Ask HN: I found documents on the backseat of a taxi. Can I legally use them? - <AUTHOR> I have found some printouts. Assuming they relate to some company on the stock market how can I ensure I do not pollute my Intellectual Property / avoid sentencing for insider trading or use of unauthorized information?
General question - what makes confidential confidential?
Is it enough to write it on sheet of paper? And how about other pages that don't have this clause?
General, open-ended question... Thanks. <comment><USER3> I'll answer your question with a situation I had happen to me recently.

Two of us were working at the local hackerspace late night. We had some trash we took out to the dumpster, and we saw a desktop tower. It had a bit of dried mud on it, so it was probably there no more than a few hours.

I take it in, and I put it in the 'dedicated desktop testing area' (read: wherever there was a keyboard/mouse/monitor). I was expecting some massive dead machine. Nope. there was a 80GB hard drive, cd/dvd, RAM, CPU.. Everything was there, and it boot right into WinXP.

Then the ohshit factor came into play. On the desktop there were icons for "Anthem Insurance Quoter", "Blue Cross Quotes".... and Client List.xls.pdf . That list alone had 500 names, SSN, DOB, address, and phone numbers. And there even more files with more identities as well. So, what do I do? Oh, and I also found the agent's name along with his license number. Nifty. He googles to about 2.5 miles away.

So.. is this a discarded machine, or was this a drop site after a theft? I don't know, and powering it up didn't tell me. There wasn't any security on the machine at all, so anybody could have plugged in a USB storage and copied without fear of logs.

I took it to the police. That's not because of the hardware, but because they can alert the users on this machine of possible identity theft and take appropriate steps.

(Yes, I do know where on Tor to sell identities like this. And the quality of these would have been roughly 100$/per. And I'm poor, but damned if I'll be unethical like that.)

</comment><comment><USER4> Why legally?

A couple of days ago I found a wallet with what looked like £40 (Didn't count it), travelcard and bank cards in it. I could have taken the money and put it the rest in the bin.

I could have even skimmed the credit/debit cards and gone on a spending spree!

But I did not.

I went to the local shop and enquired - 'do you know this guy?' The wallet owner actually lived in the flats above the shop and the wallet was returned.

To the owner of the wallet this was an unexpected turn up for the books - <USER2> faith in human nature restored etc. - fine, but not a tangible benefit to me (unless there is a god).

However, there actually is a tangible benefit, one that I did not think of when I enquired in the shop. The owner of the shop now knows that I will do the right thing for a complete stranger that happens to have lost a wallet. Hence, if I lose my wallet and cannot afford so much as a pint of milk, I can expect a favour from him, i.e. some necessities on credit until I can sort out my wallet.

All I am saying is that there may be benefits to returning the documents, benefits that you have not thought of.

<comment><USER5> Does using the information on the document mean whoever misplaced is going to lose something? Probably not. My point is, the OP's case and your example about the wallet are not the same.

PS: if I were the OP I would try to return or destroy them.

<comment><USER4> ...however, my point is that you don't actually know what the benefits are of doing the right thing, except that it is highly likely that there will be benefits, even if small ones.

Conversely, doing the wrong thing probably means that the 'unintended consequences' are bad - getting caught etc.

You could take the documents and through thinking of 'I have struck gold' and nothing else, walk out of the cab and into the on-coming bus, to go under it and be rescued by the paramedics.

However, what I think you are getting at has been discussed regarding music.

Imagine finding a USB stick, making a perfect copy of it. When you get home you find that it contains the latest and as yet unreleased album by your favourite artist. Being good you don't post it onto youtube or even let your mates have a copy. However, even then the record label would deem you a pirate, if they found out. But we have had that argument.

Or...

The financial scenario: you find documents that Google are to make a cash bid for Facebook next week. You sell your mother and buy lots of shares in Facebook. The bid happens and you get to sell your shares, buy your mother back and make a tidy profit. Seems simple, victimless crime!

However, the documents could have been planted there (and elsewhere) by someone in the city with lots of shares to sell and wanting to 'secretly tip' the market so they profit. In this case you lose out on your investment and cannot buy your mother back.

Or Sergei and Brin find they have lost their documents in the back of the cab, see it as an omen, and don't go ahead with the bid.

However, if you did try and return the documents and were successfully able to do so, they might give you a T-shirt and a pat on the back for being good. They might even give you a job.

Here is a joyful parable:

The Parable of the Flowers

Believing in God is to believe in God's presence and uniqueness. This belief saves the person from meaninglessness and from being errant. Assuming that lies would make a person happy is to go after a dream that will never come true. Reality is God's consent.

In old times, there was a sagacious emperor, and his people loved him. But the emperor was enduring an absence; he did not have a son or a daughter. After a while, the emperor decided to adopt a child.

Public criers shouted, "Listen to me people! On Friday our emperor will adopt a child. This child must be a ten year-old boy; our emperor will leave his throne to his foster son, and he will rest. The people who want to give their sons to the emperor should gather in front of the palace on Friday."

Before the crier finished talking, the public square in front of the palace became full of ten year-old boys.

The emperor gave flower seeds to each boy, and declared his condition: "After sowing these seeds and growing them, you should bring me a bunch of flowers. Of whose flowers that I become fond of, that boy will become my adopted son. You have three months; after this period it is our decision to gather in this same place."

Three months passed. The emperor went to the square and saw that the square was full of beautiful flowers with different colors. The boys who had taken the seeds were waiting for the happy moment.

The emperor looked attentively at the boys while passing near them without stopping.

At another corner stood a boy crying who had no flowers in his hands. The emperor went near the boy, and stopped. He asks:

"Why are you crying?"

The boy spoke of his trouble:

"My emperor, the seeds that your Excellency has given me did not grow despite my efforts. I tried everything, but in vain. I am weeping because you will not adopt me since I do not have any flowers."

The emperor replied, "Do not cry because of that, because I will adopt you as my son. Your seeds did not become flowers because I boiled them before giving them to you. These people who have brought flowers think that they can deceive me. Their flowers are not from my seeds. They found them somewhere else" said the emperor and hugged the boy.

"You told me the truth; you did not lie to me. Listen carefully, it is the person who accepts the truth, not the liar, who will become happy in the end."

<comment><USER6> > You could take the documents and through thinking of 'I have struck gold' > and nothing else, walk out of the cab and into the on-coming bus, to go > under it and be rescued by the paramedics.

I'm sympathetic to your conclusion, but this seems spurious reasoning. Why is it more likely that you'd be hit by a bus thinking about how you're going to take advantage of the information than hit by a bus thinking about how you're going to get the documents back to the person?

Unbalanced positive ramifications are most likely to be social.

<comment><USER4> I see your point and it is a good one!

Most people that step out into the road in front of me on my commute are doing the 'ipod shuffle', distracted by text or talking about what they are going to have for dinner. So it isn't as if they are distracted by anything really significant and in some way that is where the danger is - an assumption they can multi-task whilst crossing the road. If they were interrupted by someone calling to say they had won the lottery etc. then they probably would stop in their tracks and not attempt to cross the road there and then.

When I found the wallet the other day I did think whether anyone had seen me and I did think about whether there was CCTV and whether I could get caught had I just taken the money. However I quickly decided that I was going to try and return the wallet. I made a few paces up the road before turning back and going to the corner shop to see if they recognised the guy in the travelcard photo. I was distracted, no question about it, and, had I needed to have crossed a road then I might not have had my wits about me.

So, what would have happened had I decided to take the money? Rather than think about whether I had been seen I would have had to actually check every bit of street furniture for CCTV and every window overlooking me. I would have had to surreptitiously put the wallet in a pocket and gone through the thought process of where I was to dispose of it etc. Maybe, as a result, I would have been extra careful on the road.

However, I believe that cheating/stealing/doing wrong poses an abnormal and detrimental strain to thinking. By analogy, one of my Scrabble playing friends has this habit of cheating. He is a journalist with a considerable vocabulary, with pride to match. Therefore he has to win. However, the rest of us know that he sometimes does things with the letters bag and sometimes we choose to turn a blind eye. The added strain of cheating and not getting caught affects his game meaning that he puts himself at a competitive disadvantage. He can have a rack full of 'Q's and 'Z's and miss a seven letter triple word score word like 'quizzed' because he is more focused on trying to get a 'U' from the bag when there is a perfectly good one on the board already.

To conclude, it is the element of deceit.

<comment><USER7> >To conclude, it is the element of deceit.

And that's what makes this tricky, because stock market situations are so unlike ordinary life. Is there deceit?

The OP has the option of returning the papers as soon as possible, and informing the people he returns them to about his stock market plans. He could in fact tell everyone he meets about his stock market plans and still be capable of a tidy profit.

There's something uncomfortable about the situation, but it's really hard to pin down what it is, and I don't think there's any dishonesty involved.

</comment></comment></comment></comment></comment></comment><comment><USER8> See a lawyer.

Seriously. See a lawyer.

People on the internet are not lawyers; if they _are_ lawyers, their main advice is _go see a lawyer_.

Law is a profession of tiny details with huge consequences. Those tiny details vary from place to place and from subject to subject. Even _lawyers_ have lawyers.

If I learnt one and only one important lesson from my time in law school, it's this: _If you have a question of law, go see a lawyer._

I mean it.

<comment><USER9> If our only understanding of the law came directly from consulting a lawyer, we'd all be very poor and very ignorant.

There is nothing wrong with asking about the experiences of others who may have asked lawyers similar questions, as long as we understand that we should directly seek a lawyer's advice in proportion to what is at stake.

By sharing our legal experiences, we'd all become better at understanding the specific questions we should ask a lawyer, should the need arise.

<comment><USER8> I disagree.

As I said, law varies by place and subject. _Those differences matter_. Some subjects are generally consistent across jurisdictions. Some are not.

Who knows which is which? The professionals.

Who has the knowledge and experience to correctly interpret different experiences in different circumstances? The professionals.

Intelligent people frequently form entirely inaccurate views of subjects in which they are not experts. We mock TV shows for having VB GUIs that track IP addresses. Lawyers feel a bit like this when non-lawyers begin swapping legal advice.

> _By sharing our legal experiences, we 'd all become better at understanding > the specific questions we should ask a lawyer, should the need arise._

Lawyers are not unapproachable gods. They are service professionals like any other. You ring, make an appointment, and talk to them. It's really very simple. They will ask some questions and take some notes. If it's a simple matter they will give a simple answer. If it's more complicated they will ask to get back to you.

Self-help and Stack Overflow is fine for writing most low-risk software, where bugs can be patched. It is a risky strategy with law. Some actions cannot be undone. You can't just revert to the "before I made that legal blunder" branch.

<comment><USER9> It is important that we all have a broad understanding of what is legal, what is not, and where we need to seek advice and proceed with caution. We can then supplement that knowledge with specific legal advice from a lawyer when appropriate.

We cannot possibly achieve a broad understanding of the law if the only knowledge we have about how the law works comes directly from our own personal conversations with a lawyer.

I'm thinking of purchasing a 50 euro piece of software from a company in Germany. Do I need to obtain customs authorization to purchase software from countries other than the US? Perhaps I need a permit to run German software? Maybe it's against the law to even visit a site in Germany unless I'm an EU citizen? Perhaps I need to start paying some of my income and corporation taxes to Germany if my business uses any German software?

If we are completely clueless about what is legal and what is not, the costs of running all of these questions past a lawyer would bring the economy to a halt.

<comment><USER8> Now you're just beating up a strawman version of my advice.

As I noted elsewhere, most legal relationships, transactions, events and conditions exist without ever being noticed or cared about. That is as it should be.

But in cases of high risk or uncertainty, go see a lawyer.

<comment><USER10> I think I understand where you're coming from, but think you're going too far. When you see people asking for legal advice and getting well intended information that is somewhere between useless and dangerous, it seems natural to warn people against doing that. However, there is a healthy space for discussion between the extremes of only discussing the law with lawyers, and credulously believing everything commenters tell you.

The OP would be insane to act solely based on the comments he reads here, but there is value for everyone in having the discussion, even if people give bad advice and then other people set the matter right. All the better if the OP comes back and tells us later how it all worked out. I just sounds to me like you're trying to shut down an interesting discussion. I say "go ask a lawyer, but still go ahead and ask us too!"

</comment></comment></comment></comment></comment></comment><comment><USER11> I think you have this thing backwards. Personally if I found something in a cab my first reaction would be "that sucks, I bet someone is really frustrated about this. I would hate that to happen to me."

Your immediate reaction seems to be "how can I turn this into money without legal consequences?" Did you ever consider just doing nothing? Trying to return them?

</comment><comment><USER12> "Legal" does not necessarily = "Right".

So forget about what's legal and just do what's right.

You are in a unique time and place in history (as evidenced by your presence here) to build something out of nothing and provide great value to others. So why don't you just forget about what you found and instead spend your precious energy building something?

As for the documents, either return them or destroy them and please move on. For everyone's sake.

<comment><USER13> it's not obvious that trading on material, non-public information that you overheard is unethical. it's basically the same thing as winning the lottery, and i wouldn't not cash in lottery winnings because i have the opportunity to build something of great value to others (that's neither here nor there).

it's not even obvious that insider trading should be illegal ([http://business.time.com/2013/07/26/why-is-insider- trading-e...](http://business.time.com/2013/07/26/why-is-insider-trading-even- illegal/)). (not particularly relevant, but i do think certain types of insider trading should definitely be illegal but the scope is debatable.)

</comment></comment><comment><USER14> 1\. The texts are subject to copyright. You have to treat them as you would any other copyrighted text. 2\. You can trade on the information in the capital markets. The information was disclosed to you inadvertently. You are not an insider, you did not conspire with anyone to to violate the law. 3\. The physical papers still belong to the owner. You may have custody of them, but you do not own them. With respect to trading, this is no different than walking down the street and hearing someone say that "Company X is a good buy." 4\. You have a duty to return the documents, but you have no duty not to read them. In fact, you have to read them in order to be able to return them.

<comment><USER15> _You can trade on the information in the capital markets. The information was disclosed to you inadvertently. You are not an insider, you did not conspire with anyone to to violate the law._

Wrong, wrong, wrong! In _SEC vs. Texas Gulf Sulfur Co._ , those who had access to information not available to the general public and who used it to their advantage were seen to be insiders. [1]

In _United States vs Carpenter_ , the judge stated that "It is well established, as a general proposition, that a person who acquires special knowledge or information by virtue of a confidential or fiduciary relationship with another is not free to exploit that knowledge or information for his own personal benefit but must account to his principal for any profits derived therefrom." [2]

1\. [http://www.casebriefs.com/blog/law/corporations/corporations...](http://www.casebriefs.com/blog/law/corporations/corporations- keyed-to-klein/the-duties-of-officers-directors-and-other-insiders/securities- and-exchange-commission-v-texas-gulf-sulphur-co/2/)

2\. [http://en.wikipedia.org/wiki/Insider_trading#Court_decisions](http://en.wikipedia.org/wiki/Insider_trading#Court_decisions)

<comment><USER13> it appears to me that you're misunderstanding those cases.

in texas gulf sulfur, the defendants were officers at the company. they were directors at texas gulf sulfur and they were trading on texas gulf sulfur stock. they have a fiduciary duty to the company that a stranger doesn't have.

that's what the judge in carpenter is referring to. if you acquire the info by virtual of a fiduciary relationship, you aren't free to trade on that info. in texas gulf sulfur, they had the fiduciary relationship to the company because they were officers at that company. not so here.

</comment></comment></comment><comment><USER16> Documents left on a taxi seat can be characterized as mislaid. That is, the paper was intentionally put on the seat and forgotten.

[http://ir.lawnet.fordham.edu/cgi/viewcontent.cgi?article=117...](http://ir.lawnet.fordham.edu/cgi/viewcontent.cgi?article=1179&context=flr)

Confidentiality is a an agreement between parties not to disclose information to a third party.

You are now talking about the unintended disclosure of confidential information.

Since you are not a party to the confidentiality agreement, it is impossible to enforce against you.

As far as insider trader, I don't suspect a random person who stumbled upon such data lawfully could be found guilty of any crime for using it.

Moving from an absolutely legal treatment of the problem to an ethical/moral one. What you want to happen if you were the owner of those documents?

Something to consider.

<comment><USER17> > As far as insider trader, I don't suspect a random person who stumbled upon > such data lawfully could be found guilty of any crime for using it.

That sounds like terrible advice to me. See this for example: [http://www.investopedia.com/articles/03/100803.asp](http://www.investopedia.com/articles/03/100803.asp)

> Oftentimes, people accused of the crime claim that they just overheard > someone talking. Take for example a neighbor who overhears a conversation > between a CEO and her husband regarding confidential corporate information. > If the neighbor then goes ahead and makes a trade based on what was > overheard, he or she would be violating the law even though the information > was just "innocently" overheard: the neighbor becomes an insider with a > fiduciary duty and obligation to confidentiality the moment he or she comes > to possess the nonpublic material information. Since, however, the CEO and > her husband did not try to profit from their insider knowledge, they are not > necessarily liable of insider trading. In their carelessness, they may, > however, be in breach of their confidentiality.

<comment><USER16> I don't think you read that article closely enough, nor my comment for that matter.

Consider this, how would the fact that you took a random ride in the same cab as the "tipper" ever be established? In other words, what would be the basis of the insider information allegation? How would they ever know?

<comment><USER18> If it were worth the trouble: cell phone location records, taxi credit card transaction records, or taxi dispatcher records.

<comment><USER16> Let's say OP discovered a sure-fire way to make money with his located documents and the info they contain. He puts together all the money he can, puts it all into play, and wins huge. What starts the SEC or anyone for that matter into looking at him as an insider? When they do start looking, what ties him to the the taxi at all?

</comment></comment></comment></comment></comment><comment><USER13> you should see a lawyer.

but the black letter law as of when i was a lawyer (2010) is that you can trade on an overheard conversation (see the switzer case involving the famed oklahoma football coach).

you don't have a fiduciary duty to the company and you don't inherit the duty from the tipper because the tipper tipped without personal benefit.

edit a reliable reference (contra some of the other sources cited in this thread): [http://www.concurringopinions.com/archives/2009/08/insider-t...](http://www.concurringopinions.com/archives/2009/08/insider- trading-dear-guy-speaking-behind-me-in-the-loud-voice.html)

</comment><comment><USER19> If no one knows you have the documents, you can probably trade on confidential information, compete with the company, file a patent before them etc, and I think you stand very little chance of getting caught. I'd recommend reading them and burning them so there is no chance you can be connected to them.

But here's the thing ... if you do something you believe is wrong, illegal or immoral, you'll still have to live with yourself. Being human, having empathy (what if you'd lost your confidential papers), being sympathetic and generally operating within the folkways and mores of society serves a purpose. People who can operate without any of these qualities are classified as sociopaths.

So my recommendation isn't to talk to a lawyer, or take any actions related to the papers. Burn them (preferably without reading them) and keep your inward smile. Living with yourself is more enjoyable if you actually like yourself (and find yourself likeable).

EDIT: Posted this at the same time as kefka ... read his response for a real life application of what I've written. And nice to meet you kefka!

</comment><comment><USER20> There are three answers here;

1) You identify the source of the documents (not necessarily who they refer to but who created them) and you return them.

2) You turn them into a nearby law enforcement office and get a receipt.

3) You destroy them and forgot you ever saw them.

#1 it is important to know the source, if you go by the company in the printouts and the source was an SEC auditor who was looking into the company, then returning them to the company being audited would screw up the SEC audit. In #2 it is important to get a receipt because if the documents are part of a larger problem going on you will want to be able to prove you held them for a very short time as you transferred them to the police. Anything else and whether or not you did anything with them you will be part of the investigation. And #3, they were lost in the first place, someone knows they are lost and are dealing with that. That just finishes a path they were already on. [1]

Under no circumstances do you try to profit from the discovery as that will make you a criminal in the eyes of the law. That stuff always turns out badly.

[1] Note my wife suggested that you might give them to the Taxi driver to take back to their lost and found so if the owner called in looking for them they would have them handy.

</comment><comment><USER21> Jacques_chester is correct, but I'll provide an additional warning. If you use the information to buy or sell stocks, and it is confidential and material that is very liky to be a violation of insider trading.

If I were you, I would consider handing back to their investor relations and try to build a new contact. It may work, it may not.

</comment><comment><USER22> I have just found your netbook on the backseat of a taxi with it already logged into your bank account.

So that makes it okay to transfer your life savings to my account, right?

<comment><USER23> Not the same situation at all.

<comment><USER3> No, his netbook+bank account situation does indeed show similarities to the main question.

If you read between the lines, it amounts to "What is the minimum legal standard I have to follow to make money on this questionably gotten X?"

That's a sad question to have to ask.

<comment><USER7> The blame for the sad situation goes to stock markets and stock market regulations in the first place. They make it illegal to _know things about companies_.

</comment></comment></comment></comment><comment><USER24> Somewhat related but tangential:

What would happen if we had a "double blind" system where people could receive insider trading information based on karma points? The idea is that a system would anonymously give out insider trading information to one or more people with the highest amount of karma. The granter of the stock tip would get a corresponding boost (or drop) in karma based on the value of the knowledge but couldn't benefit from the insider information directly with the exception in the future they would have a greater likely hood of getting anonymous insider information based on their karma point count.

example: 1) Alice creates an anomymous tip that Apple stock is likely to drop due to an unexpected sales decrease of the iphone 6. 2) The system establishes an initial weight for the stock tip based on company valuation and reliability of Alice. 3) The system identifies a user or set of users with the highest current karma points. Bob is one of these users. Bob's karma point total is reduced by the value of the recommendation. 4) Later on after banking a large number of points Alice is given a tip that Tesla stock is expected to rise. Alice is able to profit on this insider knowledge without... really having insider knowledge

This is somewhat akin to profiting off of documents in the back seat of a taxi. Since this seems like somewhat of an obvious system I wonder if it is practiced in real life and what law enforcement does to counter it....

</comment><comment><USER25> [ (Ur on HN => ur top 1% of world on # of v v important metrics and intellectual gifts) \+ (Ur asking advice => u have instincts and ability) ] => high oppty cost of ur time.

My_Op => prob huge neg val even thinking about this.

Long Term: moral reasons aside, its simply highly unlikely to net add personal value.

Short Term: payoff is blindingly quantifiable, but lots of hidden costs easy to overlook => not a good likely outcome situation.

Ex 1: "not wasting energy with lawyers" is a luxury, both massively positive value and systematically + tragically under-valued by general people

</comment><comment><USER26> Don't ask around these questions because _nobody knows you have them_.

If only you get rid of the printouts you're safe because nobody can prove anything so basically you're free to do what you _feel is right_. After the printouts are gone and you do happen to remember what they said, there's absolutely no way to connect that _information_ to you.

The owner of the papers might want them back though, so consider that too, please. You can return them in an anonymous envelope if you want your identity to not be disclosed.

</comment><comment><USER27> Question about returning documents: OP stated these are printouts, so what is the point of returning them if the original owner can just print them out again? Wouldn't returning the documents actually put that person in trouble, because their superior will know this information was misplaced - or is it the point to notify superiors?

</comment><comment><USER15> If the information is not available to the general public and you use it, then that's insider trading. Don't use the documents to trade.

If the documents were misplaced, and you take them, then that's theft. Hand them in to the police. Don't use them.

</comment><comment><USER28> What is wrong with you? Ask a lawyer.

</comment><comment><USER29> it is not only a legal question. More importantly it is a question of ethics. Additionally I do not hear anything regarding whether you attempted to return the documents to the company no doubt named within said docs. My recommendation is to return to owner

</comment><comment><USER30> The answer is not to get caught.

</comment><comment><USER31> First thing I would have done, NOT F*CKING POST on HN. The person that lost it reads too and so do his friends.

Second, if you wanted to you might used part of it you would have to be very careful and pair it with something totally yours.

Oh, and laws vary from country to country. Ethics are a different thing

<comment><USER32> Ah, this is very close to >don't be a dick<. Why is it so hard to get people to follow this rule?</comment></comment>


Attribution of the Sony Hack to a Bulgarian Group - <AUTHOR> http://sony.attributed.to/

<comment><USER2> Who cares the evidence is not being shared? Attribution is at anyone's reach now! Customize and run your own Sony Hack Attribution generator at [https://github.com/blackfist/sonyhack](https://github.com/blackfist/sonyhack)</comment>


Corporate users we don't care about you - Says Mozilla - <AUTHOR> http://www.browsomatic.com/2011/06/mozillas-reaction-to-corporate-users.html

<comment><USER2> Corporate users need to seriously rethink their glacial technology adoption cycle. In the BigCos I've worked at in the past, we're usually told it's due to security, yet we're almost always stuck on versions with glaring security holes that were solved years ago.

The problem indicated in the blog post (and the comments) is that the software ecosystem, add-ons, various vendor web sites, etc., take too long to bring up to speed. I can also attest to this, I worked at one organization that was stuck on IE 6 because the bloated and ridiculous expense reporting system wouldn't work on anything newer. They finally had to upgrade to some newer version because a major customer site simply refused to work with IE6 and we couldn't turn in our work. The weeping and whining from the corp IT department over having to upgrade the enterprise lasted for a year at least. It was actually a major contributor to me leaving the company I found it so absurd and annoying.

Strange that the vast vast majority of web sites on the open web don't seem to have a problem with this. Could it be because they write to standards? I always wondered what bizarre things were going on in that old expense system that just _broke_ on new browsers.

<comment><USER3> _> Strange that the vast vast majority of web sites on the open web don't seem to have a problem with this. Could it be because they write to standards?_

I believe ther's a better answer: the owners/operators of the websites are incentivized to update them to current popular browsers. Let's face it, writing to standards helps, but does not guarantee good cross-browser compatibility if the website is somewhat complex.

Also the owners/operator usually are themselves -- or have on hand -- the people that can modify the site's code right away. May have something to do with popular sites being either very simple, or being developed all the time.

To contrast, the corporate IT is the embodiment of ``don't touch it if itsn't broken'' and ``fill in those three forms before you check any new code in'' mindset. Os just outright procurement of huge systems from external vendors with no contractual provisions for updates to match current software.

(which was one of the ills of my previous workplace, _sigh_ )

<comment><USER2> _To contrast, the corporate IT is the embodiment of ``don't touch it if itsn't broken'' and ``fill in those three forms before you check any new code in'' mindset._

I agree 100% with this and I think that _this_ is the mindset that needs to change.

Back in college I took a course in Enterprise Architecture where this mindset was ingrained as good practice. I finished the class thinking that this was all terribly terribly wrong headed.

</comment></comment></comment><comment><USER4> The concern is coming because Mozilla announced that they will soon stop supporting Firefox 4 and the enterprise has a problem with this.

Personally, I'm fully supportive of this. I feel that as the browser world is rapidly changing along with HTML5/CSS3, there's not much room to continue supporting (and thus encouraging continued use of) old browser versions.

If gaining support of the corporate world (which Mozilla has never had much luck getting into) means leaving developers, support and security resources working on old products this really isn't surprising.

<comment><AUTHOR> As I said in the blog post, there may be solid reasons behind Asa's comment. But its not the way to express it. Am I correct?

<comment><USER5> If mozilla genuinely does not consider enterprise a priority, would you really prefer them to give you some bullshit where they pretended it was?

I think the explicit honesty would be pretty helpful for a sysadmin who needs to make decisions about which technology to use. Yeah, it's blunt, but the bluntness does a pretty good job of not encouraging false hope. Obviously the sysadmin would prefer support, but mozilla just gave a very clear and understandable reason why that shouldn't be their priority.

</comment></comment></comment><comment><USER6> It is open source; they are corporate users. Why don't they collectively hire someone to backport security patches? Sounds like a businessmodel to me. You can't really expect support and consideration for your minority use-case for free, if you aren't paying for the software in the first place.

<comment><USER7> This is a good idea. Like an OS-independent RedHat, focusing on the apps.

</comment></comment><comment><USER8> Reading the comments on Mike Kaply's post, this is my favorite quote:

«Alienate the corporate users and you'll alienate home users.»

It appears these corporate IT types honestly don't understand why Apple are doing so well.

<comment><USER9> How is Apple alienating corporate users?

</comment></comment><comment><USER10> There are really two problems here

* enterprise app development that assumes that there will be no need to maintain an application once developed

* corporate IT people needing to justify their existence.

Web applications benefit from being easier to install and can be run from a central location; but, as a result of that you can't just toss the running of an app over to IT. You need a small core to maintain it. For most applications this makes the most business sense as the trade off of having one or two people still on the project is less expensive than having IT manage the installs of native applications. The result of moving the enterprise to web apps should have been a massive shrinking of corporate IT head counts and a small increase in dev head counts. Instead we see them defending their budgets by inserting themselves between the user and the browser and performing these massive test cycles. It's simply an inefficient use of resources cause by enterprise empire builders don't want to see a shrinking of their power.

</comment><comment><USER11> Am I the only one that is skeptical of the quote in Mike's post [1]? "Managing 500,000 corporate users" seems a bit outlandish to me considering that only one corporation in the world seems to have more than half a million employees period. I am not so sure that Wal-Mart has 500,000 corporate users who are affected by browser upgrades.

[1] Linked in the article but [http://mike.kaply.com/2011/06/23/understanding- the-corporate...](http://mike.kaply.com/2011/06/23/understanding-the- corporate-impact/)

<comment><USER8> I don't know which John Walicki the quote is from, but the top result on LinkedIn works for IBM, so it's a possibility that they as a service provider support users of many different corporations on a single product.

</comment></comment><comment><USER12> How is this even a problem to corporate users? If they write standards compliant internal web-apps, they should certainly work even better in newer versions of Firefox.

<comment><USER13> _should_ doesn't mean _does_ , and breaking things for thousands of corporate users is not a good way to discover a regression.

<comment><USER14> Those web startups I keep hearing about that somehow manage to target a large swath of browsers/versions must have tons of people working on the problem!

Snark aside, I think the problem is most large corporations view internal development and network/systems administration as cost centers, and treat it accordingly. Then grouse and complain when things dont work, are fragile, or require additional expenditures to keep apace with more current technologies. Go figure.

</comment></comment></comment><comment><USER7> I would rather see Mozilla focus on the individual end user experience than cater to what some IT dept wants.

Every BigCo I've worked at, IE was the official supported browser. Firefox was the defacto used browser by employees who probably didn't need a corporate IT managed desktop to get their work done.

</comment><comment><USER15> Just curious, but how does Mozilla know that corporate users make up such a small minority?

<comment><USER3> It's not that all corporate users lumped _together_ are small minority. I'ts about the 500.000 number quoted by one of admins as their corporate user count.

Comparing single corporation with all the other users is a valid argument, since every corporation defines its needs differently. The non-corporate users are quite homogenous and can be lumped together.

The core problem is the corporate users demand extra support to spare them some costs. They want browser vendors to ensure bug-for-bug compatibility with all their internal systems -- rather than invest in updating the systems. Moreover, corporate users expect browsers to adapt to _their particular_ set of systems, while still going forward on othre fields. I'd call it a minefield, and one without any grattitude to be won. It's pretty damn hard to innovate and develop a browser for such market.

Contrast that with consumer market, where content providers, ISPs etc. consider it natural part of business to update their customer-facing WWW once in a while. The browser is free to go forward, and chances are the new, cool features will soon be put to good use. Way more breathing space for innovation.

</comment></comment><comment><USER16> Previous submission on same topic: <http://news.ycombinator.com/item?id=2692205>

</comment><comment><USER17> Yeah, they don't care about corporate users to extend they disabled websockets because of some broken corporate proxies.

</comment><comment><USER18> Such a quick jump in major version usually indicates a deep code quality problem. Are we asking the right questions here?

<comment><USER19> The quick jump in major version is because Mozilla is moving to a rapid release cycle, a la Google Chrome. Firefox 6 and Firefox 7 are expected by the end of the year. Here is one of the relevant blog posts:

[http://blog.mozilla.com/blog/2011/04/13/new-channels-for- fir...](http://blog.mozilla.com/blog/2011/04/13/new-channels-for-firefox- rapid-releases/)

<comment><USER18> That blog post is almost entirely devoid of content.

And ticking though version numbers that quickly is a bad idea. There are better ways for Mozilla to go about this...

<comment><USER19> The major benchmark for browsers has been Internet Explorer, which has had 9 versions in 16 years. Compare that to Google Chrome, which is already on 14.0.803.0 (dev) / 13.0.782.32 (beta) / 12.0.742.100 (stable) after existing for less than three years. Mozilla is moving away from Microsoft's release model and towards Google's release model. While the current timeline for Firefox is a major release every three months, the target timeline is for a major release every six weeks.

Technology gets faster. Version numbers are arbitrary. Mozilla will be fine.</comment></comment></comment></comment>


SCOtutor iOS Apps - The Current Situation - <AUTHOR> http://themacscreencastguy.com/blog/2012/8/11/scotutor-ios-apps-the-current-situation.html

<comment><USER2> The iOS app review process is astronomically fucked. I've had apps rejected for comically ambiguous reasons such as "app is just a website re-packaged as an app". Right. IMO one can argue this for many apps. I've had apps rejected because "app doesn't use enough native iOS functionality" when the app uses the accelerometer/gyroscope and all sorts of UIKit features.

The review process is also hilariously inconsistent. I've had re-skins of my own apps, that are live in the app store, that have solid 5-star reviews across 100s of users, that have 100k+ downloads rejected.

On a more positive note the Android development experience has been pretty decent so far. Porting a relatively simple iOS app took about two weeks. This time span includes reading the docs, getting a physical device and downloading the app from Google Play.

I've been doing iOS development since the start of the app store. However the "nuances" like provisioning profiles mess, $99/year fee and painfully long review process are getting really old.

</comment><comment><USER3> Sounds like its time to pivot. Some ideas on how to do that:

-Attempt to submit to iTunes anyhow, and handle the rejection if and when it comes.

-Create a web app with your videos embedded into it. Provide your free videos for free and your paid videos for a price or subscription.

-Deploy your video as a part of the YouTube partner program and monetize there: <http://www.youtube.com/yt/creators/partner.html>

-Build an iOS app without videos in it that acts as a companion to your videos - organizes all of them into categories, provides URLs where they can be viewed, organizes the notes and comments on each video, even lets you stream them within that app. This is basically how the Netflix app works, right? If the streaming crosses the line with Apple again, take it out. This will give you a presence in the App Store.

-Get vindictive and target Android instead of iOS

Bureaucracy is the bane of the small business man. Learn to roll with the punches and move on.

</comment><comment><USER4> The worst thing here is the inconsistency. If the App Store had _no_ "training video" type apps, then one might disagree with the policy, but at least it wouldn't feel so arbitrary. Allowing some, but not others - plus changing their mind half way though - puts Apple in a bad light. They also need to ensure that their "suggestions" are possible. In this, I think their policies in one area are just evolving faster than those in another. I'd hope that anyone could submit video content in the not to distant future, as part of a "Tutorial" category or similar.

In terms of pragmatics, have you considered doing an interactive iBook? Videos, plus diagrams and text would seem to be more useful than just a video anyway, and (IIRC) anyone can submit an iBook.

</comment><comment><USER5> As someone who's downloaded SCOtutor apps I can see his frustration. The SCOtutor apps are really well put together and great tutorials.

Rather than moan about Apple lets look at what he can do.

The author has a collection of extremely high quality content. He's already taken the effort to turn this into chapters. With a bit more effort he should be able to turn this into a pretty good site. If you look at his actual site[1] you'll see he already has this. But lets put some patio11 thinking onto this.

He has a lot of chaptered content that would be really useful to new users. So for each class of content he could create a new site, have a couple of chapters available and the rest behind a paywall, charging per chapter or for the whole thing. He can monetize the content with adverts (for the open areas) and Youtube's partner program. Personally if I were him I'd upload my open videos to Vimeo which provides better quality (IMHO, I could be wrong) and to YouTube and monetize the Youtube content (along with links to his specific websites for further tutorials).

He can further monetize by using affiliate links from organisations such as Amazon for accessories for the things he's talking about. For example, a video on how to turn smart cover support on and off could be augmented with an affiliate link in the page to smart covers sold on Amazon. It doesn't have to be spammy or overdone.

New versions of iOS and OS X come out on a fairly regular basis. He knows the release dates in advance. As the new release date gets closer he can open up more of the older chapters as he sees fit and then release the new course when the new version comes out.

Finally the author might want to look at bundle deal sites. There's tons of them for Mac and the most popular ones tend to get around. If he can get his tutors bundled with something that people would buy on it's own then he's more likely to see more sales.

[1] - www.screencastsonline.com

</comment><comment><USER6> Apple's stance at least seems pretty clear cut: The App Store is for apps, the iTunes/iBooks Stores are for content. Content masquerading as an App will not be allowed in the App Store, but the content is welcome in the iTunes store.

I do think they're making a fair distinction between an app that's basically a wrapper around a movie, and an app that allows access to content (eg. <http://itunes.apple.com/us/app/5by5-radio/id520847556>).

<comment><USER7> Did you read the article?

 _As a side note, it's impossible for me (or any other independent video trainer) to register to sell video tutorials directly in the iTunes store as suggested in the rejection statement, as I do not meet the requirements of "5 feature-length movies or documentaries that were released theatrically (or) 100 feature-length movies or documentaries that were either released theatrically or direct to video."_

<comment><USER6> That's how they control the quality of content. I'm not saying I agree with this, it's just how they've chosen to manage the store and it's why there's a multitude of publishers which will help produce your content and get it into the iTunes Store (eg. <http://www.tunecore.com/>).

</comment></comment></comment><comment><USER8> I honestly think the post is a bit ridiculous and whiny.

While the iOS review process may be draconian and inconsistent, it's clear that the "apps" in question contain basically no functionality other than video playback - certainly they are _not_ note taking apps, even after the fixes - so how defensible is the position of the author?

Now - it's clear that the only video content that Apple can accept is content coming through traditional channels. Why? I am not sure, but probably there are some contractual reasons (e.g. the studios give content only if Apple keeps small fish at bay?). It's certainly not different for songs. I have an album on iTunes and it got there through a major. Three other independent albums were never accepted.

Also, while Apple may _tolerate_ , or _pretend not to see_ video hiding in the app store in order to be friendly to developers whilst stretching, bending but not breaking any contractual obligation they probably have, this doesn't mean that they won't stomp such content _if and when_ it's found. They certainly have no obligation whatsoever towards the author to keep his apps in.

I find the blog post naive at best and malicious at worst.

<comment><USER9> The problem is that the app store is massively inconsistent.

We don't care why Apple makes it this way, only that it is this way. Apple is not the company we look to for excuses about why things can't be built properly.

Half assed, wildly inconsistent, corporate 'droids prevailing over common sense are what we expect from companies like Google with their AdSense/AdWords program. Or doing just about anything with PayPal.

The review process is something developers rely on and pay good money for to ensure a functioning marketplace where everyone must play by the same rules.

What we have is something inconsistent and frustrating which does not deliver a better experience to the consumer.

<comment><USER10> Well, you can not pay the $99 fee anytime you wish. Apple really doesn't owe anyone a living. And I can see how they might wish to separate these videos from regular apps. If these types of apps get flooded into the app store, the quality will deteriorate and usage will decline.

</comment></comment></comment><comment><USER11> The really horrible part of this story is all the effort he went to, trying to make his app compliant but all in vain. Is there no way to just ask "if I do this or that, will it be acceptable?" rather than just blindly trying things and resubmitting?

I guess he's skirting around the fringes of what's acceptable as an app, but at what point do you draw the line between a "movie" and an app with video content? Remember those "interactive movies" that were popular in the 90's? What side of the fence do they sit on?

</comment><comment><USER12> I don't know about his apps, but I'm happy that Apple is finally putting and end to this mess. The app stores are littered with "tutorial" apps, most hoping to fool users into buying it thinking it's the actual app.

</comment><comment><USER13> I hate when apple does that kind of silly stuff. I've heard so many iterations of this kind of story that I doubt Apple will continue to have the best smartphone apps when other ecosystems offers more flexibility. Also, this kind of strict control of content must cost Apple a sizeable buck?

</comment><comment><USER14> The app store is a perfect example of missing competition. It's 4 years old now and has not been improved once inch since its original inception.

Search, discoverability and speed are still as bad as on day one. Paired with Apple's kafka-esque bureaucracy and indifference for developers it's a really shitty state the app store is in - and I don't see any improvements anytime soon.

<comment><USER2> Serious question: why do app developers choose iOS over Android today? I vaguely recall reading about developers having trouble with paid apps on Google Play. Any other reasons?

I was a hardcore Apple fan for the first few years of the app store. However the novelty of the iOS polish that Android is partially missing (but slowly gaining) has long since worn off.</comment></comment>


Ask HN: Which technology\language you find most difficult to learn? - <AUTHOR>

My answer is COM, whats yours ? <comment><USER2> Unreal would be my first choice. A company recently sued Epic for how crap it is but they lost. Still, the fact that they did sue them in the first place tells you a lot but I'm not allowed to have an opinion.

If I could sue a language I'd sue bash. I know it'd be futile but there is a reason that so many replacements exist but maybe a better reason why none of them have supplanted bash.

<comment><USER3> _A company recently sued Epic for how crap it is but they lost._

Silicon Knights sued Epic claiming that they were promised advanced features of the Unreal Engine that allegedly did not exist or were not supported in the way SK were led to believe. They allegedly ended up having to build their own engine for the game on top of the cost of the UE3 license. Epic discovered that the new engine was using source code from SK's licensed copy of the UE3 engine and counter-sued for breech of contract. The claims against Epic were thrown out because the judge felt SK was asking for unreasonable amounts of money. As far as I know, the matter of whether or not Epic filled their end of the bargain was not answered. That's the real shame.

 _why none of them have supplanted bash._

Same reason C is still popular despite more advanced and modern languages. It's not as widely supported. Bash and C are everywhere. Bash and Perl are awful, awful languages that are awful, awfully unfortunately useful.

<comment><USER2> I don't think courts are in a position to rule on quality of products unless it's blatant false advertising. I'd love to discuss this but my next job is likely to involve Unreal as well. All hail our lords at Epic.

So instead I'll disagree with you on Perl which I thought was one of those saner replacements for bash, especially when it comes to one liners. So what languages did you think I meant?

> Same reason C is still popular

I think the reasons behind C and bash staying power are different. Bash is here to stay because it is ingrained, literally embedded in the system and has a large user base. It doesn't offer anything unique that isn't available somewhere else. C is here to stay because it offers what other languages don't. There are new projects with no legacy concerns that still choose C.

<comment><USER3> _So what languages did you think I meant?_

You mentioned bash, which I agreed with. I was also adding Perl to my personal list of complaints as a language I found difficult to learn.

</comment></comment></comment></comment><comment><USER4> COM/XPCOM. Go dig into the Mozilla codebase.

Also, another vote for CSS. Mostly because its so hard to debug and figure out what exactly is making your page look like shit. Add to that varying browser support. Its hell.

</comment><comment><USER5> Objective C... It is the weirdest language I've ever seen.

<comment><USER5> besides brainfuck =p

<comment><USER6> I was reading an article about implementing an interpreter for Brainfuck in PyPy, and when the example code for some simple Brainfuck programs came up, I just stared. I really fail to see how one would go about programming just about anything in that language. (Here's the article in case anyone is interested, a pretty good read IMO: [http://morepypy.blogspot.com/2011/04/tutorial-writing- interp...](http://morepypy.blogspot.com/2011/04/tutorial-writing-interpreter- with-pypy.html))

</comment></comment></comment><comment><USER7> SML.

I remember at CMU, the sophmore level programming language theory course (the name escapes me, it was 15-212) was wildly different than anything I had done before. All programming courses one took up to that point were the normal intro level courses that most passed out of and a data structures/algorithms course. Sitting down the first day and being introduced to SML along with language constructs with no analogue in the programming languages I knew was tough. I struggled for about a month, much like I imagine many do when learning about pointers: you may be able to do some of the work, but you don't have a proper conceptual model to be able to reason about it. All of a sudden, after re-reading the material from the beginning, everything just clicked. It was probably my favorite undergraduate CS course from then on.

<comment><AUTHOR> You make me remember my compiler design course. I find it most difficult during my collage days. Thank god we didn't have SML

<comment><USER8> I wish my compiler course had used SML--then maybe I wouldn't have had to greenspun C++ so hard.

</comment></comment></comment><comment><USER9> I have a couple for various reasons:

The hardest that I gave up on was Groovy. The language itself seems really nice, it was just hard because of the lack of documentation that I was able to find so I just switched to Scala since I had to learn it for a class anyways.

The hardest that I still use is Haskell. While there documentation is phenomenal compared to other languages, I have found that it isn't something that you can just pick up and start using and be able to write idiomatic programs without studying theory. For me, when I get to monads I struggled a bit. Then I get to the monadic bind and other operators like $ and . and I find I have to keep going back to tutorials to see when and how to use them properly.

</comment><comment><USER10> Javascript. I've learned the basics of SML and Ocaml, and a bit more than basics of Haskell, but I just can't bring myself to learn how to use JS effectively.

More generally, I find it hard to learn how to do GUIs and pretty web pages.

<comment><USER11> Have you tried jQuery? The API:s to interact with the browser really sucks, but the core language isn't too bad IMHO.

If you abstract away the browser differences in event handling and DOM, it's pretty straight forward to build GUI:s.

</comment></comment><comment><USER12> For me it was (and still is) ORM, specifically Doctrine2. In principle it seems pathetically easy, but once the queries start getting immensely complicated ( Many-to-Many over multiple tables, with conditional form data, etc) I still find myself having to fallback to SQL.

Other contenders have been:

1\. Bison ( tokens, parsing, syntax, was all difficult the first time around).

2\. OpenGL because remebering function names for the api is RIDICULOUS! ahh glDrawElementsInstancedBaseVertexBaseInstance now what are the args again?

</comment><comment><USER11> CSS

It is deceitfully simple at a glance, but to make a _useful_ design with it is _hard_. There are so many hacks to get it to do what you want and hacks to work around bugs.

</comment><comment><USER13> Haskell. While I've sung its praises on HN before, I am just a novice. I've gotten deep enough to see how great it is, but not far enough to write anything nontrivial.

</comment><comment><USER14> Honestly, CSS. It's so different from programming that I can't wrap my head around it.

Ask me to write a simple web page and I'll have ~10 tabs open to w3schools.

</comment><comment><USER15> Javascript.. I have been working with the DOM for the past 3 years yet I feel like I still do not have a solid grasp of Javascript.

<comment><USER11> The DOM is not Javascript, it's just an API. A really, really sucky API. Use jQuery instead.

</comment></comment><comment><USER16> Probably <http://en.wikipedia.org/wiki/Malbolge>

<comment><AUTHOR> Interesting Language :)

</comment></comment><comment><USER17> Another vote for CSS, but then again I've never actually tried to use COM

Something about CSS prevents me from really grasping it and using it with any real skill. I mainly live off of designer friends and things I can cobble together with the help of google.

</comment><comment><USER18> Recently, I'd probably say SAML. There are so many intricacies in the spec that it's difficult to know how best to apply it to a problem, and the implementation I use is poorly documented.

</comment><comment><USER19> probably not most difficult to learn but most hated: Perl

most difficult to learn for an OO-guy: Erlang (and most interesting as well)</comment>


Ask HN: Any tips on how to get back into maths? - <AUTHOR>

Hi there,
My maths career never lasted beyond my high school years, but after becoming interested in functional programming and algorithms, it seems worthwhile to improve my general maths literacy. I'm not really sure where to start but I guess it would be beginner undergraduate level. Since I'm not currently in a position to go back to university, I'm looking for self-teaching resources and thought I'd get some good tips from you guys.
Many thanks! <comment><USER2> This has been done to death, do a site search and you'll find tons of suggestions.

That said, <http://khanacademy.org>

</comment><comment><USER3> This question comes up periodically, check the archives.

Mainly, I'd suggest working through the puzzles at <http://projecteuler.net/> . Once you solve them, _especially_ if you don't feel like your solution is good enough, read through the forums and translate interesting approaches to your language.

</comment><comment><USER4> I am relearning/refreshing math with khanacademy.org. Highly recommended!

</comment><comment><USER5> You have a 104 days old HN account, and you still don't know about any open courseware site? Names like MIT, Stanford, Berkeley get thrown around here almost daily. And if you know about them, whey not check them out. Even a routine check of these websites would yield many great videos.

A simple search of "math self learn" at searchyc gives tremendous amount of answers. Then where is the need to post this?

<comment><USER6> I think my strategy for both maths and computer science would be to look at the course pages for universities. I would pick a course that I would want to take, then visit the course homepage. Usually teachers post a syllabus and additional course resources. I would get a cheap secondhand copy of the book(s) (even if it is an edition or two behind) and try to follow the general path the teach has outlined for learning the material. It's really hard to duplicate a classroom setting and extra study sessions with TAs, but open courseware, web forums, and various other Internet-available resources go a long way!

<comment><AUTHOR> Thank you for the thoughtful response, it was much more helpful than wading through search results. I will do this.</comment></comment></comment>


Ask HN: Do we really need volume controls on embedded videos? - <AUTHOR>

Why should a user have to play equalizer on two sets of audio controls (the main computer audio and the audio of the tiny box on the screen.)
Just my $0.02, but I think on/mute gets the job done.
I noticed these folks didn't bother with a volume slider on their embedded video: http://ycombinator.posterous.com/embark-nyc-is-the-1-mta-award-winning-best-ap <comment><USER2> It's absolutely necessary; it should, in fact, be illegal to omit a volume control on any audio-playing control, embed, device, or otherwise. This is a bit of a tangent, but stay with me: Much like with playing audio without asking for an opt-in (PLAY button), not having a volume control makes assumptions:

a) The computer's volume is at a sane level.

b) The video or audio has a volume track recorded at some standard volume

c) by extension, ALL audio is always at the same level, and therefore a user would never have audio turned up to listen to some prior softer audio

d) The user doesn't already have some other audio playing, or that your embed audio takes precedence over that.

e) Their speakers have volume control; they might have headphones on. You don't know their sound situation, you can't make assumptions about it.

The reason I go so far as it being illegal to automatically play audio, and not offer even per-embed volume control is because this all has the potential to cause serious damage to their ears, equipment, and health.

That's why! :)

<comment><AUTHOR> a) I buy that;

b) hmm;

c) but then if there is only one master control, they'll just have one volume control to mess with, right?;

d) I don't buy that & here's why: are you really going to be listening to other tunes in the background while you're listening to a TED talk? For case 2, you can pause/mute the video (all I'm referring to is the volume control _slider_ in embeds;

e) I agree 100% not to make any assumptions about potentially billions of users but with a main audio slider for their device I don't force them to mess with two volume sliders.

Besides desktops, I think about tablets/mobile phones, how often do you tweak the volume of the embed itself and not the audio for the entire device?

Bridge: You are spot-on that it should be a crime for auto-start on audio (I feel like a few jerks who tried the auto-playing "Congratulations, you just won a free iPod blah blah" will be eliminated quickly) but I think we can kill off the volume sliders (assuming no auto-start audio, easy pause/mute)

I'm still trying to see if there is a bullet-proof use case out there where it is _essential_ to have a volume slider on an embedded item itself.

<comment><USER3> Volume controls are important, and should remain. To detail "d)": I frequently have 3 video/audio sources pending - a movie (which I'll interrupt), a podcast (which I'll speed through, and also interrupt), and a web flash video (alerted via tweet or email). Because their recorded average audio levels are all (wildly) different, for every type of media and content producer, each player's audio level is different, but fixed for the current selected media. So, the embedded web video had _better_ have a volume control, or I'm going to be annoyed, because I _don't_ want to be continually adjusting the system master volume control just because I'm pausing, unpausing various media sources. It's an _action minimization_ thing.

For my smartphone, I'm forced to adjust the main volume control when switching media, and I dislike having to do that so much that it tends to make me _not use_ my phone as a media player.

</comment></comment></comment><comment><USER4> I agree, it's not necessary. However, I feel some users are accustomed to it being there, and so removing it may cause them a moment of confusion.

<comment><AUTHOR> That's true- I was a bit taken aback by the fact the Embark NYC ad didn't have one but then it got me thinking why bother with them at al.

There is no consistent volume slider on the web though, everybody and their grandma seems to have some clever/fancy way of doing it, youtube is different from vimeo is different from some random fancy embed anyway.

HTML5 standards for video take audio slider as a given so this might be sticking around for a while at least

</comment></comment><comment><USER5> Maybe they want to have your volume turned down but still hear the "bing" over another event. Or any number of other scenarios.

Don't assume your video will be the only thing going on or the thing that determines the master volume setting.

Finally, if the user wants to adjust volume for your embedded object, why should they have to change the master volume, and then have to remember to change the master volume back, afterward?</comment>


How to make the Hacker News homepage - <AUTHOR> http://jacquesmattheij.com/How+to+make+the+Hacker+News+homepage

<comment><USER2> Hmm, not sure if we really need this kind of posts (even if it contains only "white hat" recommendations). If you are going to write something oriented to "new" HN users, something that tries to define what a productive member should do (posts should be good "discussion material", don't ignore the new page, karma is not that important, etc...) or give some insight into the community could be more useful. Just my $.02.

</comment><comment><USER3> Great.

Now we'll have a whole bunch of 10-character titled 400 words essays full of links to wikipedia hitting the new page every day at 8:30.

Then we'll have a whole bunch of utilities that write 10-character titled 400 word essays full of links to wikipedia, posting them to the new page every day at 8:30.

</sarcasm>

jacquesm, your contributions here are second to none, but lately I'm beginning to wonder if you might have a little too much time on your hands. As many teachers have told me, "If only we could channel that energy."

:-)

<comment><AUTHOR> I'd seriously regret writing this if that was the outcome.

As for me having too much time on my hands, my days are pretty long and I still get all the work done that I should so as far as I can see the damage is limited. In the last three weeks I've changed out the gearbox on a car (which is something I'd never done before on a car that new), had about 30K lines of changes committed, made a couple of online friends, helped some fellow HN'ers to improve and/or launch their startup, met some interesting people and I found enough time to write an article or two and be active here.

If you have any productivity tips other than 48 hour workdays I'm game :)

And I enjoy this.

<comment><USER4> Good to see you have a diverse range of activities. I firmly believe that overspecialisation (even though it is sometimes economically advantageous) can be crippling for the mind.

</comment></comment></comment><comment><USER5> Also, include Hacker News in the title. This site is getting entirely too self-referential.

</comment><comment><USER6> I think there's a large issue of luck. Your advice certainly improves the odds, but it's no guarantee. There's just _so much_ getting submitted nowadays, of front-page-worthy quality, that you need to get lucky with the first 4 or 5 upvotes. If you don't get them, you're toast. If you do, you make it to the front page where the real crowd sourcing magic kicks in.

<comment><AUTHOR> Yep, there is no magic bullet here, and I've written as much in the article. But it certainly won't hurt _and_ it will help to improve the overall quality of the stuff that does get submitted.

Of course it would be really funny if this post didn't make it!

<comment><USER6> I've noticed lately that having a very discussable, opinionated, or judgmental topic will also propel your post. For example, meta-topics, like this, seem to do pretty well. So do articles or local posts like "Why you should[n't] X" or "[Why it's | Is it] OK to X". So, I think you'll do alright. It's an interesting topic and everybody will want to chime in about their own experience posting to HN.

My "rate my start-up" post, however, is probably going to die.

<comment><AUTHOR> It looks like it worked :)

<comment><USER6> Yeah. I noticed there's also a human touch somewhere in the mix. I think the editors choose a "boost" on certain posts. It looks like mine was selected (thankfully) to benefit more per upvote/comment than yours.

Your post has more comments and upvotes than mine, but is ranked lower. It _was_ ranked higher for a period of time, then suddenly dropped down to the bottom. Mine, on the other hand, jumps up 5 spots anytime somebody upvotes it.

Or, maybe it matters _who_ upvotes/comments on posts. I don't know, but it's made me have more faith in HN.

Edit: I've been on here for this long and have not once ever noticed the "flag" button.

<comment><AUTHOR> No, this post was flagged a couple of times so that's what penalized it. Flags are an input to the ranking algorithm once a post gets more than 10 upvotes.</comment></comment></comment></comment></comment></comment>


Micro-op fusion in x86 - <AUTHOR> https://dendibakh.github.io/blog/2018/02/04/Micro-ops-fusion <comment><USER2> This "it's all RISC-like uops anyway" is what lead many (incidentally mostly academic, open-source) compiler writers to not attempt to emit the more complex instructions, thinking that the equivalent series of simpler ones (which uses an explicit register) would be just as fast (because it is, in microbenchmarks)...

 _Unfused instructions also add register pressure to the compiler, because it needs to find the free register to load the value from the memory._

...and then they complain about the lack of registers, when, to put it bluntly, "they're doing it wrong". x86 has fewer registers than most RISCs but makes up for that with memory-register and memory-immediate operations. Instead of wasting an architectural register, you're supposed to use those operations which automatically "allocate" and use a virtual register from the register renamer.

Look at what icc (Intel's own compiler)C does; it definitely will choose the _ALU m, r_ or _ALU m, i_ operations when it makes sense to. As others here have already noted, the size savings definitely have an effect on macrobenchmarks.

<comment><USER3> A problem is that on Sandy Bridge+, these complex instructions can't decode in the same cycle as simple instructions, so using them can reduce instruction decode throughput.

<comment><USER4> It depends what you mean exactly by "complex" instructions, but on SB+ and also on earlier architectures, the type of instructions discussed here (simple memory source or RMW instructions) decode just fine in parallel with other instructions.

In general, load-op or RMW is strictly better than explicit load, op, store sequences when the source supports it and pretty much every decent x86 compiler will emit those.

The "complex" instructions that have decode limitations are entirely different things like rep movs instructions, cpuid, integer division, etc, etc. Basically instructions that are implemented in micro-code.

<comment><USER3> Ignoring microcode, the instruction decoders can, per cycle, decode one of three patterns:

        4 instructions that decode to a single µop
        1 instruction that decodes to 2 µops and 2 instructions that decode to a single µop each
        1 instruction that decodes to 3 µops
        1 instruction that decodes to 4 µops

Obviously, RMW decodes to three unfused µops and thus the cycle it's decoded there are only 3 µops emitted from the decoders of a potential 4.

<comment><USER4> > Obviously, RMW decodes to three unfused µops

It's not obvious at all, in fact it's wrong. Almost all RMWs, including inc, decode to 4 unfused uops (1 load, 1 ALU, 2 store).

More importantly, the numbers you quote above for uop decode patterns are for _fused_ uops, not _unfused_ (after all, the decoders produce fused ops). In the fused domain 2 and 3 uops are common (inc is 3 but add is 2, not sure they differ - you could just use add [mem], 1 to work around this oddity). So in many cases (2 uops) it will decode in parallel with other instructions.

More to the point:

1) This applies only to the legacy decode: most instructions in most applications, and nearly all in small loops like this example will code from the uop cache, where the restrictions above don't apply.

2) Even if for some reason you are running this entirely on the legacy decoders, 3 fused uops per cycle is still "fine" in comparison to the simple instruction variant because the latter will need 4 uops to accomplish the same thing, so the reduction of apparent decode throughput was canceled out by the fact that few total uops need to be decoded.

3) The only case above where more complex instructions actually results in fewer uops is the 3 uop case: the most complex case of 4 and the case of 2-1-1 still result in the max of 4 uops: so it's kind of the exception rather than the rule (if it is even correct on modern chips: if you got this from Agner that section is wrong for Skylake where the legacy encoder has improved but it's not reflected in the document).

4) The more interesting case of "complex" fused instructions is probably load- op, which only generate 1 (fused) uop so are eligible for the fast 1-1-1-1 decode treatment.

There is pretty much no downside[1] to using "complex" memory destination RMW and memory source load-op instructions in modern x86, and all decent compilers generate them when they can.

\---

[1] Here I'm comparing using them vs not-using them in x86, which already has them - I'm explicitly not trying to compare whether it is good to put them in your ISA/arch in the first place.

</comment></comment></comment></comment></comment><comment><USER5> This article appears to have nothing to do with micro-op fusion, which is an internal optimization in some CPUs. See, for example, section 8.4 in Anger Fog manual [1]. This article is instead about whether a particular operation is better written as a single-instruction memory RMW or as there separate instructions to read, modify, and write.

[1] [http://www.agner.org/optimize/microarchitecture.pdf](http://www.agner.org/optimize/microarchitecture.pdf)

<comment><USER6> Intel says that:

> Micro-fusion fuses multiple micro-ops from the same instruction into a > single complex micro-op.

And that:

> Macro-fusion merges two instructions to a single micro-op.

The point is that the three instruction format and the single instruction format you would think would decode both to three micro-ops (or something like that), but instead the single instruction format can use a single fused micro op. That's why it's better to write as a single instruction.

And your reference backs this up - it talks about single instructions in this section on micro-op fusion.

You may be confusing it with macro-fusion, which is about fusing multiple logical instructions, which is discussed in the next section in that Agner document, but isn't discussed in this blog.

> This article is instead about whether a particular operation is better > written as a single-instruction

Yes - it's better to write as a single-instruction, because then micro-op fusion applies. Macro-op fusion isn't as strong, as doesn't apply to the three logical instructions.

<comment><USER7> That all makes sense, but it doesn't seem to apply to the example code in the article, right? `inc` doesn't decode to a single fused uop on Ivy Bridge. AFAIK, the example code in both cases decodes to the same number of uops in the fused domain...

<comment><USER4> It doesn't decode to a single fused uop, but rather 2 fused pairs of uops (so 4 total unfused uops). So there is fusion going on, twice (the load and ALU op are fused, and the two store uops are fused).

If you use the three-instruction sequence the load and ALU op can't fuse, which potentially makes it slower (but not in this case since the bottleneck is elsewhere).

<comment><USER7> I believe you're thinking about `add`. According to Agner Fog's instruction tables, the load and ALU uops are fused for `add`s, but not in the case of `inc`

[http://www.agner.org/optimize/instruction_tables.pdf](http://www.agner.org/optimize/instruction_tables.pdf)

<comment><USER4> Yes weird - it was pointed out somewhere elsewhere here and I updated some of my comments but not this one.

It's quite unusual that add gets the 2-uop treatment but inc doesn't. Yes, they treat flags differently, but that's mostly been resolved though flag renaming, and the reg forms of inc don't suffer any penalty.

I'll have to double check if this is true. If it is, compilers should generally be preferring add [mem], 1 then (except perhaps when optimizing for size) - the difference in the flag behavior is pretty much never relevant for compiled code.

<comment><USER8> Renaming is unrelated to my guess about the flags. The point is that there's a limit to how many inputs a fused uop can have, 3, and the flags register may become one input too many to be able to fuse the uops. For example,

        inc [rdi+rbx]

has the obvious rdi and rbx dependencies, the flags register, plus (presumably, depending on implementation details) an allocated virtual register for the 1 that is added. On the register forms this limit is never a bottleneck.

You also see the same behavior, according to Agner, on SHR/SHL m, i, which may or may not alter some flags depending on shift amounts, and strangely on NOT m, which explicitly does not alter the flags in any situation. This latter one makes little sense.

<comment><USER4> Sure, but everything you say about inc is true of add as well, but add double- fuses fine (by "double-fuse" I mean it is 2/4 ops in the fused/unfused domains unlike inc which is 3/4). In general many RMW instructions (double) fuse and most (all?) also modify the flags.

I doubt there is a virtual register for the 1 really - sure there is some storage for it somewhere in the ROB or the scheduler or whatever, but it doesn't need to be "renamed" in the usual sense since it's not visible anywhere. In any case, the add case is "worse" since it can have a real architectural register there, not just an implied immediate 1.

Yes, there is a definitely a limit on the number of inputs a uop can have - and you can see this in the effect of "unlamination" which is where a uop fuses in the uop cache, but then unfuses after that and so mostly acts like an unfused uop (except for uop cache space). This shows up with indexed addressing modes.

For example:

        add [rax], 1

fully double-fuses, but:

        add [rax + rbx], 1

Double-fuses only in the uop cache (counts as 2 there), but unlaminates once after that (counts as 3 in the rest of the fused domain).

Interestingly though this guy:

        add [rax], rbx

Still fully double-fuses everywhere, despite having the same number of input registers as the add [rax + rbx], case. Probably it's easier for the renamer though because the registers are spread across the uops more evenly rather than being concentrated in the load uop?

Moving away from RMW to load-op there are other indications flags aren't a problem: things like BMI shrx/shlx/rorx with memory operand don't fuse despite that these don't update flags at all. On the other and ANDN, which is similarly in BMI and is also 3-arg instruction (distinct src/dest) _and_ updates flags _does_ fuse! So actually I'd say updating the flags in a consistent way makes it more likely to fuse.

Maybe that's the answer then?

Anything that updates the flags in the "standard way" \- i.e., SF,ZF,CF,OF all set to something, can (potentially) micro-fuse. Anything which doesn't - whether that is updating fewer flags (inc) or no flags (shrx) or updating them "weirdly" (shl and friends) isn't eligible. Interesting theory and still consistent in broad strokes with your "it's the flags!" claim.

<comment><USER8> This theory is cool, but I don't think it works, all things considered. PDEP and PEXT should have the same unfused behavior as SHLX, since they also do not change any flags, but they _do_ fuse. BEXTR should (or could) fuse, but doesn't. So I don't know.

<comment><USER4> You are right, so yeah I can't explain really why certain ops fuse and some don't. There doesn't seem to be a strong pattern.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> >> Micro-fusion improves instruction bandwidth delivered from decode to retirement and saves power. Coding an instruction sequence by using single-uop instructions will increases the code size, which can decrease fetch bandwidth from the legacy pipeline.

> Out of all runs that I did unfused version was never faster then the fused > one.

I mean, yeah. These little microbenchmarks wouldn't cause the kind of I$ pressure that Intel's talking about.

<comment><USER10> Nice article. I wish it also discussed the potential value of future-proofing the code (for future Intel or - more important - Intel-compatible CPUs), in which case wouldn't it make sense to use 3 simpler instructions? Even at the risk of instruction cache pressure. It's not _worse_ here, since the problem was alignment rather than instruction selection.

<comment><USER2> _in which case wouldn 't it make sense to use 3 simpler instructions?_

No. Any competitor's CPUs will also have similar constraints on fetch and decode bandwidth, so smaller code that isn't slower will always be the better choice (and sometimes, even slightly slower for one sequence is better if it being smaller results in less cache misses overall).

Plus, the requirement to use an extra register for the simpler sequence instead of the implicitly allocated ones that memory-ops use will affect other code nearby.

</comment></comment></comment><comment><USER11> His terminology appears to be weird and i don't think he's testing what he's trying to test.

1- using the "INC mem" form is not a fused instruction. Intel has macro op fusion where two macro ops are send to be decoder as a unit like cmp+jmp to be decoded into uops more efficiently. This isn't that.

2- micro op fusion is when after decoding from macro to micro op, two micro ops that are adjacent are retired together, just as "ADD reg mem" goes to the micro ops "LOAD reg2 mem" and "ADD reg reg2".

Or in his example:

INC mem ->

LOAD reg mem

INC reg

STORE mem reg

and the INC and STORE will be fused and retired together (not the LOAD and INC), IIRC.

3- he's hitting the loop stream detector so decoding is bypassed anyways. His 3 macro op version is hitting the uop cache, same as tbe 1 macro op version.

4- he's trying to say both the "good" and "bad" will execute the same, but i dont think this is impacted by the uop fusion. And nothing in his counters shows any difference.

The single direct memory form of INC cuts down on register and L1 instruct cache pressure, neither of which this benchmark will pick up.

I'm a software guy though, so corrections are definitely encouraged.

<comment><USER4> > 1- using the "INC mem" form is not a fused instruction. Intel has macro op > fusion

inc mem is a micro-fused instruction. He's not talking about macro-fusion here, which as you point out involves two separate instructions (a flag- setting ALU op and a conditional jump) being fused together into one uop.

> and the INC and STORE will be fused and retired together (not the LOAD and > INC), IIRC.

Actually it's the load and the inc that will be fused together. The store itself internally is 2 uops, which are also fused together. So there are a total of 4 (unufsed) uops implied by inc [mem] and those get fused in pairs for a total of 2 fused uops.

Edit: what I said is true for "add [mem], 1" but apparently not for "inc [mem]" which apparently needs 3 fused domain uops, not 2. I'm not sure why it's worse and which "pair" isn't fusing (but if I had to guess it's the load- op pair that fails to fuse). It's kind of dumb since you could just use _add [mem], 1_ to get the same effect, except in the rare case you wanted the different flag setting behavior of inc.

<comment><USER11> Thanks. Is all this learnable from the Intel docs? Or is there a lot of IACA experimentation?

<comment><USER4> Most of this is in Agner's docs (check out microarchitecture.pdf and look for 'fusion') and his spreadsheets (which lists the number of uops in the fused and unfused domains).

Once you understand that background see this answer:

[https://stackoverflow.com/a/31027695/149138](https://stackoverflow.com/a/31027695/149138)

which has the most up-to-date info I'm aware of about some important issues that doc doesn't cover (in particular, revealing that there is are actually two types of micro-fusion: the bad kind that unlaminates before renaming, and the good kind that doesn't).

IACA is mostly pretty useless for this stuff: or at least I'd never trust it by itself since it fails to correctly model a lot of the various cases (including stuff as basic as L1-hit latency for the various addressing modes). In this case, it actually _was_ IACA that triggered the investigation, so this is a bit of an exception to that - but even here it failed to model it correctly once the details were worked out through testing.

<comment><USER11> Thanks so much. It really fills a gap in my knowledge. I do high performance work, so i don't use this directly, but i find it very interesting and feel it improves my mental model of what's going on under the hood.

Id also like to dig into compilers a little more than my college courses, and i have an idea for code gen of APL functions used in a particular setting (database stored procs).

</comment></comment></comment></comment></comment><comment><USER12> Hi,

Thanks to everybody who commented the post. With your help I was able to close the gap in my knowledge and summarized it in my new post: [https://dendibakh.github.io/blog/2018/02/15/MicroFusion- in-I...](https://dendibakh.github.io/blog/2018/02/15/MicroFusion-in-Intel- CPUs)</comment>


Chipotle Reports Findings from Investigation of Payment Card Security Incident - <AUTHOR> https://www.chipotle.com/security <comment><USER2> Hopefully this pushes more and more restaurants towards using separate chip- reader (EMV) pinpad devices. I've noticed several area restaurants switching lately (Arby's, Wendy's), and I hope it continues. These devices use point-to- point encryption, meaning that even if the POS machine is comprimised, no sensitive card data can be stolen. The POS machine never sees raw card data.

<comment><USER3> Chipreaders are terribly slow, I don't understand how they could not develop a secure payment system without 10-second~ delay times. My local grocery store installed new chip readers and within a week had taped over time in favor of the more-expensive but quicker stripe processing.

<comment><USER4> Hilariously, using contactless EMV payment (i.e. Apple/Android Pay) with _the same POS terminals_ is lightning fast.

But this gets filed as "infrastructure is hard". A related example: If you get a chance, try the IC card system used by the train and transit systems in Japan; they're delightful.[1] At peak rush-hour, commuters are darn near running through the (many) pay stations tapping through without breaking stride -- including display of remaining balance!

Yet, the relatively recent transit tap card system where I live is laughingly slow. At a much more modest walking pace, it's easy to pull away from the reader before it's confirmed the transaction. Seconds per commuter, for system that's considerably newer than the IC card system.

<comment><USER2> Something to keep in mind is that Apple/Android Pay support both MSD (magnetic stripe data) and EMV contactless modes, which can result in different timings. EMV contactless also drops significant portions of the EMV contact requirements. This is why banks generally won't let you get cash back, or make large purchases on contactless, there's a trade off.

<comment><USER5> I've actually found it to be _better_ ; no tradeoffs.

I haven't tried cash back as I use credit cards rather than debit cards. I've used Apple Pay in the US, Canada, NZ, Australia, Germany, Sweden, and Denmark, and it's ALWAYS preferably to using the actual card, particularly for an American.

If you have a US based bank, even with EMV the bank prefers a signature, which means you have to sign the damn receipt. This is more inconvenient than doing so in the US because:

1\. The merchants aren't used to it, so it's a surprise/hurdle 2\. It's not common, so you have to sign an actual receipt, not an electric display 3\. They don't seem to waive the signature requirement for small purchases ($25-$50) as they do in the US. So you're signing for EVERYTHING.

Magically, if you try to use your US-card-with-a-PIN (assuming you set one up) in an unmanned scenario like in a parking garage, SUDDENLY YOUR PIN WORKS! (quelle surprise!)

I also fell in love with the convenience of Apple Pay+Watch when I was skiing in Whistler; no need to take off my gloves, unzip a pocket, reach in, find, card, use card, sign receipt. Just a quick double-tap on the side button without even undoing my glove gauntlet, velcro closure around the wrist of my jacket, or any of my 5 layers of clothes (yes, it was cold).

Paywave was the most-commonly accepted in Australia of everywhere I've been recently, to the extent that they even tap your credit card to the machine first, assuming it will work, and are surprised when it doesn't. Yet they were VERY surprised by the watch, often saying they had never seen anyone use their watch before. I'm not sure if contactless+phone would have been as unexpected or not; I never tried.

</comment></comment></comment></comment></comment><comment><USER6> Just because someone is forcing you use the chip __DOES NOT MEAN THAT IT 'S AN EMV TRANSACTION __

There is no way too know if you are actually doing and EMV transaction.

The EMV spec has nothing at all to do with security. PCI controls security. I can read the card data via the chip and it's all in the clear. EMV is about process integrity, and the integrity testing is ridiculous. Chip cards are harder to forge, but that's about it. The new rules about liability puts the liability for processing a forged card on the merchant, if the transaction isn't done with EMV.

<comment><USER2> Are you saying that you know of systems which use the tag 57 (track 2 equivalent data) to read an EMV chip and process the transaction manually? I'd be surprised if most banks would even approve those transactions (no CVV/CVV2, etc).

</comment></comment><comment><USER7> My area was hit, and I did get hit with credit card fraud. I suspected a different vector (shady medical vendor and coincidental timing). The card that got hit was indeed used at Chipotle, but a week after the supposed "time range" indicated on the security site. Maybe the time range isn't absolute.

<comment><USER8> Typically, the hackers that get the data sell it off, versus using it personally. That can take a while.

<comment><USER7> I just mean that I didn't use my card during the time period, but a week later.

<comment><USER9> I used my card multiple times at multiple affected locations in four states, and I haven't seen any fraud on the card. Just a datapoint. Perhaps yours really was that shady medical provider.

</comment></comment></comment></comment><comment><USER10> No doubt the timing of releasing this news on the holiday weekend was deliberate; intended to reach as few people as possible.

</comment><comment><USER11> Here's a list of all US locations affected: [https://docs.google.com/spreadsheets/d/1_lFhMPaRBn8JbqxR9rEq...](https://docs.google.com/spreadsheets/d/1_lFhMPaRBn8JbqxR9rEqRgtezp3wM9ZPF-23Z-NomDU/edit?usp=sharing)

</comment><comment><USER12> Why is there no legal recourse here outside of spending my own time/resources to cancel cards and deal with all the BS that occurs with that whenever this happens? There should be financial repercussions, each affected individual should be awarded monetary compensation for their time.

<comment><USER13> I believe that since Chipotle was still using magstripe credit card readers that they are now financially liable for any fraudulent charges on your account.

<comment><USER14> A bit misleading- Chipotle is responsible for Chipotle transactions that get disputed as fraudulent. Not just any fraudulent charges (subsequent transactions occurring after a swipe at Chipotle).

</comment></comment></comment><comment><USER15> What was that thing? It looks like all the stores in my area were hit.

<comment><USER16> Agreed. Looks like this a big deal™. Would love to know the method of spreading across all their point of sales, were they running on windows?

<comment><USER17> A ton of POS systems run on windows. Most on windows xp embedded

<comment><USER2> In the industry I am in (mostly grocery, convenience, some specialty retail), most have moved to at least POSReady 7, and some are looking at Windows 10, though there are other concerns with PCI compliance there. Most of the large retailers are pretty good about keeping these things away from the general Internet, but once an attacker is in your network, most bets are off. The most important thing to do is to look for retailers who are using the standalone pinpad devices (i.e., they don't take your card and swipe it in the keyboard or on the display). These standalone devices encrypt card data before that Windows-based point-of-sale ever sees it. You can't steal card data from a POS which never sees card data.

<comment><USER15> > Windows 10

I'd be worried about the system rebooting to do a system update while I turn my back for a minute to help a customer.

</comment></comment></comment></comment></comment><comment><USER18> > _The malware searched for track data (which sometimes has cardholder name in > addition to card number, expiration date, and internal verification code) > ... There is no indication that other customer information was affected._

What other customer information could have been affected? Kudos on the masterful PR spin — I guess by now Chipotle has had a lot of practice at this...

</comment><comment><USER19> Anyone have the whole list? (I hate enforced drill-down selection for such things.) How many locations?

<comment><USER2> A quick look at the chrome dev tools will point to a us.json which has what you're looking for.

<comment><USER20> That's a massive list. 2249 restaurants.

<comment><USER21> I am appalled at the attempt by Chipotle to downplay the scope and scale of the incident. The sentence which reads, " Not all locations were involved, and the specific time frames vary by location", is a blatant attempt to deflate the significance of the problem. This public disclosure should have been more direct, and disclose in plain language the number of stores affected. Chipotle should explain the full impact in plain language: "2,249 out of X,XXX Chipotle restaurants were compromised."

<comment><USER19> They are international now, right? I at least think I have memory of running across them in Canada.

The file name in question (thanks, heywire) is "us.json". I'm left wondering whether and how much of an international scope there might be to this.

While the version of their web site that I'm receiving by default seems to be geo-centric to the U.S. and doesn't mention foreign locations, Wikipedia has:

[https://en.wikipedia.org/wiki/Chipotle_Mexican_Grill](https://en.wikipedia.org/wiki/Chipotle_Mexican_Grill)

 _Chipotle Mexican Grill, Inc. ( /tʃᵻˈpoʊtleɪ/)[6] is an American chain of fast casual restaurants in the United States, United Kingdom,[7] Canada,[8][9] Germany,[10] and France_

<comment><USER22> Card processing in Europe is secure and doesn't ever involve magstripe data, so it won't have been a problem.</comment></comment></comment></comment></comment></comment>