Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled - <AUTHOR> Received this email a few minutes ago:
"On Thursday, April 25th, 2019, we discovered unauthorized access to a single Hub database storing a subset of non-financial user data. Upon discovery, we acted quickly to intervene and secure the site.
We want to update you on what we've learned from our ongoing investigation, including which Hub accounts are impacted, and what actions users should take.
Here is what we've learned:
During a brief period of unauthorized access to a Docker Hub database, sensitive data from approximately 190,000 accounts may have been exposed (less than 5% of Hub users). Data includes usernames and hashed passwords for a small percentage of these users, as well as Github and Bitbucket tokens for Docker autobuilds.
Actions to Take:
- We are asking users to change their password on Docker Hub and any other accounts that shared this password.
- For users with autobuilds that may have been impacted, we have revoked GitHub tokens and access keys, and ask that you reconnect to your repositories and check security logs to see if any unexpected actions have taken place.
- You may view security actions on your GitHub or BitBucket accounts to see if any unexpected access has occurred over the past 24 hours -see https://help.github.com/en/articles/reviewing-your-security-log and https://bitbucket.org/blog/new-audit-logs-give-you-the-who-what-when-and-where
- This may affect your ongoing builds from our Automated build service. You may need to unlink and then relink your Github and Bitbucket source provider as described in https://docs.docker.com/docker-hub/builds/link-source/
We are enhancing our overall security processes and reviewing our policies. Additional monitoring tools are now in place.
Our investigation is still ongoing, and we will share more information as it becomes available.
Thank you,
Kent Lamb Director of Docker Support email@example.com" <comment><AUTHOR> If you got an email you should:

\- Change your password on [https://hub.docker.com](https://hub.docker.com)

\- Check [https://github.com/settings/security](https://github.com/settings/security)

\- Reconnect oauth for Automated Builds

\- Roll over effected passwords and API keys stored in private repos / containers

Quick take:

\- Password hashes

\- Github tokens

\- Bitbucket tokens

\- Your Automated Builds might need new tokens

Checking my github logs - It looks like they've known about this for at least a full 24 hours. Most people aren't going to have this looked at until Monday which kind of sucks. Hopefully there is more of a postmortem coming.

Is anyone from github able to comment on this as well?

There doesn't seem to be a way for us to tell if a repo was read by these keys over that time period.

<comment><USER2> Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?

<comment><USER3> GitHub provides a way for more granular third-party access: GitHub _Apps_. There, access can be set on a repository level [1]. E.g. Netlify can be configured as a GitHub app.

It seems like Docker Hub is implemented as an OAuth app [2], where these granular options are not available and you have to grant access to all your repositories.

[1] [https://developer.github.com/apps/differences-between- apps/](https://developer.github.com/apps/differences-between-apps/)

[2] [https://docs.docker.com/docker-hub/builds/link- source/](https://docs.docker.com/docker-hub/builds/link-source/)

<comment><USER4> I just looked at github OAuth scopes ( [https://developer.github.com/apps/building-oauth- apps/unders...](https://developer.github.com/apps/building-oauth- apps/understanding-scopes-for-oauth-apps/) )

honest question, what's the point of using OAuth when the Authz is so coarse? Why not augment to have scopes per repo? Is it considered bad practice to have have a variable (repo name) as a scope?

<comment><USER5> IIRC the OAuth2-interfacing application needs to (or at least should) know beforehand exactly what to request access to, so if that's read/write access to all of the user's content, it's trivial. For the external application to know something specific like a particular resource is more complicated to deal with (especially with private/hidden content), so most OAuth providers don't provide that level of granularity. It can be done, it just requires more engineering than most (all?) off-the-shelf OAuth solutions provide, and it's more control than most users actually need.

</comment></comment></comment></comment></comment><comment><USER6> What permissions did the leaked tokens have?

If they had write access, then leaked personal data is the least of anyone's worries. The real concern is how close the hackers came to infiltrating the image source for virtually every modern microservices system. If you could put a malicious image in say alpine:latest for even a minute, there's no telling how many compromised images would have been built using the base in that time.

<comment><USER7> Yes, huge poisoning target enhanced by the fact images/tags are not immutable, you really have no idea what you are fetching straight from dockerhub, one pull of the same image/tag may be different to the next pull. Most people blindly fetch without verifying regardless with multiple images of varying quality for software packages.

<comment><USER8> How could one verify ?

<comment><USER9> You can't. Not without end-to-end integrity with nonrepudiation. Checksums aren't anywhere near enough. But that's Docker.. security optional and run random, untrusted code from the internet.

<comment><USER10> > Checksums aren't anywhere near enough.

Why not?

<comment><USER11> A checksum's typical use is to detect transmission errors. A cryptographically secure signature is what's needed.

<comment><USER12> It uses SHA-256 right? My understanding is that there isn't yet a workable collision attack on the SHA-2 family.

Regardless, I think it's certainly an excellent hardening step.

<comment><USER13> Infosec in 2019: The server I download code from telling me the hash of said code is "certainly an excellent hardening step".

<comment><USER14> Can't the hash be verified by the client too?

<comment><USER15> Sure, but who tells the client what the correct hash is?

<comment><USER16> If you're the entity who created the image you can retain the original hash and verify it against the downloaded copies. But that kind of defeats the purpose of being able to download docker images across distributed hosts.

They'd really need to be signatures attached to the images, not just hashes.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Docker Hub being hacked was basically just a question of time.

With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.

<comment><USER18> Hacking aside, Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it. It's centralized. It doesn't have a context of "trustworthiness" yet I don't recall docker ever warning me that the image I'm downloading could have been the work of any person.

Shortcuts all around -- kind of reminds me of MongoDB. Sad it's the primary player...

<comment><USER19> > Docker is an invitation to trouble. Anybody can publish a binary blob, and > users are expected to blindly trust it

How is this issue specific to Docker? Anyone can download a random library off github, use a shady linux distribution, or install utility tools loaded with spyware.

I don't think Docker aims to solve issues relating to trusting upstream software. It's a tool to help package applications, just like how tar allows you to package files. What you put in it is up to you.

<comment><USER20> Libraries off Github literally have the source available for you and the community at large to vet. And you'll find almost no sane shop on the planet where people are allowed, hell _encouraged_ to use shady distros or install random utility tools in production the way they are encouraged to pull unchecked binary blobs from Docker Hub in an often non-reproducible manner.

<comment><USER21> > Libraries off Github literally have the source available for you and the > community at large to vet.

Nobody read the source code for this exact reason: "the community is here to read it so I won't".

<comment><USER22> Well, for most libraries used in Desktop Linux, a significant number of stakeholders (developers+users) exist, which actually care for development and the complete thing itself. Also the libraries generally are designed for solving problems and not getting github-stars by bots/dependency-building.

For docker (and npm for all that matters) _a lot_ of important dependencies are basically simple one-off "developments" with a single developer and no userbase at all caring for them, because they don't really solve any consistent problem, being basically just created to increase the visibility of its creator on primitive metrics. The community is there for high-level packages, but the dependencies lurk in test-scripts and seldom-used functions carefully placed by some idiotic digital nomads for their personal CV- polishment (ehm, not looking at you: [https://github.com/sindresorhus/shebang- regex](https://github.com/sindresorhus/shebang-regex)). Have a look at where this package is used (basically only in cross-spawn, where there are 10 other similar dependencies), then think about, how much effort creating the dependency hierarchy was, then look up who contributed the changes, where this micro-package was required and finally decide whether this was some thing sane people would do or if it's just for personal gain...

</comment></comment></comment></comment></comment></comment><comment><USER23> Their hub website is pretty bad. I tried changing the password and the website came back with an error: Failed to save password. Interesting, so I tried again. This time it said: Current password is incorrect.

I thought, maybe I need to log out and try if the new password works. I clicked on Log Out link, the website has refreshed and I was still logged in.

<comment><USER24> Yep - same here. :( It changes it, but reports error...

</comment></comment><comment><USER25> Why am I being asked to change my password? Why haven't they just invalidated it for me already? I'm astounded I was still able to login with my existing password.

<comment><USER26> It looks like they have sent emails to everyone, not just the 5% affected.

<comment><USER27> I haven't received an e-mail, I've got multiple docker-hub accounts.

<comment><USER28> I haven't received one yet either.

<comment><USER16> Neither have I. I manage over 30 images on dockerhub. Maybe this means they are certain my data was not in the data that was leaked but I'm not sure how they'd be certain of that.

They did just post the notice in a banner at the top of [https://hub.docker.com](https://hub.docker.com)

[https://success.docker.com/article/docker-hub-user- notificat...](https://success.docker.com/article/docker-hub-user-notification)

</comment></comment></comment></comment></comment><comment><USER29> Well, this is pretty disappointing. Docker doesn't let you install it without an account, so I registered and used it for maybe a day in all. And poof, there goes my account data.

I'm just hoping that I was using a password manager by then.

Any word as to the cause of this? Was something important stored in plaintext, etc.?

<comment><USER30> > Well, this is pretty disappointing. Docker doesn't let you install it > without an account, so I registered and used it for maybe a day in all. And > poof, there goes my account data.

Eh? Doesn't let you use what without an account?

Anyone can pull images anonymously. An account is only for publishing.

<comment><USER31> Downloading Docker CE for mac or windows requires an account.

[https://github.com/docker/docker.github.io/issues/6910](https://github.com/docker/docker.github.io/issues/6910)

<comment><USER32> Direct links still work.

Mac: [https://download.docker.com/mac/stable/Docker.dmg](https://download.docker.com/mac/stable/Docker.dmg)

Windows: [https://download.docker.com/win/stable/Docker%20for%20Window...](https://download.docker.com/win/stable/Docker%20for%20Windows%20Installer.exe)

<comment> yjftsjthsd-h True, but they deliberately obfuscate that to get people to sign up. Not a great look.

<comment><USER33> This is the opposite of what it actually should be. All the startups of the world, please ask least amount of personal information or none at all -- for all we know these things are bound to happen.

</comment></comment></comment></comment></comment></comment><comment><USER34> Not a huge surprise. Here's another security issue with Docker Hub they've let sit for 4 years with no action: [https://github.com/docker/hub- feedback/issues/590](https://github.com/docker/hub-feedback/issues/590) (which is apparently a dupe of [https://github.com/docker/hub- feedback/issues/260](https://github.com/docker/hub-feedback/issues/260)).

</comment><comment><USER35> I've seen some failed attempts to log on to my GitHub account from 'Quito, Provincia de Pichincha, Ecuador' (which is quite far from where I live, as I live in Sweden...). Not sure this is related at all, but they started appear after this leak was announced...

Luckily I use both 2fa and random password for github, would suck to loose that account ;)

</comment><comment><USER36> I wonder if that will encourage them to finally resolve this issue: [https://github.com/docker/docker.github.io/issues/6910](https://github.com/docker/docker.github.io/issues/6910)

<comment><USER37> Or fix this 4 year old issue where you cant use 2FA for accounts [https://github.com/docker/hub- feedback/issues/358](https://github.com/docker/hub-feedback/issues/358)

(Side note: this obviously wouldn't have prevented the current attack)

</comment></comment><comment><USER38> From the same company that tried to force people to login before downloading Docker CE.

</comment><comment><USER39> Official Article from Docker (Same Text as the email): [https://success.docker.com/article/docker-hub-user- notificat...](https://success.docker.com/article/docker-hub-user-notification)

<comment><USER22> success.docker.com!

</comment></comment><comment><USER40> That's a nice summary. One thing I'm curious about is:

> Data includes usernames and hashed passwords

How are they hashed? And specifically, can we expect them to be already cracked?

<comment><USER41> Yes, in particular we need to know algorithm, work factor and salting details to know whether or not the passwords may be compromised.

<comment><USER42> Just assume that it's compromised and generate a new one. There is no point in wasting time trying to estimate how long it might take someone to crack it.

<comment><USER40> It matters at lower extreme. If it was something trivial and people shared the password with another account, then they may be already compromised. If it was hard and salted per-user, they still have to change it, but the chance of compromise on other services is significantly lower.

It may also explain some suspicious behaviour / source of compromise in the past (we know when the issue was uncovered, not when the first dump was taken)

</comment></comment></comment></comment><comment><USER41> Knowing the hash algorithm, work factor and salting details would be helpful in knowing whether or not passwords may be compromised. This should be standard information given in a breach, rather than just whether passwords were hashed.

Though, as they say that passwords need changing, we can safely assume that their salting, hashing and work factor were insufficient and not following best practice. Just like the lack of 2FA.

<comment><USER43> Eh, if hashes leaked I would still suggest changing passwords no matter the crypto practices involved. If you change the password, the hash is useless. If you don't, it's sill an attack vector, even if a technically impractical one (for now)

</comment></comment><comment><USER44> Just wondering, genuinely out of curiosity - how does one get to this 5% number? If the attacker had access to the DB s/he had access to 100% user data right?

Or did the get access to a partition of the user data? How is this even possible?

Some very old backup that had only 5% of earliest users?

Some log file which had plain-text creds of approx 5% users?

Or did they discover the attack as it was happening and kicked-out the attacker in the middle of a data download (only 5% complete)?

<comment><USER45> Their data can be sharded whereas only a part of their databases got compromised. Or it could be a cache layer that got compromised. Or a partial user dump intended for something else that somehow ended up in the wrong hands. I guess there could be a lot of reasonable explanations.

</comment></comment><comment><USER46> Why can't these emails just come out and say it: "your account was affected". It's always implicit.

Also, why rely on users to change their passwords? Is there a security log I can check?

<comment><USER47> Should they change your password for you? How do they communicate it securely then? Over unencrypted email, whose password may or may not be the same of your just-compromised docker account?

<comment><USER48> They could invalidate the passwords making you use a 'forgot password' link to enter a new password instead of keeping the old compromised ones :)

</comment></comment></comment><comment><USER49> Imagine the impact if NPM got hacked instead of Docker Hub. People would go crazy, run the streets like monkeys and yelling why NPM is untrustworthy must be boycotted. Last time one user got hacked and they blamed NPM for letting it happened. Everyone went crazy...

<comment><USER50> Both situations are bad, and people are upset over Docker Hub. It just happens to be Friday night so it's not getting as much attention.

NPM is bad because the Javascript ecosystem is fast-moving with loose builds that have thousands of dependencies that are all bundled and run insider consumer's browsers.

<comment><USER49> I never complained and whined like a baby every time I install Gnome for example, using Debian's apt package manager where it fetches hundreds of packages worth of 1GB. Do you know how many Linux devs required you to use Lua libraries for example only for a single isolated piece of code just because they were too lazy to write it down in C.

<comment><USER51> Most distributions' package repos _aren 't_ a free-for-all, unlike NPM

It'd be a legit criticism of ruby gems or CPAN, but linux distros are an entirely different kettle of fish, and most of the mainstream distros take security pretty seriously

<comment><USER49> Yeah just like Mint one of the most popular Linux distro where you had a preinstalled malmware on your ISO because servers got hacked. Should I mention the ultra critical vulnerability of apt that was discovered few months ago or that apt doesn't use https, cuase it designed to work with http only in the first place.

<comment><USER52> Wait, _designed_ to work with http only? Link?

<comment><USER53> I think "http only" is a bit misleading given [1], but I'm no expert. In essence, apt doesn't use HTTPS because it provides limited value for a package manager. However see the link for a more comprehensive explanation.

[1] [https://whydoesaptnotusehttps.com](https://whydoesaptnotusehttps.com)

<comment><USER49> Apt create 20 years ago, it's using HTTP protocol almost everywhere even today. They should have redesigned the whole project and ban the HTTP completely IMHO. I'm using HTTPS even on localhost services when I have for example a project that needs Grafana and influxDB.

<comment><USER54> The cryptography that apt (and other major distro package managers) use is much more safe and useful than TLS. Even if they switched to TLS on all transports, all of the package signing would still be absolutely required in order for package upgrades to be safe. In addition, the package manger should distrust the transport no matter what (in fact, it should be resilient to compromised repo servers).

Now, should apt use TLS by default? Ideally, yes. A secure transport is better than an insecure one regardless of what you're sending through it. But unfortunately it's not as simple as that. Most CDNs charge extra for TLS, and many existing free mirrors of packages don't provide TLS at all. Also, using HTTP allows for proxies to cache packages.

Unfortunately, as we discovered recently, apt had not been distrustful enough of HTTP metadata (which was a pretty big mistake since the entire design of package managers is that they must distrust the transport, especially if it's completely insecure like HTTP).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER55> Would have made this a bit clearer to note in the post that this is an email you received, and that you are not Kent Lamb using Hacker News as a medium to distribute Docker announcements, which is what this looks like.

<comment><AUTHOR> Good point, it does look wrong. Updated.

</comment></comment><comment><USER56> I can't find an announcement of this anywhere besides HN? Will Docker be publishing info via official mediums?

<comment><AUTHOR> I assume they will. I only just got the email and it looks like only a small subset of accounts are affected. Or at least that's what that PR spin is supposed to make you think.

<comment><USER56> I see. I originally thought this was the announcement, as that is what the post indicated.

<comment><AUTHOR> Yea sorry about that I was more focused on figuring out what needed to be done today and who needed waking up so I just dumped the email.

I hope this doesn't hurt docker too badly. I really like the hub / auto build service.

<comment><USER57> You aren't the one hurting Docker, they've done that themselves. You put the word out there, so thank you for thinking of everyone else out there.

</comment></comment></comment></comment></comment><comment><USER58> It saddens me that docker hub is still lacking FIDO or any 2FA support.

<comment><USER59> Most companies get 2FA after the damage is done..

</comment></comment><comment><USER60> You're probably busy, but you might want to update the splash page on Docker [https://hub.docker.com](https://hub.docker.com) to notify users of the incident ?

</comment><comment><USER61> I did not get any email but my github is showing dozens of failed login attempts over the last 3 days.

<comment><AUTHOR> Sending 190k emails takes time but please update us here if you don't receive in a day or so. - curious if their 190k is accurate or downplay spin.

<comment><USER62> It takes around 2 hours to send ~200k emails if you use an external email gateway and have good outgoing bandwidth.

</comment></comment></comment><comment><USER63> [https://status.docker.com](https://status.docker.com) still not a mention. Wonder how long until it is.

<comment><USER18> That's the wrong place to track a hack. The status page is concerned with uptime, not security.

<comment><USER63> I disagree, destroying a ton of keys breaks stuff.

</comment></comment></comment><comment><USER64> What are dockerhub's alternatives? No 2FA. That is bad.

<comment><USER65> As others have stated you could run your own registry or use an alternative service for private repositories, to minimise or eliminate the attack vector.

By replicating the images (or packages) that you need into your own account, you can minimise the possibility of a bad actor replacing a well-known image with something untrusted.

An alternative is to side-cart a service like Notary ([https://docs.docker.com/notary/getting_started/](https://docs.docker.com/notary/getting_started/)) in order to establish a chain of trust for images. If an image gets changed, Docker will refuse to use it and you _will_ be warned that it is untrusted.

Biased opinion on an alternative registry:

\- Cloudsmith: [https://cloudsmith.io/l/docker- registry/](https://cloudsmith.io/l/docker-registry/)

But you've got other options, such as:

\- Self-hosted: [https://github.com/docker/distribution](https://github.com/docker/distribution))

\- Cloud-specific (e.g. ECR, GCR, ACR, etc.)

\- Sonatype Nexus: [https://www.sonatype.com](https://www.sonatype.com)

\- ProGet: [https://inedo.com/proget](https://inedo.com/proget)

\- Gitlab: [https://gitlab.com](https://gitlab.com)

\- Artifactory: [https://jfrog.com/artifactory/](https://jfrog.com/artifactory/)

If you're missing the auto-build functionality, this can be achieved reasonably easily with any of the mainstream and awesome CI/CD services out there, such as:

\- SemaphoreCI: [https://semaphoreci.com/](https://semaphoreci.com/)

\- CircleCI: [https://circleci.com/](https://circleci.com/)

\- DroneCI: [https://drone.io/](https://drone.io/)

Disclaimer: I work for Cloudsmith, and still think Docker Hub is great. :-)

<comment><USER66> You can run your own private Docker registry but you will still depend upon the base images pulled from hub.docker.com in your deploy chain unless you make sure to clone the base image Dockerfile from github and build it yourself. Even with this protected setup; you still have exposure from poisoned Github repos after this attack because of the compromised Github access keys. I'm not sure you can eliminate this threat, even with third-party services. What a mess.

<comment><USER65> It might be OK for the Docker Hub aspect at least, with a caveat later on; the GitHub aspect is unfortunate and I completely agree. Direct access to source is rather dangerous territory.

Back to the images bit first:

Base images are only referenced/pulled at build time. So if you've already built your own image and stored it, it'll contain all of the layers necessary to run it without explicitly pulling from Docker Hub.

In the case that you're building new images (likely), it'll need to pull the base images from Docker Hub. However, if you pull the base image(s) from Docker Hub first, you can tag them and store them in your local (or hosted) registry, then refer to those explicitly instead.

For example (using a Cloudsmith hosted registry):

      docker pull alpine:3.8
      docker tag alpine:3.8 docker.cloudsmith.io/your-account/your-repo/alpine:3.8
      docker push docker.cloudsmith.io/your-account/your-repo/alpine:3.8

Now, instead of the usual FROM directive:

      FROM alpine:3.8

You can refer to your own copy of alpine:

      FROM docker.cloudsmith.io/your-account/your-repo/alpine:3.8

As you can see Docker's syntax doesn't make this extremely pleasant, and you'll have to change existing Dockerfiles to point at the base images, but it's certainly possible to mirror your dependencies without rebuilding.

Caveat: The downside is that you have to trust those dependencies at the exact point you pull them down, so I concede it is still not perfect _without_ rebuilding the lot. :-)

</comment></comment></comment></comment><comment><USER67> Another reason to have Encrypted Container Images :) [https://github.com/opencontainers/image- spec/issues/747](https://github.com/opencontainers/image-spec/issues/747)

</comment><comment><USER68> Hmm, my GitHub account is showing failed logins starting from 2 days ago, with none for the remaining period that GitHub shows - no email from Docker yet, but I wonder if this is related?

</comment><comment><USER69> Why is this publicly posted here and not just in the platform and directly contacting people affected? So big became the HN influence and marker? It could have been just linked

</comment><comment><USER70> Well this is fun, I'm now unable to logout. I have a feeling there's more to this incident than Docker is currently disclosing...

</comment><comment><USER71> This step by step checklist might help you "what should I do" to review your accounts.

[https://blog.madhuakula.com/some-tips-to-review-docker- hub-h...](https://blog.madhuakula.com/some-tips-to-review-docker-hub-hack- of-190k-accounts-addcd602aade)

</comment><comment><USER72> What does this means for users? I was using watchtower to auto update the images in my system. One of them was autoupdated after the failure.

Can this be used to upload containers with security exploits in order to gain access to machines (i.e. does it give write access to the containers)?

</comment><comment><USER73> I'm curious, how can a database be accessed without authorization? If authorization is enabled? Also how unauthorized access can be discovered?

Say I use Mongodb and enabled authorization. Will I be fine then? How to discover unauthorized access?

<comment><USER74> Authorization has a common English definition too. If, for example, an employee's credentials were compromised, anyone who wasn't that employee who accessed the database would be considered "without authorization". And checking the access logs for any use of that employee's credentials would give you some idea of what data was accessed. Enabling authorization on your mongodb is good, but it absolutely won't stop all forms of unauthorized access. They may gain access to your server itself, or gain some credentials to your MongoDB database some other way (for example, if someone carelessly ships them as part of your software, or includes them in a github commit, or something like that).

In the worst case, if someone notifies you of a configuration problem or some software bug that allows anonymous access to your database or the ability to remove logs, you may have to assume the entire database was compromised since the existence of that configuration issue or software bug.

</comment></comment><comment><USER75> Is this affecting CircleCI? As far as I know their images pull from Docker Hub.

</comment><comment><USER76> If the passwords are hashed, just what are the likelihood of your passwords being decrypted? I'd also imagine it is a one way hash since that's typically the norm so I don't even know how it can get decrypted.

<comment><USER77> Hashes are not decrypted, they are bruteforced.

> I imagine it is a one way hash

All hashes are one way. If it's lossless and can be reverted, it's a compression algorithm or isomorphism or encryption or cipher or any of a number of other things, but not a hash.

> I don't even know how it can get decrypted.

It is not decrypted, but brute forced. For example, even if you can't algorithmically figure out what the input to md5sum is that gives you '1f3870be274f6c49b3e31a0c6728957f', you could apply md5sum to every word in the dictionary in a matter of seconds and find out that 'apple', when md5summed, has that output. You would then have one possible password for that hash (though technically there are infinitely many inputs that have that output).

The only way we can know how computationally difficult it is to brute force the password hashes is if we know the following: 1) the hash algorithm used (and other inputs like cost factor) and 2) the entropy of the salt used. Those two together lets us calculate the amount of computation needed to try one brute force "guess". Individual password's difficulty to be brute forced can then be calculated from their entropy (e.g. 'apple' has less entroy than '2SEZb'), to determine the average number of inputs needed to be tried, multipled by the cost of each attempt. Given that difficulty, you can then estimate how long an attacker will take to find your password by estimating how much computational power they have at their disposal.

In general, if you randomly generate 10+ character passwords and docker used best practices, the answer is that any attacker will not get your password in under a thousand years, and if you use a password which has been leaked before or is a dictionary word (or simple variation), it can be found on the order of minutes to days.

<comment><USER78> Hopefully they are salted with a unique ID because of the are using a md5sum only then you're screwed with rainbow tables.

<comment><USER79> I'm going to go out on a limb and say Docker are unlikely to be using MD5, salted or otherwise.

<comment><USER78> Agreed.

</comment></comment></comment></comment></comment><comment><USER80> Docker has revoked GitHub and BitBucket access tokens tokens at least as of 27 Apr 2019 18:41:36 UTC

[http://archive.fo/bKGKq](http://archive.fo/bKGKq)

</comment><comment><USER81> Let me get this right, Docker now forces users to register in order to download their client and they don't secure our data? Insane!

</comment><comment><USER82> Error 500 when I try to login:

"Sorry, it's not you. It's us, but we are working on it!"

</comment><comment><USER83> So, would it have been possible that the perpetrators knew about the keys and had built a way to scan them all beforehand? Or is this more likely to be an attempt at farming passwords?

</comment><comment><USER84> hash+salt please

</comment><comment><USER85> you guys should partner with github to disable those token which have leaked

</comment><comment><USER86> Does this lessen the relevance that docker has these days?

<comment><USER40> Did Docker become any less useful for you due to this, or provides less value? Unlikely.

<comment><USER86> I'm thinking twice about using docker hub.

And the main usecase is k8s. So docker is just an implementation detail its relevancy is waning imo

<comment><USER87> Docker hub is a centralized service. What we are seeing is the result of having a huge centralized service: if it gets compromised, then many dependencies are compromised.

Some organizations took the risk of running docker taking images directly from docker hub. They were relaying the security of the images to them.

Some organizations are going to panic now and host their own registry. Which they need to protect as well. But in general it will create a better decentralized ecosystem.

I think this is good for the docker community in general.

<comment><USER86> We run our own registry that just mirrors images that we want to use and keeps them up to date. It's not a silver bullet but it works.

<comment><USER88> I'd worry about mirroring the images because of cases like this, you'd want some sort of triage process before it gets into your environment.

</comment></comment></comment></comment></comment></comment><comment><USER89> That is a great news. Happy security.

</comment><comment><USER90> I think this is a very ugly incident for Docker.</comment>


George Hotz cancels his Tesla Autopilot-like 'comma one' - <AUTHOR> https://electrek.co/2016/10/28/george-hotz-cancels-his-tesla-autopilot-like-comma-one-after-request-from-nhtsa/ <comment><USER2> I love this paragraph of the Request:

> The singular includes the plural; the plural includes the singular. The > masculine gender includes the feminine and neuter genders; and the neuter > gender includes the masculine and feminine genders. "And" as well as "or" > shall be construed either disjunctively or conjunctively, to bring within > scope of this Special Order all responses that might otherwise be construed > to be outside the scope. "Each" shall be construed to include "every", and > "every" shall be construed to include "each". "Any" shall be construed to > include "all", and "all" shall be construed to include "any". The use of a > verb in any tense shall be construed as the use of the verb in a past or > present tense, whenever necessary to bring within the scope of the document > requests all responses which might otherwise be construed to be outside its > scope.

I've seen similar paragraphs on other legal documents, but this is the most thorough I've seen. It's basically just a huge middle finger to all (any?) armchair lawyers who want to weasel out of the order.

<comment><USER3> It didn't spell out what the definition of 'is' is, though.

<comment><USER4> The part about verb tenses is specifically referring to the "what 'is' is" loophoole.

</comment></comment></comment><comment><USER5> He's currently throwing a temper tantrum on Twitter, and all because the NHTSA wanted to ask him a few questions about the product (you can see it here: [https://www.scribd.com/document/329218929/2016-10-27-Special...](https://www.scribd.com/document/329218929/2016-10-27-Special- Order-Directed-to-Comma-ai)). Like, how dare the government try to have basic standards for multi-ton hunks of metal hurtling down the highway without human input.

I've been trying to convince people lately that Silicon Valley isn't all delusional technolibertarian assholes, but guys like this sure aren't making my case easy.

<comment><USER6> If you read the letter, it's a lot more than "answering a few questions".

He gets two weeks to provide an enormous amount of detailed information about the product, I assume under threat of legal consequences if any of it contains an error, interspersed with lots of reminders that they can and will close down his business if they feel like it.

<comment><USER7> Yeah it seems a lot of the community here thinks that if he just threw together a few bullet points in an email response the NHTSA would sit back, say "Okay, great have fun!" and not, you know, make a big deal out of it. I, uh, disagree.

<comment><USER8> I more thinking "why the hell doesn't he have the answers already?"

<comment><USER7> Having mentioned this elsewhere, I have first-hand experience going between SMEs and X/Y/Z bureaucratic entities for half a decade and there's a big difference between "having the answers you think are satisfactory" and "providing answers that they think are satisfactory." GI Joe pointed this out long ago in that "Knowing is half the battle" and putting it into a work product that accomplishes its task is the other half of the battle in this case (with no guarantees the responses provided will end the inquiry / threat of fines).

<comment><USER9> That doesn't really answer the question. You don't need first-hand experience to know that government red tape is onerous. It was flatly predictable that the NHTSA -- the government agency concerned with roadway safety -- would make such inquiries. So why didn't Comma work with the NHTSA and get their blessing before announcing a release date?

I mean yeah, it sucks that the government is so darn picky about things, but that's not an excuse to just skip the process. They should have hired someone like _you_ from the start to ensure that their ducks were in a row when they were ready to release.

</comment></comment></comment></comment></comment></comment><comment><USER10> The comments in this thread make me realize that there is a large amount of HN readers who have never had to deal with the government.

Yes, the penalty is scary looking, but it is par for the course. You don't get exposed to it if you are doing amateur/freelance/e-commerce.

As soon as you touch critical national infrastructure (Telcom, NTSB, Healthcare, finance) then you have to deal with the government, which never forgets to remind you of the threat of authorized violence and financial penalties.

If you want to play at the high stakes tables, you have to pay the blinds. If that's too scary, then stay at the smaller tables.

The unfairness commentary here is pretty naive.

<comment><USER11> I feel like another part missing in the comments here is that most US regulations allow an individual pretty extensive free reign when it comes to risky ventures (see experimental aircrafts, make your own guns, electronic devices and a couple others). The regulation hammer really kicks in once you start trying to market it to other people, or 'what are you actually selling to people.'

<comment><USER12> Yea I totally agree with you here. If he hadn't said he was selling this product and branded it so, he most definitely would have some interesting arguments under most of these regulations and verbiage in the letter. What happens if I install a little motor that controls my own pedals and steering wheel? What if I blogged about it? What if I tried to sell it? I think there were a lot of poor decisions made by hotz

</comment></comment></comment><comment><USER13> Something seems fishy to me. Cruise which GM bought for $1B a few months back was working on similar tech. Having only raised $3M he could have EASILY sold his tech/team to Chrysler or Ford or Hyundai, or any other car company for $100M and made his investors super happy and himself very rich.

So why "quit" when the feds ask you to deal with regulations that involve passenger safety. Its not like he had to spend $20M on clinical trials.

<comment><USER14> He posted the answer to this on Twitter: "Would much rather spend my life building amazing tech than dealing with regulators and lawyers. It isn't worth it."

Money isn't everything to some people. He has the true hacker ethos.

<comment><USER15> For me, hacking is about understanding systems and altering them in a way they behave favourably to you. The right thing to do when a regulator fires letters to you is to build a firewall of managers and/or lawayers to ensure they don't penetrate the hacking activity.

</comment></comment></comment><comment><USER4> I find it interesting that he was on This Week in Startups only a few weeks ago calling every company he found unconvincing "losers" [https://www.youtube.com/watch?v=2zy_07g2IrM](https://www.youtube.com/watch?v=2zy_07g2IrM)

Maybe they're all losers and you're a winner, but perhaps being an elite hax0r isn't all that's needed to go to market...

If you can't reply to a regulator letter, how are you going to deal with supply chain or cash flow issues? Bad reviews in the press or on Amazon? People who want refunds? Not to mention the literal horror of a car crash. To borrow a term injected into this election season, you gotta have Stamina.

<comment><USER16> Keep in mind that given Geohot's promise of "shipping" comma one by 2016 EOY, it's impossible to keep that promise if they have to deal with regulatory agencies and certifications stuff. And there are probably other countries and markets with much lax requirements, I think this is probably the main reason he cancelled the product on U.S.

On the other hand, I am really concerned that he and his team didn't appear to think about working with the government agencies beforehand to sort out any regulatory requirements in order to prevent this kind of situation. Shocked!

<comment><USER17> >> On the other hand, I am really concerned that he and his team didn't appear to think about working with the government agencies beforehand to sort out any regulatory requirements in order to prevent this kind of situation. Shocked!

Well consider the attitude of SV hackers toward the established auto industry. They think we're a bunch of... I dunno... rust-belt, old-school, last century, bumblefucks who don't understand technology. Given that attitude it probably never occurred to him that there might be people or even regulators taking this stuff way more seriously than him.

</comment></comment></comment><comment><USER18> It's difficult to be sure about George.

He spoke so derisively about other companies that failed to deliver, and now because of the inevitable paperwork that comes with a product that takes over your car for you at times (level-3 autonomy iirc), he too fails to deliver.

If he leaves to join Tesla, it seems pretty irresponsible, given that he's raised $3.1M and has a team of employees relying on him.

But that's all speculation until we see what comes next.

Perhaps I'm unimaginative at ~1:30am, but I can't imagine what he wants comma.ai to do, unless he sells or licenses the product to automakers who can do the paperwork for him.

<comment><USER19> He could return the unused funds still.

</comment></comment><comment><USER20> Wow, sometimes I wish HN came with a "context, please" button. ;)

It's a self driving car (or rather a prototype of an "autopilot" feature like Tesla's), AFAICT.

From [1]:

> After a couple miles, Hotz lets go of the wheel and pulls the trigger... > Hotz shouts, "You got this, car! You got this!"

> The car does, more or less, have it. ... Amazed, I ask Hotz what it felt > like the first time he got the car to work.

> "Dude," he says, "the first time it worked was this morning."

[1] [http://www.bloomberg.com/features/2015-george-hotz-self- driv...](http://www.bloomberg.com/features/2015-george-hotz-self-driving-car/)

<comment><USER21> It does have such a button! It's the comments button. Of course, it relies on enterprising users such as yourself to make it happen. You have created what you wished for!

And just to confirm, your summary is correct. It's not self-driving, but it is lane keeping and intelligent cruise control adequate for fully automatic highway driving in normal circumstances, like Tesla's current Autopilot is. It was to be an aftermarket accessory that could be installed by the buyer, presumably hooking into the OBD2 port and controlling existing servos. The initial release was to focus on a small number of Honda and Acura models which already have lane assist and cruise control features, but not as sophisticated, so it was able to take advantage of that existing hardware and extend its functionality.

</comment></comment><comment><USER22> Wow. If he really moves his project to China to take advantage of a lax regulatory environment even though he couldn't pass the scrutiny in the US, he's being very immoral and cavalier about people's lives in China.

I don't understand how a startup like Cruise can get past this regulatory hurlde in the US but Hotz can't.

<comment><USER23> Programming a neural network to learn to drive is fun; dealing with lawyers is not.

I don't think it is a matter of passing the regulatory hurdle; it's a matter of not wanting to deal with it.

<comment><USER24> So did he naively expect that he would not have to deal with the legal issues?

<comment><USER25> His rep (from people I know who know him personally) is such that actually doing anything that doesn't involve a computer sending him into paroxysms of rage sounds completely in-character.

<comment><USER24> Someone should have told the people who funded him.

<comment><USER19> Led by a16z [1], and I think the partner is Chris Dixon.

[1]: [https://medium.com/@cdixon/comma- ai-e62eea5fa8d2](https://medium.com/@cdixon/comma-ai-e62eea5fa8d2)

</comment></comment></comment></comment></comment></comment><comment><USER26> Given how reasonable the NHTSA request looks, to give up so quickly is a bit suspicious. In products like that it is likely that the first 50% looks much more approachable, and then as you try to reach something that can actually be shipped to customers, you have to solve huge problems incrementally, and it is very hard. So looks like a bit of an excuse to stop it: if you have the working thing you try harder before giving up IMHO.

<comment><USER27> I agree. I think he hit a wall with his tech, realized it and was looking for an out.

</comment></comment><comment><USER28> Nobody who is familiar with George is surprised by this. It's unfortunate that his ego has a scapegoat, however. I guess this time he couldn't find anyone on IRC to finish the hard parts for him and let him take the credit.

<comment><USER29> > I guess this time he couldn't find anyone on IRC to finish the hard parts > for him and let him take the credit.

I feel like there is some backstory here I've never heard.

<comment><USER30> Backstory here: [https://twitter.com/comex/status/709868908161929216](https://twitter.com/comex/status/709868908161929216)

</comment></comment></comment><comment><USER31> a little more detail from techcrunch: [https://techcrunch.com/2016/10/28/comma-ai-cancels-the- comma...](https://techcrunch.com/2016/10/28/comma-ai-cancels-the-comma-one- following-nhtsa-letter/)

It seems that Hotz said, "dealing with regulators and lawyers… isn't worth it."

Which seems very unfortunate/shortsighted due to how useful this tech could be. Why not hire someone to deal with them for you?

<comment><USER32> That may be just a fig-leaf to plaster over 'we couldn't do it'. It's one thing to release software, it's quite another thing to release this software and have it tested, audited and certified safe and that's definitely part of the process of delivering software that is critical to the well being of the users and the other people you're sharing the road with.

And that second part is part-and-parcel of wanting to operate in this space.

<comment><USER33> An ex-colleague of mine used to say the difference between a software engineer and a real engineer is that the latter's signature is criminally binding.

We can refuse to be real engineers (it is a great responsibility), but then we should drop the title.

<comment><USER32> I'm 100% in agreement with that. Engineers carry responsibility for their work (and do so with pride).

</comment></comment></comment></comment><comment><USER34> Hopefully his example is shown to every engineering class along side the Tacoma Narrows bridge collapse example.

He is truly an example of an irresponsible engineer and a great lesson to learn from.

</comment><comment><USER35> The dude is brilliant no doubt... But this space requires brilliance and a lot of spine. That is what makes someone like Musk so unique. Someone thats willing to risk it all, and won't let doors closing in their face and public opinion hinder them. I hope Hotz can put his ego aside and go work with someone that can handle the bureaucracy and red tape. He is surely a prodigy and it would be a shame if the world can't benefit from his ideas.

</comment><comment><USER36> I'm not involved in the machine vision field but I found his commitment to open and transparent academic publishing very admirable.

He published a paper with their summer intern here: [https://arxiv.org/pdf/1608.01230.pdf](https://arxiv.org/pdf/1608.01230.pdf)

<comment><USER37> This is not peer-reviewed. This is a tech report. Anybody can post these.

<comment><USER38> Well, you usually need a university address or some endorsers to post to the arxiv, but true, most people could probably post that.

On the other hand, the arxiv is also the default method of communication in quite a few fields (physics and maths, mostly), to the point that while grant committees etc. look at your peer-reviewed papers, I essentially only check the arxiv for new developments, not the plethora of properly peer-reviewed journals.

</comment></comment></comment><comment><USER39> Haven't we heard this story countless times from projects on sites like Kickstarter before? There is a huge difference between tinkering in your garage and creating a production product.

Whether it's something that falls under government regulations like Hotz's project, or transitioning from a couple of 3D-printed models in your basement to an injection molded factory, making things (at scale and in the real world) is hard.

</comment><comment><USER40> I'm just amazed at what a bad name that is. _" Comma One"_... Did they never think that it would be called the _The Coma One_ after even the slightest inevitable incident? Or that a segment of people will be innocently misspelling it as "Coma" everywhere? and how quickly it could catch on?

It's so obvious it seems almost Freudian ...

<comment><USER41> It's not a great name, but I'd give him the benefit of the doubt and assume it's "all things AI". Think classification language, like "Car, Self-Driving". They could be "Car, AI" and "Assistant, AI".

Less charitably, it's step one toward Tres Commas.

<comment><USER42> Given that he referenced the HBO show in his Techcrunch presentation, I'd say the reference to the three comma club is probably the most likely.

Also, one comma would be $1000, which is what the thing was supposed to cost.

<comment><USER40> I don't know if it was ever intended as a consumer facing name, but even without the "coma" puns, it's too wonky for customers, do you think?

Besides, isn't one comma 99k worth of room? It's marketing lingo aimed at the hubris of venture capitalists.

<comment><USER40> / or yeah a bit from Silicon Valley, got it.

</comment></comment></comment></comment></comment><comment><USER7> Do I think Hotz has a viable product? Yes. (A comment over at Jalopnik linked to a Tweet where an actual human rider / journalist experienced the Hotz vehicle and was quite impressed)

Do I think there's significant political pressure to have his product, ahem, driven into the ground as to not be a viable competitor to larger firms? Yes.

Do I think it's a sign of immaturity to pack up your stuff and leave when confronted by a small challenge? Yes.

Do I think dealing with the NHTSA (and potential NTSB) is a small challenge? No.

Am I still a fan of George Hotz as both an inventor, innovator, and persona? Yeah, I can see where he's coming from.

Do I think it's hilarious that a vocal contingent here criticizes him for taking a "path of least resistance" (regulation) in his development and iteration process? Absolutely.

<comment><USER43> > Do I think Hotz has a viable product? Yes. (A comment over at Jalopnik > linked to a Tweet where an actual human rider / journalist experienced the > Hotz vehicle and was quite impressed)

Journalists being shown demos in controlled circumstances are a notoriously unreliable source of information about the viability of a product.

<comment><USER7> Oh come on, do you understand the concept of journalism? It's a reporting profession. It's not goddamn PR.

<comment><USER43> I'm just saying that there are many cases where "a single instance of a journalist having a good experience with a revolutionary pre-release product" turned out to have been the company deliberately misleading the journalist. I'm not claiming that happened here, but I am claiming there is a non- negligible chance it happened.

<comment><USER7> Fair enough, I'm not trying to say the profession is 100% on the up and up and you're right, people can be manipulated. That doesn't mean it's reasonable to prima-face like you did and dismiss a journalist's impressions (being cited on an Auto enthusiast site mind you) as worthless. It just struck a nerve because I'm a pretty cynical person but do my best to weigh what I've seen / gathered, and while I do admit I think George is an interesting underdog type character and sympathetic in that regard (so to speak), I'm noticing a lot of open hostility toward the product being cloaked in dislike of the person.

<comment><USER44> I'd agree with this. The journalist in question (Alex Roy, [https://en.wikipedia.org/wiki/Alex_Roy](https://en.wikipedia.org/wiki/Alex_Roy)) is an auto enthusiast and race driver, and is well respected even in auto enthusiast circles, which are notoriously anti-self-driving-cars.

Journalists can be manipulated, but Alex Roy's tweet ([https://twitter.com/AlexRoy144/status/791996855114694657](https://twitter.com/AlexRoy144/status/791996855114694657)) is more an endorsement by a car enthusiast with 30+ years of high performance driving experience than a journalist, IMO.

<comment><USER7> Thanks, I appreciate your context because I think such quality of sources matter. In this instance, I thought it was appropriate to include a 3rd party of sorts who really doesn't have skin in the game.

</comment></comment></comment></comment></comment></comment></comment><comment><USER45> I guess that makes Hotz one of the "jokers" now?

</comment><comment><USER46> The attitude in the tech industry is to ship buggy products before they are complete. I'm so tired of wasting my time with buggy crap.

I think it's awesome that a government agency said that this practice is not acceptable when someone's life is at stake.

</comment><comment><USER47> Here's what the Special Order demanded:

1\. Describe in detail how the comma one is installed in a vehicle and provide a copy of installation instructions for the comma one.

2\. Describe in detail the advanced driver assistance features of the comma one, including how those features differ from the existing features of the vehicles in which the comma one is intended to be installed.

3\. Describe in detail how a vehicle driver uses the comma one and provide a copy of user instructions for the comma one.

4\. Provide a detailed description of the conditions under which you believe a vehicle equipped with comma one may operate safely. This description must include

a. The types of roadways on which a vehicle equipped with comma one may operate safely;

b. The geographic area in which a vehicle equipped with comma one may operate safely;

c. The speed range in which a vehicle equipped with comma one may operate safely;

d. The traffic conditions in which a vehicle equipped with comma one may operate safely;

e. The environmental conditions in which a vehicle equipped with comma one may operate safely;

f. The amount and type of driver inputs necessary for a vehicle equipped with comma one to operate safely.

5\. Provide a detailed description of the basis for your response to Request No. 4, including a description of any testing or analysis to determine safe operating conditions for a vehicle equipped with comma one.

6\. Describe the steps you have taken or plan to take to ensure the safe operation of a vehicle equipped with comma one, including but not limited to automated shutoff of comma one features and owner education.

7\. Provide a list by make, model, model year or year of production of each vehicle for which you support or anticipate supporting use of the comma one.

8\. Describe in detail any steps you have taken to ensure that installation of the comma one in any supported vehicle does not have unintended consequences on the vehicle's operation.

9\. Describe the functionality of comma one, if any, if installed in an unsupported vehicle.

10\. Have you done any analysis or testing of the impact or potential impact of comma one on the vehicle's compliance with the FMVSS? If yes, please describe the analysis or testing in detail and provide supporting documentation. If no, describe why not.

11\. Describe in detail how the comma one impacts a vehicle's rearview mirror, including whether it requires removal of the rearview mirror or the extent to which it blocks or obstructs the rearview mirror.

12\. State your position on how the comma one does or does not affect a vehicle's compliance with FMVSS No 111, Review Mirrors (49 CFR 571.111), and provide any supporting information or documentation to support your position.

13\. State the date on which you currently plan to begin selling the comma one, and provide a list of all retailers and/or websites through which you anticipate selling the comma one.

14\. State the date on which you currently plan to begin shipping the comma one.

15\. Provide any other information which you believe supports the safety of the comma one.

<comment><USER48> Wow. I guess the first thing I'd do is file a FOIA request to see any Special Orders they may have sent to Apple, Uber, Google, Tesla, GM, Ford, Mercedes Benz, Volkswagen, Audi, Nissan, Toyota, BMW, and Volvo, and for copies of any documentation received from those companies that would be responsive to the demands in their own order or the order to comma.ai . Then I'd also request an extension in the time to respond until such time as the documents responsive to the FOIA request have been produced and read.

It would be so much easier to respond if you could just do exactly the same thing that the larger players did.

Unless, of course, those other companies didn't have to produce any such documentation. In that case, clearly, every last company working on autonomous vehicle functions would have to receive a substantially similar order, post haste. We wouldn't want anyone crying about _selective enforcement_ , after all.

<comment><USER21> Something tells me that serious companies involved in this space never received any Special Orders because they reached out to and worked with the NHTSA from the start, rather than trying to fly under the radar and then being shocked! Shocked! When the government actually noticed them.

<comment><USER49> This seems to make sense, given how I'm in the past few years starting to realize how things actually work in the world..

</comment></comment></comment></comment><comment><USER50> Today, I can only paraphrase George's harsh bulling destructive feedback he gave us on our startup:

George, "that wouldn't work" :)

<comment><USER51> And days before that I was with him in a fundraising dinner and we were like besties. Sociopaths.

(Edited to reflect the point more politely)

<comment><USER52> That's a very rude thing to say publicly.

</comment></comment></comment><comment><USER53> I'm seeing a huge number of assumptions and assertions, but this is still "developing news". I think it's equally likely that this device will be brought to market at a later point when the start-up gathers the resources, test results, and the lawyers that can handle the regulators.

</comment><comment><USER54> He did release the dataset and some python scripts for training the model.

[https://github.com/commaai/research](https://github.com/commaai/research)

The last blog post talks about them having a system for the 2016 civic. I guess maybe they will sell it on aliexpress?

</comment><comment><USER55> Here's Bloomberg article on Hotz's initial prototype: [http://www.bloomberg.com/features/2015-george-hotz-self- driv...](http://www.bloomberg.com/features/2015-george-hotz-self-driving-car/)

</comment><comment><USER56> Technically it sounds more like he is pivoting to other markets and tweaking the product. I don't think he is giving the 3 million back to Andreessen.

<comment><USER7> For a community that preaches iteration so consistently it's rather hypocritical and hilarious to see so many responses basically thinking that he's vaporware and moving operations to China because he can't hack it here in the US - Occam's Razor would indicate less regulations in China would be a path of least resistance to iteration of this sort.

Besides, if Hotz can get his car to navigate China before Musk can get his product to not drive in the wrong lane in a fucking parking lot, then we've got game on.

</comment></comment><comment><USER57> Comma's main advantage over Tesla's Autopilot was, as I understand it, the use of cameras to collect video data. Hotz presented that as the advantage at TechCrunch Disrupt, at least, saying that he could beat Tesla's Autopilot because he had full video data from a small smartphone app that he had test users running as they drove while Tesla's vehicles had no video input.

I wonder if his choice to cancel Comma is related to Tesla's recent announcement that all new Tesla vehicles would ship with a full video camera outfit.

<comment><USER58> > _while Tesla 's vehicles had no video input._

This is factually incorrect.

Tesla vehicles rely on Mobileye [1] cameras to do its environmental analysis. These cameras come with the processing hardware to analyze the sensor data they're getting, and spits out environmental information that the _driver assistance_ [2] can use to navigate the car.

Whether Tesla had access to the sensor data directly rather than just the analyzed stream is not public information. Now that Mobileye broke up with Tesla [3], it's unlikely they'll ever have it.

Mobileye has years of experience in dealing with the kind of visual data you need to have on the road, such as crazy HDR (you want to be able to extract useful information when the sun is glaring at you as well as in the dark woods in the night, and be able to switch immediately as when you're going through a tunnel). They've developed dedicated hardware to reliably and quickly do object distance and velocity detection: this is exactly the scenario that a "Real-Time OS" is made for. You cannot afford to be pre-empted and lose 5ms on your analysis and miss an action frame.

Thinking you can pull this off reliably with a non-RTOS and consumer cameras is... naive.

[1] [https://en.wikipedia.org/wiki/Mobileye](https://en.wikipedia.org/wiki/Mobileye)

[2] Mobileye's equipment was never rated for full-on "Autopilot", which is why they were very unhappy with Tesla marketing their systems as such

[3] [http://www.wsj.com/articles/mobileye-ends-partnership- with-t...](http://www.wsj.com/articles/mobileye-ends-partnership-with- tesla-1469544028)

<comment><USER58> I should add, by the way, that while Teslas have onboard radar, it is not a primary sensor, but a secondary discriminating sensor.

This was admitted by Musk on Twitter following the fatal crash in Florida: [https://twitter.com/elonmusk/status/748625979271045121](https://twitter.com/elonmusk/status/748625979271045121)

<comment><USER59> It was a secondary discriminating sensor, but the latest Autopilot 8 upgrade retasks radar to be "a primary control sensor without requiring the camera to confirm visual image recognition": [https://www.tesla.com/blog/upgrading- autopilot-seeing-world-...](https://www.tesla.com/blog/upgrading-autopilot- seeing-world-radar)

<comment><USER58> Indeed. And I absolutely do not trust them on it. Their radar hardware just isn't good enough to reliably do that.

<comment><USER59> Ditto. It also seems strange to be able to retask their radar from secondary to primary control.

</comment></comment></comment></comment></comment></comment><comment><USER60> Personally, I think it's good to see this. I work on a small part of an ADAS system being developed for a large Tier 1 supplier. They won't even look at you if you haven't adhered to ISO 26262 development standards which add - easily - 2 times the work that a normal development would take. And for good reason.

I'd like to see GH's Failure Modes and Effects Analysis, Fault Tree Analysis, Failures in Time Analysis, etc., etc., etc.

This stuff is really safe and not there yet for a REASON.

</comment><comment><USER61> When is the open source project to create self driving systems going to start? I feel very uncomfortable with private corporate AI driving me around and making decisions with my family's life in the balance. For me, I need to be able to see the code, change the code, change the weightings and priorities. I've been thinking about FOSS solutions to car computers a lot and it seems like it is really the only way to go if you care about freedom, security and privacy.

<comment><USER62> Probably about ten years after it's commercially available.

</comment></comment><comment><USER63> The government threatening him to pay a penalty of $21,000 per day(!) before even selling the product sure didn't inflict affection from his side.

[0] [https://www.scribd.com/document/329218929/2016-10-27-Special...](https://www.scribd.com/document/329218929/2016-10-27-Special- Order-Directed-to-Comma-ai)

<comment><USER21> They're just asking for information at this point. The penalty is if he doesn't provide that information by the deadline. I'm sure being threatened with such a penalty isn't pleasant, but it's hardly unusual. I mean, just about every little government form I send in has a section that starts out with, "Under penalties of perjury, I declare that...."

</comment></comment><comment><USER64> There's gotta be something else, no way one letter makes you scrap a product like this, I fail to believe it

</comment><comment><USER65> I've been thinking for a while now that the main threat to the existence of self-driving cars in the medium-term future is that somebody, in the rush to beat Google, jumping the gun and selling cars that kill people cause Congress to knee-jerk outlaw the whole thing.

</comment><comment><USER66> Do third-party "autopilot" systems require ISO 26262 certification? I know that car manufacturers and tier-1s spend lots of time and money getting their safety-critical code certified. Do the same requirements not apply to aftermarket solutions?

Actually, now that I think about this more... does Tesla's autopilot have ISO 26262 certification? I hope that the recent advancements in self-driving cars isn't a result of tech companies bending or breaking the rules, but I don't know enough about when ISO 26262 is required (if at all).

</comment><comment><USER49> I hope he backs down a bit, consults widely and work with the regulators looking into his company's product, even while exploring other markets.

Still personally rooting for him because I personally think his product is amazing, and is poised to be a huge success if he does ship.

As an outsider, his audacity, backed by proven technical smarts, seems to be the quality that should define the Silicon Valley startup scene, but over time, sentiments here at HN and other forums seem to suggest otherwise.

</comment><comment><USER67> The following quote from his site speaks volumes about the hubris:

"we didn't do anything wrong, but somehow, we lost \-- nokia, or car companies in 5 years"

</comment><comment><USER68> <<George Hotz cancels his Tesla Autopilot-like 'comma one' after request from NHTSA

What is the role of the national highway transportation safety administration wrt driver less card and trucks?

Can they issue rules? Can they prevent deployment? Is it for cars and trucks? Once driverless exists will there have to be a differentiator for auto/truck?

<comment><USER69> > Can they issue rules? Can they prevent deployment? Is it for cars and > trucks?

Yes. They are a federal regulatory agency.

</comment></comment><comment><USER70> Hotz started an AI company and the autopilot system was a relevant application but not the core product or mission.

</comment><comment><USER71> "The difference is shipability."

</comment><comment><USER72> Not everything we do is a success, and there are many reasons for our failures when they happen. The trick is to lick your wounds, learn from your mistakes and get back on the horse as soon as you're able to.

I hope George learns all the lessons he needs from this to make whatever happens next a success.

</comment><comment><USER73> Why does the document from the NHTSA look like a court order..formatted like something you would receive when getting sued, etc? Is this standard format to request that questions be answered?

It looks more intimidating and scary than a friendly "hey, we want info about your product".

<comment><USER32> That's to make sure you understand that if you ignore the document there will be consequences.

</comment></comment><comment><USER74> Reading the letter seemed somewhat tame until the end - fined $21k/day for noncompliance. Ouch.

<comment><USER75> It's not really out of the ordinary. The fines provide an actual known incentive to actually respond and not brush the letter off.

</comment></comment><comment><USER44> In the discussion on Jalopnik (a fairly large auto-enthusiast site), someone mentioned that Alex Roy had a good experience riding in a comma one-equipped car ([https://twitter.com/AlexRoy144/status/791996855114694657](https://twitter.com/AlexRoy144/status/791996855114694657)).

I thought this was an interesting perspective - Alex Roy is famous in car enthusiast circles for his driving records over the past 30 years. He's set speed records with drives across the US and around Manhattan, and has set electric/semi-autonomous records in a Tesla Model S in August 2016.

The point being that Alex Roy has probably spent more time thinking about driving, planning trips, and understanding traffic rules than most other people alive today. His perspective is just a single perspective, but given his massive experience with car-driver systems I think it's an interesting perspective.

</comment><comment><USER76> The commenters on that twitter thread are critical of geohot for "rolling over easily".

I don't think we should presume that the guy who defied Sony, AT&T, Apple, and the DCMA is doing any such thing.

Maybe he discovered a flaw in the design of comma AI or something.

<comment><USER21> Then maybe he should have said so. Criticizing him based on his own description of why it's canceled is entirely reasonable. He got a letter from the NHTSA and immediately said he was done because he didn't want to deal with it. He's either rolling over for them or he's lying about his motivations, either way it's not good.

<comment><USER77> Well, it is not really cancelled. He's moving to China.

<comment><USER21> He said "The comma one is cancelled." I interpret the followup as being that they're doing other products _and_ doing those other products in other markets. Maybe he just meant they'll do it in China instead, but I can only go off what he says here.

</comment></comment></comment></comment><comment><USER78> It's weird that he would give up on his product after one letter, specially when money is not an issue. Perhaps he already has a buyer for the tech and just wants to move on to something else.

</comment><comment><USER79> Funny that Tesla doesn't even sell "Autopilot" anymore, as it was an off-the- shelf 3rd-party solution, but the reference persists. Talk about the power of marketing and branding.

</comment><comment><USER80> Was this just a face-saving way to end the project, or did he really shut down a viable project that he wanted to continue over a simple request for information by a regulator?

</comment><comment><USER81> Rule number 1. Don't piss off investors. This won't bode well for Comma or the investors. Really bad PR move.

</comment><comment><USER82> Best way to get some more press and attention? Hype a project and then claim to cancel it.

</comment><comment><USER83> May I remind everyone we don't know the full details behind what's going on!

</comment><comment><USER84> doubt he actually cancels it and changes his mind next week, this was more spur of the moment and his investors calmed him down?, way too much attention being brought to it

</comment><comment><USER85> It appears Hotz will now deploy his system in China, where the regulations on such devices are surely more lax. Looks like a good move for extended testing without pesky government scrutiny.

<comment><USER32> If it doesn't work the US might be a better place to mess up than China.

<comment><USER43> I was thinking the same thing...sure there are fewer regulations, but "death penalty" is not outside the realm of possibility for fucking this up in China.

</comment></comment></comment><comment><USER86> Must be a great morale boost for the employees.

</comment><comment><USER87> Thank goodness. It sounds like his grand scheme crumbled under a little scrutiny from a consumer safety organization. We don't need another theranos.

</comment><comment><USER88> Maybe it's a piece of crap and not worth the lawyers

<comment><USER89> This is the most likely explanation to me

</comment></comment><comment><USER90> That reminds me of my old comment about this

[https://news.ycombinator.com/item?id=12492856](https://news.ycombinator.com/item?id=12492856)

I'm really not overly negative about new things but this was predictable.

</comment><comment><USER91> YC should take note, as a bunch of recent investments outside of pure software will likely end up in the same problem space.

nuclear energy, supersonic planes, etc. - applying the "disruption" and "agile" method does not work everywhere, to put it mildly.

</comment><comment><USER92> Good. It seems exceedingly unlikely that this is a road-ready technology, and we don't need yet another software-brained megalomaniac releasing an insufficiently-developed, unproven product into the physical world, where "bugs" will actually just straight kill you.

</comment><comment><USER93> Egohotz is back!

</comment><comment><USER94> Classic government. Self-driving technology should benchmarked against how good people are at driving (and how often they kill and injure people), as opposed to being proven intrinsically safe like a car part.

<comment><USER21> The letter they received from the NHTSA is available here:

[https://electrek.co/2016/10/28/george-hotz-cancels-his- tesla...](https://electrek.co/2016/10/28/george-hotz-cancels-his-tesla- autopilot-like-comma-one-after-request-from-nhtsa/)

It looks to me to be fairly mild and entirely reasonable. To immediately respond to this letter with "fuck it, we're not going to make this product anymore" is bizarre, and not the government's fault.

<comment><USER63> You call an out of the blue threat of $21,000 per day (!) 'fairly mild'?

<comment><USER95> He was probably expecting a letter from the start and knew that time is limited. geohot may not care about laws and ethics, but there is no way he doesn't know about all the possible consequences he may face in a project like comma.ai. He works on something until either the pressure is no longer justifiable or he succeeds (like unlocking the iPhone). Working in this manner gives him a great advantage.

I also think it's likely that he never actually intended it to become a real product and it's all about the journey and experience.</comment></comment></comment></comment>


Lawsuit filed against GitHub in wake of Capital One data breach - <AUTHOR> https://thehill.com/policy/cybersecurity/455993-lawsuit-filed-against-github-in-wake-of-capital-one-data-breach <comment><USER2> As my lawyer friend said, a good class action is a lawyer's startup. Litigate one good one and you're set for life.

In a case like this, you have to be the first to file so that everyone else gets merged with yours.

It's sort of sad that they were so quick on this but that's why.

</comment><comment><USER3> Is the allegation that Github was just supposed to know about this? I am sure it's plenty busy trying to keep up with reports, less proactively seeking out questionable content. What's next, should there be lawsuits against Pastebin sites?

<comment><USER4> (IANAL) Seems to be that yeah, GitHub should have known. I'd recommend going to the complaint[1] and skipping the news article. So, the complaint states[1],

> _This outside individual ("the hacker") posted this Personal Information on > GitHub.com, GitHub's website, which encourages (at least friendly) hacking > and which is publicly available. As a result of GitHub's failure to monitor, > remove, or otherwise recognize and act upon obviously-hacked data that was > displayed, disclosed, and used on and by GitHub and its website, the > Personal Information sat on GitHub.com for nearly three months._

First, I do not like that the lawyers are punning between hacker "a person who uses computers to gain unauthorized access to data" ("the hacker") and hacker "an enthusiastic and skillful computer programmer or user" ("GitHub's website, which encourages […] hacking").

They allege it was the actual data posted:

> _Not surprisingly, therefore, the hacker, a software developer, posted the > breached data on GitHub.com_

This part is interesting:

> _According to the timestamp on the file containing certain Capital One > customers' breached data, the hacker posted the data on GitHub.com on or > about April 21, 2019._

Because AFAIK, GitHub does not display upload times on its website, so I'm curious how the plaintiffs came to this conclusion. IIRC, the times that GitHub displays, e.g., in its listing of files are the times in the _git_ data, which do not necessarily reflect the time the data was first uploaded to GitHub. (E.g., compare that a commit has a commit timestamp, but you can commit, wait 2 days, and then upload the commit to GitHub.)

> _Nevertheless, Capital One did not even begin to investigate the data breach > until or around July 17, 2019, when it received an email apparently from a > GitHub.com user alerting Capital One that there "appear[ed] to be some > leaked" customer data publicly available on GitHub.com._

> _GitHub, meanwhile, never alerted any victims that their highly sensitive > Personal Information—including Social Security numbers—was displayed on its > site, GitHub.com. Nor did GitHub timely remove the obviously hacked data. > Instead, the hacked data was available on GitHub.com for three months._

> _22\. GitHub apparently did not even suspend the hacker's GitHub account or > access to the site, even though it knew or should have known that the hacker > had breached GitHub's own Terms of Service, which state that: "GitHub has > the right to suspend or terminate [a user's] access to all or any part of > the [GitHub.com] Website at any time, with or without cause, with or without > notice, effective immediately."_

It seems likely that GitHub wasn't aware. Nowhere in the complaint do I see where GitHub is made aware of this issue prior to it being public.

This part is interesting:

> _28\. GitHub had an obligation, under California law, to keep off (or to > remove from) its site Social Security numbers and other Personal > Information._

> _29\. Further, pursuant to established industry standards, GitHub had an > obligation to keep off (or to remove from) its site Social Security numbers > and other Personal Information._

I don't know if "established industry standards" holds up in court, but the 28 there is interesting. Lawyers writing this complaint, y u no cite what _part_ of CA law? CA's law is actually really easy to browse/lookup if you know what code and what section you're looking for.

[1]: [https://www.dropbox.com/s/cjdflk7rh4z8ery/TZ_GitHub_CapitalO...](https://www.dropbox.com/s/cjdflk7rh4z8ery/TZ_GitHub_CapitalOne_FINAL_Complaint_8_1_19.pdf?dl=0)

<comment><USER5> If the 'established industry standards' were real, they would hold up in court. Software has no established industry standards. This has been an issue in many court cases. There are many "standards" but none of them are official which results in any claims of negligence when it comes to software, no matter how egregious the behavior was, failing. We saw this with the Toyota 'unintended acceleration' scandal. The court acknowledged that out of 90+ automotive industry 'recommended' and 'suggested' coding practices, Toyota's code only followed 4. They acknowledged that Toyota let software engineers play no role in deciding scheduling. They acknowledged that Toyota software engineers did not have static analysis and other tools, or even a bug tracker. But, the court had to find them not guilty of criminal negligence because there simply aren't any legal standards or regulations which they could be said to be negligent of.

If you were building a bridge and you hired unqualified engineers, deprived them of tools they needed, ignored them when it came time to determine scheduling, didn't follow established regulations and standards, etc, the companies executives would be prosecuted for criminal negligence and be sent to prison. If software is involved, however, the situation couldn't be more different. It's an issue that has been debated for well over a decade in the ACM at least. Companies don't want to have to pay more for talent, and most software engineers don't want to raise the barrier to entry. The real danger is that if the software industry waits too long to establish some way of handling these issues, some public tragedy will inspire a kneejerk government response that results in a suffocating set of standards that makes everyone unhappy.

<comment><USER6> How is a Toyota car not "automotive engineering", regardless of whether the flaw was hardware or software?

</comment></comment></comment></comment><comment><USER7> Why not sue Cisco for transiting the stolen data on routers they made?

<comment><USER8> Don't give the MPAA / RIAA any ideas ...

</comment></comment><comment><USER9> I believe this is covered by Section 230. Would expect to see this thrown out, but law is crazy so who knows.

[https://en.wikipedia.org/wiki/Section_230_of_the_Communicati...](https://en.wikipedia.org/wiki/Section_230_of_the_Communications_Decency_Act)

</comment><comment><USER10> This is incredible: they're suggesting that, in the same way that YouTube has content moderators, GitHub should moderate every repository that has a 9-digit sequence. They also say that GitHub "promotes hacking" without any nuance regarding modern usage of the word, and they claim that GitHub had a "duty" to put processes in place to monitor submitted content, and that by not having such processes they were in violation of their own terms of service.

I hope that this gets thrown out. If not, it could have severe consequences for any site hosting user-generated content.

<comment><USER11> Reminds me of the time our security team tried to add a hook preventing any high-entropy strings from being pushed to git. It lasted half a day, since they forgot about public keys, UUIDs, hex codes...

<comment><USER12> I've added a few hooks to try to improve code quality over the years. I can't imagine doing that without first running it over the whole repo to make sure it wasn't flagging good code and cleaning up any legitimate bad code that was caught.

<comment><USER11> Our code quality checks run as a CI make target instead of a hook. We then have our repo set up to disallow direct push- everything has to go through a PR and therefore CI.

<comment><USER12> Either way, it's important to validate the checks on existing code before making them a blocker.

<comment><USER11> Yes, which is why I like the make target method. You can make the target apply to new files exclusively at first, then incrementally add old files as they are touched in the course of normal work.

</comment></comment></comment></comment></comment></comment><comment><USER13> I hope I can claim another $10,000,000/500,000,000 = jack shit from my PII being released again!

</comment><comment><USER14> Frivolous. Throw it out.

</comment><comment><USER15> Most websites and their owners on the internet are broke.

Github is flush with cash ( relatively speaking ).

Makes sense why they would go after them ( Microsoft ) , not that it will stick.

<comment><USER16> They learned from the Steve Dallas example of suing Nikolta Camera:

[https://www.gocomics.com/bloomcounty/1986/06/22/](https://www.gocomics.com/bloomcounty/1986/06/22/)

</comment></comment><comment><USER17> But Why to sue Amazon?</comment>


Looking at the original Apollo 12 code listing (and the 1202 fix) - <AUTHOR> https://www.youtube.com/watch?v=-y37tXoBDx0 <comment><USER2> the docking procedure involves the subroutines KISSING and SMOOCH</comment>


Making Use of HTML5 Storage - <AUTHOR> http://www.developerdrive.com/2012/03/making-use-of-html5-storage/ <comment><USER2> I really like using HTML5 Storage since it's so easy to implement.

There's one thing you forgot to mention. You can also add arrays and objects to HTML5 Storage using JSON.parse and JSON.stingify as listed below.

var testObject = { 'one': 1, 'two': 2, 'three': 3 };

// Put the object into storage localStorage.setItem('testObject', JSON.stringify(testObject));

// Retrieve the object from storage var retrievedObject = localStorage.getItem('testObject');

console.log('retrievedObject: ', JSON.parse(retrievedObject));

I literally got this from stackoverflow ([http://stackoverflow.com/questions/2010892/storing- objects-i...](http://stackoverflow.com/questions/2010892/storing-objects-in- html5-localstorage))

Coincidentally I was building a small javascript bookmarklet for myself this weekend using localStorage. The bookmarklet allows you to make playlists on the fly. Check it out on <http://www.jefvlamings.com/projects/Youtube/>

</comment><comment><USER3> This is a good start, but I would like to see more real world experience on 1) How will this benefit w.r.t replacing or using alongside Sessions (HttpSession in java for example) 2) Size limits - 5mb and 1mb for IE7, storages different per scheme/domains 3) Data Security

<comment><USER4> The size limits are more complicated, because strings get stored as utf16, so that 5 mb is a lot less in practice. Also, on ie7, you have to fall back to userData whose capacity depends on the security zone your app runs in, and can get as low as 64 kb.

I use it to replace cookies for storing settings that don't need to get sent to the server on every request. The collapsed state of a sidebar for example.</comment></comment>


Making a JIT interpreter with LuaJIT - <AUTHOR> http://rjpower.org/wordpress/making-a-jit-with-luajit/

<comment><USER2> Very cool article.

> Still, it's somewhat surprising how easy it was to generate our 'JIT' > interpreter — the code isn't much bigger then the original version. Perhaps > with some more scaffolding/helper libraries, this could be a viable way to > create fast interpreters for new languages?

This is one of the many things that Terra excels at and is intended for: [http://terralang.org/](http://terralang.org/) I'm personally using it for dynarecing code in emulators now; works great.

</comment><comment><USER3> So in short, this is basically a specialized transpiler (transpiling your bytecodes into high level Lua code) + a call to eval to evaluate the transpiled code using LuaJIT's JIT facility.

This seems like a fairly useful technique, provided the given bytecode file isn't terribly big (since you're uh...converting it into string representation), and that the bytecode isn't some run-once-throw-away code, otherwise you spend more time converting it into Lua code and JIT-ing it.

Having said that, I wonder if it'd be even less of a hassle by skipping the bytecode part. Just transpile the source written in your custom language straight into Lua code, and have that code JIT'ed instead. Many high level structures/information would be preserved, allowing JIT to do an even better job perhaps?

<comment><USER4> Yes; this could potentially be slow. If for example, you had an application that just had straight line code (no loops), and you were running it from the command line a million times you would end up hurting from this approach. Generating LuaJIT bytecode instead of source code would (I think) make this less of an issue.

In this case, the bytecode is what you start with :)

Going straight from a parse tree to Lua could work, but locks you into the possibly slow code-generation approach. Having an intermediate level (high level bytecode, or even an interpreter over the AST) would be more flexible -- you could choose when to switch over the compiled version.</comment></comment>


Show HN: I created voice comments for Facebook. - <AUTHOR> https://chrome.google.com/webstore/detail/talk-and-comment/djnhkfljnimcpelfndpcjcgngmefaobl

<comment><USER2> Relevant: [http://xkcd.com/481/](http://xkcd.com/481/)

<comment><AUTHOR> Explains why I didn't make it possible for users to play their comments before posting !! Hearing your voice is the weirdest thing that could happen to you :)

</comment></comment><comment><USER3> what'd you use for recorderWorker.js?

<comment><AUTHOR> I'm writing a blog post about it to detail what goes behind the scenes. But globally, an HTML5 audio recorder & MP3 front-end converter (emscripten + LAME + inspired from RecorderJS).

</comment></comment><comment><USER4> Tried it and it's awesome , I'm sure this one will get viral in no time

<comment><AUTHOR> Thanks. Hopefully it will :)</comment></comment>


Show HN: I wrote a simple simulation of the economy to show how money is created - <AUTHOR> http://nbviewer.jupyter.org/github/chewxy/economy-sim/blob/master/How%20To%20Make%20Money.ipynb <comment><AUTHOR> Here's the write up: [http://blog.chewxy.com/2016/09/30/how-to-make- money/](http://blog.chewxy.com/2016/09/30/how-to-make-money/)

Here're the slides: [https://speakerdeck.com/chewxy/how-to-make-money-how- money-i...](https://speakerdeck.com/chewxy/how-to-make-money-how-money-is- created-in-the-economy)

Here's a version of the same iPython Notebook that you can play with (choose Python3 kernel): [http://mybinder.org/repo/chewxy/economy- sim](http://mybinder.org/repo/chewxy/economy-sim)

the titles were a bit click-baity but that's mainly because we had competing meetup groups for the night.

</comment><comment><USER2> "Money is abstract" is a common misconception normal people make about money. This guy has gone from this to the idea that money is a concrete good, then back to "money is abstract", as he became more acquainted with modern economic theory -- which is, of course, a crazy delirium.

<comment><AUTHOR> Hm. perhaps I was unclear. Money is abstract in the same way voltage and current and frequency are abstract - you can't touch or grab a Hertz.

In the same way voltage, current and frequency have units of measurements (volt, amp and hertz), money has varying units of measurements too (American Dollars, and over here in Oz we have our own Dollaridoo)

<comment><USER2> That's exactly the point. A hertz is abstract, a dollar is not. A gold coin wasn't. Just like an apple is not abstract, money isn't also.

(Unless you're talking about the general concept of "money", which is of course abstract, but the general concept of "apple" is abstract also.)</comment></comment></comment>


Moneyness: Sweden and peak cash - <AUTHOR> http://jpkoning.blogspot.com/2015/02/sweden-and-peak-cash.html <comment><USER2> Umm... I thought one of the biggest shockers to expats living in Japan was the huge reliance on cash, even for big purchases. The chart here says otherwise.</comment>


A geriatric assault on Italy's bloggers - <AUTHOR> http://technology.timesonline.co.uk/tol/news/tech_and_web/the_web/article2732802.ece <comment><USER2> This is almost as embarrassing as Kansas mandating that creationism be taught in biology classes.

</comment><comment><USER3> That's from last October. I don't think it was actually passed.</comment>