Zenbox brings your Shopify customers with you across the web - <AUTHOR> http://blog.zenboxapp.com/zenbox-brings-your-shopify-with-you-all-acros

<comment><USER2> This is really, really compelling. I am assuming it works flawlessly in things like a web based help desk and Gmail? (Not as a data source per say, but displaying information.)

<comment><AUTHOR> Yes, that's the pitch. We've done a lot of work to make it work within apps like Asana, the Stripe dashboard, etc. Anywhere it doesn't work, file a bug report, and we'll get it fixed up.

All your SaaS products with you, wherever you are.

<comment><USER2> You should really play that up on the homepage, maybe a slew of screenshots of useful locations. Like for any of the 100 help desk softwares that exist out there... :-)

For example, I immediately thought "how often will I run across a customer on some random forum that displays email addresses?" but that isn't the use case at all.

<comment><AUTHOR> Definitely - one of the challenges with Zenbox is getting the idea across quickly on the landing page. Often times people think it's a replacement for Desk.com/Zendesk/etc., or that it 'only' works in GMail, etc.

We'll have to experiment pretty heavily with the landing page and wording to get the idea and value proposition across clearly and immediately.

<comment><USER2> I think a slew of strategic screenshots would help. Too bad that browser history inspection hack is a thing of the past, building a database of examples that rotate based on the web apps they use would be crazy useful.

</comment></comment></comment></comment></comment><comment><USER3> I think this is helping solve a really important issue of data portability. This combined with Zapier is a pretty powerful combo.

</comment><comment><USER4> Congrats, it looks great. I'll definitely be recommending this to a few store owners I know.

About Shopify, we've been doing integrations for every ecommerce platform for our pricing engine and Shopify's integration was an order of magnitude easier to work with.

Long live webhooks.

<comment><USER5> Shopify's definitely doing integration right. The API docs are a little rough, but they've done the important parts.

I've spent the past few weeks helping new Improvely users integrate our tracking platform with all their different shopping carts. With most of them, we had to walk people through editing templates/themes or other kludges. With Shopify, we just wrote an "app" to register scripts with the theme, some webhooks and a few API calls, and the end-user just needs to click an install button.

Best of all, all those hooks/scripts get unregistered automatically when the app is uninstalled. Even other platforms that have a plugin/app system like this tend to get that part wrong.

<comment><USER6> Awesome changes coming _very_ soon to our docs over here at Shopify.

<comment><USER4> I saw a preview of these docs a few weeks ago. They were very helpful.

</comment></comment></comment></comment><comment><AUTHOR> Shopify was one of the most immediate requests we had right after publicly launching Zenbox, and made perfect sense. WE've been testing it out with some beta-users for awhile now, and the feedback's been awesome. Happy to answer any questions or hear suggestions.

</comment><comment><USER7> The Zenbox homepage is completely baffling. What does the product do? I have absolutely no idea...

<comment><AUTHOR> Maybe you can help us on this one..

It's a browser extension that you connect all of your SaaS apps to (Desk.com, Stripe, Shopify, Mailchimp, Salesforce, etc.), and whenever you hover over an email anywhere on the web (in GMail, your admin panel, your help desk, etc.), you'll see a summary of everything you know about the user (pulled from all of your SaaS apps) pop up immediately.

Any help on how to phrase it, or changes to make to the homepage, to get the idea across quickly and compellingly?

<comment><USER7> Why not just say that? At least I now understand what the product is.

Another gripe - where's the list of supported third parties? I use GoCardless - do you support that? No idea...</comment></comment></comment>


How to Match "A B C" where A+B=C: The Beast Tamed (2018) - <AUTHOR> http://www.drregex.com/2018/09/a-regex-i-submitted-to-reddit-climbed.html?m=1 <comment><USER2> Wonder what happened to the regex101 demo link [1], it just redirects to home page

[1] [https://regex101.com/r/8e2iU1/2](https://regex101.com/r/8e2iU1/2)

\---

Edit: Found a newer article [2] which does point a working regex101 link [3]

[2] [http://www.drregex.com/2018/11/how-to-match-b-c-where-abc- be...](http://www.drregex.com/2018/11/how-to-match-b-c-where-abc-beast- reborn.html#more)

[3] [https://regex101.com/r/QsFZ5M/2](https://regex101.com/r/QsFZ5M/2)

<comment><USER3> The link works for me.

</comment></comment><comment><USER4> Real example of how comodity enterprise software is configured.

</comment><comment><USER5> "# Carrying. This is where it gets complicated"

Oh, I thought we were past that already...

</comment><comment><USER6> This is a crime against sanity

<comment><USER7> This could be the best and the worst thing I've seen all year.

</comment></comment><comment><USER8> What a fascinatingly bizarre little program. It's like some kind of immutable- data assembly language with tortured syntax. The next level of Brainfuck.

</comment><comment><USER9> a b c where a+b=c is not a regular language. What exactly is the constraint on this challenge?

<comment><USER10> Whatever the PCRE supports. This essentially means that you can have at least a context-sensitive grammar, which I think a+b=c indeed is.

</comment></comment><comment><USER11> Should probably read the articles first... I was really hoping for:

        a + b = c, where a = b = c

I could only find:

* a = b = c = 0

* a = b = c = k/inf (where k < inf and k > -inf)

Off-topic but are there other solutions? I checked in Wolfram Alpha and nothing...

<comment><USER12> Not sure where you get those weird infinity results from, but the "a = b = c = 0" solution is easily show:

Note that "a + b = c" implies "b = c - a", and given our assumption that "a = b = c", we can rewrite as "a = a - a = 0". This obviously results in "a = b = c = 0".

EDIT: Modifying the proof above, it becomes apparent that this is a property of groups (most number systems are groups): Again "a + b = c", iff "a + a = a" iff "a + a + (-a) = a + (-a)" which is "a = e".

Note that addition over IEEE754 floats do not constitute a group, (in part) because "inf + inf == inf" evaluates to true.</comment></comment>


A brief visual history of MARC cataloging at the Library of Congress - <AUTHOR> http://sappingattention.blogspot.com/2017/05/a-brief-visual-history-of-marc.html <comment><USER2> wow, some of those comments are brutal

 _" You missed out on all the changes in date coding practice, subjective current practices and subjective historical applicationS of work that most of us have spent years and money on Masters degrees, and years of practice, understanding ourselves. DH is so much more than collecting matching data points and visualizing them!"_

Catalogers. Reminds me of why I never look at AUTOCAT, the mailing list for Catalogers.

</comment><comment><USER3> I love articles like this, where multiple fields of interest of mine all intersect (in this case: literature, taxonomy, and data visualization).</comment>


Classification of Titanic Passenger Data and Chances of Surviving the Disaster - <AUTHOR> https://arxiv.org/abs/1810.09851 <comment><USER2> TL;DR: Your chances were best if you were female. Much better than class or other attributes.</comment>


Mathematics in Python - <AUTHOR> http://www.math.okstate.edu/~ullrich/PyPlug/ <comment><USER2> This is a clean, well written demonstration of how convenient it is to create new types with overloaded math operators in Python. Devotees of C++, in particular, really need to see how nice it can be when operators and inheritance Just Work.

But I got a twinge of irritation near the beginning of the article. Call it a pet peeve if you want, but it's ridiculous to say that Python is "untyped". On the contrary, Python's typing can be quite unforgiving, never letting you weasel out of a type error with arbitrary conversions (a la C or C++).

It _is_ true that implicit, dynamic, duck-by-default typing (like Python) looks at first glance quite similar to no typing at all (like ANSI Forth). This is particularly true if one is used to languages like C or (as he mentions) Pascal.

But this is only true at first glance. What is really going on here is that, since Pascal came out, the language-design community has figured out how to put together type systems that mostly stay out of the programmer's way, while still being strong enough to provide useful safety guarantees. (See also Haskell, etc.)

And this, I think, is a terribly nifty thing that should not be glossed over.

<comment><USER3> I had professor Ullrich for several classes and he tends to be _very_ precise. Indeed, he mentioned that values in Python have types while the variables do not.</comment></comment>


Ask HN: Am I alone in not wanting websites to decide my specific fonts for me? - <AUTHOR> Anybody else here who doesn't like that sites have css with specific local font names first before specifying "sans" or "sans-serif" general families?
I like to think of myself as a power user who has spent considerable amount of time deciding which fonts I like as my serif/sans/mono fonts of choice and customizing them. I like seeing them when I'm reading stuff. Google does the right thing, not assuming a local font!
I hate it when some websites tell me which local font would work for me better. I can see if they're using a fancy font and loading from web but on my computer, I know better.
Why not just specify the family and be done? <comment><USER2> Most fonts used on websites are not present on users' computers. Why not disable using webfonts in your browser and be done?

<comment><AUTHOR> It's not webfonts, I'm okay when a website is using a custom font to show me. It's fonts they assume I have on my local computer. They say "deja vu sans", "sans-serif" when I don't want them naming "deja vu sans" specifically.</comment></comment>


Show HN: CNAME serv.from.zone – Serve a site out of DNS - <AUTHOR> https://serv.from.zone/ <comment><USER2> From the "Why Tho?" linked at the bottom of the page [https://code.mradford.com/post/serving-web-sites-with- emmet/](https://code.mradford.com/post/serving-web-sites-with-emmet/)

" Why tho? * It's kinda neat.

* It's free hosting without the need for a 3rd party account/password (you're not going to get any obnoxious emails).

* You can get a simple website running from the comfort of your domain registrar's admin panel.

* Reduce the need for dedicated machines by serving many sites from 1 generic server.

Attaching domain specific content to the zone makes sense in some cases (RFC), since the data is decoupled from a specific [web] server. In this case, a string which represents HTML.

* It could help lower the barrier to entry to serving sites. Not everyone has the time and/or devops knowhow to deploy their own site (and out of the box solutions usually have strings attached).

"

</comment><comment><USER3> I love when this kind of crazy things are invented, you are very creative sir !</comment>


Ask HN: Anyone ever scan the barcode on an airline boarding pass? - <AUTHOR>

I just got a 2d scanner for work and noticed that the SW boarding passes have 2d PDF417 barcodes on them.  I scanned it and found 197 characters of data.  Some of it is self explanatory (my name, confirmation numbers, destinations, etc).  Here it is:
M1TESSAR/MATTHEW D    EQR2L8Q DENLAXWN 1420 180T017A0017 125>30B0WW0179BWN 0E             0T0101L^460MEQCIC4E6a7 GJNwAfTHnyxgY3VQdsPORVOuPZifjf51WrzqAiA3Zp59 Vw5M1YOUc4snjSh86yeyVK0LxthZdoZBBT/2A==
It seems to get more interesting as the string goes on.  Anyone have any ideas on the encoded data? <comment><USER2> The specification for this standard, along with the fields, lengths and meanings are in this document: [http://www.iata.org/whatwedo/stb/Documents/Resolution792_Jun...](http://www.iata.org/whatwedo/stb/Documents/Resolution792_June2009.pdf)

<comment><AUTHOR> Thanks for the tip.

</comment></comment><comment><USER3> _Anyone have any ideas on the encoded data?_

The final == is a clear sign that you're looking at base64-encoded data; but after decoding it just looks like noise to me. Maybe there's a cryptographic signature in there somewhere? I think you'd need to compare multiple boarding passes to learn anything.

<comment><AUTHOR> Yeah, I decoded the two final words and came to the same conclusion as you. I will check out my next few boarding passes and see if any patterns emerge.

</comment></comment><comment><USER4> I would imagine that is the part that prevents forgery.</comment>


7 good tips on formatting an ebook for iBooks - <AUTHOR> http://www.sidhe.org/~dan/blog/

<comment><USER2> OK, I was going to ignore this, but now you've broken two guidelines. From <http://ycombinator.com/newsguidelines.html> :

      If the original title begins with a number or number +
      gratuitous adjective, we'd appreciate it if you'd crop
      it. E.g. translate "10 Ways To Do X" to "How To Do X,"
      and "14 Amazing Ys" to "Ys." Exception: when the number
      is meaningful, e.g. "The 5 Platonic Solids."

and

      Please don't submit so many links at once that the
      new page is dominated by your submissions.

Please, exercise some discretion.</comment>


There is a huge problem with Adtech today: It's Deplorable. Here is a new idea - <AUTHOR> https://medium.com/@bennybriceno/marketers-throw-out-cpm-ppc-for-ram-and-start-engaging-consumers-directly-a818a8dc3384#.qfukwsc1b <comment><USER2> I've taken the approach of just getting rid of "Adtech" altogether and instead sell advertising on a monthly basis like a magazine would.

Then I self-host the ads and make sure they are high-quality and static images.

The secret is to have your content be in a particular vertical that attracts the types of people who are interested in related products and services. So instead of needing Adtech to creepily figure out who is visiting, the website's content does that for you.

<comment><AUTHOR> Yes, the right content is definitely the answer. If you are not delighting users, then you risk loosing valuable social currency with your entire audience. Then you are left with no value at all.

I would agree that "Adtech" has completely put digital advertising over a barrel. I mean just take a look at the first 8 articles that come up when you search "adtech" at hacker news: [http://imgur.com/Cuizmxu](http://imgur.com/Cuizmxu) Words like "cancer" is used to describe advertising.

Current Adtech is truly the scourge of the internet.

That is the problem we at Adjoy are trying to fix. Currently focused solely on video games, we will eventually broaden our focus. The reason we are focused on games is, we want to perfect ad-UX on a medium that was designed to be interactive. Ad-UX is just another word we have coined, because nobody is really rethinking digital advertising for interactive, mobile space. Why would a banner even exist in mobile? Banners literally represent an alien concept inside mobile- there is no DNA there. Interstitial ads that pop-up, marketing Tide Bleach... there is no worse experience.

It is time to press "restart".

</comment></comment><comment><USER3> Nice concept. Would love to see how it can manifest into all forms of content/commerce.

</comment><comment><AUTHOR> I would absolutely love anyone's input, thanks!

<comment><USER4> what episode is the reference from, I don't remember it

<comment><AUTHOR> Shoot, good question. I will find out :)</comment></comment></comment>


Windows 10 support could end early on some Intel systems - <AUTHOR> https://arstechnica.com/information-technology/2017/07/windows-10-support-could-be-ending-early-on-some-intel-systems/ <comment><USER2> >are blocked from installing Windows 10 Version 1703, known as the Creators Update.

And each 'version' of Win10 only gets update for 18 months. So these people have about 12 months left before they have a machine that is no longer getting security updates because of MS's asinine updating policies, which only exist to force Win10 down the throats of people who don't really want it, or simply don't care enough to be on the endless upgrade treadmill.

Not sure what Nadella's master plan here other than pissing people off. Heck, we have to delay updates at work because they keep breaking Outlook and other critical applications. Thus far, Win10 seems like a disaster. Perhaps the last mainstream version of Windows before people migrate out to Apple or perhaps one day a Linux desktop.

<comment><USER3> I think they don't really have a masterplan, they just try to catch up. They wanted to somehow copy Apple's model of more frequent updates. This, however, is much more complicated for microsoft because they have very little control over the hardware.

</comment></comment><comment><USER4> So it looks like the issue is the Imagination Technologies GPU since the quote from Acer mentions icons displaying incorrectly.

This company has has a few forays into the PC space and everytime they've made their GPUs as long lived as a Mobile Phone.

</comment><comment><USER5> And yet ATMs still run Windows XP...

<comment><USER3> But with no support from microsoft for updates. You will be able to run those PCs for a long time, just not receive any patches (which is bad enough).</comment></comment>


Indexing Faces on Instagram - <AUTHOR> https://kndrck.co/indexing-faces-on-instagram.html <comment><USER2> This looks like a really cool work for a beginner and I do not mean to diminish his effort in any way.

But face recognition is a sensitive/politically-charged topic, I know several grad students (including me) who inspite of having ready-to-deploy scalable software and datasets (~10M instagram images) stay away from doing this type of a demo because reputational risks are enormous. Consider the controversy around geofeedia etc. The last thing you want as a PhD student is press interpreting your research incorrectly and blaming you for causing widespread harm. It happened to a student/professor in my department and even then the infamous study in question was in collaboration with the social network.

There are several cool alternatives, apply it to movies, video game faces etc.

<comment><USER3> This ship has already sailed: [https://en.wikipedia.org/wiki/FindFace](https://en.wikipedia.org/wiki/FindFace)

</comment></comment><comment><USER4> You probably shouldn't be posting images with captions like "random ig girl."

Via the Instagram Terms of Use: > We prohibit crawling, scraping, caching or otherwise accessing any content on the Service via automated means, including but not limited to, user profiles and photos (except as may be the result of standard search engine protocols or technologies used by a search engine with Instagram's express consent).

Don't be creepy

<comment><USER5> Who cares about the FB ToS?

It's not creepy to analyze globally public data.

<comment><USER6> Is being globally public enough reason to think its not creepy? I'm pretty sure the road outside my house is public, but it is still creepy if someone in a clown costume stands motionless in it and points at my bedroom window at 3am every morning.

</comment></comment></comment><comment><USER7> Great article and repo! I hope Instagram will not get to angry.

It would be interesting to use this data in order to finde small cliques :)

</comment><comment><USER8> >working all 36 of my cores haha</comment>


Pebble Reveals Pebble Time Steel and a Smartstrap System - <AUTHOR> http://techcrunch.com/2015/03/03/pebble-time-steel-and-smartstraps/ <comment><USER2> I've been continually impressed with Pebble since their very first Kickstarter. They've done a lot on a few levels:

\- For smartwatches (and possibly even wearables) they produced and shipped what I'd consider to be the first mainstream phone-connected wearable. I'm sure it was on the big players' radar but Pebble produced a decent product relatively on time and I'm sure people learned quite a bit from them. At the least they showed their was a market.

\- For crowdfunding: Pebble got a MASSIVE stack of money. Way beyond what anyone expected. They managed the sudden increase in scale well, and I think showed that startups could be funded to the tune of $millions rather than $tens-of-thousands.

\- For hardware startups: Pebble showed that an independent startup can compete (and continue to compete) with giants who have a vast existing customer base. And that funding is available for that endeavour. I also think they set the standard for communicating with customers. I still remember their updates from factories in China. I think they blazed something of a trail for companies that followed (Amp, Navdy, Ouya, off the top of my head).

Smartwatches aren't for me - I've lost every watch I've ever owned - but I'm in awe of this team.

<comment><USER3> I would add that Pebble gave away a ton of free Pebbles to universities[1]. This boosted their app production, and made them super popular. Everyone on my campus was like, "awesome, you got a pebble!" it made something to be desired, and makes you stand out as a CS or ECE major.

I know I am purchasing a Pebble because I was so impressed by the free one they gave me.

[1] [https://blog.getpebble.com/2013/12/16/pebbling-schools-in- th...](https://blog.getpebble.com/2013/12/16/pebbling-schools-in-the-name-of- awesome/)

</comment></comment><comment><USER4> So, Pebble calls it "Smartstrap", but the TC article for some reason uses the names "Smartband" _and_ "Smartstrap".

The Kickstarter page doesn't mention it by either, but the Pebble blog post ([http://developer.getpebble.com/blog](http://developer.getpebble.com/blog)) that the TC article references still links back to the Kickstarter page as a source. The blog post shows an image of connectors, but doesn't specify what the four lines do (I'm guessing two are for power and two are for data).

So confused right now.

<comment><USER5> This page ([https://developer.getpebble.com/smartstraps/](https://developer.getpebble.com/smartstraps/), linked in the blog post) has a little bit more detail.

There's not much details yet on the API, which is likely only for "is connected" or "start this app", but my guess is that most of the work is left up to the hardware developer, a la most hardware dev. Not so much API calls but straight reading IO pins. I'd pick up an Arduino for an idea of what you'd be getting into.

<comment><USER6> I'd be surprised if they didn't realize some SDKs to make working with whatever protocol they come up with easier.

<comment><USER7> Judging from the first time around, they give people just enough SDK to get started, and then develop the SDK in parallel with the community releasing products.

About two years ago they were telling people to unzip a file in their home directory and put arm-none-eabi-gcc in $PATH:

[http://web.archive.org/web/20130416000246/http://developer.g...](http://web.archive.org/web/20130416000246/http://developer.getpebble.com/1/01_GetStarted/01_Step_2)

</comment></comment></comment></comment><comment><USER8> I like the idea of smart watches, but I don't see why there would be a demand for them. Specifically, I can't think of a single "killer app" that would make a smart watch better than the phone that everyone is currently carrying around.

Can someone enlighten me? Whats going to be the killer app for smart watches?

<comment><USER9> I can't label a "killer app", but smart watches have opportunities a smartphone doesn't. The most obvious is the opportunity for biometrics, as they rest on your skin.

<comment><USER10> Specifically which biometrics? Perhaps the sensors still need to be invented but what would you like to track regardless of technical feasibility?

<comment><USER9> I'm not close enough to biometrics to know what is truly feasible, but I would think you might be able to get SPO2, bpm, EKG, body temperature, maybe even hydration... Then from there you can start building second-order measurements, like how much time you spend at your resting HR, how quickly you return to resting HR, how well your lungs are working, sleep activity. From there maybe you could even extrapolate that data to give feedback. _" Dave, your temperature has been gradually increasing the last 36 hours and your skin is unusually clammy, you might be on the verge of a cold"_ Or maybe _" Dave, your SPO2 is falling and your bpm is rising rapidly, you are going into shock, seek medical attention immediately"_. History is useful for these measurements- what is "normal" is different from person to person, so a running history could let you discover these things earlier.

</comment></comment></comment></comment><comment><USER11> Pebble is unique in this early smartwatch space because they just became a hardware platform in addition to being a software platform. If the smartbands are easy enough to change and provide a significant variety of meaningful functionality it might be the advantage that wins out over the other two major platforms.

<comment><USER12> The win here would be to get acquired by... Amazon?

</comment></comment><comment><USER13> I think I prefer the regular Pebble Time. It already includes a stainless steel bezel, although the rest of the case is plastic. I'd use a custom strap no matter which watch I got. And 7 days is a long enough battery life for me -- I'd rather have the thinner watch than the longer battery life.

<comment><USER14> Where is the thickness mentioned? I looked but couldn't find anything about it.

<comment><USER15> The Pebble Time is 9.5 mm [0], and Pebble Time Steel 1mm thicker, making it 10.5mm [1]. 10.5mm is actually as thick as the current Pebble Steel so it's actually not bad.

[0] [https://www.kickstarter.com/projects/597507018/pebble- time-a...](https://www.kickstarter.com/projects/597507018/pebble-time-awesome- smartwatch-no-compromises)

[1] [https://www.kickstarter.com/projects/597507018/pebble- time-a...](https://www.kickstarter.com/projects/597507018/pebble-time-awesome- smartwatch-no-compromises/posts/1151421)

<comment><USER11> That's pretty amazing when you consider that Apple Watch will be about 12.4mm thick with the heart sensor included and high end traditional watches can be anywhere between 11 and 13mm.

</comment></comment></comment></comment><comment><USER16> Apparently kickstarter didn't get the memo. Site buckling under pressure.

<comment><USER17> Weird, since it worked pretty well on the original Pebble Time launch.

<comment><USER18> They might have bumped up the capacity for that, and then spun down afterwards not realizing they would get swamped today.

</comment></comment></comment><comment><USER17> That gold one with a red band is a bit reminiscent of another smart watch coming out soon. (And plenty of existing non smart watches, of course.)

</comment><comment><USER19> Finnally I am convinced. I loved the color e-paper display and one week battery life. Now I don't feel geeky to wear one either.

<comment><USER20> And the battery life is even better on the Pebble Time Steel (10 days).

</comment></comment><comment><USER21> It may not be successful, but I really think Pebble has the right idea with smartwatches.

I really hope that the smartwatch industry doesn't devolve into the monoculture that is the smartphone industry (well, technically a 2 platform culture, but Android and iOS are basically 2 sides of the same coin now. Neither one offers anything the other doesn't).

<comment><USER22> Funny how Android got more iOS like while iOS was getting more Android like. (Talking both functionality and degree of openness.)

</comment></comment><comment><USER23> I don't want to wait an extra 2 months, so I think I'll stick with the regular Time and hand it down to my wife when the Steel is in stock, retail. She doesn't want the Steel version anyway and would be happy with an upgrade to her Pebble.

The smartstraps are going to be really cool -- a lot of potential there.

<comment><USER5> FYI, they mention that if you back the Time + Time Steel (@$400), they ship them separately "so you don't have to wait". I might end up doing that >:D

<comment><USER23> And now you have me pondering this...

</comment></comment></comment><comment><USER17> Very smart of them to release a gold version. If watches are all about fashion, and people want a gold-colored watch because they like how it looks, they probably can't afford it from Apple.

It may be seen as a copy by some, but a $5000 product is not competing with a $300 one.

</comment><comment><USER24> Revealing it this way leaves a bad taste in my mouth. At the very least, I'm glad that they revealed it during the main campaign rather than shortly after, but it's a pretty significant shift in the campaign. It's like an even bigger "fuck you" to the Kickstarter model, because clearly they knew they'd be doing this.

Plus, it resulted in a big shuffling around of orders, which means a bunch of people were able to "cut in line" and get the extra discounted Early Bird level.

Though all of that is only in regards to the Steel model, I'm actually extremely interested in the Smartstrap system, and I'll definitely be interested in tinkering around with it once I receive my only slightly discounted non-steel Pebble Time.

</comment><comment><USER25> I wonder why didn't Pebble user Mirasol instead of e-ink.

<comment><USER26> They're still calling the color display "e-paper", which in the case of the original Pebble meant a Sharp Memory LCD display (which, while a high-contrast LCD, looked nothing like the e-ink displays in e-readers.)

Based on the appearance of the display, it looks a lot like the color transflective displays found on older portable Nintendo game systems, so I'm guessing it's relative of those.

<comment><USER27> That's what it looked like to me as well. Here's an example[1]. These displays can be either back lit or front lit and don't get washed out in sunlight.

[1] [http://o.aolcdn.com/hss/storage/midas/a5cc0b92eb2febb051740c...](http://o.aolcdn.com/hss/storage/midas/a5cc0b92eb2febb051740c129ddf77b8/200533628/file.jpg)

</comment></comment></comment><comment><USER28> I get that Pebble is trying to milk this (marketing-wise) for all it's worth but this leaves a bad taste in my mouth... Should I also expect that next week they will announce the "Pebble Time Steel +" ??

Now I have to decide if I want to pay $70 more and wait 2 more months (best case).... If you thought Pebble was abusing KS before....

<comment><USER28> So don't get me wrong I love my Pebble Steel and I'm a backer for the new Pebble Time I just don't like how they are handling this.

<comment><USER29> Would you have preferred if they delayed the Pebble Steel Time a few more months so you could feel better about your order? You could switch your order to the Pebble Steel Time right now. I don't see how this adversely affects you at all.

<comment><USER28> I would have liked it if they would have dropped it all at the same time, this is obviously a marketing move to keep their KS relevant. I was on the fence on "Should Pebble be allowed to use KS are their e-commerce platform" and this pushed me over the edge. They didn't add a tier b/c they it some goal, they added it because it was planned from the start. I like to have all my options available to me when I make a decision and with Pebble it's not clear if we have more surprises in store. This means that I have to re-evaluate my options and I've got better things to do then re-decide what I want every week when they add/change KS reward tiers. Just my opinion and obviously not a popular one here on HN...</comment></comment></comment></comment>


Adobe confirms stolen passwords were encrypted, not hashed - <AUTHOR> http://www.csoonline.com/article/742570/adobe-confirms-stolen-passwords-were-encrypted-not-hashed <comment><USER2> I don't know about the passwords, but my card was successfully stolen[1] and a malicious transaction was initiated from another country. I know this was because of Adobe for sure because I (co-incidentally) used a brand new, fresh, unique e-mail address just for Adobe, and that email was released recently in the dump that the hackers provided.

Luckily the malicious transaction was declined by my bank and they blocked the card for me and they told me that someone had compromised my card details and issued me with a replacement card free of charge.

I only keep posting this in every thread[1][2] about Adobe because I genuinely want other Adobe customers to understand the gravity of the situation and disable their compromised credit card and get it replaced by a new one as soon as possible.

[1][https://news.ycombinator.com/item?id=6668013](https://news.ycombinator.com/item?id=6668013) [2][https://news.ycombinator.com/item?id=6632385](https://news.ycombinator.com/item?id=6632385)

<comment><USER3> So you know for sure your email was stolen in the attack, but how do you know the credit card was?

<comment><USER2> It was only the night before the hack had I bought an Upgrade to the CS6 suite. In all probability, mine would have been listed out in the recent few transactions on Adobe's database, maybe?

There is only one other service I am using this card with - A stock photo site and they haven't announced any security issues, yet. Plus, I always am required to enter my card details on their site each time I buy something, in all likelihood, they aren't probably storing the card on their servers, which leads us to the culprit, Adobe.

Also, I am very security conscious in general. I am no security expert, but I always use Linux/Mac to make transactions, with Firewalls, stuff like that.

</comment></comment></comment><comment><USER3> To play devil's advocate here, isn't this actually more secure than something like MD5 or SHA1 without stretch factors or multiple invocations, assuming that the key was not also stolen?

My reasoning is, that in order for an attacker to get the passwords out of this dump, they have to break the 3DES encryption. Brute forcing the key is, as I understand it, still very difficult, and without it they can't get any of the passwords. If someone did find the key however, they'd have instant access to all of the passwords no matter how complex.

On the other hand, if the passwords had been protected using an unsuitable hash algorithm, the highly efficient GPU-based crackers would be able to find millions of people's passwords very quickly, using the sophisticated dictionaries and mangling techniques that are around now. Even quite complex passwords can often be found in this way, since the GPU crackers have got so fast they can try billions of combinations - e.g. even things like "!)@(#*$&%^Test123" can be cracked. [1] [2]. Although, extremely long and complex passwords should be safe.

Obviously, I'm not advocating we all switch to 3DES for our password storage, and the huge risk here is that the key was also stolen - but I'm wondering if my reasoning is actually right here, and that people without extremely strong passwords are better off with this leak than if it'd been MD5.

[1] - [http://arstechnica.com/security/2013/05/how-crackers-make- mi...](http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat- out-of-your-passwords/)

[2] - [http://arstechnica.com/security/2013/10/how-the-bible-and- yo...](http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are- fueling-the-next-frontier-of-password-cracking/)

<comment><USER4> You're right --- had they used something other than ECB mode. For example, if they used CBC mode with a proper IV, _assuming the key is not stolen or compromised_ , the passwords would be quite secure.

The issue becomes verifying the passwords, then: supposing you have a CBC mode oracle, like a HSM, how can you verify two passwords are the same? (This is probably the reason they chose ECB mode in the first place.) In fact, if you allow the user to test if two ciphertexts represent the same plaintext --- and nothing else --- you still break the very definition of secure encryption, namely that a secure encryption scheme should have, as one popular definition, indistinguishable ciphertexts (usually under a chosen-plaintext attack).

So you have to develop some new way to measure security for the scheme, or perhaps somehow measure the damage that an equality oracle can inflict upon an IND-CPA secure scheme. The notion of indistinguishable ciphertexts roughly reflects the inability of an attacker to reliably learn _any_ function of the plaintext from the ciphertext. Throwing that idea out the window seems unwise, since it's such an elegant idea. So, anyway, you're off in uncharted waters, not a good place to be if you're securing users' passwords.

All of that is relatively complex, though, so just let me know if I need to elaborate on some idea more. (I am never sure how in-depth to go in these posts.)

<comment><USER5> > The issue becomes verifying the passwords, then: supposing you have a CBC > mode oracle, like a HSM, how can you verify two passwords are the same? > (This is probably the reason they chose ECB mode in the first place.)

Why is that? What's wrong with verifying a password in CBC mode with different IV?

<comment><USER4> I am assuming that the DB server cannot decrypt. If the DB server has decryption permissions, and it is compromised, then there's little need in encrypting the passwords anyway as an attacker will simply decrypt them by hand. (They may not get all of them before being detected, but they'd still get some or most --- and they might look for high-value targets!)

Unlike ECB mode, you can't just encrypt the same password again and check to see if the ciphertexts are the same --- the IVs will be different (hopefully!). So, can you somehow check two ciphertexts with different IVs to see if they represent the same plaintext? Nope, probably not: if you could, then the scheme would no longer have indistinguishable encryptions under a chosen-plaintext attack [1]. Briefly, this ability to test if two ciphertexts represent the same plaintext would allow the adversary in the IND-CPA game to simply encrypt both of the plaintexts and test them against the challenge ciphertext. (See the [1] reference for more info on this.)

In fact, this is exactly the property you _don 't_ want. You don't want to be able to determine if two users have the same password. If the DB server were able to test ciphertext equality, then it could pairwise-test each pair of users (or again only hunt for high-value targets).

If you were really adamant on encrypting passwords, I'd also suggest that we'd need to pad the password out to the max password length to prevent the revelation of password length. But of course, I _very_ strongly suggest against password encryption. Still: that's another thing to consider in this _hypothetical_ scenario.

[1] [http://en.wikipedia.org/wiki/Ciphertext_indistinguishability](http://en.wikipedia.org/wiki/Ciphertext_indistinguishability)

<comment><USER6> Why go through all that when you could use the username or email together with the password to encrypt it with 3DES ECB mode? Those would be unique and users who have same passwords would still have different ciphertexts.

<comment><USER4> Sorry for my late response.

3DES has a block size of 64 bits, or 8 bytes. Unlike a hash function where the whole input affects the whole output (the strong avalanche criterion and whatnot), in ECB mode encryption, data is only changed on 8-byte block boundaries.

So, for example, suppose the user's username was 8 characters, their email was 16 characters, and their password was some more characters. Then if you use

      3DES-ECB(uname || email || passwd)

where || denotes concatenation, then uname and email will take up 3 blocks and the password will be the rest... this is essentially the same scenario as the Adobe leak, except that the attacker now has to worry about how the password falls across the block boundaries. In this contrived scenario, the password starts a new block of its own, so the addition of the uname/email adds no security here.

Since the uname/email lengths are public, you still might be able to cross- reference sections of identical passwords with other users, depending on how the blocks line up. In any case, this scheme still doesn't offer the unconditional security level you'd like.

I'd recommend the Matasano crypto challenge [1]. It covers some material similar to this pretty early on, so you get your feet wet here.

[1] [http://www.matasano.com/articles/crypto- challenges/](http://www.matasano.com/articles/crypto-challenges/)

<comment><USER6> Wow thanks that was interesting, hadnt thought of that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> _Adobe says that they 've followed best practices for password storage and protection for more than a year now..._

13 generations of photoshop

...and they're just getting around to this after CS6?

<comment><USER8> I wouldn't call Photoshop an achievement, it's a hodgepodge of old libraries and bugs at the best of times.

Adobe refused to patch a vulnerability in CS5 at one point, telling people to purchase and upgrade to CS6 (US$199) if they wanted to not be vulnerable to malicious code execution. In response to the uproar they eventually backported the patch.

[0]: [http://www.macworld.com/article/1166779/adobe_will_issue_fre...](http://www.macworld.com/article/1166779/adobe_will_issue_free_security_patches_for_high_profile_creative_suite_apps.html)

<comment><USER9> If Photoshop, basically industry standard in image-editing software, isn't an achievement... then _nothing_ qualifies as an achievement. And this is coming from someone who prefers GIMP on linux. I would love to produce something even a quarter as popular & usable as Photoshop.

<comment><USER8> It's not. Have a look at what it's users have to put up with on a daily basis.

[http://bad-adobe.tumblr.com](http://bad-adobe.tumblr.com)

<comment><USER10> So you are saying any software cannot be an achievement if it has bugs and UX issues? Or does it have to have a tumblr?

<comment><USER8> No. I'm saying that a program that costs a massive monthly fee and is pretty much impossible to avoid in this industry is should not be this constantly bad.

</comment></comment></comment></comment></comment></comment><comment><USER11> The leaked passwords were different lengths, of course they weren't hashed.

<comment><USER12> (Sorry for the accidental downvote -- #%?!!@% tiny arrows, right next to each other)

<comment><USER6> Its okay, I upvoted it back for you.

</comment></comment></comment><comment><USER13> _the top options being bcrypt, scrypt, PBKDF2, or SHA-2_

Thanks, CSO Magazine!

<comment><USER14> Why is SHA-2 in the list? [Looks like cperciva beat me to it, 0 minutes ago]

Something I've always wondered about SHA and MD5, though: if you feed the output of a hash function into its input enough times, will you eventually reach the original value? Will you have traversed the entire output space of the hash, or will there be multiple closed loops, or perhaps even multiple starting points converging on a single terminal loop?

<comment><USER15> There has to be at least one loop (or fixed point that maps to itself). There's only a finite set of outputs, and the input space of strings as long as a hash is at least that large (in theory, some output hashes may not be possible to generate). Ideally you'd have very large, long loops, which implies few collisions.

<comment><USER16> At least one loop, but it could be the trivial one (ideally?): take the trivial case where the hash is simply a unit cyclic shift of the first N-bits -- there's just the full loop.

</comment></comment></comment></comment><comment><USER17> Xkcd said it best, this is going to make the best cross-word puzzle ever with the password hints and hashes :)

[https://xkcd.com/1286/](https://xkcd.com/1286/)

"Weather vane sword" and "sexy earlobes" indeed.

</comment><comment><USER18> As a small aside about Adobe security practices, I needed customer support from them the other year (its own horror story). As part of this, customer support insisted on setting up an Adobe account, although I'd purchased the product through a third party vendor and not directly from Adobe (as it turns out, thank goodness!).

When looking up that account information, I saw the note I made as to the original password they gave that account that they set up: "123456". I had changed it away from that; I suspect a significant number of their users might not have.

Glad that account contained only a name and ZIP code / town.

AND the serial number. If someone consumed a spare slot on the serial number, I shudder to think of how many hours on the phone with Adobe support it might take to get that slot freed up.

</comment><comment><USER19> Adobe, once again. The gift that keeps on giving. After inflicting Flash on the Internet for 15 years, now this. Has any other company caused as much grief on the Internet as Adobe?

<comment><USER15> Adobe has only owned Flash for the past 8 years. The first (and I'd say, most relevant) 9 years of infliction were caused by an independent Macromedia.

</comment></comment><comment><USER20> So, if Adobe engineers eventually realized that they needed to upgrade their password security, and they had access to the passwords in their DB (they used 3DES, and they had the key) - why did they not immediately decrypt and hash all passwords?

<comment><USER3> It sounds like they did do that, and this system was the old database which was no longer in use, but they didn't shut it down.

<comment><USER21> See neya's comment here, who believes his credit card was taken from there amd he claims to have recently purchase something.

My theory is Adobe didn't use SHA2 even recently, it's probably something that they only started to develop.

And SHA2 is still wrong, BTW. See other comments here.

</comment></comment></comment><comment><USER22> 3DES in ECB mode... great job guys. Really really well done.

</comment><comment><USER23> Anyone got a link to where one might check for the presence of their own email in this list?

<comment> dorian-graph [http://adobe.cynic.al/](http://adobe.cynic.al/)

<comment><USER24> Is it ironic that to check if my email is vulnerable i'm typing it in to a website that i'm not sure whether to trust?

<comment><USER25> My thought exactly... I did not choose to do so =P

</comment></comment></comment></comment><comment><USER26> Nowadays that everyone has lots of accounts and there are so many good password managers around I don't know why losing passwords is so important.

I couldn't care less if Adobe stored my password in plaintext. It's unique to that service and used absolutely nowhere else and I don't even have to remember it.

</comment><comment><USER27> What's worse, see [http://xkcd.com/1286/](http://xkcd.com/1286/)

They use a technique similar to ECB, which results in completely linear cipher text blocks.

<comment><USER5> The xkcd references comic 792 and I totally agree that at any given time there is a website people going to sign up and they will never realize the author of the website stores everything in plaintext so he could get your username and password. This is why we need to push identity services like Persona.

</comment></comment><comment><USER28> Remind me, what year is this again?

</comment><comment><USER29> All my passwords are different and this still pisses me off.

<comment><USER8> You're going to be getting a lot of spam in the near future, the list of emails isn't exactly a secret anymore.

</comment></comment><comment><USER30> "Adobe says that they've followed best practices for password storage and protection for more than a year now, as their authentication systems were upgraded to use SHA-256, with salt, to protect customer passwords."

Absolute bullshit! SHA-256 with salt is totally inadequate for password storage, they should use a PBKDF like scrypt.

<comment><USER31> Depends on the number of rounds used. It can be brought up to a reasonable time complexity this way and is definitely not inadequate. Worse than some alternatives? Sure. But it still gives reasonable protection.

<comment><USER32> If they said SHA-256 with salt, excuse us to think it is just that, with no iteration. If it's iterated SHA-256 it becomes a lot closer to PBKDF and one wonder why they would not use it.

Given Adobe history wrt security, let us assume the worst.

<comment><USER31> That is the standard in the password libraries really. passlib uses thousands of rounds of sha-256, so does glibc, etc.

Unless they implemented the whole thing from scratch, they wouldn't be using a single run of sha-256. It's not impossible, but I'd say at this point it's unlikely they're doing something silly - it would be a job terminating mistake for whoever implemented the new system after the last fiasco.

</comment></comment></comment></comment><comment><USER33> I've heard from several people/companies in InfoSec have copies of the database and are actively analyzing it. Shouldn't be too hard to find if you wish to check yourself against the compromised list.

</comment><comment><USER34> Someone explain the difference to me like I'm 5 please? (Not trolling btw)

</comment><comment><USER35> Plain hashing and encryption are equally silly, especially without salt. Use bcrypt.

</comment><comment><USER36> Anytime I register anywhere, I do the following:

1\. Use a new or willing-to-be-spammed email address. 2\. Use a new phrase- based password.

I write all of this information down on pieces of paper that I keep at my desk. I have a lot of scribbled up paper at this point.

<comment><USER37> How long have you been doing that? There's an email address of mine in that list that is much more likely to have been given to Macromedia back in the late '90s or very early 2000s - I was working at a different company in '02 and am quite unlikely to have given the older email address out after then…

<comment><USER36> Since about 2004 I think? Anything before that, I think it was an AOL email address. If they can access it, they can have it.</comment></comment></comment>


A Penthouse Made for Instagram - <AUTHOR> https://www.nytimes.com/2018/09/30/business/media/instagram-influencers-penthouse.html <comment><AUTHOR> I'm quite hesitant to mention this for fear that my reason for bringing it up will be grossly misunderstood, but the setup this article describes bears an uncanny resemblance to locations used by the adult entertainment industry. Both cases share the theme of a constructed fantasy life, a life that we as image consumers must realize is not real yet nevertheless choose to buy in to on some level.

This penthouse is not real; rather it exists beyond reality. The fantasy it expresses is what we imagine luxury and the good life looks like, rather than how such a life actually looks. But now that this penthouse does physically exist—now I can go take pictures of myself in it and now that people are actively decorating their own luxury apartments to look like it—how can you say that it is not real? How can you claim that it does not accurately reflect what luxury and the good life really are?

This whole hot take is basically a regurgitation of some of Baudrillard's ideas btw. I keep coming back to his concept of hyperreality because it seems so relevant today, and this is an area that I hope to keep exploring. Ahh, if only I could reserve a photoshoot there...

<comment><USER2> 'The aide said that guys like me were "in what we call the reality-based community," which he defined as people who "believe that solutions emerge from your judicious study of discernible reality." ... "That's not the way the world really works anymore," he continued. [...] when we act, we create our own reality. And while you're studying that reality—judiciously, as you will—we'll act again, creating other new realities, which you can study too, and that's how things will sort out. We're history's actors ... and you, all of you, will be left to just study what we do'

<comment><USER3> Well that totally doesn't sound like someone with a personality disorder. /s

I'm fairly sure that history will almost instantly forget them, because they exist to be disposable, to be replaced, and as interest and attention moves on their "mark" on history will be exceedingly shallow. Maybe that's the difference between this constructed "reality" and... reality. Something real can be lasting, while this cotton candy version of reality only seems substantial from a certain angle, for a little while. It's a kind of shallow "reality" for shallow people with minuscule attention spans.

<comment><USER2> Unfortunately you're categorically wrong, since the aide in question was Karl Rove.

<comment><USER3> Well at least I nailed the personality disorder bit.

</comment></comment></comment></comment></comment><comment><USER4> This reminds me of an article on The Verge two years ago documenting the semi- intentional convergence of interior design [1]. Admittedly, there was a focus on spaces like short term rentals and coffee shops, but the effect seems translatable; we seem to be converging on sterile, "personalized but not personal" designs.

I'm curious if, similar to the dislike many have for the unrealistic airbrushed images of the human form, we will arrive at a place where these sterile, fatastical spaces are no longer in vogue. In many ways, it encourages a similar level of unhealthy pursuit of the unattainable.

[1] [https://www.theverge.com/2016/8/3/12325104/airbnb- aesthetic-...](https://www.theverge.com/2016/8/3/12325104/airbnb-aesthetic- global-minimalism-startup-gentrification)

<comment><USER5> I used to be in favor of certain styles for office or home design (particularly industrial modern or industrial chic), but over time I've grown a fondness for one-of-a-kind quirkiness. Places that at first glance perhaps aren't very aesthetic, but there is still an order or a pattern to them (as opposed to an unstyled or haphazard space), and once you start looking more closely, there's a lot to like.

</comment></comment><comment><USER6> I believe that this article is meant to invoke horror and show how artificial the penthouse and the industry it upholds by using words like "picture perfect" or "spotless". Personally, I'm all for it because the penthouse is just another step to making professional looking shots more accessible and attainable for the average person. As the article notes: "some were even booking hotel rooms or making covert visits to furniture stores to get their work done."

Instagram is no longer a platform for uploading amateur photos. It's become its own industry now and we should be treating it as such, and not just shaking our heads.

<comment><USER7> Lately I've heard a lot of people complaining about magazines photoshopping women and Facebook posts that depress people because they just show how great other people's lives are.

This is the same thing. This is people deliberately creating an unrealistic scene and trying to play it off as real.

People can do whatever they want, but I'd much rather follow someone who showing their own home instead of faking it to this extent. (And that goes for the people who rent a hotel room or pose in furniture stores, too.)

<comment><USER8> What's so "unrealistic" about it? Unlike the Photoshopped fabrications you talk about it does indeed exist.

<comment><USER9> It sells the lie "I am an ordinary person and this is how I live," just like airbrushed models sell the model "this is how a person is supposed to look." Don't get too hung up on the literal meaning of "realistic."

</comment></comment></comment></comment><comment><USER8> I don't get it. It looks similar to a lot of AirBnbs I've rented. The furniture isn't really to my taste but it has that "clutter-free living space that isn't actually lived in" air about it.

If anything the NY Times have just bought into the owner's marketing hook, line and sinker and have regurgitated a press release on their behalf.

Or is this presented here for our daily social media 2 minutes' hate?

<comment><USER10> Because a photography set is a scary, scary thing when it's used for new media.

</comment></comment><comment><USER11> What's old is new again: there is absolutely no difference between this and a suburban interior built inside of a Hollywood soundstage.

Advertising: It's the same. But different. But still the same.

<comment><USER12> This was the same thought I had, and to me it speaks to the increasing professionalism of the Influencer space.

I imagine it was somewhat similarly weird when the first film companies were building studios, and the infrastructure for making movies.

</comment></comment><comment><USER13> I wonder how many luxury AirBnbs are rented a night at a time for this same purpose. If I wanted to do marketing product shots for Instagram style adverts that's probably where I'd go.

<comment><USER14> Here in NYC some Airbnbs are specifically marketing themselves as daytime shoot locations.

</comment></comment><comment><USER15> The photos look just like any catalog or magazine shoot, i.e. not having what I assume would be Instagram's charm of spontaneity and reality (I don't follow Instagram).

<comment><USER16> The charm and spontaneity of generally comes from the personality of the influencers. Real or not, it's far easier to convey a personality that _seems_ real with an IG handle than in a magazine shoot. Stories makes it even easier.

</comment></comment><comment><USER17> I'm from Spain and I am in love with Spanish country houses. I find the rawness and authenticity of those house much more beautiful than this manicured fabricated penthouse. There is an almost primal appeal to the houses of old people who don't know what Instagram is, and wouldn't give a shit otherwise; people only concerned with the pragmatism of every day life. I wonder if one day someone will decide to package and sell them as the fantasy of living the simple life.

<comment><USER18> I think that has already lived, died, and we are now haunted by it's ghost. How many hipster woodworkers are on Instagram producing various designs that are fever-dream versions of arts-and-crafts furniture (which was itself an aesthetic that relied heavily on rustic nostalgia)?

</comment></comment><comment><USER19> This article is the most dystopian thing I've ever read

<comment><USER16> Really? To me it just reads as "Instagram influencers realize that the magazine shoot industry was on to something with this concept of 'sets'."

<comment><USER20> I think he means that our reality has become a hellscape where this is a product with willing customers.

</comment></comment></comment><comment><USER21> The penthouse in question reminds me of how houses are staged. It looks sterile and as the article says, "free from the clutter of everyday life".

</comment><comment><USER22> Love the reflection of the flash on the ground in the second picture. It took me a while to figure this out.

</comment><comment><USER23> Reminds me of "that one pool" penthouse in Tokyo.</comment>


Instapaper Releases A Full API — With A Brilliant, Unique Twi$t - <AUTHOR> http://techcrunch.com/2011/02/09/instapaper-api/ <comment><USER2> When MG Siegler uses title superlatives, such as "Brilliant," "Genius," etc., you can usually replace them with NOP. ;-)

<comment><USER3> At this point he's copying and pasting articles from The Onion: <http://techcrunch.com/2011/02/10/grotesque-macbook/>

</comment></comment><comment><USER4> tl;dr - Article goes into how you have to either limit the API or charge for it... Then says that they instead... Charged for it! -sigh- Not that unique. Okay, they charged for something else and that came with it... It's still charging for it.

<comment><USER5> The twist is that he is charging his _users_ for API access - normally it would be a convoluted process where the third party developers pay to use the API, then they try to monetise the users via subscription or ads. This is a smart way to do it.

<comment><USER6> Clever? Yes. Unique? No. Spotify have "libspotify" [1] which allows developers to do pretty much anything (you could create a completely functional Spotify client yourself, which has actually been done [2]), but users can only use your application if they have a premium account.

[1] <http://developer.spotify.com/en/libspotify/overview/>

[2] <http://spotyxbmc.tumblr.com/>

</comment></comment></comment><comment><USER7> This is great news. However, it's unclear how the requirement to have users subscribed to Instapaper should be communicated to the users of third-party apps. Is there an easy way to subscribe new users? Does Instapaper provide any library support for this as part of its API?

</comment><comment><USER8> Isn't the result of this that users have to pay twice? Once for Instapaper, and once for whichever app they are using to access Instapaper?

Granted, 1$/month is low, but making people pay twice (only for apps that charge, of course) could be problematic.

It's a nice approach, just seems like it comes with its own set of issues.

<comment><USER9> No, I read it that apps only work for paid users (who only need pay once).

<comment><USER10> Once for the Instapaper subscription, once to buy the app from the third party developer (if it's not free)

<comment><USER11> Yes, but this is sort of like people having to buy a router even though they pay for their net connection.

<comment><USER12> More to me like having people buy software even though they already paid for their computer.

Instapaper is the backend. The app is the added value. Likely the 3rd party app isn't going to eclipse the brand of Intapaper so they'll be selling their added value directly to existing Instapaper subscribers.</comment></comment></comment></comment></comment>


Staples-is-now-selling-3d-printers - <AUTHOR> http://techcrunch.com/2013/05/03/staples-is-now-selling-3d-printers/

<comment><USER2> It's really only big enough to make DnD figurines.

Fortunately that's exactly what I would use it for.

Pricey though.</comment>


Stack Overflow: Support for OpenID Ends on July 1, 2018 - <AUTHOR> https://meta.stackexchange.com/q/307647 <comment><USER2> I am one of the 13k that is that little red guy. I just migrated my openid provider to a docker container and changed the certificate to LetsEncrypt.

Slashdot removed support, as did shirt woot and deletionpedia. Freecode and gitorious are gone. After this, the only things I'll have left on openid will be pipy (which doesn't seem to work) and openstreetmaps.

I understand why and the technical debt involved, but this still makes me very sad. We're moving in the wrong direction. We're going away from open, federated, distributed standards and back to closed, wall-gardened, proprietary, massive identity providers.

<comment><USER3> > _We 're moving in the wrong direction._

The thing is, too often do people lament the loss of federated/open systems and quickly jump on a blame train spanning the users who "are making the wrong choices by not using the 'obviously better, open systems' and the corporations who 'push their evil walled gardens onto users'".

But few people actually think about what is actually causing these shifts. Users don't usually care about open vs. closed, and seldom care about ideology. They want their shit to work without hassle, to look good, to achieve what they want.

I see so many people blaming users and companies for moving away from IRC, onto systems like Discord and Slack. Why you gotta blame the consumers when they are merely switching to obviously better alternatives? IRC is not a suitable replacement for Discord today, and systems like XMPP and OpenID are massive fucking messes. They don't get used because they're too hard to use. _Usability is a feature_.

Honestly, I think proprietary solutions win so often because they value pragmatism by nature, whereas open solutions tend to value ideology. Sometimes, you have visionaries at the helm who _do_ value pragmatism and you end up with the best of both worlds. Torvalds is an excellent example: He produces pragmatic, open software and his way, although not "ideologically pure", has done more to promote free software than Stallman ever has.

Not to point fingers; I definitely know there are Stallman-wannabees floating around the site who are in it purely to feel superior to others, and be able to wag their finger and make fun of those using "crass, proprietary software". They don't try to understand why consumers use the proprietary solutions (they can't try, because they refuse to use them). And at the end of the day, the needle hasn't moved.

Anyway, all that to say, we're moving in the wrong direction because too many people cling onto the systems that have obviously lost (openid and IRC) without considering _why_ consumers use oauth2 and slack. It's armchair lamenting.

<comment><USER4> I have this strange feeling while reading your comment, as if you would respond to the tragedy of the commons with, "Isn't it great! We should get rid of all the commons!"\---even though the result would be materially worse.

Open, federated systems are possibly, arguably, better, both in terms of ideology (or alternative, more specific terms like "privacy") and (maybe) technology. But, as you say, users don't care about open/closed, they don't care about ideology, they don't even care about technology. They care about ease of use and appearance.

Open, federated systems will never be as simple as proprietary systems. Further, they'll never attract the money necessary to get even as close as possible in terms of ease of use and appearance. Non-proprietary systems will usually lose out of the gate, not because they're dragging a 100lb anvil of ideology but because the alternatives have a magic tailwind of simpler requirements and more resources. (And that's as pragmatic as you can get, right?)

Note: I'm not a Stallman-wannabe, I'm not wagging fingers (at the moment, on this issue), and I use proprietary solutions all the time. But I also know what I'm trading off.

<comment><USER5> Serious question: Why is email so successful? Why hasn't Facebook messenger or Slack or WhatsApp or any other siloed messaging service unseated it? Is it just because it was there first and now it's entrenched?

Why can't other services work like email and Matrix and have success? A lot of it just seems like success of marketing to me.

<comment><USER2> Another thing to consider is that e-mail is actually part of the DNS standard. Of course with SRV records, you could add discovery for any new arbitrary service via DNS, but the fact that it's part of that standard says something to just how old it is.

I think part of it is just the ease of setting up services. You can install new programs on your desktop win/macos and they'll update themselves and all that, but servers are not so easy. There are things that are coming out that make servers more pluggable/lego brick build-able like Sandstorm, and maybe one of those will really take off and make hosted apps something more individuals would be willing to pay for.

E-mail also has its huge share of problems. Setting up your own e-mail server is also super unreliable because of over-aggressive spam filters, as I wrote about here:

[http://penguindreams.org/blog/how-google-and-microsoft- made-...](http://penguindreams.org/blog/how-google-and-microsoft-made-email- unreliable/)

</comment></comment></comment></comment></comment><comment><USER6> > _Of our 9,813,747 accounts around one-tenth of a percent are actively using > OpenID_

I created an account on SO using an OpenID provider in 2009. In 2014, the provider disappeared and with it, the ability to log into the account. I was never warned about this and have never been able to access that account again.

Since then I only access SO via web searches (didn't create another account). I wonder how many people are in the same situation.

<comment><USER7> I've always delegated my address to a provider of choice, so as providers fall I've been able to adjust my delegation. That ability to delegate any domain you control (or even different pages on the same domain) to any provider you wanted to use was one of the best features of OpenID, and something that is lost in most of the "OpenID" Connect systems like FB/Google login where provider is locked as soon as you click the button.

<comment><USER8> OpenID Connect works for users though. "Sign in with Google" is something people understand.

The original OpenID, where my identity was a URL that wasn't a website, and wasn't my email address, was never easy to explain.

<comment><USER7> OpenID was built for the world where everyone had a blog, so everyone had at least one URL that _was_ a website that they controlled that was also their OpenID. It was easy to explain in that world. That world barely existed, and now is long gone, for better/worse.

</comment></comment></comment></comment><comment><USER9> This isn't a big surprise, if anything it's surprising it lasted as long, but some thoughts/comments:

> _The reality is OpenID support has created a ton of complexity in our > codebase_

I don't doubt this is true but I do find it surprising. I would be interested to see a breakdown of this from a technical perspective. I'm sure it adds complexity, but in the context of the overall complexity of SO I would have expected it to be relatively overshadowed.

> _Users have spoken with their actions. You prefer Google, Facebook and Stack > Exchange (aka email /PW) based account auth._

No, they haven't. OpenId use in SO has declined for two reasons: (1) providers shutting down and (2) Stack Overflow UI changes to hide the option from users in the login form (making my logins require extra clicks).

> _around one-tenth of a percent are actively using OpenID (defined as having > visited a site in the past 12 months). If you include all the inactive > accounts it is still less than 2.9% of all accounts._

0.01 up to 2.9 is a massive jump and seems to indicate a high active user turnover. I wonder what the user activity retention rates are on SO. What percentage of currently active users are very recent joiners.

</comment><comment><USER10> It's a little sad, but OpenID implementations ended up being rather one sided. Everyone wanted to be an OpenID identity provider, but fewer wanted to be on the consumer side. For OpenID to succeed that relationship needs to change.

There was simply no benefit for the larger sites to access OpenID as an authentication mechanism. Perhaps the EUs General Data Protection Regulation can change that to some extend for smaller sites that wish to store almost nothing about the users, while still authenticating them.

<comment><USER11> As I see it, it has been replaced by OAuth, which is created for a different purpose but works just as well for login and authentication.

<comment><USER12> No, OpenID has been replaced by OpenID Connect, a profile of OAuth 2.0 written to specifically address user sign in.

OAuth 2.0 is an authorization framework, not an authentication protocol. OAuth 2.0 can be used for a lot of cool tasks, one of which is person authentication.

OpenID Connect is a "profile" of OAuth 2.0 specifically designed for attribute release and authentication.

For more info, see our blog: OAuth vs SAML vs OpenID Connect. [1]

[1] [https://www.gluu.org/resources/documents/articles/oauth- vs-s...](https://www.gluu.org/resources/documents/articles/oauth-vs-saml-vs- openid-connect/)

<comment><USER13> OpenID Connect is still not in any way comparable with traditional OpenID.

<comment><USER12> Nobody said it was...

> OpenID has been replaced by OpenID Connect

Replaced != compatible.

Also, "traditional OpenID" is very ambiguous phrasing... are you referring to OpenID 1? OpenID 2? or OpenID Connect?

<comment><USER14> While we're playing inequality, comparable != compatible.

<comment><USER12> oops! i've been staring at the screen too long!!

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> And they compensated by finally allowing users to add new email/password authentications to their account. Woo-hoo! I'd originally signed in with Google but I'd much rather have personal per-system logins, and now this is possible.

</comment><comment><USER16> Huh, I'm one-tenth of one percent.

AMA, I guess.

But yeah, this got me into trouble a couple times. I actually have a /openid URL on my site that redirects to Google, but forgot. This, mixed with accidentally having two accounts (back when Careers was it's own thing) meant some poor SO rep had to do a whole bunch of untangling one day.

I'm glad they're consolidating systems into an easier-to-understand thing. If it had just be email/password from day 1, I don't think I'd have had half the troubles I did by trying to be "future-compliant".

</comment><comment><USER17> FWIW, I've used OpenID for login on my personal wiki [1] for a few years and haven't had a spam issue [yet].

To forgo the bother of managing being provider or even relayer, I just use a Dreamwidth (the LiveJournal fork) profile [2]. Always interesting using a url as a login. For those who say that's confusing for the masses, there was a method of mapping e-mail address to OpenID profiles. [3]

I was a bit confused as to why OpenID Connect turned out the way it did, moving focus from federated to the closed "Login with Facebook/Twitter/GitHub/Dropbox/Google" thing (if they is Oauth/OIDC based?).

I guess the above could be related - I get no spam because federated OpenID didn't take off, and federated OpenID didn't take off because companies wished to sidestep a future spam problem.

[1] [https://wiki.thingsandstuff.org](https://wiki.thingsandstuff.org)

[2] [https://www.dreamwidth.org/openid](https://www.dreamwidth.org/openid)

[3] [https://mashable.com/2008/09/30/openid-email- addres](https://mashable.com/2008/09/30/openid-email-addres)

</comment><comment><USER12> It's a bit strange that nowhere in the post does SO mention OpenID Connect...

OpenID 1 & 2 have been dead and deprecated for some time...Google deprecated support in 2016.

All domains should move to supporting the latest iteration, OpenID Connect, which, by all indications, looks like it will be stable and relevant for many years to come.

<comment><USER18> OpenID Connect is stable, sure. But relevant? I'm not aware of any major identity provider _or_ consumer who uses OpenID Connect.

<comment><USER12> Seriously? How about Google?

[https://developers.google.com/identity/protocols/OpenIDConne...](https://developers.google.com/identity/protocols/OpenIDConnect)

</comment></comment></comment><comment><USER19> Ah, Stack Exchange (and Overflow) Meta never stops to make me smile : they used a post closed as 'non constructive' as a reference in an official announcement.

</comment><comment><USER20> > Of our 9,813,747 accounts...

Stack Exchange has less than 10 million registered users? That's surprisingly low even for Stack Overflow alone. I wonder how many MAUs they get...

<comment><USER21> ~50 monthly visitors. The key here is you don't need an account to get the value. [https://stackoverflow.com/company](https://stackoverflow.com/company)

</comment></comment><comment><USER22> Tangentially related:

The openid.net website is blocked by some popular web filters as "virus/malware".

Anyone know why?

<comment><USER23> Which web filters? I can't see any reason why it would be blocked, as I couldn't find any history of malware infection on it and they don't even have ads (so no history of their ad network pushing exploits).

</comment></comment><comment><USER24> I don't get why OpenID was introduced in the first place then. The point of using an open auth protocol is to not become dependent on monopolies, isn't it? The figures being what they are isn't supportive of this decision when using OpenID is considered a strategic decision. I thought you could use Google at least (but not Fb) as OpenID Connect provider, so wouldn't it make more sense to deprecate support for Google-proprietary login schemes instead?

Also, as remarked on the followup stackexchange discussions, this will make stackexchange login (against Google, Fb) JavaScript-only, won't it?

Could somebody with more know-how clue me in about the state of affairs of OpenID and web auth?

<comment><USER12> > I don't get why OpenID was introduced in the first place then.

Because the Internet needs standards to work. If all domains implement authentication differently, we do not have an interoperable network.

As is customary, standards must evolve to keep up with requirements. OpenID 1 and 2 weren't built with the idea that smart phones would be in every persons pocket, or Internet connected devices in every home.

The latest iteration of OpenID--OpenID Connect--is essentially Google's playbook for authentication. It's of huge value to the rest of the world.

To put it simply: having your own OpenID Provider at your domain (e.g. idp.example.com) allows you to operate a similar authentication infrastructure as Google.

What does that mean?

\- Single sign-on (SSO) across web and mobile applications

\- Ability to support a variety of strong authentication mechanisms (a.k.a 2FA), like U2F security keys and OTP mobile apps, in one place for many apps

If all apps and services were to align with OpenID Connect, we would have a truly scalable and interoperable identity layer for the Internet.

<comment><USER25> But what's the point of OpenID Connect being interoperable, if unlike in OpenID, the providers are statically defined by the site and not dynamically discovered from the user input? If you want to have your own provider for your own sites, then you don't need it to be interoperable.

<comment><USER12> OpenID Connect defines two important standards: Discovery [1] and Dynamic Registration [2].

All OpenID Providers publish their details at a publicly discoverable (and standard) domain: [https://{hostname}/.well-known/openid- configuration](https://{hostname}/.well-known/openid-configuration).

For instance, you can see our OP meta data here [3].

This provides the foundation for using email as an identifier, i.e. in order to access protected resource at autonomous site, input email at a domain with an OP, and the RP can perform discovery to find where to send the user for authentication, and dynamic registration to register their client (app) with the OP to obtain user information ("claims").

[1] [https://openid.net/specs/openid-connect- discovery-1_0.html](https://openid.net/specs/openid-connect- discovery-1_0.html)

[2] [https://openid.net/specs/openid-connect- registration-1_0.htm...](https://openid.net/specs/openid-connect- registration-1_0.html)

[3] [https://idp.gluu.org/.well-known/openid- configuration](https://idp.gluu.org/.well-known/openid-configuration)

<comment><USER26> > For instance, you can see our OP meta data here [3].

Do you e-mails end with @idp.gluu.org? Or how would the RP discover that the domain is not "gluu.org" but "idp.gluu.org"?

<comment><USER12> no, but using my email adress @gluu.org, you can find the discovery endpoint because its a standard address for domains. For instance, here's Google's OP discovery endpoint:

[https://accounts.google.com/.well-known/openid- configuration](https://accounts.google.com/.well-known/openid-configuration)

<comment> vertex-four How do I find that discovery endpoint, given your email address @gluu.org? [https://gluu.org/.well-known/openid-configuration](https://gluu.org/.well- known/openid-configuration) doesn't exist. I don't even know that idp.gluu.org is a thing from your email address.</comment></comment></comment></comment></comment></comment></comment>


Young Pinay invented air conditioning unit without refrigerant or freon - <AUTHOR> http://www.whereinbacolod.com/2018/09/young-pinay-invented-air-conditioning.html <comment><USER2> Related:

[https://www.jamesdysonaward.org/2019/project/airdisc- cooling...](https://www.jamesdysonaward.org/2019/project/airdisc-cooling- technologies-cooling-system/)

And:

"Air Disc Cooling Technologies - a new form of cooling system"

[https://www.youtube.com/watch?v=8vyYD2Rrh3M](https://www.youtube.com/watch?v=8vyYD2Rrh3M)</comment>


Amazon engineer will let strangers manage his $50,000 stock portfolio 'forever' - <AUTHOR> http://www.cnbc.com/2017/07/06/amazon-engineer-will-let-strangers-manage-his-portfolio-forever.html <comment><USER2> One of my favorite things about this story is the way it discretely slides an association between "Amazon engineer" and "has $50k to let go of 'forever' on a social experiment" across the table to the audience.

That's the real message that's going to be received by a large amount of the population reading this story as it makes the rounds on outlets like CNBC.

<comment><USER3> He's probably not just any engineer because if you actually check the stream it looks like it is viral marketing for "robinhood.com"

<comment><USER4> This is probably it. I personally signed up for Robinhood based on this project. I'm already interested in stock trading though so it wasn't that big of a commitment from me but they do have a nice App and signup process compared to other financial trading outfits I've used.

<comment><USER5> Yeah, Robinhood is mentioned quite a bit on his site, including a sign up referral link. Seems like their referral program gives you $10 for each signup.

Also he says if it hits $25K, then the game is over. So it's only $25K at real risk, not $50K. (True, the stocks could fall further before he liquidates.)

<comment><USER6> Also: anyone have an idea as to what regulations he is citing when he says if it drops below 50% he has to close the account? Is that a Robinhood thing, or an equities trading thing? As far as I know, there is no regulation limiting how much a person can lose on the market...

Makes me wonder if perhaps his account balance is $25k personal, and $25k matched by Robinhood for the stunt.

<comment><USER7> The $50k is all mine. I was not given anything from Robinhood except for approximately $500 worth of free shares for referrals.

You can learn more of the $25k rule here: [https://support.robinhood.com/hc/en- us/articles/217072366-Pa...](https://support.robinhood.com/hc/en- us/articles/217072366-Pattern-Day-Trading)

<comment><USER8> If I were Robinhoood, I'd try to be the facebook of financial startups- give every high school student a starting portfolio of fake stocks to manage through high school so they learn how to invest and manage money, then have avenues to have different "tabs" in their portfolio for real stocks they have gifted by family, and another for real ones they buy...

They can play with purchase what ifs in the stock sandbox, and plan and grow in the real tabs... among many many other things...

<comment><USER9> But is investing in stocks something you would want high school graduates to pick up?

I always thought of stock-picking as something that the average Joe should be careful with. Trading on less information than insiders and slowly being eaten by fees and taxes. It's an under EV game.

Besides that there's the wisdom of crowds that will eventually follow the trends and invest irrationally (pump and dump). That's how bubbles are created.

<comment><USER8> When I was in highschool, I was attempting to corner the market on commodities - specifically wheat!

Every day I would log in and manage my account - I was a commodities broker and I managed to build a pretty powerful little empire with my savvy transactions.

While not as powerful when it came to ore... my wheat holdings were no laughing matter... that was until the day I smoked pot, dialed in and accidentally sold all my wheat holdings as opposed to buying up all the other supply - thus eliminating my monopoly on the galactic wheat trade...

Man, Trade Wars was a blast in the early nineties.

<comment><USER9> That's an interesting story and I'm sure you learned a lot through the experience. I'm also sure there are plenty others like you, to whom trading was educative.

But on the other hand I'm sure there are a whole lot of young people on the other side of things. Those who start learning about stock-trading and soon see it as a way to make money fast by taking huge risks. They get spammed by 500$ signup bonuses to various stock-trading platforms, they're presented with 100x leveraged trading options and such. I don't see much benefit in that.

What I think is young people should be taught how the market works with a huge grain of salt. Definitely not by letting them go wild with play-money since we all know what will follow up.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Hey everyone! Glad to see you're all enjoying the project. I'd be glad to answer any questions you have. Let me know!

<comment><USER10> Why did you decide to do it with $50,000 and Robinhood instead of just creating a bot to trade stocks on an Investopedia stock simulator account? [0]

I mean, I understand that $50k might not be a lot for you, but if the aim is to see what the majority of random people on the internet feel like buying, while measuring the return of these decisions, this could be accomplished without putting up any actual money.

[0] [http://www.investopedia.com/simulator/](http://www.investopedia.com/simulator/)

<comment><USER11> The actual money aspect is why this blew up. No one would care if it was fake money.

<comment><USER10> _> The actual money aspect is why this blew up. No one would care if it was fake money._

Two things:

1\. This is assuming it was done for the press coverage, and not just as a hobby project

2\. If I were to do this, I don't think I'd advertise it was fake money. What's the difference anyway? It's not as if people on the internet benefit at all from the investment return. I always assumed this was more of a "Twitch plays Pokemon" thing than anything more serious.

<comment><USER11> I wasn't assuming it was about press coverage necessarily (though maybe it was), but that in order to be interesting it needs a critical mass of people participating. If it wasn't real money then that wouldn't happen.

</comment></comment></comment></comment></comment><comment><USER12> For realtime stats: [http://stockstream.live/portfolio.html](http://stockstream.live/portfolio.html)

Looks like they're down $577.18 so far. Jebaited

<comment><USER13> I wonder how they got one share of ZNGA for $0

<comment><USER7> Some shares were gifted for free by Robinhood for referrals.

<comment><USER13> Thanks for that tidbit.

What was second place, _two_ shares of Zynga? :-)

<comment><USER14> One share of Snap, probably.

</comment></comment></comment></comment></comment><comment><USER13> Pretty much defines a "blind trust" :-).

I find the experiment pretty interesting, how many people will try to make him go to zero? How many will want to make the value higher? If you were leveraging a pump and dump house how does that work? And home much can you trade at once? (all would seem to be a silly amount, but it has to be enough to make reasonable trades)

And how do you know it is _actually_ real money? We used to do office stock pools where folks would start the month with "$100,000" and got two trades a day, one at noon and one when the market closed (easy to do on the west coast) at the end of the month the one with the most "money" would "win". It was fun and taught me a lot about market volatility (and that I would suck as a day trader :-)) but there was no actual requirement for money to actually trade hands. And even at $50,000 you're not buying or selling enough to move most stocks.

<comment><USER15> The question that really bakes my noodle is, what if the people who try to make him go to zero collectively make his value higher? ;-)

<comment><USER16> I've come across multiple papers investigating stock trading strategies, where they mentioned little or no effect for the actual strategy, but a significant positive effect for the opposite strategy.

</comment></comment></comment><comment><USER17> Maybe this is the beginning of "Twitch Trading". If ppl like seeing other ppl playing video games, trading stocks/futures could find an audience. The question is what would be the incentive for a competent trader/algo to let ppl see it's trades.

<comment><USER18> what would be interesting though, but much more of a niche, would be if some successful quant traders did an in-depth review of some "alpha" or strategy they ran some time ago, which is no longer profitable. They could discuss their tools, analysis , trading metrics, performance, and some discussion of why the strategy stopped working.

It would give a good window into the work-flow and skills required to do this successfully. Even if it's retrospective, going back a few years.

<comment><USER19> A friend of mine kinda does this, a lot of the content on his site is comparable to what you're describing.

[http://www.verticalsolutions.com/papers.html](http://www.verticalsolutions.com/papers.html)

</comment></comment></comment><comment><USER20> Would an infinite number of monkeys making an infinite number of trades find proof of Fama's Efficient Market Hypothesis?

<comment><USER21> I don't see why they'd bother.

</comment></comment><comment><USER22> > Its 0.4 percent return slightly outperformed the 0.2 percent rise in the S&P > 500 since its launch on May 30.

Amusing excerpt. Highly relevant, of course.

</comment><comment><USER23> Screaming Eagles are an arena football team that allows the fans to call the plays.

[https://www.nytimes.com/2017/02/17/sports/football/indoor- fo...](https://www.nytimes.com/2017/02/17/sports/football/indoor-football- league-screaming-eagles.html)

</comment><comment><USER24> Is he going to support the software integration piece of this, forever?

<comment><USER7> Yes

</comment></comment><comment><USER25> I'm really curious what his streaming software looks like. I've always been interested in how stream video gets composited and what tools are available, but I'm too lazy to look into it.

<comment><USER26> OBS Studio is the most popular software right now for Twitch live streams. It's open source and under active development. [https://obsproject.com/](https://obsproject.com/)

(Disclaimer: I'm one of the developers)

<comment><USER27> are you the waffleimages r1ch?

<comment><USER26> Of all the things, that's what you recognize me from? :)

</comment></comment></comment></comment><comment><USER28> Twitch Plays Pokémon and other such games tended to be highly disorganized and take forever to accomplish basic tasks.

I wonder if that'll be the case here, and if so, whether that means better or worse investing.

<comment><USER5> Pretty easy: "The game is divided into voting rounds, each lasting 5 minutes. Every 5 minutes the top buy or sell command will be executed and one share will be bought or sold. You may only vote once per round."

[https://www.twitch.tv/stockstream](https://www.twitch.tv/stockstream)

Buying or selling a share is basically atomic, so there's no coordination needed apart from the overall portfolio. Looking at the portfolio, [http://stockstream.live/portfolio.html](http://stockstream.live/portfolio.html) , most positions are just a few shares.

</comment></comment><comment><USER29> Brokerage fees on each transaction may quickly eat up his principle.

<comment><USER30> Robinhood doesn't have transaction fees

<comment><USER29> I see, you're right. But there's the spread between the bid and ask prices, which will grind away at your profits if you rapidly trade.

</comment></comment></comment><comment><USER31> Does anyone know how is this implemented? Is there some stock trading API?

He also talks about some regulation at the end. Does the entity needs to be setup legally in a certain way?

<comment><USER32> Yes...presumably many companies offer it, but it may not get top billing because it isn't exactly a widescale consumer product.

Here's the one I use, which has great rates: [https://www.interactivebrokers.com/en/index.php?f=5041](https://www.interactivebrokers.com/en/index.php?f=5041)

<comment><USER31> thanks!

</comment></comment></comment><comment><USER33> I wonder why the Amazon engineer part is relevant?

<comment><USER34> it's not, it just gets the writer more clicks on his/her headline

<comment><USER35> You need a hook. Especially when robinhood is trying to generate some viral growth.

<comment><USER34> Oh, yeah I agree! I didn't mean to sound like I was knocking it. Good journalists know they need an enticing title

</comment></comment></comment></comment><comment><USER36> Buy in a fractal denial pattern area near the New Coastline.

Global Warming.

Rising Sea-levels.

Human stupidity.

Profit.

Your grandchildren will be grateful. Or spoiled brats.

<comment><USER37> Fractal Denial? This is a new term to me... and the #1 link for Fractal Denial on Google is your post :)

<comment><USER36> Its basically patent- trolling with ground. You buy enough to stop any construction process, dead in the water due to legal processes.

Now you can extort from any company going there, wanting to build something the money for the little area you sell + the money it would cost to restart construction elsewhere - 1$ + the legal fees saved by not going to court.

ProTip: You might want to share the wealth with local legislators later upon, to avoid having zoning-laws changed.

</comment></comment></comment><comment><USER38> is forever in quotes because it implies "until 4chan gets here"?

</comment><comment><USER39> Its 50k of advertising for robinhood, which is peanuts

</comment><comment><USER40> Twitch plays NASDAQ

</comment><comment><USER41> I bet he can beat 50% of all hedge fund managers.

</comment><comment><USER42> I bet it'll just track the s&p 500

</comment><comment><USER43> Does Robinhood offer an API?</comment>