Crowd-Sourced Flight Search - <AUTHOR> http://flightfox.com

<comment><USER2> Brilliant! I'll be using this for some upcoming flights.

I daydreamed of something like this 2½ years ago. See <http://sivers.org/semi- expert>

Thanks for making this come true.

<comment><AUTHOR> Wow! Thanks Derek. Great post; exactly what we were thinking in building the product. Lots of iterating to go to get it working seamlessly, but exciting times ahead. Would love your feedback when you get around to using the product.

</comment></comment><comment><USER3> This is so useful. I noticed their flexibility options are the usual +/- n days, but it would be more useful for me if there was an option to only + or - but not both. For example, let's say you want to leave on the 7th, but the 8th and 9th are doable, just less ideal because you'll have one or two days fewer to spend at your destination. With the current system you'd have to choose the 8th and then say +/- 1, which screws you over if the finders try their hardest to get the exact day you requested.

I just discovered you need to pay the finder's fee in advance. While this might get more finders to use the site because they won't be afraid of their efforts going to waste, this is going to deter a lot of customers who are still shopping around and only want to fly if they can get a better rate than they expected.

</comment><comment><USER4> Part of me thinks if you made "starting contests" free for customers, you'd get more traction. On the other hand the other part of me thinks that you've already tried this approach, or at least thought about it. So, which part of me is right?

Also two tiny notes about your front page:

1\. I, personally, get really pissed when I'm informed about fees of a service in any step of the process other than the first one. So, I'd suggest show the fees somewhere above the fold.

2\. This is more of a UX thing. In the "How it works" box, make the titles clickable.

I love the idea. Simple, yet has a lot of potential. Will be start my own contest someday soon.

Rock on.

<comment><AUTHOR> Hi Hamid, (full disc: we've worked alongside Hamid, awesome coder).

1\. Good point about knowing about the fees upfront. Will update in our next release. Somehow went missing after experimenting with pricing too often.

2\. They are clickable. Aren't they? Uh, oh... What OS/browser? _Opens Vbox_

Would love to iterate faster with more engineers. Any chance we can poach you from setkick.com?

Thanks again.

<comment><USER5> _> They are clickable. Aren't they?_

Nope.

 _> Uh, oh... What OS/browser?_

Windows 7: Chrome 17, Firefox 10, Firefox 11, IE9

</comment></comment></comment><comment><USER6> My first thought was: what's to stop someone from waiting for some responses and then running over to Kayak to book once they know the best dates/airlines.

But it looks like they take the finder's fee upfront. It would be nice if there were an option to only pay the finder's fee if someone significantly beats the best price you were able to find.

Everyone does at least an _initial_ search to get an idea of price when they're considering a trip, right? And presumably the experts have an idea of the typical price on given routes and can decide whether the "price to beat" is attainable?

<comment><AUTHOR> Hi drags, co-founder here...

We tried your suggested method, but there were too many complications in practice. Many people quoted fake prices and, of course, prices and availability change regularly.

Most of all, we'd rather not create a competitive relationship with the customer. The idea of the concept is to relieve you of all the time and stress related to flight search (especially on more complex itineraries). So asking you to first search yourself and post a price is somewhat contrary to our vision.

We may revert to this method in future, because we're constantly testing, but at this stage we think we have a reasonable balance between customer and expert.

<comment><USER7> I agree....I think there is more than enough incompetence and inefficiency in this industry that you will have plenty of customers who won't think twice about the fee, as long as you can ensure that they are getting a _competent_ person planning their flight, and the result will be the best that can be done.

</comment></comment></comment><comment><USER8> Have you considered allowing people to optimize for something other than cost? I'd be very interested in paying people to find me mileage runs - that is, itineraries that minimize the cost per mile.

[http://en.wikipedia.org/wiki/Frequent- flyer_program#Mileage_...](http://en.wikipedia.org/wiki/Frequent- flyer_program#Mileage_run)

<comment><AUTHOR> Yes, absolutely. You could do that know, but we need to build our expert base a little larger before we target this market specifically. Also, we need to find a way to add these options without confusing the average person. We're pretty obsessed with analytics and we've seen that even just minor details confuse people and reduce conversions. Maybe a separate menu/link/section/subdomain is needed.

<comment><USER8> Cool! I am working on automated mileage run finding at mileagebrain.com - hoping this will turn out to be complementary :)

<comment><AUTHOR> Looking good. Definitely a need for a tool like yours. Let's keep in touch to see if we can work together once we get settled.

<comment><USER8> You should put an email address in your HN profile!

</comment></comment></comment></comment></comment><comment><USER7> Extremely interesting.....a few questions that come to mind for me:

1\. Is it worthwhile using for simple flights? Ie: Toronto to las Vegas, direct?

2\. Can it handle extremely complex (maybe even almost freeform) scenarios beyond the displayed +\\- x days, such as: I have 14 days available (but would settle for an 11 day trip), and I can take travel any time between these dates, and I am willing to travel to a, b, or c - what are my options? (This is getting into the realm of travel agent services....for which I would gladly pay, assuming one might actually be able to find a competent one through this site).

3\. Does the service tend to work much less well in Canada compared to the US?

4\. Is it conceivable that if this service is successful enough (market penetration wise), that some of the optimizations used may start to disappear, or affect pricing from airlines?

5\. Any plans of extending it to vacations (flight, hotel, all-inclusive)?

6\. You mention frequent flyer plans on the site - for a person who has no clue, any (long term) plans for offering sign up for those types of things integrated with your service?

7\. Are you running some customized search tools in house, or does each person fulfilling contests just using their own secret tips and tricks?

Good luck on this, truly one of the most interesting initiatives I've heard of in a very long time!

<comment><AUTHOR> Hi mistermann,

1\. Depends on your expectations. If the absolute lowest price is found on Kayak.com, then that's the price you'll get. We can't change that, but we can save you lots of time by making sure that's the lowest price. Of course, we do save a lot of people money on short trips, but the longer the better.

2\. Yes, absolutely. Just describe your requirements in the comments section and make sure you work with the experts to keep them on the right track. This is really where we can save the most for you.

3\. No, not at all. This is a global service. It works best when you're flying to lesser know places because our experts may have local knowledge that helps get better prices than you know.

4\. Only a very small percentage of winning flights use loopholes. But yes, they can and do disappear. Luckily, because we're "human-powered" and because these loopholes are discovered by humans, it's more likely you'll get access to loophole savings on Flightfox.

5\. Yes, maybe, probably, not sure :)

6\. We need to reach critical mass to really leverage the power of frequent flyer points. We'll get there soon :)

7\. At this stage, it's all human powered. We're only a few weeks old, so we hope to evolve. Some of our experts claim to use custom software. There are definitely lots of manual tricks and tips too.

All the best and thanks for the kind words.

</comment></comment><comment><USER9> These guys are awesome. I used them to get a flight from SFO to SYD (return). It's usually $1400 and they got it down to $900.

Cheers,

Marcus

<comment><USER10> What is the difference in price really going to be, for what option you choose? I'm willing to through away $30 on a gamble of getting a cheaper flight than I can usually find (and I consider myself pretty good at flight finding), but they offer a higher-paid option and it's not clear what benefits that will have.

<comment><AUTHOR> Hi marquis, co-founder here...

Flightfox is still very much an MVP. We're changing pricing regularly, including the associated copy. Essentially, you should choose a price based on the value you expect. For a simple overseas flight on which you just want peace of mind (that you're getting the best price), just go for the cheapest option.

At the other extreme, we've had a group of 20 people flying overseas, so paying $200 is not unreasonable in this case. We saved this customer over $10,000. One of the experts achieved this using an agent who had consolidated stock (discounted) directly with an airline. This price was unmatched online, so it made sense for the contest holder to get experts working to this level.

Appreciate the feedback; we're so far finding it a little difficult to articulate our variable pricing.

Some people just want to absolve themselves of the stress, some want the absolute lowest price, some want general advice, and others want complicated itineraries built using frequent flyer points. When we had all of those options set at different prices, people just got confused. :)

We'll keep iterating and get there soon. Thanks.

</comment></comment></comment><comment><USER11> I'm thinking you should quickly rename it to Tripfox, TripBounty, or something else. It seems like the real value here is replacing travel agents more comprehensively than something like Kayak does.

Good luck!

<comment><AUTHOR> Many thanks. You're spot on. And it's so obvious in hindsight, but alas.

We've already had a contest asking for accomm recommendations and it worked surprisingly well. That person paid a $200 finder's fee and it was great to see experts who'd been to the same places recounting their experiences in detail and giving highly practical advice. Of course you can get this for free elsewhere, but the whole package is worth paying for. This person saved a fortune on the flights alone.

<comment><USER11> eBay turns people into Merchants.

Airbnb turns people into Hoteliers.

FlightFox turns people into Travel Agents.

</comment></comment></comment><comment><USER12> Everyone here seems so satisfied, but to be honest I am still skeptical. It would be nice in the "browse flights wanted" screen you showed some baseline price for the requested flight (e.g. automated kayak search, though i'm guessing that is in violation of their TOS. perhaps you can just have a link to the query) so that potential customers could see some samples of the kind of savings to expect.

<comment><AUTHOR> Hi saucerful,

We used to do this, but there was too much contention around the base price. Imagine if we showed a base price of $1000 and on your favourite search engine you saw $950. This created an adversarial situation with our flyers.

Then we had the issue of a specific requirement in the comments (e.g. I'm relocating to another country with my two pets). The experts would put up the full cost of flying with the pets, but then our base price would undercut them because no flight API handles pets.

Then we used virtual assistants to find the base prices considering the comments, but of course they couldn't interpret the comments properly. E.g. someone said they didn't want red-eye flights, but the VA didn't understand what that meant and gave a red-eye price that was hundreds below the expert prices.

Sorry for the long reply, but would love to hear any suggestions around this. At the moment we're trying to create a better flyer-expert relationship.

</comment></comment><comment><USER13> May I suggest adding more flexible options? I often find myself wanting to plan a vacation but not knowing where or when I want to go - on traditional travel sites, this is a problem, because everything has to be run through an algorithm, but as a crowdsourcer, you might be able to get away with saying 'two week trip, sometime between August and November', and just give me good options.

<comment><USER14> Hm, to do this though, you'd need to have a lot more qualifying questions. I have been a travel agent for 10 years, and it is difficult to find the "right" holiday for someone without a lot of information (ie budget, what they like to do, where they have been/stayed before and what they liked/didn't like, etc). That said, and even as a competitor, it is a really cool idea!

<comment><USER13> Mmm, that's true. Even if it was just a list of countries, though, I don't think the flight info has to be more detailed than that; you're generally going to be flying into a city anyways, so it's not like knowing that someone likes hiking will help too much. I'd be happy to have someone find me a cheap flight to somewhere-in-south-america-really-I-don't-care-where-or-when.

</comment></comment></comment><comment><USER15> This needs a little more automation (maybe a tie-in with Expedia/Kayak/whatever) so that the flight can be booked and verified booked.

Here's my problem (going with one of the examples quoted, flying from Buenes Aires to Toronto): one of the suggestions is to fly to Montreal and take a bus. But what if I _don't_ want the hassle of going from airport to greyhound to bus, only to be dropped into the middle of T'o in the middle of the night? As it stands currently, I can get a refund only if I can find a cheaper flight; but in many cases it's hard to beat the price of a shitty flight + slumming it for 12 hours on the road. So you're SOL.

A better solution, IMHO, is to offer the option of booking right there. Then you can also verify if the expert's suggested itinerary is valid or not. Then you also know that the customer booked and the 'expert' can get paid. What about abuse, you say? Three strikes and you're out: if a person puts up a bounty and doesn't book the flight 3 times, just kick 'em out.

<comment><USER16> _Here's my problem (going with one of the examples quoted, flying from Buenes Aires to Toronto): one of the suggestions is to fly to Montreal and take a bus. But what if I _don't_ want the hassle of going from airport to greyhound to bus, only to be dropped into the middle of T'o in the middle of the night? As it stands currently, I can get a refund only if I can find a cheaper flight; but in many cases it's hard to beat the price of a shitty flight + slumming it for 12 hours on the road. So you're SOL._

That seems to be accounted for with the three 'flexibility' questions contest creators are asked; whether they will fly with any airline including discount airlines, whether they'll consider ground transport to nearby airports, and whether they'll consider multiple stops and long layover times, respectively.

<comment><USER15> Unless Montreal has become a Toronto suburb recently, I don't think any of the options account for the Montreal --> Toronto bus ride.

</comment></comment></comment><comment><USER17> I think this seems like a fantastic idea. I really hope it continues to expand.

I am taking the family on a US domestic trip in a few months and have already started the process of flight-searching. I'd be willing to try out something like this, even just for the novelty. However, with so many international flights, the list inadvertently seemed to alienate simple domestic flights.

I wanted to see more examples of my type of trip (business class, simple domestic flight), but wasn't really sure how to do that. I searched through the first 3-4 pages before deciding I would have liked some filter controls on the list. I wanted to see what kind of savings people were finding and what types of trips were being posted. Basically, a way to determine if my trip met the right criteria for a contest and if it was feasible to use the service.

That said, I understand my trip may not be the immediate target market. Nevertheless, I'm going to keep watching this because I really like the concept.

<comment><AUTHOR> Many thanks bullseye.

If you think you could get value from experts do the searching and giving suggestions, then give it a try and we'll refund you if you aren't satisfied. But if you're just flying between two large cities, you really are better off going to AA, Southwest or whomever.

Flying domestic in your home country really is not the best use of Flightfox. You know all the airlines, you've heard the anecdotes regarding cheap prices, and prices are already low for domestic.

On the other hand, if you fly RTW, to a different continent, using FF points, to many cities, etc, the expert skill and local knowledge of our experts can save you a small fortune.

Hope that helps.

</comment></comment><comment><USER18> As a potential expert/buyer, I'd love to see what the results look like (and the comments on the entries as well), but it looks like those can only be viewed by the contest owner. Any way to post some examples?

(and who is this MrHyde fellow who wins everything?)

<comment><AUTHOR> Hey joshwa,

The experts tend to keep their methods to themselves. Some have trade secrets, but in the simplest cases, it takes time to find the best airports and connections, so they'd rather not share the info. They've even suggested we hide the dates because it takes time to find the cheapest dates when someone has flexibility.

MrHyde is relatively new. The winners go in waves. As you can imagine, our experts keep flying around the world and neglecting Flightfox :)

I just added detailed examples to another comment on this page. Please see below (or above).

Most of the best examples involve better routing, special offers or FF points. We've saved people $10k+ on group bookings, $5k+ on premium class, $1k+ on multi-city, etc, etc, etc. And in one case, a customer beat our experts by $700 by finding a glitch on Expedia. Of course we refunded him and offered a free contest if he dared to return.

On average, we save people 20%+ on long-haul multi-city flights. This isn't a guarantee, but the results from a test we ran on real flight contests.

We have a lot of work to do to find the best balance between the amount of info we show. We're looking for another engineer right now in the hope of being able to iterate much more quickly.

</comment></comment><comment><USER19> Since you are asking for fees when a user creates a contest, you should provide case-studies of savings on similar flight searches in the past (also include cost-benefits over other flight search engines). May be, even allow the user to extend the contest duration (with some constraints). Doing this should give a better assurance to the user.

I believe your service has the potential to do well in this market, particularly considering there are many variables involved in flight searches.

</comment><comment><USER20> Lovely concept, I will try it sometimes.

But why is the domain for sale on Sedo? I searched on whois.sc and saw the sale notice! Is that by mistake?

<comment><USER20> @Todd I think you should check your domain auctions: <http://sedo.com/search/details.php4?domain=flightfox.com>

</comment></comment><comment><USER21> Excellent site, even better customer service (refunded money instantly for some fraud answers) and some fantastic results. Keep the good work going

</comment><comment><USER22> Make this for group travel arrangements and you will be golden. Personal travel is good enough right now, but the hassles of group traveling still exists. I would definitely pay you a finders fee to book a cheaper Vegas trip for my 10 friends.

Awesome work and best of luck!

</comment><comment><USER23> I loved their friendly customer service when I approached them for help to change my flight dates after booking it.

</comment><comment><USER24> cool execution on the business model. Wondering.. wouldn't bots come to dominate these eventually? would that be allowed?

</comment><comment><USER25> I love this idea guys - v. cool

</comment><comment><USER26> Very very cool!

</comment><comment><USER27> Crowd-Sourced TSA patdown.</comment>


Bitcoin Escrow Service - <AUTHOR> https://btcrow.com/startescrow.php

<comment><AUTHOR> Anyone know any open-source/free alternative?

<comment><USER2> Escrow is a service, not just software. I'm not sure I would trust a service that was offered for free.</comment></comment>


TV Companies Will Sue VPN Providers "In Days" - <AUTHOR> http://torrentfreak.com/tv-companies-will-sue-vpn-providers-in-days-150417/ <comment><USER2> It seems like currently everything is sacrificed to content owners to protect their system of earning money. There has to be another way otherwise we are loosing more and more freedom on the internet.</comment>


Sqlmap: Automatic SQL injection and database takeover tool - <AUTHOR> http://sqlmap.org/ <comment><USER2> If you're a small startup looking to automate security testing against your application, I strongly recommend just shelling out for Burp Suite; it's like a couple hundred bucks tops, can be used to automate almost every common web app attack, and is the tool most likely to be used by good auditors when you eventually decide to get tested professionally.

<http://portswigger.net/burp/>

There's a free version, which disables the (mostly vestigial, anyways) "scanner", and slows down the fuzzer tool; if you're really automating security testing --- which, do --- pay for the real version; you want the fuzzer to work.

There are things sqlmap does that Burp does not do easily, but they're not important to app developers; if you're generating database exceptions with inputs, don't dick around trying to make time-based blind SQL work; just fix the bugs.

<comment><USER3> Here's a blog posting from Bruce Schneier on getting started in computer security:

[http://www.schneier.com/blog/archives/2012/07/how_to_become_...](http://www.schneier.com/blog/archives/2012/07/how_to_become_a_1.html)

There are links within his blog posting to other tools.

<comment><USER2> I wrote a similar piece for Krebs the week prior; I think it's linked from this one.

I'm not a fan of Schneier's take on this. Don't start a career in security by thinking about certification.

<comment><USER3> Can you provide the link to Krebs?

<comment><USER4> Here: [http://krebsonsecurity.com/2012/06/how-to-break-into- securit...](http://krebsonsecurity.com/2012/06/how-to-break-into-security- ptacek-edition/)

</comment></comment></comment></comment></comment><comment><USER5> Forgive my ignorance, but if you're using prepared statements for all your SQL queries using user input, aren't you by definition safe from any kind of injection?

<comment><USER2> Of course not. This is a pernicious myth about SQL security. Many inputs to query construction can't be parameterized.

<comment><USER5> > Many inputs to query construction can't be parameterized.

I do not allow the client direct access to the database. They access the database through objects, which have methods that only permit parameterized input.

The client cannot specify the database, table, or columns. That is hard-coded. They can only specify values. Values that are always entered through a prepared statement.

In that scenario, isn't injection impossible?

<comment><USER2> No. Of course not. In all likelihood your SQL RDBMS will only allow you to bind data. Do you paginate? What about "LIMIT" and "OFFSET"? Do you sort tables? Then you have to handle column names. Do you sort in both directions? Then you have to handle "ASC" and "DESC". And so on.

Obviously, you can write simple code to do each of these safely. But then, you can write simple code to handle query parameters too.

By all means, use parameterized queries. Just don't assume they're a magic totem against SQLI.

<comment><USER6> You can and should bind LIMIT and OFFSET with parameters on many if not most drivers (some can't handle it but most that I work with these days do, though I'm in Python, perhaps JDBC or other drivers are a different story). ASC and DESC are SQL keywords so assuming you're not a terrible programmer (which I know is what you're addressing) you wouldn't have those rendered from user input any more than the WHERE or ORDER BY keywords.

The lexical structure of the statement and the parameters themselves are two different things. You are correct that "parameterization can't save you from SQL injection", if you're such a bad programmer that you're feeding user input directly to produce lexical tokens. One example is a recent blog post talking about how to escape table names for apps that feed things like "customer_name" to serve as the table name (totally insane). Your example of feeding in "sort=xyz" to produce the column name in the ORDER BY is also a pretty awful practice - I haven't seen that one in like a decade, but sure.

So of course parameterization doesn't magically protect a system against all forms of attack - the programmer could be feeding user input directly into shell commands too. The recommendation for parameterization is addressing the bulk of the issue at least among the code that I regularly work with, maybe you deal with crappier programmers than I do on a regular basis.

<comment><USER7> > Your example of feeding in "sort=xyz" to produce the column name in the > ORDER BY is also a pretty awful practice - I haven't seen that one in like a > decade, but sure.

This still happens every day. Google how to do dynamic sorting and you'll find a hundred examples of it in PHP, and as unfortunate as it is, that's how a significant portion of code is authored.

</comment></comment></comment></comment></comment></comment><comment><USER8> How can I donate to you guys?

</comment><comment><USER9> This is an excellent tool. But generally on a penetration test, BurpSuite is what you want to use.

If, however, simply demonstrating that SQLi is there is not sufficient, or if the blind SQLi is too ephemeral sounding to the client, Sqlmap can help you dump the entire database. This will convince even the most skeptical.

<comment><USER10> I prefer using w3af over BurpSuite. Full source is a good thing.

</comment></comment><comment><USER11> Havij is a similar tool thats gaining in popularity due to its point and click interface. check out: [http://blog.imperva.com/2012/04/dissecting-the-sql- injection...](http://blog.imperva.com/2012/04/dissecting-the-sql-injection- tools-used-by-hackers.html)

</comment><comment><USER12> Here's a video demonstration playlist: [http://www.youtube.com/watch?v=fGBQm9Nfn24&list=UU8lIbC-...](http://www.youtube.com/watch?v=fGBQm9Nfn24&list=UU8lIbC- tp4cPosY0kB8Xkxg&index=9&feature=plcp)

</comment><comment><USER13> Here's a better web page that contains the same information: <https://github.com/sqlmapproject/sqlmap>

</comment><comment><USER14> Thanks god this kind of tools now has so much better layouts than few years ago.

</comment><comment><USER15> Nice little tool thanks

</comment><comment><USER16> Very cool, Thanks

</comment><comment><USER17> Has anyone done a comparative review of sqlmap vs skipfish?

<comment><USER2> They're not really comparable. Skipfish is a fast crawler with some checks for DOM corruption, SQL metacharacters, and hygiene. sqlmap is a tool for exploiting SQL injection.

I like the code for Skipfish a lot, but neither tool is particularly important in the profession; if you're working with a contract application security firm and they give you findings that came from sqlmap or Skipfish, you should be irritated.

<comment><USER18> I'm not sure I read your final remark correctly. Do you mean to say that using Skipfish or sqlmap has no place in a professional pen test or that a professional pen tester should not subject his clients to the raw results from said tools?

The latter I agree with, the former I don't. Any automated security scanner has its shortcomings - combining the results of various scanner products generally has a positive effect upon the quality of the test. I've often been in a situation where one tool (commercial or otherwise) indicated or hinted at a vulnerability while all other tools (commercial or otherwise) used did not indicate anything.

<comment><USER2> The former. With some _very_ minor exceptions, we don't use automated scanners at all in our practice. We use Burp to set up testing experiments, and we use ruby for automation. We've found that "scanners" make good testers much less sharp; if the tool spits out the names of specific vulnerabilities, it's suspect.

But even practices that do use automated scanners won't be relying on Skipfish or sqlmap.

This obviously doesn't hold for network pentesters. For tests in which application flaws aren't the whole story, and you're just looking for the fastest way in you can find, sure; sqlmap is valuable there, much more so than Skipfish. We don't do those kinds of tests often.

<comment><USER4> When you say "we use ruby for automation" do you mean using something like buby with Burp, or something custom?

I find myself writing a lot of custom fuzzers in python, and am looking to improve my toolkit.

<comment><USER2> A long time ago, Eric Monti, then a member of our team and now at a big startup in SF, wrote a Burp/Ruby bridge called Buby. For a long time, and maybe still, another team member --- Timur Duehr, who also wrote the first version of our Ragweed native code debugger DSL --- maintained it. A lot of people on our team use Buby to automate.

Another faction of our team uses Mike Tracy's WWMD toolkit, which does some of what Burp does but from an irb prompt.

I'm allergic to both approaches and tend to just start from EventMachine and ev-http-request.

Good example of the kind of scenario that'll get me into "writing code to test web apps" mode: testing those goofy cryptographic tokens applications send via email to reset passwords.

<comment><USER19> "Goofy" cryptographic tokens? Is there a better way?

<comment><USER2> Not having the tokens be replayable, rewritable to different user IDs, or decryptable would be a good start, right?

Yes: the better approach is to have the token be a 256 bit cryptographically strong random number that corresponds to a row in the database with metadata sufficient to expire the token and invalidate it on password reset.

<comment><USER19> Ah. So it's not the use of cryptographic tokens _per se_ that you're objecting to -- just that they're not generated and/or handled correctly.

<comment><USER2> I object in general to the widespread practice of using tokens that contain semantically interesting information protected by encryption.

<comment><USER19> Got it. Didn't realize that was so widespread.

<comment><USER4> You'd be surprised to know how often it's just the username encoded in base64...</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Python socket.recvfrom_into() remote buffer overflow - <AUTHOR> http://pastebin.com/raw.php?i=GHXSmNEg

<comment><USER2> Here is the patch, if you want to see what was actually missing to cause this bug:

[http://bugs.python.org/review/20246/diff/10559/Modules/socke...](http://bugs.python.org/review/20246/diff/10559/Modules/socketmodule.c)

It appears to me that a well-written server would not be exploitable: the bug fixed here is a failure to check that the "nbytes" argument is not larger than the "buffer" argument. But nobody should have been calling this function with such erroneous arguments (ideally). Still a bad bug, but not as severe as it might sound at first.

<comment><USER3> well it's not that simple, because the 'nbytes' parameter to recvfrom_into is optional and you could infer as a programmer that it will read up to the size of your buffer, since your buffer has a size attribute attached to it.

I originally thought that this wouldn't be a big deal because using recvfrom_into is annoying, you have to make a mutable buffer object and the most immediate way I found to do that involved ctypes, which is scary. However, on perusal a bunch of code hosted on github uses recvfrom_into in vulnerable ways, so that's pretty exciting.

edit: I was mistaken, see below

<comment><USER2> You're right: nbytes is optional. That means it is even less likely that a call to recvfrom_into will be exploitable. That's because the default maximum receive size is taken as the size of the buffer if nbytes is zero/unset. See the comment in the existing code right above the patch:

        /* If nbytes was not specified, use the buffer's length */

So it still seems to me that in order to be exploitable an application would need to specify a "wrong" value for nbytes, which after the patch would raise an exception. It's not a case where such code should work and instead overflows.

<comment><USER3> aha! apologies, I misunderstood what was going on

</comment></comment></comment></comment><comment><USER4> Oh look, there's a place for this other than pastebin:

[http://bugs.python.org/issue20246](http://bugs.python.org/issue20246)

Now why aren't you posting every security bug in every language to reach HN front page?

<comment><USER5> >Now why aren't you posting every security bug in every language to reach HN front page?

Don't worry, your fellow Pythonistas ensure that every Ruby security bug reaches the front page.

(I don't actually have any skin in this argument since I don't use either language but if you are going to ask such blatantly leading questions then you don't really deserve a better response.)

</comment></comment><comment><USER6> The original bug report said "very highly unlikely it's technically remotely exploitable", but it seems that may not be the case.

"Working with the exploit, its trivial to get a working remote exploit to work, below is a simple rewritten RCE from the exploit PoC": [https://www.trustedsec.com/february-2014/python-remote- code-...](https://www.trustedsec.com/february-2014/python-remote-code- execution-socket-recvfrom_into/)

<comment><USER7> It's only remotely exploitable in Python applications that use socket.recvfrom_into in a particular, unsafe way. I'm not sure how many are out there in practice.

</comment></comment><comment> cool-RR I'd really like to know whether it means my Django apps are now vulnerable.

<comment><USER8> I don't think so. I don't see any direct calls to recvfrom_into in Django, and it seems little used. It is more likely to be called with a UDP listener - with TCP sockets there isn't usually a need to use recvfrom (which returns the address of the sender, too).

</comment></comment><comment><USER8> nicely, it seems that the python3 version of socketmodule doesn't use these on-stack Py_buffer objects, so wasn't affected.

<comment><USER9> The bug says Python 3 is affected

[http://bugs.python.org/issue20246](http://bugs.python.org/issue20246)

<comment><USER8> haha, yup. I just straight up read the code wrong :)

</comment></comment></comment><comment><USER10> Wow, good catch !</comment>


Cuban system leads the way: Teachers should create strong neural connections - <AUTHOR> http://www.thestar.com/atkinsonseries/atkinson2009/article/721840--cuban-system-leads-the-way

<comment><USER2> All brains are created equal. Reminds me of something.

Very upbeat article; always good to hear about any teachers listening to neuroscientists; even better to see recognition that children are born learning machines (they all have to bootstrap into the intricacies of language without help).

I hadn't seen the phrase "Possible Schools" before, must be the title by Ann Lewin-Benham,

[http://www.amazon.com/Possible-Schools-Approach-Education- Ch...](http://www.amazon.com/Possible-Schools-Approach-Education- Childhood/dp/0807746517)

</comment><comment><USER3> I like the article's emphasis on developing neural connections but I'm a little mystified about this "Cuban system" that is supposedly leading the way. All we learn from the article is that Cuban schools have sports directors, music directors and someday a chess director. That's it? Sports, music and maybe chess? How is this different from other schools around the world?

</comment><comment><USER4> Its neuroscience children.

I'm waiting for the Onion article.</comment>


Partial Deployment with Feature Switches - <AUTHOR> http://blog.disqus.com/post/789540337/feature-switches

<comment><USER2> It seems like every company has their own implementation of these - are there any open source versions? I'm strongly contemplating throwing together a gem for rails this weekend.

EDIT:

I found <http://github.com/bvandenbos/redis_feature_control> which handles features globally (either on or off for everyone). Unfortunately doesn't handle things on a per user/session/etc basis though - although it shouldn't be too hard to add that feature using Redis sets.

<comment><USER3> There's something for PHP and CodeIgniter called Turnstiles: <http://github.com/dhorrigan/Turnstiles>

</comment></comment><comment><USER4> This seems a lot like what Flickr has been talking about for years:

<http://code.flickr.com/blog/2009/12/02/flipping-out/>

<comment><USER5> It's a pretty common pattern, but still seems to be widely unknown.

<comment><USER6> Perhaps it's not known due to several reasons:

1\. Most people aren't used to web-app development

2\. if-else is considered not OO by some purist (or even by some semi-purist). if-else might also be considered hard to test (adding more branches).

3\. People are probably ignoring deployment issues (not high priority) or perhaps they just throw it to the Ops team to deal.

<comment><USER5> Our intended goal with this is to not rely on an ops team. Use test driven deployment and automated systems to keep things in check. Discipline is what lets a system like this actually work.

<comment><USER6> DING DING DING DING DING!

The keyword is "Discipline". This is the very fundamental principal for anyone in the IT industry.

</comment></comment></comment></comment></comment><comment><USER7> This sounds like the same idea as:

<http://news.ycombinator.com/item?id=1463751></comment>


Ask HN: What's the best way to go about finding a great web development agency? - <AUTHOR>

I'm looking for a web development agency to help finish building a node.js/angular web app. I'm having a tough time sorting through the noise and finding a promising company. Any ideas or review sites that help with this? <comment><USER2> Anytime you are dealing with newer architectures, constructs or languages it gets a little tougher to weed through the noise as many agencies will make it appear they have the experience but you wind up paying for their learning process. We have seen this with node, GO and other relatively younger tech. But sometimes with node.js I think it is tougher because so many people think to themselves, oh I know javascript so I can write node.js. While technically true to a point, what I have seen is they fail to take the time to learn the ins and outs of node to understand their choices well enough to call their code good. Which usually leads to a nightmare of a project to fix later, ask me how I know.

Also, aside from raw skills you need to find an agency that you mesh with and feel comfortable with. Get a real contract with them holding both parties accountable, don't work off a verbal agreement etc. I am not sure about any sites in specific to help you with reviews.

I run a product consultancy where we help people build and get their product to market, digital marketing etc. Our core competency is node.js and we have spent the past couple of years building our own products and products for many clients almost exclusively in node. We have been in business for 8 years now and if you have any interest or just want to ask me questions you can find my email in my profile. Shoot me an email and if nothing else I'll answer questions for you. We also do code reviews and can provide you with an outside opinion about where you really sit, if you are unsure. We are proficient in a number of technologies, but like I said node is our core.

I wish you the best finding a good fit for your project/product, and if I can answer anything or help let me know.

</comment><comment><USER3> Are you open to a freelancer? I'd be happy to chat with you about what you've been working on and what sort of help you need. My contact info is in my profile.</comment>


Ask HN: Is this all there is to life? - <AUTHOR> http://media.tumblr.com/b9vfl4b63iabvohao1FMpffKo1_500.jpg

<comment><USER2> Cheer up, for a million years, it was a lot worse than this.

</comment><comment><USER3> Yes, but it's not so bad.</comment>


Ask PG: Isn't it too late, historically speaking, to apply? - <AUTHOR>

Last year Y Combinator was reported to have a 2% acceptance rate with an incoming class of 80.
Imagine that you have 50 concise filled in forms with 1 minute videos attached, behind each of which are two-three personalities, and you have to choose 1 group who has this unique amalgam of traits which will allow them to devise, build, grow, and run a successful tech company. To what extent your decision will be a product of a well-grounded analysis or at least reasonable hunch and what will be the share of mere chance in it? Is there a limit of this share after which we can be saying that the process is largely arbitrary? Or the original rule that all YC founders read all applications and then find common denominator is no longer in power?
But then OK, you're an applicant and you've been admitted. A class of 80 teams is a hell lot of people. And if you're smart, you applied not only for the money, ties or VCs' attention. When it started YC' tiny team were litereally mentors for the startups hand-crafting and guiding them gradually translating to the would-be startupers their experience, skills and wisdom which you cannot read in a book. Now a crowd of sturtups is baked simultaneously with dozens of YC alumni involved. But honestly speaking, you'd wish to learn in a mild pace from Paul Graham, not from his apprentices. Judging by the figures YC has never been more successful and one can say hence there never been a better moment to join. And maybe you'll indeed make a lot of smart friends, participate in a line of dinners with speakers, get serious VCs' attention and even money. But can you be sure that you'll get everything that Drew Houston got which made Dropbox possible in the old days? And is there a limit of class size and all the surrounding ado after which all this might become pointless? <comment><USER2> Whilst PG, Jessica, RTM, Trevor, Harj, Kirsty, Paul, Geoff etc and the other members of the team at Y Combinator are there to help founders, the most important thing that YC have created is their alumni network (YC have invested in 400 companies and ~1500 founders).

The network of YC also appear to be willing to pay it forward (in other words they are often each others first customers/users and they mentor, support and fund each other to success).

So to answer your question, can another Dropbox or AirBnB come out of YC with everything that the original Dropbox got? I believe the answer is Yes.

<comment><AUTHOR> question is, can drew houston substitute paul graham? i'm sure he'll be glad to do his best, but i'm not sure he's essentially capable to

<comment><USER2> Let's not forget that PG's full-time job is YC whereas Drew's full-time job is as Dropbox CEO. I think the difference is already apparent in that sentence – Drew isn't a substitute for PG and PG isn't a substitute for Drew.

YC has never been just PG, there has always been a group of partners (which has increased over a period of time and includes some part-time founders) and you can always arrange time with the partners during office hours.

Sure PG and the other partners can provide you with some excellent advice but, no one is an expert in every single vertical. YC fully understand that which is why they bring experts in during YC for dinners as well as hosting conferences for the founders throughout the year.

I believe the alumni network has made YC stronger because, they've funded so many companies that there's likely to be other members in the alumni network within the same industry and/or using a similar technology to you – and if you ever need their help then they are there to help you.

</comment></comment></comment><comment><USER3> Just a snark I guess, sorry...

But you write your paragraphs in sort of an inverted style. You should lead with a topic sentence that states your point and then follow up with specifics or scenarios, etc. It's much easier to read.

</comment><comment><USER4> You never win if you never begin, right? And what do you lose by applying?

<comment><AUTHOR> just contemplating

</comment></comment><comment><USER5> You can never step in the same river twice. That doesn't by itself suggest the river has dried up or turned to poison.</comment>


PRIMER-V2 robot rides a bike just like a man - <AUTHOR> https://www.youtube.com/watch?v=v5wIdlIym_I <comment><USER2> It is using a gyroscope - so it's a bit of cheating. It could even have jumped a pogo stick just as well, without any fancy balancing that we humans have to perform.</comment>


Ask HN: Are you 'crisp' enough to describe your startup idea in 2-4 words? - <AUTHOR> "You need to be able to say what your startup does in 2-4 words. No one has the time or attention span for an elevator pitch anymore." – says David Sacks from Craft Ventures (https://twitter.com/DavidSacks/status/1197276076759584768)
Would you be able to tell what your startup does using this rather restricted format?
Let me try this with Karma (https://karmabot.chat)
Karma is...
A) building happy teams B) micro-feedback chatbot C) peer appreciation chatbot D) true bonding at work
Which one would you pick/suggest?
Please do share your products and one-liners in the comments! <comment><AUTHOR> 50 startups in 2-4 words [https://www.indiehackers.com/post/say-what-your- startup-does...](https://www.indiehackers.com/post/say-what-your-startup-does- in-2-4-words-903bce6dd1)

</comment><comment><USER2> github search that doesn't suck [https://gitgrep.com/](https://gitgrep.com/)

<comment><AUTHOR> Can it be shorter, like, 'Better Github search'? Thanks.

</comment></comment><comment><USER3> [https://losthobbies.com](https://losthobbies.com)

Reconnect with your hobbies

<comment><AUTHOR> I LOVE the concept. Thanks.

</comment></comment><comment><USER2> log view @10,000 ft [https://quicklog.io/](https://quicklog.io/)

</comment><comment><USER4> I think A and D are too abstract.

<comment><AUTHOR> C then? Thanks!

<comment><USER5> Even c may be too abstract, b was the clearest to me. I can see why if you're completely familiar with your product you may prefer the others, because you feel it does so much more but for people who've never heard of a product it's perhaps easiest to understand.

I have the same issue at Tesults.com. If someone's never heard of it, I'd describe it as 'test results reporting' but yeah it's a lot more than that, it's a complete pipeline for handling post testing.

<comment><AUTHOR> "complete pipeline for handling post testing" -> "complete pipeline for testing" does the trick for me.

"True bonding for remote teams"? Too vague?

</comment></comment></comment></comment><comment><USER6> low-code for developers

<comment><AUTHOR> What's 'low-code'?</comment></comment>


Did IHOP run a Twitter ad targeted at all users named Michael? - <AUTHOR> https://twitter.com/Hoffm/status/707062111139143680 <comment><USER2> Well, you know, those Michaels are crazy for waffles.</comment>


China's Great Firewall Tests Mysterious Scans On Encrypted Connections - <AUTHOR> http://www.forbes.com/sites/andygreenberg/2011/11/17/chinas-great-firewall-tests-mysterious-scans-on-encrypted-connections/

<comment><USER2> Link to the posting of the original discovery with technical details included: <http://www.nsc.liu.se/~nixon/sshprobes.html>

<comment><USER3> How could such a technique actually give the firewall information pertinent to whether or not the offending site was illegal? It's like a MITM attack where they intercept the outgoing ssh connection, send seemingly arbitrary data to the ssh server on the non-Chinese internet, and then sometimes disrupt the ssh connection or allow it pass through.

What information could the response to garbage possibly convey beyond: "how does this server respond to garbage"?

How would that even help with fingerprinting, which is his suggestion? Would there even be much variation in how different sshds would respond to that? So what could you do with that information? 30% of known Tor servers use sshd version X, so let's ratchet up the frequency of RST packets for connections to servers of version X? Seems like a long shot: that would be both a sophisticated attack and have pretty hamfisted results. And how could this information be used to find open relays? Just guilt by sshd version again, since statistically machines with open relays have a tendency to run version X of sshd?

I'd like to hear a security person come and talk instead of my wild speculations.

<comment><USER4> TCP uses a 32bit sequence number that should be initially seeded to a _securely generated_ random number. As each packet is sent back and forth between endpoints, this number increments by 1. If an adversary wanted to disrupt the connection (denial of service) they could obtain the sequence number and other numbers such as the source and destination ports and spoof some packets pretending to be the real client. It would then become a race between the real and fake clients as to which packet is accepted first. There is usually over 2^40 bits of entropy that an adversary would need to know to hijack a TCP session.

If the adversary is in the middle (MITM) they can read all your traffic and obtain the required entropy in real time. In this scenario, it doesn't matter how much entropy is contained in each packet because the adversary knows that information in real time. Thus the adversary will be able to inject packets to reset/terminate the TCP session, causing a Denial of Service situation.

Cryptographic protocols including SSH and TLS are designed to solve the majority of problems that MITM adversaries can cause. The notable exception is that these protocols rely on unprotected TCP sessions. MITM adversaries are still able to reset/terminate TCP sessions (when SSH/TLS protocols are detected).

IPSec protects not only the information transmitted, but the IP packet headers as well. An Authentication Header (AH)[1] is appended and verified to ensure that packets haven't been tampered with or forged. MITM session reset/termination attacks are therefore no longer possible because forged packets will be ignored.

[1] <https://en.wikipedia.org/wiki/IPsec#Authentication_Header>

<comment><USER5> While IPSec would solve the technical problem using it would make blocking even easier unfortunately.

</comment></comment></comment></comment><comment><USER6> china's ssh protection is getting really serious

vpns have been horribly bad the last few weeks

tunneling through ssh has also stopped working consistently.

I don't know anybody over here who has a good vpn anymore. It's got to be hurting business that collaborate internationally - the net goes down for a few minutes at a time, throughout the day.

<comment><USER7> Using a commercial (but certainly not approved) VPN on a home DSL: It works for a few minutes and then starts to degrade. I wonder if it's related to this new tactic. It's a little hard to distinguish from old behavior, unfortunately.

<comment><USER8> Yes. I believe they start to degrade VPN/SSH, amazonaws.com, google couple of months ago. Things may vary depends on which city you are and which ISP you are using, eg: pptpd barely can connect on my DSL.

</comment></comment></comment><comment><USER9> I've been in China recently and noticed I was having trouble establishing VPN connections after just a few hours. I would have to find new VPN servers to connect to every 3 or 4 days.

I have not noticed any drop off in connectivity when using my company's VPN, but I'm sure this is because this is an authorized VPN.

The most notable blow here is that people using solutions like FreeGate are getting heavily affected by this. Most Shanghainese people use this to connect to the outside world.

</comment><comment><USER10> This is pretty depressing. It seems like the Chinese government, in creating new more powerful Internet censorship methods, is outpacing services to circumvent it.

People like those of us reading this site probably won't have much trouble finding ways around it, but it seems people (esp. Chinese) who would normally hop the Great Firewall with ease using VPNs/proxy will have to put in more effort/get more technical to do that successfully, and i'm afraid that they won't want to bother.

<comment><USER11> The thing I fear most is that if anti-ssh/ssl/tor/vpn measures start to be somewhat effective, western governments will also see it as an excuse to implement them in the guise of "crime prevention", just now that services such as gmail are finally adopting it as default.

Which means we'd be forced back to a 90's level of internet security at least for consumers, I'm sure corporations will be able to 'buy' the right to use encryption...

</comment></comment><comment><USER12> Appears to be down. Google Cache: [http://webcache.googleusercontent.com/search?q=cache%3Awww.f...](http://webcache.googleusercontent.com/search?q=cache%3Awww.forbes.com%2Fsites%2Fandygreenberg%2F2011%2F11%2F17%2Fchinas- great-firewall-tests-mysterious-scans-on-encrypted- connections%2F&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en- US:official&client=firefox-a&pws=0)

</comment><comment><USER13> From <http://www.nsc.liu.se/~nixon/sshprobes.html> "So, to more precisely describe what we have found: a small subset of the ssh logins from Chinese IPs to two of our systems are preceded by one or two connections from unrelated Chinese IP addresses, in which opaque binary data is thrown at sshd." "My hypothesis is that just over a year ago, a new function in the firewall went into limited beta test, where a sample of outgoing ssh connections from China is carefully selected for secondary screening.""For the selected ssh connections, the target system is probed from one or two IP addresses under the control of the Chinese government. These may be otherwise innocent addresses that are spoofed at the level of the great firewall, or they may be actual computers under remote control by the government - I have no way to tell.""In some cases, the legitimate ssh connections are unsuccessful; they appear to be interrupted. This may be a result of the firewall deciding the target system to be unsuitable and injecting RST packets into the TCP stream to kill it.

The last few weeks, the frequency of the probing has increased. This might mean the beta test period is nearing its end, and that this function is about to become more widely deployed."

</comment><comment><USER14> This is why I am moving my company back to the States and why the Chinese startup scene is so depressingly obscure. The Chinese government can go to hell. I'll take my business and dollars somewhere else.

<comment><USER15> Out of the frying pan...

<comment><USER14> At least it won't take me an hour to push to heroku and my aws access won't be throttled.

<comment><USER15> Today. The US is getting closer to the China model by the day.

EDIT: Downvoters, do you disagree? With the continuous attempts at controlling the internet and destroying people that get dirt on US corruption? SOPA is just the latest attempt. It wasn't the first, and if we beat it it won't be the last.

</comment></comment></comment></comment><comment><USER16> Oh well, that may be the reason I've problems connecting to my VPN and SSHing to my server. Not every time, though.

Posting via https works, however.

<comment><USER17> There may be a reason Chinese gov't does not view SSL as a threat. Collusion with CAs?

</comment></comment><comment><USER18> This is so pathetic, why do the Chinese government think they can tell users what they should and shouldn't be looking at. I agree that this type of measure should come into play if there was a guaranteed way of stopping people looking at child pornography or something like that but it almost always appear to be political.

I have not been on the Tor network before and I do not plan to but it should be the persons choice of whether they access it or not.

China are like the dick head IT manager who turns off javascript at network group policy level, just because he can.

<comment><USER19> You're expecting a relatively new Communist government, formed only about half a century ago and currently governs 1.3 billion people, to change its core philosophies overnight. It's not so easy. I don't support this stuff, but I recognize that it's not easy. I bet you it's harder than changing a country's dependence on oil as an energy source (assuming that viable alternatives are available). You have to change the world's largest population's philosophies, governing structure and infrastructure, expectations, etc.

<comment><USER20> India and Japan generally don't censor foreign websites, and their governments survive OK.

It's a big loss of face for the present leaders to change their policy. But we keep on hearing the phrase from within China: "Perhaps the new generation of leaders taking over in October 2012 will have different ideas about web censorship". If the policy is going to change, it'll be soon after this time when no government leaders "lose face".

The US and EU are also preparing to challenge China at the WTO claiming the Great Firewall violates free trade. If the US and EU can get their timing and level of prodding right, the Firewall might be dismantled. China's already given their web businesses such as Baidu enough startup advantage from the Firewall, and will probably find other ways to give advantage to subsequent startups.

But... the infrastructure's already there in China to block foreign websites. Anything that exists but isn't used will be used again sooner or later by some politician, so thanks to Cisco et al the Firewall will always exist even if "dismantled" under WTO enforcement. Just like the US military is there to defend the integrity and borders of the Union, to be used as a last resort, but gets used to invade Iraq for cheap oil.

<comment><USER19> I think you misunderstood what I'm trying to say. I don't think it's about losing face. Nor about whether the government survives. It's about cultural momentum. Look at how hard it is to change policies in any government. Look at how long it took the US to get socialized health care, despite people clamoring for it for decades, and even then, that could be repealed by future administrations, as some GOP folks are demanding.

For the same reasons a startup is nimbler than a big corporation for changing things, larger countries are slower than smaller countries for making significant change. India is lucky because it's had a tradition of democracy and freedom for quite some time. They already had cultural momentum in that direction, so they don't need to change anything to align with what you want. Similar for Japan. China, you're asking them to reverse the pull of gravity.

I've worked in teams that were focused on creating big vision cultural and organizational change in big corporations. I can't even begin to imagine how difficult it would be in a big government, especially one of China's size, and one where there is no easy allowance for diversity of opinions.

For example, China's central government is huge on trying to stamp out corruption. However, despite the number of executions they continually carry out for corruption matters and the dissatisfaction of the populace, it is logistically impossible to keep a handle on all of the regional and local governments. It's a huge complicated machine, and I'd warrant that it's even more complicated than the US government's operations, judging from what I've seen living in China.</comment></comment></comment></comment>


Java language oddities - <AUTHOR> https://www.javaworld.com/article/3252845/java-language/java-language-oddities.html <comment><USER2> Some time ago my Java app stopped showing notifications. I looked at the code and discovered that I accidentally posted URL before the line that shows notifications:

[http://example.com/](http://example.com/) showNotification();

It compiled without problem because http: is label and // commented out the rest of the line:)

<comment><USER3> If had a similar issue (in C) that took me at least an hour to find:

       switch (whatever)
       {
       E_START:
           // code
           break;
       E_PAUSE:
           // code
           break;
       E_END:
          // code
          break;
       }

i.e. accidentally using labels instead of "case E_START:". GCC at least had the decency of generating a warning about unused labels, while I suppose `javac` does no such thing.

<comment><USER4> Just tested in my Eclipse project

This mistake (unsurprisingly) isn't possible in Java:

"Syntax error on token "{", case expected after this token"

With an unused label I get the warning "The label E_START is never explicitly referenced"

A good software process prevents these types of errors. You shouldn't have any warning in your project at all, and if you see one you'll know to check it out. You should use @SuppressWarnings for any warnings you have reviewed and have determined are not errors. Your IDE should mark warnings clearly at the project level, the file, and the offending line. They also should have an overall list of warnings (and errors) and you should go through them before building a release.

<comment><USER5> I rather like the JPL rules which say that code MUST compile with NO warnings even if the warning is wrong. See rule 2 in [https://lars- lab.jpl.nasa.gov/JPL_Coding_Standard_C.pdf](https://lars- lab.jpl.nasa.gov/JPL_Coding_Standard_C.pdf).

</comment></comment></comment></comment><comment><USER6> I'm confused by "listing 5" that states private methods and variables are accessible without reflection. The example it gives shows a static main within the same class that declared private.

That's the definition of private, that only the declaring class can access. I believe the main beef is that one object _can access_ another object, even though they are the same type. That makes perfect sense to me. How else would equals and hashcode work?

<comment><USER3> It's commonly called "inheritance anomaly".

<comment><USER7> "Inheritance anomaly" is something else. It refers to the combination of inheritance and concurrency not working out well together.

[https://dl.acm.org/citation.cfm?id=968159](https://dl.acm.org/citation.cfm?id=968159)

</comment></comment></comment><comment><USER8> Bytes being signed is the ultimate Java oddity. Can't say how many times I've been bitten by this.

<comment><USER9> I also don't like it.

Legend goes that Gosling went around Sun offices and almost everyone failed to get unsigned versus signed math right, so they went with signed only types.

[http://www.gotw.ca/publications/c_family_interview.htm](http://www.gotw.ca/publications/c_family_interview.htm)

> Quiz any C developer about unsigned, and pretty soon you discover that > almost no C developers actually understand what goes on with unsigned, what > unsigned arithmetic is. Things like that made C complex. The language part > of Java is, I think, pretty simple. The libraries you have to look up.

At least Java 8 introduced unsigned math helper methods.

<comment><USER10> > so they went with signed only types

Except chars

> At least Java 8 introduced unsigned math helper methods.

They still aren't enough IMO. They don't have way ways to take LE/BE bytes out of integers or vice versa (not worth creating ByteBuffer for). I always end up recreating these utilities in projects where it isn't worth depending on or shading an entire Guava, e.g. [0]

0 - [https://github.com/cretz/javan-warty- pig/blob/master/fuzz/sr...](https://github.com/cretz/javan-warty- pig/blob/master/fuzz/src/main/java/jwp/fuzz/Util.java)

<comment><USER9> Yep, lack of unsigned primitive types belongs to my list of Java pet peeves.

</comment></comment></comment></comment><comment><USER11> The way private visibility is handled is actually pretty useful for data- structures like Linked-Lists or trees where one creates more of itself and needs to adjust internal pointers without providing an external interface for anyone else to do so.

</comment><comment><USER12> Java Puzzlers[0] has a few entries similar to this. Some of the entries are things that would trip you up (but logically makes sense) rather than oddities, but it's an interesting read. Note that the book is from 2005 and uses Java 5.

[0]: [https://www.amazon.com/Java-Puzzlers-Traps-Pitfalls- Corner/d...](https://www.amazon.com/Java-Puzzlers-Traps-Pitfalls- Corner/dp/032133678X)

<comment><USER13> You can also search YouTube for "Java Puzzlers" for a few talks by Josh Bloch (the author) where he goes through more puzzlers.

</comment></comment><comment><USER14> Many more Java language oddities are pointed out in the book "Java Puzzlers". One of its authors is Joshua Bloch, a major contributor to the Java language and libraries. [http://www.javapuzzlers.com/](http://www.javapuzzlers.com/)

</comment><comment><USER7> as far as oddities are concerned, what about java.lang.NullPointerException for a language that is free of pointers ?

<comment><USER15> Thinking about this:

For 'Object x', x is nothing but a (typed) pointer.

Pointer manipulation is heavily limited, but technically, Java has pointers.

<comment><USER7> it's a reference, not a pointer (fe, you cannot get its value/address), so it should have been NullReferenceException or NullDereferenceException (or something similar)

<comment><USER9> You can get its address via the unsafe package, and Panama will provide an alternative API to do it.</comment></comment></comment></comment>


WiFi over satellite TV coax - <AUTHOR> https://tbspace.de/wifioversatellitecoax.html <comment><USER2> not a bad result really considering that old school Co-Ax networking was 10Mb/s (ah the days of T pieces and terminators!)</comment>


Google is losing interest in Android - <AUTHOR> https://daringfireball.net/linked/2020/06/25/wong-ios-14-android <comment><USER2> This is an opinion unsupported by anything. Don't submit this crap please.

</comment><comment><USER3> This seems like a larger overall malaise with Google. I'm an outsider, but it seems like everything they have done lately has been a dud. Stadia, their 10 different messaging apps, Zoom dominating Google Hangouts...</comment>


The Firefox 3.5 fiasco - <AUTHOR> http://weblogs.asp.net/fbouma/archive/2009/07/09/the-firefox-3-5-fiasco.aspx

<comment><USER2> Although the interminable feeling the author had while waiting for Firefox 3.5 to start up mirrored my own feeling of waiting for him to get to the f'ing point, he's absolutely right: Firefox should just be using the system's secure random number generator on each platform. If you have a vulnerability in /dev/random or CryptGenRandom(), you have a massively more important finding than Firefox crypto.

<comment><USER3> This is exactly the reason, as a general rule of thumb, why I don't like end- user software packages that are designed to be cross-platform. While I find Firefox 3.5 on OS X to be way faster than Firefox 3.0, it still doesn't hold a candle to Safari. It may as well be written in Java. For something as fundamental as a web browser, which I'm using all day long, it can't take 30 seconds to open a new window, freeze up and start thrashing halfway through rendering a page, or crash twice a day. (All of which Firefox 3.0 did, and which made me decide to move to Safari.) On top of the performance, the fact that Firefox uses a fake skinned XUL look-alike interface on each platform is the straw that breaks the camel's back, at least for me.

Port the renderer cross-platform, and write separate native apps for each target platform. The amount of complication and cruft that must be in the codebase for making a massively complex software package like Firefox work cross-platform, and the amount of basic OS-level functionality that must have to be reimplemented from scratch because it isn't available on some particular target platform, is probably no small contributor to its performance woes.

<comment><USER4> Of course Safari loads faster than Firefox on OS X, as IE loads faster in Windows. Their libraries are preloaded by OS ...

Native apps for each platform may give performance boost, but maintaining a consistent UI will be a lot harder

<comment><USER5> That's the point: _we don't want consistent UI_

If we want native UI, it's obviously going to have major inconsistencies between platforms!

<comment><USER6> Well that's not 100% true because the main interface for Firefox on Mac OS X looks more like Safari than it does Firefox on Linux.

I think they've actually done a really good job making it look like a native app instead of just a port from some other OS.

<comment><USER5> It's not about _looks_ , but about _behavior_.

Fun Fact: In Safari since version 3, the <input> elements aren't actually native widgets anymore, as NSButton et. al. couldn't support a bunch of the CSS attributes. They are now rigorous behavior-level reimplementations!

A widget that looks native but behaves differently is terrible! At least when it looks alien you don't expect it to behave natively.

</comment></comment></comment></comment></comment></comment><comment><USER7> To summarize for those who have less spare time than I:

Some firefox developer had a Very Bad (tm) idea to seed a random number generator by scanning the Windows Temp folders, which is now causing a 30 secs to over a minute pause in start up for a lot of users (particularly those that use IE, which creates a LOT of temp files). Yikes.

<comment><USER8> At least the _good news_ about the Bad Idea(tm) is that this should be a very small fix for 3.5.x.1 - as opposed to some competing browsers invested development that ignored/contradicted _standards_ , requiring complete re- do's.

</comment></comment><comment><USER9> If you want to see the code that does this:

EnumSystemFiles: [http://mxr.mozilla.org/mozilla- central/source/security/nss/l...](http://mxr.mozilla.org/mozilla- central/source/security/nss/lib/freebl/win_rand.c#182)

...called by rng_systemJitter: [http://mxr.mozilla.org/mozilla- central/source/security/nss/l...](http://mxr.mozilla.org/mozilla- central/source/security/nss/lib/freebl/win_rand.c#359)

...called by rng_systemFromNoise: [http://mxr.mozilla.org/mozilla- central/source/security/nss/l...](http://mxr.mozilla.org/mozilla- central/source/security/nss/lib/freebl/sysrand.c#74)

...called by RNG_SystemRNG: [http://mxr.mozilla.org/mozilla- central/source/security/nss/l...](http://mxr.mozilla.org/mozilla- central/source/security/nss/lib/freebl/win_rand.c#509)

...called by (among others) rng_init: [http://mxr.mozilla.org/mozilla- central/source/security/nss/l...](http://mxr.mozilla.org/mozilla- central/source/security/nss/lib/freebl/drbg.c#379)

<comment><USER10> My best guess.. RNG_SystemRNG first tries to use a deprecated API (<http://msdn.microsoft.com/en-us/library/aa387694(VS.85).aspx>), then CryptoAPI, then this temp file entropy gathering approach. But if the deprecated API is _broken_, rather than absent from the DLL, then it will fall back to scanning temp files without ever trying CryptoAPI.

</comment></comment><comment><USER11> Maybe it's just me, but I consider this a (serious) security issue as well. The contents of temp files, which Firefox shouldn't even have access to, will now float around in the process memory of Firefox, even after the memory has been deallocated.

Firefox should never, ever, ever, open any file outside its own app directory, user preferences directory, or cache directory.

And a reasonably secure OS shouldn't even allow Firefox to open any of those files.

<comment><USER12> Not necessarily. If this is a typical seeding algorithm, at most there would be one block of data in memory, used for hashing. And one would also think they are smart enough to zero it out before deallocating it. It IS a security library, after all.

</comment></comment><comment><AUTHOR> I used Procmon to monitor Firefox at startup and it indeed traverses my entire temp folder and Internet Explorer's cache folder.

</comment><comment><USER13> One bug is a "fiasco"? How about the 15 years the web has been set back by supporting broken browsers like IE6? Oh, well at least it starts up quickly...

The real issue here is how hard it is to be a consumer of open source software on Windows. On Debian, if I wanted to fix this, I would just "apt-get source" the relevant package, make the change, and have Debian build me a new package with the fix. On Windows, this is apparently not possible, as there is no package management system to install the compiler and source code for you, and the apps check themselves to make sure that you don't modify them.

(I also like how the virus / spyware situation is so out of hand on Windows that you can't even recompile libraries without your own computer assuming you are hacking yourself. Nice.)

Why do people still use Windows?

<comment><USER14> maybe not a fiasco but a serious bug. Im using IE8 at the moment till a fix appears - it's just faster.

<comment><USER15> Speed isn't everything. For the love of all web developers everywhere, pick any browser (Safari, Chrome, Opera, or Firefox) and dump IE. We would greatly appreciate it.

<comment><USER16> I'm not sure when you last used IE but IE8 is as good as the others listed. Their marketing department can suck my ass though.

</comment></comment></comment></comment><comment><USER5> It gets worse security-wise -- their recommended fix is to delete all your caches, removing the entropy seed from their RNG: [https://support.mozilla.com/tiki- view_forum_thread.php?comme...](https://support.mozilla.com/tiki- view_forum_thread.php?comments_parentId=381674&forumId=1)

And if clearing the caches doesn't affect entropy quality, it's even stupider -- why bother to read them in the first place?

</comment><comment><USER17> Well yes, it's a bug but it's hardly a fiasco. Something like this should be caught in pre-release testing. Still, most users have their browsers running all the time anyway so a slow startup is not really that critical. I've seen far more serious bugs being taken far more lightly.

<comment><USER18> I'd more alarmed by the fact that they've thrown something new into the mix security-wise than the effect on startup time.

If the system pseudo-random number generator has no problem, what's the use case for not using it? And if it does have a problem I'm sure they would have told someone :)

I just don't know why you add another moving part to the security system if you could avoid it, especially since it seems like a reasonably safe bet that people have had more eyes move over / experience with the alternative.

<comment><USER17> Yeah, it's a stupid bug. Most bugs are once you find them.

I also agree that this got into the security layer is probably the most worrisome part of the whole story. Maye this could build a case for mandatory code reviews for security related modifications.

</comment></comment></comment><comment><USER19> I wish the Firefox developers would focus on bug fixing for the next big release. There are so many bugs that are not fixed for many years. For example alt-text on images not correctly shown or disable-output-encoding on XML/XSLT being ignored. Instead that add more and more features. The awesome bar already made me switch to Opera, I miss some extensions though so I do keep an eye if Firefox gets "better" for me.

<comment><USER20> Whats so bad about the awesome bar?

<comment><USER21> No idea, it's one Firefox's killer features I miss in other browsers.

That said, Firefox 3.5 allows one to VERY easily disable the awesomebar: Preferences -> Privacy -> Location Bar.

<comment><USER5> Awesome, and they even exposed in the UI rather than burying it in about:config.

Their arrogance of baking into the browser what is essentially a bundled extension was ridiculously annoying. My favorite added misfeature: it blacklists URLs with the 'about' protocol handler.

I had been disabling / detuning it piecemeal with extensions + settings to make it less obnoxious. I've come to like most of the completion features most of the time, but the visual presentation and interactive behavior is just fucking awful.

At least it's not as bad as Epiphany: it sorts only in direct chronological order (oldest first!), and in true GNOME style is not customizable in any way. Why the fuck would you ever want that?

</comment></comment></comment></comment><comment><USER22> And this is precisely why the most recent Firefox install I have is from the 2.x series. It used to be that Firefox (then Firebird) was the lean and mean cousin of bloated Netscape. Alas, age has taken it's toll and the amount of built in crud in Firefox that has nothing to do with downloading had display HTML documents is overwhelming...

<comment><USER23> Hmmm - looking back, I'm not sure why I'm on 3.0x. Were there new features? JSON backups - whoopee! Other than that, from a user's perspective, I'm not sure there is anything better. 2.x was fine by me too.

<comment><USER24> I quite like the awesome bar now (was that in 2.0?); some CSS3 support too. Bookmarking tagging, update checking are good as well. Improved SVG support I use occassionally for viewing.

Other than that I suppose faster javascript and optimisations through use of sqlite for history/bookmarks is good.

Probably a few other things if I thought about it.

Main features are in add-ons for me, firebug, yslow, noscript, adblock, seoquake,download toolbar, greasemonkey.

I keep a separate clean profile, without all the footer-bar ("clutter bar") icons for the wife to use whilst surfing

</comment></comment></comment><comment><USER25> line-height: 0.1em ftl

(gross exaggeration)

<comment><USER26> As soon as I see eye filth like that I go right to my readability bookmarklet:

<http://lab.arc90.com/experiments/readability/>

80% of the time, it works every time.

<comment><USER27> There's also always View -> Page Style ->No Style

<comment><USER28> And Ctrl + (Repeat until satisfied)

<comment><USER27> Definitely... I have Verdana as my default font and I Ctrl+ and Ctrl- my way all over the web.

<comment><USER29> How about setting a suitable default zoom level? That way you only have to sometimes decrease it.

( At least Opera supports this, don't remember about Firefox )

<comment><USER30> At least the last time I set up a computer for an elderly relative, it required an extension, I think it's called Default Pagezoom.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> The "thread dump" feature should be an absolute requirement for any language runtime environment. Java has perfected this with the SIGQUIT signal. Thread dumps give you readable stacks of all threads with a simple user command (kill -3 on Linux/Unix, although a bit more difficult on Windows), without having to install symbol files, install additional software, run "scary" commands (for end users), etc.

This is a textbook example of taking a few thread dumps, a few minutes apart, immediately showing what is going on. IBM has one of these as their Performance or Hang "MustGather" script:

[http://www-01.ibm.com/support/docview.wss?uid=swg21115785...](http://www-01.ibm.com/support/docview.wss?uid=swg21115785&aid=4)

.NET thread dumps suck -- you have to use adplus to attach and they're not easy to read. Native programs (e.g. C/C++) work better with symbols and are just too scary for end users. DTrace on Solaris with Ruby/Python/PHP extensions is nice, but too cumbersome to install, and again too scary for end users.

I'm not aware of built-in thread dumps-by-signal in other non-Java languages (please note in a comment if there is), but this feature is so basic and needs to be baked in to every runtime environment and easy enough for end users to use.

Firefox, being a native program, is in a bad problem determination position here and the haphazard nature of the problem determination process in the forum and bug report shows that. I suggest Firefox create something like IBM's MustGather scripts (starting with a performance one such as IBM's hang MustGather -- <http://www-01.ibm.com/support/docview.wss?uid=swg21115785> [click "Show Details" for the steps]). A hang MustGather should go through the process of installing symbol files, getting the thread stacks, submitting the information, etc. This will allow users to at least feel like they can do something valuable to help the developers fix the problem.

</comment><comment><USER32> FYI Mozilla does have an open blocker bug about this problem:

<https://bugzilla.mozilla.org/show_bug.cgi?id=501605>

</comment><comment><USER33> I find Safari 3 to run very well on Windows, and I've been using it at home lately. It passes the Acid3 test at 100 percent.</comment>


BeatOn Support Ending – Illicit Mods Are Now Against the Oculus TOS - <AUTHOR> https://old.reddit.com/r/OculusQuest/comments/dddjb9/beaton_support_ending_illicit_mods_are_now/ <comment><AUTHOR> Why I think this is relevant to HN: Oculus Quest is a new standalone (cable- free) VR headset, whose popularity in was to great extent driven by the game BeatSaber, which is popular because - like any dancing game - there was a way for a community to sideload custom songs to dance to. The newest ToS update explicitly kills off song sideloading on Quest, and because of that, a lot of people are talking about sending back the headset for refund. It might turn into an interesting case study of intellectual property concerns possibly ruining a pair of good products.

(Disclaimer: I did bought Quest recently, 90% of the motivation was to play Beat Saber with custom songs. So I'm personally disappointed about this too.)

<comment><USER2> They might of updated there TOS but nothing has changed, you can still sideload everything just as normal, all that is different is a message at the top saying illicit mods and privacy are against TOS.

I too bought the quest when custom songs became a thing, but found i didn't really like beat saber and perfered BoxVR instead, I don't mind the songs in BoxVR, I only wanted custom songs in Beat Saber because the original songs are cancer but most customs don't flow that well.</comment></comment>


Gravitational lensing by spinning black holes in astrophysics - <AUTHOR> http://iopscience.iop.org/0264-9381/32/6/065001/article

<comment><USER2> Gravitional lensing is one of my favorite phenomenon in physics. I did once a web version of it. Here is the link if you want to play with it.

[http://cihadturhan.com/lab/gravitional- lensing/](http://cihadturhan.com/lab/gravitional-lensing/)

<comment><USER3> This is awesome. Any links to source or comments on what tools you used to make it?

<comment><USER2> It's plain javascript. I used canvas and reflected the coordinates of pixels according to position of cursor. Also smoothed the effect using a heuristic smootherstep function.

</comment></comment></comment><comment><USER4> At present, the title here on HN is "Gravitational lensing by spinning black holes in astrophysics" \-- to which my immediate reaction, and I suspect not only mine, is: what, as opposed to in cookery?

The original article title gives the answer: "... and in the movie _Interstellar_ ". Since the article really is about the rendering techniques used in the movie as well as about the physics of rotating black holes, I suggest that the HN title be made to match that of the original article.

<comment><USER5> I saw the title and thought "is it the one from Interstellar!?!?"

Thorne said he was going to publish based on their simulations so it's awesome it's here. I agree it might be nice to have the context in the title since this is cool for both physics and science-fiction fans.

</comment></comment><comment><USER6> Gravitational lensing or just large magnetic fields bending light? [http://www.gizmag.com/synthetic-magnetism-stanford- photonic-...](http://www.gizmag.com/synthetic-magnetism-stanford-photonic- crystal/25261/)</comment>


Ask HN: How do I proove my ISP is throttling speed - <AUTHOR>

 Since last few weeks none of the videos in Yourtube are getting streamed in real time, even with the low quality (360p, 480p etc.) However speedtest showed its still 20mbps and no other website has loading issues.
For example the same video in two different streaming site
https://www.youtube.com/watch?v=jAmY4m7FcKs does not stream and buffers every few second
but
https://vimeo.com/channels/staffpicks/135806831 buffered completely in 30 seconds.
It is least likely YouTube is having a server problem, help me understand if ISP is throttling Youtube specifically. <comment><USER2> You can use a VPN and see if YouTube is still slow, if you don't have access to a VPN service open the youtube link in Tor browser.</comment>


WeChat Impact Report 2016 – latest data about Chinese social media - <AUTHOR> https://walkthechat.com/wechat-impact-report-2016/ <comment><USER2> I've been in China for 5years now. Wechat payment is awesome and made my life way easier! I pay my rent/taxi/friends/errands/restaurants with wechat. It's faster to pay with it than cash or credit card. Almost every shop accept it.

It also change my life when dealing money with people. Everyone can transfer money to each other, and people assume that everyone has it (what is 95% true in my social circle). I don't need to have cash, credit card, and don't have to deal with change/money issues anymore with them. You do not need to see people physically, or ask any bank information.

There is also pretty fun to I see in many group I am in (from 2 to 500 people). You can send "Red envelopes". You set the amount of it, to how many winner you want, and if the ammount is random across people winning or not). The others don't know the amount of money in it. The X first(s) to open the red envelope get the money. I believe this increase the stickiness of the group you're in. I know some group sending many red envelops a day (for any kind of reasons). I also believe the number of red envelops sent increased a lot during the Chinese new year (It's a tradition to give red envelope during CNY).

For the fee: After 20k RMB , you'll have to pay a 0.1% fee on on every transfer. The limit is reset every month. You can also put back the money in your bank. The limit is 1K rmb/week, if that exceeded, you pay some fee (can't remember how much).

<comment><USER3> Wow. I don't think there's anything close to that in the U.S, maybe PayPal, but the red envelope thing is really novel. I don't even know how legal that would be in the U.S. The concept of giving money away randomly is just strange.

</comment></comment><comment><USER4> Personally I like WeChat's approach: Messaging feature and social feature integrated in one app, with messaging as the default view when you open the app.

Facebook is actively separating messaging feature from the main app and force users to use two different apps, which is inconvenient IMO.

Maybe it is just a legacy issue where Facebook started as a social media whereas WeChat started as a messaging app, but I am interested to see if Facebook would be better by prioritizing "messaging" over "feed".

(Disclaimer: I am a Chinese user.)

</comment><comment><USER5> I'm actually really surprised at the 67% male statistic. I guess all I have to go on is personal observation, but I have a very hard time believing the gender imbalance is that big.

On the other hand, I live in Beijing, and just looking around you'd be hard- pressed to believe that China as a whole has a gender imbalance – if anything, there seem to be more women than men. Perhaps the majority of men have remained in the countryside? Where they're spending their time on WeChat? I'd be very curious to see if anyone's done a population study of gender by region...

<comment><USER6> I'm surprised too. I'm also curious about whether the male/female stat is asked directly to the user or is just the gender indicated on the person profile. If it is the second option (I doubt it tho...), I know quite a number of girls that set their profile as "male" for various reasons... It is also indicated that default gender is "male" so maybe a lot of persons didn't wanted to disclose this information and were set up as male (doesn't seems likely either).

</comment></comment><comment><USER7> It says 67% of users used WeChat to make payments of atleast 100RMB a month. That's a significant number! I guess WeChat makes a commission on that payment. Would that be the largest moneymaking feature of WeChat?

<comment><USER8> WeChat users can send Red Envelope to friends or relatives. It is often used as a game in a WeChat group. I dont think this can be counted as real payment.

<comment><USER9> I order lunch on WeChat and send a red envelope inside a group chat as payment after its been delivered. The group has 300+ members. This is the exception, though. There are better ways of making payments through WeChat and I'm guessing that envelopes make up a small fraction of the stated number.

</comment></comment></comment><comment><USER10> I think the most mindblowing fact in this report is the fact that 70% of WeChat users have 100+ RMB transaction per month.

This level of mobile payment adoption could only be dreamed of in Europe...

</comment><comment><USER11> Is there any way I can ascertain the validity of the report? Although it says "Translated from Tenscent penguin intelligence and China Academy of Information and Communications Technology (CAICT), 2016 WeChat impact report", I wanted to make sure.

Is there possibly a link to original source?

<comment><USER12> The Chinese title of this report is 微信影响力报告 (Report of the Influence of WeChat) or simply 微信报告 (Report of WeChat). And the issue number is 43 (2016.3). Those are the keywords can be googled.

And this is the link of the report from QQ (Tencent) official website:

[http://tech.qq.com/a/20160321/007049.htm](http://tech.qq.com/a/20160321/007049.htm)

</comment></comment><comment><AUTHOR> WalktheChat is hiring developers for WeChat e-commerce platform! Join us! [https://walkthechat.com/career/](https://walkthechat.com/career/)

</comment><comment><USER13> do you perhaps have a PDF version? thanks

<comment><USER4> I don't think there is a PDF version available from the website. If you don't mind the extra things on the page, in Chrome you can save the entire page as PDF using the built-in print function.

</comment></comment><comment><AUTHOR> Everything you need to know about WeChat

</comment><comment><USER14> I've lived in China off and on for the last 13 years, and my wife is Chinese. She, her family, and her friends all use it, and they constantly try to get me to use it.

I refuse to use any Chinese social media. They wouldn't allow something they couldn't control or monitor, and I don't feel like giving them a direct eye on all my private chats, pictures, finances, etc. At least Facebook gives me the illusion of privacy.</comment>


Markets for Information Goods (1998) - <AUTHOR> http://people.ischool.berkeley.edu/~hal/Papers/japan/index.html <comment><AUTHOR> The author is Hal Varian, alumnus professor of economics at UC Berkeley, and chief economist at Google.

I particularly draw attention to the section "Information as a public good". [http://people.ischool.berkeley.edu/~hal/Papers/japan/japan.h...](http://people.ischool.berkeley.edu/~hal/Papers/japan/japan.html#SECTION00060000000000000000)</comment>