victorhooi

I used to work in fintech, and yes, the pay was substantially better there (I'm at Google now - I took a pay cut to go across).

Likewise, I had an offer from Amazon around the same time as Google's offer - which was actually quite a bit higher. So from my own experience, and from friends, Amazon does indeed pay substantially more than Google.

I've heard other tech is sightly higher - however, I didn't go to Google for the pay (although I wouldn't say no to competitive pay, haha), but there were other drivers for me (work/life balance etc.).

This looks similar to Graylog (https://www.graylog.org/)?

From Loki's readme, It still stores the full log (but compressed), and indexes values in each logline.

Would love to know this as well =).

You're saying the CO2 risk is OK, because they have oxygen masks.

That's like saying, increasing the risk of crashing a car is OK, because we'll have airbags.

What I'm saying is (unless you're PETA), the welfare and safety of your fellow human beings will trump most other things.

Umm, surely you can see that's a little crazy?

I'm all for environmental awareness - but it's a bit like the people saying, oh, why do you not use re-usable containers for everything, or do you really need to dishwash everything?

Things like food safety, and not making your customers sick are enshrined in law - and that's a good thing.

Even at my work, they aren't allowed to re-serve/re-heat things that have been served once, due to cross-contamination.

I appreciate the work you did to run those rough calculations.

Unfortunately, it completely ignores the most salient point. Empirically, most people seem to vastly prefer seeing the occasional (ideally targeted) advertisement, versus paying $20-40 a month of their own hard cash.

Hence, you cannot take total number of users, and divide by expenses. You can take maybe 1-2% (maybe less), and divide by expenses.

The actual conversion of these currently free users to paid users is what matters - and I doubt most people on Facebook would pony up.

For example, see the sibling post from Guest9812398 about his experiences running a popular community site - only 100 of the 100,000 users opted in to this, which doesn't even cover his hosting bills. The only way he can survive is through advertising.

The no ads model has been tried on the internet before, many a time - and the majority of people simply will not pay.

People say this - but they rarely put their money where their mouth is.

History has shown time and time again that people are cheapskate. I know I'm guilty of this as well.

We like to signal that oh yes, we have money, and we'll pay. But then they seize up when they see the bill.

I subscribe to things like 1Password, Netflix, Hulu, Pocketsmith etc. If I sat down and added it all up, I assume it'd be several hundred a year. Even working in tech, I still sometimes think twice about paying for all these things.

How much would you pay for Facebook? $20 a month? $30 a month? $100?

I suspect you and I both have very little insight into how much it actually costs to run Facebook - but working for another internet giant, I can say it probably costs a lot more than the average layperson assumes.

Sorry, but this is just being shifty and irresponsible. And how are they using littering as a business model? The bloody twats who are picking these up without paying and dumping them in a creek are the ones littering - it's like blaming the shopping centre for you stealing, because they had stuff for you to steal.

Look at the mess Aussies have made with shopping trolleys from Coles/Woolworths. The supermarkets got so fed up they implemented locks on the wheels - nearly every supermarket here does this now.

The only reason the bikes are worse is because they're lighter/easier to move than trolleys, and the locks aren't as hard to overcome as for trolleys.

That, and Australia is in general very un-bike friendly. It's a cultural thing - we love our V6/V8 engines, our big SUVs, and our giant McMansions - we essentially copy the US in those traits. You compare this to say, Europe, or Japan which tend to be much more bike friendly.

No, Aussies have a bit of a "larrikin" streak, to use the polite term.

As an Aussie, I'd term is as bordering on obnoxious and irresponsible at times - and it saddens me to write this.

Whether in Europe, South America, or Asia, everybody has a funny story about what we've allegedly done - whether it's pissing on the eternal flame in Paris, stupid stunts with climbing temples in Cambodia, trying to plank on idiotic places in Singapore hotel balconies, or just general pranks.

My parents are originally from Singapore, and like it or not, they at least have the law and order thing down pat.

Look at the mess we've made with shopping trolleys from Coles/Woolworths...

So don't blame the bike companies for us deciding to do stupid things with their property.

It's like somebody blaming a shop for graffiti, because they left their wall empty...

No, that's not accurate.

If you read the article you quoted:

> We are posting before an originally coordinated disclosure date of January 9, 2018 because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation. The full Project Zero report is forthcoming (update: this has been published; see above).

Just from public Gooogling, I believe it may have been the Register who tried to get in on the scoop, and broke the embargo:

https://www.theregister.co.uk/2018/01/04/intels_spin_the_reg...

I'm not sure what you mean by "hpme" - do you mean "home"?

If so, I suspect you're just commenting without basis, and have no actual inkling what this content is really like.

I work for a large internet company, and have to deal with some of this as a tangential part of my role. Trust me, there is stuff that most normal people would never even want to go near. (No, I'm not talking some angry rants, or some naughty pictures).

I'm all for freedom of speech and all - but I have no qualms about this stuff being flagged as inappropriate and put behind a filter. If you really want to find this stuff, you can - there are communities and chat groups trading in it - you wouldn't have much trouble finding it. But I would posit that most people that want this stuff are actively looking for it, versus wanting to see it on their Facebook or Google+ feed.

I'll be honest - I don't respect people who tailgate or follow too closely. I think they're selfish and self-conceited.

People who think - I"m more important than you, I don't care if I kill you, as long as you don't inconvenience you.

The law (and insurance companies) are pretty clear on this (at least in Australia) - if you rear end somebody, it's nearly always your fault, for being silly enough and not leaving enough gap.

They have educational campaigns on leaving enough gap (it's meant to be 3 seconds). Things happen, and people have to emergency stop.

It's taught to every driver.

I was tempted to buy this - howevever, what turned me away was the subscription fee - it says:

> No subscriptions to cancel—this is a 1-time charge. > Access lasts (3 months) 1 year.

So sure - the fee may not automatically renew - but then you lose access to all the material after a year.

Is there not simply a way to pay for the course, and own a copy?

Are you actually sure it affects battery life that much?

I'm a bit dubious about this - in fact, turning off WiFi would actually harm battery life, surely, compared to LTE?

The issue isn't buying over the limit.

The issue is making it seem like your account is hijacked, or part of a bot-net, or committing payment fraud (e.g. stolen credit cards).

Say you create 100 email accounts - john001@gmail.com, john002@gmail.com, john003@gmail.com etc. - and have them each buy a phone, and ship them to a single physical address. Most people would see that as a major red flag for something fishing going on.

Or say suddenly all of these otherwise unrelated accounts suddenly started ordering goods online, and shipping to a PO Box in the Ukraine.

As a consumer, I most definitely want all of this stopped.

In fact, my bank will regularly call me up and ask me to confirm transactions that seem suspicious (or send me an SMS) - if I don't respond in time (e.g. I'm travelling), they will lock out my credit card.

That is exactly what you want as a customer.

So in this case - it seems these people knew they were engaging in something shady - but perhaps they didn't put two and two together and think, gee, if I let somebody order something on my credit card, yet addressed to him, I wonder if it will look like my account was hijacked?

That website (Inc.) doesn't cite any sources for your quotation at all. It simply appears to be their personal speculation. To me that's rather disingenuous.

I actually work in a support org at Google (on the Enterprise side, admittedly).

That account recovery link I provided (https://accounts.google.com/signin/recovery) is available to anybody (This is for consumer - i.e. GMail. If you have an enterprise - i.e. GSuite account, it's slightly different in that your domain administrator can also restore you as well).

You don't need to be anybody special - you just go to that URL, fill in your details, and somebody will review it for you.

Yes, it will take time. If you make noise, it's possibly it will get escalated and you will get assurances from somebody that it's being looked into. But in general, it will take some time to process it, simply to ensure that we're giving you (and not somebody else) access to your account.

I know it sucks, but account security is tough, and I have nothing but respect for the hardworking people that handle that. In my second week at Google, I accidentally typed my password into a non-secure (but still legitimate) web-form. Within minutes, I got an alert asking me to change my password immediately. They take security very seriously.

Disclaimer: I work for Google, but any opinions above are my own.

AFAIK, nothing was permanently or irrevocably deleted. From all the public statements at the time, all that happened were the accounts were suspended.They would then need to reach out via the recovery link to prove they were really a person (and not say, a bot). (I'm just going off public statements here).

In terms of handling and deleting user data, I do know we have some pretty clear guidelines around this - user data is sacrosanct. You can read up in the ToS, or if you need specific guidance around your personal circumstances, I would always encourage you to consult a legal professional.

Thanks for bringing that up.

I suspect you and I are talking about two different things however.

I'm using fraud as an ordinary layman would use it - that is - deliberate deception to secure unfair or unlawful gain.

In this case, I think most people would agree that spawning up multiple dummy accounts (e.g. john001@gmail.com, john002@gmail.com, john003@gmail.com) and then using them to get around ordering restrictions is definitely deceptive. (These account names are obviously illustrative).

And in terms of what's a "reasonable" response, that's above my paygrade. All I can comment on is the public statements that those people made around the time, and around their interactions with Google and their interpretation of them.

However, are you a legal practitioner? If so, then perhaps you are using the term in the other sense? Also, if you're willing to comment IAAL, that would be very interesting.

Sure, let me fix the typo.

However, I'm still unclear about your main point.

If you're not talking about a "literal" Chromebook...what are you talking about?

I'm only speaking in general terms here, not specifics.

However, reselling phones is usually against the ToS of pretty much every retailer. This isn't unique to Google. Here are our ToS - https://store.google.com/intl/en-US_us/about/device-terms.ht....

> You may only purchase Devices for your personal use. You may not commercially resell any Device, but you may give the Device as a gift. Recipients of gifts may need to open and maintain a Google Payments account in order to receive any support offered by Google. These Terms apply to any gift recipient.

I'd like to see you walk into an Apple store, and buy 10 iPhones. Or say, 100?

In fact - Apple even introduced controls to stop scalping of Genius Bar appointments:

http://www.idownloadblog.com/2013/09/12/apple-store-genius-b....

Or say you create 100 email accounts - john001@gmail.com, john002@gmail.com, john003@gmail.com etc. - and have them each buy a phone, and ship them to a single physical address.

It's certainly possible to see how this would come across as hijacking or botnet fraud.

The third - the author had already kickstarted a normal recovery process by https://accounts.google.com/signin/recovery.

However, these things take a while to process.

As I commented elsewhere - if your account got hijacked - the last thing you want is for the hijacked to get back in, via some automated form.

I had to deal with exactly this nightmare scenario for a friend a few months back. Two email accounts, one from Gmail, one from another (unnamed) provider. The hijacker tried to get back in, several times (and did on the other one).

Knowing that the bar is reasonably high that only you yourself can get back in (even if it may take a few days) is very reassuring.

Trust me - if it's between waiting 2-3 days, versus having somebody get back in, pilfer all your email and commit identity fraud, I would pick the former more secure any day of the year.

Yeah, I tried the Ubuntu desktop experience for them as well.

Unfortunately, even though I wish it was the year of the Linux desktop it's still not quite there yet for the non-tech savvy.

New devices are a pain, websites that don't work for whatever reason are a pain (since Linux penetration is so small, a lot of people don't test it), and overall the UI is nice for power-users but still inscrutably complex and unintuitive for the non-initiated. It's possible your mother has a knack for the UI though =). Which desktop environment did you use?

AFAIK, the two things are orthogonal.

My understanding was he'd already kickstarted a normal recovery process https://accounts.google.com/signin/recovery

And he wanted more details, so I assume he spoke to somebody up the escalation chain in our support org, who gave him more details.

To your first point - The natural counterpoint is - there are billions of Google account there. Yet, the number of cases you hear about this is in the handful.

To your second point - scalping phones is most definitely against ToS. This is true for Google, Apple, Smsung anybody.

Here are our ToS - https://store.google.com/intl/en-US_us/about/device-terms.ht...

> You may only purchase Devices for your personal use. You may not commercially resell any Device, but you may give the Device as a gift. Recipients of gifts may need to open and maintain a Google Payments account in order to receive any support offered by Google. These Terms apply to any gift recipient.

This isn't unique to Google. I'd like to see you walk into an Apple store, and buy 10 iPhones. Or say, 100?

In fact - Apple even introduced controls to stop scalping of Genius Bar appointments:

http://www.idownloadblog.com/2013/09/12/apple-store-genius-b...

Or say you create 100 email accounts - john001@gmail.com, john002@gmail.com, john003@gmail.com etc. - and have them each buy a phone, and ship them to a single physical address.

You can see why this would come across as hijacking/botnet fraud, right? (That's separate to the ToS violations).

But from public statements - the scalping itself wasn't what got them, it was probably the bot-net like account creation, and indications of payment fraud.

Thirdly point - it doesn't sound remotely like legalese, and there's no indication lawyers were even involved. In fact, why would they be? I would have preferred him to post some more technical details, as that would have cleared things up, but he posted a nice message of his own volition, which I suppose is fine.

It reads more like the message of somebody who's relieved, and glad he got an explanation of what actually happened behind the scenes.

It wasn't necessarily the publicity. He reached out through normal channels, but these things normally take some time to process, since they normally have to be reviewed by humans.

It's one of those things where you want to tread carefully.

I mean, say my account got hijacked.

I want to get back in. So does the hijacker. I would much rather prefer waiting an extra day or so, than risk having the hijacker purporting to be me getting back in.

I've actually had to deal with the exact above scenario for a friend before - they had a Gmail email account, and another (unnamed) email provider. The hijacker did try to get back in, and it's a pretty scary proposition. So having a bit of peace of mind that the bar is suitably high is good.

(Disclaimer: I work for Google, but any statements above are my own, and do not reflect those of my employer).

Um, you realise you uploaded a bunch of (presumedly) copyrighted material to a public video sharing site?

That would normally raise a bunch of red flags.

If you're stuck, there are dedicated support channels to actually talk to people - or feel free to reach out to me (my non-work email is in my profile.)

I actually dissected the authors example above - and they actually don't really help prove his/her point.

The first example - was basically fraud, that probably got picked up in hijacking/bot-net detection (based on public statements).

The second - I can't comment, as there are no public statements.

The third - the author made a public statement, and seems to harbour no ill-will to Google after it was explained to him what actually happened. I can't comment on that conversation, but I will say that in general, Google does a lot to protect its users from all kinds of security issues and attacks.

Yes, this is usually the more common story - Google does a lot of things to protect users (from themselves, and from external attack). I suspect a lot of people who get locked out are for fairly pedestrian reasons like password reuse across sites, and they got hijacked. It sucks, but it's better than the alternative (e.g. somebody pilfers all your email and commits identity theft).

Trust me, there are a lot of bad actors out there,

The other poster had it right - 2FA is really the way to go, ideally with something like Google Authenticator or Yubikeys.

If you ever get locked out (e.g. account is suspected as compromised/hijacked), then:

https://accounts.google.com/signin/recovery

is your one-stop shop to prove you're really you.

Thanks for bringing that up. However, te truth is often a bit more nuanced (although it doesn't make for as good headlines).

Dissecting your three examples.

In the first case, (and based on their own statements) those people were buying up phones by the hundreds, shipping them to a single physical address and then scalping over the internet.

It's basically fraud. So yes, they probably got picked up by an automated algorithm that looks for hijacking/CC fraud or bot-nets.

From public statements though, I believe most of them got their accounts back when they reached out to confirm they were real people and not some fraud bot-net. It's still technically violation of their ToS, but I won't comment on that part.

The second case I'm not directly familiar with, and there's no public statements so I won't say anything further.

In the third case, the affected customer made a public statement afterwards:

https://twitter.com/salilstatistics/status/89986397181723852...

I can't comment any further than what's been said publicly except on general principles 1. Google does a lot of things to protect users from external attacks, everything I've seen seems to indicate they really do care about users, and 2. There are pretty clear ways to get back into your account should anything happen (https://accounts.google.com/signin/recovery is your one-stop shop), and 3. The user doesn't carry any ill-will towards Google once he realised what actually happened.

(Disclaimer: I work for Google, but the above statements are my own and do not reflect those of my employees).

Your comment seems like a troll...lol.

I'm not sure how a Chromebook could "wipe out the network".

In fact, if anything, I'd argue it's less likely to than a Window laptop since Chromebooks are so secure out of the box.

I bought one for my mother a few years ago, and honestly, not having to go over and clean up malware periodically, or ever do Windows Updates, or ever worry about her clicking on dodgy links on the internet has been a Godsend.