Spyware Company Leaves 'Terabytes' of Selfies, Messages, Location Data Exposed - <AUTHOR> https://motherboard.vice.com/en_us/article/9kmj4v/spyware-company-spyfone-terabytes-data-exposed-online-leak <comment><USER3> >Motherboard was able to verify that the researcher had access to Spyfone's monitored devices' data by creating a trial account, installing the spyware on a phone, and taking some pictures. Hours later, the researcher sent back one of those pictures.

I love that they told us exactly how they verified it. Too often in the news do we just get "was verified" or "an independent source verified," which, I get that you gotta protect sources, but still doesn't give any insight into their methodology. I could ask for example "how do you know you can trust your independent source?" because I have no idea their history together.

Tech news like this is a bit easier to actually show your work for, but even when that's the case so many security articles or people on Twitter don't show the money like this. As much as everyone likes shitting on bitfi, for example, it was quite a while before someone actually demonstrated a hack was done, with reproducible methodology, rather than just blow smoke about how it's insecure.

<comment><USER4> IMO, you don't trust the independent source, you trust the journalist. Naturally, you'll only trust journalists who have proven to be right most of the time.

</comment></comment><comment><USER5> > "Spyfone appears to be a magical combination of shady, irresponsible, and > incompetent," Eva Galperin, the director of cybersecurity at digital rights > group Electronic Frontier Foundation, told Motherboard.

Leave it to EFF to have the pithiest quote in the article. Is it possible that companies that are shady are more likely to be irresponsible in their security practices, because they're focused on immediate profit?

<comment><USER6> Is it more likely that drug dealers that are shady are more likely to be irresponsible in their safety practices because they're focused on immediate profit?

<comment><USER7> More likely than (drug dealer who are not shady)? Most likely yes.

<comment><USER6> That was the point. "Shady" and "irresponsible" pretty much go hand in hand.

<comment><USER8> Not necessarily. I'd expect the leader of an organized crime group to be very responsible but shady as hell.

</comment></comment></comment></comment></comment><comment><USER9> >Steve McBroom, a Spyfone representative, told Motherboard on Monday that the company is investigating the leak, and expressed relief that the person who found it had good intentions.

Unlike spyfone whose intentions appeared to be profiting off of violating the privacy of others. I wonder if they have done the market research to determine if their core demo is domestic abusers.

<comment><USER10> SpyFone can only be used with consent of the device owner. From the Terms of Use ([https://spyfone.com/terms-of-use/](https://spyfone.com/terms-of-use/)):

"You will only install the SpyFone software on devices for which you are the owner, or on devices for which you have received consent from the owner of the device."

Their service cannot be used by domestic abusers, obviously. ( _sarcasm_ )

<comment><USER11> Google Maps has a location sharing feature. It goes to great lengths to notify the device owner through both on-device and off-device methods that the phone is being monitored, and by whom. That's the only way to run a legitimate monitoring system.

<comment><USER12> I'm not sure - given their recent location-privacy related coverage - <USER2> Google should be held up as "gold standard" here...

<comment><USER13> Which is why it is a fantastic example. "Even Google" is extremely explicit that location is being shared on the target device.

</comment></comment></comment></comment></comment><comment><USER14> Spyfone's response:

"Dear Valued Customers of SpyFone.com,

Within the last 10 days, one of our servers experienced a data breach and an unauthorized third party gained access to the data of approximately 2,200 customer accounts. The potentially exposed personal information of those affected could include pictures, call logs, and emails.

While our team is taking steps to enhance our site's security and we have since taken action to ensure that all accounts are fully encrypted, we are notifying you that your account may have been one of those negatively impacted by the unauthorized access. In an evolving landscape of online threats, SpyFone.com is committed to the highest standards of accountability and transparency, and proactively works to ensure the safety and security of our users. We will continue to work to address this matter as we partner with leading data security firms to assist in our investigation, and coordinate with law enforcement authorities."

</comment><comment><USER15> I'm not sure that this discovery will have any effect. While there are claims that this software is marketed to businesses, I'm skeptical that it's anything more than a drop in the bucket compared to use by shady individuals.

Non-business users (like nosy parents and controlling spouses) probably won't ever know about this security breach.

I have no sympathy for anyone who uses software like this, I strongly feel there is no justification for software like this that outweighs the invasion of privacy and other harms, and I don't think this functionality should even be possible at the phone OS level, nor should it be allowed for sale in application stores.

The security failure itself isn't surprising in the least, though. Only bad people write this kind of software. They've already limited their pool of potential hires to people with no ethical or moral standards.

Also, look at the image in the article containing the description of SpyFone. They can't even perform basic copy-editing. Poor grammar in commercial products is a solid barometer for overall product quality.

<comment><USER11> Agreed. The app's intended design purpose was to leak private data. The data breach happened as soon as the software was installed; the exposed S3 bucket is irrelevant.

<comment><USER16> Doesnot mean the people targeted by software fair any better with such data leaked on the internet.

</comment></comment></comment><comment><USER17> Wow, S3 is the gift that keeps on giving. My favorite quote from the article: _"Spyfone appears to be a magical combination of shady, irresponsible, and incompetent,"_

Amazing how people don't lock down S3 data.

<comment><USER18> Started playing around lately with AWS.

Gosh, getting the access rights to work properly between the various types of controls in place, whether it's the groups, the access policy and whatnot is kind of mind numbing and makes you feel very stupid.

Not that it excuses anything but it is confusing and I can foresee an overworked engineer going "Ah fuck it, no time to read up on that, just go for the easiest stuff to get started on using S3".

<comment><USER17> That is exactly the problem I see as well. Basically it is so hard to get it working "correctly" (and by that we mean in a way that isn't trivially exposed to the full frontal Internet), that engineers under pressure just punt after getting it to work _at all_. Sort of "Ok, here it is working, we'll fix the security concerns later, in the mean time try it out." and they get swept into another project because this part is "working" and nobody comes back to to do the hard work of figuring out the right way to make it work.

As a result 'war driving' through the S3 namespace continues to yield up PII, and CUI nuggets of gold to bad actors.

</comment></comment></comment><comment><USER19> > Steve McBroom, a Spyfone representative, told Motherboard on Monday that the > company is investigating the leak, and expressed relief that the person who > found it had good intentions.

>"Thank god it is a researcher, someone good trying to protect," McBroom said in a phone call.

Mr. McBroom needs to be worried about people with ill intentions who have accessed this data in the past and they have no idea about.

Given this is a routine S3 bucket access breach I'd assume lots of bad people have rainbow dictionary found this by now. You can assume people are basically doing that for public buckets all the time now.

<comment><USER20> "Thank god..." It is most reassuring when divine entity is invoked especially in a data breach context. Especially when the intervention is of a monotheistic kind.

</comment></comment><comment><USER21> "Wait, hiring a security guy is how much? Fuck that... How much is a Senior engineer to make our API? .... Shit. That would definitely cost me my third corporate lease... How much to hire those kids that emailed us out of the blue?

Yeah, I'm sure they'll do a fine job, just hire them.

</comment><comment><USER22> First the requirements for installing it on Android phones is a lot less....

 _Android Requirements:

You Need Physical Access To Device For Install

Supports Android Versions (4.1 - 8.1+)

iOS Requirements:

If 2 factor is on you need physical access to device

iCloud login access is required_

Then look at the features....

[https://spyfone.com/features/](https://spyfone.com/features/)

It says a lot about Android that anyone with physical access to an unlocked phone can put this type of spyware on it.

Even if someone does leave their iPhone unlocked long enough for someone to install the app, they still couldn't do it without authorization and even then you have to know the targets iCloud credentials and have physical access to the phone if it has 2FA.

<comment><USER23> The way I see it, it is easier to get your hands on someones iCloud credentials than on an unlocked physical device. So iphone without 2FA is less secure than android. E.g. if I wanted to spy on my partner I'd prefer she had an iphone.

<comment><USER22> But you stil have to have physical access to the person phone to install the app.

If they can do all they claim they can do on a non jail broken iOS device (and they have a disclaimer that all features don't work on all version of iOS), I would be amazed.

</comment></comment></comment><comment><USER24> I find this level of incompetence hard to believe. Is it possible that the company knowingly and intentionally left the collected data and their customers list unprotected to secretly channel it somewhere else? It would at least give them the opportunity to state incompetence if they should ever be accused of selling their customers private data on the dark market.

<comment><USER25> It's completely easy to believe. People are releasing crap software under the guise of MVP.

<comment><USER26> I watched with fascination on Twitch the other day someone programming a point of sale system, the dev was an older guy who said he'd been programming from 85 and was coding in C# (which is similar to me). First thing that struck me was the file he was editing he had a connection string embedded in the code, with what looked like the real plaintext credentials for the database. I then watched with interest as each query he copy pasted the connection string and other code for querying and then tried to create new queries by appending strings together with variables. I tried to give him some constructive advice, but he said "I'm in a bit of a rush, I just want to get this working". I watched for another 30 minutes or so as he tried to get it working. It was trivial what he wanted to do, he annouced how he hated SQL and has spent years writing sql and huge massive queries. Yet his problem was easily solvable with SQL. Looking at the code, it seems to have been done over quite some time and was really really really bad and really insecure. But the "just need to get it done any way possible" attitude means it will get deployed like that.

<comment><USER25> In a nutshell .. that's what the whole MVP thing is about. The minimal you have to do so business can sell immediately.

</comment></comment></comment></comment><comment><USER27> Well, they may as well set up a website with subpages per spyed device, and per device's collected content types, and just make it official that they are publishing third party information to the whole f __*ing world.

Wow. And their customers are likely not going to know enough or care enough to realize how much privacy they've lost.

<comment><USER28> > how much privacy they've lost

You mean that those who they've been spying on have lost?

</comment></comment><comment><USER29> It's not a "breach" when there were no defenses.

</comment><comment><USER30> Incredibly difficult to even figure out who the company behind Spyfone is. Anyone know?

</comment><comment><USER31> The most unfortunate side, is that the data isn't exactly that of their customers.

</comment><comment><USER32> "Every day our team takes great strides to enhance our site's security and we certainly anticipate that this recent data breach is the last,"

Yeah, granting public access to s3 buckets sounds like a great effort to enhance data security

</comment><comment><USER33> Here's the irony: For the last few weeks, my Facebook feed has been plastered with scare stories about certain apps being unsafe for kids. People posting image macros about things like Roblox, getting 50+ responses about how scary it is.

This situation, which imo is a real danger, will get 0 attention outside the tech community.

I really wish I had an answer. Maybe I should make of this or something in order to make people share it.

</comment><comment><USER34> Spyfone Supported devices:

\- Android operating system must be Android 4.0 or higher.

\- iOS operating system must be iOS 7 to iOS 8.4 or iOS 9.0 to 9.1 (Oct 2015)

Just make sure your target is not using iPhone :)

[https://spyfone.com/compatibility-policy/](https://spyfone.com/compatibility- policy/)

</comment><comment><USER35> > _"Every day our team takes great strides to enhance our site's security and > we certainly anticipate that this recent data breach is the last," McBroom > said._

Holy shit. They left an Amazon S3 bucket wide open, their admin site was wide open, and their API stream of contacts was wide open.

Their concept of secuity is non-existant and they think this will be the last breach?

I doubt you'd hear any competent IT director ever say they won't experience data breaches in the future.

The incompetency is mind boggling.

<comment><USER36> Yeah. I mean, at what point does this level of neglect become criminal?

<comment><USER37> I actually don't think it needs to be criminal. We just need civil laws that make these kind of leaks incredibly costly.

Maybe liability for private information loss could be $10k a user. So, Equifax would owe the public 1.4 trillion dollars. Of course, they wouldn't be able to pay that, so the company would be chopped up into bits and sold for scrap.

I think _that_ would catch more attention than some mid-level manager fall guy going to jail for six months, as would likely be the case with criminal proceedings.

<comment><USER38> _Maybe liability for private information loss could be $10k a user._

Or maybe up to 4% of the company's revenue.

<comment><USER39> Up to 4% of the company's revenue doesn't solve much. Depending on the sector, 4% of revenue (are we talking EBITDA?) may potentially be less than a slap on the wrist, and internally middle-management will take the blame for the reduction in sales margin/operating profit.

<comment><USER40> The above comment is almost certainly a reference to GDPR, for which the maximum penalty for malicious non-compliance is "up to 4 % of the total worldwide annual turnover." It is not net income or profit or EBIDTA or anything else that subtracts operating cost, it is revenue.

</comment></comment></comment></comment></comment></comment><comment><USER23> My gf was stalked by an ex using this type of crap. Had to wipe her phone and change her cloud credentails. Still worry my personal photos are now floating around on the web.

</comment><comment><USER41> Well at least this company is trying to solve the problems! So many times this ends up with the company attacking the researcher.

</comment><comment><USER42> The copy on that "EULA" is in poor English.

Also, anyone who uses an app/service like this, and that service has the word "spy" in their company/product name deserves to have their data and identity compromised.

<comment><USER43> Perhaps. But those that they spy on (spouses, children, employees..) don't.

<comment><USER35> Not even perhaps. Stop blaming the victims.</comment></comment></comment>


Ask HN: A spammer is spoofing my email address; what do I do? - <AUTHOR> About every 15 seconds all day, another Mail Delivery Subsystem Status Notification Failure pops in from random servers around the world for some email that supposedly I sent, but of course did not. Apparently someone is sending out thousands of emails as coming from my address, and there is nothing I can do about it, right? Here are my questions:<p>1) Or, is there something I can do about this? 2) Will this cause my email address to end up on blacklists and cause me significant problems? 3) Why in 2016 are Internet mechanisms not in place to prevent stuff like this? <comment><USER2> This is commonly known as a Joe Job - [https://en.wikipedia.org/wiki/Joe_job](https://en.wikipedia.org/wiki/Joe_job)

Steps to mitigate.

1\. Setup SPF immediately. You can validate your records here- [http://www.kitterman.com/spf/validate.html](http://www.kitterman.com/spf/validate.html)

You'll have to know who you send email through and their SPF record, but a quick googling of "provider name SPF" should get you what you need.

Depending on your DNS provider the results may be instant.

2\. Filter those bounces keep them out of your inbox - it's going to take while until this clears up.

3\. Make sure that YOU are not hacked, check the headers of the bounce back messages here - [http://mxtoolbox.com/EmailHeaders.aspx](http://mxtoolbox.com/EmailHeaders.aspx)

Ensure that your IP or hostname is not listed there. (This includes web servers that your domain is hosted on, apps that send on your behalf etc)

4\. You can check to see if your domain is black listed - [http://mxtoolbox.com/blacklists.aspx](http://mxtoolbox.com/blacklists.aspx) probably not...but worth a check.

TL;DR - I run one of the largest spam filtering companies in the world. Happens all day to clients...it's one of the reasons people switch to us.

<comment><USER3> UPDATE: The OP is using GMail. This doesn't apply to her/him but it's still good advice so I'm keeping it up.

I think it's also worthwhile to mention DMARC: [https://dmarc.org/overview/](https://dmarc.org/overview/). Most of the major Email Service Providors (ESPs) support it.

SPF and DKIM signatures are two data points to help form an opinion about whether a message is legitimate. DMARC is your published policy about what to do with email that fails SPF and DKIM. If you have the strictest DMARC policy along with good SPF and DKIM records, and you're signing all your outgoing email correctly with DKIM, then this should solve your problem.

It's recommended to start with the most permissive DMARC settings (p=none) so you can make sure you don't prematurely block your own outgoing email.

I work for one of the larger (by market share) "send email via an API" services. This is a common issue we come across with our customers.

<comment><USER4> +1 for DMARC - you can set your policy to ask the recipient to reject (or mark as spam) anything that fails the DMARC check. But yes, it is tricky to get right, so go for no action initially and monitor the reports.

</comment></comment></comment><comment><USER5> There are already mechanisms to prevent the spoofing of legit email addresses. See details below:

DKIM - [https://support.google.com/a/answer/174124?hl=en](https://support.google.com/a/answer/174124?hl=en)

SPF - [https://support.google.com/a/answer/33786?hl=en](https://support.google.com/a/answer/33786?hl=en)

Dmarc - [https://support.google.com/a/answer/2466580?hl=en](https://support.google.com/a/answer/2466580?hl=en)

However, implementing needs support from your email/hosting provider.

<comment><USER6> I used to work on Spam, Abuse and Deliverability for Google Apps and am one of the original authors of those help center articles (although they have been changed a bunch since).

Can you share the full message headers of one of these bounces you are receiving? Feel free to redact your email address. [https://support.google.com/mail/answer/22454?hl=en](https://support.google.com/mail/answer/22454?hl=en)

Edit: I left Google in 2013

<comment><USER7> I switched my domain away from Google Apps to Fastmail because Google was hard bouncing emails that I sent to other Google Apps domains. I had both SPF and DKIM set up correctly. I could send emails to gmail.com addresses just fine, and to Google Apps addresses that weren't aliases (which Google implements via groups as I recall). But anything that went to a Google Apps destination address that was a group alias would bounce. I was on the grandfathered free tier so I coudldn't really complain, but it was the final straw the drove me to Fastmail. Now I can email those same addresses which used to bounce just fine.

<comment><USER6> Google Apps does have email aliases (they are really just pointers to regular Google Apps Gmail accounts).

Google Groups uses a different sub system internally, and if you don't have SPF configured (or configured it wrong) it definitely rejects messages aggressively or queues them for moderation.

Virtually every problem where legitimate mail to any of your Google Apps email addresses (or groups) bounced could be addressed by adding DKIM and SPF. Some folks have strange dual delivery set ups, or perhaps use an outbound gateway server (for compliance filtering, journaling etc) - in those cases you definitely need to adjust the SPF records accordingly.

I never tried Fastmail before, maybe I'll check it out :)

<comment><USER7> I'm fairly certain I had DKIM and SPF set up correctly. It was literally only when emailing another Google Apps+Google Group address that bounced. It looked like this:

        Delivery to the following recipient failed permanently:

        firstname.lastname@example.com

        Technical details of permanent failure:

        Message rejected by Google Groups. Please visit http://mail.google.com/support/bin/answer.py?hl=en&answer=188131 to review our Bulk Email Senders Guidelines.

Full headers:

        X-Received: by 10.55.15.30 with SMTP id z30mr25314313qkg.47.1440345211659;
               Sun, 23 Aug 2015 08:53:31 -0700 (PDT)
        Return-Path: <email@example.com>
        Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com. [2607:f8b0:400d:c09::232])
               by mx.google.com with ESMTPS id 136si23593726qhc.102.2015.08.23.08.53.31
               for <email@example.com>
               (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
               Sun, 23 Aug 2015 08:53:31 -0700 (PDT)
        Received-SPF: pass (google.com: domain of firstname.lastname@example.com designates 2607:f8b0:400d:c09::232 as permitted sender) client-ip=2607:f8b0:400d:c09::232;
        Authentication-Results: mx.google.com;
              spf=pass (google.com: domain of email@example.com designates 2607:f8b0:400d:c09::232 as permitted sender) email@example.com;
              dkim=pass firstname.lastname@example.com
        Received: by qkda128 with SMTP id a128so5917057qkd.3
               for <email@example.com>; Sun, 23 Aug 2015 08:53:31 -0700 (PDT)
        DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
               d=example.org; s=google;
               h=from:content-type:content-transfer-encoding:mime-version:subject
                :message-id:date:to;
               bh=D6Jgw+8F97OpSz0ORbLuvcih9KdhWrTFusiNkbOms2w=;
               b=0X7YTsfGYQ31fR8zT8Vc4+7iYOtUmQT/kNx7SKdNyx9GxPPHo9kTqFxWhBHEKUbLiU
                zd0iFHh12IVn993lvSIkBLIBHnTaQSxgt7vpxCKhSGlvuJ1jbocHtCmYvF+FNwyiZAgE
                SNiTXBBmxCc7Z4g9GW0PGDz0hNbRp+PBJfabY=
        X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
               d=1e100.net; s=20130820;
               h=x-gm-message-state:from:content-type:content-transfer-encoding
                :mime-version:subject:message-id:date:to;
               bh=D6Jgw+8F97OpSz0ORbLuvcih9KdhWrTFusiNkbOms2w=;
               b=DfuecqdbbnVwcjQsa8Aon9ukQYC43RYb5V3uWnb3ayZzZagDyT7aVg8StcSjh9HsFZ
                +OPKwfULiQc9u3twxq5h/Q7urZQIlY/FVyBAXQbikK+c8rzfb9nB+2cSBZHPYrlgU0hd
                ZO/n0x7x6OsCOWePFVcO2sc9EEO6+YsoeapsnzAaWKgYxF2T8v34UPimKPKBtphJ7N3a
                W7anf2KbbGcsXSQiz+EfWgeNwhLMKSk5V8g0aXrCSMDXcPf20NW6NnKbcYms/rOIQRSM
                +J44wGA+rau6Wv+/0GA+XkGUOYpISMC2ATrEOO9/6XmmQSGmo3vb4oUSg9UmUCNGSVzY
                wKWg==
        X-Gm-Message-State: ALoCoQkfkZy/EZ2g8DXjWbFZEEaJou2F+r9Vhn5u4/H4A+bq9ZT/2IYeptS95RrShLFAzNDp9Bwd
        X-Received: by 10.55.21.140 with SMTP id 12mr3454160qkv.31.1440345211394;
               Sun, 23 Aug 2015 08:53:31 -0700 (PDT)
        Return-Path: <email@example.com>
        Received: from [192.168.1.131] (cpe-XXX-XX-XXX-XXX.nc.res.rr.com. [XXX.XX.XXX.XXX])
               by smtp.gmail.com with ESMTPSA id x201sm9160834qkx.28.2015.08.23.08.53.30
               for <firstname.lastname@example.com>
               (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
               Sun, 23 Aug 2015 08:53:30 -0700 (PDT)
        From: js2 <email@example.com>

This would fail 100% of the time when mailing any other Google Apps+Google Groups address, no matter the message content. I had failures from three separate Google Apps hosted domains over the course of a year. Once I moved my domain from Google Apps to Fastmail, this stopped happening.

Yes, I pay Fastmail and I wasn't paying for Google Apps. But I also get responsive support from Fastmail, IMAP push to iOS devices, more flexibility in delivery rules, etc.

<comment><USER6> Google Groups has a feature to automatically reject messages it considers to be Spam. That feature has always been quite terrible. The Google Groups Backend hasn't changed in a very long time.

[https://support.google.com/groups/answer/2627595?hl=en](https://support.google.com/groups/answer/2627595?hl=en)

I personally always disable it for public groups and then rely on Spam filtering of the recipient inbox.

By the way - the bounce message you are seeing is what is sent when the Spam Classification Server determined your message to be Spam. The main reasons for that are things like sending from a bad IP, having certain keywords that are strongly correlated with Spam, or having domains in your message that are associated with Spam (based on other messages having been marked as Spam containing those domains).

<comment><USER7> Re: Spam Classification Server. The problem went away when I moved my domain away from Google Apps. Literally, the exact same test message that I could not send when I had my domain on Google Apps, I could send once my domain was on Fastmail. Nothing changed, but that my message was now routing via Fastmail's SMTP servers vs the Google Apps SMTP servers. Same message content, same client IP, same MUA, same destination (I had a friend with a Google Apps domain setup a test group for me to send to on his domain).

<comment><USER6> So you are saying:

Google Apps SMTP -> Google Apps Group (different domain) == FAIL

Fastmail SMTP -> Google Apps Group (different domain) == SUCCESS?

It's been a long time since I looked at this. We did have great internal tools to look up the classification of individual messages, including the top 10 deciding reasons for a given message classification. With a paid Google Apps domain a support rep investigating your ticket would eventually look at this tool to figure out what's going on.

<comment><USER7> Yup, that's what was happening. Re: a paid account, I decided Fastmail was a better fit for my needs. Besides that, the problem was on the receiving end. So I somewhat disagree that I should have had to pay Google for someone to look into that.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I had to deal with a joe-job problem once, but it was over a decade ago. I was getting over 20,000 email bounces an hour. I looked at the spam emails, and put considerable work into hassling the hosting providers that were hosting the spam targets. I had the advantage that I owned the domain name as a registered trademark, and could go after the hosting site as assisting in trademark infringement.

Once I discovered that the spammer was doing credit card fraud, and paying for their hosting with stolen credit cards, my conversations with hosting companies became even more effective, and the target sites were shut down within hours. Finally, the spammer retreated to an ISP in St. Petersburgh, Russia. It took a while, but it turned out that the CEO was an American expat, and we had some mutual friends. We had a nice chat. He told me the problem would be taken care of. The spam stopped shortly thereafter and never resumed.

It's much harder now, because spammers use botnets. On the other hand, after the CAN-SPAM act, "legitimate" spamming almost disappeared. Nobody spams from their own site any more, because spam filters will blacklist them. If they spam with phony origination, they're a crook, and can be prosecuted, so nobody legit spams with a phony source. The stuff that's left is all criminal, and because the number of spammer crooks really isn't that large, the spam gets picked up by classifiers that can see the commonality across destinations. (That's Gmail's edge.)

</comment><comment><USER9> I had this problem. Back when I finally took action I was receiving 500+ bounce notifications a day.

If you fully and correctly implement SPF[1], DKIM[2], and DMARC[3], you'll see a massive improvement as much of the SPAM gets dropped completely at recipient MTAs.

To fully solve the problem, you need something to filter the backscatter[4] . At the time I purchased Postini, but now that Google has bought them, Google Apps for Work seems to have this feature built in. There may also be software you can run on your own server, or other proxy services like Postini. I've not looked since I use Google Apps for work. Such filters simply track all outgoing messages you send, and reject bounces from addresses and domains you never emailed.

This has complete solved my problem. Now I only get regular SPAM, a fact of life now.

In practice, all these things together look like this for kogir.com:

        @ IN TXT "v=spf1 redirect=_spf.google.com"
    	_dmarc IN TXT "v=DMARC1; adkim=r; aspf=r; p=reject; pct=100; rf=afrf; ri=86400; rua=mailto:email@example.com; ruf=mailto:email@example.com; sp=reject;"
        mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCFlfDA1Gpz8BQVpcNsiDkSp6ayVCWKlfeYXhiW0CaCgJJJkBpZj9E9OGMGUSAFFgEhCs8wf/fZCx9jsWkH34joEuylNnBnGt8exPSokLwrtubTQajOZcUgbpUlxwyCkyuE41mbpYUfWkPCOaRTa1VqZVWYs+ZdEkYaKXh9UALYeQIDAQAB"

The _sp=reject_ in the DMARC record is very important, but only works if all valid email from your domain will pass both the SPF and DKIM checks.

[1] [http://www.openspf.org/](http://www.openspf.org/)

[2] [http://www.dkim.org/](http://www.dkim.org/)

[3] [https://dmarc.org/](https://dmarc.org/)

[4] [https://en.wikipedia.org/wiki/Backscatter_(email)](https://en.wikipedia.org/wiki/Backscatter_\(email\))

<comment><USER10> > The sp=reject in the DMARC record is very important

sp=reject is already implied by your p=reject. You only ever need to specify sp= when it is different from your p=.

Additionally, adkim=r; aspf=r; pct=100; rf=afrf; and ri=86400; are all implicit defaults.

<comment><USER9> You're right, I just looked for reject and picked the first I saw.

As for the defaults, you have much more faith in other people's correct implementation of them than I do. Why not just be explicit?

<comment><USER11> do you think QA has done a better job testing the default implementation or flag permutations?

</comment></comment></comment></comment><comment><USER12> Postmark has a free tool to set up and monitor DMARC, which is another policy setting that can be used (if you own your domain) so that major email providers know whether or not to trust an email claiming to be from you. Postmark's tool lets you get digests and nice visuals of these automated ISP reports rather than you figuring out how to parse the XML they'd normally send directly to you.

Disclosure: I'm not at all affiliated with Postmark, I use their free tier transactional emails, and I use their DMARC tool.

[https://dmarc.postmarkapp.com](https://dmarc.postmarkapp.com)

</comment><comment><USER13> Not very helpful, but a neat story:

When I was a kid on AOL in ~2000 I made some script-kiddie mad and he did this to me. One angry person replied to me, and I explained what was going on. He took some convincing, but eventually he believed me. He became my good friend --I've even met him in person. I'm really thankful it happened.

</comment><comment><USER14> Everyone here told you that you have to use spf. But beaware that you need to put the directive -all and not the ~all. Just take care of this point as it's very important!

Second please check all of your systems that your email password is entered atleast once. Maybe a system has a spyware or virus or something.

Third change your email's password.

Except you are 100% sure that the spammer is not using your MTA then you just use an spf with the -all directive!

</comment><comment><USER15> It's extremely annoying, but usually the attacker will switch to another domain after a few hours or days. The mail notifications can be delayed by a few days, depending on the individual mail server's settings, so you should see a slowdown of the incoming bounce messages after a while before it will stop eventually.

</comment><comment><USER16> This actually just happened to me yesterday. The spammer actually added a SPF record for another host he apparently had control of.

Removing the bad SPF record and updating passwords fix it for me.

Still waiting on my web hosting provider to see if it was changed from my account with a valid login or if they were compromised in some way.

</comment><comment><USER17> In addition to all the other excellent answers:

Change your password. Check your settings for unknown API tokens or any app you may have given to the permission to access your Google account.

</comment><comment><USER18> IMO, this is a good reason to use a provider that will let you use your own domain. I recommend Fastmail. I've been using them for a while and have been very happy with them. The chances of some spammer spoofing firstname.lastname@example.com are much smaller than with email@example.com.

<comment><USER19> True, unless you have a wildcard user for your domain. Whenever I give out my email, I typically add a unique identifier to the user name, so I can have something like "firstname.lastname@example.com". Then if I start getting spam, I know who leaked my email address.

The problem that happened then is someone was using random firstname.lastname@example.com causing the blowback spam to fill up my mail box. Until I added SPF, then hadn't had an issue since.

<comment><USER20> There is a standard syntax for subaddresses with '+' suffix, e.g. firstname.lastname@example.com: the replies will end up at firstname.lastname@example.com. Wildcards in email domains are a bad idea and been so for many years.

[https://en.wikipedia.org/wiki/Email_address#Sub- addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing)

<comment><USER21> The problem with using a standard convention for this sort of thing is that it's easy to detect and subvert (in this case, drop the + character and everything following it from the username).

If I sign up for, say, a Sears mailing list with the address email@example.com, it's not possible to divine what my "real" email address is.

What are the arguments for this being a bad idea?

<comment><USER20> You can just use one subscription address for all unimportant services, thus using e.g. firstname.lastname@example.com.

> What are the arguments for this being a bad idea?

It enables spammers _and_ makes you vulnerable to their backscatter, and there is no good way around it.

<comment><USER22> _You can just use one subscription address for all unimportant services, thus using e.g. firstname.lastname@example.com._

Yes, but if they drop the "+sears" part, you lose the tracking information.

What do you mean by wildcard emails enabling spammers?

Backscatter is not really a problem, I just filter non-whitelisted addresses to another folder which deletes them after a short while. Known problematic address get filtered to /dev/null. This is really easy to do with Sieve.

</comment></comment></comment></comment></comment></comment><comment><USER23> Do check that no one has hacked your email and is sending from it. You said that its a gmail account; spf will all be allready setup.

It's quite common to see people have their gmail accounts hacked and used for spam.

<comment><AUTHOR> I assume if it was hacked, I'd see the sent mails in my sent folder or in trash, no? I have 2-factor setup on my account so I doubt it was hacked.

<comment><USER24> Go through this Security Checkup of your Google account just to be sure:

[https://security.google.com/settings/security/secureaccount](https://security.google.com/settings/security/secureaccount)

I use 2-factor auth, but I had a significant discrepancy in this checkup recently that I'm still trying to understand.

</comment></comment></comment><comment><USER25> is this a yahoo/gmail or similar , or are you using your own domain. You won't get blacklisted if someone is spoofing your yahoo/gmail because their already are mechanisms to validate spoof'd vs legitimate messages. If you are using your own domain look into setting up SPF , DKIM and DMARC records .

<comment><AUTHOR> It's my gmail account. According to a doc I just find on Gmail's site, they recommend reporting the bounced messages themselves as Spam, so I've done that.

<comment><USER3> Because GMail uses SPF, DKIM, and DMARC effectively, I'd say you shouldn't worry about it in general. And I can't really think of anything you could do short of using another email address or provider.

The major email service providers (GMail, Yahoo, Hotmail, iCloud, AOL, Comcast) should already be sticking these spoofed emails in their recipients' spam folders.

If you rely on communication with a less- or un-managed email server, then you might have issues, since they might not be filtering based off of SPF, DKIM signatures, or DMARC policy.</comment></comment></comment>


Space Between Inline Block Elements - <AUTHOR> http://nocode.in/space-between-inline-block-elements/ <comment><AUTHOR> Really cool stuff. Thought to share it.</comment>


Google experiments with no navigation bar on all its sites - <AUTHOR> http://thenextweb.com/google/2013/03/17/after-testing-a-new-grid-menu-on-its-homepage-google-experiments-with-no-navigation-bar-on-all-its-sites/ <comment><USER2> I actually think it _would_ be better without the navbar.

Google is my homepage, but when I want to go to Google Drive or Gmail, I type "drive" or "mail" into Chrome's search bar. I think the Chrome-OS-like menu would be better than the navbar. If they do remove it, they should at least make a point to maintain a page with links to all their services.

<comment><USER3> Frankly it does look way better without the navbar. I never understood this move by Google of making that bar black; I guess there was some discussion internally along the lines of "yes, it looks like crap, but we have the data here and it shows people are engaging with the navbar 240% more than before!".

<comment><USER2> Yeah. Aesthetically, the black bar with its fat Arial (I think) characters looks out of place. I know they're trying to keep things simple to make their page load time super fast, but if someone can make the Matrix in JS with like 700 bytes, I think Google could make a unique, attractive menu to replace what it has now.

</comment></comment></comment><comment><USER4> This makes sense to me. The black navbar is all links with no context. A link in-context is much more valuable: instead of a link to "play" on the top, they can put links to relevant app or media purchases in the search results. instead of a link to 'calendar' at the top when you're using gmail, calendar events can show up in the gmail UI. Instead of a link to +, they've got personal search results showing up.

the other thing i've been seeing lately is google-now style notifications in the top corner of many google properties showing my google+ contacts' birthdays. If they expand that from just birthdays to a full-on google now experience, that's a whole lot more in-context links to google properties.

<comment><USER5> Now is also getting built into Chrome.

[https://plus.google.com/100132233764003563318/posts/idTrXBfo...](https://plus.google.com/100132233764003563318/posts/idTrXBfoKN3)

<comment><USER6> RSS should not be a core functionality of a web browser but guess what should? Google Now... I like Google Now but why can't it be implemented as an extension? Does it really make sense to have Google services entangled with the browser? With sync it is at least possible to deploy your own server even if the option is hidden behind a flag (and google refuses to add an option in the UI). And then there is the new tab page with another search bar just some hundred pixels below the omnibar that has the same functionality. And a new launcher... When applications start implementing their own launchers it's usually a sign they are becoming bloated. Remember Nero (not so) SmartStart?

This a team of amazingly smart people who reinvented the browser so probably there are good reasons supporting these decisions and I'm not smart enough to understand them.

<comment><USER4> it is being implemented as an extension...

</comment></comment></comment></comment><comment><USER7> I think both experiments are consistent with the idea of thinking of the different Google properties as individual apps, and with Chrome apps becoming first-class apps.

Thus on ChromeOS you would access gmail through the menu of applications (not by going to google.com and clicking on the mail link on top). If I click on the Gmail "app" on ChromeOS it's confusing if the top navbar appears, because then there are two ways to launch other apps.

The second experiment seems to be experimenting with exposing non-ChromeOS people to this notion (i.e. get everyone used to the app menu, so that it feels natural when they get ChromeOS).

It would be possible to do this by e.g. hiding the navbar only on ChromeOS; my guess is the idea is to have a consistent experience across all browsers. If you're stuck inside IE on Windows the app menu is embedded into the google page. If you're on the "brave new world" of ChromeOS the app menu is native. But if the navbar isn't there on ChromeOS, then it can't be there on IE.

</comment><comment><USER8> I'm surprised that OP is so surprised.

I'd suspect that the vast majority of users never click on the top nav bar, have tuned it out completely ("banner blindness"), and will not even notice it's absence.

The banner bar also can get confusing when it has a menu item duplicating an 'inner' menu item but working somewhat different. I've at times had _two_ 'settings sprockets' icons on my page, one on the top navbar and one somewhere else, and leading to different pages. Also compare doing a google search and then clicking 'News' on the banner bar, vs clicking 'News' from the 'More' options in the menu below the searchbox (this second 'News' used to be avail without drilling down into 'More', which was either more or less confusing depending on which 'News' option you "really" wanted).

<comment><USER9> Apps for Business users do (when switching from Mail to Calendar to Drive to Sites to Groups to .... This change happened on my account last week (it has since switched back) and it was really disruptive while it lasted. I ended up installing the "Black Menu" Chrome Extension.

</comment></comment><comment><USER10> Personally, I like the navbar, I just don't like how it shortcuts services I don't use while hiding services I do use under the "More" option. For a company so bent in understanding my preferences and interests, this oversight has always puzzled me.

<comment><USER11> It started off as "shortcuts to services you use" and morphed gradually into "shortcuts to services we want you to use".

</comment></comment><comment><USER12> Google. Once the ultra-lean, to-the-point search site alternative (remember Yahoo, and the others, crammed with links and icons?). Now this once simple search page is becoming more and more unusable for those of us who still use perfectly good older hardware. The amount of "intelligence" now built into the search bar, the pre-fetching, the guessing what you're searching for before you even finish typing it... VERY frustrating.

Yes you can disable JavaScript and that helps some things but breaks a lot of other things.

I don't really care if gMail or their other "apps" are loaded down with bling and scripts that fire on every keystroke or mouse movement, because I don't use any of those things. But please, leave it off of the search page. I just want to find what I'm looking for.

<comment><USER13> I'm surprised that a person in your position would even bother to use the search page instead of your browser's search box.

</comment></comment><comment><USER14> Interesting. I've been asking them to flatten the number of information bars sinc ebeing a Chromebook beta tester. When you start counting from the outside of the browser window, some Google services had 7 layers of toolbars - tabs, browser nav, bookmarks, Google Nav, Document, Menu, toolbar (this has changed since then).

</comment><comment><USER15> I actually dislike the navbar.

I can't count how many times I've wanted to search for news about something, typed in my search, and hit "news" from the navbar rather than the results bar thus erasing my search term. Why do I have two ways to get news?

</comment><comment><USER16> About time! I logged into Google+ the other week and was frustrated how much of the top header was "position:fixed;" as you scroll down. What a waste of screen real estate.

Example: [https://www.dropbox.com/s/liv1rjcqojvblg8/Screen%20Shot%2020...](https://www.dropbox.com/s/liv1rjcqojvblg8/Screen%20Shot%202013-03-13%20at%2011.44.53%20AM.png)

</comment><comment><USER17> You should probably try the latest build of Chrome, Google is now integrated into the browser, and that navigation bar would break away from the seamless UI integration.

Not to mention it was ugly, and never contained the options I needed.

<comment><USER18> I guess that explains why this website UI change would depend on the user's browser version.

</comment></comment><comment><USER19> If they make the menu hoverable (at least on desktop) then their other products are still only a click away.

This makes more sense actually because it means more searches from Google's main homepage, because there are less options to navigate away.

It also makes the page less cluttered and gives the user 2 distinct set of actions: 1) Perform a search 2) Use a popup menu to navigate to a different product

<comment><USER8> I suspect google, like many of us, is either designing 'mobile first', or at least prioritizing mobile highly enough that they will never design a fundamental interaction that requires 'hover' to work.

<comment><USER20> It's easy enough to tap a menu to get it to open. As an iPad user, I don't think I would mind a well-designed hover-centric workflow, as long as it works okay on touch too.

It would have to be well-designed, though. Apparently it's really easy to wind up with a moronic hover-based menu, judging by the number of them I see around.

<comment><USER4> The trouble is that android doesn't support hover-events the way iOS does. On iOS taps automatically turn into hovers when there is a hover behaviour, on android a tap is always a click.

</comment></comment></comment></comment><comment><USER21> I've been saying it since 2005, navigation on websites is often counterproductive because the vast majority of people are using a search engine to find the pages/information they want. All you have to do is look at your stats to see this is true. People may say they want navigation but the metrics say otherwise.

Meanwhile, according to Matt Cutts, Google has been penalizing websites with "bad navigation" (which is totally subjective, but I digress) meanwhile I'm nudging Google, "You guys are in the search business, don't you want people SEARCHING for pages instead of navigating to them?"

People want to search for pages. So why is Google discouraging them from searching and encouraging them to navigate, when first and foremost they are a search engine?

<comment><USER21> And let me state the obvious: most of the time search is faster than navigation. Several clicks and realizing your information is not available or not where it should be or not comprehensive enough vs. search which takes you directly to the most relevant result.

</comment></comment><comment><USER22> Doesn't much matter to me. I'm addicted to the DuckDuckGo bang syntax anyway...

<comment><USER23> I had DDG with HTML5 voice recognition on my site for a while, but after consulting with Gabriel decided it was a data leak to Google. Can't wait for voice to be a seamless part of the real web stack. Still, a keyboard shortcut gets you to the searchbar and then you can bang on to anywhere else on the web. jkl.io if you want to try it. I will change the font in the search box soon. Keyboard shortcuts for the categories are underlined. I want to make it a suitable start page (like some kind of zen Yahoo I suppose). Feedback appreciated (although by Sunday the news thins out for Science and some others).

</comment></comment><comment><USER24> How about a large button labelled start.

</comment><comment><USER25> <https://encrypted.google.com> has had that navbar-less format for several months now. Looks like they are trying to unify them. They've also changed who signs the SSL certs: <https://www.google.com> used to be signed by Thawte but is now signed by the Google Internet Authority (root GeoTrust), which encrypted.google.com has used for as long as I can remember.

</comment><comment><USER26> Next they could maybe cut down on the UI of Google Books.

<http://i.imgur.com/BXvRdwq.png>

It is often convenient to have the browser window small when working at something else beside it.

</comment><comment><USER27> I wonder if they tested that after logging in. Maybe it doesn't make sense to offer the other services if you are not logged in?

<comment><USER28> I just tried, signed out: no navbar, signed in: navbar.

<comment><AUTHOR> On Chrome Canary, I get no navbar whether I'm signed in or not.</comment></comment></comment>


Ask HN: What Social Media are you using outside HN? - <AUTHOR> Looking to hear where else you are visiting.
I flip between Reddit, HN, and instagram. Currently losing interest in IG since I feel like I see lots of repeated content.
Where else are you visiting? <comment><USER2> Facebook: All the time. Virtually everyone I know, virtually every event I go to, virtually every business I frequent keeps their content up to date. I derive great value from it.

Twitter: Hate it with a passion. Primarily use it at conference and other such ad-hoc gatherings. Impenetrable UX (I still have no idea how anything works after 10 years of trying), impossible to get the feed working the way I want it, horrible use of space (somehow way less efficient than Facebook even though it's supposed to be for short messages), threading/replies/etc impossible to follow.

Strava: Post all workouts (multiple per day between bicycle/run/peloton/etc). Follow a handful of people. Non-addictive but I don't necessarily derive a ton of enjoyment from it either. Great for tracking my workout data but the 'social' part is something i don't much care about either way.

Reddit: Almost never; makes me feel like an old grump complaining about 'kids these days'. Every subreddit I try makes me feel like it's 1996 again and everything is new, and everyone is wowed by the same old stuff and rehashing the same old political/religious/etc arguments. It feels 20 years out of date to me. I keep hearing you just need to find the 'right' subreddits for you, but so far, no luck.

Instagram: I use it/post fairly regularly. Not quite sure why. I don't enjoy it more than when I see the same pictures on Facebook.

Likely the way I derive value from these things is that I don't care about brands/influencers/etc. People who really like Instagram and Twitter seem to care more deeply than I do about random people they've never met. The reason I derive more value from Facebook than any of the others is REAL people I actually known and care about are there, and their content interests me. I have no more use for 'online personalities' than I have for reality TV.

</comment><comment><USER3> Tumblr - still the most reliable place to find portfolio art blogs that update every now and then without the opinion fluff. While I do have an art-only blog, I use it mostly for my (separate) personal blog for genuine essays & scrapbooking of interesting links across the internet. May eventually migrate to dreamwidth, though I'm going to miss being able to reblog other folks artwork.

Twitter - self promotion via posting art and chatting with industry folks, but no real feed-reading.

Mastodon - a clone of twitter, see above.

Inoreader - RSS feed reader for all the actual consuming once every ~2 weeks.

Overall - almost non-existent consuming other than the personal blog ... what can I say, I like it nice and quiet. :)

</comment><comment><USER4> Twitter: I follow Christian leaders I respect as well as a bunch of software developers and some software projects

Facebook: I have a small number of friends on Facebook, but I never use it for posting personal things about my life, just to follow people.

RSS: I follow a lot of software projects, software developer blogs, and some Christian leaders/bloggers. This overlaps with Twitter to some extent but more for interesting articles or product updates that I don't want to miss.

Reddit: I follow some tech and software dev reddits, but it seems like there are too many beginner questions rather than interesting discussions

Blog: I have a blog in the works, not actively writing on it yet

<comment><USER5> > I follow Christian leaders I respect

That made me wonder if Jesus Chris was alive today whether he would have a twitter account for you to follow.

<comment><USER6> Well, the Pope does.

<comment><USER5> There is a bit of a difference between the Pope and Jesus Christ himself. In fact if Jesus Christ were alive I don't think we'd be in much need for a Pope (and you'd be calling him Saint Peter).

</comment></comment></comment></comment><comment><USER7> Twitter: I follow mostly programming related accounts.

Instagram: Follow church related stuff

Facebook: All my close friends and family, and some groups

LinkedIn: Don't really accept connect requests from people i don't know, so just really professional connections.

Reddit: I follow some bike subreddits, and some tech, try to avoid r/all

HN: For the news

<comment><USER8> lol, i don't want to make assumptions, but it's hard to not wonder if this post is being downvoted simply because it mentions "church"...

<comment><USER9> Yep, someone (or a group of someones) went through and downvoted the two posts mentioning "church".

The moderator abuse on HN makes me want to find another "social network" site to waste my precious time on.

(and, yes, I do in fact know this post will get downvoted because it is "uninteresting" to talk about people abusing the moderation system but, as they say, karma's a bitch)

</comment></comment></comment><comment><USER10> Mostly Reddit and (sigh) Facebook. Recently I've been experimenting both Mastodon and micro.blog [^0]. Different approaches to federation/decentralization, both quite interesting.

[^0]: [https://micro.blog/](https://micro.blog/)

</comment><comment><USER11> I use Nuzzel to track things shared by multiple people that I follow on various platforms such as Twitter that are trending over a given timeframe.

Great if you are interested in getting news from a niche area - let's say you follow 10 high profile VR people on twitter, and then half of them post an article about some VR thing, I'll see that on Nuzzel, and I won't have to scroll through Twitter and mentally cluster/count to know about the hot new thing in VR that VR people are talking about.

[http://nuzzel.com/](http://nuzzel.com/)

</comment><comment><USER12> Facebook:

        * Groups: My primary use of Facebook.  I'm involved with several local and special interest groups.

        * Messenger: It's better than SMS.

        * Videos: The video system is really good, and I've subscribed to several channels.  Mostly industry, intellectual, and educational channels.

        * Walls: When I ask myself "I wounder what that person I fell out of touch with 2 years ago is up to" this is where I go.

        * Events: If I feel the need to go out and get some R&R but I don't have any plans I check this for things to do.

LinkedIn: Early in my career I created a LinkedIn page. I've received several job offers from it over the years, and even accepted two. I keep it up, and use it as a reference to build my resume. If I'm considering switching offices I flip that switch to get a feel for the current local labor market and how it matches with my skill set.

IRC: Classics never die.

Special interest webforms: Another place to meet people with similar hobbies.

Discord: This is starting to take over IRC in several communities I am involved in. It's Slack for fun things instead of work things. I watch about a dozen topics in a half dozen "servers".

</comment><comment><USER13> Facebook: Eh, I don't check it but I use Messenger at least a few times a day. Events is neat but I never go to any. It was useful for flat hunting because there's a closed group on there with about 70K people in my city. Things like that are pretty priceless.

Twitter: I like Twitter but it took me a few years to get it. I follow a mix of shitposting anime avatars and more serious accounts which I should prune this weekend come to think of it. I've slowly transitioned over time from one of those shitposting accounts to just using my actual name and photo. It's good fun but only if you don't take it seriously.

Reddit: It's great for searching for specific communities ie: /r/thatpeelingfeeling or /r/depthdub but I don't use it too often unless I'm interesting in something in particular

Instagram: I post rarely. I'll sometimes post a photo of a meal if I'm with friends and jokingly say "Look at me, being a big millenial piece of shit" jokingly, haha.

RSS: I use Newsblur daily and it's super nice.

Blog: I sometimes write things but my site is more of an excuse to write code.

Snapchat: It's popular but I could care less. It feels like a chore honestly.

</comment><comment><USER14> I don't use any of the "social networks". Instead I frequent topic specific forums that are targeted towards things I'm interested in: advrider.com for motorcycle discussion, photrio.com and pentaxforums.com for photography and darkroom relegated info, gearslutz.com for synthesizer and music recording discussion.

</comment><comment><USER15> Subreddits: /r/Ireland /r/DevelEire /r/europe /r/swift+programming+webdev+unixporn+linuxmasterrace+etc (Still a reddit addict after years)

Twitter/Product Hunt (Really don't like twitter, gradually moving on)

Slack (Dislike it because of system footprint it imposes)

YouTube/Google+/GSuite

Have disliked Facebook since 2006.

</comment><comment><USER16> Subreddits: AskHistorians, SpaceX, NeutralPolitics, and a number of others.

Twitter: I follow a number of intellectuals I respect and hope to be linked to interesting articles and papers.

Facebook: I check for event invites as part of my daily routine but avoid reading my feed.

Newsblur: Following lots of blogs and some Tumblrs.

Blog: I don't post enough.

</comment><comment><USER17> Frequently (daily, or a couple times per day) \- reddit/imgur (news, jokes, tech stuff, etc) \- instagram (for the pics... though slowly losing interest due to the ads) \- twitter (news, fake-news, and tech stuff) \- HN (news) \- telegram (various programming channels)

Regularly (once or twice a week) \- linkedin \- ello

Infrequently (once every week or two or three or...) \- facebook (I hate it, but all my friends/family are there) \- google+ (photography groups) \- vimeo

Practically never (once a year... maybe) \- pinterest \- flickr (really just to remind myself it's still there) \- tumblr

</comment><comment><USER18> Sublevel. The design is pretty good, but it's a little lacking on features which may or may not be a good thing.

[https://sublevel.net](https://sublevel.net)

</comment><comment><USER19> IRC! It's the best system I've tried to get "social" interactions.

It's fast, text-based and the channel I'm on is populated by cool guys doing original pieces of programming (a weblink for the curious: [https://kiwiirc.com/client/irc.rizon.net?channels=#/g/dpt](https://kiwiirc.com/client/irc.rizon.net?channels=#/g/dpt)).

</comment><comment><USER20> Mostly Medium, and increasingly Linkedin. Both mostly for writing & reading blog posts.

A little bit of Twitter & Pinterest, the former for typically just for sharing my content (but I have very few followers), the latter for ideas/collections (and for work, of course).

From time to time "I" like things on Facebook, typically when my wife gets my phone and likes her posts :)

</comment><comment><USER21> Reddit but looking for an alternative, I can't seem to amalgamate the information I want to read even though I've painstakingly organised everything into multireddits in the past.

IG, PH, FB, Twitter, Indiehackers, Growthhackers, Pocket, Slack Groups, and Feedly.

ATM I'm trying to consolidate everything on Feedly and Pocket (as a read- later) but it isn't easy.

</comment><comment><USER22> [https://hubski.com](https://hubski.com) thoughtful conversations

</comment><comment><USER23> I use Marco Polo to stay in touch with family. Both my wife's family and my own discovered it a couple of months ago and it's a great immediate way to stay in touch with each others daily lives.

I use reddit to follow a very small number of specialized topics and very occasionally post.

that's it.

</comment><comment><USER24> Mastodon for general musings, art-posting and feed-scrolling

Reddit for more topic-specific stuff (mechanical keyboards, D&D etc)

SMS for person-to-person chat

I have a blog for whenever I feel like writing a blog post, or showcasing software stuff I'm working on

</comment><comment><USER25> Twitter: sadly, the UI that keeps showing me people's favorites instead of just their retweets is killing my enjoyment. I really wish they would quit screwing around with someone that should be so simple.

<comment><USER26> This was really bugging me until I realised that sorting the people I follow into lists basically reverts my feeds into a standard chronological timeline again. Minus Twitter's "screwing around", the site is actually useable. Might take a bit of work if you follow a lot of people, but it's totally been worth it for me at least.

</comment></comment><comment><USER27> I don't use social media. I have a Google+ account to share photos (and nothing else) with my family, but the bugs make that harder and harder, so I'll have to abandon it. (Any suggestions?)

<comment><USER28> Share directly from the Photos app or photos.google.com - don't go to plus.google.com, it's dead ([https://www.vanityfair.com/news/2016/06/how-mark- zuckerberg-...](https://www.vanityfair.com/news/2016/06/how-mark-zuckerberg- led-facebooks-war-to-crush-google-plus)).

<comment><USER27> Google photos is extremely buggy too, and doesn't work the way I want it to work. It's almost impossible to upload a large number of photos from a desktop machine. It inevitably dies during the upload, then I have to figure out which pictures exactly didn't upload. And then I get duplicate pictures in the album, albeit not always.

Also, the phone app is extremely adamant that I upload _ALL_ my photos to Google, which I don't want to do. If you only want to selectively upload stuff, the interface really gets in your way.

Google photos is extremely annoying because it requires me to give names to albums, while Google+ is perfectly happy with untitled posts. You can share without creating a new album... but only from your phone, not from your desktop, and if you do it from your phone you very quickly lose the reference to the untitled "album". Nor to mention that you don't have a chronological view of what you shared with whom.

Google+ had a very good permission model, Google photos lacks this, AFAICT. Also, I use a paid Google Apps account, and very often people with free Gmail accounts can't see the photos I share with them. I couldn't determine what causes this, or how to fix it. Sometimes it happens, sometimes not.

Minor gripe, but I strongly dislike the reverse chronological view used by the phone app.

With Google+, the people I shared photos with received an e-mail notification (albeit not always... again, another frustrating bug). With Google photos they get a push notification on their phone, which they dislike (perfectly understandable, IMO). Also, they could just click on the link in the e-mail and see the pictures in their browser, Google photos requires an app to be installed.

I could go on and on.

Even if Google photos would not be so spectacularly dysfunctional, I would still prefer to move away from Google services as much as it's possible.

I'd rather just use a simple, paid service where I could upload pictures (in original quality, with full EXIF data) either from the desktop or from a mobile device, and where I could share untitled posts (albums) with people who'd get the notification via e-mail and access them via the browser (or some app, but the browser must always work). The albums should be downloadable as zip files (in original quality and with full EXIF data) by the people I shared them with.

I tried SmugMug, and it kind of works, except that it doesn't support a "naked" custom domain, so example.com doesn't work, but www.example.com and pics.example.com work. This might seem like a minor gripe, but I want to do it right if I do it at all.

I am very tempted to write something myself.

</comment></comment></comment><comment><USER29> Twitter ( for the most current news on my echo chamber ) and Linkedin.

</comment><comment><USER30> Instagram for business. The rest is not needed in my life.

</comment><comment><USER31> Facebook Messenger: To chat with friends Facebook Groups: To exchange with my industry Twitter: To exchange with my industry Reddit: Fun Stomt: Feedback to Companies and to track favours. I use it like a social todo list.

</comment><comment><USER32> Mostly tech related subreddits. Like r/programming.

I have flipboard app on my phone. I have a feed for science and tech.

Twitter to follow some professionals like John Carmack.

Youtube/Google+

</comment><comment><USER33> I use [https://ello.co/](https://ello.co/) and HN. Dropped reddit, FB last year.

</comment><comment><USER34> Does Keybase count? It allows me to update various contact methods and allows strangers to contact me in a verifiable manner.

</comment><comment><USER35> Use as in actively, participating & creating content: nothing.

Use as in glansing over, stalking & timewasting: everything.

</comment><comment><USER36> \- Twitter is my main venue

\- Slack for work

\- Reddit, more for information finding

\- Facebook and Instagram periodically, maybe once a week at most

</comment><comment><USER37> Freenode IRC, for the past decade.

</comment><comment><USER38> All the ones that I'm forced to do because my friends tell me its a good idea.

</comment><comment><USER39> Snapzu!

[http://snapzu.com](http://snapzu.com)

</comment><comment><USER40> Mastodon

</comment><comment><USER41> Mastodon.social, freepo.st, and forums (does that even count?)

</comment><comment><USER42> What? HN is a social media actually!

I use Twitter and ProductHunt.

</comment><comment><USER43> Does github count?

</comment><comment><USER44> Facebook, Twitter, Linkedin, Reddit, and Google.

</comment><comment><USER45> Strava, Reddit

<comment><USER28> Strava is easily my favourite social network (if one could even call it that). It's non-addicting and the more I use it, the better I feel and more productive I am. I've never ever seen an argument on it either. Its positive flow-on effects are superb.

The heat map "revelations" earlier this year was slightly fascinating but made me wonder how many of those writing or commenting about it have actually ever used Strava.

Disclosure: I don't "race" using Strava and use "common sense" to avoid taking risks, etc - the riskiest thing to health for most people these days are sedentary activities.

</comment></comment><comment><USER46> Instagram, Twitter, Medium, YouTube.

</comment><comment><USER47> MeWe, Reddit, G+

</comment><comment><USER48> Reddit, dev.to

</comment><comment><USER49> gab.ai

the chans</comment>


The Invention of Islamophobia (2011) - <AUTHOR> http://www.signandsight.com/features/2123.html <comment><USER2> The term "Islamophobia" is in many cases a justified label for bigotry and prejudice, but I see it being used increasingly to stifle legitimate concern and criticism.

A 2015 poll of British Muslims conducted by ICM on behalf of Channel 4 found a number of attitudes that I think are genuinely worrying. 39% of respondents agreed with the statement "wives should always obey their husbands". 52% disagreed with the statement "homosexuality should be legal in Britain". 23% supported "areas of Britain in which Sharia law is introduced instead of British law". More than a third agreed with the statements "Jewish people have too much power" and "Jews have too much control over global affairs", while a quarter agreed with the statements "Jews are responsible for most of the world's wars" and "people hate Jews because of the way Jews behave".

I have been accused of Islamophobia simply for reporting on this data. Our ability to have a meaningful conversation about a significant social issue has been stifled by ideological absolutism - on one side by bigots motivated by hatred, and on the other by those who see anything but unconditional acceptance as symptomatic of bigotry.

[https://www.icmunlimited.com/wp- content/uploads/2016/04/Muli...](https://www.icmunlimited.com/wp- content/uploads/2016/04/Mulims-full-suite-data-plus-topline.pdf)

<comment><USER3> Report similar results about Jews and you'll be accused of anti-Semitism.

And stop bringing Jews into any discussion about Muslims. It's a fallacy.

</comment></comment><comment><USER4> Bruckner seems to be focusing on the word instead of the ideas behind different uses of the word. There are of course some who wish to see Islam "inviolate", and it is natural for them to use the term "Islamophobia". But there are also those who oppose different types of attacks on Islam, or different forms of fear of Islam. To resist a reflexive hatred of Islam per se is to say something that also usefully uses the word "Islamophobia". It therefore makes little sense to attack the use of the term, as opposed to (a) overly broad usage where it is unnecessary, (b) automatic assumptions that an attack on Islam is invalid, and (c) attempts to render Islam "inviolate".

[Edit] A further thought: Islam isn't homogeneous, as many point out. Just as it is generally unhelpful to attack Christianity on the basis of observations of the Roman Catholic church, so too it is probably more helpful to describe specific groups or collections of groups. This works both ways: it helps to invalidate attacks on Islam as a whole based on rare practices, but it also helps to invalidate lazy responses that rely on a small liberal group of Muslims being representative, which is about as unhelpful as denying Christian homophobia by citing the examples of a few Oxonocantabrigian liberal Anglo- Catholics.

<comment><AUTHOR> > Islam isn't homogeneous

From the text: "Above all, however, it wants to silence all those Muslims who question the Koran, who demand equality of the sexes, who claim the right to renounce religion, and who want to practice their faith freely and without submitting to the dictates of the bearded and doctrinaire."

<comment><USER4> Yes, this is an important instance of the problem with excessive generalisation. Unfortunately Bruckner ends up excessively generalising about the use of the term "Islamophobia", hence the not unjustified comments here attacking him for bigotry.

</comment></comment></comment><comment><USER5> The article is a poorly argued white supremacist screed.

<comment><USER4> I think that this is a valid initial reaction, but there is a useful point here, which unfortunately has been expressed in the middle of a combination of potential bigotry as you note, bad translation (possibly) and poor phrasing.

A reasonable attack on something then begins to use a word ("Islamophobia"). It is then used by those who seek to render Islam "inviolate". Clearly some people exist who think this, if not particularly many. Because Islamophobia can be construed as referring to any attack on Islam, there is a risk that one then incorrectly concludes from the fact that many things described as Islamophobic are bad that everything potentially Islamophobic (using the word in the broadest possible sense) is bad. Unfortunately this useful point is obscured by lots of other at least unhelpful material.

</comment></comment><comment><USER6> The term islamophobia is of french origin and dates back to at least the begining of 20th century ( _).

This fact alone gives clear indication of how serious Brukner and consorts (Fourest, Finkelkraut,etc) who have an agenda of downplaying the rise of anti- muslim bigotery on Europe.

(_) Maurice Delafosse, « L'état actuel de l'Islam dans l'Afrique occidentale française », Revue du monde musulman, vol. XI, n°V, 1910, p. 57

</comment><comment><USER7> > it denies the reality of an Islamic offensive in Europe

Stopped reading here.

There's no evidence of this.

<comment><USER8> Are you serious? The hundreds dead in terrorist attacks aren't evidence enough for you?

<comment><USER9> Are you serious ? Islam = Islamist terrorism ?

Check which religion are the first victim of Islamist terrorism in numbers and then think again...

<comment><USER8> There's a different between islamist and muslim...

<comment><USER10> Islamic is to Islamic extremist as Christian is to KKK.

We don't go judging our local Baptist congregation by the Klan and it's equally unjust to judge a Mosque full of peaceful, loving people.

<comment><USER8> Why do we have to play such word games around Islam?

When someone plants a bomb and claims to do it for christianity, I call that "Christian terrorism". When someone plants a bomb and claims to do it for islam, I call that "Islamic terrorism".

am I saying all christians are terrorists with the first statement? of course not. It would be ridiculous. am I saying all muslims are terrorist with the second statement? of course not. That would be ridiculous too.

It's about time we start calling a spade a spade.

PS: And before the "Alt right" BS starts, no, I'm not right wing, I just voted one of the most left leaning parties in my country.

</comment></comment></comment></comment></comment></comment><comment><USER11> Criticisms of ideologies is fair game.

Especially ideologies that are the source of illiberal thought and which legitimatize violence as a defensive tactic.

Islamophobia tends to get equated with discrimination towards people, however. Something which obviously should be condemned.

</comment><comment><USER12> What I find weird and annoying is that we call people who are against Islams as Islamophobics. For the most part they are not afraid of Muslims, but rather hate them. I think there reason for calling them -phobics is because it is a way to make fun of them. They are not a strong force fighting people who they hate, but rather scaredy-cats who should be ridiculed.</comment>


Stopping killer robots - <AUTHOR> http://bos.sagepub.com/content/70/1/32.full

<comment><USER2> As the article explains, the main rule of civilized war is to attack only military targets and not civilians. The authors think robots will be worse at this: " _Technical limitations mean robots could not reliably distinguish civilians from combatants, particularly in irregular warfare, and could not fulfill the requirement to judge proportionality._ "

On the contrary, I think robot soldiers will be much better at not hurting civilians. Human soldiers are actually very bad at this, as a century of televised atrocities have shown. Robot soldiers are:

\- capable of waiting to be fired upon before returning fire

\- auditable, so mistakes can be corrected or avoided next time

\- have a clear chain of command, so the military can't deny responsibility for war crimes

\- not motivated by fear, revenge or cruelty</comment>


What motivates users to add/create contents in your web service (UGC)? - <AUTHOR>

There are a lot of CGM out there, including Dribbble, Yelp, Facebook, Hacker News, and others.
What I am curious about CGM is that what motivates users to share/add/create/etc. contents within the web service.
CGM usually consists of content generator and content consumer, and it is a Chicken-and-Egg problem to start a new CGM. You need contents to bring in traffic, but you also need traffic for content makers to keep adding new contents.
What are content makers' motivation? Why would they add contents to your CGM? What are some of strategies to motivates users to create contents?
It would be great if you can share your thoughts and insights :)! <comment><USER2> What does CGM stand for?

<comment><AUTHOR> CGM stands for Consumer Generated Media :)! <http://en.wikipedia.org/wiki/User-generated_content>

<comment><USER2> Ah, I knew it by its old name of User-Generated Content.</comment></comment></comment>


How Fish and Chips Migrated to Great Britain - <AUTHOR> https://www.atlasobscura.com/articles/who-invented-fish-and-chips <comment><USER2> Interesting article however it fails to highlight the real reason for fish in a Friday, which was to do with prevention of waste.

The Church encouraged it so that the last catch on a Friday wouldn't spoil over the Sabbath. It was more out of practically than dogma from the scriptures.

Just the same as why pork has been discouraged from consumption in the middle East; it was incredibly hard to preserve it and stop it from making people ill.

<comment><USER3> Why is pork different from e.g. lamb?

<comment><USER4> Wikipedia:

>Unlike many other forms of livestock, pigs are omnivorous scavengers, eating virtually anything they come across, including carrion and refuse.

Hence tapeworms and why people don't order their pork chops rare.

<comment><USER3> But cattle also have tapeworms: [https://en.m.wikipedia.org/wiki/Taenia_saginata](https://en.m.wikipedia.org/wiki/Taenia_saginata)

Yet we do eat beef rare.

</comment></comment></comment></comment><comment><USER5> So much of our culture that we love has been cross-pollinated from elsewhere over thousands of years, it makes me sad that some people want to end that.

<comment><USER6> Integrating good things from other cultures will continue, as it always has even during the most nationalistic times in history.

The current nationalism (rather mild by historical comparison) is a counter reaction to opening up and "equalizing" everything.

I don't want a world culture where everything is the same everywhere. It's boring and the good/quirky/interesting traits of individual nations get lost.

<comment><USER7> Melancholy thoughts about how the world used to be are not helpful for the individual, anywhere. Sure, lets put half the world back into poverty because it's not boring!

I know that wasn't meant literally. We want to keep song and food and fashion distinctive, kind of like how Renaissance Fairs simulate the 1400's but without the plague and smells. But isn't that what's happening in the world anyway? Meet people from Africa or India, they are very very different from where I grew up and still very interesting. I don't think that will be lost, no matter how many internet cartoons we share.

</comment></comment></comment><comment><USER8> You know what, I hate fish and chips. Far too stodgy. The hit of deep fried carbs makes my mind feel fuzzy. It's not worth it for what's ultimately a bland meal. Maybe people who like acidic food can get past that with copious amounts of vinegar or lemon juice but I can't stand either so no hope there.

Maybe I just haven't had decent fish and chips. Most chip shops near me now double as cheap Chinese takeaways. Most have shocking food hygiene ratings.

<comment><USER9> You have clearly never had Yorkshire fish and chips.

I also note the author's ommission of mushy peas and a cup of tea, but then she isn't British, so overall a reasonable effort for a foreigner.

<comment><USER10> I had beautiful fish and chips in Whitby this year, less good ones in Settle, so Yorkshire can be variable too!

You can get a good chippy, or a bad one, anywhere in Britain. Our best local is run by a cheery Cypriot chap, in fact there are quite a lot of Cypriot chippys... but that is another story for the Atlas.

<comment><USER11> > "I had beautiful fish and chips in Whitby"

Funny you should mention Whitby, that little town was on my mind the whole time whilst reading these comments. I happened to pass through there maybe 25 years ago and the fish & chips were absolutely divine. Even today, when I think about good fish & chips, I think about Whitby.

Is there something special about that town? Is fish & chips their thing?

<comment><USER10> They are pretty well known for their fish and chips, yes.

In no particular order, Whitby is famous for

1) Jet. A black stone. Fossilized Monkey Puzzle sap. Popular for jewellery in Victorian times with the fashion for having a dead husband. 2) Fish and Chips. Although not really any better than any other seaside town. 3) Dracula landed there. 4) The Abbey, perhaps because of Dracula 5) Whale bone arch 6) Captain Cook

Pretty at some angles. Typical UK seaside of shitty amusement arcades and shops selling junk made out of shells from China from other angles.

Worth a day trip. I think most visitors go away remembering the steps...</comment></comment></comment></comment></comment>


Facebook is removing chat from mobile website - <AUTHOR> https://i.imgur.com/5WyxAeO.png <comment><AUTHOR> I could not find an article about it, that is why I submitted a screenshot here.</comment>


Clooney and Partners Sell Tequila to Diageo for $1B - <AUTHOR> https://www.bloomberg.com/news/articles/2017-06-21/diageo-to-acquire-casamigos-tequila-brand-for-up-to-1-billion <comment><AUTHOR> Assuming, wholesale prices 50% of retail, I get this sale to come out at 20X sales. High, but given its growth rate not crazy high.</comment>


Dual n-back: IQ boosting exercise - <AUTHOR> http://dual-n-back.com/

<comment><USER2> This seems to be similar to <http://cognitivefun.net> posted some time ago... Cool idea. Thanks</comment>