MyBKV - Infoman

Posts by Infoman

Infoman

2016年7月，「捉精靈」遊戲（Pokémon GO）發布，全球哄動，孩子成人莫不沉迷，但那只是AR（擴增實境）遊戲，變化不多。幾個月後，熱潮開始冷卻，遠遠不及VR（虛擬實境）遊戲那樣「迷人」。然而，最近朋友參與「綜合實境」（Mixed Reality）遊戲，玩了數十分鐘，樂不可支，恍如孩童時第一次駕玩具車。

綜合實境就是VR加上AR及3D。玩家戴上眼罩後，看到的環境恍如真實世界，加上3D，既可360度看到環境，而且影像立體，遠近分明。玩家的「替身」（Avatar）置身遊戲內，打怪獸固可，潛入水底與海豚游泳、攀上珠峰亦能。如今可用WiFi，玩VR遊戲愈來愈方便。美國業內人士預料，到2020年，VR科技市場將比今天增加20倍以上。有預測甚至認為：2020年的美國總統選舉，主戰場不再是報章、電視或社交媒體，而是VR了。

想像不及感受

史丹福大學教授謝諾美巴蘭遜（Jeremy Bailenson），15年前已經成立VHIL（虛擬人類互動實驗室），研究VR對學習和溝通有什麼影響。溝通可粗分為三類：一是單對單，如兩人面對面聊天或講電話。你來我往的談天，既可聽對方意見，也可發表自己意見，是最民主的溝通。其次是單對眾，書籍、報章、演講、收音機廣播、電視……都是單對眾溝通。受眾接受訊息，卻難以回應，較易「中招」為人煽動。第三類是眾對眾，社交媒體令人上癮，正因它可以單對單、單對眾及眾對眾溝通。群組裏人人都可發表意見，恍如小組討論，又可隨時退出，十分自由。

過去，文字人多較理性，影像人則較感性。看見一頭狗遭虐待，人會由憐生憫，反對虐畜。看見一頭待宰的牛流淚，人會不再吃牛肉。巴蘭遜的實驗顯示：若在VR中切身感受到狗遭虐、牛遭宰，人會更堅定的反對虐畜和不吃牛肉。

巴蘭遜用史丹福大學的學生做實驗，A組讀斬樹和氣候暖化的文章，B組在虛擬實境中感受。之後，巴蘭遜叫他們做一些表面無關的事，例如洗手後抹手、碰跌水杯到地上，用紙巾抹乾淨等。他發覺：B組的學生較A組用較少紙巾抹手和抹地，減少的程度達20%。巴蘭遜下結論，VR比起文字更能改變人的態度。另一個實驗，A組看錄像，看完後，使用紙巾仍然多過B組。其他實驗顯示，VR不只可以「立即」改變人的態度，且改變保持得更久，遠非文字或影像媒體所能及。

為什麼VR的影響力遠較其他媒體為大？皆因VR是「浸淫式媒體」（Immersive Medium），你的「替身」令你在虛擬實境內，感同身受另一個人的苦樂，你在虛擬實境中化身為難民，便體會到流離失所的徬徨和痛苦。文字或影像只會刺激人的想像、同情或同理心，及不上感同身受。

任何人第一次在虛擬實境中站在60層高的樓宇天台，向下望或跨上欄杆，雖然明知那是虛擬的，依然會心跳加速，皆因人的腦袋尚未進化到可分清真實與虛擬，是以VR用來訓練運動員特別有效，因高水平的比賽需要運動員在一秒半秒間高速反應，那是本能反應。美國滑雪隊經過VR的訓練，技術進步不少。巴蘭遜認為，防暴隊、消防員使用VR訓練會更有效率得多。

巴蘭遜最惹起爭論的地方是他在Experience on Demand: What Virtual Reality Is, How It Works, and What It Can Do書中展望：VR可用來減少歧視、欺凌、暴力，促進環保意識、平等、包容等，有助鞏固民主意識。在他心目中，「VR是民主」。

反對者卻擔心：VR若是用來洗腦又如何？收音機造就了希特拉，社交媒體造就了特朗普，VR會不會造就另一個為禍更大的魔頭呢？

撰文：占飛

2018/05/28
Infoman

What's Going on in Your Child's Brain When You Read Them a Story? 284 devy 1 day 85 https://www.npr.org/sections/ed/2018/05/24/611609366/whats-going-on-in-your-childs-brain-when-you-read-them-a-story news.ycombinator.com/item?id=17155644 Reading an illustrated book together. "I want The Three Bears!"

These days parents, caregivers and teachers have lots of options when it comes to fulfilling that request. You can read a picture book, put on a cartoon, play an audiobook, or even ask Alexa.

A newly published study gives some insight into what may be happening inside young children's brains in each of those situations. And, says lead author Dr. John Hutton, there is an apparent "Goldilocks effect" — some kinds of storytelling may be "too cold" for children, while others are "too hot." And, of course, some are "just right."

Hutton is a researcher and pediatrician at Cincinnati Children's Hospital with a special interest in "emergent literacy" — the process of learning to read.

For the study, 27 children around age 4 went into an FMRI machine. They were presented with stories in three conditions: audio only; the illustrated pages of a storybook with an audio voiceover; and an animated cartoon. All three versions came from the Web site of Canadian author Robert Munsch.

While the children paid attention to the stories, the MRI, the machine scanned for activation within certain brain networks, and connectivity between the networks.

"We went into it with an idea in mind of what brain networks were likely to be influenced by the story," Hutton explains. One was language. One was visual perception. The third is called visual imagery. The fourth was the default mode network, which Hutton calls, "the seat of the soul, internal reflection — how something matters to you."

The default mode network includes regions of the brain that appear more active when someone is not actively concentrating on a designated mental task involving the outside world.

In terms of Hutton's "Goldilocks effect," here's what the researchers found:

In the audio-only condition (too cold): language networks were activated, but there was less connectivity overall. "There was more evidence the children were straining to understand."

In the animation condition (too hot): there was a lot of activity in the audio and visual perception networks, but not a lot of connectivity among the various brain networks. "The language network was working to keep up with the story," says Hutton. "Our interpretation was that the animation was doing all the work for the child. They were expending the most energy just figuring out what it means." The children's comprehension of the story was the worst in this condition.

The illustration condition was what Hutton called "just right".

When children could see illustrations, language-network activity dropped a bit compared to the audio condition. Instead of only paying attention to the words, Hutton says, the children's understanding of the story was "scaffolded" by having the images as clues.

"Give them a picture and they have a cookie to work with," he explains. "With animation it's all dumped on them all at once and they don't have to do any of the work."

Most importantly, in the illustrated book condition, researchers saw increased connectivity between — and among — all the networks they were looking at: visual perception, imagery, default mode and language.

"For 3- to 5-year-olds, the imagery and default mode networks mature late, and take practice to integrate with the rest of the brain," Hutton explains. "With animation you may be missing an opportunity to develop them."

When we read to our children, they are doing more work than meets the eye. "It's that muscle they're developing bringing the images to life in their minds."

Hutton's concern is that in the longer term, "kids who are exposed to too much animation are going to be at risk for developing not enough integration."

Overwhelmed by the demands of processing language, without enough practice, they may also be less skilled at forming mental pictures based on what they read, much less reflecting on the content of a story. This is the stereotype of a "reluctant reader" whose brain is not well-versed in getting the most out of a book.

One interesting note is that, because of the constraints of an MRI machine, which encloses and immobilizes your body, the story-with-illustrations condition wasn't actually as good as reading on Mom or Dad's lap.

The emotional bonding and physical closeness, Hutton says, were missing. So were the exchanges known as "dialogic reading," where caregivers point out specific words or prompt children to "show me the cat?" in a picture. "That's a whole other layer," of building reading Hutton says.

In an ideal world, you would always be there to read to your child. The results of this small, preliminary study also suggest that, when parents do turn to electronic devices for young children, they should gravitate toward the most stripped-down version of a narrated, illustrated ebook, as opposed to either audio-only or animation.

2018/05/26
Infoman
Parallel Index Scans in PostgreSQL 78 amitkapila 18 hrs 4 http://amitkapila16.blogspot.com/2018/05/parallel-index-scans-in-postgresql.html news.ycombinator.com/item?id=17160070

There is a lot to say about parallelism in PostgreSQL. We have come a long way since I wrote my first post on this topic (Parallel Sequential Scans). Each of the past three releases (including PG-11, which is in its beta) have a parallel query as a major feature which in itself says how useful is this feature and the amount of work being done on this feature. You can read more about parallel query from the PostgreSQL docs or from a blog post on this topic by my colleague Robert Haas. The intent of this blog post is to talk about parallel index scans which were released in PostgreSQL 10. Currently, we have supported parallel scan for btree-indexes.To demonstrate how the feature works, here is an example of TPC-H Q-6 at scale factor - 20 (which means approximately 20GB database). Q6 is a forecasting revenue change query. This query quantifies the amount of revenue increase that would have resulted from eliminating certain company-wide discounts in a given percentage range in a given year. Asking this type of "what if" query can be used to look for ways to increase revenues. explain analyze

select sum(l_extendedprice * l_discount) as revenue from lineitem where l_shipdate >= date '1994-01-01' and
```
      l_shipdate < date '1994-01-01' + interval '1' year and

      l_discount between 0.02 - 0.01 and 0.02 + 0.01 and

      l_quantity < 24          LIMIT 1;Non-parallel version of plan-------------------------------------Limit-> Aggregate    -> Index Scan using idx_lineitem_shipdate on lineitem
     Index Cond: ((l_shipdate >= '1994-01-01'::date) AND (l_shipdate < '1995-01-01

     00:00:00'::timestamp without time zone) AND (l_discount >= 0.01) AND

     (l_discount <= 0.03)  AND  (l_quantity < '24'::numeric))
```
Planning Time: 0.406 msExecution Time: 35073.886 ms Parallel version of plan-------------------------------Limit-> Finalize Aggregate -> Gather
```
     Workers Planned: 2

     Workers Launched: 2          -> Partial Aggregate               -> Parallel Index Scan using idx_lineitem_shipdate on lineitem
                Index Cond: ((l_shipdate >= '1994-01-01'::date) AND (l_shipdate < '1995-01-01

                00:00:00'::timestamp without time zone) AND (l_discount >= 0.01) AND

                (l_discount <= 0.03) AND (l_quantity < '24'::numeric))
```
Planning Time: 0.420 msExecution Time: 15545.794 msWe can see that the execution time is reduced by more than half for a parallel plan with two parallel workers. This query filters many rows and the work (CPU time) to perform that is divided among workers (and leader), leading to reduced time. To further see the impact with a number of workers, we have used somewhat bigger dataset (scale_factor = 50). The setup has been done using TPC-H like benchmark for PostgreSQL. We have also created few additional indexes on columns (l_shipmode, l_shipdate, o_orderdate, o_comment)

Non-default parameter settings:

random_page_cost = seq_page_cost = 0.1effective_cache_size = 10GBshared_buffers = 8GB work_mem = 1GB

The time is reduced almost linearly till 8 workers and then it reduced slowly. The further increase in workers won’t help unless the data to scan increases.

We have further evaluated the parallel index scan feature for all the queries in TPC-H benchmark and found that it is used in a number of queries and the impact is positive (reduced the execution time significantly). Below are results for TPC-H, scale factor - 20 with a number of parallel workers as 2. X-axis indicates (1: Q-6, 2: Q14, 3: Q18).

Under the Hood The basic idea is quite similar to parallel heap scans where each worker (including leader whenever possible) will scan a block (all the tuples in a block) and then get the next block that is required to be scan. The parallelism is implemented at the leaf level of a btree. The first worker to start a btree scan will scan till leaf and others will wait till the first worker has reached till leaf. Once, the first worker read the leaf block, it sets the next block to be read and wakes one of the workers waiting to scan blocks. Further, it proceeds scanning tuples from the block it has read. Henceforth, each worker after reading a block sets the next block to be read and wakes up the next waiting worker. This continues till no more pages are left to scan at which we end the parallel scan and notify all the workers.A new guc min_parallel_index_scan_size has been introduced which indicates the minimum amount of index data that must be scanned in order for a parallel scan to be considered. Users can try changing the value of this parameter to see if the parallel index plan is effective for their queries. The number of parallel workers is decided based on the number of index pages to be scanned. The final cost of parallel plan considers the cost (CPU cost) to process the rows is divided equally among workers. In the end, I would like to thank the people (Rahila Syed and Robert Haas) who were involved in this work (along with me) and my employer EnterpriseDB who has supported this work. I would also like to thank Rafia Sabih who helped me in doing performance testing for this blog.
2018/05/26
Infoman

The Importance of Deep Work and the 30-Hour Method for Learning a New Skill 303 ingve 4 hrs 74 https://azeria-labs.com/the-importance-of-deep-work-the-30-hour-method-for-learning-a-new-skill/ news.ycombinator.com/item?id=17163251 The Importance of Deep Work & The 30-Hour Method for Learning a New Skill

The tech industry, especially the security industry, seems outrageously overwhelming to newcomers and even as an intermediate “InfoSec Pro” there seems to be an overwhelming number of paths and topics one can focus on. The problem most of us, especially newcomers, encounter is that we don’t know what to focus on. Even when we find a topic to focus on, we seem to get stuck in the vast pool of resources that are available to us.

Take the GitHub repository Awesome Hacking (highly recommended), for example. Many people are aware of its existence. The very same people are sending me messages and asking where to start and how to not be totally overwhelmed by what seems to be a structured collection of valuable resources but doesn’t seem to solve our problem. But what exactly is our problem? It’s certainly not the lack of resources. Why is it, that although we have access to all the resources we need for developing a new skill, we fail to do so, even if we have the time or could rearrange our schedule to make time for it? Perhaps we have forgotten that the distractions we face on a daily basis prevent us from performing to the best of our abilities.

We all know this feeling when we want to learn something new. We wait until motivation strikes us out of nowhere, then we tinker around for a few hours without a clear direction, checking notifications, and as soon as we realize that we’re not getting anywhere, we get discouraged and give up. Side note: if you wait for motivation, you’re doing it wrong. The formula to induce motivation, in my experience, starts with action, which sparks inspiration, which sparks motivation, which leads to action, and the loop continues.

We also know and have experienced the feeling of flow. The moment when you’re fully focused on a task. You lose all sense of time, and everything seems to flow effortlessly; you forget everything around you and have a feeling of control over the task. This rewarding feeling of flow is best described by Psychologist Mihaly Csikszentmihalyi:

“The best moments usually occur when a person’s body or mind is stretched to its limits in a voluntary effort to accomplish something difficult and worthwhile.”

Mihaly Csikszentmihalyi

Why is it that this state of flow seems so arbitrary and rare, like something that we happen to stumble upon by mere coincidence? Why don’t we strive to create a state of flow as often as possible? After all, it is not only satisfying, but also very productive and yields positive rewards. The reason we rarely reach this state is that we constantly need to remind ourselves that we live in a world full of distractions. And sometimes it is difficult to press the pause button.

To create a state of flow, one must follow certain rules and embrace deliberate practice through a concept called deep work. In order to produce the absolute best results you’re capable of, you need to commit to deep work. The key to developing the ability for deep work is to move beyond good intentions and add routines and rituals designed to minimize the amount of your limited willpower necessary to transition from a distracted state into a state of stable concentration. The rule of thumb is that it takes approximately 25 minutes of focus without distraction to reach a state of flow. If you’re checking your Twitter notifications every 20 minutes, which seems harmless, you prevent your brain from reaching that state and therefore prolong the time required to complete your task.

The Law of Productivity: High-Quality Work Produced = (Time Spent) x (Intensity of Focus)

Don’t make the mistake of confusing productivity with busyness. Doing lots of stuff in a visible manner does not mean you’re being productive. Most of what we do is Shallow Work:

“Shallow Work: Non-cognitively demanding, logistical-style tasks, often performed while distracted. These efforts tend not to create much new value in the world and are easy to replicate.”

Cal Newport

Cal Newport is the author of the book Deep Work: Rules for Focused Success in a Distracted World (which I highly recommend!) and he argues that if you spend enough time in a state of obsessive shallowness, you permanently reduce your capacity to perform deep work. Social Media overuse is exactly the type of obsessive shallowness he’s referring to here, but not the only one. He defines Deep Work as follows:

“Professional activities performed in a state of distraction free concentration that push your cognitive ability to their limit. These efforts create new value, improve your skills, and are hard to replicate. Deep work is hard and shallow work is easier and in the absence of clear goals for your job, the visible busyness that surrounds shallow work becomes self-preserving.”

Cal Newport

Deliberate practice cannot exist alongside distraction. You get better at a skill as you develop more myelin around relevant neurons, allowing the corresponding circuit to fire more effortlessly and effectively. Therefore, to be good at something is to be well myelinated. Through deliberate practice and by focusing on a specific skill, you’re forcing the specific circuit relevant to that skill to fire, again and again, in isolation. This repetitive process triggers cells called oligodendrocytes to start wrapping layers of myelin around the neurons in the circuits, which in turn effectively strengthens the skill.

Ok. This all makes a lot of sense, but I can tell from experience that simply knowing these things won’t put you any closer to your goal. I’ve read an entire book on Deep Work and the biggest lesson I learned when trying to implement Deep Work into my daily/weekly schedule is that if you don’t plan it carefully and make it a strong habit, you will fail to develop this skill and automatically fall back to unproductive tinkering. After all, you have a finite amount of willpower that becomes depleted as you use it. As it turns out, we all have approximately 4 hours of willpower available each day. Trying to force yourself to finally get started while procrastinating is exactly where your willpower gets depleted in the most unproductive way. If you have a fixed plan, a habit, you save your willpower for the actual task.

Another important lesson I’ve learned is that practice != deliberate practice. Deliberate practice refers to a special type of practice that is purposeful, systematic, and stretches your mind to its limits. Regular practice might include mindless repetitions of the same task, while deliberate practice requires focused attention and is performed with the specific goal of improving performance. The natural tendency of the human brain is to transform repeated behaviors into automatic habits. The more we repeat a task the more mindless it becomes. Mindless activity is the enemy of deliberate practice. Behavioral psychologist James Clear confirms,

“Too often, we assume we are getting better simply because we are gaining experience. In reality, we are merely reinforcing our current habits — not improving them.”

James Clear

We all have the capacity to improve our performance in any area of life if we train our brain in the correct way. This is easier said than done. Let’s be straight here. Deliberate practice is not a comfortable activity and it requires sustained effort and focus. It is basically the process of failing, over and over again, because through failure we know that we have stretched our limits. Take lifting weights as an example. You lift weights until you fail and have to take a break, which is exactly where your body learns to expand its current limits and prepare to be stronger the next time you perform this activity. Force yourself to take on challenges that are beyond your limits. Pick a project that forces you to learn new concepts and techniques. When you read a scientific paper, systematically look up the words and concepts you don’t understand rather than discarding it with a “I don’t understand half of it anyway” attitude.

When performance psychologists began to explore what separates experts, in many different fields, from everyone else, the single coherent answer was: deliberate practice. Our culture loves the story line of the prodigy and the notion that experts posses a inherent talent that separates them from everyone else. But in reality, to master a cognitively demanding task requires this specific form of practice. There are only a few exceptions made for natural talent. K. Anders Ericsson introduced the concept of deliberate practice in his 1993 paper “The Role of Deliberate Practice in the Acquisition of Expert Performance“, where he stated:

“we deny that these differences are immutable, that is, due to innate talent. Only a few exceptions, most notably height, are genetically prescribed. Instead, we argue that the differences between expert performers and normal adults reflect a life-long period of deliberate effort to improve performance in a specific domain.”

K. Anders Ericsson

Putting it into Practice

You need to choose a strategy/philosophy that fits your specific circumstances, as a mismatch can derail your deep work habit before it has a chance to solidify. Here are some strategies I extracted from the book Deep Work: Rules for Focused Success in a Distracted World:

Monastic: “This philosophy attempts to maximize deep efforts by eliminating or radically minimizing shallow obligations.” — isolate yourself for long periods of time without distractions; no shallow work allowed. Bimodal: “This philosophy asks that you divide your time, dedicating some clearly defined stretches to deep pursuits and leaving the rest open to everything else.” – dedicate a few consecutive days (like weekends, or a Sunday, for example) for deep work only, at least one day a week. Rhythmic: “This philosophy argues that the easiest way to consistently start deep work sessions is to transform them into a simple regular habit.” – create a daily habit of three to four hours every day to perform deep work on your project. Journalistic: “in which you fit deep work wherever you can into your schedule.” — Not recommended to try out first, since you first need to accustom yourself to deep work. For my current lifestyle, I prefer to switch between the Rhythmic and the Bimodal. You don’t have to fit on one box, but you can use these strategies as reference points when developing one that fits your circumstances.

“But I don’t know which topic to focus on”

Fair enough. It’s difficult to know in advance what could become “your thing”, since our interests vary from person to person and only because I like ARM exploit development, doesn’t mean it is something you would enjoy doing yourself.

Here’s an idea:

Pick a skill that can be useful to your current path If you don’t have a path yet, pick a skill that is generally useful or one that you could potentially transform into a career. Give it a try for minimum 30 hours (deep work!). You might not like it at first. Don’t get discouraged right away. Things we’re not good at are scary and we don’t like doing what we suck at. The trick is to overcome the initial frustration until you get your first rewarding experiences. Split your 30 hours into seven 4-hour sessions (plus buffer). Set clear goals of what you want to accomplish with this project. Remember, the goal is not to become a master within 30 hours but to use your time efficiently to learn enough so you can judge if you want to continue or switch to another subject.

Use your first session to perform extensive information gathering. Look at the resources available to you and pick the ones that stick out as the most useful for completing the project you’ve chosen. If necessary, use the second session to set up the environment (e.g. an analysis environment for Malware analysis including all tools you could possibly need for your first analysis) and define clear goals (e.g. Analyze Malware x). It is important to set clear goals and split them into structured parts.

If you complete two sessions per week, you’ll be done in 3 weeks. Worst case scenario: You realize that you don’t like it, but you have spent 30 hours learning something challenging and new that you wouldn’t have otherwise learned. Best case: You realize that this is actually fun and want to continue it. Having already started, you overcame the most annoying part and can now happily continue developing your skill further.

2018/05/26
Infoman
Ask HN: How are you building cross-platform (mobile and browser) apps?

123 aosaigh 8 hrs 69 news.ycombinator.com/item?id=17117243 I've been developing web apps for 5+ years and in my next project I've been tasked with building a mobile (iOS and Android) app that we can also run as a web app. I would obviously like to try keep a single code base for simplicity as we have limited resources. I've investigated writing a PWA but I'm put off by the arbritrary heuristics that Google are placing on whether or not the apps are presented as "installable". After that, it seems the only options are Ionic, or React Native + separate web app.

What is your experience writing apps for both mobile and browser?

tabtab 0 mins Advice: get out of the UI/UX business, it's an ever-changing grinder. Unless you enjoy relearning 50 Shades of the Wheel every 3 years, bail fast and quick. An alternative may smaller internal applications where they care less about latest-and-greatest UI's. It still changes, but not as fast.

jqbx_jason 3 hrs I use React + React Native for https://www.jqbx.fm. As a 1 man project it seemed like the only sensible way to build mobile (android/iOS) and browser versions. I can share almost all of the code (where applicable) so one can move a lot faster and have a lot less mental overhead.

That being said React Native has stability and performance issues that are tricky and can hold up your app for a non-trivial amount of time. Also staying on top of updates requires diligence and can be a pain. But if you're looking for the quickest path to market I would say look no further.

ChicagoBoy11 1 hr That looks incredibly well put together -- congratulations. I'm about to launch my first commercial React Native app (pretty simple app aimed at general aviation pilots), so let me know if you end up sharing some of the code for your project -- I'm sure there's lots to learn from it!

SeanLockItUp 1 hr I'm building my first app in React Native right now - I have a native Android background though.

Can you shed some light on what some of the performance and stability issues you faced are? What can I expect and how did you deal with them or work around them?

Nice app btw!

jqbx_jason 55 mins Sure- a couple of (oddly specific) details:
1. Long lists (>100 items) don't perform well if you have to reorder them. Initial render is a bit slow but not that noticeable but if you have to reorder or add/remove from them on the fly it can be resource intensive.
2. Animation behavior varies between Android and iOS depending on what you're animating.
3. Re-rendering is expensive so you need to be careful when you update your state if you're using redux.
4. Easily fixable but console logging is expensive so be sure to remove all JS logs from production.
gubsz 2 hrs Wow that app is exactly what me & my friends have been looking for. They even started hacking together an Android version of this. Looks really well done!

One question: Do you plan on writing a native desktop solution? I'm not a fan of having to keep my browser open just to run a single app.

kovacs 1 hr Hehe.. turntable.fm v2.0 :-) https://en.wikipedia.org/wiki/Turntable.fm

Just checked it out. This is really well executed! Definitely doesn't look like a one man operation. Congrats!

jqbx_jason 1 hr Thanks! And yeah heavily inspired by tt.fm (RIP). Hopefully the community keeps growing and can bring some of that 2011 internet magic back.

kovacs 1 hr Yeah and this is smart because this time around the licensing falls on Spotify where as back then TT had to negotiate licensing if I'm not mistaken. I'm not a lawyer but if that's true this seems much more viable using Spotify's APIs with the caveat that your entire business relies on them if that's your aspiration. Regardless, wish I'd thought of this :-P Seems like it would be such a fun app to work on :-) Best of luck to you!

(BTW it just pinned a Google chrome helper on my machine so I had to kill it. Not sure if you know anything about perf. with your app yet. Just FYI)

jqbx_jason 1 hr Yeah it's fun- and you're right about the licensing and reliance on Spotify. Hopefully it all works out but who knows :)

Sorry about the perf- it's a known issue and I'm working on it, I only recently got it (somewhat) feature complete so It's next on the list...

jqbx_jason 2 hrs There's a desktop app available for Mac (it's an electron port of the webapp- if anyone's curious). A windows version is coming soon (ETA ~1-2 months).

ratsimihah 2 hrs Cool app! I got a little confused as to how to add songs once you're a DJ, but the whole things looks cool, and you seem to have a nice community already!

jqbx_jason 2 hrs Thanks! Please join in :)

Also, thanks for the feedback I actually keep getting similar comments that it's a lot to learn all. I'm currently trying to simplify things. To add a track you just add it to your "queue" by searching and clicking the plus icon, then when it's your turn (your UN is all the way to the left) your track will play for everyone. Assuming you figured it out but just FYI

bytematic 3 hrs Do you share components too? How are you doing styling? I'm using a mix of js variables for different platforms and scss files but I'm finding it kinda complicated. I would like to use styled-components somehow.

jqbx_jason 2 hrs For JQBX the styling is done differently between mobile and web. I stared off using scss for web (old habits die hard) and then had to use JS styling for react-native. Not the biggest deal though since the UI is where the two apps diverge the most. Very few things use the exact same UI patterns between web and native. But if I were to do it again (and had a design laid out in advance) I would probably opt for JS-styled components across both versions- though the "CSS" syntax is a little different so you would need some way to port that. I think it still makes a bit of sense to keep styling separate between web and mobile though since you're dealing w/ a different interface... but like everything it depends on what you're building.

Zaheer 2 hrs Looks nice! What are you using for the backend?

jqbx_jason 1 hr Thanks! BE is Node + Express. I tried to keep a lot of the logic in the clients to it's pretty slim. I'm a FE developer professionally so keeping it all within the JS ecosystem was most comfortable for me.

d0m 3 hrs It's the third time I have to build the whole stack (web+ios+android).

For the first time, I used a webapp and was hoping that the ios/android experience would be good enough. Unfortunately, It wasn't and it was a big mistake. I'd only recommend this for quick mvp knowing that it'll need to be rewritten or if your audience really understand what it means to have a mobile webapp compared to a native app. I.e. if there's an IT department in place that can install it on the devices and understand the limitations.

For the second time, we went with ionic/phonegap. It was a huge improvement, but we hit too many limitations and scenarios where we wanted native tweaking for animations or handling the keyboard hiding fields or the topbar acting weird, etc. You don't see those issues at first.. but they start appearing as you start doing QA on more devices and with real users. And at that point, you've invested so much in trying to make it work that you can't just go back, so you start piling weird hacks on top of weird hacks.

For the third time, we went with react-native. Overall it was a great experience and unlike ionic, it's a real native app, not just a webview. We could reuse a big part of the code between web, ios and android. The issues we faced were often related to weird edge cases that are buggy within react-native itself such as input fields not working correctly when dictating or a "pull-to-refresh" supposed to be stateless but in practice being stateful and buggy if you call "refresh" on it twice within 30ms. However, it's a good feeling to know that when we'll have the time, we have the flexibility to either fix the library itself or re-write it (compared to ionic where we couldn't do much and web apps where the solution to most our problems would be to "wait a few years until the browsers decide to improve it".)

If I had to do it another time (a fourth time), I'd go with react-native again but I would make sure to stress test the libraries with real data on all the devices we'd want to support. Also, it's popular in the javascript ecosystem to have libraries that depend of another library that depends of another library that wraps another library.. in most cases, it's just better to write a quick wrapper for your app and only include the inner-most library that does most of the work anyway. Otherwise you're depending on too many authors and libraries quickly go out-of-sync and you're stuck with old versions that aren't compatible with new ones.

sdcooke 5 hrs We use React Native for our apps and React for desktop - I'd say about 95% of the Android/iOS code is shared and we're able to share a lot of business logic between mobile and web. Having all of the code together in one repo has worked really well for us and some of the most complicated stuff is shared between all platforms.

If you want to share UI across platforms you could potentially use something like https://github.com/lelandrichardson/react-primitives to do that, but we don't and I'm not sure we'd want to because we don't want to use the same design on all platforms.

ben_jones 27 mins Tweak the question, instead of "is there a framework that makes this difficult task simple" ask "is this a difficult task that can be simplified without significant investment or overhead?".

Personally I don't think RN, Ionic, Electron, or any other tools completely solve all cross-platform development issues. Like all things its a tradeoff and personally I am not convinced that what we have out there is sufficient for most applications - particularly for small teams. Small apps maybe, but the second you have to go off the beaten path you will be losing weeks not hours of development time.

chrisco255 22 mins Yeah but the alternative is to write native applications for every platform, which would easily cost you months, not weeks of development time.

soulnothing 4 hrs I've been using Kotlin for the past few years. The multi platform support is getting really nice. Ios is the lagging participant, but with the upcoming conference alot of the niggling bugs should be addressed. Right now JVM, android, and js are all stable.

Writing a graphql endpoint emitting a data class. Then have react directly cast to that same data class. With proper type safety is great.

There are bugs but they feel like fringe cases. I spent half a day cleaning up my bindings to react material ui. An hour or two fighting serializaiton bugs. Those are the biggest time sinks that come to mind. It's still marked as experimental but it's something to keep an eye on.

kenmicklas 3 hrs Haskell on web, Android, iOS, desktop (and shared code with the server of course) with https://github.com/reflex-frp/reflex-platform

It's pretty hard to beat the productivity of one codebase for every platform with a powerful type system catching errors across every part of system.

SCdF 5 hrs We've built an offline first webapp that is basically a PWA (it's one manifest file away from being one IIRC), but instead of relying on Google to have something installable1 we also create an Android app which is just1 a web view hardcoded to the correct URL.

I'm not convinced this is what we'd do if we were starting fresh, I imagine we'd look at React / React Native. However, this definitely works for us for now.

1 We also deploy to very old / basic phones, so we use this opportunity to bundle our own version of the web view so we can target higher chrome versions.

yesimahuman 1 hr This is exactly the vision we have for Ionic and where we are taking it. One app that works great in the app stores and when deployed on the web (or even electron), built entirely on standard browser technologies. If you are put off by Angular, our v4 release (alpha right now but quickly heading into beta and then production ready) was rebuilt on top of web components and is framework agnostic.

It also happens to be creating some of fastest PWAs right now based on benchmarks. We built a lot of web component tech to make sure we were sending the least amount of code to the client and things like SSR and lazy loading with minimal configuration on your part (see our web component compiler Stencil we built in order to build our v4 components: http://stenciljs.com/).

http://ionicframework.com/

tsmall 6 hrs Depending on your needs, using something like Turbolinks 1 may be a great fit. There are iOS and Android libraries that can make your web app talk to your native app so it can do things like trigger screen transitions, populate native menu or tab controls, etc. We're using a similar idea at my company and so far it's been very successful for us.

deedubaya 1 hr I use Turbolinks over at HOALife.com. Mobile clients take advantage of native geolocation, camera, and photo library upload.

The web, iOS, and Android devices utilize all of the same server generated HTML + JS google maps et al. 0 to completed for both Android and iOS in maybe 30 hours because of the native API stuff I had to learn. If you don't need those native API's or know Swift/Java better, that time could be trimmed down considerably.

thrownaway954 4 hrs there was a talk at RailsConf 2016 by Sam Stephenson about how Basecamp used Turbolinks to create version 3 of their, an android and ios version in 18 months.

https://www.youtube.com/watch?v=SWEts0rlezA

ianjsikes 1 hr Just wanted to mention that React Native + React Native Web is a viable solution (at least for me it was). I was able to convert a mobile React Native project into a usable mobile website with Next.js and react-native-web.

I had to use a lot of platform-specific imports (eg: index.ios.tsx/index.web.tsx) to replace anything mobile-specific, and there are some cases where you need platform-specific UI components as well to make everything look nice on larger screens.

My only complaint is it gets a bit messy having all these different entry points and platform-specific modules and whatnot. Overall, it's probably the best you can hope for to write an app for mobile + web with ~80-90% actual code sharing.

mychael 2 hrs Create React Native App (CRNA) with Expo. It doesn't get any better than this from a developer experience perspective.

weka 2 hrs How does it handle Electron apps? I thought playing with EXPO was a limited venture?

sodafountan 2 hrs I'm currently developing with Expo with plans to expand to Electron (though I haven't written anything for Electron yet, just the React-Native and Expo portion) but my theory is that once you have the core React functionality down (The API endpoints, Reducers and Actions (if using redux), and general component structure) then porting to Electron will be fairly trivial.

React-Native has a lot of cross-over with React for the web. So I'm hoping when the time comes my port will go smoothly.

teo4oro 2 hrs How are you building the applications for the app stores?

tunaoftheland 2 hrs https://docs.expo.io/versions/latest/distribution/app-stores

create-react-native-app works by leveraging Expo

gldalmaso 5 hrs You should consider your target audience and your own resources. For consumer facing apps, I'm not sure an hybrid (cordova / ionic / webview shell) approach is really up to par, as the UX is really challenging to make right and performance will be lacking. That said, a native approach requires twice the codebase and twice the resources (man hours) roughly, so the challenge becomes maintaining feature parity and team expenses.

Apps targeted for B2B users are considerably more flexible in terms of UX, the goal is mainly to help users get stuff done, so hybrid is more viable here. Which is what we usually do with cordova. Some considerations to bear: using cordova, the team doesn't really get much expertise with the proper platform, so problems are sometimes harder to debug because of lack of developer maturity in the platform. You need to design with an eye to light performance requirements, which usually means facilitating inputs and maybe have a separate web interface for complex UI like dashboard and management.

If you absolutely have to share code between apps, your options are:
- hybrid approaches like cordova, or build your own native web view shell and load your web code manually
- react native, which is not v1 yet, and looking at it recently I'm personally not sold on it yet, many unkown unknowns to actually double down and build on it. But that's just my opinion.
- Black box compatibility frameworks like Xamarim, Nativescript and the like. They work by giving a common platform middleware that builds to multiple target platforms. There are a lot of trade offs here, specially the lack of control. If a feature is buggy or not supported there is little recourse.
- I have read some big companies share code via C++ bindings used natively on each platform (loaded in Java and Objective C). I imagine this technically "solves" the problem, as you can share code and build natively, though I have no idea what tooling there is to help with this, and imagine the developer experience gets the short end of the stick.
edit: typos

Nelkins 9 mins Xamarin (the code) is open source[0]. Only the bells and whistles (live code preview, integration with VS/VS4M, etc.) are closed source. I think.

[0] https://github.com/xamarin/Xamarin.Forms ; https://github.com/xamarin/xamarin-android ; https://github.com/xamarin/xamarin-macios

pier25 1 hr

or build your own native web view shell and load your web code manually

After a few Cordova and Electron projects I'm going to try this approach in my next project.

I need to support 5 OS (Android, Chrome OS, iOS, macOS, Windows) and having a native UI for each platform is completely out of the question.

I think a web UI is a valid approach. Not only it reduces dev time, but it also adds responsive features not available anywhere else.

This is a great example of a web iOS done right: https://medium.com/missive-app/our-dirty-little-secret-cross...

nailer 3 hrs Instagram is pretty popular, has a good UX and is built on a webview (ocne a year on a shitty connection the CSS doesn't load and you see it).

slow_donkey 43 mins Wow I wasn't aware but looks like they did start with webviews and migrated to native + react native

dangoor 4 hrs At Khan Academy, our award-winning1 mobile apps are a combination of native + React Native + web view. The React Native part is relatively new, but it's definitely helping us to move a lot faster in developing our apps.

A few years ago, I worked on a project in Xamarin with some success. The iteration cycle with React Native is far faster, though.

1 https://blog.google/products/google-play/winners-2018-google...

andrewstellman 5 hrs Consider taking a look at the Visual Studio tools, which have really matured over the last few years: https://www.visualstudio.com/vs/features/modern-web-tooling/

Specifically, tools for Apache Cordova: https://www.visualstudio.com/vs/features/cordova/

(disclaimer: I haven't used them, but I've heard very positive feedback)

WhitneyLand 4 hrs 1) The Microsoft development product line is great at some things, but not for directly enabling cross web/mobile solutions. However do use VS Code as the environment for other solutions mentioned here.

2) If you are a non-MS person, make sure you don’t miss out on the greatness of Visual Studio Code by dismissing it as yet another Windows centric product. VS Code is world class performant, has a great plugin arch/ecosystem, and somehow combines a hardcore developer first mindset with carefully thought out UX at the same time.

Also to be clear for those not much in the MS world, the “Visual Studio“ product line you’ve heard of for decades is not the same thing. It’s confusing naming but Visual Studio Code is relatively new and very different.

osrec 8 hrs We launched https://usebx.com as a PWA, and have successfully managed to keep a single code base across pretty much all devices. The install process isn't much of a problem either, as a user can always "install" your app by adding it to the home screen. I would definitely recommend a PWA, unless you need some hard core native features that aren't available in browsers yet.

olijka 7 hrs Do you have any requirements for offline data storage for your PWA? If yes, how do you manage it? From what I've heard the amount of space available for data varies wildly between devices. In that case what does your offline data storage strategy look like?

osrec 6 hrs We use indexeddb, which is generally okay, but you're right, the DB size can vary across browsers (I think some limit to 10mb, and others to half the HDD). For our use case, it was good enough. Our strategy is to try and cache things offline, but if indexeddb fails to store the data, we attempt to fetch from the server. As the saying goes, cache invalidation is hard, but that's true regardless of the platform.

tunaoftheland 1 hr My take on this is that React Native works fine for content-dominant (media, text) apps but maybe not for UI interaction-dominant (arcade games, heavy animations, gestures) ones. You share a very similar API (React) and possibly the business logic between web and mobile. Your project could get bogged down by many little details and idiosyncrasies of React Native so a clear scope and discipline is important.

One example is a Bluetooth-enabled iOS/Android app that I made (but did not publish to app stores). I was able to use a RN library for Bluetooth communication and interact with another device (a bathroom scale) in JavaScript. It was one of those "Wow, this is cool!" and "Man, this is pain!" moments. Note that I did not use create-react-native-app/Expo for this.

Another app, also iOS and Android, simply renders the content of my wife's Etsy store, including the pictures (published to both Apple and Google Play stores). It was done using create-react-native-app/Expo. I didn't like the dependence on the Expo site for building app packages. It's free and there for now but I'll have to "eject" the app in the future if the something were to happen to the site. I used an open-source RN components library which does a good job selecting default typefaces and sizes. There were still fiddly bits I had to poke at to make it look decent, but it was alright for something that I whipped up as quickly as I could. The documentation for the component library was not keeping up with the continuous changes React / React Native / the library itself so that was a pain.

Note that it can get a bit confusing keeping track of what you can and cannot do with create-react-native-app/Expo. You might have to scope the app appropriately until you feel ready to "eject" it from Expo and access the more lower-level RN APIs.

On the web side, I find that I can grok the React API more easily than most other SPA libs. So there's natural affinity for me to keep the API complexity down in the projects that I choose to do by preferring the React-* APIs in general.

I agree with @jqbx_jason's comment and RN was the only sensible (sane?) choice in my case for the 1-man projects. Some background: I have professional experience in Java, C#, C, JavaScript/ES6/TypeScript and few others, but no experience doing fully-native iOS and Android apps.

FWIW, Pinterest seems to be liking RN for their mobile apps: https://medium.com/@Pinterest_Engineering/supporting-react-n...

philippz 1 hr We (STOMT) use Cordova/Phonegap and AngularJS for our desktop/mobile apps. Ionic is considered to be faster but it's difficult to implement custom UI. Ionic might be interesting for casual apps, for us it would mean to do a complete rewrite.

kreck 2 hrs We're running all our apps based on Ionic which works absolutely brilliant & allows for the deployment as PWA today or at any point in the future. That being said we primarily build b2b applications. Minor drawbacks to native in terms of UX performance exist, but tbh, if you know how to optimize rendering performance in a browser you'll get 99% of native performance by putting in the effort.

For us the ability to run on literally any(!) device (this includes for example also smart TVs) completely outweighs the potential (minor) performance drawbacks.

zerr 6 hrs Interestingly, Flash/Air seems most-popular cross-platform mobile toolkit for app dev (far ahead React Native):

https://blog.appfigures.com/wp-content/uploads/2018/03/11-No...

(from https://blog.appfigures.com/ios-developers-ship-less-apps-fo... )

dangoor 4 hrs A lot of games have been made in Flash. I'm guessing that a lot of those apps cited are games (which is true for a few other frameworks on that list).

tones411 5 hrs Ionic can get you the most code sharing. Ionic uses a web view to render the UI so it will never get you the same as a native UI, but it is actually really good. Expect a few delays here and there, though. Make sure to try it out on the oldest phone you plan on supporting to see if you’re okay with the performance before moving forward. Ionic will get you the most code sharing.

React Native is a great for cross platform iOS and Android native. If you want code sharing across native app and web app, look into ReactXP, or come up with your own code sharing technique, which apparently @sdcookie’s team did.

Titanium from Appcelerator also supposedly targets Native and Web.

Also consider focusing your efforts on native and not doing a web app. RobinHood stock trading app went a long ways without having a web app. Just throwing that out there.

arca_vorago 2 hrs Pure html+css with as little js as possible...

eg: websites/single page webapps over native ios/android apps

gtycomb 1 hr Wow. Among all conversations, haven't heard this simple truth mentioned any more. Would love to hear more discussion along these lines.

CryoLogic 51 mins Before hybrid apps where a thing I would build HTML/CSS/JS web apps and put them in an android web-view with no controls. Easy peasy.

You can use local storage to cache for offline use. TBH I don't think most apps really need the overhead of these new libraries. Half of the apps on the app store just display and update data from a DB.

aerodog 4 hrs Decided to give a go at React XP. Based on their claims, they're good because:
- React Native Web and React Native (iOS/Android) are handled in one go
- Windows Support
- Stripped down so nothing from within will work on iOS but not Android, for example, as is the case with React Native...
- Lots of components from Material UI (just launched v.1) can work right on top without too much of a hitch
Caveat: we're just getting started, so I don't want to oversell this. But faced with a similar problem, this route seemed optimal at this time.

gede 6 hrs If web app is not necessary you also have flutter.

maremmano 3 hrs you can also do web app in DART (the language on which flutter is created) you can do mobile, web and server cli apps in DART

https://www.dartlang.org

teo4oro 4 hrs At my company, we're building our mobile applications using React + Cordova. I loved the idea of React Native, but after some reading I wasn't convinced given how difficult it seemed to be to get the app built for the App Store and Play Store.

curyous 2 hrs You can share JzvaScript code without having to use a framework. Both iOS and Android let you run JavaScript within a native app.

patwolf 5 hrs Ionic uses Cordova, which you can use directly without having to use the rest of Ionic. You're then free to write the app in React or whatever web framework you prefer.

The only downside is if you do want a native look and feel, you'll need to find a UI library to provide that, but that's no different than if you were writing a PWA.

davman 6 hrs https://github.com/necolas/react-native-web

mandebi 2 hrs I were looking at Vue NativeScript. Anybody on why should I not?

pragueexpat 1 hr Also curious if someone has anything to say about Vue/Nativescript. That would be my choice as well. I'm constantly wondering why React Native gets all the attention when Nativescript seems to have so much going for it.

slow_donkey 15 mins Imo it's hard to justify betting a product on significantly smaller communities like nativescript/weex. Also when other companies have successfully used rn in prod like fb, insta, airbnb, the stress testing has already been done for you whereas I know of exactly 0 large scale deployments on those frameworks (even flutter had the Hamilton app)

WA 5 hrs I use Ionic + PouchDB/CouchDB.

One code base plus auto-syncing of user data.

Works pretty great.

Ionic is pretty close to a native feeling. I think most people wouldn’t be able to tell the difference.

daurnimator 6 hrs React Native. Trying out http://expo.io/

bernardino 3 hrs How do you like using Expo? Any serious drawbacks?

adley 6 hrs DronaHQ has a container product that runs on all mobile and desktop platforms as well as a web app. http://www.dronahq.com/platform/uec/

Edit: [Disclaimer] I work with them. To clarify, the container is already built, you can build hybrid or native apps on top of that.

Gys 6 hrs Please add a disclaimer if you have some kind of relationship. DronaHQ is obviously an enterprise solution: price info only on request and it seems the goal is to build the app for you.
2018/05/21
Infoman

People Loved MoviePass Nearly to Death

76 pat2man 4 hrs 67

https://www.bloomberg.com/news/features/2018-05-16/with-vultures-circling-moviepass-still-believes-in-a-happy-ending

news.ycombinator.com/item?id=17115788 Hannah Wolfe became a MoviePass Inc. member, hit the pricey theaters of New York, and began doing her part to drive the company out of business.

Since paying the $9.95 monthly fee for the movie-a-day service in January, Wolfe has seen Black Panther and most of the Academy of Motion Picture Arts and Sciences’ Best Picture nominees. Twelve films in total, at no additional cost to her. “It seemed a little too good to be true, especially in New York where movies cost like $16 each,” she says. “It feels like I haven’t paid for the ticket.”

In a way, she hasn’t. Wolfe has paid MoviePass about $50, and in turn the company would have likely shelled out almost $200 to theaters to cover the full ticket prices. To make matters worse, Wolfe has been recruiting everyone she knows—and some are getting even more out of the service. Her roommate rarely went to movies before and recently saw five in a week. Her father, a retired teacher, is on pace to see 40 films this year.

Eight months after slashing its price and expanding membership past 2 million users, MoviePass is now at risk of going bust. The parent company, Helios & Matheson Analytics Inc., which now owns 92 percent of MoviePass, said last week that it had just $15.5 million in cash at the end of April and $27.9 million on deposit with merchant processors. MoviePass has been burning through $21.7 million per month. A U.S. Securities and Exchange Commission filing last month revealed that the company’s auditor has “substantial doubt” about its ability to stay solvent. Michael Pachter, an analyst at Wedbush Securities Inc., warns that MoviePass may not survive the summertime run of blockbusters.

On Tuesday, Helios reported the performance of MoviePass for the three months ending on March 31. The company lost $107 million, earning just over $1 million from marketing deals and $47 million from subscriptions. Helios shares have fallen to decade lows of less than $1 after peaking at $32.90 in October, alongside the MoviePass hype.

Shares of MoviePass's parent have swooned after a huge spike that mirrored membership gains — albeit briefly.

Source: Bloomberg, MoviePass

To critics such as AMC Entertainment Holdings Inc., the largest theater chain in the world, this looks like a comeuppance for a business strategy that always required either suspension of disbelief or faith in Silicon Valley-style magic. “What we objected to was their price point, which we believed would cause them to hemorrhage cash and have an unsustainable business model,” says AMC Chief Executive Officer Adam Aron. That “doesn’t mean that the subscription model is a bad idea,” he adds.

Even rivals with subscriptions have been left puzzled by what MoviePass is doing. London-based Cineworld Group Plc offers an all-you-can-watch subscription in the U.K. that costs nearly three times as much. Cinemark Holdings Inc., the third-largest U.S. theater chain, has a $9 monthly subscription plan that affords just 12 films in a year.

Executives at Sinemia Inc., a service from Europe that charges its U.S. members $15 per month for a maximum of three films and is being sued by MoviePass, can’t figure out how the model makes sense. “Every investor asked me if I’m going to do the same pricing,” says Sinemia CEO Rifat Oguz. “Honestly, we thought it was a promotion,” he says. “It turned out, it wasn’t.”

Unlike a superhero prequel, the third act for MoviePass remains unpredictable even though the story looks familiar: an upstart willing to burn a pile of money to fuel rapid growth and disrupt an entrenched industry. The $10-per-month unlimited deal will likely prove temporary in the end, either because the company runs out of money or else decides to change the offer for the sake of its survival. But whatever happens, the big-screen subscription model MoviePass has popularized could end up changing the economics of the multiplex.

MoviePass CEO Mitch Lowe, 65, knows the audience of investors and multiplex owners doesn’t believe the script he’s been shopping around for months. Some of the dialogue can ring false.

“Who’s profitable out there?” Lowe asks in an interview. “Spotify isn’t profitable. Netflix isn’t profitable. God knows, AMC isn’t profitable.” The only problem with this view of the competitive landscape is that it’s not entirely accurate: In the most recent quarter, both Netflix Inc. and AMC reported profits.

Mitch Lowe, chief executive of MoviePass, in the company’s office at a WeWork in Manhattan. Lowe should be familiar with Netflix. He worked there until 2003, guiding the company’s position in the video-rental era and forging partnerships with companies such as Best Buy Co. From there, he jumped to the DVD vending-machine empire Redbox Automated Retail LLC and tried to outmaneuver and undercut his former employer.

MoviePass had just 20,000 members when Lowe joined in June 2016 with an undisclosed stake, a fresh hypothesis about disruption, and a techie wardrobe topped off with the facial hair configuration known as a soul patch. The multiplex, as he saw it, was the only entertainment venue that hadn’t been transformed since the advent of software special effects.

A little more than a year after taking the top job, Lowe linked up with an investor named Ted Farnsworth, the onetime owner of a psychic hotline, to make a dramatic move. Farnsworth’s penny-stock firm, Helios & Matheson, bought 51 percent of MoviePass for $27 million and provided the financing to slash the membership price from about $35 a month to $10.

It’s pure Silicon Valley logic. As long as MoviePass can capture enough users, Lowe and Fansworth believe, money will roll in from Hollywood marketing budgets, retail advertisers, and even theater owners themselves. Right now, MoviePass claims to buy one of every 17 cinema tickets sold in the U.S. On this theory, the company’s mounting losses won’t matter if it can put millions of butts into those new recliners.

The reason MoviePass’s plan sounds plausible is that startups with similar all-you-can-eat pricing models have already reshaped the music and movie-rental business. But Spotify Technology SA and Netflix didn’t just offer low prices to consumers—they also acquired content cheaply, whether by buying DVDs that could be rented many times or paying low royalties to musicians.

“It works if enough people sign up and literally forget they have the subscription”

Movie theaters have little incentive to offer discounts to MoviePass. In fact, theater owners have been raising box-office prices, pushing revenue to near all-time highs, as a way to offset lower attendance. The average multiplex ticket price in the U.S. and Canada increased 26 percent from 2007 to 2016, according to the Motion Picture Association of America, while the number of tickets sold slipped 6 percent.

This downward trend in turnout has persuaded theater owners to focus on quality, not quantity. A widespread industry vogue called reseating has removed rows of stadium-style chairs in favor of fewer, larger seats. Giants such as AMC and boutiques like Alamo Drafthouse Cinema LLC would rather sell dinner and cocktails to a couple than five tickets and a tub of popcorn to a family.

To theater owners, MoviePass pitches itself as a way to boost attendance again. “We want to prove that we can be a positive member of the ecosystem,” Lowe says.

Investors were keen on the idea at first. In the weeks after MoviePass slashed prices in August, Helios shares spiked tenfold. Farnsworth has seen this kind of pop before. Three of his penny-stock ventures—two drink makers and a vitamin company with a tiered sales structure—enjoyed bursts of investor enthusiasm. Then shares dropped to near zero.

Here’s how MoviePass explains its model, using cocktail-napkin math.

Assume that 20 percent of members see about two movies every month, at an average cost to the company of $22. From this group, filled with people like Hannah Wolfe, MoviePass expects to lose about $12 a month per member. The other 80 percent of members will see about 10 movies per year, generating about $1 per month in profit each.

If you look at MoviePass as a business that sells movie tickets, this is a rather dismal situation. The company would spend roughly $1.16 for every $1 in revenue it collects.

Joe Spiegel, whose hedge fund, Dalek Capital Management LLC, has made money shorting Helios shares, lampoons the strategy. “It works if enough people sign up and literally forget they have the subscription,” he says. “You have a ridiculous business plan, and the holes you poke through it are answered with an even more ridiculous plan.”

MoviePass says its model can realize a healthy profit margin, provided it can monetize its user data and sign up enough casual moviegoers.

Source: MoviePass

But Lowe and company see movie tickets as a loss leader to round up consumers—particularly young consumers. The most profitable side of the MoviePass model is supposed be sales of ads to studios and distributors. Retailers and services adjacent to the moviegoing experience—restaurants, ride-hailing apps, maybe even babysitters—would also become MoviePass advertisers.

MoviePass is supposed to be more like a film-obsessed Facebook than a ticket-selling service like Fandango Inc. Lowe can sketch an expansive vision of monetizing his data trove with targeted ads, reaching users with a demonstrated preference for body-horror films or female superheroes or poke restaurants.

But marketers are skeptical. Mark Douglas, CEO of digital ad platform SteelHouse, says companies would pay no more than a few thousand dollars for access to MoviePass’s customer database and about $25,000 to show a trailer to its subscribers. “They don’t have significant scale,” Douglas says. Movie studios advertise on YouTube, he points out, and the video platform has far more viewers and data on which kinds of movies they like.

“You’ve got to give some credit to a concept that people actually fanatically love”

The final chunk of anticipated MoviePass revenue is supposed to come from a share of ticket and concession sales. Lowe says something on the order of 20 percent would be a fair reflection of the increased traffic his service generates. To date, there’s been no sign large theater owners are rushing to offer money. “AMC has absolutely no intention, I repeat no intention, of sharing any, I repeat any, of our admissions revenue or our concessions revenue with MoviePass,” AMC’s Aron said in November.

Some studios, including 20th Century Fox, have had one-off arrangements to test the advertising power of MoviePass, according to people familiar with the arrangements. Fox didn’t pay MoviePass, one of the people said. But Lowe says the deals are real, and the studios won’t discuss them out of fear of running afoul of AMC.

Lowe sees these nonmembership revenue streams amounting to somewhere between $5 to $7 per user each month. In the first three months of the year, however, the company managed to bring in only $1.4 million from marketing and promotions, according to Tuesday’s SEC filing. That's far short of Lowe’s goal.

“I’m much more optimistic now than I was at the beginning of the year,” Lowe says.

Another way to keep MoviePass from teetering into insolvency is to get members to love the service less. The company switched to a sign-up deal on April 13 that restricted new members to four movies a month. Two weeks later, after social media backlash, the old terms returned. But the company is still advertising a $7.95 plan capped at three movies per month, alongside its movie-a-day deal.

Other moves to take some sting out of the heaviest users appear to be staying in place. Farnsworth recently cited efforts to reduce fraudulent use of cards, prevent repeat viewing of movies, and stop the sharing of memberships and passwords. Some MoviePass members now must upload a photo of their ticket stub to ensure they aren’t gaming the system.

The challenge of using MoviePass to actually see a movie has already been a hallmark of the MoviePass experience. The deal only applies to single tickets purchased on the same day as the showing, and customers must be standing near the theater before the app will transfer the price of a ticket to their debit cards. Imax and 3D films are out of bounds, as is buying a pair of seats (although MoviePass says it has a couples plan in the works). Using the app to secure coveted screenings at peak times is a bit like trying to book a flight with airline miles.

The other obvious problem is that the drive to increase membership ends up creating more moviegoers, burning through more of MoviePass’s dwindling cash. Last week, in a promotion, MoviePass sent members an email offering free one-month memberships that can be given to three friends. The company has blitzed the Midwest with radio ads, in some of its only marketing so far, as a way to increase membership in places where movie tickets are sold relatively cheap.

Eventually, MoviePass expects members to curb their own screen time. Lowe likens it to grazing a breakfast buffet during a weeklong hotel stay. On Day 7, he says, you don’t pile the bacon on your plate quite as high. So MoviePass is feverishly trying to attract film gluttons—and then waiting for them to get bored with going to the movies. In the meantime, Lowe says the company has “very committed” investors who have agreed to pour in more money.

The failure of MoviePass would knock out some chunk of box-office revenue—theater owners say it accounts for less than 5 percent of traffic—but the prospect of MoviePass somehow surviving could be even worse for big multiplex companies. If it stays solvent long enough, the sheer size of its millions-strong membership may begin to move the market.

“At some point, the numbers do make sense,” says Brian Schultz, co-founder of Studio Movie Grill, a chain of 30 theaters mostly in the Southwest. Schultz, who has invested in MoviePass, believes the company is creating a whole new class of cinema customers. “You’ve got to give some credit to a concept that people actually fanatically love,” he says.

Studio Movie Grill is also one of two dozen smaller theater chains that has bowed to MoviePass by entering into a marketing agreement. On average, Farnsworth says, these deals shave about 20 percent off ticket prices. At almost all of the 5,000 or so theaters where MoviePass is accepted, the company pays in full.

“I don’t look at it as a discount, or a bulk sale, or a revenue share,” Schultz says of the money lost to MoviePass users. “I look at it as a marketing acquisition cost.”

MoviePass had just 20,000 members when Lowe joined in June 2016. It now claims more than 2 million members. Lowe said he closed similar contracts at the CinemaCon conference last month with scores of theater chains, comprising thousands of screens. Most of the operations are small and speckled through less populated regions, including Main Street Theatres in Omaha, Neb., and Detroit’s MJR Digital Cinemas.

If MoviePass gets close to its yearend goal of 5 million members, marketing messages offered on the MoviePass app may start subtly—or not so subtly—shifting customers to the theaters and films the company prefers. Such as those playing at Studio Movie Grill.

“We can’t control what everybody does,” Lowe says. “But there’s definitely a lot of theaters with a competitor around them.”

The moment that came closest to this dream of MoviePass moguldom happened in late January in Park City, Utah. As the Sundance Film Festival kicked off, Lowe rented a giant house on a mountain outside of town and spread the word that he wanted to finance a film. There was a party with a dance floor, four bars—one on each floor—and plenty of MoviePass stocking hats. Filmmakers came with pitches.

Lowe gets giddy talking about it. “People were just showing up at the house,” he says. “And they were bringing their lawyers, they weren’t just exploratory conversations.”

The company cut a deal with undisclosed terms to back a buzzy film called American Animals. At the end of April, the company also backed a biopic with John Travolta cast as mob boss John Gotti. When the two films hit theaters in June, MoviePass will try to deploy its members and perhaps more theaters will screen them as a result.

Paul Davidson, executive vice president at The Orchard, which is distributing American Animals, is keen on seeing proof of MoviePass’s ability to fill seats. “I can spend $1 million on TV advertising and billboards,” he says, “and nobody can tell me if it drove a single person to the movie.”

During that snowy week at Sundance, Lowe and his team had their pick of films: comedies, buddy flicks, action fare. Ultimately they picked a movie about a group of outsiders who cook up a heist. The trailer starts with a voiceover: “You ever feel like you’re waiting for something to happen, but you don’t know what it is?”

That worked for Lowe. He was all in.

2018/05/21
Infoman

Can you improve the quality of an existing service and offer it on demand? If so, you might be the next Uber. But to develop an app like Uber and get it into the Apple App Store or the Google Play Store isn’t easy. Taking a large piece of the ridesharing market requires that you offer frictionless access, great experiences for drivers and riders, and a strong brand. No wonder one of the first people Travis Kalanick wanted to hire after he got his big idea for Uber was a product manager (as we can see from this tweet). This article can’t provide you with a product manager, but it can explain what has propelled Uber’s growth and what technology powers Uber’s mobile apps. How Uber launched: the go-to-market strategy Uber officially launched in 2010. Six months later they had around 6,000 users and had already provided about 20,000 rides.

This is what Uber’s website looked like in 2010. Image source: Business Insider To kickstart Uber, a marketplace platform, Uber’s co-founders needed to attract both drivers and riders simultaneously. In other words, they needed to tackle the chicken-or-egg problem. People in tech communities in San Francisco are always interested in new tools. They also take every chance they get to improve their quality of life. Uber launched in San Francisco for this reason. They managed to spread by word of mouth among the tech community. How did they do it? By hosting and sponsoring tech events and giving participants free rides to these events. Soon, early Uber adopters, who didn’t like the quality of traditional taxi services, took to blogs and social media to tell their friends about this cool new app. Today, to encourage new riders to try out the service, Uber hands out 50 percent discounts for the first ride. With an initial discount, new riders are more likely to become long-term customers. Uber had a brilliant go-to-market strategy. But the thing about brilliant strategies like Uber’s is that you can’t repeat them. If you were to develop an app like Uber and launch it in San Francisco with a focus on tech communities, your app would most likely go unnoticed. You need a different story. How Uber works: the technology stack Let’s briefly review how Uber works (even though I’m pretty sure you know). First, you let Uber know that you need a ride. Then, Uber asks you where you are. Next, Uber finds a nearby driver and tells you when this driver will arrive to pick you up. After your ride is over, Uber asks you how it went. You rate the ride and the cost is automatically charged to your credit card. So here’s the question for you: what technologies does Uber rely on? Geolocation Uber’s co-founders called Uber a location-based startup from day one. To create Uber, Garrett Camp and Travis Kalanick needed to understand the specifics of iOS and Android geolocation features. You’re a bit luckier than they were back in 2010. Technology has progressed,and it has become way easier to get information about the specifics of location features. You can actually get this information right here, in this article. I hope it will help you figure out how to make your own app like Uber. Taxi-booking apps rely on the following mapping and geolocation features: 1) Identifying a device’s location The Uber app for iOS uses the CoreLocation framework to locate a user’s device. The CoreLocation framework provides classes and protocols to configure and schedule location delivery and send location events to the server. The CoreLocation framework also lets Uber define geographic regions and monitor a device’s movements as it crosses defined boundaries. Geolocation for the Android version of the Uber app was implemented using Google’s Location APIs. They can intelligently manage underlying location technology while meeting various development needs when implementing location-based features. 2) Providing driving directions To display point-to-point directions on a map within the app, developers of the Uber app for iOS used MapKit. Registering the app as a routing app then makes directions available to the Maps app and all other mapping software on a user’s device. Android routes and directions are made possible by the Google Maps Android API. 3) Integrating with mapping software Uber didn’t go it alone with maps and did what you would expect any location-based service to do — implemented Google Maps for both iPhone and Android versions of their app. Now, Google Maps offers integration with Uber. But Google Maps isn’t the only service that Uber uses. To avoid paying Google for access to their solutions, Uber buys mapping technology companies to solve their logistics issues. And why wouldn’t they? After all, Uber wants to be the global king of “local logistics and delivery of people and things.” Geolocation is indeed the most important technology in Uber’s technology stack. But you might be interested in other functionalities as well if you want to know how to build an app like Uber.

Map in Uber. Image source: AppleInsider Push Notifications and SMS After you order a ride, Uber sends you a couple of notifications: the first when a driver accepts your request, and the second when the driver is less than a minute away. They also notify you when a ride has been cancelled for some reason. You can receive these messages as SMS or push notifications (you can set your preferred method in the settings). You’ve probably heard of Uber’s surge pricing, which has been vigorously criticized. Charging a premium for a ride (during peak hours, inclement weather, holidays), the company argues, it gets more drivers on the road and reduces demand from potential passengers. This business model, however, didn’t always let a customer know when surge pricing ended. Today, Uber users are notified when the price multiplier is turned off. Uber text messages are powered by the Twilio telecommunications provider. To implement push notifications in the iOS app, Uber must have used Apple Push Notifications Service, and for the Android app they must have used Google Cloud Messaging (GCM). NOTE: The Apple Push Notification Service doesn’t guarantee delivery of push notifications. Messages are queued in such a way that if a user’s device is offline or unavailable, not all push notifications will necessarily be received. From a developer’s standpoint, APNS is uni-directional. This means that there is no way to know if a user’s device has received a notification, or, if it has been received, when it was received. On the other hand, an SMS will always be delivered. If it isn’t delivered successfully, your SMS provider will inform you that your message failed. Unlike APNS, Google’s Cloud Messaging service allows you to monitor the delivery of push notifications. Payment integration Uber uses a cashless system. You can pay via debit or credit card, or use a promo code. This removes any human-to-human cash transfers from the equation, including tips. (Uber takes 25 percent of a driver’s fare, which makes for a rather profitable business model.) When accepting card payments, there are certain requirements that companies must comply with. In the US, these are known as PCI requirements. The Payment Card Industry Data Security Standards (PCI DSS) is a set of requirements designed to ensure that all companies that process, store, or transmit credit card information maintain a secure environment. In effect, this applies to any merchant that has a Merchant ID (MID). Uber chose to partner with Braintree, one of the leaders in the mobile payment market, to accept card payments. Just for the record, we should mention another great payment system, Stripe, which provides its payment services to Uber’s competitor Lyft and to other popular on-demand economy startups such as Postmates and Instacart. Uber also uses PayPal’s Card.io service for credit card scanning on iOS. Card.io allows you to input credit card information by simply holding up your credit card in front of your phone’s camera. The app ‘sees’ the card, reads the numbers, and enters the information for you. With Android, though, you have to manually enter credit card data to link a card to your Uber account.

How Card.io works. Image source: Medium In addition, PayPal’s system has Uber integration, meaning that customers can pay for the taxi service directly from their PayPal accounts (though this is not available globally in all of Uber’s markets). You can also split your fare with your friends directly in the app. How much money does Uber make? Since we’re talking about how to build Uber, we think you should know how much money this business earns. You’ve probably heard that Uber has had some troubles becoming profitable in the U.S. Only this year did the company start to turn a profit. Uber takes a 25 percent commision per ride, but what it earns in profits is only $ 0.19 per ride on average. The rest goes to interest, taxes, and equity-based compensation for employees. Most of the money earned by Uber goes to antifraud efforts, credit-card processing, customer support, marketing, and software development. Even though Uber’s $66 billion valuation makes the company seem like a huge money bag, it doesn’t make actually make that much profit. How much does it cost to build Uber? When you develop an app like Uber, you actually develop two apps: an app for riders and an app for drivers. How much does it cost to develop an app like Uber? You would need to pay for the following services: Design iOS and Android native app development Backend development Web development Project management Quality assurance According to our estimates of similar projects, the time it takes to build a taxi-hailing app, including an app for drivers and an app for riders, is somewhere near 5000 hours. The cost depends on your service provider’s hourly rates, which vary greatly from $20 per hour to $150 per hour. For more information about app development costs, check out our articles with infographics: how much does it costs of to develop and design an app. Also, you can read our article How much does it cost to develop an on-demand delivery app? This article is published to Yalantis blog.

2018/05/18
Infoman

https://www.techinasia.com/tech-startups-guide-singapore

2018/05/14
Infoman

美股上周五急升超過300點，上證指數及深證指數昨也分別升了1.5%及1.9%，港股在大好條件之下卻升唔起，恒指收市僅升67點，港滙走弱是原因之一，更大原因是幾隻重磅金融股都在業績後見光死，騰訊（00700）是去年推升港股的棋子，增長光環漸褪，開始有人質疑騰訊這家公司的科創本質。

騰訊昨天股價高開見388.8元後反覆向下，午後曾低見375.4元，創5個月低位，收報380元【圖】，連跌3日，與外圍的科技股背馳。近日一篇潮文〈騰訊沒有夢想〉引起熱議，內容主要提到騰訊正喪失產品能力和創業精神，變成一家投資公司。這家快20歲的公司變得功利和短視，強項不再是產品業務，而是投資財技。

內文指出，騰訊過去8年以流量和資本為核心動能，走上了開放投資道路，與此同時，公司亦逐漸失去內部的產品和創新能力，在搜索、微博、電商、資訊流、短視頻、雲等核心戰場，不斷潰敗。

這篇潮文論盡了騰訊急功近利的一面，儼然公司文化，但有一點筆者非常不認同，騰訊由起家開始就是靠抄襲，一直都是潮流興什麼便抄什麼，何曾有創新能力？一家從沒創新能力的公司，又何來失去創新能力？

複製概念迅速稱霸市場

QQ之產生，原先是騰訊抄襲第一代即時通訊工具ICQ，改稱為OICQ上線被控侵權，後來改名為QQ繼續經營，公司發展也不是一直順境，2010年至2011年是web2.0時代社交新平台啟動期，新浪微博崛起、人人網用中國版Facebook的概念到紐約上市，當時高盛不客氣地指出，騰訊管理層習慣持保守態度，導致騰訊的核心平台面臨新浪和人人等威脅。

2011年3月下旬，百度以收盤460億美元市值，登上中國互聯網企業市值第一名，超過騰訊的445億美元，這是騰訊保持了5年的戰績首次被人超過。同年，騰訊起死回生的一着是推出微信（Wechat），這是抄襲自2009年發明的WhatsApp，左抄抄右抄抄又加了點微博功能，自始成為了內地社交平台最多人用的工具，公司股價也開展了高速上升期。

無可否認，微信平台是騰訊從此發展一帆風順的重要原因，透過此平台再搭上手機高增速期，透過霸佔社交平台的優勢，順便在手遊市場撈一筆。

可是，這幾年騰訊手遊有自主創新過什麼遊戲？此前火熱的手遊《王者榮耀》，實際是抄襲自LOL（League of Legends），這款歐美火熱遊戲在騰訊手上幾乎原裝抄過去，僅人物設計加了中國風，其他如出招招式、技能及操作等抄足90%，完全是將別人成功一套抄寫過去。

創新力不足自研產品欠奉

當然，要讚的是騰訊搵錢的一套理念，將這隻電競頂級遊戲改成新手化及普羅玩家化，再不是頂尖高手競逐的戰場，而且每場決戰時間改短了許多，令玩家可以利用碎片時間打發時間，而不是像原裝遊戲般對決認真。

近期手遊新作《絕地求生》，騰訊網站號稱是旗下光子工作室群自研遊戲大作，實際上這是一款由韓國電子遊戲開發商藍洞（Bluehole Inc.）旗下的PUBG公司所開發及發行的多人制大逃殺遊戲。出於要打入內地市場的需要，結果變成PUBG與騰訊合作的一款新手遊，其實是大石壓死蟹，非要經騰訊發行不可。

科網大潮下，騰訊幾乎所有網絡新事物都抄，做得最失敗的卻是抄YouTube的短視頻，在霸佔中國社交平台的情況下，近年也沒什麼自主創新產品，技窮了就去收購Snapchat母公司看有什麼可抄。如此作風的科網巨企可以食老本多久呢？這也是中國科技業的死症，看看Google母公司Alphabet，人工智能AlphaGo只是其中一個絕殺，更多秘密武器還未商業化。

2018/05/08
Infoman
Ask HN: How do you continuously monitor web logs for hack attempts? 153 sandGorgon 13 hrs 63 news.ycombinator.com/item?id=17014818 what is the generally accepted best practice to be monitoring web logs for anomalous accesses ? do you guys just throw cloudflare in front and forget about it ? Or do you have engineers who work like data scientists - eyeball the logs ?

I have heard suggestions of using a firewall - but I'm genuinely curious on how do security focus companies discover things like "oh, we got attacked by Bitcoin miners from North Korea". Are there sophisticated tools that do this for you.. or is there a generally accepted practice that has evolved for even regular engineers to do this ?

P.S. I'm personally more interested in an API-focused answer, but I guess the same thing applies for websites.

tptacek 3 hrs The answer isn't quite "don't bother" but it's definitely not "install these tools and get started".

Most of the things you can easily set up to watch for security events are looking for problems you simply shouldn't have.

For instance: you can set up fail2ban, sure. But what's it doing for you? If you have password SSH authentication enabled anywhere, you're already playing to lose, and logging and reactive blocking isn't really going to help you. Don't scan your logs for this problem; scan your configurations and make sure the brute-force attack simply can't work.

The same goes for most of the stuff shrink-wrap tools look for in web logs. OSSEC isn't bad, but the things you're going to light up on with OSSEC out of the box all mean something went so wrong that you got owned up.

Same with URL regexes. You can set up log detection for people hitting your admin interfaces. But then you have to ask: why is your admin interface available on routable IPs to begin with?

What you want is an effectively endless sink for developer logs (Splunk is fine but expensive, ELK is fine but complicated to manage), and you want to add structured instrumenting logs to your applications in all the security-sensitive places, like authorization checks (which should rarely fail), and especially a very solid, very long-term audit trail of admin-like actions, so you have some prayer of tracking insider misuse. You could instrument your SQL queries and catch any query failures --- which should also be rare. That kind of stuff. I don't think there's a good shrink-wrap package that does that.

But really: focus on removing attack surface, rather than continuously monitoring it.

koolba 3 hrs

But really: focus on removing attack surface, rather than continuously monitoring it.

You buried the lede on this one.

monkpit 2 hrs I think you meant “Splunk” :)

tptacek 2 hrs thx

peterwwillis 2 hrs Or, you know, install these tools and get started:

Scanners: - Nikto (https://cirt.net/nikto2) - A comparison of tools from 2017 (http://sectoolmarket.com/price-and-feature-comparison-of-web-application-scanners-unified-list.html)

Web Application Firewalls: - ModSecurity (https://geekflare.com/install-modsecurity-on-nginx/) - Enable OWASP rules in ModSecurity (https://geekflare.com/modsecurity-owasp-core-rule-set-nginx/) - Vulture (https://www.vultureproject.org/) - Pay $500 to have SpiderLabs configure ModSecurity for you (https://ssl.trustwave.com/web-application-firewall) - Nginx (https://www.nginx.com/products/nginx-waf/) - Azure (https://azure.microsoft.com/en-us/blog/azure-web-application-firewall-waf-generally-available/) - AWS (https://aws.amazon.com/waf/) - Symantec (https://www.symantec.com/products/web-application-firewall-reverse-proxy) - Incapsula (https://www.incapsula.com/website-security/web-application-firewall.html) - Smoothwall (holy cow, they're still around? https://us.smoothwall.com/utm/) - Shadow daemon (probably defunct, https://shadowd.zecure.org/overview/introduction/) - IronBee (same, https://github.com/ironbee/ironbee)

Hardening guides: - Apache (https://www.tecmint.com/apache-security-tips/) - Nginx (https://geekflare.com/nginx-webserver-security-hardening-guide/) tptacek 2 hrs Don't do most of this.

andyfleming 2 hrs Care to elaborate?

tptacek 2 hrs You almost certainly don't want to set up a WAF.

Don't use any of those scanners, all of which look almost exclusively for vulnerabilities you don't have. Do look into getting a Burp license for every developer on your team.

By all means, harden Nginx. Don't pay SpiderLabs to do it for you.

peterwwillis 2 hrs A WAF will stop a lot of the stupid junk that a kid with a "how 2 hax0r" book can make work a disturbing amount of the time.

tptacek 2 hrs If any of that stuff is actually working on your site, not having a WAF is the least of your problems. Don't waste time with this stuff.

nxc18 1 hr I assume you are writing in an attempt to persuade.

Your message is being lost/ignored as a result of your delivery.

We want to understand your message, but you aren't giving enough background. I don't trust your message because there is no supporting background. If you're going to tell me to not do something, either:

A) provide a compelling alternative (not doing $it is not a compelling alternative to $it in nearly all cases) B) explain in detail why you shouldn't do $it. Provide more details if asked.

I want to believe what you are saying and be convinced by it, please help me. (Note: I'm not trying to be a dick, I've just known a lot of people who are perpetually ignored because of this communication style and take forever to learn that lesson because no one bothers to say anything)

TeMPOraL 25 mins I think tptacek's implicit point is this: all the problems you're trying to address with the tools listed are the problems you shouldn't be having in the first place, so, to quote, "focus on removing attack surface, rather than continuously monitoring it".

tptacek 1 hr In this instance, I'm just interested in getting the right answer written down and moving on.

pvg 1 hr I'm not trying to be a dick

You are succeeding without trying. You're essentially complaining some free advice does not fit your exact expectations and specifications. Which is fine, lots of free advice doesn't. Trying to pass this complaint off as some kind of favour to the person giving you free advice, though, is... less than great.

irundebian 19 mins No, tptacek just doesn't give proper answers here because he thinks he can afford it with his status here. He could have just left links to further links/literature.

Alex3917 1 hr

If any of that stuff is actually working on your site, not having a WAF is the least of your problems.

Is this advice assuming that it's devs who want the WAF, rather than ops or management?

For devs clearly it's not what they should be focusing on. But saying something isn't worth doing because it shouldn't work is a terrible security principle.

tptacek 1 hr I wrote a longer comment here, but decided it wasn't helping.

So, I'm just going to go with: no, if you're really building an application and care about application security, no, you shouldn't waste time setting up a WAF tool designed to help 10,000 employee insurance companies make sure their Wordpress marketing site isn't exposing some vulnerability from 3 years ago.

Not wasting time with dumb stuff like this isn't "terrible security"; every dumb thing you do exacts a cost from good things you could be doing instead.

Mandatum 29 mins Hit the nail on the head. Those suites of tools offered for existing vulnerable software is usually written for platforms and configurations that shouldn't be applicable to 99% of companies.

It's like throwing gauze over an open wound. Some companies don't care enough to put thought into healing the wound altogether, whereas some just wrap it in gauze and hope they don't bleed out. And it usually works - at least for a while, until you get big enough/become a lucrative enough target to a persistent hacker.

It isn't a case of "more security tools == better security", it's a case of "why do I need these tools in the first place". If you aren't analyzing attack surfaces and building security into your software development process, I can only hope the code you write isn't accessible externally.
- using 'you' incorrectly here, speaking to those looking to apply these tools to their setup.
subcosmos 38 mins "Don't invest in a home security system because your windows should be completely shatterproof"

balls187 0 mins More like, "Don't invest in home security, because your most precious valuables are stored in a safety deposit box at a bank, and everything else is covered by home insurance."

sebcat 1 hr A WAF will also add an attack surface, just like anti-virus software before them.

Company X, a content publisher, has a wordpress site with a bunch of plugins. They hear that the security record of such a setup is less than ideal. They buy a WAF solution to protect them.

Company Y, also a content publisher in the same space, realizes that they don't need dynamically generated content. They don't need tons of JS. They start publishing static content and what little dynamic functionality they have is well-compartmentalized, with interactions to the outside world carefully audited.

Company Y could also get a WAF, but why? It increases the attack surface, Company Y probably don't have the time/expertise to audit it, it is not clear what benefits it will have.

sandGorgon 2 hrs This is brilliant.

Thanks !

peterwwillis 2 hrs The problem with throwing tools at the thing is you have no idea what it's doing or how it works or IF it works, and it becomes forgotten about. But it's better than nothing in the short term while you figure out how to secure your application. Slap ModSecurity in front of your app while you go over OWASP and managing cloud infrastructure securely.

hluska 6 hrs I assume that I suck at security, everything I have ever built is badly compromised and I'm too dumb to know it. I'm so bad at security that evil criminals actually celebrate my birthday.

Since I'm this bad, I assume that any monitoring tool I could install on the boxes themselves, up to and including all my logs are compromised. I'll usually still install monitoring tools for compliance, basic diligence and because they make wicked graphs that impress my superiors.

Since I'm that bad, I'd rather not invest 40 hours a week combing through fake logs unless I'm validating that I've taken care of the basic security fundamentals for my threat level.

Rather, I like to make sure that my security fundamentals are taken care of so that I can stop the simple attacks. If my threat/compliance model dictates, from there I'll possibly step things up into a web application firewall (WAF).

But, through all of this, I know that there are people out there who are so much smarter than me that the best I can do is little more than an annoyance for them. So, again, I like to assume that I'm badly compromised. This implies that I'm very careful about what data I keep, and I take efforts to protect my data at rest.

dsl 4 hrs I break into stuff professionally.

There is nothing I love more than the "just throw {Cloudflare,Akamai,Fastly,etc} in front of it" crowd. If you are going to deploy a WAF [1] it needs to be at the edge of your datacenter or cloud environment. No matter what fancy feature your provider wants to sell you to fix this, there is a way to bypass it.
- Make sure you are logging centrally, and logging the right things.
- Make sure someone is looking at the logs, it doesn't have to be a full time person, but it needs to be someones job.
- Depending on how big you are, hire people to break in on some regular basis. It could be anything from hiring a cheap contractor to run a bunch of automated tools, to full on 10 person adversarial teams. They will find some stuff for you to fix, but more importantly you will know whether the first two points are working based on what you see.
- https://www.owasp.org/index.php/Web_Application_Firewall
dom_hutton 1 hr

Make sure you are logging centrally, and logging the right things.

Could you please elaborate on what some of the right things generally are?

subcosmos 33 mins A tad off-topic, but one thing I've enjoyed doing in the past is giving my attackers something to get distracted on, allowing me to observe their behavior.

https://www.youtube.com/watch?v=smvwW3vW5rM

semanticist 4 hrs We also use Fail2Ban like a poor man's Web Application Firewall - for a Rails app you know you'll never have legit traffic to anything 'cgi' or 'php' or 'exe', so crafting a couple of regexps to match those and then ban them works well.

We use CloudFlare so we feed the IP bans into CloudFlare's firewall through their API as well as local IPTables. (We also use CloudFlare's WAF - we like redundancy in our paranoia.) If you had more demanding requirements you could look at mod_security for Apache or Nginx.

We also implement rate-limiting using Fail2Ban, which helps to trip the dumber automated scans.

Every time Fail2Ban blocks an IP address, it emails our admin team with the matching log entries and a whois on the IP address, which we then eyeball to make sure there's nothing weird going on.

TBH, easily 90% of the IP addresses we block got caught looking for 'wp-admin/admin.php', which is probably a good reason to never use WordPress.

eli 3 hrs Are these bots causing problems like consuming excess resources? If not it doesn't seem worth the effort to ban them.

These days I only block bots when they're e.g. filling out forms or posting junk comment that a human has to moderate.

PeterisP 1 hr Some kid running an automated vulnerability scan can be automatically detected and blocked this way, which can protect you if that scan would have succeeded otherwise. Of course, the proper way would be just to scan all that yourself and actually fix the problems, but that may be too difficult in some cases.

_Chief 4 hrs I like this approach. Do you permaban the IPs? because a ton of ISPs rotate IPs across users

inopinatus 3 hrs Just be aware when crafting those regexes that user-generated URLs (e.g. slug-based content paths, or even just query-string params if one is very careless) can thereby be used to build a denial of service attack against internal infrastructure, third-party integrations/webhooks, and even regular customers.

Reminds me that back in the day we used to be able to train email sanitizing appliances for false positives by sending them EICAR or GTUBE with spoofed headers.

loblollyboy 5 hrs In short - security is such a big and multifaceted topic that it’s hard to know where to start, but I think that learning Kali Linux tools would cover a lot.

I started working at a cybersecurity company - our product is ridiculously stupid and I try and work as little as possible. In the time I’m not working I try to at least learn stuff. Since I’m at a cybersecurity place I sometimes try to learn about cybersecurity. It seems that even though for profit cs companies are making crazy dough, a lot of open source solutions out there do the same thing. There are so many attacks - they can be anywhere from the application level to the level of physical devices like routers having some kind of exploit. For any type of attack there is a good or multiple good open source tools that can be used to execute or defend (depending on what color hat you have), and a ton of them come standard installed on Kali Linux, but before you learn these you have to understand networks. As a python/Django dev I didn’t really have a deep knowledge and still don’t have a deep knowledge of this. Nor have I done more than dabble with any of these tools. But I know that there are a lot of videos on how to use these - including this 15 hour (!) one https://m.youtube.com/watch?t=1177s&v=vg9cNFPQFqM - if you were to go through that you’d probably be a security wizard

khamba 56 mins Thanks for the youtube link. Seems interesting. I am going to watch it in full.

crucialfelix 12 mins I use logwatch. It gives a large informative report every day. Mostly it shows me that fail2ban and my secure configuration are doing what they are supposed to do.

guessmyname 3 hrs

I'm personally more interested in an API-focused answer

OSSEC [1] is my go-tool for this type of tasks, it offers a language-agnostic interface to monitor any type of events. I used it along with my team to power the early version of the Sucuri Firewall, which later became the GoDaddy's security system. The project has matured a lot and is heavily tested using millions of HTTP requests every day. We also implemented a behavior-based algorithm to detect malicious requests, this part is not open-source but I can tell you that it was relatively easy to integrate it with the core interface.

Splunk [2] is also a good option, slightly more difficult to configure though. I have had the opportunity to meet some of the developers working in this company during a short visit to their Vancouver office and was genuinely surprised with the level of engineering that goes around this product. Definitely, worth checking it.

NewRelic [3] while the purpose has nothing to do with security, it also offers an easy-to-use interface to monitor events in the system. With some extra configuration you can make it work as a rudimentary firewall and benefit from all the great features that the product provides.

Disclaimer: I am an active contributor to the core features, but I am neutral on my recommendation.

[1] https://en.wikipedia.org/wiki/OSSEC

[2] https://en.wikipedia.org/wiki/Splunk

[3] https://en.wikipedia.org/wiki/New_Relic

StreamBright 52 mins For me monitoring the logs is already too late to do anything about the hacking attempt. Usually web servers write logs after the request was served. One approach (I have seen commercial products do it) is to hook into the web server code and inspect every request real time before it hits the application servers and make a decision if it is a legitimate request or not.

gzur 4 hrs You don't monitor web logs, you ship the logs to cold storage every [crontab spec units for time :)] and monitor your hosts and network for unusual activity.

If anything happens, THEN you look at the logs. The signal/noise ratio of the average web host logs makes combing through them just not worth it.

There are tons of products out there - have a look at OSSEC (https://www.ossec.net/), it's open source and free.

cft 27 mins Another question- how do you comply with GDPR and do that? What if a black hat sends you a SAR request?

gesman 4 hrs Using Splunk to monitor traffic either via web logs or via more detailed packet capture solutions.

Just good web logs is enough to detect all kind of malicious anomalies.

Splunk machine learning functions can cluster data and detect anomalies in anything without rules or signatures:

https://imgur.com/a/IFhUZuH

wepple 5 hrs most successful organizations ive seen don’t think about their API/app, but rather their stuff of value: usually data. If someone lifts your entire database, can you spot that on the way out the door? How quickly would you notice 100% of your fattest internet pipes spewing data at some poor souls website? You mention bitcoin; how long until you spot all your machines at 100% CPU?

twunde 3 hrs There's really no way to eyeball logs in any sort of complex environment. What you're looking for is a system that will automatically analyze logs and/or traffic for malicious events and alert on them. What you're looking for are Introsion Detection Systems (IDS) and Security Information and Event Management (SIEM). For IDS there are a whole bunch of open source solutions. Essentially these systems ingest logs into a centralized location and run them through a rules engine, which gets updated with new rules on a weekly or daily basis.

jlgaddis 2 hrs

What you're looking for is a system that will automatically analyze logs and/or traffic for malicious events and alert on them.

(I don't pick on you, so I hope this comment doesn't come off that way.)

What are "malicious events" and how will you know them when you see them?

I would argue that, instead, your system should automatically analyse logs for benign (a.k.a., completely normal, expected, innocent) events, toss them out, and leave humans to review anything that's left over.

With any new "system", it will take a bit to build up a complete "whitelist" so that the amount of data to review is down to a manageable level but you'll be rewarded with much more meaningful and actionable data when you get there.

SnowingXIV 4 hrs I’ve learned that at the very least to ensure that everything is being properly backed up and that the restore works. Testing this regularly puts my mind at ease that even if my site, application, whatever gets destroyed, stolen, etc I can bring it back to life in a very short time. It’s very difficult to ensure that something is 100% secure (not even sure if possible since the major players like Twitter make mistakes). Of course, this doesn’t solve the issue of data being taken but that’s why it’s important to understand the data you actually store and if you truly need to store it or if some could be handled another way.

busterarm 3 hrs 1) fail2ban 2) log everything to an ELK stack (or your preferred alternative) and set up dashboards and reports to feed you malicious crafted URLs 3) Reject traffic in your web proxy based on a maintained list of hostile URLs. Ban the source of this traffic. Don't send back 500s, just slow down and eventually stop answering the requests. HAproxy lets you do this easily with a few simple rules and a stick table.

eli 5 hrs I used to spend a lot of time combing my logs with custom scripts, but honestly I think the effort is better spent elsewhere. There're countless automated attacks a day on a big site but they really aren't anything you need to worry about.

realandreskytt 2 hrs SpectX is a tool that can run fast sql-like queries on top of distributed text files. It was initially built to parse logs by an infosec team. Hope it helps!

gmuslera 5 hrs Computers are better at the eyeballs-on-logs tasks. You teach them what is "normal" to be ignored and they may warn you about what is left, even the old logwatch is pretty capable for that.

Of course, there some basic security practices. Firewall, fail2ban or similar to stop/ban misbehaving IPs, monitoring systems metrics to detect abnormal activity/usage (not just for intrusion detection), and maybe feeding logs to i.e. ELK to notice new/unknown patterns.

jenkstom 7 hrs fail2ban, but I'm not sure that's what you are looking for. You'd have to customize it for an API.

ChuckMcM 5 hrs Fail2ban looking for web pages that don't exist on your web site (like ../wpadmin) works pretty well at getting rid of script kiddies.

I suppose you could add a honeypot page that took form submissions and looked for any sequence attempting a CSRF, XSS, or SQL attack and ban the source there as well.

kazinator 6 hrs I use a home-grown solution called txrban:

http://www.kylheku.com/cgit/txrban/tree/

It consists of several processes written in the TXR language. One for monitoring Apache, one for sshd and one for Exim (mail server).

TXR's standard library has "tail streams": streams which automatically follow a rotating log file.

These txrban scripts simply open tail streams on their respective log files, use TXR pattern matching to scan for what they are a looking for, and then use functions in the tiny txrban utility library to do the banning. Banning is instigated by issuing iptables commands.

The banning isn't persisted, but when you restart the scripts, they retroactively replay everything by scanning the available logs from the beginning.

Banning events are reported via syslog. A "dry run" configuration variable allows testing for the rules without actually modifying your iptables.

I never packaged this program into a redistributable form. It contains some hard-coded log-file paths that work on my server, and no documentation.

summadat 6 hrs 2nd'ing fail2ban, it's simple and awesome.

Beyond that, tripwire or it's modern equivalent. Traffic monitoring, "deep packet" inspection on the network side. Run all outbound through a proxy.

kazinator 6 hrs Not a lot of people seem to know what tripwire is nowadays.

There is this Linux thing called IMA which in some ways reminds me of tripwire (Integrity Measurement Architecture).

tbrock 5 hrs Nah, I’ve waned to use fail2ban multiple times and failed.

Unless something has recently changed it is some of the most poorly documented software on the planet.

I’ve never been able to configure the thing or figure out what it’s doing or... really anything besides find the homepage.

It’s also just not worth the trouble. Globally open SSH port? That’s like 1992 level Linux box in your parent’s basement stuff.

semanticist 4 hrs While it monitors SSH by default out of the box, people here are talking about creating custom filters which will monitor their Apache or Nginx logs. (Although, that said, we also have it monitor our non-standard SSH port with v. aggressive blocking rules, even though it's also behind a firewall. Defence in depth, and all that.)

The documentation isn't the greatest, but this page explains the concepts well enough and was easy to find using Google.

https://www.fail2ban.org/wiki/index.php/MANUAL_0_8

tbrock 3 hrs I understand the concepts but... how do you actually use it?

hluska 3 hrs I like Fail2Ban, but as I remember it, my learning process looked a lot like this:

1.) Read through the documentation.

2.) Pour myself a scotch.

3.) Read through more documentation.

4.) Start drinking right out of the bottle.

5.) Try something.

6.) Get an error or experience a spectacular failure.

7.) Use StackOverflow.

8.) GOTO 5.

In good news, it worked - the light went on and now I'm confident that I could adapt Fail2Ban to suit any use. But, in bad news, honestly, I feel your pain and understand where/why you are getting stuck. Fail2Ban is a very complicated, yet extremely useful piece of software.

strictnein 2 hrs

I'm genuinely curious on how do security focus companies discover things like "oh, we got attacked by Bitcoin miners from North Korea". Are there sophisticated tools that do this for you..

I work in a Fortune 100 Security Operations Center (SOC). We have a dev team that builds tools for our Incident Response team, Threat Intel team, etc, etc and an engineering team to manage those tools. And lots of other teams that specialize on lots of other things (malware reverse engineering, spam/phishing, red team, etc). We have to build a fair amount of our own stuff because we operate at levels above what a lot of commercial tools can do. We have hundreds and hundreds of custom alerts that fire based on various network traffic and sysmon activity that our threat team has written rules around.

This, of course, is out of the question for most.

So, what should you do? First, get your logs all in one place. The ELK stack is probably the easiest way to do that. ES makes things searchable and Kibana is a pretty good UI for a lot of this stuff.

Second, if you aren't monitoring your internal network, you really have no idea what is going on, so look at what you can accomplish quickly with distributions like Security Onion (which includes the ELK stack): https://securityonion.net/

Third, there's a fair amount of Open Source Intel (OSINT) on threats. You'll need to find a way to integrate that information and scan your logs for it. Malware, like Coinminers, will have certain Indicators that will tell you if they are on your network. If you're on the ELK platform, look at something like ElastAlert. You write rules in Yaml and then set up Alerts to fire into your Slack channel or Email you or whatever. There is no real shortcut here.

Commercial tools that can do a lot of this stuff includes FireEye's TAP, but they definitely aren't free: https://www.fireeye.com/solutions/threat-analytics-platform....

And, as mentioned elsewhere, absolutely remove any attack surface that you can. Scan your IP ranges and domains with tools like Shodan.io, HackerTarget.com's DNS tools (DNSDumpster.com has a nice, free DNS search), etc and make sure you have a handle on what, exactly, you're exposing.

And, finally, if you're big enough then every single day a computer will be compromised in some way. There is no company in the world who doesn't experience this so you need to have a clear set of tools and playbooks to handle that. If you can respond to most incidents in days (not weeks), you'll be better than 90%+ of the companies out there.

Edit: clarified acronym

jrochkind1 2 hrs "SoC"?

strictnein 2 hrs Sorry, Security Operations Center: https://en.wikipedia.org/wiki/Security_operations_center

elchief 4 hrs OSSEC is a nice FOSS tool for this

jwatte 4 hrs What is "an attack?" You need to define this better to get more focused answers.

Log monitoring is good for finding bad access patterns, but can't be trusted to find a problem as it happens.

Look for repeated errors. Hitting the same service over an over? Login attempt failures from the same few IPs? It's either a script, or the Bing crawler. Write application level code and network level configuration to mitigate the problem.

How about legitimate users doing social engineering attacks on each other? Sybil attacks in ratings or voting? Attempt to reuse mobile purchase tokens on different accounts? Some new SSHD credential leak zero day? Using your cat picture upload service for storing pictures of dogs? Each of these need different approaches, and a good logging system that can change with your needs is super helpful.

But you can't read the logs in real time, looking for bad patterns. That needs customized analytics.

cat199 3 hrs previously worked at a major shared webhost a few years back (which used Apache)

we used mod_security with common rulesets + a custom list which was reviewed/updated based on what hacks were coming in (with hacks both passively monitored by customer base/compromised spam reports and via active scans for malware deposited by attackers which were then cross-correlated/traced back to application logs to find the entry point/compromise.

support staff was ~600 (including front end call center and billing people), with probably 250 of those doing L2+ support and ~50 doing the security work which fed into the ruleset, for a server farm of ~2-4000ish (and exponentially more sites/accounts since it was shared webhosting). In some ways our network could have been viewed as a giant honeypot because of all of the outdated webapps that were being run by the customers, plus their compromised PC's saving passwords, etc.
2018/05/08
Infoman

Alibaba rolls out blockchain pilot to tackle fake food products

Photo credit: Jodie Morgan / Unsplash

Shoppers in China can now get a definitive answer on whether a product they’ve just bought is fake or legit by simply scanning a code with their phones.

It’s part of a new trial that Alibaba has just rolled out, using an incorruptible blockchain database – the technology behind Bitcoin and other cryptocurrencies – to track an authentic item going from a manufacturer to a consumer.

Alibaba, China’s online shopping giant, is initially trialling its fakes-fighter with food items imported from Australia and New Zealand.

Just two products – one from Anchor and one from Blackmores – are part of the trial, an Alibaba representative told Tech in Asia over the weekend.

Photo credit: Anchor

Once the item arrives with buyers in China, they can scan a special QR code to see the blockchain-verified database that shows it’s a genuine product.

The goal of the program – first announced in theory in March 2017 – is to use the blockchain database to “achieve end-to-end supply chain traceability and transparency to enhance consumer confidence and build a trusted environment for cross-border trade,” said Alibaba in a statement.

Alibaba archrival JD has its own blockchain pilot focused on foodstuffs and medicines.

Companies worldwide are set to double their spending on blockchain technologies in 2018 – to US$2.1 billion – as the database system finds more and more use cases. That expenditure will rocket to US$9.7 billion in 2021, according to a report from IDC.

Many firms are tapping blockchain tech “to develop innovative solutions that improve processes such as post-trade processing, tracking and tracing shipments in the supply chain, and transaction records for auditing and compliance,” says IDC’s Bill Fearnley Jr.

See: He’s putting your reputation onto the blockchain

Fake eggs Alibaba’s pilot is a small first step in tackling China’s troubles with fake food. Counterfeit soy sauce, rice, and eggs are among the potentially deadly items that have been found for sale – like this fake egg spotted in 2012:

fake food problem Photo credit: China Daily

Fraud costs the global food industry US$40 billion each year, according to research from Michigan State University.

However, it’s things like bootleg DVDs, knockoff designer handbags, and reproduction high-end makeup that have been more of a headache for Alibaba, with vendors on its Taobao and Tmall marketplaces often found selling fake goods to shoppers.

Alibaba and its founder, Jack Ma, have played whack-a-mole with these dodgy merchants, but the decade-long game has repeatedly landed the online shopping giant on the US Trade Representative’s piracy blacklist. Ma’s company says its automated systems are getting better at removing fake items before shoppers even see them, leading to a 25 percent drop in takedown requests.

It’s not just Alibaba. Amazon is struggling to rein in wayward merchants on its own Marketplace, as detailed last week in a report by The Guardian.

Alibaba’s blockchain framework will expand after this first, groundbreaking trial. “Once the pilot is complete and if successful, the framework could form the basis of a global supply chain model applied across all of Alibaba Group’s ecommerce markets,” said the company

2018/05/02
Infoman

Facebook is launching a dating feature

241 mendelk 8 hrs 148

https://www.cnbc.com/2018/05/01/facebook-is-launching-a-dating-app.html

news.ycombinator.com/item?id=16969189

Facebook founder and CEO Mark Zuckerberg received an Honorary Doctor of Laws Degree from Harvard University at its 2017 366th Commencement Exercises on May 25, 2017 in Cambridge, Massachusetts. Paul Marotta | Getty Images Facebook founder and CEO Mark Zuckerberg received an Honorary Doctor of Laws Degree from Harvard University at its 2017 366th Commencement Exercises on May 25, 2017 in Cambridge, Massachusetts. Facebook is launching a dating feature, Mark Zuckerberg announced during the keynote address at Facebook's annual F8 developer conference Tuesday.

Shares of online dating company Match and its parent company IAC both sunk on the news.

The conference, often an opportunity to announce new developer tools or hardware, comes amid a broader discussion of policy and privacy for the company.

Facebook for months has been dealing with the fallout of the Cambridge Analytica data leak and questions of user privacy — a firestorm set off by reports that an app developer mishandled sensitive user information.

The social media giant in March delayed the launch of a long-reported smart speaker, according to news reports.

2018/05/02
Infoman

外賣平台Deliveroo是港人較為熟悉的英國創企之一，其共同創辦人兼行政總裁Will Shu接受本報專訪時透露，早於2007年第一代iPhone面世時，創業意念已開始萌芽，但他一直等到手機App生態確立、條件成熟後，才鼓起勇氣下決心實現夢想。他又表示，公司雖立足英國，惟早已看中香港的潛力，創業兩年後遂攻港。Will曾揚言，有信心未來香港將可取代倫敦成為該公司最大的市場。

Deliveroo去年9月及11月先後獲得3.85億及9800萬美元F輪融資，累計融資金額逾9億美元；同年全球營業額較2016年激增逾6倍。雖然Deliveroo成立於2013年，但創辦外賣平台的念頭早於2010年以前萌生。

想當年，Will先後在英効力摩根士丹利和一間對沖基金，此前他一直在華爾街工作，已長期習慣每餐叫外賣，「所有同事的工作枱都一定有外賣紙，打電話到餐廳、提供信用卡號碼即可下單。」

獨立運送改變市場

相比紐約，倫敦的餐廳選擇較少。當時英國最早闖出名堂的網上點餐平台要數Just Eat，Will本身也曾是Just Eat的忠實客戶。他憶述當年，Just Eat仍依賴餐廳員工送外賣，客人等餐時間頗長之餘，平台自家品牌亦難做起。Will遂思考如何改革外賣模式，包括建立獨立外賣團隊，Deliveroo的概念逐漸浮現。

然而，有了創業意念仍需要有合適的時機。Will後來向好友Greg Orlowski分享創業想法，Greg認為，若要建立獨立外賣團隊，需要為每位外賣員提供掌上電腦，「但當時哪有平板電腦之類的產品？iPhone是新發明，App生態系統才剛出現。」由於條件未成熟，創業計劃暫且擱下。直至2012年，Will修畢MBA後，眼見手機App生態系統已經成形，才決心跟Greg一同實現大計，Deliveroo於2013年面世。

港首設「跑手」制度

2015年，該公司取名「戶戶送」攻港。Will看中港人叫外賣一般都是光顧茶餐廳或某幾間連鎖西餐廳，中高檔次餐廳一般不設外賣服務，「香港餐廳選擇多，城市人口密度非常高，食物由離開餐廳門口送到客人手上所需的時間應不會很長。港人在生活各方面都講求快捷方便，很適合我們大展拳腳。」

不過，他亦坦言香港的社區環境跟歐美不同，例如紐約都會區大多是平坦的棋盤式街道（Grid），而香港的中上環商業區卻有很多斜路；歐洲人一般住在路旁三四層高的平房，但香港高樓大廈林立，外賣人員要找地方泊好車再送餐上樓，無疑費時失事。Will指出，拓展新市場的時候，營運模式不可能只是「照抄」（just copy and paste），結果香港成為了Deliveroo第一個設有「跑手」外賣員（即徒步送餐）的市場。在其他地區，外賣員多用電單車或單車，這改變跟香港人口密集和較少人在市區騎單車有關。

Will早年曾表示，香港未來會取代倫敦，成為Deliveroo最大市場，只是這願望至今尚未成真，目前香港有超過2500個餐廳品牌加盟Deliveroo，當中約七至八成是跟Deliveroo獨家合作。

共享廚房灣仔試點

外賣App市場大，競爭亦激烈，為了出奇制勝，Will想到透過共享廚房「Deliveroo Editions」（戶戶小廚）增加客人選擇，並以外賣普及程度較高的灣仔區作試點，安排在Deliveroo上營運理想、有意進軍灣仔區的幾家餐廳，進駐品牌於灣仔開設的共享廚房，提供系統數據顯示灣仔區客人想吃的菜式，例如區內餐廳一直缺乏供應的蒸飯、魚生飯等。

Deliveroo香港總經理羅家聰補充說，現時有6間營運商、共18個餐飲品牌進駐灣仔「戶戶小廚」，加入後約4個月即收支平衡，故集團有意繼續在港開設更多共享廚房。此舉亦反映Deliveroo定位有所調整，「以前我們是外賣服務供應商，現在演變成餐廳的合作夥伴。」

採訪、撰文：陳子健

2018/05/01
Infoman

Earnings Beat: Four Stocks To Watch For the Coming Week (AAPL, SNAP, SPOT, TSLA)

Richard Saintvilus, April 29, 2018, 09:14:41 AM EDT

The expected positive impact from the federal tax overhaul, aimed at boosting corporate profits and stimulating growth, can’t come fast enough, given the inflationary indicators seen within some of the earning reports released this past week.

Margin compression and, in some cases, increased costs from materials and wages adversely impacted Q1 profits from the likes of Hershey (HSY), UPS (UPS), and PepsiCo (PEP). The latter, which reported Q1 results last Thursday, said each segment of its businesses — from Frito-Lay to Quaker Foods and beverages — suffered higher-cost inflation during the quarter. And CEO Hugh Johnston said he expects some level of inflation to continue throughout the year.

Will margin compression be the theme for companies reporting earnings this coming week? In that vein, here are a few stocks to keep an eye on.

Apple (AAPL) - Reports after the close, Tuesday, May 1.

Wall Street expects Apple to earn $2.69 per share on revenue of $60.98 billion. This compares to the year-ago quarter when earnings came to $2.10 per share on revenue of $52.9 billion.

What to Watch: A potential trade war with China, Apple's second-largest market, has gotten investors spooked about Apple stock. This is because, out of the $229 billion in sales Apple reported for fiscal 2017, about $45 billion, or roughly 20% came from China. As such, not only Apple stock fallen into correction territory, the risk from China has prompted some analysts to lower their price targets and in some cases, reduce iPhone sales estimates for the quarter. How will Apple respond?

From my vantage point, now would be a good time to buy Apple. The stock is priced at just 14 times fiscal 2018 estimates of $11.44 per share, which is five points lower than the S&P 500 index. When adjusting out the cash, Apple’s P/E drops to single digits, making Apple one of the best bargains on the market.

Snap (SNAP) - Reports after the close, Tuesday, May 1.

Wall Street expects Snap to lose 17 cents per share on revenue of $243.55 million. This compares to the year-ago quarter when its lost came to 20 cents per share on revenue of $149.65 million.

What to Watch: If at first you don’t succeed, try again. That seems to be Snap’s operating model as the company has opted to give its Spectacles video sunglasses another try at winning the hearts of users. How will the market embrace the newer, slimmer design, which now comes in onyx black, ruby red and sapphire blue, remains the question.

Elsewhere, the company is also rolling out a redesign to the redesign of the app it rolled out last year. That’s right. Its highly-anticipated redesign, undertaken a year ago, is being redesigned again thanks to a flurry of critical attacks against the new look, more prominently from Kylie Jenner, which sent Snap stock plunging. Analysts will press management for clues about what this redesign will look like and the company’s user engagement metrics.

Spotify (SPOT) - Reports after the close, Wednesday, May 2.

Wall Street expects Spotify to lose 31 cents per share on revenue of $1.14 billion. This will be the company’s first earnings report as a public issue.

What to Watch: Some analysts, citing (among other things) competitive pressure from Apple Music, believe Spotify shares could fall following its earnings report. This is because, aside from Amazon’s (AMZN) Alexa-powered music service, there’s also Google’s (GOOG , GOOGL) YouTube, which boasts a subscriber base of 70 million. And to say nothing about Pandora (P), which has undertaken an organizational restructuring aimed at strengthening its finances and growth position.

Can Spotify overcome these threats? Working to its advantage, the company — fresh off its highly-anticipated IPO — is already cash flow positive, growing rapidly and has the ability to scale globally. Not to mention, the Swedish-based company, which boasts 159 million monthly active users, has some 71 million subscribers who are currently paying for its premium service package, giving it ample time to figure things out.

Tesla (TSLA) - Reports after the close, Wednesday, May 2.

Wall Street expects Tesla to lose $3.28 per share on revenue of $3.31 billion. This compares to the year-ago quarter when its loss came to $1.33 per share on revenue of $2.7 billion.

What to Watch: Prolonged worries about the company’s cash position and struggles with Model 3 production will be the main topics on the conference call. Citing an internal email, last week Bloomberg reported that the company is pushing for Model 3 production to ramp up to 6,000 cars per week by the end of June. That’s an aggressive target, given that Tesla was previously targeting 5,000 Model 3 units by the end of the second quarter. If Tesla is able to achieve its production goals without pushing back Model 3 target and deliveries again, the stock will take off.

The views and opinions expressed herein are the views and opinions of the author and do not necessarily reflect those of NASDAQ, Inc. More from RICHA

2018/04/30
Infoman

國際貨幣基金預期，2018年香港人均GDP將達到4.6萬美元（逾36萬港元），位列全球第20名，比紐西蘭、法國、英國排名更高。但根據聯合國3月發表的《全球快樂指數報告》，香港依舊不開心，排第76名，更較去年下跌了5位。

顧問公司Frost & Sullivan估計，2018年亞洲需要精神健康服務的人共有3.4億，大約每13人中便有一個；美國國立精神衞生學院指出，情緒病在美國非常普遍，每六人便有一個患者。如果得不到適切的幫助，有些人甚至會走上絕路。世界衞生組織的數字顯示，全球每年有超過80萬人死於自殺，是15至29歲人口中第二大致死原因，而且每一事件引發的漣漪效應可影響20多人。世衞認為，早期介入和治療是避免悲劇的關鍵。

在日常生活中，創新科技如人工智能（Al）和大數據一直用途廣泛，而協助改善大眾的精神健康方面也可大派用場。今年初，加拿大政府便聯同一間Al公司進行為期3個月的測試，分析社交媒體的訊息來預測有自殺傾向的人。該公司曾經成功預測英國脫歐、特朗普當選美國總統和加國2015大選結果；是次研究報告將用於規劃精神健康資源。Al除了有助找出高危一族外，在防治層面上，能根據每個患者的狀況和醫生的臨床診斷，利用聊天機械人進行度身訂造的認知行為治療，透過話音或短訊跟患者對話，並「聆聽」他們的感受，藉此紓緩他們的負面情緒。

在全球人口老化下，長者的身心健康更不容忽視，日前看到熱愛新科技的銀髮大國日本如何令長者身心康泰，不無啟發。

許多長者除了面對身體機能倒退外，也飽受寂寞之苦，因此一台護理機械人Palro（意即機械人友伴）大受歡迎。這個身高如幼兒（近40厘米）、體重不足兩公斤的智能機械人，可以與人自然對話、唱卡拉OK，也能移動行走、懂得識別人臉及上網。有趣的是，它會如小孩般需要照料，令公公婆婆有機會擔當照顧者的角色。有護老院引入後，發現一半長者較以前活躍和開朗；有機構為患有失智症長者作分組測試後，和護理機械人相處及互動的組別，治療效果較顯著，用藥大減三成。可是，這機械人售價昂貴，每台盛惠67萬日圓（約5萬港元），因此日本政府於2015年撥出52億日圓（約3.8億港元）資助護老機構購置相關設備，反應非常熱烈。不論長壽與否，活得健康快樂才是你我的共同願望，這不正正是創新科技應積極努力發展的方向嗎？

鄧淑明博士香港大學計算機科學系榮譽教授

2018/04/29

«
1
2
…
138
139
140
141
142
143
144
…
183
184
»