9 ms·

I will not log in to your website

302 points by seycombi 10y ago

lucb1e 10y ago
I do not recognize the problem the author talks about, but it seems weird. From the article: > Prof. Aaronson, given your expertise, we’d be incredibly grateful for your feedback on a paper / report / grant proposal about quantum computing. To access the document in question, ... It seems odd to want feedback and then ask someone to go and register somewhere, probably requiring to accept a bunch of legalese in the privacy policy and terms of service... Just attach the document you want feedback on, right? At least if I'd email someone (out of the blue or an acquaintance) for feedback due to his expertise, I'd be grateful for the time taken and try to make it as easy as possible to do. Edit: it has been made clear to me that it's not about individuals contacting the author, it's some big corporation that probably sends this out, probably in an automated manner. I still don't understand why anyone would bother with this when "peer reviews" can happen between "peers" (i.e. sending each other documents for review, rather than going through the middleman that everyone seems to hate such as Elsevier, if blog posts linked on HN are to be believed).
- ebbv 10y ago
  I assume they are trying to keep the documents in question confidential. Email is not confidential. EDIT: Folks email is not secure. Even if someone doesn't have access to login to your mail account. Emails in transit are insecure. Using outside systems to send confidential data is common practice and has been for years.
  - michaelhoffman 10y ago
    In practice, it's no more confidential to use a system where you have a separate, high-security system, that sends out new passwords via email on demand.
  - lucb1e 10y ago
    I disagree. A sysadmin is not allowed to take a peek in emails unless there is a reason. Or if I create a folder named "private" on my work computer or work email, they aren't allowed to look in there without a good reason. But I suppose Dutch privacy laws aren't universal, so I don't know how that would be in your (or the author's) country. And if you want to take matters into your own hands, you use PGP. But outside of the computer security business I guess that's mostly unused.
    - erichurkman 10y ago
      Not allowed, or not able to?
    - SomeHacker44 10y ago
      If what is not allowed is not enforced by effective technological measures, or at least logged and reviewed by other trusted parties, then it may as well be allowed. At my company we trust our people and have a web of review. However, we try never to have anyone be the final trusted party - even the boss.
    - gnopgnip 10y ago
      Email in transit is not secure.
    - csydas 10y ago
      This is not strictly true with US businesses and academia. My last place of employment was a university, and per our legal, all data going through the University email or computers is University property; while there is a pledge from IT that all email is private and will not be accessed except for specific circumstances, these circumstances could be pretty much anything and had no relationship to any existing case law outside of what legal felt was necessary to use as reason for why we could access it. But the pledge was just a formality - should there be any interest to check the mail, there was nothing technically stopping anyone with the required access except for someone else with equal access having a problem with it. Likewise, various management offices had no issue with submitting email fetch requests for the simplest of things, with date ranges exceeding two or three years sometimes for what turned out to be incredibly minor reasons. There really is no expectation of privacy with academia in the US when it comes to University owned property or services. (The only reason I found out about any of this from legal was because I asked for clarification on our "duty to report", and one of the lawyers was almost excited as he told me about how we own everything legally.)
  - deleted 10y ago
    [deleted]
  - halomru 10y ago
    Almost all online login systems offer password reset by email. The moment another human has free access to my emails he effectively owns nearly all my accounts.
  - db48x 10y ago
    You're technically correct (which is the best kind, of course), but for peer-review of scientific papers it's not really relevant. There's nothing _private_ about the paper, since the author intends to publish it, or about the reviews, since they're going to the author anyway. Only the identity of the reviewers is confidential, and for that email is perfectly sufficient. Well, a standard email client would be far too error-prone; you'd want something like a blind mailing list just so the editor doesn't click the wrong button and accidentally unmask the reviewer.
  - jcranmer 10y ago
    If you're using large email providers, every step of the email transaction--SMTP to the outgoing server, SMTP between MX's, IMAP/POP to the mailbox server--is conducted using SSL (assuming the end user hasn't elected to avoid SSL when configuring email clients, which is actually hard these days). Yes, SMTP between MX's are routinely sent using SSL: Google reports that about 80-90% of such traffic is using SSL.
  - snakeanus 10y ago
    OpenPGP is probably more secure than whatever system they are using.
- evanb 10y ago
  When asked to peer review something for academic publication, the PDF of the paper is, in my experience, never ever emailed.
  - Zak 10y ago
    Do you know a reason for this? That seems it would be the lowest-effort option for all involved.
    - taejo 10y ago
      Note that the person asking for the review is not the author of the paper, but the editor of the journal or conference. They have several hundred submissions to keep track of at a time. They need to assign two or three reviewers to each paper, and then find alternative reviewers when those decline. They need to collate all the reviews for a paper, use them to decide whether to accept/reject/accept-with-modifications the paper, forward the reviews to the author (except the parts that the reviewer has marked confidential), having stripped the reviewer's identity. If the authors upload revisions, all the reviewers (but not anyone who declined to review in the first round) should receive the revisions, and so on.
- michaelhoffman 10y ago
  This is the norm in academic publishing. Not only do publishers (often for-profit publishers with huge profit margins) ask us academics to critically review submitted manuscripts gratis with short deadlines, but they also want us to use their poorly designed, byzantine online systems to do it. It's most fun when you are just trying to decline this invitation because you do not have time and are asked to create an account and password (with stupid password rules, naturally), and fill out an amount of personal information just to do that.
  - lucb1e 10y ago
    You make it sound as if you are required by law to do this. Short deadlines, for free, on poorly designed systems, behind a login wall. Then you just don't, right?
    - greeneggs 10y ago
      And if it is a government agency asking you to review a grant proposal? Besides the obvious service aspect, you don't want to unnecessarily offend someone with money, that you might have to apply for yourself someday.
      - lucb1e 10y ago
        I understand you're also helping colleagues, but in the case of wanting peers to review your paper it's a simple matter to send emails with PDFs to those peers. But I'm not sure how this world works anyway. I read about research in books that refer to it, Hacker News and Reddit that links to it, etc. but never in a magazine. Yet the magazines seems to be what everyone is aiming for to be published in, they are apparently some big deal. I suppose there is some reason why "peer reviews" are not between "peers".
        itcrowd 10y ago
        The peer review is supposed to be anonymous. So what happens in practice is you upload your paper to a central website from which a set of reviewers can download a copy for review and give feedback with comments, anonymously. This is also why there is a login system: to ensure the comments are from actual peers which have their own papers up in the repository too. I'm not saying this is the best way to do it, just how it is now. Also, if you want someone to just read your paper, sure, email is fine. One does not exclude the other. The central system is there to ensure that should any doubt arise over the quality of the work, the feedback can be read and interpreted. Again, there might be many other more high-tech solutions out there to solve this problem.
- CydeWeys 10y ago
  I do see why they ask for that (although it sounds like their systems could use some improvement). Imagine you trying to get someone to review a 1,000 line patch. If you can just get them to log in to GitHub, they can use all of the pull request commenting tools, and it'll be easy. Otherwise, you have to mail them a big .patch file, and then somehow manually manage comments across all of that. The assistive tools are more convenient.
  - striking 10y ago
    So then give them a one-time login ticket, and let them upgrade to an account? Not saying you could do that with GitHub, but there's design space for it.
  - capnrefsmmat 10y ago
    And add that you have dozens of such patches that you need people to review, and their reviews have to be distributed to a committee of senior developers once they're received, and so on and so on... A journal may have dozens of submissions at various stages of the peer review process. Each requires two or three peer reviewers, who are busy academics who will often fail to meet the deadline. The editor has to track all of these, follow up with lagging reviewers, and then put together all the reviews for a paper to make the final decision. Doing all that by email would be a mess. Reviews would get lost, the editor would lose track of which reviewers were sent which papers, and so on. So the online systems make sense. But they all suck. I've reviewed for several journals which use the ScholarOne system, for example, and despite all being hosted centrally, they inexplicably require separate logins. The website is a clunky piece of crap. If they just had an automated system email me a PDF and ask me to email back a review, and had their script grab reviews from the inbox and format them for the editor to review, it'd be a lot easier. Or if they emailed me a personal link that let me view the paper and leave a review, no login required. But alas, they must overcomplicate it...
    - megous 10y ago
      Linux kernel patch review is over email like this. It seems to work. I subscribe to a few lists and it makes it easy for anyone to chip in. It's a bit burdensome on the patch submitter, to collect the feedback into one place, but not that much. At least the burden is on people who want to get the patch in.
- coldtea 10y ago
  >It seems odd to want feedback and then ask someone to go and register somewhere, probably requiring to accept a bunch of legalese in the privacy policy and terms of service... Just attach the document you want feedback on, right? It's odd, but it still happens all the time.
always_good 10y ago
Recently, in my customer support tickets, more and more of my users have given me email addresses "protected" by http://boxbe.com http://boxbe.com. When I write my reply to them and submit, I get an ACTION-REQUIRED from boxbe.com telling me to register + captcha so that I can get on the receiver's whitelist. It's so invasive that I don't bother. They'll have to check their spam folder for my email.
- jcwayne 10y ago
  I'd never heard of BoxBe, so I took a look. Turns out they're owned by http://eDataSource.com http://eDataSource.com which provides "real-time monitoring of 1.5 million active consumer inboxes" for email marketers. No thanks.
- tomjen3 10y ago
  I had an email with I think bluebottle that did that, but it automatically whitelisted people if you sent them an email. Personally I think that if people aren't willing to complete a captcha to send me an email, that email is probably not so important for them. It is a moot point now, because googles spam filters are good enough that I never see spam, but I just wished there would be an easier way to mass unsubscribe marketing email.
  - dmitrygr 10y ago
    The problem is places like support forms. If you go to my site, click on "contact us" and fill in your message and email, you did not directly email me, as per boxbe. So if I honestly try to reply to you, I'll be forced to waste my time? You better believe you'll never get a reply then. So to reply to your "if people aren't willing to complete a captcha to send me an email, that email is probably not so important for them.". No. Replying to your request isn't that important to me. It probably was to you though....
kapauldo 10y ago
Unreadable for the over 40 crowd on mobile.
- intrasight 10y ago
  Everything is unreadable for the over 40 crowd on mobile. That's why I use Firefox reader view on mobile. On desktop it's as simple as ctrl-shift-+
  - CydeWeys 10y ago
    No, this site is especially bad. 50% of the total screen real estate is taken up by useless margins that shouldn't be there on mobile, and the text size is way too small. Most sites do a way better job of rendering on mobile.
    - intrasight 10y ago
      Yes, that site was poorly designed. Unfortunately is true of most sites to varying degrees IMHO. I browse in desktop mode on mobile (because I don't want the sites to treat me differently) and then use reader mode to read (because then I get a consistent experience).
  - raarts 10y ago
    Use Reader mode if you're on iOS.
- CydeWeys 10y ago
  Kind of ironic given the content of the linked post. He wants everyone to do things that are maximally convenient for him, but he doesn't even have a simple responsive layout on his site to make the margins taking up half the screen real estate disappear so that it's convenient for anyone on mobile to read his stuff.
  - phkahler 10y ago
    That's even more funny since HTML will automatically fill the width of the page. He goes out of his way to create margins to help people with wide screens but doesn't consider the effect on small screens. I just remember in the 90's when the web started taking off and all these designers and people used to regular print publications came along and had to control the page layout when the whole point was to let the layout change to fit the users needs. Margins are not necessary at all - the user can adjust the width of their browser window to alter the width of a line of text, but that's not fashionable these days.
kapauldo 10y ago
Readable version https://read.feedly.com/html?url=http%3A%2F%2Fwww.scottaaronson.com%2Fblog%2F%3Fp%3D3203&theme=white&size=medium https://read.feedly.com/html?url=http%3A%2F%2Fwww.scottaaron...
paulcole 10y ago
If you ever wondered what people meant by out of touch "ivory tower" academics, just read this post. Just imagine telling a client, "sorry I don't open Google Docs on principle. Life is too short and too precious."
- kartan 10y ago
  > If you ever wondered what people meant by out of touch "ivory tower" academics, just read this post. Did you read this: "I’ll continue to devote a huge fraction of my waking hours to fielding questions from all sorts of people on the Internet, and I’ll do it cheerfully and free of charge." The guy is doing more than most, is it so much to ask people to be polite and make things easy when asking for help?
- TeMPOraL 10y ago
  It depends on your market position. If you're a successful company, you get to tell clients what way to send stuff in. BTW. I don't see it as being "out of touch". I see it as a gentle reminder of how we're all wasting each other's time building stuff that requires creation of accounts for no real reasons (except sales tricks).
- skywhopper 10y ago
  Actually he said explicitly that he would open Google Docs. And 90% of the world has a Google account already. What he doesn't want to do is waste 20-30 minutes to create an account and log into a new system every time someone wants feedback on something.
- laumars 10y ago
  You say that but if one looks at your example at face value then you would be surprised how often things like that do happen. I had one supplier threaten to cancel business relations with us if we didn't send through customer details (related to the product they were supplying) on an excel spreadsheet via email. It took quite some negotiation to agree a secure compromise. That's just the most recent example but I've had to deal with countless insane demands from suppliers like this over the course of my career. In several cases being borerline to saying "if you don't want our business then there's plenty of other suppliers that do". However by far the most annoying one I've had, and one that used to be common place 5 years ago in the UK, was recruitment agencies refusing to accept CVs in PDF form. They would accept a Microsoft Word document or RTF. Some even accepted plain text files. But a PDF was point blank refused even in tech-agencies. This used to be a real pain for myself, a Linux developer and administrator who didn't run Windows so couldnt guarantee what OpenOffice would spit out when exporting to .DOC. I ended up having to use a spare work machine and thankfully had a very forgiving boss.
hyperpape 10y ago
This is, in principle, no different than the fact that you have to log in to Github to create issues or add comments. What makes it different is that as a profession, we have decided that Github is nice, good, and ubiquitous. Unfortunately, the portals that he's describing are crappy, bad, and balkanized.
- maaaats 10y ago
  It would be similar to Github if you out of the blue emailed someone asking them to review your code for free. But to do so they would have to sign up for SimilarToGitHubX. And when they have done so, they just wait a few hours while you add them to your private repo.
  - hyperpape 10y ago
    He mentions reviewing papers and grant proposals, which are part of your professional obligations if you're a professor. You're not obliged to do so for any particular journal, but you're absolutely expected to do some, and "cold calling" people is normal. It would be as if part of your job required code reviewing open source projects in your area of expertise, even where you hadn't previously contributed.
    - Spivak 10y ago
      That's not really the issue, the issue is on who's terms must this review take place and there's a strong case to be made that it should be the professor's.
      - hyperpape 10y ago
        I'd argue that's only true if the system can't be better than emailing papers around. I think Github/Gitlab/Bitbucket have shown us that you can do better than emailing patches. I think the academic world could do better than just emailing crap (the arXiv has already done this, but not for full on peer-review). It's just that the current tools are not good. I think Aaronson is mostly right to tell off these journals. However, I think the idea of tools that improve peer review is a good one.
mrspeaker 10y ago
Ha ha, I'm at the same "get off my lawn!" moment in my internet life to. The barrier "first, create an account and login..." is a one that very very few products can tempt me to do. I realized recently that I have space in my life for three log-in websites (HN, a gamedev site, one subreddit), three web apps (gmail, github, slack), and three non-built-in phone applications (instapaper, ride sharing app, twitter). If there's something new in town - it needs to be more valuable than these to knock someone else out of rotation!
- bdefore 10y ago
  could this be alleviated by password managers or is the act of logging in, in and of itself, a burden you would prefer not to do?
  - nuxxx 10y ago
    I'm not mrspeaker, but I have a similar stance regarding apps/logins/etc. For me, it is the burden of having to create accounts for stuff I'll probably only use once, plus the mental burden of knowing that the website has my personal information and might leak it. That, and the fact that having an account/app these days is synonymous with "oh, sure, send me all the spam you have!", via e-mail or mobile notifications. If anything, password managers help me see which accounts I should be deleting.
    - oneeyedpigeon 10y ago
      > If anything, password managers help me see which accounts I should be deleting. I think this is a hint towards what, IMO, password managers should be moving towards. I would like a password manager to really be an account manager that can do things like: * Alert me if a site I have an account on has a publicly declared breach * Let me manage personal details (such as associated email address, phone number, etc.) all in one place * Tell me how often I use each account (and when I login to them from 'unusual' locations/computers) etc.
      - 10y ago
layan31 10y ago
fedwrfc
TuringNYC 10y ago
From the article: Oh, Skype no longer lets me log in either. Funny, I've had the same issue. Between legacy Skype passwords, Microsoft accounts, and what not, for a period of time it became almost impossible to log into Skype. It has improved, but the reset process was designed almost as a maze to help shed all but the most determined. I was not determined enough and eventually gave up and forced Skype contacts to reach out to me via WhatsApp/GChat/Signal/Duo/Allo/FBMessenger. Anything but Skype. Side note: Same thing happened to Wunderlist after they too got purchased by Microsoft.
bostik 10y ago
I applaud this attitude, not least because it reminds me of the UX design story on allowing guest checkouts: https://articles.uie.com/three_hund_million_button/ https://articles.uie.com/three_hund_million_button/ Add a hurdle, any hurdle, to your potential users' workflow and you are doing yourself a massive disservice.
kerouanton 10y ago
This is a global issue. We all experienced friends or people asking for joining them on their social network, or their IM app, which unfortunately you're not on. Same for vendors and partners and such that ask you to create accounts on their websites for sometimes just a single event or document to sync. XKCD recently published a fun illustration of it (1810). On the other hand, most of us want to split between work and friends, between private and public. So we have different accounts for this purpose. I don't use Twitter and Linkedin the same way, and I don't have the same circle of relations connected by those means. So it may be "convenient" to have separate accounts, but at the same time this becomes a burden to maintain and check every of these (not counting data breaches and so). My current practice is the following : - an email address for my close friends & family. - some public accounts for infosec usage (linkedin, twitter...) - some undisclosed accounts for my professional usage. - some undisclosed accounts for my private usage (ecommerce etc.) - all the rest (a vast majority) uses throw-away emails (I own a domain, enabling me to generate unique email addresses per website) and random passwords, so I don't care to monitor them or if they are breached. If I know I won't use the site frequently I don't even remember the password, I just do a "recover password" if I need it in the future. My rules: 1. never reuse the same email twice for websites. That also helps me monitor breaches and/or spam and/or db resellers. 2. never reuse the same password twice. Obviously. 3. never use 3rd party authent such as "Login with FB, Twitter or Gmail", as it breaches the first rule. It generates some work to maintain all of this, but I've been doing it since probably over a decade, and it's now an habit I can't quit, considering the benefits. So, back to the paper, I'd tend not to follow this guideline, even if I'm tempted to do so.
- GrinningFool 10y ago
  I'm in the process of setting up the same thing for my email. Any interest in sharing what you're using?
  - AstroJetson 10y ago
    I have a godaddy domain with email. I give each company companyname@myfakedomain as the email. They all forward to me at astro@myrealdomain. If/when they aggressively send me aggravating email, I flip it to forward to some big wig at the company and forget about it. Works well and is pretty cheap.
droithomme 10y ago
On the topic of "the humans failed to engage them through the intermediary of their bureaucratic process", we long ago stopped accepting any purchases for under $20,000 if the customer insists we apply to their organization, sign contracts, and fill in paperwork to obtain a vendor account with their organization.
hujouo 10y ago
Narcissistic proclamation in a blog that brings no discussion or interesting thoughts.
- ekidd 10y ago
  A recent link from Scott Aaronson's blog points to his survey paper on P and NP (http://www.scottaaronson.com/papers/pnp.pdf http://www.scottaaronson.com/papers/pnp.pdf). If you think that this brings no "interesting thoughts", this probably says more about your intellectual tastes than it does about Aaronson's work.
a_bonobo 10y ago
The Journal Of Open Source Software does the review process rather nicely: You send them a PR with your software/description, and then a reviewer will publicly go through the review process (described here: http://joss.theoj.org/about#reviewer_guidelines http://joss.theoj.org/about#reviewer_guidelines ) Of course that doesn't work with all of science, you don't always want open peer review, usually because several people are working in various stages on similar or related things, or you don't want to publicly criticize the reviewed party, or you don't want to make the reviewer look bad when the reviewer doesn't know what s/he is talking about
EGreg 10y ago
And that is why we have implemented this in our platform: https://qbix.com/platform/features/invitations https://qbix.com/platform/features/invitations https://qbix.com/platform/guide/invites https://qbix.com/platform/guide/invites
cknight 10y ago
I'm no scientist, but I was involved in a couple of projects with a research group to develop web apps that others could use to run biophysics simulations. When submitting them for peer review, there was an absolute requirement from the journals in question that the sites did not require a login to use, and not even an email address to be entered to alert the user to results/completion. Result pages and download links were to be provided at a hidden URL which was linked to from the submission page after the form was submitted. So while we did this, we also ended up maintaining emails for job alerts, but optionally so. Most users have since used their emails to run jobs as it is more convenient for them. But for the reviewers, their requirements made sense. We were submitting to journals which had entire dedicated editions for online scientific apps. Hundreds of them, all of which required peer review by scientists who were being very generous with their time. For a free service, such requirements don't seem at all unreasonable.
dredmorbius 10y ago
I agree with all the advice and sentiments given. Moreover, the proliferation of user accounts, the stickiness that implies for registration email addresses, the general failures of password-based security systems, and the unconscionably high level of tracking implied by indivdually registerd, client-side tattling interfaces, are all rapidly reaching a crisis point. Some months back, another HN user mentioned as an aside in comments that he had over seven hundred site authentication credentials. This is a slight inflation over ordinary users, but not tremendously -- the typical citizen will have a score or several accounts -- social media, email, various vendors, and quite easily 100 or more. There's also the problem of multiple worlds colliding. As YouTube's founder famously noted when faced with a "Please create a G+ account" prompt a few years back. After being reasonably assured that G+ and YouTube activity were separate, I've just learnt that they are not, with results that 1) I'd inadvertantly changed my G+ identity and 2) I've yet again blown away a YouTube profile I really don't care for. I'm not sure what we're going to replace this system with, but extending the current path ain't gonna work. As for the haircuts, a $25 set of electric clippers addresses that need. Or a blade. A 35 year old man is old enough to learn to cut (or shave) his own hair.
65827 10y ago
The worst are the companies who seem to get completely new systems every few years, and if you didn't log in recently you effectively have to create an entire new sign in, and guess what you can't reuse that email and you have some silly new password restriction because SAP or whoever says so. Just awful experiences.
joshuaheard 10y ago
The author was me before I started using LastPass password manager and form filler. I can input my name, address, credit card number in seconds, and it will automatically track all my logins. There are many other such apps out there besides LastPass, so this is not a particular endorsement of that product. And, of course, LastPass or other password manager will not fix all the bad websites out there.
lutusp 10y ago
This describes an increasingly common practice among online businesses -- aggressively monetize visitors, turn them into clients and corporate assets. When you visit a typical modern website, within 15 seconds an overlay appears encouraging you to sign up, give away your email address, and become part of what's really happening. In a hypothetical parallel universe where telling the truth is mandatory, you would visit a website and ask, "So, what are you selling, what is your product?" The website will be forced to reply, "You." All this apart from the present state of the scientific-technical publishing business (also discussed in the linked article), which uses different methods to obtain the same result: monetize people's wish to communicate with each other.
- AnOscelot 10y ago
  I wish the sites with the annoying "give us your email now!" popups would be honest. Just say, in plain language: "You can support this site by giving us an email, which we will then add to a list we can sell to various entities. You don't have to give us your main email address. Just please use something other than mailinator (and their ilk) so it's an saleable address. This will help us stay open despite most of our visitors blocking our ads. We will send you a newsletter occasionally so we can pretend this exchange is not purely about money. Thank you."
Animats 10y ago
Google now hosts web pages on Google Drive you can't even read without a Google account. Please don't use or link to those.
bgrohman 10y ago
"Whenever my deepest beliefs and my desire to get out of work both point in the same direction, from here till the grave there’s not a force in the world that can turn me the opposite way." Words to live by.
mnm1 10y ago
Yup. In addition to not creating accounts, I've stopped filling in Captchas, especially Google's notoriously horrible re-captcha (I've already clicked all the storefronts about a million times and still it's not good enough), turning on JS for sites that don't present content without it, using sites that don't work with ad blockers, etc. except when I have no choice (banks, work). To me, all these sites are broken. If they want content, they need to fix themselves, and present something useful and secure. Most won't due to their business model.
ibgib 10y ago
> Why didn’t I call myself? Mostly, because I hate making unsolicited calls of any kind, a phobia that I admit isn’t entirely rational and that often causes inconvenience. Interesting. I hadnt thought of a reservation as being unsolicited. What about online reservations that are more pubsub-like?
jasonkostempski 10y ago
The unnecessary accounts I hate the most are the ones that are needed to send feedback. An account should not be required for that if you want feedback from outside your happy users bubble.
glangdale 10y ago
On a related, but more trivial level, I note that a lot of places that used to have a nice little punch card or whatever for a loyalty program now have accounts you can log into. So I can, if I want, choose to have to remember a burrito password. Awesome.
InquilineKea 10y ago
Lol this reminds me of the Demolition Ship Captain incident at AoKH where DSC hacked into Angel THS's account (and then ban half the active users on Age of Kings Heaven) by just creating a website where he could get Angel THS to use the same password he could use everywhere (HUNTER)

302 points by seycombi 10y ago

I do not recognize the problem the author talks about, but it seems weird. From the article: > Prof. Aaronson, given your expertise, we’d be incredibly grateful for your feedback on a paper / report / grant proposal about quantum computing. To access the document in question, ... It seems odd to want feedback and then ask someone to go and register somewhere, probably requiring to accept a bunch of legalese in the privacy policy and terms of service... Just attach the document you want feedback on, right? At least if I'd email someone (out of the blue or an acquaintance) for feedback due to his expertise, I'd be grateful for the time taken and try to make it as easy as possible to do. Edit: it has been made clear to me that it's not about individuals contacting the author, it's some big corporation that probably sends this out, probably in an automated manner. I still don't understand why anyone would bother with this when "peer reviews" can happen between "peers" (i.e. sending each other documents for review, rather than going through the middleman that everyone seems to hate such as Elsevier, if blog posts linked on HN are to be believed).

ebbv 10y ago
I assume they are trying to keep the documents in question confidential. Email is not confidential. EDIT: Folks email is not secure. Even if someone doesn't have access to login to your mail account. Emails in transit are insecure. Using outside systems to send confidential data is common practice and has been for years.
- michaelhoffman 10y ago
  In practice, it's no more confidential to use a system where you have a separate, high-security system, that sends out new passwords via email on demand.
- lucb1e 10y ago
  I disagree. A sysadmin is not allowed to take a peek in emails unless there is a reason. Or if I create a folder named "private" on my work computer or work email, they aren't allowed to look in there without a good reason. But I suppose Dutch privacy laws aren't universal, so I don't know how that would be in your (or the author's) country. And if you want to take matters into your own hands, you use PGP. But outside of the computer security business I guess that's mostly unused.
  - erichurkman 10y ago
    Not allowed, or not able to?
  - SomeHacker44 10y ago
    If what is not allowed is not enforced by effective technological measures, or at least logged and reviewed by other trusted parties, then it may as well be allowed. At my company we trust our people and have a web of review. However, we try never to have anyone be the final trusted party - even the boss.
  - gnopgnip 10y ago
    Email in transit is not secure.
  - csydas 10y ago
    This is not strictly true with US businesses and academia. My last place of employment was a university, and per our legal, all data going through the University email or computers is University property; while there is a pledge from IT that all email is private and will not be accessed except for specific circumstances, these circumstances could be pretty much anything and had no relationship to any existing case law outside of what legal felt was necessary to use as reason for why we could access it. But the pledge was just a formality - should there be any interest to check the mail, there was nothing technically stopping anyone with the required access except for someone else with equal access having a problem with it. Likewise, various management offices had no issue with submitting email fetch requests for the simplest of things, with date ranges exceeding two or three years sometimes for what turned out to be incredibly minor reasons. There really is no expectation of privacy with academia in the US when it comes to University owned property or services. (The only reason I found out about any of this from legal was because I asked for clarification on our "duty to report", and one of the lawyers was almost excited as he told me about how we own everything legally.)
- deleted 10y ago
  [deleted]
- halomru 10y ago
  Almost all online login systems offer password reset by email. The moment another human has free access to my emails he effectively owns nearly all my accounts.
- db48x 10y ago
  You're technically correct (which is the best kind, of course), but for peer-review of scientific papers it's not really relevant. There's nothing _private_ about the paper, since the author intends to publish it, or about the reviews, since they're going to the author anyway. Only the identity of the reviewers is confidential, and for that email is perfectly sufficient. Well, a standard email client would be far too error-prone; you'd want something like a blind mailing list just so the editor doesn't click the wrong button and accidentally unmask the reviewer.
- jcranmer 10y ago
  If you're using large email providers, every step of the email transaction--SMTP to the outgoing server, SMTP between MX's, IMAP/POP to the mailbox server--is conducted using SSL (assuming the end user hasn't elected to avoid SSL when configuring email clients, which is actually hard these days). Yes, SMTP between MX's are routinely sent using SSL: Google reports that about 80-90% of such traffic is using SSL.
- snakeanus 10y ago
  OpenPGP is probably more secure than whatever system they are using.
evanb 10y ago
When asked to peer review something for academic publication, the PDF of the paper is, in my experience, never ever emailed.
- Zak 10y ago
  Do you know a reason for this? That seems it would be the lowest-effort option for all involved.
  - taejo 10y ago
    Note that the person asking for the review is not the author of the paper, but the editor of the journal or conference. They have several hundred submissions to keep track of at a time. They need to assign two or three reviewers to each paper, and then find alternative reviewers when those decline. They need to collate all the reviews for a paper, use them to decide whether to accept/reject/accept-with-modifications the paper, forward the reviews to the author (except the parts that the reviewer has marked confidential), having stripped the reviewer's identity. If the authors upload revisions, all the reviewers (but not anyone who declined to review in the first round) should receive the revisions, and so on.
michaelhoffman 10y ago
This is the norm in academic publishing. Not only do publishers (often for-profit publishers with huge profit margins) ask us academics to critically review submitted manuscripts gratis with short deadlines, but they also want us to use their poorly designed, byzantine online systems to do it. It's most fun when you are just trying to decline this invitation because you do not have time and are asked to create an account and password (with stupid password rules, naturally), and fill out an amount of personal information just to do that.
- lucb1e 10y ago
  You make it sound as if you are required by law to do this. Short deadlines, for free, on poorly designed systems, behind a login wall. Then you just don't, right?
  - greeneggs 10y ago
    And if it is a government agency asking you to review a grant proposal? Besides the obvious service aspect, you don't want to unnecessarily offend someone with money, that you might have to apply for yourself someday.
    - lucb1e 10y ago
      I understand you're also helping colleagues, but in the case of wanting peers to review your paper it's a simple matter to send emails with PDFs to those peers. But I'm not sure how this world works anyway. I read about research in books that refer to it, Hacker News and Reddit that links to it, etc. but never in a magazine. Yet the magazines seems to be what everyone is aiming for to be published in, they are apparently some big deal. I suppose there is some reason why "peer reviews" are not between "peers".
      - itcrowd 10y ago
        The peer review is supposed to be anonymous. So what happens in practice is you upload your paper to a central website from which a set of reviewers can download a copy for review and give feedback with comments, anonymously. This is also why there is a login system: to ensure the comments are from actual peers which have their own papers up in the repository too. I'm not saying this is the best way to do it, just how it is now. Also, if you want someone to just read your paper, sure, email is fine. One does not exclude the other. The central system is there to ensure that should any doubt arise over the quality of the work, the feedback can be read and interpreted. Again, there might be many other more high-tech solutions out there to solve this problem.
CydeWeys 10y ago
I do see why they ask for that (although it sounds like their systems could use some improvement). Imagine you trying to get someone to review a 1,000 line patch. If you can just get them to log in to GitHub, they can use all of the pull request commenting tools, and it'll be easy. Otherwise, you have to mail them a big .patch file, and then somehow manually manage comments across all of that. The assistive tools are more convenient.
- striking 10y ago
  So then give them a one-time login ticket, and let them upgrade to an account? Not saying you could do that with GitHub, but there's design space for it.
- capnrefsmmat 10y ago
  And add that you have dozens of such patches that you need people to review, and their reviews have to be distributed to a committee of senior developers once they're received, and so on and so on... A journal may have dozens of submissions at various stages of the peer review process. Each requires two or three peer reviewers, who are busy academics who will often fail to meet the deadline. The editor has to track all of these, follow up with lagging reviewers, and then put together all the reviews for a paper to make the final decision. Doing all that by email would be a mess. Reviews would get lost, the editor would lose track of which reviewers were sent which papers, and so on. So the online systems make sense. But they all suck. I've reviewed for several journals which use the ScholarOne system, for example, and despite all being hosted centrally, they inexplicably require separate logins. The website is a clunky piece of crap. If they just had an automated system email me a PDF and ask me to email back a review, and had their script grab reviews from the inbox and format them for the editor to review, it'd be a lot easier. Or if they emailed me a personal link that let me view the paper and leave a review, no login required. But alas, they must overcomplicate it...
  - megous 10y ago
    Linux kernel patch review is over email like this. It seems to work. I subscribe to a few lists and it makes it easy for anyone to chip in. It's a bit burdensome on the patch submitter, to collect the feedback into one place, but not that much. At least the burden is on people who want to get the patch in.
coldtea 10y ago
>It seems odd to want feedback and then ask someone to go and register somewhere, probably requiring to accept a bunch of legalese in the privacy policy and terms of service... Just attach the document you want feedback on, right? It's odd, but it still happens all the time.

always_good 10y ago

Recently, in my customer support tickets, more and more of my users have given me email addresses "protected" by http://boxbe.com http://boxbe.com. When I write my reply to them and submit, I get an ACTION-REQUIRED from boxbe.com telling me to register + captcha so that I can get on the receiver's whitelist. It's so invasive that I don't bother. They'll have to check their spam folder for my email.

jcwayne 10y ago
I'd never heard of BoxBe, so I took a look. Turns out they're owned by http://eDataSource.com http://eDataSource.com which provides "real-time monitoring of 1.5 million active consumer inboxes" for email marketers. No thanks.
tomjen3 10y ago
I had an email with I think bluebottle that did that, but it automatically whitelisted people if you sent them an email. Personally I think that if people aren't willing to complete a captcha to send me an email, that email is probably not so important for them. It is a moot point now, because googles spam filters are good enough that I never see spam, but I just wished there would be an easier way to mass unsubscribe marketing email.
- dmitrygr 10y ago
  The problem is places like support forms. If you go to my site, click on "contact us" and fill in your message and email, you did not directly email me, as per boxbe. So if I honestly try to reply to you, I'll be forced to waste my time? You better believe you'll never get a reply then. So to reply to your "if people aren't willing to complete a captcha to send me an email, that email is probably not so important for them.". No. Replying to your request isn't that important to me. It probably was to you though....

kapauldo 10y ago

Unreadable for the over 40 crowd on mobile.

intrasight 10y ago
Everything is unreadable for the over 40 crowd on mobile. That's why I use Firefox reader view on mobile. On desktop it's as simple as ctrl-shift-+
- CydeWeys 10y ago
  No, this site is especially bad. 50% of the total screen real estate is taken up by useless margins that shouldn't be there on mobile, and the text size is way too small. Most sites do a way better job of rendering on mobile.
  - intrasight 10y ago
    Yes, that site was poorly designed. Unfortunately is true of most sites to varying degrees IMHO. I browse in desktop mode on mobile (because I don't want the sites to treat me differently) and then use reader mode to read (because then I get a consistent experience).
- raarts 10y ago
  Use Reader mode if you're on iOS.
CydeWeys 10y ago
Kind of ironic given the content of the linked post. He wants everyone to do things that are maximally convenient for him, but he doesn't even have a simple responsive layout on his site to make the margins taking up half the screen real estate disappear so that it's convenient for anyone on mobile to read his stuff.
- phkahler 10y ago
  That's even more funny since HTML will automatically fill the width of the page. He goes out of his way to create margins to help people with wide screens but doesn't consider the effect on small screens. I just remember in the 90's when the web started taking off and all these designers and people used to regular print publications came along and had to control the page layout when the whole point was to let the layout change to fit the users needs. Margins are not necessary at all - the user can adjust the width of their browser window to alter the width of a line of text, but that's not fashionable these days.

kapauldo 10y ago

Readable version https://read.feedly.com/html?url=http%3A%2F%2Fwww.scottaaronson.com%2Fblog%2F%3Fp%3D3203&theme=white&size=medium https://read.feedly.com/html?url=http%3A%2F%2Fwww.scottaaron...

paulcole 10y ago

If you ever wondered what people meant by out of touch "ivory tower" academics, just read this post. Just imagine telling a client, "sorry I don't open Google Docs on principle. Life is too short and too precious."

kartan 10y ago
> If you ever wondered what people meant by out of touch "ivory tower" academics, just read this post. Did you read this: "I’ll continue to devote a huge fraction of my waking hours to fielding questions from all sorts of people on the Internet, and I’ll do it cheerfully and free of charge." The guy is doing more than most, is it so much to ask people to be polite and make things easy when asking for help?
TeMPOraL 10y ago
It depends on your market position. If you're a successful company, you get to tell clients what way to send stuff in. BTW. I don't see it as being "out of touch". I see it as a gentle reminder of how we're all wasting each other's time building stuff that requires creation of accounts for no real reasons (except sales tricks).
skywhopper 10y ago
Actually he said explicitly that he would open Google Docs. And 90% of the world has a Google account already. What he doesn't want to do is waste 20-30 minutes to create an account and log into a new system every time someone wants feedback on something.
laumars 10y ago
You say that but if one looks at your example at face value then you would be surprised how often things like that do happen. I had one supplier threaten to cancel business relations with us if we didn't send through customer details (related to the product they were supplying) on an excel spreadsheet via email. It took quite some negotiation to agree a secure compromise. That's just the most recent example but I've had to deal with countless insane demands from suppliers like this over the course of my career. In several cases being borerline to saying "if you don't want our business then there's plenty of other suppliers that do". However by far the most annoying one I've had, and one that used to be common place 5 years ago in the UK, was recruitment agencies refusing to accept CVs in PDF form. They would accept a Microsoft Word document or RTF. Some even accepted plain text files. But a PDF was point blank refused even in tech-agencies. This used to be a real pain for myself, a Linux developer and administrator who didn't run Windows so couldnt guarantee what OpenOffice would spit out when exporting to .DOC. I ended up having to use a spare work machine and thankfully had a very forgiving boss.

hyperpape 10y ago

This is, in principle, no different than the fact that you have to log in to Github to create issues or add comments. What makes it different is that as a profession, we have decided that Github is nice, good, and ubiquitous. Unfortunately, the portals that he's describing are crappy, bad, and balkanized.

maaaats 10y ago
It would be similar to Github if you out of the blue emailed someone asking them to review your code for free. But to do so they would have to sign up for SimilarToGitHubX. And when they have done so, they just wait a few hours while you add them to your private repo.
- hyperpape 10y ago
  He mentions reviewing papers and grant proposals, which are part of your professional obligations if you're a professor. You're not obliged to do so for any particular journal, but you're absolutely expected to do some, and "cold calling" people is normal. It would be as if part of your job required code reviewing open source projects in your area of expertise, even where you hadn't previously contributed.
  - Spivak 10y ago
    That's not really the issue, the issue is on who's terms must this review take place and there's a strong case to be made that it should be the professor's.
    - hyperpape 10y ago
      I'd argue that's only true if the system can't be better than emailing papers around. I think Github/Gitlab/Bitbucket have shown us that you can do better than emailing patches. I think the academic world could do better than just emailing crap (the arXiv has already done this, but not for full on peer-review). It's just that the current tools are not good. I think Aaronson is mostly right to tell off these journals. However, I think the idea of tools that improve peer review is a good one.

mrspeaker 10y ago

Ha ha, I'm at the same "get off my lawn!" moment in my internet life to. The barrier "first, create an account and login..." is a one that very very few products can tempt me to do. I realized recently that I have space in my life for three log-in websites (HN, a gamedev site, one subreddit), three web apps (gmail, github, slack), and three non-built-in phone applications (instapaper, ride sharing app, twitter). If there's something new in town - it needs to be more valuable than these to knock someone else out of rotation!

bdefore 10y ago
could this be alleviated by password managers or is the act of logging in, in and of itself, a burden you would prefer not to do?
- nuxxx 10y ago
  I'm not mrspeaker, but I have a similar stance regarding apps/logins/etc. For me, it is the burden of having to create accounts for stuff I'll probably only use once, plus the mental burden of knowing that the website has my personal information and might leak it. That, and the fact that having an account/app these days is synonymous with "oh, sure, send me all the spam you have!", via e-mail or mobile notifications. If anything, password managers help me see which accounts I should be deleting.
  - oneeyedpigeon 10y ago
    > If anything, password managers help me see which accounts I should be deleting. I think this is a hint towards what, IMO, password managers should be moving towards. I would like a password manager to really be an account manager that can do things like: * Alert me if a site I have an account on has a publicly declared breach * Let me manage personal details (such as associated email address, phone number, etc.) all in one place * Tell me how often I use each account (and when I login to them from 'unusual' locations/computers) etc.
    - 10y ago

layan31 10y ago

fedwrfc

TuringNYC 10y ago

From the article: Oh, Skype no longer lets me log in either. Funny, I've had the same issue. Between legacy Skype passwords, Microsoft accounts, and what not, for a period of time it became almost impossible to log into Skype. It has improved, but the reset process was designed almost as a maze to help shed all but the most determined. I was not determined enough and eventually gave up and forced Skype contacts to reach out to me via WhatsApp/GChat/Signal/Duo/Allo/FBMessenger. Anything but Skype. Side note: Same thing happened to Wunderlist after they too got purchased by Microsoft.

bostik 10y ago

I applaud this attitude, not least because it reminds me of the UX design story on allowing guest checkouts: https://articles.uie.com/three_hund_million_button/ https://articles.uie.com/three_hund_million_button/ Add a hurdle, any hurdle, to your potential users' workflow and you are doing yourself a massive disservice.

kerouanton 10y ago

This is a global issue. We all experienced friends or people asking for joining them on their social network, or their IM app, which unfortunately you're not on. Same for vendors and partners and such that ask you to create accounts on their websites for sometimes just a single event or document to sync. XKCD recently published a fun illustration of it (1810). On the other hand, most of us want to split between work and friends, between private and public. So we have different accounts for this purpose. I don't use Twitter and Linkedin the same way, and I don't have the same circle of relations connected by those means. So it may be "convenient" to have separate accounts, but at the same time this becomes a burden to maintain and check every of these (not counting data breaches and so). My current practice is the following : - an email address for my close friends & family. - some public accounts for infosec usage (linkedin, twitter...) - some undisclosed accounts for my professional usage. - some undisclosed accounts for my private usage (ecommerce etc.) - all the rest (a vast majority) uses throw-away emails (I own a domain, enabling me to generate unique email addresses per website) and random passwords, so I don't care to monitor them or if they are breached. If I know I won't use the site frequently I don't even remember the password, I just do a "recover password" if I need it in the future. My rules: 1. never reuse the same email twice for websites. That also helps me monitor breaches and/or spam and/or db resellers. 2. never reuse the same password twice. Obviously. 3. never use 3rd party authent such as "Login with FB, Twitter or Gmail", as it breaches the first rule. It generates some work to maintain all of this, but I've been doing it since probably over a decade, and it's now an habit I can't quit, considering the benefits. So, back to the paper, I'd tend not to follow this guideline, even if I'm tempted to do so.

GrinningFool 10y ago
I'm in the process of setting up the same thing for my email. Any interest in sharing what you're using?
- AstroJetson 10y ago
  I have a godaddy domain with email. I give each company companyname@myfakedomain as the email. They all forward to me at astro@myrealdomain. If/when they aggressively send me aggravating email, I flip it to forward to some big wig at the company and forget about it. Works well and is pretty cheap.

droithomme 10y ago

On the topic of "the humans failed to engage them through the intermediary of their bureaucratic process", we long ago stopped accepting any purchases for under $20,000 if the customer insists we apply to their organization, sign contracts, and fill in paperwork to obtain a vendor account with their organization.

hujouo 10y ago

Narcissistic proclamation in a blog that brings no discussion or interesting thoughts.

ekidd 10y ago
A recent link from Scott Aaronson's blog points to his survey paper on P and NP (http://www.scottaaronson.com/papers/pnp.pdf http://www.scottaaronson.com/papers/pnp.pdf). If you think that this brings no "interesting thoughts", this probably says more about your intellectual tastes than it does about Aaronson's work.

a_bonobo 10y ago

The Journal Of Open Source Software does the review process rather nicely: You send them a PR with your software/description, and then a reviewer will publicly go through the review process (described here: http://joss.theoj.org/about#reviewer_guidelines http://joss.theoj.org/about#reviewer_guidelines ) Of course that doesn't work with all of science, you don't always want open peer review, usually because several people are working in various stages on similar or related things, or you don't want to publicly criticize the reviewed party, or you don't want to make the reviewer look bad when the reviewer doesn't know what s/he is talking about

EGreg 10y ago

And that is why we have implemented this in our platform: https://qbix.com/platform/features/invitations https://qbix.com/platform/features/invitations https://qbix.com/platform/guide/invites https://qbix.com/platform/guide/invites

cknight 10y ago

I'm no scientist, but I was involved in a couple of projects with a research group to develop web apps that others could use to run biophysics simulations. When submitting them for peer review, there was an absolute requirement from the journals in question that the sites did not require a login to use, and not even an email address to be entered to alert the user to results/completion. Result pages and download links were to be provided at a hidden URL which was linked to from the submission page after the form was submitted. So while we did this, we also ended up maintaining emails for job alerts, but optionally so. Most users have since used their emails to run jobs as it is more convenient for them. But for the reviewers, their requirements made sense. We were submitting to journals which had entire dedicated editions for online scientific apps. Hundreds of them, all of which required peer review by scientists who were being very generous with their time. For a free service, such requirements don't seem at all unreasonable.

dredmorbius 10y ago

I agree with all the advice and sentiments given. Moreover, the proliferation of user accounts, the stickiness that implies for registration email addresses, the general failures of password-based security systems, and the unconscionably high level of tracking implied by indivdually registerd, client-side tattling interfaces, are all rapidly reaching a crisis point. Some months back, another HN user mentioned as an aside in comments that he had over seven hundred site authentication credentials. This is a slight inflation over ordinary users, but not tremendously -- the typical citizen will have a score or several accounts -- social media, email, various vendors, and quite easily 100 or more. There's also the problem of multiple worlds colliding. As YouTube's founder famously noted when faced with a "Please create a G+ account" prompt a few years back. After being reasonably assured that G+ and YouTube activity were separate, I've just learnt that they are not, with results that 1) I'd inadvertantly changed my G+ identity and 2) I've yet again blown away a YouTube profile I really don't care for. I'm not sure what we're going to replace this system with, but extending the current path ain't gonna work. As for the haircuts, a $25 set of electric clippers addresses that need. Or a blade. A 35 year old man is old enough to learn to cut (or shave) his own hair.

65827 10y ago

The worst are the companies who seem to get completely new systems every few years, and if you didn't log in recently you effectively have to create an entire new sign in, and guess what you can't reuse that email and you have some silly new password restriction because SAP or whoever says so. Just awful experiences.

joshuaheard 10y ago

The author was me before I started using LastPass password manager and form filler. I can input my name, address, credit card number in seconds, and it will automatically track all my logins. There are many other such apps out there besides LastPass, so this is not a particular endorsement of that product. And, of course, LastPass or other password manager will not fix all the bad websites out there.

lutusp 10y ago

This describes an increasingly common practice among online businesses -- aggressively monetize visitors, turn them into clients and corporate assets. When you visit a typical modern website, within 15 seconds an overlay appears encouraging you to sign up, give away your email address, and become part of what's really happening. In a hypothetical parallel universe where telling the truth is mandatory, you would visit a website and ask, "So, what are you selling, what is your product?" The website will be forced to reply, "You." All this apart from the present state of the scientific-technical publishing business (also discussed in the linked article), which uses different methods to obtain the same result: monetize people's wish to communicate with each other.

AnOscelot 10y ago
I wish the sites with the annoying "give us your email now!" popups would be honest. Just say, in plain language: "You can support this site by giving us an email, which we will then add to a list we can sell to various entities. You don't have to give us your main email address. Just please use something other than mailinator (and their ilk) so it's an saleable address. This will help us stay open despite most of our visitors blocking our ads. We will send you a newsletter occasionally so we can pretend this exchange is not purely about money. Thank you."

Animats 10y ago

Google now hosts web pages on Google Drive you can't even read without a Google account. Please don't use or link to those.

bgrohman 10y ago

"Whenever my deepest beliefs and my desire to get out of work both point in the same direction, from here till the grave there’s not a force in the world that can turn me the opposite way." Words to live by.

mnm1 10y ago

Yup. In addition to not creating accounts, I've stopped filling in Captchas, especially Google's notoriously horrible re-captcha (I've already clicked all the storefronts about a million times and still it's not good enough), turning on JS for sites that don't present content without it, using sites that don't work with ad blockers, etc. except when I have no choice (banks, work). To me, all these sites are broken. If they want content, they need to fix themselves, and present something useful and secure. Most won't due to their business model.

ibgib 10y ago

> Why didn’t I call myself? Mostly, because I hate making unsolicited calls of any kind, a phobia that I admit isn’t entirely rational and that often causes inconvenience. Interesting. I hadnt thought of a reservation as being unsolicited. What about online reservations that are more pubsub-like?

jasonkostempski 10y ago

The unnecessary accounts I hate the most are the ones that are needed to send feedback. An account should not be required for that if you want feedback from outside your happy users bubble.

glangdale 10y ago

On a related, but more trivial level, I note that a lot of places that used to have a nice little punch card or whatever for a loyalty program now have accounts you can log into. So I can, if I want, choose to have to remember a burrito password. Awesome.

InquilineKea 10y ago

Lol this reminds me of the Demolition Ship Captain incident at AoKH where DSC hacked into Angel THS's account (and then ban half the active users on Age of Kings Heaven) by just creating a website where he could get Angel THS to use the same password he could use everywhere (HUNTER)