MacOS Update Accidentally Undoes Apple's "root" Bug Patch - <AUTHOR> https://www.wired.com/story/macos-update-undoes-apple-root-bug-patch/ <comment><USER3> I feel weird reading comments here ranging from excusing the developer to blaming him, for its lack of unit testing or anything. Let's make this clear : management fcked up badly. Human process. Not code, not unit testing, not a single line of code is responsible. And you know why ? Because when you've had the greatest security failure in a decade publicly shaming your company and your team, you _personaly make sure it doesn't happen again in the next release_.

And it's not just one manager. The whole management is screwed, it's a disaster. I think now is really time to say : would you imagine this happening under steve jobs ?

<comment><USER4> _> Because when you've had the greatest security failure in a decade_

It's nowhere close to the greatest security failure in a decade. It's not even a contender in the far off distance. It's a well publicized vulnerability, and it's quite silly, but in the scheme of things it's just a Tuesday for CVE writers. We even had a vulnerability functionally identical to this, and similar in both severity and silliness, hit Linux within the past year.

If you're talking about Apple specifically, it's still not that bad. The vulnerability couldn't be arbitrarily executed remotely with default OS settings, and it didn't grant kernel access. The Trident flaws were significantly worse than this, and that's just the first that comes to mind.

Yes, yes, I know this wasn't the thrust of your point...but still. People get kind of hyperbolic when it comes to rating security vulnerabilities. It's more silly than it is severe. I expect at least one vulnerability of comparable impact on every major point release of every major operating system and web browser (not that this is a good thing, but it's logistically realistic). I don't think this is particularly bad for Apple's public image or reputation. Headlines about "the sky is falling!" vulnerabilities make the rounds every so often; for better or worse, it never really seems to stick in public consciousness.

<comment><USER3> because it doesn't provide remote access, you're right. But it's been released publicly before there was a patch available, on an OS that's only used as a personal computer, not as a server. And is immediately exploitable by just anyone, with 0 technical background. I think that makes it a very big deal, no matter what CVE usually use for a scale. I also don't remember any macOS security breach getting that much publicity.

<comment><USER4> I agree it's a big deal, in that it's serious - it's a security vulnerability after all, yes. But I disagree about its significance for Apple in the face of the sheer number of security advisories that come out across iOS and macOS each year. When we broaden perspective away from just Apple, this becomes absolutely miniscule. There's a lot of navel gazing going on, but there's not a lot of reason to read anything particular out of this at all.

It's very silly, and I would also be embarrassed if I was involved in it, but those aren't good metrics for judging the realistic frequency of bugs like this, nor their severity. I've had vulnerabilities I've reported picked up by a bunch of news media before even though they weren't that serious. As it turns out, the media just latches on to security headlines, and everyone sort of forgets about it except us grumblers on Hacker News, because we Never Forget.

Someone from Google Project Zero has probably been inspired to start fuzzing the macOS at the UI level now, and that's a good thing - they should. But that's about all I'm taking away from this story.

Moreover:

 _> on an OS that's only used as a personal computer, not as a server_

This makes it less severe, not more so. I'd rather have a Heartbleed impacting nearly every server on the internet than a...whatever we're calling this, impacting every macOS computer in the world. I guess I can make a botnet...except I still have to be local to it in the majority of cases, or do specific targeting, or chain this with another piece of popular, compromised software, etc. It suddenly becomes a bit more complex than just someone pressing enter on a root prompt twice. Plus, if the vulnerability is laughably silly, it's usually easier to find than a chain of them that evidences a systemic misconfiguration in the entire OS.

In fact, I'd posit that the reason this story is getting so much attention is precisely because the vulnerability is so easy to understand, and because someone disclosed it on Twitter. Frankly, the whole situation is really quite funny in a black comedy sort of way. But while it's fun to write stories poking fun at large companies for their silly mistakes, it doesn't meaningfully reflect their security competency or the long term perception of their security competency.

Really I don't mean to trivialize it. It's not a good look, and definitely it's worthy of being patched. But I think it's worth looking at from a much broader perspective.

<comment><USER5> _> > on an OS that's only used as a personal computer, not as a server_

 _> This makes it less severe, not more so._

You are looking at it from the perspective of a seasoned security professional. It's like looking at the terrorist attack in Nice from a military point of view and saying "eh, this was just a guy on a lorry; it's much more difficult to raid Osama in the middle of Pakistan". That might well be, but this does not matter to the general public - to them, concepts like "botnets" are immaterial, whereas Slippin' Jimmy entering their macbooks to read their emails while they're sleeping is _very_ real.

In that sense, the impact here was bigger than any other security hole ever experienced on the Mac.

<comment><USER6> I don't really think your analogy is all that apt, but anyway, it just serve's to reinforce dsacco's point: there may have been a lot of fuss over this, but in terms of actual impact, this was negligible.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> I've been struggling for a long time to convince some of my less technical friends that keeping all of the software on their devices up to date is an important best practice from a security perspective. I'm afraid that the recent muck ups in High Sierra and iOS 11 are going to make sure that some of them never listen to me ever again.

<comment><USER7> I have a hard time believing that your less technical friends are even following Apple news. The average person that walks into an Apple store and buys a Mac probably has no idea about the original vulnerability, let alone the multiple patches for it.

<comment> et-al The average person that updated their iOS to 11 during the first two weeks has definitely noticed how bug-ridden it is with power issues, 3D touch issues, and the autocorrect bug.

We've trained people to update ASAP for security reasons, but when Apple drops the ball and seriously fucks up iOS 11 for a month until 11.1.1 was released, this will keep users update-shy.

I hope 2018 emphasises rock-solid releases for both macOS & iOS. Or Apple should move to a two-year release cycle (wishful thinking).

<comment><USER8> There is still unfixed IOS 11 introduced bug [1] that kills notification screen which requires powercycle to fix. Some users hit it multiple times a day.

[1] [https://discussions.apple.com/message/32638979?ac_cid=tw1234...](https://discussions.apple.com/message/32638979?ac_cid=tw123456#32638979)

</comment></comment></comment></comment><comment><USER9> Generally I've noticed more bugs on High Sierra than on previous OSX releases. Things ranging from UI glitches to freezing safari to random slowdowns - <USER2> across multiple different machines.

Coupled with the security issues it's clear that whoever is responsible for Q&A these days is asleep at the wheel.

It's the reliability of the hardware and software that brought me to Apple back in the days of the G4.

Ironic that I may have to switch back to Windows since my work machine seems less buggier than my Mac!

<comment><USER10> Win 10 has its fair share of bugs, tbf. In fact win 10 feels like a Google product that never leaves beta. There will always be glitches and weird stuff. Some things have become very good over several iterations. But there are a ton of new stuff they keep adding and all of those are half baked until the next big release.

<comment><USER11> The worst thing about Windows 10 is there's a mandatory, automatic OS upgrade every few months, which Microsoft pretend is simply an update. This can and will break things every single time.

<comment><USER10> That's actually something I like. It makes most users' PCs much more secure. Also if absolutely required, OS upgrades can be deferred by up to a year.

</comment></comment></comment></comment><comment><USER12> As serious as this is, it kind of makes me feel humbled in a way knowing I've been through these exact situations and it happens to Apple too.

<comment><USER13> >As serious as this is

... So, not at all? It's a LPE for gods sake. EDIT: Apparently it affects remote desktop too, so not just a LPE.

Can this even be exploited from within the sandbox?

<comment><USER14> Not just local. VNC and other remote protocols are vulnerable.

<comment><USER13> Ah, that's far more interesting. Do you know if SSH is affected?

<comment><USER15> SSH is not affected.

</comment></comment></comment></comment></comment><comment><USER16> Summary: the root bug reappears when you upgrade your Mac. You need to manually reinstall Apple's security patch _and_ reboot. There's no warning that a reboot is necessary.

<comment><USER17> Huh, and how do I reinstall the patch? Can't find a downloading link and app store doesn't let me do anything with the update

Funny thing is that on the update site section steps in `To confirm that your Mac has Security Update 2017-001` confirm that I have the update, but am still vulnerable to the issue.

Do I understand correctly that setting root password is also valid workaround for the issue?

</comment></comment><comment><USER18> Would a problem with something as fundamental as this happen with an open source UNIX-like distribution and fail to be discovered or adequately fixed?

Would anyone feel compelled to _apologize_ for mentioning a mistake by an open source project on Twitter?

The gentleman who tweeted about Apple's mistake actually apologized for it on Medium. Crazy.

[https://medium.com/@lemiorhan/the-story-behind-anyone-can- lo...](https://medium.com/@lemiorhan/the-story-behind-anyone-can-login-as- root-tweet-33731b5ded71?source=user_profile</comment><comment>---1</comment><comment></comment><comment>----)

Apple can claim it is "certified" as UNIX(TM). And publish the source for userland code it copied from open source projects.

Microsoft is trying again to subsume "UNIX" into Windows allowing users to run Linux binaries without running a Linux kernel.

But neither is a substitute for the original open source UNIX-like projects.

This blunder by Apple proves that even the wealthiest company on Earth does not necessarily produce better "UNIX" than a group of unpaid volunteers. At least if the user cares about the basics.

<comment><USER19> > The gentleman who tweeted about Apple's mistake actually apologized for it > on Medium

I read his statement but I don't see an apology there. It's a reply to people who are saying he should've practiced responsible disclosure.

</comment></comment><comment><USER20> I am still confused. I was prompted again today to install the security update I installed yesterday. Did they silently release another improved security update?

<comment><USER21> Yeah, the day after they put out the initial update (17B1002), they put out a second update (17B1003) that fixed the file sharing issue caused by the first one.

</comment></comment><comment><USER22> sounds like a typical extra-super-hyper-important-emergency effort under the constant gaze from the very top through the thick E/S/VP/etc. layers of CYA mediocrity eager to report up the successful completion of a glorious effort to the glorious leader in a typical BigCo where engineering culture is faltering while nobody who matters cares (or even able to care) Well, at least it was that way back at Sun :) ... Or may be it was just a one bad day at Apple. Though many people like to argue that engineering culture is exactly to prevent the "bad" days from happening...

<comment><USER23> Yup. That paired with what appears to be the lack of a decent test process.

Maybe 2018 is the year of the Linux desktop? ... one can dream...

<comment><USER24> Linux desktop user here, I'm pretty happy so far to end 2017.

[https://i.imgur.com/yG3ep3M.jpg](https://i.imgur.com/yG3ep3M.jpg)

<comment><USER25> Huh, they made GNOME look _good_ , I'm mildly surprised to admit. Not bad.

I have to admit that for a second there I thought you were running Bash on Windows and the terminal was going through an X server. Ha

<comment> vladimir-y There are many Linux distros these days with graphical installers, that look great out of the box, etc.

</comment></comment></comment></comment></comment><comment><USER26> Looks like someone screwed up their cherry-pick

</comment><comment><USER27> It appears the problem is that the fixes included in the security updated were not backported to 10.13.1 which caused a problem for users coming from 10.13.0 that had done the security update. Certainly a huge issue, but many commenters seem to misunderstand the article.

</comment><comment><USER28> Everybody can have a bug. Even a bad one. In fact, virtually every system _does_ have a doozy now and then. But recently with Apple it looks like they are serving them constantly lately. Shame for this to happen to the company that once could be pointed at as an example of somebody who gets how to make a professional Unix-based desktop.

</comment><comment><USER29> This is turning into a comedy of errors. They don't add regression tests to their test suite? I'm a bit shocked that they're having so much trouble releasing a patch properly.

</comment><comment><USER30> Wow, so now they have this massive security bug, screwed up file sharing when they fixed it, and now are apparently inadvertently rolling back the fix to the initial massive security bug.

</comment><comment><USER31> Classic "rushing to fix problem causing more problems" programmer error

<comment><USER32> Now is better than never. Although never is often better than _right_ now.

<comment><USER33> Prescription: additional sleep for security team, and non-negotiable vulnerability regression tests for all releases.

</comment></comment></comment><comment><USER34> With all the pressure to produce novelty gimmicks, it's a little unsurprising :/ and unfortunate, I'm a huge fan of osx. It's nice to have a commercially supported unix system that also has a decent UI.

</comment><comment><USER35> Not a good week for Apple. They were doing pretty good reputation wise when it concerned security so far but this whole saga has been less than stellar. Amazing that regression testing didn't catch this.

<comment><USER36> There was no regression testing.

</comment></comment><comment><USER37> Not regretting my decision to always be one major release behind. At this point, I simply don't trust Apple enough to install updates without breaking my system and interrupting my work.

</comment><comment><USER38> For something as serious as the initial bug (especially given it was all over the press) there should have been regression tests for this.

Either deployment was broken, the tests were broken, there weren't tests, or multiple of the above :\ anyway I'm hypothesizing but would love to see a post-mortem on this. How does a generally reliable company like Apple screw this up twice?

</comment><comment><USER39> Does Apple not require engineers to write regression tests? I really hope there is a blog post or press release explaining what happened.

<comment><USER40> lol, don't hold your breath.

</comment></comment><comment><USER41> Apple's security team is nailing this.

</comment><comment><USER42> [http://www.iphonehacks.com/2017/12/macos-10-13-2-beta-6-root...](http://www.iphonehacks.com/2017/12/macos-10-13-2-beta-6-root- security-patch.html)

</comment><comment><USER43> Queue obligatory 'this wouldn't have happened under Jobs' posts.

<comment><USER44> Well, it would only have happened once, that's for damned sure.

</comment></comment><comment><USER45> They're playing Whac-a-mole

<comment><USER22> Mac-a-mole

</comment></comment><comment><USER40> So my previous comment about how if Apple was smart they'd have a unit test for this seems to be confirmed. Apple is not smart. RIP.

</comment><comment><USER46> It happens. Most people don't care anyway. They will continue buying and stock price will continue rising. ;)

</comment><comment><USER47> Who remembers the System 7 Update 1.1.1?

<comment><USER48> I do.

Heck, I was responsible for the first crashing bug found in System 7.0. It was found about six hours after GM images were released to manufacturing. It was a crashing bug. _It was remotely exploitable._ It was one freakin' register, for cryin' in your cornflakes.

<comment><USER49> How it was remotely exploitable?

</comment></comment></comment><comment><USER50> I've not seen this mentioned anywhere but Apple installed the security update without my permission which made me feel both sad and unsurprised that they have effectively back doors that can run code on _my_ machine with impunity.

Will try for a Linux dev machine next time I think.

</comment><comment> vladimir-y Apple pushes those who have not yet moved to Linux to do so?

</comment><comment><USER51> The saga continues

</comment><comment><USER52> One hesitates to comment on this sequence of events because it speaks for itself. But here is a stupid user opinion (mine):

I believe users place too much trust in corporations such as Apple, Google or Microsoft to protect them. There is too much debate over which company to choose ("I like ___________'s approach to security") instead of questioning whether delegating security to _any_ of them is truly the wisest course of action.

I hope that this incident causes at least one user to question whether users might benefit from adopting a less trusting and more vigilant approach to protecting their data.

And by "vigilant" I do not mean "choosing the right tech companies to trust", diligently installing updates from these corporations and feeling self- satisfied.

I mean _questioning the status quo_ and thinking seriously about the benefits of free, open source operating systems that are potentially reviewable by millions of developers and users. Systems that can be modified, compiled and installed easily by anyone, not only by small groups of people in corporations with special knowledge. Systems that can, e.g., permit and maybe encourage "safer", more conservative usage patterns.

Under the prevailing laws, I believe this pool of open source developers and users will always contain a larger number of people who care more about protecting user data than any groups within the above companies. It is a matter of self-interest.

Apple is a company with seemingly infinite resources at its disposal. But clearly in this case there were more people seriously interested in fixing this vulnerability outside of the company than within it. And as a dumb, naive user, I question anyone who would suggest that no one except a small group of people at Apple would be competent to do this work.

IMO, this mistake had nothing to do with what makes Apple valuable, namely their hardware. A UNIX-like OS running on Apple hardware does not need to be proprietary and, IMO, users have a compelling interest for software, that can expose their data and pose other security issues, to be open.

<comment><USER53> I'm always a bit skeptical of this argument as a rationale for FOSS.

Of course, publishing your source code does make it a lot easier for outsiders to audit your software, but how many people actually do? Linux might be an exception because so many organizations build drivers and distributions for it (there are always people digging through the internals and likewise, hackers/security consultants looking for opportunities), but I suspect for most open source projects (even the big ones), there are way fewer people auditing them than comments like this would lead you to believe.

How many people do you think are digging through and critically analyzing Django/Node/Rails/Docker/OpenSSL/network drivers/etc? There's a mindblowing amount of code behind any application, and as developers/users, we tend to trust strength in numbers - people are using it, so it must be fine. But in practice, I wonder how much the bystander effect counteracts this intuition.

<comment><USER54> >publishing your source code does make it a lot easier for outsiders to audit your software, but how many people actually do?

I would say very, very few people in the world read random source code looking for bugs. Finding hidden bugs requires active use like a QA person would do. This has probably already been done on any major FOSS software, so any remaining bugs would be unbelievably hard to find, and very unlikely by just reading source code.

I mean it sounds good as a theory, but it also sounds like, "If I publish my book online for free, lots of people on the internet will read it."

<comment><USER55> You are both right. Having the code helps the kind of testing you're talking about. Also static analysis.

<comment><USER54> >static analysis

Doesn't really change the equation though. That just allows people to _not_ read it faster using automation. :)

<comment><USER55> Sorry I ninja edited above. I see your point upon reflection - we're talking about other dimensions of open source (eg. popular and trusted), not the availability of the code.

</comment></comment></comment></comment></comment></comment><comment><USER56> Oh! Well that solves the mystery of how Apple allowed their new USB-C MBPs to be so buggy in trivial use cases.</comment>


"There's no way to win": Ellen Pao shakes up Reddit by eliminating salary - <AUTHOR> http://www.salon.com/2015/04/06/theres_no_way_to_win_ellen_pao_shakes_up_reddit_by_eliminating_salary_negotiation_in_hiring/

<comment><USER2> Congratulations to getting to middle ages. After a couple more years you could get to enlightenment.

[http://blog.stackoverflow.com/2011/07/how-much-should-you- pa...](http://blog.stackoverflow.com/2011/07/how-much-should-you-pay- developers/)

joel solved that problem brilliantly a decade or so ago.

<comment><USER3> I don't get how that's still not open to alot of negotiation by a different name

best I can tell, you're pay appears to be based on the "Be Even More Awesome Chart" (page 5 [http://blog.stackoverflow.com/wp-content/uploads/Stack- Excha...](http://blog.stackoverflow.com/wp-content/uploads/Stack-Exchange- Developer-Compensation.pdf))

who determine where exactly you stand on that chart?

seems like you're incentivized to lobby hard that you're guru level instead of just awesome level, etc etc

</comment></comment><comment><USER4> Well that's an unfortunate title truncation. For those scratching their heads but not reading the article: Pao is eliminating salary negotiations for new hires. No word on negotiation of raises though.

<comment><AUTHOR> Why do you think the policy would be any different for raises?

<comment><USER4> Every mention of the policy in this article states that it applies to the hiring process. The fact that eliminating _all_ salary negotiation would be an even bigger headline leads me to assume the reporter didn't just miss this detail.

</comment></comment></comment><comment><USER5> Does this policy hold to the C-team as well?

Now that would be revolutionary: getting your C-team and board to agree to fixed compensation.</comment>


10 Ruby tricks to improve your code (or not) - <AUTHOR> http://samurails.com/ruby/ruby-tricks-improve-code/

<comment><USER2> Point 5: using ||=

@total ||= (1..100000000).to_a.inject(:+)

How beautiful can Ruby syntax be?

</comment><comment><USER3> I'm getting a database error.

<comment><USER4> Sweet irony...

<comment><USER5> Thought the same thing.

</comment></comment></comment><comment><USER6> Good, thx</comment>


Dots don't matter in Gmail addresses - <AUTHOR> https://support.google.com/mail/answer/7436150?hl=en <comment><USER2> I have been getting financial emails from several people for many years at my GMail ID. They apparently have given my address but without the dot.

But what mystifies me is how these people keep going for years without ever realising they aren't getting account transaction emails (from their banks), notifications of stock trades, even OTP emails etc. How is it possible for people to use these services for years without ever wondering _why_ they aren't getting the routine emails they're supposed to get or even why they aren't getting the OTP email they had generated?

Also none of the institutions I contacted to ask their clients to update their correct email bothered to do so. On the contrary they sent me back what looked like automated replies asking if their customer service was satisfactory.

At this point I'm sorely tempted to delete my email and start over with another service provider. The nuisance of having to delete almost a dozen emails not meant for you every single day is annoying to say the least. At least with spam you get it sent to spam folder and there it stays. Confidential emails not meant for you is awkward and uncomfortable to have to put up with.

<comment><USER3> Been there. I posted about this before but I own a 5 character common first and last name @gmail.com address. I get misdirected emails _constantly_.

Usually I am polite about it and let people know, but sometimes I make a game of it. I was invited to participate in a drum circle with an offer to pay for my flight to which I replied that I would love to join, but they would also have to pay for drum lessons. I got a mother insisting that I come home for the weekend to which I replied that I am home, perhaps she hadn't knocked hard enough.. etc.

At one point I got like 15 emails deriding me and my choice to "not support firefighters". Turns out that a member of a city council had listed his email as councilman.<me>@gmail.com and most people just ignored everything before that period. I took it as a challenge to see what the most outlandish thing I could say was that would be believed. Some of the better attempts: "My wife had an affair with a firefighter once!" and "My house has never burned down, why do we even need these guys?".. etc.

With most of the financial emails you can unsubscribe at least. =/

<comment><USER4> Unsubscribe, man, I'm jealous.

Some dude 2,000 miles away from me has bought a Lexus and now I get regular emails about the status of his vehicle, receipts for all work done to it, and reminders of all maintenance _not_ done to it. For a year and counting.

Each email helpfully includes instructions for unsubscribing: First, you log into the Lexus app...

I finally got fed up with it and reported them to abuse@.

<comment><USER5> Well, since you have the email, you can log in to the Lexus app. Then you could turn off the notifications.

<comment><USER4> I'm not sure about this but wouldn't that be a felony?

<comment><USER6> Yes.

99.9% chance no one would care. But people do freak out over this stuff.

Knew one guy that saw that a Bank got hacked on the news. Did an nslookup or similar to check the banks site.

He was arrested the next day and expelled from college for hacking the bank.

Eventually all got cleared up, but screwed up a year of his life

<comment><USER7> He got expelled for running a DNS query?

Do you mean nmap?

<comment><USER6> Maybe. Was awhile ago

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> A coworker of mine got an email once containing important scholarship information intended for a high school kid in Florida. He did a little looking online and found the kid's and his parent's actual email addresses and forwarded the email to them.

So here's where it gets weird/dumb: the kid replies to my friend and his parents and says, "hey mom, you put the wrong email address on my application, there's no dot in mine."

So my coworker, being the only tech savvy person on the thread replies. "Well, actually, [...]" and explains how dots are(n't) handled in Gmail address. Then the parents then reply and write, "but that's your old Gmail address, we had to get you a new one when we moved to Florida."

At this point my coworker gave up and the kid presumably lost his scholarship because his family didn't know you could keep your Gmail address when you moved houses.

(If you're reading this, hi Jake H.!)

<comment><USER9> I have a common last name and my email is my first initial and my last name.

I get so much misdirected mail that I don't even try to help these people.

I hope John gets to his zoom interview for Deputy Chief of Police later today, because I'm not going to tell him about it.

<comment><USER10> Happens to me all the time, because my name is fairly common. Weird that Google wont "fix" that.

<comment><USER11> Out of curiosity, what would a "fix" look like?

<comment><USER12> Never showing the email address to anyone, just letting you scan a QR code, or copy-paste a rich-text non-editable widget and passing it around. It is the same idea as not showing the URL in the address bar, it solves 1 major problem and raises dozen others.

</comment></comment></comment></comment></comment><comment><USER13> Everyone in this thread is replying with instances of receiving emails meant for other people, but dots have nothing to do with that. It's people typing in the wrong email address in a signup page (with dots or without), and the service not verifying it. The latter is what really needs to be fixed.

I personally find this Gmail feature (as well as the ability to append +anything to your email address) extremely useful.

<comment><USER14> In my experience, it's mostly the situations where people give their emails in person that are a problem: Receipts from in-store purchases (and in-store credit card signups), hotel reservations and rewards programs, EMR signups, lawyers offices, banks, realtors, etc.

Websites are pretty good at verifying email addresses these days. The real world, not so much. The super funny part is when you try to ask the bank/doctor/etc. to stop sending someone else's personal info to your email address, and they tell you they can't make that change since you aren't the account owner.

</comment></comment><comment><USER15> I think that companies' failure to verify their users' email addresses during signup is a serious problem that goes beyond any dot confusion.

When John Smith signs up for an account using firstname.lastname@example.com (or email@example.com), and the company trusts John Smith to have provided the email address accurately, three parties are affected: Both John Smiths and the company itself. Yes, verifying email address creates a bit more signup friction, but the consequences of getting it wrong way outweigh that friction for the privacy risk and confusion it causes (unless all the company cares about is a meaningless sign-up metric).

<comment><USER16> Amazon has been sending me someone else's order details for about a year now. It's crazy to me for multiple reasons:

1\. They send this information (order details, name, address, tracking numbers, receipt) without requiring a confirmation email. In fact, in their system the email on the other guy's account is labeled "unverified".

2\. The emails contain no way to stop future emails. There's no "unsubscribe", "this is not me", "contact us", etc. Every link is to an Amazon page which expects the user to be logged in to the correct account.

3\. The system does not sufficiently lock old accounts when the account email is reused. One suggestion from Amazon was to create a new account using my email, which should lock the other account. This did not happen, so now there are two accounts able to send Amazon emails to me with no way to tell them apart.

4\. The Amazon website doesn't verify the user's account before displaying order details. If I click on a link from the other person's order return (or other types of links), Amazon opens up to my account but displays information from their order. It's confusing to see someone else's "refund status" alongside my account name on the official Amazon.com site.

5\. Getting this fixed is a pain in the ass. I call, they say they'll fix it. I call, they suggest something else. I call, they escalate, try something else again. I chat, can't be handled over chat, they call me, try another thing. I'm not sure why they won't remove the email from his account or contact him and ask him to remove it.

</comment></comment><comment><USER17> This is indeed the case. I have checked it myself. The link below shows how this can be used maliciously.

[https://jameshfisher.com/2018/04/07/the-dots-do-matter- how-t...](https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam- a-gmail-user/)

I do not know if this has been mitigated.

<comment><USER18> James is wrong, this is Netflix's fault. The same "scam" would work under a variety of circumstances because Netflix relies on something it has no reason to believe is true. Maybe you signed up to Netflix but your house mate thinks she did, she gets an email because of Eve, now you're both paying for Netflix, but actually she's paying for Eve's account.

Netflix could make this mistake with postal addresses even, if for some reason they used postal addresses. You get a letter from Netflix, you don't notice it's addressed to Eve, who had stupidly written your address instead of hers, you pay for her Netflix.

This is a data protection violation, data processors have a duty to take reasonable care that the personal information they have about data subjects is correct. If you need it, make sure it's accurate. If you don't need it, don't collect it.

<comment><USER19> This is actually Google's fault. Because Google is large enough Netflix could be nice and have special handling for Gmail addresses but this would be going against the email RFC that says $inbox1+$subaddr@domain == $inbox2+$subaddr@domain iff $inbox1 and $inbox2 are _identical_.

Netflix has zero idea how any particular email operator mangles or maps inboxes to actual users. Apple's private email service maps all sorts of inboxes to the same actual person. Mailinator maps every address to everyone.

<comment><USER20> This is Netflix's fault for not verifying email addresses before taking payment details for a recurring subscription.

<comment><USER19> True, Netflix should have verified that the person signing up could actually receive an email at the address they gave.

But _in addition_ Netflix is right to allow the creation of two accounts where the difference is only dots.

</comment></comment></comment></comment></comment><comment><USER21> Dots does matter in GSuite's email addresses (those are the email addresses for enterprise via work or school.)

Also in the email name part of the email address, anything after + (plug sign) and before the @ (at sign) don't matter either. [1] This is the same behavior for personal Gmail and GSuite email (Gmail for enterprises)

[1]: [https://gizmodo.com/how-to-use-the-infinite-number-of- email-...](https://gizmodo.com/how-to-use-the-infinite-number-of-email- addresses-gmail-1609458192)

<comment><USER22> It definitely is. For example I get a lot of emails sent to me+ni@mydomian for "Not Important" which I use kind of like an RSS reader. They never appear in my inbox and I catch up on them every once and a while.

You can do this for a wide variety of things and combine it with filters to get a lot of extra value from your email.

</comment></comment><comment><USER23> Not only do dots not matter, you can suffix "+<anything>" to your user name before the "@gmail.com" and it will still come to your email address. I actually love this "+" feature and use it a lot .. like send an email to "+firstname.lastname@example.com" to bookmark a link, or register with "+nospam" and setup a filter for that address if anyone sends me email on that.

This is supported by icloud and fastmail too.

<comment><USER24> Also a good check if the site has some sloppy implementation. More than once have I seen that my "+" email was not accepted because of invalid characters. I take this as a sign to not trust the site's security too.

<comment><USER25> If I were a site accepting email addresses, I could see rejecting "+" stuff because chances are it's people trying to pull something funny like registering multiple accounts when I only want one per email address. If I were less confrontational I might just silently strip the "+" part.

<comment><USER26> Sites that do any of that stuff are infuriating. Great if that's what you're going for.

<comment><USER25> My understanding is that it's okay to be infuriating if I have an analytics query or something claiming that it'll not affect 99ish % of users and also save customer support a bunch of work.

</comment></comment></comment></comment></comment><comment><USER27> Got a guy with my same first name and surname.

Been getting his bank statements, his amazon orders, class emails, share purchases/sales.

Its a joke.

Edit: been happening for around 5 years.

Its also entertaining at the same time to see what he's doing on another continent. I'm torn, dammit Google!

<comment><USER28> I have this problem, except it's a whole nation (seemingly) of people due to how common my last name is in a specific country.

My address is [first initial][last name]@gmail so anyone with a first name that starts with the same letter as mine and the same last name (which, there are SO MANY).

I get;

job offers family photos (I typically respond letting these people know they're not getting through to whoever they're intending) verizon bills (I'm also a verizon customer and they absolutely refuse to take my email off of the other two accounts - I've also texted both accounts since they're numbers have come through various times in the correspondences and they don't even acknowledge my communication let alone update their accounts - they're always late on their payments, but have the newest iPhone's all the time :D) purchase receipts from so many retailers I don't keep track (some of these people have real silly amounts of money) auto purchase receipts bank emails lease offers (just today I had to respond to a leasing agent who was trying to let someone know they got a place they were trying to rent in NYC for crazy money)

It's mind blowing to me how many people get their email address wrong and miss so many important emails, seemingly without ever realizing it.

</comment></comment><comment><USER29> There is also the alias of googlemail.com on the domain level... Always a cause of big headaches.

      email@example.com
      firstname.lastname@example.com
      firstname.lastname@example.com
      email@example.com

all are pointing to the same logical email address.

<comment><USER30> The email you see in my profile is backed by a Gmail account, but I doubt you would know that if I didn't tell you. Hopefully I haven't made your headache worse ;)

<comment><USER31> You can see that it's backed by gmail by looking at the MX records.

[https://www.whatsmydns.net/#MX/saagarjha.com](https://www.whatsmydns.net/#MX/saagarjha.com)

</comment></comment></comment><comment><USER32> My email is firstlast I use first.last for subscriptions I am unsure I want to keep. I can then filter out based on to address and also use diff combinations when I already know I don't want them contacting me (firs.tlast) for example

<comment><USER33> If you use the + character (e.g. `firstlast+subscriptions`) it'll still arrive to your `firstlast` inbox, but will allow you to filter it more meaningfully.

<comment><USER34> I've been using this trick for a while (usually 'firstlast+per_service_identifier') and I've encountered more than a few systems which erroneously claim that any email address containing a '+' is invalid.

<comment><USER35> That's why I now own my domain, and added the first([\\.-]suffix)?@last.tld -> firstname.lastname@example.com mapping at my provider.

For selfhosting, there's `recipient_delimiter = +-.` in postfix' config. [0]

The most infuriating ones are those where you can subscribe with the '+', but the unsubscribe function errors on it.

[0] [https://try.popho.be/email.html](https://try.popho.be/email.html)

<comment><USER36> Also in many cases I am allowed to proceed with the +, but never receive confirmation emails because the sending system chokes.

</comment></comment></comment></comment></comment><comment><USER37> Dots do matter in G Suite email addresses, and that can be quite confusing for people that know this trick.

</comment><comment><USER38> This is the source of a low-impact but still interesting scam: Scammer signs up for netflix free trial with "your" email (but it's really some _new_ combination with different dots). Scammer runs out the free trial. YOU get an email saying "gotta pay for netflix." You're confused but chalk it up to some computer glitch somewhere and click the link to log in. Your password isn't taking but that's fine you just reset it. Finally, you're logged in, and you plug in your credit card and everything seems fine. You maybe don't even notice the _two_ charges on your next credit card bill.

Yes, it's definitely convenient that you can have "multiple" email addresses that all point to the same inbox, but the issue is that identity providers don't treat them as all the same logical email address which creates opportunities for scams like these or worse.

</comment><comment><USER39> 90% of the spam I get when I occasionally review it has dropped the dot in some silly effort to canonicalize my address, so yeah, the dot matters, as I filter the non-dotted address.

<comment><USER40> Same here. The "no dot goes to trash" rule catches an awful lot of spam.

</comment></comment><comment><USER41> Someone registered for Facebook with firstname.lastname@example.com. I'd registered with email@example.com and when I got the email that I'd added the account I clicked yes before reading (that's a mistake you make at most once) and now that guy has a Facebook account I can't log in to and I can't remove this email from the account and I can't remove the notifications either.

Part of the reason is that Facebook verifies you're the owner of the email if you say "someone else has my email" by sending you an email which you have to reply to. But Google will reply to all of them with the canonical sign-up so mine has firstname.lastname@example.com that the reply goes out with, which doesn't match so I'm stuck marking all Facebook notifications as spam.

<comment><USER42> In gmail, open the settings, go to "Accounts", add an address to "Send mail as ..." then you can send mail with as many dots as you like.

<comment><USER41> Could have sworn I tried this. Let me give it another shot! Thank you!

EDIT: Interesting, they no longer send me that email. Probably got flagged.

</comment></comment></comment><comment><USER43> I used to have a dot in my gmail address then I started receiving messages to my address without the dot. The messages were from people I didn't know to people I didn't know. I thought there was something wrong and I was receiving other peoples messages.

And this is where it gets weird... I was.

Just not because of the dot. My gmail handle is pretty short, 6 chars. First name last initial, pretty cool. I got it during the early in the first beta year, (gmail was beta for like 10 years.) However 10 years later I'm now receiving emails in german, parking tickets from cities I've never been, paid subscriptions, access to gmail and facebook accounts because people set my gmail handle as their recovery address. I can even unlock a guys car from the manufacturers web UI whom I've never met. The best/worst by far is the time the FBI reached out to me, which I thought was some bad phishing attempt and replied mildly taunting them. However, it was in fact a real FBI agent who wrote back noticeably annoyed at my flippant response. There was a vailed threat that if I don't take this seriously things would happen. A lump formed in my throat. I called them and for 5 minutes it was kind of scary. I found out a doctor had been using my email handle for oxytocin prescriptions and they were investigating this doctor... I explained that I had received other messages for this doctor and approximated his age and name, explained my short desirable email address, at which point the agent broke their stern professional tone and we shared a little chuckle.

</comment><comment><USER44> I love the way most services treat dotted addresses as separate addresses. So for example if you wanted multiple accounts on $service you could register the following:

        firstname.lastname@example.com
        email@example.com
        email@example.com
        firstname.lastname@example.com
        firstname.lastname@example.com
        email@example.com

And now you have six accounts, with the bonus of receiving mail in the same inbox for each account!

<comment><USER45> You can also use @googlemail.com domain name instead of @gmail.com to double the number of email addresses.

<comment><USER44> Yes, you could do even more shenanigans registering with the following:

        email@example.com
        firstname.lastname@example.com
        email@example.com
        firstname.lastname@example.com
        email@example.com
        firstname.lastname@example.com

        john.doe+uniquestring@@googlemail.com
        j.ohndoe+uniquestring@@googlemail.com
        jo.hndoe+uniquestring@@googlemail.com
        joh.ndoe+uniquestring@@googlemail.com
        johnd.oe+uniquestring@@googlemail.com
        johndo.e+uniquestring@@googlemail.com

<comment><USER44> Oops there's a mistake there; there's supposed to be just one `@` symbol!

</comment></comment></comment></comment><comment><USER46> I was blocked from my gmail account for attempting to log in without the dot. My address is firstname.lastname@gmail. Had it for years. When I learned that dots don't matter I tried to log in without the dot and was immediately blocked for suspicious behavior. Luckily it wasn't used for anything important. Few months later the block was removed. Never tried to play with the dots again since.

</comment><comment><USER47> The obvious address of <my common name>.<my very common surname>@gmail.com was still available a couple of years after Gmail was introduced, and I rushed to register it despite already getting _a little_ unintended email on other predictable free mail addresses.

I couldn't anticipate the density of misplaced email (allowing me to link multiple parties to the same idiot), the personal insistence of some people (come on, it's me! Your friend —! What do you mean by "I don't know you"?), the ready-made drama (in varied roles: vanished boyfriend, investor in shady businesses, councilman, delinquent debtor...), the quality of delicate misplaced information (with medical records and resumes topping the more obvious invoices, home addresses and bank letters) and the variety of accounts (including e.g. Spotify and a couple of dating sites).

Over the years, I've noticed a slight decrease in incorrect addresses entered by human beings matched by an increase of automated emails to incorrectly registered accounts.

</comment><comment><USER48> When I got out from college, i created my gmail account via a invitation link from a friend (In 2006, there were invitation based sign-up). I created gmail id without any dots in it and just firstname.lastname@example.com,

Later I joined as software engineer in a company, I came to know that good email is firstname.lastname@example.com format, so I wanted to have my gmail id as email@example.com But it wasn't available. I was so desperate to have it that I decided to email the person who owns it, so I emailed on the id (having dot in it).

Guess What! I received my own email, requesting myself to handover the id. Then I did some tests to know if dot is making any sense or not. so tested like first.name.last.name etc.

Found this link way back then. Great to know that someone else found it after so long :)

</comment><comment><USER49> I signed up years ago with a dot in my username, before I knew this. Folks can reach me sans dot, but my username still has the dot (so, outgoing mail does too). It bothers me a lot!

If there is a Googler reading this with the power to remove the dot from my username, please email me (with or without the dot) :)

<comment><USER42> You misunderstand the article. Your username has no dots, and dots are allowed but ignored when your username is referenced (when logging in, when receiving messages, etc). Nobody can remove the dots from your username because they aren't there in the first place.

If you just want a different number of dots in your outbound mails, go to the gmail settings and add a new presentation under "Send mail as ..." and set it as the default.

<comment><USER49> > add a new presentation under "Send mail as ..." and set it as the default.

That's what I needed -- thanks! The dot still shows in my Gmail profile, and it's not possible to remove the "Send mail as..." address with the dot; which is odd. But yes I'm also able to log in without the dot.

</comment></comment></comment><comment><USER50> I have a similar issue, though it's not related to Gmail.

I registered an obvious joke email address from a free service. I'm not going to type it here, but imagine something similar to "firstname.lastname@example.com". (I could have used a gmail address for the same purpose.)

Occasionally someone will fill out an online form that asks for an email address, and decide to use an obvious fake, assuming that any emails will go into the proverbial bit bucket. That's why I sometimes get emails about someone's health insurance or airline tickets.

It can get a bit frustrating when online support forms insist on asking for account information when the whole point is that I don't have an account.

(Yes, I know I set myself up for this.)

</comment><comment><USER51> That, and '@googlemail.com'. firstname.lastname@example.com is equivalent to email@example.com.

<comment><USER52> @googlemail.com was the default address for a few years in the UK because of a legal dispute. If you sent an email it'd always come from the longer domain.

<comment><USER53> For reference: [https://www.theguardian.com/technology/2005/oct/19/news.busi...](https://www.theguardian.com/technology/2005/oct/19/news.business)

</comment></comment></comment><comment><USER54> What about + signs? That's the trick I use.

<comment><USER55> In theory, providers/servers should ignore everything from the + to the @ so that should work just about everywhere else. And since most forms don't filter that out, you can make numerous "unique" addresses connected to a single one.

Now odds are, someone is going to respond with the one service where the + becomes significant..

<comment><USER56> > providers/servers should ignore everything from the + to the @

Why? I'm not sure it has ever been a standard and it's certainly not a default implementation for most providers?

<comment><USER35> A quick google search returns [https://www.cs.rutgers.edu/~watrous/plus-signs- in-email-addr...](https://www.cs.rutgers.edu/~watrous/plus-signs-in-email- addresses.html) . Although not standard, its use is "legal"

</comment></comment></comment></comment><comment><USER57> I'm surprised that the "+" operator isn't commonly known either in gmail (eg. I can type "firstname.lastname@example.com", and mail sent to that address will redirect to "email@example.com"

</comment><comment><USER58> I think that for Enterprise customers (G-Suite) dots might matter as I tried to create a new (bot) account in Github with my email sans dots and I never received the email (email was not @gmail.com)

<comment><USER59> This is mentioned in the article, yes. It is likely to preserve backwards compatibility with pre-existing email addresses from before the switch to Gmail.

</comment></comment><comment><USER60> I registered firstname.lastname@example.com, I often get mail for someone else firstname.lastname@example.com. I noe have no idea who else they are routing email intended to the former.

</comment><comment><USER61> Older discussion: [https://news.ycombinator.com/item?id=16781959](https://news.ycombinator.com/item?id=16781959)

</comment><comment><USER62> I have a first.last@gmail address from the beta, and after numerous misunderstandings I've learned to use very precise language when attempting to help:

First establish that they're speaking to the wrong person.

Then suggest the nature of their mistake is a simple omission of a letter or number.

never offer a 'no big deal' or de-escalation until they've acknowledged the problem, otherwise the real recipient will never get the email!

<comment><USER63> Reply with this - people are less likely to argue if they think you are a robot:

This message was created automatically by mail delivery software. A message that you sent has not yet been delivered to one or more of its recipients after more than 24 hours on the queue on mail.example.com.

The message identifier is: 1JYIJ1-0008Ew-JK

The date of the message is: <date>

The address to which the message has not yet been delivered is: <your email>.

<comment><USER62> oh I did try that approach! it was generally ignored completely except for one hilariously angry person.

</comment></comment></comment><comment><USER64> It also disregards info after a + like:

email@example.com

You can sign up for sites like:

firstname.lastname@example.com

and it will still reach your inbox fine but be very obvious if your info is sold or stolen.

</comment><comment><USER65> I spent far too much of my time trying to explain this to Humanity.com's support after someone created an account using a dotless variant of my email. I didn't want to freeze the guy out of his account as I imagine he was using it for shift work notifications but in the end they just told me to change the password. Their support repeatedly insisted that gmail was broken and I should contact Google.

<comment><USER19> Because this is really Google's problem. If someone gives you an email address you're not supposed to touch anything before the '@' and assume that if the inboxes aren't exactly identical then they are separate addresses. Because on some (most) mail servers they will be separate.

Humanity is guilty of not actually verifying ownership/control of the inbox before letting the person attach it to their account but they were absolutely right to treat it as a separate address.

<comment><USER65> Obviously. My issues is the difficulty in explaining this to tech support even when confronted with evidence.

</comment></comment></comment><comment><USER66> It's also an old trick that people do in order to create a lot of accounts on websites (typically for malicious reasons) without having to create many disposable email. They use a combination of periods and plus signs in the email label. On top of that they can use the alias googlemail.com instead of gmail.com to create more accounts on websites.

</comment><comment><USER67> Glad to know I'm not alone in being a email@example.com and receiving emails for email@example.com. For a while I was concerned there was some issue where there was an existing firstname.lastname@example.com before I created mine and gmail just fused them. But it seems more likely whoever this other johnsmith is, they just think they have this email.

</comment><comment><USER68> I created my Gmail account as email@example.com (by mistake), but I always create accounts on website using firstname.lastname@example.com.

As a result, I often have problems when communicating by email with companies, as they can't match origin of the email (firstname.lastname@example.com) to my account email (email@example.com).

<comment><USER69> You can change your default "from" and "reply-to" addresses:

[https://support.google.com/mail/answer/22370](https://support.google.com/mail/answer/22370)

</comment></comment><comment><USER70> Except for when it does matter! GSuite accounts do care.

email@example.com is a different address than email@example.com.

I learned that one the hard way.

<comment><USER71> Yes the article mentions as an admin you could remove the dots but they always matter.

</comment></comment><comment><USER72> I receive incorrect email daily because of this. Early adopter problem for early Gmail users. I could have had my first name at Gmail back in the day but I thought "what's wrong with Hotmail!?". Same thing for Twitter, but I still don't use Twitter. I could have probably sold it for a pretty penny though. Hindsight!

</comment><comment><USER73> That's pretty useful for giving out to sites that believe you can't have a + in your email, but you still want to track who the address is shared with. Does anyone know if you can make different filters for differently dotted versions?

</comment><comment><USER74> I used this to get cheap dreamhost service back in the day by signing up once with my email with the dot and once without the dot. I now use the account without the dot permanently and it always throws me off. Worth it for the 1 year of savings :)

</comment><comment><USER75> I have about 3 people sharing my Gmail Address to their banks, credit card, insurances, etc.

</comment><comment><USER76> I use a similar behavior with the plus symbol to identify who leaks me email address.

</comment><comment><USER77> Good. So I can re-subscribe to the same tryout service again and again adding dots to my address without the need of use disposable mailbox (banned for sure) or create a new one time address.

</comment><comment><USER78> I have been getting private data and private documents of people with my same name because of this moronic feature.

And I can't trust Gmail anymore because of this.

</comment><comment><USER79> I got a bunch of mortgage documentation for another person with my name (i assume they either are a 1-t brett (or a misheard brent, brad or brit) or their email contains their middle initial or someone misheard their last name over the phone ( there are several spellings for my last name that are more or less homophones ).. either way I now have enough information to easily steal their identity.

I feel like most, majorish, online services do email verification, but when you are giving your email address to a someone over the phone, that's where most of the problems start.

</comment><comment><USER80> > _Your Gmail address is unique. If anyone tries to create a Gmail account > with a dotted version of your username, they 'll get an error saying the > username is already taken._

Well then I'd like to know how someone keeps signing up for services with my address, even though I never click any confirmation links. The email used for signing up specifically differs from mine by a dot.

(Though I don't think I'll complain to Google, seeing as it's just a dedicated address for shady sites, it's free, and Google aren't known for answering complaints anyway.)

<comment><USER81> The reason is because those services don't use an email confirmation process, either because they don't know better, or because they are email marketers who are happy to have every address that they can get and don't really care who gets their mail (the email equivalent of writing "OR CURRENT RESIDENT" on postal mail)

</comment></comment><comment><USER82> Fun Fact: Dots DO matter in gmails search bar:

from:<some email>@gmail.com and from:<some>.<email>@gmail.com return different results.

</comment><comment><USER83> If someone emails you without a dot and you reply from your dotted address, it will look strange in the receiver's email client.

<comment><USER30> Depends on the client–the ones I use understand that people can reply back with a different address than the one I sent an email to. (I frequently see @cs.university.edu → @university.edu, or @gmail.com → @companyname.com.)

</comment></comment><comment><USER84> This has only recently been a problem for me. There is a nice gentleman with my same name who picked up the gmail address without the dot. He lives in Arizona. Has a library membership. Plays in a softball league. I am not sure how much of my email he gets. I haven't set up a filter yet but I will eventually. I like seeing what my doppelganger is up to some times.

<comment><USER81> No, he did not "pick up" that address. Google won't issue a second address that matches the concatenation of the characters without dots. So, if I have firstname.lastname@example.com, Google will not issue anyone else johnsmith@, j.ohnsmith@, firstname.lastname@example.com or any other combination to another user.

What does often happen is that people FORGET what their actual email address is when they hand it out to other people or write it down on forms. Or their friends or family mis-remember it. Your doppleganger may have actually been issued the address johnny.smith, or smith.johnny, but just forgets.

</comment></comment><comment><USER85> Cool, so that means we all have infinite variations of our email addresses.

</comment><comment><USER86> yeah I've known and used this forever to trace sources of spam, etc

</comment><comment><USER87> You can add memos as well: firstname.lastname@example.com

</comment><comment><USER88> I have an uncommon last name, and picked an uncommon handle, so most of my accounts never get misaddressed e-mails.

But when I was younger and more foolish, I opened a mail account with a flippant phrase as the handle, and apparently somebody used that phrase as a "fake" e-mail address when signing up for the Trump campaign mailing list.

One thing I'm learning from that deluge of e-mails is that, no matter how little I think of GOP voters, I cannot manage to treat them with the utter contempt that the presidential family is treating them with.

</comment><comment><USER89> not 100% true, gmail won't allow you to send to john....smith@gmail for example

<comment><USER42> That's got more to do with gmail's composer than with their mailer. "foo + bar@baz"@domain.net is a valid email address but gmail won't permit you to type it in.

</comment></comment><comment><USER90> cool so johnsmith@gmailcom works? nice!

</comment><comment><USER91> That's not always true. I've sent an email from not Gmail service, it returned the non-exists error

</comment><comment><USER92> I got an email from Australia with the appointment for my spousal visa application, I'm also apparently looking for a new BMW in Cape Town and I also have a partner I visit in Paris and we order Chicken McNuggets on Uber Eats.

</comment><comment><USER93> Then why did they allow someone else to create an email like mine without the dot and I even get the occasional mail addressed to them. This is really shady, specially for an important service like email.

<comment><USER18> They didn't. You get email because somebody either typo's their similar address or they simply think that's their address when it isn't.

<comment><USER93> Not sure, I contacted this person, since I got their phone number from one of their emails (e.g. they registered for a hotel). I specifically asked them if they made a typo, according to them they have been using this email for years (maybe they lied but why would they).

<comment><USER94> This is inconclusive test, and if you ask people whether they made a mistake in the signup, they will likely answer no. Try to send a mail to that account, and if you receive a reply that is a real test.

</comment></comment></comment></comment><comment><USER95> PREACH. This is hands-down the single largest reason why I abandoned my Gmail. I receive countless people's credit applications, loan details, new credit card details, bills, etc, credit collections, etc.

All because they have the same last name as me and opted to use a period in their email address.

This is happening across multiple countries as well. Sadly, none of these people ever receive their important messages because I gave up trying ages ago.

How they continue to explain this away as a feature is beyond me. Google is constantly pushing forward with various, and perhaps superficial, security/privacy oriented initiatives yet here's one of their core products offering up the most private details of others without zero care to fix it. SMH

<comment><USER96> This type of stuff happens all the time. I'm actually receiving all kinds of internal information from a large insurance company from India, supposedly because one of their employees is registered with a typo in the domain name, which is my domain.

I can't for the love of god make clear to these people that there must be a dozen laws this violates. I see insurance application, invoices, disputes, everything on at least a weekly basis.

I have no idea what my legal position in this is. I tried reaching out to the senders, but I am afraid of reaching out to the C-levels directly because who knows how they respond.

Bottom line, people make typos all the time, and it's not just dots that cause this. People are just terrible at email and email is terrible for sensitive documents.

</comment></comment><comment><USER97> I still get occasional emails for `firstname.lastname@example.com` while I registered `email@example.com`

Which seems to contradict what the article says, since the article suggests anyone who registered my `firstname.lastname@example.com` would own mine.

Or is the article suggesting actually nobody ever registered `firstname.lastname@example.com` and some idiots just think "oh i need to write to firstname lastname" (one of many who share my firstname/lastname in French) and they just compose that email address? I don't get it.

edit: but moral of the story I think it's really a bad idea to register based on a real firstname/lastname -- I'm tired of getting junk ... and worse, getting invoices for other people for a service I also use. I got confused once and actually made a payment which was not meant for me >_>

<comment><USER98> > Which seems to contradict what the article says, since the article suggests > anyone who registered my `firstname.lastname@example.com` would own mine.

It doesn't. email@example.com is also your address. Nobody could have registred it.

> Or is the article suggesting actually nobody ever registered > `firstname.lastname@example.com` and some idiots just think "oh i need to write > to firstname lastname" (one of many who share my firstname/lastname in > French) and they just compose that email address? I don't get it.

Yes, that's what is happening. If you get unintended emails, their intended destination is yet another address.</comment></comment>


Ask HN: Are pay-walled posts essentially a form of advertising? - dynamite-ready In order to foster a real discussion about an article behind a paywall, all participants would be required to pay for access and read it, right? I've only found this to be a real problem in the past 2 years. Reddit is particularly susceptible, but it's becoming more and more prevalent. <comment><AUTHOR> That's why some allow you "max 3 articles" or so. That can be circumvented with incognito mode.

But at some level it's a donation. Spotify is a donation. Sublime Text is a donation. All of us can spare $5/month for something of value. It's just a kind of forced donation.

</comment><comment><USER2> > all participants would be required to pay for access and read it

Assuming the paywall can't be bypassed. The problem is that publishers want to have the cake and eat it too, so they happily let search engine/social media bots get access to the content (based on the user-agent) which means we can use this opportunity to bypass it.

At present, paywalls are simply an inconvenience.</comment>


Show HN: Denarri – Your Tech Shopping Personal Assistant - <AUTHOR> http://www.denarri.com

<comment><AUTHOR> Hey everyone! I've been working on a mobile shopping app called Denarri, and I'd love to get feedback from this awesome community!

Denarri is designed to make mobile shopping quick and intuitive, and constantly gets smarter the more you shop with it. From search to buy in 3 clicks.

Regarding the feedback, If there's any way you feel I could make the transition from initial search to final purchase faster, easier, more effective, etc, I'm all ears!</comment>


Ask HN: Good books on the nuts and bolts of starting up - <AUTHOR> I'm looking for good books on the nuts and bolts of starting up. Ideally I prefer things written by someone who has done it a few times.  I'm looking for really practical advice rather than something like Founders at Work (good, but not what I'm after).<p>Topics like hiring sales people, how fast to grow headcount, how to structure options, etc. Book suggestions devoted to individual topics are also welcome. <comment><USER2> I think things like options and any other legal is a very delicate stuffs and better be done with experts (lawyer, accountant etc).

For resources, here are few that i have in the arsenal:

Marketing: <http://startup-marketing.com/> <http://andrewchenblog.com/>

Legal: <http://www.thestartuplawyer.com/>

General: <http://startuplessonslearned.blogspot.com/> <http://onstartups.com/>

You can ask any topic: <http://discuss.joelonsoftware.com/?biz> <http://news.ycombinator.com/>

Hope it helps.

<comment><USER3> I've also seen some pretty comprehensive answers to questions over at <http://www.chuwe.com>.

<comment><AUTHOR> Chuwe looks pretty cool. I almost didn't click because the domain name didn't look 'serious'.

</comment></comment></comment><comment><USER4> Stanford's entrepreneurship corner: book list: [http://ecorner.stanford.edu/search.html?keywords=book&x=...](http://ecorner.stanford.edu/search.html?keywords=book&x=0&y=0)

MIT Entrepreneurship center: book list: <http://entrepreneurship.mit.edu/booklist.php>

"Must have resources for startups?" at StackOverflow.com [http://stackoverflow.com/questions/120272/must-have- resource...](http://stackoverflow.com/questions/120272/must-have-resources- for-startups)

"books for startup" at StackOverflow.com <http://stackoverflow.com/questions/412677/books-for-startup>

Hope it helps you. :-)

</comment><comment><USER5> "Term Sheets & Valuations - A Line by Line Look at the Intricacies of Venture Capital Term Sheets & Valuations" and "Deal Terms - The Finer Points of Venture Capital Deal Structures, Valuations, Term Sheets, Stock Options and Getting VC Deals Done (Inside the Minds)"

Both are great books. I would read Term Sheets first, but Deal Terms has a lot of great information when you are getting ready to do VC funding. I guess that is if you do VC funding.

</comment><comment><USER6> The Four Steps to Epiphany by Steven Blank - a great manual for creating a successful, data-driven, hypothesis-based, and iterative-heavy startup.

<comment><USER7> I second this -- I think it's what the OP is looking for.

It's published by CafePress, so the fastest and cheapest option is to get it directly from them: <http://www.cafepress.com/kandsranch>

Amazon: <http://www.amazon.com/dp/0976470705>

</comment></comment><comment><USER3> To be quite honest with you, most of these books written by people like Guy Kawasaki, Jessica Livingston, Buffet, etc., are all great, but are pretty much compilations of stories or opinions. I know what you're after, because I was after the same thing not too long ago. I just went to Borders and picked up some text books on the subjects of interest - business, marketing, etc. I'm not sure if you'll be able to find text books on 'how to structure options,' but I'm sure there's some text that Harvard MBA's and the like have read throughout their time in school that covers that topic.

<comment><AUTHOR> I've been disappointed so far too.

For example, I read an article about a hard driving sales guy whose rule of thumb was n calls a day, and n appointments and to make them like you within the first minute.

I'm looking for books passing on this type of rule of thumb wisdom from entrepreneurs.

</comment></comment><comment><USER8> "Engineering Your Startup" is a GREAT guide to all of the nuts and bolts. From analyzing markets, to corporate structure and dynamics, to accounting- it covers pretty much everything.

<comment><USER9> I got this as a gift a while back and it's okay.

</comment></comment><comment><USER10> As a followup anything UK specific would be interesting to hear about. I've seen the various 'small business guides' which are good for some topics but not so great on others.

</comment><comment><USER7> _Raising Venture Capital for the Serious Entrepreneur_ is probably the most useful book I've yet read when it comes to startups. Topics covered: Financing maps; Cash flow and risk of early stage ventures; how much capital raise and what to spend it on; getting behind how VCs think (really informative), business plans, valuation of early stage ventures, term sheets, splitting rewards, allocating control, aligning interests (options, vesting, noncompete, IP, etc.).

<http://www.amazon.com/dp/0071496025>

I've read _Founders_ plus a couple of other titles on the subject, but this one really stood out.

</comment><comment><USER11> "Growing a Business" by Paul Hawken - hands down one of the best books on starting a business I have read. Don't let yourself be scared away by the release date 1988, the advice in there is timeless. Lots of the author's advice can still be found in other books on that topic. [http://www.amazon.com/Growing-Business-Paul- Hawken/dp/067167...](http://www.amazon.com/Growing-Business-Paul- Hawken/dp/0671671642/ref=sr_1_1?ie=UTF8&s=books&qid=1241895162&sr=8-1)

You might also think the title sounds "treehuggerish", I found the book not to be like that at all but very inspiring and useful.

</comment><comment><USER12> The Business of Software by Eric Sink is pretty good. [http://www.amazon.com/Eric-Business-Software-Experts- Voice/d...](http://www.amazon.com/Eric-Business-Software-Experts- Voice/dp/1590596234)

</comment><comment><USER13> Reality Check by Guy Kawasaki is excellent, and covers everything from PR to marketing to legal. Some parts are advice on how to approach various aspects of starting up while other parts are more "nuts and bolts." (on average, the book stays somewhere between those two slants)

[http://www.amazon.com/Reality-Check-Outsmarting- Outmanaging-...](http://www.amazon.com/Reality-Check-Outsmarting-Outmanaging- Outmarketing/dp/1591842239) is e

</comment><comment><USER14> Not books, but useful online articles, are the articles listed in the Hacker News Library:

<http://ycombinator.com/lib.html>

</comment><comment><USER15> Guy Kawaski's Art of the Start is more practical than FaW but I'm not sure it's practical enough for you.

</comment><comment><USER9> I liked The Entrepreneur's Bible since it provided a great foundation of all the topics. From there, then you can pick and choose. I like Art of the Start, Founders at Work as well for various reasons.

</comment><comment><AUTHOR> Blog suggestions on these topics would be handy, too... Also sales, marketing, accounting for topics...</comment>


The mystery of Google+ - <AUTHOR> http://www.elezea.com/2013/07/google-plus-mystery/ <comment><USER2> Google Plus is like the movie Dark City. It's a group of technical aliens picking apart the human experience, trying different scenarios in order to find out what the human soul is.

Once per day, humans wake up and find themselves in its meticulously- constructed parallel universe, doing things as ordinary humans do on other websites. Their activities, such as appreciating music and searching for lovers, feel familiar, necessary and meaningful, but at the same time, the unsettling atmosphere prevents the existential questions from settling deeply repressed where they should be. Instead, we're left wondering, "Why are we doing this here?" Isn't there something better? Is there a Shell Beach out there somewhere? Couldn't I just do this all myself on 1999-style website and live a more natural life?

Successful, albeit defunct, networks like MySpace work b/c above and beyond, they were passionate about connecting people with things they want. e.g. music... at all costs! Facebook reassures you that you dodged a bullet when you didn't marry your high school sweetheart. Google Plus just screams "use me. use me. use me for... everything or anything.. so that... um... so that google can keep track of what's hip and make money while I don't." There's no soul or love deep at the bottom.

There's a whole lot more I could say about passion, sacrifice, vulnerability, and empty vs. full cabinets, but I have a customer to service now, so I'll leave you with this hint: Germick is onto something with the google doodles. Hire me as a consultant if you really want to pick my brain.

<comment><USER3> _> Germick is onto something with the google doodles._

Who?

<comment><USER2> [http://www.ryangermick.com/?content=about](http://www.ryangermick.com/?content=about) Ryan Germick leads the Google Doodle Team. This is his ol' portfolio website.

<comment><USER4> Interesting. I wonder what happened to Dennis Hwang, who started the whole doodle thing....

</comment></comment></comment></comment><comment><USER5> Google+ is a UI disaster. Look at some of the basics. When the browser is fully maximized, my screen can see 8 chats / contacts / "hangouts" / whatever they're called in the sidebar on the right. On my Facebook chat sidebar, I can see 14 contacts. When you refresh a G+ page, the open chats mysteriously disappear. This cuts down on usage, because, for example, each time I go to Facebook, my chats are still open and I can immediately continue from where I left off. Google+ has 3 "toolbars" at the top of each page, taking up an enormous amount of vertical space. Honestly, with the sidebars open, it feels like you're working in a 500px x 500px window. For God's sake, the "About" page doesn't even let you be in a relationship _with_ another member. The "About" page also doesn't allow other users to see your interests, or favorite books / TV / music. Essentially, G+ utterly fails to encapsulate everything Facebook offers in this regards: when you first Facebook friend someone you just met, you immediately get the basic information about their life: where they stand romantically and what things they like.

There are other problems. Tagline? Bragging Rights? Skills? Links? Is G+ a page for socializing or a resume?

I simply cannot fathom why some people in the tech industry think that G+ is in any way a viable competitor to Facebook. Outside of the tech bubble, its usage is nonexistent and unhelpful. It is cluttered with things people don't want, and it lacks some of the basic things people DO want.

<comment><USER6> I look at G+, and as it happens GMail, and I just see a confusing mess. I have to look at it for a second or two to sort of orientate my self, and let the site sort of focus. I'm sure its the flat design lark we are currently in the middle of. Last time I used facebook (I "deleted" my account a year or so ago) it was far clearer and instantly use-able. Although looking at it now, using one of my kid's profiles, its beginning to get as bad.

I might actually use G+ if it were use-able. I have joined two groups, purely because people migrated there from Usenet, and every time I want to check whats what in these groups I come away wishing I hadn't bothered. Good job the one I most care about is a slow burner.

So, for me the biggest barrier is the UI.

</comment></comment><comment><USER7> I'm increasingly convinced that the mystery amounts to "Circles working as designed."

Let's say you've got a classic oversharer in your Aunt Sally. It's uncouth to ignore her entirely, as sometimes she does post things you need/want to be aware of, if for no other reason than to reduce family stress.

On Facebook, there's just a steady peppering of her stuff in all the other posts. On Google+, you can shunt her off into a "noisy" circle and deal with her posts maybe once a week.

But there-in lies the rub: any given dull Facebook session you can click on an Aunt Sally link -- they're always right in front of you. But on Google+ even if you've got 5 minutes to kill on a random link, clicking over to the "noisy" circle carries a mental obligation to not just find a link, but actually do the chore of scanning her aggregated posts to see if there was anything in there about your Uncle's knee surgery or the family reunion.

So you generally don't do it. Or, if you do, you're not concentrating on the random links, you're dealing with the chore of sorting the pile, and the random links still aren't getting clicked.

And the flip side is that when you construct circles for your own sharing, you may think you're sparing your gear-head uncle bob from all your links to computing articles, not realizing that he actually _did_ read them from time to time on Facebook.

Though this explanation does raise the question of "was the lost traffic actually _valuable_?" as your killing 5 minutes on an Aunt Sally post, or Uncle Bob skimming an anti-Facebook rant are certainly going to be page-views, they're unlikely to have resulted in any sales or ad-clicks.

<comment><USER8> I'd always thought that circles should have been two-sided. People should be allow to create personas (channels for their profile) and choose which channels a post is associated with. Others can then follow a person's personas, not the person directly.

I admit that the idea gets a little clunky when you have to take into account "I want to make a post that only people in my X circle can see", but I don't see why that couldn't be worked in somehow.

<comment><USER9> You've pretty well described "communities".

"Tactile Keyboards" doesn't have much kitty pictures or religious quotes... mostly.

</comment></comment></comment><comment><USER10> I've been using G+ more frequently since the upgrades introduced at IO. It is a better product now, and the photo sharing is quite good (at least compared to Facebook and Twitter).

It is still a UX nightmare, however, and I imagine hat turns off a lot of users that try to dabble in G+.

Communities seem to be the best draw for Google Plus right now, maybe because it is otherwise difficult to converse with a large group of people (e.g. friends, family) on G+.

</comment><comment><USER11> There's no mystery.

> is Google artificially inflating it's numbers while really dying a slow > death

Yes.

Every free Google product that they don't know how to monetize is being moved under g+ in an effort that g+ will be highly monetizable(?) In the future.

I have some 7 g+ accounts just for such logins.

<comment><USER12> Damnit, you're overcompensating for my refusal to join. I'm going to have to refuse to join 6 more times now...

</comment></comment><comment><USER13> The article says it's a mystery but then nails it:

 _" In line with Google's vision to organize the world's information, the focus on Google+ seems to be shifting to content more than relationships. ... I wonder if Google is more interested in being Reddit (the front page of the Internet), than it is in being a Facebook/Twitter clone (what your friends are up to)."_

<comment><USER4> Problem with that is that G+ is an even worse version of Reddit than it is a Facebook clone.

Reddit already has (a) anonymity; (b) a working karma system; (c) proper threading; (d) organisation by subject/topic; (e) freedom to start new boards; and (f) a lot more intelligent debate than G+. Fixing all of these G+ deficiencies in the current system looks a long way beyond Google's capabilities, even if it wanted to.

The dog-slow operation of G+ and the extreme information-poverty of the UI (which makes it impossible to scan topics quickly) add to G+'s problems in being a pseudo-Reddit.

<comment><USER14> I was with you until you said intelligent debate. Aside from a few pockets like /r/askscience, Reddit is an awful place for an intelligent conversation. I don't know if Google+ is worse, but there are great pockets there too (Linus Tovalds for instance).

<comment><USER4> Reddit is certainly variable, but I often find the debates interesting. On G+, I mostly see people on soapboxes: it's not so much debate as the defending of entrenched positions....

</comment></comment></comment></comment><comment><USER15> Of course network effects are more important than technical factors for a social network.

For what it's worth, I gave Google+ a pretty solid try when it came out, but very little of my social network actually moved over there, and then I moved to a new city and all my new friends were on Facebook instead, so I stopped using G+.

<comment><USER16> Why do you use Hacker News?

No, seriously.

I simply can't understand the logic of someone who says that they stopped using G+, BECAUSE all of their friends are on Facebook... when they SAY THAT on Reddit or Hacker News.

<comment><USER4> Hacker News and Reddit have lots of information and good discussions. People use them because of the quality of the content, not because they know the contributors.

People use Facebook because they know the people, and that's what makes the content significant _to them_ but not to outsiders.

G+ simply doesn't have the ease of access or quality of content (links, discussions) that you get on HN or Reddit, and it doesn't have your friends. It fails at both.

<comment><USER16> You personally don't find the quality of content on G+. I personally do.

Or at least, it's rewarding enough to make it ANOTHER site that I visit. GMail, Facebook, Reddit, Hacker News, CNN, G+. I don't think G+ is going to replace GMail, Facebook, Reddit, Hacker News, or CNN for me. But I don't expect ANY of those sites, to replace any of the others. So it just boggles my mind when people - on Reddit or Hacker News - comment that G+ didn't replace Facebook, so therefore it is not valuable.

I think I've put a bit more effort into finding interesting people, Pages, Communities, and #topics than you have, and I've been rewarded for my efforts.

Google+ doesn't have a Front Page like Reddit and HN do, that's true. But it wasn't hard to get started finding stuff I care about.

<comment><USER4> Fair enough, but the whole idea of following _people_ to find _content_ just makes it harder to find content on G+. On Reddit, you pick the topics that interest you and the best content (in theory at least) gets upvoted.

Both Twitter and Reddit (and HN) pack a ton of info into small spaces so it's very quick to scroll through and pick up new stuff, which is a major problem with G+. The same info may be on G+ but, in my experience, it's a lot harder to find. (And if do I find it, it's already been tweeted to death.)

Incidentally, it wasn't me who thought G+ should replace other services! I do think it started as an attempt to replace Facebook, but as far as I can see, it isn't a good substitute for anything I already use. Worse, it doesn't have any unique attractions (unless you want Hangouts, which I don't).

<comment><USER16> You don't need to follow people to find content - you can follow Pages, Communities, and #topics. That makes it very similar to sub-Reddits.

I can scroll through my stream pretty quickly. j/k keys work great.

Reddit isn't a good substitute for anything I already use. It augments them. Google+ is the same, it augments the things I already use.

A unique attraction for me is that when I +1 something, and later Google Search, I can find my own +1'd things very, very quickly. That's a completely unique feature.

Try to find anything you ever saw on Facebook or Reddit, for comparison.

<comment><USER4> I've not found any Pages or Communities that were worth the effort. And however fast you page, you still end up viewing close to one item per page, which is ridiculous. I want to see at least 10, preferably 20 or more. (Worse, G+'s endless pages mean you never get very far down the stream even if you try.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> It's no mystery. Google creeps people out. I am one of them. I read his comments on Google plus, but you have to be on Google + to respond. Seems self limiting if you are trying to find out why people don't use it. Facebook is at least as creepy, but for some reason, people don't seem to care. Twitter, for the most part, doesn't seem creepy. If I was to be on any of those 3, it would probably be twitter, though I don't see any reason to use it, so I don't.

</comment><comment><USER18> I wonder about that "#2 social network" statistic. Google is, e.g. getting increasingly pushy about getting me to merge my YouTube account with my G+ account. I wouldn't be surprised if a sizable proportion of whatever metrics went into determining that #2 ranking were derived from people who did NOT think of themselves as "being active on G+".

Of course the same is true for Facebook, to some extent, with an increasing number of web sites outsourcing their comment system to them.

<comment><USER19> Also, it's no longer possible to sign up for any Google product without getting a G+ account with it. You can remove G+ from your account, but of course 99.9% of people have no idea how to do this.

</comment></comment><comment><USER20> > Does it mean that Google did too little, too late? Does it mean that the > major social networks are all syphoning off their own unique customers that > will never overlap? Is Google inflating the numbers artificially and it is, > in fact, dying a slow death? Or, most disturbingly, does it mean that having > a superior product doesn't matter as much as strong network effects?

I've never given Google Plus a serious try, but I would totally do it if it had no barrier to entry ([http://www.joelonsoftware.com/articles/fog0000000052.html](http://www.joelonsoftware.com/articles/fog0000000052.html)). If I could try it for a while, use it to create content, then know that if I don't like it, I can go back to Twitter and others won't even know that I left, then I would give Google Plus a try.

If Google Plus already does this.. well. Then it's marketing's fault.

<comment><USER21> What are you looking for? Are you asking that Google+ automatically brings over all of your Twitter followers? Or automatically Circles everyone you follow? I don't think either of those would work out very accurately. I'm not sure what the barrier is that is keeping you from trying Google+, considering it's completely free, it's competitor is completely free, Google+'s character limit is far greater than any of its competitors (so you can post the same stuff)...

You literally can just try Google+ for a while, use it to create content, and if you don't like it you can go back to Twitter. They're not mutually exclusive. Google+ doesn't deactivate your Twitter account. It doesn't edit your hosts file to null route www.twitter.com. There are even browser plugins that let you post all your existing Twitter and Facebook content to Google+ retroactively, and let you post to both for future posts as well.

So... that doesn't seem like it's marketing's fault. I'm not sure what would be a barrier to entry to something that's completely free and demands literally nothing of you.

</comment></comment><comment><USER22> So perhaps Google⊉ might have been a more accurate name?

</comment><comment><USER23> Google should "remove" whatever person is in charge of the G+ UI/UX . It's so bad . that's why people dont use it. Let the content breath , get ride of the header that takes half the page on laptops , stuffs like that. It's like they want it to fail ... It's funny with the load of money Google has , they usually suck at UI. Youtube UI is good most of the time though some iterations were bad.

Keep things simple for god sake. Even Microsoft is better at UI than Google.

<comment><USER24> Youtube is fine in most aspects, but I would consider comment system one of the most broken things on the web, period. I know it's not easy to make good, given the variety of audience and usage, much less "perfect", but I doubt anyone is even trying.

How much of the quality of youtube comments can be attributed to this? Anyone wanting to make a point or responding to one would rather post the video in a forum and discuss it there. And considering that it's YOUtube, which means the initial idea was that people talk into their camera, and others respond with videos and comments, I wouldn't exactly call the comment system a gimmick either. It would be nice to at least _theoretically_ be able to have actual discussion on important videos, right where the video is. But no ^^</comment></comment>


What does Google need from Android? - <AUTHOR> http://ben-evans.com/benedictevans/2013/1/20/what-does-google-need-from-android

<comment><USER2> Profit...</comment>


Ask HN: How to find companies hiring in London - <AUTHOR>

How to find a position in companies like Dropbox, Airbnb etc. that are hiring in London.<p>I can filter startup jobs with HN's Who Is Hiring or Angel List. careers.stackoverflow.com has a pretty good filter, but not many companies are there. Any other option?<p>(Asked just before the server was down, so I'm resubmitting) <comment><USER2> Job boards are passive. Instead, research London companies that received funding the past 12-24 months. List 10 targets that look interesting. Then reach out out to them individually. You'll find the 'hidden opportunities' in those conversations.

Here's a source for ideas> [http://techcitynews.com/section/news/](http://techcitynews.com/section/news/)

</comment><comment><USER3> I'm surprised no one has mentioned www.jobserve.co.uk. I have found all my jobs on there; you will find most of the agencies advertising there. Restrict your search to London, and you're good to go. It's another matter if the agencies don't call based on your cv

</comment><comment><USER4> These sites have some good startup jobs listed on them:

[http://workinstartups.com/](http://workinstartups.com/) [http://3-beards.com/jobs](http://3-beards.com/jobs)

</comment><comment><USER5> Have you checked out [https://www.siliconmilkroundabout.com/](https://www.siliconmilkroundabout.com/) which is a careers fair in Old Street, London?

<comment><AUTHOR> Yeah I do know them all. I do know where to find a startup job, but I don't know how to find a bigger tech company/ mature startup that hires in London.</comment></comment>


Vanity Fair's 2011 New Establishment List - <AUTHOR> http://www.vanityfair.com/online/daily/2011/09/the-2011-new-establishment-list--and-the-top-spot-goes-to---

<comment><USER2> Wow, we've had 11 people on this list speak at YC dinners, plus 1 more who's scheduled for this winter.</comment>


How to setup a secure private web server with node.js using SSL authorization - <AUTHOR> https://gist.github.com/ExxKA/5169211

<comment><USER2> Good article! I had not considered requiring clients to have certificates, but it seems that would be a prerequisite to having a private HTTPs/SSL enabled server.

I read this and did not understand:

When you use the rogue certificate and rejectUnauthorized == false, you should see a TLS error being printed on the console, remeber to set rejectUnauthorized == true, to protect the web server.

Are you talking about if(!cleartextStream.authorized) part?

<comment><AUTHOR> And thank you :)

<comment><USER2> Sure! I would imagine the unsecured part would be useful for distributing certs to new users or allowing them to sign up and request a certificate, in the first place.

I have been missing a way that OpenVPN certs, configs, and instructions could be distributed to users without obscuring their general usefulness as SSL certs. Thanks!

</comment></comment></comment><comment><AUTHOR> Please let me know if you have any questions</comment>


Show HN: My social chat startup reached 1.2M members with only viral - <AUTHOR> http://connected2.me/demo

<comment><AUTHOR> This is my new startup and I'd love to get your feedback. It reached 1.2 million members with only viral.

Basically you set up an account for people to chat with you anonymously. As their identities are anonymous your friends can ask everything to you that they normally cannot ask. They can tell their thoughts and criticisms about you.

Moreover, you have an opportunity to chat anonymously with celebrities you admire through Connected2.me. You can tell your problems to specialists such as psychologists by keeping your identity secret and get an instant answer. Companies also use Connected2.me in order to get anonymous feedback about their products and give support to their customers real-time.

Please try and tell me what do you think.

</comment><comment><USER2> Interesting idea. I jumped on and chatted with a few people-seems to work well. Sign up was easy, I like the anon-bot that chats with the tutorial. Charging $0.99 for an hour of promotion is a good idea.</comment>


Show HN: Trunk – Private links for you to collect and distribute digital content - <AUTHOR> https://trunked.me

<comment><USER2> The no-signup is really good ! It would be even better if you added client- side encryption and a rudimentary support for folders. The use-case I have in mind is sharing photos of an event: there may be a ton, we may want to organize per uploader (so as to not mess up with names) and I'm not totally comfortable with all my pics being in clear on Amazon's servers.

Neat otherwise !

<comment><USER3> They say they encrypt them. They are not?

<comment><USER2> A quick test showed that content was sent in cleartext, directly to trunked's s3 bucket, and then some metadata is sent to trunked.me. Maybe that metadata is encrypted ? Anyway, the content does not leave your browser encrypted.

<comment><USER4> Are you expecting encryption of the file in JavaScript on the client before it is uploaded?

<comment><USER3> That is feasible and not too much to ask. After all, they say it is encrypted.

</comment></comment></comment></comment></comment><comment><USER5> Very useful! Have been thinking about the same idea recently!</comment>


Docker and Windows Server, What does it mean for you? - <AUTHOR> https://whiskykilo.com/docker-and-windows-server-what-does-it-mean-for-you/

<comment><USER2> What does this mean for me? As someone involved in the space it means:

* Docker isn't going away anytime soon * All the big IaaS and PaaS players will be re-positioning to incorporate * That the pin has been pulled on the future acquisition

They are becoming too big to be solo... and I'm thrilled for their team.</comment>


Embedded power source from recycled reactor waste offers a battery alternative - <AUTHOR> https://ndb.technology/technology/ <comment><AUTHOR> I'd like to see a chip with it's own power source that keeps a truly monotonic clock.</comment>