Deimorz

Here in Calgary, Alberta, Canada, we've had these food delivery services competing for the last few years, with their own apps, exclusive agreements with restaurants, and so on:

- Uber Eats

- DoorDash

- SkipTheDishes

- Foodora

- Fantuan

- HungryEats

Foodora just shut down two days ago: https://www.globenewswire.com/news-release/2020/04/27/202270...

And there were at least two more that were previously available but seem to have been acquired: Just Eat (by SkipTheDishes), and Nomme (by DoorDash).

It's ridiculous how many companies are fighting over a market that doesn't even seem to be close to profitable for anyone.

It wasn't really "inspired", the person looking up potential domain names just spelled it wrong and they decided to stick with it: https://graphics.stanford.edu/~dk/google_name_origin.html

For my site, I use Redis in addition to PostgreSQL for these purposes:

- User session storage

- Asynchronous "queues" for background processing using Streams (was able to eliminate RabbitMQ from my stack when I switched to this)

- Rate-limiting with a GCRA (via https://github.com/brandur/redis-cell)

- Bloom filter checks, specifically for making sure people aren't using passwords in data breaches (via https://github.com/RedisBloom/RedisBloom with data from https://haveibeenpwned.com/passwords)

I get at least 3 or 4 of these emails a week, and my site is a user-generated one along the same lines as HN or Reddit. They link to some thread vaguely related to a topic (e.g. VPNs, pets, gardening), usually compliment me on that "article", and ask me to publish their article on the subject too.

These aren't genuine requests. They're sending them to sites like mine where the request doesn't even make sense--the site isn't a blog, all they'd have to do is register and they could post any article themselves (I'd ban them immediately, but they could do it).

They're absolutely spam, and once you see a few of them you realize how formulaic they all are. There must be some tool that generates them, they usually just have some minor differences in words/phrasing (basically "spinning": https://en.wikipedia.org/wiki/Article_spinning).

Last Thursday, Axios contacted 40 VC firms and every single one said they were still actively investing: https://www.axios.com/venture-capital-open-business-dry-powd...

Yes, it's strange that a lot of articles don't seem to be mentioning that. Here's the relevant section of the address: https://youtu.be/pdO2HEtv92c?t=105

> And these prohibitions will not only apply to the tremendous amount of trade and cargo, but various other things as we get approval. Anything coming from Europe to the United States is what we are discussing.

I switched to uMatrix when NoScript wasn't working with Quantum yet. I think I like it better than NoScript now anyway, and have never gone back.

It depends what purpose you're using this for. If it's something like a password manager where you're checking the user's existing passwords to see if any have been breached, then yes, you should make sure not to hit false positives.

But if you're using it as a way to prevent people from using known-breached passwords on a site/service, it's really not worth worrying about. False positives would only be a problem when the user is using bad password practices anyway. If it's a non-shared, random password like it should be, a tiny chance of blocking an acceptable one is fine. They can just generate another one, it's an extremely minor inconvenience at worst.

Just include a note in the error message saying something like, "In very rare cases, this could be a false positive. Even if it is, you must choose a different password." The 0.1% of users it impacts (or whatever your error rate is) will be fine.

I use a Bloom filter for this as well, but in Redis using the RedisBloom module. This was really easy to set up, but it does mean that it requires about 1GB of RAM or so (depending on error rate) dedicated to it, so it wouldn't be ideal if you're constrained for RAM.

I run a separate Redis server specifically for this purpose, which means when I want to update the list, I can build the Bloom filter on my local machine, and then just transfer the RDB file to the server and replace the previous one.

Here's the Python code for the simple CLI tool to initialize and add the hashes from the HIBP files to the Bloom filter if anyone's curious: https://gitlab.com/tildes/tildes/-/blob/master/tildes/script...

To check if a password's in the list, you just SHA-1 hash it and send a Redis command like:

    BF.EXISTS breached_passwords_bloom <sha1>

It's tildes.net, the best overall description of my goals/values for the site is the announcement post: https://blog.tildes.net/announcing-tildes

It's not a competitor to Reddit in any meaningful sense though. If anything, my "target user" is almost the complete opposite of what Reddit prioritizes now. Calling it a competitor probably only makes sense if you still think of Reddit as the way it was like... 5-10 years ago.

It's invite-only to register, but feel free to email me at the address in the blog post and I'll send you one. (That offer's open to anyone else too.)

I also probably did thousands of hours of unpaid moderation and development work on Reddit before I worked there.

None of that's very relevant here though, other than showing that I'm intimately familiar with the dynamic from spending a lot of time on both sides of it.

Nothing will happen, exactly like the last 14 years with the employees being paid salaries while users run the site for free.

Why do you think an IPO will be treated differently?

Inoreader recently added support for subscribing to email newsletters with an email address it gives you and it acts like they're an RSS feed and combines it into all your other subscriptions: https://blog.inoreader.com/2020/02/declutter-your-inbox-subs...

Might not be enough to switch for if you're already happy with what you use for RSS, but I think it's a great feature.

Discussed yesterday on the original article: https://news.ycombinator.com/item?id=22396937

I mentioned this in my separate top-level reply, but Scroll doesn't include getting you past paywalls: https://intercom.help/scroll/en/articles/3344875-does-scroll...

I was really excited about Scroll when I first heard about it, but after I looked into it more I lost almost all interest. I was looking at it almost a month ago, so it may have changed a bit since then, but at the time, the main things were that:

1. Even though almost all of the material about Scroll says "300+ sites supported", it's actually about 30 sites, mostly from the same few networks, and 304 "SBNation blogs". This was the list of domains initially supported: https://gist.github.com/archon810/b4ec827d5fbe9e22a43ad39ca2... (and I broke down that list by owner here, if anyone's interested in that: https://tild.es/lc6#comment-4ij7)

2. Scroll does not get you past paywalls: https://intercom.help/scroll/en/articles/3344875-does-scroll...

So if it's a site that's supported by Scroll that also has a paywall (like The Atlantic), you're expected to both subscribe to the site and Scroll to get a "clean" experience. It's also notable that even though the New York Times is one of the main investors in Scroll, they apparently don't currently intend to support it themselves (mentioned here: https://www.poynter.org/business-work/2020/revolutionary-a-h...).

Andrew Essex published a response today about the "Dudes Who Dish" article being credited to Kurt Andersen when he didn't write it: https://www.cjr.org/first_person/details-conde-nast-andersen...

Why are you using HN then, when its terms include a similar arbitration agreement?

> You agree that any and all disputes or claims that have arisen or may arise between you and Y Combinator, whether arising out of or relating to this Terms of Use (including any alleged breach thereof), the Site, any advertising, any aspect of the relationship or transactions between us, shall be resolved exclusively through final and binding arbitration, rather than a court, in accordance with the terms of this Arbitration Agreement, except that you may assert individual claims in small claims court, if your claims qualify.

> YOU AND Y COMBINATOR AGREE THAT EACH OF US MAY BRING CLAIMS AGAINST THE OTHER ONLY ON AN INDIVIDUAL BASIS AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE ACTION OR PROCEEDING. UNLESS BOTH YOU AND Y COMBINATOR AGREE OTHERWISE, THE ARBITRATOR MAY NOT CONSOLIDATE OR JOIN MORE THAN ONE PERSON’S OR PARTY’S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A CONSOLIDATED, REPRESENTATIVE, OR CLASS PROCEEDING. ALSO, THE ARBITRATOR MAY AWARD RELIEF (INCLUDING MONETARY, INJUNCTIVE, AND DECLARATORY RELIEF) ONLY IN FAVOR OF THE INDIVIDUAL PARTY SEEKING RELIEF AND ONLY TO THE EXTENT NECESSARY TO PROVIDE RELIEF NECESSITATED BY THAT PARTY’S INDIVIDUAL CLAIM(S).

HN doesn't even offer the ability to opt out of arbitration, so it's even worse than Quora in this aspect.

I don't disagree with the sentiment of the post, but unfortunately this has been the norm for web service terms for a very long time. As far as I can see, there's nothing unusual in what Quora specifically is doing here.

Even HN's privacy policy and terms include both an arbitration agreement and phrases very similar to the ones he's complaining about, like:

> By using the Service, you agree to the practices described in this Privacy Policy.

> Your continued use of the Site after the date any such changes become effective constitutes your acceptance of the new Terms of Use.

There are about 10 major game streaming services available now, and none of them inject any advertising as far as I know.

Which ones are you referring to?

When a grocery store has self-service cashier stations, is it acceptable to only scan half of your items?

It's always interesting to me that so many people seem to completely lose all compunction about stealing once technology is involved.

If they were ordering from a cashier at McDonald's and the cashier got distracted for a minute and somehow forgot to charge them before finishing the order, most of the people that abuse a bug like this would tell them about the mistake. I've been in similar situations plenty of times, where I easily could have gotten something without paying because of a staff oversight, but I always tell them I haven't paid yet. Most people won't suddenly decide to steal something just because they're handed an easy opportunity.

But when the transaction is through an app or a website or something, people are completely willing to abuse errors, and will even go through an obscure process deliberately to cause errors so they can abuse them. When Amazon accidentally sells expensive camera equipment for 99% off on Prime Day, people clamor to steal as much as they can, even though it's a blatant mistake. None of those people legitimately believe the price is intentional, they know they're taking advantage of an error. The ones that get away with it brag about it, and others that missed the chance are jealous that they didn't manage to steal anything.

It's really a fascinating piece of psychology to me, that once there's a "system" in place, abusing holes in it feels like a reasonable thing to do, even if the end result is effectively shoplifting.

Edit: the replies to me are a perfect demonstration.

Here in Calgary, Alberta, Canada, we currently have these food delivery services competing, with their own app, exclusive agreements with restaurants, and so on:

- Uber Eats

- DoorDash

- SkipTheDishes

- Foodora

- Fantuan

- HungryEats

And there were at least two more that were previously available but seem to have been acquired: Just Eat (by SkipTheDishes), and Nomme (by DoorDash).

It's ridiculous how many companies are fighting over a market that doesn't even seem to be close to profitable for anyone.

The article originally said that he received a $12,500 bounty for it, but it looks like that's been removed now (maybe you're not supposed to say).

You can still see it at both the top and bottom of this archived copy: https://web.archive.org/web/20200204164053/http://www.perime...

Posted and discussed 9 days ago as well: https://news.ycombinator.com/item?id=22139975

As a specific example, Etsy recently (2017) converted back into a normal corporation from a B Corp: https://qz.com/work/1146365/etsy-made-mistakes-from-which-ot...

You edited a user's comment to fix a minor typo? Is that something you do often?

Redis persists to the filesystem pretty regularly by default, and can be configured to do it much more often. For example, the recommended configuration for its AOF persistence mode is to fsync every second, but you can set it to fsync after every command if you don't want to risk losing even a single second of commands.

Lots more info here: https://redis.io/topics/persistence

To save anyone else the trouble of trying, all of these links have been used now and are no longer valid.

If you want an invite, you can just email me as explained in the announcement post: https://blog.tildes.net/announcing-tildes

That trap happens because of sites basing themselves on venture capital, advertising, and chasing growth/profit.

Tildes is a non-profit with no advertising or investors, so none of that pressure is there. There's no danger of donations not being enough to sustain it. The expenses are already far more than covered and it could easily stay running in its current state forever.