Don't Make Me Steal - <AUTHOR> http://dontmakemesteal.com <comment><USER2> I really don't like the "don't make me steal" attitude. It undermines a good society.

The creators of this campaign decided that "Purchase should not exceed the cinema price." Really? What if we did that for, say, organic bread. "I won't buy organic bread unless it's x3 or less than the cost of the generic white bread. If it is more expensive, I'm entitled to steal it."

Sorry folks, you're entitled to not buy it, not to steal it.

<comment><USER3> "Sorry folks, you're entitled to not buy it, not to steal it."

EXACTLY. Yes, downloading a movie isn't _exactly_ stealing, but it's still taking something without permission and it should be frowned upon just as much as stealing is. If a person pirates a movie they're taking something without reimbursing the rights owner with what _they_ want. People aren't judged for stealing because it costs the store owner money, they're judged because it's immoral! When someone steals a DVD from walmart nobody says "Whoa, you stole $9.99 worth of product! You should be ashamed!" they say "You stole something you weren't allowed, you should be ashamed". Why online does it suddenly become about the cost?

it doesn't matter how ridiculous their demands are, if Disney want $100,000 per copy of their latest film, that's their choice, if you disagree then _don't buy it_ that doesn't mean you should just take it.

The whole idea behind this website is self entitlement, nobody is entitled to someone else's creation and the idea that this website is doing the content creators a favour is laughable. If someone creates content (or someone owns the rights to created content) it should be their choice how people consume and acquire it, whether that's free, $9.99 or $100,000, that's their choice and we should abide by it. Pay what they want or don't have it.

<comment><USER4> "but it's still taking something "

 _taking_ ? Or copying?

Some _thing_? Or some representation?

A problem with these discussions is that people use common words as if everyone had the same understanding of their meaning and application.

If I download a movie, I'm not _taking_ that movie. And what I end up with is not a _thing_ ; if I then move it over to another drive, no _thing_ has moved, yet the movie can be watched.

Now, in the end, this action it may or may not be wrong or immoral or whatever, but arguments based on physical notions of "take", "thing", "own" are putting the cart before the horse.

<comment><USER3> taking = gaining possession of [item]

taking doesn't have to be negative and it's not a word associated with either side of the discussion, it's just a _word_. I can take $10 from my mum to pay for dinner, or take a magazine from a shop (after paying for it), it's just the opposite of give. You can take with permission, that's why I stated take _without_.

<comment><USER5> When you take $10 from your mom, your mom no longer has that $10. When you pay money to buy a magazine, the shop no longer has that magazine and you no longer have the money. Taking in the usual sense is _moving_.

But pirates insist that they can "take" without depriving the owner of anything. That's _copying_ , which is a different kind of taking. It gets even more complicated if somebody first purchases a legitimate copy of a song or a movie, and then produces more copies to share with other people. You run the fallacy of equivocation when you use the word "taking" in both senses.

<comment><USER3> My usage of "take" is insignificant, it's just a word in my argument. You can "take help" you can "take ideas" and they're not physical.

Please don't focus on the word "take", instead the actual argument :|

<comment><USER5> Your actual argument _depends_ on the sense of the word "take" that you use.

(a) It is a well-established norm in any modern society that it's immoral to take (move) something without permission.

(b) It is _not_ well-established -- or at least, pirates would like to say that it's controversial -- that it's immoral to take (copy) something without permission.

(c) It's even less well-established that it's immoral to take (purchase) something _with_ permission and then crack the DRM or produce further copies to share with other people.

Nobody disagrees with you about (a). But you're extrapolating that view to (b) and (c), and that part of the argument seems to hinge upon an equivocation of the different senses of "take".

Content producers have a shaky argument because they want to use the "moving" sense of the word "take" to argue that (b) is immoral, while using something like the "copying" sense of the word "take" to argue that (c) is immoral. (If ownership of the movie was actually moved when you purchased it, it's none of their business what you do with the DVD you now own!) Don't make the same mistake of equivocation. This is not an argument that piracy is OK. I'm just trying to point out that there are good and bad ways to argue against piracy.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I don't think running a protection racket is the best way to get your point across. "I promise never to watch a movie until my demands are met" might actually carry some moral weight.

<comment><USER7> No it wouldn't, because the people companies make money from _aren't willing to stop watching movies_.

It would be like saying "I won't walk outside until the city cleans the streets!" It's a promise a majority of people simply won't, or can't, keep.

<comment><USER8> So, you're saying, if a company is successful at creating and marketing its product and I don't like the price I can steal it?

<comment><USER9> I PROMISE not to steal the 2011 BMW M3 Coupe SO LONG AS you price it no higher than cost + 5%.

</comment></comment></comment></comment><comment><USER10> I have some quibbles with the listed criteria, but I like the basic idea. When I was a pirate, I was a pirate of convenience. I barely pirate anything now that I have access to Amazon MP3, iTunes, and Netflix instant. The piracy I do partake in is mostly focused on ebooks since the Kindle store is so limited. But I also buy a lot of Kindle books when they are available.

I wonder if most pirates are pirates of convenience who will convert into paying customers if there is a convenient way to do so. I do get a little angry at content companies who are a decade behind the times in technology.

</comment><comment><USER11> The whole "languages" section sounds like it was written by somebody with no understanding of how dubbing is produced, who pays for it, and the issues that arise with the rights to these different versions of a film. Often it gets even more complicated with TV Shows.

Convenience? Now you're getting completely unreasonable. If you can't filter by all metadata you're going to "steal"? Come on...

<comment><USER12> I'm guessing the point they were trying to get at was, you should be able to download and share subtitle files -- which are only useful to people who already have the movie -- without fear of prosecution.

<comment><USER11> Here's the relevant bit from the "manifesto":

"I have access to the audio in every language that has been produced."

Even the subtitle issue is complicated. Are these fan-made subtitles? Otherwise, again, you're entering a minefield and the chances of something like that ever happening within a unified interface — as requested — are slim.

Something like that would require a fundamental change to how films and especially TV Shows are distributed in other countries. Not to mention the technical issues that will occur due to certain countries getting a slightly modified (whether censored or extended or just modified) version of the original.

You're far more likely to get somewhere if what you're asking is at least somewhat reasonable.

<comment><USER13> Actually, there are pretty good methods of this for piracy. If you search for the torrent title (IE: "Battleship Potemkin aXXo", etc) and "subtitle", you can generally find a subtitle for your version in my experience. Have a listing for movie, then version of movie (German edition, Director's Cut, terrible American theatrical release that cuts out the bit where last part was all a dream, etc). If piracy and fans can solve an issue like that, surely the studios can too.

</comment></comment></comment></comment><comment><USER14> I'll better sign a petition that is like: letmebuy.com, and the only clause will be

         "Outside US we are people too. Here, take our hard-earned money"

</comment><comment><USER9> My partner Dave asks when we can expect the MPAA/RIAA to put up "DON'T MAKE US SUE".

</comment><comment><USER15> This name is awful.

1)It implies that copyright infringement is stealing. 2)It implies lack of responsibility, as in someone is making you do a certain action. You have a choice.

<comment><USER16> The page itself seems as if it was written by fifth graders: "Movies are delivered adds free."

No streaming movie I've ever purchased has required me to pay for the privilege of doing arithmetic.

<comment><USER10> >"The page itself seems as if it was written by fifth graders"

or a bunch of redditors/chaners.

</comment></comment></comment><comment><USER17> This can start a copyright flame, but in order to be fair, "steal" should be replaced with "copy".

<comment><USER18> I find it amusing that second-rate grammar (loose/lose) and spelling is the norm for some communities, but the second this topic comes up, everyone turns into a armchair semantic guru.

<comment><USER19> There hasn't been a decades-long campaign to deliberately confuse the concepts of "lose" and "loose". It's just a mistake.

<comment><USER18> My meta-commentary was on the fact that the issue of semantics seems to serve as a all-too-convenient cognitive escape hatch in these discussions, diverting them from the harder topic at hand: that of intellectual property rights. I find it regrettable that it is employed, as it hinders being able to discuss the problem in a mature, logical fashion.

</comment></comment></comment></comment><comment><USER20> The implication is that by signing the petition, my intent is to "steal" a movie unless certain terms are met. No, thanks.

</comment><comment><USER21> Cool project but I'd rather not have to sign with Facebook/Twitter. Can you implement an alternative please?

<comment><AUTHOR> We considered many different authentications and chose Facebook and Twitter because they make it really easy to show avatars of the people who sign.

What alternatives would you suggest?

<comment><USER21> A simple registration form with some default avatars would be ideal, in my opinion.

<comment><USER22> Another factor was the really short time we had for development, so implementing those two allow us to cover the largest part of our target audience with a simple UI.

</comment></comment></comment></comment><comment><USER23> Don't agree with 'Purchase should not exceed the cinema price.' since that stuff comes with extra content and 20 years from now I'm sure whatever the cinema costs were will have become untenable due to inflation...

</comment><comment><USER24> I agree with the general idea but the specific criteria sounds very good from a consumer POV and not very realistic for a company to offer.

"Rent should not exceed 1/3 of the cinema price. Purchase should not exceed the cinema price."

Rent/purchase and cinema are completely different businesses, with different expenses. Going to the cinema doesn't give you a permanent copy. I'm pretty sure movie ticket prices are subsidized by sales of overpriced popcorn, drinks, and snacks. Online sales/rentals might be better compared to brick- and-mortar sales/rentals rather than cinema. Either that or offer a breakdown of how it might be viable for a company to charge those prices.

"I have access to pretty much every movie ever made."

This isn't possible using any other legitimate method that I know of; the only reason pirates can do it is because they don't have to worry about the legal issues, pay for licensing, etc. They just need access to a physical or digital copy which is far easier to do. This will probably be even harder when combined with the pricing demands since it limits how much companies can pay for licensing. If you mean major films/TV shows only, "most" might be a better word, otherwise it sounds like you want them to chase down every indie filmmaker who's put out a movie that a dozen people might be interested in watching.

"Pricing of TV shows is about 1/3 of movies. I pay for the content, not for bandwidth."

These seem almost contradictory to me. I'm guessing the pricing of TV shows should be 1/3 that of movies because they're 1/3 as long, but if "content" means "length" then the second point doesn't mean very much in most cases. If content is some measure of quality/popularity then there's no reason why TV shows would cost less than movies. (Especially since, from my POV, there are far more good TV shows right now than good movies.)

(edited for formatting and grammar.)

</comment><comment><USER25> "Hey RIAA lawyers, here's a list of people who download movies!"

<comment><USER26> RIAA = Record Industry Association of America MPAA = Motion Picture Association of America

<comment><USER25> Ooops. Well, point remains. :)

</comment></comment></comment><comment><USER27> Here's what I really don't understand. What exactly do they believe gives them the "right" to watch a given movie / tv show?

<comment><USER28> Probably something along the lines of "it is in front of them".

</comment></comment><comment><USER29> All the arguments below aside, are there any cases where an online petition has had its desired effect on an any large business, let alone an entire industry?

I do ask this both as a jab and as a legitimate curiosity.

</comment><comment><USER30> I love iPads, but Apple charges more than I think they should be allowed to charge. I'm going to steal one until they lower the price. I promise I'll buy one then.

I love Photoshop, but Adobe charges more than I think they should be allowed to charge. I'm going to steal it until they lower the price. I promise I'll buy one then.

I love Wolfram-Alpha's database, but Mathematica costs way more than I think they should be allowed to charge. I'm going to steal it until they lower the price. I promise I'll buy one then.

Does this not seam like a ludicrous attitude to you?

</comment><comment><USER31> I don't think these are really fair to include in the criteria:

"I have access to the audio in every language that has been produced." and "Once I bought a movie, I can watch it in every available language."

</comment><comment><USER32> I also want my TV to be ad-free if I'm paying for it. I prefer to pay for it than to watch the ads, because my time has value, but I don't demand that this alternative be offered. Yet.

This being said, I already follow this. I also don't illegally download media. I just don't watch stuff that's not available in a reasonable way. It seems silly, given that paying $10/month for Netflix gets me access to more content than I could ever possibly watch.

If only it worked on Linux. My Win PC is basically a "Netflix box" these days.

<comment><USER33> You could always get a PS3 to use as a Netflix box. $300 and it can stream Netflix, play DVD and BluRay titles, various formats found in AVI containers, it's a DLNA receiver, and if you get bored with all that you can play PS1 and PS3 games.

I think the Wii has Netflix streaming that doesn't require a disc or secondary subscription as well. And those can be found in the $200 range.

(I'd suggest the XBox 360 but it requires a $60/year Gold subscription on top of the price of the console.)

I'd consider it a suitable alternative if I didn't have a Windows box laying around.

</comment></comment><comment><USER34> Typo:

Movies are delivered _adds_ free.

<comment><AUTHOR> Ahh... that would be my dyslexia. Will fix it ASAP.

<comment><USER35> Dyslexia? Just wanted to make sure you know it should be "ads free," not "adds free."

</comment></comment></comment><comment><USER36> The music industry in particular is infamous for making it's fortunes via the deliberate exploitation of artist and musicians over the decades. So when those same industries turn around and try and take the moral high ground regarding piracy, for better or worse, consumers mostly laugh at the hypocrisy and continue pirating.

I agree pirating is morally indefensible. But the reality is consumers will never be swayed by those arguments. Give consumers the product they want, at the price point they would like to pay. That is the only practical solution to this issue, regardless of how loudly the content industries screams about "stealing."

Failure to accept this reality will only lead to piracy continuing if not increasing.

</comment><comment><USER37> This seems like 'I want a store like the iTunes Music Store for videos' that doesn't have the movie-company BS that the actual iTunes movie store does. (i.e. DRM free, has absolutely everything, doesn't cost a ridiculous amount for TV shows, etc) They'd need to add on 'simultaneous worldwide availability' and Linux compatibility, maybe subscriptions, and the subtitles stuff, but it'd get close to satisfying this manifesto.

I hope that a store like this exists soon. But given the track record of the studios, it's not likely that they'll become sane anytime soon.

</comment><comment><USER38> Fortunately it is impossible to steal non-rivalrous goods.

<comment><USER39> Maybe they thought dontmakemeinfringe.com didn't have the same 'zing'.

</comment></comment><comment><USER40> All I want is for any TV or movie on iTunes that is purchasable to also be rentable. I don't have any desire to buy, say, The Social Network for $20, but I'll rent it for $5. This goes double for TV shows. I love Fringe, but if I miss an episode I don't want to spend $3 to buy it, watch it once and never see it again. Let me rent it for $1 and I'll be happy.

</comment><comment><USER41> I agree with everything except yes to pay and no to ads. There really should be a way to provide free, ad-supported video, and premium, ad-free video. Once you purchase a movie it is free for all time, but every time you watch it for free it's ad-supported.

</comment><comment><USER42> If you don't like the law, make your own 'content' then you can set prices, etc.

No one cares what you think is the 'right price'. If you don't want to pay, don't buy it.

No amount of whining is an excuse for stealing. Grow up!

</comment><comment><USER43> _This_ should compel you not to steal: <http://en.wikipedia.org/wiki/Categorical_imperative>

</comment><comment><USER44> As a former classifieds phone operator, please note:

"ad free", not "adds free".

Please. I beg you.

</comment><comment><USER45> > I have access to pretty much every movie ever made.

Oh _c'mon_.

</comment><comment><USER46>
      Digital Media Consumption Manifesto

Clearly should have been "agreement" instead of a "manifesto". Then they would have made a new DMCA.

</comment><comment><USER47> "Movies are delivered adds free"

I closed the page at this point.

</comment><comment><USER48> Why is the most important point made last?

<comment><USER22> Because importance is subjective :)

</comment></comment><comment><USER49> Too bad I haven't a facebook nor a (personal) twitter account :)

</comment><comment><USER50> Francis Ford Coppola:

Q: How does an aspiring artist bridge the gap between distribution and commerce?

A: We have to be very clever about those things. You have to remember that it's only a few hundred years, if that much, that artists are working with money. Artists never got money. Artists had a patron, either the leader of the state or the duke of Weimar or somewhere, or the church, the pope. Or they had another job. I have another job. I make films. No one tells me what to do. But I make the money in the wine industry. You work another job and get up at five in the morning and write your script.

This idea of Metallica or some rock n' roll singer being rich, that's not necessarily going to happen anymore. Because, as we enter into a new age, maybe art will be free. Maybe the students are right. They should be able to download music and movies. I'm going to be shot for saying this. But who said art has to cost money? And therefore, who says artists have to make money?

In the old days, 200 years ago, if you were a composer, the only way you could make money was to travel with the orchestra and be the conductor, because then you'd be paid as a musician. There was no recording. There were no record royalties. So I would say, "Try to disconnect the idea of cinema with the idea of making a living and money." Because there are ways around it.

[http://the99percent.com/articles/6973/Francis-Ford- Coppola-O...](http://the99percent.com/articles/6973/Francis-Ford-Coppola-On- Risk-Money-Craft-Collaboration)

<comment><USER33> Yes, I'm totally convinced by the words of the son of a professional concert flautist who gets paid 7 figures to make films and was able to buy that winery with those proceeds.

So for him to say, "Oh you can make money other ways, make films for art's sake. Look at me, I'm a wine-maker" is a bit disingenuous.

</comment></comment><comment><USER51> If I could watch content on Hulu, Netflix or other in Linux and I didn't want to throw myself in front of the lunatic-driven University bus, I'd be happy.

TPB -> "The Italian Job" + 3 hours = me happy. There is NO legal alternative for me. No, I'm not walking 30 miles to Best Buy to waste $30 on a DVD that won't play in my computer that doesn't have a DVD drive. And I don't consider running Win7 in a VM to be reasonable at all.

<comment><USER52> There are plenty of legal alternatives for you. Indeed, you just mentioned several of them, and another is not to consume that particular content at all and to find your entertainment in some other way.

Please don't pretend anyone somehow forced you to break the law. You chose to do that yourself.

<comment><USER51> 1\. Hulu in Linux is effectively impossible. It's completely broken in Chrome and it stops after 10 minutes of playback in Firefox. More importantly, it does not have the movies I'm interested in.

2\. Netflix has no client or support for Linux. Microsoft won't license the DRM components and Netflix refuses to change.

I never, ever mentioned that I was forced into breaking the law, but thanks for putting those words into my mouth. Make no bones about it. I broke the law because it is more convenient. I would pay for the movies if, as I already stated, I wasn't forced to borrow someone's car to buy a frickin DVD.

Surely, you can understand that "Don't consume the content at all" is as much of a copout as someone saying they were "forced" to steal the content. Both I and the movie industry would benefit from me having easier access to the content that I would happily pay for.

This is partly why I'm hopeful to see what Amazon has in store.

</comment></comment></comment><comment><USER53> I sympathise a great deal with the spirit of that manifesto. However, I don't full agree with it.

Mainly because it's basis comes down to, "I want a pony, Daddy. And I want it now! And it must pink! And made out of licorice!" And I don't agree with arguments like that because unless you yourself (the person desiring the pony) are the one who's making/building/providing the pony, then you're in the weakest possible position to be making such specific demands. "I'd like a pony too, little Virginia, but I have to figure out how much it costs, I have to go find one, figure out where to keep it, feed it, make sure it stays healthy, etc. And if it's not pink how the fuck do I make it pink? Don't even talk to me about licorice."

Note that I'm not saying that all consumers should conform their desires to whatever the producers feel like producing and providing it under. But I do think it requires give and take on both sides, and the folks on the producer side are much more likely to be constrained by Physical Reality, whereas the consumer role can prance around in Fantasy Land. Wanting convenience is fine. Wanting "fairness" is more problematic, because it's not always clear what is fair when you have to consider things from the provider's position, not just the consumer. And some consumer demands are arbitrary or undefensible. For example, what reasonable basis would one have for demanding that you should not have to pay more money to own a product (a DVD/video) than you would to rent it (watch movie in theatre)? There are arguments for why each should be more expensive than the other, and the "cost plus" model is only part of the consideration. Value-based pricing is also fundamental to economics and market-making. Yes, artificial scarcity can make prices for a thing higher than what it would be otherwise. However, if you're not the one producing the thing in question, you're not in the position to decide whether or how much to turn that dial. As a consumer you can choose not to buy a thing under terms you don't like, but you're not in a position to demand or force a provider to match your ideal terms. You are always free to get off your ass and go make the very thing you want. But if you lack the creativity, energy, intelligence, skills, willpower, etc. to make that thing, then you will absolutely be (at least somewhat) at the mercy of those that do overcome and perform those things in order to provide it. Thus the give and take, and thus a market where price and terms must be reached by compromise on both sides.

Don't make me steal? Don't make me laugh.</comment>


Cloudflare Ordered to Expose YTS, Showbox, and Popcorn Time Site 'Operators' - <AUTHOR> https://torrentfreak.com/cloudflare-ordered-to-expose-yts-showbox-and-popcorn-time-site-operators-180919/ <comment><USER2> Well, now I know about YTS and Showbox...

<comment><USER3> Indeed, _" Streisand Effect"_ [1] is strong with this one.

[1] [https://en.m.wikipedia.org/wiki/Streisand_effect](https://en.m.wikipedia.org/wiki/Streisand_effect)

</comment></comment><comment><USER4> The Yiffy Torrents guys have an office in Shoreditch London they used to verify their identity on their website via an EV certs. I don't know why they don't start there - the street address is/was literally inside their certificate. And yes they're there, it's a coworking space and they recieve postal mail there.

<comment><USER5> Hmmm, sounds like they went with a competitor instead of using your certsimple then?

<comment><USER4> Ooh conspiracy theory! It could be that I like inspecting certificate org details and seeing if anyone had mississued anything, and I live in London (Ozone coffee nearby is pretty neat) so wandering by was convenient. But you're right: jealous over a few quid, George Soros, the globalists and I have decided to leak this info that, er, is in Yiffy's certificate already. Emoji thumbs up.

<comment><USER5> Heh Heh Heh, k.

It's just unusual - from what I've seen - to directly give pointers for locating some group in the physical world, specifically to bring harm to them IRL. :/

<comment><USER4> There's a lot of coworking spaces in Shoreditch, but more to the point, they already published the address themselves to anyone who clicked the lock in their browser.

</comment></comment></comment></comment></comment><comment><USER6> How doable is a anonymous ipfs torrent tracker?

<comment><USER7> Ipfs is very cool, but is not anonymous nor is a goal of the project.

<comment><USER8> [https://github.com/ipfs/notes/issues/37](https://github.com/ipfs/notes/issues/37) is one possible solution to anonymous IPFS.

</comment></comment></comment><comment><USER9> Is there an advantage to filing this in Hawaii? Seems like an unexpected venue choice.

<comment><USER10> In looking at dockets from that plaintiff (Venice PI), they have filed dozens, if not hundreds, of suits across the country. This just happens to be one case in Hawaii.

[https://www.courtlistener.com/?q=venice+pi&type=r&type=r&ord...](https://www.courtlistener.com/?q=venice+pi&type=r&type=r&order_by=score+desc&page=1)

</comment></comment><comment><USER11> "it is likely that the requested information will be handed over"

I would say the opposite at this point. Cloudflare has a track record of sticking to its principles and has demonstrated a willingness to defend them in court.

<comment><USER12> What principles? I can't find a mission statement or list of principles on their site, and it wasn't long ago that Cloudflare joined GoDaddy and others in shutting down the Daily Stormer -- one of the principles of a CDN might be supporting a free and open internet, but that isn't supported by their actions.

<comment><USER13> While I agree with you in principle, they aren't _required_ to host content that they don't want to. They certainly shouldn't be actively shutting down content, however that's not the same as declining to host content. I'm somewhat surprised that a conservative network hasn't been established to support the White Power, Alex Jones, Gab types of places. It would seem to be at the minimum a viable business for a niche audience.

</comment></comment></comment><comment><USER14> I don't have a problem with this. From the sounds of it, these 'operators' are distributing copyrighted content, which is illegal in many jurisdictions. IOW, they are party to the violation, not merely indices or what-not.

The fact that CF itself is not considered party to these violations (under DMCA) is a good thing.

<comment><USER15> Someone correct me here, but as I understand it, the torrent file itself is not the content. It is metadata about the content, and thus it can be shared without copyright violation. Using the torrent file, on the other hand, might very well be illegal.

<comment><USER16> As I understand it, uploading copyrighted content is illegal, but downloading isn't. So, if you don't disable uploading (or sharing) while downloading in your torrent client, then you are committing a crime when you download copyrighted content, since you are sharing it with other clients.</comment></comment></comment>


Bug Bounty Ethics - <AUTHOR> https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 <comment><USER2> This is the same story as [https://news.ycombinator.com/item?id=10754194](https://news.ycombinator.com/item?id=10754194), and the same story should not be both at #1 and #2.

Normally the thing we do with rapidly developing stories, i.e. when a new post adds significant information, is bury the previous thread and leave the new one up. But my sense is that people wouldn't prefer that in this case, and since the current post is already being discussed in (edit: at the top of) the other thread, we'll leave that one up instead.

<comment><USER3> It seems this post has now been removed from the front page. I understand your reasons for not wanting to have two similar discussions simultaneously. However, the two posts paint two different sides of the same story. How are people going to read this side of the story if it's been hidden?

<comment><USER2> The top subthread there links to this post, and the top several subthreads are substantive defences of its position. Anyone who wants to read the other side of the story will have little trouble finding it.

</comment></comment></comment><comment><USER4> He phoned the researcher's CEO and subtly threatened legal action. This is spin at it's finest.

I agree the researcher shouldn't have escalated/pivoted once they had access, that in itself breaks their ToS for the bug bounty program. However in doing so the vuln went from "so-so" to "holy shit".

Whether this policy for disabling pivoting is realistic/a bit of a cop-out from the vendor is arguable. In the real world an attacker wouldn't hesitate, however FB can't have people crawling around their internal network, potentially breaking or leaking user information.

The researcher, with all of his experience (incl a 24K bount payout from MS) should be aware of the above. However less ethically inclined hackers would have sold this access for $100K+.

EDIT: User ryanlol has made a good point, I thought they included fucking around within the server to break ToS. But their page does not indicate that. From the article it says:

> Intentional exfiltration of data is not authorized by our bug bounty program

However the ToS only talks about USER data. AWS S3 keys aren't included we can assume.

This is a tricky situation.

<comment><USER5> > that in itself breaks their ToS for the bug bounty program

Except it doesn't?

<comment><USER4> Once RCE is confirmed, any further access from there would break ToS. It's bullshit, and kind of a cop-out - but it's a trade-off that these companies have to make. Otherwise we could employ techniques like social engineering to gain internal access, then start pen-testing from within the network.

<comment><USER5> Their ToS does not state this. They do however specifically state that social engineering attacks are not eligible.

<comment><USER4> You're actually correct. I think this situation is a bit more complicated than it seems at first.

Updated original reply.

</comment></comment></comment></comment></comment><comment><USER5> >At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes.

This is pretty questionable, and seems more like a hastily made up excuse. If Alex wasn't acting with malicious intent then the logical approach would've been to ask the researcher if he's operating on behalf of synack.

<comment><USER6> Yes it is complete bullshit. This account is full of minimizing Facebook's role in this when we all know that contacting the employer was a straight forward intimidation tactic that is unfortunately all to common in infosec (because it works).

> His account on our portal mentions Synack as his affiliation

Note 'his account' here is just his Facebook account. So you can rewrite that line as 'his Facebook account lists him as employed at Synack'

> he has interacted with us using a synack.com email address

That would be a crazy new precedent if we use email addresses as authority

> and he has written blog posts that are used by Synack for marketing > purposes.

having _written blog posts_ is even crazier.

Were Alex _genuine_ in thinking this was Synack he would have copied Wes on the email and/or he would have asked him. He straight up went behind his back and over his head.

Facebook had a bounty program that was very respected and operated well. I don't understand how they've completely fucked this up and turned it into a pissing contest.

Just say sorry, forgive the guy for the data download, clarify that it was against the rules anyway, give the guy $20k, apologize for contacting his employer and just get it over with.

This way it is just going to drag on for days now and everybody has already forgotten that it was the reporter who made the first mistake.

I really, really don't get this.

edit: tip to researchers - create a new alias for each bug you report. once the bug is all done and settled claim it under your real/public name. avoid blowback, everyone gets it at least once.

</comment></comment><comment><USER7> I'm struggling to comprehend those in support of the researcher? As a security researcher myself, this is just something you do not do. There was nothing more to be gained after he had those API keys - for any other researcher its game over, you won. As far as I'm concerned anything that happens to you after that point is of your own making

</comment><comment><USER8> > Wes was not happy with the amount we offered him

Wait, how does that work? Are there negotiations involved in Bug Bounties? But there's no leverage once the bug has been exposed!

<comment><USER9> wait they offered him money and when he did not bow down to facebook they harass him through his employer? Talk about ethical lapse big time

<comment><USER10> they offered him money because it is a bug bounty program

</comment></comment></comment><comment><USER11> The discussion on the researcher's blog post:

[https://news.ycombinator.com/item?id=10754194](https://news.ycombinator.com/item?id=10754194)

</comment><comment><USER12> "the bug, which is less critical than several other public reports that we have rewarded and celebrated"

The bug lead to full access to critical data, and possibly to full control of their servers. It's interesting what these other "more critical" bugs were.

"Not very original" != "not critical". Alex seems to imply these are equivalent.

</comment><comment><USER13> I don't quite get Facebook's position here. This guy demonstrated that all of Instagram's data is publicly accessible. By jerking him around, they are resting a _lot_ of money on their belief that he's not a black hat hacker. If they were wrong, they're looking at the mother of all data leaks. Would they want to tread a least _somewhat_ gently with him, instead of treating him like he _is_ black hat? I mean, luckily for them he's not, but what if they were wrong?

</comment><comment><USER14> How come this article has fallen off the front page so quickly? It's on page 7 now, even with nearly 100 points in under an hour's time.

<comment><USER2> [https://news.ycombinator.com/item?id=10755361](https://news.ycombinator.com/item?id=10755361)

</comment></comment><comment><USER15> He's spinning what happened, now that his actions are public. It's not like the reporter wasn't responding to his emails. Alex Stamos _only_ called the guy's boss to intimidate, bully, and threaten him with legal action. He admits what he did but thinks it wasn't wrong and won't apologize. His sense of ethics seem to be one-sided.

Someone needs to call Zuckerberg to let him know about the aggressive and unethical behavior of _his_ employee.</comment>


Show HN: Linkas.io – Comment on any page - <AUTHOR> https://linkas.io/landing

<comment><USER2> I like the idea since it may be really frustrating when people disable comments under their writeups.

Some feedback: your landing page discouraged me from using this. Why do I need to sign up? Especially when you write about being anonymous. I think that perfect landing page would involve a brief information about what is it, and a big-ass "add to chrome" button, and that's it. You can explain the rest of it once I'm in, right now there is a lot of things going on and it's hard to realize what I need to do - should I read the description? But then something moves on the right side, oh and then the point #1 becomes inactive.

</comment><comment><USER3> Have you seen [https://hypothes.is/](https://hypothes.is/)? Not to discourage you, I'm just seeing because maybe it is exactly the same thing you are building here, and that should be good, right?</comment>


Facebook exec: media firms that don't work with us will end up 'in hospice' - <AUTHOR> https://www.theguardian.com/technology/2018/aug/13/facebook-news-media-campbell-brown-hospice <comment><USER2> Reminds me of this article: [https://www.nytimes.com/2018/08/14/magazine/facebook- google-...](https://www.nytimes.com/2018/08/14/magazine/facebook-google- privacy-data.html)

The big tech companies seem to be following the same abusive behavior as monopolies in other industries that preceded them.

<comment><USER3> Why wouldn't they? Humans are basically the same no matter what their trade or craft is. If you get power, you try to keep and expand it. Nothing controversial there really.

</comment></comment><comment><USER4> Didn't Facebook recently pull the rug out from under media organizations that worked with them, when they updated their feed algorithm to deprioritize news articles?

<comment><USER2> Deprioritized, but not eliminated. There are many other things facebook can do to bury specific articles or publishers.

Not showing them at all, as well as not showing articles that have been shared by friends, for example.

</comment></comment><comment><USER5> Publishers need to own their own distribution, it's that simple. That's their core business and it can't be outsourced

</comment><comment><USER6> Seems like she's just being candid to me.

Journalism is in trouble, and it was in trouble long before Facebook and Twitter came along.

Either adapt or die.

<comment><USER7> Right.

It's not like corporations, especially corps with a significant impact on society, should have any responsibility to use their power in a way that helps improve (or at least doesn't degrade) the society upon which their wealth was built . . .

/<sarc></comment></comment>


Ask HN: How open should I be about finding other clients? - <AUTHOR> I started my own software company this year (long time dream of mine realized!). It's currently just myself on an open-ended full-time contract as a developer for one client, but I am going to be expanding to multiple clients and hopefully hiring more developers soon too.
My agency and client both know that I'm billing under a corporate name, but it's just me working full-time for client #1. I have no intention of ending this contract (it is a great gig and about 95% of my projected income), but I do intend to take some time out here and there to grow my new company (meetings with new clients, traveling, networking events, etc) when appropriate. Maybe a few hours here and there, a full day every once in a while. About as much as I would have taken vacation at a FTE job.
How open should I be about my dual role as software developer and business owner? Should I just call it vacation time when I need to devote some daytime hours to other clients? Or should I just be completely open and transparent? <comment><USER2> I personally think this come down to your relationship with your client. If they are normally causing you issues with always being on your case about deadlines, getting stuff to them etc. I would recommend keeping this to yourself. But if they are usually supportive it would not be a bad idea to explain why you would be less available. But as the others said it's your company, run it like you want!

</comment><comment><USER3> Why should you tell them anything?

You're a business, and it's none of their business who else you serve. As long as you deliver what they pay for, it shouldn't be an issue.

</comment><comment><USER4> Be transparent, it is your business, run it as you see fit. Why would your client be unhappy you are expanding YOUR business?</comment>


Old-School PC Copy Protection Schemes (2006) - <AUTHOR> http://www.vintagecomputing.com/index.php/archives/174 <comment><USER2> On the NES, EarthBound is notable for a defense-in-depth approach to copy protection (the last layer is interesting):

[http://earthboundcentral.com/2011/05/earthbounds-copy- protec...](http://earthboundcentral.com/2011/05/earthbounds-copy-protection/)

I wonder if that helped any, though. At some point players are just going to think "this is a terrible game" and tell their friends that. The "code wheel"/shareware approach seems gentler. Give them a taste of the game for free, and then put up barriers to incentivize them to pay for the game. (IMO the F2P model has taken this way too far in this direction)

<comment><USER3> Yeah, some games are a bit too subtle, like reducing player accuracy in an FPS. Others can be quite funny when players complain online.

[http://www.eurogamer.net/articles/2013-04-29-game-dev- tycoon...](http://www.eurogamer.net/articles/2013-04-29-game-dev-tycoon- forces-those-who-pirate-the-game-to-unwittingly-fail-from-piracy)

It's pretty old and has been posted here before, but one of my favourite DRM examples/writeups is Spyro: Year of the Dragon.

[http://www.gamasutra.com/view/feature/131439/keeping_the_pir...](http://www.gamasutra.com/view/feature/131439/keeping_the_pirates_at_bay.php)

<comment><USER4> I wonder if you could do that with music, put a few off key notes or change a word in a song and have it uploaded to various sites? Would seem like you could have fun with people that way and still get yourself heard.

<comment><USER3> I thought I had read that DAT (digital audio tape) detected altered notes/frequencies to avoid copying, but it appears to only have been a proposed idea.

[http://en.wikipedia.org/wiki/Serial_Copy_Management_System#H...](http://en.wikipedia.org/wiki/Serial_Copy_Management_System#History)

People have done pitch-shifting and other tricks to get around YouTube's Content ID in the past.

And the fictional word "esquivalience" was added to the New Oxford American Dictionary to detect copies.

[http://en.wikipedia.org/wiki/New_Oxford_American_Dictionary#...](http://en.wikipedia.org/wiki/New_Oxford_American_Dictionary#Fictitious_entry)

<comment><USER5> Copy detection for maps: [http://en.wikipedia.org/wiki/Trap_street](http://en.wikipedia.org/wiki/Trap_street)

</comment></comment></comment></comment></comment><comment><USER6> Battle Chess 4000 by Interplay required the manual to be played, as it would ask challenge questions before it would let you play the game. The manual had about a dozen different games laid out, and a challenge question might be phrased like "On game 8, where is the white rook?" and you'd have to answer in chess notation like "D3".

I had lost the manual and Interplay sent me a new one after I had cut out the UPC code and mailed it to them for proof of purchase, which was awfully nice of them. Years later, after losing the spare manual, I got prompted with this question, and after a couple dozen tries just for fun, I blindly and correctly guessed the location of a specific piece on a specific board.

I'm not sure what the probability of that would be(probably smaller than 1/64) but I felt like I could've played and won the lottery that day :)

</comment><comment><USER7> I've always been strangely intrigued by these old-school copy protection systems. It was interesting so see all the novel ideas the companies would come up with. I especially remember playing around with those code-wheels when I was a kid.

Here's an entertaining little video with a bit more information on the subject: [https://www.youtube.com/watch?v=HjEbpMgiL7U](https://www.youtube.com/watch?v=HjEbpMgiL7U)

</comment><comment><USER8> I used to play _The (Even More!) Incredible Machine_, which had a similar scheme. You'd be given a page and have to look up a series of three items from the game.

[https://www.youtube.com/watch?v=R6etb0_u_hk](https://www.youtube.com/watch?v=R6etb0_u_hk)

Anyone else remember that game?

</comment><comment><USER9> My dad had his own business selling copy protection he invented for 5.25" floppy disks back in the early 80's. It didn't use codes from the manual though it used some trick with the floppy where a special sector could be read but wasn't written under normal conditions when the floppy was copied.

</comment><comment><USER10> I remember King's Quest 3 had a bunch of spells and/or potions you needed to use to win the game that required precisely worded commands, and they were only included in the physical manual.

<comment><USER11> KQ6, in addition to being one of the greatest adventure games of all time, had some of the best copy protection.

The manual had an extensive "encyclopedic" section that was part background material, part hint book, and part ingenious copy protection. For example it included the following 'poem' as background material about one of the game areas:

          Three roses laid upon the bower,
          A scythe for he who cuts the flower,
          A crown, a dove, most noble race!
          Thy bones make sacred this dread place.

As it turns out, this poem is really a solution to a puzzle where you must walk on the floor tiles in a particular order to survive:

[http://i.ytimg.com/vi/WUw771rvxhc/hqdefault.jpg](http://i.ytimg.com/vi/WUw771rvxhc/hqdefault.jpg)

There were several solutions that were cryptically hidden in the manual like this, such that people who hadn't read it would get stuck at various points.

The real genius however was that this was before the Internet, and so if you wanted hints you had to call Sierra on their special 900 (toll) number to get help.

<comment><USER6> I remember this as well! There were also some incomprehensible glyphs on the tower climb, leading up to the Winged One's(just prior to the Catacombs in your screenshot) that were only printed in the manual.

</comment></comment></comment><comment><USER12> I think Bard's Tale 2 had a code wheel which I photocopied as a kid for playing on my C64. Wasteland had that little book you had to refer to for little text snippets.

<comment><USER13> Star Control II uses a starmap as copy protection ("tell me the constellation at these coordinates..."). I lost the starmap at one point, but if you can remember just _one_ of the answers, you can just keep running the game until that answer is the correct one. (The copy protection is at the very beginning, and the game won't bug you during play.)

<comment><USER14> Is this a factor if you're playing the Ur-Quan Masters?

<comment><USER13> No; I lost the starmap when I still had some 5 1/4" diskettes that said "Star Control II" on them.

</comment></comment></comment></comment><comment><USER15> I recall dealing with a code wheel to play FA-18 on the Amiga, and word lookup for B-17.

The latter had a lovely manual btw, it could probably be used as a reference work for historians.

</comment><comment><USER16> try, catch, try, catch, try, catch! Take that reversers!</comment>


Ask HN: Where did you find your "cult"? (As described in Zero to One by Thiel) - <AUTHOR> Just finished reading Zero To One by Peter Thiel and there's an interesting chapter where he talks about how the best kind of startups almost resembles a cult.
The idea is that a culture of total dedication that looks almost crazy from the outside is required to make a startup succeed. In exchange, "members" experience strong feelings of belonging.
I find this idea fascinating because in my 30 years of life I still haven't found a place where I "belong".
So HN: where did you find your place of belonging? Was it in a new city/country? University? A hackathon? A meetup of some kind? <comment><USER2> When you call an organization a cult,you are essentially saying that the members accept leadership and belief without thinking for themselves and applying rationality.

Theiel's palantir is a good example. A ton of smart people and good products but as it appears not a single person doubts the organization's mission and the horrific impact it has on society. Why? It's a cult, don't doubt leadership,just be a good hacker and hack as you're told.

To each his own. For me, I can't imagine living like that. Even in the military you can doubt and question unlawful commands/orders.

I would rather be an outcast and a failure than succeed, be well connected and accepted by the group at the price of abandoning whatever conscious and principles I have. I guess you can say I am not much of a joiner?

<comment><USER3> And to that end, palantir is slowly failing, they lost a big NYPD contract due to their bad PR and inability to have their software be interopable with other vendors.

</comment></comment><comment><USER4> If you want to join an organization with a sense of mission & belonging, consider who benefits from its success.

If it's the world at large - the underserved, the unlucky, the overlooked - you've got a better chance of being able to look at yourself in the mirror each morning.

I'd grimace if I saw Thiel in the mirror.

</comment><comment><USER5> I've worked for a few startups that have had a cult-like following, and it's never gone well. If you gave notice, you immediately got the cold shoulder from all of the execs - to the point that there weren't officially sanctioned goodbye parties. People got pushed out if they asked any questions that could be perceived as critical of the company or product. At one company I worked at, people would cheer absolutely everything in company meetings ("we missed our Q3 goals by 60%" _loud applause_ "Don't worry, we'll get it next time!"). Company has layoffs, and nobody would believe that it could be due to poor performance, so they went with other implausible explanations.

The unfortunate thing about these cultures is that they self-select for the worst kind of employee. If you think there are areas of improvement in your company or product, and that's viewed as not being loyal, then you end up only with employees who already believe the company or product is perfect. Personally, I'd rather work with people who recognize the faults in their product and are actively working to fix them.

The only exception I've encountered is where there's a cult-like following AND verifiable performance of the product. Apple has a cult-like following among employees and enthusiasts, but they also make products people love and you can tell that objectively from their quarterly earnings calls [note: I'm aware that Apple certainly has it's own sets of issues with its product and work culture, my point is simply that a cult following of Apple is different from a cult following of your shitty benefits platform].

These experiences led me to a, perhaps, cynical conclusion: the more cult-like the culture, the easier it is for the executives and investors to fleece the employees. While everybody is cheering the quarterly losses, and unquestioningly supporting every product release, your executives are negotiating parachutes for when the company gets acquired for dimes on the dollar. It completely makes sense to me that Peter Thiel thinks this is a good thing: he's benefiting from those cults.

<comment><USER6> I think some low-level employees will greatly benefit from a class in philosophy.

It's not about the fault or that if the employee is right.

Founder makes a promise to customers. He comes with an initial vision. It might be a flawed vision but if the product has got any traction before you even joined. It means his flawed vision works in the market.

Don't mistake market for the world. Don't mistake your world-view for the complete truth of market or world.

Your worldview is just another way of seeing this world and unproven way since that's not what got him his first customers. Why do you want him to bet on your unproven worldview? I see newbie traders making this mistake over and over.

That's the only thing which matters.

That's his worldview and his company took off within his worldview, there is no reason to change that. Unless of course, you have an axe to the grind and you are clearly irreplaceable, try that and if he is any good and catches you halfway, next you are out of the company.

It doesn't matter who is right. It doesn't matter what is right. What matters how consistent you are in your worldview. That's what gives company success.

If you have a superior worldview, best a founder can do is - fire you, so you are set free and you start your own company, compete with them and then lose until you correct your worldview.

They do not want to bet on your worldview, you are not above the founder, no employee really is.

That's what you need to understand.

</comment></comment><comment><USER7> I think 'Cult' = 'Tribe' as described by Seth Godin.

[https://sethgodin.typepad.com/seths_blog/files/CurrentTribes...](https://sethgodin.typepad.com/seths_blog/files/CurrentTribesCasebook.pdf)

A better summary describing tribes. [https://blog.12min.com/tribes-summary- seth-godin/](https://blog.12min.com/tribes-summary-seth-godin/)

To answer OP, you can't 'Join' a tribe. (see link above that expains why)

<comment><USER2> In a tribe you don't neccesarily have to blindly follow leadership. Cult means you accept their values as-is,no questions allowed.

</comment></comment><comment><USER8> I think this is widely misunderstood. Don't look for a "cult" with "members" where you "belong". Instead look for a "tribe" of like-minded people that you feel good being around.

The core difference is that cults defines themselves through a belief system that each member has to submit to, whereas the tribe is founded on a wider set of core values but allows or welcomes variety in its members.

Of course not all "tribes" will be for you. In fact most of them won't. You know it's a good fit when meetings and conversations feel effortless and you feel your opinions and ideas are understood and valued. Finding your tribe is like a startup finding product-market-fit. It requires active search.

That said it's also entirely possible you won't find your tribe in your workplace. In that case try to find it outside of work by joining associations, clubs etc.

<comment><AUTHOR> When I used the word "cult", it seems like many other commenters have taken it in its literal sense (despite being in quotes). But yes I mean tribe.

</comment></comment><comment><USER9> I worked at a Peter Thiel cult. In no uncertain terms: you don't want to work at a Peter Thiel cult.

<comment><USER10> Boy, I wish some sort of throwaway account or pastebin would fill in details on that statement...

<comment><USER11> You can probably guess:

[https://www.forbes.com/sites/andygreenberg/2013/08/14/agent-...](https://www.forbes.com/sites/andygreenberg/2013/08/14/agent- of-intelligence-how-a-deviant-philosopher-built-palantir-a-cia-funded-data- mining-juggernaut/#72879fa97785)

</comment></comment></comment><comment><USER12> At least under capitalism as we know it, no one workplace can supply the meaning of your life. You could have a personal mission for what you want to do with your professional life. But in any workplace, you and your employer are only committed to each other as long as it's economically advantageous.

Run away from any CEO who says something like "we're a family". Your family is committed to you no matter how economically valuable you are. That's not how it is at the workplace. And you probably don't want it to be any other way.

Thiel goes even further and says that he wants a cult? Maybe that works out if you happen to be CEO and also have a callous disregard for your employees' health.

In terms of deriving belonging from projects: I think there are things to learn here from Fred Turner, who has examined how Silicon Valley culture interacts with Burning Man culture. I'm not saying Burning Man is good or even better, but it offers a contrast between voluntary/amateur communities and professional workplaces.

[https://logicmag.io/03-dont-be-evil/](https://logicmag.io/03-dont-be-evil/)

Quote:

"At Burning Man, what you're rehearsing is project-based collaborative labor. Engineers flowing in from the Valley are literally acting out the social structures on which Valley engineering depends. But they can do something at Burning Man that they can't do in the Valley: they can own the project. They can experience total "flow" with a team of their own choosing. In the desert, in weirdly perfect conditions, they can do what the firm promises them but can't quite deliver."

</comment><comment><USER11> This group identity philosophy is very destructive. Build your own identity first before you sacrifice autonomy to groupthink.

<comment><USER6> Sometimes, group exits before you. It has more experience under its belt.

</comment></comment><comment><USER13> I want to bring up a slightly different perspective, as an employee of a relatively large corporation -- not a startup.

I'll preface by stating that my manager is fantastic. Within our team, we have the capability of collaborating and making decisions amongst ourselves without fear of reprimand from the higher-ups (in effect, shielded by our manager). We don't hold standups. We don't have weekly team meetings. There is no mention of "scrum" or "agile" or "standup" or any management buzzwords. Yet, our domain is relatively complex.

Business-centric managers (project managers in particular) have no insight into our day-to-day work partly because of the involved complexity -- we rely on involved mathematics and algorithms to do our job. There is no need for PMs to dig deeper to break things out since we always go above and beyond the plain corporate expectations. This is while my manager (previously individual contributor in a similar space for 20+ years) has never given me a direct order on what to work on.

We make decisions based on the team's own best judgments and then act on them to deliver great products. Business guidance (context) is given to us as a team by this fantastic manager, based on his input, derived from the countless meetings he attends on the team's behalf. But we have the final say as to what is important to deliver after informal discussions explaining context -- never in the setting of a meeting: just conversations.

This sense of belonging that I feel with my team and the organization goes hand in hand with full autonomy over my work and believing in what we are doing: to deliver the best products we can for the customers.

I can't speak for the rest of my team, but I feel this dedication. For me, this is because of two things: a belief that we (within our space, greater than just the team I am a part of) are the best at what we do, and that I feel as though I have the autonomy to act in the way that I believe is best.

To address some of the other commenters: sure, it is likely that my contributions affect the company's profits by more than a full order of magnitude, compared to my salary. But I'm happy here in my autonomy, able to live comfortably, and I am able to make a difference based on my own judgment.

To me, this is the most important thing for me to keep living happily within my "cult".

</comment><comment><USER14> What kind of place do you think you will belong to? what characteristics are you looking for? For me, it was the hacker and demo scene in my teen years. There was no money involved, it was all fun. Money changes the dynamic of things and people don't play nice since it's a zero sum game. The only environment that I see today like that is the open source scene, but unfortunately once a product gets popular it quickly get's commercialized.

</comment><comment><USER15> I'm going to have to question the premise of your question.

I don't believe that the "best" startups resemble cults. I don't think you should feel like you're missing something because you haven't experienced that.

I'd more likely use the word "worst" to describe places with cult-like cultures, because Mr. Thiel and value very different things.

Peter Thiel is a venture capitalist interested in short-term profitability and has a very dog-eat-dog moral framework, whereas I care about long-term sustainability and the net effect of businesses on humankind. I suspect most of us are probably better off thinking more like me and less like Thiel.

That's not to say that I don't see a place for obsessiveness or singular- minded pursuits. Profit-motivated enterprises with that sort of culture are nearly always bad news though, and I even outside of that I'm pretty wary of the sort of tribal mentality that those cultures cultivate.

</comment><comment><USER16> > The idea is that a culture of total dedication that looks almost crazy from > the outside is required to make a startup succeed. In exchange, "members" > experience strong feelings of belonging.

So few startups out there _deserve_ that kind of dedication from its members. If the result of its success is (a) the owners make a lot of money, and (b) another chat app exists within the world, neither of those are good enough goals to deserve that level of dedication.

</comment><comment><USER17> Perhaps the question is not where you belong but what dent do you want to make in the world? For instance, say you wanted to get humans on Mars, then you'd most likely want to work for SpaceX.

</comment><comment><USER18> An Accelerator.

Hobby (sports) group.

</comment><comment><USER19> Thiel is a Trumpist and neo-fascist. Would not be taking advice from him.

<comment><USER19> See for yourself: [https://www.youtube.com/watch?v=HoysIfCPn6w](https://www.youtube.com/watch?v=HoysIfCPn6w)

An apologist and enabler. These people would enslave America while saying they don't support the things that their leader does or says.</comment></comment>


Ask HN: What are widely used Chinese cloud companies? - <AUTHOR> <comment><USER2> AliCloud is the biggest one. And Tencent Cloud, UCloud are smaller but also mainstream cloud providers.

</comment><comment><USER3> Alibaba has a cloud hosting service. Don't know anything about it though.</comment>


Paxos vs. Raft: Have we reached consensus on distributed consensus? - <AUTHOR> https://arxiv.org/abs/2004.05074 <comment><USER2> Heidi Howard is incredible and her work on distributed consensus is illuminating. I think she has actually successfully cracked the cookie of "making consensus easy". [https://www.youtube.com/watch?v=KTHOwgpMIiU](https://www.youtube.com/watch?v=KTHOwgpMIiU)

<comment><USER3> That was fantastic! Do you know what happened with her ios project?

<comment><USER4> Whilst working on Ios, I started work on a theoretical result which became known as Flexible Paxos[1]. Unfortunately, I never had time to go back to working on Ios. Maybe someday.

[1] [https://drops.dagstuhl.de/opus/volltexte/2017/7094/pdf/LIPIc...](https://drops.dagstuhl.de/opus/volltexte/2017/7094/pdf/LIPIcs- OPODIS-2016-25.pdf)

<comment><USER3> I'm a huge fan of your videos. Do you have a spec for ios? I'd love to give a crack at it in erlang/elixir.

</comment></comment></comment></comment><comment><USER5> I can't help myself: Wouldn't we need a third consensus algorithm to reach consensus? :D

<comment><USER6> You just got your wish in the form of Viewstamped Replication.

<comment><USER4> Diego wrote a great summary of the differences between Viewstamped Replication[1,2] and Raft on the Raft mailing list a few years ago[3].

[1] [http://pmg.csail.mit.edu/papers/vr.pdf](http://pmg.csail.mit.edu/papers/vr.pdf) [2] [http://pmg.csail.mit.edu/papers/vr- revisited.pdf](http://pmg.csail.mit.edu/papers/vr-revisited.pdf) [3] [https://groups.google.com/forum/#!topic/raft- dev/cBNLTZT2q8o](https://groups.google.com/forum/#!topic/raft-dev/cBNLTZT2q8o)

</comment></comment></comment><comment><USER7> Ten minute video by co-author on this:

* [https://www.youtube.com/watch?v=JQss0uQUc6o](https://www.youtube.com/watch?v=JQss0uQUc6o)

See also her PhD dissertation, "Distributed consensus revised":

* [https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-935.html](https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-935.html)

<comment><USER8> Love that the author recorded a YouTube summary. This is something more people should start doing!

<comment><USER4> It was actually the PaPoC workshop[1] that asked me to record a short talk and posted on YouTube. They did a wonderful job!

[1] [https://papoc-workshop.github.io/2020/](https://papoc- workshop.github.io/2020/)

</comment></comment></comment><comment><USER9> I'm more interested in reaching consensus on "libpaxos" vs. "libraft": Which algorithm is more amenable to practical abstraction, so that the distributed system developer need only register a handful of callbacks for the actual mechanisms of, e.g., persistent local logging?

<comment><USER10> From experience working in this area, I believe there's a significant tradeoff between performance, flexibility, and time to delivery when it comes to consensus and the things it's used for, like database replication. It's like: "good, fast, or cheap, pick two".

As one of the core authors of the Apache Kudu Raft implementation <[http://kudu.apache.org/>](http://kudu.apache.org/>) (which is written in C++) I know that we tried to design it to be a pretty standalone subsystem, but didn't try to actually provide a libraft per se. We wanted to reuse the Raft write-ahead log as the database write-ahead log (as a performance optimization) which is one reason that making the log API completely generic eluded us a little.

That said, I'm currently at Facebook helping to adapt that implementation for another database. We are trying to make it database agnostic, and we continue to find cases where we need some extra metadata from the storage engine, new kinds of callbacks, or hacks to deal with various cases that just work differently than the Kudu storage engine. It would likely take anybody several real world integrations to get the APIs right (I'm hopeful that we eventually will :)

<comment><USER11> I created a toy raft implementation in typescript, mostly to learn typescript. my interface for the datastore is actually pretty small:

[https://github.com/matthewaveryusa/raft.ts/blob/master/src/i...](https://github.com/matthewaveryusa/raft.ts/blob/master/src/interfaces.ts#L17-L21)

What kind of metadata do you need exactly from the datastore?

<comment><USER10> Sure, here are a couple examples of things we've had to include in the log APIs:

1\. Kudu uses a special "commit" record that goes into the log for crash consistency, related to storage engine buffer flushes. So we need an API to write those into the log. They don't have a term and an index, since they are a local-engine thing, so they have to be skipped when replicating data to other nodes in the case of the current node being the leader. If we were not sharing the log with the engine, we wouldn't need this.

2\. Another database I'm working with requires file format information to be written at the top of every log segment, and it has to match the version of the log events following it. That info has to be communicated to the follower up-front even when the follower resumes replicating from the middle of the leader's log. So we need plugin callbacks on both sides to handle this, in terms of packing this as the leader and unpacking it as a follower into the wire protocol metadata.

Requirements like these will come up and either you hack around them by making some kind of out-of-band call (not ideal for multiple reasons) or you bake the capability into the plugin APIs and the communication protocol.

Frankly, designing generic APIs is also one of the less sexy aspects to consider because we spend so much of our time dreaming about and building all the cool distributed systems capabilities like leader elections, dynamic membership changes, flexible quorums, proxying/forwarding messages, rack/region awareness, etc etc etc. :)

The details of long-tail stuff like this is often hammered out as it comes up during implementation.

</comment></comment></comment></comment><comment><USER12> Shameless plug I've written a writeup of the different implementations/variations of Paxos[0] if you'd like to see more of the ecosystem.

I'm actually kinda wondering why this is news now -- the author of this paper is absolutely right of course but I thought this was common knowledge for anyone who knew what raft was. Raft is less robust than Paxos but simpler to implement (and implement correctly) which is why projects choose it. Basically chat (run a paxos round) to decide a leader and build the log (the history of everything that has every happened in the system, see WALs for a similar concept) at the chosen leader instead of by chatting about every single/batch of changes.

[0]: [https://vadosware.io/post/paxosmon-gotta-concensus-them- all/](https://vadosware.io/post/paxosmon-gotta-concensus-them-all/)

<comment><USER13> That's a great article! Thanks a lot. I know about some more variants you might want to check out:

\- Compartmentalized Paxos ([https://mwhittaker.github.io/publications/compartmentalized_...](https://mwhittaker.github.io/publications/compartmentalized_consensus.pdf)) shows how you can compartamentalize the various roles of a Paxos node to increase scalability.

\- Matchmaker Paxos ([https://mwhittaker.github.io/publications/matchmaker_paxos.p...](https://mwhittaker.github.io/publications/matchmaker_paxos.pdf)) introduces a separate set of nodes called _matchmakers_ which are used during reconfiguration.

\- PigPaxos ([https://arxiv.org/abs/2003.07760](https://arxiv.org/abs/2003.07760)) places the nodes into relay groups and revises the communication pattern to improve scalability. This seems very similar to Compartmentalized Paxos.

\- Linearizable Quorum Reads in Paxos ([https://www.usenix.org/system/files/hotstorage19-paper- chara...](https://www.usenix.org/system/files/hotstorage19-paper- charapko.pdf)) shows how you can do linearizable quorum reads in Paxos.

<comment><USER12> Thanks -- will get started on writing another post to add these in!

</comment></comment></comment><comment><USER14> This paper was published in PaPoC 2020, which was recently organized online. The rest of the papers, along with the talks are available here: [https://papoc-workshop.github.io/2020/programme.html](https://papoc- workshop.github.io/2020/programme.html)

</comment><comment><USER15> I think all these kinds of papers are very confusing. Comparing RSM (replicated state machine) to Paxos is just like comparing a car to an engine. It makes very little or no sense.

In the original Paxos paper ([https://lamport.azurewebsites.net/pubs/paxos- simple.pdf](https://lamport.azurewebsites.net/pubs/paxos-simple.pdf)), the part 3 (RSM) is not extensively explained. There are countless ways to use Paxos to implement RSM. Multipaxos/Raft/Epaxos try to fill in that gap.

By any means, Paxos itself is 10x simpler than Raft or whatever. Every time I heard a "distributed system" engineer said Paxos is complicated, I know he/she does not have much experience in the field or at least has never implemented the core consensus part...

<comment><USER16> Indeed, in the paper they're comparing MultiPaxos to Raft.

EDIT: For others, here's a _very_ comprehensive (as of ~2018) review of Paxos- related distributed consensus algorithms with an exposition for each one: [https://vadosware.io/post/paxosmon-gotta-concensus-them- all/](https://vadosware.io/post/paxosmon-gotta-concensus-them-all/) That's 17 in all, excluding the original Paxos paper. IMO, it should be linked anywhere Paxos is discussed. The link has been posted twice before by others on HN, but unfortunately hasn't seen any discussion, perhaps because it speaks for itself.

<comment><USER15> There are three main stages about RSM.

1\. log replication (m) 2\. log consistency (n) 3\. log execution (k)

Then you will have m * n * k ways of achieving your goal based on different requirements on the three stages.

</comment></comment></comment><comment><USER17> The paper's main conclusion is accurate. Raft is more understandable because of the clarity of the paper. But implementation is very tricky. As I've written elsewhere it takes weeks or months to write a solid implementation from scratch.

<comment><USER18> Raft itself - rather than any framework in which you would actually want to use it - is quite simple to implement. A few classmates of mine and I implemented a barebones Raft instance in about a weekend.

<comment> james-mcelwain I feel like setting up the tests to validate that your Raft implementation is actually correct would take at least a weekend by itself.

<comment><USER19> This is a Distributed Systems homework project at several universities. In mine, a Jepsen-style test harness was part of the autograder.

This happens every once in a while on HN: some mentions having done one of these assignments, and immediately gets tackled for it.

Maybe professors aren't doing a good job conveying the limitations. But also this community is gratuitously hostile to people who have no reason to doubt that the code they wrote from the Raft paper, which passed the test suite, was Raft.

<comment><USER20> I don't sense any hostility here, just healthy skepticism. At the risk of sounding condescending, building something for a class assignment is very different from building something that you'd feel comfortable rolling out in production. Hell, one of the commenters upthread worked on the implementation of raft in Apache Kudu. To be perfectly frank, I would take their word on something before that of someone talking about their homework assignment. It's an incredibly useful learning tool, but it takes a lot more work to make it robust.

I really hope you read this gently. (As the HN guidelines say, "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.") I'm not trying to talk down to you or treat you with hostility (and I know that it's really hard to convey that via text). I would just ask that when someone who has professional, real-world experience in something says it is difficult and time-consuming to do it right, you'd avoid assuming they just don't know what they're doing, and that perhaps there are aspects that you haven't considered.

And hey, maybe you or some of the other commenters are just ridiculously smart and focused and _can_ write it in a weekend. But if that's the case, it's pretty uncharitable to push a narrative that it's trivial. Not saying that's what's happening here, but that could be how it's coming off.

<comment><USER19> I'm not the parent. But I hope you can see how downvotes to oblivion and a bunch of people saying "no you didn't," is hostile.

This is a proportionate response to an undergraduate trying to sell you his new RDBMS. But most students really did write a b-tree. Academic programming elides the supporting infrastructure that bridges the gap between algorithm and software system. Textbooks aren't generally leaving out 100 pages of extra steps required for the list to _actually_ be sorted or the path to _actually_ be shortest. And so a student is not exactly out of line for thinking that the Raft he was taught is actually consistent in the presence of failure. I'll defer to the community's wisdom that he's wrong! But he's still not out of line.

If anything, I'm worried about these classes instilling false confidence. People who think they know these algorithms may go implement them professionally, and not have anyone around to tell them the full story. Cryptography education is careful to put asterisks around "Textbook RSA." Distributed systems education should probably be doing the same.

<comment> james-mcelwain I really don't think my initial comment was that hostile, but I can see why it could be read that way. I appreciate what you're trying to say here, and should probably work on framing things positively to avoid this kind of contention.

Part of why the Raft paper is so excellent is because is _does_ leave you feeling like you could explain/implement the algorithm. I don't want to discourage people from being excited about these ideas, because I am too.

That being said, I am generally frustrated by the lack of humility that many software engineers exhibit. "Easy" is a trigger word for me, and I really think is something that should be expunged from most of our vocabulary when referencing software.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Is there any open source widely used implementation of multi paxos, because single paxos doesn't seem useful by itself.

</comment><comment><USER21> 2020 video: [https://www.youtube.com/watch?v=JQss0uQUc6o](https://www.youtube.com/watch?v=JQss0uQUc6o)

Paxos vs Raft: Have we reached consensus on distributed consensus? — Heidi Howard

</comment><comment><USER22> The title is ~amusing for many who have experienced consensus-based decision making.

But anyway, maybe this could be applied to helping people work together cooperatively.

</comment><comment><USER23> I thought raft was the obvious choice since it is a far simpler framework.

<comment><USER24> The conclusion of the paper is that there isn't actually a significant difference between the algorithms. The Raft paper is much clearer about implementation, but (as Heidi says) the impl ideas from the Raft paper can be applied to Paxos in many cases. Raft's leader election _is_ a bit more elegant and results in a less complex implementation. The paper was a great read!

<comment><USER4> That's a great summary. Thanks for answering the question for me!

<comment><USER24> Your YouTube video mentioned earlier in the comments was fantastic, thank you for that!

</comment></comment></comment></comment><comment><USER25> We have theorems that say that's impossible, so I guess the answer is no? Or maybe Betteridge's law?

</comment><comment><USER26> I haven't found a problem well suited to either as a solution. Either the performance constraints are too tight for industrial applications or you are in a P2P space and they are both predicated on nodes not being hostile so you can't use them.

In practice it just seems most efficient to be tolerant of consensus failures and focus on cAP.

<comment><USER27> A lot of real use production systems (spanner, cockroach, tidb) use the opposite approach - sacrifice reliability for consistency. Scaling constraints are usually solved via sharding (running multiple raft/paxos fsms per dataset)</comment></comment>