Hacker Newsnew | past | comments | ask | show | jobs | submit | Sayrus's commentslogin

And yet if you want applications to work on your phone, many times you'll need approval from either Apple or Google. Google can effectively ban manufacturers (like they did with Huawei) from using "Android" by blacklisting them from Play Services. Apple owns the entire ecosystem and prevents third-party from having access to the same feature set.

Something tells me that the thing about Google not allowing custom Andriod operating systems to install apps is not quite true. I don't know about this specific topic yet, but I bet that if I look into it, I'll find out that there's nuance here that isn't been correctly portrayed by your comment.

Look up Play Integrity, it's the remote attestation framework Google uses to ensure apps only run on Google-blessed hardware and software. Apps that use it verify that both hardware and software are unmodified and blessed by Google before apps are allowed to run. Banking apps use it, the fucking McDonald's app uses it, public transit pass apps use it, etc.

If you want to use your phone like normal people do in 2025, and not relegate yourself to being a second-class citizen when it comes to simple things like paying for stuff, riding the subway, etc, your phone is either an iPhone or something that plays nicely with Play Services.

And that's just the remote attestation side. Many apps rely on Play Services themselves, and without access to them, will not work. Google gates access to Play Services through contracts, it is not open source or part of Android.


You need to allow Play the play store and it's services and those will wall you in. Many times discussed here: many banking, gov, health apps around the world are banning anything not blessed by Google or Apple and installing on a non blessed system will not allow you to use them. My bank allows a modern and supported android or ios phone or a Windows laptop with a biometric card reader. Pretty much locked in and all banks are following.

From the article cons section:

> It only works where OpenType is supported. Fortunately, that's all major browsers and most modern programs. However, something like PowerPoint doesn't support OpenType.


Thank you, I missed that third sentence.

UUIDs are usually the go-to solution to enumeration problems. The space is large enough that an attacker cannot guess how many X you have (invoices, users, accounts, organizations, ...). When people replace the ints by UUIDv4, they keep them as primary keys.

I'd add that it's also used when data is created in multiple places.

Consider say weather hardware. 5 stations all feeding into a central database. They're all creating rows and uploading them. Using sequential integers for that is unnecessarily complex (if even possible.)

Given the amount of data created on phones and tablets, this affects more situations than first assumed.

It's also very helpful in export / edit / update situations. If I export a subset of the data (let's say to Excel), the user can edit all the other columns and I can safely import the result. With integer they might change the ID field (which would be bad). With uuid they can change it, but I can ignore that row (or the whole file) because what they changed it to will be invalid.


Yes and the DB might be columnular or a distributed KV, sidestepping the index problem.

It's unique but changes on each reload. While the details are interesting, the fingerprint itself is not useful.


Both Apple (WPS?) and Android (Location Accuracy) support improving location through WiFi access points and cellular network discovery. That's usually why you are able to get a lock onto your position even while underground.


GKE uses Spanner as an etcd replacement.


But, and I'm honestly asking, you as a GKE user don't have to manage that spanner instance, right? So, you should in theory be able to just throw higher loads at it and spanner should be autoscaling?


Yes, from the article:

> To support the cluster’s massive scale, we relied on a proprietary key-value store based on Google’s Spanner distributed database... We didn’t witness any bottlenecks with respect to the new storage system and it showed no signs of it not being able to support higher scales.


Yeah, I guess my question was a bit more nuanced. What I was curious about was if they were fully relying on normal autoscaling that any customer would get or were they manually scaling the spanner instance in anticipation of the load? I guess it's unlikely we're going to get that level of detailed info from this article though.


Testing those same captcha on Google Chrome improved my accuracy by at least an order of magnitude.

Either that or it was never about the buses and fire hydrants.


It's a known "issue" of reCaptcha, and many other systems like it. If it thinks you're a bot, it will "fail" the first few correct solves before it lets you through.

The worst offenders will just loop you forever, no matter how many solves you get right.


stock Chrome logged into a Google account = definitely not a bot. here, click a few fire hydrants and come on in :^)

I sincerely wish all the folx at Google directly responsible for this particular user acquisition strategy to get every cancer available in California.


I would think that when you're viewing recaptcha on a site, if you have 3rd party cookies disabled the embedded recaptcha script won't have anyway of connecting you with your Google account, even if you're logged in. At least that's how disabling 3rd party cookies is supposed to work.


Of course, if you have 3rd party cookies disabled, Google would never link your recaptcha activity to your Google account.

They just link it to your IP address, browser, operating system, screen resolution, set of fonts, plugins, timezone, mouse movements, GPU, number of CPU cores, and of course the fact you've got third party cookies disabled.


Isn't Chrome shifting to blocking 3rd party cookies by default? If that's the new default than the default behavior would be that being logged into Google isn't used as a signal for recaptcha


Do you really think they won't make a hidden whitelist for their own domains?


There'd be no way to hide this. If 3rd party cookies are disabled it's trivial to observe if an embedded google.com iframe is sending my full google.com 1st party cookies in violation of the 3rd party cookie settings. There's no pinky promises involved, you can just check what it's sending with a MITM proxy.

I'm sure they're doing other sketchy things but wouldn't make sense to lie in such a blindingly obvious way. (I just tested it, and indeed, it works as expected)


So like X-Client-Data which in many cases uniquely identified you but was, pinky promise, never used for tracking. Sent only to Google domains.

https://9to5google.com/2020/02/06/google-chrome-x-client-dat...


that would fall under "I'm sure they're doing other sketchy things".


"Oh, that's interesting...there is one other user that matches all of that metadata"


That's because Chrome tracks so much telemetry about you that Google is satisfied with how well it has you surveilled. If you install a ton of privacy extensions like Privacy Badger, uBlock, VPN extensions with information leakage protections, etc., watch that "accuracy" plummet again as it makes you click 20 traffic signals to pass one check.


I stop going to sites using that method due to this. I have no intention of proving I'm a human it I have to click several dubious images 3-4 times in a row.


Yeah, we've looked at it in the context of reCAPTCHA v3 and 'invisible behavioral analysis': https://www.youtube.com/watch?v=UeTpCdUc4Ls

It doesn't catch OpenAI even though the mouse/click behavior is clearly pretty botlike. One hypothesis is that Google reCAPTCHA is overindexing on browser patterns rather than behavioral movement


OVHCloud US is a different company from the rest of the world.

https://blog.ovhcloud.com/cloud-data-act/


The separation is even in the URLs, all the locales are using paths, except the US, which lives under us.ovhcloud.com. All locales use a customer console hosted at ovh.com, except the US, which has it under us.ovhcloud.com.


You can't just spin up an LLC and call it a separate company. OVHCloud is still OVHCloud US' subsidiary company.

From the FAQ page I linked:

> In accordance with our Privacy Policy, OVHcloud will comply with lawful requests from public authorities. Under the CLOUD Act, that could include data stored outside of the United States. OVHcloud will consider the availability of legal mechanisms to quash or modify requests as permitted by the CLOUD Act.


>You can't just spin up an LLC and call it a separate company.

You can actually. Becton Dickson did it and shafted loads of their employees by saying they no longer have pensions with them.


> OVHCloud is still OVHCloud US' subsidiary company.

It’s the other way around.

> From the FAQ page I linked:

Which is for the US company.


While you pay a markup on the application, UberEats and others keeps 25/30% of the price based on the marked up price. If you make the calculation they usually have to cut into the kitchen margin while the price for the customer stays more expensive.


Can't the restaurant just say no?



That's mixing up different concerns. If they make an unauthorized site for a restaurant, with no agreements, then the restaurant is getting full menu price.


While the unauthorized sites potentially deliver poor customer service and (the appearance of) higher prices, potentially driving away customers? Who do you know that comparison shops all the different ways to order from the same restaurant?

Price shouldn't be the only thing the restaurants care about.


> Price shouldn't be the only thing the restaurants care about.

Did I imply otherwise?

"Different concerns" means there is more than one concern...


These stories are horrible, but that doesn't prove restaurants lose money on Doordash. One of my clients bootstraps online ordering for restaurants. About 80% of those restaurants request to be on Doordash, and have been on there for many years. I assume they're not all dumbasses losing money on every order.

Doesn't excuse Doordash taking advantage of anyone.


Not every restaurant can handle the deferred payout either. Their business is based on receiving payment at the time of service. The restaurant model operates on razor thin margins, and they don’t buy their food on net 30 terms, but they have to absorb costs as if they do.

There are other issues, but this setup looks a lot like paying the mafia due to the imbalance of power.


Sure but you're blurting generic talking points that don't address the evidence of Doordash hosting millions of restaurants obviously profitably for the restaurants


Unless something has changed over the last couple years, restaurants opt in to being available on those apps. Uber Eats and the others are generally integrated into the restaurant's point of sales system.


That would explain why they sell less or cheaper food, which appear too high on the app due to the markup they have to add to the price to handle the fees. This would be an alternate explanation to why things seem inflated. Even with inflated ingredients prices, it actually still doesn’t add up how the volume dropped so much such that each unit would need to cost that much more (I’m arguing it can’t just be the ingredient prices being high). The fees adding to the perceptual inflation make sense.

It’s more expensive volume or less cheaper volume they can make due to higher ingredient prices PLUS the fees they have to add to cover the delivery service cut. That’s how you get a $20 burger for delivery.

This all gets worse when the prices become sticky at the retail place itself (app prices enter the real world). These delivery service are a serious agitator, true disrupter.


Nah. Those delivery services were opt-out until California passed a law in 2021 prohibiting that kind of behavior.


Ok, but if they're doing it without the restaurant's buy in, then they're presumably just acting as a middleman and ordering from the restaurant themselves, at which point I'm not sure how they're stiffing the restaurant 20-30%. If I were running a restaurant and Doordash kept calling me trying to submit an order for cheaper than the food costs I would simply decline to take their business...?


Doordash puts up a listing for a restaurant and siphons off take-out traffic. Once Doordash gets a critical mass they can turn around and "negotiate" with the restaurant.


And the restaurant can say “no.”

If I were a restaurateur and caught a glimpse of a Doordash driver in my finest establishment, the first thing I would do is put together a simple online order form and start advertising it in every order. If you just disappear from the app one day, your customers trying to reorder would probably go somewhere else – but if they know they can order on your site instead, they probably will (if your food is good enough and your ordering experience is top-notch, or vice versa).


  And the restaurant can say “no.”
And now you have hordes of angry customers who can't understand why you have a Doordash listing (that you didn't create and don't want) but won't fulfill orders.

  If I were a restaurateur and caught a glimpse of a Doordash driver in my
  finest establishment, the first thing I would do is put together a simple
  online order form and start advertising it in every order. 
Whether it's not wanting to give Doordash a cut, not wanting to sell food that doesn't travel well for delivery, not wanting to crowd out local customers, not wanting Doordash to hijack their brand, not wanting Doordash to crowd out their own in-house delivery, or whatever actual restaurant owners litigated these forced listings because they didn't want to be listed on Doordash.

e.g. https://boston.eater.com/2016/3/4/11160924/legal-sea-foods-s...


The claim isn't that your saying no to fulfilling orders, it's that your saying no to giving them a discount.


  The claim isn't that your saying no to fulfilling orders,
  it's that your saying no to giving them a discount.
Well, no. This is the comment I responded to:

  Unless something has changed over the last couple years,
  restaurants opt in to being available on those apps. 
That very much asserts that the issue is about accepting orders. Doordash et al were initially opt-out.


Yeah, like the restaurant can say “no” to giving a discount, they can say “no” to people wanting their food to get delivered now. It’s just that now it’ll be a bad business decision probably.

Everything is possible. And every choice has its own set of tradeoffs. But no, there’s no time machine to the pre-Doordash world now.


If restaurants didn't put themselves on the platform, wouldn't that mean the restaurant is getting full price? Its equivalent of paying someone to call in your order and picking it up. What are the negatives?


This is all, of course very fuzzy, but "I will spend 30 dollars on food tonight" can turn into "I call the restaurant and order 30 dollars of takeout" vs "I use door dash to get 30 dollars of food from that restaurant", and in the latter the restaurant sees less sales. But if I'm already like "I will have food from this place I like" and it's not on doordash or w/e, I might still be motivated enough to head over there!

There's a lot of dynamic variables here (including of course the "the person doesn't order from the restaurant"), but the few times I've used those delivery apps I end up ordering very little food for a lot of money.

I try to just do takeout instead.


You're just arguing against delivery food generally, not against Uber.

Of course delivery has a cost, was even typical for pizza delivery before the apps. If you're that price conscience, takeout always exists.


While I won't go as far as to say that Dominos & co. are trying to run delivery entirely at cost, it is not clear to me that delivery from a shop directly vs delivery with a middle layer (having to pay lots of engineers fancy salaries mind you..) is an equivalent operation.

Remember, delivery apps take the costs and then their cut. That cut theoretically has some pressure from markets or whatever, but ... well.....

I'm splitting hairs here, granted


Dominos uses door dash in my area.


When the market is captured by the marketplace apps: No, not really


Sure they can, and go bankrupt because people order more than they go to restaurants nowadays.


That's my understanding. Uber takes 25%, but by default that's offset by increasing the on-app price 25% relative to the in-store price, and the owner has to explicitly opt out of that behavior. So at the end of the day, they should be getting the same amount as in store orders unless they opted out of the markup, right?


That calculation doesn’t work. If an item costs $10, and Uber marks it up 25% then Uber lists it at $12.50. When Uber takes 25% of the marked up price, they’re taking $3.125 and the restaurant is getting less than $10.


Under would just mark up the price to $13.33 so after they take their 25% the restaurant would get $10.


The data is not yet deleted but will be in 2 days, would you be interested in archiving it?

https://news.ycombinator.com/item?id=45412855


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: