Pi-hole Remote Code Execution - <AUTHOR> https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/ <comment><USER2> 1) You have be be logged into the pi-hole 2) Requires the user to post into a MAC Address field

While I agree this should be fixed. This is a pretty low issue

<comment><USER3> AFAIK Pi-holes are almost always going to be sitting inside a LAN and owned by whoever owns the other devices on the network too, so the risk is quite low.

<comment><USER4> In general, yes, but this is how real issues start. Look at all the bmc software written in the world. It's utter horseshit. You are supposed to use a dedicated vlan for accessing the bmc. Everyone is still fighting the bmc software and it is routinely accessed over the open internet.

<comment><USER5> What is bmc software?

<comment><USER4> idrac, ilo, etc.

</comment></comment></comment></comment></comment><comment><USER6> The dev trusted a regexp to 'validate' user input for a _privileged_ command execution, a function which fails at validating a constant-sized, colon- separated sequence of hex numbers in a string, everything about the input screams structure, and yet it was still half-assed!

Although this requires you to authenticate at the web portal, so 'some' sort of trust is necessary to gain this level of access. I believe they even have some plan of letting authenticated users update the pi-hole code from the web interface by the wording on this issue: [https://discourse.pi-hole.net/t/how- do-i-update-pi-hole/249](https://discourse.pi-hole.net/t/how-do-i-update-pi- hole/249).

A funny thought: you can create a script (that uses the default password) to inject a code to schedule an update to the pi-hole (and revert the changed permissions) which fixes the vulnerability and leaves no trace! These possibilities reminds me of a hacker series!

<comment><USER7> Hmm, wonder if this is the type of stuff a static code analysis would pick up like (veracode)

<comment><USER8> Likely would. The `validMAC` function doesn't just fail silently if the regex fails, which would get past naive signature detections. Oh and feeding user input directly into `exec`…

</comment></comment></comment><comment><USER9> The crazy thing is that there is a correct escaping available: `escapeshellarg()`. With correct escaping, you don't even need to sanitize the user input here - the target command will parse the MAC address itself and report any errors.

The existing code is analogous to building SQL queries using string concatenation and forgetting the mysqli_real_escape_string() call. Really the solution is to use a parameterized interface (e.g. by calling pcntl_fork() + pcntl_exec(), that accepts an array of arguments instead of a string command- line).

Pcntl doesn't seem to have a wrapper for the posix_spawn syscall.

<comment><USER10> escapeshellarg is an ugly hack, php is passing everything through `sh -c` for no reason.

The pcntl_exec function is the only one that has a reasonable interface, but is way too low level.

php should simply accept this as a valid function call:

        exec(["sudo", "pihole", "-a", "addstaticdhcp", $mac, $ip, $hostname]);

</comment></comment><comment><USER11> The root of this issue seems to be a regexp function (preg_match()) in PHP coupled with an exec() of a variable that was not properly screened, coupled with an 'sudo' inside of the exec(), e.g.:

exec(" _sudo_ pihole -a addstaticdhcp ".$mac." ".$ip." ".$hostname);

and/or

exec(" _sudo_ pihole -a removestaticdhcp ".$mac);

So three places to audit:

1) Regexp's and related complex high-level functions;

2) Calls to exec()

3) Uses of sudo within an exec()

<comment><USER10> The problem is that php expects a string that is then passed to sh -c, which is then parsed by a shell.

Instead php should have an interface that accepts:

        exec(["sudo", "pihole", "-a", "addstaticdhcp", $mac, $ip, $hostname]);

without any shell trickery.

If there's a sudo in this specific like doesn't matter, your reverse shell is going to run as a regular user and after that it only matters low locked down the sudoers configuration is.

<comment><USER12> Definitely not ideal, but php provides the escapeshellarg [1] function you are supposed to use in these situations.

You can even implement a "safe" exec function like so:

      function safe_exec(array $args, array &$output = null, int &$return_var = 0) : string {
        return exec(
          implode(' ',
            array_map('escapeshellarg', $args)
          ), $output, $return_var
        );
      }

      // Example usage
      $output = [];
      $return_var = 0;
      echo safe_exec(['ls', '/tmp'], $output, $return_var);
      var_export($output);
      echo "Exit code: $return_var\n";

[1] [https://www.php.net/manual/en/function.escapeshellarg.php](https://www.php.net/manual/en/function.escapeshellarg.php)

</comment></comment></comment><comment><USER13> > exec("sudo ... " . $user_input_string ...)

Wow, this is always a mistake and a huge one. exec() is dangerous, exec calling with sudo more so, and should never be used in conjunction with unprivileged user input like this. Granted a weak attempt was made to sanitize the user string, but so weak one might wonder if it is Underhanded Code at play here.

The big problem with this sort of issue is that it indicates that there almost certainly are massive security problems elsewhere in this code base since this one is low hanging fruit that never should have made it past even rudimentary code review by anyone with a bare minimum knowledge of security.

<comment><USER14> So find the rest and fix them

<comment><USER13> I'd be happy to help you with this. My rate is $235/hr, minimum 30 hours. When can I expect your deposit so we can get started?

<comment><USER15> Yes, how dare he ask you to donate some of your time to contribute back to the open source community, tsk.

<comment><USER13> Wow you created a brand new account just to post that one comment? I'm honored.

On to the response. First, doing something I don't want to do that someone else told me to do and not getting paid for it is slavery. Slavery is bad.

Second, I don't use their solution. I have my own custom DNS intercept system I wrote myself which is much better and also enjoys security by obscurity. With a single user it's hardly worth the time to mess with.

Third, I already donated to their project, above. I reviewed their code, agreed it was complete shit, and concurred with the consensus that they need a complete security audit. That is extremely valuable advice which is worth $3000. So I donated $3000 and all you've done is sit and whine and create anonymous coward accounts to troll people. Tsk.

<comment><USER15> It's funny that I'm apparently the troll here, your comment just made me consider finally making an account.

If somebody prompts you to do something on the internet do you give it any concern? You must be swimming in free iPhone X's then. He suggested you donate time to an open source project which is about as equivalent to slavery as a cashier at Burger King trying to upsell you a large whopper menu.

You've donated absolutely nothing to the project by commenting here if you didn't provide the feedback directly via the projects public tools.

I actively contribute to many open source projects. Writing a shell script to generate dnsmasq hosts files isn't exactly rocket science. It doesn't matter if you don't use the project, lesser informed people do, by improving it you improve a large amount of people's security. Call it virtual herd immunity, it affects you too indirectly.

</comment></comment></comment></comment></comment></comment><comment><USER16> Does this pihole admin interface perform any kind of CSRF protection, or can this be exploites by any random website as long as the victim has a browser tab with a valid session?

<comment><USER2> Requires a POST that would hit CORS pretty hard

<comment><USER17> Not all POST requests require a CORS preflight. In particular, "normal" form submissions, like the type that are accessed via $_POST in the article, do not.

Specifically, "simple requests" do not, covered here[1]. This case is POST, with a Content-Type of application/x-www-form-urlencoded. (The rule of thumb you can use is that these were all essentially possible to send prior to CORS even existing. To send a POST, you would construct a form tag with the inputs filled in with the desired values, set the target URL to the "victim" site, and have JS submit the form.)

[1]: [https://developer.mozilla.org/en- US/docs/Web/HTTP/CORS#Simpl...](https://developer.mozilla.org/en- US/docs/Web/HTTP/CORS#Simple_requests)

</comment></comment></comment><comment><USER18> You have to be an authenticated user on the admin portal. Doesn't this already come with the expectation of being able to fully control the device?

<comment><USER19> Not necessarily, web GUI password and user/root ones can be different. From an attacker's point of view: he just needs to crack the Wi-fi (e.g. aircrack-ng), join the LAN an then bruteforce the Pi-Hole webadmin password.

<comment><USER20> I read further up [1] that Pi-Hole auth is http not https, so if you cracked the WiFi aready, sniffing the webadmin password might yield a quicker return than brute-forcing (depending on strength of password, and owner's login frequency). Assuming the maximum password length of PiHoles is not < 20 chars.

[1] [https://news.ycombinator.com/item?id=22717938](https://news.ycombinator.com/item?id=22717938)

</comment></comment></comment><comment><USER21> Why the sudden use of the "Black Jack ni Yoroshiku" manga comic art? I know the author released the entire thing with permissions to freely use the art anywhere, but still.

<comment><USER22> A family member of mine was the original author of pi-hope. He sold the company to his partner last year, so any changes in aesthetics would be due to the change in ownership.

<comment><USER23> One of the Pi-hole dev's here. The comment you are replying to is talking about the blog post about this CVE, not Pi-hole's aesthetics. (Which haven't changed, btw)

Say hi to J from me.

<comment><USER22> Ahh, my mistake. I will say hi for you :)

</comment></comment></comment></comment><comment><USER24> This is justification for people like me who rolled our own using the lists from pihole and a tiny bit of shell script. No need for a web gui.

</comment><comment><USER25> Why is it that, instead of just forking and making a patch is nowadays replaced with a CVE focus. Are CVE's the new big thing on your CV?

<comment><USER19> The patch has been released the day after the issue was being noticed to Pi- hole, as you can read at the bottom of the article. This is just an informative article and, as a pentester, I find it very interesting.

</comment></comment><comment><USER26> self-hosting and remote code execution don't go well together. In that very moment it's not apt for non-tech users which is the main target group AFAIK. Very sad. Just too much complexity.</comment>


Drug tests present major hurdle for employers - <AUTHOR> http://www.pbs.org/newshour/bb/drug-tests-present-major-hurdle-for-employers/ <comment><AUTHOR> From the article:

 _" So I right away asked if it was different in Colorado, say, or Washington, D.C. where [marijuana] has been legalized. And was told no, it's really no different. And the thing is, if you're an employer, say, in Colorado, where recreational use is legal, you still – it does not affect your company policies. You can still say you have to take a drug test to be hired. And you might be randomly tested while you're here."_</comment>


Show HN: "Gimmick!" scene, image and music, rendered in GLSL - <AUTHOR> https://www.shadertoy.com/view/4llSRf <comment><AUTHOR> This shadertoy generates a scene from the game Gimmick! using a complicated shader. It was done for SIGGraph '15 but was rejected because it has trouble running on the judge's computers. Many browsers get upset while trying to compile the large graphics shader, as well as the very "fat" sound shader I wrote. I made a video of what it's supposed to do for those who can't run it:

[https://www.youtube.com/watch?v=d3izbzMNq74](https://www.youtube.com/watch?v=d3izbzMNq74)

It seems to work best on FireFox in Windows. Strangely, my old ThinkPad X61 _eventually_ ran it under Chromium, while Chrome on my desktop with a GTX 970 fails to compile it. Go figure.

A friend of mine created the GLSL code to show all of the bitmapped graphics shown, including tile animations, without any inputs. I wrote a wacky little "music stream" generator called ShaderTracker to create the music as a function of time. This is my first venture into anything shader related, so the graphics code is really the more interesting part. My friend is a genius and you should check out his shader work: [https://www.shadertoy.com/user/Hamneggs](https://www.shadertoy.com/user/Hamneggs)</comment>


OneName – Distributed Identity Database using Namecoin - <AUTHOR> https://www.onename.io/ <comment><USER2> [http://imgur.com/MDwlDSt](http://imgur.com/MDwlDSt)

How many and which usernames have been set aside by the dev team, and how were the decisions made to offer them to select people?

<comment> ryan-c Looks like they grabbed all one and two character names, plus a little over 600 others: [http://pastebin.com/gnLGmvXu](http://pastebin.com/gnLGmvXu)

<comment> ryan-c It would have been nice if they're reserved names for namecoin devs, it looks like someone grabbed u/khal who is not khal.

<comment><USER3> Oh how do you know it's not the real khal?

<comment> ryan-c The bitcoin address in the profile is also used by u/speedcore and he always uses vanity addresses.

</comment></comment></comment></comment></comment><comment><USER4> This service, and it seems by extension namecoin, raise some questions in my mind.

It seems to me that you will very quickly run out of useful names and instead get confusingly similar names. It gives the illusion of human-readable, but its really not. Refer to xkcd 1279 for why this becomes an issue :)

The bitcoin integration is flawed; People don't have one wallet address, any wallet can generate hundreds or thousands of addresses. Remember, there is no message you can send with a bitcoin payment so what you are expected to do is create a new bitcoin address for every payment you want made out to you.

What is with the limitation of only supporting 'a-z0-9' ? Swedes and Russians would probably appreciate a much larger set of characters. Not to mention Klingons!

<comment><USER5> Hey Thomas, thanks for your comments.

1) Every username system has some limitation on usernames. Look at Twitter. There are 650 million twitter users, and all of them picked usernames in the same global namespace. This demonstrates that using a global namespace is quite doable.

2) You're right, people usually have multiple Bitcoin addresses and quite a few people prefer to use different addresses for different transactions. However, the protocol is extensible and is not limited to a single address. In the future, the protocol will support a list of bitcoin addresses instead of a single address. Further, you can use a hierarchical bitcoin address and direct people to different addresses in the hierarchy. In that sense, the bitcoin address listed is just a way to identify the tree of addresses the user owns. Last, the protocol supports data to be linked to from the blockchain, so if you want, you can have a next pointer lead to an API endpoint that returns a different bitcoin address every time.

3) As far as supporting only [a-z0-9_], those are the characters that most username systems support, including twitter. Some say this is due to the fact that those are the only "word" characters. Also, using this set makes it more difficult to confuse addresses. The domain name system has similar restrictions for similar reasons. I know that international readability takes a bit of a hit, but I'm sure we'll find ways to improve the experience. We're all up for suggestions.

<comment><USER6> Don't underestimate how much work Twitter has to do with a global namespace. Brand protection complaints and negotiation, conflict resolution, allowing renames, allowing reuse of abandoned names...it's not trivial, and unlike the Internet (where every registrar deals with a piece the userbase), they centralize all that labor.

</comment></comment></comment><comment><USER3> Muneeb here, one of the devs of OneName. Just wanted to let everyone know that we got way more load than we expected and had to fire up a lot of additional namecoind servers. The new servers started coming online 1-2 hours back. So if you registered between 11am and 3:30pm EST then your profile processing could be delayed by a few extra hours. Sorry for the inconvenience, but firing up 10 extra namecoind servers while keeping the current setup from not choking was a "fun" experience :D

I need my breakfast now

</comment><comment><USER7> I'm concerned that I get the following email after signup:

"P.S. The passphrase you wrote down earlier is the secret key that gives you access to your username and profile. We don't have a copy of this key, so if you lose it, your username will be lost forever. Just in case that happens, though, we've created a backup code for you. When combined with our own backup code, your secret key will be able to be recovered. Here it is: [redacted]"

I don't understand why the service is emailing out this key.

<comment><USER5> We don't have your private key, and so we have you write down a passphrase that can derive the key (sha256(passphrase)). In addition, we have a last resort mechanism to help you recover your private key if it ever gets lost. We use shamir's secret sharing to split up the secret key, and send you a share. The pk can only be reconstructed when both shares are combined. We have zero information about your pk.

<comment><USER7> Why email it to me though? If all you need to essentially recreate the private key is this tidbit you've emailed me (plaintext, available to anyone), plus the (potentially compromised) tidbit on your server... What am I missing? Shamir's secret sharing doesn't help me if you already have access to all the pieces (your email account and a hacked server).

<comment><USER8> I assume, by "they don't have it", they actually mean "they had it when you input it into their sign-up form, kept it just long enough to put it into an email, and then erased it."

</comment></comment></comment></comment><comment><USER9> Are we supposed to use the generated Bitcoin address or supply our own? I assumed supply my own, yet when the next step asks to write down the pass- phrase I'm now unsure of it's intent.

<comment><USER3> You should use your own Bitcoin address (from coinbase, blockchain.info, or Bitcoin client). We generate a default BTC address (using the same passphrase/private-key) for people who don't already have bitcoin addresses.

<comment><USER10> I didn't have a pre-existing Bitcoin address; I signed up for a OneName account mainly to claim the handle that I prefer to use online. I now have a Bitcoin address, but is it just pretend? Or what? Perplexed.

<comment><USER5> You can get the private key for the bitcoin address we created for you by calculating the sha256 of the passphrase you wrote down. We're working on improving this process and in the mean time we'll clarify further. Thanks!

</comment></comment></comment></comment><comment><USER11> Just registered my name and I have to say I really like the whole process. It was very smooth, and I like the way it looks and the potential it has.

Is there any way this can be a truly open-source project? Right now the "protocol" is open, but if wanted to host my own front-end for me and friends then I'm out of luck.

<comment><USER12> It's just a pretty front end for a namecoin blockchain explorer. You can certainly create your own or use this one: [https://dotbit.me/block_explorer/name/u/cshrem](https://dotbit.me/block_explorer/name/u/cshrem)

<comment><USER11> It's more than that. It's an extremely easy to use frontend. For instance, that link you posted doesn't have any way to see the JSON form of the profile. It also doesn't do any of the fanciness you mentioned below with joining together split up profiles that you mentioned in a comment earlier. More than that, this space needs some sort of de-facto standard for the protocol, and yours is as simple as any else.

Here's the use-case I'm thinking of. I want to create an in-browser pgp- messager using pgp keys that are on the nmc blockchain. If the onename "protocol" became ubiquitous this would be more or less trivial. A simple webpage with a "username" field and a "message" field. Javascript fetches the public key listed in the profile and encrypts the message (ignoring potential issues with using javascript for encryption).

That would be awesome, and there would be a million other applications besides. The problem is "onename.io" is a central point, both for failure and attack. If others could run this same pretty frontend, then there could be third field on that page for "onename endpoint", which would default to "onename.io" but could be anything. I could have my own personal instance, my employer could run one, my ISP for my neighborhood, etc... Farther down the line it could even be something built into a browser or OS, where you can specify custom default endpoints just like you do with DNS.

I don't really have any say with what you've created, it's your thing and you do with it as you see fit. But in my opinion your "pretty front end" is the best one so far, and I think could actually have appeal outside of crypto- geek-world. You just need to open-source it :P

<comment><USER5> Hey, thanks for the feedback!

I love your pgp-messenger idea - you should do it!

And you're right - the pretty front end is a big component. Two things, though - 1) we're working on open sourcing the profile crawler 2) it shouldn't be that difficult to roll your own pretty front end.

</comment></comment></comment></comment><comment><USER13> Cool, but how do I update my profile after creating it? I don't see any way to log back in again?

<comment><USER5> We're working on a profile updating tool for the typical user and should have it out in the next couple of days.

In the meantime, if you're somewhat tech savvy, you can update your profile as follows:

1) download/install Namecoin-Qt or Namecoind

2) use the OneName profile builder and grab the JSON

3) calculate your WIF formatted private key from the passphrase (just a sha256 then a conversion to base58check - you can use [https://github.com/halfmoonlabs/coinkit](https://github.com/halfmoonlabs/coinkit) for that)

4) import your WIF into your namecoin client (you should now see the username in your possession)

5) perform a "name update" operation with the new JSON profile data

</comment></comment><comment><USER14> Why not use and extend the id/ [0] namespace ?

[0] [https://wiki.namecoin.info/index.php?title=Identity](https://wiki.namecoin.info/index.php?title=Identity)

<comment><USER15> "we looked into "id/", but for various reasons decided to go with an entirely new namespace. "id/" has been subject to a lot of name squatting, and we believe that by starting anew, we can provide a better experience for users."

Source : [http://www.reddit.com/r/Bitcoin/comments/201g66/onename_the_...](http://www.reddit.com/r/Bitcoin/comments/201g66/onename_the_decentralized_identity_system_for/cfyzpzd?context=3)

<comment> nezza-_- By namesquatting names yourself? I'm getting the "This OneName username is reserved for..." message too.

</comment></comment></comment><comment><USER16> Any other crypto currency on the road? Like Dogecoins?

<comment><USER5> Yes, we want to support Dogecoin soon. One simple thing we need, though, is an icon similar to the fontawesome bitcoin icon.

<comment><USER17> You mean something like this?

[http://thenounproject.com/term/dogecoin/36264/](http://thenounproject.com/term/dogecoin/36264/)

</comment></comment></comment><comment> aaron-lebo Okay, so is this just for payments, or is there a way this could serve as a way to login to different websites like Persona, oauth, or similar systems?

Do different namespaces exist? DNS at least gives a ton of different options, so if a top-level domain you like is taken, you just use .net, .org, etc.

The global namespace seems like it might get crowded really fast. How to prevent that?

<comment><USER5> A login system is definitely on the roadmap! We just decided to focus on the initial usecase of bitcoin payments.

You're right, the global namespace very well might get crowded, but we'll see how it plays out.

<comment><USER18> You should consider cities or regions as namespaces and not countries like tld, because as you see with Ukraine, Kosovo etc they change. Birthcity or village remains through generations. Language is also very crowded, names just arent unique.

<comment><USER19> I don't want my identity tied to my city or region. I might not want to give out my birth city, or I may simply not identify with it anymore.

Forced namespacing is just a poor solution. Users can add whatever namespaces they want to their own username if they want to, after all, it's just a string.

</comment></comment></comment></comment><comment><USER15> What is the process for taking the passphrase generated on the website, to being able to import it into the Namecoin-qt client?

<comment><USER5> We need to be clearer with this so apologies for the confusion. Calculate the sha256 of the passphrase to get the namecoin private key (in hex form). Then import the pk into namecoind or namecoin-qt with importprivkey.

<comment><USER15> Thanks for the response mate, I did try this but perhaps I made a mistake with spelling.

For everyones reference however, should we include the spaces when applying the sha256, or should it be one continuous string which we hash.

eg. sha256("police helicopter apple") or sha256("policehelicopterapple")

<comment><USER5> Include the spaces. Exactly as it appeared.

<comment><USER15> Thanks for the clarification, though I'm a tiny bit confused.

Using my passphrase, I can successfully generate a sha256 and then import my bitcoin client, which then provides the same bitcoin public address as shown on my profile (I left it as the default on profile creation).

This shows that I have calculated the hash on the correct passphrase (no errors). However when importing the same key into namecoin-qt I'm getting "Invalid private key (code -5)".

Am I doing something fundamentally wrong, the key should be able to be imported into both -qt clients right? One for the ownership of the bitcoin address and the other for ownership and management of the u/name. I'm determined to get my head around this

Edit:

Ok it looks like Armory will happily accept the 64 long private key, but namecoin-qt seems to prefer the 51 long keys. Perhaps in 'wallet import format'. No error anymore, still trying to determine if its worked though.

<comment><USER5> Yes, when importing the private key into Namecoin-Qt, it needs to be in wallet import format. Make sure it's a Namecoin WIF, though. You might find this library helpful: [https://github.com/halfmoonlabs/coinkit](https://github.com/halfmoonlabs/coinkit).

</comment></comment></comment></comment></comment></comment><comment><USER20> Wow. Very nice! This is _exactly_ what namecoin needs to see widespread usage. It really is a very useful system.

<comment><USER3> this is precisely my point, we love namecoin but it needs better uses/applications of the key-value interface it exposes

</comment></comment><comment> ryan-c Your code is leaking data into the i/ namespace - is this a bug?

<comment><USER5> No this is a feature. Big profiles (larger than 519 bytes) are chunked into multiple key-value entries in the blockchain. The "head" chunk has a next pointer to the next chunk and so on. The head chunk's key is the username, in the "u/" namespace. We didn't want to polute the u/ namespace with follow on chunks, so we just decided to go with "i/", but really the next pointer can go to any key in the KV you want.

</comment></comment><comment><USER21> OK, would be nice to change the pay-to address ;)</comment>


Show HN: Aurees – Git GUI for Windows, Mac, and Linux – Easy, Fast, and Free - <AUTHOR> https://aurees.com/?hn <comment><USER2> As it might be relevant: Free as in beer, not speech.

And even the free beer is limited:

> You agree that each and every e-mail address, which You use during > registration or to commit changes into a Git repository, is automatically > sent to and stored by Nezaboodka for verification purposes;

> You agree with Nezaboodka's and their partners' advertising to be shown by > the Software and to be sent to Your registration e-mail;

> You may neither disable nor block automatic updates of the Software;

> You may neither disable nor block sending of anonymous usage statistics to > Nezaboodka;</comment>


Dan Ariely: "Why is the price anchor for apps so low?" - <AUTHOR> http://danariely.com/2011/12/25/the-oatmeal-this-is-how-i-feel-about-buying-apps/

<comment><USER2> No. While I laugh as hard as the next guy at that Oatmeal comic, the reality of the situation is that these examples aren't actually true: people are /often/ "really cheap".

1) tons of people refuse to go to Starbucks: "coffee should cost $0.50; I'll just stop at McDonald's"

2) tons of people don't go to see movies when they are released: "why watch it now when I could wait a month and watch it at the budget theater?"

3) tons of people don't buy concessions when they do watch movies: "I can make popcorn at home for almost nothing; maybe I can even just sneak it inside"

4) tons of people buy Dell laptops: "why would anyone knowingly pay the 'Apple Tax'? I can get a much better computer at half the price if I go with a PC instead"

I know people who refuse to purchase soda water in bottles: they only use the SodaStream, as the compressed air cartridges are cheaper (or, more simply, drink flat tap).

Everyone knows people who sit around endlessly comparing prices on plane flights on the one hand, while constantly complaining about the decreasing in- flight meal quality on the other.

Hell, McDonald's is even trying to take advantage of this by directly attacking Starbuck's where it hurts: they are now selling stronger and more intricate coffee concoctions.

[http://www.seattlepi.com/business/article/McDonald-s- challen...](http://www.seattlepi.com/business/article/McDonald-s-challenging- Starbucks-with-cheaper-1249371.php)

This isn't because these products were introduced too cheaply (I remember when domain names cost $75/year), or even because there are lots of free comparables (people optimize fractions of a percent on their plane tickets).

People are simply cheap. If you want to list a reason for it, I'd guess "short-sighted": they expect (nigh unto demand) things to be commodity products that aren't.

I mean, how many of these people who complain about in-flight meals ask themselves "how much would I pay for a better meal"? The people I know who ask that question are already drastically different consumers.

I went out shopping for a microwave yesterday, reading reviews of the various models, and I see tons of complaints that X model only lasted a year or two.

You have to wonder: if a company makes a product for $20 less that starts to fall apart in a year (as it is held together with cheap glue and plastic that wears through), will people actually not buy it?

As far as I can tell, people still buy it, and they buy a lot of them (these are the microwaves with the largest numbers of reviews; yes, the ones that don't work even have more positive reviews, as more people are buying them).

The incentives that consumers are enforcing on their suppliers simply suck. If people looked into their purchases ahead of time, asking the right questions, and knowing what they are willing to pay for various benefits, these broken products might simply never be made.

This is why companies like GoDaddy can exist: charge slightly less than the competition (as people are cheap), make it up in the backend with irritating upsells or by directly selling your personal information.

How many people who demand unlimited bandwidth wonder how that business model possibly works? Further, how many of them wonder whether the answer is more complex than "they have secret caps"?

(For the record, the answer is pretty complex, and involves a market where application vendors such as Netflix would normally pay off carriers on the backend to get their apps onto devices; the App Store has disrupted this market.)

So, given all of this, we now have to direct our questions to the story of the app developers, to see why they think their situation is so different, and I think this is where it gets good.

First off, it isn't in fact the case that people offering cheap goods are making the most money. They have the most downloads, but are not the highest grossing.

This became really clear when Apple added a "top grossing" category: in the market where everyone was whining that apps "had to be $1 to sell", the top app was actually a $50+ GPS navigation app.

So really, developers just /think/ they are in a market where no one is willing to buy apps for more than $1, despite even more obvious high-cost examples ($10 apps from EA and PopCap).

Why? Honestly, because we have made producing and distributing goods so simple that people who are neither trained nor experienced in the numbers are now dominating it (and certainly are the ones most blogging about it).

Airlines hear complaints about pricing (or alternatively, about their meal quality) /constantly/; as does Starbucks, as do movie theaters (as does Apple itself on hardware, btw).

However, they don't care. Even if they get 10,000 complaints; /if even if they get more complaints than sales/, these are not lost customers: these are people below their chosen profit point.

I seriously see app developers who seem to be optimizing for "no complaints". They keep dropping the price point trying to find a place where it becomes a "no-brainer" so that "everyone will buy it".

However, you really need to ask: if you sell it for $10 instead of $1, do you get 1/10th the customers, or simply 1/5th? If the answer is "1/5th", you should seriously consider $10.

Notice: if you do sell it for $10, and it is really really easy for people to complain or leave feedback (internal rating/commenting systems are really bad at contributing to this), you are going to see /tons/ of complaints.

You might even see more complaints than satisfied customers, and you might even see four times as many complaints as you see satisfied customers; and yet, you made twice as much money.

This allows you to hire twice as many people, allowing you to make a much better product, allowing you to make more sales at the higher price point... this is how quality products work.

Apple has classically had a fraction of the market Dell did, but they had /such a higher margin/ that they could offer all kinds of things that Dell couldn't (such as great service).

(Which is also an important point: if you increase your price from $1 to $2, the difference in margin might be much more than "twice as much": if Apple sold their iPhone at $170 they'd make no money at all.)

Instead, developers self-select themselves into the bargain bin; they are so tied in to their negative feedback (I mean: it really does hurt to get it), that they have a difficult time realizing the positive feedback.

What people really need to do is analyze their market, think about what kinds of customers they are targeting (which might very well be "price conscious consumers"), price their product appropriately, and learn to live with some complaints.

</comment><comment><USER3> One reason is the risk involved in app purchasing. With all the other items you essentially already know what you are getting.

With apps you essentially buy them blind. A crappy app already has your money when you realise it's crap.

Uncertainty leads to a tendency to put things off.

Apps might be much better off if there was an easy way to have a free trial period/limited feature set.

One reason free apps are desirable is because there is no downside risk in obtaining them initially.

If more apps had a free trial period, be it a day or hell even an hour I think we'd see a much greater propensity for people to pay and pay more after the quick trial is open.

<comment><USER2> While this is an interesting contributory factor, the kind of feedback people get regarding pricing is epic. I have a friend who released an app for customer relationship management ("FollowUp!", or something like that; it could also be used to keep track of friends you don't talk to often enough) and got a comment that read along the lines of:

"""This app is amazing. It changes the way I do business. I use it every single day. It exactly solves my problem. However, $5 for an app? Come on, that is unreasonable."""

Additionally, there are good ways to mitigate people purchasing things "blind": in addition to having good screenshots, and a well written description (preferably one you redraft often and are A/B testing), you are also going to want a website that includes more: maybe a video.

I mean, a ton of video games are also "crap": I remember many Nintendo games I used to own that simply sucked, and where you regret having spent $35 on the cartridge. However, people still paid $35 for those cartridges, as the good games spent the time to do marketing.

At the time that meant getting into trade magazines (Nintendo Power! being an epic one, but there were tons of smaller ones that I used to subscribe to); today that would mean being covered by various blogs or online papers. A few years ago, we had a game company, and one of our three people spent most of his time just handling press.

This is no different for iPhone games either: the guy who wrote GeoDefense (one of the most popular and most profitable games for the iPhone platform) talks endlessly at conferences about how what made him successful was hiring a PR firm to handle his press announcements: he was simply covered everywhere.

With things like this in place, users aren't "buying blind": they are making informed decisions about products they heard about elsewhere, and are simply using the App Store as a payment and distribution vehicle.

(Which, seriously, is all that it is good at; too many people try to use it for "discoverability", and then end up with these very problems: users don't really know what their app is or what it does, no one finds it unless you are under top-selling, and before you know it you are stuck in a $1 price category or trying to work freemium; they are bargain-binning themselves.)

</comment></comment><comment><USER4> Because when I tried to open your page on my iPad using an acclaimed 3rd party browser (that I 'underpaid' for)...it crashed. And when I relaunched and attempted a gesture that I thought would get me back to your page it instead loaded 5 blank tabs. Generally my coffee doesn't explode and Brokeback Mountain was ... Ok. I finally got back to your site on my desktop, but generally the apps themselves are the best explanation for their cost. If you want a mildly theoretic explanation, usability and programing languages are probably where you should look... despite the sun never seeming to set on the behavioral economics empire...</comment>


Seth's Blog: No more big events - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2010/02/no-more-big-events.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+typepad%2Fsethsmainblog+%28Seth%27s+Blog%29&utm_content=My+Yahoo <comment><USER2> I've spoken with Seth a few times and like the guy. He even endorsed some software I helped build. (<http://countdowncart.com/>)

But as is his normal MO this is a half baked post thats heavy on sizzle and woefully light on steak. It rings true to a certain part of me. At the same time I have the little voice in my head I almost always hear when reading his blog. It says, "What insight! but.. but... all these ideas without execution or data are worthless."

Anyway, I like this point, and he makes many good ones, but without more information or exploration most of his posts like this seem like platitudes.

<comment><AUTHOR> His posts are becoming smaller and smaller, but I like them because they make me think. Don't agree with this one fully though.</comment></comment>


AT&T sued by Sprint, must defend decision to tell users that 4G is "5G E" - <AUTHOR> https://arstechnica.com/information-technology/2019/02/sprint-sues-att-to-stop-it-from-calling-its-4g-service-5g-e/ <comment><USER2> Words and specifications have to mean something, glad to see this. Corporations can't just change reality to their bizarre whims.

<comment><USER3> Could someone please sue Intel (possibly together with Lenovo, HP, Dell and god knows who else) for gimping the PCI Express over Thunderbolt 3 transfer speed to 22 gbit/s and yet having everyone and their dog advertise it as 40 gbit/s?? To begin with, they are feeding only four PCI Express 3.0 lanes into the controller so even without these strange limitation it would never be more than 32 gbit/s -- but it's 22. (Yes, the connector, the full bus can carry 40 gbit/s but it will only do so if you are using monitor(s) requiring more video bandwidth than a single 4K @ 60 Hz.)

[https://www8.hp.com/us/en/workstations/zbook-x360/index.html](https://www8.hp.com/us/en/workstations/zbook-x360/index.html)

> Experience faster file upload and transfer speeds with Thunderbolt™ 3 - > faster than USB 3.0 at 40 Gbps.

[https://www.lenovo.com/ca/en/laptops/thinkpad/thinkpad-p/Thi...](https://www.lenovo.com/ca/en/laptops/thinkpad/thinkpad-p/ThinkPad-P72/p/22WS2WPWP72)

> With dual Thunderbolt™ 3 ports, you can simultaneously use a 4K display and > high-performance storage device—and tap blazingly-fast speeds at up to 40 > Gbps.

These are factually false, many on the egpu.io measured it and it's 22gbps and Figure 7 in the Technology Brief clearly shows it as well. [https://thunderbolttechnology.net/sites/default/files/Thunde...](https://thunderbolttechnology.net/sites/default/files/Thunderbolt3_TechBrief_FINAL.pdf)

Targus admits so:

[https://us.targus.com/blogs/discover- targus/thunderbolt-3-us...](https://us.targus.com/blogs/discover- targus/thunderbolt-3-usb-type-c)

> at full Thunderbolt 3 data bandwidth of 22 Gbps.

Dell admits too but you need to look very hard:

[https://www.dell.com/support/article/us/en/19/sln307875/thun...](https://www.dell.com/support/article/us/en/19/sln307875/thunderbolt-3-usb- c-maximum-data-transfer-rate-on-dell-systems?lang=en)

> Thunderbolt 3 may only reach a maximum data transfer rate of around 7 to > 22Gbps even though it is advertised with 40Gbps

> Although Thunderbolt 3 is advertised with a bidirectional total data > transfer rate of 40Gbps, simple data transfer like networking data or > storage data are limited to a total of 22Gbps as per the official > Thunderbolt 3 specifications.

Why do you need to look hard? Because everywhere else, even in the single article linked from the above confession:

[https://www.dell.com/support/article/us/en/19/qna44089/thund...](https://www.dell.com/support/article/us/en/19/qna44089/thunderbolt-3-40gbps- data-transfer-rate?lang=en)

> Systems with the 2 lane design will only support up to 20gbps data transfers > over PCIe devices such as external hard drives or video cards that use PCIe. > Systems with 4 lane design will support up to 40gbps of data transfer over > PCIe depending on the device in use.

</comment></comment><comment><USER4> > "By making the false claim that it is offering a 5G wireless network where > it offers only a 4G LTE Advanced network."

Well and clearly put. While the legal proceedings are sure to be convoluted, I cannot think of a single layperson who would see a 5Ge ad and think "oh this is just 4G". Indeed even as a current technologist I didn't know this until some HN comments weeks ago.

<comment><USER5> I agree. It reminds me of Tesla calling their system autopilot for whatever reason that benefited them, and then turning around and saying it's not autopilot after people die.

<comment><USER6> Its not the same thing. "Autopilot" is not the name of an established standard. also, from Wikipedia:

 _An autopilot is a system used to control the trajectory of an aircraft without constant 'hands-on' control by a human operator being required. Autopilots do not replace human operators, but instead they assist them in controlling the aircraft._

Sounds very similar to what Tesla's feature does.

</comment></comment></comment><comment><USER7> Definitely feels like false advertising from a consumer standpoint.

<comment><USER8> Unfortunately his isn't the first time this has happened and it won't be the last.</comment></comment>


The rock that could spy on you for decades - <AUTHOR> http://www.wired.com/dangerroom/2012/05/spy-rock/?pid=1213&viewall=true

<comment><AUTHOR> To be honest, I'm surprised we have not heard more about these kinds of things. It seems like an obvious use of cheap low power cpus and sensors. Of course countries are really really big and getting dense enough coverage to make it meaningful is probably not practical in the most areas, but places like passes and roads, and around villages?</comment>


Redundancy Does Not Imply Fault Tolerance [pdf] - <AUTHOR> https://www.usenix.org/system/files/conference/fast17/fast17-ganesan.pdf <comment><AUTHOR> "Modern distributed systems do not consistently use redundancy to recover from file-system faults: a single file-system fault can cause catastrophic outcomes such as data loss, corruption, and unavailability."

Systems studied were Redis, ZooKeeper, Cassandra, Kafka, RethinkDB, MongoDB, LogCabin, and CockroachDB. Serious errors in file system fault recovery were found in all systems, resulting in crashes or reduced redundancy, and some systems even spread corruption to other replicas.</comment>