Ask HN: My Startup is Illegal - <AUTHOR>

My Startup Is Illegal
I am designing a P2P hardware product that will (among other things) make it harder for governments to intercept or acquire the data from users' private communications. I am working with one other person, and our concern is this:
How do you move forward with something when you know you might be taken to court, put under surveillance, heavily fined, or otherwise harassed?
We are both shy people who like to work behind the scenes. Our current strategy is to keep to ourselves and try to get a working product while off the radar. Unfortunately our other problem is that we need help and don't know how to ask for it. We specialize in software and security and we have no experience with building hardware prototypes. Both of us are working for free, he supports a large family doing side jobs, and my family is helping me out.
I guess the discussion I would like to see is twofold:
1) How do you stay strong when faced with a huge legal grey area like this? Have you ever survived being typecast as "the wrong side of the law"? How can you move forward with innovation when you are constantly in a paranoid state?
2) How do you meet people when you feel uptight discussing the details of your project? Especially when you can't afford to hire someone, and you need to appeal to the small group who are motivated by similar passions?
I hope we are not too DIY for our own good. I would hate to see a creative project like this get killed because of something so surmountable.
It might be difficult for me to answer questions about my situation, especially publicly. I am open to the idea of talking privately, and I apologize in advance if I seem cagey.
email@example.com <comment><USER2> _How do you move forward with something when you know you might be taken to court, put under surveillance, heavily fined, or otherwise harassed?_

I think the question is also, " _Why_ do you move forward with something when you know you might be taken to court, put under surveillance, heavily fined, or otherwise harassed?"

I'm not trying to be pedantic; it's a legitimate question. Why do this if you know going into that it will cause potentially great harm to both you and your partner who "supports a large family"? It's akin to jumping off a cliff that you haven't looked over to see what's at the bottom. So there would need to be a _very_ compelling reason to move forward, I would think.

So what's your reason for pushing through these problems? When times get tough, what will motivate you to keep pushing through rather than quitting after 2-3 years?

</comment><comment><USER3> Some suggestions-

1\. Tormail rather than hushmail. 2\. Get on the cypherpunks mailing list, you'll get lots of input from lots of smart people <http://www.cypherpunks.to/list/> 3\. Use Tor for everything that pertains to your project. 4\. Find a group that really needs your product and have them on your side, like dissidents in dictatorships, talk to them, find out how your product can help them, if you're in a "democratic" country and the authorities come after you, you can legitimately tell them that you're helping to free the people of a country, it helps to be able to name dissidents who have been murdered by such a regime, you can then ask the agents of your state if they are in favor of these murders, in many countries advocating murder in a different state is a crime, so it is most likely they will not answer your question, merely asking that in a recorded interview will most likely see you free. Afterwards, assuming you are free from state interference it is important that you make it public what has happened to you, do interviews with tech and liberty minded media, talk to the EFF, NOT Wired. 5\. Have contingency plans, like having your schematics, code etc ready to be distributed on TPB like the 3D printed gun from Defense Distributed has been. 6\. If you are at some stage going to release what you have non-anonymously, do it through a separate legal entity, like a limited liability company, so any legal ramifications are borne by that legal entity and you are not personally liable, you will need a lawyer to advise you, you might contact the EFF and have a conversation with them. 7\. Be careful, and good luck.

<comment><USER3> Sorry about rgw formating, hope this is better.

Some suggestions-

1\. Tormail rather than hushmail.

2\. Get on the cypherpunks mailing list, you'll get lots of input from lots of smart people <http://www.cypherpunks.to/list/>

3\. Use Tor for everything that pertains to your project.

4\. Find a group that really needs your product and have them on your side, like dissidents in dictatorships, talk to them, find out how your product can help them, if you're in a "democratic" country and the authorities come after you, you can legitimately tell them that you're helping to free the people of a country, it helps to be able to name dissidents who have been murdered by such a regime, you can then ask the agents of your state if they are in favor of these murders, in many countries advocating murder in a different state is a crime, so it is most likely they will not answer your question, merely asking that in a recorded interview will most likely see you free. Afterwards, assuming you are free from state interference it is important that you make it public what has happened to you, do interviews with tech and liberty minded media, talk to the EFF, NOT Wired.

5\. Have contingency plans, like having your schematics, code etc ready to be distributed on TPB like the 3D printed gun from Defense Distributed has been.

6\. If you are at some stage going to release what you have non-anonymously, do it through a separate legal entity, like a limited liability company, so any legal ramifications are borne by that legal entity and you are not personally liable, you will need a lawyer to advise you, you might contact the EFF and have a conversation with them.

7\. Be careful, and good luck.

<comment><USER3> I forgot something.

8\. Assume the Moscow Rules are true, <http://en.wikipedia.org/wiki/Moscow_Rules> and if you are particularly worried, learn some tradecraft, [http://www.paladin- press.com/category/Espionage_and_Investig...](http://www.paladin- press.com/category/Espionage_and_Investigation) .

</comment></comment></comment><comment><USER4> 0) Everyone is already under surveillance all the time.

1) Be in start-up stealth mode if there is a high chance your product will be misunderstood in a negative way.

2) Seek cohorts at these places: <http://www.2600.com/meetings/mtg.html> <http://hackerspaces.org/wiki/List_of_Hacker_Spaces>

<comment><USER5> Not my post but really helpful links, thanks a lot.

</comment></comment><comment><USER6> It's not clear why you think your startup is illegal ? - encryption broadly speaking isn't legally restricted in most western countries.

If what you're doing is illegal in the country that you're in then why not move to a country in which it will be legal ?

</comment><comment><USER7> Apply for a patent. The office will be too lazy to actually consider what you are doing and give you a license to file abroad which you can show to the feebs to prove you are not doing anything illegal.

</comment><comment><USER8> Why would this be illegal? Lots of people work on products that make it harder for governments to snoop on citizens.

<comment><USER9> OP might have seen some press about the "CALEA II" proposals that the FBI is widely reported to be shopping around Washington, which would, reportedly, impose large penalties for failure to wiretap on demand. (This would probably be civil as opposed to criminal liability, but the fines are described as being large enough that they're obviously intended to force noncompliant services out of business[1].)

That certainly isn't law yet, but it appears to be a serious proposal, and for someone thinking about privacy-preserving technology, it might be worth worrying about.

[1] [http://www.slate.com/blogs/future_tense/2013/04/29/calea_ref...](http://www.slate.com/blogs/future_tense/2013/04/29/calea_reform_fbi_wants_power_to_fine_internet_chat_providers_that_don_t.html)

</comment></comment><comment><USER10> You should include which country's laws that you are concerned about.

</comment><comment><USER11> i thought you're selling drugz</comment>


Why was it so hard to take a picture of a black hole? - <AUTHOR> https://www.askamathematician.com/2019/04/q-why-was-it-so-hard-to-take-a-picture-of-a-black-hole-what-are-we-even-looking-at/ <comment><USER3> Uhhhh this statement in the article about halfway down is incredible!

"You need to be able to tell the difference between one wave front and the next, and if the next wave front is 1.3 mm behind and traveling at the speed of light, then you need to reliably distinguishing between events 4 picoseconds apart (4 trillionths of a second). So, every telescope needs a shiny new atomic clock and a really fast camera. You begin to get a sense of why the data consolidation looks more like a cargo shipment than an email attachment; trillions of snapshots every second of not just the waves you're looking for, but also the waves that will cancel out once all the data is processed. Add to that the challenge of figuring out (generally after the fact) where every detector is to within a fraction of a millimeter even as their orientation changes and the Earth rotates, and you've got a problem."

Just stupefyingly complex and amazing!

<comment><USER4> Calling it a "really fast camera" elides much of the actual difficulty. We're trying to tag individual wavefronts of light at different telescopes, record them, and then play them back at a central "correlator" with the appropriate delays so that the waves come to a focus.

For a wavelength of 1.3 mm, we'd want the time tagging to be better than a quarter of the wavelength at least - say 0.3 mm. The speed of light is 300 mm/ns (a foot per nanosecond is the shorthand beloved of circuit and chip designers). So, for 0.3 mm, we're going to have to get down to a wavefront tagging accuracy of 0.001 ns.

No clock is going to get there, but if we can get ~close enough, we can use a procedure called fringe fitting to determine the clock corrections by looking at the wavefronts. (Does it line up this way? How about this way? How about now? Yes, it's as laborious as it sounds, but computers, eh.)

This is all in the calibration of data, before we do the Fourier inversion to create images - the magic of radio interferometry is that we can record the signal to disk while preserving phase. Optical photons can not be recorded and played back with phase preserved - optical interferometry has to split up the photon streams and send different parts to be correlated against streams from other telescopes, so you run out of signal quickly. Meanwhile, we can record radio waves at the 27 VLA dishes, say, and play them back for correlation on all 27*26/2 = 354 baselines, no problem. That's why radio VLBI is a thing, but not optical VLBI.

Even as a professional radio astronomer, the underlying physics is deep and almost magical.

<comment><USER5> Shannon says you have to record at twice the frequency of the signal to see the signal. What makes you guys double that again?

<comment><USER6> Because you'd also like to know the phase of the waves. If you get unlucky and get just DC offset of the waves (think of it as the 0 crossing of a sine wave) then you've no idea what the phase is. The peak could be before the 0 crossing and the minimum could be afterwards, or it could be the opposite (pi offset in phase). Granted, this is unlikely to occur, you're much more likely to not run into these scenarios. Ideally, you want 4 pieces of data per wave, the 0 crossings and the max/min, for each wave. From that you can get the amplitude and the phase for certain (again, luck is involved)

<comment><USER7> Can you not make a coherent quadrature detector? I was under the impression that those were pretty common in optical communication systems. Edit: nevermind, 230GHz, so millimeter wave but mixers and oscillators exist at that frequency, are the noise figures just too high to use?

</comment></comment></comment></comment></comment><comment><USER8> Bouman's 2014 PhD thesis is refreshingly readable:

[https://people.csail.mit.edu/klbouman/pw/papers_and_presenta...](https://people.csail.mit.edu/klbouman/pw/papers_and_presentations/thesis.pdf)

Everybody can understand, at least the introduction. The author treats two related problems. The first is the well-known (today) integration of data from several separate antennae. The second is the problem of recovering an image of an object from the light reflected on a white wall. They are formally quite close, and the underlying math is, at many points, the same.

<comment><USER9> Previous HN discussion about seeing round corners: [https://news.ycombinator.com/item?id=17902177](https://news.ycombinator.com/item?id=17902177)

</comment></comment><comment><USER10> > Once we set up an array of space telescopes throughout cislunar space (the > volume inside the Moon's orbit) we'll get pictures of the SMBs in the cores > of every nearby galaxy and that's when the science really gets started.

This gave me goosebumps. That's the kind of stuff that justifies a permanently inhabited moon-base.

<comment><USER11> How? It justifies telescopes on Moon, not people on Moon.

<comment><USER12> It justifies telescopes on the really high orbit, but not on the Moon: unless telescope is manufactured on the Moon, logistics of flying large telescope there and safely landing it are so complex, that it's way easier to leave in Earth's orbit and get same results from there.

<comment><USER13> Stationkeeping within a fraction of a millimeter is much easier when your instrument is on solid ground. It might simplify the platform to the point where descent into the lunar gravity well is worthwhile.

<comment><USER14> Building on the surface destroys the entire benefit of the project. The moon isn't large enough to give you the effective ape rather size you need - if it was you'd be fine on earth.

<comment><USER13> The point would be to combine this with the earth-based telescopes to create a 400,000km aperture.

</comment></comment></comment></comment></comment></comment><comment><USER15> If you took the straw from a Big Gulp (1/4 inch in diameter) and made the straw 20,000 miles long, then looked at the sky through that straw, the patch of sky you'd see would be the size of the shadow of the M87 black hole.

<comment><USER16> Which is 6.5mm / 32,000km approximately.

</comment></comment><comment><USER17> The _real_ story is that my childhood was filled with lies, and every "photo" of a black hole I saw in gradeschool science books were really artist renderings.

<comment><USER18> That story is still true today: we only have artist renderings of the black holes and do NOT have real pictures.

The data manipulations that this EHT team did to process their raw data - <USER2> NOT acceptable from the perspective or a correct scientific experiment.

They got their images only when they allowed themselves to creatively interpret data from their telescopes

<comment><comment>~

[https://youtu.be/UGL_OL3OrCE?t=1177](https://youtu.be/UGL_OL3OrCE?t=1177)

19:37

What you can do is to use methods where you [have] do not need any calibration whatsoever and you can still can get pretty good results.

So here on the bottom at the top is the truth image, and this is simulated data, as we are increasing the amount of amplitude error and you can see here ... it's hard to see ... but it breaks down once you add too much gain here. But if we use just closure quantities - we are invariant to that. So that really, actually, been a really huge step for the project, because we had such bad gains.

<comment><comment>~

They also deleted multiple critical comments from that video presentation.

E.g. "Pratik Maitra" posted multiple comments that later disappeared.

<comment><USER19> Do you think the fact that the CT scanner at your local hospital needs to be calibrated and computationally reconstructed from X-ray intensities mean it does not result in an "image"?

When we use side-scan sonar to create representations of the ocean floor (e.g. [https://commons.wikimedia.org/wiki/File:Laevavrakk_"Aid".png](https://commons.wikimedia.org/wiki/File:Laevavrakk_"Aid".png)), they are computationally reconstructed from the raw data which are not intrinsically recognized as pixels without reconstruction. Are these not "images"?

What is your actual contention here? Is it that any representation which is not the result of a traditional visible-light camera doesn't count as an "image"?

If so it's an irrelevant distinction to make. If not, you need to articulate in a specific and informed way why the _way_ they reconstructed the image was wrong or could be improved.

It seems from your blog that you don't really understand what a "prior" is and why it might be useful for this kind of signal processing.

<comment><USER18> > CT scanner at your local hospital needs to be calibrated

Of course the scanner (and any other measurement tool) need to be calibrated. Specifically, the scanner (and telescope) needs to be pre-calibrated based on already known samples.

In case of telescope, it needs to be precalibrated based on known images of remote stars.

Katie Bouman (the face of EHT imaging team), however, claims: "you [have] do not need any calibration whatsoever and you can still can get pretty good results"

Check it out, she actually said that: [https://youtu.be/UGL_OL3OrCE?t=1180](https://youtu.be/UGL_OL3OrCE?t=1180)

I am surprised that only few people caught that flaw.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> A very good explanation on what we are looking at: [https://www.youtube.com/watch?v=zUyH3XhpLTo](https://www.youtube.com/watch?v=zUyH3XhpLTo)

</comment><comment><USER21> So its kind of touched on in the lensing part, but gravity acts on light.

So the black hole is slowing down the light travelling towards us.... But the speed of light is a constant so... 'time' is slowed down?

So does the mean that the light is 'older' than the 54 million years it took to reach us?

I'm over 50% sure there's a flaw in my reasoning somewhere here...

<comment><USER22> The light is redshifted when it "climbs out" of a strong gravity field but still moves through space at a constant speed. [https://en.m.wikipedia.org/wiki/Gravitational_redshift](https://en.m.wikipedia.org/wiki/Gravitational_redshift)

<comment><USER21> Ok that makes sense.

2nd stupid question: I though gravity acting on light was a 'light as particle' thing, rather than 'light as wave' thing? If that were the case gravity acting on light as particle manifesting in light as wave doesn't seem consistent.

<comment><USER23> A photon does not switch from particle behavior to wave behavior. Physicists do. These are two different models for the same thing.

In some ballistics problems, you'll consider a flat earth (baseball problems) in some others a spherical one (spaceflight). It is about which model makes the math simpler.

<comment><USER24> I'd say physicists are pretty constant in their coffee seeking behaviour (the dominant operation mode).

</comment></comment></comment></comment></comment><comment><USER25> Here is Katie Bouman, one of the EHT team members, explaining it in excruciating detail:

[https://www.youtube.com/watch?v=UGL_OL3OrCE](https://www.youtube.com/watch?v=UGL_OL3OrCE)

And an interesting side note:

[https://www.vox.com/science-and- health/2019/4/16/18311194/bl...](https://www.vox.com/science-and- health/2019/4/16/18311194/black-hole-katie-bouman-trolls)

</comment><comment><USER26> So if it's a matter of increasing the effective aperture, does that mean we can launch some spaceships and do the same trick with an arbitrarily large interferometer?

<comment><USER9> Yes, in theory. The challenges are likely to be dish size and getting accurate enough positioning. Not to mention the downlink capacity required (and also onboard storage).

<comment><USER24> What I know of space VLBI is that it exists, and in the one first hand account it didn't give extra detail.

Do you think star tracking doesn't give good enough pointing solutions?

<comment><USER9> It's not just pointing (2D) but also getting the baseline between telescopes. This is also being investigated for the LISA system [https://en.m.wikipedia.org/wiki/Laser_Interferometer_Space_A...](https://en.m.wikipedia.org/wiki/Laser_Interferometer_Space_Antenna)

</comment></comment></comment></comment><comment><USER27> He makes an interesting statement: "Science advances when we're wrong or surprised or both."

<comment><USER28> Theoretical advances require failures of existing worldviews.

They either don't make accurate predictions or explanations, or they fail to account for phenomena.

Science is the internalisation of expecting, admitting, and embracing error.

</comment></comment><comment><USER29> If you'd like to skip the very lengthy introduction, search for "The reason this hasn't be done before".

</comment><comment><USER30> I'll admit: I wasn't a person who was wowed by the picture of a black hole. For all intents and purposes, it isn't a very good picture.

Reading this write up gave me a much better appreciation for the difficulty of actually just capturing that image, which is, I'm sure, what people wanted me to focus on when seeing the photo, but that sort of context requires a write up like this, and can't be relayed through a blurry small picture.

</comment><comment><USER31> does anyone have a link to the original, full-size image of the black hole? i can only find 800x600 versions laying around. I want to know how large the original is. =)

<comment><USER32> [https://www.nsf.gov/news/mmg/media/images/A-Consensus.jpg](https://www.nsf.gov/news/mmg/media/images/A-Consensus.jpg)

</comment></comment><comment><USER33> Honestly curious: why did Bouman get the credit she did? According to Github, she didn't commit nearly as much code, 2.5k LOC vs 850k lines. I understand she migut have had a greater role in management etc.; my point is more that it was a team effort (which she reiterated). Is this a case of the media trying to "celebrate diversity" by unfairly cutting out the whole team which accomplished something incredible? Or is she just the public face and responsible for their media presence?

<comment><USER34> Because that's how the world works, project leaders get fame and line workers don't.

Somehow people are OK when Elon Musk gets credit for Tesla and SpaceX, Steve Jobs for the iPhone but suddenly if it's a women people will dig the github accounts.

<comment><USER35> I don't think the Elon Musk or Steve Jobs analogy is accurate. Katie Bouman was co-leader of one of four imaging teams on the project. It seems to me the other person who co-led that team deserves equal praise and fame, and perhaps also the leaders of the other 3 teams.

Having said that, the look of excitement and joy on Dr Bouman's face in that photo is so lovely and relatable that the pic was always destined to go viral. So in that sense you could say she was bound to become the human face of the project.

</comment></comment></comment><comment><USER36> Well, the thing about a black hole - its main distinguishing feature - is it's black. And the thing about space, the colour of space, your basic space colour, is black. So how are you supposed to see them?

<comment><USER30> It seems like the main issue here was that it was very far away and comparatively small to other intergalactic features like, say, galaxies themselves.

<comment><USER37> Forgive my ignorance, but black holes are quite common in the Universe, right? Why couldn't we simply take a photo of one that's closer to us?

<comment><USER38> One reason is that the closer holes were so much less massive that they were no easier to snap.

Just compare it, Messier 87, to ours, Sagittarius A*: [https://en.wikipedia.org/wiki/List_of_most_massive_black_hol...](https://en.wikipedia.org/wiki/List_of_most_massive_black_holes)

</comment></comment></comment></comment><comment><USER18> "The new black hole picture isn't really a discovery, but it is a stunning accomplishment."

That "picture" is a stunning accomplishment in deception -- following the steps of Elizabeth Holmes and Bernie Madoff.

This EHT team took white noise from their telescopes, then creatively converted that white noise into one of theoretical pictures of a black hole.

</comment><comment></comment><comment>==

[https://youtu.be/UGL_OL3OrCE?t=2242](https://youtu.be/UGL_OL3OrCE?t=2242)

37:22

And you can notice like at the bottom we get really terrible reconstruction, just cause if it fits the data very well, because you know it maybe wants to smooth out the flux as much as possible and we don't select things like that in the true data.

</comment><comment></comment><comment>==

They simply delete image interpretation because it does not fit the theoretical image that they want to see. How convenient. They call it "Calibration Free Imaging":

[https://youtu.be/UGL_OL3OrCE?t=1179](https://youtu.be/UGL_OL3OrCE?t=1179)</comment>


Ask HN: What would you consider your coding standards? - <AUTHOR> Just wanted to see if people had different coding standards.. <comment><USER2> Variable name length should match scope. A variable that only does something for three lines can be a single letter (Ex: i). A variable that is (god forbid) global should be nice and long (Ex: global_map_of_all_callback_functions). Everything I control should be readable.

Method/Class name length should be inversely proportional to usage. If it's used everywhere it should be convenient to type (Ex: add). Of course the method/Class should still describe what SINGLE responsibility the piece of code has. Remember that the name of the class & parameters is part of the method's call signature is many languages (Ex: Registry.add(Person person) could be read as "add person to registry").

Use the generally accepted standards of the community you code in. (Ex: Rust prefers snake_case and SCREAMING_SNAKE_CASE for names)

Be consistent.

Follow the principles of Clean Code. [https://cleancoders.com/](https://cleancoders.com/)

There's more, but that's the general thrust of it.</comment>


Canadian CS Professor fired for being into Bondage - <AUTHOR> http://www.daniel-lemire.com/blog/archives/2008/09/15/canadian-computer-science-professor-fired-for-being-into-bondage/

<comment><USER2> Short summary: People screw up.

Slightly longer summary: People screw up, particularly when they're trying to cover their (or their institution's) ass, and especially if there's any allegation of sexual impropriety involved.

I doubt that Dr. Wightman will return to an administrative position at Acadia -- working on a day-to-day basis with the senior administrators who fired him would be impossible -- but I'd place 100 to 1 odds on him being given financial compensation and offered his faculty position back.

<comment><AUTHOR> I doubt it was that much of a screw up. People do casual hook-ups for fantasy play _all the damned time_ , and only in a minuscule fraction of those does one partner later claim it was not consensual.

<comment><USER2> The police spent two months investigating and found that there was insufficient evidence to lay charges. That means that Dr. Wightman is considered to be innocent. If there were a university hearing on this matter, the allegations made against Dr. Wightman would not even be permitted to be introduced.

If Dr. Wightman had been accused of murder, torture, or war crimes, he would never have lost his job.

<comment><AUTHOR> 100% agreed. This is moral panic, pure and simple.

What's disturbing is that a University would remove a tenured professor based on sexual preference / fetish.</comment></comment></comment></comment>


How Often Do Cryptocurrencies Commit New Code? - <AUTHOR> https://priceonomics.com/how-often-do-cryptocurrencies-commit-new-code/ <comment><USER2> "The chart below shows that, of the top cryptocurrencies by market capitalization, some - like EOS, Cardano, Monero, and Bitcoin - have had a lot more commits than others - like Populous or Bitconnect". Since Bitconnect is a now defunkt ponzi scheme and not a cryptocurrency, their lack of Github activity makes sense :) This analysis would be more helpful if the author properly curated the projects / tokens to include in the study.

</comment><comment><USER3> Is this only looking at one repository per project? Some projects, like Ethereum, have a number of repositories:

[https://github.com/ethereum](https://github.com/ethereum)

<comment><USER4> Yeah, flagged for being inaccurate.

</comment></comment><comment><USER5> Here's a site that tracks exactly this:

[https://cryptomiso.com/](https://cryptomiso.com/)

</comment><comment><USER6> Seems like there would be a big difference in metrics here if committers squash their commits or not.

</comment><comment><USER7> I love this. I've been kicking around the idea of building an automated crypto index buyer that orchestrates purchases/transfers on exchanges, around metrics like commits as well as use metrics like the ratio of on-chain value transfers to speculative on-exchange trading.

Would be nice to couple this with a Linux distribution that made it easy to create an offline wallet for new cryptocurrencies that become interesting, so you could immediately shift your coins off of exchanges.

A lot of them will probably become worth very little/go to zero, but there's a reasonable chance that the Amazon, Apple, Microsoft, Google etc. of the crypto world already exists as a fledgeling project.

<comment><USER8> commit metric would be so easy to fake though

</comment></comment><comment><USER9> Coingecko has been tracking this too, for example [https://www.coingecko.com/en/coins/ethereum/developer](https://www.coingecko.com/en/coins/ethereum/developer)

</comment><comment><USER10> Another factor to consider is the content of each commit. Is it just copying from another project or making trivial changes, or is there real work being done?

</comment><comment><USER11> I was curious about market cap to twitter followers or posts in [https://bitcointalk.org](https://bitcointalk.org).</comment>


Refusing to verify myself: I am liz on Keybase.io - <AUTHOR> http://blog.lizdenys.com/2014/03/31/refusing-to-verify-myself/ <comment><USER2> I like the idea of Keybase.io, but I would prefer to use it in a way in which I don't have to trust them at all. As it stands, you need to install their command-line tool and have it directly manage your GPG keychain. For that, I'd prefer to have a platform-neutral tool that's been independently audited and managed by my OS's package manager rather than their keybase-installer tool which seems to want to update very frequently with who-knows-what changes.

<comment><USER3> While we like being #1 on Hacker News, bad (good?!) timing is what earned us this spot.

It will be the case very soon that you can push your key to Keybase and prove all your identities, without ever installing the client the OP dislikes. Technically, you can already, we just need to put together very explicit instructions and documentation that's different for each kind of proof. By ugly necessity, what it takes to prove yourself on twitter is different from github is different from DNS, etc. Documenting the API was our priority coming into this week.

Later this week the site will have very specific instructions on how to prove your identities (even the complicated ones) simply from your shell plus GPG.

Then those who care can verify all those proofs with a script, in a language of their choice. No Node or NPM needed for any of it.

There was some discussion below about "trusting" the Keybase server's definition of the public key that comes back. The goal here is to remove that trust. Software of your choice can download a Keybase user's keys, the links to their proofs.

<comment><USER4> So, am I (as #3000-something in the beta queue when I signed up for it) any nearer to having an account I can start testing? :-)

<comment><USER5> Send me a mail, I have a couple of invites available.

</comment></comment></comment></comment><comment><USER6> In reality, the biggest risk for routine comsec with pgp is that no one uses it because it's difficult, but the very specific app of code signing is something where keys need a lot of protection IMO. (I am mostly fine with START TLS for email security 99.99% of the time)

The thing which terrifies me is that the npm keybase app asks for my GPG key directly in the same window, and it's impossible for me to (easily) tell when the password prompt is from my GPG binary (which I pretty much trust) vs. the npm binary.

I'm using keybase now (rdl), mostly because I trust Chris Coyne personally, and because my key is old. I'm creating a new 4096 RSA key soon, and will be a lot more paranoid about protecting it -- it will only ever exist on read/use only smartcards after initial generation on a secure machine. (sadly, openpgp card doesn't support export and replication, so to be durable, I have to generate it externally and load onto a bunch of cards and then delete the external key; I'm not willing to trust my keys to a single smartcard I carry with me.)

Using keybase with gpg agent is maybe a bit safer. I don't _really_ mind being forced to do bad stuff by keybase, due to the risks to them if they're caught, as long as it doesn't expose my keying material. gpg agent plus a hardware smartcard should mostly protect me. The pure-software alternative would be a bunch of text-file messages which I can manually cut and paste and move around between clearly-distinct processes running in separate shells/windows (or machines!).

I've been thinking about something a lot better than openpgp card, though, as a secure end-user key management device, with more than just key protections. Unfortunately that means making custom hardware, and that makes little sense in the volumes PGP achieves; maybe if there are other client-side security credentials like ssh or bitcoin, I'd do it.

<comment><USER7> There's one instance in which we prompt for your PGP password directly, since gpg doesn't give us command line access to the needed feature: that's adding the username <email@example.com> to your public key if it's not already there. Aside from that, we never need your PGP password and just rely on gpg to prompt for it when needed. If you're seeing other prompts, it could be bug, please let us know!

<comment><USER6> The point is that in a terminal window I have no idea what comes from the keybase binary vs. the gnupg binary it calls out to. You could throw up a convincing looking prompt, steal my passphrase (optionally crashing or passing it on to the real binary to delay suspicion), and then send the key and the passphrase back to your servers.

Realistically, I'm not going to validate the keybase binary, npm, etc. every time I update the app. (and even if I am, many users won't). And a "user of interest" could be given a "special" binary pretty easily.

<comment><USER7> Agreed. We wish there was a practical solution to this problem, but at some point, it's turtles all the way down.

<comment><USER6> If your binary output a text file or whatever with commands for GPG, which I could then execute and put back into keybase, that would solve the problem.

I agree, usability nightmare, but it would be a nice paranoid option.

<comment><USER7> Hmm, interesting idea. In general, there is only one sensitive operation per keybase invocation (though many signature verifications that use only public keys), so this is doable but cumbersome.

</comment></comment></comment></comment></comment></comment><comment><USER8> You can build a newer version from an official Ubuntu source package. Start by adding a line to a file in /etc/apt/apt.conf.d/ that pins all your packages to 12.04, "precise":

      APT::Default-Release "precise";

Then add a line to your /etc/apt/sources.list to include saucy (or trusty), which has the right version of node.

      deb http://archive.ubuntu.com/ubuntu saucy main restricted universe
      deb-src http://archive.ubuntu.com/ubuntu saucy main restricted universe

Saucy won't be supported after this year. You can either use Trusty now, or wait for Trusty to be officially released next month and then switch.

Next, run these:

      sudo apt-get update
      sudo apt-get build-dep -t saucy nodejs
      sudo apt-get -b source -t saucy nodejs

This puts the packages in the current directory. Now just install the one(s) you want:

      dpkg -i nodejs_0.10.15~dfsg1-4_amd64.deb

Edit: wow, I just noticed how many packages that build-dep step pulls in. I hope that doesn't step on anything important :( At that point, you might as well just add a file /etc/apt/preferences.d/01node with these lines:

      Package: nodejs
      Pin: release n=saucy
      Pin-Priority: 1000

Then "apt-get install nodejs" will get the right version and all dependencies, no need to build from source.

</comment><comment><USER9> I've only been glacing here and there, but I keep seeing discussion of uploading ones private key to keybase being an actual mechanism that is supported / encouraged / extant ?

Surely not...

<comment><USER6> The existence of that option is utterly insane IMO. I assumed it was some kind of IQ test for users; if they accept the offer, they get deleted. Sadly, that seems not to be the case.

<comment><USER7> We seem to have hit a real nerve here. I ask everyone to question their assumptions just for a moment. If you post a public key, you are letting the world see p*q. Is it insane to let some people see AES_k(p,q) if k is 256 random bytes? If you think yes, then you are making a strong judgment about the relative difficulty of two very different problems in Crypto that are thought to be quite hard. I realize there are issues surrounding coming up with good k's and keeping those k's secret; are these issues at the core of people's objections?

<comment><USER10> Imagine that Keybase is compromised. It starts serving a password-prompt page that looks identical to the previous, but now sends your decrypted key straight to the malicious attacker.

Storing your private key on Keybase allows Keybase to become a single point of failure, which pretty much defeats the whole point of distributed social verification in the first place.

<comment><USER6> And worse -- it only needs to send that special password prompt page to a specific IP or user of interest, and maybe only when it comes from a mac box (if the victim is known to do auditing on a linux box, but uses it as a regular client on mac).

Shipping packaged software with evil inside to ~everyone is risky because at least one user is likely to find a bug (accidentally) and try to trace/reverse/whatever (or, at the very least, if you do networked evil, some kind of IDS/firewalling).

Per-user downloads, especially at time of each use, are vastly more risky; this is the "hushmail attack".

<comment><USER7> We're definitely worried about the hushmail attack, and we disclaim browser- based crypto on the site for those who want to protect against powerful adversaries. Some users might not have those concerns.

You've obviously indicated valid concerns, but note, they're not indictments of storing an encrypted private key on the server so much as they are of browser crypto.

<comment><USER6> Yeah -- from what malgorithms says, you're actually on the path to removing dependency on a given binary being "near" my key material. I trust you guys more than enough for now; I just don't want to have to trust you if this gets wide adoption in 2 years once you become an actual target.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I had a similar issue with the verifying process. I opened an issue requesting better documentation on the signing command so that people can write their own clients: [https://github.com/keybase/keybase- issues/issues/174](https://github.com/keybase/keybase-issues/issues/174)

<comment><USER3> Yeah, thanks for making this issue. (Chris here, one of the two working on Keybase. I commented on that issue recently.) Getting proofs working totally outside our alpha client (and getting them well documented) is something we're working on this week. Keybase will not require running Node at all to interact with it.

There will be 2 ways to "prove" yourself as a programmer on Keybase:

1\. running `keybase prove github` (or whatever service) which is interactive; the keybase client can generate the nice statement for you and pass it off to GPG for signing. This is already working.

2\. running something in your shell which requires nothing but gpg and standard shell commands. The key elements here are that you need to generate a signed statement connecting your two accounts, and you need to post it on github. This is pretty simple and won't require Node at all.

Oh, and 3. using some other software of your choice that implements 2.

The reason #2 isn't documented yet is that it's a bit more complicated in certain cases. Consider what it takes to perform a twitter proof (click the "show the proof")

[https://keybase.io/chris/sigs/DZ9rccBD8u-Att6kQzhHHtw-924s7i...](https://keybase.io/chris/sigs/DZ9rccBD8u-Att6kQzhHHtw-924s7iNt05dB)

The signed statement itself isn't hosted on twitter (it won't fit) but needs to be boiled down into an agreeable tweet-sized hash. In order to prove twitter manually, you need to generate this statement, boil it down, make the tweet, and push the statement to Keybase.

All this will come, and our goal with Keybase isn't to require Node or npm for anyone.

<comment><USER12> Can you document the api calls neede for #2?

<comment><USER3> yes, sorry if that wasn't clear. What I'm saying is that we'll have them documented very shortly. It's a priority for us, which I believe will address the OP's issue.

We'll have documentation on:

\- what needs to be in the signed statement

\- how to hash the statement for safety on the platform you're posting, if necessary (twitter: yes, github: no, DNS TXT: yes, web domains: no, etc.)

\- how to tell Keybase about the statement (API call)

\- how to post the statement on Keybase (API call; this is needed in the scenario where it's hashed, twitter style)

These will all be proof specific, which is necessary for reasons you can imagine. Character encodings allowed, where proofs go, what length they can be, etc., what goes into a proof (username?), etc., are all platform specific.

But the goal is that someone can do this with software of their choice.

</comment></comment></comment></comment><comment><USER13> Ok, well, keybase is less than a month old. You are refusing to use bleeding- edge software because it's not supported by your Linux distro. That means you're probably not the target user for what is described on the website as alpha software. Doesn't mean you won't be at some point when they've added functionality and extended the APIs, but for now you don't feel comfortable using it.

I think that's a fair stance to take on early-alpha software.

</comment><comment><USER14> Curious: Why do people choose JavaScript/node.js to write command line apps over traditional languages for that task like python or ruby?

<comment><USER15> Why do people choose python or ruby to write command line apps over traditional languages like BASH, PERL, and C?

<comment><USER9> Exactly - I read:

"Why do people choose JavaScript/node.js to write command line apps over traditional languages for that task like python or ruby?"

and was agreeing with the first part of the sentence and then laughed out loud at the end ...

Are we really in a world where ruby is the old school traditionalist way to write unix utilities ?

<comment><USER13> I was working with Capistrano almost a decade ago when it was called SwitchTower, so yeah -- it is kind of old school considering most "startup" developers are under 30.

</comment></comment></comment></comment><comment><USER16> You just have to know that you're placing all your trust in keybase. If keybase says they have verified that `liz` is a certain facebook account, and you are acting based on that in encyrpting something to `liz`, you are trusting that:

* keybase acted honestly

* nobody compromised keybases software when it was doing the verification

* _after_ it did the verification, nobody managed to get keybase to switch out `liz`s key for some other key that wasn't really liz's (either because keybase was compromised, or keybase was untrustworthy... maybe because the government made them be?)

That last one is the kicker for me. If keybase catches on, surely they are going to get government orders to swap our one key for another key at some point.

The traditional web of trust does not require trusting any of those things, or at least not in those simple forms.

On the other hand, yes, there are reasons traditional PGP hasn't caught on, and usability is a big one. But, still, to compromise security for usability... if you go all the way there, you just wind up where we are now, not secure at all, right?

So, okay, is there value in going some of the way there, and getting some improved security but not as much as you could, for a more usable experience? Maybe. The danger is that people will think they are getting a lot more security than they are getting, and that situation can be worse than no security at all.

One thing Snowden taught us is that if you have to trust a third party to be honest... it's not that the people running keybase aren't honest, it's that the government will _compel_ them to be dishonest if it ever matters to them.

<comment><USER10> It's not correct that you need to trust Keybase. The way that someone verifies their social identity is by posting a tweet (or equivalent) signed with their private key. So you can look up someone's public key on Keybase and then verify that Keybase gave you the correct key, by checking the signature on their original tweet / other social verification posts.

Assuming you actually do this level of verification yourself (rather than allowing keybase to do it for you), the only thing you have to trust is that Keybase/Twitter/Github/Facebook/etc aren't all _simultaneously_ colluding to give you a bad key. That seems to me like a reasonable assumption in pretty much all plausible circumstances.

<comment><USER16> Aha, good point! Hmm, have to think about that more.

It might be cool if there were an open source tool (from keybase or not) that would do this check for you. Most people in the target audience aren't going to be able to do it yourself.

That might be something cool for keybase to provide. (Yes, of course you'd still have to trust the open source tool, but that's why it's open source, etc.).

Before sending something particularly sensitive, you could run the tool to check that the public key you have still matches what was posted on their twitter, facebook, etc. (And yes, if someone can hack the old tweet on twitter, then of course, yeah).

<comment><USER17> Isn't that exactly what the command line client does when you verify a user?

<comment><USER16> Ah, you can re-verify the user at any point, not just the first time you add them as a contact or whatever? Neat.

Okay, this is good marketting for the product, because you are convincing me that at least it might have evaded some of these problems, and is worth further investigation. :)

</comment></comment></comment></comment></comment><comment><USER18> So to verify a key I need to install npm?

No thanks.

" It doesn't seem particularly safe for me to trust my valuable PGP keys to this system."

I agree

</comment><comment><USER19> Couldn't they create a challenge/response type authentication that proofs that liz has the private key for her public key?

Liz wants to authenticate. Keybase sends her a challenge, which she encrypts using her private key. Keybase uses her public key to verify that liz owns the private key for her public PGP key. Easy peasy.

<comment><USER20> Keybase seems to want identity proofs to be independently verifiable, which would not work with challenge/response mechanism.

<comment><USER19> Yeah, I know this is somehow the point. On the other hand it (maybe?) would be more useful if they would just verify that certain online-personas (e.g. github, pgp, blog) are the same person, which you could do.

I want to know that liz, is the liz that blogs and liz who forks on github, not necessary her facebook/linkedin/real name.

<comment><USER21> This is exactly what Keybase does.

</comment></comment></comment></comment><comment><USER22> I just signed up on keybase.io.

It seems that I can authenticate, get a few people to track me, than revoke my key and upload a new one. I can also, obviously, recover my password via email.

And at the end of the process, people who were "tracking" me will still be tracking me. I am not sure this is supposed to happen.

<comment><USER23> As long as you don't follow the delete account track, this seems correct. People who track you can choose to be notified by Keybase.io of the change in your key (which is the default option). Additionally, if you can re-prove your identity against the same external identities this makes sense as a way to recover from a compromised key.

</comment></comment><comment><USER24> There was a keybase security vulnerability reported last week as well. I'm not sure if it is 100% relevant because it had nothing to do with js crypto, but it could have allowed someone to impersonate 'liz' as 'iiz'

github report: [https://github.com/keybase/keybase- issues/issues/397](https://github.com/keybase/keybase-issues/issues/397) blog: [http://ejj.io/keybase-io-vulnerability/](http://ejj.io/keybase-io- vulnerability/)

</comment><comment><USER25> This talks much more to me, tho: [http://gpg.mozilla.org/pks/lookup?search=0x4E8EA664&op=vinde...](http://gpg.mozilla.org/pks/lookup?search=0x4E8EA664&op=vindex)

And of course, I like that it's distributed and not a business. I don't want people to do business on my identity.

</comment><comment><USER26> ok, the distro has an outdated version of x software. This is a pretty common issue with older distributions. The great thing about debuntu is that you can pin packages to newer versions!

[http://packages.ubuntu.com/saucy/nodejs](http://packages.ubuntu.com/saucy/nodejs)

</comment><comment><USER27> I don't even get as far as being able to verify myself. When I follow their instructions to upload my public key, I get "Whoa: Error: Unknown public key version: 3". Which doesn't really help me know what's actually wrong.

</comment><comment><USER28> > 'Prerequisites: Node.js'

No thanks. Not going to install a slew of node packages all from untrusted sources so that i can "claim" my name in some PGP key DB. Key DB's are not the way to go. Name associations are worse. As someone illustrated by pumping snowden@<somedomain> or glengreenwald@<somedomain> keys into gpg servers. The adverse effect of this names system has a heavier weight than the positive.

If people want to improve usability they first should start with authentication. That is, authenticating keys. Second they should develop systems that permit for predictable imperfections in a manner that the user can understand.

<comment><USER29> Keybase seeks to solve the exact problem you just pointed out by connecting PGP keys to established online identities (Twitter, Github, etc.). You could create a Keybase account for Edward Snowden, sure, but his friends wouldn't trust it when they discover that the Twitter account they know to be his hasn't verified the key.

You say that people should start with authentication. That's exactly what keybase is trying to do. Realize that it's a hard problem. How would you implement it?

<comment><USER28> I acknowledge that there is positive to this reputation scheme. It lets Alice ratchet up-trust. But Bob has to be able to somehow confirm the attached accounts. Keybase assumes Bob will check this.

1\. It assumes that Malory didn't copy paste all the content of Alice's bitbucket/alice account into an unclaimed github/alice.

2\. It assumes a state actor cannot change the content on github, twitter, etc at the moment Bob attempts to validate the associates with Alice's keybase name.

3\. Many Bob's will misplace their trust in the names on Keybase just as they do with GPG WoT (Web-of-Trust) systems because Bob doesn't really check the assumptions, caveats and things he should before trusting the key is Alice's.

This name/key anchoring will work for casual users of PGP who are not worried about malicious users clever enough to copy+paste enough content to attempt a Sybil attack. It works for people that are probably already in communication with each other for some time. But it should not be used for someone needing to retain anonymity, or anyone worried about state adversaries, or anyone worried about an "advanced persistent" adversary, or in the post-snowden world anyone wanting to communicate with a journalist.

It's point #3, how people actually use/abuse WoT's like this, that I feel outweighs the narrow positive scenarios. Keybase might be an improvement on absolutely horrific and broken existing WoT's such as [http://pgp.mit.edu](http://pgp.mit.edu) (I cannot believe this thing is still non-ssl only) and it explores imperfect security, which I am a big fan of. I just think WoT's in general have some other fundamental problems.

</comment></comment></comment><comment><USER30> Bitcoin blockchain is looking to take market share for "trust" and "verification" type things. The new web of trust.

</comment><comment><USER7> Install-less, hosted-private-key-less Github, Twitter and Web site verifications are now live on keybase.io. Enjoy!

</comment><comment><USER31> Yet another project that will end up at the bottom of the lake like all other digital identity claiming sites.

</comment><comment><USER32> If I connect to a computer which uses some public key, and I verify that key with keybase.io. I could connect again and the public key could change but still be valid.

Ultimately you're trusting keybase.io not to mess with the verification process, correct?</comment>


Confessions of an ID Theft Kingpin, Part II - <AUTHOR> https://krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-ii/ <comment><USER2> > "I don't know of anyone who has come close to causing more material harm > than Ngo did to the average American," O'Neill said.

> Throughout the court proceedings, Ngo sat through story after dreadful story > of how his work had ruined the financial lives of people harmed by his > services.

He made it easier for people to steal money from banks and credit card companies. Its a pretty stupid system that forces the "average American" to be on the hook for that. We shouldn't even be calling it "Identify Theft", this is just bank fraud.

[https://www.youtube.com/watch?v=CS9ptA3Ya9E](https://www.youtube.com/watch?v=CS9ptA3Ya9E)

<comment><USER3> What about cases where card-holders don't check their credit statements or transaction history or have alerts set up? Many may never even notice some of the fraudulent transactions.

It's true that this is largely bank fraud rather than theft of consumers' money, but it's still technically both, and in some cases literally both. Carders justify their actions by saying they're just ripping off huge corporations, and, yes, it's undoubtedly more ethical than burglarizing someone's home or something, but it's still major fraud.

<comment><USER4> Two things can be true at the same time.

The other thing thats true is that the most wealthy corporations on earth have twisted language and law to make these breaches of their [bank] security the failing and responsibility of the individuals who trust the bank-- or, often didn't even have anything to do with the bank (in the case of new lines of credit being opened in your name at a different institution)

<comment><USER3> I'm certainly no fan of giant banks, but this isn't concerning breaches of bank security. The fraudsters discussed in the article are generally stealing people's credit card numbers by installing malware on their devices. Sometimes it's them putting a skimmer on ATMs, but the bank's security isn't necessarily to blame for that if they aren't the ones that operate the ATM. Sometimes it's hacking a company like Target and compromising all of their payment systems; but Target is really at fault, there.

>to make these breaches of their [bank] security the failing and responsibility of the individuals who trust the bank

It's really the opposite: the consumer fucks up, by torrenting something and running Game of Thrones.exe, or whatever, and the bank is 100% on the hook for the consumer's lack of caution. It's actually quite amazing that anyone who has their money stolen gets all of their money back if it was stolen using a credit or debit card. The banks could easily just say "unless you can prove this was our fault (and it rarely is), you're on your own", but they reimburse you with no questions asked every time.

This is due to laws, not the banks' own good will, but it's still quite a nice situation for card-holders, if they realize their card has been used without their knowledge. (Often it's the bank who detects it and informs them.) That's why the fraudsters justify the ethics of their actions: the bank takes the hit, not the card-holder.

<comment><USER2> > The fraudsters discussed in the article

Your comment almost directly contradicts the article. This isn't about just stealing credit cards:

> "Many of them told us the same thing: Buying identities was so much better > for them than stolen payment card data, because card data could be used once > or twice before it was no good to them anymore. But identities could be used > over and over again for years."

And your part about "The banks could easily just say "unless you can prove this was our fault (and it rarely is)":

> "But during my case, the federal court received like 13,000 letters from > victims who complained they lost their houses, jobs, or could no longer > afford to buy a home or maintain their financial life because of me. That > made me feel really bad, and I realized I'd been a terrible person."

That doesn't sound like the banks were very forgiving for those 13,000 people, and it is 100% not their fault that Experian published on the public internet enough personal data about them to open new credit cards.

<comment><USER3> Sorry, you're absolutely right, I was mistaken and somehow ended up only skimming the parts of the article that were more about his personal story (and I guess overlooked the thread and article title, as well). Maybe partly due to reading some other previous Krebs posts about carders. Identity theft definitely is far more damaging to consumers than carding is, and banks and financial institutions are definitely a lot less forgiving.

People should disregard my above post. I think I just fell into the unfortunate HN stereotype of getting wrapped up in the comment section instead of RTFA.

</comment></comment></comment></comment></comment></comment><comment><USER5> > But based on the records they did have, the government estimated that Ngo's > service enabled approximately $1.1 billion in new account fraud at banks and > retailers throughout the United States...

Krebs really should have pressed this issue. Law enforcement always inflates these numbers significantly. They use sentencing guidelines to arrive at "financial losses" that aren't real.

For those who aren't aware, US Federal Sentencing Guidelines are how federal courts determine what punishment someone will receive. In many types of crimes they don't use true loss values because it would be very hard or impossible to determine. Instead they assign a fixed amount per instance.

For example, a single stolen credit card number may be considered $500 in fraud, even if the card was never used by the person being sentenced. I don't know if this is the current amount but it was 15 years ago when I was sentenced.

If someone has a database of 1000 credit card number they hacked, the court considers it to be $500,000 worth of fraud.

It makes sense in small cases but in larger ones like this it vastly inflates the amount of actual fraud.

<comment><USER6> From Part 1 of the article:

> _"He was selling the personal information on more than 200 million Americans > and allowing anyone to buy it for pennies apiece."_

If 1% of those is used to commit $500 in credit card fraud that's $1B in hard losses without considering the cost to those 2M people cleaning up the mess.

It sounds like $1.1B is on the absolute low end.

<comment><USER5> This is also misleading. He had _access_ to data on 200 million people. He didn't sell that many records.

</comment></comment></comment><comment><USER7> It seems like the data brokers did most of the dirty work of collecting, storing and giving away the data to anyone who asked nicely. This guy managed to get access to all that sensitive data by just a single instance of social engineering. The data brokers' executives should be rotting in jail alongside him on much longer sentences.

<comment><USER8> The data brokers have accumulated towering piles of toxic data, creating a situation where spillage — and the resulting terrible harm to the innocent — becomes statistically inevitable.

<comment><USER9> Some people consider such piles of data a liability.

<comment><USER10> Probably including your parent comment, given that they described them as piles of toxic waste.

<comment><USER8> "Data is a toxic asset."

— Bruce Schneier

It is an asset, not waste.

</comment></comment></comment></comment></comment><comment><USER11> Equifax and Experian took our most personal financial information without our permission, made money from it and completely failed to protect it. These A-#&@# are the ones who should have gone to jail.

<comment><USER12> The big 3 are so wedded to big finance. The credit reporting market needs serious disruption.

</comment></comment><comment><USER13> "I don't know of anyone who has come close to causing more material harm than Ngo did to the average American," O'Neill said.

Noit trying to minimize his crime, but since he was reselling data from _legit_ data brokers, would that not imply the latter are also "causing material harm to the average American,"?

</comment><comment><USER14> best quote (of a quote):

> "We interviewed a number of Ngo's customers, who were pretty open about why > they were using his services," O'Neill said. "Many of them told us the same > thing: Buying identities was so much better for them than stolen payment > card data, because card data could be used once or twice before it was no > good to them anymore. But identities could be used over and over again for > years."

<sarcasm>good thing the few companies who had to pay damages to those leaks covered a few dollars for one or two years of some useless data-protection scams, who do no good other than having your data pulverized to another potential data leak</sarcasm>

Can't wait for a time where PGP is part of the k12 curriculum and we can have a decent solution for all that.

</comment><comment><USER15> Outside the US, it is a norm to have government sponsored hard online verification with two-factor authentication. Examples include Estonian eResidency, online bank verification in Nordics and infamous Aadhaar in India.

Though this gives government more power, it makes simple online identity fraud, like tax refund schemes, impossible.

<comment><USER16> I am not sure you can call it the norm- it's not that common. However it is very sensible, and I am not sure why you-are being down voted.

</comment></comment><comment><USER17> "When I was in jail at Beaumont, Texas I talked to one of the correctional officers there who shared with me a story about her friend who lost her identity and then lost everything after that," Ngo recalled. "Her whole life fell apart. I don't know if that lady was one of my victims, but that story made me feel sick. I know now that was I was doing was just evil."

Earnest question. Other than a sociopath or psychopath, how could an adult human not know from the beginning that their actions are immoral and unethical?

<comment><USER18> Maybe he figured it would be no problem. The credit card company would reverse the fraudulent transactions and issue a new number and the person would be on their way.

<comment><USER19> Anecdote: I help run a gaming community (think public large Rust, Ark, etc. servers); we routinely have players, anywhere from 14-20+ age, try to "help us out" by donating large amounts with stolen cards, hacked PayPal accounts, and the like. Almost always the country is BD/PK/BR/VN/ID/LK. We don't have CIS (RU/UA/...) players, so assume that's excluded from this anecdote.

I'm unsure why, whether it's cultural or socioeconomic or otherwise. They don't see anything wrong in doing it, and when aggressively questioned (because we've banned their game accounts from our servers for fraud) the answer is always "what's wrong I am just trying to help" and "everyone here does this, no one wants to pay $[50+] for [GTAV/other AAAgame/etc], everyone buys hacked or keylogged accounts off secondhand market for $2"; some of them outright just try to offer lists of cards ("dumps?") in exchange for privileges/virtual titles on the forum/etc because they don't want to go through the effort of cashing them out. Of course we're like WTF in response.

If you look on r/gaming or other forums, it's super common to have someone "buy" your hacked account and when you reset it and recover it, you get a barely-comprehensible angry email asking why you stole the account they purchased legitimately and paid $1-2 for.

<comment><USER20> Interesting anecdote.

Some of us may try to claim the moral high ground, but we aren't fully in control - not until much later in life.

If you are a teen and all your friends do this, you'd be a sucker for paying the "full" (read: non-stolen) price. Because they don't fully realize what's involved in getting these 'goods' to them.

From the article:

> "When I was running the service, I didn't really care because I didn't know > my customers and I didn't know much about what they were doing with it," Ngo > said. "But during my case, the federal court received like 13,000 letters > from victims who complained they lost their houses, jobs, or could no longer > afford to buy a home or maintain their financial life because of me. That > made me feel really bad, and I realized I'd been a terrible person."

He may be a psychopath and faking it. But probably not. When harm happens that far away from you, it's easy to brush aside.

I'm from one of the countries in your list - won't specify which so as not to invite flames. Suffice to say that there's a baseline level of corruption that's tolerated, if not encouraged. Tax evasion, pirated software, contraband, you name it. The population is really abused by the government (very high taxes, lots of bureaucracy, terrible public services, corrupt officials) so I guess that's how some people survive. And then it creeps into other areas in their lives via network effects. That's one of the reasons I left.</comment></comment></comment></comment>


Captain Crunch needs your help - <AUTHOR> http://savingcaptaincrunch.com/

<comment><USER2> There's no mention of this on John Draper's personal website or MySpace page. How do we know this message is from John Draper?

<http://www.webcrunchers.com/>

<http://www.myspace.com/jdcrunchman>

(Found webcrunchers via Wikipedia <http://en.wikipedia.org/wiki/John_Draper> and found MySpace via webcrunchers.)

<comment><USER3> There is a Facebook page, but it doesn't look more legit than the savingcaptaincruch website. They might both be fake. <http://www.facebook.com/jdcrunchman?v=wall>

EDIT: On inspection, the stuff from early October and back seems pretty OK. I'm more inclined to believe this now.

<comment><USER4> None of my doctors are online to make comments, nor are they legally able to put anything public about their patients.. I was able to get Doctor Roy Ashcroft to make a statement on my condition but he cannot legally go into details, and if you look on both my Facebook page, and "savingcaptaincrunch" page, is a complete diagnosis on my condition including diagram of my spine, and how this condition is deteriorating the nerves that control my hands...

<comment><USER5> People just want to make sure it is you requesting the money and not a scammer. You just need to convince people that you are you and then HN/reddit will be happy to help. Hope you get well!

</comment></comment></comment></comment><comment><USER6> The US healthcare system never fails to shock and horrify me. I am so thankful for my dual citizenship every time I hear a story like this. Pathetic and sad.

<comment><USER7> I just wanted to post _exactly_ the same.

I imagine that John Draper has some sort of health insurance. So why are those things even an issue? Healthcare is one of those few areas where I think that a government backed approach provides more benefits than a private approach.

<comment><USER8> I wouldn't assume he has health insurance. He's gone through long periods of unemployment.

<comment><USER4> Agreed, not only have a not too long periods of unemployment, I cannot be employed in my current condition, let alone the fact that I'm a convicted felon in the eyes of the credit companies, and databases. I was quoted at $12,000 to fix my records and get them straight. So head hunters who access this database will see that I am falsely stated as a convicted felon. When in actuality during my initial court hearings on my past crimes, it is stipulated that after successfully completing probation, my felon would be expunged. Unfortunately, the databases like Equifax and others, have me mistakenly put down as a felon.

<comment><USER3> Why so much money? It's obviously not in Equifax et al.'s best interests to have incorrect information in their databases. One would think they'd be glad to fix the records, at least for a reasonable fee.

<comment><USER4> I was told that by the time of my inquiry, that I would have to hire a private detective to go in and see information I'm not entitled to along with my personal information that I know to be in there and needs to be corrected. The fees for this at the time is $100 or was. But I don't have any money right now, so it's really a moot point at this point. Excuse the pun!

</comment></comment></comment></comment></comment></comment><comment><USER9> USD 6000 + 2000? I don't want to seem insensitive, but a guy with Crunch's talent should easily be able to make the payments. He could take it across several years if he wanted to.

(Or he should have just gotten medical insurance in the first place, although I've heard some nasty things about private health insurance in America.)

<comment><USER10> He almost certainly does have insurance. A "Co-pay" is the small amount of the medical procedure cost that the insurance company bills to you.

<comment><USER11> The co-pay is the portion the insured pays. It isn't always small. It isn't even always a small percentage. A procedure my wife recently had, the co-pay was about half the total cost.

Co-pays depend the insurance company, the plan, the health care provider, and the procedure.

</comment></comment></comment><comment><USER12> There are barely visible links at the bottom of the page for "Shop the Best Verizon Wireless Deals" and "Thanks to Top CD Rates, Bank Rates and Bad Credit".

Nobody can verify the affiliation with John Draper.

I suspect this is a both a scam and black hat SEO.

<comment><USER13> She is using wordpress, and many wordpress themes have these sponsored links out of the box. These themes are called sponsored themes and have generated quite a bit of controversy in the past.

</comment></comment><comment><USER14> FWIW the 10K number is about right. The average cost of removing spinal hernia in Mayo clinic is 11K as of a year ago, and I expect his case to be similar. That's covering the whole stay, and excluding any follow-up physio.

However the site does look fishy... or if CC in fact can't afford a 10k expense, then things are just plain sad :|

</comment><comment><USER15> Hugged into submission by an overzealous fan?

...

Really?

<comment><USER16> Someone I know suffered a stroke from an overzealous hug. Old people are fragile.

<comment><USER17> No, _people_ are fragile. They can have underlying health problems no matter what their age. Broken bones, recent surgeries etc.

If you're going to go up to someone and grab hold of them you have a responsibility to make sure you won't hurt them. It is my opinion that you should just never do this to someone you don't know.

<comment><USER18> Yup. Last Thursday I watched a co-worker grit his teeth in pain when someone came up and gave him a friendly slap on the shoulder that had just undergone rotator cuff surgery. I personally give big, hearty hugs; but only to people I massage or spar with.

</comment></comment></comment></comment><comment><USER19> The last few times he came up on HN I'm sure there were several accounts of him being accomplished but not a particularly nice person. I have no idea. Can that be balanced out?

<comment><USER20> One friend of mine (very reliable source) told me that he met Crunch once and he was an annoying d-bag. Apparently what happened was my friend, who is a smoker, stepped out discreetly for a cig far away outdoors but Draper saw him anyway and raised a whiny fuss, so much so that my friend wanted to slap him into next month despite the respect he had for his past exploits.

<comment><USER4> excuse me! I'm highly allergic to that of smoke. It is a medical condition I have no control over. When people smoke near me, I get extreme nausea, headaches, and I find it very annoying and repulsive, not to mention it being a very filthy habit. I have every right to complain just like anybody else. You're all entitled to your own opinions about me, that's fine, just don't lie about it.

</comment></comment></comment><comment><USER4> I have been inundated with an amazing response, I know I need to update "webcrunchers.com", My "wiki", and my Facebook page. But due to my lack of being able to type at normal speed, I'm forced to use Mac Speech Dictate, which breaks when I get a skype call, or type with my thumbs. I can use a few more volunteers... "

<comment><USER4> Webcrunchers has been updated.

</comment></comment><comment><USER21> Could they have added any more self promotional links at the bottom?

<comment><USER22> If you are pledging for money the least you should do is introduce yourself.

<comment><USER4> that shouldn't be necessary, if you make a donation I know who you are, which is going to make it very easy for me to return your money if I don't need it.

</comment></comment></comment><comment><USER23> Being such a skilled programmer, one would think he could get a loan for a measly 10k and be able to easily pay it back with the kind of salaries we're paid these days...

<comment><USER24> The demand for 6502 assembly programming isn't what it was.

</comment></comment><comment><USER25> Sent you a few bucks, best of luck with the surgery.

</comment><comment><USER26> Who are the engineers that built the systems he broke into? How is their health these days?</comment>


Designing the SKA Supercomputer Platform - <AUTHOR> https://www.nextplatform.com/2019/05/22/designing-the-ska-supercomputer-platform/ <comment><USER2> The word supercomputer seems quite quaint these days, with USA striking out to build two Exascale computers perhaps a new word would be more appropriate, hyper computer is probably already taken

Is there an ISO standard for reconfigurable superlatives? Or should that be hyperlatives?</comment>