters out lots of spurious groupings. Second, this approach was inspired by super-pixels, which is an OVER-segmentation of an image into groups of pixels that are somewhat coherent -- each super-pixel probably lives on the same semantic object in the world, but they are by no means complete. Still, it's massively better than reasoning about individual pixels (or individual points).

So we err on the side of dividing single buildings up into multiple semantic objects. If our data included detailed reconstructions of the streets between each building, then the whole thing might be connected and we'd need more criteria to separate them out -- we do automatically estimate a ground plane so that's one way: just ignore everything near the ground for grouping purposes.

There's slightly more detail in the paper: [http://www.cc.gatech.edu/~phlosoft/files/schindler10cvpr.pdf](http://www.cc.gatech.edu/~phlosoft/files/schindler10cvpr.pdf)

</comment></comment></comment><comment><USER4> I find this fascinating, and I think it's a great reminder of what public institutions are capable of, especially since they are oftentimes the sole stewards of these sorts of information.

Aside: I am really interested in contributing to these sorts of efforts, except, ideally, at a level higher than a mechanical turk. [0] Might anyone be able to suggest self-directed learning resources (Coursera courses, ebooks, websites, open source projects, etc.) in the realm of geographically-oriented web development or the latest in geographic/GIS data wrangling? Any suggestions for languages to learn or frameworks to become familiar with? Thanks.

[0] [http://buildinginspector.nypl.org/](http://buildinginspector.nypl.org/)

<comment><USER5> One thing to keep in mind is that they recently won the Knight Foundation prototype fund grant. These public institutions are only capable of these amazing projects, when they are funded.

</comment></comment><comment><USER6> Many (many) years ago I was briefly involved in this: [http://sydney.edu.au/arts/timemap/](http://sydney.edu.au/arts/timemap/)

It was a larger scale, lower resolution version of this. The PoC demo was to demonstrate the borders of the Mongol empire over time. It was, as far as I can tell, a few years ahead of it's time in 1997(ish).

It was also the first time I got to use a proper SGI workstation. Damn, those things could make every other computer you used feel like a Jalopy.

EDIT: This has since been bundled into the "Heurist" project: [http://heuristnetwork.org/](http://heuristnetwork.org/)

</comment><comment><USER7> I always wondered if you could from the ground up visualize, delineate, and track ethnic neighborhoods in NYC without human input. All of the historic naturalization documents and ship manifests have been digitized and OCR'd now and include country of origin and nationality. By tracking the addresses from naturalization and census forms, a computer should be able to build a really accurate map of how neighborhoods changed and shifted from the 19th century through the early 20th up until the data becomes private.

For example, everyone in NYC knows that "Little Italy" is really a shadow of its former self and is mostly "Chinatown" now. If all the data was processed, you could visualize changes like that on a map over time and increase accuracy by adding more data sets (e.g. business directories, also in City archives).</comment>