Cameron reaffirms there will be no "safe spaces" from UK government snooping - <AUTHOR> http://arstechnica.co.uk/tech-policy/2015/07/cameron-reaffirms-there-will-be-no-safe-spaces-from-uk-government-snooping/ <comment><USER2> Is this really about terrorism? I have a feeling that terrorism is the excuse being used to try and surveil the public generally.

Why would they want to do this? My feeling is so that they can keep control of public order. It's a mystery to me why there hasn't been more public activism around unemployment levels and wealth equality in Europe so far.

[http://www.theguardian.com/commentisfree/2014/apr/01/europe-...](http://www.theguardian.com/commentisfree/2014/apr/01/europe- young-people-rioting-denied-education-jobs)

<comment><USER3> I'm a firm believer that the whole "Terrorism" illusion has been foisted in order to maintain control of increasingly uncontrollable populations (as information is a powerful weapon).

I mean, Germany, 1930's, they deflected from the economic woes inflicted by reparations by banging on about communist and jewish terror - and that's just one, small, well-known recent example. This tactic has been applied over and over since hierarchical societies emerged - i.e. forever.

I'm sure tribal big men thousands of years ago would go "hey, don't look at me, I didn't make the yams not grow this year, it's those fuckers across the valley, worshipping the wrong gods! Let's get 'em!!!".

Same same.

<comment><USER4> _I 'm a firm believer that the whole "Terrorism" illusion has been foisted in order to maintain control of increasingly uncontrollable populations (as information is a powerful weapon)._

Note the way voting patterns are trending in the UK, long term, with both major parties from the historical duopoly now in decline and more people voting for a minority party than for the eventual government. Note the way the UK is being marketed as a hub for international finance and London turned into a dormitory town for global billionaires. Every government since Bloody Sunday has been worried about public insurrection somewhere, to some extent: arguably the UK is in a long-term trend towards what used to be called a pre- revolutionary situation, as the interests of the general populace and the elite diverge.

(The real solution is a sustained dose of Piketty's proposed wealth tax, and any other measures necessary to reduce the widening Gini coefficient, but neither the Conservative or Labour parties, which are both in hock to the capital accumulators, are able to address the problem effectively.)

<comment><USER5> Britain has an offshore tax haven in a square mile of its capital city and it's not new or even modern.

[http://treasureislands.org/](http://treasureislands.org/)

</comment></comment></comment></comment><comment><USER6> What I'd like to see is all the big internet names - Google, Microsoft, Facebook, and so on - getting together to say "We will provide our services _only_ over fully secure encryption with strong keys. We will not implement backdoors, weaken our algorithms, or let you put a tap behind the SSL servers in our network. We will pull up our roots and leave your country if you demand them. And if you block your public from using strong encryption, they will have to manage without our services."

<comment><USER7> Problem is the companies exist to generate money for shareholders.

That is against what the shareholders want because it reduces the money.

Ergo, it will never happen.

At best we can expect some half baked ambiguous promises about not being evil (Google), excited yapping about something else as a distraction (Microsoft) or deafening silence (Apple) all backed up with thousands of pages of legalese and even more ambiguous international law.

So forget it; we have to move our feet. Stop being lazy and relying on all the services. Take a minimal set of services from elsewhere (I just have a domain and an IMAP box hosted by two small companies) and give the finger to them all.

<comment><USER8> Could the shareholders be convinced that the combination leaving (inevitably) exploitable backdoors and telling all of their customers that they'll roll over on 'em at government's slightest whim result in losing more customers than pulling up stakes?

<comment><USER9> because governments won't take no for an answer. they have the means to effectively put a company out of business. hence shareholders really have no voice in this area.

this isn't about profit as some claim, its about the absolute ability of governments to do as they wish. you choice as a corporation is simple, cooperate or get shut down.

to fix this requires getting voters to elect politicians who abhor this arrangement.

<comment><USER10> "to fix this requires getting voters to elect politicians who abhor this arrangement."

Do you honestly believe that is an option, when the mechanism for election is controlled by the very people and system you'd try to replace?

</comment></comment></comment></comment></comment><comment><USER3> I run an ecommerce agency in the UK. We turn over several million quid, employ forty odd people, and process the better part of £1bn of ecommerce purchases in the UK.

Needless to say, if encryption is banned here, we'll either be going out of business or moving to a progressive regime - say Yemen.

The UK is the second biggest ecommerce market in the world. He kills encryption, he will sink the UK retail economy - which is rather at odds with the whole "nation of shopkeepers" bit.

Actually, if it does happen, I'll raise an army and march on Westminster. Cromwell managed.

<comment><USER11> It's possible to solve this technically ,such that the encryption will happen on government mandated servers, in a fully secure manner that doesn't hurt most businesses - and hat's probably how they'll handle that.

<comment><USER7> I'm not sure if this comment is a joke, shill or some serious fucking crack smoking.

The chain of trust is broken. It doesn't matter where or who does it.

<comment><USER12> "Nothing the government can't read" doesn't mean no encryption. It means that there has to be a stored version of the message and the encryption key is handed over if asked, otherwise you go to prison. It'll be no different to what we have now (it's already illegal to withhold an encryption key) but with mandated storage.

<comment><USER7> So they can factor your keys at their leisure?

No chance.

</comment></comment></comment></comment></comment><comment><USER13> Last week, the UK minister for Internet Safety and Security Baroness Joanna Shields was speaking at a conference in London. She was asked about the potential impact on the fintech sector of mandating backdoors in encryption and she said, in reference to what Cameron said, "That quote was misinterpreted."

Everyone has assumed that when Cameron says that he wants to "ensure that terrorists do not have a safe space in which to communicate", that means that he wants to mandate encryption backdoors.

I think that assumption is incorrect. The guys at Number 10 are well aware that (a) they can't ban math, and (b) the UK tech sector would suffer if they legislated to mandate backdoors in all encryption.

I suspect that what Cameron actual means is that he wants to put in place a legal mechanism to authorise GCHQ (presumably by issuing a warrant) to hack into suspect's laptop or smartphone in order to gain access to the content of whatever messages or communications they may be exchanging with any co- conspirators.

<comment><USER14> Another apologist.

Cameron has all but said he wants to ban encryption:

"[I]n our country, do we want to allow a means of communication between people which we cannot read?", the prime minister asked rhetorically.[0]

I like the UK. They're backwards in some areas of policy, though. And probably have a penchant to control _their_ populace by any means possible.

\---

[0] [http://www.theguardian.com/commentisfree/2015/jan/13/cameron...](http://www.theguardian.com/commentisfree/2015/jan/13/cameron- ban-encryption-digital-britain-online-shopping-banking-messaging-terror)

<comment><USER15> Politicians long ago worked out that you don't actually have to _do_ something to get the positive effect, you just have to _say_ you'll do it.

Most people want to "deny safe spaces to terrorists", so the more they harp on about it, the more popular they become.

We're doing their dirty work by publicising it.

</comment></comment></comment><comment><USER16> This kind of thinking smacks of ignorance, it is akin to saying we should ban international travel to avoid terrorist attacks over seas.

<comment><USER17> Don't give them ideas.

</comment></comment><comment><USER18> According to todays news, No "safe spaces" apparently also includes Amnesty International.

"UK surveillance Tribunal reveals the government spied on Amnesty International"

[https://www.amnesty.org/latest/news/2015/07/uk- surveillance-...](https://www.amnesty.org/latest/news/2015/07/uk-surveillance- tribunal-reveals-the-government-spied-on-amnesty-international/)

</comment><comment><USER19> So Cameron wants to reinstate the writ of assistance for the online world? Because that's what his proposed "warrant" is (signed only by the Home Secretary).

[https://en.wikipedia.org/wiki/Writ_of_assistance](https://en.wikipedia.org/wiki/Writ_of_assistance)

</comment><comment><USER20> I'm mostly concerned about the 'safe space' in Iraq and Syria that is the acting as a recruiting and training ground for people.

<comment><USER21> What do you want to be done about it, send more young boys from "western" countries to die and/or be crippled like has happened in the wars of the last decade? Spend further billions of dollars/euro and for what, the locals would still hate "us" no matter what when by now its plainly obvious that the greatest danger to the average muslim are other muslims.

I am not sure how wiretapping everyone in the west would help, if someone wants to go to Syria, let them, hell take their passport off an buy them a one way ticket to that shithole to learn all about their religion and how it treats people and hopefully they endup in their heaven surrounded by 72 other jihadi virgins.

</comment></comment><comment><USER22> Would anybody like to predict and defend a probability above 0.00 that gov.uk will be able to meaningfully impede my ability use cryptography by 2020? Obviously politician's rhetoric, and to a large extent the law, have become unhinged from reality, so the odds of passing one more moronic, ineffectual law are a given: 1.0. But I'm asking someone to seriously state and defend even the slightest possibility that David Cameron might, in even the smallest sense, succeed. I can't.

</comment><comment><USER23> Conspiracy theory here... Me thinks they've already got their hands on a quantum computer and this is all just a smoke screen.

Yes yes, encryption, can't get through that...

<comment><USER15> In case you weren't aware, quantum computers cannot break modern symmetric encryption.

<comment><USER24> dude's alleging secret future-tech developed by some modern covert bletchley park, and you're gonna refute it with a fine point about what algorithms can currently do? I don't think you two are playing tennis on the same court.

<comment><USER15> My point was that "quantum computer" sounds like a scary apocalypse scenario, but isn't. It makes key exchange awkward but by no means impossible.

We already know that GCHQ has an underground level full of _conventional_ computers. That's a lot scarier.

</comment></comment></comment></comment><comment><USER25> It's like they really want to become 1984.

I wonder what Orwell would say if he were still alive today.

</comment><comment> rm_-rf_slash If Britain mandated encryption for Internet services in the UK, I would feel extremely unsafe making any kind of financial transaction while I'm there unless it's in cash.

Wait, shit, isn't London the global center of the finance industry?

</comment><comment><USER26> Someone tried to steal the genderless no form factor options of everyone & more long ago. They may have succeeded, or they may have failed.

One of the two happened...

Which would mean, the public would be absolutely useless to them anyway.

</comment><comment><USER27> As the domestic European terrorism (ETA, IRA, RAF) faded, our governments/elites imported foreign (mostly Muslim) terrorism and are now using this as an excuse to spy on everyone. I guess if we let them get away with it, we deserve the fallout.</comment>


AOL Tech: Opinion, news, and analysis from the best and brightest on the web. - <AUTHOR> http://www.aoltech.com/

<comment><AUTHOR> Actually a decent dashboard to view all the feeds from AOL-owned technology websites.</comment>


Google bug bounty for security exploit that influences search results - <AUTHOR> http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-bypass-black-hat-seo-bug-bounty/ <comment><USER2> Google should be ashamed of themselves for this meaningless, token "make ourselves feel good" payout. They have straight up exploited the reporter of the exploit.

This could have been used to make millions and they took advantage of the reporter's good faith and benevolent motivations.

Google, this is worth at least $1,0000,000 to you guys, and even more, in lost revenue, plus the impact of what gaming your search algorithm would have cost and damage to your reputation. Stop taking advantage of people.

Give this man what he deserves!

<comment><USER3> His console says 33.2k of ad buys. I'd say it's worth _at least_ that much to them.

It's literally their numbers spitting out how much it would have cost!

But hey, at least it's Leet.

<comment><USER4> It was a SEMRush screenshot, not related to Google, so it wasn't their numbers.

<comment><USER3> Apologies. Definitely an estimated start.

</comment></comment></comment></comment><comment><USER5> @TomAnthony, This is f*up, google should of given you at least $1,337,000 bounty for this. This is one of the most profitable exploits I've seen discovered by anyone. Plus you've done the right thing and reported it. Good job on this discovery!

"I have a couple of other ideas for search related attacks, but am not sure I'm going to explore them any longer."

You're valuing yourself way too low. You've done a good job with this and should receive more bounty for it. Also see if you can earn more for doing research else where; [https://www.bugcrowd.com/bug-bounty- list/](https://www.bugcrowd.com/bug-bounty-list/) Also maybe use something like; [https://www.hackerone.com/](https://www.hackerone.com/)

</comment><comment><AUTHOR> To answer a few FAQs I've had over the last few days:

\- I've not seen a confirmed use of this in the wild yet, despite a few people emailing me stories where they suspect it.

\- I am unsure what is with the bug bounty amount. I think either:

      1) The various teams didn't communicate well about the impact until after the award,
      2) I haven't fully understood the bug, however as per VRP rules I stopped when I had "discovered a potential security issue", at which point "The panel will consider the maximum impact". It may be I've not understood the impact fully.
      3) They want to discourage SEO type research as opposed to pure security research, but I doubt that is the case and it doesn't match up with my previous dealings with the team.

\- There are a few technical details not in the article (for example I believe the sitemap has to be an sitemap index file), but nothing that greatly changes it.

\- If you are concerned you are affected, I'm happy to take a quick look at your data for free (firstname.lastname@example.com) to see if I have any insights.

\- The best/only way to detect this being done to you is to find the 301/302 redirects for the sitemap in your server logs.

<comment><USER6> Google doesn't issue rewards for SEO tricks. My guess is your sitemap redirection trick could be used to leak data about the victim site (search terms, traffic stats, malware urls), or to do other privileged actions on behalf of the victim site now the two domains were linked (for example sign up for google apps or trigger rate limits DoS'ing the victims ability to use certain API's)

<comment><AUTHOR> Perhaps. We could argue the semantics of it, but it feels within the spirit of the VRP. It directly impacts the secure and correct functioning of a (the!) core Google service.

The VRP page [0] talks about the "maximum impact" and this impacts users and advertisers, as well as businesses relying on organic Google traffic.

However, I take your point - I'm aware this is not a typical sort of issue for a bounty.

To reiterate - I am grateful to Google that they run the bounty programme and that they awarded a bounty for this. I've previously reported several issues (e.g. [1]) that have not been rewarded any bounty, which is the nature of the programme and absolutely fine.

[0] [https://www.google.com/about/appsecurity/reward- program/](https://www.google.com/about/appsecurity/reward-program/) [1] [http://www.tomanthony.co.uk/blog/confirm-google-users- email/](http://www.tomanthony.co.uk/blog/confirm-google-users-email/)

</comment></comment></comment><comment><USER7> I've worked at other companies in teams that take these security reports in. There's no excuse for their long delays in response, you showed them clear abuse immediately. I wish you would have given them the tavis experience. Next time use Google's own terms, with a set date on when you will publish to put pressure on them. They do this to others and need to be held to the same standards.

Nice work! It is amazing how a bug that so many people don't care about (open redirects) could have been exploited Google's prime income generator.

If nothing else, you can use this as a nice gem on your resume, which can help you get more interviews or better paying jobs in the future.

</comment><comment><USER8> $1337 is not enough money. A bug like this if used secretly and correctly could have made millions easily.

<comment><AUTHOR> I think if it worked more broadly (I couldn't test without risk at that point) you could make decent money off of this just through affiliate programs.

I've been doing research like this for 5+ years, and you go in knowing most if it won't lead to anything. I'd hoped for more, but I could have simply failed again and got nothing! :)

As I've said below, I'd have reported it anyway even without a bounty; however I probably wouldn't have done the research in the first place were there not a bug bounty programme.

I've previously had 2 bounties from Google. One was an easy find and was also $1337. The other was more technical but still straight forward and also played to SEO and got $5000 - in that instance Matt Cutts was involved and I believe advocated for the amount (thanks, Matt!). This was far more impactful than that other issue, and more directly monetisable.

<comment><USER9> I do have to ask...were you at all tempted to try to monetize this? The guys in the BHW thread aren't wrong about the potential. I applaud you for taking the high road, I'm just curious if the thought of giving away probably low six figures/day for $1337 nags at you at all.

<comment><AUTHOR> It is a good question. I wouldn't have monetised this and would have still report it, because doing so would hurt legitimate businesses (by pushing them out of the results).

However, I have to admit it does nag at me a bit that the bounty is so small - it is like they are trying to send a message but I'm just not sure what it is!

I have done loads of research over the last 5 years (this exploit took me a couple of months to craft) and most comes to nothing, and then when I do find something big that the bounty is so small is frustrating. A bigger bounty would have made a meaningful difference to me (kids+no savings!).

The broader issue is how this may play to motivating people to discover/report these sorts of issues in the future. I have a couple of other ideas for search related attacks, but am not sure I'm going to explore them any longer.

<comment><USER10> This is a straight-up 100k-500k bug. If I were to discover this bug and know I'd only get $1k and be a "good guy" vs. getting millions, well...

The fact is that these bug bounty programs should start paying competitive prices. They can lowball it by 10x-20x at most, but lowballing by 1000x leads to people just giving up their ethics.

<comment><USER11> Almost as if a bug bounty program should show the effect of the bug before explaining how it works. Then, Google will be more inclined to pay more if it wants the info on how the bug works.

</comment></comment></comment></comment></comment></comment><comment><USER12> This is an incredible bug, not just for its severity, but for its relative simplicity. And of course because it targets one of the most ubiquitous and popular and ostensibly secure software interfaces ever.

Also very interesting how long it took for them to figure out a solution. The bug report was filed and acknowledged in late September. According to the author, Google struggled with how to fix the issue for several months, even though the fix seemed simple ("don't follow cross-domain redirects for pinged sitemaps").

<comment><USER13> Seemed simple. If legitimate customers do that too, it suddenly is not so simple.

<comment><USER12> To clarify, by "simple", I meant that the bug was discoverable, exploitable, and testable by Google's own public interface -- i.e. didn't require the researcher to break into anything, or find an otherwise extreme set of conditions. This isn't meant to impugn the skill of the researcher, just to point out how amazing it was that such a bug could exist in the open. I wonder if any analysis was done to figure out how many customers (good and bad) specified cross-domain redirects for sitemaps. Should have been easy to calculate, I assume.

</comment></comment></comment><comment><USER14> Looking at the bounty amounts, this is insane. If you find a bug that allows you to take over a Google account, through "Logic flaw bugs leaking or bypassing significant security controls", the _maximum_ payout is $13,337.

Sorry Google, but you should be paying $1,333,337 for that.

</comment><comment><USER15> I'm with pretty much everyone else here. As symbolic as $1337 is, this is worth far more.

That said, if one had taken advantage of this, what legal repercussions could or would you face? I mean, technically I can't see anything _illegal_ here, albeit unethical. Assuming you wanted to, isn't this just playing the system?

<comment><AUTHOR> I have discussed this with a bunch of people (and there is a discussion on Twitter right now [0]), and it seems quite unclear whether it would be illegal.

It would certainly be unethical, and if it is illegal it may mean many other shady black hat SEO practices are also illegal. I really have no idea though - would be interesting if there is a lawyer reading to hear any thoughts.

[0] [https://twitter.com/thetafferboy/status/981883506350608385](https://twitter.com/thetafferboy/status/981883506350608385)

<comment><USER15> It's pretty fascinating. I can't think of anything similar...

</comment></comment></comment><comment><USER16> This is really great research. I don't understand howcome Google didnt react sooner. It's the biggest black hat exploit I have seen in years.

<comment><USER17> I was wondering this too. If the researcher was playing by the same rules that Google does with vulnerability disclosure, the post would have gone up months ago regardless of whether Google had fixed it yet or not.

</comment></comment><comment><USER18> $1337 is a joke. This bug is worth so much more than that in potential lost revenue to Google!

<comment><USER19> \+ lost value to the victim, who are essentially paying an attackers bill for them

</comment></comment><comment><USER20> There's nothing on the VRP which effectively covers business logic vulnerabilities. Realistically, this would be precisely why such a category would be needed.

Closest I can fit it into within their existing scheme is:

> Logic flaw bugs leaking or bypassing significant security controls -- Other > highly sensitive applications [2] -- Vulnerabilities giving direct access to > Google servers

But that's a stretch, and the payout is still atrociously low for the value you could've squeezed out of it, potentially legitimately (millions).

TomAnthony, in your position, I'd keep making a stink here and possibly even see what other quirks you might find in PageRank and just pocket them for now. I've reached out to some old members of the VRP team to see if they can shed any light on whether the VRP can be tuned a bit in response to this, but you certainly should've gotten more.

<comment><AUTHOR> Thanks for your insights. I actually considered the same spot in the matrix as best fit, but also identified this sort of 'business logic' isn't a good fit anywhere in the matrix.

I'm British so not good at kicking up a stink! However, it is Google's VRP, and they are under no obligation to give anyone anything, so am not sure I have grounds to do so anyway. As I've said elsewhere, it is just hugely de- motivating and a disincentive (for both me and others) for similar research in future.

I think it would be a great addition to the VRP for them to include things affecting the core algo (their main product), but imagine it would be tricky to do without also getting a huge number of very tenuous reports.

</comment></comment><comment><USER21> Has anyone ever heard of another case like this? I've been following search pretty closely for most of Google's existence and this is the only bug bounty payout I've ever heard of for a blackhat core algo exploit.

[Disclaimer: Tom's a colleague of mine at Distilled where I'm a founder]

<comment><USER5> [https://www.google.com/about/appsecurity/research/](https://www.google.com/about/appsecurity/research/)

But they don't list any bounty rewards there. Tom should be on this list too, this could land him a nice job.

</comment></comment><comment><USER22> As others have said, $1337 for such a bug is pathetic.

The point of a bug bounty is to give researchers an incentive to report bugs rather than sell or abuse them. This does exactly the opposite for me.

<comment><USER23> This is being downvoted but it's so true. Google just clarified the value they place on advanced (aggressive) SEO techniques/exploits.

</comment></comment><comment><USER24> $1337 bounty is a symbolic number to signify the receiver is an elite hacker.

So, it's the meaning that counts, not the amount.

edit: source: [https://en.wikipedia.org/wiki/Leet](https://en.wikipedia.org/wiki/Leet)

<comment><USER25> >So, it's the meaning that counts, not the amount.

Still, I believe that a more heavily accented/long "e", like in $13337 would have been graciously received ...

<comment><USER26> Or 31337, the long form of 1337

</comment></comment></comment><comment><USER27> Set up a Patreon and a Donate button.

I wish Google had paid you more, but maybe the people in this thread will put their Money where their Outrage is, and thank you themselves.

</comment><comment><USER28> A commenter (@ivan2kh) raises a good question... what happens if you submit "evil.xml" on "[https://www.amazon.com/clouddrive/share/xxx"](https://www.amazon.com/clouddrive/share/xxx"), or similar? Any host that allows user submitted files, and hosts them under their domain, could be exploited right?

<comment><USER29> Serving user-submitted files from your main hostname is generally a bad idea because of the risk of XSS vulnerabilities. On Amazon cloud the content is served from the subdomain. Though it does raise a good point as a content domain/subdomain for a large website/service may have an impressive pagerank that could be exploited.

<comment><USER28> archive.org hosts with URL's like "[https://archive.org/details/myfile.xml"](https://archive.org/details/myfile.xml"). They must have good pagerank for anything storage related. Perhaps a cloud storage service could use this exploit?

</comment></comment></comment><comment><USER30> Receiving 1337 $s from Google is awesome, but that bug bounty should have been higher.

</comment><comment><USER31> Although I agree that $1337 is definitely WAY too low, it's also someone's job to budget this and minimize payouts.

To Google, 100k is nothing and in good faith, they should definitely reward more, but when it ties into someone's KPI, it will be tough to get more. They'd have to work with PR to understand the tradeoffs, etc.

</comment><comment><USER32> Wow, this is a great find with enormous potential impact. Kudos!

The payout from Google seems very low, this bug took their core business model on a ride.

Cool find!

</comment><comment><USER33> Great work, and kudos for reporting it.

It's worth noting that Google took 5 months to fix, and almost discard it a couple of times.

</comment><comment><USER34> The bounty is incredibly low.

</comment><comment><USER35> I hope you made yourself significantly more money out of this than $1,337...

<comment><AUTHOR> Alas, not. I thought the bounty would be larger, but I'd have reported it anyway due to the damage it could do to legitimate businesses being pushed out of the results. You can't do this sort of research and rely on a specific bounty payout.</comment></comment>


Ask HN: How do we take our business to the next level? - <AUTHOR>

TL;DR: We want bigger clients and aren't sure how to find them.
---
An old friend and I run a tiny (just the two of us!) web agency. We do a lot of work with non-profits and small businesses... mostly traditional website builds, but some software work as well. Our skill-set is primarily design & code, and we've always just sort of wung it when it comes to sales & marketing. This pays the bills (sometimes just barely, though usually we do pretty well), but we both feel like we want to take things to the next level.
We sort of find ourselves stuck in this cycle where we move quickly from job to job to keep cash flowing, and as a result are never really able to deliver the caliber of work we both think we're capable of. I guess what I'm saying is we want to be making the best work of our lives, and feel like time/budget constraints are keeping us from being able to do it.
One obvious solution to that is higher prices per project, but the clients we're working with are almost always on extremely tight budgets. That being the case, we feel drawn to attracting bigger clients, with more realistic budgets, but don't know how to break through to that audience.
Almost all of our sales come from word-of-mouth leads, and if our goal is to find a different type of client, we feel like we need to do something different, but don't know what that thing is.
Anyhow, hopefully this isn't out of place being posted here. Just looking for some answers. <comment><USER2> Decide what you do best, and what you love the most. TO me it sounds like you love doing larger/medium scale projects and are getting bored with these smaller projects.

I am in a similar industry (in business for 5 years) and have had a lot of success, with some similar challenges.

this post helped me so much (originally found it here) [https://training.kalzumeus.com/newsletters/archive/consultin...](https://training.kalzumeus.com/newsletters/archive/consulting_1)

One thing I had to decide was do I want to put more money in my pocket or grow my business.

I realized I didn't want to take bigger deals. The deals I was bringing in allowed an amount of profit for every deal. I just wanted more deals of that size. The challenge was how to scale that up.

</comment><comment><USER3> > our goal is to find a different type of client-

Generally speaking, larger companies or those with big ticket items, have bigger budgets. Suggest defining those business niches/categories interesting you. Then strategically network with those players in your market. It's enough to start a conversation with 'I was curious about your current online presence'. See where that goes.

</comment><comment><USER4> What if you were to make a product or service that can eventually generate free cash flow for yourselves?

Edit: Grammar</comment>


Where we're going, we don't need headphones - <AUTHOR> https://rradczewski.github.io/ymmv/2017/06/Where-we-are-going-we-dont-need-headphones <comment><USER2> I agree with the same concerns that Raimo and Markus have. It's not just acoustic noise, it's also visual noise. I face the entry to our open floor plan office and every time someone walks in I can't help but look to see who it is.

One man offices are cheap and by far the most productive work environment for software development. Any software development organization that's not investing in them isn't thinking strategically. Engineers should be able to face somewhere that's not distracting, and have a quiet work environment without requiring headphones (music can be a distraction too). If you want to collaborate, do it in your office, it should be big enough for a couple people to join you, or a conference room if you need more.

The only criticism I have for one man offices is that it makes it too easy to goof off and surf the web, but that's a different managerial problem. You should make sure all the offices have glass walls so you can see if someone is in their office and have an idea what they are doing. But mainly you should review all code as it's checked in for quality, and it should also give you a good idea of their productivity.

I think Apple has the best idea for this. Their work pods at the new campus have all glass walls facing the hallway, sliding doors to maximize room in the office, and built in storage. There looks to be plenty of room for a couple of coworkers to join you and help collaborate when need be.

<comment><USER3> I think it's easy to severely underestimate the value of having people overhear conversations and interactions of others beyond their obvious scope of work. If you set things up so only explicitly opted-in collaborations occur, then those are the collaborations you will get: people who all agree they should work together on something. This is a subset of the types of interactions that I believe result in great teams. Many collaborations begin when one person overhears another person they had no idea was working on something relevant to them, or that they could give valuable input on.

As with anything, there is a balance, and I believe there is no silver bullet to designing good offices. But I question those who think there is, and that siloing humans into isolated offices (a fundamentally unnatural state) as the default is objectively the best option.

(And before citing the various studies showing the impact on productivity of doing this, I feel productivity is only one characteristic of what I personally consider to be a good measure of a healthy work environment.)

<comment><USER4> Offices do not mean having each person locked in their room never interacting with anyone else. They mean you can close the door and be able to focus on something.

In my experience you get a lot more interaction when people have private offices, or at least cubes. It's easy to walk into someone's office and have a discussion. Easier than let's go find a meeting room so we don't disturb everyone. It's also pretty easy to call other people in as needed and have an impromptu meeting without needing to book a room for that and without disturbing others. Not to mention other technologies like e-mail, messaging etc.

The most collaborative places I worked in are those where people had offices and the least collaborative ones have open plans. Anecdotal but there you have it.

Let's face it, open plan offices are about reducing cost and pretending to be collaborative. It's the "Agile" of offices and I don't mean it in a good way.

<comment><USER5> >It's easy to walk into someone's office and have a discussion.

Certainly less easy than joining in on a conversation you overhear while sitting at your desk.

What we have here is disgreement over the optimal 'activation energy' for social interactions that produces the best work. This parameter depends on all kinds of factors, e.g. the type of work and work culture. What we need is a workflow that optimizes this parameter for a given office.

IOW, somebody needs to come up with a cost function and run gradient descent on it.

<comment><USER3> It's a little out there, but I think VR workspaces will potentially provide such a method. Currently the iteration cost is too high. (For example it could involve rearranging desks, tearing down walls, buying equipment, etc.) VR opens the door to a malleable workspace that still comes close to pairty with face to face communications (it is not there today but most likely will be in a few generations.)

<comment><USER5> For large companies, I can imagine using new branch offices for a/b testing.

A while ago I read a comment here about a university that, instead of paving roads to a new campus, just had grass everywhere. A semester later they paved over all the parts where the grass died from all the foot traffic.

I wonder if something like that would be workable? Have easily reconfigurable panels and furniture, encourage the staff to arrange it however they like, wait six months, then standardize/remove pain points/make permanent?

<comment> benji-york That's an interesting thought. Here's another: why standardize? Each team's needs are likely to be different and may change over time.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> > "Get... ceiling baffles for the whole office."

Yes please! At least this. For some reason there has been this huge trend with new buildings to just have exposed concrete ceilings and HVAC plant. Why? Seemingly because it's "cool" and how the "start ups" do it. (Back when a start up meant working from a low cost warehouse.) But ceiling baffles were there for a very good reason, to dampen and prevent reflection of noise in office spaces. How did we forget this?

EDIT: (At the last place I worked like this their solution was to install white noise generators on the ceiling. So the whole place was like being on an aircraft and very sleep inducing.)

<comment><USER7> Oh man as a traveling consultant, I purposefully trained myself to fall asleep on an airplane and anytime I hear anything resembling white noise I'm instantly asleep. Having it in a building would just lead to an increase in naps from me.

<comment><USER8> How did you train yourself to fall asleep on an airplane?

<comment><USER7> I have an app that plays noise that sounds like a jet engine that I play as I'm falling asleep. After a few weeks of that, being on a plane just knocks me right out.

</comment></comment></comment></comment><comment><USER9> I'm not sure the problem is with the physical decibel level of office noise at all. My workplace is silent as a tomb, we all have our own offices with closing doors, and I still bring headphones to work.

Sure, even something little as phone chatter can be distracting, but the main distractions come from people just passing by and saying 'hi', or worse, actually needing something from me and interrupting my work. Headphones and a closed door tend to signal that I'm busy, but even then someone will knock on the window and see if they can come in.

People are _intentionally_ distracting, and I think it's something that's way harder to fix than just a stop light indicating noise level. It has to be "fixed" on multiple levels. Having an office culture of "just stop by their desk" is a huge problem, but I can't imagine being unavailable because there's so many distractions that really _are_ urgent and need my synchronous interaction _right now_. That's a tough thing to fix.

<comment><USER10> >> but even then someone will knock on the window and see if they can come in... People are intentionally distracting,...

I think it is, like most things, about balance. I would not like it if the workplace had an implicit culture that strongly discouraged people from going and talking to other people without going through red tape (set up a meeting or similar). What's the point of being in a common space then? Might as well just work from home.

I think there is value in those spontaneous conversations (sometimes all you need is a one line response for what would otherwise have wasted your whole day), and I think people who assume that sitting with headphones on all the time means they should never be 'disturbed' are being a bit uncharitable.

<comment><USER9> > I think people who assume that sitting with headphones on all the time means > they should never be 'disturbed' are being a bit uncharitable.

I stop feeling charitable when I start missing deadlines and can't get any work done because of constant interruptions.

Is there a more clear way that I can signal I need fewer interruptions than a closed door and headphones? Just a couple hours each day without being interrupted would be great.

<comment><USER11> What do you work that you as a single person have deadlines? Usually in SW development those are as a team. So it doesn't matter if you help your teammates?

<comment><USER9> Solo dev

</comment></comment></comment></comment></comment><comment><USER12> Something about this doesn't feel right, I want to call it "passive aggressive" but that doesn't feel right either.

In an open office I've always felt that headphones were the best solution to the need for peace. I feel like spontaneous dialog would be cut short by this solution more often than being moved.

I guess what works for one may not work for another, and the frequency and varying views on this topic reminds me of the "tabs vs spaces" discussions.

p.s. tabs

<comment><USER13> We should all embrace intersectional office space personalities and that no office of the future can belong to the future if it doesn't accommodate different types of people, work, social and personal needs.

p.s. tabs

<comment><USER14> I've always been confused that people will set up 6-7 different kinds of areas in their house, but expect an office to be wall-to-wall cubicles with a restroom tacked on.

Let's see if we can list out some of the things to do in an office:

* Focused solo work

* Focused small group work

* Making phone calls - one person

* Making group phone calls and teleconferences

* Small group meetings

* Large group meetings

* Handling documents and records

* Food preparation

* Eating areas for individuals and small groups ("cafe")

* Eating areas for large groups ("cafeteria")

* Relaxation

* Reference and reading

* Loose teamwork e.g. sales and support

* Client/vendor meetings - small and large scale

* Shipping and receiving

* Maintenance

* Storage

I wish there were names for these kind of spaces beyond agglomerating descriptions onto generic terms.

I think if you say "Living room", "Kitchen" or "Bedroom" most people have an idea of what happens in that room. "Medium conference #3" is less descriptive.

</comment></comment></comment><comment><USER15> We are asked not to lead with negativity on HN, but once in a while an article comes through that just screams out as requiring an exception.

Asking people to reduce the noise level is straight up a horrible idea. Especially the obnoxious /noisy command and the nanny state thinking it encourages.

I thrive and get in the zone when there is plenty of noise and varied conversation around me. I know that many people feel the same way. A quiet office is the worst for maintaining focus, as then any little conversation will stand out and catch my attention.

And I say all this not as a loud person. Quite the opposite.

I almost never use headphones; don't need to because the office is noisy enough to stay in a good coding zone. But having some social stigma about wearing them, that would be bad.

<comment><USER2> I believe your anecdotal evidence is wrong. Studies have shown that developers are much more productive when they have quiet and private offices.

In fact, studies have also shown that listening to music reduces productivity, with instrumental music the least bothersome. Our brains have highly developed communication abilities, language processing is a function that requires a significant part of our brains to work. Whether you are consciously aware of it or not, whenever you hear words, whether spoken or sung, your brain starts decoding them. That's reducing the amount of brain power you have remaining to work on your conscious tasks.

</comment></comment><comment><USER16> Sometimes people wear headphones because they find listening to music helps them work, regardless of the noise level in the office.

</comment><comment><USER17> I wouldn't have to wear AirPods beneath 30dB landscaper earmuffs to get shit done if management would do something about the 5% of noisy people polluting the common space we all have to sit in. The best office layout would be the one that puts the inconsiderate primates behind soundproofing.

<comment><USER18> or maybe the problem is that you can't handle people? "Inconsiderate primates?" AirPods underneath muffs? But why?

<comment><USER17> Because one cellular telephone conversation can disrupt the concentration of 30 engineers hours-deep into complicated debugging jobs, especially when it's one side of a lengthy dramatic argument. It takes each engineer about 15 minutes to recover concentration, in my estimation. So that's about 7.5 hours lost, or about a programmer day.

Concentration is precious and fragile. If you can know just one thing about managing programmers, please know that.

</comment></comment></comment><comment><USER19> Slightly OT, but any recommendations for an alternative to music with headphones?

The reason I'm asking is because I don't think I could concentrate with any form of music. I tried some "fake cafe sound" and I still felt distracted (more than I do in a real cafe). White noise? Ear plugs? Binaural beats?

I actually work from home with my wife across the desk. We have a relatively quiet environment, with no or very low volume music playing. I'm not hyper sensitive to noise at all. But I would still like to be able to isolate myself completely some time to focus. So just wondering if there are any tips.

<comment><USER20> I've tried so many things. Many styles are out of the question because I focus on the words too much.

As far as music goes electronic like Daft Punk or Neelix is my favorite but it also has its drawbacks.

So finally I think asoftmurmur.com is best.

But even with the perfect noise, or lack of noise with active noise cancelling headphones, not everyone can wear headphones 4 hours in a row. Some people hurt from being built differently around the ears.

And this article focuses a lot on noise level but that's not the problem for me. The office could be totally quiet but if one person is having a phone conversation I focus on everything they say. Depending on the person my mind might even start to wander and think about what the person on the other end might be saying.

So for me working from home has been a god send. And we didn't have an acceptable culture of working from home. I simply forced it and said damn to the consequences.

But I have no kids and live alone. When I'm at my gfs place her daughter and her friends are too much for me. I can only work 3-4 hour sprints because wearing headphones longer than that is uncomfortable.

I've found the in-ear headphones to be better in that case.

<comment><USER19> Thanks for that. Never tried any noise cancellation headphones before.

I did find that it's not so much the pressure, but rather that my ears get really hot with those big headphones. So I can't wear them for longer than 20 minutes or so.

Are there / can anyone recommend in-ear headphones with noise cancellation?

<comment><USER20> I got a recommendation from a friend that his Bose in-ear active noise- cancelling phones were really good. Haven't tried them myself, can only forward his recommendation.

</comment></comment></comment></comment><comment><USER21> I have read dozens of articles like this and as a developer, it would be great to work at a place like that: WFH option, non-open plan layout / 4-man offices. But the people who want that are rarely the ones in a position to implement that sort of environment. So nothing ever changes.

</comment><comment><USER22> As a software engineer, unfortunately, the sound sources that drive me to the edge of insanity are things like loud typing, or hands fishing around for chips in a bag. While I feel totally comfortable asking people to quiet down a conversation, there is something too personal about asking someone to consider, specifically, how must force they drop down on the space bar. I like the idea behind /noisey, but I feel like I may be alone in being concerned that no one would register these fringe noise sources when considering their contribution to a soundscape. There probably isn't a good solution, so headphones will have to do.

<comment><USER23> A couple solutions: one man offices, working from home.

</comment></comment><comment><USER24> Depending on roles, it can make sense to do the following:

\- have reservable floating offices and various sized-conference rooms w/ doors

\- some dedicated offices w/ doors

\- some open layout for pair coding, but not exclusively

\- some casual multipurpose hangout/couch meeting/work/relax areas

\- remote work from home, coffee-shop, beach, mountain top, etc.

\- perhaps an discreet workspace indicator (web + IoT physical) that says (perhaps using color codes):

\- out for the day

\- out temporarily

\- free to socialize (which auto-suggests people to chat with in this state)

\- working

\- do not disturb, unless it's an emergency

This way, there's more choice and people can self-select some common-sense and have enough variety to not get stuck in open floor-plan, panacea, audio- visual-social distraction hell.

</comment><comment><USER25> My current office is pretty ideal for me. We have 6 devs, and we sit in a room with a door. It's quiet, but we can hear if there is a concern or something going on that requires attention. The issue with single person offices is that you'll miss when somebody is discussing an issue they're having, maybe they mention it offhandedly, and you know the solution.

That said, I would still vastly prefer an office to myself than a god awful open-floor bullshit abomination. How anybody can work in that kind of environment boggles my mind.

<comment><USER2> I've worked in 2 man offices that were super distracting. The product manager on the product I wasn't working on would come in to talk to the other engineer, and I could not filter it out, even though it was entirely unrelated to my work.

I think the key to a shared work area is that everyone should be on the same team working on the same project, so the distractions are at least pertinent to your job. But I also think you are probably reaching the limits of that with 6 devs.

</comment></comment><comment><USER26> I increasingly suspect visual and auditory noise are _symptoms_ rather than problems. The underlying problem may boil down to this: while easy collaboration helps us be productive, having our own space also helps us be productive.

Here's an idea: every worker should get their own big desk, maybe an L-shaped one, with file cabinets and ample storage, and even shelves and walls behind the desk that they could put up memos, calendars, whatever. But they don't have to be completely walled-off little offices. Don't give them doors; don't make the walls go all the way to the ceiling. This would greatly reduce visual noise, and combined with good acoustic design for the rest of the office (as the article touches on), it would at the least cut down on auditory noise--and more importantly, it would make it so going over to talk to a coworker in person required just a little more effort than it does in an open office. Collaboration would still be pretty easy, but raising a _little_ more barrier than the current fashion might improve concentration and, dare I say, the little bit of emotional boost that comes from having your own perceived space.

I'm not sure what we would call these purely hypothetical half-wall workspaces --these "cubicles," if you will--though....

</comment><comment><USER27> The traffic light reminds me of SoundEar [1], noise monitors which were popular in Swedish classrooms fifteen years ago (and might still be). It worked well in my seventh grade classroom.

I'm not so sure about the red light being manual trigger only. I think it's better to decide objectively on what the desirable noise level should be.

[1]: [http://soundear.com/](http://soundear.com/)

</comment><comment><USER28> The company I work for has open plan offices — it's a US company with multiple offices worldwide. The specific one I work from is small, and devs and non- devs are _mixed_ together.

Whenever I tried to bring up noise-related issues and made specific proposals, I felt I was ignored because of a) clash of cultures (non-devs might not understand/value "being in the zone" [1]), b) spending money in sound-proofing is seen as a cost, not an investment.

What worries me the most is that in the course of a few years I haven't heard any internal voices putting open plan offices in doubt. This office layout looks to be seen as a good default with problems that are either ignored or that people have to learn to live with.

So I wonder if the situation is similar in other companies with open plan offices, and whether people see there's any trend to question the given default or not.

[1] [https://www.joelonsoftware.com/2000/04/19/where-do-these- peo...](https://www.joelonsoftware.com/2000/04/19/where-do-these-people-get- their-unoriginal-ideas/)

</comment><comment><USER29> > " This is where Noisy comes into play, a small Slackbot I wrote that enables > people to anonymously raise the issue for everyone else to see"

It's a good idea, but it might be counterproductive to message everyone that they're being too noisey; that might contribute to the noise

<comment><USER30> That just sounds like passive aggressively leaving angry postits on the fridge. If you're being obnoxiously loud and keeping me from working, I will assertively tell you to keep it down (or aggressively, if you're the annoying salesperson who spends most of his time making loud, personal calls).

Good office design certainly helps with noise, but some people are simply obnoxious without realising it. Educating them can be helpful.

</comment></comment><comment><USER31> I am so happy to work 100% remote. Interruptions and noise are real productivity killers to me.

</comment><comment><USER32> > "I assembled this chart to show how this can already have an impact five > days into the experiment..."

[https://rradczewski.github.io/ymmv/assets/office_noise_noisy...](https://rradczewski.github.io/ymmv/assets/office_noise_noisy_invocations.png)

I don't think this chart demonstrates your point. Don't you want people to eventually stop needing to use Noisy at all? As of now the chart just shows that more people are familiar with the Slack command.

I would also be interested in knowing how large the team is that this is being tested on.

</comment><comment><USER11> I often have the opposite problem. We are like 15 people in our office, and some are very sound sensitive. I feel like I can't even properly discuss things with my other colleagues or even peer program out of fear of disturbing the others.

If you are really that sensitive get earplugs, instead of cussing at others!

<comment><USER33> It's not them being sensitive or that you want to discuss things. This is the problem:

> We are like 15 people in our office

I wouldn't even be able to read comics with so many people talking, let alone do my job.

</comment></comment><comment><USER34> I'm a big fan of this. Work environments should be optimized for productivity. Most software is a team sport, so they should generally be optimized for team productivity.

What that means will be different for everybody. But for me I've had the best results with team-specific spaces that have some visual and noise isolation from other teams and wandering interruptions. I also like to have clear separate space for non-whole-team discussions and for hanging out.

Places where everybody gets in and cranks up their headphones to protect from the madness strike me as the modern noise equivalent of the 1960s/1970s rivers that were basically open industrial sewers. [1] If that's what it's like, you might as well let people work remote, as you've already lost most of the productivity gains that come from close collaboration.

But those gains really can be amazing, so personally I'm going to keep pursuing them.

[1] E.g., the Ohio river that caught on fire: [https://clevelandhistorical.org/items/show/63](https://clevelandhistorical.org/items/show/63)

</comment><comment><USER35> > GitHub, Slack, Screenhero, Hangout etc will make sure nothing gets lost and > we stay up to date. Except for that you miss being challenged at the soccer > table … just sayin'.

Sometimes when you're not there at the meeting in person, your point isn't taken as seriously.

</comment><comment><USER36> I like the idea of acoustic padding and visual blockers. My desk is in a darker area with lots of conversation and visual noise. Can anyone recommend how to set up padding and simulate sunlight without being weird/blinding others?

<comment><USER37> Simulating sunlight is relatively easy; look for lamps characterized as "full spectrum". Point them down from high places rather than up from low.

Noise reduction is hard. The fastest, most efficient solution is to wear a pair of reusable, washable earplugs. If you buy them with a brightly colored cord connecting them, people will usually notice when they approach you. Next best is external ear defenders, the kind used for shooting sports. People will definitely notice that.

The downside to both methods is that most people do not like having things inside or on their ears for hours at a time.

<comment><USER38> Definitely agree on the downside. Another problem is that such hearing protection doesn't work very well against the human voice or similar sounds such as throat clearing, sniffing, etc.

</comment></comment></comment><comment><USER39> Hopefully when we start using voice activation as much as we now use the mouse, then the open office space will become a thing of the past.

One can hope.

</comment><comment><USER40> I've read so many articles about people who can't stand noisy offices, but the only complaint I've ever heard from co-workers IRL is the office being too quiet. If it's quiet, no one is collaborating.</comment>


Ask HN: Evernote vs /home/*username*. Is the fs dead? - <AUTHOR>

Should Evernote replace the filesystem (for me)?
My predicament is that Evernote (free) doesn't store all files, though storing pdfs and other files in my computer isn't as cross platform as Evernote.
What do you see as the solution? Has anyone tried removing all local storage and just using Evernote? I suppose dropbox is another option <comment><USER2> You can use Insynch for free, it syncs your home directory with Google Docs.

Request an invite here, they will give it to you quickly:

<https://www.insynchq.com/>

</comment><comment><USER3> I do want to work offline, so, no, haven't tried, didn't even consider.

What advantage would having the whole home up on evernote/dropbox/whatever over having only select parts of it there?</comment>


EBook Readers for Android - <AUTHOR> http://codecondo.com/free-ebook-readers-for-android/

<comment><USER2> "eBooks nearly twice as cheap (on average) as _psychical_ books"

Pretty sure that "physical" was the intended adjective, although I do like the idea of a 'psychical book'.

<comment><AUTHOR> You're totally correct, fixed!</comment></comment>


PostgreSQL 9.0 - Hot Standby, Streaming Replication - <AUTHOR> http://www.depesz.com/index.php/2010/02/01/waiting-for-9-0-streaming-replication/

<comment><USER2> Fuck Yeah!

I have never been satisfied with a piece of software as I am with Postgres.

Fact: 11 year old version of postgres are still actively maintained.

</comment><comment><USER3> For those of you running postgresql with some kind of multi-server setup, how do you do load balancing and replication right now?

I'm running pgpool-ii but just tonight noticed some pretty serious discrepancies between the two backend postgresql instances so I am getting rid of pgpool for the time being.

Will this change make pgpool-ii obsolete?

<comment><USER4> I'm not an expert, but PgPool also servers as a local connection pooler, so for those purposes it won't be obsoleted.

<comment><USER5> I'd personally recommend pgbouncer as a connection pooler rather than pgpool.

<https://developer.skype.com/SkypeGarage/DbProjects/PgBouncer>

<comment><USER6> I second that, I did a comparison a few years ago and pgbouncer blew pgpool away:

[http://www.last.fm/user/Russ/journal/2008/02/21/zd_postgres_...](http://www.last.fm/user/Russ/journal/2008/02/21/zd_postgres_connection_pools:_pgpool_vs._pgbouncer)

<comment><USER3> Thanks guys.

</comment></comment></comment></comment></comment><comment><USER7> I have nothing to add except for: yay!

<comment><USER8> I'd like for the PostgreSQL team to add synchronous replication :) (ideally as a per transaction setting)

Well, exactly this is planed for a future release: [http://wiki.postgresql.org/wiki/Streaming_Replication#Future...](http://wiki.postgresql.org/wiki/Streaming_Replication#Future_release)

</comment></comment><comment><USER9> This is definitely big news for PostgreSQL. When I had to set up replication for one of the projects I was working on I was highly dssapointed with all the solutions out there. I'm really excited that this will be built in and it looks like it will be really simple to get set up and working.

I agree, yay!

</comment><comment><USER10> Ironically all I see is _"Error establishing a database connection"_ when I visit the site

</comment><comment><USER11> This is just more evidence that it's one of the greatest pieces of open source software ever written.

</comment><comment><USER12> "Error establishing a database connection"

They running wordpress on mysql or something?</comment>


How EverTrue Hired Their First H-1B Visa Employee - <AUTHOR> http://venturefizz.com/blog/living-%E2%80%9Chai-life%E2%80%9D-%E2%80%93-evertrue%E2%80%99s-first-h-1b-visa#.UfurtOj4atg.hackernews <comment><USER2> I'm disturbed by the reactions in this thread. To argue that the US shouldn't allow foreigners to come and work here because it undermines local talent is like saying schools should give out fewer CS degrees because big companies will exploit them to undermine existing talent. It screams narrow-minded selfishness. What are we, a medieval guild?

<comment><USER3> These reactions are extra-funny given HN's propensity to complain about the long arm of the government, state-sanctioned monopolies, artificial restrictions on the free market, suppression of competition, etc.

It seems like some people want the government to GTFO of the way when it benefits them, but cry for government when the free market doesn't tilt things in _their_ favor.

<comment><USER4> "Libertarian until it hurts me"

<comment><USER5> TRUE TRUE TRUE

Ima just go out and build a 6 lane highway myself. For everyone else to use. In exchange for free emoji.

</comment></comment></comment></comment><comment><USER6> I wonder exactly what skills this gentleman had that were unobtainable from citizens in the Boston area...

<comment><USER7> Unfortunately, we live in a world where discrimination against someone who doesn't hold the right passport is legitimate. Replacing the word 'citizen' in your statement with 'white', 'straight' or 'men' would automatically destroy any argument there.

<comment><USER6> Maybe. But since the law isn't written that way, that's a straw man.

<comment><USER7> So explain this to me like I am 12: If the law made it legal to discriminate based on race (as must have existed when you were a kid), would you be okay with aforesaid discrimination?

</comment></comment></comment></comment><comment><USER8> And there you have a step-by-step blueprint on how to undermine the efforts of local talent pools to stand out in favor of saving tens of thousands of dollars and hire an H-1B.

<comment><USER9> Yeah, those dirty immigrant bastards that pay US taxes in the highest rate and don't have any tax allowances. Those spoiled brats whose wives can't legally work. But they are lucky to be allowed to work 80-100 hours a week in order to keep their job and visa status, and to pack up the next day if they get fired.

Yeah, you should disallow that. If you push them out, then Joe SixPack would be able to make much more money for writing JS and Ruby code and bring US economy forward.

<comment><USER10> I'm always amazed at the vitrol that comes from the people in the Pro-H1B denomination. You guys sometimes make the Protectionist denomination seem quaint.

1) You SHOULD disallow that. Why tolerate a system that creates incentives for that kind of abuse.

2) "dirty immigrant bastards" \- You're assigning a point of view that the commenter isn't advocating at all. Protectionism is generally more about looking into the future and being scared for your ability to continue at your standard of living and less about disliking certain kinds of people.

And to add my own anecdote to this discussion without siding with anyone else's viewpoint (because I'm a special snowflake with my own nuanced opinions): I've worked at companies that chronically underpay H1B workers. The ones that got fair pay were the ones that were brave enough to demand it.

<comment><USER7> > And to add my own anecdote to this discussion without siding with anyone > else's viewpoint (because I'm a special snowflake with my own nuanced > opinions): I've worked at companies that chronically underpay H1B workers. > The ones that got fair pay were the ones that were brave enough to demand > it.

That is really a different issue. The law says that there is a baseline salary to be met. Now anything above that is what the employee should be negotiating. There are enough American/women/$minority engineers who get underpaid because they suck at negotiating. That doesn't necessarily mean discrimination exists.</comment></comment></comment></comment>


Ask HN: What is your opinion about employers providing free Virtual Healthcare? - <AUTHOR> A simple video chat could help employees and their families members to take care of their illnesses & medical conditions.
Yes, there is an cost to employers, it is not exactly free tough. But, bill is payed by employers who can get it done at very affordable rates, just by sheer economic of scale, which is lot less than what they pay for insurance.
What do you reckon? <comment><USER2> I've used telemedicine (the proper name) for vision prescription renewal and to check with a nurse or doctor about some of my children's various ailments.

The biggest problem is that there seems to be a pretty limited range of conditions that can be taken care of over the phone- been sick enough you might need antibiotics? You need to come in for a test. Injure yourself physically? Well someone needs to be there to patch you up.

The two exceptions have been when someone caught it pinkeye- it's so obvious my pediatrician called it in based on a phone conversation alone, and the aforementioned vision prescription.

For me, my insurance company provides a free nurse line and a paid doctor line (still cheapish at $40). My GP and pediatrician are also very proactive over the phone, and they do it for free (that's craziness right there).

I think the reason insurance companies and doctors aren't pushing telemedicine more is that the vast majority of ailments are (successfully) treated with "take two aspirins and see how you feel tomorrow" or require on site tests.

<comment><AUTHOR> I do agree, that all situation cannot be covered. But there is this vast majority of illness & conditions which can be done virtually. Expect for emergency or physical injury like you have mentioned.

See how Amazon care is doing it virtually, they are even doing Labs reports by visiting employee Homes. If need be provide a nurse as well. This is moreso on the lines of preventive medicine, which prevent you from getting hospitalized and thus saving insurance costs too.

All of this is at company cost. Why Can't other employers replicate this with or without insurance line.?

</comment></comment><comment><AUTHOR> I wonder why? this has not been implemented across, why is that only Amazon and Apple are the companies doing it?</comment>


Stripe creates a typechecker for Ruby - <AUTHOR> https://twitter.com/darkdimius/status/1002049138366730240 <comment><AUTHOR> I guess this means types have "crossed the chasm". There isn't a mainstream language / platform that doesn't have some form of relatively modern type system.

</comment><comment><USER2> I hope their RubyKaigi2018 presentation will be online soon.</comment>


Ask HN: Tech thought leaders, who is on the list? - <AUTHOR> Reading the commentary of top tech thinkers is extremely helpful. Let's compile a list of the best.<p>Please comment one name per comment so crowd can upvote. <comment><USER2> As my favorite thought leader points out ([https://twitter.com/glyph/status/735782813211840513](https://twitter.com/glyph/status/735782813211840513)), you cannot be a _true_ Thought Leader until you have confronted the Cognitaur, Mind-Beast and Arbiter of All Thought.

</comment><comment> zeal-technology [https://Zeal.technology](https://Zeal.technology) is trying to establish some thought leadership around company culture.</comment>


Coconut Programming Language - <AUTHOR> http://coconut-lang.org/ <comment><USER2> This sorta kinda reminds me of what macros do for Common Lisp, except that they position it as a language unto itself.

I can also see it used, in a "side effect" sort of way, to get modern code running natively on older or limited devices that wouldn't normally be able to support the advanced capabilities.</comment>


How Anonymous Just Fooled Donald Trump, the Secret Service, and the FBI - <AUTHOR> http://anonhq.com/anonymous-just-fooled-donald-trump-secret-service-fbi/?utm_campaign=shareaholic&utm_medium=reddit&utm_source=news <comment><USER2> Wow, they fooled everyone!

In reality, everyone I know were laughing at anonymous because we already knew the info had been public for years.

I find it funny that anti-trump protesors have to resort to violence (there were violent protests this weekend) and extortion.

Yet, sanders and hillary rallies see no such violence or protesting (unless you count blm).

<comment><AUTHOR> > In reality, everyone I know were laughing at anonymous because we already > knew the info had been public for years.

Exactly. I found it pretty humorous and topical so I submitted it anyway :)

</comment></comment><comment><USER3> They only fooled all of those people on Reddit that kept upvoting these "Anonymous goes after Trump" stories for the simple reason that they hate Trump.

</comment><comment><USER4> I guess Anonymous must have already won its war against ISIS...</comment>


Ask HN: How would you monetize software that runs mostly offline? - <AUTHOR> So Im close to finishing an electron (yeah, I know...) application that helps run competitive weightlifting events. Im not really looking to build a business out of it, but I would like to monetize it in some way.
Normally this would be relatively easy... just have a subscription model for $x/mo and move on. But the weightlifting events are rarely held at locations with internet. So the software is written to 100% functional offline... but Im having trouble thinking of a way of monetizing it.
So far my idea is to encrypt the results of the competition after it is complete. The user would then need to connect to the internet after the competition, log in, pay, and then could get their decrypted competition results. Alternatively, I could just sell it like a normal product, $x/per download...
That all feels so obtuse though... Id love any feedback, better ideas, or discussion. <comment><USER2> Sell it like a normal product. This was the way commercial software worked for decades. They buy a license. They download it and register it while connected to the internet. They then take it offsite. Then, have an option to be paid to be on call for support when a meet is happening. That way nobody is surprised if something doesn't work.

<comment><USER3> When you say normal product, do you mean users will have to buy the next version?

We should be responsible developers with the ability to patch insecurities in the software we sell. You're also going to have feature requests you'd like to publish to your users. As a sole developer one evergreen version seems much easier to maintain for both these concerns. And I think a subscription model or some recurring payment model makes more sense both for you and your users. Explaining this to your users maybe difficult, but if they actually find a product useful they should want the developer behind it to be able to support it.

<comment><USER4> How many insecurities are there going to be in software that doesn't connect to the internet or process input from untrusted users?

<comment><USER5> > How many insecurities are there going to be in software that doesn't connect > to the internet or process input from untrusted users?

In principle there are ways this can be exploited, though I know the poster's application is likely a less interesting attack vector than uranium centrifuges (e.g., [https://en.wikipedia.org/wiki/Stuxnet](https://en.wikipedia.org/wiki/Stuxnet)).

But there may still be user-facing bugs that would require fixing.

</comment></comment></comment></comment><comment><USER6> Do a normal product with a time-based license key.

Results are read-only without a valid key. Don't encrypt the data as it will irritate all your users. People will want to review results during the event, if only to verify that it was correct. Or contest results a few days later. In races, people are sometimes disqualified even months later - I don't know about weightlifting.

On the other hand, new input/modifications require a valid key.

Keys are renewed either automatically (with an online license check / renewing payment) or through an online purchase which returns a license key to input.

You can have a start/end date to the license to bracket the event, with a few days/weeks on either side for flexibility.

Note: I've never done anything like this; these are proposal only.

</comment><comment><USER7> JetBrains style - pay for a license to use the software forever, and get a year's worth of updates. Buy a new licence after a year if they want the next update. Maybe offer a discount for renewal.

<comment><USER8> In case it's not common knowledge, make sure license key requires a server- side verification.

<comment><USER9> Maybe. One of the primary advantages of offline software is that it can be used offline. If you're going to require people to connect to your server you might as well make it a web app.

To be fair, it's not really all or nothing like that, but remember that offline software is already a niche market. Is it better to go half-way into a niche market, or all the way? In other words, your users likely chose your software over the dozens of online offerings because it is an offline app, and then the very first thing you do is make them connect to your server.

Although, I don't see any downsides of doing server-side verification if there is a network connection available, it would be nice if offline software could work on a computer that was offline.

I'm working on a side-project that I may sell as offline software. One of my marketing claims will be that the users own the software forever. They wont experience a "UI upgrade" that makes things worse, and if I go out of business their software will still work for decades or longer. I cannot honestly make that claim if I require server-side verification. I'm betting that my niche users will care about this; if not I have no product because there are dozens of online competitors.

</comment></comment></comment><comment><USER10> I wrote an electron app and I just charge per license. It's an Apache Parquet format viewer [https://www.parquetviewer.com](https://www.parquetviewer.com)

I've actually specified that a single license is per a single user but can be installed on multiple machines. I've had several users request this.

<comment><USER11> How are u managing piracy? With a same username or license - can the software be used by many people? Or you can lock some license remotely?

</comment></comment><comment><USER12> Genuine question - why an electron app and not an iPad app (or even iOS/android app) ?

Is there a massive amount of data entry that is not suited for an iPad or phone(iOS/android) ?

Given the fact that you can probably record the video of the lift using the device camera, plus a few more obvious advantages...wouldn't it be better to do it this way ?

Plus your distribution+billing is also sorted (using the Play Store/App Store).

<comment><AUTHOR> The people that would be using it arent really the ios/ipad type... its hard to explain without sounding like Im stereotyping.

<comment><USER12> I really recommend you do customer discovery here (just like what YC would teach you). Given the number of lifters who are Instagram savvy, I think you might be surprised.

If you do a ipad version, remember you can make it keyboard friendly, so even that reason is out.

I can think of more and more things that are only possible in the mobile version - bar code/QR code scanner (in case you are selling tickets to the event), livestreaming to YouTube/Instagram, etc

</comment></comment></comment><comment><USER13> Encrypting results seems indistinguishable from holding the customer's data hostage. That's not a great place to be, especially if an event is in Outer Qlyphm and the participants want their results _now_ , not when the caravan returns from civilization.

Just charge for the software, provide a download link, and have a simple activation step. Most of your users are not going to be technically capable of bypassing even a very simple registration system. And if they are, it will be _very_ difficult to win that arms race without alienating your honest customers and destroying your product's reputation.

Choosing a good price and treating the customer fairly are the most effective anti-piracy measures you can take.

<comment><USER14> >your users are not going to be technically capable

Did you just assume weightlifters aren't technically capable?

<comment><USER13> Er, no. Just assuming that weightlifters are a representative sample of the general population. There will, of course, be exceptions to this due to geographies and special-interesting groups ("The Usenix Lambda Lifting Association?").

Also not assuming that weightlifters are the same as the folks running the events. In my experience the people who run events just want software that works, and are unimpressed with packages with elaborate and fragile DRM systems that can fail in the middle of a conference. Laptops fail or are stolen, and recovery from thumb drives and "somebody drive find a Starbucks and get those files from Dropbox" are often done with the clock ticking and the crowd getting restless.

<comment><AUTHOR> This guy gets its. The software already available is a headache to use and the goal here is to "get out of the users way", so they can focus on running the meet instead of fighting the software.

</comment></comment></comment></comment><comment><USER15> Sell keys. Why are you trying to make this complicated? Don't encrypt the user's data and hold it for ransom, that's just insane.

You could also just release it as shareware. Especially if you're writing this because you take part in this kind of event and have gotten a lot out of the general weightlifting community; now you're giving something back. Have a splash screen asking people to send you some money (maybe with a suggested donation) or a note with their thanks.

</comment><comment><USER16> You can't monetize it without it being a business. So accept that and manage it like a business; decide how much time you want to devote to it and what are acceptable revenues to justify the time you are giving it.

Look at different business models and pick the one that works for you. If you want to hang ads on it, do that. If you want to work with the certifying authority for the sport and have the sports association pay you a yearly fee to provide the software to all official events, start investigating if that's possible. If event promoters find value in the software figure out what they are willing to pay for it and sell them licenses ( yearly, per event, lifetime, whatever works ).

Don't half-ass it by thinking you aren't in business, fully ass it by making it _your_ business.

</comment><comment><USER17> Try to make an online portion that is subscription provides all the value.

Use the electron portion as an offline data collector for the web app.

Once the event is over the electron app uploads the data to the web app where they interact with it, share it etc.

Then you can handle your subscriptions through the web application.

</comment><comment><USER18> I completely agree with all the comments that suggest a time-based licensed or paying per major version/updates. But have a small suggestion.

In addition to offline functionality, can there be any type of online functionality built-in as a convenience? I'm thinking automatic backups when an event ends, sharing results to a portal for competitors to log into later, etc.

If there is, you can use a hybrid model and offer those as a subscription with a fixed license or (depending on price) a more expensive monthly that will bundle the fixed license.

Good luck!

<comment><AUTHOR> Yes, definately it will do those things. But it also needs to be 100% capable of running a meet offline.

</comment></comment><comment><USER19> If it were me (and you asked how I would do it) I would make the program open source and give it away. I would then build revenue around 1) Accepting donations, 2) selling custom feature development/consulting, 3) Selling additional products and services related to weightlifting.

You said that you have no interest in building a business out of it, so maybe you could just work with donations and maybe occasional feature request bounties.

<comment><AUTHOR> Yeah, this approach is still on the table. Id just like to recoup my time _somehow_... even if monetization wasnt the original intent.

</comment></comment><comment><USER20> > The user would then need to connect to the internet after the competition, > log in, pay, and then could get their decrypted competition results.

Can you rely on them eventually connecting to the internet after the competition?

Can you add a cloud component that stores and shares the results online that they'd want to access?

Is it important to encrypt the local results? I would worry about getting successful first before wasting even a small amount of time on copy protection. People that are going to burn their own time breaking copy protection and risk legal consequences for the sake of a few $100 are unlikely to ever be your customers anyway.

</comment><comment><USER21> Hey, I'm working on a similar product for a different type of fitness competition. Email is in my profile if you'd like to catch up and compare notes.

<comment><USER22> > Email is in my profile

No, it's not.

<comment><USER21> Oops, my bad. Fixed.

</comment></comment></comment><comment><USER23> > weightlifting events are rarely held at locations with internet.

Really? Even mobile networks? Are you familiar with floarena? Seems like a similar idea for wrestling events and it works great online -- allows people both at the event and remote to follow what's going on...

<comment><AUTHOR> Yeah, but its a poor pitch to say, "Oh, no internet? Just use your phones mobile hotspot." Existing solutions run entirely offline and I need to replicate that experience to get any initial usage of the app... at least outside of my contacts.

<comment><USER23> Sure, but your monetization strategy could still be tied to online access/community/etc. -- in other words, you could provide the software to keep track of the event offline for free, but have it connect to a website where people can see results live (when the event supports it), search historical results, and even watch video of the event for a fee (again, if the event supports it).

</comment></comment></comment><comment><USER24> I should think a standard license key should be fine.

Sublime Text isn't a bad model.

<comment><USER25> For how many people I know who depend on Sublime Text, I'm shocked at how few have paid for it.

<comment><USER7> You get work to pay for it eventually.

</comment></comment></comment><comment><USER26> I'm writing an Electron app too:

[https://getpolarized.io/](https://getpolarized.io/)

We're pretty far ahead so you could probably look at the source code repo if you want to look for ideas.

Anyway.

Do this...

Create a public/private key pair. Require the user to enter a 'key'. The key is just ascii armoured encrypted data from the private key. Just make sure the key validates.

They're competitive body builders not alpha hackers. Just obscure it in some way and you're probably good.

This system works offline too since you distribute the public key with the app.

The ASAR stuff in Electron has some obfuscation related framework but I haven't looked at it much.

<comment><USER27> Related: I recently wrote an article about license key generation and validation. The code examples are in Python, but are equally applicable in JS: [https://build-system.fman.io/generating-license-keys](https://build- system.fman.io/generating-license-keys)

</comment></comment><comment><USER28> > So far my idea is to encrypt the results of the competition after it is > complete. The user would then need to connect to the internet after the > competition, log in, pay, and then could get their decrypted competition > results. Alternatively, I could just sell it like a normal product, $x/per > download...

This would be so annoying for customers. I'm sure your customers will not expect this to happen no matter how many warnings you so and when it does, they'll be furious that you let them use it first and then locked in their data forcing them to pay.

Why not make it a subscription and make the app lock down if it cannot contact your server to verify its subscription key let's say every week or so. Most traditional desktop apps followed this model. It can also let you charge them based on the usage or volume of data so you can have subscription plans. Of course people talented and inclined enough can find ways around it but I wouldn't worry about that as much.

</comment><comment><USER29> In addition to the choices already offered (just give it away or sell it like any conventional piece of software): I would favor your choice of seeing the results.

But don't encrypt the results -- what's the incentive to use the app then? Instead provide value to any user (it collects and saves the results locally), but for a subscription the data collector could upload the results.

Then you have a choice: does the event holder or the competitor (or both) pay to see the results? The fact that you collect them means competitors who compete in different events can see all their results, view leaderboards and the like. You could pretty well automate all that so your involvement would be minimal. I don't understand your domain but without prior knowledge I would think it would be easier to charge the contest holder.

Your model might be something like Strava.

</comment><comment><USER30> I created two weightlifting iOS apps - Lift Log and FitnessAI.

\- Lift Log is a weightlifting journal that doesn't have any cloud functionality. It's been free for years, and I recently paywalled it at 7.99/mo or 59.99/yr (for all new and existing users). I received an incredible amount of backlash, but in the end it was worth it.

\- FitnessAI uses all the data that Lift Log users generate to power an AI weightlifting coach. I charge 9.99/mo or 59.99/yr for that one with little pushback from users.

At the end of the day, you are affording your continued time and effort to maintaining your app, which is why I think a subscription model is fair.

Its not like we're writing books where all the user gets is v1.

They get v1-Infinity.

Its very easy to undervalue your work, don't!

And remember, you can always give anyone who asks free access, since you have unlimited supply :) Thats what I do for Lift Log.

Feel free to PM me if you want to talk more!

jakemny gmail com

</comment><comment><USER31> I created _Video Hub App_ \- [https://videohubapp.com/](https://videohubapp.com/) (Electron app)

I sell per download for $3.50 minimum (users can pay more if they would like). It was released last year around the same time and now has 473 copies sold. Late last year I made it open source: [https://github.com/whyboris/Video-Hub- App](https://github.com/whyboris/Video-Hub-App)

Unsure if anything I shared is valuable to your situation. I chose against using licenses / serial numbers / etc - fewer headaches. Makes the user experience better I suppose.

</comment><comment><USER32> What companies are trying to build mindshare among weightlifters and their coaches? ESPN for competition TV shows? Companies that make weightlifting gear, clothes, training products? Reach out and white label the product so they can pay you an annual maintenance contract, you stick their brand on it, they promote it and distribute it for free. One transaction per year so no licensing systems required.

</comment><comment><USER33> How about the Sketch model: a license buys you perpetual use plus one year of updates. If you want further updates you can pay again to refresh the license.

</comment><comment><USER34> I would venture selling the application would be your best bet.

The idea of having to login to see the results, is frustrating.

If you are looking to do pay per model, you could sell usage credits, and have them buy them before hand, or require to purchase one to see the results?

Additionally you could do a split functional option, with basic free functionality always available, and then enhanced functionality available only when connected.

</comment><comment><USER35> Subscription, not permanent license. You do not want to maintain more than one version, the latest one.

Generous trial. It will help with distribution.

Implement some way to upload competition results to YOUR results server. Make it easy to navigate. If traffic deserves it add some relevant ads.

</comment><comment><USER36> I'd be thinking about the next version. How could that next version be leveraged to require an always connected model? E.g. is there an iOS version that needs cloud sync or is it possible to generate a subscription model?

IMO, non-techies are generally in tune and generally accept that there should be an iOS app for the software and aren't adverse to sub models given the plethora of other things they do. In fact, some might see it as a negative for the tool to not be iOS based and have cloud-type presence.

</comment><comment><USER37> How about those dongles with a license key, you can make it USB. Free download of software then you need the dongle to run it.

</comment><comment><USER38> Have it run on an iPad and you can do iOS subscriptions that work fine offline.

</comment><comment><USER39> Charge money + 25% maintenance annually.

<comment><USER40> Unless you offer phone support and an SLA, 20% is much more common.

<comment><USER39> It used to be.

Customers failure to fight subscriptions made everyone realize that you can extract much more money from them. Back in the day, only big vendors like Microsoft got away with wacky high maintenance percentages.

I see even little vertical vendors come in with 30-35% proposals all of the time lately.

</comment></comment></comment><comment><USER41> B2B sales! Message me if you want to chat further

</comment><comment><USER42> build in an auto-update mechanism

</comment><comment><USER43> License it

</comment><comment><USER43> Licence it

</comment><comment><USER44> TL;DR:

Sell it per download.

Why?

If it is to be run in areas that rarely have access to the internet, then your target market isn't probably interested in buying a license or any thing that even remotely makes the app hard to use.

Go easy on your customers. From the moment they visit your website to the moment they have the app up and running should not take more than 3 clicks. Just my 2 cents.</comment>


VoFi Is Coming - Are You Ready? - <AUTHOR> http://www.technewsworld.com/story/VoFi-Is-Coming---Are-You-Ready-69212.html

<comment><USER2> How come Wireless Voice is Vo-Fi and not Wi-Vo? I can see the connection between Hi-Fi, which went wireless and becomes Wi-Fi, so why do we lose the Wi(reless) now?</comment>


How the biggest decentralized social network is dealing with its Nazi problem - <AUTHOR> https://www.theverge.com/2019/7/12/20691957/mastodon-decentralized-social-network-gab-migration-fediverse-app-blocking <comment><USER2> Personally I find the edgy humor on gab to be very boring. "Oh wow yeah those Jews right? Haha" is boring after the zillionth time. But I also find the "oh my God I went to a website for people I don't like and they said things I disagree with" to be equally boring. Like yeah, we get it there are other opinions on the internet. It seems like it would be simple to have a phrase filter for worldviews you don't like, does anyone know of any open source projects or browser extensions that implement this? Feels like it would be some pretty simple JavaScript.</comment>


Amazon Killing Mobile Apps That Use Its Data - <AUTHOR> http://www.techcrunch.com/2009/07/07/amazon-killing-mobile-apps-that-use-its-data/ <comment><USER2> It's an unfortunate restriction but it is definitely not a "recent change" as the article suggests. It was in their T&C's at least six months ago, I recall seeing it while prototyping an iPhone app that used the Amazon API for some things.

If you're a developer who's only just noticed this after months of work then that sucks, but don't try to portray it as a malicious act of Amazon against your project.

</comment><comment><USER3> I'm sorry but building your business on another business's data without explicit permission from them is just setting yourself up for this kind of thing.

<comment><USER4> It's kinda funny that in the 90's, "web masters" wanted search engine crawlers to ask for permission to crawl their site.

Right now, there's no economic advantage to sharing your data--especially in this case where Amazon is trying to protect its investment in the Kindle and its impending "App Store" for books.

Perhaps when we have a way for published data to benefit the publisher, we won't have stuff like this going on.

</comment></comment><comment><USER5> The interesting thing from my point of view is that the Delicious Library iPhone app doesn't make Amazon API calls for ISBNs. It synchronized with the desktop version of Delicious Library, which gets its information from the Amazon API. So the headline is pretty carefully written, they're killing mobile apps that use their data.

Source: <http://twitter.com/wilshipley/status/2517998206>

</comment><comment><USER6> I have noticed the restriction for mobile services in Amazon's TOS about two years ago.

</comment><comment><USER7> From the comments on that article, this is apparently nothing new:

[http://www.techcrunch.com/2007/09/16/amazon-killing-web- serv...](http://www.techcrunch.com/2007/09/16/amazon-killing-web-services- access-from-mobile-services/)

</comment><comment><USER8> Isn't there some other bookstore that the data can be gleaned from? A google search would also probably work.</comment>


Machine Learning in SaaS paradigm - <AUTHOR> http://mytechgossips.com/2012/03/12/machine-learning-in-saas-paradigm/

<comment><USER2> Most of the time we couldn't find situation where like using AI for web developments. I have no idea why people apply most of AI theories only for electronic stuff.</comment>