Nutjob attempts to extort $35 computer from non-profit foundation - <AUTHOR> http://www.raspberrypi.org/archives/1901

<comment><USER2> "Nutjob"

To me it just looks like a kid who is willing to randomly make up stuff to try and get a Raspberry Pi for free.

As amusing/crazy as this was, I'm not really sure if it merited it's own blog post (or HN submission for that matter).

<comment><USER3> I saw it as a preemption of a threatened attack on Upton's and the Foundation's reputation. Probably unnecessary, but then, not as much trouble as having someone spreading rumors that you are an anti-semite.

</comment></comment><comment><USER4> Eben has the patience of a saint.

The irony of that exchange was that Eben showed pretty amazing customer service the whole time.

<comment><USER5> Perhaps, but I think his approach could be improved.

Basically, he was feeding a troll and now they're playing the troll's game by using "eyecatching headlines". (I don't think for a minute they are seriously concerned about blackmail; this was a troll being a troll, not anything serious enough to warrant the name "extortion".)

"sorry, I'm afraid we can't provide free samples" was the right response (although "we do not provide free samples" would have been better as "can't" implies there's a barrier that might be overcome; do not give unreasonable people a reason for a decision because then they have a target).

If the troll asks "why", the answer can be "because we do not offer free samples." Repeat meaningless responses until the troll gets bored (or better yet, block and ignore them).

As soon as you say the reason is policy, they can try to get you to change or go around the policy. If you provide no reason at all, there is nothing to discuss.

<comment><USER6> Why do you think it was a troll? Don't trolls have better things to do like troll message boards where people will actually see the havoc they're attempting to wreak?

Personally it smells legit. If it was a prank then kudos to the troll.

</comment></comment></comment><comment><USER7> Throughout the whole ordeal, Eben didn't break character. If that maroon wasn't trolling, it was indeed a very funny attempt.

Overall, the RP is hard to get. I paid about 2 months ago. All I got since was a couple of emails saying that the shipment will be pushed back, etc. And I'm totally fine with that. I guess, some aren't and shit like this happens.

</comment><comment> X-Istence I paid for my RaspberryPi and just recently got an email from Rs Online that my RaspberryPi will be delayed by a further 9 weeks. I ordered July 3rd, it was supposed to be delivered in 11 weeks, now it looks like I won't get my RaspberryPi until mid October if I am lucky, most likely mid November.

At least I will get an early christmas gift, by the time it shows up I will have forgotten all about it and version 2.0 will most likely be out ...

</comment><comment><USER8> We get similar requests fairly often.

Traits:

1\. They want free stuff.

2\. They dangle the possibility of hundreds or thousands of sales.

3\. When the answer is no, they start making threats and/or take to the internet to post lies about the company.

Current policy is no free samples under any circumstances whatsoever.

We do give away copies of our products as gifts sometimes though and we make available review copies to journalists who can actually verify their credentials. (With about 9 out of 10 claiming to be writing a review for a magazine the magazine editor will say they have never heard of the person.)

<comment><USER9> Sounds like a lot of RFP bids I worked on at my current job.

Big company shows up, dangles a bid the size of Texas (at least in our eyes). We pull all-nighters making a killer design and proposal. The client "changes their mind" and takes the completed bid overseas and has it made for peanuts.

</comment></comment><comment><USER10> I kept waiting for the guy Steve to type "someone set us up the bomb"

<comment><USER11> I kept wondering what his native language must have been. And then I wondered if you could write a program that analyzes text written by someone who doesn't speak a language natively to figure out what their native language is.

<comment><USER12> I'd be more interested in a system that knows the grammar rules of several foreign languages and can realistically fake me being a native of that language attempting English. Bonus points for a "proficiency" parameter.

</comment></comment></comment><comment><USER12> It still hard enough to get ahold of them one at a time paying full price. They are definitely not at the "free samples and thousands of orders" stage. As I understand it, the foundation doesn't even directly control production. Even if "Steve" had been reasonable, it's a perfectly understandable policy.

Those interested in samples and big orders would be much better off talking directly to the distributors.

</comment><comment><USER13> Repeatedly hustling someone over $35? Seriously???

</comment><comment><USER14> I suspect "Steve's" address is in Nigeria.

</comment><comment><USER15> charging someone $1 to have a chat with the director may be a good tactic to weed out the riffraff.

<comment><USER16> Make a puzzle game that people have to complete before they can talk to you, with variable difficulty levels for when you are feeling particularly anti- social.

</comment></comment><comment><USER17> The sound of a collective face-palm rolls like thunder through the hills...</comment>


Anyone else see "Unknown or expired link." after writing a long comment? - <AUTHOR>

Sometimes when I spend a lot of time writing a comment I click "submit" and it takes me to the "Unknown or expired link error page".<p>It's a little annoying having to go back, copy my post, go back again to the story, then click "reply" and post the whole comment again. <comment><USER2> Yes, this is a known "feature" of HN.</comment>


The Man Who Preserved Decades of NBA History - <AUTHOR> http://fivethirtyeight.com/features/meet-the-man-who-preserved-decades-of-nba-history/

<comment><USER2> What a legend. I love reading about works of obsession and solo perseverance over time.

<comment><USER3> I remember reading a similar story about the person who created IMDB - for a long time, he was updating the site by himself, before it was sold. I can't find the link though.

There was another person who wrote hundreds of webcam drivers, for Linux - [http://www.theinquirer.net/inquirer/news/1047633/one- writes-...](http://www.theinquirer.net/inquirer/news/1047633/one-writes-linux- drivers-235-usb-webcams)

</comment></comment><comment><USER4> Sometimes the best computer is human brain.</comment>


RIM tries to attract BlackBerry 10 developers with awful music video - <AUTHOR> http://venturebeat.com/2012/09/25/rim-bb10-music-video/

<comment><USER2> Instead of this low-quality garbage, why not post something newsworthy about BlackBerry 10, like the first look at their next OS? [http://www.theverge.com/2012/9/25/3386444/blackberry-10-beta...](http://www.theverge.com/2012/9/25/3386444/blackberry-10-beta-3-hands- on-photos-video)

<comment><USER3> Looks very "android-y" from that video. I'm not sure how they going to differentiate.

So far it seems like the Windows Phone stategy of "cool and different" isn't working, so maybe BB's strategy is to have consumers thinking that BB 10 and Android look and act similar, so they might as well go with either one!

<comment><USER4> They can android apps on the playbook. Having a Android like styling, makes the foreign apps look more native.

</comment></comment></comment><comment><USER5> > RIM CEO Thorsten Heins guaranteed developers that their BlackBerry 10 > applications would make at least $10,000 in their first year. If those apps > don't generate $10,000, Heins said RIM would make up the difference.

Wait. That can't be right. Last I heard, you had to make $1,000 on your own first. Is this new item a misquote, or can I release a free app, get 0 downloads, and have RIM pay me $10,000 a year later? No way, it's gotta be an incorrect quote.

Edit: They updated the article with sources. The situation has not changed. "Any developer that makes $1,000 from a BlackBerry 10 app submitted by January 23rd is eligible for a payout from RIM for up to $9,000."

<comment><USER6> Are there other restrictions? What's to stop someone from putting together _some_ thing and putting it on the store for $1000, having a friend buy 1 copy (which makes $1000 in sales for your company), then split the $9000?

<comment><USER7> They need to be certified by RIM ahead of time.

This is a no lose situation for RIM.

      A) They only certify Apps that pass their arbitrary quality test.
      B) They don't have to market your apps initially.
      C) If you can get enough money from your likely already reasonably
         quality apps, then RIM can then market them in the store,
         and easily push you over the $10K line.

Everybody comes out a winner. Very difficult to game, though.

<comment><USER3> "...then RIM can then market them in the store, and easily push you over the $10K line."

I don't quite agree with the assumption that their app ecosystem will be popular enough to make this happen "easily". First let's see if BB 10 is released successfully...

<comment><USER7> Just have them as a featured app (or whatever Blackberry's version of that will be) for a few days - it would be pretty hard _not_ to be pushed over the $10K line. And, if a couple days as a featured App won't get you $10K, then RIM is dead, and this is all for naught anyways. An extra $10K for the 900-1000 developers they chose won't make a difference one way or another.

</comment></comment></comment></comment></comment><comment><USER8> In my short 5 year career as a software developer, my absolute lowest point was working with Blackberry creating applications.

This was around July 2010-ish.

The development environment: Sucked. Eclipse with some rubbish plugins that didn't work all the time.

Each change in the UI, I had to compile, publish to my BB device (which took about 20 minutes each time) and see how it ran there because the simulator was nowhere near to the actual representation on the phone.

Using Java to make BB apps wasn't so bad, I mean, I was only used to C# at that point, and the transition wasn't that painful. It was the god damn awful developer tools.

I wouldn't go back to making Blackberry apps ever again; I value my happiness much more these days and I can afford to pick and choose my jobs.

I wonder if they have made things easier this iteration. It's been 2 years since I've seen things in the ecosystem after all.

My absolute favorite platform to make Mobile apps is Windows Phone 7 (I hear 8 is pretty much the same). You just can match the developer tools for it. It's so simple.

<comment><USER9> You were targeting the Java devices (probably BB5, BB6?) Unlike those devices, the BB10 devices (like the Playbook) are based upon the QNX OS and so the overall development experience is significantly better. But don't just take my word for it, click any of the BB10 links that talk about the development experience for a more in depth discussion.

<comment><USER10> I watched a friend write an app for the playbook, and he kept firing up a virtual machine to do something. Why would the dev environment need a virtual machine running every time you need to run a test?

<comment><USER11> Because you need to test it in the actual runtime environment, not your machine? That's how mobile development works.

</comment></comment></comment></comment><comment><USER12> Looked at in an alternative light, this video can be seen as rather courageous. It acknowledges the problems that developers for the BB platform have faced, and directly addresses some of the doubts and fears developers must be experiencing. For example:

* "A whole new mobile platform may be one tough proposition" * "And though I know you're all wondering, when? It won't be forever."

I'm not really all that opposed to the rather human and self-deprecating approach taken here.

<comment><USER13> Agreed. Thought it was clearly a self deprecatory parody. And putting Steve Jobs on guitar was a nice touch.

<comment><USER14> Yep, clearly tongue in cheek.

</comment></comment></comment><comment><USER15> This story has just the right mix of condescension, editorialization, and an absence of meaningful journalism.

Forgive my cynicism but do a search for RIM or Blackberry 10 on HN and its easy to see why this is on the front page instead of something discussing the merits and flaws of the OS that was shown during the keynote today.

</comment><comment><USER16> This is definitely material for a future version of "N years of high tech marketing disasters", which, by the way, is a pretty good - and entertaining - look at the history of computing from the point of view of the various errors and screwups along the way: <http://www.amazon.com/dp/B001G0OANQ/?tag=dedasys-20>

I think the other commenters are right that we ought to be focusing on the technology that they are releasing. And yet, sometimes something like this is really emblematic of what is otherwise a long, drawn out, slow motion failure without any really moments where it's easy to say _that_ is when things blew up.

 _Edit_ incidentally, I went and had a look at the links showing actual information about the launch, and I don't see anything that would cause me to switch from Android.

</comment><comment><USER17> The casual negativity in the headline is really too bad. I kind-of enjoyed the video, even though I'd been primed not to.

</comment><comment><USER18> Went to BlackBerry Jam in Waterloo with a co-worker who did a co-op at RIM previously. They played a similar music video and the key joke from my co- worker was "The cost of that music video could've paid the salary of the guy who used to be beside me."

<comment><USER19> If this video gets the ball rolling in getting bb10 a chunk developer mindshare - and we are talking about it - then it's likely worth the cost.

<comment> SG- why would this video get any ball rolling?

</comment></comment></comment><comment><USER20> Genuinely the saddest marketing stunt I've ever seen.

<comment><USER21> Nah come on. Why so serious. There's worse music in the charts. This is kind of cute.

</comment></comment><comment><USER22> Wow. VB wastes no time in editorializing, it's right there in the headline.

</comment><comment><USER23> Was the video that bad really? I didn't even know about BB10 at all (I honestly didn't even know it still was being made). I'm not going to watch it again, but I wouldn't call it awful.

</comment><comment><USER24> I never understood why companies think developers would care for their platforms with such type of videos.

</comment><comment><USER25> I feel bad for them. I mean, at least they're trying.

Maybe I'll make a pity app.

</comment><comment><USER26> I found this video funny

</comment><comment><USER27> RIM should probably cut the crap and laser-focus on whatever the hell it is they're good at, instead of trying to battle apple, google, and microsoft. This video just makes the blackberry seem pathetic, and who would want to develop for a pathetic platform?

</comment><comment><USER28> Tongue in cheek or not, it reeks of desperation.

If I developed for the Blackberry, this would increase my skepticism that RIM will be around for a long time, and thus make me less inclined to continue developing blackberry software.

</comment><comment><USER29> A very desperate and sad move by RIM. It's decision making like this that continues to cost RIM jobs.

</comment><comment><USER30> These videos tend to go viral - just for the wrong reasons.

</comment><comment><USER31> All I can say is they have hit Rock n' Roll bottom.</comment>


History of Teaching Machines - <AUTHOR> http://teachingmachin.es/timeline.html <comment><AUTHOR> In case it's not clear from the timeline, this is part of a larger project by Audrey Watters, writer of the fantastic Hack Education blog ([http://hackeducation.com/](http://hackeducation.com/)).

 _Teaching Machines_ is the title of her forthcoming book, to be published by MIT Press.

</comment><comment><USER2> Wasn't expecting to see Sesame street on the list. You could indeed argue its a system for broadcasting information to young children. But by that definition would a teacher with a standardized textbook not apply as well (only less technologically advanced as it uses paper instead of radio waves)?

I fondly remember the first time I did a computerized spelling exercise at school. Especially in what I didn't learn (spelling) and what I did (Windows 1.0 when I minimized the application and started clicking around).

<comment><USER3> If sesame street is in, then every puppet or shadow show going back to prehistory is also a teaching machine.

<comment><USER4> Well no, Sesame Street was explicitly designed for engaging and teaching young children. Significant research and testing went into production to validate.

</comment></comment></comment><comment><USER5> AH Thanks for sharing this. SUPER fascinating. I've always loved B.F. Skinner (1955) after I learned about pigeon superstition from the intro to Mr Nobody.

[https://www.youtube.com/watch?v=Ye5D1qdTh4Q](https://www.youtube.com/watch?v=Ye5D1qdTh4Q)

<comment><USER6> Make sure you've watched Mind Field episode about replicating Skinner Box experiment on humans. (It's probably for YouTube Premium accounts only, but really worth it)

[https://youtu.be/BR-eMMCp7tg](https://youtu.be/BR-eMMCp7tg)

<comment><USER5> Thanks for the heads up.</comment></comment></comment>


Why you should care about your Swift compile time – Medium - <AUTHOR> https://medium.com/@ivanbruel/why-you-should-care-about-your-swift-compile-time-f69f9054610c#.aof5q1xov <comment><USER2> Or don't use crappy dependancies.

While you're at it you may want to not use swift and instead learn to write good C for performance minded code and compilation.</comment>


Ask HN: How do you approach salaries for distributed/remote teams? - <AUTHOR> As I spend time across tech companies, I find myself questioning the efficacy of different salary strategies.
A few that I've seen in the wild: a. Pay top dollar (probably confined to FAANG and the well funded/profitable) b. Aim for the market rate for the geographic area the employee is located in c. Come up with a band and leave it for prospective employees to negotiate (read: most people are terrible at negotiating their own salaries) d. Know what they can afford, regardless of location, and pay the higher of the candidates expectations or the budget
I personally find myself having an issue with b and c most of the time. It might be utopian, but I like people I work with and those who work for me to make the most they can.
As for myself, I have lived in very expensive cities and relatively cheaper ones. What remains consistent is my saving/investment rate, I have an absolute minimum ($) and a relative ideal (%), and adjust my standard to achieve this.
It seems logical that some cities might have a premium attached to the salary (SF and London come to mind). But is discounting acceptable?
Think two engineers providing equal value to the company, one working remotely in Toronto and another in Bucharest.
How do you navigate salaries?
context: Besides advocating for employee salaries at companies I've been affiliated with, I see myself taking a more active role in this area in the near future for some time to come.
This is my attempt to hear from peers and to better establish my foundational principle on this topic. <comment><USER2> I'm all about paying above market rates, you get what you pay for and it's not a linear scale, probably more like an activation function.

There is an interesting idea that seems to be working well. That is salary transparency. Everyone in the company knows how much everyone else makes. It instantly removes gender / race / negotiation skills as a difference maker. Geography seems like it would benefit, and that some amount of cost of living adjustment ought to be incorporated, though perhaps how you do this encourages behavior in some direction.

</comment><comment><USER3> There are no right or wrong answers to this. It can be pro-rated for the cost of living, pro-rated to the cost of market (GitLab approach) or just a standard rate that's below SF market.

You can pay $60k to a senior engineer in an emerging economy and he/she will be super happy about it because that is way above market in his/her country. Regardless of which method you used to get to that number.

<comment><AUTHOR> Thanks for that, led me to discover Gitlab's compensation page!

Gitlab's documentation on this topic is fantastic: [https://about.gitlab.com/handbook/total- rewards/compensation...](https://about.gitlab.com/handbook/total- rewards/compensation/)

Admittedly, I hadn't considered the golden handcuff angle which seems very relevant!

<comment><USER4> It's not as well-documented as Gitlab but you can check Buffer too:

[https://buffer.com/salary/senior-data- architect-2/average/](https://buffer.com/salary/senior-data- architect-2/average/)

I think the most thoughtful/fair approach is to use more than one factor: role, years of experience, costs of living (having kids? big or small city? etc.) and loyalty (how many years in our company?) are the most important factors that come to my mind...</comment></comment></comment>


[pdf] Java Structures - Data Structures in Java for the Principled Programmer - <AUTHOR> http://www.cs.williams.edu/~bailey/JavaStructures/Book_files/JavaStructures.pdf

<comment><USER2> This is an entry level book, it should be called Data Structures for Beginners (presented with Java).</comment>


Show HN: MarketMatrix, an intraday stock trading assistant for the iPad - <AUTHOR> https://itunes.apple.com/us/app/marketmatrix-us-stocks-etfs/id923669120

<comment><AUTHOR> Hi HN, I'm a day trader who wrote this app during the times when the market is closed. I'm trying to build an app over time that becomes an extension of the apps that I run on the desktop, and this is what I have so far. In the future, I'd like to get some direct broker data connectivity and deliver signals to the tiles in the app, but I wanted to get a feel for how others interacted with the user interface.

I wrote a quick summary set of the features over here on a blog, [http://marketmatrix.edgecapture.com/blog](http://marketmatrix.edgecapture.com/blog) . Your feedback is more than welcome.

Thanks all.</comment>


GNU Screen: an introduction and beginner's tutorial - <AUTHOR> http://www.kuro5hin.org/print/2004/3/9/16838/14935

<comment><USER2> Stop using Screen. Switch to Tmux (<http://tmux.sourceforge.net/>). Screen is voodoo. Tmux isn't.

EDIT: Compare my tmux.conf (<http://pastebin.com/m2394d7a2>) and my screenrc (<http://pastebin.com/d7bb649a5>). It was much easier for me to set up tmux the way I wanted from reading the manpage, than it was to configure screen. My screenrc is a hotchpotch of cut-and-paste from lots of different sources, but I never really understood screen. Maybe that's just me.

<comment><USER3> Screen has a very large chunk of the potential market share for this sort of utility app. Tmux is going to have to be 10 times better to get people to switch. ("Screen" also has a name that's easy to remember, and to spell.)

Is tmux 10 times better than screen? Cause that's what it's going to take to get people to switch at this point.

<comment><USER4> Not 10 times, no. On the other hand, tmux is improving quickly; if not every day, at least every week. screen, on the other hand, seems pretty stagnant.

<comment><USER5> That's because screen does what most people who use it want. I haven't used "new" functionality in newer versions of screen since I first started using it years and years ago.

</comment></comment></comment></comment><comment><USER6> The day I learned about Screen...It was pure bliss..it solved so many problems I didn't know I had.

Copy/pasting, Switching between workstations while working remotely all without losing your spot. Collaboration.

If you don't know about screen, and you find yourself using a CLI even just a little bit, you should take the time to learn it.

<comment><USER7> First thing I install on solaris, probably my favorite unix tool also ;) Can't imagine doing giant database imports without it.

</comment></comment><comment><USER8> Screen has a hell of a learning curve.

If you're a beginner to screen, consider byobu. It's a user-friendly wrapper around screen with intelligent defaults and a discoverable menu-based configuration system. It's also very pretty :)

Screenshots: [http://unixlab.blogspot.com/2009/11/enhancing-terminals- with...](http://unixlab.blogspot.com/2009/11/enhancing-terminals-with-byobu- on.html)

Project: <https://launchpad.net/byobu>

</comment><comment><USER9> Does anyone use screen and vim to pair program? Me and my co-founder tried to by ssh'ing into a common box, doing 1) screen -S pairprog 2) ctrl+a :multiuser on 3) ctrl-a :acladd username. However the second person always gets an error with something regarding multiuser

<comment><USER10> I've done it a few times with just step 1. I'm not a screen expert, but for whatever reason we didn't need 2 and 3

<comment><USER9> I'll give it a shot thanks! edit; thanks it works!

<comment><USER10> I'm glad to hear it worked out. It's been quite helpful the few times I've needed it

</comment></comment></comment></comment><comment><USER11> By coincidence I decided to properly configure screen yesterday, getting rid of the two stupid defaults that it comes with:

<http://rwmj.wordpress.com/2010/02/01/screen/>

</comment><comment><USER12> While we are talking about screen - I'd really like to be able to highlight text in VIM (using the visual mode) and then be able to paste that into another screen. Does anyone know how to do this?

<comment><USER13> ScreenShell. It leverages screen to create a viable REPL-buffer for vim, for any language that has an interactive interpreter.

<http://www.vim.org/scripts/script.php?script_id=2711>

Here's an article describing how to use it with lisp:

[http://www.ktaylor.name/2009/11/vim-screen-lisp- programming-...](http://www.ktaylor.name/2009/11/vim-screen-lisp-programming- environment.html)

And finally, some key mappings to bind <C-c><C-c> to sending the current paragraph or selection to the interpreter, from any mode.

<http://gist.github.com/278733>

<comment><USER14> Found this about a week ago and am loving it. Almost all of my time is spent in Python or LaTeX, and having either ipython or bash open in a small window just a keystroke away is brilliant!

</comment></comment></comment><comment><USER15> dtach is a lightweight, minimalist alternative.

<http://dtach.sourceforge.net/>

<comment><USER16> Saying dtach is a minimalist alternative to screen or tmux is like saying notepad is a minimalist alternative to visual studio.

</comment></comment><comment><USER17> It's worth grabbing the latest version of screen from git and installing it. That way you get vertical splits with _ctrl-a ctrl-|_. If you're running a new version of Ubuntu, you already have this.

Building screen isn't too hard. Run the autogen.sh script to generate the configure script.

</comment><comment><USER18> I love love love screen, but ctrl-a is a terrible binding. ctrl-] works well for me.

I'm going to check out this tmux thing.</comment>


Why I Switched from Ubuntu to Manjaro (Arch Linux) – Matthew Haffner - <AUTHOR> https://mhaffner.github.io/post/arch-linux/ <comment><USER2> I switched to fedora for similar reasons, still has version upgrades but more frequent and dnf in practice makes it pretty painless.</comment>


Would Anonymity Help Activists On Facebook? Maybe Not - <AUTHOR> http://www.rferl.org/content/would_anonymity_help_activists_on_facebook_maybe_not/2317476.html <comment><USER2> I agree that everybody (not just activists) should be allowed pseudonymity on Facebook. But his argument that "it could lull many into a false sense of security, encourage complacency, and actually put people at more risk" is just silly. Activists are using Facebook today; giving them more rights can only help them.

</comment><comment><USER3> Surely the common sense solution is to keep the no-pseudonyms policy but use some discretion and not ban peaceful pro-democracy protestors whose passive protest group was favourably received by the world's media.

<comment><USER2> It seems to me the common sense solution is to remove the no-pseudonyms policy, which in addition to activists also impacts domestic violence survivors, authors, performers, transvestites, whistleblowers, and many others.

<comment><USER3> Doing that also legitimises fake celebrities, sockpuppets and dedicated stalking accounts. It's pretty fundamental to Facebook's value proposition that the identities (usually) represent a graph of real people and their social relationships and interests (more or less the opposite of the sometimes intentional anarchy of popular internet fora)

I don't think authors and performers who are offered the more appropriate option of Facebook fan pages or domestic violence survivors who connect under a single assumed name have too much to worry about from Facebook policies applied reasonably.

<comment><USER4> So this means there is a business opportunity for another social networking site that can both offer pseudonyms as well as deal with the problems you mention (which btw, are not exactly solved by Facebook's policy, though they are discouraged).

I agree Facebook is unlikely to ever rescind their "real name" policy.</comment></comment></comment></comment>


Ask HN: What's your IQ? - <AUTHOR>

<comment><USER2> Enough to know that IQ is a poor measure of intelligence.

</comment><comment><USER3> Over 9000.

</comment><comment><USER4> Absolutely no idea.

</comment><comment><USER5> foobar

</comment><comment><USER6> 132</comment>


Opening *.txt file is dangerous on Windows - <AUTHOR> http://technet.microsoft.com/en-us/security/bulletin/ms11-071 <comment><USER3> The report says this vulnerability is specific to remote network shares and WebDAV. All you have to do is send someone a link to a .txt file on a WebDAV site with a .dll in the same directory, I guess, and they'll be owned... That is pretty awesome.

(As was commented on below, this is identical to an LD_LIBRARY_PATH type exploit on Linux; here is Microsoft's fix as well as an explanation of how it works <http://support.microsoft.com/kb/2264107>)

Edit: I realize now literally any URL could be a WebDAV site with a text/plain mime type and an exploit DLL in the same dir. So really, every single URL you hit with IE is potentially vulnerable. Have a nice day.

<comment><USER4> Except that LD_LIBRARY_PATH is not a type of exploit and shouldn't be mentioned as such.

<comment><USER5> Not in itself, but if you can manage to change it for someone without their awareness you have basically tricked them into running arbitrary (local) code.

<comment><USER4> The thing is that someone has to execute some code to change it, and if so then malicious code has already been run. By then it is irrelevant if LD_PRELOAD_PATH will be used or not. If I trick you into running 'rm -fR *', does that count as an exploit?

<comment><USER6> _"The thing is that someone has to execute some code to change it, and if so then malicious code has already been run."_

Wrong. You could have at least googled "LD_PRELOAD exploit" before writing this.

Setting LD_PRELOAD does not require running your own code. A real life exploit using LD_PRELOAD took advantage of a weakness in telnet server that let the connecting client export environment variables (yup, even before logging on - no local login required). Write access to a directory visible by telnetd was enough to plant own malicious *.so and then gain root access by exporting LD_PRELOAD via telnet.

<comment><USER4> So, again, the exploit was that a telnet session was exporting environment variables. LD_PRELOAD_PATH was just a way to take advantage of the telnetd exploit, which might not be the only way. I think that naming it "The LD_PRELOAD_PATH exploit" is just misguiding.

<comment><USER6> _"So, again, the exploit was that a telnet session was exporting environment variables."_

No, this was a feature. It had been safe in the days of static libraries, it became a problem when the LD_something family of variables was introduced. Besides, the telnet was just a single vector of introducing the LD_. Other examples concern local privilege escalation by calling suid apps:

[http://xorl.wordpress.com/2009/12/01/freebsd-ld_preload- secu...](http://xorl.wordpress.com/2009/12/01/freebsd-ld_preload-security- bypass/)

<https://www.kb.cert.org/vuls/id/686403>

So there definitely exists a family of exploits that rely on bypassing the usual checks on LD_PRELOAD (and other similar variables) to inject malicious lib into protected code.

<comment><USER4> > No, this was a feature. It had been safe in the days of static libraries, it > became a problem when the LD_something family of variables was introduced.

So? Still a bad design in the telnetd's part. If it wasn't LD_ variables it would have been something else eventually.

> So there definitely exists a family of exploits that rely on bypassing the > usual checks on LD_PRELOAD (_and_other_similar_variables_)...

Yes, ofcourse, every issue of environment mishandling would lead the exploiter to utilize LD_PRELOAD, it's the easiest but not the only way. Even without LD_PRELOAD, those bugs would still be a liability for compromising security or normal operation of the system. And just like any part of any OS, ugly bugs will come up now or then.

But it is far too much to compare the casual use of LD_PRELOAD to the brain damaged/stupid handling of dynamically loading libraries Microsoft's Windows have. Actually, LD_PRELOAD is a needed feature (eg. for binary package distribution) that at least provides one layer of protection, it is the opposite of blindly loading any library found in non system folders.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.

<comment><USER8> I wonder if Notepad, Wordpad, and maybe Word all call some library (or all have copy/pasted code) that, for whatever reason, looks for a particular DLL in the working folder and executes it?

Not sure how the network drive part would fit into that hypothesis, though.

<comment><USER9> The article doesn't mention it, but does anyone know if a requirement to reproduce the vulnerability is that the files be opened in Notepad, Wordpad, or Word? What if you used a third-party editor?

<comment><USER10> I'm guessing it's actually a bug with Explorer (that is, the actual opening action) than any particular editor, since RTF files are also affected - <USER2> doubtlessly many other file types.

<comment><USER11> It's not Explorer, it's a bug with the Win32 API that loads DLLs. Any program that uses Win32 to load libraries is affected.

<comment><USER12> Not true, see here:

[http://msdn.microsoft.com/en- us/library/ms682586%28v=vs.85%2...](http://msdn.microsoft.com/en- us/library/ms682586%28v=vs.85%29.aspx#search_order_for_desktop_applications)

The vulnerability, as I understand it (I did a little research by examining one of the vulnerable applications), since we don't have any actual PoCs to examine:

notepad.exe, like many of the stock Windows apps, uses a bunch of system libraries. One of those system libraries loads shdocvw.dll (an Internet Explorer related component). shdocvw.dll has a delay-load dependency on a library called 'ieshims.dll'. On my computer, when I start notepad.exe, shdocvw.dll tries to load ieshims.dll, and fails, but continues normally.

This means that since ieshims.dll is not found in the app directory or the windows system directory, the search for it will continue all the way into the current working directory, which would make it possible for an exploit to put a payload in an 'ieshims.dll' stored in the current working directory (next to the .txt file), and it would then be loaded.

Assuming my research is correct, this looks like a security vulnerability introduced by one of the Internet Explorer developers, probably for some sort of compatibility purpose. They ignored the fact that IE is used as a component in many system applications, and basically added a vulnerability to every app using shdocvw (there are a lot of them).

</comment></comment></comment></comment></comment></comment><comment><USER13> So basically send someone a zip file with a DLL + readme.txt. Most people would avoid the DLL but not think twice about opening the readme. Sounds nasty.

<comment><USER14> From the "Mitigating Factors" section of CVE-2011-1991:

"For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application."

Since a ZIP file would extract to a local directory, nothing would happen.

<comment><USER15> If you extracted the TXT+DLL locally, then you'd be vulnerable, because the problem is that the TXT file is the current directory, and something (WordPad and Notepad, maybe, or Explorer itself) is searching for a DLL that doesn't exist elsewhere on the system, and one of the places searched is the current directory.

All the stuff about WebDav being necessary for a successful attack is because they're assuming someone can't drop a DLL onto your system. But if you unzip a package with a README.txt in the same folder as a DLL you would be vulnerable.

</comment></comment></comment><comment><USER16> It remember me of an old stack overflow that I posted just running the command cat: <http://seclists.org/bugtraq/1999/Sep/432>

</comment><comment><USER17> I wonder if this was in use (for legitimate uses) by anyone prior to its omg- security-breach discovery, and if their use still works. Quite a few Windows applications look in their folder first for DLLs - checking the loaded-file path could conceivably make the same kind of sense. Or just not accounting for current-directory changes when launching with a file (not entirely sure what the behavior is there).

</comment><comment><USER18> The description of the vulnerability reminds me a lot about how Stuxnet exploited weaknesses with shortcuts unknowingly loading a malicious dll.

</comment><comment><USER19> This reminds me of hacking ANSI.SYS escape sequences back in the day. You could create a text file which would be "executed" when someone entered "type readme.txt" at the DOS prompt, by using keyboard remappings and so on.

I remember creating a fairly unsuccessful "text file virus" that would try to copy itself around our school network and reboot people's machines. Good times...

</comment><comment><USER20> I think this vulnerability is related to WebDAV and SMB, not the DLL/path issue mentioned.

</comment><comment><USER21> I wonder if this is still an issue when using a 3rd party editor, such as EditPad, etc.

</comment><comment><USER22> Has this been fixed since this was posted? Either way, the title is inaccurate now. This is only dangerous if you haven't installed the update.

</comment><comment><USER23> details here:

[http://blog.acrossecurity.com/2011/05/anatomy-of-com- server-...](http://blog.acrossecurity.com/2011/05/anatomy-of-com-server-based- binary.html)

</comment><comment><USER24> It is not dangerous if you install the update. Why is the headline hyping it as if it's an unpatched zero day?

</comment><comment><USER25> MISLEADING TITLE!

</comment><comment><USER26> Isn't everything about Windows considered dangerous anymore? Has there ever been such problem-stricken piece of software?

</comment><comment><USER27> Clicking "start" is even more dangerous. Once you start, can you stop?</comment>


GM's Cruise Automation Is a Fiction - <AUTHOR> https://www.theinformation.com/articles/inside-cruises-bumpy-ride-the-limits-of-self-driving-cars <comment><AUTHOR> I work at Cruise. The technology is worse than the article says it is. Much worse.

<comment><USER2> At least Cruise is not false advertising and scamming people into buying any vaporware like Tesla...</comment></comment>


The Serious and the Smirk: The Smile in Portraiture - <AUTHOR> http://publicdomainreview.org/2013/09/18/the-serious-and-the-smirk-the-smile-in-portraiture/ <comment><USER2> _With an ISO of about 1, it's not uncommon for exposure times to fall in the 5-10 second range, even in broad day light. Smiling is not recommended for these long exposure times._

\-- Fernando Ramirez, _Making tintypes_

[http://nondo.net/blog/?p=486](http://nondo.net/blog/?p=486)

<comment><USER3> Yes that was my guess upon reading the headline. I was surprised they did not even mention this.

<comment><USER4> It's mentioned, just not in the context of early photography:

      When a camera is produced and we are asked to smile, we
      perform gamely. But should the process take too long, it
      takes only a fraction of a moment for our smiles to turn
      into uncomfortable grimaces. What was voluntary a moment
      ago immediately becomes intolerable. A smile is like a
      blush – it is a response, not an expression per se, and
      so it can neither be easily maintained nor easily
      recorded.

</comment></comment></comment><comment><USER5> This is close to blogspam. I think the source article is better: [http://publicdomainreview.org/2013/09/18/the-serious-and- the...](http://publicdomainreview.org/2013/09/18/the-serious-and-the-smirk- the-smile-in-portraiture/)

<comment><USER6> Petapixel is all blogspam, they appropriate a _lot_ from their sources, including rehosting photographs they don't have the rights to. The amount of content they take from their sources seems to go well beyond the typical "quote and link" blog format.

</comment></comment><comment><USER7> > By the 17th century in Europe it was a well-established fact that the only > people who smiled broadly, in life and in art, were the poor, the lewd, the > drunk, the innocent, and the entertainment.

Not sure this explains it all. Maybe later not smiling got established as the style of portraiture of high class because the high class was the only to have portraits in the first place, but doesn't explain why they didn't smiled in the early days.

The best explanation I heard about this was technical: old photos had long exposure, and holding a perfect smile for long is tiring.

<comment><USER8> Take a look the portrait paintings here: [https://en.wikipedia.org/wiki/Portrait_painting](https://en.wikipedia.org/wiki/Portrait_painting)

Barely any smiles either. And paintings don't have the long exposure time of photographs. Sure, you would have to pose for an extended amount of time, but a talented painter could apply any facial expression he chooses from a quick sketch.

</comment></comment><comment><USER9> In modern (as opposed to old) photography, smiling is often forced and awkward. As a serious photographer, I don't like posed photos at all, except from people who are comfortable and expressive while modeling. For most people, I prefer candids. And in my candid work (which isn't necessarily representative of the world at large), people tend to either look serious, or be laughing. Smiling is less common.

<comment><USER10> Thinking of your portrait subjects, even in the most formal portrait setting, as "modelling" is starting at the wrong end. Personally, I'd like to see the word _model_ eradicated from the ordinary photographer's vocabulary; we have had the perfectly good _subject_ and _sitter_ to work with for longer than we've had photography. A model is just that — a stand-in for a "real" person (or persona). It's a job that people can be good or bad at, and when we think of our "real people" subjects as models, we immediately expect too much of them.

The root _portray_ in the word _portrait_ , on the other hand, is one we should pay more attention to. As photographic portraitists, we don't have the luxury of creating an expression that represents the essence of the subject from a (relatively) long period of observation; we need to elicit and capture a person's natural expression (sometimes one that fits a target portrayal) under conditions that are anything _but_ natural. That's people skills, not camera or lighting skills, and those skills can be learned. (If you want a quick but not-so-cheap lesson in basic technique, it might be worth checking out Peter Hurley's video _The Art Behind the Headshot_. As a photographic technician, he's merely competent, but he's good at waking people up and making them themselves.)

<comment><USER9> I agree that model work (and I don't have a problem with the colloquial meaning of "model") is fundamentally different from formal portrait. But that said, I do actual models and studio photography quite a bit.

Even when using models, I'm generally after some essential expression of personality. The difference between a good model and an ordinary sitter is that they can achieve direct expression directly and comfortably, and through indirect means (such as playing a role or wearing a costume).

</comment></comment></comment><comment><USER11> My in-laws are definitely not American (they're East Asian) and grew up as young children at the tail end of a rather serious war which killed several million.

My Father-in-law is quite genial and smiles quite often in person, never in a photo. My mother-in-law usually doesn't smile in photos either (despite being an incredibly warm person who smiles and laughs quite a bit), but she smiles enough that there's a photographic record of her smiling exists.

But, I've never taken a photo of my father-in-law or even seen one where he is smiling. In family portraits everybody has a nice warm smile, except for him. He looks like he's attending a funeral.

It's funny because the photos of my mother-in-law, the ones where she's smiling, seem to capture her personality much better than the ones where she is not. And you'd never guess at the personality of my father-in-law from a photo at all.

About 2/3s of people of my wife's generation generally smiles. And pretty much 100% of the next generation smiles.

</comment><comment><USER12> I had always assumed that it was due to the long exposure times of early photographic techniques such as the Daguerreotype.

Specifically, since photographic skill was in short supply, and people with equipment had bad experiences with blurry faces when people couldn't maintain their smiles long enough for the exposure, that a trend emerged advising people not to smile.

Then, as this trend became firmly entrenched and everyone forgot the original reason, an idea was collectively conjured that it simply wasn't "fashionable" to smile in a photograph.

</comment><comment><USER13> The question could be asked in another way: why do Americans smile so much in photographs, compared to many other cultures? Right now.

This research seems quite insular.

<comment><USER14> I've met a lot of people from a lot of different cultures, and all of them tend to smile in photographs. Can you list a few where smiling in photos is odd?

</comment></comment><comment><USER15> I've heard some Americans that work with Russians comment that they actually feel this way about smiling during the day at work. It's a sign that you are an idiot or not taking things seriously or something.

<comment><USER16> Serious doesn't require being bleak, solemn does: [http://www.ted.com/talks/paula_scher_gets_serious.html](http://www.ted.com/talks/paula_scher_gets_serious.html)

</comment></comment><comment><USER17> Does anyone else clearly see a cheeky smile on lincoln's face in 3/4 of those photos?

<comment><USER18> Looking at the uncropped image (from the source link) of the "smirking Lincoln", the smirk disappears [for me] and he simply looks relaxed.

[http://commons.wikimedia.org/wiki/File:Abraham_Lincoln_O-116...](http://commons.wikimedia.org/wiki/File:Abraham_Lincoln_O-116_by_Gardner,_1865.png)

In fact, after returning and looking at the cropped image, he no longer looks like he is smirking at all. Maybe it's the power of suggestion in the article.

</comment></comment><comment><USER19> I don't like smiling at all in photos. It seems so fake, and unnatural. If they do insist on me smiling, I smile as big as I can to the extent it looks more scary than happy. "What? You wanted me to smile?!"

</comment><comment><USER20> In what universe is having a big grin associated with being a humorist? The people in the top half of photos look more _bored_ than serious, but Lincoln and Twain with their set jaws, intense stare, slightly tilted/twisted head and expressive, engaged faces look like they're about to say something either deadly serious or seriously funny.

Those bottom half ones would all be great modern photos, I wish I could capture people like that. Most of the subjects I photograph wind up looking either confused or goofy.

</comment><comment><USER21> _A photograph is a most important document, and there is nothing more damning to go down to posterity than a silly, foolish smile caught and fixed forever. "_

Adding this for posterity: I have such a huge stupid smile on my face to help maintain my privacy.</comment>


We need searching capability on here ASAP! - <AUTHOR>

This site reminds me of old-school Digg. Can we please get some searching though? <comment><USER2> There is also <http://searchyc.com/> (and a few others)

<comment><AUTHOR> Thanks that's useful. Now why can't that be added to this page? I guess I am on Hacker News so I should just roll my own search engine for this.

</comment></comment><comment><USER3> google "searchterms site:news.ycombinator.com"

<comment><AUTHOR> what if i don't want to search for "searchterms"??

*please note sarcasm above</comment></comment>


The story of the youngest (14) CEO of the world. - <AUTHOR> http://timesofindia.indiatimes.com/business/india-business/Globals-Geek/articleshow/9290251.cms

<comment><AUTHOR> His name: Suhas Gopinath</comment>


Police in Ga. shut down girls' lemonade stand - <AUTHOR> http://www.usatoday.com/news/offbeat/2011-07-15-lemonade-stand-shut-down_n.htm

<comment><USER2> Back when I was a kid in the '60s, lots of people suffered from lemonade poisoning at the hands of these unregulated peddlers. It's better that these young girls are now doing dangerous manual labor.

</comment><comment><USER3> When will todays criminals learn that they must have a box of donuts and fresh coffee "complimentary" when they sell lemonade.

</comment><comment><USER4> Stories like this make me wish for a button that says 'Go Viral'---so that I could push it and take the information to everyone. Idiots who create laws without regard to consequence and those 'who just follow orders' are a part of the problem in the Eldridge Cleaver/Charles Rosner sense.

</comment><comment><USER5> Meanwhile an actual crime was committed two blocks away.

</comment><comment><USER6> Seems to be a fairly common (and ridiculous) occurrence: <http://www.cbsnews.com/8301-504083_162-20012899-504083.html></comment>


Woobius Eye, HN user swombat's product, featured on Lifehacker - <AUTHOR> http://lifehacker.com/5503537/woobius-eye-makes-online-communication-visual

<comment><USER2> Thanks, bemmu!

I'll be sure to write a blog post some time soon about how we got TC coverage (about a year ago) and now Lifehacker coverage. It's all pretty serendipitous, but could be an interesting/useful story.

<comment><USER3> Also, would be interested to hear if/how you prepared for the traffic level, and whether or not those preparations worked. (i.e. Did Lifehacker users visit more than just your homepage? How much did you cache?, etc)

</comment></comment><comment><USER4> Congrats swombat!

One of my apps was just featured on Lifehacker as well. The post hit at 11:30am and total uniques for the day were 3,500 the first day and 1,800 the second. I thought they would be a bit higher than that. It would be interesting to compare numbers...

<comment><USER2> I think it depends on the article... my "How to Nap" article which was republished there got 76k hits so far... this one clearly won't get as many, but we've already had about 20 beta sign-ups since the article went up.

<comment><USER4> Those are amazing numbers. What kind of post was it? Was it featured with a large image, or the small thumbnail? Mine was a small thumbnail and was pushed quite a few down the list quickly.

Of my 3,500 visits the first day I converted over 20% though, so I can't complain!

<comment><AUTHOR> That's an amazing ratio, what do you count as conversion?

<comment><USER4> User signups. Unfortunately signups are free. LOL. But I'm working on the paid conversions.

</comment></comment></comment></comment></comment><comment><USER5> That is one of the best demo videos I've ever seen. The background music was sweeeeeet. Congratulations!

<comment><USER2> FYI, the music is by someone called Kevin MacLeod. He publishes Royalty Free music here:

<http://incompetech.com/m/c/royalty-free/>

</comment></comment><comment><USER6> It seems the writings were sped up or the users were using tablets. It sure seems a neat program, but I doubt I'd ever use it to write anything. Maybe for using during a call, for example?

<comment><USER2> That's a very typical use case, actually. If you're on a phone or Skype call and you catch yourself saying stuff like "You see that link on the page, third one from the right at the top? Yes, the blue one, not the magenta one. Can we move it to right beneath the bit of text next to the picture of a monkey?" try firing up Woobius Eye instead. You'll then be able to just say "Can we move this link here?" Much more efficient conversation, and allows multiple sides to join in easily.

</comment></comment><comment><USER7> Would be great to be able to make the drawing area full screen and/or resize it.

Great app. Fast, simple, effective.

<comment><USER2> That feature is on the way.

</comment></comment><comment><USER8> @swombat Nice video :)

Very interesting.

I personally feel the user experience can be improved more by using draggable vectors for the onscreen drawing. Anti-aliasing would be big bonus too.

<comment><USER2> Thanks. @bobleung put together the video.

What do you mean by anti-aliasing, in this context?

Re: draggable vectors, you mean allowing people to drag their scribbles around?

<comment><USER8> Yes. By AA, I mean smooth edges of the drawings. Pretty much like how Flash does it (or any other vector composing tool). Although not essential, it's a nice feature to have. Just my 2 cents :)</comment></comment></comment>


Official Google Research Blog on Machine Translation - <AUTHOR> http://googleresearch.blogspot.com/2008/09/doubling-up.html <comment><USER2> I know this probably sounds like a troll, but I think a useful translator would be "english -> simple english".

I'd use it on my own documents.</comment>


Stop Stealing Doctors from Developing Countries - <AUTHOR> https://www.scientificamerican.com/article/stop-stealing-doctors-from-developing-countries/ <comment><USER2> People are not the property of the countries they grew up in.</comment>


The Case for Having a Hobby - <AUTHOR> https://www.nytimes.com/2018/05/10/smarter-living/the-case-for-hobbies-ideas.html <comment><AUTHOR> I feel like if I ever have some spare time I have to write code in a new language to keep up with the treadmill. Is it possible to have a family and a hobby? Seems like the only way to get stuff done you like it to get the family to like it too, then it becomes an outing.</comment>


Iptables Basics - <AUTHOR> https://jvns.ca/blog/2017/06/07/iptables-basics/ <comment><USER2> iptables is the standard currently, but I'd suggest learning nftables. nftables is meant to replace iptables everywhere.

It might take time for it to gain the same usage as iptables, but it is currently a drop-in replacement for iptables on many distros. Relevant discussion here: [https://news.ycombinator.com/item?id=14286016](https://news.ycombinator.com/item?id=14286016)

Also: [https://developers.redhat.com/blog/2016/10/28/what-comes- aft...](https://developers.redhat.com/blog/2016/10/28/what-comes-after- iptables-its-successor-of-course-nftables/)

<comment><USER3> Nod.

iptables is old and awful.

nftables has been around for quite some time, and is now part of pretty much all distributions, including Debian. It's way cleaner and easier to use.

There are no reasons to stick to iptables in 2017.

</comment></comment><comment><USER4> It's inconvenient that something so important is so hard to understand and manage.</comment>


xkcd on the comment policy of News.YC - <AUTHOR> http://xkcd.com/438/

<comment><USER2> This is often touted as the solution to comment meanness (even here in HN's guidelines), but I think it's too simple to help. Politeness isn't inherent to real-world interaction: people are mean in face-to-face conversation too.

Of course there is some difference in face-to-face debate. Probably blatant, irrelevant personal attacks decrease, for example. But that is more because they are instant debate killers since the other person will likely just walk away. The more integrated meanness – hostility, caustic zingers, and the overall drive to embarrass your opponent – is definitely still present.

I think the issue isn't the separation between the two people debating: it's that other people are standing around watching. The _publicness_ of comments is what leads to nasty behavior. Comment threads end up not being two people's search for truth, but their attempts to impress and gain audience support. It becomes a performance.

And I don't think people necessarily intend to do it – it's something you sorta fall into. You may realize you're sacrificing any chance to sway your opponents by being mean or embarrassing them, but the thought of a hundred other people admiring your ass-handing abilities or laughing at your stinging zinger can make the sacrifice seem worthwhile.

To help me be a better commenter I don't ask, "What would I say if this was face to face?" I ask, "What would I say if no one else could see this but the person I'm arguing with?"

</comment><comment><USER3> I think the face-to-face rule is a bad one. Even PG in his Things You Can't Say concludes that you shouldn't say certain things to anyone but close friends, valuable though these ideas may be.

Of coure, that only applies face-to-face. If you are anonymous on the internet, as I am on this forum, you don't have to self-censor. And yet, I do it anyway, just because the spirit of conformity and self-censorship permeates this place so much. My comments were better on Reddit, when Reddit was still worth going to. And so were the comments of others.

Quality of the average comment is not what matters. It's the quality of the best comments that does. If you eliminate half of the top 5% and all of bottom 50% of comments, you've made the community worse.

</comment><comment><USER4> The cartoon is cool, like every other xkcd cartoon, but has nothing whatsoever to do with News.YC.

<comment><AUTHOR> "Don't say things you wouldn't say in a face to face conversation." <http://ycombinator.com/newsguidelines.html>

<comment><USER5> Is it really "on news.yc" as much as Buddha's (or whomever) teachings is "on news.yc"? I believe that's swombat's argument.

<comment><USER6> Right. Unfortunately the title evokes "Great Job Redditors! We Got ___ To Do ___!"

</comment></comment></comment></comment><comment><USER7> For future reference, instead of arguing with me, just have your angel put this into her GPS:

Latitude: 40.441333

Longitude: -79.769018

I'll have beer for you and nectar for her.

<comment><USER8> Monroeville, next to the 376 near Pittsburgh huh? Yeah, I digitally stalked you on Google Maps: [http://maps.google.com/maps?q=Latitude%3A%2040.441333%20Long...](http://maps.google.com/maps?q=Latitude%3A%2040.441333%20Longitude%3A%20-79.769018&ie=UTF-8&oe=utf-8&um=1&sa=N&tab=wl)

<comment><USER7> Right. You just won a free beer at the Penn Monroe.

</comment></comment></comment><comment><USER9> I think it's adorable how the karma points went up and down in this thread. Who are you people upvoting and downvoting, because I would really really like to meet you folks face to face.</comment>


Ask HN: how do you process payments? - <AUTHOR> I'm starting to research payment processing systems for my startup, and was hoping to get some feedback from some HN readers who have had some experience with some online merchant service providers.
Which payment processing provider do you use?  And how would you describe the quality of your service?
Google, Yahoo, and PayPal all provide this service, and they all charge similar fees.  How do they stack up against each other?
Also, the ability to charge for recurring payments (subscriptions) is important to me.
Thanks! <comment><USER3> Google Checkout has no customer service, not for merchants at least. No phone number, no email address, just a knowledge base and a forum where GC merchants vent their frustration by making threats and typing in all caps:

[http://www.google.com/support/forum/p/checkout- merchants/lab...](http://www.google.com/support/forum/p/checkout- merchants/label?lid=12de2eed05d80c5b&hl=en)

In addition to the rate hike which now puts them in the same fee range as Paypal, Google Checkout is missing basic functionality.

True story: you can't download your complete transaction history. You can download one day of transactions at a time, but if you want something to give to your accountant at the end of the year, you've got to download 365 .csv files and combine them yourself.

</comment><comment><USER4> I'm in the same boat, here's a little bit of research regarding subscriptions:

1\. PayPal subscriptions are an under-documented mess. I was hoping to get a trial going with their subscription quickie form builder but couldn't figure out how to get return data. I'm sure this is possible, but it all seemed more like it was setup for magazine subscriptions than for online subscriptions.

2\. Zuora is a company that keeps getting mentioned on TechCrunch and had given me the impression it was subscriptions done right, where right is simple API and simple setup. On investigation, they're only open for private beta and they seem more like a "solution" provider where you're going to have to talk to a salesperson to get anywhere.

3\. If you mention Zuora on twitter you will be contacted by a company called Aria Systems. In order to see their API they will say they "need a signed NDA as our API's are mature proven and we guard them like the family jewels."

4\. Spreedly seems a little bare bones but is the only company out of that bunch that seems to share my sensibilities.

I would love to hear an authoritative answer. If you were building a subscription based service like Basecamp, what would you use to start?

<comment><USER5> PayPal's API was actually pretty easy to implement for my subscription service.

PayPalTech has a nice script generator that outputs a simple PHP script that gets data from PayPal's API after a purchase/subscription is processed, I'm a terrible coder and I was able to get all the data I needed pretty easily.

<https://www.paypaltech.com/PDTGen/>

</comment></comment><comment><USER6> We use Braintree (<http://www.braintreepaymentsolutions.com/>), and I've never had a better experience with a service provider. They're consummately professional, know their product and category inside and out, and are eager to educate people on the ins and outs of credit card processing. I had heard at one point that they had a higher rate for services billing less than $1MM a year, but I've since heard that that doesn't apply to SaaS companies that are using Rails (I'm not sure what the definitive answer is on this; I know they were the best price we could find, and I looked extensively).

For recurring billing, we use a Rails-based billing framework called Freemium (<http://github.com/cainlevy/freemium/tree/master>), and have been very happy with it. It integrates with Braintree flawlessly. Also, its primary developer is a freelancer (<http://cainlevy.com/>) who is available for hire, if you're looking for someone to help you get set up. We hired him, and couldn't be happier with his work.

One thing to keep in mind when you're looking for a payment processor is this: How transparent are they with their costs? Do they complicate their fee structure with hidden costs? Credit card billing can be a really complex beast, and having a partner who's interested in helping you make sense of it is very valuable. That's what we found in Braintree. I'm sure there are others that are good, but I'm glad I haven't had to look for them, and that I've been able to just focus on building my business.

</comment><comment><USER7> <http://www.zuora.com/>

<http://www.braintreepaymentsolutions.com/>

<http://aws.amazon.com/fps/>

previous HN thread <http://news.ycombinator.com/item?id=432284>

</comment><comment><USER8> I use Plimus (<http://www.plimus.com>) for ViEmu and Codekana sales (<http://www.viemu.com> and <http://www.codekana.com>). It's very good, and the price is good, too. I used to use share-it (<http://www.shareit.com/>) for a few years, but they were more expensive and less informative.

I'm using them from the EU. ShareIt is based in Germany and Plimus in California, and still Plimus is cheaper.

These are one-time payments only, so no idea how they work with subscriptions. I'd expect them to work fine if they provide the service, they are very professional.

</comment><comment><USER9> Hey...my name is Ed and I'm the founder of Aria Systems (www.ariasystems.com) which we started based on my experience building a very large subscription based service (2.5 Million users). I'd encourage you to think about a few things when creating a subscription based service:

1\. Think beyond taking people's money. Consider all of the use cases (credits, refunds, upgrades, downgrades, partner commissions, activation etc.). This way you can create a great customer experience, reduce cost of acquisition and maybe more importantly reduce the cost of owning a customer.

2\. caveat emptor with payment processors and payment methods. Make sure you understand things like processor fees, reserves, chargeback fees, chargeback disputes and window for chargebacks. Also, please please please treat processors and payment methods separately...almost like different layers in your application. The timing of fund settlement is critical...it may be worth it to pay a little extra in fees for faster cash.

3\. Scale. Volume and velocity of transactions. Some pay methods and merchant account providers only offer a best effort service. Think deeply about your projections, response times of each step in the process vs. your needs. Ask for latency SLA's if you think you'll spike volume at launch or PR etc.

4\. Security. Think about security from a process perspective and don't rely solely on your processor's PCI compliance. Compliance needs to be END TO END!

I hope this was helpful.

<comment><USER10> Great advice but... so? What do you use?

</comment></comment><comment><USER11> I use Authorize.net and am quite pleased with it, though, admittedly, I've never used any other service.

I don't currently accept automated payments through them, though they do have a recurring payment functionality built in. I haven't used Auth.net's recurring payment system.

Before they implemented that, when I was building a service that relied on automatic recurring payments, I built a script that managed it (as the amount could vary from month to month depending on the selected features), and ran it on a cronjob.

It was quite secure as the processing server itself was firewalled from the internet (no way of accepting incoming connections, and operated from my home, away from the data center). Furthermore the data was all stored encrypted in the database (but it didn't survive on the public servers longer than 5 seconds or so). Whenever it processed the payments, it would pipe the output to a file and then to the printer for the hard copy records, resulting in daily printouts of the service.

Unfortunately, my service never went live, but the homegrown recurring payment system ran flawlessly for months (until it was decommissioned, that is).

<comment><USER12> We are using Authorize.net's recurring billing service, and we are very happy with it. Mostly because we don't need to worry about the security issues you mentioned (encrypting, secondary processing server, etc...). Authorize.net stores the c/c info and takes care of it.

Paypal also does that, but we chose Authorize.net mainly because Paypal is not completely behind-the-scenes in the process (I don't remember exactly, but I think PayPal forces you to redirect the user to a PayPal page). Also, Authorize.net is cheaper in the long-run.

The downside of Authorize.net is the account set-up, which is a bit cumbersome. A provider will contact you and you need to describe them how you are going to use the account, etc... Also, I think you need to open a merchant account. It's not painful per se, but you should expect at least a week to get the whole thing up-and-running.

On the upside, Authorize.net gives you access to their test environment in the meantime, so you can do the integration while you wait for your account...

<comment><USER13> PayPal with Web Site Payments Pro can be completely behind the scenes. You create a recurring payments profile, that has a profile id, you use that to reference it in the future (to cancel it for example).

PayPal also does not require that you setup a merchant account. All you need is a bank account. It's $30/mo for Web Site Payments Pro. If you provide them with a URL that shows what you're selling that's all they need. Otherwise you have to fax them a brochure or similar, to show that you're doing something legitimate.

</comment></comment></comment><comment><USER14> Spreedly looks like an interesting alternative for outsourcing the hassle of subscription payments: <http://spreedly.com/>

Not used them myself yet.

<comment><USER15> Does anyone here on HN have experience with spreedly?

<comment><USER16> I know one of the founders, and hold him in pretty high esteem. I haven't personally used Spreedly, but I know they make good stuff. They're also very accessible, and are hackers. If you have questions, just ping them and you'll get a real answer.

</comment></comment></comment><comment><USER17> Choose more than one. It's important to have redundancy when it comes to getting paid. Ask anyone who's had their PayPal account suspended for arbitrary reasons.

I don't think you can get away from PayPal, their market share is just too big to ignore. Amazon Payments sounds like a good second choice, but it depends on your customer base.

</comment><comment><USER18> Amazon payments for cost efficiency. We thought considered using pay pal but it was more expensive. The other nice thing about Amazon is they let payers use their amazon payment accounts.

<comment><USER19> Amazon payments seems very bad for repeated billings, particularly variable repeated billing. They seem to be really pushing their P2P payments, so if that's what you're doing then great, otherwise I would think twice...

<comment><USER20> Does Amazon payments allows 3rd party developers to hook into the P2P-style payments?

Their web site is a bit confusing.. as a consumer, it seems that they offer me P2P micropayment services. As a developer, it seems like they just offer me the ability to bill people.

What if I want to write an application that wraps around their P2P services? (Like an "Email Money" application)?

<comment><USER19> You can definitely facilitate a P2P transaction - they have 3 entities in each transaction - the sending account, the receiving account and the calling account. All 3 can be different.

Sounds like your app is exactly in the target zone for FPS - I just wish they hadn't neglected the more conventional use cases!

</comment></comment></comment></comment><comment><USER21> Authorize.net is great for customer service, I've never once needed to talk to them and had to wait more than 5 minutes (granted, on-site text support, but it's useful and they're efficient).

We used paypal's payflow pro on our latest project. PayPal is TERRIBLE for development. For auth.net, you just put the account in test mode, send it some transactions, and get the appropriate responses. For PayPal, you have to have a sandbox account, and users in the sandbox, and this and that and blah. What it ends up meaning is that it's HARD TO SHOW YOUR CUSTOMER THAT PAYMENT IS WORKING. They have to have a sandbox account, and manage all of that stuff. Or you just conference call and screenshare, right?

Now, it turns out PayPal's not TERRIBLE, but I'll never use it again. WAY more hassle on that project than any of my others (I do ~10 ecom-enabled apps in a given year).

<comment><USER22> I'll second this. Paypal is a _huge_ hassle to develop for. Their sandbox goes down very regularly, and it's one of the most annoying things, because you don't know if it is a bug with your code or if it is Paypal.

They are the biggest, most popular, and probably most trusted; but if you're going on technical merits alone, Paypal is one of the worst.

</comment></comment><comment><USER23> Worldpay.com

They are a pain to work with, they delay payments by a month, and they're expensive but they do multi-currency. This is important for me in Australia, because it means a customer in the US can buy in US dollars, and their credit card is billed in US dollars, with exactly that amount (no mysterious currency fluctuations). Same for Euros.

Their take is about 4.5% (better than PayPal etc when you take into account its hidden currency conversion spread).

Every so often I look around for an alternative for my situation ("there _must_ be something better than this"), but so far they're the best in this.

<comment><USER24> Hi there. We use Worldpay. Just a note - they ARE flexible on their rates after you have been with them a while. We reduced ours to 3.3% with just one phone call, so it might be worth you giving that a go

<comment><USER23> Thanks for that.

</comment></comment></comment><comment><USER25> I use PayPal, Google, and Authorize.net currently. We are dumping Google in a few weeks - 1+ years of "1 in 5" chargebacks and poor (non-existent?) customer service. PayPal is best of breed but we do not use them as our primary payment handler; it's an option presented to customers upon checkout though.

<comment><USER26> +1 for Authorize.net. Paypal's Website Payments Pro is good too.

Consider the trade offs between better user experience if the payment process is on your site vs. not having to deal with PCI compliance with a hosted solution.

</comment></comment><comment><USER27> Be sure to evaluate FastSpring.com as well.

Before you go with PayPal, you may want to read up on some of the issues people have been having with PayPal: <http://www.fastspring.com/blog/2008/...nt-processing/>

Also, this post explains the difference in a full service e-commerce solution and a basic payment service like PayPal and the others: <http://www.fastspring.com/blog/2009/...ng-e-commerce/>

Keep in mind that one of the ways customers can pay when using a full service solution is via PayPal, but customers have numerous alternative payment methods available as well. Some vendors won't need the features of a full service solution, while for others it makes a huge difference in their bottom line.

\- Dan

</comment><comment><USER28> On a related note, could anybody comment on their experience getting PCI compliance?

I'd like to have the payment process a bit more integrated with my web site, but many of those solutions seem to require PCI compliance, and that looks rather involved.

<comment><USER29> There are several levels of PCI compliance. At PowerPay we spend thousands of dollars becoming compliant and staying that way. For most merchants, the requirements are far less onerous. The biggest tip I can give is don't store card numbers. Ever. Just pass the info along to your payment gateway and forget it. Let them deal with the compliance and risk. Take my advice for what it cost and speak with your sales agent for the exact guidelines you need to follow.

</comment></comment><comment><USER29> I work at PowerPay which is a payment processor. Unless the person or organization you sign up with is a registered ISO than you are actually doing business with a company such as PowerPay. Visa and Mastercard require the ISO to be clearly stated on the merchant account application. Most of the time merchants go through sales agents who are working for or with a registered ISO. Just an FYI, as the industry can be a bit sketchy. I've been at PowerPay for a few years and for what it's worth I've always been impressed with how we do business.

</comment><comment><USER30> Cybersource is an oft-overlooked option I'd recommend considering. We were going to go with the defacto AuthNet, but ended up choosing Cybersource for the added features (better recurring payments, international currency support) and the fact they gave us a pretty sweet deal (same price as Authorize.Net, which is their lower-priced option).

I think a lot of these companies that typically target larger businesses are more willing to cater to startups these days to drum up new business.

</comment><comment><USER31> Paypal is good and pretty feature rich, but it's not the most straightforward thing to work with. It's not really that the API is under-documented, more that it can involve lots of back and forth and your code needs to deal with lots of cases. The advantage is ease of use. In terms of time to implement and wide spread user awareness it's a good starting point to get the money coming in - with more options provided as time permits.

</comment><comment><USER32> I like cdgcommerce, they have reasonable rates and very good reputation. They also give good support. You can find a whole bunch of reviews on webhostingtalk

</comment><comment><USER33> I'll plug myself here... :) If you are using Rails, take a look at <http://railskits.com/saas/> \-- a great starting point for your Rails apps to not only do the recurring billing (with Auth.net, Braintree, etc.) but also do account management, upgrades/downgrades, etc.

It has a lot of the work done for you, so you just plug it in and go.

</comment><comment><USER34> Amazon Simple Pay Subscription has worked out very well for me. Startlingly easy site integration.

[https://payments- sandbox.amazon.com/sdui/sdui/business?sn=pa...](https://payments- sandbox.amazon.com/sdui/sdui/business?sn=paynow/subscription)

It's described as being in closed beta, but Amazon's friendly representative gave me access minutes after I emailed them.

</comment><comment><USER35> I actually work for a software firm that created a billing and payments application specifically for recurring and subscription services. Feel free to send me an e-mail and I can answer any questions for you or provide some information for you. My e-mail addy is email@example.com or feel free to check out our site at www.ipapplications.com.

Cheers.

Paul

</comment><comment><USER36> We use authorize.net ... authorize.net provides remotely stored credit cards (you just store a token). This is available through pretty much all auth.net resellers.

For some reason Braintree has gotten a lot of hype but offers nothing any better than the most lowly auth.net reseller.

</comment><comment><USER37> We use Payflow Pro Recurring Billing (PayPal).

If you don't need access to the funds for a few days I would recommend using Braintree for recurring billing. But if you want the funds in your Paypal account immediately Paypal's Payflow Pro is a decent option.

</comment><comment><USER38> I got a local merchant account (huntington national bank), which is flexible, and I get a choice of gateways (we chose authorize.net). Great service at both the merchant account and gateway level, also pretty good rates.

</comment><comment><USER39> TrustCommerce.com is very fast (<2 sec.) and developer-friendly, and they run on open source systems if that's important to you.

</comment><comment><USER40> <http://www.ccavenue.com/> for Indian customers

</comment><comment><USER41> I agree with pretty much everything said here. Just for full disclosure - <USER2> work for Zuora, one of the companies listed above.

All the above methods have pros and cons. I would echo the sentiment above to look at payment processors and payment methods as separate entities. I would also echo the sentiment about Google Checkout. With its now higher rates, less customer support and higher fraud rates, there are fewer reasons to choose it over others.

When choosing a payment processor, be sure to take into account your business needs, not just who is cheaper. For example, some payment processors work better in different geographic regions (or if not better, have different commission rates). So make sure to look at where your sales are coming from. If the the vast majority of your sales are (or will be) in North America, then you can probably just compare prices. If you sell to Asia or Europe/EMEA, make sure to see if the commissions are different in those areas. If you do a significant amount of transactions in multiple geographic regions, it may be worth the cost to support more than one payment processor (ie, use PayPal in North America, someone else for Asia because they offer a lower rate, etc)

While commission/rate is probably the biggest driver in choosing a payment processor, be sure to take into account a few other things:

* Ease of integration - how much work does it take to integrate with a payment processor. Moreover, if you are using a pre-built shopping cart, see if they have integration with a payment processor (most support Authorize.net, Paypal, and Google Checkout, with some even adding mobile payment processors as well). * Customer service - this isn't just if you can call someone. Most will rely on self service - be sure to vet their self service portals as well. * Fraud/chargeback - (especially in gaming and social networks). How much emphasis this is given really depends on your business. If you are selling physical goods, not usually a huge concern. If you are selling digital or virtual goods (usually consumable goods, as opposed to service), it can become a bigger problem.

For handling recurring fees/subscriptions, it also depends on your business needs. If you are looking for a simple recurring flat fee on a monthly basis, and will only have one fee per customer, many providers can help here. I know that Paypal can support this today, and from this thread it seems that Authorize.net and Braintree can handle it well, too. If you are already considering one of them as your payment processor, then that may just suit your needs. Google just released a subscription product as well, but that is brand new, and I have no experience with it (or know of anyone who has used it). So I cannot offer too much commentary there. From what I have seen (and also mentioned elsewhere in this thread), Google Checkout does suffer from higher fraud rate. I've known other companies to drop support for this reason.

Subscriptions can get complex quickly, but if your needs aren't likely to grow beyond a single product with a simple monthly charge, then I would look into Paypal/Authorize.net. However, if you are looking for more complex features like offering multiple rate plans for a single product (ie, offer different payment plans - like $9/month vs $99/year), offer usage based pricing (similar to a pay-as-you-go cell phone plan), offer multiple products/rate plans to a given subscription, offer ability to change from one plan to another, etc, then using a subscription processor is the way to go (e.g., Zuora, Vindicia, Aria, eVapt). I could give the whole spiel on Zuora, but I'll save that for a different forum. Hope that helps.

</comment><comment><USER42> I use paypal subscription thing atm, it seems to do the job ok.</comment>


The Wuzhen Summit and the Battle Over Internet Governance - <AUTHOR> http://thediplomat.com/2016/01/the-wuzhen-summit-and-the-battle-over-internet-governance/ <comment><AUTHOR> At this point, I'm almost inclined to say fuck it - take it. The parts of the internet that haven't been legislated to death have been bastardized by commercial interests. At some point, you've got to just pick your battles and slip between the cracks. You want a medium that tracks nearly your every move, and has effectively been turned from a huge library into a huge mall? You can _have_ it.

Enough is enough.</comment>


A Labor Shortage Could Explain Negative Interest Rates - <AUTHOR> https://www.bloomberg.com/opinion/articles/2019-09-13/negative-interest-rates-could-their-cause-be-a-labor-shortage <comment><USER2> It seems like there are (almost) unimaginable bottlenecks in technology creation, leadership and creativity. The contrast between thenear unlimited amount of capital available for value creating companies, and the almost universal lack of people who can reliably create those companies, is staggering. Why does school still prepare people for a world of zero sum, mediocre work? There has never been a larger, more diverse capital class, but it seems like people could not be trying harder to avoid being a part of it.

<comment><USER3> >There has never been a larger, more diverse capital class, but it seems like people could not be trying harder to avoid being a part of it.

Because people don't really like Monopoly.

Not everyone seems to want to sit on, micromanage, or otherwise have their life degenerate into a real life version of savvy financial instrument user: the game.

There is living, raising a family, seeing the world, experiencing something truly singular, discovering something, realizing something no one else has, sacrificing for something importamt, or being satisfied merely living and existing sustainably.

Yet every day, a Market clamors for their participation. It demands they take their credit, consume it's output, entrust their life savings to it regardless of the risk or consequence.

Transact! Transact! Transact! It screams incessantly, unwilling to be silenced. If you cannot transact directly, hand the fruits of your sweat to someone that will! Feed me!

I'll insure you! Just give me a cut! I'll loan to you, but trade your debts and obligations to others involved in the original transaction!

It forces itself in the most unhealthy, self-reliance poisoning way into your life like a layer of poison gas traveling along the floor.

I'd suggest a read of Henry David Thoreau's Walden to understand that part of the Hunan psyche that seems to sit in rebellion to the modern financial system. There is life beyond the economic construct. Something beautiful, real, and worth finding, sharing, and experiencing that is robbed and trodden upon by the worldwide market. It is outright rejected and decried as savagery by the very tenets of decent economic theory. All actions under economic theory must be in search of profit, or in avoidance of loss. In reality though, a person may spend one's time to make some good in the world besides mere dollars and common cents.

To see communities and churches flourish; to see work done, and excess goods grown and gathered distributed between friends/adopted family merely because they are there and it seems the right thing to do.

It seems fitting that capital is caught in a tizzy looking for somewhere to be, and fears of a recession circle in the markets due to a lack of labor.

The next generation, like the latter born sibling, need not repeat the mistakes of those who came before to learn the lessons of the past. They are unconsciously drawn (or possibly even shielded, or explicitly warned away) from the banks, lenders and money men, and see the damage the financial system becoming the ultimate arbiter off all that is "good" and "worthwhile" has on the human spirit.

The dollar sign reigns supreme from it's bag, even as most are left struggling to find their financial footing from the get go as the Jack Welch's of the world play to the financier's tune, sacrificing the many, and the mission in a quest to deliver value to the shareholder and no one else. Why labor for their pittance of a wage? Why accept the slavery and encumberance of the responsibility for such a tethering of possibility? Why sacrifice my birthright as a free agent to these men and their ledgers?

Just as J. P. Morgan famously said of banking during Congressional testimony,

 _Untermyer: Is not commercial credit based primarily upon money or property? Morgan: No, sir. The first thing is character. Untermyer: Before money or property? Morgan: Before money or anything else. Money cannot buy it … a man I do not trust could not get money from me on all the bonds in Christendom_

There is little to recommend the Market in terms of Character nowadays. It is volatile, unreliable, and as untrustworthy as those people we currently find ourselves attempting with great difficulty to share a sociopolitical sphere with.

Without trust, the underpinnings of the "the economy" comes undone. That trust has been eroded by government overreach, reckless banking, unrestrained excesses of the capital wielding class, and the splitting of the population into the shareholding vs. Non-shareholding class. No call to "then buy-in, damn you!" will succeed to move one who has experienced the economy as an impersonal predator of one's time and virtue. Who has toiled and toiled yet barely seems to make ends meet without taking any steps repugnant to their moral character.

"Chiding their ignorance" and attempting to correct it will not move them as well. Deep down, man is still animal as much as rational being, and the animal spirits that move us are just as connected to our feelings on the status quo as the instincts of wildlife in the midst of a forest fire.

It's a lot to unpack, but to summarize, the issue isn't economic, but one of Character. The financier/economist wishes (through actions if not through words) to lay claim to a role of primacy in everyday dealings and existence. They assert the systems of monies and transactions suffused all that man should ever do and and aspire to/for. Yet, that primacy comes at the price of blind trust being present. A commodity in precious supply nowadays. Solve that for laborer and shareholder/instrument holder alike, and you have the beginnings of a recovery in the works. Continue in the current direction at the system's own peril. It takes precious little to lose mankind's faith, especially in comparison to what it takes to restore it.

My 4.a.m. 2 cents at least.

<comment><USER4> Thank you...

<comment><USER3> You're welcome.

It just felt like it needed to be said.

</comment></comment></comment></comment><comment><USER5> ...</comment>


Firewalling with OpenBSD's PF packet filter - <AUTHOR> http://home.nuug.no/~peter/pf/en/long-firewall.html <comment><USER2> This little tutorial ultimately lead to Peter writing 3 full editions of "The Book of PF", which are absolute must-have books for anyone using pf on BSD/Mac OS X.

[https://www.nostarch.com/pf3](https://www.nostarch.com/pf3)</comment>


OEC: The Observatory of Economic Complexity - <AUTHOR> https://oec.world/en/ <comment><USER2> The first page I looked at shows exports of the US [https://oec.world/en/visualize/tree_map/hs92/export/usa/all/...](https://oec.world/en/visualize/tree_map/hs92/export/usa/all/show/2017/)

It doesn't include software, so seemingly ignores the economic activity of some of the largest companies in the US. Does anyone know what's going on there? I guess software isn't visible at customs boarder checks, so isn't included.

<comment><USER3> Physical goods are easier to track than services, since the former have to go through a port.

The UN has made great efforts to standardize _goods_ data, but AFAIK they don't have services data. This is the data that this website is using: [https://comtrade.un.org/](https://comtrade.un.org/).

That said, the Harvard version of The Observatory of Economic Complexity, the Atlas of Economic Complexity (there is an MIT/Harvard rivalry here), includes services data: [http://atlas.cid.harvard.edu/explore?country=231&product=und...](http://atlas.cid.harvard.edu/explore?country=231&product=undefined&year=2017&productClass=HS&target=Product&partner=undefined&startYear=undefined).

From the Atlas's website: "The raw trade data on goods are derived from countries' reporting to the United Nations Statistical Division (COMTRADE). The trade data on services are from the International Monetary Fund (IMF) Direction of Trade Statistics database, via the World Development Indicators."

</comment></comment><comment><USER4> Several comments seem to be somewhat critical of the visualisations and the lack of quote data sources.

I'm an economist and I have to say this is a beautiful exercise in visualisation. The Federal Reserve's Economic Data (FRED) facility is my go-to source of quick numbers, alongside Bloomberg and Wolfram Alpha, but these visual depictions are simply beautiful.

Congratulations to whomever assembled this together.

</comment><comment><USER5> What is the 'Broadcasting Equipment' which is China's largest export category and one of US's largest import category.

Also the site would benefit from having some interesting curated content on the landing page. Hiding all interesting content behind a search box, does not give any indication of what sort of content is available.

<comment><USER6> _Broadcasting Equipment is also known as television, radio broadcasting, antenna, digital, wireless, FM, AM, bluetooth, microwave._ [https://oec.world/en/profile/hs92/8525/](https://oec.world/en/profile/hs92/8525/)

So anything with a radio, like phones for example.

</comment></comment><comment><USER7> Doesn't seem to include services - at least that's my rationale for why the trade deficit of UK appears as so damn large - about 50% of imports, $300bn or so

</comment><comment><USER8> Couldn't find any references to data sources. This would be much more serious and useful if sources were listed.

Of course, it would be even more useful if there was a "download all data" link...

<comment><USER6> I'm guessing the source is [https://comtrade.un.org/](https://comtrade.un.org/) Who else but the UN has that kind of data?

<comment><USER8> From the other comment it looks like they indeed use comtrade.

The IMF and Worldbank have some similar public data, although not in that amount of detail. [1] And I recently stumbled upon a project that tries to standartise the API for a lot of official data sources [2].

[1] [https://www.imf.org/external/np/ds/matrix.htm](https://www.imf.org/external/np/ds/matrix.htm) [2] [https://db.nomics.world/](https://db.nomics.world/)</comment></comment></comment>