Hacking Imgur for Fun and Profit - <AUTHOR> https://medium.com/@nmalcolm/hacking-imgur-for-fun-and-profit-3b2ec30c9463 <comment><USER2> These programs are great in the sense that companies are starting to accept security research and appreciate responsible disclosure instead of non/full disclosure.

However, and I know this is not a popular opinion and that most people argue they do it "just for fun". But in my mind the "just for fun" argument is nothing more than an excuse for letting large corporations* use you. Seriously, swag? Your hourly salary is minimal wage. What about all the time you spend studying? You should get payed like everyone else. Even if you really think it is that much fun, why wouldn't you want to be able to make a living out of it? Your knowledge should be (and are!) valuable.

I don't really have a solution. Maybe time is the answer. Globalization does not make it easier as the bounties are quite large from the perspective of some countries.

What do you guys think? I think it is time we start valuing our knowledge. No one will do it for us.

* If it is a start-up, non-profit, or a corporation you believe makes the world a better place the situation is different, obviously. Nothing wrong with volunteering your knowledge.

<comment><USER3> Cyber security is a paying profession and I don't think bug bounties undercut that. A company that's not willing to pay and wants to put in place a bug bounty will get what it pays for, which is a mystery to them and us. Others will pay.

Fin Tech companies, for instance, have regulations that require a professional audit every year. We recently paid out over $25k for one of them (and it was worth it, their guys found some extremely subtle vulnerabilities).

Also hacking on sites for fun and profit is fun and something some people like to do in their spare time. So some people are gonna do it no matter what.

</comment></comment><comment><USER4> I'm not nearly as adept at pentesting but out of curiosity, is there an established point at which you just don't go and farther? Like a point between "get a $5000 bug bounty" and "CFAA charges and prison time"? The author mentions this at one point but it seemed like more of a gut feeling of not being too intrusive.

When I read about this stuff, it seems like half of the articles end with some company either patching or not patching their security holes with some tester maybe making some money and the other half end with someone being charged for accessing public-facing data that wasn't meant to be accessed.

<comment><AUTHOR> For me, it boils down to two questions:

1\. Does pursuing the vulnerability further benefit the research? 2\. Would it cause any damage?

If the answers are yes and no, I'll happily see where it takes me and re- evaluate as I go on. With bug bounty programs it's generally expected that researchers are going to poke and prod at things which they otherwise shouldn't, although some programs do specifically state their objections to pursuing issues further. Facebook, for example, would rather you find an issue and report it straight away while others might admire your creativity to show exactly what an attacker could do.

</comment></comment><comment><USER5> Congratulations on being such a Nice Guy. Do you feel good about helping an unassailable and unaccountable titan of a given niche further cement their dominance, and getting practically nothing in return?

<comment><USER6> _> Congratulations on being such a Nice Guy._

The alternatives are to be a criminal or let tens if not hundreds of thousands of users risk being compromised. I rather dislike Imgur - but if I discovered a vulnerability I would still report it to them.</comment></comment>


A fast gesture recognizer based on the PennyPincher algorithm, written in Swift - fe9-lix http://fe9lix.github.io/PennyPincher/

<comment><AUTHOR> The paper isn't linked from the article, here it is: [http://www.eecs.ucf.edu/isuelab/publications/pubs/gi2015_eug...](http://www.eecs.ucf.edu/isuelab/publications/pubs/gi2015_eugene.pdf)

It's a neat trick: instead of trying to work with the (x,y) points of a gesture, and worrying about rescaling/translating to match, it resamples the template and gesture into n vectors each with the same length, and the comparison is then just the sum of the angle differences in corresponding vectors in the two lists.

<comment><USER2> So, gestures that involve strokes radially outward or inward might be fairly difficult to distinguish?

<comment><AUTHOR> I imagine it would have difficulty with letters that differ only in scale (x, X) but for things like varying stroke order, stroke direction to achieve the same mark - which is I think what you're getting at? - the paper suggests just recording more templates for the glyph works well.</comment></comment></comment>


Google, Facebook and the Ad Block Wars (an interview with Cory Doctorow) - <AUTHOR> https://blog.getadblock.com/google-facebook-and-the-ad-block-wars-9322b732fafc <comment><AUTHOR> An interview with Cory Doctorow.

<comment><USER2> I think you should put that in the title, I don't think this would count as editorializing.

<comment><AUTHOR> Done. Thanks.</comment></comment></comment>


Lisp in about 200 lines of Ruby - <AUTHOR> http://gist.github.com/220035

<comment><USER2> Lisp in about 100 lines of Python:

<http://www.flownet.com/ron/lisp/l.py>

<comment><USER3> Please instruct your httpd to serve *.py files as "text/plain". Right now it's forcing a download. Win32 FF.

<comment><USER2> It's being served as text/x-python, which I think is appropriate. So it's not the server that's "forcing" a download, it's your client. I suspect you're using FireFox, which seems AFAICT to be b0rken in this regard.

</comment></comment></comment><comment><USER4> A micro-Lisp compiler (to x86 executable) in about 100 lines of OMeta: <http://www.vpri.org/pdf/m2009011_chns_mng.pdf>

examples given which run about 70% of the speed of equivalent C code.

<comment><USER5> That's a nice one, albeit several simplifications are made in there (e.g. from a quick glance I could not find anything dealing with scopes [the prefixing with "_V_" for variables might probably hint at its non-existence]).

Nevertheless, impressive work from one of the most interesting projects around.

</comment></comment><comment><USER6> This makes me vocalize something Ive wondered about...

Whats the smallest subset of lisp which you need to implement in order to bootstrap the language? So, given this small subset, one can implement the rest of say scheme or common lisp or arc on top of.

I vaguely recall Sussman or Ebelson implementing car and cadr in terms of lambdas, for example.

It seems this should be quite modular, given so many implementations of lisp [ in javascript, PHP, etc now Ruby ]. So that new lisps might be easily brought up over this kernel.

<comment><USER7> According to pg, seven: (quote, atom, eq, car, cdr, cons, and cond)

Eighth paragraph: <http://www.paulgraham.com/ilc03.html>

<comment><USER8> Ya that should be the minimum required to bootstrap. I always thought the definitive minimum code for lisp was here:

<http://lib.store.yahoo.net/lib/paulgraham/jmc.lisp>

Or at least from a historic perspective.

</comment></comment></comment><comment><USER9> I threw something like this together in python some time ago: <http://bitbucket.org/statictype/code/src/tip/pylisp/>

Not as elegant though.

</comment><comment><USER10> I wonder if this says more about Ruby, or more about Lisp?

</comment><comment><USER11> _X in (some small number) of lines of Y_

This is generally an indicator that language_power(X) > language_power(Y)

<comment><USER12> I think you have that the wrong way round.

Taking a specific example, "Lisp in 100 lines of Ruby" means that once you have Ruby, you have Lisp. That means that anything you can do in Lisp can be done in Ruby, and hence Ruby is at least as powerful. That means:

X in (some small number) of lines of Y

implies

language_power(X) <= language_power(Y)

Exactly the opposite of what you said.

</comment></comment><comment><USER13> Does lisp not support negative numbers? :)

<comment><USER14> Fixed in 1.4.2... Thanks for pointing that out!

</comment></comment><comment><USER15> Greenspun's Law in action ;-)

<comment><USER16> Greenspun's Tenth Rule of Programming: "Any sufficiently complicated C or Fortran program contains an ad-hoc, informally-specified bug-ridden slow implementation of half of Common Lisp." <http://philip.greenspun.com/research/>

</comment></comment><comment><USER17> A upgrade to Ruby?

<comment><USER18> [http://img43.imageshack.us/img43/2413/johnmccarthyposter1.jp...](http://img43.imageshack.us/img43/2413/johnmccarthyposter1.jpg)

<comment><USER19> Thanks for that. It's been my motivational poster for a while now.</comment></comment></comment>


Ask HN: Mobile analytics aggregator? - <AUTHOR>

I've been driving myself nuts this past couple of weeks going back and forth between mixpanel, google analytics, bit.ly stats and my custom reports.
Most of my time I'm on my mobile .. I refuse to believe that there aren't people out there that haven't been facing the same issue as I am for much longer time. So I surely must be missing something.
Is there a good analytics aggregator that stitches all this data into a unified dashboard for mobile out there? I did a quick search, but didn't come up with anything interesting. <comment><USER2> Ego (<http://ego-app.com>) does something like it on iPhone and iPad. Maybe it's worthwhile getting in touch with Garrett to figure out how easy/hard it would be to integrate bit.ly and mixpanel.</comment>


OpenFeint Service Shutdown - <AUTHOR> http://support.openfeint.com/dev/openfeint-service-shutdown-and-gree-migration/ <comment><USER2> I don't play tons of mobile games but OpenFeint has been one of the most annoying things to deal with in a lot of the games I play. It slows everything down constantly bothers me with integration popup and adds absolutely nothing to my experience. It sucks for a lot of games and probably a lot of (less casual) gamers but I'm glad I won't be dealing with it in games anymore.

</comment><comment><USER3> Heyzap (YC'09) is launching leader-boards on Android and iPhone. Still in alpha but we have some good results, you can check them out here:

<http://developers.heyzap.com/>

Unlike most other leader-board services everyone has a name and most people have a picture, so you don't see a lot of playerxxxxx scores, and we give you lots of ways of seeing/challenging your friends. If you have an Android you can try it out on: [https://play.google.com/store/apps/details?id=com.piratemonk...](https://play.google.com/store/apps/details?id=com.piratemonkeystudios.speedybiker&hl=en)

You could roll your own, the benefit in using us is that a) its easy (< 1 hour). b) it allows you to leverage our user base. c) We are working aggressively to add new features like challenges

Get in touch if you are interested or have any questions.

<comment><USER4> Question: What is your revenue model? What is your motivation not to go the way of the article we were all just reading, reminding us never to trust a platform because it will shut down and leave us with our thumbs up our asses?

<comment><USER3> People use Heyzap to install games, so its a pretty good opportunity to promote games to them.

We have a sustainable business model and are not too far from profitable with 16 employees.

We also have an API and will make it very easy for developers to download all the data if they ever want it. Openfeint is unfortunately not allowing that at all.

<comment><USER5> Okay then, why can I scan all your user data without an account or _any_ authentication?

This URL: <http://www.heyzap.com/api/v1/users/search?q=mike>

Allows me to _anonymously_ see numerous (limited by # of results) users records.

When I choose one from the list and go to this URL: <http://www.heyzap.com/api/v1/users/mike_midkiff/activity>

I see all of Mike Midkiff's info. All the games he has, WHERE he played (are you f'in kidding me??????), HOW MUCH he paid, and even his unique ID.

 _hackers_ , wake up. Bad engineering is bad.

Only the developer whose game Mike bought should be able to request his information, and ONLY relative to that developers game.

Hell. If someone gets mad at him in game, they can use YOUR API to track him down and beat the crap out of him.

Nice.

<comment><USER5> Just admit it's a bad implementation and commit to fix it.

Except with Twitter and Instagram, I need to authenticate to get the information about WHERE an action occurred, so at least there's a trail.

With your implementation, I can scan all my competitors users with public profiles (at the very least) and see who's buying what.

If this is a transparency play, then say that and make a stink about it. But when Mike gets the crap kicked out of him, also step up and cover his medical bills.

Edit: Okay.. so the location IS truncated, kudos. Why is this an unauthenticated API?

<comment><USER6> You sound angry, calm down.

I fail to see your point. I could also just go here <http://www.heyzap.com/profile/mike_midkiff> and scrape for the same data.

<comment><USER5> I am SOOO not angry, just shocked.

HeyZap didn't build the games that power them, the developers did. HeyZap, in releasing information such as installs, etc., to unauthenticated API calls is saying "This is HEYZAP's data".

It's not. It's the developers data too.

Without that developers game, you'd have NO data, and each player is a customer of the developer once they buy the game. They're not just HeyZap's users, they are paid customers of that developer.

Treat your developers businesses with respect and limit information to the developer and let them decide if they want to release it.

<comment><USER7> Hi, just to clarify, we don't have install data or anything from developers, only public information of what's on the app store, and what users share on Heyzap. It is the user's right to share this information if they would like to, in the same way that I can leave a review of an app without the developer's permission.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> From the email they sent me:

"Migrating to GREE Platform is easy and a basic integration can take less than a week of engineering time. In addition, migrating your game to GREE Platform allows you to keep your user data and player scores. Please note that migrating to GREE Platform will require you to remove the OpenFeint SDK and re-submit your game to the appropriate platform."

Three cheers for subcontracted proprietary services!

</comment><comment><USER8> For those who don't know the backstory, as I didn't: Openfeint was acquired by Gree last year for $104 million.

</comment><comment><USER9> Something doesn't add up. They are claiming a dec14 shutdown. Regular app approval delay on iOS is maybe one week, but really two during the holiday season. Let's be generous and say that publishers will take only one week to implement the new SDK. That only leaves 10 days of wiggle room? Yikes.

</comment><comment><USER10> From the end-user (very casual gamer) standpoint, good riddance. When it came out as an a feature of the "upgraded" AuroraFeint, I chucked the game I spent most of my gaming time playing, and have since avoided everything that used it, regardless of how nice the game may have looked.

</comment><comment><USER11> Yes, I don't want those AWESOME features! Thank you.

</comment><comment><USER12> Finally! I get my name back.

</comment><comment><USER13> FTW ( <http://www.ftw.co> ) is an alternative which is in the same space. I did some work for them on the Android side of things.

</comment><comment><USER14> One of their competitors in the Android space is having a very good week :)

<http://swarmconnect.com/openfeint_shutdown>

</comment><comment><USER15> It's a shame really, as OpenFeint was developed initially for Aurora Feint†, a very nice iPhone puzzle game and one of the very first iPhone games. It was free, and it seems OpenFeint was an effort to make money for the devs

† <http://www.appsafari.com/games/5330/aurora-feint-app/>

</comment><comment><USER5> Perfect example of why you should roll your own platform libraries, or at least try to use an open source engine that allows you to control the servers.

All those users just lost faith in yet another service, and all these guys are doing is saying "Hey, we failed you as a SAAS vendor, but we made $100 million, so lube up and try GREE because they need to [overcharge you voraciously to] recoup their investment.

You'd think the geniuses in the game industry could put their collective [self acclaimed] intellects together to come up with a platform agnostic approach to these common issues, and open source it for the betterment of the customer.

Oh, yeah... the... customer. Oops.

>>>>>>>>>>> UPDATE <<<<<<<<<<

OOH.. and it gets better... From GREE's agreement, paraphrased:

ARTICLE 5: Virtual Currency; Revenue Sharing

We've created our own currencies, not unlike BitCoin, called J-Coins and G-Coins. We reserve the right to change the ratios to capture more revenue, but right now you should just trust us that we're being honest.

Customers will pay US, not you. We'll tell you how much they spent of that money with you, and then pay you what we think is fair, in our sole discretion.

Oh yeah, to further confuse the customer, you can't call YOUR currency anything like ours, and we get to decide what you call it, and if you don't change it, we don't have to pay you.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Where the f __* do I SIGN UP!!!

<comment><USER16> I don't think rolling your own, or hosting your own is a feasible option for indie mobile and social game developers in the current climate short development cycles and small budgets.

<comment><USER17> The whole POINT of OpenFeint was basically: Hey, indie game developers! We know that building and running a game server is really hard and expensive. Why don't you let us run the servers for you, and you just use our (fairly simple and easy-to-integrate) SDK to make some calls to set high scores and unlock achievements?

<comment><USER5> Exactly, and they sold out and screwed the indies.

If you think OpenFeint had issues, just try getting your concerns addressed now that (a) GREE is in Japan, (b) time shifted 13 or so hours ahead of the US, and (c) works in YEN and uses _at least_ two levels of currency conversion to compute your revenues.

<comment><USER17> I actually used to work at OpenFeint (and was there through the GREE acquisition). This is a sad day for me.</comment></comment></comment></comment></comment>


Raising money for StackOverflow - <AUTHOR> http://www.joelonsoftware.com/items/2010/02/14.html

<comment><USER2> I've got mixed opinions of StackOverflow.

On the one hand, it's definitely better than ExpertsExchange, and does an adequate job of providing answers to many developer questions.

On the other hand, it's far (far!) from living up to it's potential. The basic premise of the site is that the wisdom of the crowd will separate the gold from the dross; however, the incentives lead to a plethora of mediocre answers which do _not_ converge (Wikipedia-style) towards some platonic ideal, despite Joel's stated wishes to that effect. What's more, there's a well-documented problem ("the fastest gun in the West") whereby the first semi-correct answer will quickly rise to the top, drowning out later (but more correct, more thorough) answers.

In short: they haven't (yet) solved the basic problem of "changing the way people get answers".

What's more, gaining the critical mass of early users was leveraged largely through Joel and Jeff's celebrity. Which is not transferrable to other domains. Which means that the site can't easily scale out.

Based on the preceding, I'd say that VC money is a good way to go-- it should give them the resources to a) solve the basic problem, and b) build subscriber bases in other domains.

<comment><USER3> The "fastest gun in the west" bug has been fixed for awhile; answers at equivalent ratings are ordered randomly. In my experience, that's eliminated the problem 90% of the time and ameliorated it the rest.

<comment><USER4> I agree, this does help fix the "fastest gun in the west" issue, but I don't think it eliminates the problem.

A mediocre answer that was posted one minute after the question was submitted often has more votes than a well thought answer posted several hours later.

A better solution might be to randomly order answers, regardless of votes, for the first couple of hours (maybe even day). This will further help remove any ordering bias.

I also feel that authors of answers should be hidden for the first couple of hours (or day). Just because John Resig answered a question, doesn't necessarily mean it's the best response.

<comment><USER5> Why not hide all submitted answers until 24 hours after the question is posted? Once this interval expires, there would presumably be enough of them to be shuffled and presented without any sort of fastest-gun bias.

Optionally, question submitters could pay for "Urgent" status, where the submitted answers are posted as they come in. No ratings or votes would be accepted for the same cooling-off period, however.

<comment><USER6> I don't think you should hide the answers, but you should definitely hide the ranking (votes) for about a day (or half a day) or so. During this stage the answers would be randomly sorted. After a day you get to see the votes for each answer...

</comment></comment></comment></comment></comment><comment><USER7> One problem that seems to have come up a few times is their inability to make serious revenue. This is a perennial issue for sites aimed at developers that don't sell products - coders + advertising don't mix (well).

I get the impression Joel's looking at expanding the SO model into other non- developer/non-geek niches where advertising could work, but I'm not convinced he's proven the revenue model enough to make it a tempting investment just yet. Anyone know any different?

 _Note: On another post, someone reminded me of the Careers move, so that's one easier-to-monetize stream at least._

<comment><USER8> "their inability to make serious revenue"

To somebody like me who doesn't really understand advertising, it seems like the value of an impression ought to be really high for StackOverflow. Based on the tags associated with my userId and the questions I've read, they pretty much know which technologies I use everyday. How much would it be worth for EnterpriseDB (the PostgreSQL folks)to advertise to someone who is wondering how to covert his Oracle database to MySQL? Perhaps, even with 6M users, there are so few people in any coveted niche that the friction overshadows the value?

<comment><USER9> I'm not sure I've seen anybody report hard numbers on this, but anecdotally what I've heard is this: geeks don't click on ads. Any site that targets geeks has a harder time making revenue from advertising than one targeting non- geeks, by a significant margin.

<comment><USER7> You're right, but since you follow me on Twitter, you must have missed my numbers on this.. ;-)

On Ruby Inside, Rails Inside, and Ruby Flow, I run a cpl million ad impressions each month and make an OK amount of money from it despite the CPM being deathly low (say $2-$3 on a per ad basis). The CTR, however? It's south of 0.5%.

I also ran an Adsense for Feeds experiment for a few days recently. Don't have the numbers to hand but it was 1 click in approximately 16,000 impressions.. and these are real, unblocked impressions. I made 40 cents. Developers don't click on ads. "Geeks" _do_ , though, IMHO.. otherwise sites like Slashdot wouldn't bother.

Compare this to Adsense ads on my old, archived personal blog.. and they run at over 20%.

<comment><USER9> Yeah, I had seen your numbers, but I was referring to some sort of larger study on the matter.

As for Slashdot, I always sort of wondered whether or not the appeal to those advertisers was less clickthrough and more name recognition. That is something that I think is a bit under-rated. I think that matters when evaluating products - I know that I tend to favor brands that I've heard of in some way vs something completely unfamiliar.

<comment><USER7> _As for Slashdot, I always sort of wondered whether or not the appeal to those advertisers was less clickthrough and more name recognition._

That has been cited by some advertisers, for sure - especially those who are recently funded or have larger branding budgets.

Take New Relic, for example. They're sponsoring The Ruby Show for I'd _guess_ (and I don't know for sure, but basing on rates of similar podcasts) at least $300-$500 per show? There's no way they're getting that much business from people listening to the show checking them out at that very moment. In terms of brand awareness, though, $5-8k a year is nothing if almost every Ruby developer has at least heard of you..

</comment></comment></comment></comment></comment></comment><comment><USER10> I enjoy using StackOverflow.

Jeff Atwood seems to get a lot of flack, but in creating such a nice site and community, he's walked the walk as far as I'm concerned.

</comment><comment><USER11> One thing that wasn't clear from the article, what does he want to spend the money on?

If it's marketing, I don't see why they can't do that with existing revenue. It's not as expensive as say a retail location for a starbucks and they must be doing some revenue with ads and job board already.

If it's hiring more developers that might make sense, although I can't think of any huge features they don't have yet.

Overall, not sure I'm convinced this is a good play for VC. They are growing nicely without it.

<comment><AUTHOR> Obviously, they would need to target a larger audience if they are going after VC. I can see them rolling out the site to 500 different niches. Image answer sites for home improvement, gardening, small engine repair, microsoft office, botany, project management, cooking...

</comment></comment><comment><USER12> _Jeff and I started out with a goal for StackOverflow of changing the way programmers and system administrators get answers to their questions on the Internet, which was deeply broken. In 18 months we've accomplish that_

Have they? Whenever I have a question the first place I turn is Google, and I usually find my answer on a site that's not stack overflow.

<comment><USER13> It's getting better, but StackOverflow is still pretty dominated by C# and .Net questions. If you're using something else there is a significantly smaller chance that they'll turn up in your search results.

<comment><USER14> Check out the "Tags" page to see the popularity of various technologies on StackOverflow. Although C# and .NET are pretty popular on StackOverflow, I don't think they are disproportionate to their overall popularity in the developer community.

Look at how StackOverflow has displaced Experts Exchange, though, and it tells a clearer story:

[http://www.alexa.com/siteinfo/stackoverflow.com+experts- exch...](http://www.alexa.com/siteinfo/stackoverflow.com+experts-exchange.com)

I don't think there is ANY other general-audience programming site with more traffic.

<comment><USER15> I've been watching that over time, as a potential data source for <http://LangPop.com> , and StackOverflow has definitely "improved", but it has historically had a .net/c# bias compared to what turns up elsewhere, just like github has had a Ruby bias, which is slowly fading as github gains in popularity with the developer population at large.

<comment><USER16> Joel and Jeff don't create the content for the site, the communities do. The fact that other communities haven't moved into their sections en masse is not their fault. It's YOUR (ie. everyone else) FAULT.

For example, I tried to get the Grails community to use StackOverFlow when the site first started and their attitude was that they would rather just use the mailing list and sift through Nabble.

[http://archive.codehaus.org/lists/org.codehaus.grails.user/m...](http://email@example.com)

The problem isn't with StackOverFlow, it's with the other communities refusing to adopt something new. "After all, IRC is where all the best people hang out...who needs this .Net thing..."

I'm currently learning Lisp. You wouldn't be able to get this kind of an answer on a mailing list or on IRC.

[http://stackoverflow.com/questions/2264267/generating-a- quiz...](http://stackoverflow.com/questions/2264267/generating-a-quiz-in- common-lisp)

This .Net/C# site just made it easier to learn Haskell, Lisp, Erlang, Scala... a little irony not to be overlooked.

<comment><USER17> "The fact that other communities haven't moved into their sections en masse is not their fault. It's YOUR (ie. everyone else) FAULT."

The first sentence is fine. The second not so much. "Fault" assumes that moving to SO/contributing etc is unambigously a good thing. I would not be suprised if at least some developers thought their existing communication channels are just fine.

"For example, I tried to get the Grails community to use StackOverFlow when the site first started and their attitude was that they would rather just use the mailing list and sift through Nabble.

[http://archive.codehaus.org/lists/org.codehaus.grails.user/m...](http://archive.codehaus.org/lists/org.codehaus.grails.user/m..). "

This sounds like a valid choice to me.

"The problem isn't with StackOverFlow, it's with the other communities refusing to adopt something new."

They may have good reasons to do so. Just because you are enthusiastic about SO doesn't mean everyone has to be.

(Due Disclosure : I don't use SO at all. I once saw an algorithm question on SO I could answer and when I tried, I found out I had to use OpenID to log in. Couldn't be bothered.)

<comment><USER16> StackOverFlow provides structure and organization to the information. I've dug through enough email threads that ended at a dead-end to be able to say that the structure is welcome.

People tag their questions, while others vote on the questions and answers. Question titles are matched against the database when people enter new questions. Admins "close" duplicates, and stop trolling. The reputation "economy" provides a way to get an answer.

StackOverflow isn't perfect but it is a _big_ step forward in organizing the information so that that the data can be searched more effectively.

<http://stackoverflow.com/search>

There are 500,000+ questions tagged. Some are great, some are not. Joel and Jeff don't provide either of these. We do!

Don't try this on a mailing list.

[http://stackoverflow.com/questions/101268/hidden-features- of...](http://stackoverflow.com/questions/101268/hidden-features-of-python)

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> One of the things that comes to my mind is this:

Craigslist is widely described as leaving 90% of the money on the table. Most people don't think this is _why_ they are this popular. They could have monetised more categories or cities and still kept their position. Maybe.

But maybe they did exactly what was necessary to become the number 1 classified site. What if the _right_ amount of revenue for some top 200 site (or network of sites) is really a couple of million?

Can such a site survive VC or does the option of staying a certain size disappear??

Starbucks was a perfect example. They new exactly where the business was going if constraints got lifted. More stores. Potentially tens of thousands. If they were less capitalised they would have to go slower but they knew where they were going.

</comment><comment><USER19> I wonder how this modifies their StackExchange offering. Does this mean that if you are doing anything beyond a internal knowledge base Stack Overflow is now a competitor?

<comment><USER20> The twist here is that StackOverflow is its own company (of which Joel is a founder) and StackExchange is a product of Fog Creek, currently available to everyone. If their pitch to VCs is "we can add sites for XYZ topics" what's preventing a competitor in that vertical starting up a StackExchange site on the same topic?

<comment><USER14> Nothing. It's not so hard to code, either, if you have time. That's why it's a land rush.

<comment><USER20> In this land rush you offer would-be competitors a turnkey solution to compete with you. So hypothetically let's say you were going to get into Automotive or Cooking Q&A and Car & Driver (or Cook's Illustrated) sees you get a little bit of traction and they sign up for StackExchange and heavily promote it faster and probably more effectively than you can since they have a dedicated core audience. This doesn't worry you? Or are you going to avoid verticals you can't quickly get a critical mass in?

<comment><USER21> Seems like a nice position to be in, actually.

Either you get a successful site in that vertical, or somebody else pays you $50k/year for the right to have it instead.

</comment></comment></comment></comment></comment><comment><USER22> Lately, Stack Overflow has been a mixed blessing.

How it goes: I post a question(questions are rather specific, but technology stack is very common on SO)

I usually get one-two answers very quickly and maybe one more slightly delayed answer, all helpful but also rather generic. You definitely get the impression people are just point whoring.

After a day or two I end up accepting the closest answer, even if it is not that close.

Seems real experts have moved on or perhaps I am missing some trick in asking questions.

If this problem persists on their scaled out sites, I am not sure how much VC money will help them.

</comment><comment><USER23> Someone has been envious on the Vark acquisition :-)

Of course VC makes sense in their case. There is no barrier to entry in this field, the model is clear:

* users tend to type questions in search engines

* search engines tend to rank up exact matches (especially with some trivial SEO like put the question in the title and url)

* given the proper environment, users will help each other answering those questions for free, generating lots of content - exposing ever bigger surface to the search engines

</comment><comment><USER24> Why do they feel the need to publicize their desire to raise money? Surely they can get their foot in the door of potential VC's based on Joel's reputation with Fog Creek alone, so what do they gain by announcing that they are looking for investment and giving a bunch of reasons why it's the right thing for StackOverflow? Why not just quietly raise the money and then, if/when they get funded, announce it along with the reasons?

</comment><comment><USER25> As a user of some of the more recent Q/A sites (StackOverflow and Fluther) I find one of the most valuable pieces to be the community. I don't think that necessarily scales to a venture-worthy size or that venture capital leads to long term care takers of that community. However, clearly the founders seem to think otherwise. Joel's looking for money and Fluther took seed funding.

</comment><comment><USER26> _"... There are a few indicators for the type of company that I believe can benefit from, and should take, VC. ..."_

The question I'd be interested in knowing is, _"if SO was in accepted into a YC intake, what advice would SO be given to evolve given the app is built, idea is validated?"_.

</comment><comment><USER27> someone needs to do this for shopping.

<comment><USER11> checkout <http://BuyersVote.com>

</comment></comment><comment><USER20> Joel's going to the Valley to pitch SO while Jeff's off in New Zealand at Webstock/on vacation. Do VCs care if only half of the founding team is there? What if one of them is 1/3 of the development team and the primary technical driving force?

<comment><USER14> No VC would invest based on one meeting. Nor would they expect the guy who is building the site to schlep along on every pitch meeting -- Jeff has better things to do!.

Presumably if we found some interested parties, they would want to meet the key team members, in a second or third meeting.

</comment></comment><comment><USER28> OT but the bronze statue of the two "guys" with the coin... anyone know what that is? There is a similar style statute outside of the ICC in Indianapolis.

<comment><USER3> Those statues are in the New York Subway at a couple of stations. I believe that particular one is at 14th St. and 8th Ave., on the A line, but I'm not 100% sure.

</comment></comment><comment><USER29> Jeff has to go in the new company. He is a liability for the VC.

<comment><USER30> Care to explain this a little more?

<comment><USER31> Jeff talks publicly all the time about how much of a fuckup he is, how proud he is that he sort-of figured out something you thought was obvious, how he just can't do anything right. It's his public persona, and the subject matter for his formulaic blog, where posts usually end with an explicit confirmation that it was a waste of your time: <http://blog.wekeroad.com/blog/nothing-to- say/>

He doesn't talk so much about what a successful badass he is (see Joel), despite obviously having accomplished some pretty major shit.

<comment><USER32> And all of the above presumably helped him to co-found a successful (in a make-something-people-want sense) startup. Not too bad after all, eh?</comment></comment></comment></comment>


Economist Magazine's Take on India's Entrepreneurship Scene - <AUTHOR> http://www.economist.com/business/displayStory.cfm?story_id=12814618&source=hptextfeature

<comment><USER2> Sounds like there's a pretty big opportunity for early stage seed funding in India, like, umm, you know, YC? :)

Anyway, there's still a lot of resistance to business and red-tape in India, I think. Couple that with the lack of a professional environment in a LOT of technology companies (the so-called sweatshops) and you have the classic slow bureaucratic anti-thesis of small lean startups. Not sure how and if this will ever change (or if it is already...)

<comment><AUTHOR> There is one called Morpheus Ventures, which looks like A YC clone to me

</comment></comment><comment><USER3> I'm no expert in hindi but doesn't Sammaan mean stuff/belongings not dignity ?

<comment><USER4> saamaan is stuff

sammaan is dignity.

Note the lengthy `a` in the first syllable and light `m` in the second syllable of the first word

and the short `a` and stressed `m` in the second.</comment></comment>


Twitter is in a rut; is the Philippines its key to getting out? - <AUTHOR> https://e27.co/twitter-rut-philippines-key-getting-20160219/ <comment><AUTHOR> Maybe it's just me, but I'm kinda getting tired of the whole trope of, "US company sees that it's going down the drain, checks out SEA to hopefully make ends meet." That said, maybe this is just a reality that countries like the Philippines should just accept? (See similar cases: How well Multiply & Friendster worked out in the Philippines)</comment>


Project Tango Developer Kit Now Only £256 (UK) - <AUTHOR> https://store.google.com/product/project_tango_tablet_development_kit <comment><AUTHOR> Maybe also cheap in other countries? But US price still $512?</comment>


The Psychology of Money - <AUTHOR> https://www.wsj.com/articles/do-you-know-the-difference-between-being-rich-and-being-wealthy-11596808802 <comment><AUTHOR> Do you know the difference between being rich and being wealthy?</comment>


Home server build, part one - specifications - <AUTHOR> http://www.stochasticgeometry.ie/2011/07/27/home-server-build-part-one/ <comment><USER2> That's way more CPU & RAM than you're going to need. 850W is A LOT for an idle machine. Fortunately, you won't draw anywhere near that without a graphics card.

Let's do some math.

Say your machine draws 250 Watts (~2 Amps). That's 6 KilowattHours(kwh) per day.

The US. national average for electricity is $0.112/kwh (as high as $0.31 in Hawaii) <http://www.eia.gov/cneaf/electricity/epm/table5_6_a.html>

Electricity for your machine will cost 6 * $0.112 = $0.67/day (on average)

That's $245.28/yr

These days you can get integrated Atom boards with up to 8 SATA ports.

Less power, less heat, less space. <http://www.mini-itx.com/store/?c=2>

<comment><AUTHOR> Kev, I could definitely do this on less CPU, less RAM, less power, and possibly less money (some of the parts for the custom small atom boards are more expensive, pound-for-pound, than their mainstream desktop counterparts). But the moment I hit any extra task, my spec would be all out of whack and I'd have to rebuild the box. No thanks, I'll accept a higher initial spend and a less-than-optimal running cost as insurance against the time and effort I spend keeping an infrastructure box up and running over that time period.

To give you some math back, my time on salary comes to a net of (approximately) €20/hr (and yes, it'd be far higher if I was contracting, thanks). Lets say a hard drive goes because I bought a different PSU which was closely matched to the spec but it's a friday model so the 12V line was kinda struggling. Now I have to buy the new hard drive, have it shipped, install it and rebuild it; that's going to come to 1-2 hours of my time in total on repairs, and probably three to four days where I don't have my infrastructure here which comes to around 24 hours of my time where I'm being put out because of a hardware failure. That's €480 worth of my time, against about $163/yr in running costs (because I really doubt this will be pulling 250W continously). Think of it as health insurance - yeah, odds are you'll never get back services equal to what you paid for, but that's not really the point...

<comment><USER3> It only costs you €480 if you lose time that would otherwise be spent at work. But I understand (and agree) with your point of losing time. If you use it for as your media library, 4 days with only standard TV broadcasts can be boring :-)

<comment><AUTHOR> Even more boring when you don't have a TV in the house qw :)

</comment></comment></comment></comment><comment><USER4> 320GB drives dedicated to the OS seems like a bit much, no? The power supply is also overkill, you don't need anything close to 850W to run that box. This could certainly be a lower cost build.

<comment><AUTHOR> 320Gb is definitely more than needed, but look at the disks on the site; the smallest drive there is an 80Gb Western Digital, but it costs £29.10; the 320Gb Seagate costs £28.66. /shrug Hey, if they want to charge less for a 320Gb than a smaller drive, I'll take the 320Gb.

As to the 850W, darn right I don't need all of it right now, but (a) I want the PSU nowhere near its limits when running two RAID arrays; and (b) I'll be adding in disks in the future to increase storage space as needed; I don't want to have to buy another PSU or worry about stressing the PSU at that point. It's relatively cheap future-proofing.

<comment><USER5> Few notes from someone who's built way to many home, and other, servers.

You made the right call on the drive, low end hard disk prices hit a wall pretty hard which leaves them looking a bit silly.

You're vastly overestimating the amount of power required to run the disk arrays, even at peak spin-up loads. The only way you could fit enough hardware into that chassis to come near using that PSU is multiple high-end GPUs.

If you're going to build a home server it's almost always worth investing in an AC power meter if you don't already have one.

Nearly every PSU operates most efficiently somewhere in the middle of it's power range, operating a high power PSU at 20% capacity will use notably more power than a correctly sized one. Take a look at any PSU review over at silentpcreview.com, they do good efficiency testing.

<comment><USER6> > Nearly every PSU operates most efficiently somewhere in the middle of it's > power range, operating a high power PSU at 20% capacity will use notably > more power than a correctly sized one.

One note from a physics major who's first job out of college was a the electrical officer on a frigate: this applies to all electrical devices. This sort of "over-supply solves all problems" attitude is quaint when it's a home server. It really sucks when under-loaded 1MW diesel generators shit the bed almost weekly on deployment in the summer. Any idea how much hot-dark-and- quiet sucks when you're bobbing like a cork in the middle of the ocean in the summer? Now imagine you're the person that 250 hot, cranky people expect to fix it. Why? because some "contracting expert" in the Pentagon decided to "over-spec" the generators 25 years ago.

<comment><AUTHOR> Niels, the PSU in this build actually does operate most efficiently in the 40%-60% load region according to its specs; it wasn't just a rule-of-thumb.

Also, the lower you load it, the easier it gets to cool, according to its own specs. Which I take as a nice bonus.

</comment></comment></comment></comment></comment><comment><USER7> This seems like a waste of money and environmentally unfriendly for little gain especially with the given list of taks from the article.

Ex-enterprise gear or a retired/second-hand PC would be a lot easier on the wallet (and much higher quality for enterprise gear). Add a couple new drives in a mirror and you're good to go.

Low power 1U atom or amd fusion builds are the one place new hardware makes sense to me for a home server.

<comment><AUTHOR> Ex-enterprise gear or a retired or second-hand PC would indeed be easier on the wallet and able to do the job. However, since I had neither, nor a way to get either...

And yes, Atom builds could handle NAS loads easily enough, no disagreement there; but add in the backups and other tasks, and you'll start reaching the limits of the platform. This isn't just a NAS box, this is the main server for the house.

<comment><USER7> You are willing to ship things based on this build, so don't be to quick to dismiss. eBay, Craiglist, and other regional list sites are the go to places. Say you spend $400 USD equivalent on an older Opteron system and a generous $200 to ship it. You're still coming out ahead and would have a higher quality engineered system IMHO. Just something to consider in the future.

NAS, backups, web development, etc aren't going to stress an atom. I/O will be your enemy far sooner in most conceivable server scenarios until wide RAID arrays or SSDs enter the picture.

<comment><AUTHOR> In the US, I'd definitely be going with newegg, craigs and other places kev; but in Ireland, well, places like scan are about as good as it gets. Ebay is an option as well, but the build takes longer; I have a week's vacation to get this done in for various personal reasons - so having the parts here now is worth the 10% I'd save on average if I spent a month hunting down bits on ebay and shipping them seperately.

And buying an older system on ebay and shipping it... er, no, I wouldn't be doing that locally in Ireland. I'd get an overpriced, heavily kicked system unless I was very lucky, and to quote a google sysop, hope is not an acceptable plan :D

</comment></comment></comment></comment><comment><USER8> that icy box thing looks cool. I have been looking for something like that for a while, trying without luck to use some other non-backplane devices that haven't fit properly in the case, or have pieces broken off after very light use.

As for the other comments about environmental friendliness, well it's not that bad. Running old enterprise gear will more than likely use a lot of power. The processor and power supply in that build are a bit overkill, but I think it is overall ok. You could get a 45W version of the processor and I bet that power supply won't be using more than 10% of its capacity, so yes it might have efficiency issues. 80Plus certification only measures efficiency at certain loads, 20% being the lowest, so who knows how efficient that will be at 10%. But of course you could add a GPU in there, or run a few virtual machines. I still don't think Atom's are worth it for general computing, as the platform is pretty limited in terms of expansion (no PCI, seriously limited RAM).

</comment><comment><USER9> What could inspire somebody to buy 8TB of storage today for ~100GB storage requirements? It'll be half the price in three months.

<comment><AUTHOR> It's 1-200Gb of live data, but about 1.5-2Tb of data that's currently sitting offline on DVDs which are a pain to access. I generate a fair amount of video data when training. Plus, as I said, future-proofing. I'm old enough to remember the "Who'd need more than 640k of RAM?" comment from the first time around...

<comment><USER9> Okay, at least in the ballpark then. But I think you missed the point— you're paying today for storage you won't use until God knows when. How do you justify that with HDD prices per GB dropping dramatically every few months?

I understand not wanting the hassle of buying a new drive at some point in the future, but I've a hunch that this is the sort of "future proofing" that makes your system seem charmingly quaint a year from now.

<comment><AUTHOR> It's not the drives I'm future-proofing guys, it's the entire box. And "future-proofing" doesn't mean "I'll never need new hardware ever again", it means "I won't need to worry about the hardware in this box again". So I come back in two years, swap out the 2Tb drives in the RAID array for 4Tb drives and it costs me half what I'm paying for them now; but I don't have to go spending extra on a new PSU, case, etc - the stuff whose prices won't have fallen by much.

<comment><USER9> I think that's what other commenters and me are getting at, though. The responsible way to not need to worry about the hardware in the box is to purchase only as much capability as you're going to to need in the time it takes before you want to replace it.

But you're wildly overengineering for your needs; you could literally spend half as much on a system which isn't "future proof", and in two years replace the entire thing for half again what you paid. So my question, which seems to be the common one, remains, _why_?

<comment><AUTHOR> (a) I don't agree that that's what I'm going to be spending money on in two years, or that costs will have fallen that far for the entire box (CPU, RAM, yes; physical box, PSU, no), or even that that money will be available (I'm in Ireland - check out the news on our economy :) Right now, whether it's better to keep euros in the bank or to spend them while they still have purchasing power buying things that will last and can be used seems like a terrifyingly close decision!

(b) This box's destiny is to go sit in a room quietly and just work. Any time I spend on it after it's in that quiet room is time wasted, and I'm willing to spend a bit more (though not a huge amount more) now to save a lot more then. If I was a postgrad again and my time was low-cost and I wasn't hosting data I really worried about, sure, I'd pick the newest, shiniest toy and try to make it work and if it didn't, oh well, I learnt something; but that's not the case here, I just want a solid box I never have to worry about no matter what else we throw at it. This ain't the project car in the garage being endlessly worked on for fun, this is the family estate wagon that's used for the shopping and getting the kids to school, if that analogy makes any sense.

</comment></comment></comment></comment></comment></comment><comment><USER10> personally, my home server is a "Seagate Dockstar Network Adapter", a 1.2GHz ARM box that can run Debian, with some USB disks, and a USB sound card so I can stream pulseaudio stuff to my larger speakers. Speedwise, the network is the bottleneck, so having USB disks for everything works fine. I suppose if you have your stuff wired up for gigabit and really need that much more speed, going for a box with faster interfaces would make sense, though you can get ARM plug computers with SATA or eSATA, iirc.

Things it does: NAS for large file storage and backup, pulseaudio sink, transmission w/ webclient, IRC client (ssh/screen), light home webserving.

I used to have a more serious box, but I found this runs silently, very low power, does everything I need, and is tiny. Also I got it on woot for $20. I'd strongly advise a similar setup for home stuff.

<comment><USER11> I like your line of thinking. I just ordered a BeagleBoard today that I plan to use as a static HTTP server. You've found the Debian ARM port to be stable and complete? I was pondering giving Angstrom a go first.

I also love the fact that it also runs on less than 12.5 watts!

<comment><USER2> I've got an Alix parked under my router and it uses about 0.07A <http://cgi.ebay.com/270782068385>

</comment></comment></comment><comment><USER12> I would buy a machine with ECC memory, see djb's rant <http://cr.yp.to/hardware/ecc.html> I would also add another 2tb drive and mirror them.

</comment><comment><USER13> I love the idea of a home server far more than I do using typical "end-point" electronics... But one thing I'd love to see a hardware manufacturer make is a wifi monitor that functionally doubles as a tablet.

Just a light, wifi, touchscreen (with mic, speakers, and cameras) that uses my desktop, and just streams content to the device. A smart charging stand that hold it vertical, and you could use it in place of a traditional monitor too. (Pie in the sky territory: awesome remote abilities that let you control your desktop over wifi from anywhere.)

</comment><comment><USER14> The ethernet port on that motherboard is horrible, especially if you plan on streaming video or moving lots of data onto or off of that server. I strongly suggest you get either a different motherboard, or buy an Intel card. Given your design goals, it's worth it, as you'll see significant performance gains in throughput and cpu load.

</comment><comment><USER15> Too much storage in the short term, considering a 1.5TB drive has dropped like $50 in the last year alone. Why 320GB non-SSD for the OS? Seems like a lot of money for a home server. I spent a little more than that and built a work horse that I use for data crunching and running VMs to do my day to day development.

Oh come on downvoters. We're talking about $1300 for a glorified print and file server. Please tell me I'm not the only one that finds that surprising.</comment>


European Parliament Urges Protection for Edward Snowden - <AUTHOR> http://www.nytimes.com/2015/10/30/world/europe/edward-snowden-nsa-whistleblower.html?_r=0 <comment><USER2> [https://news.ycombinator.com/item?id=10471172](https://news.ycombinator.com/item?id=10471172)</comment>


Watches - <AUTHOR> http://xkcd.com/1420/

<comment><USER2> We were never watch-free, we were _wrist_ watch free. By the same token, we've had smart watches for a long time; smart _pocket_ watches that we for some reason call "smart phones".

<comment><USER3> You mean those computers that happen to be able to make phone calls?

<comment><USER2> Those are the ones, yeah. It lives in my pocket and it tells me the time - that's a pocket watch, in my book. It just became an electronic computer instead of a mechanical computer, and progressed like the rest of computing...

</comment></comment></comment><comment><USER4> Are there any example articles of people criticising the use of watches as mentioned in the alt text.

<comment><USER5> Here's a couple that I found with a Google Books search:

"The Stress factor: thriving emotionally and spiritually in the turbulent 90s" (1992) - "Type A people easily become slaves to the clock. They are constantly looking at their watches, checking calendars, reviewing their daily diaries and lists of things to do, crossing off this and adding that, and endeavoring in every way to cram ..."

"Man and the Stars" (1978) - "It was only recently, while my wrist-watch was being repaired, that I came to realize how widely it is assumed that the good citizen knows the time, at least to the nearest five minutes. The law, for example, takes it for granted that somehow or other, the law-abiding motorist knows the time. ... If, for a moment, we could turn the clock back to the what our history books call the Middle Ages ... They were not, like us, slaves to the clock."

and a close match, with "Jay Walking: the ultimate fitness journey" (1998) - "So how come we become so stressed about time? It seems as though we wear time around our ankles, like a ball and chain, becoming slaves to the clock."</comment></comment>


Every HN front page post of last 3 years - <AUTHOR> https://twitter.com/hn_frontpage <comment><USER2> There's also this: [https://news.ycombinator.com/front?day=2019-02-01](https://news.ycombinator.com/front?day=2019-02-01).

We might put it between "new" and "threads" in the top bar.

<comment><AUTHOR> Oh, damn! Please do. This feature saves lot of time and effort.

Any way to browse a continuous list of all articles that made to front page?

<comment><USER2> Can you say what you mean by continuous list?

<comment><AUTHOR> A never ending feed, but anything works.

</comment></comment></comment></comment><comment><USER3> Anyone know how I can search this feed, or any other user's feed for that matter?

I'm an iPhone user. What am I missing?

<comment><USER4> Are you looking for something more than the search capability found in the footer (powered by Algolia)?

[https://hn.algolia.com/](https://hn.algolia.com/)

<comment><USER3> Looking to search all the tweets by a user of Twitter.

Edit: thank you sir for the link below.

<comment><USER4> Does this work for you? [https://twitter.com/search- advanced](https://twitter.com/search-advanced)</comment></comment></comment></comment>


How to Migrate Between Cloud Hosts the Easy Way - <AUTHOR> https://content.nanobox.io/how-to-migrate-between-cloud-hosts-the-easy-way/ <comment><USER2> So, basically they're saying... "Hey you can prevent vendor lock in to a single IaaS provider... just use our special process"... So you trade IaaS vendor lockin for software vendor lockin.

Perhaps a better solution would be to just realise that if you don't control it to the OS level, you have risk associated. You may not feel its a significant risk or that its worth changing, but at least be aware that it _is_ a risk.

<comment><USER3> Apcera announced a similar service today; "migrate three apps from on-prem to any cloud provider without rewriting it for $70K." Except now you're likely tied to their solution post-migration...</comment></comment>


Apple's New Reality - <AUTHOR> https://stratechery.com/2020/apples-new-reality-apples-transition-strategy-apple-v-developers-continued/ <comment><AUTHOR> Interesting take from Ben that custom chips means that Apple expects the Mac business to grow - in order to support the fixed costs - and that probably means new designs. Maybe finally a touchscreen to go with the iPad and iPhone apps?</comment>


The C++ community is polarized about C++11's random-number facility - <AUTHOR> http://www.pcg-random.org/posts/ease-of-use-without-loss-of-power.html <comment><USER2> Features like this make me think that C++ is designed by people who think that perfection is reached when there is nothing more to add. As a C developer, I side with Antoine de Saint Exupéry.

<comment><USER3> Sigh... Too often that criticism is leveled at C++ without an understanding of the terrain.

I don't think C developers should be sitting on a high horse on this one.

C represents a pretty good example of the problem. Almost every program that relies upon the standard C runtime's random functions has a flawed random distribution, so any correct program completely bypasses that infrastructure and/or has a ton of additional code/complexity layered on top of it.

That open source basically festered until the C++11 <random> proposal was accepted. The chief proponents of that proposal were, of course, those with the most sophisticated needs & understanding for random functions, and the proposal reflects that. So, the problems with that proposal are arguably a consequence of the flaws in the original C standard.

What remains to be done is to harmonize that proposal with something that makes sense to less sophisticated users, who nonetheless have reached the point where their appreciate the problems with C's random functions.

<comment><USER2> _Almost every program that relies upon the standard C runtime 's random functions has a flawed random distribution_

Right, and that function is a mistake in the C standard. It should have been omitted entirely.

<comment><USER3> That would have messed with C++'s goal of providing compatibility for C code.

Let's assume things had proceeded as you suggest though. We'd still not have a good solution for random number generation until the C++11 standard came out, and so we'd still have all the forces in place that gave rise to it and to the current mess.

<comment><USER2> You misunderstand me. I think random(3) should have been omitted from the _C_ standard.

<comment><USER4> What happens if you don't provide sensible, easy-to-use built-in implementations of things is that a diverse, bewildering ecosystem of different options tends to arise, confusing programmers who just want to get their job done and leading to a high probability of them picking the wrong thing.

See, for example, crypto before NaCl came around.

(NB: I'm not defending either this C++ standard or random(3).)

<comment><USER5> I thought NaCl was something related to browser plugins. What is the connection with crypto?

<comment><USER6> Name collisions: [http://nacl.cr.yp.to/](http://nacl.cr.yp.to/)

Although, I've never actually seen it used in the wild.

<comment><USER7> Threema use it. (I don't know if they use it in a sane way though.)

<comment><USER8> They do. There's an audit that confirms it, and you can use Validation Logging to verify it yourself: [https://threema.ch/validation/](https://threema.ch/validation/)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I wish they had mandated the algorithms used in the distributions. Even with the same generator initialized with the same seed, the normal distribution, for example, will give different results across platforms. At least the results of the generators are consistent across platforms.

<comment><USER10> Is that feasible for distributions over the reals across CPU architectures or maybe even revisions? FPUs typically do not compute the best possible result for floating point operations.

Also, instructions like 'estimate one over square root' have multiple 'correct' answers.

Edit: [https://www-01.ibm.com/support/knowledgecenter/#!/ssw_aix_71...](https://www-01.ibm.com/support/knowledgecenter/#!/ssw_aix_71/com.ibm.aix.alangref/idalangref_frsqrte_instrs.htm) shows things are worse:

"The estimate placed into register FRT is correct to a precision of one part in 32 of the reciprocal of the square root of FRB. The value placed in FRT may vary between implementations _and between different executions on the same implementation._ "

<comment><USER11> Is this an indication of a randomly seeded Newtown's method?

<comment><USER10> But why would they? My guess would be that they don't bother to clear a carry flag or are computing the estimate using a few extra significant bits, and do not bother to initialize those at start, but that's 100% guess. I know very little about designing CPUs.

</comment></comment></comment></comment><comment><USER6> Why not specify the algorithm for std::rand?

The specification, as far as I'm aware, gives no guarantees at all about the algorithm used. Why not just specify a good algorithm instead of adding a new function?

<comment><USER12> std::rand has global state. Specifying the algorithm doesn't fix that.

And this lets you (easily) generate more than just integers in the range [0, INT_MAX]. std::rand doesn't have that level of convenience.

There are all sorts of inconveniences with std::rand, and it looks like this solves the vast majority of them.

<comment><USER6> > _std::rand has global state. Specifying the algorithm doesn 't fix that._

Adding other functions also doesn't fix std:rand. People use std::rand. They will continue to use std::rand, unless it's removed. And even then they'll keep using it, because implementations will add it back in for compatibility.

There's already a simple, half baked, crude random number generator. It's possible to fix it so that it provides at least acceptable randomness, and isn't complete junk. Doing this breaks nothing.

Why add another similar function with similar API issues?

<comment><USER12> What is this "similar function" with "similar API issues"?

C++11's random utilities and O'Neill's randutils aren't similar to std::rand at all. They're totally different beasts from std::rand.

Making std::rand a decent RNG would probably make the world a better place. I'm not disagreeing with that. But even if std::rand used a decent algorithm, it's still a suboptimal API.

</comment></comment></comment></comment><comment><USER13> One thing that I would like to have is a common base class that can be passed around. Often, I would like for a function orclass to be told which engine to use, quite useful for unit testing, or for having reproducible results. As it is, the only way to accept multiple different engines is by templating over the engine type. This ends up requiring that every part of the code that uses the random engine be brought into the header file, and classes need to be templated on the engine type to store a reference to the engine.

I was kind of hoping that the `random_generator` class would be a templated class derived from a non-templated base class, so that it could be used in this manner. Looking over it, I can see why it doesn't, as many of the methods are much, much more useful as templated methods, which do not interact nicely with virtual functions.

<comment><USER14> I kind of agree! But think about performance. A fast pseudo random generator will/should create a random number in less cycles than one virtual function call has overhead. Also it's not hard to create your own virtual random class if you are willing to pay the price.

</comment></comment><comment><USER15> I like this proposal and I agree that randint is a bad idea.

<comment><USER3> I think there is a case to be made for doing both. The one advantage of randint is that it makes for a convenient migration path for those relying on std::rand() and friends.

I honestly am a bit at a loss though in terms of understanding how this proposal makes things significantly easier for programmers.

Absent this proposal, you would write:

        std::default_random_engine e(std::random_device{});
        std::uniform_int_distribution<int> uniform_dist(1, 6);
        const int random_value = uniform_dist(e);

The new process basically cuts the first two lines down to one, and uses a method call for a uniform distribution instead of creating an object for it. Is that really _easier_?

If so, then yeah, go with the idea of an empty constructor version of engines that will smartly seed from a random device, and add a mixin that does the magic of mapping all the different distributions in to methods.

I'm just wondering if that is somehow missing what is actually making life difficult for developers.

<comment><USER16> See the author's comments on very similar code here:

[https://www.reddit.com/r/cpp/comments/31857s/random_number_g...](https://www.reddit.com/r/cpp/comments/31857s/random_number_generation_it_might_be_harder_than/cq00h6y)

> One minor issue is that you're using `default_random_engine`, which in some > systems may be a LCG with a tiny 32-bit state. If so, you'll have an RNG > with a tiny period. That's why Stephan recommends[1] that you explicitly use > the Mersenne Twister. Of course, it might be something better, with more > state.

> But what's really wrong with it is that you use a single 32-bit integer to > seed the RNG. If you're using the Mersenne Twister, you're using four bytes > of state to try to seed 624 bytes. It'll work, but it's way worse than what > the Python code does; Python uses 624 bytes of actual entropy rather than > four bytes.

[1]: [https://www.reddit.com/r/cpp/comments/31857s/random_number_g...](https://www.reddit.com/r/cpp/comments/31857s/random_number_generation_it_might_be_harder_than/cpz7coh)

<comment><USER3> I think the solution for platforms which use bad default_random_engine's is for said platforms to stop doing that. ;-)

Seriously, the whole point of platform defaults is that they make appropriate choices for the platform. Sure, you can define your own engine, but that's exactly what the original API gives you...

<comment><USER16> You could say that about a lot of platform defaults. Sadly it's still our responsibility to avoid the bad ones.

<comment><USER3> Exactly. Working around it in the standard is the wrong way to do it though. You send what the standard requires, and maybe the bad guys are standards compliant, but there is no point in bending over backwards to work around a platform that is going to find a way to mess it up anyway.

</comment></comment></comment></comment></comment></comment><comment><USER17> "To the extent that anyone cares about C++11's random-number facility at all, the C++ community is polarized between two views—one that likes it, and one that hates it."

Isn't that almost a tautology? "People who care about X either love it or hate it".

<comment><USER18> There's a wide spectrum between love and hate.

<comment><USER19> Yeah, and all those people probably aren't participating in online discussions about it. I'm pretty happy with most aspects of <random>, but I don't seek out arguments. I just use it.

<comment><USER20> This is basically the problem with the whole Internet though ;)

</comment></comment></comment></comment><comment><USER21> I do not like it because [http://stackoverflow.com/questions/18880654/why-do- i-get-sam...](http://stackoverflow.com/questions/18880654/why-do-i-get-same- sequence-for-everyrun-with-stdrandom-device-with-mingw-gcc4)

<comment><USER22> Because Microsoft implemented random_device correctly while MingW / GCC hasn't?

Its a bug in MingW. Which isn't a big deal because Microsoft Visual Studio Community Edition is an excellent IDE and compatible with OSS projects now.

<comment><USER23> Could you point to the gcc bug? Note: the standard does not require a non- deterministic random_device, at least C++11 doesn't, so the behaviour as described in the stackoverflow link would be allowed.

<comment><USER24> There are a lot of things the C and C++ standards _allow_ implementations to do, such as making int 16 bits, using one's complement for signed integers, (in C) only making the first 31 characters of identifiers significant, (in C++) not allowing any identifiers longer than one character, except those in the standard library, et cetera. This is because they are designed to be portable to a wide variety of compilers and target devices which might have limits that weren't envisioned at the time of writing the standard. Doesn't mean it's a good idea to write absolutely pathological implementations for no real reason other than laziness...

<comment><USER23> >This is because they are designed to be portable to a wide variety of compilers and target devices which might have limits that weren't envisioned at the time of writing the standard.

That's not really the case here, is it? If anything the bug is in the standard.

<comment><USER22> > std::random_device may be implemented in terms of an implementation-defined > pseudo-random number engine if a non-deterministic source (e.g. a hardware > device) is not available to the implementation.

Windows has a non-deterministic source (IE: The function CryptGenRandom). Therefore, this is a bug in MingW's implementation. CryptGenRandom is hard to use, but that's no excuse for MingW's developers to be lazy.

Pointing at a "mistake" in the spec when the intent of the spec is extremely clear is laziness. Pure and simple.</comment></comment></comment></comment></comment></comment>


Show HN: Heroku Deploy Button and App.Json Schema Maker - <AUTHOR> https://www.expeditedssl.com/heroku-button-maker

<comment><USER2> Wow. That was a really fast turn-around from blog post to an app that makes it really easy to pull off without reading all the documentation.

I figure this is also a great marketing instrument. Nicely done!</comment>


California Uses More Gasoline and Diesel than China - <AUTHOR> http://www.treehugger.com/files/2008/07/california-more-gas-diesel-than-china-satistics.php

<comment><USER2> Article would be more helpful if it actually mentioned how much gasoline China was using per year. According to this article:

<http://www.greencarcongress.com/2007/03/chinas_gasoline.html>

the answer is about 20 billion gallons, and estimated to rise to about 25 billion by 2010. If California does indeed use more than China then it's both not by much and not for long.

Also, why is this on HN?

</comment><comment><USER3> OK. I checked the gasoline numbers and they are right. That said,I think China will pass California soon. Of course, that still means that fuel usage in California is profligate in a 'world class' sense.

I also checked CAISO 2006 energy usage statistics for California against CIA world fact book numbers for China. California uses more energy in general than the entire nation of China. I am ashamed to say that I have to confess to being surprised by this. What exactly is it that causes that level of usage? Does anyone have any ideas? I don't know enough about what the energy is being used for to know if usage can be safely reduced in California. Can someone more learned in this area help me out?

<comment><USER4> (My speculations:)

I doubt it's really any one thing, unless you count California being really wealthy as the one thing.

I think air conditioning is fairly normal in California? It isn't in most of the world.

High motor vehicle usage.

Lots of energy-using technology used in agriculture.

Manufacturing: stuff is actually still made in California.

<comment><USER5> Don't forget all of that energy used to keep that intarwebs thing running.... While California uses a lot of energy it also produces a ton of stuff. California's economy would make it the sixth largest economy in the world if it was its own country (11th by PPP) and according to wikipedia it has one of the lowest per-capita energy consumption rates in the US.

</comment></comment></comment><comment><USER6> "But what's really bad about that is that when you look at efficiency numbers only about 20% of the energy contained in those gallons of fossil fuels are actually doing useful work. About 80% of their energy is simply wasted as heat. That has to change."

Uh, I'm not a Mechanical Engineer, but isn't that a pretty typical ratio? Obviously higher-efficiency tech should be a priority, but in an article whose purpose is apparently to compare China and California, this makes it sound like California is using particularly wasteful technologies.

<comment><USER2> Yep, 20% efficiency is pretty normal in an internal combustion engine.

Burning the same fuel in a power plant, on the other hand, you can get 80-90% efficiency.

<comment><USER7> I wish that I remember which law of thermodynamics makes 80% "unlikely".

<comment><USER2> The second (it's always the second). And you're right, I was wrong, the maximum efficiency of a power plant is more like 50%.

Perhaps I was thinking of the efficiency of the turbines rather than the whole process.

</comment></comment></comment></comment><comment><USER8> i think that is a bold faced lie</comment>


Ask HN: Is everyone on the internet particularly pissed off this week? - <AUTHOR> I have had some really negative comments on reddit and stack overflow where normally they are quite positive.
On another forum was I accused of fraud and generally people seem pissed off.
Is it just me? Ha ha <comment><USER2> Some possibilities: 1\. Disgruntled employees who got pulled back to save the failing clouds blowing steam off on Reddit 2\. Just had dinner with his/her least favorite relative and had a fight over why blue cheese is edible.

Hope that makes you feel better lol.

But if you still feel sad, take a look at : [https://news.ycombinator.com/item?id=16508921](https://news.ycombinator.com/item?id=16508921)

The top Rants by Linus on the Linux Kernel Mailing List</comment>


Google Drive will hit a billion users this week - <AUTHOR> https://techcrunch.com/2018/07/25/google-drive-will-hit-a-billion-users-this-week/amp/ <comment><USER2> I had no idea this service was so popular. I just read the Drive TOS [1] and was astonished:

 _When you upload, submit, store, send or receive content to or through Google Drive, you give Google a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our services, and to develop new ones._

They're asserting the right to _publish_ and _publicly display_ anything you put on Drive for the purpose of promoting Google products.

Dropbox TOS: [2]:

 _We need your permission to do things like hosting Your Stuff, backing it up, and sharing it when you ask us to. Our Services also provide you with features like photo thumbnails, document previews, commenting, easy sorting, editing, sharing, and searching. These and other features may require our systems to access, store, and scan Your Stuff. You give us permission to do those things, and this permission extends to our affiliates and trusted third parties we work with._

Accessing, storing, and scanning feels reasonable though not thrilled about "affiliates."

iCloud Drive's TOS [3]:

 _...by submitting or posting such Content on areas of the Service that are accessible by the public or other users with whom you consent to share such Content, you grant Apple a worldwide, royalty-free, non-exclusive license to use, distribute, reproduce, modify, adapt, publish, translate, publicly perform and publicly display such Content on the Service solely for the purpose for which such Content was submitted or made available, without any compensation or obligation to you._

Apple claims the right to publish your content only if you choose to share it, and solely for the sharing purpose.

Google's really out of line here!

1: [https://www.google.com/drive/terms-of- service/](https://www.google.com/drive/terms-of-service/)

2: [https://www.dropbox.com/terms](https://www.dropbox.com/terms)

3: [https://www.apple.com/ca/legal/internet- services/icloud/en/t...](https://www.apple.com/ca/legal/internet- services/icloud/en/terms.html)

<comment><USER3> See also the adendums at [https://support.google.com/drive/answer/2450387?hl=en](https://support.google.com/drive/answer/2450387?hl=en)

These likely supercede Google's license.

<comment><USER4> They do not. The "license" is a _contract_. You still have the potential copyright, just google may use it for promotional material as they please.

</comment></comment></comment><comment><USER5> Well, I account for at least 6 of them.

</comment><comment><USER6> How many of them are solely Google Photos users?</comment>


Casino high-roller database stolen through a thermometer in the lobby fish tank - <AUTHOR> http://www.businessinsider.com/hackers-stole-a-casinos-database-through-a-thermometer-in-the-lobby-fish-tank-2018-4 <comment><USER3> I studied the photo to see if I could spot the Internet-connected thermometer, and then finally noticed that the caption said "Ethan Miller/Getty Images", and only after that saw that it also said, "An aquarium at a casino — not the one in question."

Forbes who wrote an earlier story did the same thing, but with a Shutterstock photo[1]. At least the original source of the story (the cyber defense company) used an illustration so it was obvious that it wasn't the real thing[2].

[1] [https://www.forbes.com/sites/leemathews/2017/07/27/criminals...](https://www.forbes.com/sites/leemathews/2017/07/27/criminals- hacked-a-fish-tank-to-steal-data-from-a-casino/)

[2] [https://www.darktrace.com/resources/wp-global-threat- report-...](https://www.darktrace.com/resources/wp-global-threat- report-2017.pdf) (see page 8)

<comment><USER4> Another reason to boycott Getty!

<comment><USER5> Why would we boycott Getty simply for having an image of a fish tank in a casino-looking lobby? That seems .. stupid.

<comment><USER6> To my understanding they're also responsible for getting the "View Image" button removed from Google Images

<comment><USER5> Even if they were, the parent's experience is not a valid reason to boycott in this case still.

<comment><USER7> perhaps it was sarcasm

</comment></comment></comment></comment></comment></comment><comment><USER8> What the article doesn't mention: IoT devices are harmful not only because they are vulnerable. They can be used to collect data on users. Every enterprise aims to get as much profit as possible; collecting users' data and selling them later obviously gets you more profit than not collecting.

Why would a thermometer need to connect to the Internet in the first place? It is absolutely unnecessary. The software could be installed on a server in a local network or even inside the thermometer itself.

I think the reason why these devices require an Internet connection is that vendors just want to lock user to their servers and collect "anonymous statistics" from them.

<comment><USER9> This reminds me of "cloud cameras" which seem to be getting more and more popular, and the absurdity of the whole situation.

Years ago, the standard was "IP cameras" which you basically connected to directly and they would stream video to you. Now these cameras stream video to some remote server, so the output from a camera which might be sitting only tens of meters away, goes maybe thousands of miles out into the Internet, crossing a geopolitical border or several, before coming back in. IMHO it's absolutely disgustingly inefficient in addition to all the privacy risks.

Of course the makers claim this is so you can watch from anywhere, but a lot of those old "dumb"(?) IP cameras could be configured to upload video to a remote server if you wanted, and one under your control.

Relatedly, the musings of a coworker who wondered why IM'ing someone sitting less than 10ft away in the office should even require a working Internet connection --- because his message gets sent far away and then back, in a horrificly wasteful loop, instead of going directly from computer to computer within the LAN.

<comment><USER10> >Of course the makers claim this is so you can watch from anywhere, but a lot of those old "dumb"(?) IP cameras could be configured to upload video to a remote server if you wanted, and one under your control.

The average consumer doesn't have a remote server or the knowledge to set one up.

<comment><USER11> > The average consumer doesn't have a remote server or the knowledge to set > one up.

Which is fine to say, but doesn't really address the main issue of the IoT Cameras and honestly comes off as exploitative as an excuse. Just because something provides a convenient service does not mean it should get a free pass on basic and reasonable security precautions, nor should it be able to exfiltrate data, much less in a lazy way.

To be 100% clear, I'm not meaning to put words in the parent's mouth; I understand that the statement is just a factual statement that most people don't know how to set up a remote server. However, small SOC boards have never been cheaper and continue to grow cheaper; a "remote server" to feed data to can be bundled easily at extremely low cost to the manufacturer, let the user provide their own storage, and then work on making the discovery experience elegant. (Plug in the cameras and the SOC box close to one another. Plug the SOC Box into a monitor/TV. Follow the on-screen prompts to discover the local WiFi and Cameras and connect all of them)

Apple has found ways to make their wireless vision almost complete; setting up remote printers, connecting via Airdrop, etc, is all fairly close to elegant with some minor bumps. Xiaomi's line of hardware ties in neatly to Mi-Life fairly well also and discovery is easy (though the actual connectivity is in dire need of work). The idea that consumers need to let their data be exfiltrated due to lack of knowledge is silly; there are numerous examples on how to do it right, and the tech has never been more ready.

<comment><USER12> This is far more eloquent than my reply. +1

</comment></comment></comment></comment></comment><comment><USER13> Old news: this is from 2017 [0]

It's just that the attack was part of a new article, and the headline used it to make it sexy.

[0] [https://www.forbes.com/sites/leemathews/2017/07/27/criminals...](https://www.forbes.com/sites/leemathews/2017/07/27/criminals- hacked-a-fish-tank-to-steal-data-from-a-casino/)

</comment><comment><USER14> Regulation to try to prevent weak links in a still perimeter-security-based design is hopeless. We need to stop substituting network of origin for real authentication and authorization systems.

<comment><USER15> But don't go too far and substitute authentication for network isolation. Vulnerabilities are a thing.

<comment><USER16> No kidding, who puts a valuable database on the same network as their HVAC system? The sysadmin should be fired.

<comment><USER17> AND that database presumably wasn't password protected?

</comment></comment></comment></comment><comment><USER18> I have a friend who works in a casino, and the industry standard is to put untrusted devices on a segregated network.

Even trusted devices are segregated by vendor.

<comment><USER19> It would be nice if at home routers made this easy to do too

<comment><USER20> You can get Home routers that setup VLAN. Ubiquiti Edge Routers will do almost anything you need to do.

<comment><USER21> I have one of those (but no Internet of Shit devices to segregate). Still, it's nice to know I can do so if I need to.

Unfortunately, all is not rainbows and unicorns. Ubiquiti's GUI doesn't treat IPv6 as a first-class citizen; if you want IPv6 you need to head for the CLI and hope you hit upon the right recipe to enable it for your provider - <USER2> make sure you set up your firewall rules to only open IPv6 addresses/ports you want open.

</comment></comment></comment></comment><comment><USER22> How does a hack like this work? Is the device somehow connected to the Internet, the attackers take over the device, then since that device has access to the casino network, the attackers could then see anything that wasn't secured on the network?(basically anything that relied on the network being secure for their security?)

<comment><USER23> I don't know exactly what happened in this case, because they're not sharing details, but I've done similar things in a lot of pen tests.

Your assumption is pretty accurate. Whatever internet-facing device is compromised is then used as a gateway onto the internal network, and a conduit for getting data back out if necessary. With access to the internal network, it's usually much easier to find things like systems with default/weak passwords, exploitable services, and so on.

It usually takes a couple of steps, like hopping from the initial system onto something that has interesting credentials stored/cached on it, and from there on to the things that are actually of interest. Every once in awhile, I'm lucky, and the initial point of compromise has super-privileged credentials on it, but that just makes things easier.

</comment></comment><comment><USER24> At this point I wouldn't be surprised if the high roller database itself were stored on its own IoT device linked to some "high roller analysis as a service" platform.

<comment><USER25> Or maybe just in an unpassworded MongoDB instance somewhere in Amazon, because agile.

</comment></comment><comment><USER26> You'd think these companies would use VLANs or at a minimum a router or layer 3 switch to segregate camera, critical services and fish tank IoT network traffic.

<comment><USER3> The original source[1] claims that the casino did take some precautions (a VPN) but still doesn't clearly explain how the failure occurred: _" A North American casino recently installed a high-tech fish tank as a new attraction, with advanced sensors that automatically regulate temperature, salinity, and feeding schedules. To ensure these communications remained separate from the commercial network, the casino configured the tank to use an individual VPN to isolate the tank's data. However, as soon as Darktrace was installed, it identified anomalous data transfers from the fish tank to a rare external destination. Communications took place on a protocol normally associated with audio and video."_

[1] [https://www.darktrace.com/resources/wp-global-threat- report-...](https://www.darktrace.com/resources/wp-global-threat- report-2017.pdf)

<comment><USER4> Note that the "source" here is an _ad_ for an "AI-enhanced" network monitor. There's no information to vet their claims, and a little weird that their client would happily subject themselves to public embarassment like that.

</comment></comment></comment><comment><USER27> This is such a clickbait article.

It doesnt mention any details of how the data was actually stolen using the thermometer. It doesnt even explicitly say that the thermometer was an IOT device. "Hacked through a thermometer" could mean so many things

</comment><comment><USER28> Right now /r/movies is having a laugh about a scene from _Rampage_ where a character hacks a corporate network through a thermostat. Much as I love a good chuckle at "Hollywood hacking", this is a thing that can actually happen.

<comment><USER29> I think the big difference between reality and a lot of Hollywood hacking is 1. the time it takes 2. how elaborate it always have to be 3. the fact that during the initial exploration they would most likely find an even easier point of attack.

</comment></comment><comment><USER30> Maybe the fish tank shouldn't be on the same network as high value assets. That way, vending machines could be accessed by the fish tank but not the mission critical data.

<comment><USER31> It's likely that was the protocol, but it wasn't followed. It usually comes down to actions of a Pointy Haired Boss rather than some glaringly obvious hole in their security plan.

</comment></comment><comment><USER32> "S" in "IoT" is for Security

</comment><comment><USER33> what is a high-roller database?

</comment><comment><USER34> How do you verify a database you stole isn't a decoy with dummy data?

<comment><USER35> Because this isn't a spy movie and that sort of thing rarely happens in real life.

It's also fairly easy to vet the data.</comment></comment>