Site requests bank logins for online purchases - <AUTHOR> https://lolware.net/2016/11/17/requesting_bank_login.html <comment><USER3> This is common practice in germany. The whole payment methode "sofortüberweisung" or "sofort" is based on this. You give your login information and a single use password to sofort, they initiate a wire transfer and instantly guarantee the money will arive. (It will arrive 24h later, as banks are allowed to delay it this long and they use it as additional liquidity) Of course this is a security nightmare and or course the ToS of the Banks prohibit you from sharing your login details. But unfortunately they don't enforce their ToS. Recently the cartel office called for making this part of the Banks ToS void, as they would "hinder the adoption of innovative FinTec".

But it illustrates how deeply flawed the whole banking sector is that people are willing to give up passwords to third parties or paying insane fees to paypal. IMHO we urgently need a law that makes wire transferees instant, or this dangerous and incredible expensive layers grow for the disadvantage of everybody (expect paypal and sofort).

<comment><USER4> This is a solved problem in the Netherlands with iDEAL. Go to checkout, select your bank, authenticate at your banks website with your credentials and 2FA (SMS/EMV CAP reader/QR code), confirm transaction details and you'll be redirected back to the web store. The wire transfer is not instant but it is guaranteed so the merchant can start shipping immediately.

See [https://www.ideal.nl/demo/en/](https://www.ideal.nl/demo/en/) for a demo.

<comment><USER5> In France we have 3D Secure, when you make the paiement you are redirected to a page that belongs to the bank, you receive a SMS with a one time code to validate the paiement and are redirected to the merchant with the validation.

Quite efficient, but I think there's fees for the merchant in this case.

<comment><USER6> I've seen some horrific UI on some 3D secure implementations. Also, I've seen some websites refresh to a "loading 3D secure ..." page, only to somehow skip it and go further. If the merchant can just skip it and charge your card like a regular credit card, then what's even the point of having it?

<comment><USER7> The merchant can choose wether and when to use 3dsecure (at least in France). I work for a company that uses Paybox for online payments. We can set an amount above which 3dsecure is used, e.g 20 EUR. I'm guessing the bank has to support 3dsecure, but they can't or at least don't impose it.

<comment><USER8> I work with fraud detection at an online travel agency. If you use 3D Secure and there is a fraud, your insurance will cover the cost of that transaction. As a merchant you may bypass (not use) that security feature at your discression. 3D Secure is a Mastercard feature, no?

<comment><USER7> 3dsecure works with Visa too. I don't know about AmEx, although I do know that for Point Of Sale payments we have to have a special bank contract (one for Visa / Mastercard and one for AmEx).

I suppose the merchant decides wether to use this or not by trying to find a balance between user experience and fraud risk.

In our case I think the limit is set right above the usual purchase amount (we sell movie tickets). It's low enough that a fraud wouldn't hurt us too badly and there's not much incentive for it either. Also, most of the clients don't have to fiddle with 3dsecure (in my case I would have to cary a fob around, which I never do), so it's a better experience for them.

If someone tries to buy a lot of tickets at once, they are more likely to be doing something fishy so we use 3dsecure.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> >Yes, I've spoken to them. They don't see an issue.

This is exactly why the PCI Security Standards Council is a thing. They need to have someone straight up tell them something at least as serious as "fix this, or we will no longer take your credit card payments". Honestly, it's better off being "we aren't taking your credit card payments, you should know better. Fix this and go through a security audit and we might reinstate you".

<comment><USER10> But this _isn 't_ a credit card payment. This is for direct debit.

I've sadly seen all sorts of stuff spring up around this in australia, like [https://polipayments.com/Buy](https://polipayments.com/Buy) (which e.g. is one of the only ways a normal person can pay for a jetstar flight without a credit card surcharge)

<comment><USER11> What's wrong with just sending money from your acct# to their acct# with a reference number/code to identify that transaction as you, other businesses work this way (such as my power and phone bills from diff. companies), but the NZTA for example requires me to use either a credit card (which is fine) or POLi, which is garbage.

"no one can see your bank details" it says on [https://www.polipayments.com/security](https://www.polipayments.com/security) which is a fraudulent claim, yeah the hell you can, its being sent to your server, not my bank, this is crazy. It also says they don't cache anything -- all kinds of criminals claim they're up to no harm. POLi says they're up to no harm, why should I believe them? There is NO EXCUSE for using POLi vs. just paying with your bank, if a business offers POLi and not bank transfer directly or a credit card, i would never even remotely entertain doing business with them. NZTA is not a business though, it's a government agency. You can do it in person though (transfer ownership of a car for example), or by CC, so whatever, I don't understand who would ever use POLi, the naive? Hopefully they go bankrupt in the near future.

<comment><USER12> > There is NO EXCUSE for using POLi vs. just paying with your bank

POLi is instant. Bank transfer is anywhere from 1 - 3 days. Until banks finally implement instant transfers, POLi will still be useful to some.

<comment><USER13> POli uses bank transfers underneath. It just takes control of the browser and makes sure you inputs the correct values for you, like selenium.

</comment></comment></comment></comment></comment><comment><USER14> I'm confused. They think this is easiest? Either they have someone manually going into bank accounts and making transfers, or somebody actually programmed something to log in via the webpage and do stuff. Neither of those are "quick and easy".

Is a paypal button really so hard?

Also, how are they not shut down? It seems a single user sending that screenshot to Amex should be more than sufficient to close any merchant account they have.

<comment><USER15> There are services that give you programmatic access to bank accounts from multiple providers. Plaid and Yodlee are examples of these.

Not sure exactly how they services work under the hood, but it wouldn't be too dissimilar to just screen scraping.

</comment></comment><comment><USER16> There is a similar system in use in New Zealand and Australia called POLi:

[https://en.wikipedia.org/wiki/POLi_Payments](https://en.wikipedia.org/wiki/POLi_Payments)

It's discouraged by banks and you don't see it as much as you used to (in NZ anyway).

<comment><USER17> It's still around for some things, eg Jetstar. You used to be able to do a manual online transfer to pay for flights but now POLi is the only way you can avoid the $5 credit card surcharge. Grinds on me every time I buy a flight.

</comment></comment><comment><USER18> There was similar attempt here in Poland few years ago, i believe it was sofort used by few online shops owned by German parent companies.

This ended very soon, because people here are quite sensitive for such practices and Financial Supervision Authority begin informative action as this was against the law.

But what was more important, people quickly realized that they could abuse this process. After such payment, they log in again to bank account and cancelled wired transfer (in most banks we can cancel wired transfer unless it actually leave your account few hours later), and then change their bank password. From point of view of shop, payment was successfull, they process order, but never get cash for it. This was the reason such payment systems ended very soon.

Like kybernetyk and other wrote, in Poland we have very modern banking system, there's no problem to make fast wire (up to 15min) using official banking systems or reliable payments systems - you authorize each transaction directly in your bank system without revealing your login details to the middleman.

<comment><USER19> Stay away from German payment "inventions" like Sofort, direct debit by default, "cash is the king" bollocks. Many German retailers and "startups" entering Polish market are trying to introduce their (low) standards and this can deteriorate banking culture in Poland. The retail banking in Poland is working really good and is customer friendly - keep it this way.

</comment></comment><comment><AUTHOR> Author here. The post was put together in a bit of a rush - I've updated it based on a number of the queries I've seen.

Overall, if attention to this issue can stop one other company doing this, I'll be pretty happy.

</comment><comment><USER20> I don't think PCI compliance is a factor here (unfortunately) - they literally only deal with the taking of cards, I would think Banks should be looking at this pretty skeptically! Although here in Australia there seems to be a lot more "access" available to your bank account than in many other countries (including my native UK), it makes things like integrations nicer but I do wonder just when it's all going to come crashing down!

<comment> joatmon-snoo According to the PCI-DSS website, "[i]t is important to note that the payment brands and acquirers are responsible for enforcing compliance, not the PCI council." [1] No idea what the state of actual legally-enforceable penalties is.

In the meantime I've tweeted @AmericanExpress about this.

[1] [https://www.pcicomplianceguide.org/pci- faqs-2/#1](https://www.pcicomplianceguide.org/pci-faqs-2/#1)

<comment><USER21> I think legally-enforceable penalties in a regulatory sense vary depending on where you and your customer are. But the contracts between you and your credit processing merchants are civilly enforceable and in my experience they don't mess around. They will fine you and raise your transaction costs when out of compliance and will ultimately cut you off if necessary. They also know their competitors will do the same thing because they bear the brunt of the costs incurred by fraud.

</comment></comment></comment><comment><USER22> Is that even legal? What is the difference between this company and phishers collecting bank logins?

And doesn't it look suspicious if the logins into different accounts are made from the same IP belonging to the online shop? Some banks in my country even require SMS verification if you are logging in from new IP address.

</comment><comment><USER23> _Why do I need to provide my bank login information (username, password, security questions)?_

 _Mwave has identified online banking access as the quickest and easiest method to get access to your banking information. In order to access this information, it is required that you provide your username, password, and any security questions associated with your online banking account._

<comment><USER24> _Mwave has identified online banking access as the quickest and easiest method to get access to your banking information._

Well, one can't argue that they're wrong in making that statement. However, that's the reason we don't give random websites the credentials for our "online banking access". :-)

</comment></comment><comment><USER25> I am wondering about the legalities of them doing this. I remember back when we had a merchant account for a retail style business, we were repeatedly warned by the bank that we were legally on the hook if we took a customer's credit card information and it got somehow compromised or leaked.

This was back in the pre-EFTPOS days when a store would have to keep a carbon copy of the customer card imprint (as well as their signature). We were told to guard those slips like gold, and dispose of them properly when not needed any longer, because with that information, we could in effect impersonate the customer elsewhere.

I would say that things have changed markedly these days, but I wonder if the legislation, especially here in Australia, has kept up with that, seeing as a customer's login credentials are effectively the same as having their signature which can be copied?

</comment><comment><USER26> > Mwave has identified online banking access as the quickest and easiest > method to get access to your banking information.

Well, that's certainly true...

[https://www.mwave.com.au/help/faq/view/76](https://www.mwave.com.au/help/faq/view/76)

</comment><comment><USER27> Is this the verified by visa thing? [https://usa.visa.com/pay-with- visa/featured-technologies/ver...](https://usa.visa.com/pay-with- visa/featured-technologies/verified-by-visa.html)

Bank passwords alone wouldn't work on any of my accounts because it would detect a different computer and request secondary authorization. It does this by looking at the information the browser sent...and...oh...oh. Geez I hate security theater. Is there anything less secure than the information sent by your browser?

<comment><USER28> It looks like their own ghetto implementation of Verified by Visa.

Verified by Visa is secure because it uses a shared secret (not terribly unlike how JWT works) for the merchant to redirect you to the bank (with information on what card you used), who verifies your username and password and that that is your card, who then redirects you back to the merchant with something that says "Yep, we verified them"

<comment><USER29> A big problem with VbV is that the VbV step is usually embedded as an iframe, making it near impossible to verify its authenticity in normal browsers.

<comment><USER30> My bank (Thailand) has VbV that requires me to set up personal phrase with the bank and that phrase is shown on VbV page. Also it sends SMS OTP to preregistered mobile number so I doubt any sites could fake that.

<comment><USER29> I've seen that phrase thing, but what would prevent a fake page from fetching your phrase from the real VbV website?

</comment></comment></comment></comment></comment><comment><USER31> Typically the payment process is be managed by a dedicated payment gateway through an iframe and not the merchant so it should in principle be slightly more secure than it looks. Someone mentioned Poli, one such gateway in Oz.

As being shut down is a genuine business risk they strive for legitimacy - <USER2> be surprised if it was in-country and operating without at least tacit agreement of banks. Even slow moving banks could counter against this type of browser automation technically - not to mention legal action. No large merchant would fancy negative security related PR either.

Honestly speaking - the payments industry is full of hacks like this. Look at US p2p systems built on ACH refunds. Or using 3D Secure for identity verification. Or processing pre-auths of 1 cents and rolling back to add a card to a wallet.

Banks are slow and competitive, schemes are just slow, central banks often take a wait-and-see approach. When they get their act together systems like this tend to be replaced or evolved into more sensible and durable solutions - but that can take awhile.

And in the meantime everyone tries every avenue possible to reduce fees or provide a better UX (in this case at the expense of consumer protection).

</comment><comment><USER32> This page has a good explanation of why - [https://www.mwave.com.au/help/faq/view/24](https://www.mwave.com.au/help/faq/view/24)

<comment><USER25> That link explains other security measures, but doesn't actually say that they need your bank/credit card login details though?!? (unless I missed it somewhere).

"Please note: Due to the rise of credit card fraud and for your security all credit card orders will be subject to detailed security checks requiring further documentation; that may include Driver Licence, CreditCard or bank statements. If your order does not meet our security check requirements, you will be contacted and further credit card security procedures will be implemented.

As part of our verification process we will utilise various procedures to ensure ultimate protection to the Credit Card holder. These processes may include but not limited to charging a small amount randomly under $2 requiring confirmation prior to approval; verbal verification via phone or a request for written Authorization, photo identification including valid Driver Licence, Utilities bill or the copy of the credit card or a request for your bank statement displaying the debit entry.

Mwave may also use a verification service powered by BankStatements.com.au, the Australian leader in automated bank statement data retrieval. Since 2013 BankStatements.com.au has provided secure, automated data retrieval services to over a quarter of a million Australians as part of their credit applications. "

</comment></comment><comment><USER33> I've talked with a friend working in the IT department of one of Austrias biggest banks (black + yellow colour ;) ) about it. Apparently, banks want to become the identification services of the future. The idea is, that you can only (not sure if that is true) open a bank account with a valid ID, therefore the bank login can identify if a person is real or not. Example: creating a Twitter/FB account with you bank credentials would make your account automatically an approved account (you are you)

<comment><USER34> This is true. However, they will not let you enter the details on the page itself.

In The Netherlands they are launching 'iDIN'. Which is a bit like OAuth 2.0, so it only provides the webshops with the things they need (and a bit more like age. So yay, privacy issues).

<comment><USER33> One of the problems is when this is done by companies instead of states. A company might remove your access for some, not obvious reasons. Just see current trending HN link [http://www.dansdeals.com/archives/98444](http://www.dansdeals.com/archives/98444) where google suspended an account and with that the person could not use the google login anymore. Even for non-google pages. That is scary. A protocol like the EDUROAM system would be nice. In that case, credentials include a domain (usually a Uni name), and with that domain the home uni(bank) can be used as an authentication authority.

</comment></comment></comment><comment><USER35> As the son of an otherwise amazing woman who falls for every credit card scam to ever hit her inbox I think this is another great reminder of the mindset disparity between techies and the wider public. While we obsess over end-to- end encryption and distributed ledgers the vast majority of people are perfectly happy typing online banking credentials and uploading pins to random websites.

</comment><comment><USER36> I used to love MWave, many years ago. They were just a fantastic vendor back then. They shipped faster than anyone, handled returns fast and with zero hassle.

But, I had a couple of mildly negative experiences (slow to ship, items listed as in stock weren't, etc.) and I stopped buying from them.

This, though, is just crazy. I can't believe their merchant bank even allows them to do this.

</comment><comment><USER37> Wow. And that's an Australian company, based in Sydney no less, not far from where I live... how embarassing.

</comment><comment><USER38> This is very normal in Australia. All the major airlines do it via POLi[1]

[1][https://en.wikipedia.org/wiki/POLi_Payments](https://en.wikipedia.org/wiki/POLi_Payments)

<comment><USER39> I wouldn't say it is common - I've never seen it.

<comment><USER40> It's usually the only option to avoid a $5-$70 credit card surcharge. Have you ever paid for a flight online with Jetstar, Tiger or Air Asia?

With Jetstar, up until a few months ago, you could do your own bank transfer, but now poli is the only option.

<comment><USER41> Tiger used to not charge for Mastercard debit. It has changed recently, but still only a matter of cents.

</comment></comment></comment></comment><comment><USER42> There's a few places doing this now.

I've met the CEO of bankstatements.com.au at a trade conference. Currently it's hard to get data feeds from banks - these guys are logging in, scraping bank statements and then providing them as digestable feeds.

Pocketbook is another Australian fintech that was recently acquired that do the same things with credentials.

The banks know they're doing it, it's against terms of service, but seem to turn a blind eye.

POLi seems to have more reputation but I still feel dirty the few times I've been strongarmed into using it.

</comment><comment><USER43> There is something similar in India called netbanking. Typically, the site redirects you to a payment gateway, which then redirects you to the bank's site. You enter your username/password only on the bank's site and complete the transaction. It is used quite frequently due to convenience and security.

When I moved to Oz and tried to buy something online, I was quite taken aback that I was being asked to enter bank login details on 3rd party sites directly. Felt completely unsafe, so haven't used it yet.

</comment><comment><USER44> The way I handle this is, I have a dumb checking account which I transfer money to, when I do such transactions. This is more akin to giving a lame email address to websites you don't care.

<comment><USER45> If only banks had a special login for these one-time transactions. One where the history isn't enabled either. In the Netherlands such a system exists, it's called iDEAL

</comment></comment><comment><USER46> > It's that they apply the charge to your card a day before giving you this > prompt, leaving you begging for refunds when you refuse.

That is strange. I never begged for a charge back with any of my credit cards. When I say the transaction is fraudulent or not authorized by me, I get my money back. Always.

The merchant can then sue me, if he thinks different. Is that not what happens with all credit cards in all countries?

</comment><comment><USER47> No. Just no. Not necessary. Its amazing that this is successful by any means.

</comment><comment><USER48> So, technically, everyone who does this (provides their login info) violates their terms with the bank I assume, as they probably told you not to share your password with any third party?

</comment><comment><USER49> Paypal does the same thing. I added a bank account, and Paypal requested my username and password to automatically verify the two test deposits they made.

<comment><USER50> Is that new. When I signed up, admittedly a number of years ago, they just asked me to tell them the amounts of the two test deposits. No login creds provided.

<comment><USER49> At first I thought so, as the first time I saw it was a couple of months ago when I added a new account, but then I googled and found [1]

So I guess it's based on your routing number and whether your bank's online system has the proper framework to allow it.

[1] [http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/12...](http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/1235839118.html)

</comment></comment></comment><comment><USER51> Newegg recently did this when I used my American Express. It was a valid referral to Amex's website so I see how folks would fall for this.

<comment><USER52> Newegg redirected to you the Amex site which asked you to enter your password (this is 3D Secure aka SafeKey) or Newegg asked you to enter your Amex password on Newegg's site?

<comment><USER28> NewEgg does the former, for sure, with my corporate Amex. Oddly they don't do it with my personal one.

</comment></comment></comment><comment><USER53> Pretty sure Expensify and Mint did/do this, no?

<comment><USER54> Yea, but those are different services that utilize the history of your transactions. What reason does an online retailer have to access that level of detail? Shouldn't they simply be able to accept the information on the credit card for the sale?

<comment><USER55> They can reduce their risk by doing this. For online retailer there is always risks in accepting card payments. (Not saying this is a good idea, just trying to find reasons).

<comment><USER54> Whose risk is reduced? The retailer or the bank? Certainly not the cardholder.

<comment><USER28> The retailer and only the retailer.

It probably reduces fraud chargebacks to nearly 0.

</comment></comment></comment></comment></comment><comment><USER56> It wouldn't work for me (UBS, Switzerland), I need to punch a code into a special calculator thing in order to login.

</comment><comment><USER57> This is how Venmo does it so they don't have to make you do the "verify two microdeposits" process, and it's getting more popular. I think because when you give your login you're giving over complete access so bank is not liable for fraud.

<comment><USER58> I never had to do this for Venmo. Is this a recent change?

<comment><USER59> I had to do it when I signed up. That's why the history of my interaction with Venmo was (1) change bank password, (2) accept the money from the person who would only pay using Venmo, (3) change bank password back so that Venmo / late hackers into Venmo databases don't get any ideas.

</comment></comment></comment><comment><USER10> mwave can be pretty shady... I know that their user email list has been either stolen or sold.</comment>


Only the Lonely - <AUTHOR> http://www.stephenfry.com/2013/06/24/only-the-lonely/ <comment><USER3> > I don't want to be alone, but I want to be left alone.

I have always suffered from this as well. Perhaps it is just a touch of introversion? I have a happy marriage and family but I often need time all to myself or I just get overwhelmed by the constant stimulus of...other people. I don't even necessarily do anything different than I would with my family, though I generally try to work on my own projects or study something interesting.

<comment><USER4> As somebody who has cancer, mentioned in the article and mentioned right next to diabetes (cringe), I look at the people complaining about how human interaction is complicated and life is difficult and I am left speechless.

Fuck people, make an effort. Do it for the dying ones.

<comment><USER5> That portion of the article is referring to _clinical depression_ , not general loneliness and unhappiness. You just demonstrated his point (that people have a hard time seeing mental conditions like bipolar disorders as _actual diseases of the mind_ and not just bad attitudes) quite nicely.

Pardon me for being frank, but when I pause to imagine having my life taken from me before I was done living it, or being so profoundly unhappy that I would sincerely attempt to kill myself, I can only see both as terrible in their own right. There's no sense in trying to compare the severity of one to the other.

<comment><USER4> Your life is not "taken from me before you're done living it".

You get to keep it. For a while at least.

</comment></comment></comment></comment><comment><USER6> Personally, I think it's great that Fry has been so forthcoming with his travails. It helps others tremendously to know that they are not alone.

I want to speak to an important question, though: why DO we continue? This is a discussion of the rational justification, independent of brain-chemistry. Hamlet is right for the wrong reasons. These are my beliefs:

The only real reason to continue is because you think that you can contribute, in at least a small way, to the long-term well-being of humanity. You, an individual, are a cell in a vast organism of humanity, and your duty is to find something useful to do. There are many ways to do this, as a (spiritual, physical) healer, as a (artistic, technical) creator, or as a player of (business, political) games (who, by the way, use the output of the first two types in the game).

The "long-term well-being of humanity" itself has many possible expressions. On the largest scale, it means making sure that humanity itself can survive any calamity. That means not only taking care of this planet, making sure that it can sustain life, but it also means reaching and colonizing other places in the solar system and galaxy. Given the incredible work required to build a self-sustaining colony orbiting the Earth (which is the only viable option given our level of technology) maintaining intellectual freedom is paramount. Constructing social/political/economic systems that reward power to those with self-restraint, and engender trust in those who could harm us is also important. On a smaller scale, raising children is crucially important, because the organism of humanity needs new cells to replace the cells that die.

Comedians like Stephen Fry are our philosophers. They perform a remarkable feat of alchemy, taking the banal horrors of political and social life and transmuting them in to something funny, something insightful, something that makes you think. Humor is an effective coping mechanism when we face our own prejudices, our own contradictions and, importantly, the same mistakes we see in others. Too often our leaders, and indeed we ourselves, don't laugh enough at the tragedies of our age - for laughter is more powerful than hate, because it criticizes injustice but mercifully leaves behind the terrible burning that anger creates.

Please, Stephen, continue.

<comment><USER7> Sorry, but this is a load of disgusting hogwash.

Life is not about sacrificing for the good of the collective.

People who tell you that do NOT have your best interests in mind.

<comment><USER6> > Life is not about sacrificing for the good of the collective.

Good heavens, is that what you heard? Sacrifice means giving something up; I'm talking about gaining something, in this case a goal that is actionable, useful, and very difficult to achieve. You are clearly free to pick that purpose for yourself (I hope you do), or pick another purpose, or none at all.

And we are both free to advocate for our choices in the hopes of inspiring others who, at least in my case, may not have thought about it in quite these terms. You clearly don't like the sound of my purpose, so why don't you share yours?

<comment><USER7> > I'm talking about gaining something, in this case a goal that is actionable, > useful, and very difficult to achieve.

What exactly is that?

> so why don't you share yours?

Just as the body has a pleasure/pain mechanism, so the mind has a joy/suffering mechanism.

The biological purpose of this mechanism is to give you joy when you experience physical pleasure, and pain when you experience physical pain; but moreover, to regulate the _anticipation_ of physical pleasure/success and physical pain/failure. That anticipation is mediated by your rationally (or not) chosen values. There is more that can be said about this... for example, self-esteem comes from building a character that allows for the rational assumption that you can expect continued success as an organism, and the rewards thereof.

So, my purpose is to experience joy and happiness in my life by choosing and pursuing rational values, given the constraints I mentioned above.

Obviously, the amount of philosophy you can do in an online comment is pretty limited. What I've said is just a summary. After all, I started in ethics, whereas a full philosophical exposition would start with metaphysics or epistemology.

Since your post was mainly about other people, let me say: other people are valuable to me, because they can be friends, lovers, trading partners, etc. So, there are _good_ arguments to be made for helping others. I think arguing it from "duty" is not doing it in a rational way and will lead to bad conclusions.

By the way, I want to make it clear that when I called what you said "disgusting hogwash," that wasn't a reflection on _you_ at all. I just wanted to call out what I saw as a bad argument that I think could influence people to go in a very bad personal direction.

<comment><USER6> >> a goal that is actionable, useful, and very difficult to achieve.

> What exactly is that?

This question implies that you did not read my original comment carefully, or perhaps at all, as answering that question was it's subject. I suggest you read it again, and perhaps this time more slowly and with an open mind.

> your post was mainly about other people

This also implies that you did not read my original comment well or at all.

As for the "disgusting hogwash" comment, it is a barb but one that was not too hard to ignore, as your criticism was not substantive. But thanks for the clarification.

> very bad personal direction.

...and yet, you seem to have judged my view as bad without comprehending it. How can you do that if you don't know what it is? Perhaps you are goading me? Well, I'll write this one comment, in the hopes that you really will re-read what I wrote and understand it.

<comment><USER7> > This question implies that you did not read my original comment carefully

No, I did. And I re-read it before my second response. I don't think what you listed, "contributing to the long-term well-being of humanity," is either actionable or useful. I was hoping you would clarify your thoughts on that point.

I was disappointed by your last comment, because I think it was made in poor faith. Your accusations that I didn't read your comment carefully or may be goading you are in poor faith. Furthermore, I took the time to carefully respond to your question on the purpose of life, and you completely ignored it.

> for the "disgusting hogwash" comment, it is a barb but one that was not too > hard to ignore, as your criticism was not substantive.

I think it's a pretty appropriate response when somebody calls for people to sacrifice their own lives and happiness for the good of the collective. Pointing out that that is what it is, _is_ a substantive criticism.

<comment><USER6> > I don't think what you listed, "contributing to the long-term well-being of > humanity," is either actionable or useful.

Shortly after, I mentioned two examples of such: working toward the colonization of other worlds at the large scale, and having children in the small. These are both actionable; their utility, I believe, is unquestionable.

> I took the time to carefully respond to your question on the purpose of > life, and you completely ignored it.

It is my turn to apologize. Perhaps I was too quick to dismiss you as a "Randroid" in my mind, since that was essentially the view you espoused. Maximizing your personal pleasure is a path that, I believe, leads to a profound emptiness.

> when somebody calls for people to sacrifice their own lives and happiness > for the good of the collective

I defy you to show where I said that or implied it. Living for a higher purpose than yourself is, ironically, a central tenet of Objectivism: Rand placed the Truth above all else. Egoism was merely an expression of the acknowledgement of that Truth. I am not an adherent to Objectivism, but I don't believe that even the most fervent Objectivist could blanch at my proposal to work to achieve the stars. Or do you think that Objectivism requires that it's adherents exist purely as agents in self-interested economic market? Rand was an idealist to the extreme, and, I believe, would have recoiled at your narrow view of what she taught.

<comment><USER7> > These are both actionable; their utility, I believe, is unquestionable.

Who are they useful for? Future humans? If every generation just lives to make the far future better, instead of enjoying life, I think it's all rather pointless.

That's why I question the utility of what you've given. If you claim something is useful, it has to be useful _for someone_ to do something worth doing.

Rand wouldn't disagree with going to space, but she would ask, "For whom?" and "to what end?"

> Maximizing your personal pleasure is a path that, I believe, leads to a > profound emptiness.

It's maximizing happiness, not pleasure.

> Living for a higher purpose than yourself is, ironically, a central tenet of > Objectivism: Rand placed the Truth above all else.

That is absolutely a false characterization of Rand.

> Or do you think that Objectivism requires that it's adherents exist purely > as agents in self-interested economic market?

It's a philosophy, not a religion. It doesn't require anything, and it doesn't have adherents. To answer your question, no, it doesn't consider that everything worth doing be framed in terms of economics.

> Rand was an idealist to the extreme, and, I believe, would have recoiled at > your narrow view of what she taught.

Rand was not an idealist. She explicitly rejected idealism. Rather, she defined exactly what it means to neither make the mistake of being either idealistic, nor rejecting all abstraction.

I can assure you that Rand would _not_ recoil at my (at least) approximately accurate portrayal of her views. I should say that some of the finer details of my point about the pursuit of pleasure/pain and joy/suffering are, I think, my ideas, not hers, but I think they are completely commensurate with what she wrote.

> It is my turn to apologize. Perhaps I was too quick to dismiss you as a > "Randroid" in my mind, since that was essentially the view you espoused.

Thank you for apologizing. However, you do not understand Rand's views well enough to legitimately dismiss someone just because they agree with Rand.

<comment><USER6> 1\. I'm still not seeing backup for your claim that I was asking anyone to sacrifice themselves for the good of others.

2\. You should read Objectivist Epistemology, where she connects her ethical system to her metaphysics. It's fairly execrable as philosophy goes, but it does underscore my point that she's fundamentally driven by her idealism, particularly about the nature of truth. (BTW that's why it's called Objectivism and not Selfishism).

Anyway, you really do sound like a young Randroid (again). In a few years you'll see that, well, she was wrong. Emotions are not vestigial. Reason is one tool in the box among others. And when self-interest, rather than self- restraint, becomes widely accepted as the criteria for merit, we end up with a system like we have today, where a docile public unable to even articulate a criticism of abuse of power, since there is no such thing as "abuse of power" in a framework that rewards only self-interest.

Adieu.

<comment><USER7> I've tried to engage productively with you, even to the point of chiding you for being rude without retaliating myself, but now you're just being an asshole.

I've been studying philosophy as a hobby/passion for many years. I've read the work you're referring to, and a whole hell of a lot more. You have a very, very naive understanding of Objectivism.

> Anyway, you really do sound like a young Randroid (again). In a few years > you'll see that, well, she was wrong.

Likewise, you really do sound like a young <X>, and in a few years, you'll realize how wrong you are about everything.

That is, literally, the sum of your argument. That is really pitiful.

And for all you know, I could be a 55 year old philosophy professor (though I'm not).

<comment><USER8> I only skimmed this exchange, and I have no dog in this fight, but you should be aware -- you seem to be the only one using obscenities, and you started this exchange with "Sorry, but this is a load of disgusting hogwash".

None of these comments are very friendly-feeling to me (on either side... you're both obviously feeling defensive), but if you start the exchange with that kind of comment, you're the first to deploy obscenities, you're more actively insulting, etc., you can't really claim the higher ground at the end.

I hope this is useful... it's hard to discuss these kinds of things, but if you can manage it (without getting tangled up in attack/counterattack) it can be rewarding.

<comment><USER7> It's been a personal goal of mine to get to the point where I never say something online that I wouldn't say in person, and so far I've made a lot of progress, but it looks like the next step is to never use obscenities.

So, you're right, thank you, and that is helpful.

I strongly disagree that I was more actively insulting. I think a detailed reading of the conversation speaks for itself on this.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> _it's the thought behind the most famous speech in all history. To be, or not to be._

In high school I started memorizing that for no particular reason. Upon completing a test, I idly doodled it in the margin waiting for the class to end, and handed in the paper. The next morning, the teacher cornered me in the hall and delicately asked if everything was OK. Bewildered by the time & tone of the question, I suddenly realized what Hamlet's soliloquy was about.

<comment><USER8> I enjoyed reading through this speech again just now -- I have a strange sense that my thinking has been clouded every time I've read it in the past (primarily in school), but now I can grasp it.

That said, I don't agree with Hamlet at all, and the real problem is far deeper than he realizes. I'm also surprised that Stephen uses this soliloquy to capture his own thinking.

"To sleep: perchance to dream" \-- that's the turn, but Hamlet is worried about the _afterlife_ , about supernatural judgement. He's very right to be, in context -- he's already met a ghost. But isn't Fry a vocal atheist? Isn't he already sure that "no dreams will come"?

I don't think I've ever had "might go to Hell" as a reason against suicide... I was already most of the way to atheism by the time I was playing with these kinds of thoughts as a teenager.

It's also a cheat, in a way -- sort of like "I don't kill people because I'm afraid then I'll burn in Hell" is much less moral than "I don't kill people because I understand the pain and harm of murder, and I don't want to inflict that on anyone".

The real problem of answering "to be or not to be" is that suicide isn't as obviously morally wrong as murder. Yes, harm is done -- the people around us can be devastated, for example -- but for a mind in sufficient pain, it's not hard to attenuate the imagined future suffering down to nothing, and I've talked to lots of people actively doing this ("they say they love me, but they'll be happier when I'm not here causing them so much trouble..."). And it doesn't work to argue someone out of depression, of course, though I'm afraid I learned that lesson the stupid way.

</comment></comment><comment><USER10> I've always thought that if you know someone is suicidal, don't always make it apparent that it is on your mind.

Sometimes they just need to have a person who lets things be normal - <USER2> who knows what is there, but doesn't let it change the tone of every interaction.

That seems one of the most helpful things you can do, in my opinion.

<comment><USER11> It is extremely difficult to know how to interact with someone with depression.

Often, you're right, it would be fantastic to just hear from someone who invites themselves over for lunch and a game on the weekend. Other times, you really want to be able to just have a deep conversation with someone, to be able to let your guard down for a while and talk about troubling things openly and honestly. Unfortunately, that's often unrealistic: the other person has to be in the mood for it, you have to feel safe enough about it to not shy away from it because it might be made a big deal of later on, when you're feeling better.

</comment></comment><comment><USER12> "The strange thing is, if you see me in the street and engage in contemplation I will probably freeze into polite fear and smile inanely until I can get away to be on my lonely ownsome."

This is me. I feel lonely all the time, yet when people approach me for conversation, I smile and respond with the least amount of words possible, and long for the moment I can be on my own again.

</comment><comment><USER13> ..."what the fuck right do I have to be lonely, unhappy or forlorn? I don't have the right. But there again I don't have the right not to have those feelings. Feelings are not something to which one does or does not have rights."

This is a great quote. Having been exposed to significant poverty and hardship growing up, I am often unnecessarily and overly harsh on celebrities and privileged people - this quote stopped me in my tracks.

Then I begin to think about the life/health that I have and start to feel like the jammy one.

Sorry Sir Stephen, wish I could help in some way.

</comment><comment><USER14> Maybe lots of people already know about it, but I'll just copy-paste this in here: [https://www.youtube.com/watch?v=k7X7sZzSXYs](https://www.youtube.com/watch?v=k7X7sZzSXYs)

It's not an anti-dote (to loneliness and everything), it just genuinely helped me from time to time and I hope it will also help others.

</comment><comment><USER15> Suicidal thoughts as a disease may not only be solely genetic, but may have something to do with lifestyle/environment, like other diseases. I wonder how many starving Africans actually have this disease.

<comment><USER16> First World Problems (tm): because the people you don't sympathize with are just playing life on easy mode.

</comment></comment><comment><USER17> I don't deal well with being alone, but I am also an extrovert. Loneliness and being alone are very much different things. I was much, much, much lonelier in a marriage where love had died than since my divorce, though I was romantically "alone" a long time (however, my sons still live with me so I have rarely been literally alone).

</comment><comment><USER18> I don't understand how nihilist people (as I am) who are suicidal (as I am not) are still alive. As long as I can recall I've never had even one thought about killing myself, but if I did I can easily imagine that I would have killed myself.

</comment><comment><USER19> I'm deeply thankful to Fry and everything he's done in this regard. Had I not watched him talking about his experiences so openly I would not have noticed myself acting in a similar manner.

</comment><comment><USER20> I can't help feeling a bit cynical about Stephen Fry's suicide "revelation". After gaining all the news coverage, the very next day he announced some new TV project of his. Coincidence?

<comment><USER8> Perhaps he's starting a new TV project he's pleased about, has his meds well in order, and is feeling strong & stable enough to discuss this now?

Or should he wait until nothing's happening in his professional life? Then the cynics would say look, it's been 6 months since he's done anything important, and so he has this suicide "revelation" to get back into the spotlight. Coincidence?</comment></comment>


SkiFree in the Browser - <AUTHOR> http://basicallydan.github.com/skifree.js

<comment><USER2> Twenty-nine comments and no one has posted the site of the author of the original SkiFree?

<http://ski.ihoc.net/>

SkiFree was originally written for VAX/VMS on VT100 terminals. Scroll down that page to see a small animated GIF showing where abominable snow monsters come from.

<comment><USER3> Wow this really brings me back, what was the name of the game with the bow and arrows? that was another favorite of mine "back in the day" Thanks for making this!

<comment><USER4> I think I remember what you're talking about (pretty sure it was just called Bow and Arrow) and I think this is it: <http://www.download- central.ws/Win16/Games/B/Bow-and-Arrow/>

</comment></comment></comment><comment><USER5> Some differences from the original:

1.) You can't press right twice to stop, then up repeatedly to climb.

2.) You can't press various arrow keys after jumping to do a trick pose that gives you extra points.

3.) There's only 1 degree of 'turning right', not two. Same w/ left.

<comment><USER6> 4) There aren't those rock/?? things that when you hit turn into mushrooms/tombstones/??

<comment><USER7> 5) There are no bare trees that catch fire when you hit them in flight.

6) You cannot jump by clicking the mouse.

</comment></comment></comment><comment><USER8> Confirms that I'm still terrible at this game over 20 years later.

<comment><USER9> Don't worry. Soon there will be a version for Google Glass that will superimpose trees, rocks, other skiers and so on. And then...

<comment><USER10> Are you saying that soon, there will be monsters which will try to catch me in the street ?

<comment><USER9> I watched Harry and the Hendersons as a kid so I'm fairly sure his mountain cousin is a similarly misunderstood gentle giant.

</comment></comment></comment></comment><comment><USER11> Nice. I expect SkiFree to finally get a modder community after you complete this version. :-)

Unfortunately, the player's movement seems to come to a halt every 14-15 m or so in Firefox 18.0.2 on Linux x86_64. That is not the case in Chromium 24.0.1312.56 on the same platform.

Edit: there are also visible lines over and under the tall fir trees in Firefox: <http://imgur.com/3wnXSqs>.

<comment><AUTHOR> Brilliant feedback thank you :) I get the same line issue in Mobile Safari but can't work out why without setting up debugging tools so maybe solving the issue in Firefox will help.

</comment></comment><comment><USER12> Played just to confirm that the yeti ate me :-D. Good times!

<comment><USER13> <http://xkcd.com/667/>

</comment></comment><comment> the-come-ons This is great. I miss the pooping dog though. :)

<comment><AUTHOR> Hahaha! I will get on it!

</comment></comment><comment><USER14> Time to make it an MMO with websockets.

<comment><USER11> Joking aside, it could be useful to implement ghosts [1]. You'd have to have non-random (fixed seed) tracks for this, though.

[1] <https://en.wikipedia.org/wiki/Ghost_%28video_gaming%29>

<comment><AUTHOR> Oh my god that is an amazing idea. What a perfect excuse to learn how to implement another classic racing game feature. Thanks!

</comment></comment></comment><comment><USER15> Just realized you have to run the yeti into trees to keep them from eating you... Feels like a good moment for a facepalm.

<comment><AUTHOR> Haha! This wasn't a feature in the I original but I thought it might add some balance to my version which was lacking some features which are useful for accruing points!

</comment></comment><comment><USER16> Awesome! Just got transported back to my parents living room on Windows 95. And yes, I still suck at this game.

</comment><comment><USER17> I love it. This game brings back so many memories for me! As it's written in JavaScript, I intend to take it, add some realtime players via Node.js and get this up and running. So much fun for a side project and with a great starting point!

</comment><comment><USER18> hey he doesn't do tricks and he doesn't get fully eaten by the yeti

<comment><AUTHOR> Nope, not yet. He has five lives because I haven't quite worked out the difficulty of the Yeti yet. Tricks will happen, too, eventually :)

<comment><USER19> You're also missing the "speed up to escape the yeti" binding. ;)

<comment><AUTHOR> The "F" key should work :) but it doesn't last forever, I put a limit on it.

</comment></comment></comment></comment><comment><USER20> Ooh, I loved this game!

</comment><comment><USER21> :( The controls aren't the same. I want to make him walk up forever really really slowly.

<comment><USER22> I noticed this too. In the original, the left and right arrows rotated you. In this, they correspond to 'face left' and 'face right' respectively.

The difference is, in the original if you were facing left and hit the right arrow, you'd rotate one position to the right. This would put you as facing down again. In this, if you're facing left and hit right, you immediately face right. To face down you have to press down.

It's still confusing my muscle memory :(

<comment><AUTHOR> Sorry guys, I'll get to it when I can :) if you fancy helping out and beating me to it you're more than welcome to do a pull request!

</comment></comment></comment><comment><USER23> Amazing! Works super well on Mobile Safari and it has the yeti attack at the end!

</comment><comment><USER24> It's amazing how something as funny and non-scary as this monster could scare the hell out of me when I was a kid... I remember myself playing and almost getting a heart attack every time the monster showed up.

</comment><comment><USER25> If you crash when the yeti is chasing you, the yeti disappears.

</comment><comment><USER26> amazing finally! you could do tricks though in the original one maybe an addition to patch on the following release ?

<comment><USER27> The controls are wrong, too. Left and right should rotate the character, but right now they make him turn hard left and hard right. In the original there were also two degrees of left and right turning, so you could navigate with more precision. You could also turn fully horizontal and then use the up arrow to climb the hill sideways.

Please fix this! :-)

<comment><USER28> I knew the original was somehow different too.

Also, couldn't you right-click in the air to do tricks or something?

<comment><USER27> You could press up or down while mid-air to have the player flip back and forwards.

</comment></comment></comment></comment><comment><USER29> Now if we could just get a JS version of the Johnny Castaway screensaver, reliving my youth would be quite possible.

</comment><comment><USER30> I swear this game is better than most of the game I've played this and last year. Graphics aren't everything.

</comment><comment><USER31> Wasn't this posted a couple weeks ago?

<comment><AUTHOR> You may be thinking of my submission to /r/webdev on reddit?

<comment><USER31> Ah. Probably. I am so used to getting all my original content from HN :P Sorry!

</comment></comment></comment><comment><AUTHOR> If you haven't tried this in mobile Safari or Chrome yet please do, it works surprisingly well!

</comment><comment><USER32> I don't remember the controls being like this. The controls here seem far less intuitive.

</comment><comment><USER33> I'm glad the yeti has taste. It's not interested in snowboarders.

<comment><AUTHOR> Hahah! Maybe the Yeti is trying to clean up the slopes though, eh? ;)

</comment></comment><comment><USER34> Damn, I'm itching for pressure-sensitive arrow keys.

</comment><comment><USER35> Your next project - Elasto Mania in the browser!</comment>


SF's homeless problem: A civic disgrace - <AUTHOR> https://marco.org/2016/07/05/sf-homeless <comment><USER2> As Marco says here, it's not just SF. My home town of Ann Arbor, MI was a lot more egalitarian when I was growing up. Now you have insane amounts of money spent on U of M's football stadium getting skyboxes for the 1% and putting a tacky, hideous, gigantic, double-sided LED billboard out front of the stadium while the city's infrastructure and public transportation haven't really been updated in 20+ years.

The only places investing in public good are small towns like the one I've moved to, where building up parks and public spaces, taking care of infrastructure and yes looking after our citizens is still something seen as worthwhile and the purpose of government.

</comment><comment><USER3> Main discussion: [https://news.ycombinator.com/item?id=12038100](https://news.ycombinator.com/item?id=12038100)</comment>


Stripe's remote engineering hub, one year in - <AUTHOR> https://stripe.com/blog/remote-hub-one-year <comment><USER2> The points under "Cultural improvements" can't be stressed enough:

* When only one member of that team is remote, they often suffer a combination of isolation ... and organizational burden ...

And their approach to foster inclusiveness is a great checklist:

* We nominated a site lead ... to be responsible for the overall happiness and productivity of the hub. * We ensure that our leadership regularly visits the hub via Zoom meetings to lead discussions, answer questions, and provide a sense of connection. * We encourage virtual coffee chats to promote a sense of belonging. * We survey the team regularly and review feedback and people data, so that we can understand both the shared needs of our employees and the particular needs of a hub.

Remote doesn't have to mean work from home, and I can attest that having too few remote employees and not enough cultural investment is a recipe for failure.

An ole employer had a satellite office with just a few employees. The main office was in a city in a different state. There were many occasions where we were in the dark about talks that'd happened at HQ, activities, and even some times when the owners would let folks leave early on Friday! Without dedicated leadership and effort to make sure employee are included, even a small satellite office can feel isolated and neglected.

In the end there were just 3 engineers total, all in different teams. I left a year after the company restructured, closing the satellite and everyone was WFH.

<comment><USER3> To add another story... a previous company I worked at had an HQ of about 700 people in Chicago with satellite offices of 20ish people in a number of locations, one of which I worked at. After a couple years it was extremely obvious that the satellite offices were not only left out of important discussions and considerations from HQ, but were also treated very poorly in comparison when it came to bonuses and promotions. This despite many of the satellites being more percentage-profitable with higher growth than HQ. It led to a toxic environment and a personal lesson to be wary of working away from an HQ.

</comment></comment><comment><USER4> Am I the only one thinking that "remote" would mean "anywhere in the world", but most of the times mean "anywhere in the country" (in Stripe's case, the US)? Is it even possible, due to legal/logistics, to have really "internationally remote" workforce?

<comment><USER5> Broadly, there are tradeoffs, including organizational risk tolerance, and which margins one is permitted or not permitted to take which risks on.

For example, some software companies are regulated in some jurisdictions. A not-too-hypothetical regulation is "regulatee understands and enthusiastically consents to unannounced site inspections by regulator at any time of our choosing." Thankfully, this doesn't apply to most software companies, but ones who it does apply to have hopefully long-since had a chat with their competent legal professionals about _precisely_ what the definition of a "site" is.

There are many, many issues like this, and they're fractally complicated. Even the basics of "How do I hire a full-time white collar employee with the standard package plus equity?" vary substantially between jurisdictions. Setting up the infrastructure for it in a jurisdiction can take the better part of a year. (It would be an excellent thing, for everyone, if jurisdictions decided to compete on ease to employ their residents.)

<comment><USER6> A lot of smaller companies elect to onboard international employees as the employee's country's equivalent of a 1099 rather than setting up the local infrastructure. I am not sure at what point this no longer becomes viable because it's obviously not a practice followed by larger corporations for the most part.

</comment></comment></comment><comment><USER7> Two things I'd be most interested in are:

1) Career Opportunities: what's the rate of promotion, moving into management for remotes vs non remotes

2) Compensation: is an engineer an engineer an engineer? Or are there SF engineers and Tulsa engineers and Austin engineers, each with different salary bands?

<comment><USER5> 1)

We're extremely solicitous of there being advancement opportunities for everyone in every office. This is something that we're looking at over time. Companies that can't manage this will lose to ones who can, as their seasoned talent moves to places where it is valued appropriately.

Promotion isn't co-extensive with moving into management; we have senior IC tracks, too, including in engineering, and many remote engineers happen to be senior ICs. (IC = "individual contributor", meaning "has no people reporting to them." I am an IC at Stripe.)

2)

Like most employers, we craft compensation to be competitive with what we perceive as the market. We expect that geography will continue to influence who the "marginal buyer" is for most engineering talent, which will in turn influence prevailing compensation. That said, we expect that the importance of geography in determining compensation will continue to shrink, and data suggest that candidates outside of major tech epicenters have found our offers to be very competitive.

While a lot is said and written about how geographic compensation "should" be done, tech company hiring is at root a highly competitive and vibrant market. If our (or any other company's) strategy is wrong, the market will quickly tell us.

<comment><USER8> > Promotion isn't co-extensive with moving into management; we have senior IC > tracks, too, including in engineering, and many remote engineers happen to > be senior ICs. (IC = "individual contributor", meaning "has no people > reporting to them." I am an IC at Stripe.)

This sounds great, and I wish more organisations did this - for most, it seems there is an absolute limit at which your career path stops dead.

<comment><USER9> Unfortunately, this is largely a fundamental issue. It is _outrageously_ hard for an IC to have impact that is orders of magnitude more than their peers. Volume maybe. But in terms of impact? Really hard.

Managers get to cheat, to some degree. They instead are tasked with organizing a whole bunch of people - who _can_ achieve things that a single person never could. So a manager has a much easier "I made the company 10% more money" story than an IC.

Some organizations try to fight this bias, but it is hard and takes a clear framework for promotion guidelines and constant vigilance.

<comment><USER10> High-level IC roles (in the companies that have them) are still leadership roles. They are just technical leadership roles instead of people management roles. They may not have direct reports, but they are still responsible for getting big projects done, usually by organizing a large number of engineers.

</comment></comment></comment></comment></comment><comment><USER11> A while back I was looking for a remote position at Stripe. I live near the Chicago area and was told I couldn't work remotely because they were starting a Chicago office and wanted me to be there instead.

<comment><USER5> Feel free to check back in the next time you're looking; our appetite for "remotes in the same city / metro area we have an office in" has been increasing over time, particularly as individual offices mature.

<comment><USER12> Are there opportunities for partial remote, or WFH when you want but go into the office sometimes as well? In my case I'd like to live in the city and go in but also work from a coffee shop or at home on certain days, to get some variety.

<comment><USER5> This was reasonably common for our office-based employees in better times. I expect it will be even more common when we re-open our offices.

<comment><USER12> Sounds good, Patrick. You'll be seeing my application later this year :)

</comment></comment></comment></comment></comment><comment><USER13> Heh Heh Heh. After the article talks up all of benefits of remote working, and how they can hire in any of 50 countries, there's a link to "these are our remote positions".

 _Every one_ of which has leading text stating:

      Remote in North America only

Something seems off. Pass.

<comment><USER5> I work at Stripe, including on this post. As we mentioned, our remote hiring is in scaled production mode in the U.S. and Canada, and in early stages elsewhere. We anticipate this will change, and are working towards changing it, as quickly as various constraints allow.

<comment><USER14> There are 212 job openings listed on Stripe's careers page as either located in the United States or remote. Of those, 17 are remote (~8%) & the rest are not. So even excluding non-US listings, it's a small percentage -- Seattle has ~30%, SF has ~50%, NYC has ~11%.

Even though a single job listing can/does represent multiple job openings, that's true for all the listings as well. So all other things being equal, I would expect Stripe to have _way_ more remote listings if it's been as successful as this post implies. Which leads me to believe the reality is much more nuanced and that the blog post is a bit heavy with PR fluff (no shame!).

Also, big fan.

<comment><USER5> I'm pretty confident that we made only true claims, particularly the ones with numbers. If your model doesn't agree with our SQL, I think the maximally polite observation I can make is that one of us is probably wrong.

<comment><USER15> Or both.

</comment></comment></comment></comment></comment><comment><USER16> super tough to take this post seriously, it sounds very much like a company marketing/recruiting post

</comment><comment><USER17> I wonder what the engineering comps are.

<comment><USER18> I wonder about this as well because usually the inclusion of remote engineers is usually to pay less comp than main locations especially when outside the country.

</comment></comment><comment><USER19> "Remote Work Is Eating The World" , next week on HN

<comment><USER20> I'm already looking forward to the front page in 2025: "What's the secret of our success? We did the unthinkable and co-located our whole team in one office."</comment></comment>


How do you quote a passage that has used '[sic]' mistakenly? - <AUTHOR> http://english.stackexchange.com/questions/24750/how-do-you-quote-a-passage-that-has-used-sic-mistakenly

<comment><USER2> Off topic, but reminded me of a great joke from Judge Kozinski in the Roomates.com case, viz.:

". . . Some subscribers are just looking for someone who will get along with their significant other[34] or with their most significant Other.[35]"

[34] "The female we are looking for hopefully wont [sic] mind having a little sexual incounter [sic] with my boyfriend and I [very sic]."

[http://scholar.google.com/scholar_case?q=521+F.3d+1157&h...](http://scholar.google.com/scholar_case?q=521+F.3d+1157&hl=en&as_sdt=2,5&case=12982314326945878032&scilh=0)

<comment><USER3> unfortunately his rapier wit also demonstrates an internal bias. if he feels the need to put down people with nontraditional sex lives maybe he shouldn't be judging a case involving such things.

<comment><USER2> I think the [very sic] referred to the fact that it should be "my boyfriend and me." That's all.

</comment></comment></comment><comment><USER4> Practical solution: remove the "sic" and replace it with a "..." to indicate that you've excised a portion of the quote. Or, y'know, don't bother to quote the passage with the offending "sic" at all. You could even come up with a way to phrase it so that you're quoting the original rather than quoting the quotation.

If you wanted to include it and do it unambiguously you'd need to come up with a convention and state it clearly in the text. "Please note that all instances of "[sic]" which use square brackets are author B's insertion when he quoted author A, while instances of "(sic)" with parentheses are my own insertion in quoting author B."

Thus we have "a letter from me [sic] (sic) to you".

</comment><comment><USER5> You use escaping of course:

        ...suppose I write a letter from me \[sic\] [sic] to you.

<comment><USER6> Ok, but imagine for a moment that you use the wrong-facing slash like so:

        ...suppose I write a letter from me /[sic/] [sic] to you.

What now, huh?

        ...suppose I write a letter from me /[sic]\[sic\]/[sic] \[sic\] to you

<comment><USER7> It's turtles all the way down...

</comment></comment></comment><comment><USER8> Unless you're making a point about the [sic], Just remove it. It adds no value and distracts from the original message.

 _Fun question =)_

<comment><USER9> Yes, I think 2 negatives make a positive here, and the situation where you do want to draw attention to a misplaced [sic] is so rare that it warrants further discussion in your text.

</comment></comment><comment><USER10> Based on some investigation in Google Books, what books actually do is use a footnote: "blah blah [sic] blah" 1

1 [sic] in original.

It's fundamentally the same thing as clarifying "blah _blah_ blah" (emphasis added) or (emphasis in original).

Note that the purpose of [sic] is not to point out how clever you are to find an error, but to clarify for the reader that the text is copied accurately. Thus, the original question about putting a [sic] on a mistaken [sic] is not something that makes sense to do.

</comment><comment><USER11> Unless your actual aim is to draw attention to the incorrect use of [sic], when would this actually be needed? Surely the normal use would be "So and so is quoted in the <whatever source> as saying:" in which case you can quote what they said without needing any editorial additions, such as [sic], that the source added themselves.

<comment><USER12> Their [sic] will look like yours, though. And since it's stipulated that the quotee used [sic] incorrectly, you (the quoter) will look as if you are using it incorrectly.

</comment></comment><comment><USER13> Happily, readers aren't fragile parsers, demanding escaping or special formatting. They can handle you making your meaning explicit, either inline or in a footnote.

</comment><comment><USER14> Note beforehand or in brackets at the end that the [sic] was not added - wherever you'd add "emphasis mine" if you'd highlighted part of it.

</comment><comment><USER15> Italicize the quote or set it in different font. If that is not possible (because of strict style guidelines, maybe), your best remaining option is to lampshade its appearance.

</comment><comment><USER16> That's what you call a "meta sic".</comment>


CSS Bugs and Inconsistencies in Firefox 3.x - <AUTHOR> http://www.webdesignerdepot.com/2010/03/css-bugs-and-inconsistencies-in-firefox-3-x/

<comment><USER2> Good reference. Thankfully a pretty small list.</comment>


Would there be any pattern in the death of Roman emperors? - <AUTHOR> https://arxiv.org/abs/2008.10344 <comment><AUTHOR> Would there be any pattern in the death of Roman emperors? This paper apply statistical methods to this interesting problem.</comment>


Who killed Ashraf Marwan, described as the 20th century's greatest spy? - <AUTHOR> http://www.theguardian.com/world/2015/sep/15/who-killed-20th-centurys-greatest-spy-ashraf-marwan <comment><USER2> Had the pleasure of being taught by Ahron Bregman (the lecturer mentioned in the piece) in King's College.

I always thought there was something about the death and investigation that didn't fit well. That area is covered in London by CCTV etc, the fact that the investigation didn't really go anywhere is strange.

On the face of it, I and many other Bregman students thought Israel was the most likely immediate candidate for the killing - but doing it in London and in such a high-profile way didn't really seem like their modus operandi (plus the description of "Middle Eastern looking men" on the balcony wouldn't really fit with a "kidon" team sent to kill him). Also his actions had been known for years by Israel, so why do it now?

Marwan was clearly playing so many sides and involved with so much intrique that there were many who might have wanted him dead.

Also, i'm sure there are probably many other people who might be deemed worthy of a the "20th Century's greatest spy"

<comment><USER3> > but doing it in London and in such a high-profile way didn't really seem > like their modus operandi

They carried out the Dubai murders in a high-profile hotel also covered with CCTV, with fake British, German, and Australian passports. I wouldn't put this past their "modus operandi".

<comment><USER4> One of my favourite Mossad stories just for its pure audacity was the Cherbourg Project:

[https://en.wikipedia.org/wiki/Cherbourg_Project](https://en.wikipedia.org/wiki/Cherbourg_Project)

<comment><USER5> Mossad always seems to run the craziest ops because of a lack of ability to project significant power in foreign lands.

</comment></comment></comment></comment><comment><USER6> So the guy most famous act was that he helped israelis win a war against egypt, and people still wonder if his killers are egyptians or israelis ?

<comment><USER7> Its more complicated than that, during the 73 war he pass wrong (false?) information that Egypt is not going to attack Israel, up until today it is unclear (read argued by the intel community) if he was a double agent or that he was caught and Egypt decide to feed him false information to pass to the Israel without him knowing.

</comment></comment><comment><USER8> if he was the greatest spy then how does everyone know about him?

EDIT: Oh i am foolish, I know this guy, have read a book

</comment><comment><USER9> The real 20th century greatest spy? :)</comment>


Ask HN: How do you verify the identity of your users? - <AUTHOR>

I am working on a website that runs contests. We need to confirm that users map to real people to avoid cheating on contests. Obviously email confirmation is a way, but easily scammed.
Twitter or FB login are possible, and I could even see when the account was created to ensure that they didn't just make it to scam my site's registration, but I am worried about scaring users away with it.
What do you recommend? <comment><USER2> Note that you don't really need to confirm everyone who participates, only people who win. You should make it clear that should someone win you will go full forensic on them. Providing you've saved enough data you can go back and correlate their activity with similar activity to see if cheating appears to happened. You can do investigation with humans which makes attacks harder, and also scales (you only need to investigate the limited number of winners rather than all participants).

As 0xEA mentioned you can go network effect on them too. For example you can require that winners had Facebooked/Tweeted something at the time of their entry. When someone wins you can go back an check that which means that someone cheating would have to do so with lots of dummy accounts. And of course the messages form advertising for your contests.

You can also make them nominate FB/Twitter friends to share their prizes should they win at entry time. Again this makes life a lot harder to cheat as it gives your win investigations more to work with.

</comment><comment><USER3> If you have a working solution to that problem, stop working on contests and proceed directly to IPO.

</comment><comment><USER4> Make them upload a picture of themselves next to today's newspaper, where today's date is legible, and you need to be able to verify the paper is legit. That would be possible but not easy at all to fake.

The second best way is credit card, and use a third-party service that doesn't require you to store any cc info locally.

Unfortunately, people have more than one cc, more than one email, and you can't ask for ssn, but even if you could, that isn't guaranteed to be unique:

[http://ssa-custhelp.ssa.gov/app/answers/detail/a_id/79/~/req...](http://ssa- custhelp.ssa.gov/app/answers/detail/a_id/79/~/request-for-a-different-social- security-number)

DNA is unique, but that is too expensive and can be faked unless checked immediately, and depending on type of test, can be faked even in person if blood not taken (difficult to fake otherwise), and can't do online.

Vocal recognition for determining whether a user is unique and for relogin later can be faked online easily.

Visual recognition online may be decent way to do it, but probably too expensive, and could be faked by someone holding up someone else's picture, or a video of someone from YouTube (although could check for artifacts indicating is from video source).

Retinal scan can be faked.

Gait + body/facial recognition isn't too bad, but you can't do that online. That is what the government uses with street cameras in cities, etc.

<comment><USER5> You don't have to do a newspaper. Generate a one-time, expiring string, like "Q8uZ3" -- they have to write it on a card and take a picture of their face with the card underneath. They have 30 minutes before it expires.

</comment></comment><comment><USER6> A credit card number would be hard to fake.

A scanned pic of govt id that matches a name would work too.

<comment><USER7> If high schoolers have access to scannable fake IDs, then I'm not sure a scanned pic of an ID is really suitably difficult to fake.

I agree that CC numbers is probably a good way forward as long as your users trust your site enough to provide that information.

Are CC numbers easier to "name check" than SSNs?

<comment><USER8> High schoolers also have a larger net gain to faking their ID (years more drinking and partying), as opposed to winning a competition online.

But I guess it depends on the competition (eg. a digital camera vs. a car would provide different levels of motivation to cheat)

</comment></comment></comment><comment><USER9> You could use the PGP endorsement model. Network effects should work out decently.

</comment><comment><USER10> How about an SMS verification code sent to the user's mobile phone?

<comment><USER11> Mobile phones are $30 at your nearest bodega.

<comment><USER8> Meaning that multiple entries are very cost-prohibitive. If you want to enter 100 times with Facebook, you can buy 100 Facebook accounts for much cheaper than the $30 * 100 mobile phone cost.

<comment><USER11> In that case, you can just get a VOIP number for 8 cents or whatever.

<comment><USER12> It might be possible to prevent this. Craigslist somehow detects when you use a Twilio number.</comment></comment></comment></comment></comment>


Uber Health - <AUTHOR> https://www.uberhealth.com/?_ga=2.114796039.1666788483.1570757479-1274530960.1570757479 <comment><AUTHOR> Curious how Uber is planning to ensure the service 24 hours available? Anecdotally, it has been difficult recently getting rides before 6AM in the morning on a few occasions.

</comment><comment><USER2> With how much disregard for laws that Uber has shown, I'm not sure I'd trust Uber to actually be HIPAA compliant or to be committed to privacy.</comment>


Skype Hits 40 Million Simultaneous Users - <AUTHOR> http://www.disruptivetelephony.com/2012/04/skype-hits-40-million-simultaneous-users.html <comment><USER2> I'm surprised to see the complaints about call quality. In recent years I've found the call quality to be really good. It helps if you have a dedicated headset.

I'd much rather criticize their UI design. The latest OSX client is an abomination.

<comment><USER3> I switched from Windows to OS X a couple months ago. Everything was bright and shiny until I installed the Skype client. I could literally not believe that this is the same Software I used to love on Windows - there is so much wrong with it (constantly popping up Dial Pad that I never use, inability to resize the Name column, to just name a few). Over time I got used to the annoyances, but it it still one of the worst UIs I've ever seen. Does anybody have an idea how this could happen?

<comment><USER4> The _"craigslist effect"_. It's when a product or service with shitty design and severe flaws is the only one that does what it does and starts growing in popularity due to it's monopoly and it's owners think "hey we must be doing something right so lets not change or improve it because we don't have to". A.K.A. " _What happens when you don't have competition._ "

<comment><USER3> But what's so surprising is that I don't remember the Windows client to be nearly as bad as the one for Mac. I guess they are made by two completely different teams with no coordination on UI issues.

<comment><AUTHOR> The Mac Skype client was actually quite excellent, too, up through version 2.8. Then Skype jumped the version number to 5.0 and came out with the UI mess that they did. About a year ago I wrote about the issues I had with the 5.x client... and I _still_ have the issue with the lack of multiple windows:

[http://www.disruptivetelephony.com/2011/04/my-3-main- issues-...](http://www.disruptivetelephony.com/2011/04/my-3-main-issues-with- skype-5x-for-the-mac-and-jim-courtney-summarizes-the-skype-for- mac-5-saga.html)

</comment></comment></comment></comment></comment><comment><USER5> Maybe they could work on the quality of the service now!

One of my largest pet peeves is that Skype quality is so poor that DTMF tones can't travel across intact. If you're using Skype and trying to enter an extension, good luck. This morning I tried to use Skype to access my voice mail without success.

Customer support is also horrible. The standard response is that it is the customer's fault. Audio quality on Skype seems to be directly proportional to how old the device is.

Nokia Maemo tablet? Great! Nokia N95, not so great. Windows, Android, Linux, Apple? Nuh uh.

<comment><USER6> Does anyone know the technical reason for DTMF tones having difficulty?

Because the quality of a Skype call, for me, is so much higher than a cell phone or landline, why do the tones have a problem? Is it something about the codec?

<comment><USER7> ([https://support.skype.com/en-us/faq/FA10292/Does-Skype- Conne...](https://support.skype.com/en-us/faq/FA10292/Does-Skype-Connect- support-DTMF-signaling))

(<http://datatracker.ietf.org/doc/rfc2833/>)

(<http://datatracker.ietf.org/doc/rfc4733/>)

(<http://datatracker.ietf.org/doc/rfc4734/>)

([https://lists.cs.columbia.edu/pipermail/sip- implementors/200...](https://lists.cs.columbia.edu/pipermail/sip- implementors/2007-June/016970.html))

> _GK >> You are right that with in-band DTMF, you need to perform tone > detection at RTP level which isn't exactly an ideal scenario._

(<http://www.voipmechanic.com/dtmf-issues.htm>)

> _In some VoIP routes a switch may be configured to detect in-band DTMF which > is sent by the VoIP ATA, but then switches to an out of band RFC2833 DTMF > required for an upstream provider. This upstream carrier then terminates the > call to the PSTN, possibly to a voice mail system, which will require > regeneration of the audible inband DTMF tones. The switch has to detect and > remove the tone sent by the ATA from the audio stream because the upstream > provider specified RFC2833 DTMF. At times the switch can't always completely > remove the in-band DTMF tone which is a problem, because by the time it has > detected the DTMF tone, it has already passed a short amount of it. This > small amount of in-band tone along with the RFC2833 tone sent are both > received by the far end voice mail system which will then register an error > (problem), possibly an invalid mailbox or invalid password._

</comment></comment></comment><comment><USER8> I never seem to have these quality issues that people are complaining about elsewhere in this thread. About the only thing I can give them flack for is the horrible, _horrible_ UI design.

<comment><USER9> Are you talking about the windows or OSX one? They're both so different.

<comment><USER8> Both of them are pretty painful, albeit in different ways. OSX Skype could take a cue from Adium, Windows Skype could take a cue from ICQ, and _BOTH_ could take a cue from Linux Skype.

<comment><USER10> Linux Skype, which makes you open a new window for every chat you have? Linux Skype which won't notify you of incoming calls if you're already on a call? That Linux Skype?

<comment><USER8> I was talking more about the minimalist UI and less about janky behavior. The Windows (and to a lesser extent, OS X) versions seem to have taken their designs from the worst parts of MSN Messenger and AIM.

And call me crazy, but I prefer my chats in separate windows.

</comment></comment></comment></comment></comment><comment><USER11> While I congratulate Skype on reaching 40M simultaneous users, I am somewhat disappointed that there was no mention of how the 40M people can stay online without melting Skype's servers. Some architectural insight would have been nice from an article posted on the front page of HN...

<comment><AUTHOR> Skype uses a peer-to-peer network for the majority of the connections and really only uses servers for authentication and for gateways to other services/networks (such as the regular phone network).

A couple of years ago I wrote a brief description of the technology underlying Skype:

[http://www.disruptivetelephony.com/2010/11/a-brief-primer- on...](http://www.disruptivetelephony.com/2010/11/a-brief-primer-on-the-tech- behind-skype-p2psip-and-p2p-networks.html)

(I have no connection to Skype myself, but have worked in the VoIP industry for 10 years and have been writing about Skype for a good portion of that time.)

<comment><USER11> Cool, thanks for the link. If I understood correctly from your article, supernodes are basically Skype clients that act as distributed servers used for discovery of other clients.

But I imagine authentication has to happen against a Skype server, and the clients would have to constantly communicate with that server to stay online, to get the current balance, etc... That's 40M requests at any given time. Since it's semi-distributed, and you have to pay for the service (to call a landline or internationally, for example), how does this fit into the distributed model and how do they keep track of everyone?

</comment></comment></comment><comment><USER12> Which means there were probably 100 million users attempting to use Skype simultaneously. Skype works maybe 50% of the time I try to use it at best.

</comment><comment><USER13> Maybe I'll finally have to see if I can do something interesting with skype.

[http://search.cpan.org/~mncoppola/Win32-Skype-0.01/lib/Win32...](http://search.cpan.org/~mncoppola/Win32-Skype-0.01/lib/Win32/Skype.pm)

<comment><USER10> I wrote a script that lets you initiate and respond to calls using only the keyboard, which made my Skype usage bearable when I still had to use it: <https://raw.github.com/technomancy/dotfiles/master/bin/skyyy>

</comment></comment><comment><USER14> Just to clear things up, that's 40M people logged into a Skype client, not simultaneously video chatting.

</comment><comment><USER15> That sounds really high? That's more than 10% of the population of the USA, all using Skype at once.

<comment><USER16> That's the number of people who have skype running on their computers, not the number who are on a call. Skype is fairly common, automatically starts when the computer starts, and doesn't actually close when you click the "x". So I think that number is believable for total users online worldwide.

<comment><USER17> Not to mention smartphones.

</comment></comment></comment><comment><USER18> Are there rooms for an alternative?

<comment><USER19> Of course there is. I don't think it will happen, however. Google Plus already demonstrates rich in-browser video teleconferencing. I think that's the way to go.

It should be relatively easy to build a Google hangout client with nothing but HTML and a WebKit+plugins engine.

<comment><USER20> Could you be more specific on why this will not happen? As you say, in-web calls should be possible, why people don't compete against skype with decent web apps?

<comment><USER19> I think a new stand-alone application has zero chance of successfully taking on Skype head to head. A web app, possibly embedded in a social setting, has a much better chance of success, if well executed.

</comment></comment></comment></comment><comment><USER4> I think Microsoft got a good deal when they bought skype.

Looking at Skype (despite it's flaws) it's success was unavoidable. The same way people want an all-in-one device that does everything (like smart phones) over multiple separate solutions (camera, mp3 player, phone, pda), people seem to want one IM client for calling, texting, IMing, voice chat & video chatting. I don't think any other client provides everything wrapped up so well. Yes the UI is horrendous and tedious but its services are well offered and cheap. And with ever increasing globalization those services are vital.

It's just too bad that Microsoft introduced a back door to spy on skype calls. I now trust it about as much as I trust Google Voice + Google Talk.

<comment><USER21> Please back the backdoor claim up, it's the first time I've read that and it does not really make sense (to me), as there would be no reason to do so...

<comment><USER4> [http://www.computerworld.com/s/article/9218002/Microsoft_see...](http://www.computerworld.com/s/article/9218002/Microsoft_seeks_patent_for_spy_tech_for_Skype)

Correction: Not a back door, but a eavesdropping technology.</comment></comment></comment>