Bank of America Telephone Access Security Hole - <AUTHOR> https://www.privateinternetaccess.com/blog/2012/11/even-a-vpn-service-cant-protect-your-privacy-if-youre-using-bank-of-america/ <comment><USER3> This is more dangerous than it sounds. As the blog post points out you can only get account balance and last transactions. Here's what's really dangerous: the last transactions.

Say you have one more piece of information: account # and routing #. This can be obtained from any check the person has written. Now you can link their account to your account from your bank's website. Your bank will make some small deposits into their account that you will have to verify. Now you use the security hole discussed in this post and you can find out what the amount of those small deposits was. You have now successfully linked their account to your account and you can withdraw their entire account balance into your account from your bank's website.

Now go to your local bank branch and withdraw your entire account in cash and walk away. So yes, this security hole is bad.

<comment><USER4> ...and then prepare for the FBI to show up at your door. You can't open a bank account without producing several pieces of ID bearing you current address. Not discounting the apparent stupidity of BofA relying on caller ID for auhthentication, but it's not quite that easy. Moving money from one account to another leaves a trail.

Still a really bad situation though.

<comment><USER5> Current address can change. The only reason my bank knows my current address is because I've repeatedly informed them, and it took about half a year and some effort from my side to have them update _all_ accounts and records with the correct address. So the FBI has a good chance of scaring some innocent men living in a rental apartment that was used by some bad guy two years ago. In one place I lived, I regularly got payment demands from various credit companies to the name of somebody that (I suspect) lived there 2 years ago at least (I knew who lived there before me, and that wasn't the bad credit person). So address doesn't give much.

</comment></comment></comment><comment><USER6> The responsible thing to do in this situation is to keep escalating at the bank until somebody listens. "Bank of America supervisor" implies a manager at a call centre. A few more escalations and you reach some pretty senior people with actual authority to change things.

A zero-day involving actual dollars (BoA) is a lot different than a zero-day involving email addresses (AT&T, recently). If this exploit makes withdrawals possible, and it sounds like it does, then you're making it easy to seriously mess up someone's life before it's fixed.

<comment><USER7> This is a feature...

This is basically a lookup which authenticates users based on caller ID (the password is the ssn). This is the same as when your carrier changed your voicemail password to be your phone number (and self-authenticate on inbound calls).

The problem everyone is looking at effects 100% of customers but the bank (mistakenly) believes the barriers to entry are high.

The important takeaway is this: You cannot have a secure service that is authenticated with a phone number.

Phone numbers have been, and will continue to be, an invalid source of identity. In fact, considering a phone number as a signaling agent in a Web of Trust is a terrible decision to make. Time and again we hear of these exploits which wouldn't happen without terrible assumptions.

PSA: YOUR PHONE NUMBER IS SPOOFABLE; IT TAKES 10 SECONDS. DO NOT BUILD SYSTEMS THAT TRUST YOUR PHONE NUMBER AS IDENTITY.

<comment> brown9-2 I am no expert but I think the problem is assuming that the caller ID of the incoming call to the bank is authentic.

I'm curious if you could break a similar system that assumed that receipt of an _outgoing_ call made to the customer's phone number was validation of identity.

<comment><USER8> Outbound call to a number is harder to break. One way is to port the number to another provider, illegally. If you have the person's information and bill, you probably have enough info to get the line transferred. And sometimes, providers will accidentally/idiotically allow a number to be ported even if the information isn't correct; there's plenty of room for mistakes.

Another attack is to target the way they place the outbound call. Suppose they place the outbound call with provider X. An attacker might sign up and start a port via provider X. If provider X has poor code, they might activate the number internally, and route all their customers calls to your account, before they find out the port's been rejected. Or you might be able to compromise the provider another way - many providers and VoIP software systems are hilariously weak on security.

The first attack will work across the entire phone network; the second requires the authentication call to be made via an insecure provider.

<comment><USER7> Right but you're talking about owning the DID, which one may or may not need to do in order to compromise your connection. For example, if I pwn the Asterisk box your call routing runs through, I can mirror the audio or redirect the audio pretty trivially.

Going a step further, given how few people aren't buying through a reseller, it's possible to pwn an upstream provider and impact boxes through a man in the middle attack. Even over TDM you're not safe because of physical taps which are difficult to detect (albeit easier than IP).

No, Phone numbers are not secure and should never be used as a form of authentication. You don't even need to port a number, you just need to be somewhere in the stream.

<comment><USER8> I think there's a significant scope difference in performing a MiTM attack (via hacking a provider or installing a tap) and forcing a port through.

After all, it's implicit in telephone banking when you authenticate via voice that you trust the connection. The argument you're making is that telephony is insecure, which is arguably true, but sorta irrelevant within the scope of telephone banking.

<comment><USER7> How is it irrelevant? Is it not the crux of the issue here?

Many upstream providers are just Asterisk boxes forwarding traffic. Those boxes can be overloaded with a malformed SIP header; hell, most application switches get wrecked by malformed headers.

What I'm trying to say is that money is one of those things where security is actually important. Trusting telephony, even as a signal and not source, is foolish. There are many better methods of deriving identity.

My point, and arguably the point of the article, is that telephony is insecure, and I think it's pretty far from irrelevant... Please correct me if I misunderstood, I'm not trying to offend I just don't understand.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> So if this was on a website instead of via phone the authors would presumably be facing criminal charges or years in prison, right?

<comment><USER10> Well, they used a proxy to log into their own account, so probably not. Had they tried to demonstrate this using someone else's SSN, then yup - lock 'em up!

</comment></comment><comment><USER11> Hate to pile on but security & boa don't go together too well [http://www.gosecureauth.com/blog/easily-bypass-bank-of- ameri...](http://www.gosecureauth.com/blog/easily-bypass-bank-of- america-2-factor-safepass-authentication/)

</comment><comment><USER5> From what I understand, knowing somebody's name, SSN, address and DOB would allow you to impersonate him/her at 90% of places. In 90% of the rest, they'd require some password but if you sound convincing enough and desperate enough and claim you forgot the password, they'd give you some information they're not supposed to in exchange for the pieces from above. SSN especially is treated like it's super-secret even though practically everybody asks you for it - banks, employers, car dealers, credit cards, lenders, etc. Government loves to ask DOB for some reason like it's a big secret - even though looking for congrats of anybody's facebook page allows to know DOB for like 90% of people.

In general, this whole system does not collapse only because overwhelming majority of people are honest and don't even think about cheating it. Which I think is good, but still I am a bit scared when I think about how fragile it is.

<comment><USER12> I am both amused and annoyed at now having to enter my US postal ZIP code when using my credit card at some gas stations. If someone stole my wallet, they'd have that information already as it is on my driver's license.

<comment><USER13> Don't use your license address as your billing address.

</comment></comment></comment><comment><USER14> It's not just BofA. I know of at least one other popular bank that uses the last four of one's SSN as the default password. They may also require a DOB, but that's simple enough.

</comment><comment><USER15> First, its not off CID, its off ANI (ANI is what is passed to the remote endpoint when you call a toll free number), not that you cant spoof ANI - <USER2> often it can be a little harder, as its used in billing on the telco side.

Second, every bank does something like this, I can access my credit card by phone with just the last four digits of my account number, and by calling in from my phone. I can do the same thing with my BofA account number in lieu of my SSN.

Third, again, every bank is like this to some extent - every CC I have, if I call in from my number, and key in the last for digits of my credit card, I can get info. I should also point that knowing someones Tel Number, Account Number and/or CC number is a considerable amount of info to have.

<comment><USER16> "Second, every bank does something like this"

I can't tell if your implying that this makes the practice somehow less bad, but I hope not.

"I should also point that knowing someones Tel Number, Account Number and/or CC number is a considerable amount of info to have."

It's a considerable amount of information for a random stranger to have, but _not_ for an attacker.

</comment></comment><comment><USER17> On a related note - can anyone give me perspective on the quality of their VPN service?

<comment><USER18> I use PIA for my VPN and like it very much. Lots of different places to connect to, runs fast enough to do torrents, no complaints here.

</comment></comment><comment><USER19> This is the same sort of exploit used in the "Phone hacking" scandal that News of the World and other newspapers got in trouble for. Except in that case they were hacking voicemail boxes not bank accounts. This is pretty serious and not exactly a novel idea, very surprised that BoA hasn't encountered this problem yet.

</comment><comment><USER20> So the worst case scenario that this maybe non-repeatable process might result in someone: 1) accessing more of your data and 2) maybe perform fraudulent transactions that will be detected and/or reported; investigated; and refunded. Uptown problems.</comment>


Show HN: GPS Tycoon, Android game where you compete to own land on Google maps - <AUTHOR> http://webdever.net/gpstycoon

<comment><USER2> I really like this kind of game, and I congratule you for doing one that seems kinda cool (although too simple), but I will not play, because I don't have an Android device.</comment>


Woman Posts Boyfriend Request on GitHub, Requires Access to His Server - <AUTHOR> http://betabeat.com/2012/10/woman-posts-boyfriend-request-on-github-looking-for-someone-who-maintains-their-own-server/ <comment><USER2> > _"Someone who can tolerate social gaming companies like Zynga..."_

Welp, most of us on HN are out of the running! ;)

But in all seriousness, am I the only one that thinks this is just ridiculous? It would have been funny and one thing had it been a joke, but this just seems crazy to me. Maybe it's because I'm _only_ 23 and I'm not that "desperate". Or maybe it's cause I'm very social and rarely have troubles finding dates or new people to meet, but I just can't imagine ever trying to get an actual date or make a real connection with someone from an absurd _list of demands/requirements_ like this.

Plus, using github in this way just annoys me a bit. There are plenty of free dating sites out there (Okcupid, for example) where you could find mates that meet your "needs" or are compatible with you. Using github like this ( _again, if it was a joke, that would be one thing_ ) just screams "I'm desperate" or "I want attention for using github to find a date." Github has drink-ups and meet-ups if you want to meet other people on there or similar to you, as well!

<comment><USER3> > Maybe it's because I'm only 23 and I'm not that "desperate".

It's because you're not a single Japanese woman living in Japan who's in her 30s. She's likely facing enormous pressure from her family and friends to get married.

In Japan, women's marriageability is often compared to Christmas cake - expired after 25.

<comment><USER4> The social pressure does exist, but the Christmas cake thing died down with the Showa era. Nowadays the average wedding age is closer to 30 than to 25.

<comment><USER5> Her parents probably don't know that.

</comment></comment></comment></comment><comment><USER6> Wow, that's quite a list of demands.

Is this a more common thing with Japanese women, do they go into dating with a very specific set of criteria rather than "winging it" as western women would?

"Someone who plays at most only 1 hour of videogames a day, or at most only 30 minutes of TV."

Most good TV shows are at least an hour long per episode, I assume you have to split them over 2 days.

<comment><USER7> > _"do they go into dating with a very specific set of criteria rather than > "winging it" as western women would?"_

I find many western women are quite specific also, and men too. Treating potential mates as a checklist instead of unique individuals seems to be a global problem.

<comment><USER6> That is true, perhaps it is more an issue of how it is articulated.

When I look at female profiles on dating websites, I see western women say vague things like "I want a caring guy with a good sense of humour who knows how to treat a lady".

Whereas from asian women I see things more like "Between ages X and Y , minimum salary Z , must enjoy A, B and C".

I'm sure some western women have similar requirements but perhaps it is just more taboo to articulate them.

Some of the stuff on here seems very specific though, but I guess some of it must be somewhat tongue in cheek.

<comment><USER7> Ah yes, it really is a difference in articulation. I also don't see westerners expressing their "requirements" quite so bluntly, though from private conversations these lists certainly do exist, and are every bit as ridiculous.

</comment></comment></comment></comment><comment><USER8> First time I saw this, I actually thought this was a repost of the gay guy on github who had a list of requirements for a boyfriend so I didn't read it.

Normally women keep this sort of list as a secret hidden agenda which we're meant to guess. Nice to see some transparency. ;-)

<comment><USER9> Another positive for open source I'd say!

</comment></comment><comment><USER10> I cant explain why, but this strikes me as quite sad. Not her, really. But the guys that go after her. From the list and her demands I cant imagine a relationship with her would be a happy one. But that is just my opinion tho. (Out of curiosity I counted quickly the requirements I would fulfill : 25, and all her bonus requirements except the access to the server bit. That just screams "paranoid" to me. Why would that be a requirement for a relationship?

<comment><USER11> Most of us have demands for a partner, even if you aren't consciously aware of them. Perhaps not this specific, but who knows? Try writing down the qualities of what your "perfect" mate would be and see what you end up with.

Of course, it's a completely different thing to do that as an exercise for yourself compared to actually publishing it on a social developer site, but to each their own I guess.

<comment><USER10> When I sit down and write out a list of qualities I want in my perfect mate I find that I rarely deal in absolutes. And the absolutes are more of the negative kind like I wouldnt want my new spouse to be doing drugs or anything like that. I think the appropriate way is to apply fuzzy logic to the good attributes and average it out.

The thought that just because the mate watches an hour of tv a day instead of the required half hour she would never be interested is horrible to me. This kind of thinking would reduce the act of dating down to just meeting up for five minutes, filling out questionaires and comparing them.

<comment><USER11> _> This kind of thinking would reduce the act of dating down to just meeting up for five minutes, filling out questionaires and comparing them._

Isn't that the entire idea behind OkCupid? That seems quite successful.

</comment></comment></comment></comment><comment><USER12> Pretentious. Controlling. Possibly obsessive compulsive.

<comment><USER13> Anal retentive came to my mind.

</comment></comment><comment><USER14> Kids, vegetables, no tv and 'social gaming' ? Yeesh.

No sudo for you on Ammonite I'm afraid...

</comment><comment><USER15> Reminds me of the Application to be my Boyfriend from Best of Craigslist (2009)

<http://www.craigslist.org/about/best/vic/1396835868.html>

<comment><USER16> Curious: Did you find a boyfriend in the meantime?

<comment><USER17> I suspect that Andy found it through the aforementioned "Best of Craigslist" and was not the woman looking for a boyfriend.

</comment></comment></comment><comment><USER6> "I don't discriminate based on looks."

It's always hilarious when women say this, are you saying that somebody with severe disfigurations and scars or someone is morbidly obese would not affect the decision at all?

<comment><USER18> Obesity isn't a look, it is a lifestyle-impacting condition.

</comment></comment><comment><USER3> Previous discussion on HN: <http://hackerne.ws/item?id=4629969>

</comment><comment><USER19> For such an incredibly long list of demands... her GitHub profile only listed 4 projects. Very disappointing :p

</comment><comment><USER20> Direct link [https://github.com/norinori2222/boyfriend_require/blob/maste...](https://github.com/norinori2222/boyfriend_require/blob/master/README- en.md)

</comment><comment><USER5> > Someone who will let me help them maintain their own server (Required)

Twitch.

<comment><USER21> Nobody touches my shell scripts!

</comment></comment><comment><USER22> Account norinori2222 on github has no public projects (except for test repos), no commits to any public projects, what is this, a joke?!

</comment><comment><USER23> I'm pretty sure this is sarcasm. Late 30s, undisclosed weight ("? I'd like to lose some") and a wall of demands.</comment>


Fuck it. Why 100% commitment is needed to succeed - <AUTHOR> https://medium.com/@brandon_brown/just-say-fuck-it-why-100-commitment-is-needed-396660bccb3e <comment><USER2> Really? How about all these who succeeded without 100% commitment?</comment>


Show HN: Vulkan bindings for JavaScript - <AUTHOR> https://github.com/maierfelix/node-vulkan <comment><USER2> Is there a benefit of using Vulkan over WebGL?

I would think you can achieve similar speed using WebGL in the browser and then have all the comfortable functionality of the browser for free.

<comment><USER3> This is for Node.js, so it's for desktop app, not web app (it's not possible to use Vulkan on the Web).

For the web, you have no choice but to use WebGL.

<comment><USER4> The future is WebGPU.

If you're interested on why a Vulkan binding for the web is not a good idea, I found this doc (from two engineers working at Google) quite interesting : [https://docs.google.com/document/d/1-lAvR9GXaNJiqUIpm3N2XuGU...](https://docs.google.com/document/d/1-lAvR9GXaNJiqUIpm3N2XuGUWv_JrkpGizDN0bNq7wY/edit#)

<comment><USER3> Thank you for the document !

Definitely, having some form of GPGPU on the web is the next step. It is currently one of my few complaint with WebGL: The lack of compute shader.

<comment><USER5> You can do GPU compute without the OpenGL "compute shader" feature. WebGL 2 has much improved features for it vs WebGL 1.

There are existing GPGPU things running on WebGL, see eg [https://github.com/tensorflow/tfjs-core](https://github.com/tensorflow/tfjs- core) and [https://magenta.tensorflow.org/demos/#web- apps](https://magenta.tensorflow.org/demos/#web-apps)

<comment><USER3> But WebGL compute shader are under an extension which, as far as I know, doesn't have much support yet :/

</comment></comment></comment></comment></comment></comment><comment><USER6> Pretty cool!

</comment><comment><USER7> What is the point of using a low overhead graphics API like Vulkan if you're just gonna crush performance with JavaScript?

<comment><USER8> The performance critical aspects of an app shouldn't need to run on the topmost abstraction layer.

JavaScript should tell the CPU what to do, not how to do it.

Edit: If there are CPU intensive tasks that also need to be customized for a particular app we should perhaps have some way to define those tasks in a way that gives you as developer more control of performance characteristics. I guess this is one of the intentions behind WebAssembly?</comment></comment>


Google's Goma client is now open source - <AUTHOR> https://groups.google.com/a/chromium.org/forum/#!searchin/chromium-dev/goma/chromium-dev/q7hSGr_JNzg/p44IkGhDDgA <comment><AUTHOR> "Goma is a distributed compiler service for open-source project such as Chromium and Android. It's some kind of replacement of distcc+ccache."

[https://chromium.googlesource.com/infra/goma/client/](https://chromium.googlesource.com/infra/goma/client/)

I know that Opera at least, had been using icecream ([https://github.com/icecc/icecream](https://github.com/icecc/icecream)) internally to do distributed builds, and occasionally the main repo would make a modification to the build system that would break it. One time this actually resulted in the discovery of a bug in the llvm project ([https://bugs.chromium.org/p/chromium/issues/detail?id=778209](https://bugs.chromium.org/p/chromium/issues/detail?id=778209)). Hopefully external teams that are building chromium will have this pain point alleviated. :)</comment>


How accurate is Domino's Real-Time tracker? - <AUTHOR> https://melmagazine.com/en-us/story/i-staked-out-my-local-dominos-to-see-just-how-accurate-its-pizza-tracker-is <comment><USER2> This was a fun read, but my guess is you could accomplish the same outcome (finding out it has nothing to do with the preparation process) merely by offering someone at Domino's a $20 bill to spill the details.</comment>


Ratio: The Simple Codes Behind the Craft of Everyday Cooking - <AUTHOR> http://blog.ruhlman.com/ruhlmancom/2009/04/ratio-the-simpl.html

<comment><USER2> Well I take his point that expressing quantities in ratios may make more sense that absolute values. But aside from baking (and in particular anything involving yeast), cooking is not very sensitive to quantity variations. For people that cook a lot, these things come easy after a while, and for people that don't, they will have to follow a recipe anyway.

I remember when I first taught myself to cook obsessing about what constituted "a medium onion". Medium compared to what? Others in the bag? Others in the store? How I am i supposed to know what the smallest or largest onions in the world look like, so that I could figure out whether my onion was the golden medium?

After a while, I learned that I can have a 50% error in the size of the onion and the food will still be edible. If it's an onion, it will do, much as the OCD geek is screaming "looks a bit small for a medium onion" inside my head.

<comment><USER3> I think you're simultaneously missing and proving Ruhlman's point. Take anything you know how to make; say, bread. Start subtracting out ingredients: the carmelized medium onion, the herbs, the olive oil. Get to salt, water, flour, and a little yeast; take any of these out, and it's not bread anymore.

Now take your bread "kernel" and look at the ratio between the ingredients. Go read a bunch of (reputable) bread recipes. You'll find that most reputable bread recipes will be some variation on that core ratio, just like both Linux and FreeBSD have a VFS layer and a system call table.

I'm halfway through the book (I'm a fan of Ruhlman's; "Charcuterie" sort of changed my life) and while the ability to generate recipes on the fly is a win, I agree with you that it's not revolutionary. But being able to eyeball any other recipe and see what kernel it's built on (or, if it's a crap recipe, if it's built on any sane ratio at all) is a huge win.

<comment><USER2> I bow to your judgement since you have actually read the book. I was more reacting to the "Eureka!" tone of the OP (you know, ten long years I have been toiling on this insight etc).

I am certainly intrigued to know how a book about smoking meat changed your life though!

<comment><USER3> Smoking isn't the half of it. Where before I ate duck, I now eat duck cured for 2 days with cloves, cooked sous-vide in its own rendered fat for 7 hours at 73C, and then stored for 3 weeks. Learning how sausage works, how curing works, and how preserving works is every bit as big of a deal as learning how to make a pan sauce from a fond. Can't recommend that book enough. I'm trying to source a half pig from a local farm; when I do, I'm going to work my way through the book start to finish, blogging it like the Alinea Cookbook blogger did.

Sous-vide, something else you don't want to get me started on; amazed that nobody here has picked that topic up. It's fucking amazing. I can't see how there isn't 11 billion dollars to be made with it somehow.

</comment></comment></comment></comment><comment><USER4> If I've understood this article correctly, the book can be summarized as: _Feel free to multiply all the numbers in a recipe by a real number greater than zero. Tolerances on measurements are loose._

Are people really so afraid of math that this comes as a startling revelation?

<comment><USER3> No, you've missed the point of the book. It's not that you can scale recipes. It's that behind almost every recipe there's a very simple ratio; when you know the ratio and the technique to apply it, you can generate many other recipes yourself. Think of it as a compression scheme.

</comment></comment><comment><USER5> It also feels like patterns, little building blocks to build bigger things. Thats whats compelling me to buy it, its not just technique or recipes, its knowledge you can use to expand on. Also, his blog is great.</comment>


Some books with crunchy code - <AUTHOR> http://abecedarius.tumblr.com/post/71370089924/some-books-with-crunchy-code <comment><USER2> Very nice list. I have read maybe 30% of the books listed, and I agree, they do contain great and subtle insights. Definitely books that I like to pick up again and again. I'd add those 2 to the list: (i) "Programming on Purpose: Essays on Software Design" by P.J. Plauger, and (ii) the two "Programming Pearls"/"More Programming Pearls" by Jon Bentley.</comment>


A Chess Program in PL/I - <AUTHOR> https://github.com/SonarSource/sonar-examples/blob/master/projects/languages/pli/src/chess.pli

<comment><USER2> I had different version of a chess program back in the 80's when I was teaching PL/I. It is a good example of doing something complex (chess) fairly simply in code. This version looks pretty clean, maybe because of the Fortran root.

I'm going to guess that the 5000 / -7500 is an error in the translation, a typo. If I find an hour to kill I may compile it up with -5000 to see what it does.

</comment><comment><USER3> Why is the white king represented by 5000 but the black king by -7500? All the other white and black pieces have the same absolute value.

(This really brought back memories. I haven't written a PL/I program since 1978.)

</comment><comment><AUTHOR> Relatively short -- the Fortran version is 500 lines.</comment>


Tech giants to enable IPv6 on "World IPv6 Day" in June - <AUTHOR> http://arstechnica.com/tech-policy/news/2011/02/tech-giants-to-enable-ipv6-on-world-ipv6-day-in-june.ars

<comment><USER2> > _Web giants Facebook, Yahoo, and Google, with a combined one billion > visitors per day, are participating by enabling IPv6 for their main services > that day. … unlike during the IETF IPv6 experiment, IPv4 won't be turned > off._

Why don't they turn it on sooner?

<comment><AUTHOR> At their scale the slightest percentage of users having broken IPv6 implementations means millions of users cut off form their service.</comment></comment>


Ask HN: Am I the only one having problems with SparkFun's website? - <AUTHOR>

I am sure they are slammed, but just to make sure it's not me....was wondering if other HNers are having problems adding stuff to the cart and checking out? <comment><AUTHOR> I know...i emailed them and by the time my email got to them, the reply I got was "freeday ended 2 minutes ago".

How convenient.

</comment><comment><USER2> I had my cart full a couple of days ago and was sitting on a checkout page and never got through.

</comment><comment><USER3> Check their IRC. The free day offer meant about 3000+ ppl are trying to place orders at once :)</comment>


SolarCity Files for IPO, Aims to Raise About $200 Million - <AUTHOR> http://www.treehugger.com/renewable-energy/solarcity-files-ipo-aims-raise-about-200-million.html

<comment><USER2> Anyone know what they plan / state they'll use the money for?</comment>


Gambler hits $1.4M jackpot, casino says bingo machine "malfunctioned - <AUTHOR> https://arstechnica.com/tech-policy/2017/10/1-4-million-jackpot-is-voided-because-bingo-machine-malfunctioned/ <comment><USER2> So the gambler brought the case to the tribal court of the Poarch Band of Creek Indians where it was dismissed, then took it to the Alabama state court system.

It looks like the Alambama Supreme Court ruled it had no jurisdiction over the case [1].

Some interesting allegations:

 _Rape alleged that at that point he was approached and congratulated by casino employees and patrons and that one casino employee said to him: "[D]on 't let them cheat you out of it."1 Rape alleged that the machine printed out a ticket containing the winning amount of $1,377,015.30 but that representatives of Wind Creek Casino took possession of the ticket and refused to return it to him. Rape was then taken by tribal officials or casino employees into "a back room," where they discussed how Rape's winnings would be paid, mentioning the possibility of a structured payout over a period of 20 to 30 years. Those officials then instructed Rape that he had to wait outside the room while they "called PCI" to confirm his winnings._

I checked several sources in addition to the Ars article, and it's interesting that nobody is reporting what the max payout on the machine was. Although without jurisdiction I suppose that doesn't really matter wrt the court case.

[1] [http://caselaw.findlaw.com/al-supreme- court/1875570.html](http://caselaw.findlaw.com/al-supreme-court/1875570.html)

</comment><comment><USER3> Back when I dabbled in bitcoin, one of the coolest things to me was the cryptographically verifiable casinos. To explain simply, the hash of each day's seeds were published the day before, and the actual seeds posted the day after. So you could verify that your wins and losses were legit.

This could be applied to casinos, but it would take legislation to require it. I doubt any casino, especially the ones in sovereign Native American lands would voluntarily adopt such a system.

<comment><USER4> Or using Ethereum-style smart contracts you can go one step further, and have the casino be implemented by a public program on the blockchain. That way, it's not only verifiable after the fact if the payout was correctly handled or not, you can verify before you play that it will be, and there is no way for the casino to not pay if you win.

<comment><USER5> Yep. Look into Funfair ([https://funfair.io](https://funfair.io))

</comment></comment></comment><comment><USER6> Those machine have a disclaimer posted, saying malfunction will void payout. If they have big latitude on what they consider "malfunction" it sounds like a big scam and we all should stop patronizing them.

<comment><USER7> The casino prohibition against "counting cards" in blackjack works the same way. How does one not notice and unconsciously count the cards played face up in a card game, then later on act on hunches coming from the back of our minds? "Counting cards" is a vague definition that enables the casino to void any customer's winnings at a blackjack table.

<comment><USER8> Where it gets even more vague is that they _do_ want card counters, just not the ones who are good at it.

Shuffle with replacement between every round will eliminate card counting.

<comment><USER7> Card shuffling and deck replacements take time, and time is money in a casino. Keeping an eye out for card counters and sharing blacklists with other casinos is cheaper than slowing down the operation of all their blackjack tables.

</comment></comment></comment></comment><comment><USER9> Somewhat off-topic, but this man Jerry Rape has a very unfortunate last name. If I had a last name like that, I'd have been looking to get it legally changed the day I turned 18.

I mean, c'mon...imagine if he wanted to become a school teacher and children had to refer to him as "Mr. Rape".

<comment><USER10> I don't know what nationality that name is from but it might not be pronounced the same as the horrible act you're thinking of. English may also be a second language in which case he may not be familiar with the negative association.

</comment></comment><comment><USER11> I'm pretty sure most tribal casinos have their machines "malfunction" in order to not pay out millions to the winner. It is easier to bring the winner into a tribal "court" battle (which will then be dismissed) versus just paying the winner. It's a sleazy tactic that shouldn't be allowed but it isn't an issue most people would want to get into.

</comment><comment><USER12> Absolutely disgusting.

But why does the Alabama court say that this is the end of the line? Why can't this go to SCOTUS?

<comment><USER13> The Alabama Court didn't say it was the end of the line, just thst, whether or not sovereign immunity applied, Alabama courts had no jurisdiction to address the case, because Alabama law would deny the plaintiff any basis for recovery since gambling is illegal.

</comment></comment><comment><USER14> This is the same BS that Indian Tribes are using to hold patents and fight IP lawsuits.... Come on!

</comment><comment><USER15> Is there more to that side of the story, like the machine having a maximum payout?

The sovereign immunity thing isn't the real story, I've seen New Jersey state use circular legal logic to prevent casinos from losing.

</comment><comment><USER16> I experienced this with a Trivial Pursuit quiz game in London. Three times I was doing well and it rebooted.

Is this standard practice in betting to avoid a payout?

<comment><USER17> Those touch screen quizzes in pubs have a pretty low maximum payout anyway, and are known to be progressive (they have a memory of their payout history and a bank of practically impossible questions to ensure they pay out the right amount). I suspect it was just not ventilated correctly.

</comment></comment><comment><USER18> If they are sovereign and cannot be sued, I'd imagine there should be a border and customs union controls, and complex and details trade agreements?

<comment><USER13> US States also have sovereign immunity, without any of those things.

<comment><USER18> If this incident happened in a state Casino, there would be a means to sue them.

If Tribes are protecting their scams under 'sovereign immunity' then they should lose that immunity.</comment></comment></comment>


Ask HN: What domain knowledge should I learn? - <AUTHOR> I've read numerous times that software engineers who possess domain knowledge usually get much better jobs / hourly rates.
I'm entrepreneur minded and don't care much about better salaries or jobs. However, the corollary is that to do a better startup, one has to possess domain knowledge.
One way to go about building a startup is to identify an opportunity first and then learn the necessary domain knowledge (just in time).
One other way to go about it is to first learn a domain knowledge (just in case) which should then help you identify opportunities that you wouldn't have thought of otherwise. This is the path I'm looking forward to take.
So, what domain knowledge should I learn? What expertise is in demand right now? Which will be in the future? What would you do if you weren't doing what you are right now?
PS: Please, no cliche like "learn whatever you are passionate about" - I've heard it all before. What I'm looking for right now is to step out of my comfort zone (SE). <comment><USER2> _PS: Please, no cliche like "learn whatever you are passionate about" - I've heard it all before. What I'm looking for right now is to step out of my comfort zone (SE)._

Sorry, but that's about the only responsible answer to a question this broad. It's a bit like asking "What book should I read?"

If you can narrow the question down a bit, you'll get a much more appropriate answer.

Gaining "domain knowledge" is key. However, the range of possible domains is next to infinite.

Your success is not going to be dependent upon the quality of the domain, but on the quality of your ability to learn the domain.

So, pick a subject that you are able to learn. Is there some domain where you have a natural advantage of some kind?

<comment><AUTHOR> I'm mostly interested in engineering/science. That's pretty much as narrow as I can get. The point of asking a broad question was to get answers I wouldn't spontaneously come up with. I'm looking for diversity and originality.

<comment><USER2> In that case, explore those realms, and see what opportunities arise.

My career has been successful largely because of my domain knowledge, in a few different domains-- but it's all come about accidentally. I've just kept my eyes open, tried to soak up the things that interest me, and (most importantly), tried to see how I could apply the knowledge in new ways.

Put another way: don't wait for some guy to come up to you at a party and say "Plastics."

</comment></comment></comment><comment><USER3> If I were starting over right now, I would definitely get in on the bioengineering/genetics stuff. The barriers to entry are now very low compared to the last 20 years and they keep getting lower every day.

Imagine if you could hack a new cure or bacteria that changes the world. This field will make the information revolution look like a little girl's tea party.

<comment><AUTHOR> This field looks indeed fascinating. That being said, I wonder how I could go about learning bioengineering by myself. Perhaps I should find an online community and ask them where I should get started.

<comment><USER3> I would start by finding the best online communities of DIYers and read everything you can. If you're near a big city, you can probably find IRL groups to check out. You can do anything alone, but you can accelerate the learning process by collaborating or, better yet, finding a mentor.

You didn't mention your present circumstances, but a good university will help immensely with this type of field. You can also make a lot of contacts if you go to the right school.

With all of that said, I'm not sure how far you can go if you aren't truly interested in it. Just keep trying different things, giving each a respectable amount of effort, and eventually something will strike a chord with you and you'll know what you want to do.

</comment></comment></comment><comment><USER4> Expertise that's in demand now wont necessarily be as hot by the time your learn their ins and outs.

Just a hunch: enterprise software design. Someone has got to navigate all those XML specs.

Also, it's always a good idea to learn whatever programmers hate.

<comment><AUTHOR> That's precisely why I'm looking to learn something not related to software development.

</comment></comment><comment><USER5> Baby boomers are starting to retire. That's a large demographic that isn't good with computers. Maybe find an industry that caters to them where technology can help. It doesn't sound like fun to me, but where there's muck there's brass.

Also, you may not have to be "passionate" about the domain, but you've got to at least tolerate it since you'll need to spend a lot of time doing it.

</comment><comment><USER6> Look around for mentors. If you can get a good mentor, you will be significantly better than you would be otherwise. It's impossible to say what will be 'hot' five years from now, so you might as well go for what you can become good at.

(I'm assuming you are talking about deep knowledge that takes a while to obtain... if you mean a month or two of studying, ignore me.)

</comment><comment><USER7> product marketing!</comment>


Ask HN: Does a self hosted Google Spreadsheet like tool exist for NASA? - <AUTHOR>

NASA/JPL's engineering data is heavily regulated and it's not legal to store our data on unapproved (ITAR/EAR) servers.  It's 2013 and there's got to be a simple, browser based way for engineers to collaboratively share & work with numbers.  Emailing spreadsheets, clunky webpages or complex 3rd party models can't be the only options. <comment><USER2> I'm not a huge fan of Sharepoint, but I'm pretty sure you can do some basic at least view of Excel files in Sharepoint. Alternatively, you can share the documents out with a read/write lock.

I'm not aware of any other products that support it. You could try out this Stack Exchange answer: [http://webapps.stackexchange.com/questions/16072/web- based-o...](http://webapps.stackexchange.com/questions/16072/web-based-office- suite-not-in-the-cloud)

<comment><AUTHOR> From that list, etherpad looks like the most promising open source & self hosted solution. We'll give this a shot soon. Thanks.</comment></comment>


Advice on finding more clients - <AUTHOR> We recently (accidentally) received a request for an ERP implementation using Odoo. We had played with it in the past, so we got to work, and implemented a manufacturing, inventory workflow for them.
Our client was very happy with the results and has started using it.
We want to replicate this success with more clients, but have to idea on how to find more clients.
I wanted to seek advice from you guys here to see how I can find an adviser / Growth Hacker(?) or if you had tips on how we could do this ourselves ?
Thanks in advance. <comment><USER2> If you want clients for this sort of enterprise software my former boss (who runs a successful business software development company that works with Odoo among other things) told me to go to trade shows, listen to the people there and what problems they have and see if your company can make software that solves it.

<comment><AUTHOR> Thank you for the suggestion. We may try to find a few trade shows for manufacturing industry. Good suggestion.</comment></comment>


3D Printable Headphones - <AUTHOR> http://www.core77designawards.com/2013/submissions/1330/

<comment><USER2> I think you meant to say "3D Printable Headphone Plastic Shell Only"</comment>


Bitcoinfographics.com – infographics about Bitcoin - <AUTHOR> http://bitcoinfographics.com/

<comment><USER2> mh.. bizantine consensous and bitcoins, mining saga, transaction explained as "calculation of a certain hash" (lol, certain)

I don't believe these are good infographics, I am more puzzled than before. If this is what the user base accepts, then probably the protocol is wasted in their hands.</comment>


Payments = Growth - <AUTHOR> https://medium.com/@lylemckeany/payments-growth-49edf9b23ff6

<comment><USER2> I agree: right now the biggest competitor to PayPal isn't Apple Pay (or Amazon Payments, or Google Wallet)... it's Stripe.

Another advantage Stripe has right now is what the developer community is building. 3rd party tools like [http://baremetrics.io](http://baremetrics.io) make Stripe even more attractive to business owners.</comment>


Ninja Blocks – What's been happening, what's happening next - <AUTHOR> https://discuss.ninjablocks.com/t/ninja-blocks-whats-been-happening-whats-happening-next/3608

<comment><USER2> Although this is a shame it is yet another sign (for me) that the 'Internet of Things' is going to be DoA if we have to _also_ rely on them for a backend cloud service. Most of these devices could be run in a completely decentralised way, such that if the company goes under, your device is hardly affected. e.g. I don't expect my light switches to stop working if the parent company gets acquired or shuts down.

There are real challenges to making distributed systems easier to build but I'm working with others on that c.f [http://nymote.org](http://nymote.org) and [http://openmirage.org](http://openmirage.org).

<comment><USER3> Completely agree. But of course using a cloud service means no need to run a server on your own network/device or have to punch holes in your router to have the device accessible whilst you are not at home. Requiring either of those wouldn't help IoT adoption outside of enthusiasts.

<comment><USER2> If you could give everyone their own 'personal cloud', without having them become sysadmins, then it's possible (of course, that's not easy but it's also why it's a valuable goal). The work under Nymote has a longer term vision so not ready to help people just yet -- some more detail at [http://nymote.org/blog/2015/brewing-miso-to-serve- nymote/](http://nymote.org/blog/2015/brewing-miso-to-serve-nymote/)

In this instance, I bet sandstorm.io could come up with a transition for Ninja Blocks users. I hope they think about it.

</comment></comment></comment><comment><USER4> Ninja Blocks just became the poster child for cloud based hardware failures.

The product never "needed" to be cloud-based. The dashboard could have lived on the Beaglebone Black inside the main unit and from there it could have allowed us to hook it into IFTTT, Pushbullet, etc. without the need for Ninja Blocks to still be a part of it.

These sort of failures make the larger corporate offerings look even more sweet, and that is a terrifyingly dangerous prospect. The company might not go away, but the data they will collect on you will probably blow your hair back.

IoT needs an open source solution, and fast.

</comment><comment><USER5> One thing I feel the NB never quite achieved was "state". It sort of worked, but sometimes not the way expected. It turns out that "state" \- like a door open or closed, is not easy to keep track of reliably. Caution is needed for anything else in the chain eg "if door open for longer than 30 sec, sound alarm".

In the end, nothing beats a physical switch on the door (wireless battery operated), with hardware on/off states. Then the door can't be mistaken ever as open or closed due to mis-matches in sending the state, or whatever other interference cause the "door open" state to get out of sync. If Ninja Blocks had made their own special little purpose-built wireless sensors and switches rather than use aftermarket, then things like state could have been sorted out early on IMHO.

The supplied door switch for example that came with the NB, triggered the same thing whenever the pin was moved in or out. The switch had no concept of open or closed or on/off, it just blurted the same signal each time it was triggered. Attempting to build "state" from such trigger data is never going to be reliable.

Knowing _without doubt_ that your garage door is open or closed when looking at the app on your phone, is not something you want your security device to be wishy-washy about. You want the truth. Ninja Blocks (in combo with the basic remote sensors) simply couldn't give you the truth, it could only give you a "pretty sure, quite likely, almost certainly the door is closed". This isn't good enough for security.

</comment><comment><USER6> This sucks. I wanted to buy one because it seemed to do what I want, but I guess they have decided that its better to go under than sell me one.

All I was waiting for was better support for existing services and devices.

Anyone behind YC want to go buy them to keep them alive? Its a massive waste to let the company go under when they have customers wanting to buy their product.

<comment><USER7> Unless that product cannot be produced for much less than the price those customers are willing to pay for it.

</comment></comment><comment><USER8> If the Ninja Blocks guys are reading this, you should remove the "Buy" buttons from your site.

</comment><comment><USER9> They are a great source of inspiration to me. This comes as a shock.

</comment><comment><USER10> The bubble is coming.

</comment><comment><USER7> This reads like an onion article. This material is ripe for an episode of Silicon Valley.

<comment><USER11> What a mean thing to say about a shutdown post. Kicking people when they're down is not ok.

Please don't post mean comments to Hacker News.

<comment><USER7> And you think it's perfectly ok for a company to say, "hey sorry guys we wont be delivering what we promised you because we made bad decisions and spent all your money." Sure companies fail but this is ridiculous. A typical example of a heavily promoted company riding a wave of hype in to the gutter. I'm sure it's hard for the guys who built this company but they should be ashamed of not delivering what they promised 300 of their customers. I found their post rather cavalier and deserving of some kicking.

I'm not saying HN should be a place of ruthless criticism and shnarky comments but I'm also not in the camp that thinks it should all be cuddling and cooing either.

<comment><USER11> > And you think it's perfectly ok

No; more than one thing is not ok.

HN's values aren't "cooey and cuddly", they're "civil and substantive". That leaves plenty of room for criticism, so I'm not really seeing the worry here.

</comment></comment></comment></comment><comment><USER12> so, snappy core didn't see the day?</comment>


Why ISOC sold .ORG to VCs - <AUTHOR> https://easydns.com/blog/2019/12/06/its-called-f-you-money-for-a-reason-why-isoc-sold-org-to-vcs/ <comment><USER2> Honestly if that analysis is correct then on one hand I concede that it does make the decision appear less like pure bribery than I initially thought but on the other it's even worse for .org users.

Maybe I'm wrong to consider this a zero-sum game, but surely if ISOC made a good deal selling .org that means that Ethos Capital got the short end of the stick. That means that eventually they'll realize that they can't make as much money out of it as they had hoped. And then what will they do? Agree to continue operating the TLD at a loss? ell oh ell. It's more likely that they'll either attempt to extort more money from people who can't actually afford to migrate or "strip" the TLD for parts somehow.

On the other hand if ISOC bet on the wrong horse they've lost the Goose that Laid Golden Eggs, and they'll be in a worse position to help the open web. From the point of view of people believing in the ethos (ha!) of what .org is supposed to stand for, it seems like a lose/lose situation.

I still don't really think it made sense to greenlight that deal for purely monetary reasons, I think the people on that board lost track of their objective, which I think is what the author acknowledges in part in his conclusion.

<comment><USER3> > Maybe I'm wrong to consider this a zero-sum game, but surely if ISOC made a > good deal selling .org that means that Ethos Capital got the short end of > the stick.

The field of economics, and pretty much all monetary transactions, are about demonstrating that sales (and thus wealth) are not a zero-sum game. Whether that's true for any particular case, such as this one, can be debated forever still, just often not based simply on that assumption.

<comment><USER4> > _The field of economics, and pretty much all monetary transactions, are > about demonstrating that sales (and thus wealth) are not a zero-sum game._

Yes, a good chunk of them are really _negative_ -sum games, once you include all secondary stakeholders in the calculations.

</comment></comment></comment><comment><USER5> If I understand the article correctly, ISOC took a reasonable decision based on (a) they are not supposed to be a registry operator; and (b) "a bird in the hand is worth two in the bush". That is, the $75m/annum profit from .org may not last for long, but the $1.1135 billion will be a great endowment fund.

The flip side is the implication (and I hope I read this correctly) is that a bunch of smart but possibly ethically challenged individuals infiltrated ISOC (a non profit) in order to create investment opportunities for themselves down the road.

<comment><USER6> Considering that the price of a .org will almost certainly be going up soon, I think that $75m/year will soon be $82million. I don't think it's sustainable to pull that amount of money every year from a 1.1 billion endowment.

<comment><USER5> From the article (not my view): "And yet, those of us in the technology business understand viscerally that nothing lasts forever. What seems like a steady cash cow today may be obsolete sooner than anybody suspects. Personally I think even DNS will be disrupted in the future by some kind of distributed ledger technology beyond even blockchain, like hyperledger or hashgraph or some post-singularity quantum foam."

<comment><USER7> Well, after that sale the odds of something disrupting DNS grew a lot.

</comment></comment></comment></comment><comment><USER8> No, that's not why they did it. They did it because they thought they could get away with it. But the charter of ISOC never was to make a mint of the .org TLD by selling it, and as far as I'm concerned this deal will be reversed at some point or we should simply set up an alternative root and a pox on both their houses.

<comment><USER9> OpenNIC would be that alternative root although often are they at odds with ICANN creating new tlds that conflict with their own. It seems like the DNS system in it's current form is broken and I'm not convinced an alternative root is the solution but perhaps part of one.

<comment><USER10> Handshake.org is trying to create an alternative root that is better (along the dimensions of security and governance) than the current system. I can see it gaining adoption especially in light of recent events.

<comment><USER11> Maybe I'm just cynical, but the fact that the first thing mentioned on their homepage is a cryptocurrency "airdrop" doesn't leave me with a confident feeling about the project's long-term viability.

<comment><USER12> That's a fair response. That said, it's worth noting:

> The Project Sponsors received a minority participation (7.5%) of HNS in the > interest of aligning all stakeholders, including industry. All of the 10.2MM > USD collected from Project Sponsors (Funds and Individuals) will be given to > Free and Open Source Software projects.

The rest was all airdropped in an attempt to get wide distribution / get it in the hands of as many users as possible.

<comment><USER11> Honestly, that doesn't allay my concerns at all. It all reeks of a pump-and- dump scheme. (I'm not saying that Handshake is trying to execute this scheme, but that they remind me of other projects which have done so.)

The pattern for these projects is pretty predictable: Promise amazing things from a technical project associated with a cryptocurrency token. Premine a bunch of those tokens and give them to insiders, then airdrop the token to create a market. The insiders sell off their tokens, and the project is forgotten.

</comment></comment></comment></comment></comment></comment><comment><USER13> I don't want to be aware of relationships between zillion different companies and organization just to be able to understand how much it will cost to _map a string to a number_ and what BS hoops I will have to jump through to keep that mapping "operational". It's totally absurd.

DNS is a rotten system. It's rotten technically, politically and administratively. It has to be replaced by something distributed. Step #1 is to collectively admit this.

</comment><comment><USER14> The real loser in this deal is us. Not only is trust lost (or already has been from other past DNS goings-on), but we, the registrants, end up paying more, financially and otherwise.

Generally speaking, the underpinnings of the Internet (protocols, certain levels of infrastructure) should always and forever be public, not-for-profit, "open-source", and not patentable, in order to protect the integrity of the system. I'm no expert, so maybe a lot of it is this way already, but DNS seems to be a bastion of for-profit greed.

All of this walks hand in hand with Net Neutrality, in my view -- governance to protect what is a fundamental human right, the free (as in freedom, and to some degree, as in beer) flow of information. And in an ideal world, objectively factual information.

<comment><USER10> Agreed. IMO no organization should be able to collect rent on what's basically public infrastructure at this point.

</comment></comment><comment><USER15> This analysis is _highly_ suspect. It's a great sales pitch sure - but it's false.

So first of all: the overhead for running the registry is unreasonably high. You'd expect there to be considerable room for reducing costs, so the 75M$ per year is artificially low; revenue is around 100M.

Secondly, that revenue is artificially (but reasonably!) low because the price is capped. But guess what? That price cap was just removed; so the actual price may rise considerably; certainly it is not reasonable to assume that under the terms specifically changed for the deal the revenue will stay at just 100M a year.

Thirdly, the risk of .org evaporating is pretty absurd. The cost of a domain is (and should be) pretty trivial compared to the value most people can extract from it; the fact that this is a for-profit business at all is highly questionable - it's as if your street address were owned by a third party, and you can't have anything shipped their at your cost without the acquiescence of a third party. I'm not sure _anybody_ is seriously buying this story of .org becoming irrelevant to the point that people won't pay 10$ (+margin above wholesale) for a domain. But even if you're unsure - the very fact that a private party snapped this up is evidence to the contrary.

Fourthly, it's entirely unreasonable for ISOC to earn even a penny off of this deal. What exactly did they do to earn the right to profit of other people's valuable contributions? Right, nothing - they were just there are the right time. There's no reason they should even be an exclusive party at all, let alone one that operates with a profit motive.

Fifthly, the people involved, and the timing, stinks. If this were all above- board, it should have been public and not have been bought out by insiders almost immediately after those same people are involved in enabling the deal. It's not at all transparent what those insiders were doing, but if it's not plain old highway robbery again, perhaps some transparency would have helped.

Frankly, the whole cartel (DNS, not merely .org) should simply be dumped; there's just no reason this is private to start with, and most certainly not run with a profit motive; that's just asking to reasons to distort the far more important markets with rent-seeking behavior here. If chrome+safari were to sponsor an alternative to DNS, I'm sure the rest of the browsers would follow; e.g. by using a different protocol (not http(s)) to disambiguate, and by forking the existing (as of some fixed date) DNS domains. Good riddance to those leaches.

<comment><USER16> Pretty sure PIR outsources their DNS management to afilas or something, and they even negotiated a cut of the fees by 50% in a recent bid.

</comment></comment><comment><USER17> The "devils advocate" first part misses that ISOC was already not operating .org, all of that was outsourced to Afilias, PIR was essentially a vehicle to pay some more graft to another set of musical chairs people that travel freely between ISOC, ICANN, PIR and Afilias.

</comment><comment><USER18> If they've been rolling $75M in profit for the past 15 years, why couldn't they have built their own endowment from that? Where did that money go?

<comment><USER19> It went up their noses.

</comment></comment><comment><USER20> Can someone explain to me what actually operating a registry means? I have always assumed that it basically consists of maintaining a database replicated across a few authoritative servers and handling WOIS information but this can't possibly warrant $25M of yeary expenses.

<comment><USER21> Administration can consume any amount of money, so long as it isn't getting in the way of the money coming in the door. Just look at universities in USA. They're not doing anything now they weren't doing in 1980, yet tuition inflation was 7% over for most of the period since then. Where did the money go? They hired more assistant administrators, to justify higher salaries for the top administrators. Also the perks are pretty nice.

<comment><USER22> I doubt even your numeric figure is exact; source?

Anyway, supposing that it is - how do you know that's where the money went? And - how do you know the money went mostly to the same place in most universities?

This sounds like a baseless generalization.

PS - I'm not from the US.

<comment><USER21> [https://www.kansascityfed.org/publications/research/er/artic...](https://www.kansascityfed.org/publications/research/er/articles/2019/1q19bundick- pollard-rise-and-fall-college-tuition-inflation)

<comment><USER23> The summary here has it all laid out:

>They find that supply factors such as wages in the education sector and state appropriations to higher education both play important roles in explaining changes in college tuition inflation. In contrast, they find little evidence that demand factors such as changes in the availability of student loans have a significant effect on college tuition.

</comment></comment></comment></comment></comment><comment><USER24> The whole concept that the registry owner has an ownership interest in domains is just wrong. Registrars have gotten uppity. Here are the current terms from Network Solutions:

 _" Web.com expressly reserves the right to deny, cancel, terminate, suspend, lock, or modify access to (or control of) any goods or services (including the right to cancel or transfer any domain name registration) for any reason (as determined by Web.com in its sole and absolute discretion."_[1]

You don't have to put up with that overreach. Compare Gandi:

 _" You are the owner of the domain name, i.e. the individual or legal person who is declared as the owner as soon as the domain name is registered and visible as such in the "Whois" domain name directory"_[2]

[1] [https://assets.web.com/legal/English/TermsOfUse.pdf](https://assets.web.com/legal/English/TermsOfUse.pdf) [2] [https://contract.gandi.net/v5/contracts/18056/DomainNameCond...](https://contract.gandi.net/v5/contracts/18056/DomainNameConditions_FR_3.0_fr.pdf)

<comment><USER25> Gandi has had a "moral clause" in their ToS in the past. Don't know if it's ever been enforced or not.

</comment></comment><comment><USER26> > But hey: if somebody offers you 11X revenues. You're going to take it. I > know I would.

Not if it's only 15x profits!! And those profits are more or less guaranteed.

</comment><comment><USER27> If the mission of the Internet Societies is to connect people to the Internet, one question is why they want to connect people to the Internet. The .org sale communicates that the reason is to extract as much money from them as possible. What they really have a problem with is the people extracting money paying to develop standards, so they strive to extract as much free labor as possible from people as their money is extracted.

</comment><comment><USER28> If you're a .org owner for personal use and aren't happy with this change - what are the feasible alternatives that others have settled on?

</comment><comment><USER29> FWIW, the economics of .org are easy to look up in the PIR 990, as of 2017. The 990 shows ~90m in revenue with ~75m in profit - which was split 40m to ISOC and 35m to ISOC foundation (a subsidiary of ISOC).

</comment><comment><USER30> Adding an additional pieces of Information to the mix.

Donuts, Inc, was bidding for .Web in 2016, and lost to Nu Dot. Nu Dot then sold the name to Verizon. Somehow this was unfair and they decide to sue them. ( What ? )

Had Donut got .Web, they would have floated the company and make a return of Investment. Since they lost, they figure out their next step / solution was .ORG. And the timeline in 2017 and 2018 seems to confirm that.

</comment><comment><USER31> Since the site seems to be struggling: [http://archive.is/0aOfz](http://archive.is/0aOfz)

</comment><comment><USER32> I haven't yet heard the point that if .org prices go up too much, nonprofits could abandon it and switch to .ngo, which is better anyway. Many will keep their .orgs even if prices go up 10-fold or more, but what percentage is that from all .orgs?

<comment><USER33> Why should organizations be forced to change their business cards, website address, all email addresses, letterhead, signage and such because the new venture capitalist vulture owners of .org are a pack of shady rent seekers?

To quote Michael Bolton from Office Space:

Samir: Hmm… well why don't you just go by Mike instead of Michael?

Michael: No way. Why should I change? He's the one who sucks.

<comment><USER34> For once, .ngo is more credible. From wikipedia:

> Unlike the more prevalent .org domain, which is also managed by the Public > Interest Registry, .ngo will require validation of the registrant's non- > governmental status

<comment><USER35> It's more credible on paper, but the common internet user is more likely to know and trust .org domains then any of the new TLDs.

<comment> dane-pgp Yes, and it is slightly amusing to think that an ordinary internet user is going to make a decision about whether to trust .org more than .ngo domains by checking Wikipedia. That's wikipedia dot org...

</comment></comment></comment></comment></comment><comment><USER36> dumb question, but if VCs decided that the venture is profitable under a certain model (aka: no limits pricing), then why doesn't the domain registry just do so themselves?

</comment><comment><USER37> TLDR: Rich get richer

ICANN owner who also owns Donuts, Inc (they own all the new TLDs .donuts, etc) buys .org from former owner (ISOC) who is also now much richer.

</comment><comment><USER38> It would be nice if the author knew the difference between VC and PE.

</comment><comment><USER39> TLDs are interesting, intriguing and hard.

TLDs serve as a classification structure for various aspects of human interest, knowledge, creativity and commerce...

Where should the canonical for TLDs come from?

Should a particular interest have its own TLD, regardless of topic - how to measure when to provide a TLD -- is it scale of interested people? is it ideologically based?

As such, should there be a .dem and a .gop? if so, then should them be a .socialist? .nazi? .zionist? etc?

Some of the current TLDs are silly, to me, but what is the barrier to entry and what is the criteria for approval?

And most importantly, WHO APPROVES? Like literally - the names of the people who actually make TLDs happen?

</comment><comment><USER40> Isn't the ISOC the same group that initially sponsored the Lets Encrypt program?

</comment><comment><USER41> I would love for the people who did this to lose a ton of money on it.

</comment><comment><USER42> Ethos Capital, as per their website and business model, is a private equity firm, not a VC firm. Very different things. Hard to take people seriously when they don't know the difference.

<comment><USER21> Are you here to argue that PE people are somehow more ethical or better at business than VC people? That's going to be a laugh line for anyone who has ever been exposed to them.

<comment><USER42> Nope. Just trying to help people distinguish the two businesses. PE companies acquire private companies and run them. VC companies invest in founders and they run the company.

<comment><USER21> Since we're striving for accuracy here, usually they acquire _public_ firms and "take them private".

<comment><USER43> There are a lot of purely private transactions now -- they've already taken everybody private who wants to go private.

</comment></comment></comment></comment></comment><comment><USER9> How often do people notice domains? I've seen many users use Google or similar to find their desired site such as facebook without typing the URL. If it were only an IPv6 address, would people even care?

<comment><USER44> I notice domains. And I don't trust domains that don't end in .com, .org or a recognizable national TLD.

Besides, the point is irrelevant.

When you build an online brand, you build it by having links distributed on the web, to get the Google juice going, on social media, on forums, etc. Even in business emails you add your domain there for easy reference later.

Then if you have to change the domain, all of those links will be broken.

As they say... Cool URIs don't change ;-)

[https://www.w3.org/Provider/Style/URI.html](https://www.w3.org/Provider/Style/URI.html)

<comment><USER9> Perhaps it was incorrect of me to claim that users don't notice domains. I suppose the issue I was getting at was users don't appear to memorize the domain and instead use Google or similar for finding the site they are looking for.

<comment><USER15> But how does google find those domains? Link juice still matters, and those links work via... domains.

<comment><USER9> Those links work with domains or addresses no matter if it's [https://yourdomain.com/](https://yourdomain.com/) or [https://[2001::1]/](https://\[2001::1\]/). Google finds those domains through a variety of means (social media, collecting other domains from the sites they index, manually submitted domains, etc). Google also indexes addresses.

<comment><USER15> But links aren't alive; so if somebody once linked to something you wrote/own/built/whatever on some domain, you can't magically transfer that link to your new site if the domain name system decides to jack up prices until you consider moving.

And you're similarly not likely to own an ip address forever, not to mention that if you have any doubts about the userfriendliness of domains, you don't need to wonder about ip-addresses. Ip addresses are worse on all fronts; leaving you back to square one: the DNS gatekeepers own your domain and merely let you use it. Just pray they don't change the terms of that deal.</comment></comment></comment></comment></comment></comment>


Ask HN: Who owns archive.is, and why are they trustworthy? - <AUTHOR> I understand the need for anonymity when you're doing this due to the sheer amount of abuse reports, fake and real DMCAs, etc.
But why do people trust it? How do you know the pages you're archiving haven't been tampered with selectively to change history? This is just out of sheer curiosity, and I am not saying they do this.
This is made further interesting because of the following:
- Analytics from various Russian providers, instead of self-hosted (FYI: I consider GA to be equally privacy-violating as Metrika or Mail.ru)
- Large amounts of reverse proxies off questionable or bulletproof hosting providers
- Indefinitely doing this can't necessarily be cheap either at scale, who is paying for this?
- Demanding tracking or else blocking your access to the site, blocking any resolver that doesn't send the first 3 octets of your IP to them (edns-client-subnet)
- Explicitly tracking you in odd ways: they repeatedly load pixels/do DNS preconnect/preload from wildcard subdomains containing a cookied number, IP, country, tracking IDs. View any archived page and ^F "pixel.archive.is" <comment><USER2> Archive.is isn't very important yet. I don't believe they warrant much concern re such questions. It doesn't yet matter very much if they're super trustworthy or not.

At their present scale, going through and manually changing (tampering with) saved content for propaganda (or similar) purposes, would have very little impact. More realistically, it probably has close to zero potential consequential impact. It'd be quite the chore for very little return.

If they become important some day, with dramatically greater scale of usage, then getting answers to these questions might be important.

If they eventually betray trust, they're trivial to replace. Other competing variations of archive.is exist now. It's a relatively easy service to create. Someone should probably challenge them just on the basis of how bad their ui & ux are.

At scale, if they begin abusing their position, it would become well known, they would get a reputation and it'd kill their service. The barrier to competition extremely low.

</comment><comment><USER3> Why would you trust them? If you are trying to archive something, make sure to use multiple (separately owned) services so that you don't need to trust them.

<comment><USER4> Which services would you recommend? Last time I searched for free general- purpose website archival sites (for personal bitrot prevention), I could find only archive.is and archive.org.

<comment><USER5> Some alternatives that may be what you are looking for are archive.st, Webrecorder.io, FreezePage, and ArchiveBox. There is also perma.cc, which is a project of the Harvard Library Innovation Lab intended for academic usage.

</comment></comment></comment><comment><USER6> > This is made further interesting because of the following:

An additional concern: they've shown signs in the past of being capricious, or at least, easily annoyed by (subjectively) insignificant slights. They continue to block Cloudflare DNS users, last I checked. The "reason" is that Cloudflare doesn't send along the eDNS client subnet, as a way of protecting their users' privacy. [1]

I would argue this means archive.today / is can't be trusted to have the best interests of the community at heart. It's not a public service in the way that archive.org is.

[1] This bad behavior is actually mentioned in their Wikipedia article, along with the additional uncited claim that they throttle users to 20 MB of data per day, upon which they apparently ban your IP address. I haven't verified the latter claim. [https://en.wikipedia.org/wiki/Archive.today#Worldwide](https://en.wikipedia.org/wiki/Archive.today#Worldwide)

<comment><USER7> I didn't know about the Cloudflare DNS users being blocked. I started using Cloudflare's DNS two days ago, I just checked and it looks like I can't use the site anymore.

I can use it with Tor after more than a dozen different reCaptcha requests.

</comment></comment><comment><USER8> Also, why do people use archive.is over web.archive.org? One (web.archive.org) is an actual library and gets all the legal protections that entails, while the other doesn't.

</comment><comment><USER9> I share most of these concerns, especially since it's primarily used in the "alt-right" sphere and could easily become a vector to sow discord, either by tampering with content or simply by mapping the communities of users visiting it.

Worth noting, it's probably not _that_ expensive to run. Most of the hosting services they use would be offering "unmetered" bandwidth, so the cost is probably fixed per month, likely under $1000.</comment>


Download Lisp to my brain. - <AUTHOR>

If I were a character in the movie The Matrix, I could ask an operator to download a program to my brain so I could fly a helicopter or something.  I would like to learn Lisp and, well, download it to my brain as rapidly as possible so I can start working with it to write a roguelike.  I am looking for good online resources, preferably including a sand-box or similar.  I learned to code my websites by having a template (gifted to me by a friend) and playing with it and I still learn new things when I want/need to do something new on my sites.  I know a little (X)HTML and CSS already and had intro to VisualBasic about 7 years (which I don't particularly remember, of course).
Yes, I know I can google this.  But since I know nothing, I can't judge the quality of the sources.  So I am hoping folks here will indulge me.
Thanks.
PS:  Am I supposed to do an intro?  I just joined today and this is my first post. <comment><USER2> Assuming this isn't a Joke:

Lisp IDE for Windows (the easiest and most basic; use it just for your first 30 days, after that move to SLIME.)

<http://www.daansystems.com/lispide/>

Implementations (both work with LispIDE above)

<http://clisp.cons.org/> (byte compiled, fast)

<http://sbcl.org> (natively compiled, multithreaded, industrial strenth)

Books

<http://www.cs.cmu.edu/~dst/LispBook/> (easiest intro)

More here <http://lisp.org/alu/res-lisp-education>

<comment><AUTHOR> No, this isn't a joke. Thank you for replying.

<comment><USER2> You might wanna revise that "download to brain" requirement. Programming is a skill learned and polished over years; none of us are Johny Mnemonic ;-)

<comment><AUTHOR> Just hoping to convey a concept. I already write code by hand, just not programming languages. :-)

Thank you!

</comment></comment></comment></comment><comment><USER3> Lisp nowadays comes in two main flavours (dialects, technically): scheme and Common Lisp.

I prefer the former and my favorite implementation at the moment is plt-scheme (<http://www.plt-scheme.org/>).

From the website above you can download the distribution of the language for your platform. It also has a very nice IDE which has been designed primarily for learning.

Here's a book to get you started (it is fully available online): <http://www.htdp.org/>

Happy hacking!

<comment><AUTHOR> Thanks! Any reasons why you prefer scheme to Common?

<comment><USER3> For me it's mostly an aesthetic thing. It's difficult to explain.

I just find simple things more elegant than and Scheme is terser and all the implementations (that I know of) are lighter than CL. It' s also very easy to embed in C code.

I'm by no means an expert, though.

</comment></comment></comment><comment><USER4> For an online sandbox, you can use _the Lord of the REPLs_ from Google: <http://lotrepls.appspot.com/>.

You can evaluate expressions (= program) in 2 Lisp dialects, Scheme and Clojure, directly in your browser! (You can also use other non-Lisp languages, notably Ruby).

<comment><AUTHOR> Thank you everyone. This thread is the best internet discussion experience I have had in a long time. :-)</comment></comment>


Facebook: Google+ has 'no users' - <AUTHOR> http://www.telegraph.co.uk/technology/social-media/8706645/Facebook-Google-has-no-users.html

<comment><USER2> If you read the article, Zuckerberg didn't say that, it was Sean Ryan, Facebook's director of game partnerships.

<comment><AUTHOR> You are right, but it is interesting to see how they are trying to minimise G+ booming.

</comment></comment><comment><USER3> He's just 20M off. No big deal.</comment>