Men Arrested at Courthouse Say They Were Sent to Test Its Security - <AUTHOR> https://www.nytimes.com/2019/09/16/us/iowa-courthouse-burglary.html <comment><USER3> It's extremely important to include a clear statement of work in any pentesting contract exactly for this reason. The contents of the contract will become very important in this case, and depending on whether or not the SOW included physical intrusion into the buildings, one side or the other will end up with egg on their face.

Without the contract and/or other agreements it isn't clear who's at fault here, the pentesting firm involved may very well have been an incompetent one that exceeded their SOW or did not even produce one to be agreed on--and I tend to suspect that this is the case, because physical intrusion testing will almost always include measures to prevent the police being called or make them aware of the test due to both the expense of an intentional false alarm call and the risk involved in triggering a law enforcement response.

<comment><USER4> The company in question is Coalfire. This company assesses who can become FedRAMP compliant. They also have their pentesting team in-house, and they are fuckig sharp. They know their contracts, rules of engagement, and exactly what they are and aren't allowed to do.

These folks do this stuff for their livelihood. They test contractor, state, and fed systems at all scopes and levels.

And if 2 broke in (yes, you work in teams ABSOLUTELY onprem), they had the contract explicitly allowing physical penetration ON THEIR BODY. That contract is the difference between felony trespass and 100% legal.

I would LOVE to be a fly on the wall and watching the conversation between State IT and the public safety community there, and especially with the AG, who will have to release them.

<comment><USER5> That's right. If I had to bet who was incompetent, Coalfire or the state agency, my bet is on the latter. The state agency probably didn't understand/read the full contract or maybe some internal miscommunication through hierarchy lead to confusion about what was or wasn't allowed in the pentest. I'll be waiting for Coalfire's press release who will probably confirm the contract did allow physical pentest...

<comment><USER6> This is dealing directly with the government. I doubt we ever hear of this again if the government screwed up.

No way coalfire would embarrass a client if they can avoid it.

I feel bad for the contractors who now have arrest records. They are the victims here.

<comment><USER4> > This is dealing directly with the government. I doubt we ever hear of this > again if the government screwed up.

Exactly. We won't hear of it. They do work all across the US in the state and federal space. It's too lucrative to give up to shame them into submission publicly. Privately, sure.

> I feel bad for the contractors who now have arrest records. They are the > victims here.

Well, they've been arrested. So their clearances have been yanked already, as per standard for Confidential/TS/SCI. Unless they can get complete restoration, including expungement of the arrest, and admission of unlawful arrest, they're done in federal/state infosec.

</comment></comment></comment></comment></comment><comment><USER7> [https://www.coalfire.com/Solutions/Coalfire-Labs/Red-Team- Ex...](https://www.coalfire.com/Solutions/Coalfire-Labs/Red-Team-Exercise) does list physical testing, but who knows what the agreement was.

The case numbers are 05251 FECR042175 and 05251 FECR042176 if anyone's interested: [https://www.iowacourts.state.ia.us/ESAWebApp/DefaultFrame](https://www.iowacourts.state.ia.us/ESAWebApp/DefaultFrame). The latest appears to be that this guy is representing them: [http://www.grllaw.com/blog/attorneys/Matthew- Lindholm-A3.asp...](http://www.grllaw.com/blog/attorneys/Matthew- Lindholm-A3.aspx)

<comment><USER8> Here in Canada the prosecution would have quickly withdrawn the charges. It's pretty clear that they were acting under the color of law, given that the State admitted they hired them. If they went beyond the contract, it seems pretty clear they did it under the mistaken but reasonable belief that they had proper authority to enter. I understand ignorance of law isn't a defense but ignorance of the facts is and it seems pretty clear that's what happened here. It seems unreasonable and unnecessary to hold them in jail and unnecessary to take this to trial. I don't see how proceeding with a prosecution like this could be in the public interest.

<comment><USER9> > Here in Canada the prosecution would have quickly withdrawn the charges

There in Canada, prosecutors are not elected, because that would be completely batshit insane.

<comment><USER10> Why is this insane? At least it's some kind of accountability to the public.

<comment><USER11> It creates perverse incentives, and it actually reduces accountability.

The prosecutor's job is to represent the State by applying the law to the facts. The public doesn't pay attention to the details of every individual case. The Public looks for narratives like "tough on crime," or "protecting the children," or "cracking down on illegals" or "protecting minorities," depending on where voters fall on the political spectrum.

Elected politicians put their voters' demands first, but prosecutors are supposed to put the law and department policy first. Prosecutors would be tempted to prosecute based on political will - not guilt and evidence - <USER2> is unjust by definition. And since they're elected, they don't have to answer to the AG or city council - just the polls.

It's better to elect reps that hire/confirm, supervise and set policy for prosecutors instead.

<comment><USER12> You're just swapping one master for another.

In states that don't elect judges, they are appointed. Who makes a decision on who is appointed? The politicians of course. And you're never going to get appointed unless someone owes you it.

</comment></comment></comment></comment></comment></comment><comment><USER13> >>> Mr. Demercurio told the deputies that part of the job was to "check out law enforcement response time," the documents say

HA! There is nothing that cops like more than to participate in random timed response tests. I cannot imagine anything worse that one could ever say to a cop. Even if it is true, do not ever admit that you are "testing" police, not to the overworked, under-staffed and generally frustrated officers who are stuck working the night shift.

<comment><USER14> Well, it may be necessary to tell them, but there needs to be a backstop in place, a contract to wave around, proper identification, a live phone number to call to get confirmation, etc. The cops will still be pissed, if you weren't careful in following their instructions when they caught you then you might find yourself tasered and soaked in someone's urine (hopefully your own, I guess) But you wouldn't be, as these two are, getting charged with felony burglary.

<comment><USER15> You're 100% correct. Having done multiple red teams I would never attempt to break into a building without 1) the CEO on call, 2) a notarized statement of work identifying my and the client's identity, and 3) notarized authorization from the landlord.

If a client refuses any of these then the physical pillar is quite simply off the table.

<comment><USER16> If the "physical pillar" is off the table, would you really feel confident giving any sort of certification of security?

Kinda like a mechanic saying "I checked the brakes, this car will definitely go for 100k miles without a breakdown"

</comment></comment></comment></comment><comment><USER14> They _" did not intend, or anticipate, those efforts to include the forced entry into a building"_

Isn't that the point of the test? If you thought you were properly anticipated all attack vectors you wouldn't need the test. Or if you did, it would be to find out if you were right.

It will be interesting to see what the actual RFP or statement of work said on the matter though. If it was specific in mentioning only electronic methods, that's a problem. It doesn't seem like it should be a "Charge them with felony burglary" problem though. More like "make them pay damages" (if any)

<comment><USER17> The court is claiming it wasn't a prearranged part of the test that they were aware of. It will be up to the company to prove that it was.

> But it added that the administration "did not intend, or anticipate, those > efforts to include the forced entry into a building."

It's possible they misunderstood something in the contract such as what physical entry means and the scope of red teaming.

In the article it said they were aware of a forced entry made at another court house, but I'm assuming it was after the fact and the security company told them they did it before? If it was before the test then that changes the story but I dont know why they'd admit it to the press otherwise.

> Iowa's State Court Administration also said in the statement that it had > been made aware of a break-in at the Polk County Historic Courthouse in > nearby Polk County on Sept. 9 that was similar in nature to the break-in at > the Dallas County Courthouse.

The fact they courts aren't fully supporting the guys raises a lot of questions.

It's not like the guys were caught doing anything for personal gain. But there's a small possibility they wanted to show off their ability and keep it hyper realistic, and crossed a lined that should have been better communicated.

<comment><USER14> _The court is claiming it wasn 't a prearranged part of the test that they were aware of. It will be up to the company to prove that it was_

It should be pretty straightforward to determine if the contract explicitly specified electronic penetration or left some ambiguity. Unfortunately it looks like they won't release the contract so we won't know. (I'm sure the defense will get to see it, unless they go to Kafka land, though presumably they also wouldn't have charged these guys if there was such a large hole in the contract language.)

<comment><USER18> The contract will almost definitely go into evidence. Unless the judge makes an explicit ruling to the contrary, I believe this means that it will be made public (although access might involve a physical visit and some fees)

</comment></comment></comment></comment><comment><USER19> It's not clear exactly what happened here, but hypothetically...

If the state/public office did _not_ agree to it in contract, but if the individuals doing the breaking in a) do it for a living, and b) were operating under the knowledge that they had a contract enabling them to do so legally... what happens to them?

In this case they committed a crime, to them everything including past experience led them to believe it was explicitly not a crime. Obviously the contracting company would be ultimately at fault (at least morally so), but the person messing up the contract isn't going to go to prison for burglary.

How would this likely be resolved? Would the burglary case be dropped and it be turned into a criminal negligence case against the company? If not, how do we effectively protect physical penetration testers like this?

<comment><USER10> IANAL, especially in American law, but mens rea is usually a neccessary element for criminal liability.

<comment><USER20> Hadnt heard of the term before:

[https://en.m.wikipedia.org/wiki/Mens_rea](https://en.m.wikipedia.org/wiki/Mens_rea)

<comment><USER21> It's okay, there are a number of people in this thread who haven't. The interesting part is, legally, how there are two separate parts: intent (I intended to do this action, why car accidents are not murder) and knowledge (I knew, or should have known, this was a crime).

In this case, they could not form mens rea because, to their knowledge, they had permission to "break into" the building. Like when you lock yourself out of your house and hire a locksmith to "break in". The locksmith has intent, but no "criminal knowledge" because you gave them permission.

<comment><USER19> I guess the "or should have known" is a key part here. In most cases where the person didn't know, they should have. The difference here being that they _did_ know that they _weren't_, and they had probably taken reasonable steps to ensure that they weren't breaking the law.

<comment><USER21> Right, "ignorance of the law is no excuse", but in this case they had an exemption.

</comment></comment></comment></comment></comment></comment><comment><USER22> Reminds me of that time I hired a boxing coach and he punched me in the face, what a jerk!

</comment><comment><USER23> Well, I guess the (physical) security has been tested and found acceptable.

</comment><comment><USER24> Moving on to phase 2 of the test: Jail containment capabilities.

</comment><comment><USER24> What a surreal article.

`the administration "did not intend, or anticipate, those efforts to include the forced entry into a building."`

It seems a little crazy they went so far as to break into the building when it looks like what was actually wanted was just do a few things and sign off on our security. You know, things we "anticipate" (doesn't that defeat the entire purpose?).

Contractors seem like they went above and beyond really. Bureaucrats don't appear to like that.

</comment><comment><USER25> _> and possession of burglary tools_

Is that a crime? Like picks and stuff?

<comment><USER26> In most states, unless you are a locksmith, yes it is a crime.

<comment><USER27> >In most states, unless you are a locksmith, yes it is a crime.

This is not true. Only nine of forty one states make lockpicks illegal. [https://tihk.co/blogs/news/116232133-lock-pick- legality](https://tihk.co/blogs/news/116232133-lock-pick-legality)

</comment></comment></comment><comment><USER28> I don't understand all the secrecy in doing these types of pen-testing. Why wouldn't you just tell the cops what you intend to do and make sure everyone involved has a clear understanding of what is going to be done and what not. Personally, there is NO WAY I would have tried to break into a court for a pen-test without the cops and a representative from the state right there while I'm doing it.

Sorry everyone, but as you can see, now these employees risk criminal records and prison over something stupid. And if you think some over zealous prosecutor isn't going to see this to the end, you have another thing coming.

And the worst part about it, I highly doubt the company does ANYTHING to help these dudes. I feel so bad for them.

<comment><USER29> > I don't understand all the secrecy in doing these types of pen-testing. Why > wouldn't you just tell the cops what you intend to do and make sure everyone > involved has a clear understanding of what is going to be done and what not.

It's not really an accurate measure of response time if the responding parties are told ahead of time. That said, I would imagine the benefit of an accurate measurement vs. the cost of a heads-up is vastly different when you're dealing with first responders as opposed to a vendor.

</comment></comment><comment><USER17> I'm curious, couldn't they have warned the police or alarm security company ahead of time so they dont get accidentally shot by confused responding police? Or were they so confident/cocky that they assumed this wasn't a possible outcome? At a minimum you could warn the top managers the night in question.

Especially at a serious government building that's typically always has law enforcement during the day as security there in important. As opposed to some mid-level corporation office which they'd normally hit up.

Some precautions in the situation just sound prudent.

<comment><USER30> The police aren't supposed to be shooting unarmed people.

<comment><USER31> That's never stopped them before

<comment><USER32> Exactly. Police killed an innocent man with no gun and won't even charge the policeman who opened fire.

[https://www.usatoday.com/story/news/nation/2019/09/15/casey-...](https://www.usatoday.com/story/news/nation/2019/09/15/casey- viner-ohio-gamer-prison-swatting-call-of-duty/2336255001/)

Heck, the state will not even tell the cops name who executed a civilian at his own door.

<comment><USER20> If that had been in Florida it would of been revealed.

</comment></comment></comment></comment></comment><comment><USER33> So from the sounds of it the courts hired coalfire to do pen testing but neglected to mention it should be electronic only so they attempted physical access?

<comment><USER34> Pentesting works the other way, you need to scope things in, not out. Otherwise you'll get into all sort of legal and ethical issues.

</comment></comment><comment><USER35> UPDATE: [https://www.desmoinesregister.com/story/news/crime-and- court...](https://www.desmoinesregister.com/story/news/crime-and- courts/2019/09/18/iowa-courts-dallas-county-courthouse-coalfire-contract- judicial-branch-test-security-ia-crime-arrest/2356047001/)

HN: [https://news.ycombinator.com/item?id=21012191](https://news.ycombinator.com/item?id=21012191)

</comment><comment><USER36> Reminds me of this story posted a while ago:

Story of a failed pentest [https://news.ycombinator.com/item?id=18475438](https://news.ycombinator.com/item?id=18475438)

</comment><comment><USER37> So now, next question. Have they done anything in there. They've caught the intruders, good on them. But as a security guy myself I am asking: did they check ALL electronics for tampering as well as do a basic bug sweep.

I am not saying it was, in fact I don't think the courthouse who let's them rot in jail now gives a damn, but a thorough test could also test whether after catching intruders the court bothers to check their equipment. Something added/manipulated is sometimes worse than something stolen.

</comment><comment><USER38> They appear to be employees of Coalfire Labs.

"The State Court Administration hired Coalfire Labs to test the security of the court's electronic records, said Steven Davis, a spokesman for the state judicial branch."

Mr Demercurio's LinkedIn page appears state that he employed by that organisation.

I understand that hubris is followed by nemesis...

</comment><comment><USER39> i can just imagine the scene: cops: you are under arrest for breaking and entering. pentester: we were just checking your security. you passed! congratulations!

sorry couldn't resist /getscoat

</comment><comment><USER40> Successful test!!

</comment><comment><USER41> This shows such a comical level of incompetence from Iowa's state admin that it borders on malicious.

</comment><comment><USER42> Sounds like they were authorized and the court administration just made a mistake in the contract.

</comment><comment><USER43> It is confirmed(allegedly) they also broke into Polk County Courthouse two days earlier -

[https://www.desmoinesregister.com/story/news/crime-and- court...](https://www.desmoinesregister.com/story/news/crime-and- courts/2019/09/16/iowa-polk-county-courthouse-dallas-burglaries-linked-same- two-suspects-judicial-branch-coalfire/2343135001/)

<comment><USER44> I'd be very interested to learn who hired them / their firm. Hope we find out!

<comment><USER45> We know who hired them. Read the article. Iowa's State Court Administration contracted with Coalfire, of which the two men are employees.

<comment><USER44> Doh. I skimmed the article and missed that. Thought they might have a common client for both Iowa and Texas and therefore it was likely to be something federal / higher up.

Thanks for correcting

</comment></comment></comment></comment><comment><USER46> What sort of pentesters was that who didn't specify and get a signed off code of conduct _before_ they did a physical pentest? Having a paper to wave in front of the arresting cops is more important than the promise of money. Jesus. Amateurs.

<comment><USER47> What's more likely, a big pentesting company messed up this one engagement, or the state is incompetent and doesn't understand pentesting? I'm leaning towards the latter.</comment></comment>


Tell the FCC what you think about the T-Mobile Buyout - <AUTHOR> http://fjallfoss.fcc.gov/ecfs/upload/begin?procName=11-65&filedFrom=X

<comment><AUTHOR> It's interesting to see the number of filings per docket in the last 30 days too: <http://fjallfoss.fcc.gov/ecfs/hotdocket/list>

This one has 3,386. The next closest has 389.

</comment><comment><USER2> Isn't this more a FTC/DoJ issue than an FCC issue? Anti-competitive mergers are more general than just the FCC specifics. Besides, I wouldn't think the FCC would have the jurisdiction to oppose the merger in any meaningful way. Am I mistaken?

</comment><comment><USER3> I actually don't think the merger will be approved.

If I had more guts, I'd go short on AT&T stock right now.</comment>


How do you dress for work? Do you have dress code? - <AUTHOR> I work in a IT department of Construction Company. Most people are project managers / directors / accountants / administrators. Since they dress formally, our IT department follows the formal dress code too. However, I'm not so keen on it and would love to wear something casual. What do you guys wear to work? <comment><USER2> I dress no differently than I would any other day to feel like myself and be confident. I absolutely refuse to work for any company with a dress code. The only exception is that I wouldn't wear something that could be considered offensive or with swearing on it. There's no specific rule against it, but I wouldn't want to offend a coworker unintentionally.

</comment><comment><USER3> No dress code. I try to dress "presentable" should anyone care what I look like, but if I'm tired I usually go to work in whatever I had on (likely hoodie, jogging pants, slippers). If I feel fancy I will wear a suit jacket and nice shoes.

<comment><AUTHOR> Wouldn't the slippers cause WorkSafe issues?

</comment></comment><comment><USER4> I've been working in software in San Francisco since 2001: i wear shorts and a collared shirt every day. I never have to interact with clients, though. I wear long pants when I interview for new jobs ;)

</comment><comment><USER5> We have a pretty lax dress code. I ain't client-facing, so I come in wearing a T-shirt and jeans on the regular.

</comment><comment><USER6> Ironically I dress the same every day. There's no dress code here. You can dress as "comfortable" as you want.</comment>


EA Admits SimCity Could Have Run Offline - <AUTHOR> http://www.forbes.com/sites/erikkain/2013/03/17/ea-admits-simcity-could-have-run-offline-went-against-developers-vision/

<comment><USER2> Maxis, not EA. And this isn't "admits it could have run offline" but "tells us they changed conceptual direction from single player to multiplayer at the design stage".

Why is this on HN?

<comment><USER3> > __ _Why is this on HN?_ __

Because it is in our industry - and people on HN often follow all aspects of issues and stories related to our industry.

(Our industry being high-tech and computers in general - get the fark off your "only- __ _hacker_ __"-related-news-that-exactly-matches-my-ego-should- actually-be-posted-here horse)

<comment><USER4> Dude, dont be that way. You could have made your counter-argument without the nastiness.

<comment><USER3> How is stating that one is on a high-horse nasty?

Too often, people say "why is this on HN" without actually thinking about how some of the stories and information may actually be of interest to people of this community.

Further, it appears that such statements are more often coming from a sense of superiority and its really annoying.

</comment></comment></comment></comment><comment><USER5> Old news is so exciting! (And, yes, two days in this day and age is an eternity as far as the news cycle is concerned)

[http://www.ea.com/news/simcity-update-straight-answers- from-...](http://www.ea.com/news/simcity-update-straight-answers-from-lucy)

</comment><comment><USER6> "The game we didn't envision, design and build, the game that doesn't exist, could have run offline"</comment>


Ask HN: What are your thought on online communities using shadow banning? - HN-Censorship <i> <comment><AUTHOR> It's extremely useful to isolate people from the wider community, and if you do it properly it's not detectable. It definitely has its place, but it's just a tool and can be misused like any other tool.

If you get a guy creepily flirting with every female that signs up and making them leave the site, hide his comments on profiles of females he's not friends with, if you've got a spammer that is trying to give away 'free trump gear', then make their posts only visible to them, if you've got a group trying to police your site by looking for 'socks' just make all their posts invisible to other members etc.

Straight up banning people only works as a last resort, they'll trash your network to anyone who listens, or worse set up a rival etc.

<comment><USER2> > It's extremely useful to isolate people from the wider community, and if you > do it properly it's not detectable. It definitely has its place

Absolutely agreed -- consider the impact of Russian bots on the 2016 U.S. elections. There will always be malicious actors in every social system. If you do not isolate them, their perverse ideas will spread like a cancer through the population.

</comment></comment><comment><USER3> Easily circumvented if you care. Call them out on it if you do. First and foremost, don't be a dick.

</comment><comment><USER4> Shadowbanning is reasonable and appropriate against bots, but a massive dick move when applied to humans.

</comment><comment><USER5> I think it's insulting (not just to the one shadow banned) and high handed.

</comment><comment><USER6> Just grow some balls and publicly ban people.</comment>


Update to Microsoft Takedown – Domains Fully Restored - <AUTHOR> http://www.noip.com/blog/2014/07/03/update-microsoft-takedown/ <comment><USER2> The existence of the case has been unsealed, so here's the latest docket: [http://ia902509.us.archive.org/20/items/gov.uscourts.nvd.101...](http://ia902509.us.archive.org/20/items/gov.uscourts.nvd.101935/gov.uscourts.nvd.101935.docket.html)

Looks like there was a stipulation filed on July 1 to transfer the domains back to No-IP, although the actual document isn't accessible in PACER.

<comment><USER3> I found the TRO that pulled the trigger:

[http://www.scribd.com/doc/232961396/MSFT-Temporary- Restraini...](http://www.scribd.com/doc/232961396/MSFT-Temporary-Restraining- Order)

<comment><USER2> That was published by Microsoft before the case was unsealed, so that one has been known for awhile, nothing new. [http://www.noticeoflawsuit.com/](http://www.noticeoflawsuit.com/)

</comment></comment></comment><comment><USER4> noip.me got seized as well? ".me is the Internet country code top-level domain (ccTLD) for Montenegro." \- [https://en.wikipedia.org/wiki/.me](https://en.wikipedia.org/wiki/.me)

How did this happen? Since when did Montenegro fall under U.S. jurisdiction?

I thought my personal domain (andrewkelley.me) was safe, but now I'm not so sure.

<comment><USER5> .me is operated by Afilias, a US corporation.

<comment><USER6> Afilias is an _Irish_ corporation, not a US one.

<comment><USER5> An Irish holding company. Actual technical registry operations are handled by Afilias USA, Inc. and subject to US law.

</comment></comment></comment></comment><comment><USER7> Has Microsoft gained from this fiasco, or lost? Not sure.

<comment><USER8> Microsoft seized the domains in order to discover command-and-control servers of a few botnets.

Now... whether or not Microsoft seizing another legitimate company's property without any notice is legal/ethical is another question (one that probably should get more attention).

<comment><USER9> Microsoft seized them by court order, I don't see how was it without notice or how could they have done it illegally.

<comment><USER8> Yes, the question was along the lines of, why is Microsoft seizing other company's property, even _with_ a court order... sounds to me like Law Enforcement should have done the actual seizure, even if Microsoft is consulting for them.

And there was no prior warning to noip.com -- they woke up one day and their domains were seized. They only found out why after the fact -- and, given the nature of free Dynamic DNS services, it's very unlikely noip.com was even aware that a botnet was using their services (the justification for the seizure).

And, I can't help but feel Microsoft could have obtained the same data by politely asking noip.com -- nobody likes to harbor botnets (and we have no reason to suspect noip.com of trying to do so). Seems domain seizure was heavy-handed at best.

<comment><USER10> > And there was no prior warning to noip.com -- they woke up one day and their > domains were seized. They only found out why after the fact -- and, given > the nature of free Dynamic DNS services, it's very unlikely noip.com was > even aware that a botnet was using their services (the justification for the > seizure).

No-ip was _DEFINITELY_ aware of it. OpenDNS published an article in April 2013 identifying no-ip as the top used provider for malicious use [1] and a representative from no-ip posted a comment on that article which proves that no-ip was aware of it.

Cisco published a similar article on February 11, 2014 [2]. We know that no-ip was aware of this because they posted a comment in response, and posted a blog entry about it at their site [3].

[1] [http://labs.opendns.com/2013/04/15/on-the-trail-of- malicious...](http://labs.opendns.com/2013/04/15/on-the-trail-of-malicious- dynamic-dns-domains/)

[2] [http://blogs.cisco.com/security/dynamic-detection-of- malicio...](http://blogs.cisco.com/security/dynamic-detection-of-malicious- ddns/)

[3] [http://www.noip.com/blog/2014/02/12/cisco-malware- report/](http://www.noip.com/blog/2014/02/12/cisco-malware-report/)

<comment><USER8> You seem to be missing the point.

They (noip.com) had zero pre-warning of a domain seizure. Regardless of any literature you dig up from years ago that states some botnets use Dynamic DNS services such as noip.com, it does not mean they had warning they were about to be seized. Others have commented that the court order forbid anyone, including Microsoft, from informing noip.com prior to the seizure.

It should be noted, that most/all "cloud" services likely have some sort of illicit behavior being conducted through them... Ec2, Azure even, etc. Botnet's use the same services me and you do... that does not for even a second make noip.com responsible for the botnet's actions.

<comment><USER10> You wrote: "it's very unlikely noip.com was even aware that a botnet was using their services (the justification for the seizure)".

The links I cited show that this is incorrect. No-ip was aware.

<comment><USER11> "We would like to be on the record to state that at No-IP, we have a very strict abuse policy. Our abuse team is constantly working to keep the No-IP system domains free of spam and malicious activity...We provide a valuable service for free, but because of this, it is common for users to abuse our service. Our abuse team is amazing and they are usually pretty quick to shut them down, but sometimes a few can slip through the cracks".

No-ip was aware of the potential and had an abuse team to deal with such cases. They were also aware of other experts finding their abuse team wanting. But that doesn't seem to be enough evidence to suggest they were partly culpable in any particular case. Perhaps there were examples of particularly galling incompetence in their abuse team, or the abuse team tipping off fraudsters but otherwise informing them seems to be the most reasonable and responsible action.

<comment><USER12> > abuse team

Every domain provider must have an abuse team or at least an address to send abuse notices too [[http://who.is/whois/cloudapp.net/](http://who.is/whois/cloudapp.net/)], that PR statement from No-IP states no facts or figures of many abuse notices they combat - which I would cite if my abuse team actually did stuff "look how amazing our team is - we had x,000's requests and took down x00 of malicious hosts just last month."

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Url changed from [http://threatpost.com/all-seized-domains-returned-to-no- ip/1...](http://threatpost.com/all-seized-domains-returned-to-no-ip/107028), which points to this.</comment>


Commodore 16 and Plus 4 8501 to 6510 CPU conversion - <AUTHOR> http://hackjunk.com/2017/06/23/commodore-16-plus-4-8501-to-6510-cpu-conversion/ <comment><USER2> I initially confused the 8501 with the 8051 which is a totally different architecture. However, a quick Wikipedia trip taught me that the 8501 is a later variant of the 6510 so they're pretty much compatible. Still very impressive of course, especiall the part of re-writing the kernel to fit the different pin-out.

</comment><comment><USER3> Now, that's interesting. Haven't looked at the article yet, but would like to note the C-128 actually used an 8502 processor, which I'd bet was a sibling/successor to the 8501. I never realized the +4/16 processor was a different one, too. I would have expected it to be just the same as the 6510 the C-64 used. Very interesting!

</comment><comment><USER4> finally!! Some love for the ole Plus/4! No one knows about that machine, but it's the one that got me started with programming so many years ago. Mostly because there was nothing out there for it and user groups had very little for them.

This CPU project is cool, but no SID or VIC means you still can't game on them...sigh...

<comment><USER5> There are games for the plus/4 and 16. Check out [http://www.commodore16.com](http://www.commodore16.com) which has a game database as well as a forum of Commodore TED machine enthusiasts.

The biggest difficulty I've found with gaming on these machines is the difficulty in finding joysticks that work with them, since Commodore decided to give them mini-DIN game ports instead of the DB9 ports used by virtually all other Commodore machines (including the Amigas). It is possible to make an adapter, however.

</comment></comment><comment><USER6> Gorgeous act of love. The c64 gets the lion's share of attention, but these machines deserve some time.</comment>


Stellar Smart Contracts - <AUTHOR> https://www.stellar.org/developers/guides/walkthroughs/stellar-smart-contracts.html <comment><USER2> If I'm reading the docs right, the Stellar smart contracts are extremely different from Ethereum smart contracts - in fact, it almost feels like a stretch to call them the same name. Like "animals" vs "plants".

Ethereum smart contract are actual virtual machines. They are tiny computers that run whatever bytecode you want. You could calculate pi to a million decimal places in a smart contract, if you had the money for gas.

Stellar smart contracts, on the other hand, are simpler. A transaction can only choose from 13 operations (Buy, make offer, change trust, etc). On top of the operations, you can add some restrictions to the transaction - Stellar has support for built-in multi-sig, built-in start and end time limits, and built in transaction grouping. By combining these restrictions, grouping transactions, presigning this, and handing out that, you can make something that's smarter than a single person doing a single transaction.

As an Ethereum blockchain developer, using Stellar smart contract feels very limiting, and outside the simple cases, very convoluted.

<comment><USER3> The Stellar smart contracts seem to function like versions of Bitcoin Script transaction types with more features. For me this seems like a more appropriate direction for transaction abilities in comparison to Ethereum's approach, which has more capability but also massive room for implementation error.

<comment><USER4> I see room for both, at least until Ethereum is more mature (and maybe longer).

</comment></comment></comment><comment><USER5> Stellar isn't decentralized. Just like Ripple, it uses Federated Byzantine Agreement, which means that nodes use a list of other nodes they trust. The fact that this scheme has nothing to do with the concept of a decentralized cryptocurrency, aside from the hype train, doesn't appear to have percolated into the collective mainstream or even geek consciousness yet.

<comment><USER6> This is why Stellar probably doesn't count as a real "blockchain." It's also why Stellar is potentially a lot more useful than blockchain. You don't have to do proof of work, which is wasteful of resources by design.

Note that the cryptocurrency people use the word "decentralized" differently from the rest of the world. They use it specifically to mean that the mechanism for determining consensus is perfectly distributed among an unknown number of arbitrary nodes.

Stellar consensus _is_ decentralized in the conventional sense. Federation is a form of decentralization.

<comment><USER7> There are plenty of consensus protocols that don't waste energy but I think it's important to understand why PoW relies on an unproductive algorithm.

Mining fulfils two roles:

\- identity management: To identify who is a trustworthy block producer in an anonymous and trustless network, mining introduces a cost to the block generation process and we use a game theory assumption that it serves as a barrier for attackers. This doesn't mean there aren't validation checks performed by other nodes in the network and the consensus forming rules themselves of course.

\- consensus formation: In a distributed network, nodes are bound to disagree on which is the canonical chain out of two or more competing forks. The most common algorithm calculates the accumulated computational effort of each chain of blocks and picks the "heaviest" one, ie the one with the most work done on it. This has the nice side effect of ensuring economic finality for the transactions in those blocks.

Now, regarding decentralisation you state that "the cryptocurrency people" use it wrong, but the definition you gave is incorrect. As a cryptocurrency person, Vitalik Buterin described decentralisation here: [https://medium.com/@VitalikButerin/the-meaning-of- decentrali...](https://medium.com/@VitalikButerin/the-meaning-of- decentralization-a0c92b76a274)

<comment><USER8> > There are plenty of consensus protocols that don't waste energy but I think > it's important to understand why PoW relies on an unproductive algorithm.

DPoS consensus used by Bitshares/STEEM & EOS seems to the most advanced among the models and they also have the highest TPS

<comment><USER7> All consensus protocols make tradeoffs between three properties:

\- Finality Latency: how fast is a block finalised after it's been proposed

\- Decentralisation: how many consensus-forming nodes can exist in the network

\- Resource Overhead: how many blocks per second do consensus-forming nodes need to verify

dPoS protocols sacrifice decentralisation and compromise in resource overhead for apparent performance, ie many transactions processed by a few very powerful servers.

The game-theory and security aspects of a blockchain like its censorship resistance, immutability or who can produce the next block are also relaxed to a level that many blockchain professionals consider unacceptable. Case in point the formation of cartels is incentivised by the dPoS delegation of vote mechanism. Corruption is baked in.

I wrote a short intro to consensus protocols a while back if you're interested in knowing a bit more: [https://medium.com/@jpa_of_snc/consensus-casper-and- cryptoec...](https://medium.com/@jpa_of_snc/consensus-casper-and- cryptoeconomics-in-15-minutes-or-less-c7ca2427bf88)

</comment></comment></comment></comment></comment><comment><USER9> > As a reminder, smart contracts are created using code. Code can contain bugs > or may not perform as intended. Be sure to analyze and agree upon all > possible edge cases when coming up with the conditions and outcomes of the > smart contract.

Predicting all possible edge cases of a piece of software has been proven to be very hard in the past (there have been software bugs that literally killed people).

Why would I ever agree to let software ALONE enforce a contract? And if there is a human process to override the outcome of the contract, what advantage does it have over a "dumb contract".

I just find the whole idea of computers enforcing law very unsettling.

<comment><USER10> Smart contracts allow you to completely shortcut intermediaries and their fees in the case where everything goes right or can be checked objectively by an algorithm (ex price of a commodity on a particular platform at a particular time).

With a multisig escrow account, if you and your counterpart both agree to transfer the funds, or both agree to unlock the funds, there is essentially no fee to give away to anyone else. If something goes wrong and you don't agree anymore, well then you can involve authorities from the real world.

<comment><USER11> but the issue at hand is the case where the multisig contract has a bug and one party (or even a third party) can trigger a transfer of funds or render the funds inaccessible.

<comment><USER12> Just do a symbolic execution of the code and prove that your intended behavior holds.

A multisig contract is an utterly trivial program. It is easy to prove correct.

<comment><USER11> > Just do a symbolic execution of the code and prove that your intended > behavior holds.

So... Introduce a human to the process? This is the exact issue we're talking about.

> A multisig contract is an utterly trivial program. It is easy to prove > correct.

Even if it is, we're not just talking about multisigs. This process should scale up to more advanced smart contracts or this whole "innovation" is just replacing escrows, which is a greatly diminished innovation from the actual claim of smart contracts.

<comment><USER12> How complex smart contracts are needed? I think we should keep them simple.

</comment></comment></comment></comment></comment></comment><comment><USER13> Both of the examples (2-Party Multisignature Escrow Account with Time Lock & Recovery, and Joint-Entity Crowdfunding) have been possible with Bitcoin for some time.

<comment><USER14> But aren't Bitcoin transactions slow and expensive?

</comment></comment><comment><USER15> I recently started moving our token from Ethereum to stellar for the simple reason that I came to the conclusion that Ethereum is too far from being production ready to be of use in an application that has actual users that generate any kind of sizable amount of transactions. Ethereum is cute until you have use cases and uses that require it to actually process transactions. The Ethereum ecosystem is a big mess right now.

All the proper solutions for this are years out from being production ready and widely used. I'm talking about sharding, proof of stake, etc. It's going to take several hard ethereum forks to get there. I think Vitalik is thinking 2020/2021 type time frames currently for this. I would not be surprised if that shifts some more. This stuff is hard. Until then, smart contracts on ethereum are only useful for very limited volumes of transaction that, so far, have been mostly about ICOs for shit coins. Essentially all of the transaction volume on Ethereum is trading in these coins. So, unless you are doing an ICO to raise funding, Ethereum has no practical value whatsoever. And given the scams happening there, it is not a great place for that either.

Some people use side chains to work around this, i.e. a centrally run private blockchain. There are several proof of stake based platforms with smart contracts in the works (e.g. hashgraph, IOTA). Mostly that stuff is really immature (or not ready at all) and lacking the broad user base that bitcoin and ethereum have. Bitcoin is nice but useless for custom tokens. There are not a lot of options here that are usable now, scalable, and reasonably widely used (critical if you are going to lock up millions $ in value in it).

Stellar may not be perfect but it works right now and it scales and it is reasonably widely used. They have built a few things into stellar that largely remove the need for centralized things like exchanges or convoluted smart contracts that need auditing. This is why it is gaining a lot of traction lately.

Specifically: \- any stellar account can issue tokens \- any stellar account that trusts (this is stored in stellar) those tokens can receive those tokens \- any account can create offers to buy/sell any tokens (that they trust) on stellar \- when offers are matched by a counter offers, the trade happens.

There are no websites where you need to go to get your token listed, no middlemen to bribe/deal with, no transaction fees (beyond the 1/10^5th of an XLM), no smart contracts to write. This stuff works out of the box. You can be up and running in minutes if you know what you need to do.

If you want to issue a token on stellar the process is as follows: \- create an issuing account with a minimal XLM balance \- create distribution account \- make your distribution account trust your FOO coin issued by the issuing account \- pay some FOO from the issuing account to the distribution account. This creates the token. Paying it back to the issuing account destroys it. \- write a stellar.toml file with some meta data and put it on your domain foo.com in the .well-known directory. This tells your users and exchanges what your coin is, who issued it, etc. \- set foo.com as the home domain on the issuing account \- fiddle with the issuing account options to further control things (multi sig, preventing more tokens from being issued, etc.)

Done. They have lots of other stuff built in that is highly useful like federated accounts, a compliance protocol for people to pre-clear transactions, etc. If you start reading the documentation, it becomes very clear that this was developed by people who deeply understand the needs of those that develop complex financial products.

To trade tokens, you simply create offers and counter offers on stellar. This works right away. The recently launched Stellarx.com is just a pretty UI around the built in functionality.

To get listed on stellarx, you need some positive evidence of trading happening with your token. I think this currently means evidence of a (small) trading volume and a minimum number of accounts that hold your token. Other than that there are no bribes, listing fees, etc. I imagine that over time the requirements for this will change and there will be competing websites getting involved as well.

People making the point that stellar is a centralized system are of course somewhat right. However, it is a system that can be used right now and you can easily scale it to meaningful numbers of transactions. The shared database of transactions that stellar produces can be validated by anyone and if you run a full node, that's exactly what it does. So, it's not as black and white as this being 'controlled' by a single entity. In practice the companies that are active on stellar end up running their own nodes and validators. Many people do.

<comment><USER16> That was very informative, thanks! I was having the same impression about Ethereum, that the ecosystem was becoming wider and ever more complex, but still not very practical to actually use. How does Stellar compare to EOS? AFAIK EOS uses the same approach of federation / trusted nodes, and is also a platform for smart contracts, so it would be interesting to see a comparison.

<comment><USER15> I haven't got much experience with EOS. My feeling is that they are a bit newer to the scene than stellar in terms of adoption/traction. They only launched this summer and stellar has been gaining traction since late last year so they are a bit ahead on that front. Regardless of what you pick, you are taking a leap of faith in long term viability/stability of what you pick.

We went for stellar because we saw some traction there, kind of liked the notion of being in an ecosystem with a bit more serious players, and we liked what it did functionally.

<comment><USER17> What do you define as traction? CoinMarketCap shows EOS trading at significantly higher daily volumes than Stellar.

<comment><USER15> I tend to look at developer traction: people converting money into code as a good signal that smart people are deciding to give it a shot. Logically, since it has been only about 3 months since they launched, there cannot be a lot happening yet in terms of companies launching products based on EOS, running EOS related infrastructure, etc. I did not look at Stellar for the first half of this year for the same reason. That changed when I started hearing about people using stellar or switching to it from Ethereum around the same time I started having serious doubts about being able to run our product on top of Ethereum any time soon. I wanted to understand why stellar was suddenly a thing and found that there was a pretty mature ecosystem of companies and developers using it already. I'm not getting that kind of vibe with EOS yet.

In any case, a lot of blockchain related trading is speculative and most of that is not based on technical merit but the investors irrational perception on the chance of exchange rates going up or down. Speculators make lousy CTOs, so I tend to ignore them for technical decision making.

So, EOS doing brisk trading beause ETH holders are panicking and acting like lemmings, or because Vitalik farted in a particularly interesting way, or whatever madness of the day drives the market does not constitute meaningful developer traction in my view. It just means EOS core development is likely well funded for the next few years. Good for them.

<comment><USER17> So are you considering developer traction to be platform age and what people you know are working with?

I'm not trying to be argumentative. I personally like Stellar over EOS as well, but I haven't seen the same developer traction advantage that you're seeing. At least on Stack Exchange, EOS is more active despite being half the age.

</comment></comment></comment></comment></comment></comment><comment><USER18> One thing I've found impenetrable about Stellar is the use of the XDR data format. I've never encountered this before and it's been a painful step in starting to build on their platform.

Are their any simple, introductory texts on it? A lot of stuff is from Stellar themselves.

I'm sure there are good reasons for using it, the rest of the platform looks simple to understand and well designed.

<comment><USER15> It's a simple binary format similar to e.g. protocol buffers. You write an idl and then generate code for different languages. The reason they went for this is that is compact. This kind of matters because this stuff is actually stored in stellar in large quantities.

It's a pretty old ietf standard actually. I recently had a discussion on this on their slack channel making the point that the choice for this was a bit unfortunate given that this is a relatively obscure format with not a lot of developer ecosystem around it.

Because of this, the stellar guys are actually maintaining their own code generation tool for this because there's nothing else out there apparently. It's called xdrgen. It generates code for a few languages. If you want to understand xdr, that's a good place to start. You can find the idl in stellar core.

I actually have an open bug for the java code generation with them, it generates broken code currently.

<comment><USER19> Any idea why they picked XDR rather than something that is more widely used in the present day, like Thrift? That is efficient on the wire, and pretty widely supported:

[https://thrift.apache.org/docs/Languages](https://thrift.apache.org/docs/Languages)

<comment><USER15> they wanted something standard and I guess did not realize that the IETF standard for XDR is not that widely used. I agree it would have been nicer if they went for something like thrift instead. However, it's done and I don't think they can fix this without breaking compatibility.

I do wonder why XDR sort of failed to get used and why people went ahead and created protocol bufs and thrift as alternatives.

</comment></comment></comment></comment><comment><USER20> From a legal perspective, this is very interesting. The concept of escrow has existed for centuries I suppose. It needs three parties, A (origin), B (escrow) and C (destination). An escrow is only needed, because A and C don't trust themselves enough. Trust is a basic necessity in any contract and providing trust is a extremely valuable service.

In (Austrian) civil law, there is something called "acquisition in good faith", which allows a third person under certain circumstances to lawfully acquire full and unrestrained ownership of a good from someone who does not have the rights to transfer full and unrestrained ownership of said good.

Example: A wants to sell a laptop to C, but doesn't trust him until he has fully paid the price. They agree to use an escrow agent B. A gives B the laptop and C gives B the money/price. Now what happens if B doesn't acts in bad faith and decides to sell the laptop to the third party T? Well, if T isn't colluding or doesn't have to suspect that B is acting in bad faith, he (under certain conditions, that are most likely met in this case) can acquire full and unrestrained lawful ownership of that laptop. A is only left with claims on account of unjust enrichment against B, but has zero chance of getting his laptop back if T refuses to give it back. In that case it may not be problematic, because A only wanted the money, although he now has to take B to court and B maybe insolvent and so forth. The problem is more poignant if the laptop wasn't a laptop, but something very unique that has no equivalent monetary worth.

And here smart contracts help: they make it impossible to transfer certain goods before certain conditions have been met. The ensure trust. That's why I believe this technology is very valuable.

tl;dr: smart contracts are very valuable, because the ensure trust.

<comment><USER21> The escrow used to be a trusted third party though. Blockchain moves the "quantity of trust previously assigned to the escrow agent" to the two parties. If one party disputes for some reason the algorithm this can't be settled automatically. With a trusted human escrow agent, an abnormal situation would probably end with him sharing part of the blame , which help resolve the conflict in a way that is not fair, but surely blame-able. There is nobody to blame with a machine though.

</comment></comment><comment> onion-soup Great to see smart contract technology unfolding before our eyes.

<comment><USER22> Is it? Really?

As far as I'm aware the oracle problem still exists, the problems of having to get data onto the blockchain from external, trusted sources.

In real-world contracts the problems don't arise over the simple execution of contract, they arise when intent is muddied or missed by words, when terms are unfair, overly onerous or legally unenforceable. Given this, there are very, very few situations in which smart contracts appear to be a good idea, particularly as you talk about anything more than trivial amounts of money.

The world just isn't that black and white.

<comment><USER10> It is, yes.

Most transactions that occur daily across the whole world involve trivial amounts of money.

If I want to sell you a 300€ dishwasher, for example, I can either require cash, ask for a check/bank transfer and pray it doesnt bounce, or involve a 3rd party whom i trust in which case I will have to forego a % fee for their escrow service, maybe 30€. With a smart contract, I can now be sure the buyer's funds exist and are locked before we meet. Then we shake hands, we load the dishwasher in their car and we both release the funds before parting way. I just saved myself a 10% fee and the buyer wasn't forced to get cash from an atm.

<comment><USER23> > funds exist and are locked before we meet

What does _locking_ funds entail?

<comment><USER23> In the hypothetical dishwasher example, what is the buyer's incentive to lock up funds before even physically inspecting the item? What is my recourse if a spiteful seller refuses to agree to releasing my funds if I decide not to go through with the purchase?

I'm not being facetious. I'm trying to understand why one would need to use an escrow service for something like this.

<comment><USER10> Buyer and seller enter a smart contract where the buyer's funds are locked for two days, then freely recoverable by the buyer only after the contract expires. That proves to the seller that the funds exist at no risk to the buyer.

A day before the contract expires, buyer and seller meet up to inspect the goods. Upon inspection, seller hands over the goods and buyer validates the release order in front of him before departing, thus completing the contract before its expiration.

Infinitesimal cost, infinitesimal risk.

</comment></comment></comment></comment></comment></comment><comment><USER24> IOHK has Smart Contracts too (Cardano)

[https://iohk.io/blog/cardano-smart-contracts-testnet-iele- la...](https://iohk.io/blog/cardano-smart-contracts-testnet-iele-launches/)

</comment><comment><USER25> Stellar is a waste because it's a great idea with a super cool protocol but with a useless shitcoin (XLM) all mixed up in the system.

I'm waiting for someone to rewrite Stellar to not have to use that shitcoin (if you need it for antispam, use Bitcoin Lightning donations, whatever), and also use it for other things, like federated DNS or a federated Wikipedia.</comment>


Demo of Jeff Raskin's Zoom World user interface [links to video]  - <AUTHOR> http://rchi.raskincenter.org/index.php?title=Demos#The_Zooming_User_Interface_Demo

<comment><USER2> Feels like using AutoCAD to me.</comment>


Facebook is terrible. But as I was grieving, it was a lifesaver - <AUTHOR> https://www.vox.com/first-person/2019/1/16/18183686/facebook-social-media-grief-grieving-widow <comment><USER2> This is something I have been talking about recently around the whole Facebook data breach/trust scandal, for those people that feel the need absolutely trash Facebook. No matter how much people might want to hate on Facebook, threaten to leave and talk about all of the supposed "benefits" its had on their lives quitting.

I feel like people have become far removed (And maybe Facebook has as well) from how life was when Facebook came along and the impact it had on us. I remember Facebook being this clean version of MySpace or MSN and everyone was jumping on it, soon I was sharing content on a clean looking website getting likes and comments, connecting with friends and family in ways I'd never done before. And it did such a great job because people of all ages were getting on board. At the time I was in boarding school and so being able to communicate with my friends and wider family was important and Facebook was the best way for me to share it with everyone.

There have been some issues with Facebook of late, and they have publicly announced they are aware of these issues. Not just issues in relation to data privacy, but issues such as effects on our mental health. And I personally have seen improvements to the type of content that shows up on my feed. This is also partially mentioned in the article where she says her relationship with Facebook is still complicated and that if she spent too much time on the platform she felt more depressed, but when she used it communicate with others, she felt lighter. The effects of social media on mental health are only recently coming to the forefront and is a reflection of the world of social media not just Facebook itself.

So when we bash Facebook, lets not forget the social network it brought us and the extremely challenging environment it made of itself with the amount of data it collects and uses. That only now we are considering important to be protected, something that not many companies around the world are getting a real grasp on.

My response to the article is well, is Facebook really all that terrible if you found valuable social connections by using the platform as it was always intended? I think not.</comment>


Microsoft's new Xbox controller designed entirely for players with disabilities - <AUTHOR> https://www.polygon.com/2018/5/17/17363528/xbox-adaptive-controller-disability-accessible <comment><AUTHOR> This looks like a technological marvel. The hardware is at a relatively low pricepoint that could even appeal to input hobbyist.

More coverage:

[http://xbox.com/adaptive-controller](http://xbox.com/adaptive-controller)

[https://www.theverge.com/2018/5/17/17363964/microsoft- xbox-a...](https://www.theverge.com/2018/5/17/17363964/microsoft-xbox- adaptive-controller-announced-price-release-date)

[https://www.engadget.com/2018/05/17/xbox-adaptive- controller...](https://www.engadget.com/2018/05/17/xbox-adaptive-controller- disabilities-gamepad-microsoft-tour/)

Videos:

Announce: [https://www.youtube.com/watch?v=9fcK19CAjWM](https://www.youtube.com/watch?v=9fcK19CAjWM)

Exploration: [https://www.youtube.com/watch?v=wEKIAHrugZ4](https://www.youtube.com/watch?v=wEKIAHrugZ4)

First look: [https://www.youtube.com/watch?v=KfnmCUFxZwA](https://www.youtube.com/watch?v=KfnmCUFxZwA)</comment>


Ask HN: Are you interested in becoming a technical cofounder? - <AUTHOR> Hello!
I'm creating a social network that allows users to purchase affiliate products directly from within the network.  I need a technical cofounder to help me get it off the ground.  I'm currently based in Fort Collins, Colorado, but am open to moving wherever we'll have the best chance of succeeding (NYC, Seattle, Austin, Boulder, etc.).
So far, I've designed the app, and done some light user testing with different Flinto prototypes.   I'm in the process of putting together a full prototype and getting more users involved in testing.  I've also done some work to game the app to make it more engaging.
I'm looking for a technical cofounder to choose a stack and do the MVP development work so we can get to the first round of funding.  I've been to some startup events and meetups, but I haven't found anyone that doesn't have ideas of their own they're trying to create.
I need help.
- Is anyone interested in being a technical cofounder?
- Does anyone know anyone that is interested in being a technical cofounder?
- Do you all have any advice on where to find a technical cofounder?
A little about me:
I'm a Cal Poly grad with a degree in Economics, Finance, and Statistics..  I worked at Apple for about 7 years in both Finance and Project Management.  Most recently I worked for a fast growing YC startup and was able to hone my user experience skills, gain a working knowledge of startups, and learned a ton about design.  More personally, I'm an avid skier, hiker, backpacker, and definitely geek out on Star Trek and Star Wars to a semi-obscene degree. <comment><USER2> If I were you I would do following: 1\. If you have worked in a big Co for 7 years then I assume you have some money saved up.(Or some discretionary savings for entrepreneurial activities?)

2\. I would allocate around 20k from my saving and hire somebody(a developer or two) from toptal or codementor and then build the MVP. I am sure you will find some great developers on those sites who won't mind building the MPV if you pay them per hour. You can even negotiate a lump sum for the entire MVP project.

3\. Then start aggressively acquiring users.

4\. Next convince the working developers to come onboard as a full time and become technical-cofounder.

I am sure there are few caveats to this approach

This is my personal suggestions though. Take it with a grain of salt.

<comment><AUTHOR> Hey! Thanks for the suggestion. I'll definitely consider that route, it's been something I've been looking at in a variety of forms.

If you happen to know anyone specific that you'd recommend, I'm all ears!

</comment></comment><comment><USER3> I am interested. We can have the application built. I have sent you an email. If you have not received it, you can reach me through Skype as well.

</comment><comment><USER4> What's your plan for acquiring users? I've built several small social networks, and the biggest issue is always getting new users - and keeping them active.

The technical part is more or less a front-end, a back-end and some databases.

<comment><AUTHOR> Want to build a big one? My plan to acquire and keep users is to create a fun, engaging, and rewarding experience. Let me give you an example. Let's say you're a huge fan of skateboarding. So you follow Tony Hawk on our network. Tony post a rad pic of him doing some insane trick. Being a huge fan, you like many other people may be thinking, "I wonder what board he's riding?" With our network Tony can tag the board he's riding, right down to the bearings and trucks, and you and the rest of his followers can then purchase them. Also, consider SnapChat as a great example, the idea isn't world changing, but it is really fun, and people respond well to fun.

If you're interested please shoot me an email telling me about yourself, the projects you've worked on, and any examples of your work that you feel comfortable sharing. email@example.com

<comment><USER5> That's an interesting idea, but why does Tony Hawk want to spend the time tagging all the parts in his skateboard? Does he get a commission?

<comment><USER3> Maybe Tony Hawk's fans can do all the work in exchange for some credits which can be used for other things.

Through gamification, tagging and user participation can be done.

</comment></comment></comment></comment><comment><USER6> Best of luck to ya Robby, where do you suspecy users most likely engage on this network? That might help find a co-founder.

<comment><AUTHOR> Thank you! I suspect early on our key markets are going to be fitness, fashion, and skiing, but mostly because I have the most connections in that world, and those things are already popular.

<comment><USER7> Suspect? That means you don't have customers or know where to find them. Prove that first. Otherwise you're just another business guy offering nothing in exchange for 100k+ worth of technical skill.

<comment><USER8> Oh, get over yourself please. HN has this huge disdain for "business guys" but there are tons of "hackers" that aren't worth their salt either.

This guy has already been through YC, and been at Apple for 7 years (where you need to be a hard worker to last). His idea may or may not be good, but I can bet he's gonna work his ass off.

<comment><USER7> I'd say the same to tech side who obviously didn't do Customer Development and wanted a B-side role.

Working your ass off is not sufficient to ensure success.

<comment><AUTHOR> By "suspect" I meant those are the customers that I can see the need already. I understand the sentiment of needing validation to commit significant time to an idea, but I'm also a big believer in rapid prototyping and getting something in a limited number of users hands to work the kinks out before going for large traction. It's the classic chicken and egg problem. Can't have users without a product, can't build a great product without users.

</comment></comment></comment></comment></comment></comment><comment><USER9> I don't exactly understand what you are building. Are you suggesting something like RetailMeNot?

<comment><AUTHOR> To the best of my knowledge RetailMeNot is a coupon site. This isn't coupons at all. Let me give you an example. Let's say you're a huge fan of skateboarding. So you follow Tony Hawk on our network. Tony post a rad pic of him doing some insane trick. Being a huge fan, you like many other people may be thinking, "I wonder what board he's riding?" With our network Tony can tag the board he's riding, right down to the bearings and trucks, and you and the rest of his followers can then purchase them.

If you're interested please shoot me an email telling me about yourself, the projects you've worked on, and any examples of your work that you feel comfortable sharing. email@example.com

<comment><USER9> So you aggregate all fb, Twitter etc updates of tony hawk and put them in your app?

</comment></comment></comment><comment><USER10> Does location matter?

<comment><AUTHOR> Good question. I'm looking for someone US based, and preferably in a startup hub. As with a lot of startups being nailed down to a location is a bit of a negative because you often have to move based on where your investors are, or if it's decided that an accelerator is a good route to go. Where are you located?

<comment><USER10> Sydney

<comment><AUTHOR> Please reach out to me privately, and we can see if this would be a good fit. firstname.lastname@example.com

Thanks!</comment></comment></comment></comment>


The Washington Post is preparing for post-cookie ad targeting - <AUTHOR> https://digiday.com/media/were-building-for-media-businesses-of-tomorrow-how-the-washington-post-is-preparing-for-a-cookieless-future/ <comment><USER2> > what URL they have used to arrive there

This is yet another example of why sending the Referrer header is _insane_. It's a massive privacy breach _by design_. Anything serious about protecting privacy needs to stop intentionally betraying the user's browsing path and simply remove the header from all HTTP requests.

Anything that functionally _relies_ on a valid referrer is at best an unfortunate but necessary casualty. However, I suspect that far too often this is simply a way to obfuscate the usual tracking. If you tie your functionality to something designed to violate user privacy, don't be surprised if that functionality breaks when the privacy leak is finally fixed.

<comment><USER3> "something designed to violate user privacy"

I fail to see why sending the referer is a privacy concern. Following that logic, every datapoint is a privacy concern. From screen resolution to mouse movement, everything can be abused to build profiles. Referer headers have a host of valid usecases but if you are opposed any data being shared you'll probably dismiss all of them.

<comment><USER2> > I fail to see why sending the referer is a privacy concern.

From the article:

>> The Zeus platform monitors contextual data such as ... what URL they have used to arrive there ... The publisher will then match that data to its existing audience data pools ... to create assumptions on what that news user's consumption intent will be. The technology uses machine learning to decipher the patterns.

They are explicitly stating they use Referrer-like data to track users.

<comment><USER4> > They are explicitly stating they use Referrer-like data to track users.

To me, "track user" means persistently ID one person. This sounds more like inferring anonymous interest, like inferring that someone arriving from ESPN.com might be interested in your sports section.

If that person comes back tomorrow from The Financial Times, you might infer that they are interested in the economy.

But without cookies, I don't see how you would recognize that visit as the same person as yesterday and integrate the sports and economy interests into a persistent profile. Each visit would be self-contained, which doesn't fit my definition of "tracking."

<comment><USER5> > But without cookies, I don't see how you would recognize that visit as the > same person as yesterday and integrate the sports and economy interests into > a persistent profile.

If you gather enough of that "anonymous" data, and particularly if you combine it with other data sets (as they claim they are intending to do), then it's not that hard to recognize individuals based on their usage patterns and metadata.

<comment><USER3> But does it matter if you don't know who they are?

<comment><USER5> It does to me.

<comment><USER6> Why?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Total online ad spend works out to about $1/person/day in the US.[0]

We have collectively sacrificed our privacy because we're collectively not willing to pay $1/day for what used to be called newspapers and magazines ($1/day is equivalent to subscribing to a daily paper or a couple magazines, as most people did in days of old). There is a cost to providing news. The industry made clear it preferred to sell subscriptions but consumers collectively said no I want free beer and laughed at newspapers and magazine publishers for being so stupid as to try to sell subscriptions. Having been told no I won't pay for subscriptions the industry was dragged forcibly from what was unquestionably its preferred subscription model into the ad tracking supported model we have today. All because costs people can see (subscriptions) are less palatable than far higher costs they can't see (ubiquitous tracking).

[0] [https://www.vox.com/recode/2019/6/24/18715421/internet- free-...](https://www.vox.com/recode/2019/6/24/18715421/internet-free-data- ads-cost)

<comment><USER8> > we're collectively not willing to pay $1/day for what used to be called > newspapers and magazines

> The industry made clear it preferred to sell subscriptions but consumers > collectively said no

That's not how I see it.

People were happy to pay for cable TV and get no ads. But ... cable channels were all too happy to take that payment AND the money from ads. Magazines and newspapers aren't any different, and neither is the internet.

I would be happy to pay $1/day, even twice as much, to not be tracked. There is no one I can pay that to, and there never was; and if such a thing would have existed, they would still likely start tracking at some point, as happened with cable TV and ads.

<comment><USER9> That's not anywhere near enough. The guy who can pay is worth way more than the guy who can't pay. The $1 is the arithmetic mean but the distribution isn't uniform.

<comment><USER8> And the end result is that the people who are not willing to pay $1/day are subsidizing me, the person willing to pay much more - because the currency is ads and tracking — of which I opt out as much as I can through uBO, uMatrix and a variety of other tools.

</comment></comment></comment></comment><comment><USER10> All of this money and effort to create something that has never scientifically been proven to work: Super-targeted ads, instead of contextual ads.

The context is already there. Each article on a newspaper already provides the context.

What is the true purpose of this? The true purpose is psychological control and manipulation, as well as making additional money with the data beyond ads.

Psychological manipulation gives the ability to actually create demand. And this is what this is about, because that's the only way to actually increase revenue in a meaningful way.

If you can target a person everywhere on all channels, and all the time, you can do things that are not possible with simple contextual ads, and the profiles that are being created are for lots of different purposes, not for ads.

I wait for the day some newspaper actually does an in-depth investigative study into the level of manipulation that drives sales in ad-tech, because I suspect that the entire system feeds off low-educated and poor people, for example lower-class stressed-out people who struggle to lose weight and are prone to manipulative ads. This is the target audience that you can manipulate into spending 500$ instead of 50$.

<comment><USER11> > All of this money and effort to create something that has never > scientifically been proven to work: Super-targeted ads, instead of > contextual ads.

Have you worked in the field? Because I have, and I can tell you that ads targeting works. I've built some of these systems that people love to hate on HN. Hundreds of PhDs at Yahoo Labs, Google, FB etc have worked on this for decades and run thousands of A/B experiments. Are you saying that all these people are fraudulent / incompetent and that somehow the whole market cap of Google and FB combined (above 1 trillion dollars) is just a complete fraud?

Contextual advertising works, but much less than behavioral targeting. Anyone who has seen and worked on the data knows that.

Knowing that you just visited Best Buy website 10 minutes ago and searched for a camera is _much_ more relevant to figure out which ad to show you on nytimes.com right now than the content of the article you're reading on nytimes.com

<comment><USER12> > Knowing that you just visited Best Buy website 10 minutes ago and searched > for a camera is _much_ more relevant to figure out which ad to show you on > nytimes.com right now than the content of the article you're reading on > nytimes.com

The concern here is that you're just selling a camera that they were already going to buy. So the ad agency wins, Best Buy _thinks_ they win because they register a conversion, but you didn't actually create any value.

In my experience when the PhDs say "this doesn't work," the PMs say "that's fine, because we still get to say we have machine learning [insert other buzzword] and the customer thinks it's delivering value."

> Contextual advertising works, but much less than behavioral targeting. > Anyone who has seen and worked on the data knows that.

I admit this is possible, and my gut feeling is that properly implemented targetted ads should be immensely effective, but theory isn't implementation, and I'm taking your word on it either way.

<comment><USER13> Driving the user back to BestBuy.com to convert into a concrete sale seems much more valuable than "well, they searched for cameras so they might come back one day and pull the trigger. Fingers crossed!"

Why wouldn't Best Buy pay for that?

I search things on Amazon all the time without checking out. Those aren't locked in as eventual purchases at all. There are even things in my Amazon cart as we speak that I probably won't buy. I'm often a mere teeter from pulling the trigger. Coming home drunk or being reminded at the right moment sometimes push me over the edge.

There's obvious value in giving me the right shove.

</comment></comment></comment></comment><comment><USER14> Is this Jeff Bezos's influence?

Things I would never have imagined a big old newspaper having their IT team whip up:

> The Zeus platform monitors contextual data such as what article a person is > reading or watching, what position they have scrolled to on a page, what URL > they have used to arrive there and what they're clicking on. The publisher > will then match that data to its existing audience data pools, which it has > accumulated over the last four years, to create assumptions on what that > news user's consumption intent will be. The technology uses machine learning > to decipher the patterns.

<comment><USER15> Yet another extremely compelling reason to simply disable all javascript (and other active content) by default.

<comment><USER16> For me it works like this: the default is disabled. When something doesn't work (actually The Washington Post works great, much better than with JS on), I esitmate the tradeoffs: if it's a really useful website with JS functionality that is actually useful to me (say, with JS doing the math notation rendering or an app I badly need), I enable JS. Otherwise, why bother?

JS is like ads used to be: first they put it everywhere, then you get fed up and just switch it off.

<comment><USER15> Do you block all JS, including 1st party and inline scripts, or only 3rd party scripts and resources?

I've used uBlock Origin to block all 3rd party scripts and frames for a while, but I'm seriously considering going full default-deny all scripts and other active content.

<comment><USER17> Not the GP, but I block all scripts by default with NoScript, then selectively enable them, starting with the first-party scripts. I've learned to identify likely tracking domains and have memorized several of the more widespread ones, so over time this technique has proven effective.

<comment><USER18> Why would you need to memorize them when you can just mark them explicitly untrusted?

</comment></comment></comment></comment></comment></comment><comment><USER19> It should be noted that the so-called "cookie law" is about more than just cookies. It's about all user data and who can access it and for what reason.

If this more tightly controls who user data is given to then that is a big improvement. If it's just trying to find technical loopholes in the law... well EU law tends to take a dim view of that.

</comment><comment><USER20> If I type in the address bar a URL or click a bookmark rather than click a link, is the referrer still sent?

<comment><USER21> If they don't see a referer, then they can assume that you typed in the URL or bookmarked the page.

That could signal higher intent than someone clicking a random clickbait link to your site.

Other events could prevent the referer from being sent too, but you can filter some of those out using other tracking methods and looking at user behavior.

<comment> dao- > If they don't see a referer, then they can assume that you typed in the URL > or bookmarked the page.

... or followed a link from an IM or some other source outside of the browser. Too many possibilities to really assume anything and draw conclusions.

</comment></comment></comment><comment><USER22> WashingtonPost has been ahead of the curve on this for a while. Here is my anecdotal experience with their tracking.

WashingtonPost allows a non subscriber to view a few articles per month and if you went over the limit it would require a login. I had been able to circumvent that by clearing out my cache, cookies and local storage or using the anonymous mode. But now that does not work anymore.

I am able to work around this by disabling javascript. Your move WashingtonPost!

<comment><USER23> Well, the next move looks obvious to me.

</comment></comment><comment><USER24> Could Firefox's containers be extended, and include an option to resist fingerprinting?

This would limit the information sent by the browser (maybe run everything in a lightweight VM with standardized performance, feature and settings), including the referrer used to open the containerized tab (which might be done already).

The VM sounds complicated, but we already have qemu running in browsers. Reduce the timing granularity, randomize I/O slots, and lie about the RTC, and fingerprinting becomes much harder, unless I am missing something?

Side note: I am against fingerprinting me across websites as an individual, but I am perfectly OK with fingerprinting me about my interests, provided everything is done in a stateless manner: if I spent more time on the technical section, which 80% people skimmed over, maybe offer me more technical articles at the bottom?

But please, do not keep information about me. Tracking would be illegal under the GDPR provisions anyway, AFAIK, cookies or not.

<comment><USER25> If I understand it correctly, this is what tor browser does, in addition to using the tor network itself to as-close-to-anonymize you. Tor browser has warnings that encourage you to not-resize your browser because that could be used as fingerprinting data.

<comment><USER24> Well, I was thinking about enabling those on specific domains only (leveraging the container feature).

An interesting (research) approach would be to taint the data that can be used as fingerprinting, and forbid its exfiltration, perhaps with different levels of aggressiveness.

Example: a webGL game requires my wwindow width, GPU capabilities, etc? fine. But now, the thread that has this data cannot send anything to the other threads.

It would require some adjustments, and tightening the side-channels (making available download bandwidth/timings/etc more granular, for once). I do not expect it to be completely fingerprinting-resistant, but it would go a long way.

</comment></comment></comment><comment><USER26> Once they have better tracking, wonder if they would use it to manipulate news items on a per-customer basis. That is show one news item to this person but not to that person. Or maybe change the tone or phrasing in the articles.

> The Post plans to license the Zeus platform to publishers both domestically > and internationally

Does that imply data sharing as well?

<comment><USER27> > That is show one news item to this person but not to that person.

I imagine they do this to some extent already. Personalization is nothing new.

<comment><USER26> > Personalization is nothing new.

It is for ads, and newspapers adjust their content for different regions. But I wonder if they intend to do what they do for ads for news stories. They may choose to hide some, bring some to the top or even reword them. So if I go to WaPo's front page, I'll see different "news" than what my co-worker next to me sees.

<comment><USER5> > But I wonder if they intend to do what they do for ads for news stories.

I actually pay money to read the WaPo. If they started "personalizing" the news like that, I'd cancel my subscription and stop reading them at all.

There are a lot of things that I think are made worse by personalization, and what news reports I get to see is toward the top of that list.

</comment></comment></comment></comment><comment><USER28> I'm surprised WaPo isn't trying something simpler and more disruptive: making a point of selling non-targeted ads. Targeted ads may be somewhat effective at selling a specific product, but they're creepy and they don't help build a brand. Non-targeted ads are not creepy and signal that a brand is legitimate.

Of course, it's much harder to apply metrics to this type of ad, since conversions aren't the point.

Daringfireball.net does this kind of non-targeted advertising. I would love to see a major publisher (other than TV) try it.

<comment><USER29> I'll not say it would be impossible to run a general news website this way, but Gruber's website is basically pre-targeted already. Advertisers know pretty much _exactly_ what they're getting with his audience - affluent, tech- focused Apple-aficionados with disposable income. It works great for him and his advertisers, but isn't a generalizable example.

</comment></comment><comment><USER5> If I understand what they're proposing, this is a method of ad targeting that I don't actually object to. It doesn't involve spying on me, identifying me, or tracking me (either on or off the internet).

It's closer to, but not completely, how ad targeting should be done -- based on the context the ad appears in rather than trying to figure out my own personal characteristics.

</comment><comment><USER29> I admire steps taken to improve the privacy of ad-supported media ecosystems, so this effort by WaPo should be applauded on it's own. Their results, taken along with NYT's switch back to content-only ads in the EU [1] might help spread the word that all the creepy ad-tech isn't even necessary or beneficial!

That said, I'd like to make a simple request of media outlets... Please build a rate plan which provides all of the benefits of subscription, adds the expected profit from advertising, and then _let me buy it to experience your content ad- and tracking-free_. Please!

[1] [https://digiday.com/media/gumgumtest-new-york-times-gdpr- cut...](https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut-off-ad- exchanges-europe-ad-revenue/)

<comment><USER29> A case study in this: The New York Times

In 2018, it made $202MM in revenue from digital display advertising. [1] Averaged across an annual reader base of 125MM worldwide, or 91MM in the U.S. alone [2], that averages out to just $1.62 or $2.22 per customer. _Let us pay it to opt-out!_ Where is the harm?

[1] [https://s1.q4cdn.com/156149269/files/doc_financials/annual/2...](https://s1.q4cdn.com/156149269/files/doc_financials/annual/2018/updated/2018-Annual- Report-\(1\).pdf)

[2] [https://nytmediakit.com/digital](https://nytmediakit.com/digital)

</comment></comment><comment><USER30> Are there any ad networks out there that do not track users?</comment>


Pattern Analysis of MegaMillions Lottery Numbers - <AUTHOR> http://www.omninerd.com/articles/Pattern_Analysis_of_MegaMillions_Lottery_Numbers

<comment><USER2> The analysis is interesting but it needs to come with tests of statistical significance. Are the trends observed really inconsistent with random variables?</comment>


New Australian Cloud Computing platform gets launched today - <AUTHOR> http://orionvm.com.au/

<comment><USER2> Thanks for the shoutout! You can follow us @orionvm We are online and available to answer questions both here and via twitter.

</comment><comment><USER3> Like all servers based in Australia, traffic is still ruinously expensive. $1 _per gigabyte_ in and out.

This is why I have and will continue to host all my sites in the USA. It annoys me but I'm not made of money and I don't see why I should pay so much of my hard-earned to Optus and Telstra through a third party.

<comment><AUTHOR> Thats a fair point, I used to pay Telstra 19c /Mb when starting an ISP back in the late nineties - it doesnt look like much has changed in that regard where Telstra is concerned. However I see OrionVM as a great option for those clients of mine that flat out refuse to be hosted outside Australia and to my suprise there are more of these than I thought there would be.

<comment><USER3> If you can afford the Telstra tax, hosting in Australia is a no-brainer. You can shave hundreds of milliseconds of page loads. But I can't afford it for self-hosted sites doing over a hundred GB of traffic per month -- the standard bandwidth overage charges _alone_ are roughly quintuple the _entire_ monthly cost of a Linode VPS.

<comment><USER2> This is true, unfortunately the cost of bandwidth in Australia is very high even for service providers such as ourselves. That being said we currently don't have the scale to leverage our data consumption to decrease costs through peering etc. For now $1/Gb places us one of the cheaper providers for bandwith in Australia. We do however see data ingress as a significant hurdle to cloud adoption so we will be foccussing on reducing these costs in the future. :)

<comment><USER3> I know it's not your fault, but it's one of the reasons that the Australian internet market is so rooted.

<comment><USER2> Aye. :( Ahh well, in time things will get better.</comment></comment></comment></comment></comment></comment>


Windows 8 Kernel Memory Protections Bypass - <AUTHOR> https://labs.mwrinfosecurity.com/blog/2014/08/15/windows-8-kernel-memory-protections-bypass/

<comment><USER2> So it's just an "if we would have a hole, we could use it." They used the "recently patched" hole (that is, the unpatched system) for their submission to Microsoft, and the custom kernel driver they crafted for this article. Unsurprisingly, Microsoft's response was "yes, we know, no, you don't qualify."

<comment><USER3> It is an impressive piece of research that bypasses several key pieces of kernel protection. It could definitely be utilised by a kernel mode exploit in the future to expand limited access into a full blown piece of running kernel code.

I don't really have an opinion on Microsoft's response one way or the other. They get to set the rules on their own bug bounty and that is that. Also to fix this would almost certainly require a large scale kernel re-write (as the article itself alludes to).

<comment><USER2> As far as I understand, their demo is dependent on their _kernel mode driver_ through which a user mode application can write to _any memory address_ with the "root" privileges.

So it demonstrates that if you already have the "root" "write" privileges, you can bypass the protections provided by the kernel. I fail to see what exactly is impressive then.

Raymond Chen would probably cite the following segment from "The Hitchhiker's Guide to the Galaxy"

""We're trapped now aren't we?"

"Yes," said Ford, "we're trapped."

"Well didn't you think of anything? I thought you said you were going to think of something. Perhaps you thought of something and didn't notice."

"Oh yes, I thought of something," panted Ford. Arthur looked up expectantly.

"But unfortunately," continued Ford, " _it rather involved being on the other side of this airtight hatchway._ " He kicked the hatch they'd just been through."

</comment></comment></comment><comment><USER4> In case you're a little confused, as I was, by the step from "can tag arbitrary user memory as kernel executable" to "get the kernel to execute it", the technique used by the PoC is (apparently) well-known enough not to mention:

[http://poppopret.blogspot.com/2011/07/windows-kernel- exploit...](http://poppopret.blogspot.com/2011/07/windows-kernel-exploitation- basics-part.html)

Short version: You can overwrite a function pointer entry in the HAL dispatch table that will be called by NtQueryIntervalProfile().

<comment><USER5> They allude to this in the introduction: "requires only a single vulnerability that provides an attacker with a write-what-where primitive"

</comment></comment><comment><USER6> the point of this is simple: if you have a kernel vulnerability that allows you to construct a write-what-where primitive (or even something lower like an arbitrary inc/dec, although it is most of the time possible to transform vulnerabilities into the former mentioned), you are able to turn it into a fully blown kernel-mode code-execution using that technique. this is what bypassing mitigation-techniques is all about: turning a vulnerability into code-execution. in particular, the technique eliminates the need to use ROP in order to bypass SMEP and DEP, this is why it is a big deal. the only reason that it was not considered eligible for microsofts Bluehat-Program is the fact that it is a kernel-land mitigation bypass, not a userland one.

<comment><USER7> What seems even more interesting about it, is that it's directly related to the paging structures in x64, making it potentially applicable to kernel mode exploit mitigations on any OS running there (MacOS X for example).

It's a great example of why kernel mode exploit mitigation is unlikely to ever reach the same level of effectiveness as in user mode.

</comment></comment><comment><USER8> The blog post mentions PoC code but I couldn't find it linked anywhere? Anyone find it?

</comment><comment><USER9> A meta question: Why is this post so high on HN? It's not particularly new and it doesn't have particularly many upvotes. Does HN have a list of websites/blogs it prefers? I'm not saying this post is bad though it is outside my field of interest, but I don't really understand the ranking mechanism.

<comment><USER10> I did not see anything on your profile to contact you directly, so I will share this here:

How Hacker News ranking really works [https://news.ycombinator.com/item?id=6799854](https://news.ycombinator.com/item?id=6799854) (~9 months old)

How Hacker News ranking algorithm works [https://news.ycombinator.com/item?id=1781013](https://news.ycombinator.com/item?id=1781013) (~4 years old)

Hacker News Charts and Data [https://news.ycombinator.com/item?id=8075216](https://news.ycombinator.com/item?id=8075216) (~1 month old)

Hacker News Rankings [http://hnrankings.info/](http://hnrankings.info/)</comment></comment>


Group Text – Schedule Emails and Texts - <AUTHOR> https://apps.apple.com/us/app/grouptextbot/id1458478374?ign-mpt=uo%3D4 <comment><AUTHOR> Group Message is an iOS app that allows you to schedule texts or emails to automatically send at specific times.

The messages are stored on the developers sever and then sent from a server chosen number.

There are costs associated with each scheduled message but very useful for sending out marketing promotions or any time sensitive message.</comment>


Ask HN: Extending C - <AUTHOR>

Just for fun, I'd like to extend C with a few control structures, wrapper functions, and maybe even overload bits of the standard library. What's the most portable way to do this? A header file? Writing some preprocessor code? <comment><USER2> I second the notion of a front-end like CFront. It's a fun exercise. It took me about a week to do a Pascal to C translator a couple of decades ago. One problem is that the grammar for C is not context free. If you are using a top down parser, it's probably manageable, If you are using yacc, bison or the like, you will probably need some kind of parser or lexer hack. Unfortunately, I cant remember where the problem lies.

Ordinarily I would recommend getting a ready-made parser, but they usually generate an abstract syntax tree and often throw away things like formatting and comments that you want in your generated code. I also recommend using Python or your favorite scripting language. Doing it in C hurts the flexibility that you want in your experimentation.

</comment><comment><USER3> 'overloading' the standard library is simply a matter of some #defines that make funcx call my_funcx, that's easy.

If you want to mess around with language features such as control structures and such then you probably will have to write a pre-processor of your own that parses your language accurately and outputs the corresponding 'C' code.

The macro system will quickly run out of steam when you start doing things like that.

</comment><comment><USER4> Perhaps the way that C++ started (CFront): write a front-end to the language that maps your additional language constructs to C.

Another lesson from C++ (there are probably many) is to be careful with C compatibility, it's not always as easy as it seems.

</comment><comment><USER5> Wrap some preprocessor macros in a header file, if you must. Or use a macro language to preprocess your source, such as m4, although that's probably dirty.</comment>