One simple way to attack social anxiety - <AUTHOR>

Benzodiazepines.<p>Sure, they create tolerance, but so does alcohol. Do it responsibly and under medical supervision. <comment><USER2> It would work for one night if you wanted to go out and pick up women, but it's a terrible idea to take benzos every day for social anxiety, because you quickly reach the point where the drug has absolutely no effect but you need it to feel normal. No doctor would prescribe that, you need some type of panic disorder. SSRIs like Celexa/Paxil would be a much better idea.

<comment><AUTHOR> It's not that difficult to discontinuate benzos. You just need to taper off slowly. You'll just be left at the same place you were before.

Many doctors treating depression will actually use benzos in addition to SSRIs as a standard first-attempt protocol. Antidepressants are inespecific for social anxiety, and can actually aggravate general anxiety (hence the SSRI- suicide problem). Sure, if social anxiety derives from low self-esteem or something... but you can work that out in psychotherapy. While on benzos. Or you can work it out by yourself, by interacting with people.

I was actually being provocative about all the pop psychology crap being thrown around. If your head is a mess, then the pop psychology is useless. When unscrambled, you can attempt the pop psychology methods or join buddhism or something.</comment></comment>


Ask HN: Advice for Moving from Tech Lead to Manager/Director Position? - <AUTHOR> Hi HN,
I work for a well known company in Bay area as Tech Lead.  I don't have direct people management responsibility but I do manage team from technical aspects.  I would say I am good at what I do, though far from expert.
I make my point and get along with people often. I sense mutual respect from few members of my team and almost all of business partners.
I want to move to management and perform role of manager.  I have talked this numerous times with my manager.  Problem is that my manager is less of technical guy and doesn't seem like he wants to support my career growth.  He is of similar age as me.
What and how do I move into managerial/director position ?
I am getting tired of day-to-day technical stuff where it's your fault when smallest thing goes wrong and it's everyone's efforts when things go right.  There is also great degree of undercutting happening from equal senior members of my team.  I don't want to be manager of my own team but moving in Org is not feasible due to internal politics anytime soon.
TBH, it seems that managers/directors have less and less work I have seen in multiple companies I worked for.  All they do is preach / talk and present.  I am not making gross generalization but it seems that manager/director job has far more security than being tech lead.
I was not born in US but I studied all my life in English.   I don't sound like  an american when I talk. People understand me fine though. I know I have to work hard on communication skills and I plan to do so.
What other steps shall I undertake in order to advance my career to manager/director position ? <comment><USER2> New managers get promoted when there's a need for one. Sometimes that's because the existing manager is moving up, or because they're leaving the company or transferring to another department, or just because the department is growing and lots of new employees are coming on. The most dependable path to becoming a manager is actually the last one, making sure that you join a high-growth department in a high-growth company.

That said:

"I am getting tired of day-to-day technical stuff where it's your fault when smallest thing goes wrong and it's everyone's efforts when things go right."

If you dislike this, then you will _suck_ at being a manager. It's the manager's _job_ to take the bullet when things go wrong and pass on the credit when things go right. That's the only way you can create an environment where your reports feel safe in taking risks and working their hardest on a high- value problem.

It's also a manager's job to navigate internal politics and advocate for their team. If you don't do this effectively, both you and your reports will end up marginalized, and you'll find that your best reports will transfer away.

If your problem is that there's too much internal politics and you're sick of it, that's usually a problem with the company (or sometimes just the department), and is best solved by switching companies to one that higher- growth, where everybody is too busy to undercut each other, or alternatively by getting better at politics.

</comment><comment><USER3> > All they do is preach and preach / talk and present. I am not making gross > generalization but it seems that job has far more security than being tech > lead.

I don't think you understand enough about being a manager yet. Are you interested enough in becoming one to do things like reading books on effective people management, and treating it as a skill to be learned over a long time?

If not.. there are worse things than being a tech lead. :)

<comment><AUTHOR> Sorry if I came off as rude. What I meant was job security increases X fold when you are a manager. Yes, I am absolutely interested in reading and learning everything I can.

Do you have any resources where to get started ?

<comment><USER4> I don't understand why you're thinking about "job security". Job security comes from being a high performing professional - manager or not. If security is really your main driver, you should look for a company that rewards average performers with lifetime employment - there's plenty of those.

The question "where do I start as a manager" is fundamentally wrong. Effective managers are leaders - and not all leaders are managers. You should focus on sharpening your leadership skills first. Lead projects, initiatives, product launches, events, pick up things that nobody else wants (but you know are important). Learn to influence people, give and receive feedback, develop negotiation skills, invest in becoming a better communicator. Those are all important parts of being a leader, and you'll have to demonstrate it in practice _before_ being promoted to being a people manager.

Also, you should talk to your manager, ask for candid feedback on which areas you need to work on in order to become a manager in the future. Not today, or 6 months from now, but "in the future". That is distant enough that won't trigger any alarms, thinking that you're ready to quit.

Lastly, ready everything you can. Here's a few, to get you started (in no particular order): Work Rules, Crucial Conversations, The Hard Thing about Hard Things, Search Inside Yourself, Strengths Finder, The Power of Habit, Lean In, How to Win Friends, Zero to One.

</comment></comment></comment><comment><USER5> Distributing praise/criticism to maximise productivity and morale, rather than to reflect the truth, is part of managing people. You should adopt a mindset/philosophy that makes this seem intuitive to you before you progress further imo.</comment>


Adventures in Improving AI Economics - <AUTHOR> https://a16z.com/2020/08/12/taming-the-tail-adventures-in-improving-ai-economics/ <comment><USER2> In my experience, there are just a lot of "bad" AI/ML engineers who don't fundamentally understand what data can do, what ML algorithms can handle, and how to piece it together to produce something of value to the end user. A couple of these people on a team can torpedo a project. Worse are those who sabotage projects or are general pain points of hindering progress. These may be jaded people who don't believe that ML has any value yet have titles like Data Scientist or ML engineer, and can bring team morale down. The economics are similar to a grad-school research project, yet is infiltrated by all sorts of people with 3 month certificates believing they are the star of the show.

The most important element of AI project success is the right people and the right team. Projects are long-term and failure can be often. It's not easy to succeed but cultivating the right people and their mindset is in my opinion a needle mover for AI projects, more-so than what data is available, what algorithms are tried, and what shiny framework people want to use.

<comment><USER3> Correct me if I'm wrong but isn't this fundamentally true for any team working on any project?

<comment><USER4> No, there's more ambiguity in machine learning projects. When you develop a website, aside from the design, it works or it doesn't. Whether some kind of ml product can work at all is often team dependent

<comment><USER5> > When you develop a website, aside from the design, it works or it doesn't.

This really isn't true. There are websites and web apps that "work" but are really suboptimal from a performance and UX perspective. It's possible to do this right, but it's much easier to do a poor job. You end up with something that kind of works and may even be profitable but which is a boat anchor around your company compared to a better approach.

</comment></comment></comment></comment><comment><USER6> a16z has a podcast where they explored gross margins a month back. The panel called out AI as an example of a software business that has a high likelihood of not having standard SaaS margins (Most of the panel thought this could be a limitation).

The podcast is nice because I think it holistically explores gross margins in a way that you start to understand how it might impact AI as a viable primary business model and valuations related to companies who that is the case for. Quite complementary to the article.

Might be interesting to people who are interested in this article: [https://open.spotify.com/episode/79lJCrHB3nBn1qXCxKA5s7?si=R...](https://open.spotify.com/episode/79lJCrHB3nBn1qXCxKA5s7?si=RFlHPM0_QwWHZsqwf3nbxA)

<comment><USER7> This is a great feature of the AI space for startups - in the short term it reduces competition, in the long term it's not really a problem. If your business is break-even currently, it will be profitable in 2-3 years due to declining cost of compute. In 10 years the compute costs will fall by an order of magnitude and more efficient models will become available, making the economics closer to traditional SaaS.

This does disadvantage smaller bootstrapped businesses though.

<comment><USER8> Not true if there's enough competition that you need more resources for a bigger model in 2-3 years. Anecdotally, it seems like SOTA model training costs are rising much faster than computer cost is falling.

<comment><USER7> maybe, but model quality doesn't scale linearly with model size. The performance/dollar metric is more important, and that definitely will decline over time.

Personally, I have a boots trapped business that uses a transformer model. I'm not worried about supermassive models like gpt3 because it would be way too expensive to deploy for my use case, with marginal additional quality.

</comment></comment></comment></comment><comment><USER9> Good analysis and great of them to share their thinking. Does feel like this could have been a tweet that said the necessary condition for successful ML solution is applying it to a problem that has asymmetric upside.

Great for telling people they should get tested for diseases, terrible for diagnosis. In the alerting first case, consequences of being wrong are no better than base rate as they wouldn't have been tested otherwise, and the upside saves a life. In the latter diagnosis case, the consequences of being wrong are catastrophic, and it is substituting for the best available judgment. Similarly, it's great for fraud detection, terrible for making credit decisions, because the false negative rate is essentially externalized. It's good for finding opportunities, bad for providing services. So funnels and conversion pipelines it's great for.

So perhaps there's an ironic Turing test for ML solutions that is related to the relationship between the size of a group of people and the effect of mean reversion of their collective intelligence on their behaviour makes them indifferent to the perceived intelligence of the model, whereas a given individual will find the results of the model unsatisfying. From an indifference perspective, AI can fool some of the people all the time, and all the people some of the time, but no confusion matrix satisfies all the people all the time. Economically, ML will be useful for creating simple and cheap services that people who can't afford better will use, and substitute up from them when they can afford better, known as "inferior goods." There may be a hard limit on ML providing "normal goods," to individuals at scale for this reason. Lots of money to be made, but lots to be wasted tweaking your ROC curve to in the hope of creating a normal good.

I yell from the rooftops every chance I get that "the confusion matrix is the product." That is, your FP/FN/TP/TN rate is your product, and you are optimizing your system for the weights your customer assigns to those variables.

There is another ML/DL use case I'm hacking on that is about enabling privacy, but even this reduces to the asymmetry of the upside/downside of the confusion matrix. Obviously the article is more nuanced than this, but I think this heuristic is a key tool for reading articles like it.

<comment><USER10> I appreciate the thoughtful commentary. I couldn't disagree more with you more of course.

There are 2 instances where AI breaks the mold you've cast.

Executing rote tasks that no humans need do, and relatedly, while there does seem to be a tough hurdle when it comes to "better than human" execution there is also an inverted survivors bias. Once a technology is production ready it is no longer AI. Cars aren't robots, antilock brakes aren't AI, Once a system outperforms a human it's technology, not intelligence.

<comment><USER9> Our disagreement might be subtle. An old saw of mine is that the Turing test thought experiment is covered by prior art in economics, where the idea of an indifference curve describes the points between amounts of things where people are indifferent to substituting between them.

I agree these things you state aren't intelligent, but nor are computers, or can they be - people just become indifferent to whether we are dealing with a human or a computer.

My assertion is that we are highly sensitive to substitutes when the downside risk is large, but largely indifferent to them and even like them when they resemble a lottery with good upside at low cost or risk.

Self driving cars are a good example, where someone asked me whether, if I had kids, would I send one to school in traffic in an autonomous vehicle. I told them it would depend on how many kids I had.

But this pretty much describes the dynamic.

<comment><USER11> _Self driving cars are a good example, where someone asked me whether, if I had kids, would I send one to school in traffic in an autonomous vehicle. I told them it would depend on how many kids I had._

Pretty sure that answer is much less convincing than you think.

Infact, I thought you were right until that, then realised that was an answer no parent would ever give which made me realise there's a lot missing in your hypothesis.

</comment></comment></comment></comment><comment><AUTHOR> > This is the crux of the AI business dilemma. If the economics are a function > of the problem – not the technology per se – how can we improve them?

The article focusses on the costs of resources to build a model (annotated data + compute) but the economics are also affected by the ongoing cost of making a prediction error. False positives and false negatives usually have a different cost and each user might have their own preferences:

e.g. "show me all the content that's a bit relevant" vs "show me just the content that's really relevant".

If you can write out the loss function in $$$ terms not just accuracy, then you're closer to either abandoning the problem or finding a profitable AI model.

<comment><USER12> Great way of putting it. The trouble there is that it takes an exceptional kind of senior ML person to basically wear a product manager hat all the time and press to translate project success criteria into revenue impact or cost reduction terms.

Having these "glue people" that connect ML engineering to product management is probably the most important thing to running an ML organization.

</comment></comment><comment><USER13> this is more related to the previous a16z article on the topic but I found "Data as a Service" by Auren Hoffman a great read for thinking about businesses that sell access to machine learning models

[https://www.safegraph.com/blog/data-as-a-service-bible- every...](https://www.safegraph.com/blog/data-as-a-service-bible-everything- you-wanted-to-know-about-running-daas-companies)

</comment><comment><USER14> "Andreessen Horowitz (known as "a16z") is a venture capital firm in Silicon Valley, California"

In case anyone was as confused as I was about what a16z means - it's just the company not a new abbreviated term related to AI.

<comment><USER15> Yeah, I find this kind of abbreviation annoying. But there's a few words that are commonly abbreviated like this:

i18n -> internationalization

l10n -> localization

g11n -> globalization

l12y -> localizability

a11y -> accessibility

It bothers me because my brain does not jump from the abbreviation to the underlying word. I really need to stop and think about each one. And I get the numbers wrong when writing them.

<comment><USER16> There was a period of a few months when I was first learning about web apps where I saw "i18n" multiple times. The first time I came across it, I tried to sound it out:

i18n -> I-one-eight-n -> iwonation

I was already a couple of rabbit holes deep at the time and didn't have the mental capacity to look it up and wrap my head around yet another new concept.

"Oh boy." I thought to myself, "One more word I've never heard of, probably representing some complicated CS concept."

I was so annoyed when I finally found out what was going on.

<comment><USER17> Wait, can you clarify what is actually going on? Is there any rhyme or reason or is are these shortenings just random?

I'm having trouble parsing the grandparent comment...

<comment><USER18> It's the number of letters between the start and end letters. Yeah, it's annoying.

</comment></comment></comment></comment></comment><comment><USER19> Gr8 article.

I'd add that caveat that software dev processes can be well controlled or not well controlled. AIML is not so much a new kind of project but it is a project likely to be poorly controlled.

Another thing they don't mention is that AIML projects break the agile assumption that you can manage with only punchclock, not calendar time.

Imagine you have a 2 week sprint and it takes 1 week to train a model. You have to get the training started in the first week, and any tasks that need to be done to start training have to start before that.

This of course means applying PERT chart thinking even if you don't make PERT charts. It often isn't that hard but in an agile shop that mistakes the map for the territory they will start the 1 week job consistently on the last day of the sprint.

The 'containerization' process they describe is close to the methods used by East coast defense contractors (in a band between research triangle park and the applied physics dept at John Hopkins in baltimore) to get high accuracy. Also they were what IBM Watson did as opposed to what people thought they did.

It's amazing those methods have remained so obscure, but the mind that is impressed with BERT is going to be impervious to asymtopes. That article should be telling people to run not walk away from those kind of models -- it is how you always be a bridesmaid but never a bride.

</comment><comment><USER20> Good analogy about discovery of Pharma molecules.

It's really fun to think about the fact that Tesla has more than enough data to unlock autonomous vehicles, but all that is missing is the correct AI architecture to get it working...

Who will figure out how to code that? Will it be a breakthrough, or can sub- optimal architectures eventually reach equilibrium with 10x or 100x the amount of time/data processing.

<comment><USER21> > Tesla has more than enough data to unlock autonomous vehicles

Many people in the automotive industry, myself included, disagree with this statement pretty strongly. Driving data quantity is not equivalent to quality and they are severely lacking in advanced sensor data.

<comment><USER22> So is the claim by Elon Musk that current iterations of Tesla vehicles have all of the sensors and compute power needed to be fully autonomous (Level 4+ I guess?) in the future, via software updates only, a specious one?

<comment><USER11> It's hard to be absolutist on the response to that: anything is possible, and humans can drive without LIDAR.

But at the moment it seems a strange position to take: we know LIDAR data is useful in many circumstances, and we know it can solve a number of the hard parts of computer vision.

</comment></comment></comment></comment><comment><USER23> I'm happy a VC is providing these insights. If the economics of AI don't make sense by helping increase profits or cutting costs... it's going to be a long road to reaching the "promised land."

I'm biased but in a lot of industries synthetic data has the potential to balance the costs from the perspective of data acquisition and preparation as well as model testing.

This article doesn't focus too much on the edge side of things but one pattern I'm seeing is that edge deployment can be notoriously resource intensive and time consuming.

</comment><comment><USER24> One way to deal with AI/ML shortcomings I've seen is to require end-user intervention for edge cases; such as a support chatbot that transfers the customer to a human rep if it can't understand the issue. Human intervention isn't mentioned in the article but maybe they'd put that under "narrow the problem," or they may not consider that a solution since human involvement eats into margins.

I believe all software companies will be AI companies in <5 years. By then, not having AI/ML would be like not having a database today. There will be no choice but to deal with the long tail, and the competitive advantage will go to the company that does it better. That makes this advice all the more timely and important, and it also means opportunities for startups to innovate in this space. Eg, better model optimization, low-cost operations without regressing to colocated GPUs, etc.

"The critical design element is that each model addresses a global slice of data... There is no substitute, it turns out, for deep domain expertise." Totally true for marketing as well. Much more effective to define audience segments and tailor the messaging and marketing for each.

</comment><comment><USER25> [https://yts.mx/movies/robot-frank-2012](https://yts.mx/movies/robot- frank-2012) show subtle issues related to AI in real life;

</comment><comment><USER26> Indubitably</comment>


A Confederacy of Quacks: The War Against Antidepressants - <AUTHOR> https://www.nsfwcorp.com/dispatch/war-again-antidepressents/ed777898f06c3523f2b91953ca512efe073c4614/ <comment><USER2> I am very tempted to add my personal anecdote to the pile, but let me make a humble request instead...

If you are not a medical professional, please stop spreading unscientific memes and try to keep your opinion on mental diseases to yourself. The question of whether the drugs work is better left to the actual scientists and not be allowed to cloud the basic fact that one should always seek medical attention if they feel they have a problem. Unlike most physical diseases, the mental ones often impair your judgement and all this tinfoil hat bullshit really isn't helping. So please, just don't.

Thanks.

<comment><USER3> The route out of depression is simple - go to see a doctor. At first they will try to improve your state with talking sessions. If this doesn't work they should prescribe antidepressant. Can somebody offer better way?

<comment><USER4> Also - if your doctor seems unhelpful, aggressive or useless, keep changing doctors until you find a good one.

</comment></comment></comment><comment><USER5> How does someone use the word 'Quack' in their title and then focus entirely on anecdote and pointing out that fringe wackjobs like Scientologists are spewing nonsense (no shit). Using the rhetorical style of quacks against them?

Here's an idea, focus on the actual evidence. It seems it's because the evidence is murkier than the stance the author wanted to take, which makes for a garbage article and yet more nonsense spewed into a debate that affects a lot of people.

</comment><comment><USER6> I've been on antidepressants from time to time. For the most part they did very little for me and, on occasion, caused awful physical addiction (Effexor, I'm looking at you) and this made me want to avoid them. But... newer medications are much better than they've ever been and I recently needed to start them up again so down the medical rabbit hole I went. I have to say that the current generation of meds are nothing short of life altering, for me. After a lifetime of varying degrees of depression I am finally finding relief that lasts and seems to have no down side (specifically with a medication called mirtazapine).

</comment><comment><USER7> Meh. Some people like it, some people don't. Works for some people, doesn't for others. To each his/her own.

But every drug has side effects and you're not actually changing anything permanently - the minute you're off the drug you're right back where you started. Psychotherapy actually changes the brain, and there are no negative side effects. That's why I prefer the later and not the former (for any issue).

<comment><USER8> > _you 're not actually changing anything permanently_

Antidepressants can cause real and permanent changes to the human body. Like any drug, some of the side effects cannot always be reversed when you come off them. For example, there is thought to be a link between some antidepressants and an increased risk of type 2 diabetes.

And if you stop taking some anti-depressants without weaning down the dose you can have severe psychological side effects that can result in self harm, suicide, etc.

It is good that psychotherapy is working for you, but it doesn't work for all. The same is true of the drugs: some people respond very well, others not so much. One of the issues, particularly in the UK where I come from, is that the former (drugs) are both cheaper and more readily available than the latter. Ideally people should be able to choose the treatment that works best for them. This sadly isn't always possible.

<comment><USER7> I meant positive changes - i.e. curing depression. And I don't have depression - I'm speaking broadly about solving problems with pills vs. non-pills.

</comment></comment></comment><comment><USER9> I write as someone who would easily have been prescribed (at several points in his life) various antidepressants. I never felt the need for them truly but they had been suggested for me basically with the same level of consideration as most docs hand out ADHD drugs. My girlfriend whom I love takes anti- depressants and they help her tremendously, so I do acknowledge that they are not without merit.

That said, I have seen people put on meds that were pretty clearly not needed (both anti-depressant and ADHD/ADD meds). These meds were added as either a form of insurance policy against some form of academic failure, or generally in high school, a way to dampen off-median behavior.

The big issue I have is the scale at which these medicines are distributed, as well as the early age of the target audience. It does seem odd that there are more than 1/10 over the age of 12 in the US (2011 numbers, [http://www.reuters.com/article/2011/10/19/us-usa- antidepress...](http://www.reuters.com/article/2011/10/19/us-usa- antidepressants-idUSTRE79I7FI20111019)) taking antidepressants.

I have no religious or economic reasons to discourage adoption of any medication (if it works it works).

My primary objection to any given medication is based on my consideration of how I might have turned out differently had I been put on every med suggested.

People are strange screwy creatures. I know some people really need help, and to them: get it, it really does help. My fear is that an 8 year old version of me (or you) somewhere is being told that something is wrong with them because they're a bit spazzy in class and that they need to be medicated because of it.

</comment><comment><USER10> I was given anti-depressants and ADD medication when I was in college. I went to a cognitive psychologist who gave me a barrage of tests and told me I was off the charts ADD and had really bad anxiety and depression. I was definitely anxious and at times I can get pretty down. I turned in less homework than anyone in my whole high school and generally didn't care about most things people wanted me to (I did pretty well in community college and university though).

The psychologist didn't want to even start treatment til the meds kicked in so I, being naive and trusting, said OK, went to the croaker he recommended I go to and started taking them.

The anxiety went away as did the depression. So did any semblance of self- control I had. I can definitely see how someone could fly off the handle on these things kill a bunch of people if s/he had even the remotest inclination to do so beforehand. I started dressing crazy. I started basically talking at people, trying to blow their minds and confuse them and play with them. I lost any desire to really connect with anybody, any empathy or sympathy. My ability to introspect totally disappeared so I was unable to see what was happening to me. Maybe the idea was that depression or anxiety is related to overthinking/over-introspection or something like. Maybe I had an anomalous experience but I'm pretty sure if I continued with them I'd be in prison or suffering in some other way for the unanalyzed extremes I let myself get to.

I have other friends who have taken them or are still on them and I see/saw the same thing with them, a complete inability to self-judge causing them to make the same mistakes over and over and over and a tendency towards unfulfilling behavior. The pill they take to be happy hijacks the ability to ever create the circumstances to be happy without it.

I was unable to see what had happened to me when I was on them. I had to be told by someone who I hadn't seen in a long time how much I'd changed. It was a person I deeply respected. She told me in no uncertain terms that I wasn't the same person I had been and that I had changed for the worse. I finally tried looking inward and I realized she was right. Then I had to deal with the hallucinations and electric shock sensations of withdrawal but I'm glad I did

I may not be happy all the time, or even most of the time. I may be full of irrational fears but I believe I am becoming less so.

Meditation and Qigong help me.

<comment><USER11> For certain psychiatric disorders (and I believe for people who don't really have depression) SSRIs can cause mania, which sounds a lot like what you went through.

</comment></comment><comment><USER12> Members of my immediate family have had, and still have, anti-depressants as part of what is making them worse than what was ailing them in the first place. By far.

Everyone is entitle to their own opinions and has their own experiences, and that's mine. So to me, the quacks are many of the ones prescribing the meds.

</comment><comment><USER13> Here is an interesting source that contradicts the tone of this article:

[http://jama.jamanetwork.com/article.aspx?articleid=185157](http://jama.jamanetwork.com/article.aspx?articleid=185157)

</comment><comment><USER14> > Drugs in contemporary America are like prostitutes in Victorian Europe

Victorian Britain?

</comment><comment><USER15> I know a prominent psychiatrist who believes that antidepressants are largely useless. He still prescribes them all the time because his patients expect him too.

</comment><comment><USER16> After being on just about everything that can be prescribed, I can safely say that they all make you into somebody you're not. Yes, it might make some people happier. But, you know what? So does heroin.

In the end, the only thing that can fix you is you.

<comment><USER17> It's exciting to hear that your personal subjective experience with "everything that can be prescribed" generalizes perfectly to the other 7 billion humans on the planet. This should save a ton of time and money on medical research.

<comment><USER16> I think it's obvious that any psychoactive substance will change one's self. Hence the word _psychoactive_.

<comment><USER18> Of course they'll change one's self, that's the point. Also talk therapy (hopefully) changes one's self. More specifically changing from depressed to not depressed. But that completely different from your original statement of "make you into somebody you're not".

<comment><USER16> To change one's self _artificially_ is to make one into something he or she is not. Yes, I did not mention artificial, but I assumed that was a given.</comment></comment></comment></comment></comment>


Cloudflare drops support for Daily Stormer - <AUTHOR> https://arstechnica.com/tech-policy/2017/08/racist-daily-stormer-goes-down-again-as-cloudflare-drops-support/ <comment><AUTHOR> If this is accurate, it's a huge shift for Cloudflare and people will have to start questioning every site that CF decides to service.

<comment><USER2> This would have happened eventually anyway. Cloudflare is not run by robots. It's run by people who have boundaries.

Also, the case of the Daily Stormer doesn't really fall into any kind of ethical gray area as far as I'm concerned.</comment></comment>


Ask HN: Where/How do I find a good salesperson? - <AUTHOR>

I am a freelance web designer based in Dhaka, Bangladesh.
Since I am in Bangladesh and most clients are in the US, I find it difficult to find and negotiate new clients. Email is not really as good as face-to-face interaction.
To help me out in this regard, I am looking for a salesperson who lives in the US and would be willing to work for commission.
I was wondering if HN could help guide me on where/how to look for a good salesperson. <comment><USER2> Although we are not in the same situation, I can help you with some tips. I work for a web development company in Croatia and recently we started to search for a _great_ salesperson.

We wrote a post on our blog <http://www.logit.hr/blog/logithr-hiring-it-sales- specialist/> describing what we do and what we don't want in a salesperson. (the site is in Croatian, but that post is in English). We ran a marketing campaign advertising that post on several ad networks, including Google Display Network (AdSense). It's intentionally provocative, but it did produce the results we expected, namely, a few good men worth interviewing. We treat hiring the same way we treat any other marketing ad. We want to attract great people, therefore we make an effort to make it look really good. Of course, that is only a first step in hiring process: the next step is an interview part, which is another topic altogether.

The main point is this: first you need to find _quality_ people to talk to and you need to sell them your idea. Advertising a job post might be one good way to do that.</comment>


What the ideal founding team should look like - <AUTHOR> http://blog.adku.com/2010/12/ideal-founding-team.html

<comment><USER2> "If you're a 3-time successful entrepreneur with VCs clamoring to give you money at astronomical valuations without an idea, then this might be an option for you. Otherwise, this option is a death sentence."

Not sure if he's trying to provoke people to comment, but he can't just say that and not substantiate it one bit.</comment>


Using a Yubikey as smartcard for SSH public key authentication - <AUTHOR> http://www.undeadly.org/cgi?action=article;sid=20190302235509 <comment><USER2> I recently wrote a different application for YubiKeys - using the YKOATH functionality to sign AWS API requests with HMAC-SHA256 ([https://github.com/pyauth/exile](https://github.com/pyauth/exile)). What I found is that Yubikey's protocol documentation is good, but their tools are pretty bad, and none of them should be used. Instead, I recommend talking to the smartcard interface through the lowest level library that's already bundled with the major OSs - winscard/pcsclite/PCSC.framework (three implementations all providing the same API).

The app I wrote includes Python ctypes bindings for all three implementations ([https://github.com/pyauth/exile/tree/master/exile/scard](https://github.com/pyauth/exile/tree/master/exile/scard), and [https://github.com/pyauth/exile/blob/master/exile/ykoath](https://github.com/pyauth/exile/blob/master/exile/ykoath) contains an example of how to use them). Hopefully these will be useful to others writing YubiKey-based applications.

I should add, there are other YubiKey modes (like U2F) that use the USB HID protocol instead of the USB PCSC protocol. For those, someone at Google wrote this library: [https://github.com/google/pyu2f](https://github.com/google/pyu2f) which provides similar capabilities for HID-based protocols. It similarly interfaces directly with the system-provided HID API using ctypes.

<comment><USER3> Can you use pyu2f with ssh? It'd be great to have a ssh binding to fido2, with full support for new algos and resident keys, instead of gpg/pkcs11.

<comment><USER4> This can't work technically without a new SSH auth method.

The SSH public key auth method goes like this:

1\. Client "I want to do SSH public key auth. I can prove I know the corresponding private key for key X" 2\. Server (typically checks authorized_keys file to decide) may say "OK, yes, prove that" 3\. Client signs per session data with key to prove possession [it may use the proxy technology to have this done by a different client].

But a FIDO2 / CTAP key needs things to go the other way around

1\. Client "I want to try FIDO2" 2\. Server "OK, here is a Cookie. Can you prove you know the associated private key?" 3\. Client uses CTAP protocol to verify that the Yubikey recognises this cookie and gets back a proof, sends it to server.

In the current world SSH clients know which keys they know, so they can begin by telling the server, but in the FIDO world the Security Key is deliberately too dumb to even know this, it has to be prompted with a cookie.

This is because of a correlation attack [edit: maybe that's the wrong word? The attack is a bad guy figures out who you are based on seeing you connect with this key in many places], which was not considered a big threat for SSH but is clearly a problem on the Web. So FIDO SecurityKeys are engineered to resist correlation by being so dumb that even they don't know if they know your Facebook keys, until Facebook says "Hi, do you know the keys that go with this cookie?" when you try to log in as you.

You can somewhat defend against correlation attack in SSH if it worries you by the way, by explicitly configuring a particular public key for each connection and forbidding the client from trying other keys (which it will by default) using IdentitiesOnly and IdentityFile in OpenSSH.

<comment><USER2> SSH supports multiple methods of authentication, including challenge-response authentication, which is specifically designed for the kind of exchange that FIDO2/CTAP uses.

<comment><USER4> Blergh. RFC 4256, which I'd guess is what you're thinking about, aka keyboard- interactive - is completely unsuitable for this purpose and certainly wasn't "specifically designed" for it.

In fact RFC 4256 pretty much spells out what it's for, it lets you use PAM to augment your authentication policies by changing what the remote user types into their console. You can add a One Time Password check or whatever.

It is full of requirements like "A command line interface (CLI) client SHOULD print the name and instruction (if non-empty), adding newlines" which have nothing whatsoever to do with the actual problem for Security Keys.

Of course you could _add_ a new SSH authentication method, but the existing RFC 4256 "challenge-response" approach is completely inappropriate.

<comment><USER2> Good to know, thanks, I didn't know challenge-response support in sshd was specifically tied to RFC 4256.

With that said, I suspect it could be retrofitted for this purpose.

</comment></comment></comment></comment></comment></comment><comment><USER5> i bought a yubikey to do this. and after a while installing gpg and creating master keys and subkeys, and dealing with the usual 'there are 4 different verions of recipes to do this and none of them seem to work anymore', i gave up.

this seems like such an overwhelmingly common use case I dont understand why yubico doesnt make this as frictionless as possible. i understand that the smart card spec is probably a hindrance, but still..

but its still on my (physical) keychain, looking forward to trying your non- gpg workflow. thanks for posting.

<comment><USER6> I almost gave up too, but after (admittedly) a lot of battling I finally got GPG to work well with my yuibkeys, allowing a portable SSH/GPG identity using a single yubikey over several machines.

I also got GPG agent forwarding to work transparently and with improved security by forwarding a dynamically created unix socket instead of a TCP socket. It allows me to do remote code signing, as well as chain through a bastion host.

Aside from jamming up with ansible occasionally, the setup is reliable.

I've documented the process for my own reference as much as I could here (yep, a fifth guide): [https://github.com/naggie/dotfiles/blob/master/etc/yubikey.m...](https://github.com/naggie/dotfiles/blob/master/etc/yubikey.md) \-- see functions.sh in the same repository for some mechanisms to automatically manage gpg-agent and the sockets without getting deadlocked.

I hope someone finds this useful. I'll certainly be trying the opensc method here though, out of interest.

<comment><USER7> You're talking about forwarding the GPG agent, so I was worried that you hadn't found the touch-to-sign setting, but indeed you had.

Do you have a strong opinion on `on` vs `fixed` ? I tell myself that I should use fixed but haven't bitten the bullet yet.

<comment><USER8> I set it to `on`. I read somewhere on internet an argument why `fixed` is not really necessary: for setting it back to `off` you need the admin PIN, and you have only 3 tries (by default) for the password. So I am not really worried about someone managing to disable it. And that keep the possibility to change my mind later on open, without having to reset the key.

<comment><USER6> I have it on -- if my Yubikey is locked out or lost, it's not a problem as I have a backup of the master key in my safe. I could revoke the subkeys if the yubikey is stolen, or trust that whoever finds the yubikey has only three attempts on the pin.

Also I further mitigate the risk by having an explicit wrapper (gssh) to be selective about when I forward GPG/SSH agent.

</comment></comment></comment></comment></comment><comment><USER9> If you are OK with using PGP keys, there is an excellent guide at [https://github.com/drduh/YubiKey-Guide](https://github.com/drduh/YubiKey- Guide) — I've been using this kind of setup for almost a year now and it works really, really well. Highly recommended.

Be sure to set the Yubikey to require touch.

As a side note, the author writes:

> GnuPG's user interface is a disaster

Well, I'd say the procedure described in the article is a strong contender, too :-)

<comment><USER10> I used this too, it was great and works flawlessly. I found the author's reasoning unconvincing (and not really argued at all).

</comment></comment><comment><USER11> As I'm currently working on possible options to expose on-device keys and cryptography for our open source FIDO2 key (SoloKeys) beyond the FIDO use case, I'd be curious about opinions on just exposing and using the PKCS#11 API (Cryptoki) [0] directly.

Envisioned setup would entail: download (custom) `libsolo-pk11.so`, generate RSA or ECDSA key on the USB key, get public key via `ssh-keygen -D libsolo- pk11.so`, use via `ssh -I libsolo-pk11.so email@example.com`.

The equivalent thing can be done for TPMs with simple-tpm-pk11 [1] today.

Technically, I'd extend the FIDO2 CTAPHID transport with "vendor commands" [2] mapping the basic Cryptoki API, and call that from the custom PKCS#11 shared library, which is then just a simple shim/wrapper. No additional drivers needed (everyone has HID).

Issues I can foresee: Users too attached to GPG workflow. Installation of custom shared library. No SSH support (via PKCS#11) for Ed25519 yet. SSH support for ECDSA only in about-to-be-released OpenSSH 8.0. Vanilla PuTTY on Windows has no PKCS#11 support. Bad rap of PKCS#11 due to existing vendors adding proprietary and closed source extensions. And the fact that SSH (currently) presents _all_ keys to the host - I'd really like to be able to specify which key to use.

Personally, I'm a bit allergic to the GPG/PCSC/PIV/CCID way of doing things... My itch-to-scratch is just having a few keys off my computers (in particular, portable), and perform (infrequent) signatures on the separate device. And do this via a (comparatively) sane, open standard.

[0] [http://docs.oasis- open.org/pkcs11/pkcs11-base/v2.40/os/pkcs1...](http://docs.oasis- open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html)

[1] [https://github.com/ThomasHabets/simple-tpm- pk11](https://github.com/ThomasHabets/simple-tpm-pk11)

[2] [https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido- cl...](https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to- authenticator-protocol-v2.0-rd-20180702.html#usb-vendor-specific-commands)

<comment><USER12> Personally I'd prefer as open a standard as possible usable across the greatest swath possible (e.g. Chrome Windows/Mac, Chromium Linux, Firefox W/M/L, Android Chrome/Firefox).

Someone else seems to second lower-level standards as the best way [1].

[1]: [https://news.ycombinator.com/item?id=19567277](https://news.ycombinator.com/item?id=19567277)

</comment></comment><comment><USER13> I love using the Yubikey Neo with NFC, having my GPG Keys on it and using it also for SSH connections, but mostly I love it for the OTP Feature.

Mostly using it on my Nexus 5. It is great, because using it by NFC with Open Keychain and k9 I do not need to place my private key on the phone. Additionaly that works also great to use the Yubikey to unlock the Phone and also using it on the Yubico Authentificator for the OTPs.

That keys are really great. Love them.

The only other Tool I would recomend with similar features is the Nitrokey ([https://www.nitrokey.com/](https://www.nitrokey.com/)) but the Disadvantage is, that they really lack on some features. But maybe a good alternative for GPG and SSH.

The advantage of the Nitrokeys are, that in compare to Yubico products they use open hardware.

Hope this helps out some people.

And, for everybody who is struggling on the usage, belive me, I spend over four years making everything work and some really frustrating time reseting stuff, building keys, fu*... up big and recover Accounts :D

<comment><USER14> > Mostly using it on my Nexus 5. It is great, because using it by NFC with > Open Keychain and k9 I do not need to place my private key on the phone.

And with TermBot you can use Yubikey to login via SSH. Can come in handy in trouble.

</comment></comment><comment><USER15> I second using opensc over gpg.

GPG was a nightmare with it's own particular way of doing things and general refusal to help other projects.

Their scdaemon takes exclusive use of the card and when this has been brought up with the project, they said other projects should use their scdaemon to inferface with cards rather than PKCS11 and opensc.

<comment><USER16> This was exactly my experience from two years ago. But to my surprise with recent gpg2 versions most of those issues are gone (plus EC ssh key files are supported, older gpg-agent could only do RSA)

scdaemon used to crash all the time, that doesn't happen anymore. GPG doesn't lock the card so I have to stop scdaemon to use it w/ other apps.

So for the last half year I've happily used gpg-agent/scdaemon also as SSH agent and it works really well without any issues.

But setting this up (w/ Ubuntu+Gnome) is still a ridiculous task:

\- Ensure gnupg2, scdaemon, pinentry-gnome3 are installed

\- cp /etc/xdg/autostart/gnome-keyring-ssh.desktop ~/.config/autostart/

\- edit ~/.config/autostart/gnome-keyring-ssh.desktop and add "X-GNOME- Autostart-enabled=false"

\- edit ~/.gnupg/gpg-agent.conf and add "enable-ssh-support"

Gnome session startup will read both the "X-GNOME-Autostart-enabled=false" and the "enable-ssh-support" and set up and start gpg-agent as ssh agent in the session. There are other ways to disable a .desktop file, but the String "X-GNOME-Autostart-enabled=false" has to be there for this to work.

When all this is set up usability is excellent. the system will even prompt to plug in the right yubikey when you ssh into something. No need to add/remove the card to/from the agent.

<comment><USER17> And yet, scdaemon will still hang everytime you suspend on linux[0]. I've written a udev rule to somewhat mitigate this[1], but it's still really annoying that seemingly nobody cares enough to fix this issue.

[0] [https://wiki.gnupg.org/SmartCard#Known_problem_of_Yubikey](https://wiki.gnupg.org/SmartCard#Known_problem_of_Yubikey)

[1] [https://github.com/Tharre/pkgbuilds/blob/master/arch- system/...](https://github.com/Tharre/pkgbuilds/blob/master/arch-system/etc- yubikey.rules)

</comment></comment></comment><comment><USER18> I really loathe the fact that I can't just enroll 3 Yubikeys (or the equivalent) for an employee (1 to be used, 1 for backup, and 1 extra in case the backup fails) and be done with security for _everything_.

I'm not even requesting that I as the issuer be able to subordinate those keys. Just make them work without making me want to shoot anyone who mentions the word "security".

The security folks whine that nobody does security, but they sure don't make it very easy to do so when someone wants to.

<comment><USER19> We had a very good system at Google and I think there are papers floating around about how it worked. You authenticated once per day per machine, and occasionally privileged operations would require human presence detection by pressing the security key. ssh, web... everything, all integrated. I wish we had the same system at my current job, but alas, much programming would be required.

I believe Google sells a product, the "identity aware proxy", that is very much like what existed internally. I haven't used it, so am unsure. But it sounds great.

<comment><USER20> Sounds like you're talking about BeyondCorp?

[https://static.googleusercontent.com/media/research.google.c...](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/44860.pdf)

<comment><USER21> AFAIK, it's part of the BeyondCorp initiative, which started as a way to give trusted access to devices on untrusted IPs. GP here is talking about the individual hardware dongles that are make the feat possible today:

[https://www.businessinsider.com/none-of-googles-employees- ge...](https://www.businessinsider.com/none-of-googles-employees-get-phished- because-of-yubikey-security-key-2018-7)

</comment></comment></comment></comment><comment><USER22> I'm amazed this is so complicated. I recently used [https://github.com/sekey/sekey](https://github.com/sekey/sekey) to set up SSH with TouchID on a mac, and was really surprised how simple it was.

<comment><USER23> As a 10+ year smart card crypto specialist I absolutely LOVE sekey

</comment></comment><comment><USER24> This article was featured on BSD Now, a podcast that I would recommend to anyone interested in using any of the BSDs: [https://www.freebsdnews.com/2019/03/21/bsd-now- episode-289-m...](https://www.freebsdnews.com/2019/03/21/bsd-now- episode-289-microkernel-failure/)

<comment><AUTHOR> Thanks for this! I used to listen to this regularly but fell out of the habit a couple years ago.

</comment></comment><comment><USER25> I've configured gpg to use keys from "smart cards" before, and didn't really fall in love.

After the setup, things worked ok, but there were a few limitations that made me more happy with just having the key on my computer.

The primary was that I had no way to validate that the key material was encrypted at rest, and no documentation even appeared to make claims about how the key material was stored. My setup used a fairly long PIN to replace what would have been a fairly long password for decrypting the key material stored on my computer. I wasn't really comfortable with using something simpler as a PIN.

It may be the case that I could have leaned more on the hardware for security and told myself that the limit to the number of password attempts should allow for a shorter PIN to be used. But I was looking for something that I could add as another layer to my existing process, rather than something that replaced it.

At the end of the day, using a smart card to store key material just made it harder for me to reason about the security of the key material itself due to the increased number of unknowns. And it was more inconvenient.

</comment><comment><USER26> I was frustrated with the complexity and automated the process. Unfortunately even automation doesn't protect you from the complexities of GPG, but it does help. This is the tooling: [https://github.com/ixydo/gpg-smartcard- automation](https://github.com/ixydo/gpg-smartcard-automation)

</comment><comment><USER27> I have been doing this for a little over a year now. The most difficult/frustrating thing was using it on my phone. Luckily, TermBot [0] solved that, allowing me to choose an external agent for my key with OpenKeyChain [1]. A Yubikey 5 with NFC and I feel real futuristic tapping my phone to my pocket to gain access to remote computers. I get to do this with my password manager too [2].

[0] [https://f-droid.org/en/packages/org.sufficientlysecure.termb...](https://f-droid.org/en/packages/org.sufficientlysecure.termbot)

[1] [https://f-droid.org/en/packages/org.sufficientlysecure.keych...](https://f-droid.org/en/packages/org.sufficientlysecure.keychain)

[2] [https://github.com/zeapo/Android-Password- Store](https://github.com/zeapo/Android-Password-Store)

<comment><USER28> I have been waiting for this for so long! Thank you so much for these links!

I have Pass working but SSH was always a glaring missing piece of the puzzle. Now if only I can convince an SFTP client to do this, I'll be really sitting pretty.

</comment></comment><comment><USER29> Remember to buy two devices and to swap usage every month. If one breaks you loose access since the keys shouldn't leave the device. Use two and always setup two keys .

Oh and the yubikeys nowdays are closed source. If you want actual open source hardware and software, checkout the Nitrokey Start. It's cheaper and fully open source, hard and software. Its an openpgp token: [https://raymii.org/s/articles/Nitrokey_Start_Getting_started...](https://raymii.org/s/articles/Nitrokey_Start_Getting_started_guide.html)

If you want a smartcard, Nitrokey had Both the pro and the HSM. An openpgp smartcard and and smartcard-hsm (just pkcs#11).

</comment><comment><USER30> In addition to using YubiKey's U2F capabilities, I've been using its HMAC-SHA1 challenge-response mode as my password manager (more precisely a password generator) for the past few months.

It uses these 3 to consistently generate a password for websites:

1\. A secret that I've pre-programmed in the YubiKey (+ 2 other backup YubiKeys)

2\. A "pin code" (either provided by me, or in my case - protected by my TouchID)

3\. The website's name

If you want to take a peek, I always appreciate feedback. [https://github.com/noliran/ykpass](https://github.com/noliran/ykpass)

</comment><comment><USER14> > Since nobody can get at the ssh key thats in the Yubikey, a short pin will > be fine - at least that's what the system promises.

Short pin is fine because after 3 tries the token is locked.

On the other hand there are no limits with software keys.

</comment><comment><USER31> I love my Yubikey for SSH auth, but it's a complete pain in the ass that gpg- agent and OpenSSH won't play together on Windows. I and others have tried to make broker apps that let them talk with each other but to no avail thanks to libassuan's Windows "workaround" for AF_UNIX sockets.

In the end, I have to use gpg-agent's PuTTY support, which means no command- line SSH, only a separate PuTTY window when I want to do SSH sessions, and using plink for SSH auth for Git.

</comment><comment><USER32> If you have a newer MacBook with TouchID, you can get similar benefits using [https://github.com/sekey/sekey](https://github.com/sekey/sekey). Arguably better, because access is backed by biometrics (TouchID) so it's "something you are" (fingperint) + "something you have" (laptop) and quite a bit simpler than setting up GPG backend SSH keys.

<comment><USER33> Uh, what?

You're just combining "something you have" \+ "something you have". Unlike with a Yubikey, your fingerprint will always be with you when you have your laptop.

Biometric access is a terrible idea if you don't combine it with "something you know". Access to your laptop can now be coerced or compelled at any time.

Every commercial biometrics system I've ever seen that's worth a damn at least combines it with a pinpad.

<comment><USER32> Obviously, depends on your threat model. I'd argue that being physically coerced ends up being a pretty low risk for most people. If you're just looking for something better than storing private key material on a hard disc, sekey is a pretty great alternative to using Yubikey + GPG.

</comment></comment></comment><comment><USER34> There seems to be an opportunity here for someone to create the "Algo VPN" version of Yubikey SSH.

Or maybe the Teleport people can just make this as painless as possible.

Or for keybase to make it painless. Don't try to support everything. Just start with only supporting Yubikeys. Then you can expand.

<comment><USER35> Whoever does this -> I would love for the ability to backup my ssh and gpg keys using backup words, similar to what cryptocurrency wallets use (24 words that are used to define the entropy).

</comment></comment><comment><USER36> Funny, that's exactly what we're doing at work right now: we're adapting our JavaCard applet to use them with Yubikey, to be able to use the Yubikey like a smartcard, including public key authentication.

</comment><comment><USER37> Earler discussion on HN:

[https://news.ycombinator.com/item?id=19340638](https://news.ycombinator.com/item?id=19340638)

</comment><comment><USER38> Speaking of Yubikeys: I found a Yubikey lying somewhere. I asked around, no takers. Is it safe to use such a Yubikey? It'd be a shame to waste it.

<comment><USER39> You have what appears to be a Yubikey. Many devious attacks involve dropping a device that LOOKS like a generic USB drive in a public location.

<comment><USER40> If the device is U2F capable, you can check whether it is genuine [0]. Of course, if it is not genuine, it can own your machine the moment you plug it in.

[0] [https://www.yubico.com/genuine/](https://www.yubico.com/genuine/)

</comment></comment></comment><comment><USER41> This is for OpenBSD. What about for us lowly Debian users? Anybody know how I can do something similar? :)

</comment><comment><USER42> After using one for over a year now all I can say is it shouldn't be this hard :(

</comment><comment><USER43> This is awesome. I've played with something similar and have been thinking about automating some of this process to give small startups a really lightweight way to on-board this kind of capability for physical + PIN multi- factor SSH access.

</comment><comment><USER44> What happens when I loose the yubikey

<comment><USER45> You have a spare and revoke the ability to use the one you lost.

<comment><USER44> Ah, makes sense.

I bet most people only buy 1 though

<comment><USER46> You keep a backup of your master key in a secure way (paper key + locker + passphrase)</comment></comment></comment></comment>


Show HN: Land conservation through crowdfunding - <AUTHOR> https://www.helsinkifoundation.org <comment><USER2> If this is successful you should somehow open it to people that have land or want to buy land in other parts of the globe to let it be sold like that.

Which is probably very difficult legally speaking.

Ok, I've changed my mind, maybe there should be an Ethereum smart contract for this.

<comment><AUTHOR> We had dismissed this as too difficult for the moment, so the Foundation must hold the title. Currently we have leads on some land that matches your description, but we need to transfer it to the Foundation.

At some point I'll investigate the Ethereum contract, I don't know anything about it apart from it being blockchain based. Thanks!

<comment><USER2> Maybe in a somewhat near future the smart contract hype will be good advertisign.

</comment></comment></comment><comment><USER3> This seems like a great initiative and increasingly important for future generations - congrats!

I noticed there's a disproportionate number of Australian owners. Any insight why that is?

<comment><AUTHOR> Thanks. Please share if possible.

I'm Australian, so it would be the network effect :)

</comment></comment><comment><USER2> Why isn't that foundation disapearing with our money in some years?

Is that foundation taking government money?

<comment><AUTHOR> Great questions.

The foundation is specifically designed to avoid problems like hostile takeovers, etc. In the agreement between you and the Foundation when you purchase a Greenspace, you get a veto voting right for any change in the purpose of the land. So, even if <bad company x> buys all the other ones, you can stop them.

Anyone can read the statutes here:

[https://www.helsinkifoundation.org/Helsinki-Foundation- Statu...](https://www.helsinkifoundation.org/Helsinki-Foundation-Statutes.pdf)

No government money. It is totally free market conservation. We buy the land, people choose to buy Greenspaces if they want to.

</comment></comment><comment><AUTHOR> Hi folks. This is a non-profit I'm involved with. I would be happy to get HN'ers feedback here. I'm trying to feed the YC knowledge and other HN info to the other founders.</comment>


How do I make my mark? - <AUTHOR>

Its a rhetorical question.
I want to state something to the HN community who I think shares the same interest in people who inspire and break ground in almost anything they do.
I watched the Charlie Rose interview with Jay-Z yesterday (http://www.charlierose.com/view/interview/1211).  If you like rap or not you've got to hand it this guy.  He started selling crack then became one of the most successful rap artist/entrepreneurs in history.  I just can't get enough of these life stories.  Game Changers (http://www.bloomberg.com/tv/shows/game-changers/) is another show on Bloomberg which has had episodes about Steve Jobs, Larry Ellison, the Google founders, and Mark Zuckerberg.
Now each time I see these inspirational stories I feel amazing!  I feel great for them and I think its a reflection on all of us, of who we are as a species.  Humanity is capable of amazing things and its successes are a celebration of life.  We should all share in these inspirational stories as if they were our own.
On the flip side, I also yearn to be an inspirational story to others.  I often ask myself, 'How can I change the world?'  How can I make my mark?  The feelings to do so are so strong in me that it makes me sad that life might pass me by without ever doing so.
Does anyone else ever feel like this? <comment><USER3> I think we all feel this way sometimes. After a good event or conference, I can be all pumped up. Call it an event high fructose corn syrup high. The key is having a purpose - working towards it - on and off, all your life - you all know what you are good at. Some of you are excellent communicators, hackers, designers. Some of you don't know yet. That is fine.

All of us change the world. Some of us have a bigger platform to do so. All of us can make a bigger platform for ourselves. Fame, wealth, personal power are all ways to increase our platform. But the best way to increase our platform is to encourage and inspire others, to bring together people, to build a community.

For example, do you want to speak at Ted? It's simple but not easy. Become one of the best in the world in your particular field. You can have a much more direct impact by simply taking time to volunteer with those who don't have the skills you take for granted. That's a cliche. But a lot of people don't have your skills and you might be able to work in symbiotic fashion. Similarly, you can ask other people who have the experience, connections, skills for help. People love to help. In fact, it is a psychological conflict that asking someone 'higher' than you for help makes you look better than if you were try to do something for the person higher (asking a favor vs doing something for them).

As software developers, as another HN commenter said, we have unprecedented access to power to affect the world, to grab a bit of its attention. Most of us can or know someone who can create a website/app that can be scaled up to be used by thousands of people, within hours of its genesis.

Aim for being the local maximum. Be the guy or girl who co-organizes events, throws parties, brings people together. It is very hard to be the global maximum (that is like POTUS - President of the United States). It is definitely attainable to be one of the local maximums (leader, board member, advisor).

It is very hard statistically and numerically speaking to be a Mark Zuckerberg or a Jay-Z. They are literally one in hundreds of millions or one of a billion. But you can affect the world around you, in a positive feedback cycle. Stop fearing what you fear and do it. Keep the motivation going (take it with a grain of salt, particularly the self-help blogs/podcasts - <USER2> that not everything is sunny-side up all the time), listen to Ted videos, Charlie Rose (rocks).

For more inspiration of the entrepreneurial kind, check out Stanford's mother lode of entrepreneur lectures and interviews:

<http://ecorner.stanford.edu>

</comment><comment><USER4> Self-plug:

I gave a Toastmasters speech on this topic titled "I Don't Want to Change the World" - <http://www.youtube.com/watch?v=Jkct9OcTKRI>

Changing the world is overrated. It puts an incredible amount of pressure on you and may take you in a direction you don't want to go. Do what interests you.

(There may be irony in this advice)

</comment><comment><USER5> "Does anyone else ever feel like this?"

Yes, lots of people to varying degrees. Start by scratching an itch and have laser focus on this singular issue. The market rewards value.

Have a story to tell and work towards positioning yourself as a leader in a field.

</comment><comment><USER6> Yes, that's part of why I just posted about how I need a cofounder to start a company, lol. I didn't watch the Jay-Z interview, but I'm going to check it out, thanks for the post.

</comment><comment><USER7> <http://lesswrong.com/lw/373/how_to_save_the_world/>

</comment><comment><USER8> In my teens, I had a boatload of academic awards. There was a lot of social expectation (pressure) in terms of me Being Somebody Someday. I passed on a status-y scholarship, dropped out of college, and did the wife and homemaker thing for a couple of decades.

As a teen, I fixed my dad's back. He had been bedridden for short periods about every other year due to his back problems. When I was 17, he was so bad, for the first time ever he was unable to make it to the bathroom a few feet from his bed. They got him a bedpan. I spent 2 weeks using intensive gymnastics stretching techniques to get him back in normal range of motion, modified the doctor prescribed exercise sheet, and spent 6 months doing daily massage. He threw out the "corrective shoes" they had prescribed. His back problems never came back.

With that experience, I seriously considered going in to medicine. At 17, while filling out my college applications, I had two majors I was considering: Physical Therapy or Geology. I interviewed an actual physical therapist and discovered it wasn't what I was envisioning. So I put down Geology for my desired major.

Years later, I enrolled in an environmental studies program. In many colleges, such programs grew out of the Geology department or something closely related. And then I had a major health crisis and spent a year at death's door. Doctor's told me "People like you don't get well". I've been getting well for some time now -- which I don't think would be possible had I gotten some kind of medical degree because I would have the same training and thinking of the people who claim I can't get well.

So, I've done something pretty amazing. And it mostly isn't welcome news in online communities for folks with my condition. I get accused of being a liar, a charlatan and a snake-oil salesman.

I don't know if I want to Make My Mark. I don't feel I have anything to prove to anyone. I didn't get well to impress anyone. There is apparently no money in trying to help others who are suffering horribly and dying. There is not only no money but I get routinely kicked in the teeth and very few people are at all interested, so all this crap isn't even accomplishing anything. So I spend a lot of time wondering if I should bother to keep trying to find a way to more effectively share information about how I got well or if I should just leave these hostile people to their dire fate while I go off to make money rather than my mark.

I don't have any answers. I wish you well in your journey.

</comment><comment><USER9> I'd ask the question: do you want to do something important/big, or do you want to be famous? There's a difference.</comment>


Spectacle.io - API for grabbing relevant images from any Web page - <AUTHOR> http://spectacle.io/

<comment><USER2> Love the concept as I was looking at an API for this :) might be cool in the future if you guys can do re-sizing/cropping in the future too.

<comment><AUTHOR> Thanks Tim, that's great to hear!

We have a separate service for resizing and cropping which isn't featured there. Feel free to say hello, we'll be happy to learn about your usecase and if possible offer some free help and pointers.</comment></comment>


Facebook Building Cryptocurrency-Based Payments System - <AUTHOR> https://www.wsj.com/articles/facebook-building-cryptocurrency-based-payments-system-11556837547 <comment><USER2> .. on the same day the 'undesirables' are banned.

+1 for 'social credit score', USA style.

<comment><USER3> Facebook is not the government, a payment system is not the same as credit, and deciding not to broadcast something is not censorship.

<comment><USER2> True, and i technically don't need a social security card, bank account, and can use cash. But I'm hugely disadvantaged, blocked from certain actions, and potentially put under suspicion if I operate in this fashion..

<comment><USER3> I'm not sure what kind of connection you are trying to make here.

<comment><USER2> that this could be used to form the basis for a social credit score, _" USA Style"_, much like bank accounts, SSNs, etc. are required to function in the 'free market' economy?</comment></comment></comment></comment></comment>


YC Fellowship rejection letter - <AUTHOR> Thank you for applying for Y Combinator Fellowship. However, your startup was not selected for an interview. We thought your application was very promising -- out of over 6,500 applications, yours made it to the final 300.
Since there is a limit on the number of startups we can accept for this beta test of the Fellowship, we had to turn away a huge amount of promising groups. Hopefully in the future, we can expand the Fellowship and fund even more companies this way.
Unfortunately beyond that, we can't give you individual feedback about your application. This page explains why: http://ycombinator.com/whynot/
That said, we sincerely hope you'll apply to YC's winter batch. Applications for that are scheduled to open the week of August 24th. <comment><USER2> Thank you for applying for Y Combinator Fellowship. We're sorry to say that your startup was not selected for an interview. We read through more than 6,500 applications, and since there's a limit on the number of startups we can interview, we had to turn away a huge number of promising groups.

Unfortunately we can't give you individual feedback about your application. This page explains why: [http://ycombinator.com/whynot/](http://ycombinator.com/whynot/)

We sincerely hope this won't stop you from pursuing your startup. We're not yet sure if we'll continue to do YC Fellowship past this pilot program, but we definitely welcome and encourage you to apply to YC in the future. Having applied to YC Fellowship will in no way count against you, and a surprisingly large number of companies are funded after applying to YC programs more than once.

We're trying to get better at this, but it's certain that groups we rejected will go on to create successful startups. If you do, we'd appreciate it if you'd send us an email telling us about it; we want to learn from our mistakes.

</comment><comment><USER3> Thats cool! so, the normal rejection letter means that we didn't make it into top 300 and that we are not potential YC's Winter 2016 batch. It's really such a pity that there is no real feedback that could help to improve pitch/business model ...!

<comment><USER4> Have you done a ShowHN / AskHN? I'm not sure how good the feedback is, but it seems rigorous in the showHN threads.

<comment><USER3> Thanks Dan! Thats a good idea. I will do that!

</comment></comment></comment><comment><USER5> Guys, a really important thing I noticed here, and please tell me if this is consistent with what you did: Applying late is bad for YC, especially in this fellowship case.

I got this rejection letter, and there was no evidence my application was even looked at. I didn't apply literally at the last minute, but I submitted the last day.

I had applied for summer YC batch before, and there I got people thoroughly exploring my demo, watching my app videos, and even looking at my linkedin profile. This time I got 0 hits across all mediums. Not even the video.

Please share if you had similar or difference experience as I think we will all benefit from this knowledge.

<comment><USER6> I believe this too. I wasn't expecting for there to be so many applicants, given that the application was open for only one week; I certainly learned my lesson. I read on another article that they only accepted 20 teams out of the 6500 pool. I can only imagine that they came across these teams early on and didn't pay a lot of attention to the rest of the pool, especially one's like mine where, now that I look back on it, my application was not ready for submission. When I read what I wrote, I used way to many "weasel words", as PG would say, and didn't state clearly anything in my application.

So to anyone reading this, if you apply to YC, make sure you do these two things: 1) Have a clear, well-written application that states your idea and your background clearly. 2) Start your application early and submit it early. This is one of those things that can only help you.

<comment><USER7> We did read every single submission. That doesn't mean we watched every demo / intro video (even for some invited to interviews), but we read everything.

I hope you'll still consider applying again in the future.

<comment><USER6> Sorry about the assumption. That's actually pretty amazing that you guys managed to read through every application. Even though I was rejected the application was still worth doing because it forced me to think thoroughly about my product. I will still apply in the future.

</comment></comment></comment></comment><comment><USER8> Thank you for applying for the Y Combinator Fellowship. We're sorry to say that your startup was not selected for an interview. We think your startup would be more appropriate for YC's Winter 2016 batch, and we encourage you to apply.

The startups we have invited to YC Fellowship interviews are primarily founders in the idea or prototype stage, and most are first-time founders who haven't previously raised funding. We're asking almost all companies that are further along or with more experienced founders to apply to YC winter batch.

Applications open the week of August 24th at apply.ycombinator.com. We sincerely hope you will apply!

<comment><USER9> We received the same. Do you think they are being honest with this one? Maybe we have a chance for the Winter batch.

<comment><USER8> We hope so, we'll reapply for Winter. Good luck to you!

<comment><USER9> You too, mate!

See ya.

</comment></comment></comment></comment><comment><USER10> Made it to the top 300 (5%), so I'm satisfied with that. I think I'll improve my application and apply to the winter batch.

<comment><USER11> How do you know? I don't mean to be rude but I'm just curious as someone who applied and was rejected.

My team and I are planning on continuing on. Good luck to everyone else who is in the same boat!

<comment><USER12> Sam A. said that they received around +6500~ applications, so being in the top 300 would make you in the 5%

[https://twitter.com/sama/status/626523690533027840](https://twitter.com/sama/status/626523690533027840)

<comment><USER11> Awesome. Thanks!!

</comment></comment></comment></comment><comment><USER13> That's something! And I truly believe they don't just say these things, they know that people can turn their startups around, so hopefully it will be a more attractive application the next time you apply.

</comment><comment><USER14> looking at some applications that got into YC (not fellowship though), it seems biggest 'mistakes' are 1 - wasting even one word not sharing more, enthusiasm hurts you in this case; 2 - technical founders, 3 - team of COfounders. I believe you can pass with one of those 3 'rules', but just the one. Nevertheless, I'll love to help them learn from their mistakes.

</comment><comment><USER15> And to think, the odds were still thousands of times better than a regular lottery.

</comment><comment><USER16> So it begins...</comment>


Suburban Lego Sisyphus mows his lawn over and over again / Boing Boing - <AUTHOR> https://boingboing.net/2017/10/17/suburban-lego-sisyphus-mows-hi.html <comment><USER2> Next, a Lego person who bathes despite getting dirty again.

</comment><comment><USER3> one must imagine lawn mower Sisyphus happy</comment>


WikiLeaks releases secret TISA docs: The more evil sibling of TTIP and TPP - <AUTHOR> http://arstechnica.co.uk/tech-policy/2015/06/wikileaks-releases-secret-tisa-docs-the-more-evil-sibling-of-ttip-and-tpp/

<comment><USER2> How is TISA, TTIP and TPP not the foundation of the New World Order?</comment>


Inside Netflix's Plan to Boost Streaming Quality - <AUTHOR> http://variety.com/2015/digital/news/netflix-better-streaming-quality-1201661116/ <comment><USER2> Already submitted: [https://news.ycombinator.com/item?id=10734974](https://news.ycombinator.com/item?id=10734974)</comment>


Flappy Bird Removed - <AUTHOR> http://www.macrumors.com/2014/02/09/flappy-bird-removed/

<comment><USER2> Can anyone explain why the dev did so?

<comment><USER3> Perhaps this is the kind of attention he didn't want. His Twitter timeline makes him sound like a pretty humble indie dev who is more interested in making games fun than making money. I guess the "fun" part doesn't exist when you get death threats.

[https://twitter.com/search?q=%40dongatory%20kill%20you&src=t...](https://twitter.com/search?q=%40dongatory%20kill%20you&src=typd) [https://twitter.com/search?q=%40dongatory%20idiot](https://twitter.com/search?q=%40dongatory%20idiot)

Probably has an inbox that looks similar.</comment></comment>


PayPal terminated my account because I use a VPN - <AUTHOR> https://uwnthesis.wordpress.com/2013/04/08/paypal-terminated-my-account-because-use-of-a-vpn-is-against-their-terms-and-conditions/ <comment><USER2> What did you expect? VPN is a favorite tool for all sorts of frauds.

If your true IP is obscured by a VPN this is just a red flag for PayPal or any other payment processor. Especially if you happen to share the same IP as someone committing actual fraud - which is very much likely if you are using public proxies. Very few legitimate customers pay over VPN.

Do not use VPNs if you do not want to be flagged or blocked.

EDIT1: In response the comments, no I am not sarcastic at all. The number of legitimate VPN users (among general Internet population, not HN) is miniscule and does not justify the financial risks involved. If you are using VPN you are seen as hiding something and flagging/blocking you from sensitive transactions is an obvious response.

EDIT2: I am talking about public VPNs that can be anonymously abused by anyone - where you'd be likely sharing IPs with criminals. By all indications that's what OP was using if he wanted to hide himself. If you use VPN from work or coffeeshop you'll be identified by some innocuous-looking residential / corporate IPs.

<comment><USER3> "Do not use VPNs if you do not want to be flagged or blocked." I hope that was sarcastic.

I do understand that legitimate VPN users are probably a small percentage of Paypal total user base and that a large portion of frauders use VPN (I don't know what percentage of VPN users who paypal are trying to commit fraud, could be the majority, I don't know) But using VPN should cause you to get flagged. It has a very legitimate use. A lot of people use them when on the go to protect themselves while on wifi. I use a VPN all the time when I'm not at home (well aside from working at home which I do over vpn).

I don't see why I should expose myself to avoid being flagged.

<comment><USER4> _I don't see why I should expose myself to avoid being flagged._

Don't you explain this yourself? If few PP users use VPN and a large portion of fraudsters use VPN, I think we can chalk this one up to cold math despite the is/ought problem.

</comment></comment></comment><comment><USER5> HN is running like clockwork, I see. Soon, we'll have another post about how the Apple App Store policies screwed someone else over, complete with the usual hand-wringing and justifications from believers.

Why do people still use PayPal? This stuff is not news.

<comment><USER6> HN is running like clockwork, but it's because everyone has become an entitled developer and not an actual entrepreneur that analyzes a business decision rationally.

Use PayPal or don't. Just don't expect them to let you use it anyway you want.

<comment><USER7> Hey jackass. I am an actual entrepreneur that told PayPal to f'off AFTER they held several weeks of income hostage because I logged in from Shanghai. It's not the "entrepreneurs" that are the problem, it's the fact that a company like PayPal gets away with harming our businesses while catering to grandma's trading beanie babies. Developers and entrepreneurs alike STILL use PayPal -- at least until they themselves get burned. Stories like these are important because it should remind us to tell companies like PayPal where to go.

As far as "entitled" -- hell yes we're entitled. The developers here on HN make the apps that use the services like PayPal -- they/we have a right to demand that PayPal not suck. PayPal has a right to not listen, but we certainly have the right to complain and take our business elsewhere and as a community of spoiled, entitled, not-actual entrepreneurs we should ALL tell PayPal to pound sand.

<comment><USER8> Dude, chill. Downvote for language.

</comment></comment></comment></comment><comment><USER9> [https://www.paypal-community.com/t5/Account-limits-and- verif...](https://www.paypal-community.com/t5/Account-limits-and- verification/Virtual-Private-Network-proxy-use/m-p/284318#M3783)

TLDR: It's against the legal agreement to access PayPal that way.

</comment><comment><USER10> Connecting to a payment service through an anonymizing VPN service (or your own VPN running on some server in a data center) is like walking into a bank in a ski mask. You look like the criminals, and you're likely sharing IP space with them. If you were just VPN'ing to your home or office network, I doubt that would ever arouse any suspicion.

Telling: Type "PayPal VPN" into Google and what you get are VPN services advertising how they help you sign up for PayPal when you're normally forbidden, with FAQ pages like "why is my PayPal account now terminated".

<comment><USER11> From the comments:

 _...I have uber security… and blocks against eavesdropping and MITM, and SSL and AES 256 encryption via an EFF sponsor, who runs a VPN…_ [https://uwnthesis.wordpress.com/2013/04/08/paypal- terminated...](https://uwnthesis.wordpress.com/2013/04/08/paypal-terminated- my-account-because-use-of-a-vpn-is-against-their-terms-and- conditions/#comment-2406)

Looks like they were using a very public VPN that Paypal probably already had pre-flagged for fraud.

<comment><USER12> ... and an incomplete understanding of how a VPN works.

</comment></comment></comment><comment><USER13> FWIW, PayPal's CEO was on HN 6 months ago, promised substantial change, and then promptly disappeared.

<https://news.ycombinator.com/threads?id=davidmarcus>

</comment><comment><USER14> I'm extremely skeptical. Nowhere in PayPal's terms of use does it mention restricting use of a VPN. The only similar restriction I can find is against using an anonymizing proxy which seems like a reasonable restriction.

However I'll take the author at his word for a moment. Judging from the content on the author's blog, I think it's fair to assume he lives in Europe (where PayPal is regulated as a bank). Where does his VPN reside? It's certainly possible that it resides in a region that is regulated differently. One could look at this situation similarly to how YouTube, Hulu, Netflix, BBC, etc, block by region; not because they want to but because they have to. In the case of the mentioned sites, because of licensing terms, and in PayPal's case, because of financial regulations.

<comment><USER15> Pretty sure they interpret a VPN as an anonymizing proxy. Just because you paid for it or it's through your business, it still shows PayPal a different IP address than your true location. Intent isn't the issue, as they both look alike.

</comment></comment><comment><USER16> This is somewhat a flawed argument on Paypal's part. If a user chooses to obscure their connection via a VPN for security purposes but has supplied the appropriate identification needs to Paypal, what is the problem here?

Paypal like any other big corporation has lost touch with its customer base. Its been that way for a long time now, someone needs to come in and beat Paypal in its own territory. Payment providers like Square are still the small time, they're not in countries like Australia or New Zealand or any other first world country that needs some Paypal competition.

<comment><USER17> I'd imagine it's yet another level of fraud prevention. IP information can be quite useful. If a customer does something that limit's PayPal's ability to limit fraud, then PayPal cuts them.

I agree this is hostile and not friendly. But nor is dealing with fraud. I dislike PayPal and avoid them as much as possible, but it's hardly an easy task and I'm not sure other people would do vastly better if they had to operate with the same parameters.

<comment><USER16> It's kind of a steep move terminating his account. My Facebook account was almost hacked once because someone from an overseas IP tried logging in to my account. Facebook waited for me to login via my Australian IP address and alerted me to he fact and asked if it was me, I said no and I assume they blocked that IP. If security is such an issue, why couldn't Paypal ask the account owner if it was himself behind a VPN and to provide some identification documents?

I remember a little while ago having to supply some identifications documents to Paypal (scan of my passport, scan of my assigned credit card with most of the numbers blacked out, etc). If an account owner is willing to provide that information and is say from a country like the United States, Australia or the UK, then Paypal should lower their suspicions.

I can see where Paypal is coming from here. IP scanning is one of many criteria that determines if a user is potentially fraudulent (I've used Maxmind fraud protection before and it operates with similar criteria).

</comment></comment></comment><comment><USER18> Paypal is crap! It's a wakeup call for you to move on to another payment service. They froze my account 4 months ago with over $1k in it. Reason? Because I had a donation button on my site, and my site wasn't a registered non-profit organization. Well no shit, it's a hobby/fan site and I need a way to pay for my servers and such. Not to mention, I did pay taxes on those so call "donation". Sorry for the rant but just move on; you can't win against their stellar dispute department.

</comment><comment><USER19> Would your bank let you walk in and withdraw $10,000 from your own account with a ski mask or panty hose over your head? Even if you knew your account number and password?

Probably not.

<comment><USER20> No, but they'd let you go through the drive-through ATM in a rental car.

<comment><USER21> Perhaps, but there are per-transaction and daily limits on ATM withdrawals.

</comment></comment></comment><comment><USER15> It's like the gun control argument. A microscopic percentage of everyone who has ever purchased an assault weapon has ever committed a violent act. Regardless, the argument is that the potential harm makes banning necessary.

<comment><USER7> Exactly. PayPal would rather just ban the "thing" rather than try to actually do their jobs and solve the security issues. The IP address shouldn't matter -- it's the data that comes from the IP. They want to ban "guns" as a shorthand for actually trying to catch criminals.

</comment></comment><comment><USER22> Is it possible that they are using a VPN service (as opposed to self hosted) and other users of said VPN service have committed fraud and they just drew a bad card in the IP pool pot luck?

</comment><comment><USER23> _sigh_

PayPal is (still) not evil. It charges too much, and does some shitty things, like all companies.

It's ridiculous to jump to conclusions based off a blog post that doesn't even post a copy (redacted if necessary) of the allegedly offending communication.

<comment><USER24> PayPal is evil. They're not evil because of what they charge, they're evil because they treat their customers with utter disregard and contempt.

It appears there's an internal lottery that all their customers play without their knowledge. If your numbers come up, the fuckup fairy will come visit your account and you will have little to no recourse.

<comment><USER25> Agreed.

If you have a website dedicated to chronicling just how badly you suck ( <http://www.paypalsucks.com> ) it probably means you're doing something very wrong.

<comment><USER26> Or it means you are a large company, or are in some way interesting. Google returns many hits for "Apple sucks," and "Amazon sucks," and "Linux sucks."

Seriously, if you _don't_ have pages devoted to how you suck, it means you haven't done anything noteworthy

<comment><USER24> There's a difference between doing something noteworthy and having some irate customers, and doing something noteworthy and almost routinely actively fucking over your customers. One's inevitable, the other's just unnecessary.

</comment></comment></comment></comment></comment><comment><USER27> I am never shocked when people posts these paypal accounts being banned. Stuff like this happens all the time. What did you really expect?

</comment><comment><USER28> Check out Bitcoin, currency for grownups.

<comment><USER29> Until I can walk into my local bank branch (or any of the hundreds of currency conversion stalls that dot London) and ask for a couple hundred satoshis, or deposit bitcoins direct into my bank account, bitcoin isn't ready to be a legitimate alternative currency, let alone an alternative to payment processors such as Paypal.

<comment><USER30> Cash will be dead before you know it. So will ATMs and bank tellers.

<comment><USER29> Would you care to explain why? Cash is really useful, lots of little places don't take cards and couldn't if they wanted to. As much as I despise it, the vagueries of "I owe you four fifty for lunch but all I have is a ten, so take the ten and that'll cover pizza next week." are a nice part of my social interaction with my friends. Electronic transfers (either bank account to bank account or paypal etc.) are useful for stuff >£20 but I can't see myself splitting lunch and going through the (understandably) rigorous security checks my bank enforces to pay a couple of pounds (says the guy who once wrote a cheque for a copy of the i[1] (I'd been given a cheque book by my bank and cheques are novel to me, not having been old enough for them to be anything other than that thing grandparents send you that you can swap for money)).

Bank tellers are useful in that they are a human being with whom I can discuss things about my account with face-to-face, which is useful when something's gone belly-up with their systems and you need a real person who can see you're also a real person and hit the damn thing a few times until it works.

Finally, I'm still going to need a proper bank account for things like credit, overdrafts, standing orders of rent and such to people who haven't moved over to bitcoin yet, not to mention paying my taxes and taking my earnings from companies that pay in pounds sterling, US dollars, euros or other traditional currencies. It only makes sense that instead of holding a mass of bitcoins, that my bank (nominally HSBC for myself) holds a much larger mass and allows me to make payments in BTC much like I would in any of the hundreds I already can. If I wanted to hold BTC myself, then I could open an account in BTC much like I could open a EUR or USD account now.

[1] The i is a 20 pence newspaper by the makers of the Independent. Prior to moving to London where if you're not paying attention you can amass fifteen copies of the Evening Standard whilst walking across the river, I tended to buy a copy of the i every day going into college because it was something I could read entirely whilst eating breakfast and tended to avoid the fluff I noticed in larger papers on slow news days.

</comment></comment></comment></comment><comment><USER31> I think the dwolla.com interface is nice and have good (but limited) experiences with them.

</comment><comment><USER32> The real WTF here is that people still use PayPal.

<comment><USER25> Stripe FTW

<comment><USER33> Useless outside of N.America

<comment><USER7> Braintree can handle it.

<comment><USER34> Completely useless:

1\. None of the ~ two dozen websites I've bought from in the past year supports it (and those are already technical shops). And most importantly, Amazon doesn't support it.

2\. None of the people I've wanted to send money to have it

3\. Never heard of it; why would I trust it? (well, ok, they have some well- known clients, so that gives them some level of trustworthiness)

I am aware it's a chicken/egg problem, but as a user, I don't care.</comment></comment></comment></comment></comment>