This isn't just about cash back -- it's also about cards that provide points for airline/hotel/etc. loyalty programs.
Air France, incidentally, seems to have several Mastercard-branded cards which reward with Flying Blue miles.
12,994 karma · joined June 4, 2008
Air France, incidentally, seems to have several Mastercard-branded cards which reward with Flying Blue miles.
https://guernseypress.com/news/2016/12/15/man-raises-clameur...
The procedure used there:
Which is amusing in the case of Musk. As I've said over and over, his approach is to find an industry where most or all of the hard, expensive fundamental R&D has already been done (and paid for) by someone else, and then start a company to incrementally improve it and promise vast cost reductions from economies of scale.
That's what SpaceX is. That's what Tesla is. There's not really staggering heart-breaking Copernican-revolution work being done at either company. They're just applying incremental improvement and economies of scale to problems where the hard fundamental work was already done. The idea that it requires some special sort of unbelievable genius to come up with that plan, or that it's impossible to do without this specific (alleged) genius, is baffling to me.
* FizzBuzz with no control-flow keywords: https://github.com/ubernostrum/interviewer-hell/blob/master/...
* Detecting if a number is a perfect square as a one-line lambda: https://github.com/ubernostrum/interviewer-hell/blob/master/...
* Be in the US, get your mobile number years and years ago and it has the area code of where you lived at the time.
* Move somewhere else, keep the mobile number.
* Now you get 4-5 robocalls per day spoofing numbers from "your" area code and calling at reasonable hours for that area... which are not reasonable hours where you now live.
And if you say "just turn on do not disturb", remember some folks have to be on call for their jobs, don't know in advance what numbers the pager alerts will come from, and so have to leave the phone open to ring from whoever calls. Which will be robocalls with "helpful" offers at 4AM.
What I would love to see in a future mobile operating system is the ability to say "block all calls from this area code unless they're in my contacts".
https://twitter.com/errbufferoverfl/status/10197667755614453...
And I don't mind at all. Many of the things you can technically do in an email address are needless complexity that shouldn't be encouraged.
I personally find it hard to believe that the average Google employee doesn't know and didn't, by that time, know, that Google's algorithms -- which introduce a selection pressure for content that causes outrage (in the name of greater "engagement", and that's been pretty thoroughly demonstrated) over content which contains facts -- were promoting awful things.
I find it very easy to believe that the average Google employee simply didn't care about that up until the moment it started affecting their friends and colleagues (the "Muslim ban" would have impacted some Google employees' ability to travel). Up until then, "politics" was something that happened to other people, and so they didn't have to bother about it.
But in general, there are classes of ads that you just can't target based on certain classes, period. Even if you hypothetically might have the ability to target a counterbalancing ad somewhere else. Facebook repeatedly has been in hot water over this, and both they and the people using their ad platform to do this stuff need to get more than a slap on the wrist, in order to deter others from trying the same in the future.
It's the same CYA reason that people will respond to a question about law with "Here's what the law says, but I am not your lawyer and this is not legal advice".
Given that decades of user research overwhelmingly indicates that the average web user does not understand the components of the browser URL bar, and in many cases those users are completely unaware there even is useful information there, I'm going to bow out of this, because you're now into territory where you need to forcibly educate every single person on earth to understand the URL bar.
(and you're "only" now requiring that every single person who will ever do business of any sort must pay up for an EV cert, but that's actually less of a problem than trying to force people to understand what an EV cert is and how to tell if a site has one)
Except the only way to get what you want using EV is to force literally every site on the internet to go through the EV cert process. Otherwise, somebody's going to go get a "less verified" cert, set up an impostor site and phish people.
Is that really the world you want? Is that the price you're willing to pay to get it?
The issue is that credential stores which know how to recognize the "real" version of a site aren't going to achieve the level of effectiveness we'd like to have against phishing.
When people insist EV have value, they almost always base it on some hand-wavy claims about preventing phishing. Cite to research (not to advertising claims from CAs) showing that significant numbers of users are aware of EV and use it as an indicator when deciding whether to trust a site, for example.
The problem is you won't be able to; the average web user is barely aware of what the various things in the URL bar mean, if they're even aware of the URL bar at all, as decades of user research have taught us. So it always just comes back to hand-wavy stuff. And hand-wavy isn't enough to justify the cost of the system.
Meanwhile, we have real, hard evidence that even technically-literate, security-savvy users can easily be fooled into giving up their credentials, and even will bypass mechanisms intended to get in the way of them giving up their credentials. I'm going to keep plugging this phishing talk until everyone has internalized that message:
If you want to blame someone, blame the original designers of the current system, who decided certificates had to be a one-size-fits-all solution for both encryption and identity. Also, blame the years and years and years during which people on sites like HN condescendingly insisted that identity was the important part of TLS/SSL, and who more or less said you'd be better off unencrypted than encrypted without ultra-mega-hyper-octuple-verified identity.
The industry has basically given up on the idea that there is some way to establish trust on first visit. Which is nuts, because we take it for granted in real life that we can just walk into a brick and mortar store and conduct business without getting mugged.
In real life it's difficult and expensive for me to rent a brick-and-mortar storefront, cover it with the branding and logos of a trusted company, stock it with real-looking products and employees in uniforms, etc. On the web, it takes five minutes and costs little or no money to produce a good-enough imitation of a trusted company's site. Any attempt to analogize between them will fail because of how much lower the barrier is online. Any attempt to say that it's easy in real life, so it ought to be easy online is based on missing this fundamental fact.
Also, we live in an age where it's profitable to cold-call people on the phone and say "I'm the tax authority and you owe money, buy $500 worth of iTunes gift cards and send them to this address", and where the majority of calls that come to my phone use spoofed caller ID to try to scam me.
"Trust on first visit" is really a monstrously hard problem, and I think you're underestimating that.
1. Can an arbitrary third party eavesdrop on my communications?
2. Am I communicating with who I think I'm communicating with?
It is now extremely easy to handle use case (1). Use case (2) is still genuinely hard, because even extremely technically literate security-savvy people can still easily be phished (my current go-to example is this talk: https://www.youtube.com/watch?v=ZjW12K0IHgo).
Compounding the problem, many people insisted, for many years, that use case (2) was the overwhelming majority of all the value of SSL/TLS, and use case (1) was at best a tiny microscopic fraction of a fraction of a fraction of what was useful about SSL/TLS.
Lest you think I'm exaggerating: I've spent years arguing with people, including right here on HN, about this, and being condescendingly told that identity verification is the crown jewel, and that if I'm not going to make use of that then I might as well literally just go back to plain unencrypted HTTPS, because apparently that's actually better than using SSL/TLS without identity verification.
Also, I really recommend watching that video I linked. It's a security engineer at Stripe, talking about how she ran some pretty successful campaigns within the company. Whatever you may think of them, they're not unlettered philistines. But even things like your "Expect-EV" wouldn't have helped -- she cites an example of people noticing their password manager wasn't autofilling, because it knew they weren't on the expected domain, and then users manually copy/pasting the credentials out of their password manager anyway. There just aren't any easy "just do X" technical solutions here.
This is an assertion not presently supported by evidence. With any other resource they need, companies typically respect the law of supply and demand: when there's low supply or high demand (or both), they pay more to get the resource. But when -- and seemingly only when -- that resource is labor, paying a higher price is practically unthinkable. That's why we've seen decades now in the US with little or no (inflation-adjusted) wage growth, despite higher average productivity and periods of low unemployment (either of which ought, in a rational market, to produce higher wages).
Google's going to maintain a root store either way. The parent I replied to was worried that Google becoming a CA would be a power play to eliminate all other CAs and then Google would get out of the business. Apple, Microsoft and Mozilla have the power to drop Google's CA from their root stores and make Google-issued certs worthless on a huge number of devices worldwide, which is how they act as a balance against unilateral moves by Google-the-CA.
The argument people tend to make here is that the net change he's creating in the world is not for the better. If 1,000 people have to suffer misery because of his company in order to enable 10 people to get the benefit of his personal charity, that doesn't look like "making the world a better place" to many of us.
Also, any unilateral move by Google would have to get past the rest of the CAB, which includes Apple, Microsoft and Mozilla, who all control significant root certificate stores.
And then a couple years later when the next next generation comes out, suddenly that worst-thing-ever-that-was-going-to-bankrupt-them turns out, actually to have been amazingly great and darn near perfect, so why did they go and mess it up!
But first check the terms of service to make sure you didn't agree to mandatory arbitration and waive the right to class action.
If there's an epidemic of e-cigarettes, why aren't they doing the same? And I guess I may be ignorant of how the market for these works, but I've never actually seen them in regular shops. Where would I go to buy a Juul? I know there are dedicated vape shops, and also tobacco shops that sell e-cigarettes. Could you run stings there the way many US states run them at stores that sell alcohol?