The fall and rise and rise of chat networks - <AUTHOR> http://arstechnica.com/business/2016/02/the-fall-and-rise-and-rise-and-rise-of-chat-networks/ <comment><USER2> Did it feel very weird to anyone else that some of the most important chat protocols ever to have existed were not even mentioned once in the article, in favor of various startup apps that many people have never even heard of?

Any history of chat networks needs to include BBSes, IRC, ICQ, and Google Talk (now Hangouts).

<comment><USER3> I skimmed it, didn't see IRC or ICQ and didn't read the rest. Just another filler article from Ars Tech...

<comment><USER4> ICQ get a mention in passing, but the story seems to begin with MSN Messenger.

Not surprised, as i think MS was quite aggressive in pushing it. After all, the early version came bundled with Windows XP, iirc. And you were greeted with a signup/login dialog on first boot.

This is not that different from how MS pushed IE back in the day, or grabbed the office network out from under Novell's nose back in the day.

And btw, i feel to some degree MSN Messenger ruined the net. Before then there was thriving local IRC channels for the smallest of places. But come MSNM people started exchanging contact info for it, and the net turned "clique-y".

<comment><USER5> MSN Chat...looked for that...didn't see it...

Had many memorable chats at "philosophy and absurdity" and "poetry shack"....

All gone....all gone...

</comment></comment></comment></comment><comment><USER6> Chat sure has come a long way, yes indeed. Why, once it was a console app, which all look the same, then it made the _huge_ transition to GUI apps, which once you look past rounded corners and profession emoticons, essentially all look the same and have nearly the same features. And in the future, we are sure to witness a variety of additional chat networks with pretty much the same features.

Yes, what a journey it has taken... from... console app to GUI app. What a journey indeed.

<comment><USER7> In modern chat apps like FB Messenger or WeChat, you can hail a taxi, send money, send your current location, send a variety of stickers/gifs, send disappearing messages, send pixellated messages you have to pay to unpixelate (only in WeChat as far as I know), among other things.

Regardless of what you think of these features, modern chat apps are certainly very different from IRC.

<comment><USER8> Are all those actions considered "chat" features?

I am probably old fashioned, but I prefer separation of services. If a taxi driver was on IRC, sure, I could "hail" him. I could post my current GPS location to anyone I please. Gifs & vid (links) are just as easily shared.

Yeah, I understand integration, but... I curmudgeonly fight it. I hope I am being Unix-like by striving for separation of services, but I am probably just being stubborn. :(

<comment><USER7> I tried to ward off this exact sort of comment with the line "regardless of what you think of these features". I don't feel like getting into a debate about whether the millions of non-tech teenagers using chat apps should care about The UNIX Philosophy (TM). I just wanted to point out that, rightly or wrongly, they're very different now, contrary to popular HN belief.

</comment></comment></comment></comment><comment><USER9> I find it very odd how chat apps (AIM, MSN, etc.) died and gave rise to.....chat apps (WhatsApp, WeChat, FBM). I'm still not sure what caused the mass migration.

<comment><USER10> A number of other responses are suggesting that the explanation is all about the switch to mobile. I'd argue it was less about the platform transition itself and more that people misjudged what behavior that transition would enable. People generally thought the future was voice and video and text was of the past. Few people thought that one of the smartpjone's most powerful features would be a semi-decent typing experience.

When I think back to 2008, sure, geeks used irc, but for most people the thought of typing messages in a chat room seemed hopelessly anachronistic. It wasn't something you do on your fancy new iPhone. Siri, released in 2011, seems driven in part by this perspective, and a vision that the future will be voice-based.

The fact that a lot of people actually prefer texting kinda took the tech industry by surprise. People thought the more advanced technology that more accurately reproduced a conversation with another person would dominate. It turns out that the more psychologically comfortable technogy won, which I think is often the case.

Of course, there are a lot of other reasons why apps like WhatsApp and WeChat have succeeded in developing markets that more driven by local infrastructure and economics.

<comment><USER11> _The fact that a lot of people actually prefer texting kinda took the tech industry by surprise._

And not for the first time, either. SMS was originally just a kind of afterthought, and the original GSM phone UIs de-emphasised it strongly (eg. hidden away several levels deep within menus, and some early Nokias I remember couldn't even send SMS at all - only receive!). The industry was entirely unprepared for how it took off.

</comment></comment></comment><comment><USER12> Okay, I have to ask: it's been years since I came across someone else who'd heard of (nevermind used) Odigo[1]. Anyone remember that?

It was one of the most beautiful applications I'd used, one that mixed magical fantasy with something purely functional. It _got_ affective design a decade before the industry started started getting interested in it gave it a name. If I remember correctly, it even had a beautiful on-boarding experience with lush imagery and sound effects. As a kid, I got to meet people from all around the world, imagined their lives (you created an avatar but everything else was just information you chose to disclose, or not) -- it was just fantastic.

And then it vanished.

Anyone?

1: Some images to give you an idea of what it was like: [https://duckduckgo.com/?q=odigo+messenger&ia=images&iax=1](https://duckduckgo.com/?q=odigo+messenger&ia=images&iax=1)

<comment><USER13> I did not remember the name but that picture sure brought back memories. I remember trying it out. Never actually used it though because of network effects. Everyone I knew was on Y! Messenger or as we used to call it mess.

</comment></comment><comment><USER14> I was just thinking about this. In 2010 (when many people were building GroupOn clones) I don't think people thinking about tech really saw this coming: that chat apps would not just be successful at such large scale but also subsume VOIP, ecommerce... Otherwise large companies would have valued and focused on their older chat apps like BlackBerry Messenger, MSN Messenger, AIM. Even actively used apps like Google Hangouts and Skype didn't really go aggressively after the user base now held by WhatsApp, WeChat, Facebook Messenger.

<comment><USER15> Blackberry's former co-CEO saw it coming. But he lost a battle to reposition the company in a way where he thought they could go for the opportunity. That being said, if he had won that battle, who knows whether or not he would have actually succeeded in his vision though.

[http://www.theglobeandmail.com/report-on-business/the- inside...](http://www.theglobeandmail.com/report-on-business/the-inside-story- of-why-blackberry-is-failing/article14563602/?page=all)

Relevant quote:

 _Inside RIM, the brash Mr. Balsillie had championed a bold strategy to re- establish the company's place at the forefront of mobile communications. The plan was to push wireless carriers to adopt RIM's popular BlackBerry Messenger (BBM) instant messaging service as a replacement for their short text messaging system (SMS) applications – no matter what kind of phone their customers used.

It was a novel plan. If RIM could get BBM onto hundreds of millions of non- BlackBerry phones, and charge fees for it, the company would have an enormous new source of profit, Mr. Balsillie believed. "It was a really big idea," said an employee who was involved in the project._

<comment><USER16> > If RIM could get BBM onto hundreds of millions of non-BlackBerry phones, and > charge fees for it,

Why would carriers want to get on board with it? Just take a look at heir resistance to _free_ SMS replacement, now imagine they had to pay fees for it as well...

</comment></comment></comment><comment><USER17> Thought that it'd be interesting to compare the usage numbers of a few chat networks, since this article missed a few:

IRC - 1 million users around "peak" in 2003 (I don't actually know if this was the peak, but couldn't find numbers prior to 2003) ([https://en.wikipedia.org/wiki/Internet_Relay_Chat](https://en.wikipedia.org/wiki/Internet_Relay_Chat))

      RC usage has been declining since 2003, losing 60% of its users (from 1 million to about 400,000 in 2014) and half of its channels (from half a million in 2003).

Slack - 1 million users as of last year ([https://en.wikipedia.org/wiki/Slack_(software)](https://en.wikipedia.org/wiki/Slack_\(software\)))

      In 2015, Slack passed more than a million daily active users.

Kik - 240 million users as of last year ([http://arstechnica.com/business/2016/02/the-fall-and-rise- an...](http://arstechnica.com/business/2016/02/the-fall-and-rise-and-rise-and- rise-of-chat-networks/))

      With an updated figure of 240 million users...

WeChat - 570 million users as of last year ([http://arstechnica.com/business/2016/02/the-fall-and-rise- an...](http://arstechnica.com/business/2016/02/the-fall-and-rise-and-rise-and- rise-of-chat-networks/))

      As of September 2015 there are now more than 570 million people on WeChat's network...

</comment><comment><USER18> Ah, nostalgia. I used MSN Messenger religiously until I started college at which point had to switch to Linux (thank goodness). Lots of fond memories. At some point I figured that since MSN lists the online "buddies" in unicode order, putting a space at the start of one's display name puts them at the top of everyone's list!

Also, it's interesting to see how people corrected their typos back in 80s, "Er, " instead of "*". I like the former better actually.

</comment><comment><USER19> My first contact with internet was Microsoft Chat. I didn't know, at the time, it was an IRC client. But I was like 13, and at this time it was great fun see those comics take life on the screen and react accordingly to keywords !

Screenshot : [http://www.mermeliz.com/files/summary/comic.jpg](http://www.mermeliz.com/files/summary/comic.jpg)

</comment><comment><USER20> Some stats on chats [https://en.wikipedia.org/wiki/Instant_messaging](https://en.wikipedia.org/wiki/Instant_messaging)

Have to scroll down about 4/5 of the way.

<comment><USER21> Here's a more granular URL for convenience: [https://en.wikipedia.org/wiki/Instant_messaging#Statistics](https://en.wikipedia.org/wiki/Instant_messaging#Statistics) :)

</comment></comment><comment><USER22> Most people I know use Skype for the same purpose that I used MSN Messenger for back in 2000. I think I pay $6 a month for a telephone number through Skype.

The idea of valuing a cell phone chat app at billions of dollars seems silly, because if the cell phone companies made text messages free there would be no reason for the chat apps to exist.

<comment><USER23> It's not true that there's no reason for the chat apps if texting is free. For me and all of my friends text messaging is practically free (there's no unit cost, and every plan we would want has no unit cost), but we use WhatsApp and WeChat just as much.

The last two are super convenient when you want to send pictures, video, and location and they have indicators to tell you if people are online or not and if they've seen your message or not.

They have reliable group messaging unlike iMessage which only works with half your friends and is therefore useless, and Hangouts which switches views so slowly the conversation has gone right by you.

Oh, and the cost thing just makes things worse because these chat apps work internationally seamlessly with all features. I can be in an airport in Thailand and just need to find a WiFi point and I could just as well be sitting in SFO waiting for my plane.

<comment><USER24> > we use WhatsApp and WeChat just as much.

> The last two are super convenient when you want to send pictures, video, and > location and they have indicators to tell you if people are online or not > and if they've seen your message or not.

I use wechat heavily. I haven't noticed presence indicators or message status at all. Presence indicators actually contradict the basic premise of a phone messaging app, which is that the other person is always online. Your phone moves with you.

Where might I find these purported features of wechat?

<comment><USER23> Whoops sorry. I switch between the two (WhatsApp and WeChat) for different groups. That's a WhatsApp feature and it's great (says "last seen at" or "Online").

</comment></comment></comment></comment><comment><USER25> I got curious and researched the history of IM, the decline of the old networks, and the rise of the new.

Anecdotally, I got into college (in the US) right as Facebook and Gmail opened up to everyone, and my peer group created a "professional presence" of Facebook and Gmail for our college lives, slowly leaving our myspace/AIM/WLM lives with the crazy hair and skinny jeans behind. My experience was not unique; this phenomenon has been researched by others [1][2][3][4]. Soon, Facebook and Google introduced chat, and nearly everyone I wanted to talk to was on one or both of those networks.

During my research, I was surprised to learn that AIM was in fact present at the iOS appstore's launch, but I suppose there wasn't much overlap between a typical AIM user and a typical iOS user at the time.

I also found an infographic from 2014 that charts some of these dates and compares the active user counts of the IM networks over the years [5].

Here's a chronological timeline of selected milestones in the IM/social space:

2005-09 - Meebo launches offering web access to AIM, WLM, Yahoo

2006-02-07 - Google Talk integration inside Gmail goes live

2006-03 - Nielsen/Netratings survey for active users: AIM 53M, WLM 27M, Yahoo 22M

2006-07-12 - seamless interop starts between Windows Live Messenger and Yahoo Messenger

2006-09 - Facebook opens up to everyone (not just colleges)

2007-07-07 - Gmail opens up to everyone (not just invite-only)

2007-05-09 - Windows Live Messenger released for Xbox 360 (with dashboard update)

2007-12-06 - Google Talk gets limited AIM interop

2008-04 - Facebook chat goes live

2008-04-19 - Facebook overtakes Myspace in Alexa ranking

2008-07-11 - iOS App Store launches, AIM for iOS released

2008-08-26 - Facebook hits 100 million active users

2008-09-23 - Android 1.0 launches

2008-11-11 - Google Talk introduces voice and video calling

2008-12-22 - Meebo integrates with Facebook chat and Myspace IM

2009-03-31 - Skype released for iOS, Skype network has 42 million active users

2009-04-08 - Facebook hits 200 million active users

2009-06 - iOS gets push notifications

2009-09-15 - Facebook hits 300 million active users

2009-11 - WhatsApp released for iOS

2010-01 - WhatsApp released for BlackBerry

2010-02-05 - Facebook hits 400 million active users

2010-05 - WhatsApp released for Symbian

2010-05-20 - Android gets push notifications

2010-06-21 - FaceTime released with iOS 4

2010-06-21 - Windows Live Messenger released for iOS

2010-07-21 - Facebook hits 500 million active users

2010-08 - WhatsApp released for Android

2010-09-30 - Windows Live Messenger starts interop with Facebook Chat

2010-10 - Kik released

2010-12-02 - Viber released for iOS

2011-01-05 - Facebook hits 600 million active users

2011-01 - WeChat released

2011-01 - Skype for iOS introduces video calling

2011-04 - Facebook introduces voice calling

2011-05 - Viber released for Android

2011-05-30 - Facebook hits 700 million active users

2011-06 - LINE released

2011-07 - Facebook introduces video calling

2011-07 - Snapchat released for iOS

2011-09-22 - Facebook hits 800 million active users

2011-10-12 - iMessage released with iOS 5

2011-10-13 - Microsoft finishes acquiring Skype

2012-04-24 - Facebook hits 900 million active users

2012-07-11 - Meebo is acquired by Google and shut down

2012-10-29 - Snapchat released for Android

While it's tempting to accuse AIM, MSN, and Yahoo for being incompetent and not catching up to the "mobile era", they in fact did pursue this market as much as they were able. In truth, early iOS and Android were inferior platforms for a chat app. Push notifications were absent, data rates were expensive, and the average smartphone user at this time was not very likely to use those networks anyway.

Based on this info, I reason that it was truly Facebook that killed incumbent IM networks, at least in the US. Between the release of the iOS App Store and the introduction of push notifications for Android, Facebook grew by more than 300 million active users. This coincided with exodus of users from Myspace to Facebook; many of those users likely having used AIM, MSN, or Yahoo messenger in the past, now found themselves in a much larger network that also offered chat. Since Facebook largely subsumed everyone a person knew in real life, these users only had to go back to the old IM networks to chat with people they didn't know in real life, setting the stage for the weakening of connections and these networks' decline.

By 2010, Facebook, or at least awareness of it, was mainstream. At the end of 2008, the Webster's New World Dictionary named "overshare" as the word of the year [6], while in 2009, the New Oxford American Dictionary chose "unfriend" [7]. For people new to the IM landscape, the old networks were dying and full of "old people" now in their 20s and 30s, so new networks surfacing around this time were appealing. This contributed to the grown of Kik and Snapchat, while people for cheaper alternatives to texting and voice calls drove the adoption of Viber, WhatsApp, and Skype. iMessage went live in late 2011, offering with FaceTime a built-in rich chat on iOS, successfully capturing an audience that would've surely gotten a third-party app otherwise. Later, Hangouts on Android emulated this strategy.

Skype is a remarkable special case. Microsoft managed to squander the popularity of MSN/WLM with its confusing product strategy, then it acquired a VOIP product that targeted a different customer base. Not content with running the two products separately, they deprecated WLM and encouraged everyone to migrate to Skype, which didn't happen. Later, they leveraged Skype as the built-in IM for their OS, while still committed to keeping it cross-platform. It could very well be a trojan-horse into the Microsoft ecosystem, but it's essentially entirely separate, completely unlike Google Hangouts.

So now we're living in a time when smartphones come with IM out of the box, nearly every social network is gaining IM functionality (Instagram, Twitter, Tumblr, etc.), and the new wave of circa-2011 chat apps are diversifying into social networks (Snapchat) or platforms themselves (Kik, Viber, WeChat, LINE). You actively use more than product capable of IM, but rarely by choice and mostly by acclimation. Ironically, this situation benefits platforms the more closed they are, an intuition that's made clear by complete decline of interoperability between platforms in the past. IM is ubiquitious, leaving old "IM only" networks owned by corporations who can't figure out what they're doing (AOL, Yahoo) utterly irrelevant.

Sources:

[1] 2012 [http://socialtext.dukejournals.org/content/30/2_111/99.full....](http://socialtext.dukejournals.org/content/30/2_111/99.full.pdf)

[2] 2011-06-22 [http://www.bloomberg.com/bw/magazine/content/11_27/b42350539...](http://www.bloomberg.com/bw/magazine/content/11_27/b4235053917570.htm)

[3] 2007-07-11 [http://www.nbcnews.com/id/19717700/](http://www.nbcnews.com/id/19717700/)

[4] 2009-03-16 [http://www.newsfactor.com/news/Facebook-Traffic-More-Than- Do...](http://www.newsfactor.com/news/Facebook-Traffic-More-Than- Doubles/story.xhtml?story_id=10000BCLMR0W&full_skip=1)

[5] 2014-10-22 [http://www.whoishostingthis.com/blog/2014/10/22/instant- mess...](http://www.whoishostingthis.com/blog/2014/10/22/instant-messengers/)

[6] 2008-12-01 [https://wordoftheyear.wordpress.com/tag/websters-new- world/](https://wordoftheyear.wordpress.com/tag/websters-new-world/)

[7] 2009-11-16 [http://blog.oup.com/2009/11/unfriend/](http://blog.oup.com/2009/11/unfriend/)

</comment><comment><USER26> Not a single word about lacking interoperability and encryption? What a crappy article.</comment>


About the AOL announcement (2005) - <AUTHOR> https://googleblog.blogspot.com/2005/12/about-aol-announcement.html <comment><USER2> > _There will be no banner ads on the Google homepage or web search results > pages. There will not be crazy, flashy, graphical doodads flying and popping > up all over the Google site. Ever._

How times have changed.

[https://mashable.com/2012/08/28/google-homepage- ad](https://mashable.com/2012/08/28/google-homepage-ad)

[https://www.theguardian.com/technology/2013/oct/24/google- br...](https://www.theguardian.com/technology/2013/oct/24/google-breaks- promise-banner-ads-search-results)

<comment><USER3> To be fair, there aren't "banner ads" on either the Google homepage or the search results pages. Neither are there "crazy, flashy, graphical doodads flying and popping up". There are definitely ads on the search results pages, and they take too much vertical space IMO, but they're text and small images, not flashing and tacky stuff.

<comment><USER4> completely depends on your definition of "crazy". I mean Google used to show ads for a particular drug if you searched for suicide methods that would call for such drug.... that's pretty crazy in my book.

also most of the deal was about video ads. just take a look at YouTube.

</comment></comment></comment><comment><USER5> _Google to Invest $1 Billion for a 5% Stake in AOL

Companies to Collaborate on Online Video Offering and Make More AOL Content Available to Google Users_

([http://googlepress.blogspot.com/2005/12/time-warners-aol- and...](http://googlepress.blogspot.com/2005/12/time-warners-aol-and-google- to-expand_20.html))

Wow, I really didn't remember!

<comment><USER6> At that time Google Video was a decent alternative to Youtube.

</comment></comment><comment><AUTHOR> Google SERP with banner ads (2019): [https://twitter.com/glenngabe/status/1098939747018461184](https://twitter.com/glenngabe/status/1098939747018461184)

</comment><comment><USER7> I was more surprised with how archaic the word "webmaster" sounds today.

</comment><comment><USER8> Note this is the 2005 deal. The 2002 ad deal with AOL is probably the single moment that defined the business success of Google, the moment when the AdWords product took off and became the unstoppable juggernaut. I'm still impressed with Google's executive team, particularly Salar, that the deal worked even better than we could have hoped. [https://www.nytimes.com/2002/05/02/business/technology- aol-s...](https://www.nytimes.com/2002/05/02/business/technology-aol-shifts- key-contract-to-google.html)

</comment><comment><USER9> This was important at the time. AOL's ad inventory converted VERY well and it was very strategic to keep it out of the hands of Microsoft/Bing and Yahoo, both of whom were serious competitors (on hindsight this was where they were actually beginning to diverge and hit their maxima). In the two sided ads marketplace this was critical to have the most and the highest-quality inventory to bring more network effects w/ advertisers getting good results. The investment was terrible but I suppose they just wrote it down as a $1b fee to keep Yahoo off of AOL.

<comment><USER10> Google sold back it's 5% stake in 2009 for $283.0 million.

[https://www.nytimes.com/2009/07/28/technology/companies/28ao...](https://www.nytimes.com/2009/07/28/technology/companies/28aol.html)

</comment></comment><comment><USER11> "Our goal is to organize all of the world's information."

Funny how this seems much creepier in 2019 than it did in 2005...

<comment><USER12> Yeah. In 2005 I had no idea they meant "personal information".

Although in 2005 maybe they hadn't even realized yet.

<comment><USER13> They didn't have any clue. Back in 2005 personal data and access logs and analytics was considered a chore, you'd delegate the annoyance of log rotation to some sys admin or helpdesk intern and generally purge all data as quickly as possible because storage was expensive.

Occasionally someone would make a cool tool that parsed htaccess logs and gave you a neat visualization or something, but that was it. Literally nobody tracked anything on the internet.

It almost seems like fiction when I type it out now.

</comment></comment></comment><comment><USER14> The writing style is really different in Google blog posts today.

It really shows how the blog post passing through PR, legal, etc. review makes it bland and almost meaningless.</comment>


Ask HN: Provocative yet Funny Advertising for Startup - <AUTHOR>

So we're trying to come up with a catchy, short, provocative phrase to use for marketing our startup that would make a person curious enough to look us up (and get a laugh or two out the phrase).
Background: We're trying to make a "Pandora for food" that works across multiple countries and runs on smart phones. The app is called Eatable.
So we have a few ideas, but I'd love to hear your thoughts and suggestions for better ideas! Some ideas (We would put it on shirts and stickers):
"Are you Eatable?" "Is it Eatable?" "See anything Eatable?" <comment><USER2> I'm not helping here but what is 'Pandora for food' a streaming smorgasbord?

Curious

<comment><AUTHOR> Basically the same way Pandora recommends music based on your musical tastes, we want to do with food.

An app that based on your tastes will recommend food you might like, anywhere around the world.

<comment><USER2> Sounds good, but non-users of Pandora might not get it.</comment></comment></comment>


Immutable Values and Invariant Names - <AUTHOR> http://mortoray.com/2013/02/04/immutable-values-and-invariant-names/

<comment><USER2> Even if collection types, such as vectors, are immutable in your language (which BTW I think is a great idea), you can still allow element-wise assignment:

      a = [1, 2, 3]
      a[1] = 4

This works if it has a different semantics from what you might expect: instead of updating a potentially shared object, it is considered equivalent to

      a = [a[0], 4, a[2]]

That is, it doesn't modify the object 'a' refers to; rather, it updates the binding of 'a' itself. So, for example:

      a = [1, 2, 3]
      b = a
      a[1] = 4
      b[1]  -->  2

I've used a language with this property for some years, and it's quite pleasant; you don't have to worry about copying a collection before returning from an interface, for example, to protect it from being modified by the client.

<comment><AUTHOR> That syntax certainly fixes a major problem when dealing with immutables. The mutable-like syntax I find is the cleanest way to construct complex data types.

I keep thinking about using only immutables in my language, but I don't think it will be possible. I'm intending to a be a system language, and there are simply too many situations where you need to modify data in-place. I'm struggling to see if I can still find a place for immutables in situations where they work fine.</comment></comment>


EFF to Tenth Circuit: First Amendment Protects Right to Record Police - <AUTHOR> https://www.eff.org/deeplinks/2019/05/eff-tenth-circuit-first-amendment-protects-right-record-police <comment><USER2> It just struck me that destroying evidence is a crime, but that is essentially what police officers are doing when they delete footage of themselves. Whether or not that evidence would support their actions.</comment>


Show HN: Almost 3 years after Ask HN - <AUTHOR> 3 years ago, I asked for help around how to get revenue from a website with decent traffic (https://news.ycombinator.com/item?id=5342144). I got some really good feedbacks but didn't action them. My main issue was that I wanted to get revenue while keeping most of the content free.<p>In November, I finally managed to push out a subscription based system that provides extra-content (videos), online access to exercises and the ability to get certificates of completion: https://pentesterlab.com/pro. The growth is steady so far and people love the service. <comment><USER2> This is great. Beginners can also join 33k users world-wide on [https://www.hacking-lab.com/](https://www.hacking-lab.com/) for free :)</comment>


Square Arrives in Canada - <AUTHOR> https://squareup.com/news/releases/2012/square-arrives-in-canada?a=1 <comment><USER3> You are useless in Canada without Interac (debit, but not really from a US POV [1]). This is the number one choice of payment in Canada. Hell, I don't even _carry_ cash anymore because Interac is near universal.

It's going to be difficult to gain traction for Square if they are offering businesses a solution that only provides half of what the competition does, even if it is cheaper.

Square has - unless they know something they aren't saying - <USER2> misunderstood the reality of the marketplace in Canada. It is not the US with funny tax laws. In the realm of consumer banking/payment, we are light years ahead of the US in certain key ways.

1\. In Canada, our bank/atm cards are our debit cards. The entire system is linked with a joint network called Interac. When you open a bank account you get a chip/PIN enabled card that allows you to make direct withdraws from ATMs, as well as instantly buy something from a terminal at a store. Credit Card providers are shut out of this system, and its 100% penetration with Canadian banks has made it the primary consumer choice for payments. Yes, security is a bit of an issue, hence the high rate of chip adoption in Canada. See: <http://en.wikipedia.org/wiki/Interac>

<comment><USER4> In the US our bank/atm cards are our debit cards. I don't see how that is light years ahead of the US.

<comment><USER5> Our debit cards don't have credit card companies man-in-the-middling the transactions, instead using a standardized network governed by a non-profit.

Also the debit system has been ubiquitous for 28 years.

</comment></comment></comment><comment><USER6> What is really amazing is to launch a website this big and have a typo right on the front page. "Sains frais" just means nothing. My guess is they wanted to say "Sans frais", which is "without fee". Nobody speaks French at Square ?!

<comment><USER7> Their English isn't much better.

"Square Register is the free app that allows anyone to safe and secure credit card payments with[...]"

That said, it isn't a big deal to me. Square is really cool and I hope it will be available in Australia at some point, though I won't be holding my breath.

<comment><USER8> More startups should hire writers, or at least, people with some level of writing skill who will notice stuff like this.

<comment><USER9> Definitely under appreciated. Writing is everywhere!

<comment><USER8> *under-appreciated

;)

</comment></comment></comment></comment></comment><comment><USER10> Some of the comments criticising stripe-only and lack of Interac support, seem a tad hyperbolic.

While these are valid concerns, Stripe transactions are still accepted and I'm sure there's a decent chunk of places using stripe. By the time chip is universal, I'm sure Square will have addressed this shortcoming. As for Interac, I'm presumig that the expansion to Canada will also include the Starbucks partnership, so I imagine it can't be far behind.

The regulatory environment is much different in Canada. The biggest thing I see here is the fact that a startup with significant attention and traction is entering our market. When they partnered with Starbucks, I was curious if that would mean they would provide coverage across North America and it definitely looks like they are. In the short term, I think Square Wallet is the key takeaway here. Mobile payments are gaining some serious steam and Square has a big chance to establish an early lead.

<comment><USER11> I think some of my fellow Canadians are being a bit harsh on Square here. You raise some good points, Starbucks is also one of the only places here in Canada that I still swipe at. Most other places insert chip.

But I think it will take a long time for those others to switch or even consider using a different platform. I'd guess that this is also what Square assumes.

But there's a big opportunity here that I enjoy dealing with in the US but hate here in Canada. I don't use cash and I travel a lot. I have to go to the airport by taxi frequently. In Canada it's a pain in the ass because they actually get out the old carbon copy machine and the drivers complain all the time. In the US the driver hands me his phone with a Square on it. So much better.

<comment><USER12> Square's goal seems to be removing as many barriers as possible to accepting CCs; they aren't aiming for people who already take them as much as those who otherwise couldn't (easily). The hardware needed to accept chipped cards is far more complex than the simple mag-stripe reader they're currently using (not to mention likely not universal); it'll take time to start production on those. The incumbents will still be around to displace once they're ready to.

<comment><USER13> They could buy iZettle ;)

</comment></comment></comment></comment><comment><USER14> Someone should tell Square that in Canada we use smart chips...I don't remember the last time I swipe a card....Cool product with prehistoric technology...

<comment><USER15> Canadian credit cards still have stripes on them that work. I don't see the problem.

<comment><USER14> You are right but you and I know the Square brand so I won't have a problem to use it but here in canada any time Banks give you a brand new card with smart chips , they tell you to stop using the swipe system because it's not as safe as the smart chips... Guess what!? my mom stops and refuses to use a swipe system of any kind....

<comment><USER16> Because the PIN is not meant to be shared, it is a lot easier for banks to deny all responsibility for any card fraud when using chip-and-pin in court, which is why they are so gung-ho in convincing people to use them.

</comment></comment></comment></comment><comment><USER17> What would be amazing is if they started taking Interac as well.

<comment><USER5> Yeah, it feels significantly less useful in the Canadian market without support for Interac. You couldn't run a business with just this, here (unless you want to get yelled at by, and lose a lot of sales to, the 90% of your customers who are going to want to pay by debit and not credit).

<comment><USER18> My girlfriend was selling at a craft fair recently, and I bought her a nice pair of earrings from another vendor who used Intuit's GoPayment system, and honestly I probably wouldn't have remembered to come back once I had cash (if I'd even gone to get any). In that sort of environment, the standard is 'cash only', so adding Visa/MC to that is a bonus, not a drawback, and in my case it made her a $60 sale she wouldn't have otherwise had.

This is especially true for higher-ticket items like silver jewellery, where I'm not likely to have $60 kicking around in my pocket, but I'll have no problem putting $60 on my Visa. Personally, I also find it hard to part with $60 in cash (more tangible) vs. putting it on my Visa or debit card.

For actual businesses (like bigger food carts), a proper 3G bank terminal is probably the appropriate response, but in places where people aren't likely to expect any card use at all (smaller food carts, craft fairs, yard sales), having Square (or similar) is a net positive.

<comment><USER5> The problem is, that's really a different use case/value proposition than Square has in the US.

Square is a godsend for small businesses there. Square's all over Portland, for instance, not just at yard sales and craft faires but in real businesses because it's an absolutely disruptive form of payment that lets them avoid some onerous fees and setup costs, and it lets them accept debit because debit piggybacks on the credit system in the US.

But it's pretty crippled for that here in Canada. I know several small business, including my wife's, who were dying for Square to come here, because getting set up with a proper payment terminal in Canada is obscenely expensive for a small business.

But there's absolutely no way that they could use this as offered, with zero debit support, ubiquitous customer demand for debit usage, and no support for chip-reading in an environment where chip usage will be mandatory in 2 years and in which not using a chip already causes credit card transactions to be declined as 'suspicious' at a fairly high rate.

<comment><USER19> I have to agree. I used Square in the US and loved it; since coming back to Canada I've been singing its praises to anyone who'll listen. However, now that it's launched and we've had time to think through what it looks like on the ground, these all look like pretty serious limitations to its widespread applicability in Canada. Although it's still useful for my needs (the odd Craigslist purchase, craft fairs, pop-up stores in the neighbourhood), I can't see it being as disruptive here as it is in the US given these limitations.

</comment></comment></comment></comment></comment><comment><USER20> Impressive that Square can launch in Canada while much of Google's offerings apparently can't.

</comment><comment><USER21> Does anybody know how they deal with the smart chips on the credit card? Almost no retailer uses the swipe anymore.

<comment><USER5> They seemingly don't. Which gives the current reader a, what, 2 year lifespan max? They shut swipe-based transactions down entirely at the beginning of 2015, IIRC. My Visa already is far more likely to flag a transaction as suspicious if it isn't chip-authenticated.

Between that and the total lack of Interac support, this is honestly a pretty lame offering. It feels like Square has absolutely no awareness of the current state of Canadian payment systems.

<comment><USER22> They give the reader away for free, and it costs them almost nothing to make it. Who cares if it's only good for a couple of years?

<comment><USER5> If I'm going to use Square for my business, I want to know I'm not going to be changing horses frantically in 24 months when the strip is no longer an option.

The problem here is that Square is launching with, for the Canadian market, antiquated, rapidly approaching EOL technology, and given no indications if or when they'll catch up to the standard -- or even that they realize that their offering is substandard here compared to the US. Will they issue a new reader next month? A week before the deadline? Will they just pull out in 24 months?

No answers forthcoming.

(and that's on top of the other issues, like the vast majority of customers demand debit, and chip card credit cards that get swiped for transactions get declined at very high rates because it's highly correlated with skim fraud)

</comment></comment></comment></comment><comment><USER23> Square's company motto: Don't be Oval.

</comment><comment><USER24> Canada is nice and all, but what about us Australians? There is no alternative payment provider to a bank other than using "Paypal Here" (which launched a few months ago). Eftpos absolutely dominates retail transactions here, I think a competitor needs to step up because my understanding is Eftpos fees are quite high for a retailer here.

</comment><comment><USER25> So far I've attempted two different forms to mail me a Square reader in Canada and both failed.

The first (presented immediately after registering) required me to provide a Zip code (and wouldn't accept a postal code) and the second (found through account settings) allowed me to provide a postal code but required I select a state (and only presented US states in a drop down).

Clear examples of common localization issues. Hope they get it sorted out so maybe, one day, I could actually use Square in Canada...

</comment><comment><USER26> Embarrassingly, square.ca is rather... bare at the time of posting.

I am super excited for this, though. I have a number of friends who sell artwork at various outdoor fairs, and I've inundated them with tales of how much easier theirs lives would be if they could get a credit card reader for their phone. It really reduces the friction involved in trying to make what is essentially a several hundred dollar impulse purchase.

edit: Is it just me, or are all the thinks in the press release broken? squareup.ca, square.ca, squareup.com/ca/ca/fr, none of these work.

<comment><USER27> Seems to be up and working now. You can tell as the credit cards seem to be limited to Visa/MC as opposed to the US version.

<comment><USER26> For me, square.ca goes to a small 'Search The Web' page still. As linked in their press release.

<comment><USER5> Stale DNS, most likely.

</comment></comment></comment></comment><comment><USER28> Very very very poor french translation.

<comment><USER29> Read through it, could not find any grammar mistakes. I think it's fine.

<comment><USER28> Grammar is not the problem. Hence the word "poor" and not "bad".

</comment></comment></comment><comment><USER30> There's also Kudos:

<http://takekudos.com/>

which seems to do the same thing as Square. Anyone used both services and is willing to compare them? Kudos seems to be slightly more expensive ($50 signup + higher swipe fees).

<comment><USER31> "Paypal Here" should be here soon too. <https://www.paypal.com/webapps/mpp/credit-card-reader>

Also, there's <http://payfirma.com>

<comment><USER18> PayFirma is pretty pricey (and via Twitter I was told that they're 'aiming for a different market' than Square). Intuit's Gopayment seems like a better option for smaller businesses or craft fairs: <http://gopayment.intuit.ca/>

</comment></comment></comment><comment><USER32> What advantages does Stripe have over Intuit's GoPayment (<http://www.gopayment.ca/Intuit>)? Intuit's rates are actually lower (albeit by only .05%).

</comment><comment><USER33> Anybody notice that www.square.ca has been hijacked? I have it redirecting to a page with an iframe from areasnap.com . I have tested this on two different networks near Vancouver.

<comment><USER18> I thought they just had a broken website. Saw the same thing from home in Vancouver this morning.

</comment></comment><comment><USER34> Please, come to Europe.

<comment><USER35> <https://www.izettle.com/>

Might not be your parts of Europe, though. :-)

</comment></comment><comment><USER36> Looks to only be Visa/MasterCard, not American Express. Any idea if Square is looking to add Amex support in Canada?

</comment><comment><USER37> I chuckled a lot at this headline.

</comment><comment><USER38> We want Square in France too!</comment>


Derek Sivers' 3 Minute TED Talk (Video) - <AUTHOR> http://37signals.com/svn/posts/2151-derek-sivers-3-minute-ted-talk

<comment><USER2> At the PAX 2009 Saturday night concert, my 5+ friends and I were people watching. There really are some odd folks at any big geek convention.

While we were waiting for the next act, someone brought up the story of the shirtless dancing guy and I jokingly challenged my slightly drunk friend to be that guy. He said "I can't dance." I told him "Dude, just do the Hokie Pokie."

He started singing and dancing and we all backed up a few steps. He was joking, but he soldiered on to the second verse, and then the third. During the 3rd verse, we kinda felt bad for how ridiculous he looked and people were watching _us_. So I and a few of our circle started in. Then, a girl in a giant dragon costume ran over to join. As soon as the dragon girl showed up, everyone was watching. We started the song over, expanded the circle, and before you knew it, there was 3 more people running over. By the time we actually made it through the whole song without having to expand the circle, there was almost 40 people doing the Hokie Pokie!

The weird bit about this story, however, is that doing the Hokie Pokie in a circle limits how far you can grow. As the circle kept expanding, it became less and less space efficient. People were excluded simply because there wasn't space for them to join. At almost 40 people, the Hokie Pokie circle had effectively collapsed under its own size. Maybe next year we'll try a dance that scales better.

<comment><USER3> Your hokie pokie story reminded me of this video: <http://www.collegehumor.com/video:1912826> (Sorry for the collegehumor link, it seems to have been removed from youtube.)

<comment><USER4> Am I missing something? That's video shown in the article...

</comment></comment></comment><comment><USER5> The Dancing Guy never fails to amuse. Almost as good as the Hitler subtitle meme.

Of course, a "lone leader" is an oxymoron. By definition, a leader requires followers. The concept of "first-follower advantage", as opposed to "first- mover advantage", is interesting to think about in the context of technology. Haven't most or all of Apple's really big things been "first-follower" or "early-follower" products?

<comment><USER6> In support of you: your first _competitor_ validates your market space.

<comment><USER7> Yeah. For about 1 week I was totally paralysed by this list of my competitors. Then I realised that

1\. They totally validate my value proposition

2\. None of them offer multi channel, web enabled, real time power monitoring

3\. I am the bomb.

Okay, perhaps 3 is exaggerated, but I've got to stay sane somehow!

The list: [http://blog.mapawatt.com/2009/10/07/list-of-energy- monitorin...](http://blog.mapawatt.com/2009/10/07/list-of-energy-monitoring- tools/comment-page-1/#comment-1962)

</comment></comment></comment><comment><USER8> Seth Godin says we need more risk takers like Guy #3. Let's go out on a limb and say that guys 1-3 are all stoned. What does that say about the difference between risk-taking vs. lack of inhibition? I think a lot of what is called risk taking is actually just stage fright and fear of public failure.

<comment><USER9> Well in this case, the consequence of failure is the ridicule and embarrassment, so the risk calculation is affected by the dancing guy's perception of those consequences. This isn't exactly a far-reaching effect.

In other cases, the risk may be greater - when thesixtyone launched a full interface redesign, they could have sat on their hands indefinitely, not just because of stage fright, but because something that they put a whole lot more of their life into is on the table than the opinions of other shirtless concertgoers.

I think it's related to a lot more than inhibition, although I would agree that the risk-taking personality trait probably spans both situations.

And to be fair, Seth also said we need more leaders(1) and artists(2) - encompassing all three of the core team, really. Also, it's worth note that a stoned customer is still a customer :)

(1)<http://amzn.com/1591842336> (2)<http://amzn.com/1591843162>

<comment><USER7> You can remove inhibition by removing risk.

Money back guarantees, free trials, browsing existing sites, services that attract groups of people are all great for this.

Gridspy offers a 5 year back to base hardware warranty. I'd like to offer a "if you don't like it, send it back for a full refund any time in the first year" warranty.

</comment></comment></comment><comment><USER10> Transcript can be found at Derek Sivers' site: <http://sivers.org/ff>.

</comment><comment><USER11> I'm a bit confused, as this: <http://www.youtube.com/watch?v=1K5SycZjGhI> is his TED talk, and the dancing guy was just a really good video that Derek posted, right?

<comment><USER12> No..the video you have posted was from TED talk 2009 in Mysore, India...and the video mentioned here is from TED talk yesterday as Derek mentioned in his blog

<comment><USER11> Ah, ok thanks

</comment></comment></comment><comment><USER13> Obligatory:

Bolero - Maurice Ravel

<http://www.youtube.com/watch?v=3-4J5j74VPw>

</comment><comment><USER14> Very well done.

</comment><comment><USER15> Strong stuff!</comment>


Why is Internet Explorer not available for Mac? - <AUTHOR>

When Safari is available for both Mac and Windows why Internet Explorer is not available on Mac and other platforms? <comment><USER2> IE was available for Mac until Safari came out. MS knows all about crushing the competition by bundling your browser with the OS, so they just skipped to the endgame and canceled IE.

</comment><comment><USER3> IE9 isn't even available for Windows XP, I don't think need to say more. IE is a part of Windows, nothing more.

</comment><comment><USER4> Microsoft Office is available for both Windows and OSX, why is iWork not available for Windows ?

<comment><AUTHOR> Because Microsoft Office is a paid app and Microsoft want to squeeze some juice there as well I guess where as IE is free...and so...</comment></comment>


Ask HN: What was your product's biggest marketing win? - <AUTHOR> My friend Lars recently told me that his company's biggest win (in terms of getting new email leads) was a focus on SEO: "Nothing beats people searching with intent."<p>What's been your biggest marketing win of the past year? <comment><USER2> I have had two pretty big wins.

Pretty easy (results in days): Answering questions on Quora was a relatively easy, quick win. I answered a question on salary negotiation or job interviews every day for a month, and immediately saw a lot more interest in my site.

Harder (results in 90+ days): A focus on SEO has really paid off. SEO takes a while to build up, but once it's built up, it's pretty reliable traffic source. That means I can spend time working to offer more value to visitors so they'll stick around and come back later.

<comment><AUTHOR> How long did it take? What keywords did you target?

What tools / approaches were most helpful?

<comment><USER2> My site is [https://fearlesssalarynegotiation.com](https://fearlesssalarynegotiation.com)

It seems like you're just asking about the SEO side (not Quora), so I'll focus on that.

My book is about salary negotiation, so most of my focus is on variations around "salary negotiation". That's a pretty competitive search term, so I focus on more long tail terms like "salary negotiation email", "salary increase letter sample" and "current salary interview question".

The tools I use are all free: Google analytics, Google search console, Google keyword planner, MozBar, and Google itself.

When I want to write a new article - I have a topic in mind - one of the first things I do is hop into the Keyword planner and figure out what people are ACTUALLY searching for around that topic. Most of the time, the way _I_ describe the topic is not the same as what people are searching for.

Once I know what people are searching for, I write the same article I would've written, but I try to use the more common terms rather than my own made-up terms. (For example, I would not usually say "salary negotiation email sample" \- I would say "counter offer email template" or something like that. But when people want that email template, they search for "salary negotiation email", so that's the terminology I used for that article on my site.)

I gave a very, very brief overview of some other tactics I use in a talk at this year's MicroConf in Las Vegas. Here are my slides, a link to a video, and links to some of the tools I use: [http://www.joshdoody.com/microconf](http://www.joshdoody.com/microconf)

Hope this helps!

<comment><USER3> I've never really thought about diving deeper into those tools until you and several others have been mentioning it more and more.

Quora has surprised me how much traffic you can get from it if you're correctly and directly answering questions with value

<comment><USER2> I highly recommend Quora as a marketing channel. It's worth exploring for your subject. Some areas aren't great, but some are very good. Mine (interviewing, salary negotiations) is particularly good on Quora because people have LOTS of questions about those things.

You could just search for a few terms in your area of expertise and see what comes up. You'll know pretty quickly if there are a lot of questions about it, or if Quora might not work for you.

</comment></comment></comment></comment></comment><comment><USER4> We reached out to everyone that ever did a review of a direct competitor within the last 4 years - we were very much last-to-market.

About 10% actually did a review of us on launch which gaves us a major boost. However, the ones that reviewed us a few months later are those with a long tail.

Reach out to those that love good products. Even if they have a small audience, it all adds up in the end.

</comment><comment><USER5> Biggest marketing win for [https://www.withcoach.com/](https://www.withcoach.com/) has been using our own product to create and promote free content.

Since Coach is an online course platform, we're not only giving people a demo of our product, but we're also providing value through content.

For example, we giveaway a free eBook on selling more online courses & digital products: [https://coach.withcoach.com/level-up-your- sales](https://coach.withcoach.com/level-up-your-sales)

We also run a free email course on launching your next digital products in 10 days: [https://coach.withcoach.com/10-day-product- bootcamp](https://coach.withcoach.com/10-day-product-bootcamp)

Both have driven thousands of leads to our product.

</comment><comment><USER6> The Cheap Bastard Plan:

[https://www.s3stat.com/Pricing.aspx](https://www.s3stat.com/Pricing.aspx)

<comment><USER7> Hats off to you for thinking up a really clever way to get and offer something of value to people who are super price-sensitive.

</comment></comment><comment><USER8> Our focus has been on giving as much free value at [https://www.cluboid.com](https://www.cluboid.com) as we can.

We mostly do this through our blog to pick up traffic like @JoshDoody mentioned below, but we try to capture the email by pay-walling (which I was MASSIVELY against at first) with a subscription page popup.

From there we drip feed them value before ever mentioning our own product.

However, without a decent backlink profile it can seem like you're not getting anywhere, so do bear in mind that SEO is the other side of the coin here.

</comment><comment><USER9> For [https://hellowebapp.com](https://hellowebapp.com), it was running Kickstarter campaigns to promote the books. It's a really effective way to do a "pre-order" campaign for the book, start a lot of conversations, and start building my email list (not to mention getting a chunk of money that replaced a traditional advance a publisher could give.)

For [https://weddinglovely.com](https://weddinglovely.com), I work with small businesses and running the weddings blog has been our biggest marketing win. Our businesses send us content, which we publish, getting traffic and also cementing our relationship with the submitting business. We've also started getting significant affiliate revenue ($2k+ mo) from past articles we've written.

</comment><comment><AUTHOR> OP here. These answers are great! Feels like content marketing is a big winner so far.

If you'd rather not comment on this thread, I've also created a quick survey here:

[https://tinymarketingwins.com/2017survey/](https://tinymarketingwins.com/2017survey/)

</comment><comment><USER3> I set up a small product and self assessment tool for [https://compassofdesign.com](https://compassofdesign.com) validating my target audience.

About 20% of my visible audience took part in the assessment and/or bought the product. I got a really good vibe of the people that are most likely to engage and who I should be focusing on.

Surprisingly, people that my content is reaching are further along in their journey than I had intended on reaching out to.

This has been my biggest result so far from my efforts

</comment><comment><USER10> Writing, blog posts on [https://thomasroest.com/](https://thomasroest.com/) that lead people to [https://linuxforwebdevelopers.co/](https://linuxforwebdevelopers.co/)

</comment><comment><USER11> B2B here: Cold everything. Then put them on a drip to keep warm if nothing happens quickly.

Be active not reactive.

</comment><comment><USER12> Yep. Inbound marketing. Let people find you. That is the most qualified lead ever.</comment>


Sleepy Puppy: XSS detection tool - <AUTHOR> http://techblog.netflix.com/2015/08/announcing-sleepy-puppy-cross-site.html

<comment><USER3>
        With delayed XSS testing, security engineers inject an XSS payload on one application that may get reflected back in a separate application with a different origin.

No need to go beyond application scope. Most tools even fail to detect XSS if it is reflected not in the immediate response, but in a later response. They inject the XSS payload and check if the immediate HTTP response contains that very string. If not, _there 's no XSS._

Maybe Sleepy Puppy is a solution. You could now define some standard click- paths through your app with Selenium IDE and inject various payloads into every parameter. I didn't take a deeper look in how Sleepy Puppy works, but automated workflow execution + payload injection + delayed XSS detection is what matters in modern complex web apps.

</comment><comment><USER4> Has anyone demonstrated XSS attacks that work even when CSP is properly configured? Seems like all discussion of XSS now-a-days should be preceded with a note that you should go turn on CSP before worrying about any other form of prevention.

<comment><USER5> From what I've seen, no -- but that depends what you mean by "properly configured."

If you look at challenges like this ( [https://github.com/cure53/XSSChallengeWiki/wiki/H5SC- Minicha...](https://github.com/cure53/XSSChallengeWiki/wiki/H5SC- Minichallenge-3:-%22Sh*t,-it%27s-CSP!%22) ), you'll see that CSP _appears_ to be properly configured, but there are actually ways to bypass. It's problems like this that I've seen "in the wild" most of the time.

The other side of the argument is that not many people are building web applications with CSP built-in from the beginning. If you don't start development with CSP in mind, it can become very cumbersome to put CSP into place (outside of report-only mode). As a result, a lot of people are currently using CSP as just report-only analytics on potential violations.

</comment></comment><comment><USER6> Sleepy Puppy doesn't really address the primary problem I've found when trying to automate the detection of non-reflected XSS issues: Mapping the input points and outputs outputs

The first thing you need to do when testing for XSS is you need to find where a user-supplied input is returned back out to a user. In reflected XSS, its the page you sent the request to. With "Stored" or "Delayed" XSS, it's somewhere else in the app or even a different app entirely.

Building this mapping when input and output points are in different areas, and doing that automatically has 2 challenges:

\- Clobbering your input

\- Finding the output point.

Clobbering input is something automated tools are terrible at. Let's say you are auditing a "save my settings" functionality in an e-com store, but the address values you save aren't actually displayed until later in the checkout process (i.e. you are dealing with a stored XSS). Let's say the vulnerable input is the state name (devs often forget to validate input when the input is a dropdown, because they forget people can make that input be anything they want).

You submit an attack string for the address, and valid input for state and zip. You don't see it reflected. You then do valid input for address and zip, but state has an attack string. Nice, but that doesn't appear until to later in the app. As an attacker, you don't know this, so you see its not a reflected XSS, and you do a 3rd attempt and submit valid input for address and state, and attack the zip. You have now clobbered your attack string that you submitted against the State with a valid, normal input for the state. When you get deeper into the app and see the state returned in the checkout process, it wouldn't be rendering your attack probe. That got clobbered by the valid input.

Unless you inject an attack token, and then sweep the entire site for that token, you won't find most stored/delayed XSS. Probe address field, crawl rest of site looking for your probe. Probe State field, crawl rest of site looking for your probe. This is super time consuming to do.

Automated tools suck at this. Humans are a better, because they understand context. I know that an address associated with an account is a likely stored XSS vector, and I have a gut feeling about where in the app the address will be rendered. Knowing context helps you also prune the number of inputs you should test for stored XSS. Unless I find an admin or analytics area in a site, I'm not going to bother doing this work to test if an HTTP header like User-Agent or Referer [sic] is a stored XSS vector as it is highly unlikely those inputs are reflected out somewhere else in the site.

If you have an output in another app its super hard. Sleepy Puppy tries to get around this by having the XSS payload "phone home" and pull an external JS file for a site they control to register where the output point is. While this is the best attempt I've seen, it has short comings. CSP defeats this. Also, it means the vulnerable input has to allow far more more characters to do the attack. spaces, quotes, parens etc cannot get filtered or encoded for the various Sleepy Puppy payloads to work.

This is a hard problem to solve. I'm glad NetFlix open sourced this.

<comment><AUTHOR> I agree with you about Sleepy Puppy not being a universal solution - <USER2> this is true for almost every tool.

The big wins with SP:

* automated

* narrows what kind of XSS can be present.

Security seems to be like quantum mechanics: there is always an uncertainty principle that prevents perfection.</comment></comment>


Saucy Business - <AUTHOR> https://www.thecleaverquarterly.com/stories/sichuan-chili-crisp <comment><USER2> This is a good article but it's a dupe (or quasidupe) of [https://news.ycombinator.com/item?id=18317591](https://news.ycombinator.com/item?id=18317591), from yesterday.

</comment><comment><USER3> Very well written, and has one of the better descriptions of Sichuanese food & cooking techniques I've encountered. It is truly one of the great cuisines of the world IMHO. Was incredibly relieved when credible Sichuanese restaurants started popping up in the Seattle suburbs about 5 years ago.

I believe we will find out that Sichuanese peppercorns have some kind of mild, physically addictive quality. And I'm totally fine with that!

</comment><comment><USER4> "There really is no fast-forward button to mastery – behind every step forward may be a couple steps backward – but slowly, it is earned."

Worth the read by the end.</comment>


Innovation videos: making sure they're not ignored - <AUTHOR> http://www.iijiij.com/2011/02/13/innovation-videos-making-sure-theyre-not-ignored-07525 <comment><USER2> plenty of good advice here for tech-related videos in general</comment>


Study shows that financial crises lower life satisfaction - <AUTHOR> https://www.eurekalert.org/pub_releases/2019-06/mh-sst062619.php <comment><USER2> glad someone studied this thoroughly, because i would have sworn financial crises makes us all happy, but now i stand corrected.</comment>


Sony open-sources NNabla – a simple, fast and lightweight NN library - <AUTHOR> https://github.com/sony/nnabla <comment><USER2> Could we modify the title to say Neural Network library? Not sure most people can guess what NN library means but maybe it's just me.

<comment><USER3> I thought it was a library for doing nearest-neighbour search. Most neural network literature tends to use "ANN" (artificial neural network), not "NN", I think.

</comment></comment><comment><USER4> Some basic analysis:

1\. Kernels (Functions in NNabla) are mostly implemented in Eigen.

2\. Network Forward is implemented as sequential run of functions. No multi- threaded scheduling. No multi-GPU or distributed support.

3\. Python binding is implemented in Cython.

4\. Have some basic dynamic graph support: run functions as soon as you add them to the graph, and run backward afterwards. Somewhat similar to PyTorch.

5\. No support for checkpointing and graph serialization, or I'm missing something.

I'm not sure why Sony is releasing this (yet another) deep learning framework. I don't see any new problems the project is trying to solve, compared to other frameworks like TensorFlow and PyTorch. The code is simple and clear, but nowadays people need high-performance, distributed, production-ready frameworks, not another toy-ish framework. Someone please shed some light on me?

BTW, for newcomers to deep learning systems, [CSE 599G1]([http://dlsys.cs.washington.edu/](http://dlsys.cs.washington.edu/)) is a good start.

<comment><USER5> The problem is that this library is not just a C easy-to-bind project, otherwise an high quality embeddable library that can work reasonably well with CPUs and can also benefit from commonly used GPUs in small systems, could be useful for a number of projects. Not all the problems need to have a huge dataset of complex entries (like million of images), there are many IoT problems that instead need a self contained library supporting different kinds of NNs.

<comment><USER6> Seems like out of the major libraries (TF/Caffe/Theano/pytorch), pytorch is the only one to have a core that is C (the TH*). It's not exactly a small library, though. One small library that is in C and has some state-of-the-art features is Darknet ([https://pjreddie.com/darknet](https://pjreddie.com/darknet)).

That said, seems like directly using the C++ API was a major use case here, and it looks fairly clean to me.

<comment><USER7> TensorFlow and Caffe are also implemented in C++.

<comment><USER8> Being implemented in C++ doesn't ensure that a C++ interface exists. A C++ API is available for TensorFlow, though, and also a C API.

</comment></comment></comment></comment></comment><comment><USER7> Looks interesting. Maybe some more context here:

[https://nnabla.org/](https://nnabla.org/) [https://nnabla.readthedocs.io](https://nnabla.readthedocs.io)

It looks like it's from Sony.

I think every new Deep Learning / NN library should put itself into more context. How does it compare to all the existing frameworks, like TensorFlow, (Py)Torch, CNTK, MXNet, Theano? It actually looks pretty similar, which makes this question even more important. From the examples, it might be most similar to PyTorch with autograd but I'm not sure. So, what are the differences?

<comment><USER9> This one implements DRM as a NN rather then a rootkit.

[Only half joking.]

<comment><USER10> Which half? One half is bad for the future and the other is worse now.

<comment><USER9> I'm not sure what you mean, but I was referencing Sony's illegal and unethical usage of a rootkit on every CD they manufactured to hack user's computers so that they could implement DRM (in)effectively[1].

[1]: [https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...](https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal)

<comment><USER10> I didn't know this happened but I thought you were implying the NN was a rootkit. Well I guess I misinterpreted.

</comment></comment></comment></comment></comment><comment><USER11> Related question: Is there a framework which lets us do very basic tasks without getting deep into NN and ML? For example an image classifier, which takes images under different groups and when trained, can tell which group a picture more likely belongs to?

I'm not a data scientist, just a potential end-user who doesn't know what input_shape is.

<comment><USER12> Tensorflow has the solution to all problems :)

[https://github.com/tensorflow/models/tree/master/slim](https://github.com/tensorflow/models/tree/master/slim)

This is a flexible image recognition framework written in Tensorflow and TFslim

It allows you to train/fine-tune a NN from the command line by specifying only the few details necessary... which NN architecture to use, path to custom data, etc.

<comment><USER13> And maybe there are is such thing for text processing?..

</comment></comment></comment><comment><USER14> Probably just me but NNabla seems unfortunately close to NAMBLA.

<comment><USER15> It's alluding to the nabla symbol ([https://en.wikipedia.org/wiki/Nabla_symbol](https://en.wikipedia.org/wiki/Nabla_symbol)) used in mathematics, and the similarity in sound between the two does not go unnoticed by many students of calculus.

<comment><USER14> TIL!

</comment></comment></comment><comment><USER16> I created a docker image that allows you to play with their tutorials, currently not supporting the GPU extension but plan on using nvidia-docker later this week and have an image ready to play with. Here's a link to whoever is interested [https://github.com/alcedok/nnabla_notebook_docker](https://github.com/alcedok/nnabla_notebook_docker)

</comment><comment><USER17> ''NN Used as a substitute for an unknown name or one that the writer wishes not to reveal.

Etymology Latin nōmen nesciō ''

</comment><comment><USER18> What exactly does this library do?</comment>


Ask HN: What are the best tips to teach programming to kids? - <AUTHOR> <comment><USER2> I find the hardest things for new programmers to understand are variable scope, and execution order.

One of the things I focus on when teaching is evaluating different example code snippets manually, as a "human computer" to double check that their mental model of the interpreter/compiler is correct. Understanding why a variable is shared with a child scope, but not necessarily with a parent in different circumstances is not intuitive, and takes some practice even for intermediate-level programmers.

Here's an example:

Code snippet:

      int result = addNumbers(1, 3)
      int final_result = addNumbers(result, addNumbers(4, 5))

To evaluate it, these are the steps the computer takes:

      1. int result = addNumbers(1, 3)
      2. int result = 4
      3. int final_result = addNumbers(result, addNumbers(4, 5))
      4. int final_result = addNumbers(4, addNumbers(4, 5))
      5. int final_result = addNumbers(4, 9)
      6. int final_result = 13

</comment><comment><USER3> Teach concepts before code.

For example, if I'm teaching kids what variables are I bring out a bunch of boxes with labels on them. The boxes represent the computer memory. I can put numbers in the boxes. I can put other things in boxes, strings and so on.

I find a lot of people get confused by the difference between a variable name and its value. This isn't helped by the the fact that almost all programming languages use equals for assignment.

Only after showing them the concept thoroughly do I introduce code. I treat code as "telling the computer what I want to do" and the activity as "what I want to do".

<comment><USER4> Yea I'm teaching my kid hardware first, then observing her interests. Hopefully the "bunch of boxes" will come :)

</comment></comment><comment><USER5> Build a game or something he/she likes together, that's what I'm doing, and very smoothly.

</comment><comment><AUTHOR> Thanks all for inputs.</comment>


Ask HN: Where do you find side project ideas? - astro-codes Hi,<p>Where does everyone go to find inspiration / existing side projects to work on? (Primarily in computer science / software engineering). <comment><AUTHOR> Side Projects List for hobby / Practise

[https://github.com/karan/Projects](https://github.com/karan/Projects)

</comment><comment><USER2> If you work in the field it gives perspective.

Also reading reviews of software, FAQs, issues etc will help you identify potential opportunities</comment>


AirBnb is a rental economy, not a sharing economy - <AUTHOR> http://www.thepressproject.net/article/68073/AirBnb-is-a-rental-economy-not-a-sharing-economy

<comment><USER2> And quite expensive for that sake. As people seemingly charge travelers much more than what locals are paying for renting the same level apartments.

<comment><USER3> Exactly the same as hotels ? Te me it seems somehow a standard hotel room anywhere in the world costs about USD 150-200 per night. Odd, because the costs of living varies a lot more. So it might be more related to what visitors are willing pay ?</comment></comment>


Artificial Conciousness and the Nature of Reality - <AUTHOR> https://www.youtube.com/watch?v=P-2P3MSZrBM <comment><AUTHOR> Incredible view on conciousness from a very technical perspective while aiming to "converge mathematics and philosophy" to explain reality, the universe and how to create AI based on the turing test.

Very disruptive and highly challenging podcast by Lex Fridman and Joscha Bach

<comment><USER2> Hrrmph. Nope. Listened to it with a few breaks and found it to be underwhelming. Too much assumption, no implementation.

Could have talked about Phlogiston theory the same way...</comment></comment>


24M would lose insurance under the G.O.P. health bill within a decade - <AUTHOR> https://www.nytimes.com/2017/03/13/us/politics/affordable-care-act-health-congressional-budget-office.html?action=Click&contentCollection=BreakingNews&contentID=65023125&pgtype=Homepage&_r=0 <comment><USER2> This includes people who decide not to have coverage because they figure they don't need it. Even with the "surcharge", if you can go 4 months without using insurance, it's cheaper to drop it and then only pay for it when you need it. I would guess that saves those individuals a lot of money, even if it raises rates for people who use their insurance on a more regular basis.

I guess what I'd like to see from the report is a breakdown along economic lines. Is it that healthy, relatively well-off people are dropping it to save money? Or is it mostly poor people who can't make the increased payments?

<comment><USER3> A huge chunk is the repeal of Medicaid expansion.

<comment><USER2> I haven't done too much research on that part of it, but states like Kansas that declined the current Medicaid expansion don't look like they did very well. What's the rationale for not doing it?

<comment><USER3> Basically the belief that government shouldn't be funding health care.

The current bill is pretty much a huge tax cut based on that idea.</comment></comment></comment></comment>