Hacker Claims Feds Hit Him with 44 Felonies When He Refused to Be an FBI Spy - <AUTHOR> http://www.wired.com/2015/02/hacker-claims-feds-hit-44-felonies-refused-fbi-spy/ <comment><USER2> This reminds me of a The Florida case of Rachel Hoffman [1]. In short Rachel was arrested for marijuana (and 4 ecstasy pills), and flipped as a CI in a sting requiring here to buy ounces of cocaine, ecstasy and a gun. Rachel disappeared during the sting under watch of LEO and found murdered. It is similar to charging a "hacker" for scanning websites and cyberstalking (I don't know all the charges) then asking that hacker to obtain information on drug cartels and politicians, it is dangerous and unrelated to the underlying crime. At least in Florida as a result of Hoffman we have enacted Rachel's law to protect people in such a situation in the future (but it does not outlaw CIs totally just gives them protection, such as training for officers and right to a lawyer).

[1] [http://en.m.wikipedia.org/wiki/Rachel_Hoffman](http://en.m.wikipedia.org/wiki/Rachel_Hoffman)

<comment><USER3> I remember reading about this case around the time the charges were originally filed and those are pretty much the charges. The guy ran nmap (or equivalent) on the website, and submitted some attempts at SQL injections in a few forms. That was pretty much the entirety of his "hacking". Honestly what he got on the plea bargain is at the far end of what I'd consider appropriate for what he did. Something like a small fine, say $500 and a "don't do that again" would probably be more appropriate honestly. Had he actually gotten somewhere with the SQL injection, or actually gained access to something I'd say more might be warrented.

FYI the 44 counts were arrived at by charging each form submission individually, so it was really just 1 charge, just counted 44 times.

<comment><USER4> I don't see any reason why attempting SQL injections on a few forms on the County website should be treated any differently than trying a few ways to pick the lock on a county building. Should the punishment for the latter depend on the sophistication of the lock-picking techniques the intruder uses?

Web servers are other peoples' property, and there's no "right to tinker" with them. All you have is an implied license to use the site in the way the owner expects you to use it, the same as with a physical storefront.

<comment><USER3> Yes but there are degrees with these things. If you attempt to open a locked door they don't charge you with armed robbery, even if that door has a sign that says "employee's only". I'm not suggesting attempting a SQL injection should just be ignored, but it should clearly be at worst a misdemeanor and not a felony, about on par with trespassing in terms of severity. Now, if you then use that SQL injection to steal protected data, gain further access, or delete data, then yeah you're talking about moving into felony territory.

Web servers are other peoples property, but they're also a public space when you open then up to the public by hosting public services on them. A private server is different from a public server in the same way private property is different from a public storefront. By making your server accessible to the public you lose some of the expectations of privacy and implicitly allow a certain degree of access.

<comment><USER4> If you try to break into a building under the cover of darkness, you're going to get hit with more than a trespass charge.

<comment><USER5> Would you mind explaining which charges you'd get hit with? As a non-laywer, trespassing and entering (not breaking and entering, since you didn't break anything) are the only charges that would make sense to me in that context.

<comment><USER6> If the intent is there, then Attempted Burglary would be the charge in California at least. Penal codes; 663, 459.

[http://law.onecle.com/california/penal/663.html](http://law.onecle.com/california/penal/663.html)

[http://law.onecle.com/california/penal/459.html](http://law.onecle.com/california/penal/459.html)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> When I was a child I became a member of a cracking group of friends that disassembled and broke protections just for fun(we did not share or sell our cracks although we published info about how to do it).

The other day I met them again, now as an adults. It seems like one of the members of the old group took the bait and now is working for secret services or something shady. His life is miserable.

You start selling vulnerabilities for easy money and you could end badly. Those entities have so much power and too few scruples.

<comment><USER8> It doesn't always go bad. I worked for the Secret Service for two years as a CI. At the end they screwed me out of a few hundred dollars but I also didn't have to serve the eight years in prison I was facing. They never asked me to rat on someone, I built up new online identities and trained them.

</comment></comment><comment><USER9> The lead is buried in the _last_ paragraph,

> vindictive indictment after a refusal to cooperate... very troubling and > very improper

How is this different than indicting first and then dropping charges after obtaining cooperation? The threat is the same: work with us or go to jail.

<comment><USER10> In this case, the charges were clearly bogus, and they were dropped in the end (except for 1). It's not the same as facing a real conviction threat for something you are clearly guilty of.

<comment><USER11> The treat of financial ruin is the same though. Regardless of how bogus the charges may be lawyers are expensive and it's not like if 44 out of 45 charges are bogus they need to pay 44/45 of the defendants attorneys fees.

This is just like throwing shit at the wall and seeing what sticks. It should be illegal.

<comment><USER10> I agree. The pro bono lawyer is the real good guy, here.

</comment></comment></comment></comment><comment><USER12> How stupid are the FBI?

Do they really want to bring someone "in the fold" in a coercive manner like this? Someone who's entire ###existence### is about cracking systems and spreading information on what they find? They want to invite him into their own living room, knowing that he hates them and feels they screwed him?

The arrogance of these people to think they could actually manage and control someone like him, and not get burned.

<comment><USER13> Rumor has it that they have some experience turning people. The scary part is that it may not be all that hard to manipulate people.

Now excuse me I have to go buy a Lenovo from Best Buy...

<comment><USER14> > Now excuse me I have to go buy a Lenovo from Best Buy...

What am I missing?

<comment><USER15> Elsewhere on the HN front page is an article about Lenovo putting adware on their computers, and Best Buy is notorious for their shady practices.

<comment><USER16> It's not just adware, it's a piece of crapware that defeats SSL on your machine, allowing anyone to pretend that they're e.g. your bank.

</comment></comment></comment></comment></comment><comment><USER17> All this and the six month sentence just for "repeatedly scanning the local Hidalgo County website for vulnerabilities"? Scanning?

<comment><USER18> It's selective enforcement based on who he is and his associations. That is, they were being opportunistic. Whether that was to send a message or otherwise. It's also possible they were tracking his activity and they chose to pursue it because from early on they wanted to convert him to do work for them.

</comment></comment><comment><USER19> Wait, he ended up with 44 charges for just scanning a police website with a vulnerability scanner?

</comment><comment><USER20> It's kinda similar to the post I've submitted yesterday. Shows how us government is playing. It's kinda disturbing: [https://news.ycombinator.com/item?id=9071148](https://news.ycombinator.com/item?id=9071148)

</comment><comment><USER21> The transformation of the already morally culpable role of confidential informant to morally abhorrent confidential provocateur is one that many agencies are forcing upon the useful yet to be convicts.

</comment><comment><USER8> If this guy gets six months for scanning a website the WebSense execs should be in prison for life. WebSense repeatedly scans websites for security vulnerabilities without permission.

</comment><comment><USER22> So, "do our dirty work or we'll hit you with all the legal loopholes we can find". Lovely.

<comment><USER23> Outside of computers this has been going on for decades in the FBI/ATF's drug and gun business. This is and has been the modus operandi for at least 30 year (that I know of) and probably far longer, and it works well. Get caught with a joint and they'll try to stick distribution on you (with 10+ year sentences) unless you narc someone out. Some with gun violations, they will think of 10s or 100s of very questionable charges and place them against you, threaten jail time in the centuries. Reminds me of the Aaron swartz case.

</comment></comment><comment><USER24> Why is probing for weaknesses against the law? If I walk up to a house and jiggle the door handle, and figure out whether it's unlocked or not, and do not actually enter, what crime did I commit? What precedent caused this to be the case? If I am a salesperson who probes for weaknesses in a customer to my own gain, am I also violating the law? What if I am an employee who figured out how to reduce my workload but didn't inform my boss, so I get to surf Hacker News more?

I'm a website developer who patched 11 security holes after a security audit in my last contract gig. I think there is nothing wrong with probing. Actually breaking in and taking is another story.

</comment><comment><USER25> Is this legally distinct from blackmail, and if so, how?

<comment><USER26> Blackmail involves not revealing something compromising or injurious. This is legally distinct both because they are not "revealing" anything, and is legal because they're supposedly just enforcing the laws you broke.

The government generally works like the mafia, but in reverse: instead of using intimidation tactics to get you to break the law, they use intimidation tactics to get you to put other law breakers in jail. The difference is that the mafia would at least pay you for your efforts. The government just threatens you more.

<comment><USER27> They are choosing whether or not to reveal evidence at a potential trial. With cooperation, they do not reveal damaging evidence at trial. Without cooperation, they reveal everything. This is exactly how blackmail works in a lot of mafia movies.

<comment><USER26> If you broke the law, you can, should and will be punished for it; this is not usually negotiable, and they are doing you a favor by not prosecuting you.

The moral/ethical grey area here is that forcing someone to work for the government in exchange for not seeking what the law would call 'justice' is the equivalent of indentured servitude, a form of slavery.

With blackmail, you might normally have a reasonable expectation of privacy, and a reasonable expectation that someone will not intentionally harm or injure you. The government is not seeking to harm or injure you (well, not theoretically) when it enforces the law.

We've all signed the social contract that says that if we break a law, we will suffer the consequences, so it's not unfair for the government to prosecute crimes you have actually committed. It is also fair for them to give you a way out of them, as most cases are pleaded down, prosecutors change offenses to lesser degrees for a good track record, etc.

It's also definitely a grey area how prosecutors will often tack on "trumped- up" charges in the expectation that a judge will knock them down to a smaller list but still apply some. Both these practices need to end, or be curtailed greatly.

</comment></comment></comment></comment><comment><USER28> Oh, that happened to a friend in Russia as well.

Superpowers - they are all the same and never learn.

<comment><USER29> My serious start in anti-Communism began with reading in 1971 +- a couple of years a _Reader 's Digest_ condensed version of one such "spy's" autobiography. He was entrapped and forced into becoming one, was caught almost immediately upon entering the US.

One of the strong and unquestioned implications was this sort of entrapment was _wrong_ , and one of the things that distinguished the US from the USSR. Fast forward to Ruby Ridge, and Randy Weaver's refusal to try to become an undercover agent against a group of white supremacists, which he was not, and they knew that and hated him with a passion, i.e. it would have been suicide, brought the full weight of "the law" on him, resulting in the Feds murdering his wife and son.

</comment></comment><comment><USER30> Spying on politicians and cartel members, no thanks. You'd be chained to the FBI forever since they would threaten to dump you in gen pop as a known CI or leverage the safety of your family if you don't do everything they ask.

</comment><comment><USER31> "And these are only the ones we did not frame you with!"

</comment><comment><USER32> It's entirely possible that these "cybercrime" divisions are really desperate to justify their funding. Chances are those sorts of entities are not made up of technical wizards. So coercing someone to do their job for them is pretty much the only hope. If they just hired people then those people would end up running the place.

</comment><comment><USER33> Since when is using nmap or its kin illegal?

</comment><comment><USER34> He's lucky they didn't plant n.u.d.e photos of young boys in his computer and charge him for...

</comment><comment><USER35> The American system of _piling up charges_ sucks so hard because it's so easily abused, especially when you live in a country where anyone commits _3 felonies a day_ [1] due to shitty and complex law.

When things have gotten so bad, Americans should take example from other countries and only count the _biggest_ charge when sentencing someone to prison. Minimum sentences + abusive plea bargains don't help the current system either (they do help vengeful government tax-paid employees, though, in destroying the life of anyone they wish).

[1] - [http://www.threefeloniesaday.com/Youtoo/tabid/86/Default.asp...](http://www.threefeloniesaday.com/Youtoo/tabid/86/Default.aspx)

<comment><USER36> "3 felonies a day" is more of a marketing tagline for a book than it is any sort of meaningful fact.

edit: [http://skeptics.stackexchange.com/questions/22530/does- the-a...](http://skeptics.stackexchange.com/questions/22530/does-the-average- american-unwittingly-commit-three-felonies-a-day)

<comment><USER37> That link is a "worst of" for Stack Exchange. Most of the answers there are from people who admittedly didn't read the book, and are really bad.

If you read the book, the source of the "3 felonies a day" claim, is mostly related to the "honest services" laws, which were narrowed in scope somewhat by the Supreme Court after the book was published. If a prosecutor were to very liberally apply the "honest services" law, typical white lies like calling in sick to work when you're not sick or screwing around on the internet can be elevated to felony status.

Another key area supporting the claim is that participating in a transaction where a foreign law was broken is also a felony. I believe the (absurd/bizarre) prototype for this was somebody charged with a felony for possessing warm-water lobsters that were inappropriately packages according to the law of some central american country. (I believe they were in wax paper instead of plastic)

The point was that ordinary people in the ordinary course of business and life can be subject to extraordinary punishments for vaguely defined crime. That means that you're freedom is subject to the whims of an all-powerful prosecutor, which is contrary to generally accepted notions of justice and democracy.

<comment><USER36> They were convicted of conspiracy after 5 years of lobster smuggling, the transport laws were tacked on (and not necessarily ridiculous), see my other comment.

The book reaches super hard to make the argument that we have too many laws. It would do better to simply make the argument that we have too many laws.

It's also the case that the injustice in the US system is not aimed primarily at lobster smugglers and dumb lawyers (two of examples cited at the link).

The point of linking that worst of stack exchange is that you don't even have to read the book to eviscerate the factertisement, so it's not really a great "fact" to introduce into a discussion.

edit: corrected 10 years to 5 years.

<comment><USER37> The fluffy marketing distracts from the content if you don't read the book. Putting "you can go to jail for not providing honest services" isn't very catchy. The stack exchange link is a personification of "Don't judge a book by it's cover".

The argument of the book is that we have too many vague laws, some of which are nearly meaningless to a lay person. If you're familiar with how the various computer crime statutes are enforced, I think it is difficult to question that assertion.

The other aspect of the book to consider is that your typical middle class working person doesn't see the overreach in things like drug laws as something relevant to them. It's a wake-up call that the fundamental injustice that has been a way of life for the poor and minority community is expanding.

<comment><USER36> You'll notice I started by objecting to someone claiming the fluffy marketing as a fact.

That's true whether Stack overflow and I have misjudged the book or not.</comment></comment></comment></comment></comment></comment>


Peculiar pattern found in 'random' prime numbers - <AUTHOR> http://www.nature.com/news/peculiar-pattern-found-in-random-prime-numbers-1.19550 <comment><USER2> It's even worse if you represent the primary numbers in binary notation. Every prime number greater than 10 ends with the digit 1 ;) [edit typos]

<comment><USER3> Which leads to the interesting question: if this happens in base 10, but not (trivially) in base 2, what other bases does it happen or not happen in?

<comment><USER4> I think you may have missed the joke.

<comment><USER5> He got the joke, but was also taking it seriously as a phenomenon that could have interesting implications. This finding obviously doesn't hold base 2 (more accurately, isn't an applicable concept), and apparently becomes more pronounced in base 3.

</comment></comment></comment></comment><comment><USER6> I was curious, so I wrote a small program to check it:

The normal distribution is

        1: 24.9940%
        3: 25.0128%
        7: 25.0100%
        9: 24.9832%

The distribution following a prime ending in 1:

        1: 17.0448%
        3: 31.0789%
        7: 32.1018%
        9: 19.7745%

Source: [https://gist.github.com/kbadk/71bbb57c9be0d66de156](https://gist.github.com/kbadk/71bbb57c9be0d66de156)

<comment><USER7> FTA:

> "Every single person we've told this ends up writing their own computer > program to check it for themselves," says Kannan Soundararajan, a > mathematician at Stanford University in California, who reported the > discovery with his colleague Robert Lemke Oliver

</comment></comment><comment><USER8> Primary discussion: [https://news.ycombinator.com/item?id=11282480](https://news.ycombinator.com/item?id=11282480)

<comment><USER9> > Primary

</comment></comment><comment><USER10> Finding patterns in primes is old news.

In the 60's Scientific American had an interesting article about a curious pattern in primes. If you start on a grid and fill in the integers in a spiral there are obvious patterns of connected primes. I had to try it of course, on grid paper by hand up to a couple of hundred.

<comment><USER11> This is true, they're called Ulam spirals. But the reasons for these patterns appearing are afaik pretty well understood (I forget exactly how but it wasn't hard to get a grasp of why they are there).

Though these patterns are pretty noisy still.

[https://en.wikipedia.org/wiki/Ulam_spiral](https://en.wikipedia.org/wiki/Ulam_spiral)

</comment></comment><comment><USER12> Could this be related to [https://en.wikipedia.org/wiki/Benford%27s_law](https://en.wikipedia.org/wiki/Benford%27s_law) ?

</comment><comment><USER13> Why is random in quotes? Random numbers can have patterns, too.

<comment><USER14> Can they? Genuine question.

<comment><USER15> It's actually a very good question. Even up to the Renaissance, we had no real conception of "probability" \-- even though there were games of chance that depended on it. The Greeks had notions of impossible/possible/likely, but no way to link the notions to the world.

It was finally in the correspondence of Pascal and Fermat in 1654 that a mathematics for probability started to emerge. With the emergence of the laws of large numbers, this mathematics could be linked to observable real-world occurrence rates. (Ian Hacking's book "The Emergence of Probability" is a standard reference, [http://www.jstor.org/stable/2184357?seq=1#page_scan_tab_cont...](http://www.jstor.org/stable/2184357?seq=1#page_scan_tab_contents.))

Suppose you were confronted with a stream of random numbers, and no intellectual or mathematical framework for quantifying them. Just coming up with a notion of a frequency curve (i.e., a density), and statistical independence of "unlinked" events would be a huge leap.

I used to TA an undergrad probability class, and in the first weeks, I'd ask the students to quantify some random variable, and they'd sometimes blankly look back and say, "it's just random" \-- what we taught them is how you break that down in terms of the familiar quantities (densities, independence, correlations) and operations (multiplying for independence, integrating for expectation, integrating and renormalizing for conditioning).

So to get back to your original question, even a deterministic sequence, like

      0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, ...

could be regarded as random, and given a density and all the other folderol. And a "completely random" sequence of 0/1 equiprobable bits also has a density, etc. And so does everything in between.

<comment><USER14> Thank you, that is a very good answer. So "random" is how you look at a sequence. It's more a model (context in which to interpret a sequence) than an observable fact. Is that a fair interpretation?

By saying "this is a random sequence," you enable a statistical view of the problem. Even for purely deterministic sequences, this can be useful.

Last question, something I've never been perfectly clear on, what is the difference between "random" and "stochastic"? My understanding is that a stochastic model is a model featuring stochastic variables, which are variables that draw from some random distribution. Is the terminology I am using correct?

<comment><USER15> For almost all purposes, "stochastic" is literally a synonym for "random". But sometimes the usage favors one and not the other.

You would talk of a "random variable" (loosely, a quantity that exhibits random behavior, although there is a technical definition that is more precise and has a different flavor), not a "stochastic variable".

Sometimes, you would talk about a "stochastic matrix" (which is actually deterministic, an example of a namespace clash), because a "random matrix" would indeed be random be filled with "random variables".

But, you would often talk about a "stochastic process" like Brownian motion. Although you can also say "random process", and that's the same thing.

You would _not_ talk about a "random distribution", that sounds like you mean "arbitrary distribution" (as in, "I picked out some random socks today"). But you don't mean arbitrary, you mean a "statistical distribution" or "probability distribution".

To get all this right, you have to live in that world, you can't just visit. If an outsider could just speak the language using clear rules, there would be no point in all those advanced classes, right? ;-)

<comment><USER14> Thank you!

</comment></comment></comment></comment></comment></comment><comment><USER16> just tested it against the 10000 first prime numbers in Sublime Text : 2462 prime numbers have a direct neighbour with the same last digit. That's nearly a quarter of them... Edit: by taking into account sequences with 3 identical digits (110 occurrences), it's even more.</comment>


Show HN: Make navigating your music library super easy with Jam On Music App - <AUTHOR> http:// https://itunes.apple.com/us/app/jam-on-music-player-play-+/id994911155

<comment><USER2> For some reason, I can't navigate to the linked URL ([http://](http://) [https://itunes.apple.com/us/app/jam-on-music-player- play-+/i...](https://itunes.apple.com/us/app/jam-on-music-player- play-+/id994911155) )

Oh, well, now I see: you might want to take out [http://](http://)

[https://itunes.apple.com/us/app/jam-on-music-player- play-+/i...](https://itunes.apple.com/us/app/jam-on-music-player- play-+/id994911155)

</comment><comment><USER3> 'navigating your music library'

But in the description it says this app really is good at:

'Explore gives you basic recommendations on what you could listen to next so you pick something relevant quickly and get back to whatever you're doing. The Explore feature will continue to evolve in future versions of the app.'

'Discover shows you artists and music you might not know about that is similar to the music you play and love.'

But this music would be external to my library ? Does it link to the free 'pre-view' links of iTunes ?

On a side note: the music I play is not necessarily the music I 'love' ;-) I might just be experimenting or just 'in that mood'.</comment>


Samsung announces Galaxy S5 - <AUTHOR> http://arstechnica.com/gadgets/2014/02/samsung-announces-galaxy-s5-launches-in-the-us-in-april/

<comment><USER3> I'm on an S4 right now, and it may be my last Samsung product - the bait and switch of the 64GB S4 has soured me on Samsung.

When the S4 was released, Samsung took heat for the memory capacity: The S4 was more expensive than the iPhone 5, but the 5 had 64GB while the S4 had 16GB. Samsung was likely peeved, since the S4 beats the iPhone on pretty much everything else, but critics blasted them for the memory - which was a fair criticism, see below.

Samsung relented and indicated 32GB and 64GB variants would be available, created spec sheets, even put some into the hands of reviewers.

But try buying one. Samsung and its carriers are convinced that 16GB, max 32GB, is all most people will need, which, for the carriers, is self-serving, because the less room you have on your phone, the more data you use - <USER2> carriers ding for data.

Apple understands storage requirements, primarily because of iTunes: Your music, etc., are local, and synced. Consumers with music collections are largely on iPhone; Samsung and Google want to differentiate themselves, somehow, but don't have a full clue. Google wants you to stream everything, so they believe you can live with less space.

Yeah, maybe in downtown NYC, but try streaming in rural or even semi-rural Ontario sometime.

So Samsung is playing bait and switch. Part of me is pissed beyond all reasonable belief. My choice came down to the Nexus 5 (32GB, no bloatware, no external SD card) and the S4 (64GB, bloatware up the wazoo like you wouldn't believe, external SD card, but WTF it has 64GB!!!).

I chose based on storage - knowing it would take me hours to disable all the bloatware. But knowing I wouldn't have to muck with external SD cards anymore.

My admin orders the phone, a 16GB arrives, I say "whoa, what's up", she does some research, I am gobsmacked, I do some research, validating hers and leading to the above rant.

Lying bastiches.

My next phone will be a decent Android phone with 64GB of internal storage - 64GB available to me, not 8GB sucked up by the OS thank you Samsung - and no bloatware. Anyone? Anyone? Bueller?

(Too bad I cannot stand the iPhone - used one for two months while waiting for my S4, and couldn't abide the kindergarten level of one-click-at-a-time-a- tude.)

</comment><comment><USER4> I'm in the market to move off iOS, but still pretty unimpressed with Android hardware. I'm not sure why these phones have to be so large.

Maybe the HTC One 2 (or whatever it will be called) will get it right for me.

<comment><USER5> exactly. I was looking at the Xperia Z1 Compact. Kinda expensive, but Android hasn't completely won me over..

</comment></comment><comment><USER6> I'm happy to see that Samsung has stuck with the design philosophy of its previous Galaxy S-series flagships.

In a world where other manufacturers of high-end mobile devices have adopted a unibody, no-replaceable battery, no-storage expansion approach, it's nice that Samsung sees the value of a device that works for users who like expansion possibilities and who don't really care about the added expense of shiny metal. They're serving a huge market that other mobile device designers are increasingly ignoring.

<comment><USER7> When was the last time you had to replace a phone's battery?

<comment><USER8> I have always spare battery on me (fits small pocket), and it's quite often it has its use.

When I travel I always have 2 spare batteries, so I have assured battery live for long day of heavy usage (GPS navigation etc).

With such option you never worry about battery drain and you can freely use your device up to maximum.

</comment></comment></comment><comment><USER9> Samsung, unfortunately, seems to formulaically try to stuff new hardware and gimmicky features into an otherwise thoughtless, without taking much time to design it to run well and look good. Their skinned version of Android is hideous, and I can't imagine their build quality has improved much.

Sorry, I'm just grumpy and unimpressed and needed to rant.</comment>


Ask HN: What are the best logging packages you have come across? - <AUTHOR> As devs, we spend so much of our time reading logs.
So what are the best logging packages you have come across (across languages/frameworks/OS) ?
What features makes it the best/better ?
What features wish you existed in existing packages ?
edit: sentence corrected <comment><USER2> Depends on the volume of data you're logging and if you need to do real-time analysis on it. Certainly not for all use cases but where I work we're doing a lot with LogStash (on Elastic) to "do business work" on data streams that are coming in at up to 1Gbps. Since we have it in place already for other business needs we throw a lot of app telemetry data at it as well and have rules for processing events and issuing alerts.

For more down-to-earth scenarios, log4j (which can be used from Python and other languages) along with several Apache logging projects (eg: log4php) are good options. If you're on .NET I would look first at Serilog.

</comment><comment><USER3> For Go just use logrus [https://github.com/sirupsen/logrus](https://github.com/sirupsen/logrus)

It's easy to use and full of features. There are faster packages out there but you don't really need them unless you're Twitter scale or something.

For log aggregation in all environments try oklog [https://github.com/oklog/oklog](https://github.com/oklog/oklog)

Much easier to run and maintain then Elastic, excellent performance and scalability. Especially good if you're a small shop and don't have the time or resources to complicate your infrastructure.

</comment><comment><USER4> sfl4j of pretty solid.</comment>


Can someone tell me where my decentralized/blockchain theory breaks? - <AUTHOR> Hi folks! Can someone please tell me where my theory breaks? I theorize that the cost to get enough shared ledgers to agree that user x has 0$ (previously had $5M) is less than or equal to the amount of money that could be divided amongst the thieves. IE if you get enough people to say the sky is purple is the sky purple? Isn't cooperation key to a decentralized system? What happens when a new patch is released that pays you $100 to say a lie that user X has $0 and everyone involved has $100 more? <comment><USER2> Something like this happened last year with Ethereum. A hacker stole $150 million, but the funds were conveniently trapped on one place for a month. People rolled out a patch that moved the funds back to their original owners.

Some people thought that was a bad idea and kept running the unpatched version. That caused the blockchain to split into two separate blockchains, the patched (ETH) and unpatched (ETC).

After that, it was up to the market to determine which version was more valuable. So far ETH is worth a lot more, so apparently the market was fine with this action in this particular case.

If people were to roll out a patch that _committed_ a theft instead of repairing one, it's unlikely that many other people would go along with it. There'd be another split, the thieving chain would drop to a low value, and the original chain would keep rolling along with funds unstolen.

<comment><USER3> The term "hacker" depends on your viewpoint. Put another way, a user executed a function on a decentralized smart contract platform that transferred $150 million to the possession of the function's caller.

If the value of smart contracts is that they will execute as written with no possibility of third party interference then Ethereum is not a smart contract platform. It is a very inefficiently designed public ledger governed by a highly centralized group of developers who can change it on a whim.

<comment><USER4> > If the value of smart contracts is that they will execute as written with no > possibility of third party interference then Ethereum is not a smart > contract platform.

Why would there be such value in a dumb contract platform like that? Historically, what societies have chosen to adopt such a set of values?

<comment><USER5> I think the perceived value comes from the assumption that contracts can be written perfectly. Apparently, some people believe that the problems encountered so far are just a matter of weeding out the problems and eventually contracts will be much less likely to have loopholes like this.

I don't really agree with that worldview, but not strongly enough to bet that it won't reach some fairly safe equilibrium at some point. Even then though, a major bug could be lurking for years just waiting to be exploited later.

<comment><USER6> This is a rather perfectionist point of view, implying that our current day- to-day contracts are perfect and don't have loopholes. Why do smart contracts have to be written perfectly to be usable by people.

In the end, what's perfect in the world around us? Big banks fail and lose people's savings, cars break and cause deaths and it has't stopped people from adopting these on a large scale and keep on improving them.

<comment><USER5> Wanting all contracts and actions performed by them to be immutable is an _odd_ point of view in my eyes, but I'm not sure I would call it perfectionist because the perfection depends on whether you think a perfect system fulfills the contracts to the letter or the spirit.

In the physical world, we arbitrate contracts with authorities vested with the power to make decisions over them, such as courts, governments, mediators, etc that both parties have agreed has the final say, because the alternative is _unworkable_.

In a consensus system such as a blockchain, that consensus is based on a majority of the participants. Wanting them to have no say on the outcome of actions is like wanting the courts to have no jurisdiction over your contracts.

</comment></comment></comment></comment></comment></comment><comment><USER7> You're forgetting that the integrity of the blockchain has value, particularly for miners. The token would crash once such a deception were made known making the miner's reward for mining worthless. That's the cost that you are not factoring into your example.

<comment><USER8> Game theory. While the mining community understands the value, whoever is committing the theft is probably just interested in short-term gain. A few thieves have not broken the fundamental trust in crypto, but there is definitely a tipping point.

<comment><USER9> Yeah - as long as the crypto token has liquidity to settle into other currencies, there is a possibility of agreeing to ruin the chain and exchange the tokens while information asymmetry still exists. Essentially, if you don't care about the "store of value" part, a large enough group could do it.

</comment></comment></comment><comment><USER10> Too many things going on here:

a. Are you aware of the Ethereum DAO hack? The whole Ethereum vs Ethereum classic. Short story - The largest ethereum contracts was hacked and money stolen. Then a patch was released saying that the hack didn't happen.

People who accepted the patch were "ethereum" holders and those who refused are now on "ethereum classic".

So, changing the rules in a patch doesn't matter. If there are enough people helping user x and the currency is still accepted it can be called 'currency classic/cash'.

b. There is a lot of confusion on whether cheating n blockchain somehow requires a patch or 51% support. It doesn't. 25% is enough to try and cheat within the rules. Read:

[https://steemit.com/ethereum/@dhumphrey/update-f2pool- manipu...](https://steemit.com/ethereum/@dhumphrey/update-f2pool-manipulates- usd1-2-million-on-the-ethereum-blockchain-during-the-status-im-ico)

</comment><comment><USER11> With greater than 50% of capacity, you can do a lot of bad things.

For ASIC blockchains like bitcoin, a few companies in china dominate the network so they could easily collude and do just this.

For non-ASIC blockchains, you can do it through the cloud. Here is some math i did on it the other day:

digiconomist [0] estimates that current etherum mining cost is 1.3 billion a year, or 3.6 million a day, or 151,000 an hour, or 2,500 a minute.

Multiply by 5 for cloud on demand premiums and you could dominate the etherum network for an entire day for 18 million. You could also do it for free if you can manage to do it with stolen credit cards.

[https://digiconomist.net/ethereum-energy- consumption](https://digiconomist.net/ethereum-energy-consumption)

<comment><USER12> The reality is that even for Bitcoin, the attack, as described, is infeasible. It is possible for miners to collude to censor transactions, but not to create fake transactions, or to somehow steal money from a person and deliver it to others. An attack on that scale would require rewriting the block validity criteria, and no existing nodes or other miners would accept the new criteria, which would result in the chain forking, and the main chain simply losing a lot of hash power, which would be working on the fork that contained the change the validity criteria.

</comment></comment><comment><USER13> You're correct that cooperation is key and that if you get "enough" people (50% of hashing power in most cases) behind a plan, they can change the rules of the game. This could be used to steal coins.

This has actually happened in the past. When massive amounts of Ethereum were stolen from the DAO, the community got together and decided that those coins did not belong to the hacker. With >50% of the network, they forked the coin and created a refund contract where people could retrieve their stolen coins.[1] The dissenters remained to form what is now Ethereum Classic.

So, what prevents this from happening in a malicious way? The first hurdle is building that consensus. Many people involved in cryptocurrencies today believe that the future value is much higher than today's value. Paying them off would not be easy, especially considering that cashing out a large sum would crash the price of the coins, and thus the profits from your maneuver.

That being said, a core assumption of cryptocurrencies is that 50%+ of the network is not malicious. Another way of looking at this is that whoever controls greater than 50% of the network cannot be considered malicious from the network's perspective. They _are_ they consensus.

The last point I'll make is speculative. If you created (or took over) a cryptocurrency and built consensus out of malicious actors, what value do you think the outside world would place on that coin? You would win lots of coins, but would anybody pay you dollars for them?

[1] [https://www.cryptocompare.com/coins/guides/the-dao-the- hack-...](https://www.cryptocompare.com/coins/guides/the-dao-the-hack-the- soft-fork-and-the-hard-fork/)

<comment><USER14> Now sell your coins...bitcoin is only worth something if it works. you'd also have to get bunch of people that have invested most of their lives to it.

<comment><USER15> ... unless the end goal is not to generate profit, but to diminish value represented as BTC by undermining fundamental faith in the network, in which case, a value drop is working as intended.

</comment></comment></comment><comment><USER16> When you create counterfeit money, you damage people's trust in the money, which damages it's perceived value. You'd have to do it without doing catastrophic damage to the public trust, because then all you've stolen wouldn't have nay value.

However, you could SHORT crypto currency and then do some damage it. Where would this logic break?

<comment><USER17> Shorting never damages anything, it's just a market adjustment mechanism.

<comment><USER16> Yes, it doesn't. Also isn't not what I wrote about.

</comment></comment></comment><comment><USER18> > the cost to get enough shared ledgers to agree that user x has 0$ > (previously had $5M) is less than or equal to the amount of money that could > be divided amongst the thieves

That's the trick. In some cases, you'd be correct and the thieves can get away with theft. In most cases though you are incorrect, the cost of getting that many ledgers to agree with the thieves is prohibitively high.

This theory underscores the importance of having many full nodes running on the network. If only a small number of people run validating nodes, the cost of committing some theft like this is substantially reduced. This is one of the biggest and most important arguments behind having small blocks instead of large blocks.

Large block supporters tend to think you only need a few full nodes to get immunity from these types of attacks, and small block supporters tend to believe that a small number of nodes is easy to compromise relative to the reward for doing so.

<comment><USER19> > Large block supporters tend to think you only need a few full nodes to get > immunity from these types of attacks

How exactly do you see an attack on full nodes going down? I imagine the attack would occur on the mining side..

Also, if the mempool becomes more expensive to host than blocks on disk - would you still think small blocks are safer?

<comment><USER18> Hack the full nodes to modify their database. Or cut a business deal with the biggest full nodes (Coinbase, Bitmain, Shapeshift, But go, etc.) and decide to implement a rule much of the network opposes, like raising the block size (which consequentially makes a repeat attack easier in the future because fewer users will have the resources to run full nodes themselves)

<comment><USER19> > and decide to implement a rule much of the network opposes

And they'll immediately be blacklisted from the network..

Do people realize you can store the entire bitcoin chain for less than the cost of one transaction? The centralization narrative doesn't hold up.

</comment></comment></comment></comment><comment><USER20> >> Isn't cooperation key to a decentralized system?

Slightly off-topic, but cooperation is key to traditional currencies, too. If a majority of the United States determines that I suck and tries to stick it to me and anybody who does business with me, all of my US Dollars would have substantially less purchasing power.

<comment><USER21> I'll be off-topic with you. Your scenario seems a little different, because I could still shop with dollars at the 49% of stores that still like me. Whereas if bitcoin replaced dollars, even those 49% of stores that liked me couldn't take my money, because the 51% can veto the transaction.

<comment><USER22> Imagine its an industry at the top of the food chain and middle man are forbidden, so you can go shop at the neutral 49% of stores, but they may not provision you with something essential and monopolised. Although in those cases the law is layed out to mandate certain types of business take contracts.

</comment></comment></comment><comment><USER23> 1\. enough people means >50%, that's a lot.

2\. ledgers keep transaction histories, not absolute values. to clear someone's wallet, you have to transfer his money out. you can't forge that guy's crypto signature.

3.whoever owns more than 5m would not probably put all the money under one wallet.

<comment><USER24> > 2\. ledgers keep transaction histories, not absolute values. to clear > someone's wallet, you have to transfer his money out. you can't forge that > guy's crypto signature.

As long as there's >50% consensus, they can do anything they want (longest chain wins).

You don't need to forge someone's crypto signature to clear their wallet.

You just stop agreeing that the guy has the 5m.

<comment><USER25> The longest valid chain wins. People can't add invalid blocks to the chain and have them be accepted by the rest of the community that is not in on it.

The power of >50% is that you can keep some (valid) blocks on the chain, like some payments to a service provider, for as long as you want and have them accepted by the community because that's the longest chain that everyone's seen, and collect the service for that payment. Then whenever you want release another chain, that's longer and doesn't include the payment blocks, invalidating the payment.

The rest of the 49% of the users can still agree that someone has 5m, nobody's gonna take that away from them. But they're not going to be able to agree on any payments on the chain, because the 51% could invalidate them at any point.

<comment><USER24> Yes you are correct.

</comment></comment></comment></comment><comment><USER24> As another person said, that would damage the reputation of the network.

It reminded me of how in the movies a group of bad guys get away with the big briefcase of money and then two of them plan to get rid of the third guy and split the rest between themselves.

</comment><comment><USER26> You don't even need a protocal change (patch) - a supermajority group of validators (miners or stakers) can censor the minority group profitably, with no way to tell in-protocol.

The fact is, all existing blockchain protocols are not coalition resistant Nash equilibria ([https://en.m.wikipedia.org/wiki/Coalition- proof_Nash_equilib...](https://en.m.wikipedia.org/wiki/Coalition- proof_Nash_equilibrium)) and we rely on the difficulty of coordination for security. Strong centralization can make coordination easier though.

</comment><comment><USER19> No you can't do this. Disregard the DAO comments. Yes, a hack _caused_ a hard fork - but the fork itself _was not a hack_.

You can't _update_ an account value without issuing a valid transaction (requiring the private key). What you can do with a majority hash power is _roll back_ transactions. But this is limited to your ability to generate a longer chain which becomes more improbable with each mined block.

This attack vector isn't that great because transactions worth larger amounts will wait for more confirmations. You're essentially left with an expensive DoS.

</comment><comment><USER12> The particular attack you describe is infeasible in Bitcoin for sure, and almost certainly for any other cryptocurrency. The problem is that the miners certify that a given chain is valid, but nodes and other miners will apply block validity criteria on top of that. Block validity includes things like "transactions are properly signed" and "miner rewards are correctly calculated".

This effectively means that creating a "fake" transaction that would empty someone's account and credit it to the thieves would require a valid signature from the original account. Otherwise nobody would accept the new block. Changing the block validity criteria is possible, but requires cooperation on a much more grand scale, especially for Bitcoin where there are many implementations of the protocol that would have to change to match the new block validity criteria (which, suspiciously, will contain a new criteria saying "oh, and the signature check criteria don't apply to transactions from this address").

Without some form of consensus, this would amount to "theftcoin" simply being a hard fork of Bitcoin, with the main chain continuing, potentially with less hash power.

</comment><comment><USER27> There's a cost to run shards - bandwidth, processing and storage. Each transaction has a 2n1 cost (2 Parties, 1 shard, 'n' shards to sync too.) Decentralization has a high overhead to verify transactions over 'n' participants.

That why centralized ledgers were created. Sharded ledgers just means that you have smaller ledgers that have to be synchronized at some point. When you have more centralization you have larger chance of fraud.

</comment><comment><USER28> It doesn't break down everywhere. This is one of the reasons why BTC is leading the way even though there are a lot of other blockchains which are arguably "better". Being the first kid on the block has a lot of benefits since the mining power is sufficiently large and distributed that it's near impossible to have a 50% attack now, unless the miners stop mining or cooperate.

If you think about it, there are many improvements that could be made to basic networking protocols (TCP, IP, HTTP), but since the standards were set "in stone" so long ago, it is difficult to change now.</comment>


Ask HN: Do you have a side project you want to sell? - <AUTHOR> A similar thread was posted a couple of years ago. If you have any side projects that you've built and that you no longer have time for, I'm sure the HN community would have an interest in hearing about them. <comment><USER3> [http://westoncb.com/projects/tiledtext](http://westoncb.com/projects/tiledtext)

A new form of text editor designed from the ground up for lower precision input devices (e.g. motion sensors, touch screens). Demo video at the url above.

I had issues using mouse and keyboard and gave up programming for six years until the concept behind this hit me. The actual software is an engine/framework for producing particular text editors (I figured I'd need to extend it to in a similar manner to Emacs, so that I could efficiently do, e.g., command line things too). _It could also be configured to edit natural language documents for text editing on e.g. mobile devices and VR_.

Editing and navigating documents is done, and there's a system built, but not yet attached to the UI, that is effectively a universal autocomplete: you give it an EBNF grammar for some language and it can list all grammatically valid options (that you could insert) from any point in a document. (I'm thinking of extracting and open sourcing that part. Not sure yet, though.)

I worked on it for a year and half, had an increase in medical bills and had to work more—haven't touched it much for a couple years. The copy on the website is oold.

<comment><USER4> this is really cool. the sound effects are legit.

</comment></comment><comment><USER5> [http://wordsafety.com](http://wordsafety.com)

I made this last year, but failed to build on the initial audience... There's no revenue, so any offer will be considered.

The site was launched in August 2015 and got 79,000 pageviews in its first month. It also got some media attention which has given the site quite good search engine ranking: it is a top-3 Google result for most of the relevant keywords and search phrases.

I can also throw in the domain BabyNameCheck.com. There's no site there currently, but you could easily reuse the word check back-end from WordSafety... Just make a new baby-themed design and it could be a site that any parent would want to check out when trying to decide a name.

(Edit: Please don't post word suggestions in comments - there's a form for that on the site :))

<comment><USER6> It seems like you could get at least a little monetization by combining it with a domain registration affiliate program.

The BabyNameCheck could also link to name popularity data to find names that aren't too common but also not too rare. Monetize with Amazon links to baby products.

<comment><USER5> Good ideas! Does someone want to take this site off my hands and try these?

</comment></comment></comment><comment><USER7> [https://breaker101.com/](https://breaker101.com/)

I launched this a few years ago with great success (>$100k in a single day), but despite the content being highly valued by the folks that have gone through it, I've had a hard time getting it in front of people. It's very profitable, but I just don't have the time nor the marketing acumen to really take it to the next level.

<comment><USER8> Surprised that this is one here. Curious- how many folks are helping you run this? I'd love to chat about how my skills / experiences (sales, marketing) can help you out. Email me [hn_username]@gmail.com so we can talk.

<comment><USER7> It's just me on this one. Honestly, I'm happy with how much it's bringing in at this point ($1-2k/mo, with the occasional jump up if a company sends their whole team through) and not looking to put any more time into it. Outside of a few hours a week in reviewing coursework/exams and helping students, it's really just pure profit for me, but I think that someone else could do a lot more with it than I can (or am willing to).

</comment></comment></comment><comment><USER9> [http://json-porn.com](http://json-porn.com)

Well known API for adult content, hosted on the Google Cloud Platform. 0 seconds down time since about a year. Profitable.

<comment><USER10> Getting ERR_CONNECTION_CLOSED on that URL. Edit: URL is not https, it's http. [http://json-porn.com/](http://json-porn.com/)

<comment><USER9> Thanks for pointing this out. The actual API provides SSL encryption, the landing page however doesn't.

</comment></comment></comment><comment><USER11> For those who might be interested, I run a website called SideProjectors.

[https://www.sideprojectors.com](https://www.sideprojectors.com)

It's a marketplace where you can post and sell your side projects to those who might be interested.

Also a few months ago, there was a post regarding "tips on selling your side projects"

[https://news.ycombinator.com/item?id=12254484](https://news.ycombinator.com/item?id=12254484)

<comment><USER12> Cool project! I can't open results links in a new tab, so it's hard to browse through the site :(

Reproduce: CMD+Click any project.

</comment></comment><comment><USER13> [https://www.slidingboxes.com/](https://www.slidingboxes.com/)

Saas portfolio site for artists. Launched Jan 2013. 0 Marketing. 5k+ users (not sure where they are coming from, not sure if they are spam accounts) 29 customers, but only 8 are currently active/billed.

Site exists on an AWS ec2 instance, mysql DB on RDS. Application is split into three Laravel apps: 1) slidingboxes.com site 2) admin panel to manage portfolio 3) the portfolio itself

Stripe used for billing (via laravel Cashier package).

Ansible used to provision/deploy. Local dev via Vagrant. Source code managed via private Git repo on bitbucket.

<comment><USER14> Shot you a message on your contact form

</comment></comment><comment><USER15> [http://www.secretsantagenerator.net](http://www.secretsantagenerator.net)

Lets people organize secret santa gift exchanges via e-mail, including rules about who can buy for who.

At its peak in the holiday season, gets about 10k uniques per day. Close to a million people have used it since launch in 2011.

Very easily monetizable - just provide affiliate link gift recommendations. I had intentions of doing this so many times but just never followed through and got bored with the project.

<comment> angry-hacker What is it written in?

<comment><USER16> I found builtwith.com way too late for the internet age... See [https://builtwith.com/?https%3a%2f%2fsecretsantagenerator.ne...](https://builtwith.com/?https%3a%2f%2fsecretsantagenerator.net%2f)

</comment></comment></comment><comment><USER17> [http://rdnation.com](http://rdnation.com)

Long running project. Team Management. Profitable with 100s of customers. 5 other sister sites, [https://snation.com/](https://snation.com/), [https://oarnation.com/](https://oarnation.com/), [https://bullockingnation.com/](https://bullockingnation.com/), [https://swimdecknation.com/](https://swimdecknation.com/), [https://thatgreek.com/](https://thatgreek.com/)

<comment><USER18> I'm interesting buying. Can you please contact me? firstname.lastname@example.com

</comment></comment><comment><USER19> [https://freeyourmusic.com](https://freeyourmusic.com) \- songs mover across different music streaming services (eg. Spotify -> Apple Music).

It makes around 20k$ in revenue but I am focusing now on something else.

<comment><USER20> Hi, I'm interested. Can you let me know how much you are planning to sell it for. My email email@example.com. Thanks.

</comment></comment><comment><USER21> I have two side projects for sale:

[http://pagecull.com/](http://pagecull.com/) \- Simple API to extract content from articles.

[http://stilt.im/](http://stilt.im/) \- Provide Twitter support from Slack. Get mentions and DMs, send replies, view users and engage directly on Slack.

Buzz me on firstname.lastname@example.com for a chat

<comment><USER22> Interested in stilt.im. Email me: drigbye [at] gmail.com

</comment></comment><comment><USER23> Will entertain offers for my startup [https://commando.io](https://commando.io) (Commando.io). Solid monthly recurring revenue. Contact info in HN profile.

</comment><comment><USER24> [https://achshar.com/school/about](https://achshar.com/school/about)

A cms for schools and colleges, lets students, parents, teachers, staff, etc log in and view/add student attendance, homework, assignments, datesheet, exam result, generate report card, view/manage student and teacher data, lecture timetable, send SMS/email newsletters, get different printouts with different set of data columns and a bunch of other stuff that I am probably forgetting about. I made/maintain it myself. I have 4 paying customers (schools). Revenue isn't much but whatever it is, it's all for myself, not have to pay anything forward other than hosting which is like 2500 rupees / year (37 dusd/year).

<comment><USER12> I built something similar with a friend (grades.io) but student data compliance laws in the US made us decide to let the project sit.

<comment><USER24> I am based in India so I don't have to worry about that much. We have a very over priced market here, with something like $2/student/year to 1$/student/month. With an average of 2k students in each school that would be insane amount of money. I instead charge a fixed 250 usd per year. Somehow schools still aren't that interested.

</comment></comment></comment><comment><USER25> [http://founderskit.co/](http://founderskit.co/)

FoundersKit – The membership that saves you money, on the tools that save you time.

We launched this last year (it was the 2nd highest upvoted product of the month on Product Hunt: [https://www.producthunt.com/posts/founderskit](https://www.producthunt.com/posts/founderskit)).

We've not focussed on it at all since launch, other than launching v2 based on some feedback. There's been no marketing efforts gone into it due to other focusses.

Looking to sell it on so we can give the users the best experience and focus on another project.

DM me on twitter (@fredrivett) or message me at fred [at] wearecontrast [dot] com.

Happy to give more details on request.

</comment><comment><USER26> I have a project where I "reverse engineered" this world class poker bot: [http://www.slumbot.com](http://www.slumbot.com). I have something akin to a "what would slumbot do?" API where you can enter the parameters for a heads up poker situation (hole cards, aggression, etc.) and get back a decision. It's far from perfect (and the code is a mess) but it worked surprisingly well in practice. I don't have time to work on it since I've started a new job and online heads up poker is kind of dead at low stakes but it might be useful to someone? Drop me an email via my profile if you're interested.

<comment><USER27> Hello, I've always been interested to work in a coding project that is related to poker and this might be a good start. Can you please send me a quick reply to (not able to send private email here): email@example.com

Thanks, Roger

</comment></comment><comment><USER28> Hyperbook ([http://getbook.co](http://getbook.co)) is for organising study notes and research information.

I used many bookmarking/note-taking/wiki software while writing my research thesis. Found limitations such as searching, linking notes and revisiting bookmarks. Currently it is used by many students, book authors and research scholars at top universities in India. . Maintained the site for two years without any revenue model. Want to maintain the free version for more years to come.

</comment><comment><USER29> [https://www.freesunglasscompany.com](https://www.freesunglasscompany.com)

It's an e-commerce fashion store for sunglasses. It is very similar to a website that sells watches, freewatchcompany. The website is built off the Shopify platform, which is amazing. Products are dropshipped from China, and made easier using an app called Oberlo. I don't put any additional time into the website, though I should.

I advertised using Facebook/Reddit one time and made over $100 revenue in the first 24 hours (end of September), then got busy and haven't touched the site since. The site is pretty much setup and ready to go. You would have to run through the site's products and confirm that the seller on AliExpress is still in business and still has the product, but you can easily use Oberlo to wipe out all inventory and start over with sunglasses that you want to sell.

The sunglasses are all $0 to the customer, but we charge for shipping, which is where the profit comes from. The "free" brings the customer to the door. Typical sale is $10, with profit being between $6.50-$8.00.

Any tips to market the site or make it better are appreciated, as well :)

<comment><AUTHOR> How can I get in touch with you?

<comment><USER29> As a starter I would suggest to you and any others that read this reply to just simply shoot a quick note over at [https://www.freesunglasscompany.com/pages/contact- us](https://www.freesunglasscompany.com/pages/contact-us). It will come direct to me

</comment></comment></comment><comment><USER30> I'm interested in selling [http://www.seasonalysis.com](http://www.seasonalysis.com). The site has been around for over 4 years and has a wealth of seasonal market data. We have subscriptions ranging from $50/month to $5000/year with several at the top membership tier. I think with the right marketing campaign and site content it could be quite lucrative but I just don't have the time.

<comment><USER31> What is the best place to discuss this with you?

<comment><USER30> Get in touch via email and we can take it from there. You can find my contact info here: [http://illyabusigin.com/about](http://illyabusigin.com/about)

</comment></comment></comment><comment><USER32> I wrote a very popular iOS animation program, FlipBook, and a friend wrote a companion Django-based website, flipbook.tv. Then I hired a group to write an iPad version, FlipBook HD. I also own all the legal rights worldwide to the trademark FlipBook for mobile animation software. I've just been too busy to update it, so I'd be up for selling it. You can reach me on twitter (@joshanon) or via joshanon.com (there's a contact form).

</comment><comment><USER33> [http://www.sysadminsoftware.com](http://www.sysadminsoftware.com) I made this tool like 5 years ago, to scratch my own itch as a I was a sysadmin in charge of securing thousands of machines. Those days are gone now and I currently have no time for this. The tool still works. To be honest I have not advertised it at all. I made sales only from people landing on the website through google search.

</comment><comment><USER34> Attendize is an open-source event management and ticket selling platform.

The platform is licenced under the Attribution Assurance Licence so all installs are required to include the "Powered By Attendize" link.

Money is made by selling white-label licences.

[https://www.attendize.com](https://www.attendize.com)

[https://github.com/attendize/attendize](https://github.com/attendize/attendize)

<comment><USER35> [update] Sent you an email.

</comment></comment><comment><USER36> [http://bitcoinmegaphone.com](http://bitcoinmegaphone.com)

An anonymous public blog where you pay per character with Bitcoin. Kind of like "The Million Dollar Homepage" for Bitcoin.

Got some press when I launched in 2014 ([http://bitcoinmegaphone.com/press/](http://bitcoinmegaphone.com/press/)), but haven't had time to build beyond the core product.

</comment><comment><USER37> I might consider parting ways with [http://www.LiberWriter.com](http://www.LiberWriter.com) if the right person were interested. It currently has revenue and doesn't require much of my time, so it's not urgent for me. Someone who is willing to take good care of existing customers is important too.

</comment><comment><USER38> [https://www.browser-details.com](https://www.browser-details.com)

Written in Django, got some HN love a while ago - no signups for a while now but we have over 500 accounts that signed up at some point. About 20 sprang for the "Pro" version at $10/month. We even had a customer pay $50/month for an API version integrated directly into their site.

It's used to have your customers send their browser details directly to your inbox. Just point them at your site such as [http://example.browser- details.com](http://example.browser-details.com) (CNAMEs with custom domain possible).

Created to scratch our own itch: previously, most of our customer would be hard-pressed to name their browser version so it was very helpful in development. Uses an external API to map the user agent string to browser make/version.

Interesting trades considered. ;-)

<comment><USER39> > Interesting trades considered. ;-)

How about a conversion van? Lightly used by an elderly couple for a getaway in Central Park. Other than that, completely unsullied!

</comment></comment><comment><USER40> [https://www.twitteraudit.com](https://www.twitteraudit.com)

Estimates fake Twitter followers for any account. Helps users find and block fake followers (coming soon). >100k visitors per month (45% returning). >1M users audited and over 500k users signed-up. Some revenue ($12k/year).

<comment><USER41> Why does it want permission to post from my account?

<comment><USER40> We recently changed the permission to introduce the "pro" blocking feature. There doesn't seem to be a way to get "write" perms in a more granular way. The app doesn't actually post anything though.

</comment></comment></comment><comment><USER42> [http://founderpact.com](http://founderpact.com)

It's not making any revenue so any offer will be considered. It's a tool for helping inexperienced founders avoid common mistakes when starting a business with someone, both legally and in terms of making sure you're on the same page. Did it after getting very burned on a business venture because of this.

Got retweeted by some TechCrunch writer and also got to the frontpage (I think) of ProductHunt a while back. But I never got the time to get the product to where I wanted it to be (pay a $49 fee to get a good legally binding agreement based on the data you provided that you can just download, print and sign, and avoid problems and lawyer fees) nor market it properly (I also think it would be great to partner up with people who organize hackatons etc).

Built in Rails, hosted in DigitalOcean.

Email in profile

</comment><comment><USER43> [https://www.rackforms.com](https://www.rackforms.com)

Started in 2007, profitable every year since.

Web-based form and application creation software offered both as a stand-alone purchase or fully operational cloud subscription. Currently outputs as PHP or C#, can be extended to just about any other language/platform.

Very loyal users, often generating excellent leads for software consulting projects.

Currently finishing up code for several partnerships including offline forms, workflow integration, and several others. The hope is these partnerships could bring huge wins in existing markets.

Want to sell for a simple reason: every year I tell myself I'll start marketing properly, and every year I ignore that and write code instead.

It's time to place this project in the hands of someone or some organization that can grow it into the powerhouse it can be.

If interested let's chat!

</comment><comment><USER44> A few years ago I co-started [http://www.bitcoinpulse.com](http://www.bitcoinpulse.com). I had to take it down last year after running out of time to deal with it, but I've recently brought back a simplified version.

While the traffic is insignificant at the moment, I'd like to believe that the brand is still strong and a small push could revive the traffic.

The twitter account [https://twitter.com/bitcoinpulse](https://twitter.com/bitcoinpulse) has a small following - there are a few known people from the bitcoin community (but the vast majority seem like "bot" accounts).

It's written in clojure/script and hosted on heroku.

I'll take offers in bitcoin (obviously). Any interested parties can email me at firstname.lastname@example.com

</comment><comment><USER45> My answer from a similar thread a couple of months ago:

[https://news.ycombinator.com/item?id=12285392](https://news.ycombinator.com/item?id=12285392)

StartOpz ([http://www.startopz.com](http://www.startopz.com)):

Workday-lite (really lite) for small businesses. Individual components such as time-off tracking and expense reports all have sites on there dedicated to them individually that seem to do well. This covers all of them and could use somebody who has time to dedicate to (content) marketing.

Moviestud.io ([http://www.moviestud.io](http://www.moviestud.io)):

Production management for independent filmmakers. The blog has a lot of epic length blog posts that can use somebody who can spend some time promoting them.

</comment><comment><USER46> [https://kitgui.com](https://kitgui.com)

This is something I had to put together from scratch to cope with working across any type of backend programming language when I was doing ecommerce web apps to enable customers to edit their websites very easily and flexibly.

KitGUI is a content management SAAS that runs off of Amazon S3 for content storage and plugs into any backend. Editing is accomplished on the customer's website directly through a JS plugin. It makes a little money but more as an adjunct to existing products. I would also be open to working on this seriously if there was investor interest but there is a hell of a lot of CMS systems out there. It is very sturdy because it runs off of Amazon S3 for all the content serving.

</comment><comment><USER47> It's not that I don't have time for it, I'm actually looking for a partner. I'm making a DIY Chromecast-clone Software solution, which you install on Debian and you can use our apps to cast stuff to your TV. Great way to repurpose an old PC, or test out a rPI, etc... It's meant to be semi- proprietary, and it's great for countries where Chromecast hasn't launched and 2nd hand ones go for as much as $100 which is a price of a refurbished Intel Atom PC :S. Mail me at (my username) (at) gmail (dot) com if you're interested and want a demo over Skype or something. It could earn money by showing ads on the screensaver or simply being pay to use...

</comment><comment><USER48> In 2013 I built an app essentially for myself to solve the recurring problem of sales tax declaration in Germany. I have to do this quarterly or monthly and filling out all the official forms was painful and time consuming. So I came up with

[http://kassomat.net](http://kassomat.net)

An SPA with a simple yet accurate approach where you just enter 4 key numbers and are done in under a minute.

Due to my recent lack of time I was not able so far to adjust the App to the latest official API's, but that's doable. Open to offers.

</comment><comment><USER49> [http://www.dailysitesnap.com](http://www.dailysitesnap.com)

Take a screenshot of a web site every day, optionally have it emailed directly to you as an attachment.

<comment><USER18> I'm interested in buying. Can you please get in touch with me? firstname.lastname@example.com Thanks!

</comment></comment><comment><USER50> [https://metropolis.dysr.com](https://metropolis.dysr.com) \- centralized, automated SFTP / GPG / Zip tool for Windows environments.

</comment><comment><USER51> [http://www.packagehop.com/](http://www.packagehop.com/)

\-- "Ask your friends and acquaintances to deliver your package on their route."

</comment><comment><USER52> I have an uptime monitoring iOS app with bespoke Golang API and Django web dashboard to go with it.

I have discontinued it couple of months ago due to lack of time to concentrate on growing it.

Here's a blog post with couple of screenshots if anybody is interested: [http://blog.richardknop.com/2016/05/pinglist-uptime-and- perf...](http://blog.richardknop.com/2016/05/pinglist-uptime-and-performance- monitoring-done-right/)

</comment><comment><USER53> [http://psatool.com](http://psatool.com)

Physical security assessment tool based on NIST and ISO standards.

Needs more work. I have some ideas if you want to discuss.

</comment><comment><USER54> [https://atlantastartupjobs.com](https://atlantastartupjobs.com)

no revenue. 250+ subscribers to weekly email blast. 75 sessions / day.

make an offer.

<comment><USER55> Where are you sourcing the jobs? indeed.com api or something?

</comment></comment><comment><USER56> A bunch of .it domains with exhausted, failed or never started projects: bestapps (formerly a web magazine, now a never happening apps recommender system); databot (now a landing page for a local business); jobsud + jobcentro + jobnord (an empty job board, not starting because of a break up with the sectoral partner). Getting rid in order to focus on my primary nuclearresearch.net. Anyone going for the full batch of five .it?

</comment><comment><USER57> [http://mskr.co](http://mskr.co)

I wrote a (free) simple super-basic photo editing app natively for iOS, Android and Windows Phone and have over half a million downloads. It has been a good resume piece, but I don't have time to work on it anymore.

I also wrote mrgr (also on mskr.co) a similarly simple video editing app for iOS. Less downloads, but I'd throw it in if anyone wanted to buy either.

<comment><USER58> I am interested - email me (id in profile)

<comment><USER57> I sent a message using the form on the website in your profile.

</comment></comment></comment><comment><USER59> [http://www.wpcommandcontrol.com](http://www.wpcommandcontrol.com)

Managed WordPress updates, backups, uptime alerts, security scans, performance tracking, etc

I use this every day personally, but don't have the time / energy / resources to market it beyond my immediate network.

Currently manages ~100 "real" accounts and I've spun up 15k dummy sites on occasion for load testing without issues.

<comment><USER60> I'd be interested in operating this with you. I see the appeal and have my own customer-base that would definitely want this type of product.

<comment><USER59> Sure, probably the best way to get in touch would be the contact form here:

[https://www.wpcommandcontrol.com/contact/](https://www.wpcommandcontrol.com/contact/)

thanks!

</comment></comment></comment><comment><USER61> I made a facebook chat bot for teaching people vocabulary. It asks you mcq- questions and responds back with yes or no. Can be used for any kind of single/multi-choice question quiz/game.

Have some people using it but I did't really bother marketing it too much. If somebody is interested, I can set it up for you and provide a backend to manage it yourself. Contact : sudshekhar02[at]gmail[dot]com

</comment><comment><USER62> [https://www.playplay.io](https://www.playplay.io)

A Slack bot leaderboard for ping-pong, chess, etc. Open-source, written in Ruby, [https://github.com/dblock/slack- gamebot](https://github.com/dblock/slack-gamebot), with premium features. A handful of paying customers at $29.99/yr. No time to work on it.

</comment><comment><USER63> [http://devport.co](http://devport.co) \- Portfolios for developers.

Supports uploads from GitHub, Websites, App store, etc. Automatically imports screenshots, titles, and descriptions.

Command line tool and documentation for creating your own themes. Built on Mongo, Express, Angular, Node. SailsJS. A few hundred users with a few thousand total uploaded projects.

</comment><comment><USER64> [http://agile-gps.com](http://agile-gps.com) Scalable real-time, fleet tracking web app built on Node.js and RethinkDB. Contact info in HN profile. Uses RethinkDB changefeeds and websockets for efficient realtime updates to clients. RESTful, can handle many vehicles on a typical server, and stateless and horizontally scalable.

<comment><USER65> May be interested email jaykwal at gmail.

</comment></comment><comment><USER66> Developed a solution (File System Filter Driver) to prevent ransomware from encrypting users' files. It's 70% done but I have recently accepted a position at a company and will not have time to build a full fledged product. I have tested it against major ransomware variants and it has proved very effective. I am looking to license either object or source code.

</comment><comment><USER67> [https://www.asknestor.me](https://www.asknestor.me) \- a programmable Slack bot platform, over 2000+ installs, featured by Slack App Store and has a cool programmable interface for AWS Lambda.

[https://www.youtube.com/watch?v=61MimimmOZQ](https://www.youtube.com/watch?v=61MimimmOZQ)

</comment><comment><USER68> Considering selling rights to Planimeter's Grid Engine.

[https://github.com/Planimeter/grid-sdk](https://github.com/Planimeter/grid- sdk)

[http://www.planimeter.org/grid-sdk/](http://www.planimeter.org/grid-sdk/)

<comment><USER69> Sounds quite cool. You need some screen shots / animations on that page :D

</comment></comment><comment><USER70> I have an iOS app which is for internal organisations like they can chat among groups,create new groups for chat or individual chatting.Any one can create a meeting event and fellow folks can accept or decline that calendar event.Events get synced with device calendar.Very Clean UI/UX.

</comment><comment><USER71> [https://brandfountain.com](https://brandfountain.com)

A startup brand store with curated inventory of premium project and startup domains. Domains can be developed or sold as is.

Needs a little polish before launching, don't really have the time.

Instant revenue stream with a bit of marketing.

<comment><USER72> This is neat, I missed the service Stylate used to provide.

</comment></comment><comment><USER73> [https://play.google.com/store/apps/details?id=co.kica.bitzah...](https://play.google.com/store/apps/details?id=co.kica.bitzah&hl=en)

Bizah retro pixel camera android app written in java with a C++ image conversion routine

<comment><USER31> This seems cool. Have you done any marketing for this?

</comment></comment><comment><USER62> [https://market.playplay.io](https://market.playplay.io)

A Slack bot that gives Yahoo! Finance market quotes and lets you track stocks. Free 7 day trial, 1.99$/mo after that, virtually no paying customers but hundreds try. No time to work on it.

</comment><comment><USER17> [https://myheaps.com](https://myheaps.com)

Lets you download content on the web. Backup social sites, reddit, etc... 100s of subscribers. Getting ready to shift to a credits based system. 1 url per 1 credit.

Profitable and well received.

</comment><comment><USER74> www.c0dereview3rs.com (I mangled this to avoid having this comment associated with the domain).

Boutique consultancy providing professional code reviews. Could be run by a coder who likes to do reviews and writes well or by a project manager who contracts the work out to experts with the appropriate skills. I have done projects both ways. I have some good reports to give to prospective clients and have found that customers who reach out are usually serious.

It has been completely ignored for many years. It used to get a good lead every month, but I haven't checked the inbound email address in years. I joined a trading group in 2007, loved the work and quit doing side projects.

</comment><comment><USER75> [https://flockmetrics.com/](https://flockmetrics.com/)

User signup/acquisition analytics for SaaS startups. Always open to entertaining offers from someone excited about the user lifecycle space.

</comment><comment><USER76> [http://www.diff.so](http://www.diff.so)

An online diff-as-you-type tool with the ability to generate static HTML diffs. Built it to scratch my own itch. Has basically 0 users and no revenue whatsoever :).

<comment><USER77> contact info?

<comment><USER76> Oops, added to my profile.

</comment></comment></comment><comment><USER78> [http://www.suitematch.com](http://www.suitematch.com)

One of the original websites for sharing office space. I used to have Google display ads on there, but since removed so revenue is zilch.

</comment><comment><USER79> [http://first-commit.com/](http://first-commit.com/)

It helps you find the first commit of a GitHub repo, created this year, it's on the front page of HN for a short while

</comment><comment><USER80> [http://changelogtheme.com](http://changelogtheme.com) wordpress theme+plugin for changelog sections/subdomains 15 sales during current year

<comment><USER31> I would be interested in this. If you would like to discuss further, my email is shauravg at gmail

</comment></comment><comment><USER81> Yep: [http://seosorcerer.com/](http://seosorcerer.com/)

It's a bunch of page analysis scripts. Cool domain and grand-fathered Google Apps Free.

</comment><comment><USER82> [http://jp.sapterc.com/](http://jp.sapterc.com/)

This is demo site. contact me for detail (mistrypar[at]gmail[dot]com)

</comment><comment><USER83> [http://ineedaresu.me](http://ineedaresu.me)

I made it March 2015 and updated it December 2015. It's been sitting since, with a few thousand people using it every month.

It hit the #1 spot on Product Hunt, and after that it was posted about on Lifehacker, Inc., Newsweek, and others.

I've recently tried to spend time updating it to monetize it, but I just don't have the time to work on it.

Right now I make $100-200 per month from AdSense, but I really have no idea what I'm doing with it so nothing is optimized with the ads - they were just kind of slapped on there. I know it has potential to make money, I just don't have time.

<comment><USER65> I may be interested email jaykwal at gmail.

</comment></comment><comment><USER84> Im currently selling [http://jquerycards.com/](http://jquerycards.com/) A jQuery plugin repository

</comment><comment><USER85> [http://thefeed.press](http://thefeed.press) \- Easily follow articles shared by your Twitter friends.

</comment><comment><USER86> iBought < [https://itunes.apple.com/us/app/ibought/id811696972?mt=8](https://itunes.apple.com/us/app/ibought/id811696972?mt=8) > finance tracking app (iOS only). I had big plans for it but just don't have the time to make improvements. If anyone's interested, send an offer to email@example.com.

</comment><comment><USER87> [http://bidwars.net](http://bidwars.net) buy and sell with neighbors you trust

</comment><comment><USER4> [https://hexlist.com](https://hexlist.com)

its a simple way to make lists of links

</comment><comment><USER88> [http://netstati.com](http://netstati.com) \- website profiler

<comment><USER89> what is your current stack, hosting and crawling infrastructure? how many websites have you crawled so far?

<comment><USER88> PHP and Python. Current count - <USER2>

I have also scrapped all the websites from Quantcast but haven't scanned it yet.

The website is build using PHP including the crawler which works for the new websites not in the list.

For scanning multiple websites, the crawler is in Python which uses multiprocessing.

</comment></comment></comment><comment><USER90> insidertrades.org.

I won Yahoo!'s international student programming competition in 2009 with this site. About a year ago it stopped working because of deprecated PHP functions. It had/has quite a few users but I've been too busy to fix it up. It could use a more nurturing home.

<comment><USER91> Have you thought about putting it up on Github and asking people for help? Seems like a good site that could use a community behind it.

<comment><USER90> That's a pretty good idea. I've had a few people ask over the years how it's done, and I uploaded the original source code a few years ago. Although I could probably fix up the site faster than I could properly move it over to Github...

</comment></comment></comment><comment><USER92> [http://wesawit.com/](http://wesawit.com/)

</comment><comment><USER93> Www.prepaidfinder.com

Includes a backend for updating the listings. Was picked up by life hacker

</comment><comment><USER94> practido.com made with the dojo library. Is used by anyone who works with appointments (doctor, personal trainer, masseuse, etc) to manage their customers, appointments and invoices.

</comment><comment><USER95> [http://www.transparentstartups.com/](http://www.transparentstartups.com/)

If you are a developer, founder or wantrepreneur you should visit this site and learn from the ones that managed to build a successful business.

</comment><comment><USER96> mailsac.com email testing and disposable email

</comment><comment><USER97> i run a systematic trading strategy that has generated 44% returns since 2013.

would be happy to sell.

<comment><AUTHOR> What's your email?

<comment><USER97> email@example.com</comment></comment></comment>


Unify helps you understand ur audience so u can make better marketing decisions - <AUTHOR> http://tryunify.com?promo=hackernews <comment><USER2> Oh please</comment>


We're doing something stupid so that you don't have to - <AUTHOR> http://blog.superfeedr.com/gospel/something-stupid/

<comment><USER2> I was looking at something like this recently: <http://spinn3r.com/>

</comment><comment><USER3> Bad title. Diagram was interesting though.</comment>


Pwned Passwords, Version 6 - <AUTHOR> https://www.troyhunt.com/pwned-passwords-version-6/ <comment><USER2> I am seeing multiple discussions confusing the 'have I been pwned' and 'pwned passwords' services. This is a release of pwned passwords. I wrote a small commandline tool where I generate my own passwords and I validate them against the pwnd passwords database. The code can be seen here [https://github.com/vivekhub/password- generator/blob/9a3ca8aa...](https://github.com/vivekhub/password- generator/blob/9a3ca8aafaa39d3007293aff2b7f49ad2fc843d2/passgen#L73). The two lines of python code summarizes the approach. Create an SHA1 and send the first five characters.

</comment><comment><USER3> has anyone used the bloom filter that uses this? [https://github.com/62726164/bp](https://github.com/62726164/bp)

<comment><USER4> There are a few implementations of this kind of filter - [https://github.com/search?q=have-I-been- bloomed](https://github.com/search?q=have-I-been-bloomed) lists four I found. I haven't seen any usages yet in open source code on Github though.

Most seem to use the web API: for example [https://github.com/search?l=PHP&q=haveibeenpwned+API+v2+pwne...](https://github.com/search?l=PHP&q=haveibeenpwned+API+v2+pwnedpasswords&type=Code)

Other projects for pwnedpasswords: [https://github.com/search?q=pwnedpasswords&type=Repositories](https://github.com/search?q=pwnedpasswords&type=Repositories) YMMV, "read the source, Luke!" :)

</comment></comment><comment> timothy-quinn I've always found HIBP in this funny conflicting situation - on hand you should never provide your email or password to a 3rd party service because it's probably malicious, but on the other hand in HIBP's case it's very evidently _not_ malicious, so it's totally fine. But it's evident only if you follow Troy for a while to see what he's doing.

I think it's a good study in game theory at the least.

<comment><USER5> You don't have to send the password to determine if it's pwned... they have a hashing scheme to determine if a password was in any leaks.

See [https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByR...](https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange)

<comment><USER6> How can a regular user validate this? A malicious or compromised site could have same explanations and API page but would actually collect passwords.

<comment><USER7> It lets you search based on the first 5 characters of a SHA-1 password hash. So you use a trusted tool on your own computer to hash the password you want to search, and pass in just part of it. You get multiple results, and you can then compare against the hashes yourself to see if yours is in there. There's no way for them to collect your password that way.

</comment></comment></comment></comment><comment><USER8> I've always felt nervous entering my info, to do a look up. It's yet another data trail to elevate certain set of stolen data above the noise of unused/throw away/dead accounts.

<comment><USER9> Pwned Passwords uses a k-anonymity scheme so that your password is never actually sent to the server [0]. You can just call the API directly [1] so that you don't have to trust haveibeenpwned.com's JavaScript with your password.

[0]: [https://www.troyhunt.com/ive-just-launched-pwned- passwords-v...](https://www.troyhunt.com/ive-just-launched-pwned-passwords- version-2#cloudflareprivacyandkanonymity)

[1]: [https://haveibeenpwned.com/API/v3#PwnedPasswords](https://haveibeenpwned.com/API/v3#PwnedPasswords)

<comment><USER10> And if you are really paranoid, you can just download the whole set of hashes and do the lookup yourself.

</comment></comment></comment><comment><USER11> Is there a way I can hash my password myself then check if the hash is in the database via the web?

<comment><USER12> Yes: do a SHA1 of your password (no trailing newline), then fetch [https://api.pwnedpasswords.com/range/{first](https://api.pwnedpasswords.com/range/{first) 5 hash chars}. If the full hash appears in the results, the password has been seen in a breach.

<comment><USER10> Small correction: It's not the full hash that appears in the results, it's the suffix (so the part after the 5 chars you put into the URL).

If you don't want the password to end up in your shell history, this works on in the shell with common tools:

tr -d '\n' | sha1sum

Then type the password you want to look for, hit enter and control-d. You can test with "common" passwords like [https://www.reddit.com/r/XFiles/comments/6ge7h4/mulders_home...](https://www.reddit.com/r/XFiles/comments/6ge7h4/mulders_home_computer_password_is_8_characters/) if you're doing it right.

</comment></comment></comment><comment><USER13> Quote: "Further, a whole bunch of passwords that, um, well, I can't really print here also make an appearance, but use your imagination and you'll probably be able to work out a few of those."

Hihi, this cracked me up, best joke for today. Keep up the good work Troy

</comment><comment><USER14> I don't get what Troy Hunt has done to his tool. You used to be able to type in an email address and learn all the times your credentials have been in a leak/breach. Now he wants you to _enter your password_. What security minded person would reveal their password to a site like this? It would be trivial to associate your password to your IP address.

<comment><USER15> You're getting two different tools mixed up -- "Have I Been Pwned?" and "Pwned Passwords."

Have I Been Pwned is the tool where you search your email, and it displays breaches.

Pwned Passwords is an API (there is a front-end but that's not the usecase) where you send a partial hash of a password to the API, and it returns a list of partial hashes that match, and the implementation from there sees if any of them match the full hash. It's used by quite a few online services to ensure users don't use weak passwords, as if it's shown up in multiple data breaches, they might not let you set it as your password.

<comment><USER16> Good article explaining how they use k-anonymity here:

[https://blog.cloudflare.com/validating-leaked-passwords- with...](https://blog.cloudflare.com/validating-leaked-passwords-with-k- anonymity/)</comment></comment></comment>


Ask HN: Fitness without money and gym - <AUTHOR> I want to build muscles and good fitness, but I don't have enough money to join gym. How to do it? <comment><USER2> Start with the 30-Day Plank Challenge.

Since you mentioned good fitness, start recording what you eat in a food diary. This is the first step to eating healthier.

Also, get away from the damn screen and go take a walk.

</comment><comment><USER3> Not to market this app but I highly recommend "Sworkit" app. Tag line: "No Gym, No Excuse"

PS: I did workout today using that app.

</comment><comment><USER4> Body weight exercises and YouTube can take you a long way.

</comment><comment><USER5> body weight exercises</comment>