The curious economics of being ripped off on holiday - <AUTHOR> http://timharford.com/2019/09/the-curious-economics-of-being-ripped-off-on-holiday/ <comment><USER3> I've long been thinking about this topic. I sometimes call it the "Grief economy" \-- The entity which can suffer the most grief "wins" . For example, calling Comcast to cancel. The company is paying pennies per hour to have you on hold. But its costing you your real time. Therefore comcast can easily suffer more in the process and ultimately could just wait you out...

Another example is the idea that some people get a better price because they jumped through arbitrary and non-cost affecting hoops. Things like coupon codes or buying on an arbitrary sale day.

The best customer is one that comes in and says "I want this item, I will pay a reasonable price right now and walk out a happy customer"... Instead we give the best price to those who waste sales people's time with negotiations and give the worst prices to those who dont first put in a bunch of work extract the information about the right price. We are increasing the total cost of our products by making the purchase filled with uncertainty (am I getting a good price?) and external costs (I searched 2 hours for a $5 coupon) .

I would propose this. If you're going to give a customer $5 off then give them all $5 off. If you cant give them all $5 off, then give none (maybe give them all $1 off?).

<comment><USER4> I once sold a car to a man for $500 _more_ than my initial asking price because he made me mad with ridiculous haggling.

I thought it would make him just go away. He produced the money instantly. I've always wondered about that...

<comment><USER5> Any one know what happened to Saturn's fixed price cars idea? I know the brand is gone, but not sure if its troubles had anything to do with fixed prices.

<comment><USER3> Lots of used car brands doing that now. "No Haggle Pricing"

I have noticed their prices are consistently lower than the asking price at high touch dealerships. Especially when you remove hidden feels like "Doc fee" .

I will likely buy from a place with a fair advertised price sooner than walking in at an advertised price of 125% aiming to negotiate it down to 95%.

<comment><USER6> You can also outsource it for new cars, e.g. Unhaggle.com

</comment></comment></comment></comment></comment><comment><USER7> Resort fees are probably one of the best examples of rip-offs that travelers have become accustomed to (but still loathe).

Fortunately, there is a proposal to make it illegal to list prices without including mandatory fees. [1] This would include "resort fees" for hotels and "cleaning fees" for airbnbs or other rentals.

1: [https://www.sfgate.com/travel/article/hotel-resort-fees- Cong...](https://www.sfgate.com/travel/article/hotel-resort-fees-Congress- airbnb-14470281.php)

<comment><USER8> > the legislation would prohibit hotels and other lodging providers from > advertising room rates that do not include all mandatory charges other than > government taxes and fees

so close, but what does "fees" include? If that legislation required them to include tax _then_ I would be excited

</comment></comment><comment><USER9> Remember how credit cards had a bunch of consumer legislation passed a few years ago to protect consumers in the US?

And how airfare comparison sites are required by law to show full prices, not before airport fees etc. the way they did way back when?

It's time for the same kind of legislation to be applied to car rental companies, and enforced on _reservation sites_ so their policies apply worldwide (e.g. when an American books a car to rent from Hertz in Spain, they can't resort to saying it's a foreign subsidiary the law doesn't cover). I'd say they're now the #1 source of sneaky fees and hidden upsells, even worse than banks, cell service providers, and internet providers at this point.

Surprise fees at time of booking should be illegal (e.g. "driving out of country"), and "extra processing" fees (e.g. for a toll with no choice) legislated to a reasonable level (e.g. $5 instead of $50) -- the same way credit card late fees are currently set by law. And toll transponders included in the base price in any country that has any roads where paying in cash is unavailable.

Where's the movement for this? Why aren't we all writing our representatives about this?

<comment><USER10> Why limit it to credit cards, airfare, and car rental? Why shouldn't this apply to every product and service sold, period?

<comment><USER9> Just a question of cost/benefit I think.

In long-established and stable industries like these, regulation can benefit the consumer and we can trust it will still mostly make sense five years from now.

But when industries are evolving quickly, nobody knows which regulations will actually create benefit or harm to consumers (law of unintended consequences) and by the time they're written they might already be out of date.

<comment><USER11> I agree with your principle, but I don't think transparent pricing is an item that should fall under that umbrella. It's just basic honesty.

</comment></comment></comment></comment><comment><USER12> These types of things used to infuriate me. To stop them from ruining my mood on vacations I just account for them as "various other charges". It is sort of like tipping now.

For example, When you book a cruise, the price they give you doesn't bring up the fact that the cruise line also expects you to pay the wages for the wait staff and room stewards. If you bring a family of four (the charge is per person) on a 10+ night cruise (the charge is per night), that charge adds up quickly. Something like $15 charge * 4 people * 14 nights = $840 in charges. That can be a significant percentage of the cost of your entire cruise.

Yes, those in the know, realize that they can change the amount that you get charged by going to guest services - but now if you do adjust those fees... the Cruise line has effectively shifted the guilt of shafting these unfortunate and hard working souls on to you. Hope you sleep well at night. Ugh..

Now when I see these types of charges I just shake my head, sigh and move on. I just account for some percentage of unexpected charges such as these when I visit tourist hotspots - Resort fees, Cleaning Fees, Bag check fee, City fees, the list goes on and on and on. It's not right... but the way I see it I can either fret over all these fees, or just accept that they will be there if I travel to tourist hot spots. I don't really know of a solution.

<comment><USER13> > Yes, those in the know, realize that they can change the amount that you get > charged by going to guest services - but now if you do adjust those fees... > the Cruise line has effectively shifted the guilt of shafting these > unfortunate and hard working souls on to you.

Do the staff see any difference anyway? It's not like they get any more money than minimum, and the cruise company is probably pocketing that "wage".

Just like that one asshole delivery company that pockets the "tips" you can opt to give on their app.

</comment></comment><comment><USER14> T-Mobile's taxes & fees included pricing is the #1 reason I switched to them from AT&T.

Amazon has items for less than $10, but most items with a price between $0.01-$9.99 have to sell for $10.00 for their free shipping economics to work. That's notwithstanding the fee that your license to buy, i.e. Prime, cost you.

In San Francisco, if you sit down at a restaurant, take the written prices on the menu and multiply them by 1.5 to get what you'll actually be paying. I don't think it's that bad in Los Angeles.

Further, in San Francisco, if you sign up for $40/mo fiber Internet, it's really $63.50. Somehow Sonic managed to break past 1.5.

The takeaway is there is no hard and fast rule about transparency in pricing. It's all psychological.

<comment><USER15> > In San Francisco, if you sit down at a restaurant, take the written prices > on the menu and multiply them by 1.5 to get what you'll actually be paying.

Is this anything other than taxes and gratuity (which, technically, you can give 0% for)? I'm trying to understand how even with 20% gratuity and SF's 8.5% tax, how you could get anywhere close to 1.5.

> Amazon has items for less than $10, but most items with a price between > $0.01-$9.99 have to sell for $10.00 for their free shipping economics to > work. That's notwithstanding the fee that your license to buy, i.e. Prime, > cost you.

Amazon actually now will give you a longer ETA on cheap items to make it more affordable for them.

<comment><USER16> SF has a half dozen extra taxes that aren't listed on menus. It's not quite 1.5x bad but they aren't too far off.

</comment></comment></comment><comment><USER17> It's not "on holiday", but the one that always bugs me is inactive account fees from banks. Is my account _increasing_ their expenses by being inactive? No, it's not. If anything, it's _decreasing_ them. So why an inactive account fee? The most charitable interpretation I can give is "since you're not giving us a chance to make money on other fees, we'll make money this way". The worst interpretation is "since you're probably not paying much attention to this account, we're probably safe to rip you off".

<comment><USER18> There are non-trivial compliance costs with maintaining accounts, an inactive account can absolutely be a cost for a financial institution. Not to mention that the bank makes a spread on deposits, so an inactive account is generating compliance costs + not generating any revenue (not necessarily the fees).

<comment><USER17> > There are non-trivial compliance costs with maintaining accounts, an > inactive account can absolutely be a cost for a financial institution.

Sure. But in terms of compliance costs, an active account costs just as much, and perhaps more (if there are compliance costs per transaction, not just per account).

> Not to mention that the bank makes a spread on deposits

They make a spread on money left in the account. But I can leave money in an inactive account, too, and they make just as much money on that.

<comment><USER19> I have not heard of inactive account fees on accounts with a significant amount held in them. Typically, they charge you for keeping too little in there, sometimes regardless of activity.

Edit:

I did a little research. Bank of America has no dormant account fee that I can find. SunTrust does[1]... but only for Florida accounts, for some unknown reason. This may be a jurisdictional thing.

[1] [https://www.suntrust.com/content/dam/suntrust/us/en/personal...](https://www.suntrust.com/content/dam/suntrust/us/en/personal- banking/2019/documents/fs-retail-english.pdf) (page 6)

</comment></comment></comment></comment><comment><USER20> These scams work because once you have made a reservation online, and have likely made other plans that depend on it, the service is now more valuable than what you agreed to pay for it.

Thing is, nobody has agreed to anything yet, so you have just signalled your willingness to commit to that anchor price when you show up, now at a disadvantage because you have no other plan or way to get to a competitor, and they can pile stuff on until your complaining causes them opportunity cost against screwing other people.

Making a decision takes effort and energy, meaning once you have done it, you have less if it to argue. Pretty much every online price for holiday or services I have seen has a %33 markup of "fees," "insurance," "deposits," above the sticker price.

When someone renegs on a deal or tries to add "what about this one last thing," once you've committed, leave.

</comment><comment><USER21> My experience with this was trying to get my dad, who basically doesn't use his phone, to a cheaper phone plan. He was on Verizon and paying $60 a month but usually keeps his phone off. He didn't want to move to a different provider, so I looked at what cheaper options Verizon had and they offer a $35/month "Small" plan (this plan still is listed on their plans page but trying to "get started" with it sends you to a page to purchase a smartphone). We went in to the store and said we'd like to switch him to the small plan. She says, oh you're already on the small plan. But then why are we paying $60 a month? Oh, that's the $20/month line access fee, plus taxes, 911 fees, etc. But what the hell is a line access fee and how is that not just what the $35/month would be for? The sad thing is I wouldn't have even blinked if it had been just a few dollars a month even though that shouldn't be OK either.

I later got him to switch to PagePlus for under $30/month, but only after his phone broke. The line access fee is, admittedly, marked in small text beneath the actual price on their current website.

<comment><USER22> Is a phone plan even necessary at this level of usage?

In much of the world, I'd just use a pay-as-you-call SIM, probably with it set to automatically top-up. The price of calls varies widely, I have one aimed at immigrants which charges €0.005/minute for some _international_ calls but is expensive for local calls, but it's appropriate for "emergency" phone use.

</comment></comment><comment><USER7> I recently booked a flight on Alaska Airlines that turned out to be their version of United's "basic economy". But somehow Alaska managed to avoid having an asterisk next to their flight listing in Google Flights (possibly because you can bring a carry-on bag, you just can't pick seats and are in the last boarding group — where you likely will be forced to gate-check your bag). United's "basic economy" flight had an asterisk, so I knew to avoid it.

After buying the ticket, I was offered the chance to actually be able to pick my seats, for $85 or so. I decided to do so, and was then taken to the seat map, which showed 3 middle seats available. What's the point of picking your seats if you have to pick between the 3 worst seats on the plane? And how did Alaska thread the needle so their ticket prices don't get flagged as being not-real-economy-tickets?

<comment><USER23> There's at least one dude whose job it is to thread that needle, and another dude who tries to prevent that.

Our economy is filled with jobs that effectively cancel eachother out.

</comment></comment><comment> mark-r Once on a family vacation to Florida, I found myself on a toll road with no toll booths. If you didn't have a toll transponder, they just took a picture of the license plate and billed you later.

I had rented the car in Georgia, so the transponder wasn't even an option. A couple of weeks later at home, I got a bill in the mail - $4 for the toll, and a $50 processing fee from the rental company. It had already been charged to my credit card.

<comment><USER24> In case this helps anyone: Most cashless toll roads have an option where you can go to a website within a couple days and pay the toll online by entering your license plate. If you do this, your rental car company shouldn't get a bill, and you will avoid paying the extra fees.

I agree that the processing fees charged by rental car companies are ridiculous, though. The per-day rental charge for toll passes (in addition to the tolls) is also ridiculously high.

<comment><USER25> Golden gate bridge is like this as well. Except I got the time wrong. Congrats to Sixt who I think only charged me $8 for a fee.

</comment></comment></comment><comment><USER26> This is even worse in the era of "sort by price." That top spot is immensely coveted, so the competition and innovation is to get a lower sorting price, rather than competition and innovation in getting a lower true price.

Of course, if your competitors engage in tricks, you have to as well. Otherwise you're relegated to the bottom of the list where no one clicks.

The natural equilibrium sucks. What's the solution?

<comment><USER27> The solution is regulation. Here in the EU I see very few of these dirty tricks I see Americans complaining about, because we have strong consumer protection laws.

<comment><USER28> Agreed. It's mostly a non-issue in Australia too because of the law (which includes airline tickets) - [https://www.accc.gov.au/consumers/prices- surcharges-receipts...](https://www.accc.gov.au/consumers/prices-surcharges- receipts/price-displays#single-pricing)

</comment></comment></comment><comment><USER29> Car rentals. The dark pattern kings.

Rented an Avis car in france, It came damaged so we got the guy in the shop to sign off on the little car diagram.

Long story short, they charged us for the damage. It wasn't a ton (100$), but Avis "dispute resolution" didn't believe us despite the photos and the damage document.

There comes a point were you ask yourself, how much time I'm going to put into getting this money back.

The credit card company thankfully looked into and the charge was rejected, but the grief it causes.

<comment><USER13> > There comes a point were you ask yourself, how much time I'm going to put > into getting this money back.

Also the airbnb problem resolution.. the agent is getting paid to save the company money, so they'll dick around with you as long as it takes.

Maybe someone can make a "Fight-against-companies-as-a-service", but maybe that's the CC company's portfolio...

</comment></comment><comment><USER30> So I can not speak highly enough about having an Amex Platinum for this crap. Call them, say this sucks, here is the reason why and they say yup, refund. In the case listed the extra 14.99 EURO they would have said, hum not listed up front, here is your refund and then told the car rental to take a swim. I have had a number of instances like this where I just said whatever to the company and after (returning car, airline fee, etc.) chatted to Amex and solved.

</comment><comment><USER31> We got in to our Hawaii honeymoon at 10:30 pm, utterly exhausted and went to get the rental car. We had prebooked everything with an agency, but we had never traveled before, so we didn't know what to expect. They asked for $500 for insurance for the week. We felt sick, but we didn't know our options or what coverage we had, so we paid. We phoned our insurance agent the next morning, and realized we could drop a lot of that, so did the long drive back to the car rental place, but it was quite the eye opener. I'm still angry about it, and pretty sure even the reduced number was an absolute rip-off, but we just didn't know.

Combine that with the sudden resort fee we didn't know about until we got to the hotel, and we spent that first night and next morning wondering if we'd made a huge mistake.

<comment> crooked-v I don't understand how 'resort fees' haven't been prosecuted as fraud or false advertising.

<comment><USER32> They are indeed annoying. Fortunately they are normally disclosed (in tiny print) on the hotel website so at least now I can expect them.

Same goes for mandatory valet parking…

</comment></comment></comment><comment><USER33> Cost of a pizza in a normal pizza restaurant in San Francisco: $18. (if not higher in some of the fancier places)

Oh, wait! We need to add:

1) sales tax (9.75%) = $1.75

2) tip (20%) = $3.60

3) S.F. Mandates (4 to 6% depending on restaurant, let's say 5%): $0.90

Total? $24.25, or roughly 35% higher. Unbelievable, and ridiculous.

I wish all restaurants would advertise the FINAL price.

<comment><USER34> A $6 baseball ticket on StubHub becomes $10.41. The seller receives $5.10. So StubHub keeps more than half the total.

</comment></comment><comment><USER35> We shouldn't expect the companies to be "fair&transparent", especially given the documented evidence that it's unprofitable. It's really the job of the governments to impose fairness rules. E.g. in Europe you don't see prices without tax - I believe they're not legal.

<comment><USER36> In some parts of the EU, there are tourist taxes that are excluded from the quoted price. They have taken me by surprise when I paid in advance and had to make a payment just for the tourist tax.

</comment></comment><comment><USER37> > _Why not offer a price with "no hidden extras"?_

In addition to the problem the article highlights, there is also the mess that is human psychology.

JC Penney tried replacing random discounts with everyday low prices [1]. It backfired. Their shoppers _wanted_ to play the irrational game. (My assumption is rational shoppers shopped elsewhere, but that's neither here nor there.)

[1] [https://www.forbes.com/sites/panosmourdoukoutas/2013/09/27/a...](https://www.forbes.com/sites/panosmourdoukoutas/2013/09/27/a-strategic- mistake-that-haunts-j-c-penney/#2ad1c48e134c)

</comment><comment><USER38> An interesting corollary to this is that 3/4 star hotels in major business centers can get away with charging $15 or $20 a day for wifi. This is because they know that a huge percentage of their travelers are on business, and putting all credit card charges through an expense reimbursement process, so they don't really care what it costs as if it were their own money.

Whereas 1/2/3 star hotels aimed at the tourist market, and even the cheapest freeway-adjacent motels like Super 8, mostly all have free wifi because if they don't, people paying out of their own pockets will go elsewhere.

</comment><comment><USER39> > _There is a subtler problem too, explored a few years ago by the economists > Xavier Gabaix and David Laibson. Even if an advert proclaiming "no hidden > charges" is credible, it is not necessarily profitable. The problem is that > not all customers would find the promise appealing. Some would instead infer > "if you are good at avoiding hidden charges, try one of our competitors, who > will offer you a cheap deal in the vain hope of ripping you off". The > transparent company would attract the suckers without exploiting them; the > sneaky company would be a magnet for the sophisticates, who might well then > avoid the tricks. The advertisement would backfire._

Without some experiments backing this up, this argument sounds contrived and perhaps overthought.

I seriously doubt there are that many "sophisticates" who factor that into their decision, even less so, sophisticates who would consciously go for the "hidden charges" business with the idea that their savviness would help them avoid the charges.

In any case, the fix is simple: regulating hidden charges away with business destroying penalties.

If the rental companies face a law that they should make all charges known in advance of be shut down, they'll change their tune in unison, and there would be no "hidden charge" competitor advantage...

</comment><comment><USER40> Cell phone plans are the most annoying one for this; I remember at one point the advertised price for the plan I was on was $118 ($99 per line, plus $19 per additional line, I had 2 lines). The amount I actually payed was a bit over $165. The big 3 providers had different amounts of tacked-on fees and at one point I called up one of them to ask what my actual bill on a particular plan would be 3 times and got 3 different answers. This made it essentially impossible to price compare plans.

</comment><comment><USER41> Europcar overcharged Tim Harford by €14.99? Europcar Barcelona recently tried to me charge me an extra €260! I had arrived at the airport, after booking online, and they wouldn't allow me to pay the rental deposit with a debit card. 'Company policy' to only accept credit cards. Unless I paid the extra €260.

This is nothing to do with subtle economics. It's extortion because you're in a foreign country and desperate. I think we are just talking about a very unethical company.

<comment><USER42> Well, debit cards are not accepted anywhere for car rental (at least I don't know any counterexamples). $260 in this case are returned at the end of the rental term, it is just a (relatively recent) additional service from Europcar, allowing people with only the debit cards to rent cars nevertheless. (Disclosure: I use Europcar at Barcelona airport about 5-6 times per year; they have some quirks, but I wouldn't use the terms "extortion" and "unethical").

<comment><USER41> Well in this case at least this €260 was not going to be refunded. It was a one off charge. And I have rented many cars elsewhere in Europe using only a debit card.

<comment><USER42> OK, this is called "prohibitory pricing". As in, "we really really don't want your debit card, but if it is an emergency, here's an option. Still, please don't". I tried to rent a car with a debit card a few times, and it was simply not accepted everywhere I tried, (Europcar in Barcelona, Hertz in Geneva and Copenhagen, Avis in Geneva).

</comment></comment></comment></comment><comment><USER43> What I don't understand is why governments don't just flat-out legislate about this. They actually have made steps in some narrow areas (like airline ticket pricing). But not in most areas.

Probably my least favorite is event ticketing, just because it's so shameless. And it isn't even a monopoly anymore. For example, my local concert venue recently advertised tickets to a concert at $35 each. After all the ticket fees and service fees and other mandatory unavoidable charges, two tickets ended up costing $100. The service provided for that extra $30, which was to a third-party ticketing company but not one of the giant ones, was, as far as I can tell, to print off a piece of cardboard and leave it at will call.

It boggles the mind.

<comment><USER43> Actually, I take it back. The answer is, of course, in Mancur Olson's _The Logic of Collective Action_ \---it's much easier for ripoff industries to organize politically than for consumers.

</comment></comment><comment><USER44> I just keep a long list of companies that have dubious business practices and then avoid them. Unfortunately in the aggregate the feedback loop is probably too slow to change behaviors, particularly in an oligopolies with implicit fee-fixing.

</comment><comment><USER45> Don't rent a car here in (northern) Europe, if you can avoid it.

Renting a car in the US is painless and pretty risk-free.

Renting a car in Europe is different. I've read multiple accounts of local aquantancies here arguing with car rental firms about minor scratches that US rental firms just wouldn't care about.

When I return a rented car in the US the overworked guy I return the car to seems to be happy as long as the car is at least mostly intact.

In Europe meanwhile, you should worry about the rental company looking for minute scratches and then charging absurd amounts for these.

I don't rent cars in Europe. (Not sure if this is a Scandinavian, Northern European or European thing.)

<comment><USER46> I guess it's because all these amounts are paid by insurance? Nobody ever pays the €1000 themselves, so nobody cares?

<comment><USER47> I think it is to force you to pay the full CDW fee, or face the $6000 charge. In North America it is common for people to have the hire car coverage option on their main car. So it becomes a fight between e.g. Hertz and a big insurance firm.

I can't pick up a car in Europe in less than an hour, have to check/photograph everything. I have an actual checklist.

<comment><USER48> can you share the checklist for us who are curious?

<comment><USER47> It's just like the one the hire car companies use, front/right/rear/left elevation, roof, windscreen, tyres, side mirrors. Inside: seats, control knobs, petrol gauge, odometer, warning lights. Engine bay: water, washer fluid, oil cap.

The difference is that it's my checklist and I do it, taking the required time. Photographs of every panel. It is inspired by all the times I've been ripped off or they have tried to rip me off.

</comment></comment></comment></comment></comment><comment><USER49> There should be fines for opaque pricing.

There should be a website where you can report shenanigans.

</comment><comment><USER50> The only honest car rental companies I've ever used were a family owned one in Romania and Sixt, I think, in Sydney. All the rest, in Europe, were essentially scams. Not surprised.

<comment><USER51> Which company did you use in Romania?

</comment></comment><comment><USER52> For bullshit charges, you can just call your credit card to dispute them, and chances are you'll get your money back. I'm sure Avis and Europcar have probably received a bunch similar complaints, so they may just be automatically approved.

</comment><comment><USER53> Gaming the aggregator in order to appear high in the search? Who would have guessed!

</comment><comment><USER54> This seems like a pretty weak example of being "ripped off." He's complaining about a 15 eur charge for a one-way car rental? One ways are notoriously expensive...that reservation was probably a few hundred dollars.

I don't think there's a more egregious rip off than mandatory "resort/destination fees" \- a lot of hotels charge $40-50+/day extra on top of the stated room rate as a daily "fee" for the pleasure of using the gym or internet. Marriott is currently being sued in several states for these fees. Write about that if you want to discuss a "rip off" \- not a 15 eur fee.

<comment><USER55> Yeah and the really lame thing about the hotel situation is when browsing and comparing rates, they all show the rate without the inclusion of those "resort fees". Suddenly your $60 / night room is really double that at checkout.

<comment><USER56> At least (in my experience) hotels tend to charge those resort fees at the time of booking, instead of at the time of check-in.

<comment><USER55> Sorry, I didn't mean checkout as in checking out from the hotel. That was checkout from the booking site, when you're ready to enter in your billing details (shopping cart style) to pay for the room you just browsed on their site. The issue is the browsing experience on the main site and Google results shows $60 but at payment time it's really $100-150 because of non-avoidable resort fees and taxes.

It's one of those "dark patterns" that feels scammy.

<comment><USER56> Yeah, it's annoying, but it, at most wastes a few minutes of your time, when comparison shopping.

Compare it to getting off an airplane, arriving at the car rental kiosk to pick up your reservation, and discovering that your options consist of shelling out $100 in bullshit fees, in order to actually get your car - <USER2> car that you've placed a non-refundable reservation for.

(And even if you throw a fit, and get a refund, your only option is to go across the street, and eat a $150 markup on a same-day car rental, instead.)</comment></comment></comment></comment></comment>


How I Stopped Being a Founder - <AUTHOR> http://antonioevans.com/how-i-stopped-being-a-founder/

<comment><USER2> I've used Myles' FollowGen tool and I have to say that it's awesome even though the site is broken half the time. Funnily, it didn't really bother me. Reading about his whole philosophy behind this now, puts it all into context. What I cared about was whether it did what it was supposed to, even if the bells and whistles malfunction from time to time.

I think what an entrepreneur is best at, and what makes him or her a true entrepreneur, is carving out your own path and creating value for somebody (who is willing to pay for it in return). Myles is succeeding in both. tip of the hat to you sir.</comment>


Answers to front-end developer job interview questions - happy-go-lucky https://github.com/yangshun/front-end-interview-handbook <comment><AUTHOR> If you're new to front-end development and this questionnaire freaks you out, that's okay. This is probably useful for the author as a preparation aid, or for programmers whose interviewing style is based on regurgitating trivia. And this is trivia - man-made transient factoids, most of which are quirks of history that will go out of fashion in a few years.

This is not how a well-run interview happens. Can you read things and comprehend them? Can you think? Can you write? Can you be kind? Can you be professional in times of stress? Ultimately, can you build? If you can and if you've already built things, go into the interview so that you can speak about the things you know, the things you have opinions on, the things you've built and the things you want to build. If it is a good interviewer on the other end you'll have a good time jamming with a fellow maker; if it is a bad interviewer they'll ask you questions from a checklist they collected maybe from this handbook, and it is best that you don't work with those people.

<comment><USER2> Honestly? If this were back-end programming I'd agree, but as someone who's done a tremendous amount of front-end programming, the guide feels spot-on.

Sure many of these questions are "quirks of history", but your job as an effective front-end programmer is to know them so your site works everywhere where it's supposed to, and you have the knowledge to make the right trade- offs between legacy support and future maintainability. Front-end programming really is much more about sheer accumulated _knowledge_ than back-end is -- and it's not knowledge you can just "look up", because a huge part is knowing the gotchas in advance, in order to avoid them.

This shouldn't be a _whole_ interview -- all the things you list are important too -- but validating a candidate's experience of all these "transient factoids" is not just valid but necessary, like it or not.

<comment><USER3> What a b_ll_x reply to a sensible comment.

Mate, the personal website url you list in your HN profile don't work.

Funny that this is about frontend.

</comment></comment></comment><comment><USER4> I find the whole concept of "preparing for an interview" kinda strange.

I understand why people do it, and I certainly wouldn't fault anyone for giving themselves the best possible chance. But at a certain level, it really feels like trying to cheat the system.

In an ideal world, a normal conversation about the technology - your opinions, preferences and experiences regarding it - should be able to reveal what the interviewer needs to know.

<comment><USER5> True.

I've never been asked these kinds of "knowledge" questions in any interview. Nor have I asked them of any candidate. To me, interviewing is more about finding a fit to the company's and team's culture, than to ascertain if a candidate knows what she is supposed to know. Even if a candidate succeeds in bluffing her way through an interview, she will fall short in the one-month trial period.

I like the one-month trial period. I've walked away twice during the trial period from a company because they were a lot less organized than they did appear during the interviews. Similarly, we have let go of a couple of employees during their one-month trial because they were unable to learn fast enough or were too arrogant.

<comment><USER6> How does one even hire senior folks on a trial period?

So you work at this big co. How about you leave your job and come work for us and we may fire you after a month?

The best people are never on the market. You have to get them before they even leave their existing company otherwise someone else will

<comment><USER5> What's the difference? The intention of employing them is to offer them a permanent contract, but if things do not work out, firing people is hard. So, we almost always have three stages when we employ someone:

\- one-month trial period \- one-year contract \- permanent contract

For senior people, the trial period is more of a formality as they are often quick to become productive in the organization. Of course, when after a couple of months it is discovered that the new senior and management do have a fundamental difference of opinion with regard to the future of the organization, professionally, or even personally, the end of the one-year contract is the moment to part ways. This can be initiated by employer, employee, or even both, but that depends on the situation.

<comment><USER7> What do you offer that makes a contract position attractive versus other companies that will bring you on permanently immediately?

<comment><USER5> Nothing. It is quite common to do it like this here in the Netherlands. Of course, once we have a new employee and after a couple of months we think she is a great addition to the team, we will start negotiate for the permanent contract immediately.

Our team consists of experienced and above-average educated developers. We are not looking to attract that one 10x developer, nor do we desperately need a senior developer now. We sort of have too many senior level developers; our retention is high. Anyway, we are looking for similarly educated and experienced people that fit our team, and we offer a culture where such a person can thrive. We prefer to take a while longer to find and grow a great match rather than to gamble on potential talent that might leave again soon.

On the other hand, we do need new developers, particularly specialists, and we have gotten to the point that we are willing to take more risk. But the organization as a whole is still figuring out how to grow beyond a 10 person post-startup development team towards a 100+ person company (we merged with our biggest partner).

</comment></comment></comment></comment></comment></comment><comment><USER8> Some if these are just kinda...why does it matter. Honestly who cares what a doctype does/is for when you only ever use one from a boilerplate.

For most people in most companies weeding out the overly zealous, the ones who are unable to be pragmatic and the ones who can't play well in a team or in front of clients instead of biasing selection on technical knowledge is far more beneficial to the business.

Spending some time pair programming in an interview doing something actually relevant to the job is much more enlightening than throwing questions.

<comment><USER9> "...who cares what a doctype does/is for when you only ever use one from a boilerplate..."

This sums up many of the front-end candidates nowadays. Reminds me of "why do I have to know what XMLHttpRequest or a browser event is, I just use jQuery .ajax() and .on() anyway" from a few years ago.

<comment><USER10> This same logic can literally be applied to anyone working on anything. Engineers, carpenters, pilots, literally anyone.

I bet there are many people who know everything about "XMLHttpRequest", but know nothing about congestion control. Or how a network stack comes together...

You do realize "XMLHttpRequest" wasn't even a thing until several years ago, and it's safe to assume further down the road it may well be phased out (in favor of better/more secure APIs).

Instead of asking about "XMLHttpRequest", wouldn't it be better to talk about the general need for "websites" to communicate with a backend on demand, at runtime, after everything has been loaded and rendered? Or, put "XMLHttpRequest" on the table, and talk about how one would implement such an API within the context of a browser?

<comment><USER11> xmlhttprequest has been obsolete for 3-4 years.

[https://developer.mozilla.org/en- US/docs/Web/API/Fetch_API/U...](https://developer.mozilla.org/en- US/docs/Web/API/Fetch_API/Using_Fetch)

<comment><USER12> It's used everywhere though, so you'll likely still encounter.

In fact you'll probably encounter it in code your coworker wrote 15 minutes ago.

:[

</comment></comment></comment></comment></comment><comment><USER13> I'm doing backend development but interact with frontend developers all the time. Something I've noticed, especially among younger devs, is that they are sometimes unknowledgeable about how HTTP, DNS, certificates, and related tech work, and have a hard time grasping why state persistence and synchronization need to be done a certain way. The problems arise when something goes wrong and they immediately need support from backend, when a little more knowledge about the technologies below React or Angular would suffice.

<comment><USER14> Sure, but to be fair, I've met plenty of back-end developers, even senior ones, who don't know the intricacies of DNS, certificates, OS, etc. It's best to recognize the domain is enormous and a lot of folks have a desire, or arguably a requirement, to specialize.

I'm reasonably certain that if we created a union of all of the topic sets that HackerNews commenters identified as requisite knowledge to be a software engineer it would take a lifetime to plow through.

Like putting together a winning baseball team, it's best to recognize that your team wins when you put together a group of contributors that contribute their specific honed skills.

"Try to learn something about everything and everything about something." \- Thomas Huxley

<comment><USER15> Each Hacker News commenter believes that the exact set of topics that they are knowledgeable on are requisite to be a software engineer.

</comment></comment></comment><comment><USER16> Most of the questionnaire is (in my humble opinion) absolutely bad, as it focuses on stuff that you either know on the top of your head or you don't.

I'm sorry, but I'd rather hire someone that can't describe all the nitty gritties of `float`, but that can _think properly_.

Questions that can be looked up on Stack Overflow in 2 minutes are absolutely useless in hiring someone. They just favor people that have better memory.

<comment><USER17> If someone asks me a question that I don't know in an interview, I'm going to search the answer on Stack Exchange. If the person has an issue with that, I probably wouldn't be happy working there and should move on sooner than later.

<comment><USER18> Woah, woah, woah. Let's not start doing in interviews what we all do when working. That's crazy talk!

<comment><USER19> You mean you actually look things up on the Internet when you work? How unprofessional!

I for one rote-memorize all the aspects of languages and frameworks before using them. If I can't remember the name of some function, I just implement it from scratch using my superior knowledge or algorithms and data structures. Also, I write code on etch-a-sketch (sometimes whiteboard) in one go and then let a trained monkey type it into an IDE on a computer.

</comment></comment></comment></comment><comment><USER20> Damn..... I've been learning and actively using React + Bootstrap over the last 8 months. I can barely answer any of these questions....probably the only one I can answer is fizz buzz.....

Is it just me but do you even need to know all of this to make an SPA? If I need to know something, I just go and figure it out.

<comment><USER21> I can assure you that building things will teach you more than reading off a massive list of facts.

</comment></comment><comment><USER22> I am a full stack senior with quite some years of experience. I use the internet when I have the tiniest bit of doubt about any of these questions. To get my app right and have fewer bugs I tend to use my own memory less because it's simply not reliable. Another reason to look up things is that standards change over time.

Why would you need a handbook like this in the first place? Clearly because your memory is not reliable. So the interviewer acknowledges his own poor memory, using this handbook to find a candidate with better memory? Oh my..

I know hiring is hard, but this doesn't cut it at all IMAO.

</comment><comment><USER23> This would be really cool as a GitBook[1]. That way people could download a clean pdf, mobi, or ePub file while still maintaining open contribution.

[1] - [https://www.gitbook.com](https://www.gitbook.com)

</comment><comment><USER24> I like stuff like these handbooks.

Because i see my work / skill not only in 'i'm doing what i'm doing and i'm good in exaclty what i'm doing' but more like 'i like software development and i should know more about that than just what i need right now'.

I also take interviews more serious than before: Its always a good chance to evolve. Thinking about technologies in a different angle.

Understanding products on version number level. Really trying to understand what i'm doing.

</comment><comment><USER25> This looks more like a list of questions you'd prepare in order to show your boss that you are a good interviewer, not to find the right candidate for a position.

</comment><comment><USER26> Does anyone else get peeved by the fact that "front end" is now synonymous with "web front end?"

<comment><USER27> It's always been synonymous with "web front end". I was hiring "GUI Developers" in the 80's and 90's not "Motif Front End Developers"

<comment><USER28> I was curious so I searched Google Books for the phrase "front end developer". It appears that before 1995, it was used to refer to a software product called "Front End Developer" and it was also used to refer to a tech company (as opposed to an individual) that developed the "front end" for a larger system.

</comment></comment></comment><comment><USER29> On this one:

> Describe z-index and how stacking context is formed.

I have another question: what are best practices for using z-index and simply setting z-index values?

This came up at my last company where we had some huge unruly stylesheets with what looked like arbitrary z-index values sprinkled throughout (e.g. 1, 100, 660, 661, 10000). I guess maybe this is the answer: keep your stylesheets organized from the start.

I had added an action item to draw up some best practices for using z-index but never got a chance to get to it before I left. I did do some cursory googling and didn't come across anything especially enlightening on the topic.

The links provided in this section of this guide explain how it works but don't really address this question. Can anybody point to a good reference for using (as opposed to explaining) z-indexes?

<comment><USER6> Try to use a css preprocessor like sass, less, stylus.

Now make a file Called z-index.styl

Make variables for all your z indexes used in the app, organized by stack level

Do not use a z-index directly in css. Always use a variable after you import the file. This means you can see all the z-indexes in the app and change them atomically if you want.

</comment></comment><comment><USER30> I'd add this one: can you explain how you are going to make exact number operations on the website, e.g. for calculating an invoice according to the law, when you have only float type in JS? Any answer "I don't care" would automatically fail any interview, as any programmer who doesn't care for the program correctness or working according to the business rules should be automatically fired.

<comment><USER31> Have you really had people answer "I don't care" to an interview question? I've done a lot of interviews and I don't think I've ever heard that.

My impression is that mistakes due to floating point issues are usually due to ignorance (not understanding floating point nuances) or oversight, or due to an incorrect judgement call that it won't matter. (And really, I think that in the vast majority of situations, normal float math is fine. The backend should be doing the important math anyway.) "Automatically fired" seems very harsh in these situations, or even the situation you described.

<comment><USER30> I haven't, however for the last 20 years I've been working with people who didn't care about things like that. The worst thing is that they were proud of that, and they got promoted quite fast. Of course the software was buggy, but the manager got bonus for deploying things on time :)

</comment></comment></comment><comment><USER32> Does anyone know of any equivalent "handbooks" for other domains like back end or machine learning?

<comment><USER33> Dear god, I shudder to know why you are asking this..

<comment><USER32> Huh? Because sample interview questions would be nice to read over if someone was not interviewing for something that is not front end?

</comment></comment></comment><comment><USER34> This is pretty nice, anyone know of something similar for iOS?

<comment><USER35> Here are some algorithms in Swift: [https://github.com/raywenderlich/swift- algorithm-club](https://github.com/raywenderlich/swift-algorithm-club)

</comment></comment><comment><USER36> the section about local storage is wrong, localStorage and sessionStorage are definitely domain scoped, it will be an egregious security hole otherwise

</comment><comment><USER37> As a back-end fullstack developer this guide is great. Allows me to fill some gaps in a very readable and concise way.

</comment><comment><USER6> As a senior FE engineer, I have a lot to learn. Some of the questions are sneaky and interesting.

</comment><comment><USER38> Don't take a job where the interview includes trivia questions.

</comment><comment><USER39> And yet the anchor links don't work

</comment><comment><USER40> This is a _webtech_ front end interview handbook.

<comment><USER41> And it misses the important question: "what is your 1-3 year plan for when new web assembly GUI frameworks make 75% of your knowledge obsolete?".

<comment><USER26> When we get closer to the reality that a game like Grand Theft Auto or something runs in your browser without audio hitching, asset streaming and more, maybe this will make sense. 1-3 years though? Seems dubious.

</comment></comment></comment><comment><USER42> A friend of mine (who also happens to be the best developer I've ever had the pleasure of working with) was interviewing for a web frontend job. He didn't get it because he couldn't answer the question "What is a linked list?" I'm surprised to see that this handbook does not include that question (hint: sarcasm)

<comment><USER43> Your friend is probably a very good designer but not a developer in the usual sense.

<comment><USER44> Since linked lists are a concept you don't need in many languages, I don't think you can nowadays say someone not knowing about them is "not a developer". They are a developer without knowledge of some fundamentals, but they can be perfectly productive as a developer without that knowledge.

<comment><USER24> He doesn't know what a linked list is? Srsly?

<comment><USER44> Yes, seriously. If someone learns programming with JS (or Python or ...) and has neither been interested in nor exposed through work to lower levels they can easily go years of professional work without having to deal with the concept (not meaning that they wouldn't understand it, just that it never came up). Thanks to abstraction, you can go far without really knowing what's happening below, and that has moved up the layers more and more.

Where does a JS frontend developer really need to have heard of linked lists?

<comment><USER43> JS and Python can't decide what's best for your problem: an array or a linked list. It's the programmer who decides these things. I'm currently working on a project started by people who apparently were completely unaware (among other intellectual obscenities) that it's not OK to return a long list of integers by concatenating them into a long string only to split and parse them again later when some subset of this list was needed. Recently, due to increased traffic, the web service kept crashing.. with 64GB of RAM. Some of these people are probably on this forum, trying to justify why "you can be productive" without knowing wtf you are actually doing.

<comment><USER45> To be fair, languages like Ruby and Javascript only have one sequence container in their standard lib and the difference just doesn't come up for most people most of the time. Just like how most day-to-day data for most people probably fits in array with a capacity <100\. And the most common day- to-day operations are array[0] and array.append().

And even when it's thrown in your face like listOf() vs arrayOf() in Kotlin or [] vs '() in Clojure, one is the conventional default that you use most of the time anyways.

That said, someone who doesn't know what a linked list may also be lacking experience with many other things that you would expect from a candidate, but it's no mystery how someone can go far without really encountering one.</comment></comment></comment></comment></comment></comment></comment>


Uncovering Android Master Key That Makes 99% of Devices Vulnerable - <AUTHOR> http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key <comment><USER2> This tantilising and makes me want to work out what the problem is pre- Blackhat. Looking at JAR signing in general (which is what Android packages are) I see a few possible flaws:

* The zip format doesn't structurally guarantee uniqueness of names in file entries. If the APK signature verification chooses the first matching file entry for a given name, and unpacking chooses the last then you're screwed in the way described.

* The JAR signing scheme signs a file containing hashes of file name/data hash pairs. However, there seems no part of the verification steps (in the JAR specification) where _extra_ files not mentioned in the signed data cause signature rejection. This seems like a bad idea.

From the description, though, it sounds like a key management problem. Anyway, this talk is definitely on my Blackhat schedule!

<comment><USER3> You should really dig into this more, regardless of Bluebox's work.

I was approached about buying two different Android 0days related to APK signing about 3 months ago, so definitely some issues to be found. The seller wanted unrealistic terms, so I never got full details.

</comment></comment><comment><USER4> Maybe I'm missing something, but I don't see this security bug could be used against a majority of people. Can someone explain to me how this exploit could be used against people?

To me, it seems like someone would have to side-load an application. Anything coming from the Play store should be safe?

<comment><USER5> Sit on an open wi-fi network that you're connected to and intercept Play Store traffic and spoof an app update, like Gmail, inject my malicious app download URL which might look exactly like the Gmail app, except my malicious version of Gmail also sends your emails to me.

Then I go to paypal, forgot password, get email, gain account access, ruin your life.

Not sure how plausible any of this is, I'd have to be a really dedicated hacker to set all that up. _But it 's all possible._

 _Also, never ever ever EVER connect to open wi-fi._

<comment><USER6> Your scenario doesn't work at all given that such traffic is encrypted -- you can't simply inject into it. If someone breaks that, we have much bigger problems.

However, to your ending comment, some time back I asked whether passwords actually gave you security from other people who know the same password (e.g. a coffee shop that has a big sign telling you the WPA password). While I have zero knowledge to confirm or deny this, someone in the know claimed that no, given that the wifi password is used for the initial key exchange, it offers superficial interception/monitoring protection against someone malicious who knows the same password. Take that with a grain of salt, but I never could find other resources on that.

<comment><USER7> I just checked - the Play store downloads aren't encrypted (client hits a HTTP URL that 301 redirects to another HTTP url) and all of these were fully visible in a HTTP proxy. There may be some additional hash-checking going on though, I can't say for sure (the actual listings of apps and their details are indeed encrypted). Hopefully they're not relying 100% on the APK signature check for downloads.

<comment><USER8> There is additional hash checking indeed. Google Play will fail to install an APK you MitM to the app.

Edit: the hash checking is done _in addition to_ the APK signature verification, i.e. you can not replace the APK with a different APK signed with the same developer key.

</comment></comment></comment></comment></comment><comment><USER9> Is it my imagination or is 5 months a very short disclosure window for a vulnerability that affects Androids since Donut?

I think about how manufacturers drag their feet on normal updates and can't imagine what heaven and earth movement would be required to patch this industry wide.

Then again, maybe the attack surface for this is small enough that it's manageable.

<comment><USER10> I think Google itself sets a higher bar than even 5 or 3 months for other companies and itself.

[http://www.darkreading.com/vulnerability/google-sets-new- agg...](http://www.darkreading.com/vulnerability/google-sets-new- aggressive-7-day-deadlin/240155757)

<comment><USER11> Those are for bugs that are "under attack", where it's important that those being attacked have the information necessary. There's no evidence that this is being exploited in the wild (at this point).

<comment><USER12> "Under attack" allows people to distort reality as much as they want for their own benefit. Google sure looked like a tough cookie by disclosing bugs in 7 days and now it gets a pass.

</comment></comment></comment></comment><comment><USER13> If I'm reading this correctly, this hack would potentially allow a standard app developer to create an app that has elevated permissions and thereby be able to access and transmit any data on the phone.

The story also says that this hack could be used to send text messages and other communications. In the wrong hands this could be a devastating financial and social exploit.

<comment><USER14> It gives you the ability to modify the app without changing its cryptographic signature. If such problem would exist in standard PC world, it would essentially give you the ability to modify the binary without changing its hash.

This is a major blow to essential system of Android security system, the core functionality is broken the consequences can be massive not to mention it will never be fixed on old devices.

<comment><USER15> I don't get why this is a problem.

In the PC world, authenticode on executables does not really offer that much security: Any malware can be signed and you normally don't verify the signature of applications.

And with Android: Just because APKs could be forged, what exactly is the attack vector? If sideloading is not enabled, and the play store uses HTTPS, how would such an forged APK with an stolen signature get placed on your device? Could other apps modify the APK of another app? Doesn't each app have it's own Linux userid and aren't there access restrictions? How would some random game go and write into the APK of an app with high privileges in order to inject code? If that were possible, there would already be DOS like attacks: One game destroying the APK of a competing game, etc.

I'd really like to know the attack vector!

<comment><USER16> The thing that makes this dangerous is the "system" certificate for core apps. If you hijack traffic to any update to such an app (and OEMs have a ton of such apps), you you can inject code before it's installed under "system" abs that's that.

No, you can't actually go poking into other apps' apks but how many people would press "update" if they see the package manager's "Installing Gallery update, no permissions required" dialog?

</comment></comment></comment></comment><comment><USER17> Yesterday I swapped my Android for an iPhone due to security concerns. No regrets.

<comment><USER12> yet.

</comment></comment><comment><USER18> This is really one of those news that just seems to be bought by Android's competitors.

The user has to install a pirated APK. Also Play store is SSL secured. Just use common sense.

<comment><USER19> Not everybody can download from the Play Store because of ridiculous device and country restrictions. If you are from the US or Europe, you're mostly fine but from other countries you often have to download the APKs from non-official websites and I guess that's where there could be a problem.

<comment><USER20> Why? I installed most of my apps from Play Store, if some apps have country restriction, it's because they have a good reason to do so (range of service or support)

<comment><USER19> Where I live, many apps are not available and it's not clear at all why. Usually I just end up searching for the apk, install it and it works just fine.

</comment></comment></comment></comment><comment><USER15> I don't get why root access is so much worse than any other problem:

1\. Apps like Skype already allow themselves access to so much sensitive and private information and things like the Motorola spyware uncovered recently ([https://news.ycombinator.com/item?id=5973282](https://news.ycombinator.com/item?id=5973282) ) are so bad that I find the extra evilness possible with root access not so significant. What amount of additional harm would it really be? Intercepting network traffic? Better hidden rootkit that even hides from the few users who have jailbroken their phone?

2\. The Linux kernel regularly has security bugs and we know that Android phone manufactures don't update devices timely or at all. Wouldn't every Android phone not have at least one exploit for the kernel itself at any given point in time? Where are the apps that just use this to gain root access? Or has Google hardened the kernel well enough that there are no known exploits by which an APK with native code doing syscalls can increase it's privileges?

<comment><USER21> just because one thing is a problem, dosent mean other things are not a problem.

</comment></comment><comment><USER22> Bluebox seems to be having some sporadic database connection problems. Here's the Coral Cache mirror: [http://bluebox.com.nyud.net/corporate-blog/bluebox- uncovers-...](http://bluebox.com.nyud.net/corporate-blog/bluebox-uncovers- android-master-key/)

</comment><comment><USER23> So, it seems, that there is some "special, less strict" way to install packages for "trusted vendors", because it is much less probable to find a major flaw in a standard jarsigner + zipalign procedure. If so, it is just another idiotic "management decision".

</comment><comment><USER24> Looking on the bright side, this offers a wonderful new opportunity to root your phone without rooting your phone.

And at what point do we stop calling these sorts of problems "vulnerabilities" and start calling them surrepitious "back doors"?

<comment><USER25> There is no rooting involved

<comment><USER24> Yes, precisely my point. Hence the phrase "rooting without rooting".

If it's possible use this vulnerability to arbitrarily rewrite the contents of any or all of the APKs loaded onto a given phone, then this flaw allows for the ability to engage in a key behavior that makes rooting Android popular: Disabling all of the unwanted bloatware that device manufacturers usually prevent you from deleting.

<comment><USER25> This exploit won't disable anything, you still will have any of those apps installed and shown

</comment></comment></comment></comment><comment><USER26> There are some weird sentences in this that make it very confusing:

"Installation of a Trojan application from the device manufacturer"

Ok, so the manufacturer of the device is shipping a trojan on my device. Isn't there a bigger problem in this situation?

<comment><USER27> I think he means an application which is "signed" by the manufacturer but actually comes from a malicious third party.

<comment><USER28> But how did it get there? I'm pretty sure the device would have to be rooted, _and_ the user would need to have run some code written by the attacker and allowed it run with superuser privileges (or haphazardly followed some malicious tutorial online, e.g. "follow these steps to install new themes!" or "use this tool to unlock your phone!").

<comment><USER29> You install an app from the Play store that is very normal, it only requests Internet permissions.

Then after a week or so, it wakes up and downloads its payload which with it can modify itself, transforming itself to seemingly be the Gmail app you are so often using, while moving the real gmail away. Then you continue using and updating "gmail" like you normally would, except you know, its now using a proxy and no ssl.

<comment><USER28> I'm not sure it could covertly replace Gmail as you describe without being granted super user rights.

</comment></comment></comment></comment></comment><comment><USER30> A device manufacturer can already do whatever they want.

</comment><comment><USER31> Are Android apks converted to BlackBerry10 bars still vulnerable?</comment>


"During the investigation we noticed that you placed a shell into our web root" - <AUTHOR> https://hackerone.com/reports/136169 <comment><USER2> His argument makes sense to me as to why that was needed, however if they want to take that stance, thats understandable, as is people being less likely to run things down for them.

<comment><USER3> If a shell was necessary, a better-secured one (e.g. requiring a signed command) would have been a good approach.

<comment><USER4> Yes. The Uber representative implied that a secure web shell would have been, at the very least, less objectionable:

> we noticed that you placed an _unauthenticated_ web shell into our web root

(emphasis mine)

That being said, I imagine a phpinfo(); or passthru("whoami"); would have been preferred.

<comment><USER5> An earlier comment said "Although the system() PHP function didn't directly work..." so it would probably have been phpinfo().

Authenticating something like this is an interesting question though. Maybe make the php script filename a sha256, then make the query string another sha256, and possibly add a few more sha256 query keys that have to match more sha256 strings. Or maybe that's overkill. (I keep wondering about cryptographic cipher-based solutions...)

As an aside, an attacker would have needed to know about the name `bugb.php`, which isn't an intuitive or easily guessable filename IMO, so there was a reasonable level of security-by-obscurity.

<comment><USER6> Since system() PHP function didn't directly work, do you think he would have been able to gain full access as he suggested?

<comment><USER5> It would probably have required a bit of thought, but PHP can access databases, (presumably) alter files, and the like; so while full UNIX shell access might not have been possible, practically speaking PHP could have done a lot of damage on its own.

</comment></comment></comment></comment></comment></comment><comment><USER7> Wow, am I correct in reading that uber just paid out 10k for a OneLogin wordpress plugin bug? Who said open source was free...

<comment><USER5> Step 1: go to homepage

Step 2: browse

Step 3: profit, literally

I'm considering looking around at bug bounties... I know nada about security, but who knows, maybe I'll stumble on something.

<comment><USER8> yeah, anyone offering bug bounties and also running wordpress must be offering easy money...

</comment></comment></comment><comment><USER9> Sniffs (faked) user-agent and won't even show me the page.</comment>


Umberto's Echoes - <AUTHOR> http://www.the-tls.co.uk/tls/public/article1640053.ece <comment><USER2> First off, a reminder that Umberto Eco is an Italian author. (as I'm sure most of the commenters here are familiar with The Name of the Rose or Foucault's Pendulum in English)

Based on this (and a few other) reviews, I'm not entirely sure how this book is supposed to be different from Foucault's Pendulum.

<comment><USER3> It is completely different. Think of Focault's pendulum as an intellectual and noble ancestor of Dan Brown's Da Vinci Code, better written, better researched and much more intellectually rewarding. The story is beautifully twined in extremely fascinating scenarios and the general topic was much more relevant when the book came out.

Numero zero, on the other hand, reads like some long form notes hastily out together to resemble a short novel. The book is fast, lacks action (as noted by the review) and in the end really seems unfinished or unproperly edited. It certainly wasn't something you'd expect from someone like Professor Eco. Plus, the plot and the setting are completely out off time and focus on a period - the 90's, or the late Wild West of media control by Berlusconi and his accolades - that's obsessing Eco for some time, along with the fact that he's more comfortable writing about the mechanics of old media that he, on some level, misses dearly.

<comment><USER4> I upvoted you because you definitely made a better job than me in trying to explain things :)</comment></comment></comment>


Jon Stewart Rips Into Apple Over Lost iPhone Debacle. - <AUTHOR> http://techcrunch.com/2010/04/28/jon-stewart-rips-into-apple-over-lost-iphone-debacle-thats-going-to-leave-a-mark/

<comment><USER2> Also discussed in: <http://news.ycombinator.com/item?id=1303598></comment>


Securing Memory at EPYC Scale - <AUTHOR> https://blog.cloudflare.com/securing-memory-at-epyc-scale/ <comment><USER2> I have been following this space very closely as we're planning some killer roadmap use cases at my place of employment. This has been in the works for sometime after the interest in Intel's SGX + AMD's SEV environment that delivered subpar results.

Yesterday, Intel announced that Multi-Key Total Memory Encryption is coming to CPUs ([https://arstechnica.com/gadgets/2020/02/intel-promises- full-...](https://arstechnica.com/gadgets/2020/02/intel-promises-full-memory- encryption-in-upcoming-cpus/)) and it's very exciting to see this space heat up.

If you're interested in embedded systems and data security is interesting to you, we are hiring! (send me an email - mahmoud @ linux dot com).

<comment><USER3> What are you using this for?

<comment><USER2> Running "serverless" functions on [https://github.com/bytecodealliance/lucet](https://github.com/bytecodealliance/lucet) which is running in these enclaves provides a relatively simple way to offer "confidential computing" to offer an alternative against "semi-honest" (or sometimes known as "honest-but-curious") adversarial threat models.

</comment></comment></comment><comment><USER4> I really don't see the point of encrypting memory this way, with what boils down to a global key.

Anything breaking security of your OS kernel or some trusted process will still be able to steal all your data, since it's executing on the CPU with access to the keys.

Any attacker with physical access can still grab a hold of some PCIe or LPC port somewhere and try to convince your IOMMU to let it DMA out all memory. Or just manipulate the BIOS to install a permanent rootkit.

Why is this not using per-page or per-process keys, in some kind of secure storage? That'd actually add another barrier even if the kernel is already compromised. And the CPU does actually support this... but only for VMs with SEV, it seems. Would be nice to extend this.

<comment><USER5> > I really don't see the point of encrypting memory this way, with what boils > down to a global key.

SME was initially developed for game consoles[1], and was designed to protect security keys used for DRM against hardware probing. The feature makes sense in that environment, or any environment where the computer may realistically fall into the hands of an adversary (e.g., a laptop) while still running.

Plain SME on a server doesn't really make sense for DRAM unless your threat model needs to protect against extremely sophisticated attackers (although if there's no real performance hit, you may as well just enable it). However, it would be useful on a system with NVDIMMs.

[1] [https://www.crn.com/news/components-peripherals/amd-s- xbox-p...](https://www.crn.com/news/components-peripherals/amd-s-xbox- playstation-work-led-to-a-big-security-feature-in-epyc)

<comment><USER6> Can it protect against DMA access from malicious PCI devices (in case the IOMMU has to be disabled, e.g. for performance reasons)?

<comment><USER7> In transparent mode it will only protect against somebody pulling the Stick, in per page mode it will depend on the mode.

</comment></comment></comment></comment><comment><USER8> It's always nice reading about a company taking security seriously, and Cloudflare has some decent write ups for their hardware/software security, but I sure wish they would take other forms of security more seriously.

I visited Cloudflare's Austin office. The door to the office is an old unlocked door with a glass pane and an old deadbolt. There is no reception desk or even anyone watching the door. I was able to walk in completely unnoticed and walk around for a couple minutes trying to get someone's attention to figure out where I needed to go (not the best job interview experience, but that's a different topic), while desks full of unattended and unlocked computers were fully available to me.

For a company that bills itself as an internet security company, it wasn't very inspiring security.

edit to add: this was over a year ago so it's possible things have improved since then. My understanding is that the Austin office is relatively new so maybe at the time they were still working out the kinks (still not great security but more understandable at least)

<comment><USER9> Before posting this, did you give them this feedback directly?

<comment><USER8> One of the folks I talked to while there was one of the senior security team members, and I mentioned it to him during the interview but felt like it was brushed off (honestly that's not that uncommon, I've worked in security for years and while software people are always really critical on software security, they really don't care about physical security). I've been back once and nothing had changed at that time, but that was over a year ago so hopefully in the past year things have improved.

<comment><AUTHOR> I went ahead and copied your comment to our internal security team. We do take this stuff seriously and I was surprised to hear about unlocked machines and easy access.

<comment><USER8> That's good to hear! I edited my original comment to say that this was over a year ago and was still when the Austin office was relatively new so perhaps it was just the effects of adjusting to a new space, and hopefully things are different now. Still, glad that it's taken seriously.</comment></comment></comment></comment></comment>


Ask HN: Would you join a trade union? - <AUTHOR>

I have often wondered whether such a thing would be beneficial. Sometimes it does seem things have swung too far in employer's favor but are there better ways of asserting individual rights than this?<p>All opinions and discussions are welcome whether you agree or disagree. <comment><USER2> No, of course not.

We're in the single best market for developer talent that has ever been, where a guy who is provably good at what he does can negotiate rates at double, triple, even 10X the going rate for a senior developer. In that light, what sane person would voluntarily pin himself to a Union-esque system where he is paid on a scale determined by seniority?

Ask a simple question, get a simple answer: The bottom 50%.

If you're provably bad at what you do, or are unable or unwilling to negotiate your way away from the middle/bottom of the pack then yes, maybe, a union might make sense. But leave the rest of us out of it.

It's just too good here. The last thing we want is some fool to come by and ruin it.

<comment><USER3> Hollywood actors and NFL players have essentially 100% union participation. That hasn't prevented the top performers from negotiating exceptionally high pay.

There is no reason to expect a union of software developers to rigidly follow the example of blue collar unions.

</comment></comment><comment><USER4> Here are some ideas I'd like to see a union fix for our industry:

Agesism in tech

Non payment for employees or contractors

Protect programmers refusing tasks on ethical grounds

Establish ethical standards

Better working conditions - quiet offices, not open floor plans

Working from home when practical

minimum vacation time (not pooled with sick days)

No 2 day exploding offers

Dignity in job interviews

(Can you guys think of any more?)

<comment><USER5> This sounds like the exact sort of question that tptacek would have a lot of insight to offer.

</comment></comment><comment><USER6> Here in the UK the relationship between unions and business has always been hostile and unproductive and since the 1980s the unions in the UK have been stripped of any effective power.

I think if our unions were more like Germany's which have board representation and pay determined by collective bargaining - then I'd be more inclined to join.

Another difference between the UK and Germany is what happens to workers when technological innovation occurs. For example there have been strikes by the RMT union against driverless trains on London's underground.

Initially this appears to be counter-progressive, striking against what is an advancement in technology. In Germany these workers would be retrained so that their careers would not be destroyed. The UK does not retrain workers when they are made redundant.

</comment><comment><USER7> I wouldn't join a union, but I would donate money to a lobbying group that lobbied for tightening restrictions on visas. I understand getting a visa if you truly can't find the talent you're looking for in the US, but companies just do it for cheaper labor and are exploiting the system.

</comment><comment><USER4> Here's a recent article I came across that makes some good arguments:

[http://michaelochurch.wordpress.com/2014/10/13/it-might- be-t...](http://michaelochurch.wordpress.com/2014/10/13/it-might-be-time-for- software-engineers-especially-in-silicon-valley-to-unionize/)

</comment><comment><USER8> Trade unions make sense when the employer has disproportionate power over its employees. That's typically shallow employment markets with a single dominating employer.

Dev market in most places are efficient enough; so no I wouldn't.

</comment><comment><USER9> We live in an age of disinter-mediation.

Adding a new middle-man into the talent/employer mix sucks value out of that relationship. You can always assert your rights by employing your talents elsewhere.

</comment><comment><USER10> No. I'm _pro-union_ , but I also know how slow unions can be. I enjoy the speed at which technology is moving and I think that adding in unions, although it would add a host of great qualities, would also bring about undesirable problems.

I can't reconcile a Bar-like association or a trade union with the wonderful stories of things like Apple starting in a garage or Facebook by a student, or the super coders like RMS programming a new gigantic feature to Emacs in a 10-hour sprint.

</comment><comment><USER11> It'd be nice if freelance tech folks could pool their resources and get group health-care rates... but I'm not sure if a full-on union would be needed for that.

</comment><comment><USER4> There was a previous discussion on this topic here: [https://news.ycombinator.com/item?id=8384641](https://news.ycombinator.com/item?id=8384641)</comment>


Facebook takes down accounts and pages of Roger Stone - <AUTHOR> https://www.reuters.com/article/us-facebook-disinformation-usa/facebook-takes-down-accounts-and-pages-of-trump-ally-roger-stone-idUSKBN2492YK <comment><USER2> I enjoyed an interview with one of two filmmakers about a documentary they made on Roger Stone. Politics aside, he's an interesting character.

[https://www.npr.org/2017/07/13/537023277/documentary- reveals...](https://www.npr.org/2017/07/13/537023277/documentary-reveals-the- dirty-tricks-of-one-of-trumps-closest-political-advisers)

</comment><comment><USER3> I think FB has a rule that people in prison are not allowed to be on Facebook.

<comment><USER4> It sounds like the rule is formally "you can't run an account of someone else"? Coupled with the other rule that prisons set of "you can't maintain a social network account in prison", that means there's no way to have an account: [https://www.themarshallproject.org/2016/04/14/should- prisone...](https://www.themarshallproject.org/2016/04/14/should-prisoners-be- allowed-to-have-facebook-pages)

</comment></comment><comment><USER5> The digital era is not kind to preserving history.

<comment><USER6> Not just in terms of data preservation, but also in the amounts and the ever- quicker shifts of context. I can barely understand the controversy of the day on Twitter as it is, and I'm living through it. I don't know how future historians will make any sense of the data we do leave behind.

<comment><USER7> It will be a line item in a text book one day.

"During the early 21st century as "social media" began to emerge, various political forces attempted to manipulate it to achieve their goals. Luckily, only the bad people were unsuccessful."

<comment><USER8> "In the century leading up to the formation of the Hivemind, there were many rebellions around the world. Individual adult humans resisted the Hum when they were not raised with it. In 3 BHE (2020 CE), an outbreak of rona killed a quarter million humans in the United States of America, sparking the Q Rebellion. Even after the formation of the Hivemind, there were rebellious humans. After the Pan-National Treaties were ratified in 4 HE, the People's Republic of China invaded Hong Kong, starting the Skynet Rebellion, which would continue until 6 HE."

"You mustn't be afraid to dream a little bigger, darling." ~ Eames, "Inception"

</comment></comment></comment></comment><comment><USER9> > "that included a Nazi symbol"

I believe it was an upside down triangle... That's a common symbol and just happened to match an obscure Nazi symbol I think very few people alive today have ever seen before.

Just more propaganda repeated over and over. "Nope, it wasn't an upside down triangle, it was a Nazi symbol. Everyone using upside down triangles is hereafter deemed to be making Nazi dogwhistles!"

<comment><USER10> I see this come up a lot and it seems silly, let's summarize:

• The ad was about a political stance they disagree with (Antifa)

• The upside-down red triangle was specifically used to mark groups of prisoners who participated in anti-nazi political speech

So what's the alternative? That the Trump campaign chose an upside-down red triangle in an ad _at random_ because... it's uh... a shape?

Do they also have ads with blue circles? pink rectangles? hmm, no.

Have they also "accidentally" used gold 6-pointed stars? yes.

<comment><USER11> They didn't choose the symbol at random but rather because it's the symbol many Antifa supporters use to brand their movement [https://www.redbubble.com/i/sticker/Antifascist-Red- Triangle...](https://www.redbubble.com/i/sticker/Antifascist-Red-Triangles- antifa-left-symbol-by-reydefine/43631729.EJUG5)

Perhaps Antifa itself got the symbol from nazis though?

<comment><USER10> You picked a single example that's also referenced in a stackexchange answer that did a fair amount of work exploring the usage of the symbol.

"It can be found in that context. But it is surely not the most recognisable symbol for Antifa in the US."

[https://skeptics.stackexchange.com/questions/47917/have- anti...](https://skeptics.stackexchange.com/questions/47917/have-antifa- members-used-an-inverted-red-triangle-as-a-symbol)

So ok, maybe we can give the benefit of the doubt. By why not use the _actual_ symbol that's very predominantly used in Antifacist protests? It's very easy to find and much more familiar and relevant. Honestly it would have made for a better ad.

And in isolation this is a single mistake, but the administration has been repeatedly criticized for using fascist symbolism and language, including "America First." At what point do these things stop being coincidental?

<comment><USER12> I'm not saying it isn't xenophobic and pandering to a nationalist base but it seems like a stretch to call "America First" fascist, especially when the phrase is generally accompanied by (dubious) accusations that the opposing party failed to prioritize the needs of the people. I could see the argument that the slogan was perhaps used as a tool to further fascist policies but "America First" represents fascism about as much as the Che Guervarra hats that Hot Topic used to sell represented communism.

<comment><USER10> It's not the phrase "America First" on its own, but its history of use.

"While the America First Committee had a variety of supporters in the United States, 'the movement was marred by anti-Semitic and pro-fascist rhetoric.'"

[https://en.wikipedia.org/wiki/America_First_(policy)](https://en.wikipedia.org/wiki/America_First_\(policy\))

And again, this is another example where they could have literally picked anything else... but they didn't. When pressed about its history Trump literally backed up the phrase's use by stating "I like the expression."

It's isolationist, nationalistic, xenophobic nonsense with a tinge of antisemitism. It's been denounced by multiple jewish scholars and the Anti- defamation league.

</comment></comment></comment></comment></comment></comment><comment><USER13> The future is decentralized, techs and hackers will leave and regular joes will follow later.

<comment><USER14> Don't know why you were downvoted, this is true and it's already happening.

</comment></comment><comment><USER15> > _Nathaniel Gleicher, Facebook's head of cybersecurity policy, said the > removals were meant to show that artificially inflating engagement for > political impact would be stopped, no matter how well connected the > practitioners._

Taking the goodwill approach for Facebook's actions, they determined Stone "broke the rules". I don't personally think these actions pass the consistency "smell test" of good community governance.

That's the beautiful thing about vague policy, they can be selectively enforced. When there's pushback, well, the rules are the rules right?

<comment><USER16> Do you have any examples of sock-puppet rings that Facebook has selected to not enforce a policy?</comment></comment>


At WeWork, an Idealistic Startup Clashes with Its Cleaners - <AUTHOR> http://www.nytimes.com/2015/09/13/business/at-wework-an-idealistic-startup-clashes-with-its-cleaners.html <comment><USER2> The workers were bullshitted by CBM and didn't get it:

"When I asked WeWork for more money, they told me to talk to CBM, he said. When I asked CBM for more money, CBM said WeWork had to approve the raise. It was frustrating."

The underlying problem, that both companies in question are under pressure of financial forces, didn't get mentioned.</comment>


How to Grow Your Twitter Account from 0-500+ Followers - <AUTHOR> http://projectpivotal.com/how-to-grow-your-twitter-account-from-0-to-500-followers/

<comment><USER2> It's all about engagement. If you are interesting and offer something of value to people on Twitter, you will get followers.

<comment><AUTHOR> That is true! This will just help you get started, so that your early tweets get in front some more eye balls</comment></comment>


Org-mode Babel is cool - <AUTHOR> https://anbasile.github.io/2016/12/02/org-babel-is-cool/ <comment><USER2> I tried moving to emacs/spacemacs but went back to vim. This is the biggest feature I miss. I've even go so far as to do some extremely preliminary work on re-implementing it in vim.</comment>


Thousands of Ruby on Rails sites leave logins lying around - <AUTHOR> http://www.theregister.co.uk/2013/11/28/thousands_of_ror_sites_leave_logins_lying_around/

<comment><AUTHOR> I am not remotely qualified to judge this, alas. Can someone please indicate how valid this is?

</comment><comment><USER2> Classic Rails.</comment>


Millennials want to be job-hopping generation. But economy won't let them - <AUTHOR> http://www.washingtonpost.com/news/storyline/wp/2014/09/04/millenials-want-to-be-the-job-hopping-generation-but-the-economy-isnt-letting-them/?hpid=z5 <comment><USER2> Isn't it just a symptom of how the job market works nowadays? This is not even limited to USA.

There aren't many jobs where you can move up without moving out, or funding your own company. The information era worker is more like an entrepreneur (seeking opportunities where he can apply knowledge/experience and negotiating pay, working conditions) than the industrial era worker.

</comment><comment><USER3> _" But he doesn't mind. Buying a house. Investing in a retirement plan. A steady job. Gribbin has little faith in the trappings that once were associated with stability and a secure future. "Most of my peers would never put their trust in investments like that," he says matter-of-factly. "Why pour all your money into something, when the value can so easily disappear and you lose it all?""_

That's really what it comes down to, doesn't it?

Gone is the perception that a company will take care of you, that there is anything worth saving up for, because any student of recent history is acutely aware of how arbitrarily things can be taken away--because of a shitty cop, because of a medical bill, because of "because fuck you that's why".

Things are a lot less stable than they appear.

<comment><USER4> Wow that's cynical. Insurance can deal with most issues. Saving continues to be a buffer against unemployment. Invest in predictable securities and you can do ok, at least not lose. If a generation has that short a view, then they're destined for not-greatness. Because doing worthwhile things takes time, and short-sightedness won't get you there.

<comment><USER5> Well, yes, you can buy your insurance and then the company refuses to pay out because ... arcane reasons. Savings goes into a mega-bank that goes bankrupt in a scandal of home mortgages or something like. Securities ... run by sharks who would sell you your own mother given half a chance.

Seriously, if you're not paranoid, you haven't been paying attention for the last decade.

The grim truth is that there is no alternative.

<comment><USER6> > the company refuses to pay

This is a very real problem.

> bank that goes bankrupt

You money is still safe even if the bank goes bankrupt, which it won't.

> Securities ... run by sharks

Doesn't make them any less secure. You do have to do your research before investing and its not the most approachable process, but you can still invest in low risk securities. If you want to cautious you can always buy treasury bonds.

You can pay attention and still not be paranoid.</comment></comment></comment></comment>