Deliveroo users are getting defrauded - <AUTHOR> https://www.newstatesman.com/science-tech/security/2019/01/deliveroo-users-are-getting-defrauded-and-it-could-be-fined-millions <comment><USER3> Perhaps worth mentioning, since it's nowhere in the article, that the first thing to do is not to spend hours on the phone with Deliveroo (or whoever else) but to call your bank to report the transactions as fraudulent and to block your card.

That will probably get you a refund quicker (the transactions will likely be held until clarified) and will stop any further fraud.

As for Deliveroo's support team... Not very good in my experience, but that's common. Their competitors are no better.

<comment><USER4> This is basically the sole "feature" of credit cards I value. Any time I'm buying something from somewhere that might act poorly, I use a credit card for the free leverage I have in a disagreement.

Had an old phones screen repaired at a store inside a Walmart. They fixed it but half the screen had no touch capability. They were highly resistant to doing anything about it until I said I would just do a charge back. Tone instantly changed.

<comment><USER5> I've started using privacy.com after I saw a post here on HN about it. It's pretty nice. Basically you link up your bank account and they create debit cards for any online vendors you use, and you can set limits, destroy cards etc. I usually put monthly / transactional limits. Like with Uber Eats I know I only spend x amount, if anybody tried to use my Uber Eats card for 100 USD it would decline it. But also it locks itself to the vendor you choose, so it can't be used elsewhere.

<comment><USER6> > I've started using privacy.com

Which is US only. Is there anything like it for the UK?

<comment><USER7> UK banks are already very good about refunding fraudulent transactions and associated fees:

[https://www.fca.org.uk/consumers/unauthorised-payments- accou...](https://www.fca.org.uk/consumers/unauthorised-payments-account)

"In most cases the bank must refund the payment without undue delay and by the end of the business day following the day on which it became aware of the problem, unless it has reasonable grounds for suspecting that you have acted fraudulently."

"When your bank refunds an unauthorised payment it must also refund any charges and interest you have paid because of the unauthorised transaction."

<comment><USER8> I would be very careful on this one.

Some providers are interestingly stubborn when it comes to charge backs and can hold on to the (fraudulent) vendors side even if you're clearly right.

Monzo in the UK is a prime example for that. An internet vendor charged me more than he should and refused to void the transaction (basically text-book fraud) and I filled for a charge back with monzo. I was extremely confident that it wouldn't take much however monzo customer service resisted to help.

The monetary value wasn't much however in the end I perfectly understood that this "protection" does not exist on the credit card issuer/bank side of things.

Be careful.

<comment><USER9> You didn't file for a chargeback with Monzo, because they don't offer credit cards. There's less protection generally with debit cards.

Generally guidance is that you are entitled to a refund from the bank only if you did not authorise a particular transaction.

<comment><USER8> Does it matter? The simple reason they are there is to protect my interests. If they can't do it for a few quid, how can they do it for larger sums of money?

The Moral of the Story: Money institutes may not cover you like you think they will.

I've learned my lesson.

Again, be -very- careful.

<comment><USER10> _Money institutes may not cover you like you think they will._

Not if you didn't read your debit card agreement, no. Nothing you've stated wouldn't be clearly spelled out in the agreements I've seen for debit cards. I mean, I can see how this happens: looks like a credit card, must have the same protections as what people online say about credit cards, right? Nope.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'm not surprised by this response from Deliveroo. Their focus lately has definitely moved away from customer satisfaction.

I discovered recently that drivers are allowed - without penalty - to reject an order when they reach the pickup location if they see the receipt and decide it is too far to travel [1].

As a customer you just see your food go: `Assigning Driver -> Driver En Route to Pickup -> Driver Arrived at Pickup Location -> Assigning Driver`, for two hours on repeat. Eventually your cold food arrives 2 hours later, and you are offered £5 credit for your ruined meal.

I live in Central London (Old Street), and have had this happen repeatedly with restaurants that are not far from me.

[1] = [https://www.reddit.com/r/deliveroos/comments/82w97o/riders_o...](https://www.reddit.com/r/deliveroos/comments/82w97o/riders_only_taking_close_orders/)

<comment><USER12> I think I'm old fashioned but I just don't understand the appeal of these food delivery services. My friend's son uses Postmates to order fast food and it seems absurd to me.

I must be missing something about theses services given their popularity. Do you mind explaining why you use them?

<comment><USER13> I think you are just trying to be that guy. I go to this website, pick what I want, pay and some time later what I ordered gets delivered to my door. What's there to get?

<comment><USER14> Fast food is pretty bad when it's fresh. It's awful after it's been in transit for 20-30 minutes or more. The idea of spending $10 or more to get a lukewarm burger and mushy limp french fries has no appeal to me.

<comment><USER15> I think people are ordering from more upscale restaurants, not McDonalds.

Food temperature is a personal preference, some people are really picky about food being hot/fresh, some aren't. I prefer the taste of room temperature food over hot food so "sitting around for 20 minutes" would be a feature for me.

<comment><USER16> You say that, but I saw someone picking up an UberEats at McDonalds...

... and then jumping into his new C300 to deliver it.

I'm not sure I can process that. New Mercedes, let's put miles on it delivering fast food...

<comment><USER15> He owns a Mercedes so he probably loves driving. Maybe if he wasn't delivering for UberEats he'd be out joyriding in his new Mercedes without a destination. In doing UberEats he's got a destination and he'll decrease his expenses by like $5/hour and take another car off the road. I know a guy who spends like half his free time driving around in a $70,000 pickup truck because he enjoys it, doesn't have a destination, just goes for a drive for fun.

And some people like really like McDonalds and don't care for the fancy stuff.

It's not for me, but it basically it boils down to "people like different things than me."

I know someone else who can't understand why anyone would ever play video games "its time and effort for zero reward."

Some people enjoy doing work on their car, while others would rather pay someone to do the work for them.

Humans aren't the same.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Fun fact about Deliveroo. A lot of your drivers aren't the registered driver. It's really common practice for a citizen or someone with a work visa to register and then rent their phone to someone desperate with no work visa. So your driver is often making almost nothing while someone else sits on their ass and collects cash for doing nothing and then Deliveroo again sits on their ass providing poor service collecting even more cash.

<comment><USER18> > It's really common practice for a citizen or someone with a work visa to > register and then rent their phone to someone desperate with no work visa

Do humans really have such low morality and ethics? I just can't picture a person who does this to another human being...

<comment><USER19> Did saying this make you feel better about yourself or something?

Because it's a ridiculously naive statement at best. More likely just some sanctimonious BS you decided to post to signal how much of a good person you are.

Like seriously, what world do you live in where you can't picture a person doing something to take advantage of another person? Have you read literally anything in history?

<comment><USER20> Did saying this make you feel better about yourself or something?

Because it's a ridiculously smug statement at best. More likely just some sanctimonious BS you decided to post to signal how much of an intelligent person you are.

Like seriously, what world do you live in where you can't picture a person thinking that it's sad that a person takes advantage of another person? Have you read literally anything in history?

<comment><USER19> How meta. You must be a super clever person with original thoughts to add to every discussion.

</comment></comment></comment></comment></comment><comment><USER21> There is one more aspect of fraud the journalist has missed - <USER2> fraud. Chargeback fraud is where companies try to lengthen the timeline of resolution of a fraudulent incident such as this one so that it exceeds your bank's official timeline for being eligible for getting your money back. Usually it's about 45-60 days and varies from bank to bank.

To me, as someone who worked in this industry before, this simply seems like a ploy by Deliveroo to escape absorbing the chargeback cost. Because, that is exactly what would happen if you called your credit card's bank/company and ask them to initiate a charge back for the fraudulent transactions instead of begging Deliveroo - the money will first be refunded to you almost immediately (varies from bank to bank) and then an investigation will be opened against the merchant in question (in this case, Deliveroo) and when you prove your credit card company valid proof that you're innocent by sharing logs, screenshots, etc. the dispute would be settled and the bank will side with you, the customer and thus this will lead to a loss on the merchant to bear the fraudulent transacted amount.

It seems, Deliveroo may be doing EXACTLY this to avoid letting the customer becoming eligible for a refund later through their banks by pushing them past the chargeback window. This is actually criminal in some countries, and grounds for a class action suit, which I hope someone sues them for if they are found guilty of this.

The other reason for the elongated resolution timelines is because Deliveroo actually benefits from these transactions - think about it, they earn for each transaction and in some markets, if I'm not wrong, the larger the transaction, the more they earn. So, why would they do something fast that affects their revenues negatively.

Anyway, my personal experience with Deliveroo also has never been positive and don't recommend them at all.

</comment><comment><USER22> I thought this was going to be about ordering food from one restaurant, only to have it prepared in another 'sublicensed' kitchen, sometimes a shipping container:

[https://www.theguardian.com/business/2017/oct/28/deliveroo-d...](https://www.theguardian.com/business/2017/oct/28/deliveroo- dark-kitchens-pop-up-feeding-the-city-london)

<comment><USER23> Is this actually shady? When doing takeaway you are not really paying for the ambiance of the restaurant anyway and IF the quality is the same I wouldn't necessarily have a problem with it.

<comment><USER24> > IF the quality is the same

That's the thing. It isn't. Every franchise, big or small, has wildly different quality of ingredients and preparation (and even send the correct damn drink and remember the dip) among outlets, and if I order from _that_ one, I want _that_ one to prepare my food.

<comment><USER25> Deliveroo Editions sites are clearly marked on the app with a banner across the main photo of the restaurant. You aren't led to believe the food is coming from somewhere it isn't.

<comment><USER22> > banner across the main photo of the restaurant

> You aren't led to believe the food is coming from somewhere it isn't.

I think we have different definitions of what being 'led to believe' is.

</comment></comment></comment></comment></comment><comment><USER26> Maybe I'm missing the point but how did the fraud take place to begin with? Somebody fished the author's Deliveroo account and used it to buy a lot of food? If so what would be the right way for Deliveroo to solve the issue? I mean if they just swallow the cost and reimburse her with no questions asked it seems easy to abuse, I could just order a lot of food then later complain that my account has been breached. Then again that's pretty much what Amazon does in these situations in my experience but not everybody has Amazon's deep pockets...

That's not to say that their current response (or lack thereof) isn't bad, it's more that I'm not sure what would be a good response in this situation.

I'm also not sure how Deliveroo could be considered liable if the breach is on the user's side (phished password) rather than a server-side vulnerability. If I offer an online service and one user gets their password stolen, would I be liable for that? If so, what should I do if somebody claims that their account was stolen? What if they're actually lying to get access to a legit account?

<comment><USER27> Standard security practices: not allow delivery to a new address without reconfirming credit card details, sending email confirmation upon login from a new location/device, and in the more extreme cases, 2 factor auth.

<comment><USER26> That makes a lot of sense now that you point it out. Thank you.

</comment></comment></comment><comment><USER27> It sounds very much like this journalist is trying to make a mountain out of a mole hill.

The real story is that Deliveroo does not handle fraud properly. This is a much lesser crime than what they are being accused of.

The author wants to make it seem like Deliveroo has had a data leak and are trying to hide the fact. There is no evidence of this, but if it did turn out to be true then the author would be able to claim that they broke the story.

<comment><USER28> If I recall, there's no distinction between an en masse data leak and someone being able to access your personal info without authority under GDPR. Both are a data breech. It seems like many people have been affected by this too so clearly Deliveroo doesn't have the mechanisms in place to protect user information. The fact unauthorized people can spend your money through Deliveroo is even worse.

Deliveroo are responsible for the data you give them. If they fuck up and allow unauthorized people access to that data, they're in breech of the GDPR.

If they haven't informed ICO (and equivalent in any country within GDPR rules) within 72 hours of each breech, they're in even deeper shit. First, they have to be clear about the scale of the breech and what exactly has gone wrong. They've got to be able to demonstrate the steps they've taken to mitigate the issue and prevent it happening in future. If people are complaining on a regular basis for months, they've not done that.

<comment><USER29> > there's no distinction between an en masse data leak and someone being able > to access your personal info without authority under GDPR. Both are a data > breech. It seems like many people have been affected by this too so clearly > Deliveroo doesn't have the mechanisms in place to protect user information. > The fact unauthorized people can spend your money through Deliveroo is even > worse

Well, the distionction can be as easy as someone hacking the company vs. guessing your password. What is the company to do to protect against the latter?! After all, the password is the authorisation, so I would even claim it's not unauthorised access...

<comment><USER30> There are many things they could do. For starters they could verify (email, 2 factor, something) unusual sign ins - for example sign ins from a new IP, especially if that IP has a higher risk profile (data center, known vpn, tor exit nodes, different registered country, etc.), or sign ins from a new device.

</comment></comment></comment></comment><comment><USER31> > Deliveroo has blamed the breach on cybercriminals getting hold of login > details "stolen from another service unrelated to our company in a major > data breach".

> This is despite the company not asking customers to enter a Card > Verification Value 2 (CVV2) code when making orders, a card security system > designed to ensure that someone ordering something online has physical > possession of the card used to pay for it.

More info on an article from November 2016: [https://nakedsecurity.sophos.com/2016/11/25/fraudsters- eat-f...](https://nakedsecurity.sophos.com/2016/11/25/fraudsters-eat-for-free- as-deliveroo-accounts-hit-by-mystery-breach/)

BBC's Watchdog documentary: [https://www.bbc.co.uk/programmes/articles/3ZMjkWFfDZQ8zFYQJL...](https://www.bbc.co.uk/programmes/articles/3ZMjkWFfDZQ8zFYQJLWFKQM/deliveroo) (with response from Deliveroo)

</comment><comment><USER32> > (Later – a lot later – a Deliveroo spokesman would tell me it was likely I > had been the victim of a "credential stuffing" attack, in which hackers > obtain lists of usernames and passwords and try them out on other > platforms.)

So this Tech Journalist uses the same password on every site?

<comment><USER33> the real issue IMHO is the "credential stuffing attack" makes no sense: hungry people getting their hands on leaked password dumps? a bunch of black hat hackers running a Delivery clone, getting clean money from customers, but really getting an innocent Delivery user get charged, and having the order be sent to the address of the customer? none of this makes sense!

It seems to me like the corruption or fraud is _within_ Deliveroo.

</comment></comment><comment><USER34> Another good reason to use a fintech bank account such as Monzo [1] or a credit card such as Tandem [2] or a virtual card that can forward transactions onto any other card such as Curve [3].

All of these services can give you a push notification every time a transaction is made on your account so that you are immediately made aware and are able to cancel them. You can block the card from within the app immediately.

1\. [http://join.monzo.com/r/vrlkxvo](http://join.monzo.com/r/vrlkxvo) (Using this link gives us both £5)

2\. [https://www.tandem.co.uk/credit-card/](https://www.tandem.co.uk/credit- card/)

3\. [https://www.imaginecurve.com/](https://www.imaginecurve.com/) (Sign up with WAI91 and we both get £5)

<comment><USER35> Amex has the same thing and their customer protections are generally better than the Fintech companies. Although Amex is not so common in the U.K.

Do any UK credit card companies offer consumer and fraud protection above the norm? Amex would immediately side with me if I showed them the Deliveroo communication. Another Citi VISA I had offered 18 months warranties on laptops and other electronics if I used the card.

<comment><USER36> Do all Amex cards have this? I've never seen this feature offered by them.

Edit: apparently they stopped doing this for average cardholders 15 years ago and it's a corporate-card-only thing now called 'Amex Go'

<comment><USER37> Amex recently detected a fraudulent charge on my card, and sent me an email with a "click here" button which, after I confirmed my identity, triggered the issuance of a new card in the mail in a couple of days.

I should note I have a "Starwood Preferred Guest" Amex card, but that is not a corporate card. It may be that the SPG card has additional features that a regular card would not.

</comment></comment></comment></comment><comment><USER38> _"Deliveroo takes online security very seriously. Sadly fraudsters rely on the fact that people reuse the same passwords on multiple online services to try and gain entry to different accounts across the web."_

Yeah! Blame it on your customers! Way to go!

Sigh! Another gig economy service I'm damn sure never to use.

<comment><USER28> That's not even an excuse. There are solutions out there that mitigate the fact people reuse the same passwords.

<comment><USER39> I'd love to see a more specific version of Troy Hunt's "have I been pwned" API which explicitly blocked user/password combinations which had been leaked.

The catch is, you'd have to store the pairs together which then makes you a target, so in practice the best you can really do is what's on offer already -- check that the password hasn't been leaked (and maybe if the email address has a high HIBP leak count).

That solution would seem to force people into password managers and random high-entropy passwords or passphrases...

</comment></comment></comment><comment><USER40> Credential stuffing attacks aren't a valid excuse IMO, and should not make this sort of fraud possible. Amazon for example instituted a very simple and effective policy years ago: if you want to deliver something to a new address using an existing payment method you need to reenter the payment details. This means even if someone guesses your username and password and you have a valid CC on file they still can't send a package to some arbitrary new address.

It's conceivable that the fraud is on the merchant side, with a restaurant faking a large order to an existing address, but in that case Deliveroo still has responsibility for allowing bad merchants into the system.

<comment><USER41> I actually found the other day, if I edit an existing address, it doesn't make me re-enter payment details. But adding a new one does. Not sure if this was due to a trusted device or if it always does it though.

</comment></comment><comment><USER42> I can't understand this fraud - surely getting something delivered to your door is the silliest way to defraud something? Also what are they doing with the £100s of takeaway food they are ordering?

I must be missing something here.

<comment><USER43> From my experience with Deliveroo, you can pretty much order at any address, wait for the delivery person at the doorstep and retrieve your order without actually living there.

<comment><USER42> But what you going to do with 3 £100+ takeaway orders back to back? You can hardly resell it!

<comment><USER44> Can you not buy things like bottled and canned drinks from places on Deliveroo? I suppose you could resell those.

<comment><USER42> Fair enough. But the markup on those items is crazy; you could order £100 worth of beer + wine and I'd be surprised if you could resell it for more than £10-20. Seems like a really risky way to make (not much) money.

<comment><USER15> You can sell in bulk to shady grocery stores and restuarants at slightly below wholesale costs and they sell to their customers.

This is how the market for stolen gas works anyway, I'd imagine stolen cola and beer would be similar.

</comment></comment></comment></comment></comment></comment><comment><USER45> This is poor form from Deliveroo - their fraud detection seems particularly lacking, and fobbing customers off for months at a time is not good enough.

However the article is unnecessarily sensationalist in banding around GDPR data breaches. Much of the article intimates there has been a Deliveroo data breach, whereas in fact the most likely explanation is attackers reusing passwords leaked from other breaches. This is acknowledged towards the end of the article but quickly glossed over.

If consumers are reusing exposed passwords this makes life tricky for Deliveroo. Maybe they should be using Troy Hunt's "Pwned passwords" to protect new user signups:

[https://www.troyhunt.com/ive-just-launched-pwned- passwords-v...](https://www.troyhunt.com/ive-just-launched-pwned-passwords- version-2/)

<comment><USER46> From this Deliveroo engineering blog post:

[https://deliveroo.engineering/2017/09/05/improving- password-...](https://deliveroo.engineering/2017/09/05/improving-password- security.html)

"Therefore, from today, we will be informing our customers when we determine that the password which they use for Deliveroo is publicly known in some way. We will contact the impacted customers to request that they change their password, and advise that they also change that password at other sites where it is also used."

<comment><USER45> Thanks for posting this - I hadn't realised they were already doing it. I'm not sure how else they could be combatting password reuse attacks, short of forcing every user to reset their password.

It sounds like their engineering time might be better spent on fraud detection algorithms.

</comment></comment></comment><comment><USER47> Calling the police seems like an important thing the author didn't seem to do. This is not a nuisance, it's a crime. I am less interested in fining Deliveroo, rather I would like to see them forced to cooperate with law enforcement to prosecute thieves.

</comment><comment><USER48> Of all the job interviews i've done, Deliveroo stands out as the only company that gave me a trick interview test - said specifically not to write a feature, and when I didn't, they rejected me on that ground.

Not surprising their whole business is like this.

<comment><USER49> Why would they do that anyway?

<comment><USER48> As they explained it, they wanted people who "went above and beyond"

<comment><USER50> To the point of ignoring clear directions? Ok..

</comment></comment></comment></comment><comment><USER51> Fun fact regarding newstatesman.com

I am a user of NoScript, AdBlockPlus (still using 2.9.1), with its "Element Hiding Helper for Adblock Plus".

My NoScript had already blocked 24 domains, which I guess I have added in the years before. I proceeded to block another 6-7. When the site reloaded, and was perfecly visible, the count was "Untrusted (13)". Which means the original 6-7 that I 'just' blocked were loading at least another 12.

And then companies are wondering why Noscript, uBlock, etc. are so popular and complain about when we care about our privacy!

</comment><comment><USER33> I don't understand? hungry people are buying leaked credentials? black-hat hackers are selling meals through a competing service to customers who then open the door for a Deliveroo guy? None of this is making sense!

Either the fraud is within Deliveroo (dig deeper!), or locating the served customer will result in the discovery of some kind of weird low-usage "stolen credential delivery of Deliveroo foods" service (dig deeper!)

This is not properly fleshed out IMHO... but yeah lets market and compare credit and debit cards and point systems and pffff

</comment><comment><USER52> Disrupt disrupt disrupt. Avoid any liability for any damages or frauds, employ gig workers, grow 10x, be a unicorn make the investors wealthier than before and outsource the negative externalities to society.

</comment><comment><USER53> I'm a bit confused, probably since I don't have Apple pay.

Does it not use credit cards? It should then be very easy to dispute the charge with the bank.

<comment><USER54> I use Apple Pay with both my debit cards. This is in the UK.

<comment><USER44> I wouldn't use my debit card for any purchases. More protections and less hassle using a credit card.

<comment><USER55> The big issue for me is that I have a joint bank account with my partner, so using my debit card for that automatically splits the bill. I suppose we could each get a second credit card that we use only for joint transactions and pay those off from the shared account, but that means that the joint balance is now effectively split over three accounts, and at any time each of us can only see the balance on two of them (not the other's credit card). So it's definitely not "less hassle" in that respect.

<comment><USER56> I think every credit card I've had has given me the option of adding a second card for a spouse to use. Maybe something like that?

Then just make sure you both have access to the online account so you can both view the balance at any time. There's a small amount of extra friction in that you'll have to coordinate a bit to ensure the card is always paid off equitably, but it probably wouldn't be too big a hassle.

<comment><USER53> That's possible at my bank at least, my wife and I have a common account with two visa debit cards attached (no credit on it).

It's not so much for splitting the bill (I pay the most of what goes in there), but it makes putting it in our accounting system much easier :)

<comment><USER55> Who said the split has to be equal :-) But it sounds like you have what I already have: a joint current account with two debit cards (one for each person).

</comment></comment></comment></comment></comment></comment></comment><comment><USER57> It sounds like the GDPR is more or less unrelated and those fines are not forthcoming.

If deliveroo's own analysis is correct (and that is admittedly an 'if', but if you come out and say 'we hash our passwords, and you can quote me', let's assume they aren't complete morons in thinking that nobody on their staff would ever leak it if they didn't), then the problem is not that there has been a security breach over at deliveroo. The problem is merely that

[1] Their handling of a breach of account info that they weren't the cause of is very bad, both not investigating / blocking the recipients of the food orders (clearly 'whitewashing' fronts), or even trying to take it seriously,

and

[2] doing a bad job at enabling (or even motivating) their users to have good account security. Anywhere from scanning such credentials lists out in the wild and autoblocking any user/pass combo that is also a valid deliveroo login, to offering TOTP.

Both are, to be clear, very bad. Deliveroo deserves all the scorn they are getting. But neither of these issues is something you can be fined for, at least, not via GDPR.

</comment><comment><USER58> I find it funny how the new "I know I guy" is the "I tweeted to my many followers" when it comes to dealing with problems.

</comment><comment><USER54> I found Deliveroo sending highly detailed location information to a marketing company(Braze) yesterday[0]. I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough.

On the topic of this story it seems like a case of credential stuffing so it's not a breach in Deliveroo's systems. Do the requirements as a "Data Controller" still apply in such as case? Regardless Deliveroo seems to be handling this poorly.

0: [https://twitter.com/K0nserv/status/1087753850088554496](https://twitter.com/K0nserv/status/1087753850088554496)

<comment><USER59> > _I can 't remember every giving explicit consent for this and AFAIK under > GDPR just covering this in a Privacy Policy is not enough._

I don't believe Deliveroo is obligated to tell you who they send such information to. They are however obligated to tell you that they gather such information and, should they share it with a third party, ensure that said third party is GDPR compliant and sign a data processing agreement with them.

Deliveroo doesn't mention Braze directly by name in their privacy policy ([https://deliveroo.co.uk/privacy](https://deliveroo.co.uk/privacy)), but they do let you know that they disclose "information they collect" to, among others, "Marketing and advertising partners".

They also mention in the same privacy policy that they "also collect technical information about your use of our services through a mobile device, for example, carrier, location data and performance data".

Braze themselves does appear committed to GDPR. That isn't especially surprising, it's a huge selling point for marketing companies towards enterprise customers. [https://www.braze.com/product/data-agility- management/regula...](https://www.braze.com/product/data-agility- management/regulations-and-compliance/gdpr/)

IANAL but I don't believe Deliveroo is in breach of GDPR. The best you can probably do is make a case that they do not have a reasonable justification to collect such highly-accurate location data for that particular use case, and should tone it down to, say, 5km instead of 1m accuracy. If you email firstname.lastname@example.com with such a request, there's a decent chance you could get the change done.

<comment><USER54> Doesn't GDPR require explicit cosent[0] for collection of sensitive private information? This is what many website has implemented as popups with "I accept" or "Manage Settings" options. I don't remember going through such a flow with Deliveroo and if I did I would have disabled the "marketing" category for sure.

0: [https://www.i-scoop.eu/gdpr/explicit- consent/](https://www.i-scoop.eu/gdpr/explicit-consent/)

<comment><USER59> Hm, I tried to create an account to check the signup flow but it looks like you need to place an order to create an account (and I'm not that hungry) (also, that's a really fun and interesting way of massaging growth numbers…).

To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary.

What they might not have gotten, or at least not clearly, is your consent to send that data to a third party, explicitly and exclusively for marketing purposes. I don't know how this would play out.

Realistically, GDPR and its enforcers err on the side of caution (you need good justification to gather the data and share it, including consent and a reason to gather it in the first place). So if you care about this and wish to see it corrected, as I said an email to their dpo@ will likely go a long way. In case it doesn't, your national enforcement agency may be interested. Extremely-accurate location data is pretty creepy, especially if they get it very often and doubly so if they store it for a long time.

The #1 thing I would look at here is what they actually need it for. They may need it for security reasons (eg. anti-fraud measures) and happen to be storing it in Braze which is _probably okay_ if Braze respects GDPR and Deliveroo signed a DPA with them (you'd be surprised the amount of companies storing security data in GA).

But you wouldn't have a very hard time making a case that they're using this for marketing purposes and are gathering an unreasonable amount of accuracy. So now the question is, do you care about this enough to follow up on it? :)

<comment><USER54> > To add to what detaro was saying; even if explicit consent were required for > sharing your location data, Deliveroo most likely got it; they after all > need it to know where your order is going to go. When such functionality is > core to the app, an opt-out is not necessary.

Per GDPR[0] consent must be specific. i.e. aquiring constent for a legitimate feature of an app and then also using the data for marketing purposes, what seems to be happening here, is not legal. Of course it could be the case that Deliveroo uses Braze for all their push notifications and thus consider it an essential part of their product. IANAL, but as I read the GDPR giving an app location access required for legitimate functionallity is not a carte blanche for the app to use location data for any purpose without obtaining consent for each specific usage.

In any case, like you say it's extremely creepy and the level of accuracy is worrying.

0: [https://gdpr-info.eu/issues/consent/](https://gdpr- info.eu/issues/consent/)

<comment><USER59> I just replied elsewhere in the thread regarding this. Consent to collect was acquired, but nothing actually says they're processing this data for marketing purposes if you haven't opted in to it.

I've seen this pattern quite often: The opt in/out flag is stored somewhere and companies invalidate the data they have based on that in the marketing tooling itself; collection still happens regardless. I've not used it but it's even possible Braze has information on the optin/optout and the ability to immediately reject data about optouts.

The reality is that, while the clean and intuitive privacy practices we're talking about are compliant, they're not _required_ for compliance. Companies go the least-effort route. Deliveroo has clearly done a GDPR pass on their practices so I highly doubt they're _using_ the data in question for marketing (even if they're collecting it).

But I'm still encouraging you to go and talk to them about it. I promise you if you're polite and clear about what and where the issue is, you can likely get some changes done. It's pretty fulfilling, too :)

</comment></comment></comment></comment></comment></comment><comment><USER60> I did one order in Milan with deliveroo, from that day I receive kind of emails and phone calls from different call centers.

</comment><comment><USER61> I am wonder if good fraud detection is one of things routinely ignored by unicorns trying to get explosive growth. First, we had ridersharing companies where drivers could start rides without their customers. Then were digital wallets getting hacked left, right and center (in India).

</comment><comment><USER27> Interestingly the same author had a very different opinion when the same was happening to someone else. [https://www.newstatesman.com/science- tech/internet/2018/09/g...](https://www.newstatesman.com/science- tech/internet/2018/09/gdpr-easier-access-data-hackers-access-online-security- spotify)

> Although what Spotify has done, or failed to do, by handing over data to > whoever is logged in on an account, could be considered irresponsible, it is > in no way illegal – and, in all likelihood, is generally the norm.

</comment><comment><USER62> Pretty bad pronoun use in the headline.

</comment><comment><USER63> _Midway through writing this story, I got my money back, by the way – and from Deliveroo itself. Other victims have not been so lucky._

The author's experience is not uncommon and seems sensationalised to create a Twitter storm and garnering sympathy, which is uncharacteristic for a journo, who writes about 'tech and digital culture'. It would have been more apt to go into triage mode i.e. stop the bleed of finances and dispute transactions immediately, before entering into communications with the delivery firm. After a resolution, choose to go turbo and further explore the implications of GDPR, then write about your experience in detail.

The article does not leave the reader any more informed or equipped to deal with such a fraud. It does not even pretend to offer any piecemeal advice e.g. don't use/re-use easily guessed passwords, use 2FA, use credit cards or virtual/disposable cards, contact your bank/issuer first, don't bother contacting low-level support via social media, explore data protection laws after a resolution etc.

</comment><comment><USER64> After Brexit (March 29, 2019) is the GDPR still valid?

<comment><USER65> Presuming the UK actually exits. They can still withdraw A50 -- or possibly extend it but the EU has cast doubt on this.

Even if it does exit -- EU will have incredible influence over the UK and can effectively enforce GDPR on most companies over a certain size as those companies will have to create entities and corporate structers in the EU for varying reasons -- mostly tax minimisation for exporting.

Little sole traders with no amibition of expanding outside the UK will probably have the benefit of not having it enforceable on them.

Again this presumes the UK chooses not to implement it's own data protection laws.

</comment></comment><comment><USER66> Zero proof seems to be given in the article that it is Deliveroo's fault. While they probably should be more helpful, spreading the accusations based on guesswork seems to be yet another example of shoddy modern journalism.

</comment><comment><USER67> this website makes it a point to make it as annoying as possible to disable all tracking. No option to disable all.

full article for whose whom want to read it but not be tracked:

Deliveroo users are getting defrauded – and it could be fined millions for it

Scammers are using the delivery service to clear out bank accounts, and the company's response may be in breach of GDPR regulations. By Sarah Manavis Follow @@sarahmanavis Getty Images

On Friday morning, I woke up late, rushed to the tube, tapped in with Apple Pay, only to discover a few minutes later that my payment had been declined because I had insufficient funds. Figuring, "Well, it's January", I went to check my bank balance.

But rather than seeing an overspend or a direct debit I'd forgotten about, I saw three enormous charges from the food delivery service Deliveroo from the night before. They weren't mine.

I immediately called Deliveroo to say that it wasn't, in fact, me who ordered £100 worth of food in the space of ten minutes in three separate orders; and told them that the fraudsters had changed my email address, so I couldn't even get into my account to look at where it was sent. I was told that they would investigate, and I would be sent an email asking for more information immediately.

I was not. After an hour, I rang again, to find that actually the email had been sent to the new email address – the one the fraudsters plugged in – so that they had presumably been alerted to the investigation. I complained, got the email re-sent to me, and was then met by radio silence for the rest of the day. When I eventually rang again, the company said it couldn't actually tell me whether or not I would get my money back, adding that I might not hear from them for nearly a week before they let me know either way.

By 5pm, I was getting fed up, so I did what any journalist with a modest Twitter following would do, and tweeted. What I thought would happen was that my case would be bumped on the list, and maybe I'd get my money back sooner (or, indeed, at all). What actually happened was that my replies, DMs and email were all immediately flooded with people who had been a victim of the same fraud, saying, yes, this had happened to them too and no, Deliveroo had never refunded them. Of the roughly 40 people I spoke to, not a single one had been refunded by the delivery service; those who did get their money back had got it from their bank. The people tweeting the account claimed to have experienced fraud ranging from the low hundreds of pounds, like my case, to, in some cases, thousands. One person tweeted me to say that a friend of his was fraudulently charged £3,500 on his account. "Deliveroo offered him a £40 credit as a gesture."

More shockingly, nearly half of these people told me that their cases were still technically "under investigation" by Deliveroo, some for over two months. Most of those who had been waiting for more than a week to hear about their case told me Deliveroo had simply stopped responding to their calls.

This problem is not actually new. In 2016, the Telegraph ran an expose of rampant fraud on the food-delivery service, and reported on customers' shock at Deliveroo's poor handling of the situation. The same day, a BBC Watchdog programme did a feature on Deliveroo fraud, in which Deliveroo claimed that "instances of fraud on our system are rare".

But dating back several years, Deliveroo's customer service Twitter account, @DeliverooHelp, has responded to claims of fraud nearly every day – often, in recent months, multiple times a day. They may represent only a small percentage of Deliveroo's wider customer base, but it's not at all obvious this is "rare".

However, help for customers – and fines for the delivery service – could be coming from Brussels. Laura Irvine, a regulatory lawyer and Partner at Davidson Chalmers, tells me that Deliveroo may have breached the GDPR regulations introduced last year on multiple counts.

The General Data Protection Regulation (GDPR), which became European law on 25 May 2018, made sweeping changes to data protection rules across the EU: now, companies are more liable for protecting the data they hold on customers than ever before.

Irvine tells me that Deliveroo appears to have breached these regulations three times over. The sixth principle of Article 5, for example, requires companies to have "appropriate security in place to keep your financial and other personal data secure", she notes. The firm also appears to have breached Article 32, "which provides more detail about what is expected in terms of data security – namely encryption, which appears not to have been in place".

Lastly, there's Article 34, which requires the "data controller" – that's Deliveroo – to tell "anyone who may be affected by a data breach about it without undue delay. This applies when the breach is likely to result in a high risk of an impact on the individual. Getting your bank account emptied would, I suggest, meet that threshold."

So what fines could Deliveroo face, if it were to be found guilty of these data breaches? "It could be millions of pounds," Irvine says.

She emphasised that this is a big "could" – the millions of pounds they could be fined would be the upper end of the spectrum. But it is entirely possible, especially given the criticism the Information Commissioner's Office (ICO) has faced for the small size of its fines in the past. "They were criticised for the small fine imposed on Facebook – £500,000 which was the maximum under the old law," she tells me. "So I think they will want to use their powers. And they need to keep up with the other regulators," she adds, noting that Google recently faced a €50m fine in France for breaching GDPR.

That said, there are some things that could spare Deliveroo from this fate: if, say, Deliveroo had told the ICO about the data breach within 72 hours, the threshold for fines would be lowered. But, Irvine says, the high volume of incidents and the reported response from Deliveroo suggest they aren't informing the ICO of their data protection problems.

"They may blame other parties, but at the end of the day if you give them your data then they remain responsible – in most cases," she says. "I am not sure how the bank would stop this."

I put all this to Deliveroo. A spokesperson told me: "Deliveroo takes online security very seriously. Sadly fraudsters rely on the fact that people reuse the same passwords on multiple online services to try and gain entry to different accounts across the web."

Ultimately, though, fines are not the only problems that data leaks of this sort pose to firms like Deliveroo. "Soon people will stop using companies based on how responsible they are with data," she says. "Particularly financial data – but even your address being out there can be uncomfortable or dangerous for some people." If she's right, then this, for Deliveroo, could be just the beginning.

Midway through writing this story, I got my money back, by the way – and from Deliveroo itself. Other victims have not been so lucky.

</comment><comment><USER68> By the sounds of it this is a simple credential reuse attack (it's even states as such in the article) so I really don't see where these accusations of a "data breach", and "encryption, which appears not to have been in place" come from. If these fraudulent transactions are the result of credential reuse I really don't see the GDPR violation here.

<comment><USER69> Yeah, not to defend Deliveroo (that's still abhorrent customer service), but I fail to see how they can back up the allegations of the various breaches. How do they know encryption was not in place?

</comment></comment><comment><USER70> All of this discussion about the company here (which isn't responding in a correct and honest way) and not much discussion on the root cause of this problem.

The journalist and the 40+ People were victims of a credential stuffing attack which means they used the same password on multiple sites.

Had they used a password manager to roll a new password per site and had deliveroo had proper rate limiting, this attack would have been mostly mitigated.

There's not much excuse for this behavior.

</comment><comment><USER71> This kind of articles and journalism makes me a bit uneasy.

This article only exists because the Journalist was affected. If anyone would contact the this paper saying company X has fraudsters leveraging their service (which is not uncommon), this article would never have been written.

That aside, I've been on the other side, resolving cases like this. Sometimes cases are complex, take months to figure out while involving multiple stakeholders (police, banks, payment processors, etc), and you have no idea who to trust on the other side of a phone line (it can be a victim, it can be the fraudster).

<comment><USER72> This kind of reflex journalism hate makes me uneasy.

> If anyone would contact the this paper saying company X has fraudsters > leveraging their service (which is not uncommon), this article would never > have been written.

You don't know that. The New Statesman is an excellent magazine and has run plenty of investigations in its time.

<comment><USER71> It's not journalist hate, and I'm not attacking The New Statesman, I'm criticising _this_ article.

If the article would be about the growing problem of online fraud (which is growing quite steadily), and not only about Delivaroo, I would be happy.

Yes, I do know that, because as I said I've been on the other side and the number of articles covering individual companies being targeted by fraudsters is low compared with the number of cases.

Regardless of the motives that sparked the article, it still brings attention to the topic, which is positive.</comment></comment></comment>


What Killed Straight Pool? (2005) - <AUTHOR> http://www.billiardsdigest.com/current_issue/aug_05/index.php <comment><USER2> Simple answer: Declining attention spans.

For those who've never seen straight pool (AKA 14.1) played, here's a link to video of an all-time classic match: Joe Balsis running 150-and-out to beat Irving Crane in 1966.

[http://youtu.be/k06-M12lQWE](http://youtu.be/k06-M12lQWE)

For a pool aficionado (like me), it's a delight to see such a masterful performance. But for most people, watching a guy shoot-in balls for an hour without missing is probably like watching paint dry.

I love the game, though. I like snooker even better, which was also popular in the U.S. back in straight pool's heydey. Now it's hard to even find a snooker table in the states.

<comment><USER3> If it really is a matter of attention span, then I wonder why snooker remains so popular in the UK and is growing rapidly in China, Germany and elsewhere. The game attracts global TV audiences and sponsorships that dwarf any form of pool, in spite of being longer, slower and more difficult to understand.

Are Americans uniquely impatient? Are American TV networks lousy at presenting billiards? Is pool just inherently boring?

<comment><USER2> Good observation. I wondered the same thing when someone else commented that _most_ people are uninterested in watching pool on TV. Yet snooker is a big hit on TV in the UK, as you point-out.

I think that, historically, snooker became popular on TV in the UK because the BBC started airing the weekly "Pot Black" series to showcase their early color broadcasts. The green cloth and different colored balls looked great!

Makes sense when you consider that snooker, while still enormously popular, has also seen a decline from its 1980's high point. Color TV isn't much of a novelty anymore.

</comment></comment></comment><comment><USER4> straight pool is great fun if both players have some minimal level of skill (mostly speed control and top/back spin). i think that's why it's not popular at a casual level since most casual players just want to smack balls around and drink beer (and there's nothing wrong with that =)

</comment><comment><USER5> I'm 41, grew up playing with my Dad, who is now 74 and my Grandfather. He was a straight pool player from Missouri, usually called it 14-1.

My best run is 17.

<comment><USER6> _with my Dad, who is now 74 and my Grandfather_

Wow, that must have been a surprise. I wouldn't have thought that would be legal even in Missouri! But I suppose it could be worse...

[https://www.youtube.com/watch?v=eYlJH81dSiw](https://www.youtube.com/watch?v=eYlJH81dSiw)

I'm My Own Grandpa - Ray Stevens (with family tree diagram)

<comment><USER7> Commas save lives. [http://www.cafepress.com/+commas-save- lives+gifts](http://www.cafepress.com/+commas-save-lives+gifts)

</comment></comment></comment><comment><USER8> I wonder if I'm the only guy out there in his 30s who still plays straight pool?

<comment><USER9> Nah...there's probably at least one or two more :-)

What I really miss shooting is one pocket.

<comment><USER10> I still sometimes see one-pocket, but I frequently see last-pocket played, especially in gambling situations. It's a nice way to hog a barbox.

</comment></comment></comment><comment><USER11> Why would straight pool require more skill than 9-ball? Hitting any ball in you want seems easier to me.

<comment><USER10> My guess is that the point is that real skill is exposed over a long game of both players shooting at any ball. There is a considerable amount of positioning luck involved in any single 9-ball game.

<comment><USER12> Right, but nobody plays a single 9-ball game. For one thing, you can win on the break! But over many games the relative skill of two players will be revealed, just as in straight pool. However, in 9-ball the maximum risk from failing to play a safety is much less--one rack instead of many.

<comment><USER2> It seems like straight pool provided a more accurate means of distinguishing skill levels between players. Dallas West (straight pool pro from 70's) once said that he knew he had arrived as a pro when, as a teenager, he finally ran 100-balls in a row. He then said that he had made a 100-ball run every day of his life since then. There's a similar jump in standing at 50-balls. A complete beginner might have to practice hard for a year to clear a single rack.

9-ball players like to boast about their long runs, too, but there's an element of luck (the break shot) that throws a kink into direct comparisons between players' high runs. Earl Strickland once ran 11-racks in a row to win a $1 million prize, but a player with a "six-pack" (6-racks in a row) isn't necessarily half as skilled.

</comment></comment></comment></comment><comment><USER13> > Thorsten Hohmann, the 2003 world 9-ball champion,

How can this article be from 1997?

The URL suggests that it is either the "current issue" or that it is from August 05 (2005? The fifth August issue)?

At any rate, it doesn't seem like it's from 1997.

<comment><USER14> Sorry, my mistake.

This is a good place to repeat that if anyone would enjoy figuring out a programmatic solution to this problem, we'd be interested:

[https://news.ycombinator.com/item?id=8831616](https://news.ycombinator.com/item?id=8831616)</comment></comment>


Paralyzed man can now feel via a prosthetic hand connected to his brain - <AUTHOR> http://www.darpa.mil/news-events/2015-09-11 <comment><USER2> I know it'll be a long road from this research to the normal therapy, but it's exciting nevertheless to see such a progress, especially in so frightening area.</comment>


Comparisons of Alloy and Spin (2018) - <AUTHOR> http://www.pamelazave.com/compare.html <comment><USER2> Alloy and Spin are used in modeling/verification. You can use these to verify properties of your system (like your IPC protocol, or a million other ideas). Aside: on HN, this guy [2] often shares his expertise on formal methods. Let's hope he chimes in w/his thoughts here ;)

Zave (the author) studies Alloy and Spin by trying to model a service/protocol called "Chord" [1]. Her findings are summarized in "Table 2. Summary of comparative advantages on the Chord case study.":

> Promela + C / Spin: not necessary to know a sufficiently strong global > invariant, supports progress assertions

> Alloy / Alloy Analyzer: half the startup time, safety assertions are > declarative rather than procedural, can be used for a convincing proof of > correctness

[1] [https://pdos.csail.mit.edu/papers/chord:sigcomm01/chord_sigc...](https://pdos.csail.mit.edu/papers/chord:sigcomm01/chord_sigcomm.pdf)

[2] [https://www.hillelwayne.com/about/](https://www.hillelwayne.com/about/)

<comment><USER3> I've read parts of Holzmann's Spin book but haven't actually tried to apply any of it. Without some experience I can't really compare other tools to it.

Also I've forgotten like half the language already :/

The primer still sits of my bookshelf, disapproving of my life choices.</comment></comment>


Visual encryption enables true ephemeral messaging - <AUTHOR> http://flashbang.strikingly.com/ <comment><USER2> Finally, an interesting technological innovation to social messaging. This visual encryption is pretty amazing to see.

<comment><AUTHOR> Thanks! The seemingly simple technique actually took many iterations to get a good balance between security and view ability.</comment></comment>


TRIZ – Theory of Inventive Problem Solving - <AUTHOR> https://en.wikipedia.org/wiki/TRIZ <comment><USER2> Thank you for sharing this OP, never heard about it before.

Christopher Alexander (architect and influencer of GoF's original software Design Patterns) very cleverly re-frames design problems in one of his books [1] as optimization problems, where the designer is tasked with minimizing the tension between two or more conflicting requirements arranged as a graph, and where each requirement interacts positively or negatively with it's neighbours. By representing a design problem this way, it follows that "solving" it amounts to clustering requirements together to form sub- components that interact well together, or redefining the solution/context boundaries to re-frame the problem and minimize the overall tension.

It's interesting how this TRIZ framework arrives at many similar insights about the design problem, and I wonder what you get by mixing the two approaches. A lot of what makes it hard to apply is also what makes Christopher's framework hard to apply, which is clear definition of the requirements in the first place. C-K theory seems to overcome these limitations but I haven't played with it yet.

[1] [https://en.wikipedia.org/wiki/Notes_on_the_Synthesis_of_Form](https://en.wikipedia.org/wiki/Notes_on_the_Synthesis_of_Form)

[2] [https://en.wikipedia.org/wiki/C-K_theory](https://en.wikipedia.org/wiki/C-K_theory)

<comment><USER3> Notes on the synthesis of forms is an awesome book! It really is about systems design in general - the graph based view is the concrete formulation of the fact that elements of the system affect each other amd if these connections are not made explicit in the design process then the components will still be connected - albeit in hidden and accidental ways which will make the system development into a neverending game of whac-a-mole problem fixing.

In retrospect this may sound obvious and trivial but taking this simple graph based view of the basis of systems design as the fundamental idea gives concreteness to e.g. lot of software systems practices and unifies them.

</comment></comment><comment><USER4> Recently a book for kids was published, in Russian, which describes TRIZ in an easy manner.

[http://fictionbook.ru/static/trials/09/81/13/09811350.html](http://fictionbook.ru/static/trials/09/81/13/09811350.html)

Main character, a boy called Denis frequently sees problems around him, which allow him to apply his TRIZ skills. The book has explanation and problems, so the reader can try to learn the method.

<comment><USER5> Man, I really want to read this. Wonder if there's an English version. Is it worth reading?

<comment><USER4> I'd say yes it's worth reading. The material is pretty basic, as it's targeted on 10 years old. The book came I think only in 2012, I'm not sure if there is an English version.

</comment></comment></comment><comment><USER6> The Wikipedia article has no criticism section.

It might be great as taxonomy of problem solutions, but there is no reliable evidence that it works as a methodology. Reducing research activity to a bunch of codified chess-like moves is a huge temptation. However I haven't seen its adepts producing any unexpected results (in practice, not on some TRIZ textbook puzzle). The solutions were on par with what you'd expect from a person of comparable intelligence, experience and education background otherwise.

<comment><USER7> I learned it as part of my 2nd year mechanical engineering design course. It was a great way to teach concept generation to novices and expand awareness of alternative solutions. As our experiance grows, we become more aware of the possibilities. I don't think any of our class still uses TRIZ in their professional work, but learning the process of seeking inventive solutions from other applications is critical.

A parallel is perhaps biomimetics [1], an active current research area of 'design inspired by life/ biology'. Often, it is controversial if the invention was truely inspired by nature, or just made for good marketing. 'Shark skin' swimsuits were named by marketers after the actual invention [2]. Our experiance with heavier-than-air flight was terrible until we _stopped_ trying to mimic how birds fly.

[1] [https://en.wikipedia.org/wiki/Biomimetics](https://en.wikipedia.org/wiki/Biomimetics) [2] [http://www.independent.co.uk/news/science/swimsuit-is-not- li...](http://www.independent.co.uk/news/science/swimsuit-is-not-like-shark- skin-6699673.html)

<comment><USER6> Had bionics (the older name of biomemetics) on tip of the tongue for analogy sake too, but felt am not familiar enough with it. I however worked and shared hobbies with a few people who were into TRIZ: our alma mater was one of the hubs. Never seen it make a difference, but maybe it has its merits as pedagogic tool.

</comment></comment></comment><comment><USER8> This somewhat reminds me of the "symbolic AI" software before the first AI winter in the early 90s... It looks like the methodolgy is making progress towards a solution, and you are able to find answers for heavily stylized sample problems...

...but then you realize a lot of the complexity is just hidden behind your definitions for the words in the TRIZ matrix (or in the case of "symbolic AI", in the precise semantic meaning you are assuming for the symbols)

<comment> gene-h You should check out the idea of function structures. Functions structures are a symbolic means of representing the functions a electromechanical product must perform in order to do its job.[0] The cool thing about function structures is that you can go from a function structure to a simplified conceptual model of a product. For example, one can replace the function convert electrical energy to mechanical energy with a motor. Unfortunately, the same function structure can translate to many different possible products, some of which don't make any real world sense.

For instance, for a carrot slicing machine you might end up with a solution that uses the forward motion of the whole device in conjunction with an airfoil to create the force to cut the carrot. While plausible, this is not the best solution.

If some of these problems could be fixed, we'd essentially have a hardware description language for mechanical engineering. And with this we could do the same sorts of design automation the semiconductor industry has been doing except for mechanical systems.

[0] [http://enterprise.mie.uic.edu/me250/files/1113/4688/4799/woo...](http://enterprise.mie.uic.edu/me250/files/1113/4688/4799/wood_stone_function_basis_jmd.pdf)

</comment></comment><comment><USER9> ТРИЗ is awesome, as well as Altshuller's sci-fi writings.

</comment><comment><USER10> nice</comment>


Kill Windows 10 bloatware for good with this new open source tool - <AUTHOR> https://www.techradar.com/uk/news/this-open-source-tool-lets-you-remove-windows-10-bloatware <comment><USER2> After being a Windows advocate my entire life and refusing to use Apple products, I bought a Macbook yesterday. I am tired of Windows and its bloatware, the updates that break my drivers, the constant battle to fix these issues, having to download third party software to prevent it from breaking stuff again, the literally hundreds of hours of my life I've spent doing all of this. Macbook has been great so far, the hardware is great, stuff just works.</comment>


Pattern-matching is as real in tech media as it is in Silicon Valley - <AUTHOR> http://betabeat.com/2013/02/race-tech-media-silicon-valley-pattern-matching-jamelle-bouie-jason-calacanis/

<comment><USER2> "Twitter attempted to have a conversation about race and the tech industry yesterday. The loudest voices? White men on either side of the argument shouting each other down."

The end of this para links to Buzzfeed, which adds nothing except a lot of crap advertising to this Storify: <http://storify.com/mattbuchanan/how-to-not- be-racist>

Actually I'm not convinced that Jason Calcanis is as wrong as he looks in the linked story. He's kinda right that if you want to be a top tech writer, you can probably get there by starting your own blog, building a following, and then being rewarded with a column on <insert major tech site here>. And this process will probably work just as well for a person of any given ethnicity.

The real problem isn't that awesome ethnic minority tech writers can't succeed, it's that there's an awful lot of mediocre white male tech writers, and relatively few mediocre black/female ones. This is presumably because a lot of tech writers aren't really judged on their merits; their editors need to employ some people to write about technology, and they're making 'safe' choices by going for the white guy who fits the pattern of 'tech person'.

</comment><comment><USER3> Warning: not about pattern matching as found in functional languages. Hopefully those discussing race in tech can latch onto another term.

[Edit: yeah I missed the word "Media" in the title which would have been a hint...]

<comment><USER4> That's the term VCs use. What would you suggest?

</comment></comment><comment><USER5> > That might also be the reason why, when we read about how black people use > Twitter, it's so rarely from their own perspective.

Isn't this whole framing that "black people" use Twitter differently than "white people" or "Chinese people" part of the inherent dysfunction in these discussions?

I wish civic discourse in America would grow up and talk about the issue of socioeconomic class as a first-class concern (no pun intended), instead of overloading it on race.</comment>


Show HN: INTULocationManager – Easily get the device's location on iOS - <AUTHOR> https://github.com/intuit/LocationManager

<comment><USER2> great readme! the documentation helps answer a lot of my questions. just wanted to chime in with a note of appreciation for that.</comment>


Delaware Man Charged With Faking His Way Into Harvard - <AUTHOR> http://www.nytimes.com/aponline/2010/05/17/us/AP-US-ODD-Academic-Fraud-Probe.html

<comment><USER2> Shouldn't they check that sort of thing _before_ admission?

20 offenses, no way. He's just played them for fools and now they're trying to do their best to get back at him. They should simply throw him out and mark his name on some list and be done with it.

<comment><USER3> According to the story linked in the other thread, there's "over" $45K of money involved. $14K in two writing prizes won with plagiarized material and $31K in financial aid.

The latter is certainly a criminal issue.

However you do have a point about the rigor of their admissions process, one local phone call to the MIT Registrar's office before the final decision would have sunk his scheme ... unless of course he used the name of a real student there. Maybe "identity fraud" includes identity theft, which is also something the state has in interest in deterring.

One final point: higher education is a big Massachusetts industry and probably one of its healthier ones, I can see the state taking a harder line on all this than many others.

</comment></comment><comment><AUTHOR> The Boston Globe on the same story, with photograph of the accused:

[http://www.boston.com/news/local/breaking_news/2010/05/by_gl...](http://www.boston.com/news/local/breaking_news/2010/05/by_globe_staff_60.html)

<comment><USER2> Right, because of course, an accused person automatically loses all rights and needs to be nailed to the proverbial cross for all to see.

Shaming people went out of style in the middle ages, once convicted it's a different matter, but it seems a bit premature to do this.

The university has a couple of things to explain as well, such as why they believe applicants without checking up.

What's interesting is that the article does not mention how well he was doing academically.

<comment><AUTHOR> In the case of a man with a name like that in the United States, publishing the photograph of a charged defendant (which is quite routine here, actually) may do a favor to other people who have the same name but are not that man.

<comment><USER2> The counter of that is that they shouldn't be publishing the names of defendants in the first place.

If someone is exonerated (unlikely in this case, but still) then their lives are still ruined, _especially_ if their name is rare.

<comment><AUTHOR> No, actually here in the United States the presumption of innocence for the accused is sufficiently strong that it is all right to publish the names of the accused. The reason that the names of criminal defendants are a matter of public record is precisely to avoid the totalitarian practice of secret trials, in which no defense witnesses come forward because no friends of the accused know that they need to come forward.

<comment><USER2> That's nice in theory, but in practice it seems to lead to trial-by-media.

<comment><AUTHOR> I know from your other posts that you don't live here in the United States. Really, truly readers of the mainstream mass media in my town understand that reports of ACCUSATION of criminal behavior are just that: reports about accusations. Some defendants are acquitted at trial, even after extensive press coverage. There is currently a businessman in my town accused of multiple financial crimes. He is still out of jail as prosecutors prepare for trial, and he still has friends, lawyers, and various forms of practical help in dealing with the accusations against him.

<comment><USER2> Again, in theory it works that way. But in practice, the accusations are front page news and the exoneration is not, if it even gets a mention at all.

In the days before google that may have been ok, but now a reputation is damaged for a lifetime for prospective employers, spouses, business partners and so on that have no knowledge of the case as it happened.

Every year there are more indications that prospective employers will google the names of job applicants, if something negative comes up about you there is a good chance you'll be turned down without so much as the benefit of a chance to tell your story.

It also depends very much on the crime the person is accused for, being accused of some crimes is more easily 'forgiven' than others even if the person was exonerated.

But try finding a job as a teacher once you've been accused of child molestation charges, even after you've been exonerated.

And then there is the problem that even if you are found guilty, there may be a miscarriage of justice or, after you've paid your debt to society you are supposed to be able to start with a clean slate.

If your mug is all over the internet with a juicy story attached to it then you might as well forget about starting over, which in turn might lead to recidivism.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> paywalled.

Does the NY Times understand that not everything that happens at Harvard is of consuming interest to the public in general?

<comment><USER3> I think that all you need to do (for now) is to register. They've said they're going to go to a real paywall system within a year.</comment></comment>


Keep Calm As A Service - <AUTHOR>

kcaas.herokuapp.com
There are 3 endpoints: /
custom/:message (lots of easter eggs here e.g. below)
trending/:provider
keep calm! <comment><USER2> How about using a font that looks at least a little like the original used? That's where, graphically-speaking anyway, the impact of the poster comes from..

[http://www.k-type.com/?p=2199](http://www.k-type.com/?p=2199) or [http://www.dafont.com/forum/read/4200/keep-calm-and-carry- on...](http://www.dafont.com/forum/read/4200/keep-calm-and-carry-on-thanks)

<comment><AUTHOR> I read those links when choosing the font, and several others as well. The font I picked is a Google web font (Cabin) which is closest to Gill Sans, which is pretty close to the original. I should probably use the thicker version, though. Thanks for the feedback!

</comment></comment><comment><AUTHOR> [http://kcaas.herokuapp.com/custom/prosper](http://kcaas.herokuapp.com/custom/prosper)

<comment><USER3> [http://files.zachlatta.com/VtdK](http://files.zachlatta.com/VtdK)

<comment><AUTHOR> updated link

<comment><USER4> yo! .. wht next !?</comment></comment></comment></comment>