sprovoost

I'll try to dig one up. Obviously they won't use such wording. They send out a completely automated message with fairly vague instructions. If you then do what they ask and explain the situation, you get another fully automated response rejecting that attempt. This means either no human bothered to look into the situation or a human did look at my message, but did not feel the need to type an explanation or even apology for their decision. In stead, they press a big FY button and don't look back. Maybe it's because I can tell which part of an email represents human effort, that I tend to get more offended by this sort of thing. Even automated blurbs saying "we're sory if this caused any inconvienience" don't work for me.

It's interesting to look at the companies that are mentioned. Pearl-in-palm is based in Beijing and has been around for seven years [0]. They make games and this one gets great ratings on the English store [1].

But very bad ratings on the Japanese store [2], saying things Google translates as "Amount has been exploited to gain unauthorized access".

Based on this and on anto1ne's comment about Chinese "gift cards" [3], my guess is that the company is legit and that someone sells iTunes usernames passwords to individual gamers looking for extra points.

There's another company mentioned in these discussions: Kamagame Poker. In fact, if you Google "Kamagame poker chip" the first two hits are people on Apple forums complaining about unauthorized charges. Same phenoma as above: great reviews in the US store, bad reviews in the Japanse store.

Perhaps the Japanese are not interested in these two games, so a larger percentage of their downloads are scam related, while in the US the majority of downloads is legitimate?

So here's an opportunity for some automated detective work:

1 - scrape all applications with in app purchases

2 - scrape US and Japanese reviews

3 - look for rating differentials (and of course terms like 'fraud', 'charge')

Follow up with more manual labor:

1 - where are most of the customers of these apps? (China?)

2 - are these companies related? (I have no reason to suspect these two, but the bigger picture might look different)

[0] http://investing.businessweek.com/research/stocks/private/sn...

[1] http://itunes.apple.com/en/app/id428912410?mt=8

[2] http://itunes.apple.com/en/app/id428912410?mt=8

[3] http://news.ycombinator.com/item?id=2879423

I think a lot of people in Silicon Valley don't want to touch it, because of the stigma. Having that on your resume reduces your chances of getting a job with high profile companies or government agencies.

It's a numbers game; it would help people without an @me.com account or with a secondary email address.

As I mentioned in another comment, you don't have to go as far as verifying before usage (although in some cases you should), but at the very least alert the user of any new device, just like Facebook does.

> In Hanselman’s case, though, he admits he was using PayPal, > not a credit card. Perhaps it’s therefore safer to use a > credit card instead of PayPal for iTunes Store payments?

I don't see how that makes a difference if your iTunes account is compromised. Or perhaps it's because your creditcard company is more likely than Paypal to alert you to suspicious activity?

They could do something similar to what Facebook does: as soon as they detect a new device using your account, send an email. If the new device is not in the same country as your other devices, don't allow purchases until you've clicked on that link in your email.

There's a difference between someone using your creditcard to buy stuff on iTunes with a different iTunes account* and someone using your iTunes account to buy apps. In your case I'm guessing they did the first thing.

* = possibly not their own; they might own the apps that you're buying or make money through affiliate networks. And of course they could buy gift cards with your cards and sell them on eBay through another payment account.

Only one way to find out; go through all your accounts and try that password. Let us know...

Even if the password was unique to iTunes, a key logger on your computer could have intercepted it.

Does Apple always use HTTPS? Otherwise it might have been intercepted when you were on an insecure wifi network.

If someone tried to buy an app "manually" using their own device and your account, they would need to know your email address and password. There's plenty websites out there that store password in plain text, some of them even email it to you so everyone can intercept it. Other sites use some encryption, but could be still be compromised.

The possibility I hinted at is that someone just "pretends" they have an iPhone and communicate with the Apple server directly. I don't know how their algoritm works, but it may be the case that they only need an Apple id and some secret key that is stored on the device. In that case asking the user for their password is just a way to protect the user when they lose their actual device. That would be pretty insecure from Apple's side. They should at least use the password to generate a key pair. (This doesn't necessarily require anyone to steal secret keys from Apple I just realize)

I completely agree with your second more general point. See also my comment on the Paypal thread: http://news.ycombinator.com/item?id=2880194

In the extremely unlikely case that Bitcoin becomes a generally accepted currency, I suspect the government will regulate it. Such regulations will most likely provide a monopoly such that only certain credit card gateways and Paypal can facilitate transactions in them. Which means you're back to square one.

That said, Bitcoin looks like a crowd sourced Ponzi Scheme to me, a buggy one at that.

I understand PayPal needs to take certain unpleasant measures to mitigate risk. The problem I have with them is their disrespectful attitude towards customers in general and their arrogant tone in particular.

If something goes wrong they don't say "Sorry, we believe there may be a problem so we had to suspend your account. Not to worry, just send us X or call us on this number.", but rather something along the lines of: "You're a fraudster, we disabled your account, go figure out yourself how to fix it. Here's a few unhelpful pointers."

They managed to beat the competition because of their superior fraud detection ability. Because of their succes, they now have no incentive to work on customer service.

The web allows for some unprecedented powerful corporations to come into existence and most of them (Google, Apple, Paypal, Facebook, Amazon, etc) have already abused that power on several occasions, particularly regarding small business. Get used to it...

Based on his story, I would guess that:

1 - someone got their hands on Apple's private encryption keys

2 - some got their hands on a list of Apple id's or device UDID's

3 - Apple knows this, but wants to fix the problem behind the scenes and keep it under the radar.

My memory of Apple's in App Purchase system is a bit rusty, but my guess is a combination of 1 and 2 is enough to cheat it into buying products on someone else's behalf.

Then again, it could also just be a reused password.

That last link has the word "bptumblr" in their Amazon EC3 link. If you Google that term, you get a bunch of porn sites. That might explain their popularity in random bars and early profitability :-)

I agree it would make more sense for the next generation of students to seriously consider alternatives to certain overpriced educational institutions.

On the other hand, with the printing press at maximum, now is a good time to have debt.

I'm not from the USA, but agree the situation here is probably one of the worst in the world. However I've been to several countries in the past year and the best deals tend to be around 300 MB - 1 GB for anywhere between $10 and $30 a month sim-only. Assuming most people don't want to spend more than $40 / month on their data, that means 4G speed will eat your monthly allowance in minutes.

Also, in some European countries, like The Netherlands, Telco's are actually increasing the cost per gigabyte, blocking Skype and other competitors and reintroducing data caps. They lost a lot of money in the past few years and are trying to recover from that.

Regardless of whether it's true if the next iPhone has 4G, who cares? They quote spotty coverage and battery issues as a reason. But if I were Apple I would most certainly not support it for a very different reason: why offer a product that can eat your data bundle in two minutes? The real bottleneck in almost every country in the world is the high price per gigabyte. That price will go down eventually, but not by a lot in the life time of that phone (3 years tops). There's a few factors that determine price:

A physical / technological limits, such as 3G / 4G masts

B number of masts

C number of customers

Even in a perfect market B can't keep up with C until the market is a bit more saturated with smartphones. But in many countries, including the US, phone companies have nasty monopolies and other incentives to not hurry up with building capacity.

So let's stop the hype over 4G and focus on reaching $1 / gigabyte and decent bandwidth during rush hours first.

It took me much too long to realize this, but there's a fundamental difference between a Startup and a Muse. A Startup is about creating something new, which takes years to develop, can scale hugely, but may never turn profitable.

A Muse is a form of passive income, and although it's still hard work, it can be built much quicker. The reason for that is that a Muse does not create something fundamentally new, it's usually a very conventional product in a well known market.

I read the Four Hour Work Week years ago and love the idea of creating passive income to work on other things. But my natural tendency is to build startups, not muses.

Besides, if your hourly rate is high enough and your spending low enough you can travel the world for less than a day of contractor work a week.

So if you're still interested in building startups, my next piece of advice is to really read up on Customer Development. Read Ash Maurya's Running Lean http://www.runningleanhq.com/, Eric Ries' upcoming book (he also has some lectures on Udemy) and Steve Blank's blog, in particular about the class he gave at Stanford.

Key takeaway for me: figure out what people are willing to pay for, before you actually build it. Of course there's a tradeoff where it makes sense to just quickly build it first, but I've been trying hard to move that threshold from 3 man-months to a few days.

From what I can gather from those two links and the original memorandum, you need to show that you are an employee. They are worried about three scenario's:

* founding your own company and hiring yourself (especially if you do that on borrowed money it would make it too easy to immigrate)

* contractors (not sure why)

* job shop employees

The first item is where ownerships comes in. You're not allowed to be in control of the company, because you could prevent it from firing you. So that clearly rules out having >50% ownership.

However, I don't see how it rules out stock options for say 10% ownership? Particularly because, if I understand correctly, stock options don't give you any control until the company goes IPO.

The easiest way to find out: are there any startups that have given out stock option, without jumping through legal hoops?

> offering to fix it, from the very beginning

That does not contradict the victim's statement, but it ignores her statement that communications stopped after she went public with it and that she claims that she hasn't received any of this compensation yet.

There's a big difference between being nice and being on top of something before the media forces you to.

I think most people are much more interested in knowing if AirBnB tried to cover this up (with the victim and/or the journalist), than about details of miscommunication. As I commented elsewhere, it's very difficult for either party to provide evidence for or against this.

The elephant in the room needs to be adressed in non ambiguous language, to prevent Clinton-Lewinsky syndrom.

Technically this part of Paul's comment does not contradict the victim's statement; AirBnB has offered to fix it from the beginning (give or take a day), but perhaps just forgot to communicate after that. Any calls from her could have ended up accidentally ignored by customer support or some other gate keeper.

However, that leaves two big issues in my view:

1 - This should have been handled by the CEO from day one. He can delegate the work down later, but the victim should have his phone number in case his minions screw up. The fact that he still believes a blog post is sufficient and that he throws in PR gimmicks such as doubling customer support (in a company that's growing exponentially), is not helping. But that is not at all evidence for...

2 - There needs to be some clarity really soon about whether AirBnB has attempted to cover this up, with Paul being miss-informed (I'm not ready to doubt his integrity), or if it's the other way around. I understand it is hard for AirBnB to disclose evidence in their favor, because they would risk defamation issues, privacy issues, precedent issues and even risk screwing up the police investigation. It's also difficult for the victim and journalists to present any definite evidence.

Perhaps both parties can agree to let an independent journalist with a solid reputation look into the situation? It may be hard to find anyone who considers this important enough though; sadly this sort of stuff tends to fade out in a matter of days.

It helps, but it still wouldn't protect you from someone serious on bullying a host or the system.

This is the heart of the problem: if I open a grocery, I pay the landlord a fixed rent, not a cut in my sales. That's because rent is generally seen as a commodity. Apple doesn't want to accept that their App Store infrastructure is a commodity (it's not cool to be a commodity), so they come up with this revenue sharing system. They see themselves as a publisher.

That's nice if you're a small developer, because the alternative is paying a high fixed fee. So what would that fee be? There's 50.000 iOs developers [0] and the app store generates about a billion in revenue (off the top of my hat). That means we're paying Apple about $300 million. That means the fixed price should be $6.000 per year for Apple to earn the same amount (there's probably no sustainable fixed-price point).

Obviously, if they did that, Android would become infinitely more attractive, since they could offer a much cheaper service (no expensive in-house review team).

So here's the dilemma for Apple: 1 - continue with their publisher business model (percentage), maximize for profit at the cost of karma and long term risk of anti-trust lawsuits

2 - dramatically reduce cost (less or more efficient quality control), introduce a fixed fee that developers can still afford ($500?) or subsidize the whole operation more.

3 - keep the current system, but don't force developers to pay you. Sort of an honor system / convenience. That seems to work well for DRM free iTunes music.

[0] http://bit.ly/pyNwCj

I'm curious to see how far they can and will push this. Apple is growing rapidly and for good reasons. This action is pure exploitation as far as I can tell, but they get away with it. Will this slow their growth? I doubt it. Will EU anti-trust step in? Probably not, because Apple's market share is tiny.

So they'll make a few hundred million bucks with this. Ten times more and they will face anti-trust issues. If I was CEO, I wouldn't consider a few percent extra revenue worth the karma damage. But greed can blind even the smartest people.

Anyway, I strongly believe different layers of "the stack" should not interfere with other layers and that companies should accept that they deliver commodities. Telco's should charge by the gigabyte and bandwidth, Apple should charge for their hardware, software and whatever it costs to maintain App Store infrastructure.

Otherwise, what's next? Should Amazon pay AT&T 40% of their internet revenue or risk getting blocked?

@c I believe the expedited service only takes two to three weeks, but I don't know how much other paperwork is involved that might add up to 6 months.

From what I've been able to gather:

* there is no lottery. If you apply after the cap has been reached you're out of luck (not sure about edge cases).

* if you were to apply right now, you would be able to start working no earlier than October 1st. After that you could start within a few weeks of application if your employer pays for expedited service. But you don't want to apply much later than autumn either; last year the cap was reached in January: http://1.usa.gov/H1Bcap11 The current batch is at 1/3rd: http://1.usa.gov/H1Bcap

* I've heard people say the market is more "hot", because of the potential bubble, which may mean they run out faster this year. On the other hand I've stats that say total investment is the same as last year, it's just more concentrated.

But I already see one problem with this: your co-founders are probably working at a much lower "excepted hourly rate". I've heard people claim that the average silicon valley entrepeneur earns less in 10 years than someone working at McDonalds. In other words, you may need to be willing to accept an irrationally low amount of equity if you need a cash salary.

I agree with option 1. But in order to calculate how much your salary is worth in equity, you'd need to estimate the worth of the company at some point in the future, your hourly rate and the risk that is involved. In his case, if there is already funding, you could take the value of the company at the time of funding as a benchmark. If they got funding from a well established angel investor or VC, you also have an idea of the odds for success (1 in 10?). What's the going rate for a full time developer? Just multiply et voila... You know how much equity you want for your first year of work.

That's probably what I meant. Or "the worst suffering", regardless of whether it is punishment.

It's only a good sign if the government is not a big employer (directly or indirectly though subsidies, trade barriers, etc). I don't know enough about the German economy to know if that's the case here.