What are your criteria to join an existing team (of non-technical members)? (I presume that most YCers are hackers.) - <AUTHOR>

<comment><USER2> 1\. Interesting product or service. I like to work on cool problems.

2\. Team that I like and trust. Implicit in this is that it's people I know; I can't imagine working with non-technical strangers on a business idea.

3\. Non-technical founders know what they don't know and don't try to trivialize it. They don't all have to be hackers, but they do have to realize that you need hackers to get a web startup off the ground.

4\. Fills in gaps in my skillset and covers areas I'm weak in. I'm more than happy to have someone else do the dealmaking, the people-stuff, the legal minutiae, the graphic design, and the drumming-up-business part.

5\. Offers fair equity. Doesn't need to be a majority, but you're dreaming if you think you can get away with 5-10% (some dot-coms in the first boom tried that, with predictable results). If there's one other founder I'd want at least 35-40% (assuming he did almost all the non-technical work), if there're two others I'd want at least 25-30%, if there are multiple I'd want equity on par with what the other "primary" participants are getting.

</comment><comment><USER3> One criteria could be: A majority of existing team members have to be hackers. Otherwise, who will be doing all the work which is primarily technical in the beginning?

<comment><USER4> 1\. Technical yes but you will need someone who can find out every single competitor out there and find a way to make your product better.

2.In addition, you need to be able to find and talk to users who are using your competitor's product to find out what they're complaining about so that you can make it better.

You're probably thinking "a hacker" can do that. Ummmm..hackers have no problem talking to other hackers but how about talking to non-hackers? In addition, you need to make sure that your user interface is idiot proof to someone who isn't a programmer.

Another example of why you need people who understand the industry or your users -

Example: Awhile back there was a debate I had with somoene, can't remember his name so I will call him Mr.Citrus. Anyways, I stopped responding because he was too stubborn. Mr. C and his team are building a site that is a women- related site. Mr.C says that he is going to take on Monopoly X by building site Y. However, after looking at site Y, I noticed that it offers nothing better than Monopoly X. In addition, if Mr.C had people on his team who understood this industry or knew where to look or who to ask, he would have known some juicy gossip related to his competitor that would have assisted him to get acquired quicker or beat out his competitor. What kind of gossip can a non-hacker give him? Well things like:

1\. Monopoly X has a partnership with several women magazines in which the editor of that magazine would never do an article who is a competitor of Monopoly X. So that cuts out an avenue of obtaining users.

2\. The recent acquisitions Monopoly X had acquired as well as the new venture Monopoly X had recently branched out too would provide a glimpse of where the competitor is heading and who/what he just bought. It would have helped Mr. Citrus predict his competitor's next move

3\. Understanding what Monopoly x is missing, and fill in that gap or void because currently, there is a HUGE chunk monopoly X is missing but because Mr. Citrus and his team compose of only hackers who are attempting to penetrate a women related industry, he doesn't see it. And unfortunately, asking your sister or wife for their opinion isn't always helpful b/c if they're not into the whole web 2.0, kill your competitor attitude, they won't offer much opinion.

And that is why you would need a non-hacker...on your team...

Disclaimer: This does not apply to dimwitted, moronic non-hackers who have an idea but don't know the competitors or offer programmers suggestions, opinions, or even know how they can make it better or why something is better

<comment><USER5> The flaw in your reasoning is you present different areas and don't consider overlap. The way you explain it, you make it sound like a hacker / coder is a beast more constrained by his class than a twelfth level paladin.

A successful startup will have members who individually fill many roles with diverse skillsets. For a web startup I fully believe the most important factor is being able to take whatever vision you have and form it into reality.

If you don't understand the customer base you won't do so well. If you can't build your product you won't do anything at all.

<comment><USER4> I'm presenting the point that you shouldn't lump everyone into one category. If you notice the anti-MBA feeling on the forum that they are useless on a team.

Well, how would hackers feel to be lumped into the category of a "beast constrained by his class than a twelfth level paladin."

The point is: Don't lump people based on their degree

</comment></comment></comment></comment><comment><USER4> What do you have to offer to the team of hackers?

Are you somewhat technical savvy? Do you know every single competitor out there and now how to make your product better to slaughter them?

I've heard a lot of entrepreneurs say "I can help with marketing"...um well at the beginning there's no marketing because there's no product. So you need to think of a way to help your team out before the "marketing" phase.

<comment><USER2> Marketing doesn't start with a product. Marketing starts with figuring out what is the right product to build. You should have some idea what the market wants _before_ you start designing the product.

One of the things that attracted me to my (non-technical) cofounder was that he has a pretty good understanding of the market space. That's valuable _in the beginning_ , because it means less flailing around building the wrong project.

Of course, you shouldn't _only_ be doing marketing, because that tends to take a lot of time before development, a lot of time after the product is ready, and very little time in-between. But a smart cofounder (and who would partner with a dumb one?) can find other ways to help out in the meantime. My cofounder is learning Flash and helping on the UI end, for example.</comment></comment>


The Stock Market Is Down But the Movie Business Is Up 14% Over 2008 - <AUTHOR> http://www.slashfilm.com/2009/03/03/the-stock-market-is-down-but-the-movie-business-is-up-14-over-2008/

<comment><AUTHOR> Yep, that piracy stuff is really killing the film industry. 2009 is turning out to be Hollywood's best year ever, even with the economy crumbling around them.</comment>


Stenographer Gets Ass Kicked by Screaming Fast Typing Game - <AUTHOR> https://player.vimeo.com/video/159972167 <comment><AUTHOR> I'm certified at 260 words per minute, but even so Jonathan Coulton's "I Feel Fantastic" was too much for me. I only got 77% accuracy. Can you do better?

Download the 4-song demo of Steno Hero at [http://stenoarcade.com](http://stenoarcade.com) or via Steam. Works with any steno machine or qwerty keyboard.</comment>


Should laws have built-in expiration dates by default? - <AUTHOR> http://www.intellectualpornography.com/2010/03/one-oclock-daily-the-case-for-a-forgetful-legal-system.html

<comment><USER3> What will happen when a law expires? The easiest thing to do—the thing that takes the least thinking, writing and arguing—would be to simply re-instate it. This means that this system, when the principles of efficiency are inevitably applied to it, will actually _encourage_ the permanence of silly laws—laws will simply be made as monolithic as possible, so they only have to re-instate one thing, that everyone can pretend they read already.

Now, instead, imagine a boundary on the _space_ the law may take up. If set near (or below!) the current size of the law, this would encourage something lawmakers never, ever currently do for its own sake: refactoring. It would also encourage clarity, strict and manifold definition of terms (to allow later reuse), and many other strange and exciting (though not necessarily ethically sound) ideas.

<comment><USER4> > What will happen when a law expires? The easiest thing to do—the thing that > takes the least thinking, writing and arguing—would be to simply re-instate > it.

Almost. But they will be read first, followed by a "reinstate" or "let expire" decision. If it's a bad or unnecessary law, this will cost political capital, which favours the "let expire" option.

Then there'll be committee hearings, where citizens affected by the law will get a say, and since the text is open anyway, motions for amendments can be presented.

And finally, it has to actually pass parliament, making the current parliament answerable for the passage, rather than a past one. It's a lot easier to say "yes, I agree that law is not the best, but I have prioritised other issues over fixing it" than "I voted for it, when I had the option of simply pushing the other button."

> Now, instead, imagine a boundary on the space the law may take up.

That sounds like a good idea. No text longer than 2000 words can be passed by a single vote.

<comment><USER5> I've thought for a long time that we should have a cap on the size of the body of law - say, 250,000 words. This would accomplish sunset indirectly. If someone wants to pass a new law and the body of law is already at the limit they'd have to push for something to be repealed first.

As a downside, though, this might lead to obfuscated and confusing laws as legislators try to fit as many ideas as possible into few words, rather like code with lots of three-way operators.

As we're all subject to all of the laws on the books, even though no one could possibly read or understand all of them, this would be a much more fair solution.

The Icelandic example has, in effect, a similar cap. There can be no more laws than the law-speaker can remember. Capping the size of the body of law would be more like the Icelandic example than sunset provisions. Also you wouldn't have to worry about important laws, e.g. murder, from expiring because no one noticed.

[edit - moved from top-level comment to this thread]

<comment><USER6> I don't see how this could work. In a society with a developing technology and economy, new situations come up (e.g., how to allocate spectrum for these cool new cellular telephone thingies) where one could reasonably argue that new government regulations are called for, and old laws are unlikely to become obsolete at the same rate.

So either the total number of words of The Law goes up _or_ some body of executive-branch regulation grows to have the same effect _or_ (as you pointed out) courts read complicated legal doctrines into terse legislative text _or_ the law is so ambiguous that citizens have no way to predict how a court will rule.

Of all these alternatives I think the first is the least bad.

<comment><USER5> I'm not sure how it would work either or if it would. As new technology develops old technologies also become obsolete - thus as we have more laws dealing with biotech and airplanes, we can get rid of laws dealing with leprosy and stagecoaches. More importantly this might force legislators to write their code more efficiently and address the intent of the participants.

You do make some good points about limiting the total size of the legal code but NOT limiting the size of the legal code, as we do now, also has some serious drawbacks.

</comment></comment></comment></comment></comment><comment><USER7> Consider a bicameral legislature where newly elected representatives serve a four year term in the lower body. Their sole responsibility is the review/renewal of existing laws. Every law must be renewed every four years.

After completing their term in the lower body, the representatives graduate to serve a four year term the higher house. Here, they are entrusted with the power of making new laws.

Elections are staggered (similar to the US sentate), so every year one fourth of the members are elected, one fourth move up, and one fourth retire. This way, the chambers have institutional memory and transitions are smooth.

Both houses have the power to change the legislative topography of the nation. Because newly elected representatives serve in the lower house, when citizens vote to change the direction of the country, the first response to public opinion is the removal of existing laws. Only after serving a term in the lower house can laws be added.

To make this kind of system successful, there might need to be a legal review process that demands small, unbundled laws. Or perhaps a simple word count like @derefr and @mseebach suggest.

I guess the fact that we even think about this stuff pretty much means we're geeks. =)

<comment><USER8> As it stands, the State of California has a bureau that uses software to ensure new laws do not conflict with existing ones.

<comment><USER9> Do you have a little more information about that? I'm curious to know how the software would do that, and how sophisticated it is. I would imagine it is simply based on user input representations of the bills, and fairly simple tests, but even that would be difficult to do accurately/effectively.

<comment><USER8> I was involved in a software project there in the late 90's. Their software back then seemed to just consist of a search engine on the text of the bills. There may have been other tools I didn't know about. My project there was fairly limited.

My (probably incomplete or incorrect) understanding was that they would vet a new law by doing keyword searches concerning the main points of the new law. So if a there was a new law about people's lawns, they'd search for "lawn" and whatever other keywords or synonyms would occur to them.

<comment><USER9> Thanks. Makes sense. I was curious because I've spent much time developing quality case parsing and semantic analysis technologies, and one of the very difficult problems I've been interested in - but not yet approached - <USER2> automatically parsing and analyzing legislation. I think there is much headway that will be made there in the coming years/decade, but it's a tricky problem.

</comment></comment></comment></comment></comment><comment><USER10> Built in expirations do exist, they just are not required: <http://en.wikipedia.org/wiki/Sunset_provision>

</comment><comment><USER11> I think so...in principle. But imagine how this would work in our partisan legislature - I'm sure you can think of equally awful possibilities regardless of your individual political affiliation. While some bad laws would die a suitable death, some good ones would be made into political footballs as well.

And it would create havoc in the courts. Recall that the Icelanders settled most of their disputes via blood feuds and something like weregeld. Doing that in the modern age would result in many arguments about retroactive punishment and/or restitution for people convicted under expired laws. you might be found guilty, punished, declared innocent, compensated, and then declared guilty after all and owing the money back.

<comment><USER12> Are retrospective criminal laws even allowed in the US? They're generally considered dicey from a human-rights point of view.

<comment><USER13> <http://www.usconstitution.net/const.html#A1Sec9>

"No Bill of Attainder or ex post facto Law shall be passed."

<http://www.usconstitution.net/glossary.html#EXPOST>

"ex post facto adj. Formulated, enacted, or operating retroactively."

This is, however, a limit on Congress.

<comment><USER3> So, if someone invents a whole new kind of evil—say, simulating a universe composed purely of vingtillions of minds being tortured—they go free, even after a law is purpose-made to stop them—but the next guy to do it gets the wrap?

<comment><USER4> > say, simulating a universe composed purely of vingtillions of minds being > tortured

No, you can't outlaw The Sims retroactively.

<comment><USER8> Being tortured by being trapped in the pool and/or in houses without toilets?

<comment><USER4> Stuff like that. Inflicting slow and painful death for amusement.

Frankly, I didn't completely follow derefr's post .. Did he really suggest that there could be a need for laws to govern what happens to simulated minds?

<comment><USER13> Read the book Altered Carbon. People can switch bodies and their minds can be run in simulation and there are laws about running someone's mind in simulation just for the puroses of torture.

<comment><USER4> That's all very interesting, but the "fiction" part of "science fiction" is there for a reason.

And by the way, if you're somehow successful in removing my mind from my body and torturing it in a computer, current laws would apply just fine.

<comment><USER11> Unlike fantasy, the fictional aspect of SF is not permanent. Yesterday's personal communicator is today's smartphone.

Artificial intelligences with distinct personalities are not here yet, but I see no fundamental bounds to their creation and am pretty optimistic about the timeframe. The question of whether such intelligences qualify as people will become a pressing one at that time, even if it seems abstract to you now.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> As a counter example, I present Florida. Florida is a no-fault driving state. A couple years ago, the law that decided this expired for about a month before it was renewed into law again. This sort of last minute law wrangling is a mess and requires millions of people reconsider their insurance temporarily. It's a "great idea," but it's terrible in practice.

<comment><USER4> That's just incompetence. I'm not sure making it easier for politicians to be incompetent is a good idea.

Also, if all laws expire automatically, the working rhythm of the legislative body would change to accommodate this. After all, stuff like passing budgets, which is time sensitive, tend to happen in time.

<comment><USER11> _stuff like passing budgets, which is time sensitive, tend to happen in time._

I'm guessing you don't live in the state of California, where the opposite is true.

</comment></comment></comment><comment><USER6> I'm a little worried about this opening up new opportunities for political brinksmanship. "If the Majority Leader wants my vote to renew the law against dumping toxic waste into the harbor, he'd better let me get my way on the farm bill."

</comment><comment><USER15> Anyone knows where that law comes from? "A person may not walk around on Sundays with an ice cream cone in his/her pocket." It makes me kind of curious

<comment><USER16> No, but there are quite a few strange old laws still around.

For example, if a Welshman crosses the border on a Friday with goods for market, you can kill him.

<http://web.mac.com/jdewynne/OldAquarium/MISC/welsh.html>

"In Shrewsbury in 1776, seven Welshmen were killed, three by musket, three by sword and one was bludgeoned to death with his own crops. The Borders Act has never been repealed."

<comment><USER17> My favorite crazy law is that in Massachusetts it is illegal to display an artificially created albino person.

<http://www.mass.gov/legis/laws/mgl/272-33.htm>

<comment><USER8> In many states, there are laws along the lines of: 5 or more unmarried women living under the same roof constitutes a brothel. Hence, most colleges are running brothels.

<comment><USER6> IIRC Boston recently passed an ordinance forbidding landlords to rent a unit to (IIRC) groups of more than 4 unmarried persons living together. The intent was to deal with absentee landlords who rented houses to large groups of students, since (a) the students, as a rule, could outbid working families interested in the same kinds of housing; (b) there have been a number of problems with students being bad neighbors (drunken late-night parties, and so on).

Since Massachusetts has same-sex marriage, I suppose that six Boston College students looking to crowd themselves into a three-bedroom house _could_ take a short trip to City Hall and present themselves to landlords as three married couples....

</comment></comment></comment></comment></comment><comment><USER18> Yes, of course they should, but this will be exactly as meaningless as the other tools in your "democracy" toolkit.

I see what you're getting at, but you are waaaaay late to the party.....the democracy thing has already been figured out.

But, it's always good to hear from citizens. The government likes people to feel they have a voice in the way their country is run!

</comment><comment><USER12> I'm extremely dubious about the claim that it's harder to repeal old laws than to create new ones. Why would this be the case?

The big problem I see is that it makes it harder to know what the law says at any given time; that's an inevitable result of more change. Change isn't necessarily bad, but in this case, change for change's sake undoubtedly is.

<comment><USER19> > The big problem I see is that it makes it harder to know what the law says > at any given time;

It's already the case that no one knows "what the law says at any given time".

> Change isn't necessarily bad, but in this case, change for change's sake > undoubtedly is.

It's not change for change's sake. It's change to get rid of laws that aren't worth renewing. Since laws are, by definition, threat or imposition of force, they should be somewhat valuable.

I'd argue that simple renewal isn't enough, that renewal should require more effort/votes than the original passage. After all, renewal comes after experience. If a law actually works, it will have more support with experience.

Note that expiration also makes it reasonable to try more experiments because you can reasonably say "hey, if it doesn't work, we're not stuck with it". With "stay until explicit repeal", it's a lot more work to undo mistakes. (Note that almost all laws have benefiaries, and those folks fight tooth and nail against repeal to keep their benefits.)

<comment><USER12> > It's already the case that no one knows "what the law > says at any given > time".

So nobody knows, for example, the road rules in their local area at any given time? That's my point: it's incumbent on people to know _some_ laws. The more stable these laws are, the easier it is to know what they say. This proposition makes them less stable.

> It's not change for change's sake. It's change to get rid > of laws that > aren't worth renewing. Since laws are, by > definition, threat or imposition > of force, they should be > somewhat valuable.

So repeal bad laws. That sounds like a better idea than presuming that all laws are bad and repealing them automatically.

<comment><USER19> > nobody knows, for example, the road rules in their local area at any given > time?

Actually, they don't. Almost every vehicle, including those fresh off the lot, will fail an inspection by someone who wants to find a problem.

> The more stable these laws are, the easier it is to know what they say. This > proposition makes them less stable.

You're assuming that this change will significantly affect people's ability to know the law. It doesn't - they're already ignorant AND the law mutates enough as it is.

> So repeal bad laws.

It's almost impossible to repeal things. The US still has a mohair subsidy from WWI.

> That sounds like a better idea than presuming that all laws are bad and > repealing them automatically.

I'm not presuming that all laws are bad. I'm proposing a mechanism for getting rid of bad and obsolete laws that has some chance of actually working.

We don't elect legislators for life, so why should the default for laws be "forever"?

<comment><USER12> > It's almost impossible to repeal things. The US still has a mohair subsidy > from WWI.

This is what I don't get; why? I get that laws aren't repealed as often as they should be. My personal suspicion is that it's a lack of political will. I'm not from the US, I don't know that much about the political system. I imagined that repealing a law would be a matter of passing a bill, same as making one. Is this assumption wrong?

<comment><USER19> > I imagined that repealing a law would be a matter of passing a bill, same as > making one. Is this assumption wrong?

That's correct.

> This is what I don't get; why

Why doesn't matter. What matters is whether it's true, because it's silly to act as if things are different, and what you're going to do about it.

> My personal suspicion is that it's a lack of political will.

Laws have beneficiaries. For example, someone is collecting that mohair subsidy. Those folks are quite motivated to keep things the way they are. The folks who would benefit from killing ths subsidy are diffuse - they don't even know that they're paying it.

Plus, legislators get rewarded for doing "new" things, not for fixing old ones that no one remembers.

That's why my "must be renewed every so often" proposal requires more and more effort to pass each time (approaching some limit). The longer that something has been around, the more popular it should be if it's actually worthwhile.

<comment><USER19> Argh - too late to edit for clarity.

The assumption is correct - the mechanism for repealing a law is just like the mechanism for making a law.</comment></comment></comment></comment></comment></comment></comment>


Is PrivDog another Superfish - <AUTHOR> While reading about Superfish, I ran this simple test at https://filippo.io/Badfish/ by visiting the webpage and noticed despite the fact i don't have superfish installed i failed the test and got "Yes, Your connections can be tampered with".
After quick check on my system, I realized I might have failed the test due to the presence of PrivDog (http://www.privdog.com/) on my system.
Here is a screenshot of Bank of America http://i.imgur.com/pbEFW5X.png
Is this another Superfish? <comment><USER2> Did you get Privdog with Comodo Internet Security, if so can you share what version of Comodo Internet Security it was ?

<comment><AUTHOR> Its came with the version 7 and you can see here [https://help.comodo.com/topic-72-1-451-6840-.html](https://help.comodo.com/topic-72-1-451-6840-.html) it says

You can install PrivDog while installing Comodo Internet Security or by downloading the app from www.privdog.com/downloads.html

I saw the option to install PrivDog while Installing the Comodo Internet Security

<comment><USER2> It looks like Privdog which was bundled with CIS didn't have the vulnerability (it was an older version of Privdog) but if you downloaded it from the website you would have had the new version (Privdog v3 or later) which would have had the vuln.

If you're running the version of Privdog which came with CIS could you check the version of Privdog ?

Badfish shouldn't have failed for you with the bundled version, but if it did that's probably something that needs to be looked at more deeply.

</comment></comment></comment><comment><USER3> Actually it is worse than Superfish.

It does TLS MitM, but it doesn't do any verification at all. It just accepts every self-signed cert and replaces it with a cert signed by it's locally installed root cert.

So it completely disables HTTPS protection. Everyone who has this: get rid of it, this is super-dangerous.

</comment><comment><USER4> Looks like one of those malwares that takes the ads out of a website and replaces them with its own. In order to do this over SSL/TLS it has to use its own certificate—as if that weren't bad enough, you're vulnerable to man-in- the-middle attacks through HTTPS.

<comment><AUTHOR> Why would comodo promote such a software ???

<comment><USER5> Apparently security software giants have motives other than security these days.

This really makes me put more faith into microsofts own defender.

</comment></comment></comment><comment><USER6> There are a bunch of these - check the cert that you're getting from BofA and add a comment here if it's similar:

[https://gist.github.com/Wack0/17c56b77a90073be81d3](https://gist.github.com/Wack0/17c56b77a90073be81d3)

</comment><comment><USER7> Yes, it is!

The fact that you're getting this result from the Badfish test page means that _Privdog is not validating SSL certificates correctly_. This is incredibly bad -- uninstall this software immediately.

<comment><AUTHOR> Its bad enough because this was bundled with Comodo Internet Security ( [https://help.comodo.com/topic-72-1-451-6840-.html](https://help.comodo.com/topic-72-1-451-6840-.html) and [https://help.comodo.com/topic-169-1-413-6109-.html](https://help.comodo.com/topic-169-1-413-6109-.html) )

<comment><USER8> Neither of those links imply that PrivDog is bundled with those apps. It just mentions it as something you can download.

 _Edit_ : Just re-read the linked document. Yes, it does indicate that it's an install-time option. However, I've yet to see confirmation that Comodo software comes bundled with the SSL-intercepting version of PrivDog.

<comment><USER9> It auto-installs via nagware however.

</comment></comment></comment></comment><comment><USER10> waited and its fixed, and ran test: Good, you seem not to trust the Superfish CA. Also no other SSL-disabling product was detected on your system. with PrivDog installed No need to uninstall it. Sometimes give it 24 hours from when uncovered and things are fixed after releasing the info. For those that said remove immediately, well you can reinstall it now, for those that waited like me, good job as I wasn't using my pc when the report was posted/then the app was updated.

</comment><comment><USER10> Made the bbc: [http://www.bbc.com/news/technology-31586610](http://www.bbc.com/news/technology-31586610) Update: "The issue potentially affects a very limited number of websites," the firm said in a statement.

"The potential issue has already been corrected. There will be an update tomorrow(2/24/2015), which will automatically update all 57,568 users of these specific PrivDog versions."

Ad-blocking software is 'worse than Superfish'

The software was created by the founder of security firm Comodo

Researchers have identified a fresh threat to the way consumers interact with websites, this time from software designed to block advertisements.

PrivDog has been found to compromise a layer of the internet known as Secure Socket Layer (SSL) - used to safeguard online transactions.

It follows the discovery of a similar problem with Superfish, software pre- installed on some Lenovo computers.

PrivDog said that its issue might compromise more than 57,000 users.

"The issue potentially affects a very limited number of websites," the firm said in a statement.

"The potential issue has already been corrected. There will be an update tomorrow, which will automatically update all 57,568 users of these specific PrivDog versions."

PrivDog - a tool designed to block ads and replace them with ones from "trusted sources" \- joins a growing list of software affected by related security flaws.

Experts say they have uncovered a further dozen examples since Superfish was brought to the public's attention last week.

Superfish was designed to help users find products by visually analysing images on the web to find the cheapest ones.

But it compromises security by intercepting connections and issuing fake certificates - the ID's used to identify websites - to trick sites into handing over data. This a practice commonly known as a man-in-the-middle attack.

Lenovo has since issued a tool to allow users to remove the hidden software. It now faces legal action from a group of users who say that it acted unlawfully in pre-loading it.

Shocking PrivDog, has been described by several experts as being "worse than Superfish".

A particular concern is its links to the security firm Comodo, which issues a third of the secure certificates used on the web.

PrivDog was developed by the founder of Comodo, Melih Abdulhayogulu, and some versions of it are packaged with Comodo's own software.

But Comodo told the BBC that the affected versions "had never been distributed" by it.

A discussion begun on the Hacker News forum first uncovered that in the process of swapping adverts, PrivDog also appeared to leave machines vulnerable to attack.

In a blogpost freelance technology journalist Hanno Boeck explained: "A quick analysis shows that it doesn't have the same flaw as Superfish, but it has another one which arguably is even bigger."

"PrivDog is in every sense as malicious as Superfish," added Simon Crosby, co- founder of security firm Bromium.

"It intercepts and decrypts supposedly secure communication between the browser and a remote site - such as the user's bank - ostensibly to insert its own advertising into pages in the browser.

"It is substantially more scary, though, because PrivDog effectively turns your browser into one that just accepts every https certificate out there without checking its validity, increasing vulnerability to phishing attacks, for example."

User privacy Last week Comodo announced that it had become the number one digital certificate authority in the world, with its products used by nearly 35% of all websites ending in .com.

"They are one of the leading certificate authorities, and the fact that PrivDog is issuing fake certificates is shocking," said Marc Rogers, principal researcher at security firm CloudFlare.

In a blogpost written at the beginning of 2014, Mr Abdulhayogulu said that he had developed PrivDog "with the privacy of the user in mind".

"Isn't it great that the company whose DNA is about your security makes more money so that they can continue to innovate and invest in products that make you safer," he wrote at the time.

Parental controls Security experts have identified a growing list of software that appears to interfere with SSL.

Most of the products were developed by security firms, said Mr Rogers.

They include anti-malware software and tools designed to offer parents more control over their children's web browsing.

All can be traced back to Komodia - technology developed by an Israeli firm, which describes itself as a "SSL hijacker".

At the time of writing, Komodia's website was offline. It blamed this on a denial-of-service attack prompted by "recent media attention".

</comment><comment><USER11> Maybe. Export the cert and post it.</comment>


Ada 2012: A New Language for Safe and Secure Software (2012) - <AUTHOR> http://cotsjournalonline.com/articles/view/102810 <comment><USER2> These articles give the worst impression of Ada possible. It's not the it's a specialized language for the military, but a language created to cleanup the DoD's software nightmare of the 70s, which is not unlike the software nightmares of today. It just happens that they had a pretty good grasp, even at that time, of what helps make good software easier to write, large software projects easier to manage and maintain, and strong ideas about how much a language should intervene if the programmer is doing things that look pretty dumb.

Ada has a neat OO system (not like the Javas or C++s), built-in state-of-the- art tasking (since 1983!), ranged types (one of the things I can hardly bare to live without), but also simple things like switches that aren't useless and just a general appreciation for what a discrete type can allow you to do. It has generics, too, though I know they've been proven irrelevant by newer languages. Have you seen that new Java 8 date time stuff? It's playing catch up to Ada. Ada's numerics are, hands down, the best facilities of any mainstream language.

Most importantly, it's probably already available for your Linux distribution because it's a part of the GNU Compiler Collection, which means that it's on the commercial OS you've settled for, as well.

An out of print book that I always recommend to those who are interested in playing with Ada is John English's "The Craft of Object-Oriented Programming". Enjoy.

[http://www.adaic.org/resources/add_content/docs/craft/html/c...](http://www.adaic.org/resources/add_content/docs/craft/html/contents.htm)

<comment><USER3> I did the first couple years of my undergrad (starting 1990) in Ada. I liked the generics, although the lack of inheritance was peculiar for an OO language. As a Pascal programmer in high school, Ada was pleasant and familiar, but I quickly lost interest when I discovered Eiffel. Eiffel felt like what Ada should have been from the beginning.

I've not written a single line of either post-graduation.

<comment><USER4> Sadly both suffered from enterprise prices by the compiler vendors.

Although Ada seems to be quite well in high integrity systems. At least that is my perception from the, now regular presence, at FOSDEM and European safety conferences.

</comment></comment></comment><comment><USER5> I was an Ada programmer for about 4 years in the aerospace industry.

I remember my last Ada project. It was run as a traditional 'waterfall' project (In the early 2010s). I sat in my hole (cubicle, in the very center of a massive cube farm) coding away on a simulation model for a satellite's attitude control system, while the other devs worked on their own modules in silence and isolation. Integration and testing was pushed all the way to the end of the project.

I was a scumbag contractor, hence I was not allowed to see the complete code base like the regular employees were, so I couldn't, say, do a complete build to verify my stuff worked (because some of the libraries I needed to build my module I wasn't allowed access to). So I was armed with the Ada compiler as one of my only tools (I just had to ignore the link errors. Though, I _was_ able to code up a few tests for some of the algorithms I was able to isolate, even though unit testing was neither expected nor encouraged, as it did nothing to increase my SLOC numbers -- i.e., "wasting time").

I worked slowly and deliberately (getting constant flak for my SLOC numbers not going up fast enough -- and apparently if you ever reduce your SLOC, you've made _negative_ progress), and at the end when I passed my code off to the 'build master' to my amazement my module built and largely _just worked_. I have to give credit to the language -- it caught a __ton __of stuff at compile time.

Suddenly I was no longer a slacker (Gee, thanks). At the end of that project I left and never touched Ada again. I now (probably unfairly) associate Ada with old-school waterfall-driven software development and dank, dark offices with flickering, soul-sucking fluorescent lights.

<comment><USER6> You'll like this:

[http://www.folklore.org/StoryView.py?story=Negative_2000_Lin...](http://www.folklore.org/StoryView.py?story=Negative_2000_Lines_Of_Code.txt)

<comment><USER5> Been a while since I read that :)

I do remember entering a negative number one week on the manager's "status spreadsheet (an excel spreadsheet on a network share that he asked everyone to edit)" next to my name. Of course he came by asking for an explanation, and if memory serves had me enter the number of lines deleted as a positive number, so that the 'metrics' he reported up the chain didn't look bad.

</comment></comment></comment><comment><USER7> American programmers like to think they are engineers. German ones cannot because "engineer" is a legally protected title here and programming is not recognized as an engineering discipline.

I think that is justified by the way. Programming is a fad / fashion driven industry more than anything.

This is relevant here because whenever I look at Ada source code I hear synth pop. It is _so 1980s_. Sorry, maybe if Google or some other hip company took Ada, and simply changed the superficial appearance (i.e. syntax, identifier names) to look more 2010ish, gave it a cool name, and marketed it as the hot new thing it might go somewhere.

Sad fact is, whatever merits Ada has or does not have is completely irrelevant until that happens.

<comment><USER8> Probably explains why Germany is such a powerhouse in software development NOT.

I do wonder about the effect of all the bright kids who would do CS/Computing in the USA/Uk instead want to work for Audi.

Rigid hierarchies do have down sides until recently get put on the vocational track in the German school system that was it you where on it for life and it was almost impossible to go from Aprentice-> Technician to Engineer.

<comment><USER9> It might not be a powerhouse but it's fairly stable/good. There's at least one major player (SAP) there's plenty of companies in future fields (Metaio for AR for example) and there's a lot of in house stuff. There's also sort of an "alternative OS" tradition (Suse, yellowTAB). There's also more of a focus on business software (SAP influence might shine through) imo (the difference between Wirtschaftsinformatik and Information Systems has been discussed at length in journals)

Berlin is one of the better non-SV startup locations from what I hear.

<comment><USER10> " _There 's at least one major player (SAP)..._"

I'm not very familiar with any of the other examples you mention, but, uh,....

Have you ever gone anywhere near SAP?

<comment><USER9> I've worked for a competitor. Independent of the quality of their products SAP is still a big software company and the German software marked makes up roughly 50% of the entire European market. At least that was the case around 2012 haven't checked since (SAP alone is responsible for most of it). My point is merely that Germany is hardly a software wasteland and the assertion that "the talented people flock to traditional engineering" is somewhat dubious (imo).

There's some cultural indicators that programming is a topic of interest as well (the existence and size of the CCC for example).

</comment></comment></comment></comment></comment><comment><USER9> The only thing I remember about Ada is that it introduced exceptions (or maybe was one of the languages that spread it). Useful little tidbit since I like to keep a mental picture of what languages roughly influenced other languages. +it has a military/secure programming background (and thus is inherently friendly towards proving/verification) It was fairly widespread in Austria for a while (90s).

Never really used it and kind of expected it to be dead or only used in specific old systems. Interesting to see that there's a new version (I have to admit I'm still stuck on 95 and missed 2007 completely).

Edit: I think SAP generates roughly 1/3 of all European software revenue so that's already pretty major. Germany has always hovered around 50% of the European software market (last time I checked was a couple of years ago)

<comment><USER4> Exceptions were already in CLU and Mesa (70's), among others.

</comment></comment><comment><USER11> "Ada: A New Language"

Haha. Did I just take some acid and end up back in 1973. That would be cool if this is true. Now I can really see Pink Floyd live.

<comment><USER12> No, you just missed the "2012" part of the headline. :)</comment></comment>


Building a dead link checker in Swift to analyze the state of my 1,078 bookmarks - <AUTHOR> https://markjames.dev/2020-04-20-bookmark-dead-link-checker-swift/ <comment><USER2> I didn't see any code to deal with timeouts, which could be ambiguous around link health.

A weighted system, where things like timeout, NXDOMAIN, etc, have specific probabilities of a "dead link" seems like the right path to me.

</comment><comment><USER3> I should do this for my 76,259 bookmarks.

I'd be very pleased with a 70% retention that i could send off to an archival service.

<comment><USER4> Would you export them and upload that as a pastebin?

<comment><USER3> Hah, what is your interest?

<comment><USER5> yes</comment></comment></comment></comment>


Show HN: JavaScript and Node.js API (Library) for Dropbox, Google, OneDrive and Box - <AUTHOR> http://www.cloud-rail.com/product

<comment><AUTHOR> We released our Node.js Library and added Box.com as a connected service plus a lot bug fixes. Open for any comments and feedback :)

<comment><AUTHOR> Btw: Our JavaScript SDK, which already was on HN, is now out of Beta and stable.

</comment></comment><comment><AUTHOR> What should be the next service to be accessible via our API?

</comment><comment><USER2> Is it open source?

<comment><AUTHOR> Actually no. But it is free to use.</comment></comment>


US to shoot down broken spy sat - <AUTHOR> http://www.cnn.com/2008/TECH/space/02/14/spy.satellite.ap/index.html

<comment><AUTHOR> I sure hope they plan to do this in such a way as to minimize the debris in orbit.

Also, wouldn't be embarassing if they missed???</comment>


Warning: App Store scrapers can discover apps before their release - <AUTHOR> I just received a startling email from a user of my company's first iPhone app, informing me that they'd learned of our new app on AppMiner and wanted to know why it was only available in the U.S. App Store. The problem? The app hasn't been released yet!
After a few minutes of panic, checking the actual App Store and confirming the app hasn't accidentally been released early, I realised that websites scraping the App Store listings can apparently pull information on unreleased apps. A quick search shows up three other app listings sites which have info on this unreleased app.
A lot of effort's gone into planning the release of this app, and it's frustrating to have information leak early. Not a disaster in this case, but not great - for example, the price point listed is wrong.
So be warned: make sure your app metadata is ready for public consumption before your app exits the review process - whatever you've set its release date to! <comment><USER2> One side-effect of this is you can also give out promo codes between the app being approved and being released.

</comment><comment><USER3> What site are you using to view the unreleased app info?

<comment><AUTHOR> AppMiner.com and iApper.com are both showing listings. A Google search shows up some other sites, but the mentions seem to have disappeared now.

</comment></comment><comment><USER4> You might want to file a bug report to Apple.

<comment><AUTHOR> I have submitted a bug report, but I'm not sure if I can expect much response.

As far as I know, these sites are already 'misbehaving' by scraping the App Store info, and Apple seems to turn a blind eye - will they bother plugging security holes in an interface which is already being abused?

</comment></comment><comment><USER5> Thanks, this is good information to have.</comment>


The software engineering lifecycle: How we built the new Dropbox Plus - <AUTHOR> https://dropbox.tech/frontend/the-software-engineering-lifecycle--how-we-built-the-new-dropbox?hn=1 <comment><USER2> I wish dropbox had fewer features not more. Peak dropbox was like 5 years ago

<comment><USER3> Yeah. It's too expensive now.

G Suite is $12 USD / user / month. It gives you unlimited storage. AND everything else like Meet, Forms, Docs, Slides, Mail, Sheets, Apps Script, etc.

Dropbox is $15 / user / month. For 5 TB. How does that even make sense? The features are also lacking. SSL is apparently a feature now.

<comment><USER4> G Suite is an incredible value. I have an account with a single user, paying $12+tax/month. On that account I have 20TB in Drive. Good luck getting that kind of storage pricing elsewhere, I'm actually nervous about Google ever deciding to kill the heaviest users or charge more because I don't know where else I would go.

In my understanding my 20TB isn't just 20TB sitting in their datacenter, it's de-duped across accounts. But still, amazing value.

<comment><USER5> Isn't it <= 1TB if less than 5 users ?

<comment><USER4> Technically, yes. But it has never been enforced AFAIK. That could change tomorrow of course, so I would be cautious of using it for anything that is very important.

<comment><USER6> I suspect that posting about this on HN is one of the fastest routes towards getting this fixed, in terms of concentration of Google engineers likely to see your post.

<comment><USER4> Ha, that would be super unfortunate. But not too worried about that happening. It's been openly talked about online for years with no action.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> > While we started as a storage company, we've grown to be a hub to manage > your digital life.

This line from the linked post is a great summary of exactly how I think Dropbox's product direction has taken a turn for the worse.

This is no sleight against the author (who seems to be doing great work; I enjoyed this read!) or the engineering team. Just like, the general direction of the company. This line also stands out:

> it had been a while since we delivered new value to our personal users.

I can't speak for all paying users, but the value I derive from Dropbox is how it syncs fast and "just works". I do _not_ find new value in popups and notification badges about features that other companies have already perfected (much like I don't need to go anywhere else for file syncing).

I realize I'm not representative of the userbase as a whole, I'm just frustrated.

<comment><AUTHOR> We get it. The simple truth is we need to provide more than just storage to succeed in the marketplace. We rewrote our sync engine recently to make things much more performant and we're working on shipping more value to users with fewer upsells.

[https://dropbox.tech/infrastructure/rewriting-the-heart- of-o...](https://dropbox.tech/infrastructure/rewriting-the-heart-of-our-sync- engine)

FWIW you can turn off all the notifications in the preference panel.

<comment><USER8> (this sounds snarky but is not, I'm genuinely asking)

Which notifications option do I uncheck to stop from getting the popup asking me to upgrade to dropbox plus that I got this morning?

<comment><AUTHOR> Click the dropbox icon, click your avatar, preferences, notifications for most in app notifications.

TBH the whole point of Basic is to be a trial sku so I don't know if you can turn those off. We do want you to become a paying customer :D

<comment><USER9> Call it Dropbox Trial edition then, not Basic.

</comment></comment></comment></comment></comment><comment><USER10> The only change I've noticed in Dropbox is it's getting less and less convenient to simply open the Dropbox folder in Finder. They really, really want me to use their fake file browser app thingy, which I loathe

</comment><comment><AUTHOR> Author here, happy to answer any questions about how we build products at Dropbox.

<comment><USER11> Very well written and amazing job. I really trust Dropbox engineering teams. My only wish would be the return of the simple desktop app for those of us that just need ultra reliable synced folders (I use macOS). The app today is bloated and upon boot takes 600MB of RAM. Would you guys ever consider a streamlined version of the app for desktop?

<comment><AUTHOR> This is definitely something we're talking about. We're aware there are a set of users who want just sync and we're figuring out how to ship that while making our other features discoverable.

<comment><USER12> HN is a tough crowd to sell everyman software to. Compared to your moderately tech literate person off the street, many here fiercely stand their ground on the computing solutions that they choose. Maybe this is a consequence of knowing how the sausage is made.

I admire your goal to try to deliver value to _both_ groups. I think this strategy is broadly underappreciated, and I expect it improves the product faster than focusing on either group exclusively.

<comment><AUTHOR> Thanks so much. We love to share how we build things with the tech community and we know the tradeoffs when we post them.

We're just a bunch of people doing our best to do right by our users.

</comment></comment></comment></comment></comment><comment><USER13> I wish Dropbox had a lite version which could just sync my files without having to install over 100 MB of useless bloat

<comment><USER14> It's called syncthing.

</comment></comment><comment><USER15> I have been a long-time Dropbox+ (and now Dropbox Family) user. I don't mind so much that it is more expensive than the paid personal G/M offerings. It (usually) just works for me, however over the last year annoyances have crept in. Specifically the new File Explorer interface. It is incredibly slow and inefficient and I curse myself every time I open it instead of through the native Windows File Explorer. Hope that gets fixed soon. That annoyance alone is probably not enough to drive me to another service, assuming other features don't get degraded. Paying 200$ for a product that fights you is not something i plan on doing for a long time...

<comment><USER16> What stops you from using the normal Windows File Explorer? As far as I know the Dropbox replacement for Explorer is optional.

<comment><USER15> Yes it is, but launching it from the system tray icon forces you to use their interface and it is a pain. Like I said, this specific issue is not a deal breaker, but if their other features take a turn for the worse the way this has then it would be time for a change.

</comment></comment></comment><comment><USER17> I've been disappointed with CPU/battery usage recently. When adding a lot of photos, I have to plug in my laptop--otherwise the battery dies.

When uploading a 100MB file on a gen8 Thinkpad:

\- Dropbox uses 6 minutes of CPU time, basically maxing out a core for the entire upload

\- offsite scp uses <1 second of CPU, so scp is >100x more efficient than Dropbox

\- In wall clock time, Dropbox is 4x slower.

I imagine their sync problem is very very hard, but but pushing bits up for a large file should be much more efficient.

</comment><comment><USER18> Seeing a lot of negativity here re: "Dropbox should just sync files." Personally I'm stoked about Dropbox branching out to help with more aspects of digital organization, and I think they're well-positioned to do it. All that remains is whether or not they can execute that well.

Good luck, Dropbox!

<comment><AUTHOR> Thanks so much! We're very excited about our roadmap.

</comment></comment><comment><USER19> I struggled to understand the relevance of Dropbox as soon as the alternatives of Google Drive and OneDrive came on the market with vastly more storage capacity.

Is there a sizable market for people who require locally-stored content synchronised to the cloud (e.g. video editors?) Beyond that, the only people I encounter day-to-day who mention Dropbox are those not sufficiently tech-savvy to have known about the free alternatives mentioned above, and are still coasting on Dropbox's first mover awareness advantage.

<comment> rv-de I don't want to use Google and onedrive doesn't work seamlessly on Linux and Android.

<comment><USER20> What's your issue with OneDrive on Android? It has been working perfectly for me and for everyone around me for many years. Really fast sync, tight integration with the OS, and so on.

<comment> rv-de and on Ubuntu?

</comment></comment></comment></comment><comment><USER21> I love some of the Dropbox features, but the thing that annoys me EVERY time I log into their website is that it wants to try and shove team plans in front of me.

I actually logged in just before posting to check if it was still there and yep. Giant popup in the corner of the window[1].

I have dismissed these types of notices multiple times. What I don't understand is WHY. Surely it can't be a good idea to harass every one of your individual users to become a business user.

[1]: [https://www.dropbox.com/s/hibz1zkohjnc2ly/Screen%20Shot%2020...](https://www.dropbox.com/s/hibz1zkohjnc2ly/Screen%20Shot%202020-09-17%20at%207.36.50%20am.png?dl=0) (yes it did just sync that screenshot to Dropbox).

<comment><USER22> I posted something similar a few months back[1] - since then, I have ditched Dropbox.

I felt like they really weren't interested in me as a consumer.

I have switched to OneDrive. I already had a subscription to Office 365 (Home), so I've not spent any extra. I can't complain so far. It actually feels like a consumer product.

[1]: [https://news.ycombinator.com/item?id=23797065](https://news.ycombinator.com/item?id=23797065)

</comment></comment><comment><USER23> What are the cases where Dropbox works well for people? Years ago I used to regularly have people tell me "my computer is slow, how do I fix it?" I look at their running programs, uninstall Dropbox, and their computer is no longer slow. I hoped maybe a combination of better resource usage by Dropbox and increasing computing power had alleviated that issue, but just the other day another person called me with slowdown issues and sure enough the culprit was Dropbox, which they had just installed.

<comment><AUTHOR> This should be substantially better since we shipped our new sync engine

[https://dropbox.tech/infrastructure/rewriting-the-heart- of-o...](https://dropbox.tech/infrastructure/rewriting-the-heart-of-our-sync- engine)

<comment><USER24> You might want to know that Dropbox Passwords hogs the CPU On windows if the browser is running but the Passwords native app is not. You will see high CPU usage from the Windows Delivery Optimization service, but the culprit is DBP whose extension is trying to contact with the host app in a loop, constantly spawning processes that die.

<comment><USER25> Thanks so much--nsm alerted us and we have a fix in the works--an update should be available presently.

</comment></comment></comment></comment><comment><USER26> Why doesn't Dropbox have a middle ground solution between free and $15/month for 5TB?!

I've been asking myself this question for a long time. Every other cloud storage provider has something like 100GB or 500GB for a nominal 3$ or 5$ per month. Dropbox works really great, but it's painstakingly frustrating that they their barrier to entry is too high that makes non-business users almost give up.

<comment><USER27> Likely because profit-per-user falls off a cliff very rapidly under $10, due to increased support and admin costs and ballooning storage requirement. They would rather make $12.50 from 1 user than $0.50 from 25 users. Other players have different requirements (most of the value they get is into keeping people locked in their ecosystems).

</comment></comment><comment><USER28> My two cents, thanks for the developers, Dropbox works perfectly and it's hands down the best place to store one's digital life.

I am a paying gsuite user, and nevertheless I pay for Dropbox because Google is not even close to where Dropbox is in this area. How to verify this: try to resync every couple of minutes a file of 500mb or more with only few changes on Drive with the sync client, then do the same with Dropbox. Delta syncing in Dropbox is still unbeaten, even by those that claim they have it (Google doesn't to my best knowledge, I think Microsoft introduced it a while ago, but doesn't work as good, try the same test).

</comment><comment><USER29> If this is the place to share feature requests, I would like to be able to find the largest files in my Dropbox using the web interface.

</comment><comment><USER30> Which user asked for a password manager!? When will these companies do real market research

<comment><USER31> > Which user asked for a password manager!?

Likely not many, but that's likely at least partly due to a lack of exposure: The market is still severely under-saturated - Everyone should have one, but not that many non-techies do. Thus if you're in a position to make someone try your password manager that may be a serious advantage.

</comment></comment><comment><USER32> Are there any other sync services that can handle large git repos without choking?

It's been a few years since I last checked but when I did Dropbox was the only one that didn't choke

<comment><AUTHOR> Honestly just use GitHub. My (high level) understanding of sync is file system issues file event for every file change, we receive it, determine if its relevant, and then make the appropriate delta. You can imagine with thousands (or millions) of small files this becomes nearly impossible to manage with an OS integrated sync engine.

<comment><USER32> Indeed, and I do/did, but I was in an environment where I would switch quickly between a laptop and a desktop, and Dropbox sync worked extremely well for quickly switching between the same codebase on multiple computers, even with our large, half-a-decade git repo

<comment><USER33> You can put the .git directory outside the working directory. Might be helpful. Sync the working dir with a sync service, but the .git dir with... git.

</comment></comment></comment></comment><comment><USER34> Ditch Dropbox, use something like Syncthing [https://syncthing.net/](https://syncthing.net/)</comment>


Hybrid Bicycles May One Day Power City Buses - <AUTHOR> http://www.switched.com/2009/07/19/hybrid-bicycles-may-one-day-power-city-buses/

<comment><USER2> I'm all for innovation and sustainability, but come on!

Could someone put some some numbers on this? Is the extra weight(and price) of the battery and the loss of energy at each power conversion worthwhile?

<comment><USER3> From what I've heard, not at all. Basically, this is making bike riders go slower so that they can ride longer and put some small amount of power into a bus.

However, what some gyms are doing is hooking up essentially the same thing to their stationary bikes, and hooking those up to their power grid. This has apparently saved them decent chunks on their power bill.

<comment><USER2> So bikers spend more energy so others can ride.</comment></comment></comment>