Man Accused of Spoofing Some of the World's Biggest Futures Exchanges - <AUTHOR> http://www.bloomberg.com/news/articles/2015-10-19/before-u-s-called-igor-oystacher-a-spoofer-he-was-known-as-990 <comment><USER2> It's always been unclear to me why the fines in these cases are so laughable. Trader produces several millions of dollars of gains with purportedly bad faith spoofing, fine is $275,000. Of course nobody would stop, the fines are lower than income or even sales tax...

<comment><USER3> I came here to say the same. These people are economics masters; if the incentives are wrong, they'll take full advantage of them.

Make the fine 1.5X the profits, and watch the problem dry up in a flash.

<comment><USER4> The 1.5x the profits issues may not be enough.

A few years back, I read a story about a doctor who ran a scam that would assure the sex of your unborn child for $3000. Now, his treatment literally did nothing and he knew this. Half his patients didn't get the gender they paid for. He'd bring the distraught parents in, immediately hand over a full refund, talk about how the procedure was only 99.95% effective, then offer the parents another $1500 back as sign of his sincere regret.

Basic algebra shows that, despite doing nothing, he could expect to make $750 per patient, despite doing nothing, because the half of the children who had the sex desired by their parents more than paid for the half that didn't.

As you said, these people are masters of economics. If there is less than a 66% chance of being caught, a 1.5x fine means that there's still money to be made.

<comment><USER5> That's actually a well thought-out scam, where can I read more about this doctor? I wonder how he finally got caught.

</comment></comment></comment></comment><comment><USER6> Why write rules based on intent? Seems like it'd be far better to write rules specifying limits on ordering. So if you cancel more than X% of orders, a set suspension or fine gets issued. Write rapidly increasing suspensions or fines.

Or is it that there's just too much legitimate orders meeting this criteria? If so are there no other material criteria to discriminate on?

Edit: It seems there are already limits in place both for absolute frequency as well as trade/order ratios.

<comment><USER7> See [http://www.bloombergview.com/articles/2015-10-08/why-do- high...](http://www.bloombergview.com/articles/2015-10-08/why-do-high- frequency-traders-cancel-so-many-orders-)

<comment><USER6> Yeah and the ratios are already limited by exchanges and the SEC tracks it nicely:

[http://www.sec.gov/marketstructure/datavis/ma_exchange_cance...](http://www.sec.gov/marketstructure/datavis/ma_exchange_canceltotrade.html)

Some exchanges have a far higher ratio. Instead of ~10 (90%) it's ~150 (99.3%). But there's probably a good reason for this.

</comment></comment></comment><comment><USER7> Make sure to see [http://www.bloombergview.com/articles/2015-10-21/regulators-...](http://www.bloombergview.com/articles/2015-10-21/regulators- bring-a-strange-spoofing-case) for some reasons to doubt the charges here.

<comment><USER8> Turns out someone in the comments to that article had a better idea of what was going on:

"He isn't trying to push the price with his big orders so much as get a certain type of participant to join his level whose behavior he can exploit. He's exploiting two things about market-makers. 1. They look at book imbalance to decide where to bid and offer. By balancing out the book or skewing it one way, he incites them to join and can sweep them. 2. Once they trade contracts on one side of the market, their risk management logic creates price impact or is predictable."

[http://www.bloombergview.com/articles/2015-10-21/regulators-...](http://www.bloombergview.com/articles/2015-10-21/regulators- bring-a-strange-spoofing-case#comment-2320996180)

<comment><USER7> That's the government's claim, more or less. The article says that's not evident from the actual trades done: he may have simply changed his mind after the orders didn't get hit. A piece of evidence the article gives for this is that much of the filling of his second order was later, well after algos had a chance to see his cancellation. So there was no need for any spoofing anyway.

</comment></comment></comment><comment><USER9> This was a common strategy among pit traders in the 80's to place orders to entice other traders to follow, while a partner would take a large position in the opposite direction. Paul Tudor Jones was infamous for it and even laughed about it on the documentary, "Trader".

It is ethically questionable, but shouldn't be illegal. You shouldn't be managing money if your strategy is to follow bigger fish.

</comment><comment><USER10> I don't understand why other market participants can't adapt to spoofing.

I agree that fines won't work because it's just another variable influencing the value of the spoofing strategy and if you get extreme about it you're punishing legitimate parties.

Maybe the real problem is the culture of finance. I'm sure this guy isn't all too embarrassed about what happened and there are plenty of people who would love to hire him

</comment><comment><USER11> So, a crook beat the other crooks at their own game. Where's the crime in that.

<comment><USER12> Externalities.

<comment><USER13> Which are what, exactly? As far as I can tell HFTs playing against each other has no net effect on bystanders, other than providing marginally more liquidity.

<comment><USER12> If so, why are we discussing HFT at all then? Isn't the primary reason people bring it up because HFT algos can occasionally deadlock and the effects start to affect the regular markets in a serious (read: dangerous) way?

</comment></comment></comment></comment><comment><USER14> Its sad that day trading attracts these geniuses that could otherwise use their brainpower to solve more important problems in society.

<comment><USER15> Is it also sad that there are a ton of geniuses working at the big 3 solving internet advertising and social media?

<comment><USER16> As Jeff Hammerbacher said[1], "The best minds of my generation are thinking about how to make people click ads. That sucks."

[1][http://www.bloomberg.com/bw/magazine/content/11_17/b42250609...](http://www.bloomberg.com/bw/magazine/content/11_17/b4225060960537.htm)</comment></comment></comment>


Google CEO Eric Schmidt Circa 1986 - <AUTHOR> http://techcrunch.com/2010/02/28/google-ceo-eric-schmidt-circa-1986/

<comment><USER3> I think by the time this photo was taken, he had already re-architected the second and most popular version of lex.

<comment><USER4> Wow - I thought you were joking. I met him once when he was CEO of Novell - <USER2> I had known this then I would have asked him about it rather than the usual polite chit chat.</comment></comment>


Performing IMAP queries via curl - <AUTHOR> http://debian-administration.org/article/726/Performing_IMAP_queries_via_curl <comment><USER2> Since reading about this gist: [https://gist.github.com/cfenollosa/79c22e2ecbb2bdfee15b](https://gist.github.com/cfenollosa/79c22e2ecbb2bdfee15b) yesterday, i've gotten interrested in scripting for imap. Great writeup on getting even more information.

"Bobby Tables" got a little laugh from me.</comment>


Building Your Dreams In Chile - <AUTHOR> http://www.shaharnechmad.com/2011/02/19/building-your-dreams-in-chile/

<comment><USER2> The last two points are contradicting. One says that there is a lack of developers (especially compared to the Bay area) and the next says there is an abundance of developer talent, and that it would be much easier to find developers in Chile than in the US.

So which is it?

<comment><USER3> The last point says there are plenty of developers. The second-to-last says there isn't a vibrant developer/entrepreneur community and it's hard to make connections. Those are different things. You can have lots of individual developers who don't communicate with each other much.

</comment></comment><comment><USER4> Anyone with experience with the application process?

<comment><USER5> Hi. I'll be happy to try and help as I went through it.

<comment><USER6> Hi Nechmads, I'm an Indian entrepreneur and planning to apply. I might need your help, can you please send me your contact details at <http://contact.pratikrokade.com> thanks.</comment></comment></comment>


Show HN: Noticeable – Build a product changelog in seconds - <AUTHOR> https://noticeable.io?ref=hackernews <comment><USER2> I love the design.

<comment><AUTHOR> Thanks! Glad that you like our pages. What about the service?</comment></comment>


Android libstagefright still exploitable - <AUTHOR> http://blog.exodusintel.com/2015/08/13/stagefright-mission-accomplished/ <comment><USER2> Any competent malware developer must have already figured out how to exploit this the first time around. Now that every single one of those malware developers has learned it is still exploitable, the payload they've spent the past month perfecting can now be deployed in the wild.

So, can someone explain why a disastrous worm hasn't already swept the globe and infected 99% of Android devices on the planet within ten minutes of being released in the wild?

1\. Text payload to victim

2\. Payload executes on victim's phone and texts itself to all of the victim's contacts

3\. Repeat

Assuming the average Android phone owner has 20 contacts who also have Android phones, and assuming also that texting the payload to those 20 people would take two minutes to complete, the infection would spread exponentially and only take ten minutes for the initial text to result in the infection of 10 billion devices worldwide.

Why am I not currently being bombarded with MMS video texts from infected devices? It frankly seems a bit miraculous. Did Google set up an emergency arrangement with all of the carriers to block suspicious video texts so this wouldn't happen?

<comment><USER3> It's not often that Android's fragmentation is touted as a benefit, but the fact that Android isn't a monoculture is certainly one of the hurdles to developing a worm capable of mass deployment. Supposedly the varying implementations of the Android media services mean a libstragefright exploit may or may not end up with root access.

Now, if this were an iOS zero-day exploit...

[Actually, it'd be trivial for the carriers to filter the payload, so I don't reckon SMS/MMS is ever going to be a viable transmission vector.]

<comment><USER4> do carriers already have a mechanic in place to trigger precautions a message matching worm-like patterns (similarity, mass transmission)? or would they have to implement one after it's too late?

<comment><USER5> I'm afraid carrier don't care enough to do that. I hope I'm wrong.

</comment></comment></comment></comment><comment><USER6> Summary: A little over two weeks ago, it was publicly disclosed that MMS messages can cause Android phones to decode video with libstagefright, which is a C++ library with vulnerabilities and insufficient sandboxing, leading to remote code execution without user interaction. Today, Exodus Intelligence is reporting that the patch to fix one of these vulnerabilities does not, in fact, fix it. Thus, all Android phones are still vulnerable.

You can partially mitigate the risk by disabling auto-downloading of MMS messages in whichever app you have set to handle text messages, such as Messaging or Hangouts. If you have not done so already, this is urgent. Furthermore, you should assume that auto-downloading of MMS messages will not ever be safe, no matter how many individual security fixes are applied, until this component of Android is significantly re-architected.

<comment><USER7> I'm still unclear on the sandboxing assertion. The mediaserver in current versions is, in fact, pretty well isolated. I've had to work around and defeat lots of this protection for debugging purposes in my professional life, so I know it's there. IIRC you can't read system or app data outside the sdcard area, you can't write anywhere persistent. You can open network sockets and make binder requests, which is not trivial but again rather different from a remote root.

That this is an exploitable bug in libstagefright seems to be uncontested. But AFAICT there are no assertions of an actual sandbox breakout or a practical payload that does something more than e.g. send spam. Are there? Link?

<comment><USER8> The isolation seems mostly defined by this SELinux policy: [https://github.com/android/platform_system_core/blob/lollipo...](https://github.com/android/platform_system_core/blob/lollipop- mr1-release/rootdir/init.rc#L564)

       service media /system/bin/mediaserver
           class main
           user media
           group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc mediadrm
           ioprio rt 4

You'd need another exploit to elevate from SELinux (and I think send MSSes for a self-propagating worm). Though given Android's abysmal patching, most Android kernels are also terribly outdated...

<comment> vezzy-fnord That's not an SELinux policy? That's just a service statement for Android's init, defining the process' supplementary groups. There is no explicit seclabel I can deduce.

<comment><USER8> Whoops, yep -- definitely wasn't that clear. As pointed out below, the policy is linked to: [https://android.googlesource.com/platform/external/sepolicy/...](https://android.googlesource.com/platform/external/sepolicy/+/master/mediaserver.te)

</comment></comment></comment></comment></comment><comment><USER9> Is this timeline correct?

April 2015 - Original stagefright exposed

July 31st - Author noticed patch was not sufficient but could not test (did not notify google)

August 6th - Patch released

August 7th - Author notified google that patch was not adequate

August 13th - Author went public?!?!

They are counting the original date of exploitation as the start date for notification. I would think a more responsible and friendly date would be August 7th. Just me.

<comment><USER10> I sympathise with your point, but one complicating factor is that when big security vulnerabilities like Stagefright are found a lot of people then turn their attention to that code. Either finding other issues in the same code, or that the patch isn't fully effective. It was similar with Shellshock, where there was a series of patches as more issues were found because suddenly people were looking at this bit of code that had previously been uninteresting.

I'm not sure keeping it secret for long serves much purpose in this kind of situation; the eye of Sauron is already gazing on the code in question. I doubt these people were the only ones to notice that the patch didn't completely fix the problem.

<comment><USER9> That's fair.

Perhaps I am more alarmed by the assertion of the author that they had given 100+ days notice... it came off like they talking about the patch and not the original issue.

</comment></comment></comment><comment><USER11> Even if Google patches this, there's an incredible delay in getting the patch to users. Android in fundamentally flawed in this respect.

[http://www.extremetech.com/mobile/197346-google-throws- nearl...](http://www.extremetech.com/mobile/197346-google-throws-nearly-a- billion-android-users-under-the-bus-refuses-to-patch-os-vulnerability)

<comment><USER12> > Even if Google patches this, there's an incredible delay in getting the > patch to users.

I don't think delay is the problem - not being able to get or apply the patch yourself is the problem. Ignoring the somewhat ridiculous requirements to compile Android (200GB of HD space and 16GB of RAM [1]) - you couldn't put it on your Android device due to proprietary drivers for wireless and/or video.

Assuming you can get an updated version - I have noticed that after getting root on my Nexus 6 it won't install new versions of Android. I don't know if it's a by-product of getting root/installing a new recovery or if they have an actual check. I have a legitimate reason for root because I use FreeOTP and it does not have an export feature - so I use Titanium backup to backup and restore the app. Getting the OTP QR codes for: dropbox, gmail, Microsoft account, facebook, srchub, github, paypal etc would take a very long time and considerable effort to recover (hint gitlab).

[1] [https://source.android.com/source/building.html](https://source.android.com/source/building.html)

<comment><USER13> It's a check - as of Android 5.0, Google's OTA updater scripts refuse to overwrite your /system partition if its checksum isn't on the known-good list. Rooting inevitably involves writing files to it, so OTA updates will stop working with an uninformative "Error!" in recovery. Whoever came up with the idea should be fired, but that's Google for you.

See [1] for details from the author of NRT [2], which can update your phone from factory images without wiping it. The procedure is a bit more involved if you're not on Windows - IIRC, you have to download the correct archive from [3] and modify the update script so it doesn't try to flash userdata.

[1] [http://www.wugfresh.com/faqs/can-i-still-take-an-ota- after-i...](http://www.wugfresh.com/faqs/can-i-still-take-an-ota-after-i- unlock-and-root/) [2] [http://www.wugfresh.com/nrt/](http://www.wugfresh.com/nrt/) [3] [https://developers.google.com/android/nexus/images](https://developers.google.com/android/nexus/images)

<comment><USER14> > Whoever came up with the idea should be fired, but that's Google for you.

To be fair to Google, once you've modified your /system partition, it's really case-by-case how an update will interact with it. The alternative is Google push an update that inadvertently bricks a bunch of rooted phones. Can you imagine the kneejerk reaction from the internet then?

<comment><USER12> > The alternative is Google push an update that inadvertently bricks a bunch > of rooted phones. Can you imagine the kneejerk reaction from the internet > then?

That already happens [1] on non-modified devices. So just come up with a "yes I know what I'm doing and accept that this may bork my phone". Or and even better idea - how about the ability to turn off OTA updates? Right now my phone says there is an update but I can't apply it due to being rooted.

[1] [http://www.techtimes.com/articles/51525/20150508/nexus-9-and...](http://www.techtimes.com/articles/51525/20150508/nexus-9-android-5-0-2-update- bootloop-problem-heres-what-to-do.htm)

</comment></comment></comment></comment></comment><comment><USER15> Did I read that right? They reported the bug to Google on August 7th and disclosed it publicly on August 13th?

Is this still responsible disclosure if they give Google basically 6 days to respond and use the original notification date as justification? I'm not learned enough in the practice of responsible disclosure to know if this is common, but I've not seen that before.

<comment><USER16> Eh, fuck google. They still haven't patched the original stagefright for android 4.4.4 on my nexus 5, and I don't want to upgrade to android 5, which I shouldn't be required to do to get security releases.

<comment><USER17> _I shouldn 't be required to do to get security releases._

Why should you not be required to do that?

<comment><USER18> Because withholding security updates over accepting horrifically invasive UI and branding changes is unacceptable.

Similar to Microsoft still patching Vista nearly ten years later, Google should be obligated to deliver security patches to all versions of Android within a reasonable timeframe.

<comment><USER19> I think it's more difficult to patch old versions of Android than you're suggesting. You can't just backport a few lines of code and hope for the best. You have to maintain all the testing infrastructure that you had in place back when that version was supported, to avoid introducing new bugs with your change. And if you're releasing a security fix, you now have to coordinate that release across all versions that were vulnerable, because patching the vulnerability in one version usually discloses it in all versions. So you've slowed down fixes for your most up-to-date version, on top of the added expense of all that testing.

Companies like Microsoft make boatloads of money in exchange for supporting old versions of their software like that. But nobody is going to pay Google enough to support old Android phones.

<comment><USER16> it's already disclosed, don't pretend like patching 4.4.4 discloses anything

</comment></comment></comment></comment></comment></comment><comment><USER20> Doesn't seem very responsible behavior by the reporter. Google accepted the suggested patches, fixed the original cases. Now some other cases are discovered for these larger numbers, OK, that seems like a new thing to fix next. Not sure why I have to read paragraphs of hate when the company put the suggested patches in already. Seems like just an excuse so they can ride the page view wave.

<comment><USER21> This doesn't seem hateful to me, and the problem is that google took so long to fix anything at all on top of barely caring about the fix. Why not fuzz the fixed version for 10 seconds?

</comment></comment><comment><USER22> And I was wondering at the beginning of the article why they were doing

        if (SIZE_MAX - chunk_size <= size)

and not the more readable

        if (size + chunk_size >= SIZE_MAX)

Of course, C integer overflow. The real WTF is that this is possible in C.

What would be more sensible than integer overflow would be to automatically promote integers to a larger type in the context of a comparison, so that they don't overflow. I wonder if you could add that to the language in a backwards- compatible way? Maybe add a new builtin (compiler-specific, but shared by popular implementations?) like

        if __no_overflow(x + y > z)

that would make the addition of two ints become long, two shorts become int32, and so on. (Two long longs would internally become BigNums, but that wouldn't be exposed.)

And while we're at it, add a __checked(a+b) construct, that sets a flag if overflow occurs (or maybe raises an assertion - or maybe we should have both options).

<comment><USER23> You seem to be asking for quite some magic in that __no_overflow idea. It might be possible with a trivial expression like this, but what if there are function calls in that expression, or even library calls? There are lots of places overflow could happen, and the site of your __no_overflow may not have code-gen control over it at all.

As for __checked, gcc has some builtins like this: [https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow- Builtins...](https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow- Builtins.html)

<comment><USER22> Well, it wouldn't reach into functions. It would mainly just change the + and - operators within its scope to return a larger type. So instead of

        int32_t plus(int32_t left, int32_t right);

the plus operator would be equivalent to

        int64_t plus(int32_t left, int32_t right);

So basically

        int32_t a = 2000000000;
        int32_t b = 2000000000;
        int64_t c = __no_overflow(a+b);
        // now c is 4000000000;

I don't claim the idea to be flawless or completely thought out, but I believe something like that could be one of the more useful C language extensions.

Oh, and thanks for the link!

</comment></comment></comment><comment><USER24> Just to give everyone a bit of calm, nobody's demonstrated a successful exploit with ASLR bypass.

Meaning that while the vulnerable is technically exploitable, the chance of system compromise is very low on modern android phones (I think post 4.0)

<comment><USER25> Per the wikipedia article[0] ASLR (address space layout randomization) was first added in 4.0 and fully enabled across the OS in 4.1. To go with that, 91% of android phones are on >= 4.1, and 95% are on >= 4.0 [1].

[0] [https://en.wikipedia.org/wiki/Stagefright_(bug)](https://en.wikipedia.org/wiki/Stagefright_\(bug\))

[1] [https://developer.android.com/about/dashboards/index.html](https://developer.android.com/about/dashboards/index.html)

</comment></comment><comment><USER10> >Deadline exceeded – automatically derestricting >The flaw was initially reported over 120 days ago to Google, which exceeds even their own 90-day disclosure deadline.

It always seemed likely that Google's hubris[1] would come back to haunt them. I guess this is that day.

It would be funny if it wasn't remote code execution affecting 950 million phones, with no official patch in sight.

[1] [https://news.ycombinator.com/item?id=8896221](https://news.ycombinator.com/item?id=8896221)

<comment><USER26> Wait, either I'm grossly misunderstanding the article, or you are. The flaw the author is talking about is one that Google has been aware of for six days... Not 120. The original bug from 120 days ago was already patched.

We're essentially talking about a bug in the bugfix, which obviously hasn't existed as long as the original bug itself. I'm really not seeing where "hubris" comes into this.

<comment><USER10> That's the logic the blog author is using. As you can see in the bit of the article I quoted. I didn't say I necessarily agree with their analysis of this still being the same bug.

The fact that they mentioned it a couple of times suggests it was a factor in their decision to release the details today (or at least wanted to poke fun at Google).

</comment></comment></comment><comment><USER27> Why are arithmetic overflows and underflows not exceptions/crashes by default, like divison by 0?

Aren't the cases where you actually _want_ an over/underflow the exception? Why not resort to special instructions/macros/operators for these operations?

<comment><USER28> Performance. That's an extra branch on every arithmetic operation.

<comment><USER29> There's a performance cost now because processor instruction sets have dropped hardware overflow detection due to disuse. Current processors are largely engineered to just run legacy C code fast. See eg. [https://news.ycombinator.com/item?id=7847980](https://news.ycombinator.com/item?id=7847980)

<comment><USER30> No, overflow is still properly detected by common CPU instructions. There are flags that are set on overflow after the addition and subtraction and they can be tested.

It's only hard to test the flags in "standard" C (I don't know if it's better with newer standards or those in progress) but the CPUs do their work on the hardware level.

<comment><USER29> But like ploxiln said you now need a conditional branch to test for the overflow flag after the arithemetic operation, unlike the old overflow traps on x86/MIPS/Alpha etc.

<comment><USER30> I'm not aware that integer operations ever made traps on x86 and nobody actually uses floats for allocation sizes (in C). And checking the flag would be more than enough IF the languages supported it.

It's the languages that should be changed to be able to simply check the overflow after the critical operations, not the CPUs. The overflow checks are needed only where something can "go wrong" not everywhere.

</comment></comment></comment></comment></comment></comment><comment><USER31> This is a common problem in C. Integer types are inherently type unsafe and are silently promoted with many different rules which are hard to remember and understand. As is seen in this case, even the ( borderline paranoid ) flag -Wconversion would not catch the bug.

I think this problem in C would be solved with a single flag: -Wwarn-if-using- integers-of-different-types-in-an-operation , forcing you to cast the integer if the types don't match in a arithmetic operation, or an assignment.

<comment><USER21> I can understand the comparison passing, but why in the world does nothing warn about the truncation inside the new operator?

<comment><USER31> Because no truncation happens. In this case [] operator doesn't specify any type, only that the expression inside is an integer expression. While normally the type size_t is used for object and array sizes, [] takes any integer expression and the compiler won't complain.

<comment><USER21> I'm talking about this line

      uint8_t *buffer = new (std::nothrow) uint8_t[size + chunk_size];

size + chunk_size is clearly unsafe to truncate to 32 bits, but it truncates anyway. When I say 'inside the new operator' I'm including the allocation function. _Something_ truncates it. If it actually allocated 8GB, or failed to allocate 8GB, there would be no exploit.

<comment><USER31> I was talking about the same line.

Apparently new is a "special" operator, or there is a bug in the compiler. I also can't get a warning with g++.

The problem seems to be that, as I said, [] takes any integer expression, it is there where the value gets truncated when operator sizeof or new is applied on it since they either return or take a size_t value.

</comment></comment></comment></comment></comment><comment><USER32> The bigger issue of libstagefright is that it there's a ton of code involved with media playback at the native level that has access to many system resources. This specific exploit was just looking at a small part of the MP4 handling -- one of the many parts within the library. It is very likely more severe exploits like this one will surface as a result of this huge library.

<comment><USER33> It's a bit surprising because so much of Android is written in Java. Given hardware decoding of the video itself I wonder why Stagefright needs to be written in C++ at all. Media processing code has been notorious for being exploit ridden for years, so it's not like this problem was unpredictable.

</comment></comment><comment><USER34> Can carriers (and by extension, the Hangouts backend itself) check messages and block "evil" ones? Wouldn't that be an easier way of fixing these things quickly?

At the very least, Google should block any Hangouts message that triggers the bug even on non-updated devices.

</comment><comment><USER35> I think the proper check is:

// size_t size; // uint64_t chunk_size;

if (chunk_size >= SIZE_MAX - size) { return ERROR_MALFORMED; }

Due to size being a size_t and SIZE_MAX being well a maximum size_t, SIZE_MAX- size is properly calculated. The comparison with chunk_size is also properly done (due to the C promotion rules - as strange as they are, they do work "as expected" when your values are nonnegative, which they are here).

Also, I am slightly puzzled why one would use SIZE_MAX as a limit rather than some "small" number, like a few megabytes or whatever is a reasonable bound for this buffer. In this case the fix may be a bit more complex than this: if (chunk_size >= SIZE_MAX - size || size + chunk_size > the_limit) .

</comment><comment><USER36> There was an Android update pushed to my phone recently. I wanted to know if it was an urgent security fix so I checked the diffs. It's hard to tell but it doesn't seem to be. It's a bunch of fixes to do with video out, SIP etc.

I thought maybe the patch fixed this security flaw. It wasn't clear what it was for from the phone. I had to do a fair bit of digging. Are there any change-logs or release notes for these system updates?

</comment><comment><USER37> IMO, the Android echosystem is a clusterfuck and Google needs to get a hold of it. I would buy a Windows phone before I would buy an Android device.

<comment><USER38> > IMO, the Android echosystem is a clusterfuck and Google needs to get a hold > of it. I would buy a Windows phone before I would buy an Android device.

This is nowhere near as bad as the situation with Windows XP 10 years ago.

The difference is that Android has the majority marketshare worldwide and Windows phone does not, making Android the more attractive target both for researchers and malicious actors.

Security by obscurity is not _entirely_ without value, but it's not particularly strong as a defense either.

<comment><USER37> I think it is worst. As least with XP, you didn't have Dell preventing you from getting a security update.

</comment></comment></comment><comment><USER39> [http://www.cyanogenmod.org/blog/more- stagefright](http://www.cyanogenmod.org/blog/more-stagefright)

Looks like Cyanogenmod has patched this toot-sweet.

</comment><comment><USER40> So, a security engineer, working at Google, cannot catch that a 4 lines patch is ineffective?

</comment><comment><USER41> Things like this is why I trust an iPhone enough to handle two-factor auth for banking (in Sweden: "Mobil BankId"), but not an Android device.

I hope Google will raise the security level now that they have reached global dominance, in no small part through lax security (as a consequence to their liberal licensing models).

<comment><USER42> How do you think jailbreaking is accomplished?

<comment><USER41> Not via the appstore.</comment></comment></comment>


Bill Gates Says This 1 Employee Perk Is Most Important - <AUTHOR> https://www.inc.com/bill-murphy-jr/bill-gates-says-this-1-employee-perk-is-most-important-now-a-new-harvard-study-backs-him-up.html <comment><USER2> The funny thing is that this is how I've run all of my companies over the last 30 years or so. I pay salary, not hourly, so there's no need to track hours. Unless the position intrinsically requires certain hours (such as if the position deals with the public), there's no need to require people to work specified hours. Everyone has space in the office, but unless we're having a face-to-face meeting, there's no need to require people to use it.

What I do instead is have mileposts. If the expected work is done, with acceptable quality, in time for the milepost, then it doesn't matter to me when you worked on it, how long you worked on it, or where you worked on it.

It just seems logical and fair to me. It's not without downsides (what is?), but it's always worked well for me, and most (but not all) of my employees have considered it a very positive policy.

</comment><comment><USER3> employee perk = flexible work arrangements

Everything from this author seems to be linkbait [https://www.inc.com/author/bill-murphy-jr](https://www.inc.com/author/bill- murphy-jr)</comment>


How exactly does React handle events? - <AUTHOR> https://levelup.gitconnected.com/how-exactly-does-react-handles-events-71e8b5e359f2 <comment><USER2> Great explanation. React events are something I've never fully understood. Incredible how they've abstracted it be handled the same way for all clients.</comment>


Python Tuple Syntax Is Confusing - <AUTHOR> http://dino.codes/posts/python-tuple-syntax-is-confusing/ <comment><USER2> The tuple notation is one of those places where the obvious way is a distraction. A non-empty tuple doesn't need the ()s - it's the "," which makes the tuple! The following two are equivalent:

      x = 1,
      x = (1,)

so are the following three:

      y = 1, 2, 3
      y = 1, 2, 3,
      y = (1, 2, 3)

Of course, then there's no way to express the empty tuple using commas, which is where () comes in.

<comment><AUTHOR> Thanks for reminding me tuples can be instantiated without the use of parenthesis, that's something I usually forget about.

I'm much more used to only using commas when extracting values from a tuple, for example:

        a, b, c = (1, 2, 3)

I think maybe the only "issue" with the syntax where no parenthesis is used is that, as obvious as it may seem, you can't use it when passing parameters to function. For example:

        # Will work
        function(parameter, (1,2,3))

        # Won't work
        function(parameter, 1, 2, 3)

Not really an issue but just nice to know that it doesn't work on every scenario.

Anyway, nice to be reminded of other options :)

<comment><USER2> Tuples and generator comprehensions also don't mix well:

      >>> (x, x*2 for x in "qwe")
        File "<stdin>", line 1
          (x, x*2 for x in "qwe")
                  ^
      SyntaxError: invalid syntax

      >>> ((x, x*2) for x in "qwe")
      <generator object <genexpr> at 0x107821350></comment></comment></comment>


Show HN: Booz Club – Real-Time alcohol inventories of local ma and pa stores - <AUTHOR> http://www.booz.club/ <comment><USER2> Really cool idea.

Would you care to describe how this works? Where is your data coming from? How do calls work and what kind of response do you get?

<comment><USER3> Yes please explain. you're not literally making phone calls are you!?</comment></comment>


Centralized video conference WebRTC server available for testing - <AUTHOR> https://alioth-lists.debian.net/pipermail/babel-users/2020-May/003730.html <comment><USER2> Looks like this is a very basic sfu written in go. Not really "open source", even though the source code is available. Header in source files reads...

        // This is not open source software.  Copy it, and I'll break into your
        // house and tell your three year-old that Santa doesn't exist.

<comment><USER3> The OT link mentions that:

      The code is available, and will be licensed under a Free license when I'm ready.

So he may or may not relicense it to a free license...

</comment></comment><comment><USER4> Pardon my ignorance but would this work with an xmpp server?</comment>


A tiny toy compiler proven correct in Idris - <AUTHOR> https://github.com/mbrodersen/idris-sandbox/blob/master/compile-to-stack-machine.idr <comment><USER2> I would love to read an explanatory article/blog/essay/whatever because the idea sounds more interesting than what I can translate from the language in which the code is written.</comment>


Google Receives 12,000 Requests To Be Forgotten From Europeans On Day One - <AUTHOR> http://techcrunch.com/2014/05/31/google-receives-12000-requests-to-be-forgotten-from-europeans-on-day-one/

<comment><USER2>
      For us to evaluate your request, you must:
      (a) Provide the URL for each link appearing in a Google search for your name that you request to be removed. (The URL can be taken from your browser bar after clicking on the search result in question).
      (b) Explain, if not clear, why the linked page is about you (or, if you are submitting this form on behalf of someone else, the person named above).
      (c) Explain how this URL in search results is irrelevant, outdated, or otherwise inappropriate

      If your request concerns more than one URL, please provide an explanation for each URL. *

They don't make it exactly easy, do they? Also this seems to indicate they really have to check every single request and each link in it. Could be a fulltime job.

<comment> chestnut-tree _" They don't make it exactly easy, do they?"_

The steps seem clear to me. I can't think of another way they could do this. They're asking for all the information needed to make an initial assesment. The onus is on the submitter to make the claim and provide the evidence.

I can imagine in most cases, Google will require follow-up documents or further evdence to prove that you are no longer associated with event X, Y or Z. All of this will make the process even lengthier.

What I'd like to know is if this ruling applies only to Google or to other search engines too? The action was bought againt Google, but the European Court of Justice uses the generic wording "operator of a search engine" in it's press relase about the ruling. Presumably this means any local or international search engine that operates with offices in that country must also provide a link removal assesment service. Does the search engine have to remove results from their entire index or just the results served to users of a particular country (where the claim was filed)? And are search engines under any obligation to publish the results of successful requests to remove links?

This ruling feels unworkable and throws up so many complications.

<comment><USER3> It applies to any search engine with a European presence. I don't know if that means data and servers or just offices.

It doesn't cover non-local data. Thus, I can have results removed from google.co.uk but google can leave those results in for google.com

I am interested in how Google will handle cultural differences. The UK has a lot of publicity about politicians who have extra-marital affairs. France doesn't appear to care whether their politicians have affairs. So, is that information relevant or not?

</comment></comment></comment><comment><USER4> So we just change passive to active in the following and adjust to required level of truth: ([https://www.youtube.com/watch?v=KiIP_KDQmXs](https://www.youtube.com/watch?v=KiIP_KDQmXs) "I did not have sexual relations with that woman")

"People simply disappeared, always during the night. Your name was removed from the registers, every record of everything you had ever done was wiped out, your one-time existence was denied and then forgotten. You were abolished, annihilated: vaporized was the usual word."

Orwell's 1984</comment>


Russian Hackers Publish Passwords to Nearly 5M Email Accounts - <AUTHOR> http://www.businessinsider.in/Russian-Hackers-Publish-Passwords-To-Nearly-5-Million-Email-Accounts/articleshow/42189899.cms

<comment><USER2> WARNING: This is probably fake and a scam. If you ctrl + f you are giving away your account name to the site which can be done with some simple javascript.

There was a talk about that a while back. And the username can then be used for a bruteforce attack. News companies need to stop being so dumb and reporting on these fake hacks.</comment>


What I've Learned About Venture Funding - <AUTHOR> http://www.bothsidesofthetable.com/2015/08/20/what-ive-learned-about-venture-funding/ <comment><USER2> The best quote: _" Our market is simply back-logged with companies that will never go public any time soon, that are far too expensive for most buyers to take out and who feel very good on paper but have painted themselves into a corner."_

You reach a point, and then its make it or die, no other check-ups, no other funding rounds. Once you can't be acqui-hired you have set the clock, make a profit or die, there is no other way out. If you're in that situation and you don't yet know what the product is, its a very stressful time.

<comment><USER3> Yet there's some _really_ oddball funding stories out there, I'd love an interpretation of this:

[https://www.crunchbase.com/organization/palantir- technologie...](https://www.crunchbase.com/organization/palantir-technologies)

<comment><USER2> Palintir promised the government they could provide information awareness from unstructured sources. That is like telling one of the knights of the round table you know where the Grail is.

<comment><USER3> So does 3 rounds of private equity "investment" mean they're now a private company?

<comment><USER4> All companies except for public companies are private companies. Or is this a trick question?</comment></comment></comment></comment></comment>


Gender equality influences how people choose their lovers - <AUTHOR> http://www.york.ac.uk/news-and-events/news/2012/research/gender-equality-lovers/ <comment><USER2> _The researchers had 3,177 respondents complete an online mate preference survey_

I suspect this is an area where revealed preferences are very different from stated preferences.</comment>


Ransomware virus that uses 1024-bit encryption key - <AUTHOR> http://www.intology.com/computers-internet/ransomware-virus-that-uses-1024-bit-encryption-key/ <comment><USER2> Although virus designers are the creeping crud in the moral bucket, they come up with some uniquely creative ways to piss people off.

This model is particularly good. The pain of losing your important work is almost greater than the pain of paying off the hostage company.

Again, good reason to back up your stuff (especially offsite!), but until it bites you, people won't do it. Eventually, OSes need to do backups by default. The bandwidth, connectivity and cheap drive space make this a no brainer.

<comment><AUTHOR> What I wanna know is how they collect payments. Virtually any form of payment is traceable today and if you can pay with a CC, you can complain to your CC company about fraud and get your money back. I did hear that some scammer use "gold payment systems" but never looked into those payment systems myself.

<comment><USER3> Perhaps the scammer waits until the money is free and clear -- transferring to a different card, spending it, etc. Other options: the scammer might just use the email to arrange a physical cash transfer.

</comment></comment></comment><comment><USER4> Is it really a bigger feat to encrypt with a 1024-bits encryption key than a 660-bits one? If not I don't understand why they didn't do 1024 in the first place. Or even why not use a 2048-bits one...

Given the situation the scammer probably doesn't care about performance, so might as well mitigate any attempts at decryption.

<comment><USER5> They _do_ care about performance. If the victim could figure out what was happening before their files were completely "ransacked", they could simply shut off their computer and take it to the shop to extract however much of their data wasn't yet encrypted. If the value of what was encrypted so far was less than the ransom, why pay?

Also, another aspect you have to consider: strong encryption algorithms usually have large implementations, which means large viruses. Virus transmission rates are logarithmically proportional to their size (a virus that can get sent from one computer to N others in half the time spreads twice as fast each generation, and therefore exponentially (2^t) faster over time.)</comment></comment>


Bogus story: no Chinese backdoor in military chip - <AUTHOR> http://erratasec.blogspot.com/2012/05/bogus-story-no-chinese-backdoor-in.html <comment><USER2> "While they did find a backdoor in a popular FPGA chip, there is no evidence the Chinese put it there, or even that it was intentionally malicious."

Nor did the original article specifically allege that it was "the Chinese", or that the backdoor was malicious. It did allege that it was inserted by the manufacturer (although technically anything on the chip is inserted by the manufacturer), presumably because it differed from a public spec, but the veracity of that statement is still unknown (at least to us). But I don't think that that's enough to call it "bogus".

<comment><USER3> Agree; I feel like I've misjudged the story here, because apparently the idea that silicon is as riddled with backdoors as software is _isn't_ a big deal; just, "is China cyberwaring us".

The technology behind this story is serious and interesting, and all anyone wants to talk about is politics.

<comment><USER4> > _The technology behind this story is serious and interesting_

Which is why, at the end of this article, I suddenly went "what?!" when I read:

"And researchers will not probably hunt for similar JTAG backdoors in other chips."

If there's one good thing to come of all this fearmongering, it is that chips will be subjected to more scrutiny. Hopefully someday chips are much more open, standardized, and well documented. That's a long way off, but there are many reasons to hope it might happen.

I don't know, maybe I read that sentence wrong. Maybe the author meant, "researchers will, not probably, but for sure hunt for backdoors."

<comment><USER5> I read that as a typo, i.e. "not" -> "now"?

</comment></comment></comment></comment><comment><USER6> As always, logical reasoning arrives just a tad too late to the party. The original story has already circulated the web and stirred anger and mistrust in a sufficient amount of people who will never read this common sense follow- up. Chalk up one more win for sensationalism and fear-mongering.

<comment><USER7> The reason corrections to sensational stories never make it as far as the original is because the people who propagated the first story have to admit they were fooled, or at least misinformed. I'm about to share this correction to my own link feeds -- but I'll be honest, I'm not enthusiastic about looking dumb.

<comment><USER8> You can cover for it by raging against the people who misinformed you.

</comment></comment></comment><comment><USER9> This _is_ a military chip. It's used in military applications. I'm not saying that the original article didn't use this to sensationalise 'We JTAG-fuzzed a chip and found an AES key', but to deny that the chip is used in the military is inaccurate.

Good call on the Chinese front, we don't know who generated the key material to block the JTAG.

Incidentally on z/OS systems things that open the system up to external access are sometimes referred to as backdoors, which is what this is. It's a way of accessing the chip, nothing more.

<comment><USER10> The ProAsic3 is a commercial FPGA. So no, it's not military. The military may use it, but that doesn't change that it is a commercial part built to commercial specifications.

To call it a military chip is inaccurate.

<comment><USER8> It's ambiguous, not inaccurate. If the military used a certain COTS revolver as standard equipment, and the revolver had a eye-first camera with cellular upload to the public Internet, and that feature was not approved and known by the gun selection people, it is fair to say that "military revolvers upload battlefield images to the Internet, a serious security breach.

<comment><USER11> It's false, implies everything the military uses is military grade. By that reasoning I'm having military-grade coffe this morning. The keyword you need is "defense-grade". Most fpga vendors sells "defense-grade" FPGAs, for example the Xilinx Virtex 6Q and Spartan 6Q (the 'Q' means defense-grade) a very different product line.

<comment><USER9> There's a difference between grade and use. Grade implies a certain standard of assurance for a specific market or environment. Use just means it's used by someone, or a group (in this case security).

Heck, people could (if they're nuts) call 44Con a military conference given that it's attended by various armed forces folk. I'd rather people didn't though, but if they want to look stupid while thinking they look smart, who am I to stop them?

</comment></comment></comment></comment></comment><comment><USER11> The original article was censored so it's hard to tell if it's bogus or not. I believe it's still very interesting. Here <http://bit.ly/JKatpV> it's an older paper from the same author detailing a technique about reading thermal signatures from individual transistors on the chip with a microscope and an astronomy camera. A little more advanced than jtag fuzzing. However I agree that's very hard to insert a hardware backdoor on a mask, even a FPGA mask. Given the hundreds of variations and revisions that FPGAs normally have, it's about impossible to cover even a single familiy. A more plausible explanation is: some big client got very angry in the past because they lost the password and the FPGA vendor didn't had a "master key" to unlock it. Still, very stupid move.

</comment><comment><USER12> Are the critics basing their objections on the rough, generalist abstract for this paper or the paper itself?

<http://www.cl.cam.ac.uk/~sps32/Silicon_scan_draft.pdf>

</comment><comment><USER13> The bigger issue here is if such a back door/debug mode was accidentally/intentionally left in any of the Actel FPGAs that use their anti- fuse technology. At present, anti-fuse seems to be the most robust technology for preventing read-out of configuration bit-stream as there is no serial data being pushed around each time the logic resets. ProASIC3 is a great platform for when you are on a very constrained power budget, however, I would not consider it one of their leading security-hardened chips. There is a lot of design reuse in complex semiconductor products so it is possible that this portion of the design was leaked to other devices.

</comment><comment><USER14> This is some sensible response to the evil Chinese hype.

As Feynman put it, when a researcher over blow his findings, he's doing "Cargo Cult Science" (See the ending chapter of "Surely, you're joking, MR. Feynman").

<comment><USER8> I thought cargo cult science was (mis)copying techniques without understanding how they work. The original example was building a fake airport / ATC at an abandoned military base and hoping cargo planes would land there.

</comment></comment><comment><USER15> For the record - Original discussion on HN: <http://news.ycombinator.org/item?id=4030746>

</comment><comment><USER16> Whoever wrote that article is a little sketchy with his facts:

Quote: """One of the most common building-blocks is the debugger, known as JTAG. This is a standard way of soldering some wires to the chip and connecting to the USB port,"""

JTAG is just the low-level interface to a debugger. "Soldering some wires" is not the building block and USB is nowhere related to it (for example, my work- horse JTAG interface connects to Ethernet).

Quote: """Whereas companies (should) disable the debug feature in the version they send to customers, that's not so easy with chips. It requires millions of dollars for every change to chip design. Therefore, chips always have the JTAG interface enabled."""

At least parts of JTAG need to be enabled (most notably the boundary scan that allows you to read/set individual pins) for proper testing of complex circuit boards, but also this is not the problem here: It seems that they left some instructions active to read back supposedly write-only values (e.g. the AES key in question). Designing one of these internal, protected bits to be the "disable JTAG debugging" would not be that hard. CPUs with integrated flash are doing that for years: A certain signature in the internal non-volatile memory will disable flash-readout and CPU debugging, but boundary scan will stay active.

Quote: """ As real silicon chips are becoming more expensive to manufacturer, FPGAs are becoming a more popular alternative. (...) Every change to a chip design requires millions of dollars in changes to the masks that print gates onto a chip."""

Actually looking at a fixed complexity ASICs are getting cheaper to manufacture over time, just as everything else in chip-making. Or as FPGAs. And again: High-end special-technology ASICs might cost "millions of dollars", but no one in their right mind would re-design a complete ASIC for such a simple change like disabling JTAG debugging:

Chips are built in layers, and it quite common to produce a whole batch of wafers with the "lower layers" that form the actual transistors. The metal layers on top of them (those that form the wires interconnecting the transistors) may be added to say one third of the chips.

Then when errors are found during testing, one could take another wafer from the lot, apply a corrected metal-mask and check if the error could be remedied by re-wiring (often a few spare gates are spread over the wafer "just in case" one has to splice in an inverter in a signal... or such things).

Such a relatively cheap (say: 10% of the complete ASIC production run) change would be the right thing to build a chip with JTAG completely disabled, it would be impossibly to re-enable the feature from the outside, but of course, by opening the chip and re-wiring the metal (this is possible by using focused ion beams on a bare die) one could do it. But this was not the message of the quoted article.

<comment><USER17> He also keeps imposing the view that the Drone was "shot down" over Iran as fact. While many people have different views on how the drone was taken intact it was not "shot down".

<comment><USER18> Its a contentious point if the RQ-170 was shot down or just malfunctioned or run out of fuel or whatever.

That's the most famous drone.

But there have been other, tactical drones shot down on the Afgan and Iraqi borders and over the gulf.

Also, the Americans have shot down Iranian drones over Iraq.

Its best to Google with custom date range before last December so as to avoid all the RQ-170 stuff clogging the results.

</comment></comment></comment><comment><USER19> Is this debunking from a reputable source? (I've never heard of this blog before.)

<comment><USER20> Of course it is reputable. Its on blogspot, a free web host known for exclusivity and high standards.

Blogspot is well known for some of the highest quality software(1) and adult paradigm-shifting(2) link sites on the planet.

Blogspot, along with Errata Security(3), provides only the highest of high quality security(4) information. After all, the tagline is "Errata Security is a high-end cyber security consulting company."

(1) NSFW: <http://iphonevolt.blogspot.com>

(2) NSFW: <http://fascormet.blogspot.com/>

(3) <http://erratasec.blogspot.com/>

(4) NSFW: <http://tophackdownloads.blogspot.com/>

<comment><USER21> _> Of course it is reputable. Its on blogspot, a free web host known for exclusivity and high standards._

Robert Graham, aka ErrataRob, is well-known and well-respected in the information security industry.

Although you obviously wouldn't know this just from his Blogspot subdomain (and I agree he should probably just register an actual domain name), his content should also stand on its own merit.

There is a lot of crap code on Github and there are a lot of idiots on Twitter, but you shouldn't discount all users of a service because of the quality of _some_ of its users.

Hell, that goes for HN, too.

<comment><USER20> > We shouldn't be surprised by this backdoor, ... And researchers will not > probably hunt for similar JTAG backdoors in other chips.

Ya. He sounds real thorough, too.

> ...[the problem] we should insist on fixing it.

Wait, I was under the impression that no backdoors exist and even if it did, everyone does it, anyway, like the author claims.

> ... there are a lot of idiots on Twitter ...

Don't forget blogspot and HN. This site isn't just for editorials from Forbes and the New York Times after all, it also features lots of PR from Techcrunch and kickstarter. ;)

</comment></comment></comment></comment><comment><USER22> There are non-malicious reasons for designing in backdoors (debugging) but the manufacturer is based in the PRC, is subject to PRC laws and pressure, and the PRC government undoubtedly knows that the company supplies hardware to the US military. However benign the original motivation for creating the backdoor may have been, it's potentially bad news.

<comment><USER23> There is no evidence this chip is being used by the military for sensitive tasks, it isn't even certified for those uses. It's just an off-the-shelf FPGA chip that was found to have a backdoor (requiring physical access!), likely for debug purposes. While that should certainly be a concern for many of the company's customers, it is not necessarily a national security crisis.

<comment><USER24> Not evidence, but the product page indicates:

"In addition to supporting portable, consumer, industrial, communications and medical applications with commercial and industrial temperature devices, Actel also offers ProASIC3 FPGAs with specialized screening for automotive and military systems."

<http://www.actel.com/products/pa3/>

There seems to be a special variant of the chip for military use, hopefully without this 'debugging feature'.

<comment><USER16> "Specialized screening for automotive and military systems" means that they have done more extensive tests on otherwise identical chips.

As an example: for military chips they will certainly do every (non- destructive) test they know on every single device, say at elevated temperature with a little less than the minimum specified operating voltage... The test-devices themselves might cost $1M and be occuplied for oen hour per chip, hence they will charge you more for the final chip.

</comment></comment></comment></comment><comment><USER25> Who even uses that FPGA?

It's neither a Xilinx, nor an Altera.

<comment><USER26> Actel devices are often used because they use flash memory for the configuration, which makes them usable in situations where RAM may be untrustworthy for something so important (e.g. where you can get bit-flipping due to ionising radiation).

They also make properly rad-hard FPGAs, although these are ridiculously expensive (I've heard that if you are looking at building more than ~10-15 units, an ASIC may actually be cheaper).

Edit: I should add that you could still use Xilinx and Altera devices in these situations, but you really need some way of mitigating the problem -- such as TMR memory.

<comment><USER11> Xilinx also has flash fpgas, the Spartan 3AN and I believe altera also should have one.

About the rad-hard cost, yes they are >10k u$s each in most models but rad- hard ICs also are very expensive, I doubt an IC will be cheaper unless you buy by the millions. Anyway if you need something to be rad-hard, cost is the least of your concerns.

<comment><USER26> ICs have their hardware 'configuration' effectively in the metal layers, which are not so susceptible. The configuration is the biggest concern, as this is essentially the processor (or whatever the circuit is) itself. RAM used by a processor is also at risk, but this is easier to handle. From what I'm told, a reasonably large feature size ASIC can have far fewer problems than a modern FPGA.

Also, note that the Spartan 3AN does not seem to use flash for configuration. It looks like the internal flash is just for storage and the configuration is copied into RAM, as with normal Spartan devices. This means one less chip on the board and potentially better security, but no real advantage for avoiding SEUs.

</comment></comment></comment></comment><comment><USER27> Even I who promised myself I would take all future stories about "cyber threats" with a huge grain of salt, because I know the US Government is very keen on expanding their (offensive) Cyber agencies, and would stop at nothing to spread propaganda about it, I still almost believed this story. Damn it.

</comment><comment><USER28> Seems as though there is some truth and some doubt. Perhaps not "Bogus" but rather "Over-Hyped" --

[http://www.securityweek.com/china-wrongfully-accused-over- ba...](http://www.securityweek.com/china-wrongfully-accused-over-backdoor- found-chip-used-us-military)

</comment><comment><USER29> While I find much of the author's argument relevant, "it would be expensive" is very unconvincing.

Military operations and espionage by state actors are rarely limited by commercial constraints. In other words, access to confidential data on a vast array of devices would be a bargain at several million dollars when it comes to a national intelligence agency (or Apple or Google or Microsoft for that matter).

</comment><comment><USER30> _The cause of these backdoors isn't malicious, but a byproduct of software complexity. Systems need to be debugged before being shipped to customers. Therefore, the software contains debuggers._

I should think that embedded development environments would have a foolproof way of excluding debug code built into their environments. If they don't, then perhaps this is an opportunity?

</comment><comment><USER31> This article doesn't seem to actually debunk anything at all. It's a weakly supported opinion piece.

</comment><comment><USER32> Cue Bogus Bogus story link...</comment>


Sony v. Hotz Ends with a Whimper, I Mean a Gag Order - <AUTHOR> https://www.eff.org/deeplinks/2011/04/sony-v-hotz-ends-whimper-i-mean-gag-order

<comment><USER2> Hotz got SLAPP'd [0].

He's currently getting heat for his request for legal fee donations that was sent due to his defence against Sony [1][2]. It seemed like he received thousands [3].

You can read the court documents: [http://ia700401.us.archive.org/35/items/gov.uscourts.cand.23...](http://ia700401.us.archive.org/35/items/gov.uscourts.cand.235965/gov.uscourts.cand.235965.docket.html)

[0] <https://secure.wikimedia.org/wikipedia/en/wiki/SLAPP>

[1] <http://geohot.com/>

[2] [http://geohotgotsued.blogspot.com/2011/04/joining-sony- boyco...](http://geohotgotsued.blogspot.com/2011/04/joining-sony- boycott.html#comments)

[3] [http://www.escapistmagazine.com/news/view/109193-Geohot- Hint...](http://www.escapistmagazine.com/news/view/109193-Geohot-Hints-at- Plans-After-Sony-Settlement)

<comment><USER2> Just found this article of Sony having the records of those that donated to PayPal: [http://www.geeky-gadgets.com/sony-wins-access-to-george- hotz...](http://www.geeky-gadgets.com/sony-wins-access-to-george-hotz-paypal- records-17-03-2011/)

Edit: The settlement that GeoHot can't discuss: [http://psx- scene.com/forums/attachments/f6/26802-settlement-...](http://psx- scene.com/forums/attachments/f6/26802-settlement-george-hotz- case-127-stipulation.pdf)

</comment></comment><comment><USER3> This is truly disappointing. It's unfortunate when a large company can exercise such tight control over information about their products. As far as I know, Hotz never violated Sony's copyright. He just pointed out a flaw in their system that could be used, down the line, to violate copyrights.

</comment><comment><USER4> Easy to call out and mock Hotz sitting in chair behind the computer but the majority would be singing a different tune if they were in his place.

<comment><USER5> If you ran a small service website and some person randomly sued you, it would be enough of a hassle and expense to respond to that through the legal system, as it is. Doing so as an individual with the full force and might of one of the largest multinational corporations on the planet which itself has the support (against intellectual property concerns, etc) of the entire government, including the president and vice president who have made ignorant and vigorous statements against what they perceive you to be doing is an entirely different situation. It is a situation that you almost surely can't win and can't afford to fight and most _certainly_ can't afford to lose.

The problem here is that you also shouldn't go around making rap videos of yourself talking about how you're going to completely fuck Sony up and challenging them to "bring it on" while collecting contributions to your legal defense fund, when you know full well that you're going to roll over when the time comes, because you simply have no rational choice.

</comment></comment><comment><USER6> "Here's hoping future security researchers will refuse to be intimidated"

Is this a dig at Hotz for not fighting a legal battle?

<comment><USER7> I hope it is and he deserves those digs. If I was in his situation I would have done exactly the same, I would settle and run home crying to avoid being financially destroyed forever, but for him to solicit donations under the guise of doing good... and then do the opposite, it's ridiculous. He should be ashamed and he deserves any negativity he takes for this.

<comment><USER8> Hotz has said all along that any leftover donations would go to the EFF. If he used part of those funds to get good lawyers, and those lawyers told him that his case couldn't be won in a way that would strengthen the right to jailbreaking, the the right thing for Hotz to do was settle ASAP and pass along the leftovers to the EFF.

How would the typical Hotz donor feel if he fought the case all the way, only to win on a technicality that didn't establish any meaningful precedent that could protect future hackers?

EDIT: Hotz also took donations for a duration of _two days_ before he stopped, deciding that he had enough to cover short-term legal expenses, and he didn't want to have too much money lying around in case Sony won.

<comment><USER7> Hotz claimed he would not settle (unless very specific things were done, which haven't been), he took donations when this was the understanding. I have seen multiple people complaining that they donated because he wasn't going to settle, they wanted to support his fight for "justice".

He settled.

Whether or not the money goes to the EFF is irrelevant.

"What if SCEA tries to settle? Lets just say, I want the settlement terms to include OtherOS on all PS3s and an apology on the PlayStation blog for ever removing it. It'd be good PR for Sony too, lord knows they could use it. I'm also willing to accept a trade, a legit path to homebrew for knowledge of how to stop new firmwares from being decrypted."

<comment><USER9> Sony would never have agreed to those terms. Period. That is not how they conduct their business or PR.

<comment><USER10> That was kind of the point. He wasn't supposed to settle unless they did something they obviously never would. AKA never settle

</comment></comment></comment></comment></comment></comment><comment><USER11> Slightly off-topic: These "gag orders" never cease to amaze me. My (very limited) understanding is that the US is _the_ country fighting for free speech. It's valued higher than most other things (i.e. over here, in Germany, it's restricted: You seem to be far more limited in what you can say without legal consequences).

Yet, I regularly stumble upon rulings like these. Am I missing something? Isn't that exactly the opposite of free speech, with a court nodding gravely and supporting the outcome/helping to enforce this?

<comment><USER12> It's not really a 'gag order', as much as he's signed an agreement with Sony which contains 'confidentiality clauses'.

The court didn't mandate this agreement - he decided that it would be better for him to settle than to face court, and part of settling included the 'gagging'.

</comment></comment><comment><USER13> AFAIK, the EFF didn't support Hotz by e.g. "loaning" a lawyer or two. Does anyone know why? I can imagine that they have other priorities, but Hotz might not have settled if he'd had some serious backing. ("Thousands" in donations just means that he'd bankrupt himself a few days later.)

</comment><comment><USER14> What's the penalty for violating a gag order like the one from this settlement?

<comment><USER15> It's laid out in the settlement -- $10k per violation, plus $25k per violation for actual hacking events.

</comment></comment><comment><USER16> I guess the next company he investigates knows what to do now.

<comment><USER17> This goes both ways. The wisest action for the next guy who digs up an exploit is to release it anonymously.

</comment></comment><comment><USER18> So what's the end result of this? Someone named "Heogotz" will now be documenting his PS3 hacking from a VPN service in Europe?</comment>


Great Debate (astronomy) - <AUTHOR> https://en.wikipedia.org/wiki/Great_Debate_(astronomy) <comment><USER2> Later Hubble sent Shapley a letter that changed his mind in one fell swoop: "Here is the letter that destroyed my universe." He became a great mapper of galaxies and superclusters. Bravo.

Then in 1946 he was called up by the House Un-American Activities Committee for suspicious associations:

> HUAC committee chairman John E. Rankin commented, "I have never seen a > witness treat a committee with more contempt" and considered contempt of > Congress charges. Shapley accused HUAC of "Gestapo methods" and advocated > for its abolition for making "civic cowards of many citizens" by pursuing > the "bogey of political radicalism."

Bravo again Dr. Shapley.

</comment><comment><USER3> It puts into perspective just how much our understanding of the universe has grown in the last 100 years. Of course, this is true for all kinds of sciences, but still, this concrete example gives me goosebumps. Just 100 years ago, almost within one lifetime, top scientists were not sure whether there were galaxies other than Milkyway. And today, we are observing quasars from the beginning of the universe and gravity waves from colliding black holes.

</comment><comment><USER4> _Curtis 's galaxy was centered on the Sun, while Shapley correctly placed the Sun in the outer regions of the galaxy_

It seems pretty obvious, just from looking around a bit on a dark night, that most of the Milky Way is on one side of us. So why would any model put the sun at the center?

<comment><USER5> Why would you know that the sun is the same as the stars?

<comment><USER4> In 1920 though?

</comment></comment></comment><comment><USER6> I find it amusing that after the heliocentric debates in the middle ages, some ~500 years later we still struggled to admit that we are not the centre of everything. :-)

Primates...</comment>


Stop Payment: A homeowner's revolt against the banks (2012) - <AUTHOR> https://harpers.org/archive/2012/01/stop-payment-a-homeowners-revolt-against-the-banks/ <comment><USER2> I have personal experience with this back before the 2008 crash.

I owned a house along with someone else, an okay house, bought it for $115,000, held onto it for 5 years, until it appreciated to $350,000 in those hurly-burly days.

At some point, and I forgot why it came up, we needed to figure out who owned the loan. And we never did. It the morass of paper work and nearly fraudulent claims by various people who claimed to own the loan, we stopped paying on the loan. We literally had more than one company claim to own it at one point. What was weird is it was kind of a slow burn, even after we stopped paying. No one really seemed to care as much as you'd think $900 a month would make you care.

In the end, we sold the house, never paid off the remaining debt, and split the cash. I told my lawyer I'd hold onto savings to cover the debt if they ever came back and could legally claim it.. It's been 11 years. Nothing yet.

<comment><USER3> > In the end, we sold the house,

How did the bank lien from the mortgage get handled in the sale?

<comment><USER4> I am also interested in hearing about this. I guess they guaranteed good title, but kept money (earning enough interest?) in case the bank comes knocking?

<comment><USER2> Yes, I just talked to the person who I owned it with, and this is their recollection. We could transfer the title, but we were on the hook for the the mortgage. I'm pretty sure there wasn't a lien on the property.

Pretty funny you mentioned the interest. In the 11 years it's been like $50.00, since I keep it in just a regular account (instead of CDs or whatever).

<comment><USER5> >I'm pretty sure there wasn't a lien on the property

Which country was this in? Banks don't typically hand people hundreds of thousands of dollars without making sure that they'll get their pound of flesh when things go south. Not having any kind of collateral is a pretty big mistake on the bank's side.

</comment></comment></comment></comment></comment><comment><USER6> > A lender called Rose Mortgage had originated the loan, then sold it to > Option One Bank, which sold it to Lehman Brothers, which sold it to Lehman's > fully owned subsidiary Structured Asset Securities Corporation, which pooled > the loan into Structured Asset Securities Corporation Mortgage Pass-Through > Certificates, Series 2006-Z, whose investors were now alleged to be the > owner of Ibanez's note. U.S. Bank was appointed trustee of the securitized > trust, to enforce the payment of the notes, and, if necessary, to foreclose > on defaulting homeowners such as Antonio Ibanez.

This statement is truly mind-boggling. Took me a minute or two to understand what was going on (or what I think was going on)...

</comment><comment><USER7> When you signed the loan for the mortgage, you made a business transaction with the bank. You knew full well the terms of the mortgage and the consequences of not paying it. You also should have known that the bank could sell the mortgage. They explained it clearly on all six mortgages I've signed for over the years.

But, I also have no moral qualms with "strategic defaults". The bank also knew what they were signing.

<comment><USER8> But mostly I don't understand why would the borrower should have its say on who he owns the money to. As far as the borrower is concerned he got some money and must pay it back with interest. What does it change that the payment goes to institution x or y?

I don't have much sympathy for people who borrow money to then find some loophole to swindle their way out of their debt. They succeeded? Good for them! Proud to be dishonest. Let the other borrowers pay for you through higher margins.

<comment><USER9> I think I should have a lot of say over who owns my debt.

There's a lot of mechanics that go into paying my debt, is it automatic withdrawal? If so how do I change the account? Is it someone I can barely hear in a noisy call center I get to talk to after an hour? Or is it someone at the bank around the corner where I first opened my account when I was 14?

I've got a mortgage, they've got a fine UI for logging in and making a bonus payment, printing out amortization schedules, etc. etc. If they sold my debt to someone who would only talk to me via fax I'd be pissed off.

<comment><USER7> _I think I should have a lot of say over who owns my debt._

That's the thing. You don't _own_ the debt, the bank does.

 _There 's a lot of mechanics that go into paying my debt, is it automatic withdrawal? If so how do I change the account? Is it someone I can barely hear in a noisy call center I get to talk to after an hour? Or is it someone at the bank around the corner where I first opened my account when I was 14?_

I don't let any company have direct access to my bank account. I pay my mortgage and all of my other bills using bill pay _from_ my bank. When the letter comes saying the mortgage has been changed, I log into my account at my bank and change the bill pay. A mortgage is one of the easiest transactions.

</comment></comment></comment></comment><comment><USER10> As near as I can tell, this complaint sounds like an offshoot of SovCit approach. Very similar approach.

In any case, I strongly favor discarding deeds, title search fussery, in favor of a national title registry - the decentralized approach seems, today, to be pointless. Maybe MERS should be nationalized and turned into the Standard Property Registry. It should be as simple as checking the database view to see the title, liens, claims, etc.

edit: I read each and every single document I signed for the 30 year conventional mortgage, both in the run-up and in the grand finale. Law is _like_ code, but executed by courts and lawyers with a "virtual machine" of the great Anglo-American legal tradition governing it. Anyone competent to write code and read manuals should be able to read their mortgage documents.

<comment><USER11> Many of these homeowners, unlike "sovereign citizens", actually appear to have the law on their side. They aren't just making up their own insane interpretation of the legal system. It even sounds like it's more like MERS who made up an interpretation of title that disagrees with state laws.

You seem to be saying that MERS's interpretation _should_ be correct, that MERS's database should be the law of the land and investors should be able to buy and sell the title to mortgages without states and counties being involved.

The current system has homeowners getting windfalls because MERS screwed up, and I suspect that screw-ups in your version would have the opposite effect, where homeowners get robbed by computers and nobody can be held accountable.

So that seems bad. And what would the benefit be? Sure, it would make mortgage-backed securities more efficient, but -- why is that good?

<comment><USER10> Crap happens. That's the point of the courts; to enforce remedy.

If you've ever dealt a little bit with funky titles, you'd know that having a central authority managing all claims to title would be a _big_ deal and massively improve life for property buyers. Title searches are _not_ exhaustive. That is why title insurance exists.

If MERS is a title registry and it also manages bundling of debts, I genuinely don't care. The issue isn't debt bundling, it was granting high risk mortgages and other high risk behavior.

</comment></comment></comment><comment><USER12> looks like Trotter lost... [https://law.justia.com/cases/idaho/supreme-court- civil/2012/...](https://law.justia.com/cases/idaho/supreme-court- civil/2012/38022.html)

[https://www.housingwire.com/articles/idaho-supreme-court- dec...](https://www.housingwire.com/articles/idaho-supreme-court-decision- gives-mers-court-win)

<comment><USER13> Man, that's crazy. If the law says you have to have the deed and the note to foreclose, how can the court ignore this? Honestly, it sounds like Trotter was trying to game the system, but shit, isn't that what they do to us all the time? We forgot to check a box, or filled in something wrong, and they hurt us. We should hurt them for the same reason.

<comment><USER14> _> If the law says you have to have the deed and the note to foreclose, how can the court ignore this?_

Simple: that's not what the law says. At least not in Idaho.

According to the court's opinion, what the law says is that a trustee who forecloses must meet four specific requirements. None of those requirements equate to proving that you have "standing" (which was what Trotter alleged was required) to foreclose.

However, the first of the four requirements (p. 5 of the court's opinion) is: "The trust deed, any assignments of the trust deed by the trustee or the beneficiary and any appointment of a successor trustee are recorded in mortgage records in the counties in which the property described in the deed is situated". Since the main concern given in the article is that MERS and similar arrangements are circumventing the recording of who owns or has claims on real property in the local jurisdictions, it would appear that in the Trotter case, that concern was not present, since the relevant claim information _was_ recorded in the local jurisdiction; the trustee who forecloses has to be the one whose trust deed is filed with the county for that property.

</comment></comment></comment><comment><USER15> An interesting article, but the whole thing had a whiff of "paying income tax is unconstitutional", complete with the protagonist coming off as _just_ a tad unhinged. IANAL, and even as an amateur one I wouldn't begin to claim to argue the merits of the law. But none of the folks mentioned in the article garner any sympathy from me. Banks weren't screwing anyone, AFAICT. Folks just couldn't make the payment, and found a loophole. Hell, one person had mortgages on _eleven_ houses in San Diego. Hmm, could it be that they were just a bit over-extended, and not victims of the evil banking system?

Now, I'm not hatin' on anyone mentioned in the article. Overall, I'm about as neutral as I would be watching two people I have no interest in have a fist fight, because I have no great love for banks, either. And if they succeed, good for them. But the state of ID, as pointed out by another commentor, seems to put this in the "don't pay income tax" bucket as well.

<comment><USER16> Paying income tax _was_ unconstitutional. The 16th amendment had to be passed to make it constitutional. Only Federal Income taxes after 1913 were constitutional: [https://en.wikipedia.org/wiki/Sixteenth_Amendment_to_the_Uni...](https://en.wikipedia.org/wiki/Sixteenth_Amendment_to_the_United_States_Constitution)

<comment><USER17> > Paying income tax _was_ unconstitutional.

It was never generally held to be, and the US had (though not permanently) income taxes prior to the 16th Amendment.

> The 16th amendment had to be passed to make it constitutional.

No, it had to be passed to make income tax on revenues from certain forms of interest, dividends, and rents to be Constitutional under the (quite controversial) holding in _Pollock v. Farmers Loan Trust Co_. Income taxes moe generally were held by the Supreme Court to be excises rather than direct taxes and therefore Constitutional even prior to the 16th.

[0] [https://en.m.wikipedia.org/wiki/Pollock_v._Farmers%27_Loan_%...](https://en.m.wikipedia.org/wiki/Pollock_v._Farmers%27_Loan_%26_Trust_Co).

</comment></comment></comment><comment><USER18> So, I was not surprised to discover that this did not exactly revolutionize the mortgage industry, and on some level I'm not all that disappointed. There is a problem, but getting "mad as hell" is probably not the solution.

However...it does remind me of my chief disappointment with the Obama administration's approach to rebuilding after the Fiscal Crisis, and that is that we did not really change the financial system very much. I have the very strong impression that it will all happen again.

<comment><USER19> In a lot of ways, the government are employees of the finance industry.

</comment></comment><comment><USER20> More banks need to be foreclosed on:

[http://business.time.com/2011/06/06/homeowner-forecloses- on-...](http://business.time.com/2011/06/06/homeowner-forecloses-on-bank-of- america-yes-you-heard-that-right/)

</comment><comment><USER21> Not quite sure what the relevance is today of this article from 2012. It's core message is a good one, though.

Americans are used to getting pushed around by "the machine". Bills come from various places (utilities, hospitals, banks, the government) and we pay them without thinking. Why think that much about it? You _have_ to pay or your precious credit rating will suffer.

But the mistakes are so common it's likely that everyone has a personal example from some point in their lives. Credit card fraud, billing errors, mistaken identity, hidden charges on a phone bill, and on and on, and on again. The companies are faceless, emotionless, and completely without loyalty to their customers. It's rather insane that we grant them fidelity in return.

You've paid your insurance bill diligently for years, but as soon as they are needed, they start looking for ways to get out of paying the claim. They will happily screw you over the tiniest technicality. The insurance industry certainly isn't the only offender in that regard.

Some people might scoff at the ideas in the article. You took out a loan, only a deadbeat leech would default on that loan and expect to keep their house. Sounds about right, but that assumes we live in the world we all imagine. The "right" world, where business still resembles interpersonal relationships. It doesn't, and we don't live there.

It shouldn't just be about fighting Wall Street greed, or getting out of an eviction. Everyone _should_ be on top of any business from which they have purchased a service. Be informed. Force them to deliver the service they promised. Force them to make you whole when you've been screwed. Force them to prove that they have accurately managed your account and they they truly do own your debt. Above all, make them actually compete again.

It would be nice if everyone did that, but I don't actually believe that they will. Oh well...

<comment><USER22> _It would be nice if everyone did that, but I don 't actually believe that they will. Oh well..._

It would be nice if everyone had the wherewithal to. It would be nice if they did that it would have a lasting impact. There are a few problems though.

"The Machine" is set up so that we don't have the time or money to actually fight these claims. I certainly can't miss time from work to deal with much of this. Maybe if it'll bankrupt me either way, but for every little error I've come across, the lost time and wages aren't worth it financially. Am I going to go into debt to sue someone just to prove a point? No. That would be a terrible use of my resources.

Also, these agreements we enter into are written with technicalities built in. To expose them would take an intricate knowledge of contract law. Companies rely on this imbalance of knowledge and power to take advantage of us. Even if there is a successful claim it's not like it would automatically set a precedent or retroactively void existing contracts or prevent new loopholes to be written into new contracts.

Action from private citizens is a band-aid here. Something needs to come from a higher power. It would be great to have a government that works _for us_ in this regard, but they side with big business here. It sucks, but it's a reality of the machine.

<comment><USER23> I want to know who all these people are who just thoughtlessly pay every bill they receive in the mail as long as it looks official. I have some bills I need to start printin'!

<comment><USER24> There already are people who take advantage of others in this way. You will need to differentiate yourself to be successful in this crowded marketplace.

[https://www.consumer.ftc.gov/articles/0258-fake-debt- collect...](https://www.consumer.ftc.gov/articles/0258-fake-debt-collectors)

</comment></comment></comment></comment><comment><USER25> Looks like this is his LinkedIn Page [https://www.linkedin.com/in/poppakoppa/](https://www.linkedin.com/in/poppakoppa/)

still refers to www.TitleTrail.com but that's up for sale

Looks like he might have some connection to this group still doing some of the work [http://certifiedforensicloanauditors.com/](http://certifiedforensicloanauditors.com/)

There are benefits to the ancient system of physically recording everything in the locale, and potentially good reasons to move to a more modern system. While I don't have enough info to form a final opinion, I do know that if they are going to centralize it, they should certainly be held to a standard of doing it right.

</comment><comment><USER26> Instead of bailing out the banks after the crisis, the government could have decided to do something like this and sever the loans. Let people keep one home (the cheapest if they had more than one) and let the banks take the fall for what was completely their own fault. They didn't. They decided that these banks should continue to fuck people over in the same way, passed a few laws to prevent it for a few years and that's about it. They claimed these banks were "too big to fail," a moniker no one understands because it's absurd and doesn't make any sense. If anyone deserves to be fucked over it's these banks who fucked the rest of us over royally.

<comment><USER27> I agree with the sentiment but considering the bailout we got barely passed because of conservative outrage, anything with even a wiff more of "socialism" would've been doomed.

Reading about the crisis still pisses me off but I also am grateful there still is a system. Conservatives flirted with stupid in a big way in 2008 & 2009 and it could've been a lot worse.

</comment></comment><comment><USER28> > Adam Levitin, a professor of law at Georgetown University, told me that if > the lawsuits are successful, the banks will be on the hook "for hundreds of > billions of dollars" and will likely go bankrupt.

I'm guessing that these lawsuits were not, ultimately successful?

Trotter's case ultimately failed: [https://law.justia.com/cases/idaho/supreme- court-civil/2012/...](https://law.justia.com/cases/idaho/supreme-court- civil/2012/38022-0.html)

</comment><comment><USER29> Referred to in yesterday's article "The million-dollar brownstone that no one owned" [1] with HN comments [2], about a particular building in NY with an ugly financial history through the mortgage crisis.

[1] [https://theoutline.com/post/5807/the-million-dollar- brownsto...](https://theoutline.com/post/5807/the-million-dollar-brownstone- that-no-one-owned?zd=1&zi=rwqu3xgo)

[2] [https://news.ycombinator.com/item?id=17804023](https://news.ycombinator.com/item?id=17804023)

</comment><comment><USER30> For those curious to see who the current Servicer (ie place that takes your monthly mortgage check) and Investor (ie the actual owner of the debt) of your mortgage is, the following site at MERS seems to work:

[https://www.mers-servicerid.org/sis/](https://www.mers-servicerid.org/sis/)

I'm actually somewhat surprised that my 6 yo mortgage is still owned by the same local credit union that originated it.

</comment><comment><USER31> If anyone wants to know how Vermont Trotter's case panned out, here's the last appeal he exhausted in 2015:

[https://www.carltonfields.com/files/uploads/Documents/realpr...](https://www.carltonfields.com/files/uploads/Documents/realprop/trotter- v-bayview-loan-services.pdf)

TLDR: he lost.

</comment><comment><USER32> Not just not paying off your debts but being proud of it. You want Greece? Thats how you end up Greek. But the evil banks! Try buying a house without them then. But the evil system! You are living in it and you were enjoying the boom times.

This article reads like a Marxist manifesto. Which is fine if these people vote Communist next election.</comment>


What Do Countries Talk About - <AUTHOR> http://blog.frrole.com/image/45339996250

<comment><USER2> Just 5 countries, the title and the map was promising more.

On the method: what is the ratio of tweet that are unclassified? I do not believe your data to be accurate on the whole picture. For example, tweet on good restaurant is very frequents in Asia, but restaurant's names will hardly match some keyword.

</comment><comment><USER3> Not sure how accurate this is, but I really like this. Seems to be kind of the way I would expect it to be. Can you guys share what data went into drawing these conclusions?</comment>


Analyzing US Election Russian Facebook Ads - <AUTHOR> https://simonwillison.net/2018/Aug/6/russian-facebook-ads/ <comment><AUTHOR> The tool I built can be found here: [https://russian-ira-facebook- ads.datasettes.com/](https://russian-ira-facebook-ads.datasettes.com/)

Here are the ads they spent the most money on: [https://russian-ira-facebook- ads.datasettes.com/russian-ads-...](https://russian-ira-facebook- ads.datasettes.com/russian-ads-919cbfd/display_ads?_sort_desc=spend_usd)</comment>


Amazon S3 now supports server side encryption with customer-provided keys - <AUTHOR> http://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html?sc_ichannel=em&sc_icountry=Global&sc_icampaigntype=launch&sc_icampaign=em_118914880&sc_idetail=em_1660044680&ref_=pe_411040_118914880_8

<comment><USER2> Why would anyone do this instead of encrypting on the client?

<comment><USER3> Isn't keeping the key not on the client more secure. If the encrypted data is on the client then the key would have to be on the client at some point to decrypt it. If my phone is jailbroken it wouldn't be too hard to extract the key and depending on the security of the app it may be likely that this key is used for every client.</comment></comment>


Where Did the Future Go? - <AUTHOR> https://generativist.substack.com/p/where-did-the-future-go <comment><USER2> The future is here. We got super computers that fit in the palm of your hand and operate as a smart phone compared to what we had in the 1980s 8-bit world.</comment>


Ask HN: What makes being an early employee of a startup worth it? - <AUTHOR> To me being an early employee seems to be all around a bad deal.  But it is also a vitally important position for startups.
For example, lets say you join a startup as employee #2. You're granted 0.5% and make significantly less than a market salary. Now let's say this startup is pretty successful and exits for $50 million in 4 years. With that kind of exit the founders will likely never have to work again in their lives if they do not want to.  You, however, will have made less than if you joined a more stable company.
Now people will say your impact is bigger or you get to work on something you're passionate about.  But that is also true for the founders and they also get to make enough money to be financially independent.
Of course this also ignores the more common case which is that the startup just fails. And in that case "founder" still looks good on a resume while "engineer at company no one's ever heard of" is neutral to negative at best. <comment><USER2> Money isn't everything. There are people who want to work on interesting problems with interesting technologies and have the flexibility to influence what kind of tech the company may use in the future.

</comment><comment><USER3> Im interested in info on this too.</comment>