Quick fix for an early Internet problem lives on a quarter-century later (2015) - <AUTHOR> http://www.washingtonpost.com/sf/business/2015/05/31/net-of-insecurity-part-2/ <comment><USER2> BGP was intended for a specific niche. Earlier, there was the ARPANET, operated by BBN out of Boston, and peripheral stuff connected to it. Early Internet thinking was that there was a "core" with its own routing protocol, and BGP was how the core communicated with small peripheral networks. BGP wasn't intended as the core routing protocol.

Mutually mistrustful routing is hard. I wrote some stuff on this in the early 1980s. The best I came up with was a scheme where forgeries would be detected, and once the source of the forgeries had been kicked off the network, the system would heal itself. (Asymmetric cryptographic signing had been invented but wasn't yet used or trusted.)

</comment><comment><USER3> Related project: [http://www.scion-architecture.net/](http://www.scion- architecture.net/)

SCION is a BGP replacement that's in development at the ETH Zurich network security group; it promises isolation of routing hijack attacks (by means of so-called "isolation domains", planned to be grouped by jurisdiction AFAIK). It's even already deployed in a bunch of places (edit: [https://www.scion- architecture.net/#deployment](https://www.scion- architecture.net/#deployment)).

It also has cool extensions like SIBRA, which provides DDoS protection by means of bandwith reservation, and HORNET (which you might've heard of before), which is a high-speed anonymous communication network (which is sadly not yet available to the public in implemented/working form).

Previous HN discussion on HORNET: [https://news.ycombinator.com/item?id=9930929](https://news.ycombinator.com/item?id=9930929)

</comment><comment><USER4> > BGP won out because it was simple, solved the problem at hand and proved > versatile enough to keep data flowing as the Internet doubled in size, again > and again and again.

So if you want to replace it, make something that is equally simple and solves the new problem(s) at hand without un-solving the original one. If you don't do that, people have no incentive to switch.

It sounds like the (vaguely described) new alternative is more complex. If it was better for business, things would have gravitated toward it quickly.

<comment><USER5> It's unreasonable to demand that a new solution be "equally simple". History is full of simple solutions that _aren 't good enough_ that get replaced with more comprehensive yet complicated solutions. HTTPS isn't as simple as HTTP, C++ isn't as simple as C, democracy isn't as simple as monarchy, the courts aren't as simple as mob justice.

<comment><USER4> > HTTPS isn't as simple as HTTP, C++ isn't as simple as C, democracy isn't as > simple as monarchy

Right, none of those have led to obsolescence even with long periods of time to grow.

Instead, think of replacements that have caused something to basically just disappear.

I'm not convinced this is the best example, but I think it helps get my point across. This is from a user's perspective, not a manufacturer's. Maybe someone can share better examples from software if these aren't appropriate.

When a new type of cable connector enters the market, it has to be at least as simple as the old one or do something more than the old one did. Serial or parallel plugs have screws to help hold the cable in place, newer plug types like FireWire or USB don't need the screws, so they are simpler. Now we are seeing new types of plugs that work "upside down" so they are even simpler for consumers to use.

I guess a better example might be media distribution. From a user's perspective, the compact cassette was just as simple to use as the 8-track. Or BluRay replacing DVD replacing CD.

Would high speed internet be as popular if it required a time consuming arcane ritual to establish a connection, compared to the simple bleep bloop of a dial-up modem?

So if you want the users of BGP (network operators) to switch to something better, make it just as simple for them to use, while providing additional benefits. Yeah it isn't easy, but it's certainly been done in other arenas.

<comment><USER5> > Instead, think of replacements that have caused something to basically just > disappear.

Okay, SSH and Telnet. SSH is not as simple to use as Telnet. Windows users have to download a client, even in 2016. Server key changes cause warnings. People are often using encrypted key pairs instead of password authentication.

These (network admins who care about BGP) are sophisticated users. A secure version of BGP is not going to be as simple for them to use. It's just not happening that way, that's the way it always goes with security. More security makes the product more difficult to use, and a secure version of BGP is going to be more difficult to use.

Yes, you can find examples of simpler products that have replaced more complicated products, but that's rather poor support for the idea that replacements must be simpler or they won't be accepted. We're replacing magnetic strips with chip & pin for our credit cards, which are more complicated for everyone. Unencrypted HTTP may never completely die out, but HTTPS is everywhere and is only getting more common.

Or if you want simpler examples, think of the smart phone replacing the flip phone (less battery life, more complicated, more expensive) or the MP3 player replacing the cassette player (more expensive, more complicated, you have to get a computer and rip your CDs or buy digital music online). Or think of locks replacing simple latches on doors, now you need to carry a house key with you.

Or if you want examples more similar to BGP, think about spanning tree protocol. It's simple and it gets the job done. It's also completely dead in the modern data center, replaced by things like the far more sophisticated software defined networking. BGP is headed for the same fate.

<comment><USER6> I think that from an end users point of view SSH is as simple as telnet. Sure there are ways to use ssh keys and so on, but the base operation is as simple, ssh machine instead of telnet machine.

Regarding need to download ssh, the same has been true about telnet since (at least) windows 7. (Telnet is NOT included by default in windows 7)

Warnings about server key change, is something i feel happens very rarely with a workaround described in the error message. I feel this is a very minor issue

The other ssh added complexity is optional stuff. and is something i feel made ssh better than telnet, example: You can forward X11 connection between unix machine using ssh.(Sure you use telnet and xhost/ DISPLAY et.c )

SSH-keys are also a optional feature, that are not forced on the user, but can simplify remote login.

Sure there are more complexity inside ssh and the protocol, but the simplest use of ssh is about as simple as telnet.

<comment><USER5> Yeah, I'm not buying it. I'm an end-user of SSH and I've experienced WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED or all sorts of bizarre problems with authentication just _failing_ for reasons that took me hours to diagnose. That, and configuring servers to reject password authentication, converting private keys between the different formats expected by different clients, the unhelpful errors like "Permission denied (publickey)." which actually means "you typed your password in wrong" but Telnet will actually tell you that your password is wrong. How many users have discovered that after upgrading SSH that their known_hosts file is now _hashed?_

The protocol itself is a total mess. Having implemented servers for the Telnet protocol, I can say that Telnet is a little bit of a mess, but SSH is a total nightmare by comparison.

You're right though, that if you look at a very tiny slice of SSH then it almost looks like SSH is simpler than Telnet, once you've gone through the work of generating a key pair, securing the private key, and installing the public key on your server.

<comment><USER7> And if you're going to cherry pick tiny slices, I'd rather pick the slice:

"SSH lets me communicate with a server securely, more simply than via Telnet."

By the same vein, HTTPS is "simpler" than HTTP in this regard.

Ditto for many possible BGP replacements.

<comment><USER5> That seems like wordplay, to me. Does a car make it "simpler" to travel 60 miles an hour down the freeway, compared to walking?

SSH is more complex and more secure than Telnet.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Similarly, UTF-8 was designed on a diner placemat.

[https://www.cl.cam.ac.uk/~mgk25/ucs/utf-8-history.txt](https://www.cl.cam.ac.uk/~mgk25/ucs/utf-8-history.txt)

<comment><USER9> UTF-8 was also designed under rather severe restrictions: you want to keep binary compatibility with 7-bit ASCII, i.e. 128 out of 256 possible byte values are taken and you want to encode the entirety of Unicode including any future additions. This means you need variable-length encoding. You also want to detect if the stream is well-formed and you want to detect if you're starting decoding in the middle of a character. UTF-8 is one of very few possible solutions that cover all requirements.

BGP had a lot more to work with since you're designing an entire protocol that doesn't need any backwards compatibility with anything else.

<comment><USER10> > You also want to detect if the stream is well-formed and you want to detect > if you're starting decoding in the middle of a character

These are positive characteristics of the UTF-8 design, but weren't necessary pre-requisites. Other encodings don't have the same redundancy (for integrity check) or freedom from boundary ambiguity.

</comment></comment></comment><comment><USER11> There's a motto in my department at work: Nothing is more permanent than a temporary solution.

<comment><USER12> Yes, I learned this pretty early in my career, from a (technically literate) client.

"I've added a temporary solution for X" "These temporary solutions are usually permanent"

Sure enough. The temporary workaround was eventually deployed.

There's another one that I've learned, loosely translated to English it would be "The Symmetrical Workaround Theory". It states that workarounds usually come in pairs. If you fail to figure out where the other half of the workaround goes, a bug will take its place.

</comment></comment><comment><USER13> "Temporary is permanent."

"Test is production."

These two mantras have saved me and coworkers from making stupid "temporary" fixes countless times through the years.

</comment><comment><USER14> from 2015, discussion here back then: [https://news.ycombinator.com/item?id=9636141](https://news.ycombinator.com/item?id=9636141)

</comment><comment><USER15> A related, interesting read: [https://security.stackexchange.com/q/56069/15648-what- securi...](https://security.stackexchange.com/q/56069/15648-what-security- mechanisms-are-used-in-bgp-and-why-do-they-fail)

</comment><comment><USER16> BGP at 18 from the guy himself:

[https://m.youtube.com/watch?v=_Mn4kKVBdaM](https://m.youtube.com/watch?v=_Mn4kKVBdaM)

</comment><comment><USER17> I get the feeling that the core Internet protocols (in the 80s and early 90s) were built by people who were like 75% sysadmins and 25% developers/system architects. Typically sysadmins employed by US universities. (I don't want to cast any shade on their accomplishments! They made brilliant things for the time.)

Then things got stuck because the Internet started hyper-scaling in the mid 90s.

This is just an outside observation though; it would obviously be great to hear any insider perspectives from people who were there.

<comment><USER18> It sounds like you're suggesting that a lot of system admin/developer types that were left in a room without adult supervision and, oops, the Internet!

The truth was that there was no lack of experienced architect/developer types at the time working on networking standards. The OSI model, for example, traces its roots back to 1977! The struggle was that the "adults in the room" were typically were older and held senior positions in large corporations and government agencies. The standards that they created were typically developed through a consensus protocol and by committee where the single biggest aim was to make sure that no company would gain or lose a competitive advantage based on the standard.

These standards were always pitched as being just over the horizon and, if anything, did a lot of early damage by delaying rollout of simpler protocols. I personally won't ever get back the hours that I spent studying protocols that were never relevant and never would be.

<comment><USER17> Thank you for sharing!

</comment></comment></comment><comment><USER19> Why isn't the sensitive data sent encrypted?

<comment><USER14> The issue is not that a third party can read contents, it is that a participant in the protocol (which could encrypt/decrypt) can do malicious things, so encryption wouldn't do anything.

Newer proposals include signatures and other steps to solve this, but as the article discusses uptake is slow and it makes operations more complicated. The weakness of BGP against hijacking also means that it's quite simple and very flexible, which operators like.

<comment><USER19> So, why would the US military care if sensitive data is being routed through Beijing?

<comment><USER14> (I misunderstood your question and thought you referred to BGP protocol data, which is why I mostly answered about BGP, but...)

The attacker could have just thrown the data away, totally interrupting all these communications. Even if encrypted, traffic patterns could be interesting and harder to obtain otherwise.

</comment></comment></comment></comment><comment><USER20> IPv6?</comment>


Chicago Tribune being sued for $10 M by patent troll over how it links to stuff - <AUTHOR> http://windycitizen.com/whRE

<comment><USER2> The patent is hilarious <http://priorsmart.com/6049835>

"A system for quickly and easily accessing preselected desired addresses or URLs on the Internet is disclosed in which a published list of Internet or World Wide Web sites together with their unique jump codes is utilized in connection with a corresponding specialized Web site which is accessed by a user using either a personal computer or a TV Internet Terminal and remote control, after which access a jump code corresponding to the preselected desired URL is entered by the user and software contained in the specialized Web site immediately and automatically accesses the desired Web site."

Bitly?

<comment><USER3> Is there some kind of mandate that patent abstracts be written as run-on sentences?

</comment></comment><comment><USER4> Seems like a stretch to me. I read the patent and in particular the claims they are saying the Chicago Tribune infringed on. I then looked at the Tribune's website and don't see where they would be infringing based on the claims and description in the patent. Looking at the Jump Code website, it gives an example of newspaper classified ads, but in looking at the Tribune website I don't any "codes" in their classifieds. In fact most of their classifieds are run by third-party systems (CareerBuilder, Pets.com, etc...). I wonder if the print version of the Tribune includes some reference to these numbers in their classifieds or even articles in the paper relating the print article to the online version.

I don't think this is a unique idea though and I would think it would be easy to find some form of prior art in the case. The system basically sounds like using a "keyword", or in this case a JumpCode, to link to a website. But the patent was filed in 2000. Companies like AOL and even CompuServe have used keywords for years on their site to link to webpages. I know newspapers have used keywords in print classifieds to link to online resources for a while (not sure if it would be before 2000 though) as well.

I don't believe these people are trolling necessarily, but I do think they have some aggressive legal advice here and may be looking to get some attention or prevent their business from failing.

<comment><USER5> I think the patent violation only applies to advertisements that appear in the print edition. At least, I hope so.

<comment><USER4> I would hope so too, but in reading the link it sounds like they are only referring to the website. Really sounds like a long shot to me.

</comment></comment></comment><comment><USER2> Might not be "troll" - here's their "JumpCode" system: <http://www.jumpcodesystem.com/>

<comment><USER6> Wow, the pricing is unbelievable. $250-500/month per "Jump Code". I'd love to know if they have a single paying customer at that rate.

<comment><USER7> There is always the chance that they aren't trying to attract customers but give themselves the best opportunity to win patent cases by actively pursuing their patent?

</comment></comment></comment><comment><USER8> I almost want to set up a competitor to this (having not read the patent) and sell it for $5 per code. Could one simply ignore such a silly lawsuit? Or would it really ruin me if they sued?

Honestly, a bit.ly clone like this would take an afternoon to do _well_.

</comment><comment><USER9> It's the people like this that are retarding the progress of software. I understand the need for protections but for something so basic and widely used I don't see how suing someone who uses a similar system helps anyone but the lawyers.</comment>


Netherlands falls on list of random countries - <AUTHOR> http://translate.google.com/translate?sl=auto&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.speld.nl%2F2011%2F11%2F07%2Fvn-komt-met-lijst-van-willekeurige-landen%2F

<comment><USER2> Please note that this website isn't an actual Dutch news site. It's ment to be funny!

<comment><USER3> In short, De Speld is the Dutch Onion</comment></comment>


Online resources for the amateur astronomer - <AUTHOR> http://news.cnet.com/8301-17939_109-10307289-2.html?part=rss&subj=news&tag=2547-1_3-0-5

<comment><USER2> <http://stellarium.org/></comment>


Nicholas Tse, a HK actor, has some surprising insights on running startups - <AUTHOR> https://www.youtube.com/watch?v=STgR9hlYFDw

<comment><USER2> I really like the part where he talks about how companies have forgotten that employees are human beings. So true in so many cases.</comment>


New Chinese Space Plane Landed at Mysterious Air Base, Evidence Suggests - <AUTHOR> https://www.npr.org/2020/09/09/911113352/new-chinese-space-plane-landed-at-mysterious-air-base-evidence-suggeststhe <comment><USER2> > "We're not even really sure why the U.S. military is pursuing a space > plane."

> The U.S. X-37B program remains highly classified. Weeden says he believes it > is being used to test new sensors and systems for the military.

Maybe looking at Wikipedia is a good place for an aspiring journalist to start:

> The mission hosts more experiments than prior X-37B flights, including two > NASA experiments. One is a sample plate evaluating the reaction of select > materials to conditions in space. The second studies the effect of ambient > space radiation on seeds. A third experiment designed by the Naval Research > Laboratory (NRL) transforms solar power into radio frequency microwave > energy, then studies transmitting that energy to Earth.

> The X-37B released a small, 300 pounds (136 kg) satellite named FalconSAT-8 > (USA-300) around 28 May 2020... the small satellite carries five > experimental payloads. The spacecraft will test a novel electromagnetic > propulsion system, low-weight antenna technology and a commercial reaction > wheel to provide attitude control in orbit.

[https://en.wikipedia.org/wiki/Boeing_X-37#OTV-6_(USSF_7)](https://en.wikipedia.org/wiki/Boeing_X-37#OTV-6_\(USSF_7\))</comment>


Ares booster damaged on return - <AUTHOR> http://news.bbc.co.uk/1/hi/sci/tech/8334951.stm

<comment><AUTHOR> Especially cool is the shock wave as the rocket goes transsonic:

[http://newsimg.bbc.co.uk/media/images/46628000/jpg/_46628214...](http://newsimg.bbc.co.uk/media/images/46628000/jpg/_46628214_ares_ap_226.jpg)

<comment><USER2> It's not really a shock wave, technically it is the Prandtl–Glauert singularity. <http://en.wikipedia.org/wiki/Prandtl–Glauert_singularity>

<comment><USER3> Compare with visible shockwaves from ThrustSSC:

<http://www.andrewgraves.biz/ssc_stuff/images/exCS/Shock.jpg>

<http://www.andrewgraves.biz/ssc_stuff/images/exCS/Waves.jpg>

from <http://www.andrewgraves.biz/ssc_stuff/SSC_pics.htm>

<comment><AUTHOR> I've up-mud both of you, but for some reason you appear to have been down-mud again. No idea if it's real, or just some effect of the voting system, but thanks for your comments. It's interesting to get examples to compare, and the name of the singularity. This is one reason why this is a cool place to participate.

EDIT: Someone down-mud this comment, no doubt because they think it's meta- discussion, or doesn't add value, or whatever. I don't care. I'm still going to thank people for doing good things.

<comment><USER4> What do you think 'mud' is short for?

<comment><AUTHOR> It's the use of an alternative form of regular past tense. Just as "thunk" is a joke past tense of "think".

<http://news.ycombinator.com/item?id=667550>

<http://news.ycombinator.com/item?id=667674></comment></comment></comment></comment></comment></comment>


How Much Worse the Coronavirus Could Get, in Charts - <AUTHOR> https://www.nytimes.com/interactive/2020/03/13/opinion/coronavirus-trump-response.html <comment><USER2> Can't read. Some popup banner.

<comment><USER3> NY Times links are effectively just advertisements for NY Times subscriptions. I'd really like to see HN/reddit/etc ban links from these domains, because there's no meaningful discussion that can be had when the vast majority of users can't even read the content.

</comment></comment><comment><USER4> [https://beta.trimread.com/articles/7585](https://beta.trimread.com/articles/7585)

<comment><USER5> This gets around the adwall, but on my device I don't see any interactive charts!

</comment></comment><comment><USER6> It's hilarious this counts as "news". So the nytimes is in the prediction business? If a youtuber did this, the nytimes would have blasted them as conspiracy theorists and demanded youtube shut them down.

The news industry would be more respected if they actually reported news. Leave the "how much worse", "how much better", "could", "would", "might", etc to others.

<comment><USER7> this is an epidemiological model with sliders. to show people how epidemics work.</comment></comment>


Google Spaces about Computer Science - <AUTHOR> https://egorsmkv.github.io/google-spaces/ <comment><AUTHOR> I also encourage everyone to create their own space (one can only create 100 Spaces) and Pull Requests sent to the repository.

</comment><comment><USER2> Wow that was Quick! I haven't joined yet but is there a public list of all spaces? Can you search by topic (or even hashtag)?

<comment><AUTHOR> Unfortunately no. 99 percent made me. But I deliberately made it to GitHub to others added their own Spaces.</comment></comment>


Microsoft Becomes Linux Foundation Platinum Member - <AUTHOR> https://www.linuxfoundation.org/announcements/microsoft-fortifies-commitment-to-open-source-becomes-linux-foundation-platinum <comment><USER2> Apparently, being a platinum member entails donating $500k [1], so it's not that big a deal for Microsoft ($85B revenue[2]). And as the article states, there has been negativity in the linux community regarding the old arch-enemy joining their ranks. Looking at the new Microsoft however, I think it's fair to assume that the days of "embrace, extend and extinguish"[3] are over and they are genuinely interested in cooperation.

It's an important political gesture that Nadella goes in this direction. Since they also added a linux subsystem into the latest Windows release[4], I get the impression that he wants to leave the cloud to linux and try to position Windows as a user-facing client. This is a difficult decision to make, but it makes sense. Microsoft without Ballmer is seeing its position in the Corporate world as it is and I hope we will continue to see more openness as a result.

[1] [http://www.slashgear.com/hp-pays-500000-for-linux- foundation...](http://www.slashgear.com/hp-pays-500000-for-linux-foundation- platinum-membership-05255636/)

[2] [https://www.microsoft.com/en- us/Investor/earnings/FY-2016-Q4...](https://www.microsoft.com/en- us/Investor/earnings/FY-2016-Q4/press-release-webcast)

[3] [https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish](https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish)

[4] [https://news.ycombinator.com/item?id=12234735](https://news.ycombinator.com/item?id=12234735)

<comment><USER3> Half the HN frontpage right now is MS articles. Seems oddly coincidental.

We can't forget about the bad MS is still doing: forced Win10 upgrades, Win10 spyware, Android patent extortion, FAT/VFAT/exFAT patent suits and licenses, etc.

The developer arm seems to be working hard, which is commendable. But looking at the rest of the org, this just seems like another Embrace round of the EEE cycle.

<comment><USER4> It's not "oddly coincidental", it's Microsoft's developer conference today, which is where the announcement was made. During WWDC and I/O the front page is filled with Apple and Google news too.

<comment><USER5> Comparing to Apple, Microsoft seems to be getting more attention to their news, which is a praiseworthy change.

<comment><USER6> well since steve jobs died there wasn't anything noteworthy. I mean seriously, was there any new device or and WORTHY feature? I can't think of any. And old devices like the mac series or others weren't overhauled with something that made it more interesting. I mean everything since then was the touchbar from mac, which many weren't seeing as _that_ feature, they basically removed more than they added noteworthy stuff. That's why they probably will suffer soon. They need a leader to bring them forward and not a businessman.

</comment></comment></comment></comment></comment><comment><USER7> The new game is to use as much open source as possible to build a closed source ecosystem with vendor lock-in.

Microsoft was late to the game, but we gotta give them props for contributing back something more useful than "open core", platform onboarding or "hire me" piles of code.

</comment><comment><USER8> I guess the other thread was the one that became the dupe:

I'm fairly certain all of 2016 is a mass-hallucination. Or something. In all seriousness though, I don't think this is surprising. Visual Studio on macOS is more surprising to me. Azure runs on Linux and that's a really, really big business for Microsoft. And they've also built a Linux Subsystem into Windows. Rock on Microsoft, rock on.

<comment><USER9> Azure runs on Linux? What? Small portions do, but it's misleading to say it "runs on Linux".

Edit: clarifying

<comment><USER8> Sarcasm? I imagine that they're not emulating the Linux Kernel on Windows... From what I've gathered from job postings and whatnot, their virtualization system is in line with AWS's (Xen) on Linux.

<comment><USER9> The primary backbone of Azure is an OS known as "Red Dog OS". It's based off of Windows, with much of the core kernel tailored by Dave Cutler.

When you're running Linux on Azure, it's via Hyper-V or rather the Azure flavored form of it. Windows is very much the core of Azure.

Azure Cloud Switch does use Linux - on metal I believe so no virtualization.

Edit: a word

<comment><USER8> Ah! Ok, that actually makes a bit more sense... thanks for clarifying! That's actually quite neat then.

<comment><USER10> TBC, parts of Azure are now starting to migrate to pure linux on linux.

<comment><USER11> source?

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> This thread is full of people making the familiar mistake of treating an organization with hundreds of thousands of employees as a single entity with a single mind instead of a vast organization with multiple departments and different teams.

</comment><comment><USER13> So much has changed in 10 years! The old me would never believe how the future me moved more "Micro$oft sucks" to "wow another great product!"

I am happy to use Office in wine, as it gives me a very stable experience, full unicode supports even with my Xorg keymaps.

I use Visual Studio in wine - not as good as Office, but still very good.

I have a Windows phone, a priced relic since Microsoft abandoned them. Rock stable, last for a week in airplane mode.

I have a Windows 10 LTSB in a separate partition. Initially I just wanted to test it out. Now I consider running it in KVM for Visual Studio, in case I want more than what wine can now offer.

Hell, I am considering replacing my Thinkpad by one of Microsoft surfaces. As soon as it runs Linux as well as a Thinkpad, can get 32G of RAM, a user replacable SSD, wifi and lte module, I buy one. Seriously, even if the keyboard is not as good. And given Microsoft new focus on developpers, I wouldn't entirely dismiss the idea of a Surface Developper, bulkier but sturdier and user upgradable.

People say "hell froze over". I don't care. I look forward for more change from Microsoft. Because their tools are innovative again.

<comment><USER14> >I am happy to use Office in wine, //

It'd be great if companies would support this sort of use if they're not going to bother creating native versions.

I used to play games using PlayOnLinux but the company, Origin (IIRC), updated their game manager software _seemingly_ in order to break the Linux compatibility. The games were paid for and worked perfectly well.

Annoying as hell when companies appear to be actively hostile to you buying their product.

</comment></comment><comment><USER15> Another example of how far Microsoft's focus has changed. Rather than focusing on products, they're focused on selling solutions.

<comment><USER16> Aren't all products essentially solutions?

<comment><USER17> Not Microsoft products.

/me ducks.

</comment></comment></comment><comment><USER18> first they mock you, then they fight you, then they coopt you, then they win.

<comment><USER19> Don't forget that we have the _New Microsoft[tm]_! Source: Hacker News.

<comment><USER20> Hacker News is really the site with the least amount of self criticism on the entire Internet.

'dang, go ahead and do you thing.

</comment></comment></comment><comment><USER21> Me from 2001 is pretty blown away.

<comment><USER22> Yeah... the me from that era would _never_ have thought that MS would be where it is today.

<comment><USER23> Me from 2001 is astounded that people keep falling for same lie, year after year.

</comment></comment></comment><comment><USER24> The Linux Foundation troubles me a little. They have vested interest in making sure Linux's copyleft is not enforced. For example, VMWare is part of it, and has used its clout to refuse funding to Software Conservancy, due to the ongoing GPL lawsuit.

I guess the money from the LF is helping pay Linus' paycheque, but it has also become a bit of a lobbying group to steer Linux into more proprietary software.

</comment><comment><USER25> [https://en.wikipedia.org/wiki/Embrace%2C_extend_and_extingui...](https://en.wikipedia.org/wiki/Embrace%2C_extend_and_extinguish)

Let's see how they'll try the next step.

<comment><USER26> I really don't see how that strategy would work with open source projects. Wouldn't most contributions for the "extend" phase be open source?

Once open source, it's much harder to extinguish.

<comment><USER27> Open source means nothing and is same easy to extinguish, it's only more visible when someone is trying to. Microsoft, Google, Apple do open source work for publicity, if you as a single developer want a change in a projects, you submit PR... and wait weeks. First you need to write RFC, at some point RFC will be discussed behind closed doors by corporatisation members, you can have your vote in it on GitHub, but nothing else as we saw once already with MS. All you can do is fix documentation and tests for them, means they get free labour to improve their products, you can have an important repo forked on GitHub.

<comment><USER28> So have you ever contributed to OSS projects by these companies? I ask because what you've described is definitely not the case from what I can see.

</comment></comment></comment></comment><comment><USER29> Hell has frozen over, but that's just my opinion :)

<comment><USER30> Except that Microsoft is still hostile towards Linux with patents at the same time but no one talks about it.

<comment><USER31> Microsoft loves Linux (the kernel), but they hate with passion anything userland that could ever have the dreaded "GNU" or "GPL" letters anywhere mentioned.

<comment><USER32> Isn't WSL Linux userland running on NT Kernel? Just the opposite of what you said?

Sorry if I said something silly :)

<comment><USER33> WSL is an implementation of (some of) the Linux kernel APIs on top of the Windows kernel. The userland that you run in WSL is technically independent of WSL itself, but Microsoft provides direct support for installing Ubuntu there.

</comment></comment></comment></comment></comment><comment><USER34> Everytime I see a big corporation donate money to a software project, I like to imagine what the software project would do with 10 or 1000 times that amount. What would a Billion Dollar funded Linux Foundation do?

<comment><USER35> As the Mythical Man-Mnth says, you can't build software faster by adding more programmers.

So not much, unless the work they have to do is highly parallelizable (i.e. can be broken up), and would truly benefit from more developers.

I can imagine KDE benefiting from this, because KDE is an umbrella organization with hundreds (if not thousands) of projects underneath it.

<comment><USER36> The vast majority of the kernel code is a massive number of drivers and subsystems that can be worked on independendly.

A better funded Linux Foundation could also invest in better tooling (better compilers, better test rigs), and in research on speculative improvements to pretty much every subsystem.

<comment><USER35> Yea, good point.

But on that note, I never understood why they track the drivers in the same git repo as the kernel.

They should just develop a _stable kernel API_ for drivers, and have extract the drivers out and track them separately from kernel development.

<comment><USER37> > But on that note, I never understood why they track the drivers in the same > git repo as the kernel.

Because the advantage of Linux drivers is code sharing, cooperation between different companies include competeting one, hierarchy of maintainers and developers. No driver code can be merged into upstream driver until subsystem maintainer, Linus and planty other developers see it.

So companies that maintain drivers in same subsystem improve and fix each others code. They also can't just merge some mess into upstream and have to follow certain rules that benefit kernel as whole. E.g for instance at least in GPU drivers it's not allowed to add any code upstream if it's only used by proprietary components in userspace.

> They should just develop a stable kernel API for drivers, and have extract > the drivers out and track them separately from kernel development.

[https://www.kernel.org/doc/Documentation/stable_api_nonsense...](https://www.kernel.org/doc/Documentation/stable_api_nonsense.txt)

</comment></comment></comment></comment></comment><comment><USER38> I don't think they are going to support GPLv3, ever.

<comment><USER39> FWIW, the same could be said for the Linux foundation. They're not really pro GPLv3 either. Linux is GPLv2 and will stay that way.

Open Source != Free Software

<comment><USER40> And note that many of the new Linux Foundation projects (kubernetes, runc, etc) are under Apache licenses.

<comment><USER39> Precisely! The Linux Foundation is fundamentally convinced open source creates the best software in the long run and doesn't much care about philosophy or "freedom".

</comment></comment></comment></comment><comment><USER41> Does it mean they'll stop patent aggression against Android now?

</comment><comment><USER42> So a person buying a Windows license is indirectly paying for my Linux usage? Interesting!

<comment><USER43> Microsoft has $85B of revenue[0] and joining as a platinum member costs $500k. Even if Windows licences are the only ways Microsoft makes money (they're not, by a longshot), every copy would only account for 0.000008% of the donation.

[0]: [https://www.microsoft.com/en- us/Investor/earnings/FY-2016-Q4...](https://www.microsoft.com/en- us/Investor/earnings/FY-2016-Q4/press-release-webcast)

<comment><USER42> Right. But you know, it's a nice feeling. Even if it brings 0.000008% of joy. :)

</comment></comment></comment><comment><USER44>
      The company has become an enthusiastic supporter of Linux

Curious to know from any users out there: How well does Mono work, especially on Linux?

<comment><USER45> Mono works really well. But, Mono's not the future. The future is Roslyn, CoreCLR, and CoreFX, basically the compiler, runtime and standard library for .NET applications.

They all work really well on Linux. They're part of the .NET foundation ([https://github.com/dotnet](https://github.com/dotnet)).

</comment></comment><comment><USER46> Microsoft are doing good by supporting Linux and shipping Ubuntu as an option in Windows 10 which is good for developers. In the past Microsoft has released a UNIX based operating system called Xenix and there has also been a subsystem for Unix in previous Windows NT versions.

Windows subsystem for Linux [https://blogs.windows.com/buildingapps/2016/07/22/fun- with-t...](https://blogs.windows.com/buildingapps/2016/07/22/fun-with-the- windows-subsystem-for-linux/tem)

Xenix [https://en.wikipedia.org/wiki/Xenix](https://en.wikipedia.org/wiki/Xenix)

Microsoft Interix, Windows services for Unix historic link [https://en.wikipedia.org/wiki/Interix](https://en.wikipedia.org/wiki/Interix)

<comment><USER47> I think most of us are feeling extremely cautious about the recent Embrace- Extend-Extinguish overdrive.

</comment></comment><comment><USER48> MS is going all Oracle-y on us, they'll probably release a full fledged MS Linux distro soon.

(Social game: what will they call it? I'd say something like Unsinkable Linux ;-)

They should also have their own filesystem - ow, right, NTFS. I was thinking they could take another go at the database FS that stalled Vista a decade ago ...

</comment><comment><USER49> Open source is "Un-American", Linux "a cancer", and should be made illegal. Microsoft in 2001.

[http://www.infoworld.com/article/3042247/open-source- tools/b...](http://www.infoworld.com/article/3042247/open-source-tools/bill- gates-gets-real-about-free-software.html)

[http://www.linuxjournal.com/article/5015](http://www.linuxjournal.com/article/5015)

[https://slashdot.org/story/04/07/11/1714235/gates-open- sourc...](https://slashdot.org/story/04/07/11/1714235/gates-open-source-kills- jobs)

</comment><comment><USER50> Pride gets in the way of many things, especially progress and innovation, in Microsoft's case, it's holding on to the Window's O.S. If I were the new man at Microsoft, I would immediately set course to release two versions of Windows, and let people make the decision: One with the standard Window's filesystem and one built on the Unix/Linux kernel, like Apple has done. And above all lead with design. The possibilities of what they can do at that point would be endless. But you gotta let go of that pride first!!!

</comment><comment><USER51> This. All the Visual Studio stuff (shame, as their tools have long had a good reputation). .NET . Etc.

It's a trap.

Been around long enough to have formed that singular impression of such Microsoft initiatives and to have it confirmed, repeatedly.

They failed in mobile. They are losing mindshare elsewhere.

It's a trap.

I'm not going to try to back up my statement, here and now. Just keep it in mind. The more wary you remain, the quicker you can move away when the noose tightens.

Cheers

<comment><USER52> Yes, it's a trap, but not much different than the traps other companies are attempting to lay for you.

Remember that the majority of people working at Microsoft today probably have little to no memory of the tech world of the early 2000s. They don't seem too much better or worse than others in attempting to shape open-source projects to their benefit - that's something you should always be wary about.

</comment></comment><comment><USER53> Is there a possibility that MS buy Canonical/Ubuntu?

</comment><comment><USER54> but they still getting money for the patents over linux ...

</comment><comment><USER55> embrace && extend && extinguish

</comment><comment><USER56> Embrace(check), extend(check), and extinguish(?)

<comment><USER57> MS employee here - the new Microsoft is: _Enable_ (make sure open source runs well on MS platforms) _Integrate_ (make sure MS platforms work well with open source) _Release_ (release key MS technology into open source) _Participate_ (commit MS engineers to participate in communities)

<comment><USER58> Nice of you to say but what about this:

[https://eugene.kaspersky.com/2016/11/10/thats-it-ive-had- eno...](https://eugene.kaspersky.com/2016/11/10/thats-it-ive-had-enough/)

Obviously Kaspersky isn't open source, but the tiger's stripes certainly haven't changed.

Also, Microsoft bundling Windows 10 upgrade malware into its security update channel has turned me off Microsoft, probably forever. Still don't understand why installing 10 after being told not to isn't a CFAA violation.

<comment><USER59> Kaspersky and all of the AV vendors deserve to get wiped out.

<comment><USER58> I'd like to know why you think that, and also if you think that W10's unstoppable updates is the right way.

<comment><USER60> Not the grandparent, but I think the issue is that people want clients to have an uptime that is comparable to a server.

Windows Server has controllable updates and reboots. Win 10 - is a client OS and wasn't designed with the same level of hardening and shouldn't have the same uptime requirements.

The challenge is convincing the general public of this; people want a Ford Fiesta with the speed and features of a Audi R8, meaning they want the best of all worlds at reasonable cost and no penalties.

By forcing updates on clients, MS has eliminated a generation of machines being owned by various botnets. They've also made it relatively cheap to get a server in Azure should you have a temporary need for uptime (like a research project for a week).

That aside, some portions of those updates are bad (like removing functionality, pushing telemetry, etc), but the overall strategy of auto updating isn't a bad idea if they can convince people to adjust to it and use Server when they need stability.

</comment></comment></comment></comment></comment></comment><comment><USER17> First they ignore you, then they laugh at you, then they fight you, then you win.

Still, it'll be a while before they are worth our trust. They fought dirty and hard.</comment>


Continued Funding for Minix (2.5M Euro) - <AUTHOR> http://www.heise.de/english/newsticker/news/137015

<comment><USER2> I was going to be snooty about this, but on reflection the existence of Minix is a good thing for mission-critical applications like medical, military or scientific computing (eg satellites). Likely, the performance advantages of Linux's monolithic kernel have been obviated by the advances in hardware performance over the years.

The maintainers don't sell themselves very well though. It does give off the flavor of ivory tower academia despite the apparent concrete benefits. Tannenbaum's public comments that he doesn't know who is using Minix (and by implication, doesn't care) isn't a very good advert for it.

Do HN readers think there's a demand for apparently-bulletproof *nix, or are other OS offerings already good enough for anything that isn't classified?

<comment><USER3> Is Minix actually used for embedded stuff like that? I thought it was mostly used for teaching OS stuff.

It _does_ have very clear, easy to read code. I once needed a floppy driver for the eCos operating system, and Minix's was way easier to read than Linux & the BSDs', probably because it doesn't try and do everything for everyone.

<comment><USER2> I don't know. It just seems like it would be a natural candidate if the claims about the size and fault-tolerance of the kernel are true (as opposed to reinventing the wheel and writing everything from scratch).</comment></comment></comment>


Detailed VPN Comparison Chart - <AUTHOR> https://thatoneprivacysite.net/vpn-comparison-chart/ <comment><USER2> And a few DIY VPN options (open source ansible etc. scripts) that have been features on HN recently (in order of popularity)

[https://github.com/jlund/streisand](https://github.com/jlund/streisand) (6000+ stars)

[https://github.com/sovereign/sovereign](https://github.com/sovereign/sovereign) (6000+ stars)

[https://github.com/Nyr/openvpn-install](https://github.com/Nyr/openvpn- install) (3000+ stars)

[https://github.com/ttlequals0/autovpn](https://github.com/ttlequals0/autovpn) (1400+ stars)

[https://github.com/trailofbits/algo](https://github.com/trailofbits/algo) (1100+ stars)

[https://github.com/robbintt/popup-openvpn](https://github.com/robbintt/popup- openvpn) (700+ stars)

<comment><USER3> Has anyone setup OpenVPN via Docker? I've seen some of the images, just wondering if anyone has actually got it working.

<comment><USER4> Using openvpn with deluge in UnRaid as a container - runs flawlessly, and not leaking (re: data out of the VPN) as verified by firewall logs for 3 months now.

<comment><USER3> Nice, which docker image?

<comment><USER4> I believe this is what you were looking for:

binhex/arch-delugevpn

If you have trouble reach out again.

</comment></comment></comment></comment></comment><comment><USER5> If I was the NSA, I'd certainly be looking to launch a VPN company or two - maybe even subsidising their offerings, to get them to the top of the performance and value for money charts.

After all, getting users to voluntarily direct their traffic through your network would be much easier than installing snooping hardware at every ISP, backdooring hardware in transit or snooping on undersea cables.

<comment><USER6> _> If I was the NSA, I'd certainly be looking to launch a VPN company or two_

not worth the trouble when you can just compel existing VPN companies to send all traffic to you.

<comment><USER7> In foreign jurisdictions?

</comment></comment></comment><comment><USER8> Genuine question: why's OpenVPN so popular over L2TP/IPsec? Configuration on the server side is maybe a little more complicated, but configuration on the client side is super simple, as all major OS, mobile or otherwise, have support built-in.

I've read arguments that firewalls tend to block IPsec packets, but there's also UDP encapsulation. And IME, I've never had connectivity issues, from multiple random coffee shop / airport WiFi, in multiple countries. I suspect it's because Cisco's VPN product used to (still?) uses IPsec, just with proprietary authentication schemes, and a lot of businesses use it, so most firewalls are configured to let it through.

<comment><USER9> at the expense of latency and performance, openvpn can run in purely TCP mode which is more likely to survive shitty wifi connections and aggressive/stupid captive portal wifi and firewalls/NATs like you might find in an airport. I have an openvpn server running its public interface on port 443 in tcp mode which is frequently accessible when ipsec stuff is blocked.

openvpn can also be used with obfsproxy

<comment><USER8> > [...] openvpn can run in purely TCP mode which is more likely to survive > shitty wifi connections and aggressive/stupid captive portal wifi and > firewalls/NATs like you might find in an airport [...]

That's contrary to my own experience, hence my original post. Obviously I've not been to every airport, but I've been to a handful of different ones over the last decade, and I've _never_ had problems with IPsec. And IME airport / coffee shop / hotel WiFi are usually not the ones most locked down, but corporate guest WiFi. The last one I used blocked everything except TCP port 80, 443...and UDP port 500, 1723, and 4500.

I used to run OpenVPN to my home network, since that's the general recommendation, and Cisco VPN to the school, and later work, networks, and I've had more connectivity issues with OpenVPN. Switching to one of ports 53, 80, or 443 generally works, but Cisco VPN always "just works"...connectivity wise anyway. The client software broke like every other minor OS update. I even switched to PPTP for a while, because it'd also always worked, plus support was built into the OS. And that's what drew my attention to L2TP/IPsec.

Finally, when Tunnelblick stopped working after one of the OS X major upgrade, I looked into setting up L2TP/IPsec, and have been using it since.

Maybe IPsec is more often blocked in Europe / Asia / Africa?

</comment></comment></comment><comment><USER10> That site should have a top 3 pick, tailored for paranoia, torrenting and normal unsecured wifi hotspot hardening.

Personally: I use AirVPN because to me it matters the client is open source. For all others, I guess PIA (Private Internet Access) is fine.

<comment><USER11> > I use AirVPN because to me it matters the client is open source.

Don't most VPN providers offer OpenVPN as an option? Private Internet Access does. I always assumed that the client offered is to have an easy setup method for users who don't know how to configure a normal VPN client safely.

<comment><USER12> It's been a while but the last time I used PIA I noticed that their configurations were woefully insecure (BF-CBC Ciphers, no tls-auth, pre-shared keys instead of certificates). This was maybe a couple of years ago.

Has that changed recently?

<comment><USER13> Yes, they recently updated their OpenVPN configuration and now have a 'strong' OpenVPN config option.

>All our servers are now running OpenVPN on UDP port 1197 with our 4096bit RSA server certificate, 4096bit Diffie-Helman key exchange, AES-256-CBC, SHA256 and TLS v1.0-1.2 support.

[https://www.privateinternetaccess.com/forum/discussion/20093...](https://www.privateinternetaccess.com/forum/discussion/20093/using- stock-openvpn-with-strong-encryption-settings)

</comment></comment></comment></comment><comment><USER14> Think its suffering from the HN effect - out of resources for me.

<comment><USER15> Internet hug of death

</comment></comment><comment><USER16> I've seen lots of VPN comparisons that rate VPN providers on what they do and do not log. But who really verifies this? What's to stop VPN provider X from claiming "We don't log anything", while simultaneously streaming a real-time log to any government agency that asks for it?

<comment><USER13> Definitely a valid point. A recent court case involving VPN provider Private Internet Access seemed to back up their 'no logs' policy.

>"A subpoena was sent to London Trust Media and the only information they could provide is that the cluster of IP addresses being used was from the east coast of the United States," the FBI's complaint reads.[1]

Unfortunately, waiting for a court case involving your VPN provider isn't a great way to determine what they log.

[1] [https://torrentfreak.com/vpn-providers-no-logging-claims- tes...](https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in- fbi-case-160312/)

</comment></comment><comment><USER17> Error 508. Resource Limit Is Reached

</comment><comment><USER18> How much profit does a VPN operator make? Since running my own box on DigitalOcean costs as much as a VPN ($5), at <10% traffic utilisation.

<comment><USER19> I also run my VPN on a cheap VPS. Dedicated VPN companies can easily come under attack/scrutiny, or could have temptations of selling user data if subscribers fall, but I doubt anyone is monitoring individual, ephemeral DO droplets/AWS instances.

<comment><USER20> If you're the only user of your VPN, doesn't that make it pretty easy to trace your usage back to you? I would have thought that using a VPN Provider would assist privacy by making it hard to figure out which client initiated the any request coming out of the VPN node...

<comment><USER19> A local adversary (in your network) can know that you're establishing a connection to a certain IP in another country, but they cannot know what that particular machine is accessing in turn. [This is my threat model, I use this in public WiFi].

And a remote adversary (who sees your VPS IP) cannot know who is, in turn, connected to that VPS, unless they can extract that information from the VPS provider via court order or hacking. [This is of more concern if you plan to do illegal things or are a dissident].

As always, you must model your threat scenario and proceed accordingly.

<comment><USER20> That's a fair analysis. I guess I was imagining something like a government. For example, the UK one would now be able to see that you're establishing a connection to your VPS IP. However, I don't know if they would then be able to see the connections from there to various hosts back in the UK.

</comment></comment></comment></comment></comment><comment> jeppesen-io Surprised not see Pritunl on the list, or here. Its such a nice product.

[https://pritunl.com/](https://pritunl.com/)

</comment><comment><USER21> I use ExpressVPN mainly for Netflix, but most of their servers are banned and it's quite expensive. What VPN do you use for this purpose?

<comment><USER11> That's pointless. Netflix bans each and every VPN IP address they can get their hands on — they are quite thorough. You might as well get a cheaper VPN subscription with a VPN provider who condones torrenting and access the shows you are missing that way.

<comment><USER22> Well then they haven't got every vpn ip because expressvpn has been working with netflix for almost 6 months straight in my experience.

</comment></comment></comment><comment><USER23> I just get an AJAX error when trying to filter the list.

</comment><comment><USER24> [http://vpnspeedtest.org/](http://vpnspeedtest.org/) tests over 20 VPN services to find the maximum speed of each VPN from 8 locations around the world.

ThatOnePrivacyGuy should use their open source speed test tool instead as the tests are verifiable (unlike his tests from a single location which nobody can reproduce).

<comment><USER25> I don't see a "disclaimer/disclosure" (kinda standard practice around here) so I assume your username is entirely coincidental?

<comment><USER26> The 'name and the link are less than a centimeter apart on one's screen. That seems enough to clue in most readers?

<comment><USER27> Yeah, it's not so subtle. But then again:

> ThatOnePrivacyGuy should use _their_ open source speed test tool instead

Using _their_ instead of _our_ makes it sound like there is no affiliation.

</comment></comment></comment></comment><comment><USER28> This is terrible. Whoever "That One Privacy Guy" is, should really consider not being a dick and stop pushing VPNs as a privacy tool.

And yes, you're a dick if you even kind-of imply that VPNs might be good for privacy without immediately providing a strong disclaimer: if it matters, they aren't.

Edit: Oh wow, it's worse than I expected. Check out [https://thatoneprivacysite.net/choosing-the-best-vpn-for- you...](https://thatoneprivacysite.net/choosing-the-best-vpn-for-you/)

The vast majority of the recommendations here have absolutely no connection with reality.

This entire website is bullshit, here's a few quick quotes.

>a. More on Trust

>As a lawyer represents your legal interests, a VPN service (among others) represents your privacy interests.

>c. Jurisdiction >In the last few years, certain revelations have been made manifest regarding the mass surveillance programs of various countries around the globe. These countries are known as the five, nine, and fourteen eyes. These countries not only spy on their own citizens where they can get away with it, but they spy on each others, and swap notes to bypass governmental restrictions on power. If a service, or the people who run a service is based in one of these countries, it's not unreasonable to expect that they may be susceptible to unlawful searches and compromises made in the name of national security

Suggesting that NSA & Co. don't spy outside of FVEY (or fourteen eyes if that's what you prefer) countries is utterly ridiculous at it's face and just makes it look like the author hasn't studied this stuff at all.

Instead of blogging about mass surveillance and unlawful searches, maybe focus on the more realistic issues like search and wiretap warrants which are ridiculously easy to get in some countries?

<comment><USER29> I can see you complaining, very strongly, but wouldn't it be better provide some kind of constructive feedback.

<comment><USER28> I guess you replied to the wrong post, I made a rather explicit recommendation.

>you're a dick if you even kind-of imply that VPNs might be good for privacy without immediately providing a strong disclaimer: if it matters, they aren't.

This website reads like it's written by an amateur from some torrenting subreddit, there's not much constructive feedback to be given here besides "do some actual research and do it all again"

<comment><USER29> Have you done some research? Can you tell us what you recommend?

<comment><USER28> >Have you done some research?

Yes.

>Can you tell us what you recommend?

For privacy? Tor.</comment></comment></comment></comment></comment>


Ask HN: Do you still pay with Paypal? - <AUTHOR> Unfortunately Stripe and Braintree isn't available where I live (South Africa), making accepting payments (subscriptions) in an international market a bit more difficult.
That basically leaves me with 2/3 options.
Use one of the few local Payment processor - but a huge drawback is that I cannot charge in foreign currencies (USD/GBP/EUR, etc). Obviously for a little 'startup', quoting in a relatively unknown currency (South African Rand) will highly impact conversions, so not an option for me.
There's Paddle. Which is super nice, but integrating it with something like React appears to be a hack-ish mess as it requires jQuery, so not ideal. Also their fees are almost double Stripe.
I think I can use PayPal.... I've heard some horror stories though, but willing to give it a shot.
Question is, do people still use Paypal?
Do you lose conversions when it comes to the redirecting the user to Paypal's credit card / login page?
Cheers <comment><USER2> We had been using different providers but sticked with Paddle. It's not more expensive if you think about benefits you get.

1) We started with Braintree. We had to implement their SDK, and then we were charging PayPal and Credit Cards. Each transaction had to be accounted by us, we had to specify how much VAT. In Europe it's tricky because you have to charge VAT-MOSS based on which country customer is from (eg. 20% for UK, 23% for Poland). So accounting was a nightmare. 2) Then we switched to Stripe (new sdk to implement) and PayPal separatelly (another integration to support). Same crap as with Braintree. We only switched because Braintree kicked us out. A lot of developer work wasted to support paypal separatelly etc. Even more work for fixing PayPal's constant CSV changes and API changes to integrate with accounting. Then there was still some issue which I had to manually fix in accounting. Again: nightmare.

3) Then comes our saviour Paddle. One SDK to implement (so like implementing only Stripe) but you get all different features, like nationalized prices, one big invoice at the end of the month with VAT calculated by them, abandon baskets recovery etc and much more.

5% but hours saved in productivity and accouning. It was and still is worth it and I don't want to ever switch back.

Thanks to Paddle for keeping my mind sane :)

PS. If anyone is interested we use it at FreeYourMusic.com

<comment><USER3> For similar reasons, I use Paddle to process subscription payments for a paid Chrome extension ([https://www.checkbot.io/](https://www.checkbot.io/)).

Fastspring and Gumroad deal with VAT as well. Fastspring is more expensive than Paddle but has more features. Gumroad is cheaper than Paddle but doesn't integrate well with SaaS products last time I checked.

Doing VAT processing yourself sounds like a nightmare.

</comment></comment><comment><USER4> I'll definitely use PayPal instead of submitting my details directly to a site for purchase of goods or services.

I might even go so far as to not purchase from a site if I'm not confident with assumptions of how their infrastructure is and they don't offer PayPal.

</comment><comment><USER5> I avoid it like the plague. Only using it temporarily now because it's the only way to sell on eBay but deleting it as soon as my stuff is sold.

</comment><comment><USER6> Also always choose PayPal as every time I want to pay for something online my Belgian bank forces me to use what looks like a small physical calculator where I have to insert my credit card and punch in 3 sets of 4 to 6 digits each and then get a confirmation code for me to use on an online form.

</comment><comment><USER7> I have used PayPal for a few years, mainly because paying with it was more convenient than using directly my credit card, even if the PayPal exchange rates were disadvantageous.

For a few years, PayPal worked fine and I was a satisfied customer. Than it had some kind of breach of security. The credit card known to PayPal was charged with a large number of small fraudulent transactions.

I did not loose any money, because within hours my bank alerted me about unusual activity and I blocked the card and refused the transactions.

Then I got a new credit card. Soon after making another payment through PayPal, similar fraudulent charges appeared again.

After obtaining and then cancelling 3 or 4 new credit cards, the causal relationship between making a payment through PayPal and a third party receiving my credit card details became obvious.

I have stopped making payments through PayPal and I have never had any credit card fraud problems again.

I have no idea about how my PayPal account was accessed by whoever was behind this. The only thing that I am certain about, is that it was not possible to guess my PayPal password, which was a long string of random characters and which had never been used for anything else except for logging into that PayPal account. Therefore I believe that it was some sort of inside job within PayPal.

Because I have never used again PayPal during the last 3 years, I do not know if there was any improvement in their security procedures.

<comment><USER8> How many times over the years did you change your PayPal password?

</comment></comment><comment><USER9> I would recommend setting up a subsidiary with Stripe Atlas[1] which would allow you to set up a U.S. bank account, and use Stripe to charge your customers. You don't need to be a U.S. resident or citizen, or have any connection to the U.S. in order to do this.[2]

[1] [https://stripe.com/atlas](https://stripe.com/atlas)

[2] [https://stripe.com/atlas/guides/incorporation#who-can- incorp...](https://stripe.com/atlas/guides/incorporation#who-can-incorporate- companies)

<comment><AUTHOR> Definitely seems worth it in the long run... but just don't see myself forking out a couple hundred USD when I just wanna validate a little app I built.

</comment></comment><comment><USER10> I avoid PayPal totally for any online purchase unless it's the only option. I learned it the hard way.

Once I paid $5 to buy the trial version of some software tool. Since I didn't know the seller, I used PayPal thinking it would offer more protection. After one week I was charged another $100 for the full license. I contacted the seller asking for a refund, but they declined it on the grounds of me having already accepted "recurring charges" on my PayPal transaction. Apparently I had but it was kind of hidden on the transaction and I hadn't paid enough attention. I contacted PayPal but they refused to help either. Finally I reached the credit card service attached to my PayPal to initiate a charge back. But at the same time I informed the seller about my intent and they refunded me instantly.

So long story short; don't use PayPal and if you have to, use only reputable credit cards. Never use your debit card on PayPal. PayPal doesn't protect you any more than your credit card does.

<comment><USER11> Your case wasn't a security issue though, right?! Also, I might be wrong but I don't think that PayPal's offering is of a platform that makes it easier for you to cancel transactions.

<comment><USER10> You're right! I was being careless and stupid. I was just surprised how easy it was to miss the recurring charges agreement. That experience made me wonder what value PayPal actually offers to buyers (I don't know much about the sellers' side). If people are worried about fraud, their credit card provides more protection that PayPal.

</comment></comment></comment><comment><USER12> A lot of power users are a bit wary of PayPal but for much of the average customer it's still a great option so you will get a request for PayPal.

I haven't had the opportunity for myself yet but I can suggest you to look in to Mollie[1]. I think that's the processor I will use for my next project.

[1][https://www.mollie.com](https://www.mollie.com)

</comment><comment><USER13> When it's available, yes. It's especially helpful when living in the UK to be able to pay with my US bank account.

Also, from the perspective of someone who ran a successful SaaS for a couple years, I _highly_ recommend PayPal. About 50% of my payments were via PayPal, especially for international customers.

</comment><comment><USER14> I try to pay with Paypal wherever i can.

</comment><comment><USER15> I use PayPal often, especially when I need to subscribe to a service on the internet that I don't fully trust with my credit card information. PayPal is a great buffer against identity theft.

</comment><comment><USER16> All the time. It's default on eBay. I can pay with my credit card, without having to give my card details to anyone but PayPal. Also, I can pay from my bank account directly. I also buy things from people on different forums, and using PayPal gives me a sense of trust. I can use F&F if I know the seller and save the fees. Chase runs cash back promotions on PayPal from time to time as well.

At work we even run PayFlow for credit card processing, which is a PayPal company.

</comment><comment><USER17> I prefer to use paypal if a website offers it so that I don't give my card details to a random website that may steal my details.

</comment><comment><USER18> I never had issues with Paypal and in general people do not complain about stuff that works. I always only use Paypal since it is available everywhere, convenient and i trust it more than random websellers with my debit card details (i do not use credit cards as i prefer to either have the money to buy something or not buy it at all).

</comment><comment><USER19> I still use PayPal frequently because it is more convenient for my client to pay me in USD. And since the banks in my country have poor online transactions implementation, PayPal can really help. But take note,

PayPal will hold your amount for months if you are new to them, because you need "cred" to be able to use their service.

</comment><comment><USER20> I'm happy to use PayPal as a customer. You can checkout without signing up, which I sometimes do even though I have an account. I don't think it's a problem. As a seller you might have issues with limits or funds being blocked if you make a lot of money.

</comment><comment><USER21> Well, I have been using Paypal gateway for the last 2 - 3 years and never faced any issue.

Especially in India, the process of making foreign payments is very lengthy and if I make payment through credit card, their charges are very high.

I find paypal is a much better option for both buyers and sellers.

Thanks..

</comment><comment><USER22> Yes, all the time. PayPal (and their subsidiary, Venmo) provide the most convenient ways to pay someone online who doesn't have a merchant account. That includes a lot of smaller vendors that I deal with on a regular basis.

</comment><comment><USER23> I use SOFORT or Giropay where available, it cuts out the middleman between bank and merchant. I also prefer Stripe or my prepaid Credit Card over Paypal. Basically Paypal is my absolute last resort to payment if nothing else works.

</comment><comment><USER24> Imho if you do not offer paypal, quite a few customers will ask for a paypal option.

</comment><comment><USER25> Much of this depends on who your customers are. Are they the average computer user? PayPal is fine, maybe even preferable. Are the hip, ultra-connected and young? It would be worth setting up Stripe Atlas as mentioned.

</comment><comment><USER26> Yes, often. It is more convenient and safer than using credit card directly. When combined with Paypal credit card, you get cashback too, so you are not really losing anything.

</comment><comment><USER27> Seems Flutterwave [1] fits your needs perfectly. Have you tried it?

[1] [https://flutterwave.com/za/](https://flutterwave.com/za/)

<comment><AUTHOR> Thanks will check it out!

</comment></comment><comment><USER28> Horror story time:

[https://minifree.org/paypal/](https://minifree.org/paypal/)

</comment><comment><USER29> When I didn't have a credit card, I used PayPal for all my online payments since I could top it up from my bank account.

</comment><comment><USER30> I use paypal for personal purchases and business invoices. its so easy and painless. been doing so for 12 yrs.

</comment><comment><USER31> My Europe webshop: 1/4 of the customers are paying with paypal

</comment><comment><USER32> I use it whenever I can. It works just fine for me

</comment><comment><USER33> What about Amazon Pay?</comment>


Dear Developer (2008) - <AUTHOR> http://blog.arc90.com/2008/01/dear_developer.php

<comment><USER2> I wish I could empathize with this, but our project managers generally have a ton of business experience and very little, if any, technical experience.</comment>


The Psychology of Pricing: A Gigantic List of Strategies - <AUTHOR> http://www.nickkolenda.com/psychological-pricing-strategies/ <comment><USER2> Nick, this is extremely impressive and I applaud you for putting this together so concisely. Some comments:

1\. Kahneman and Ariely both mention in their writings how their is a difference between free and even just 1 penny. Especially given how popular Freemium is I thought this might be a good topic for you to cover. (Ariely calls this "market norms" vs "social norms")

2\. A common theme here on HN (mainly from people like Patio) is to "charge higher". I couldn't find a place that explicitly mentioned this. Many people perceive higher quality and value of products and services simply because they cost more (regardless of whether they actually do or not)

3\. No mention of Kahneman?!?

This is awesome regardless...saving it and sharing it with some clients.

Feel free to contact me directly if you want me to elaborate on any of this.

<comment><AUTHOR> Thanks so much for the kind words.

1\. I remember reading about that concept in Ariely's book. And I actually considered adding it to the list, but I wasn't sure where to incorporate it.

2\. I think everything boils down to your ability to communicate the value of your offering. People will pay any amount, as long as they perceive to be getting more value from it.

3\. And I can't believe I didn't mention Kahneman anywhere! His research was a large foundation behind a good portion of those techniques.

<comment><USER2> Re: point 1.

Maybe something like:

"Strategy: Giving away for free and then upsell"

Tactic X: "Give away free product or usage of your service" (talk about Ariely's theory of social norms vs market norms)

Tactic Y: "Up-sell free users into a more compelling value proposition" (distinguish between the free product/service and use it as a framing exercise to get your users to pay)

</comment></comment></comment><comment><USER3> I know the arguments behind it, and I know the research shows it brings slightly higher conversions, but I always see charm pricing (e.g. 2.99 vs 3.00) as an insult of sorts to my intelligence.

It's like the company is saying they don't think their customers have the mental capacity to reason that 9.99 is effectively the same price as 10.

It's even doubly meaningless for some products in Australia, because with 5c being the lowest coin in circulation purchasing a single item worth $9.99 will be rounded up to $10 anyway.

<comment><USER4> Can't find it any more, but in some literature I was reading that actually it's not so clear as people think. In some situations -1ct works well in other situations other prices like $10.23 work much better. I don't remember the requirements, though.

In any case it's bad to do something that you haven't tested yourself for your market. So if you sell something try different prices and pricing strategies and see what works best.

What certainly works (but is illegal in many countries, I think) is price tagging something as $20 and offering 50% off.

<comment><USER5> Well, tfa says it pretty clearly: When asked to estimate the real value of TVs priced at 4998.10, 5000 and 5012.56 the middle one was estimated nearly $500 lower than the others.

Same goes for houses and other situations where you're likely to be conceived as having rounded up.

<comment><USER6> Interesting. Wasn't something like this in the undercover used car salesman article a while back as well? You should always come up with weird numbers so the customer doesn't think you made it up.

<comment><USER4> Maybe that's the article, yeah.

</comment></comment></comment></comment></comment><comment><USER7> This is a great How to be Evil manual.

 _" If you decide to downsize your product, you should reduce the size of all three dimensions — height, width, and length — by an equal amount. Consumers are less likely to notice a change in all three dimensions."_

 _" People will perceive your price to be smaller if you display that price in a smaller font."_

 _" People will perceive your price to be lower if it contains fewer syllables."_

<comment><USER8> When I shop, I look at the quantity. If my chocolate has 90 grams instead of 100, I'll immediately put it back and look for another brand - because it's too hard for me to compute how much I would get swindled of.

<comment><USER9> I'm not sure whether it's a practice everywhere, but many shops in NYC also indicate the "per unit" price: per gallon/oz/pieces etc. I use it all the time, and I wish it was mandatory by law for all products.

</comment></comment></comment><comment><USER10> a colleague sent me a link to "tactic 14." after reviewing the citations i'm skeptical of the rest. it appears the author misunderstood some research he cited.

the thesis for tactic 14 is:

> Anchoring not only works for prices, but it also works for any number, > regardless whether that number is a price.

the SSN example demonstrates anchoring based on price (not just any high number). the results of this experiment would have likely been the same if people rolled dice.

and the only experiment [#4 of 5 from adaval and monroe (2002)] which tested "irrelevant dimensions (e.g. weights)" vis-à-vis priming with high/low prices seems to have been poorly designed and produced questionable results. (it should be noted the test methods were also sufficiently different than the UX illustrated in the article.)

so based on the cited research there's nothing that leads me to believe it makes sense to use "any high number" to make my price look better. and if i've understood adaval and monroe (2002) correctly this could actually create a contrast effect (and diminish value perception).

additionally, the suggestion in the article -- "join 2,387 happy customers" \-- could also be an example of social proof, making it difficult to ascertain the cause of behavioral change. (was it any high number, or all those happy customers? or both?)

and lastly/separately, why base pricing strategy on the offline behaviors of a bunch of starving students looking for extra credit? it's 2015. where's the shopping cart data?

<comment><USER11> I skimmed through the article and saw some misunderstandings of research too.

Also another thing that made me raise an eyebrow - "You should avoid charging different prices based on past behavior, demographics, or any other factor besides natural supply and demand."

Clicked the "X" shortly after.

People are eating out of his hand it seems though, so he has that going on for him at least. Many ebooks will be sold.

<comment><USER10> i'm disappointed this made it to the top of the front page yesterday with such little criticism. it feels like something written by an intelligent yet naïve marketing undergrad, not something on which to base pricing strategy.

> "You should avoid charging different prices based on past behavior, > demographics, or any other factor besides natural supply and demand."

wow. what an incredibly stupid recommendation. based on this, every major grocery chain should terminate their loyalty card program, many luxury products/services should never see the light of day, and perhaps the rest of us should just start businesses in perfectly competitive markets with little hope of long-term economic profit.

an aside: searching for "you should avoid" led me to another incredibly naïve recommendation: "you __shouldn't __A /B test your prices."

there are so many ways to test pricing it seems irresponsible to dissuade people from doing this, especially in the context of a gigantic list of pricing strategies.

here are just a few types of tests that come to mind:

* practically any promotional/limited offer pricing scheme could (and probably should) be tested.

* prices of users' shopping cart items saved for later (e.g. amazon) \- can a/b test same items in different users' shopping carts and measure purchase patterns

* grocery coupons for people in different zip codes \- most people don't get coupons for other neighborhoods so they won't see two prices

anyway. rant over :)

<comment><AUTHOR> Thanks for the feedback. I don't mind the criticisms - I think a healthy debate is good. :) However, I just want to clarify something.

> "You should avoid charging different prices based on past behavior, > demographics, or any other factor besides natural supply and demand."

That quote is taken out of context. Obviously you should determine prices based on those factors. That quote was referring to dynamic pricing and how you shouldn't charge different customers different prices based on those factors (e.g., I'll charge $200 to Customer X, but I'll charge $150 to Customer Y because I don't think he'd buy at $200).

<comment><USER11> Price discrimination is like the most wide spread marketing initiative period. Don't worry ebook buyers don't like to read comments, you're safe :)

</comment></comment></comment></comment></comment><comment><USER12> I also find this list fascinating, but I also agree with other commenters that energy is better spent educating people on these psychological pitfalls than to try to take advantage of them. If "do no evil" was ever a motto that a company believed in this would certainly qualify.

<comment><USER13> Agreed, but I wonder how many companies would educate people on these tricks? Would it give any company any advantage or benefit? And what if a large charity uses these tricks in their fund raising schemes? In the UK for example we have a number of street "chuggers" (charity muggers) who use a range of bad tactics on the street and doorstep. Legally they are allowed to get away with their bad behaviour because so many people support the charity in normal ways.

</comment></comment><comment><USER14> Nice write-up, but it hurts to see a generalized warning against dynamic pricing since that's what we provide with our product Baabedo[0] (we don't adjust prices on a per-customer level though).

One point where we observed the exact opposite effect is the splitting of shipping cost. Products with free shipping sell better than with split pricing, but that might be a marketplace specific effect of Amazon.

[0] [https://baabedo.com](https://baabedo.com)

<comment><USER13> I'd say the dynamic pricing should be done transparently, that is, the user should know that the products have been re-priced.

It also depends very much on how you do it.

From the article:

>Is dynamic pricing always bad? Not necessarily. Dynamic pricing can be effective when adjustments are based on supply and demand (e.g., stadiums trying to fill remaining seats).

>Dynamic pricing becomes harmful when adjustments are based on a customer's willingness to pay. You should avoid charging different prices based on past behavior, demographics, or any other factor besides natural supply and demand.

Does badbedo do re-pricing based on the positive or negative factors? From the blog it appears to be choosing optimal prices based on the market, not on the user.

<comment><USER14> > Does badbedo do re-pricing based on the positive or negative factors? From > the blog it appears to be choosing optimal prices based on the market, not > on the user.

Because we are currently only on Amazon we can't do optimization based on the customer because we only get information about him when a sale is made. So at the moment we optimize based on market and past sales history.

I am generally open to the idea of customer based pricing and think that it can be very powerful if done right and be benifical to both the merchant and the customer.

</comment></comment></comment><comment><USER15> That's an interesting read. But it just feels wrong. And the worst is that it works. Could we all just stop buying things based on some annoying pricing tactics and start buying products of companies that we want to support for their good work?

<comment><USER13> Are you are suggesting consuming based on how the company makes you feel? If they make you feel good, or convince you that they are doing good work then should they get more business? Is that rational? What if they are lying or exaggerating? Doesn't a lot of marketing and advertising seek to increase the positiveness of the particular brand? How about morality? How about if a charity uses these tactics in their fund raising? Is a charity raising funds to protect children allowed to use somewhat manipulative psychological pricing strategies to do good?

My point is that it does feel wrong and it does work, but it works because of feelings and psychology. It's fascinating morally. I agree, it's very hard to stop this and start consuming based on rationality.

<comment><USER15> > If they make you feel good, or convince you that they are doing good work > then should they get more business? Is that rational? What if they are lying > or exaggerating?

It is certainly more rational to believe a company should get more business if they can convince you that they're doing good work or better work than others. In order to protect customers from lying or exaggerations, there are (ideally) laws in place that should give you the right to return whatever it is that you bought. The whole discussion loses its purpose if we include fraud or otherwise illegal tactics.

> How about morality? How about if a charity uses these tactics in their fund > raising?

That's a tricky question. I think you could reframe it into: Is it morally justifiable to do bad things in order to ultimately achieve a greater good? Morally, the answer is no since the morality of a society are a set of rules that determine what can be done and can't be done (instances of these rules can be found in the law). So, if something can't be done morally (e.g. child labour), you simply can't do it, whatever the context might be.

On the other hand, pricing tactics are not illegal and there's probably not enough consensus to derive morality from it. However, ethically, from my personal viewpoint, I would argue that it amounts to manipulation and therefore deceits people. Thus, I can not endorse charities that use manipulation, no matter the context. After all, if you want to do something good for people, why would you try to manipulate the ones trying to help you?

<comment><USER13> I like the idea about the charity. In the UK we have what's been called "chuggers" \- charity muggers. Essentially doorstep and high street salesmen, these professionals work on behalf of many well loved charities but they harass and aggressively try to make sales.

Councils and people have tried making laws to enforce against them but they do not succeed because the charities are well liked by the majority of the population. So on the whole the charities do lots of good and people cannot effectively complain against their fund raising tactics. The charities do not suffer as a result of this, and those who support the charities do not suffer.

Is any kind of physical cold calling, being stopped in the street, or at your doorstep manipulative? Does it seek to control people into donating to the charity? Yes. Is it objectively wrong? I don't know, but personally I think it is subjectively. Do some people dislike the behaviour? Yes. Do some people like the charity nonetheless? yes.

</comment></comment></comment></comment><comment><USER16> _I hate SPAM and promise to keep your email safe._

Then why are you asking for my email? I hate it when they ask for your email for something can be provided without. And the worst part is that it doesn't tell you if it's going to send more emails.

<comment><USER17> It doesn't say he won't email you . he is going to email you.

</comment></comment><comment><USER18> This is very high value, well presented, and I went to read some of your other work.

I appreciate your source cites. Well done.

Gold Star for never discounting without a reason. The amount of lost value due to this is insane. It is a constant issue I face. Most of the time, I find improving value perception to be the better, more sustainable answer to sluggish sales.

</comment><comment><USER19> This is a list of tactics, not strategies.

</comment><comment><USER20> Can knowledge of these strategies reduce their effectiveness on the part of the buyer?

For example, even though many items like gas are priced at 2.1999, I calculate it to be $2.20.

<comment><AUTHOR> That's a good question. I think it depends on the pricing technique.

For example, research shows that anchoring effects occur even when people are explicitly warned about anchoring before they make their estimate.

On the other hand, if people are aware of other pricing techniques, then those techniques could backfire in a negative direction. For example, researchers have found a "reverse priming effect." In other words, if people detect some persuasive intent behind the marketer, then those people are more likely to resist that persuasion attempt. So it could make things worse.

<comment><USER21> So it might have negative effect on some people (who feel it as insult on their intelligence), but if twice as many people don't notice it and are positively affected, it's still a net gain.

</comment></comment></comment><comment><USER22> Some of these tactics are contradictory. Tactic 2 says to add cents for a "rational" purchase, i.e. 19.86 verus 19. This contradicts tactic 3 which says to use fewer syllables, i.e. 19 versus 19.86. How do you prioritize these tactics?

<comment><USER23> I think you need to look at it holistically and place yourself in the shoes of your audience. I imagine an example of a "rational" purchase to be something like searching for a good (eg. headphones) on Amazon and comparing prices between brands. A buyer will try to research and justify their purchase, and the cents may help push them over the edge and convince them that they've "done their homework". Meanwhile, an example of the syllable tactic is a restaurant menu. When I order from a menu, I'm time constrained and forced into a decision. I ask myself internally: "Would I get 19 dollar value from this meal?", and if the answer is "Yes", I'll order it.

</comment></comment><comment><USER24> Great list. Minor quibble-- I wish Nick had put the last part first. Pricing effectively is all about successfully communicating value. Your price is limited by your perceived differential value. Once you get that part, the rest of the techniques might be helpful to optimize, but if you start with the optimizations without really understanding how your value compares to your customers' alternatives, you may get a local maximum, but you won't get the best results.

</comment><comment><USER25> I am biased (or the audience of this post, who knows) because neither I am nor a salesman or startups funder (not even american), but I really feels bad about the vendor when noticed that psychological tricks are used to convince me to buy something. Yes, I know that's how world works, but I am more keen to buy when I am sure and here is a room for valuable marketing.

</comment><comment><USER26> It's a really good list, can work as starting point. I advice you to be careful before applying in your business.

Pricing is too important for we stop just with this list. The list just show topics, results and conclusions of experiments, not the psychology experiments made and the reason behind each strategy, so, very easy to be forgotten, or even applied wrongly.

If you want to lean in a way you will never forget, and apply it correctly, you need to read some books about pricing.

Books about pricing on Amazon: [http://www.amazon.com/s/ref=nb_sb_noss?url=search- alias%3Dst...](http://www.amazon.com/s/ref=nb_sb_noss?url=search- alias%3Dstripbooks&field-keywords=pricing&rh=n%3A283155%2Ck%3Apricing)

</comment><comment><USER27> Excellent writeup. Just one point that I disagree on is the Shipping price split up. I tend to look for other sellers when I see one with paid shipping, and tend to favour free shipping sellers more.

\- If you are combining a discount with the product, and mention a shipping charge, the discount registers as a false discount ('He is just shifting costs through shipping split')

\- Maybe it registers as more of mental processing (X$ + Y$ needs more time to process than Z$)

\- Sometimes, it is human nature to be greedy, and look for best value possible. Seeing a shipping cost feels like seller is not 100% working for the customer, or we just become plain greedy, that why should someone else get a part of the price.

Just my 2 cents.

</comment><comment><USER28> Conversion rate of 2 --> 2.39%

Converison rate of 1.99 --> 5.2%

Mind = Blown. I mean, I knew the *.99 affected the consumer perception about the price, but not in such a huge way... Fantastic article (and blog).

PS: The "leaving know" modal is annoying, I was just trying to switch tabs

<comment><USER11> Hey, do you believe everything that you read on the Internet? Because I might have some bad news for you, that will blow your mind too.

<comment><USER28> > do you believe everything that you read on the Internet?

Only when I put my tin foil hat on

</comment></comment></comment><comment><USER29> This list is great. I think it's funny how many of these folks criticize the list. They are probably the same ones who chose to OS their products for them to go off and die on Git rather than actually sell it.

I would add that doing bundles after payment is huge. Once a customer has paid, adding 15% to their bill is a very easy sale. Whether a soft good or in the form of version insurance/download protection. Conceivably, it could be done on Saas too, perhaps to lock in the rate for life with a one-time charge.

Cheers.

<comment><USER30> "...version insurance/download protection."

This set off each and every one of my slimy scumbag _and_ no-good charlatan alarms. Please convince me that this protection is a good that's actually not extortionate and/or doesn't rely on the ignorance of one's customers.

</comment></comment><comment><USER31> A short heads-up: The page seems to freeze IE11 on Win 8.1 - tried 2 times (once with lots of tabs, one in only one tab/instance). IE has to be restarted both times.

(Firefox worked.)

</comment><comment><USER32> This kind of stuff is a strong argument for communism. An immense amount of mental energy was squandered on creating this list (not Nick Kolenda, the people who studied these things). That same energy could have been spent on curing any number of psychological ailments, but instead it was spent on getting people to pay more for less. It's interesting, but as far as I'm concerned the energy was wasted.

<comment><USER33> Translated: "That same energy could have been spent on something I care about and not what the author cares about."

Which kind of explains why communism always leads to tyranny: it is based on the essentially tyrannical assumption that communists alone have the knowledge to decide how _everyone else_ should be spending thier time, and the moral authority to impose that judgement on others by force.

The problem is that no one has ever found a way of granting such power of central decision making in such a way that either:

a) central planners have access to the information and computing power distributed in the market such that they can make well-judged decisions even by the theoretically pure criteria they claim to be using (that is, communism is inefficient)

b) central planners have no incentive not to make decisions that serve their own interests to the detriment of all others (that is, communism is corrupt).

Given that theses results are incredibly robust and widely known, it is weird that anyone would suggest communism is an interesting alternative to anything. Reform capitalism all you want, but why bring up the political equivalent of a perpetual motion machine as the solution?

<comment><USER34> Just curious, but does communism by necessity or definition require central planning? Is a distributed power model not possible, aside from the fact that it hasn't been done?

I'm genuinely curious, as I've never studied political systems in any depth.

<comment><USER32> It doesn't: in fact, I think central planning is generally what breaks communism.

Kibbutzes and communes generally are communist but work without central planning

</comment></comment></comment></comment><comment><USER35> Pricing is a very inexact science and this list is quite helpful to educate startups. Thanks for writing this.

One of my favourite articles on this is [http://www.joelonsoftware.com/articles/CamelsandRubberDuckie...](http://www.joelonsoftware.com/articles/CamelsandRubberDuckies.html)

</comment><comment><USER36> I was hoping to see a list based on how the price of a product better communicates a product's value. It's sad to me that there is so much energy focused on the manipulation of the buyer as the goal.

Frankly, I consider the aggressive use of these tactics to be a sign that the company is manipulative and untrustworthy.

</comment><comment><USER37> Now I feel like I'm ready to go make and sell some "As Seen On TV" product.</comment>