Authentication made easy, fast and RESTful - <AUTHOR> http://www.authdog.com/ <comment><USER2> "hash - An MD5 hash value made of the concatenation of YOUR_APPLICATION_KEY + EMAIL + CODE"

Stop using unsafe keyed hashes: [http://rdist.root.org/2009/10/29/stop-using- unsafe-keyed-has...](http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed- hashes-use-hmac/)

That's a red flag that these guys don't know what they're doing and thus not to be trusted to handle my authentication.

<comment><USER3> Seriously, HMAC was built for this exact purpose. The primary design goal of HMAC was to combat insecure ad-hoc keyed hash schemes exactly like this. I saw this a couple months ago on moonshado's SMS API and after going back and forth with someone from their team I just let it go because they obviously didn't get it. For anyone who cares about security, this is a huge red flag.

<comment><USER4> The HMAC library in Python still uses MD5 (<http://docs.python.org/library/hmac.html>) which is known to be exploitable with hash collisions. My opinion is that its not too difficult to roll a MAC setup using some SHA based hash.

<comment><USER5> The constructor for the Python HMAC library just defaults to MD5; you can pass any of the hashlib modules to it via the digestmod parameter. I don't know why it doesn't default to something more secure, but it's no challenge to do.

</comment></comment></comment></comment><comment><USER6> Maybe I am missing something, but why would I want to use this? I develop in Rails, where Devise is extremely simple to implement.

Do other frameworks lack a good auth plugin?

<comment><USER7> To restrict access to a static web site, providing authentication through this api and nginx auth request module[1]? Not even sure if this specific use case is even possible with this API but that would be nice.

That being said, I don't think I would rely on an unknown API for such crucial part of my web app. In there shoes, I would just release it open source so that people can inspect the code and build street cred out of it.

[1]: [http://mdounin.ru/hg/ngx_http_auth_request_module/file/a29d7...](http://mdounin.ru/hg/ngx_http_auth_request_module/file/a29d74804ff1/README)

</comment></comment><comment><USER8> Nice idea, especially if the service can offer some really nice analytics on users, but perhaps the MVP should try to sell itself from a security perspective, so that the reason to use it is because its easier and more secure than creating a simple user system with username and straight MD5 password storage.

</comment><comment><USER9> I'm wary of signing up for a service that has no cost details.

</comment><comment><USER10> This looks very interesting. So is it safe to pass clear text credentials over to another site? Is it via HTTPS?</comment>


Estonia becomes the first to open a nationwide electric vehicle charging network - <AUTHOR> http://estonianworld.com/technology/estonia-becomes-the-first-in-the-world-to-open-a-nationwide-electric-vehicle-fast-charging-network/ <comment><USER3> Estonia has impressed me with their forward thinking policies. Everything about their execution of this plan has me impressed. They have executed well in financing the building of this network and in creating a sustainable business model for the future.

Related note: 5 Months ago I remember hearing about their plan to introduce programming into elementary curriculum. [http://developers.slashdot.org/story/12/09/04/2136256/estoni...](http://developers.slashdot.org/story/12/09/04/2136256/estonia- to-teach-programming-in-schools-from-age-6)

<comment><USER4> _"They have executed well in financing the building of this network..."_

They have executed well in the building. Financing is kinda easy for a country of only 1.3 million people heavily subsidized by the European Union (which Estonia is a part of).

During the 2008-2009 crisis (which is not done yet but I digress), the Estonian GDP took a gigantic hit: -20% of the GDP. That's what you get when you're taxing the private sector like crazy: the private sector, in usual circumstances, can barely survive. If any crisis happens, then the private sector dies and the economy crumbles (thank you socialism for the crazy high confiscatory tax rates on the private sector).

It's like Poland, for example: I love this country and it feels incredibly more "new" and even sometimes more "hi-tech" (e.g. in big cities malls) than western europe... But Poland is receiving crazy funding from the EU to get up to speed.

As an EU taxpayer, that said, it's good that at least some of money is used to invest in technologies that are bound to become very important in the future...

<comment><USER5> Agree with your point about both the size of the country and the funding they are receiving. That said, when I visited Estonia in the early 2000s, prior to being in the EU, their broadband infrastructure seemed better than that of Finland and Germany (two countries I spent time in). That may have well been due to it's overall size.

What is interesting to me about Estonia now is the lack of overall diversity in the tech sector there. The biggest tech employers seem to be the government, the banks, and Skype.

Maybe Skype buyout V2 will inject more in the way of a startup culture there.

<comment><AUTHOR> Estonia has ~15000 people working in the tech sector. There are 1500 tech/IT companies, 26 of them above 100 employees. IT/Tech is ~5.8% of GDP (2010).

Here is one Estonian Startups list: <http://hub.garage48.org/estonian- startups> \- all in all, there are 100+ active startups in Estonia, which I would say for a country of 1 million people is quite a startup culture. Estonia now has I believe 7 or 8 European startup accelerator Seedcamp winners, trailing only UK, Seedcamp's home country.

<comment><USER6> This is kind of misleading. Many of the start-ups on that list are headquartered (or host major operations) outside of Estonia; they're considered Estonian only because the founders hold Estonian nationality. You wouldn't call start-ups headquartered in the US and founded by Indians "Indian start-ups", would you?

<comment><USER7> This might not be the case for quite a few Estonian startups though -- with 1.3 million people you're desperately lacking a large enough target market for the niche products that some startups are developing, and looking to other countries may actually be a part of a strategy, not simply a case of 'I happen to be an Estonian living in the UK so I'll just go with the flow and do my startup here'. I would call these startups Estonian.

</comment></comment></comment></comment></comment></comment><comment><USER8> Being an Estonian citizen and all I know that I'm very lucky to have born in Estonia. Blazing fast internet speed comparing to U.S (according to a few U.S friends, not some giant stats machine) and free WiFi in nearly all of the bars, clubs, pubs, coffee shops, restaurants, malls there are. At least in the capital city that is.

That being said, tech might be top-notch, but the economy is sinking. Sure, they raised the minimum wage to 350 EUR / month, but all it really did was increase the number of "officially poor" and since living cost is catching up with Finland (not in houses or apartments as of yet, but pretty much everything else) the ~400 EUR most people get for paychecks around here is not for living, it's for suffering.

So perhaps a better thing to do would be to just fall behind in the tech field a bit (a bit, not die) and actually do whatever the hell is needed to provide companies with enough income to pay decent salaries. I have no idea how the entire "money making" system works and I'm sure it's complicated as hell, but if they have money to make Estonia a tech country that has a ton of poor people who are struggling to collect enough money to get the hell out of here then maybe they should instead invest that money in people - and in return get people invest in the country itself.

</comment><comment><USER9> I do have to note that Estonia with its 165 chargers is curiously only as wide as the distance between the 'superchargers' in the recent Tesla debacle...

<comment><USER10> Surprised Vatican hasn't beaten them to a punch with a nationwide charging network, but with their upper management exodus I guess that slipped on the priority list.

<comment><USER9> Interesting point - I didn't even think the Vatican had roads. Looking at google maps now, it does seem to have some, but I'm not sure if they're public (not that you couldn't have a charger because of that)

<comment><USER11> Challenge accepted.

<http://news.bbc.co.uk/2/hi/europe/6768395.stm> says there's a 30km/h speed limit and an accident in 2006. <http://en.wikipedia.org/wiki/Ten_Commandments_for_Drivers> says there are 1,000 cars in Vatican City.

A-ha! Here's a description of the people who drive in Vatican City: <http://mes.stparchive.com/Archive/MES/MES03141997p05.php> . It's at the bottom, along with a description of the parking problems and congestion. Based on [http://www.slate.com/articles/life/welltraveled/features/201...](http://www.slate.com/articles/life/welltraveled/features/2011/vatican_inside_the_secret_city/vatican_guide_inside_the_pope_s_supermarket.html) , these roads are not open to the public.

Lol. The joys of automatically generated text. [http://www.expedia.co.uk/Compare-Cheap-Car-Hire-In- Vatican-C...](http://www.expedia.co.uk/Compare-Cheap-Car-Hire-In-Vatican- City.d6052608.Car-Hire-Guide) claims "However, most car hire vendors will also have pick up/ drop off locations within Vatican City, so if you are staying in the city then you may want to consider this as an option ... If you plan to hire a car and drive around Vatican City to take in the sights, it's worthwhile taking a bit of time out and stopping off and visiting the historical Casina Pio IV (Villa Pia). The big advantage of hiring a car in Vatican City will not only allow you to enjoy the scenery within the city boundaries but will also makes it much easier to explore beyond the city."

Casina Pio IV is "home to the Pontifical Academy of Sciences, the Pontifical Academy of Social Sciences and the Pontifical Academy of St. Thomas Aquinas." I'm pretty sure it's not on the top things to see while in Vatican City.

<comment><USER12> ><http://news.bbc.co.uk/2/hi/europe/6768395.stm> says there's a 30km/h speed limit and an accident in 2006.

Hm, they could just restrict driving to golf carts and be the first fully- electric-car nation ...

<comment><USER11> A lot of the people with cars in Vatican City also want to drive in Rome. I suspect most would not like golf carts for that purpose, compared to a car.

</comment></comment></comment></comment></comment></comment><comment><USER13> _The construction of the fast-charging network was financed by using the funds received pursuant to a CO2 emission quota sales agreement entered into between the Republic of Estonia and Mitsubishi Corporation._

Anyone understand what this sentence from the article means?

<comment><USER14> I believe it refers to Estonia selling off excess carbon credits to Mitsubishi under a mid-long term agreement.

Mitsubishi needs to purchase these credits to stay within regulatory requirements pertaining to emittance of CO2 probably in the EU. Given that Mitsubishi is a large manufacturer they probably produce above their alloted quota of CO2 and therefore must purchase credits from someone/some organization (in this case Estonia) that does not use their full quota.

Estonia is using the income from this agreement to fund the fast-charging network.

This is all educated speculation as to its meaning. Apologies for no links to references to back up my understanding. I am sure a quick search will provide more information.

</comment></comment><comment><USER15> Wouldn't it be great if governments everywhere created solar-based chargers like those of Tesla, with some back-up to electricity for night charging or for when all the power is used at a charger for the day, and then the whole population could buy electric cars much faster?

<comment><AUTHOR> Not in Estonia. We don't have any sun, except for few days in the summer. Wish we could produce electricity from cold, rain and darkness.

<comment><USER16> For "rain" see [1] using the mechanical energy of falling rain drops.

For "cold" see [2] the idea of using the potential energy of snow on mountains (or hills). Maybe create artificial avalanches.

For "darkness", no idea. :)

\-----

[1] <http://phys.org/news120216714.html>

[2] <http://www.newton.dep.anl.gov/askasci/eng99/eng99635.htm>

<comment><AUTHOR> Crap, we don't have mountains either :D The highest point is 318 meters ASL.

</comment></comment></comment></comment><comment><USER17> And they already beat the US in Internet speed. <http://www.netindex.com/download/allcountries/>

<comment><USER18> Know what the top countries on that list have in common?

I could beat the US in Internet speed if I setup a neighborhood network.

<comment><USER19> What's the average Internet speed in, say, the Bay Area?

<comment><USER20> Anecdotally it sucks. The ADSL people generally have in SF is terribly slow. Even my moms internet in the Dutch country-side, 8 miles from the nearest city, with cows for neighbors on all four sides of the house, had faster internet than that.

For the Bay Area numbers: [http://online.wsj.com/article/SB1000142405274870395970457545...](http://online.wsj.com/article/SB10001424052748703959704575454042453615112.html)

</comment></comment></comment></comment><comment><USER21> On the highways, every 60km a ChaDeMo quickcharger. €18.000 credit if your car is 100% EV. I just wish Tesla sold some here.

<comment><USER22> I spoke to Tesla about this, they were not interested. Said I'd have to sell a few Roadsters to demonstrate interest.

Mind you I was talking to their sales team in London, who probably needed to offload unsold Roadsters.

<comment><USER23> Ha! Perhaps try calling them back on the 1st of the month rather than the 27th when they're trying to make quota :-)

</comment></comment></comment><comment><USER24> Unfortunately, because Estonia derives almost all of their electrical power from coal, this is a wasteful setback for the environment.

[http://www.tradingeconomics.com/estonia/electricity- producti...](http://www.tradingeconomics.com/estonia/electricity-production- from-coal-sources-percent-of-total-wb-data.html)

<comment><USER25> Even if they derived 100% of their electricity from coal, it would be a huge win for the environment. There have been multiple studies done on this, and power plants and electric motors are massively more efficient and clean than gasoline cars. Even when you factor in transmission losses, charging losses, etc. and assume you're using 100% coal power, EVs beat ICEs by a wide margin.

Not to mention, solar is rapidly approaching the point where it will be cheaper than coal, so it's only a matter of time before coal will start getting phased out anyway.

<comment><USER26> _Even when you factor in transmission losses, charging losses, etc. and assume you're using 100% coal power, EVs beat ICEs by a wide margin._

I'm pretty sure it's the opposite. Do you have a particular study/calculation in mind?

[http://www.nytimes.com/2012/04/15/automobiles/how-green- are-...](http://www.nytimes.com/2012/04/15/automobiles/how-green-are-electric- cars-depends-on-where-you-plug-in.html?pagewanted=all)

</comment></comment></comment><comment><USER27> What happened to hydrogen cars? I was expecting them to come out on top, but it seems electric charging stations are growing much faster than hydrogen refill stations.

<comment><USER28> Burning hydrogen is but one step in the whole "well to wheels" chain that's needed to get your car moving. That single step appears very appealing - <USER2> turns into water! - but all the other steps along the way are extremely difficult.

How much energy can a car have with a "full tank of hydrogen", and what would that tank look like? Remember, a bucket of gasoline contains more hydrogen than a bucket of liquid hydrogen, and the gas kan be reasonably safely kept in the bucket, but the hydrogen requires very special equipment.

How will you get the hydrogen into the car? Gas can be poured into the gas tank, how would you transfer liquid hydrogen safely? Remember, chain-smoking stressed out soccer moms with three screaming kids in the car have to be able to do this without blowing themselves up.

How will you get hydrogen to the gas stations? How will you manufacture the hydrogen? You can't mine it or collect it, so you would have to create it by splicing water, a process which consumes a lot of energy. Where will you get that energy from? And if you're going to use electricity anyway, how much of that energy is lost in the process?

What's the "well to wheels" efficiency of a hydrogen vehicle? I'm pretty sure it's smarter to just charge a battery in the vehicle directly, through the electricity network, rather than going the roundabout way of creating volatile hydrogen at special plants, transporting that hydrogen to gas stations, having equipment for allowing people to fill up their cars, and finally combust the hydrogen in the car to make it move.

So what happened? Someone did the math on the whole chain, instead of just handwaving the massive infrastructure problems away.

<comment><USER29> The benefit of hydrogen IMO is not needing to mine tons of potentially hazardous or toxic minerals to make giant swaths of batteries, not to mention that you can actually fill up the fuel tanks just like you would with gasoline, rather than needing to wait 30-60 minutes for a "supercharger", and the overall range of existing hydrogen vehicles is generally on par with or better than the range of gas-powered vehicles.

They've already "solved" most of the problems you mention; the "problems" are with scaling that sort of infrastructure. Scaling EV chargers is just much simpler.

<comment><USER30> Once the number of EV's get high enough, we can have recycling stations for them. Another benefit of having an Electric car is that you don't care about the source that produces the electricity. So tomorrow when cold fusion is feasible, we just build a bunch of them and power all our vehicles with the electricity that they produce.

However, I am interested in hydrogen as a fuel from a long term perspective. In the future when we have vehicles that need to run on other planets, presumably hydrogen will be the fuel; however I'm not sure those engines will be IC; maybe miniaturized jet engines? :) edit: probably not, since jet engines need _oxygen_ which may not be available on other planets

</comment></comment></comment></comment><comment><USER31> It'll be an interesting test, Estonia can get bitterly cold.</comment>


Mu: Sketching out a minimal system programming language - <AUTHOR> http://akkartik.name/post/mu-2019-2 <comment><USER2> > Performance is not a priority.

I like your outlines so far. It is very interesting -- even if it probably will fail eventually.

I am only concerned with this quoted guideline. Performance should always be a priority. Your other guidelines -- keeping the translation simple and transparent -- already put a constraint on the aesthetic. You can't allure users by hiding complexity beneath something. So if you also don't promise users performance, what good is your language to a user (unless he is a poet)?

I feel that you are adding this guideline only because you are thinking about taking the dynamic approach to memory safety rather than the Rust approach. That is fine as long as either approach is only an add-on rather than the permanent infrastructure of your language. If they are, then I am afraid your language will just reduce back to one of the language that is hardly worth to checkout.

My suggestion is always to put performance as your priority. Always start with solutions that performs, then work on enhancing your language to express the same solution easier.

<comment><USER3> You seem to be assuming everybody in the world always wants the same things, which is demonstrably false. There were excited communities of people using Lisp in 1962 and Java in 1997. Both were significantly slower than mainstream platforms of the time. There are many platforms today that provide performance, and people who need performance will use them. I can't compete with them. Mu is for people who don't need performance quite so badly, and who are willing to trade performance for other benefits.

Also, the word "priority" means _relative_ importance. Too many priorities are equivalent to no priorities. Performance not being a priority just means other aspects are more important, not that performance will be glacial. Indeed, a lot of performance stems from doing less, and I fully expect fewer layers of abstraction to keep Mu quite competitive for many tasks. But that will happen naturally without me needing to push on it.

</comment></comment><comment><USER4> Ages ago I wrote "type safe macro assembler" on a postit note, and then never did anything with this idea. It looks like someone has taken it a lot further.

Reminds me a bit of LLVM-IR.

</comment><comment><USER5> One major issue that causes C compiler optimizations to be necessary are impedance mismatches between the architecture and the language. bulitin/intrsinsic functions are the "work around" for this, but they tend to be very non-portable (between compilers, and even sometimes between backends on the same compiler).

If you do this in C, most compilers will optimize into a 64-bit rotate:

        (n << d)|(n >> (64 - d))

But that requires an optimizer.

Many compiler vendors have an extension that will compile to a rotate instruction, but they tend to differ from one compiler to another.

<comment><USER3> Author here. You didn't really ask a question, but I thought I'd mention a few things that may be related.

1\. Mu isn't intended to be portable. There are no other backends, not even other processor families. Though you still have to put up with other processors within the same family, if it's a new instruction that older processors don't have. So far it just focuses on lowest-common-denominator 32-bit instructions.

2\. The whole goal with Mu is to eliminate impedance mismatch with the architecture. It's relatively straightforward to add another instruction at the Mu level called 'rotate', and have it code-generate the appropriate x86 instruction. That seems less convoluted than assuming a fixed language and compiler and expressing a rotation out of 4 binary operators.

3\. Finally, there's also the option of writing some functions in the 'machine code' level called SubX. Functions generated by Mu and SubX will freely inter- operate, though SubX functions lack safety guarantees.

<comment><USER5> Thanks for the clarifications!

</comment></comment></comment><comment><USER6> I'm surprised by the assertion that you can't use expression syntax because you would then be forced to implement common subexpression elimination. You don't: Just run your C compiler with -O0 and you should get expressions without CSE.

What you do give up if you use expression syntax is control over register allocation, unless you specify that expressions are evaluated via the stack and a designated accumulator. Or you could annotate every single subexpression with the register to put it in. I'd agree that this might not be a good fit for the overall design of this language, but I don't think CSE is to blame.

Besides that, the description of the calling convention could use a few more details. Are all registers except the stack pointer and the return value(s) callee-saved? Can you return multiple values? Can each function choose where to return its results, or is eax fixed as the return register? The "may be just documentation" comment confuses me.

<comment><USER3> As I reread that passage now, there's some redundancy in my prose. The first time I mention CSE I'm talking specifically about optimization and the need to avoid the temptation to build an optimizer over time. The second time I don't, but I'm still implicitly assuming the need to optimize. I should clean that up.

Calling convention: yes, all registers are callee-saved. Multiple values can be returned. (Up to 6, I guess?) Since the callee saves registers, any returned registers are just not saved and restored. A function can return in any register, though I use `eax` by convention. Since miscommunication between caller and callee about what registers are clobbered can lead to subtle bugs, I require the caller to also show the correct register being written to. Does that help? I'll work this in. Thanks!

<comment><USER6> Yes, that's great, thanks!

</comment></comment></comment><comment><USER7> I wonder what Mu will offer that Rust does not.

<comment><USER8> It looks like it's shooting to be a lot lower level than Rust, probably Zig is a more apt comparison.

<comment><USER9> It looks like it's shooting to be even a lot lower level than Zig.

<comment><USER3> Yeah. (Author here.)

The goal is not a specific level, just to do as much as possible with local rewrite rules. That gets some surprisingly high-level features, but the result overall will still seem fairly low-level.

(And then there's all the runtime overheads. Mu isn't trying to compete on performance.)

</comment></comment></comment></comment><comment><USER10> Any real thing to show or just poor dream?

<comment><USER11> Please don't post dismissive comments like this to HN. Maybe you don't mean to be a jerk, but on the internet that's how it resonates. As the site guidelines say: " _Please don 't post shallow dismissals, especially of other people's work. A good critical comment teaches us something._"

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment></comment>


Ask HN: Which sites are there for idea sharing and brainstorming? - <AUTHOR>

1)Do you know any website that allows you to share your ideas(business ideas,web app idea etc), organize them and let you brainstorm it with other users to improve the idea? Basically something that works like sourceforge.net but limited only to ideas, not its implementation.
2)Do you think there is a need of some new web application for this?
3)What features would you like to have in such application? <comment><USER2> There's a couple of similar sites that exist. They're lighter on the features of brainstorming, but I could see both easily expanding to have these types of features.

The first: <http://www.startedby.com> is specifically for throwing out ideas and starting to converse on them. It's very much for getting an idea out there and beginning to coordinate with others on it.

The second: <http://www.builditwith.me> is a bit larger and for the latter part of the idea stages. It seems the ideas are usually defined and its people looking to connect with the opposing skill set either designer or developer of what they need.

Obviously there's definitely a need, the hard part is how do you target and what features do you offer. Are you targeting a technical or non-technical crowd. Are you hoping to focus more on the idea process, or helping connect others that already have the idea but can't execute?

<comment><AUTHOR> Basically as per my idea(what I want from such sites), the focus should be on -

1\. Validating and improving the idea through feedbacks, discussions, brainstorming, etc.

2\. Maintaining a wiki/document repository for idea and its execution related planning i.e. Feature List, Designs, Marketing Strategies, Technical Architecture etc.

3\. Connecting various people who can execute the idea through some startup or may be an open source project - Developers, Designers, Entrepreneurs etc. This can be done through twitter like system "Follow Idea" as "Developer/Designer/etc"

4\. Encourage those who implemented the idea to share it with group.

The system should improve the raw idea to an extent so that it can be practically executed by those who are interested.

</comment></comment><comment><USER3> <http://shapea.com> (I am the founder) is trying to do this. We are currently in beta (though you can sign in publicly). The main goal of Shapea is to help validate your startup ideas and one of the thing we do is allow you to share your ideas and get feedback from the community. Would love to hear what you think about it.

<comment><AUTHOR> Hi, I signed up for your site. It is nice but my idea about such sites are little different. What I usually see are sites that let you post an idea and get feedback from other members. For example -

<http://www.halfbakery.com> <http://www.globalideasbank.org> <http://www.whynot.net/> <http://www.creativitypool.com/> <http://ideaaday.org/>

Your site does the same but also allows landing pages and beta signups.

Here are some of the features I want in an idea sharing site -

1\. Idea submission (It exists)

2\. Feedback (It exists)

3\. Ratings - up/down votes(It exists)

4\. Brainstorming - A chat room/FB wall/discussion board/google wave/Whiteboard like features where members can easily do brainstorming with other interested members.

5\. Document Repository(Wiki Style) - For things like Feature List, Proposed UX/UI Design pics, business plan, etc.

6\. List of Interested Developers,Designers,etc. (Followers)

7\. List of implementation - Links of actual implementation of idea.

and many such things...the goal should be to allow users to share, validate, improve, document ideas and keep track of interested developers, designers, etc and implementations.

It should be in a manner that if someone likes the idea and wants to implement it he can quickly access all the available information to do it.

<comment><USER3> Thanks for the feedback. Appreciate it.

> 4\. Brainstorming - A chat room/FB wall/discussion board/google > wave/Whiteboard like features where members can easily do brainstorming with > other interested members.

I have been thinking about it but just haven't been able to come up with a best way to do it. Would you like to talk sometime about it?

> 5\. Document Repository(Wiki Style) - For things like Feature List, Proposed > UX/UI Design pics, business plan, etc.

I will be pushing an update soon that will allow one to add different information about your ideas. It won't support attached documents yet but will allow one to better manage the researched information.

> 6\. List of Interested Developers,Designers,etc. (Followers)

This is in the works actually.

> 7\. List of implementation - Links of actual implementation of idea.

There is an example in the site already where a user got feedback on the idea, implemented it and then shared the implementation link in the comments. I agree it's different than what you are proposing.

Again, let me know if you would like to talk sometime.

<comment><AUTHOR> Sure. We can talk about this. I would think more about these features and let you know about it.</comment></comment></comment></comment>


Ask HN: Why aren't more native apps compiled for ARM aswell? - <AUTHOR> The new Microsoft Surface Pro X seems to suffer heavily from a lack of ARM-compiled apps.<p>I am not much of a developer (light web-dev) and do not understand why this is so hard to provide. Don't most compilers support ARM at this point? What prevents adoption at this point? Who's working on this issue? <comment><USER2> After you compile your app for ARM you'd also want to test it, but not many developers want to buy a separate ARM system just for testing for a small minority of Windows users.</comment>


Lyft moves San Francisco IPO roadshow as drivers protest - <AUTHOR> https://www.bloomberg.com/news/articles/2019-03-25/lyft-moves-san-francisco-ipo-roadshow-as-local-drivers-protest <comment><USER2> I'm not sure it's possible for ridesharing to be adopted en masse by consumers at a price point that would provide healthy wages to drivers. E.g. if a rider works 40 hours a week and uses ridesharing for 2 hours a week, for the driver to earn as much as them, they'd need to be spending 5% of their pretax income on the ridesharing, in addition to gas and car value, with a multiplier on top for ridesharing inefficiencies since drivers don't magically pick up new riders in the same time and spot that they drop off. Pool / line can help lower this cost but in my experience I've ended up just riding alone more often than not anyway.

Of course, that doesn't mean Uber and Lyft aren't taking an unfairly large cut of the revenue, further reducing drivers' earnings.

<comment><USER3> Is anyone expecting ride-sharing to be adopted by a majority of the population for everyday trips? My impression is that taxi rides are inherently transportation for the upper middle class or occasional necessities for anyone else, not an everyday mode of transportation for the masses.

<comment><USER4> I had hopes that multi-rider trips would catch on more. So 2+ passengers would split the fare. My commute is toward the city center like most of the single occupant traffic. And I don't need dropped off exactly at my place. Close is fine. (Last mile problem)

<comment><USER3> > _My commute is toward the city center like most of the single occupant > traffic._

This is the problem mass transit is ideally suited to solve. Hiring 1 professional driver per 2–3 commuters when there are thousands all going the same place is ridiculously inefficient. A bus can easily fit 10x more passengers.

<comment><USER5> I've only ever been impressed with mass transit in megacities like NYC. SF public transit left a lot to be desired. The muni was not worth the hassle and I did not have a bart station near my rented room in a house.

<comment><USER6> I used to avoid the Bay Area's buses like the plague for many years, but in the last couple of years I came to ride them a lot and have been pleasantly surprised.

They're really convenient, with buses being able to take me to within a five to ten minute walk from most anywhere within the Bay Area that I want to go, and even closer within SF proper. They're a lot quieter than the BART (where I feel I need ear plugs to protect my hearing), it's as clean or cleaner, and there are now apps like Citymapper which tell you exactly which bus to take and when to get where you're going.

My main gripe is that a couple of times buses just didn't show up at all when they were scheduled to arrive (not just late, but just skipped a bus).

NYC's subway system is definitely way better than BART in terms of having way more stops and going virtually everywhere, but it also has its own problems (like the stops being deadly hot in the summer and freezing cold in the winter).

<comment><USER3> Note that BART has gotten a lot quieter recently. [https://www.sfchronicle.com/bayarea/article/BART-rides- quiet...](https://www.sfchronicle.com/bayarea/article/BART-rides-quieter- metal-why-so-loud-13419926.php)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> They lost almost a billion dollars last year.

Doesn't profitability rely on eventually being able to replace drivers with automated systems?

I feel sorry for the drivers at that hotel.

</comment><comment><USER8> It's not a great experience to work for an algorithm.</comment>


Show HN: Pricing Freelance Projects - <AUTHOR> https://tomhir.st/pfp <comment><AUTHOR> Hi HN!

Pricing Freelance Projects is the book that I've always wanted to write, born through chance.

I've been freelancing as a web developer (WordPress/JavaScript) for the last 11 years.

When I began pricing my work, I did so without knowing:

\- What pricing methods to use

\- What to charge for my work

\- How to ensure that I got paid in line with what I was worth

As time went by, and with a keen interest in business, I started to study pricing heavily.

Through my learning, experience and experiments, I priced myself to a six- figure yearly freelance career.

Since my success as a freelancer, friends and other freelancers started to come to me for advice on their own careers, leading me to start sharing my thoughts on social media to help reach a wider audience.

In June 2020, I posted a Twitter thread summarising my thoughts on pricing freelance projects. It went viral.

The thread has received 37,100 likes, 11,200 retweets and over 3,000,000 impressions.

Freelancers, consultants, owners of agencies and entrepreneurs across all industries got in touch to offer their praise for the condensed version of my approach. Many people wanted to know more.

I'd already thought about writing a book on pricing for freelancers and this response was the catalyst.

I set myself a deadline and dropped everything to start writing. I set up a pre-order product on Gumroad to announce that I was working on the book.

The book received 229 pre-orders and generated $4,351 in revenue while I was writing it.

Now, Pricing Freelance Projects is here and I'm super proud of it!

It's ~30,000-words, across 135 pages, divided into 59 easy to digest sections. Available in PDF, ePub and MOBI formats.

You can check out a sample from the book here: [https://pricing-freelance- projects.netlify.app/pricing-freel...](https://pricing-freelance- projects.netlify.app/pricing-freelance-projects-sample.pdf)

Pricing Freelance Projects covers everything that I've learned in over a decade of pricing real-word freelance work.

Early readers have given 5-star reviews and I'm humbled at the level of interest my vantage point on pricing has received.

I wrote Pricing Freelance Projects because I see skilled freelancers every day who can charge more for their services.

I'm posting on HN in the hope that more of these people get to know about the book.

If you have any questions, please leave a comment, I'll be happy to answer them!

Cheers, Tom</comment>


Shaun Wylie obit (2009) - <AUTHOR> http://www.telegraph.co.uk/news/6389667/Shaun-Wylie.html

<comment><AUTHOR> I think Wylie's masterclasses are being reconstructed by the Royal Institution for their (the masterclasses) 30 year anniversary. This is of some interest to me, since Wylie is a Ph.D. ancestor of mine.</comment>


Update on Taking Tesla Private (Elon Musk) - <AUTHOR> https://www.tesla.com/blog/update-taking-tesla-private <comment><USER2> What does going private mean exactly ? Is it just delisting from nasdaq in tesla's Case ? Would they be allowed to keep any number of investors or just the top few ?

<comment><USER3> I believe they are planning on creating a holding company whose only business function is holding private Tesla stock. This makes it easy to crate a prospectus so that non-accredited investors can participate.

<comment><USER2> i wonder if companies will start doing this right from their ipo, and just list the holding companies instead of the whole company.</comment></comment></comment>


Ask HN: What is the most amount of people you have had on your site at one time? - <AUTHOR> Mine and my mates site GetInspired365.com has just been featured on BBC Click - http://t.co/0OmbHSSwuk - and were staggered to see we had 250 people on our site at one point. What's the most you've had on your site? Just interested to see as means of a comparison against other sites.<p>By the way, if you're able to get a small mention on BBC Click, we'd highly recommend it. We've seen some great triffic and feedback since our mention. <comment><USER3> Over a hundred thousand. I was the Senior Web Producer (head geek) at Bravo, the cable channel, and we did live voting during "Project Runway" first-run episode commercial breaks, where viewers would respond to on-air questions either through our site or through SMS. Vote tallies were displayed during later commercial breaks, after a competitor had been eliminated. People who voted would also be entered in contests to get prizes and their names splashed on screen during the live broadcasts.

Then we'd do it all again, live, for the West Coast airing of the episode, the same night.

Season finale episodes brought roughly a bajillion people to our site simultaneously, because everyone wanted to "participate" in telling the world which contestant they wanted to win the season.

Thank God for Akamai...

<comment><USER4> That's awesome! How many people it take total to run the operation?

<comment><USER3> In LA (Burbank, actually) we had one manager, two devs (me and a slightly more junior person), and two video editors who transcoded stuff almost on-the-fly and kept our online video library humming along. In New York (at 30 Rock) we had about four content and social media people, two designers, and a photographer.

This was about five years ago, so the set-up is a little more robust now. For example, they now have a CMS to manage web content, whereas we used to code and manage all our assets by hand. And back then they were too stingy to buy an extra server to automate a lot of the processes, so I actually had to stay late every week to literally "push the button" to make things go live in sync with the on-air broadcasts. All kinds of crazy stuff, on a shoestring budget.

But yeah, if you're talking about code stuff alone, we only had two actual coders/devs, me and another girl. Fun times!

</comment></comment></comment><comment><USER5> I'm curious about what you mean by 'most amount of people you have had on your site at one time'. This can mean a few different things...

1) For monitoring applications like Chartbeat, IIRC they count a user as concurrent if they are on the site anytime within the past 30 seconds. 2) I've seen real-time monitoring systems count a concurrent user as any visitor in the last 5 seconds. 3) Lastly, the only real raw numbers that I've seen are the traffic hits through an F5 load balancer to a set of backend servers, and that is the only number that will give you an unbiased # hits per second in real-time. Unfortunately, this amounts to requests (HTML) to the server and may not be a 1:1 ratio with users.

So in terms of what I've seen, it depends on the type of calls and the application. For the EA forums (forums.ea.com) which I was in charge of up until March 2013...

For #1, forums would regularly reach 15,000 on the launch of a new game. We would sustain that for ~12 hours [1]. On just an average normal non-event day, it pushes 3000 concurrents. For #2, I've seen something north of 3000 for EA forums. For #3, the F5 would report peaks of 200 requests per second.

When I built the Campus Wide Login (<http://www.cwl.ubc.ca>) SSO auth system for UBC about 11 years ago (still in use today) we would have almost 50-75% of the full campus using it at once, which is about 30k concurrents (unfortunately I didn't have access to the numbers over the F5 LB). However, most of these calls were for the HTML which then went through an SOA (XML-RPC, ugh) architecture, so I'm sure the req/s was much higher on the XML-RPC backend.

[1] this is a feat in itself because most of the forum data is not cached because the business wanted the data in real-time, so the read databases would receive a lot of traffic when the web servers spiked.

Edit: formatting

</comment><comment><USER6> Our company (www.radfan.com) was featured on BBC News Look North for 90 seconds (no web address mentioned so pure google searches) and I watched our google analytics real time climb to 1200 people simultaneous.

We were on BBC Radio 2 Drive Time the Friday before (web address mentioned this time) and we got about the same.

Shopify did an amazing job dealing with the traffic spike.

Good job getting on Click, that's awesome. We got lucky with the bad weather in March making our launch a relevant story.

<comment><AUTHOR> Thanks very much. And neat site - I actually have used this before!

<comment><USER6> No probs, good to hear!

For those interested in how an ecommerce site stacks up with traffic spikes, Shopify did a great job, the weak link was paypal. We had a good number of (potential) customers email to us to say that paypal locked up during payment, we were taking several orders a minute for a while there but still annoying that some were dropped.

One of our mailing lists also grew by 1200 names in 3 hours and Mail Chimp coped fine.

</comment></comment></comment><comment><USER7> From 1 to 20 then down to about 3 on average now. I've had my project (<https://writeapp.me>) on HN a few times but it really went nowhere. Recently however its been featured on MakeUseOf at least twice, Web Appstorm, and a number of other tech/teacher blogs.

Before the MakeUseOf article I'd get 3 to 10 hits a day with 1 visitor at a time. After the first MakeUseOf article it went to about 20 at a time for about a day. After that the site has been picked up by other blogs (some of them review it multiple times on different days) so the traffic has increased about 100% from pre-review levels and has been holding steady at about 100-ish visitors a day and 3 users at a time normally. Note that there are obviously periods in the day where its 0 because you can't have 100 uniques and 3 visitors on site at the same time all day. The math doesn't add up. I'm just talking about what I see whenever I check my analytics which is pretty often during the weekdays.

</comment><comment><USER8> My own homepage? 1 (usually me) The last big site I worked on? About 55,000 concurrent users on an average day before I left (now it's about 110,000).

</comment><comment><USER9> I used to be the tech lead for the UI and much of the infrastructure behind ovidsp.ovid.com. We regularly had 20000-50000 concurrent user sessions active. Each one had a dedicated backend process, so we had an exact count of active users. The UI served over 1 billion http requests per year... using a custom http server I wrote in Perl :)

</comment><comment><USER10> About 20 on average and 30 in rare occasions. It's a media player app for chrome with about 5k active weekly users.

[https://chrome.google.com/webstore/detail/achshar- player/fdd...](https://chrome.google.com/webstore/detail/achshar- player/fddboknafkepdchidokknkeidnaejnkh)

</comment><comment><USER11> Ten people at the same time is my max for a personal project (<http://sproutsheet.com> or <http://sproutshit.com> as the haters like to call it) when I linked it on reddit.

<comment><USER12> I really like the design! Nice concept!

<comment><USER11> Thanks, I found out that grower enthausiasts have a lot of data to remember so thought it would be a cool app to make. I noticed that cannabis cultivation is really big on the internet so asked a reddit community what app they would like. My first prototype looked like twitter but they didn't really care for that. They just wanted an easy way to link data to a certain date. Would also love to have some vegie growers on the site but it's hard to get a foot in smaller communities without looking like a spammer. Anyway it's not really a commercial project but I do get a kick out of people using and enjoying my website.

<comment><USER12> I wish I could have cannabis cultivation in the UK, but unfortunately it's illegal. I've been pondering whether I should start a basic kitchen garden type thing and your app just gave me a reason to!

<comment><USER11> I've been thinking of growing indoor stawberries. Can never have enough strawberries. Red Alpine strawberries gives you fruit the whole year through. They are a bit smaller but they look awesome: <http://imgur.com/8JzBPVr>

</comment></comment></comment></comment></comment><comment><USER13> I had about 180 according to Google Analytics for [http://maxburstein.com/blog/python-shortcuts-for-the- python-...](http://maxburstein.com/blog/python-shortcuts-for-the-python- beginner/)

It was at the top of Hacker News and /r/programming for a little bit. It stayed pretty constant at that level for about half the day.

My first post to get over 120 users at a time was <http://maxburstein.com/blog/creating-resume-using-latex/>

It was at the top of /r/programming with over 1000 points so it was also getting some traffic from /r/all.

</comment><comment><USER14> My side-project (<http://www.quizme.se>) got posted to a decent sized facebook-group and peaked at 400 active visitors. Then the postgres-server stalled at 100% CPU-usage and the site went down. I was at day-work and could not do much about it.

The hourly graph from Google analytics looks like this: [https://www.diigo.com/item/p/podoedezbpdaaccrczbabdsacq/05eb...](https://www.diigo.com/item/p/podoedezbpdaaccrczbabdsacq/05ebb740128f9f599c8e4caed72a27f3)

</comment><comment><USER15> It depends on where I pull the traffic from: when I post on social networks, like Tumblr, I usually get at most 3 concurrent at a time. If they come from direct source they are usually more spread around the clock also due to their time zones differences. The peak I had was when I wrote a comment on the Sex channel on Reddit right after the launch of my platform (<http://www.sexycrets.com>) a few months ago.

</comment><comment><USER16> 178K is the biggest I can find a screenshot proof of: <https://pbs.twimg.com/media/Aa7f-uvCMAQF1th.png>

Thats on one site out of 8 that share the same cluster/platform, so the net total would have been in the mid 200K's.

edit: props to chartbeat for even being able to track such things, I'm just scaling reads, they're scaling writes.

</comment><comment><USER17> My site made it to #1 on hacker news last wednesday for a couple of hours. It peaked at 287 concurrents. Unfortunately, I wasn't expecting that kind of surge and only had it on a small linode, so it couldn't handle the traffic. Since then, I've moved it to an S3 bucket with cloudfront as a cdn. <http://www.appraptor.com>

</comment><comment><USER18> I was one of two developers on a social media network in Norway, at peak hours (from about 20:00 till 22:00) we had 60.000 unique users with activity within the last 10 minutes. This generated about 400 dynamic req/s and about 6000 static req/s. We managed this sustained traffic with a total of 12 webservers (apache + memcached), 4 databases (mysql) and 6 Varnishes.

</comment><comment><USER19> Main Site: Around 2000 IIRC, before it crashed, anyway. This was back in the days of Digg, and less robust hosting. Average is 150-250 at a time, less at night, more during the day.

Micro-Site: We set up an experimental just-for-fun site with a bit of a viral edge and got 1.1 million visitors in one day, mostly from China - <USER2> apparently front-paged on a few major sites over there.

</comment><comment><USER20> When one of my articles made it to the #2 spot on Hacker News, I was watching my Google Analytics Real-Time stats pretty closely. It got as high as ~700 people on at one point. (Here's the submission: <https://news.ycombinator.com/item?id=5062761>)

<comment><USER21> Our recent post on the Webpop blog about a/b testing a puppy photo (<http://www.webpop.com/blog/2013/04/16/can-a-puppy-sell-a-cms>) got to #2 as well.

Sat at a pretty constant 250 online visitors for hours. Pretty sure the brief peak must have been close to 700 as well.

Fortunately Webpop is built to handle that kind of traffic, so we never had to worry about the site crumbling under the load...

<comment><USER20> Yeah, I'd be curious to see traffic data from people who got to various spots on the front page and see what trends emerge.

Though, now I'm remembering that the post was also on /r/webdev and /r/web_design, so that skews things a bit.

</comment></comment></comment><comment><USER22> No idea how many at one time however I did get 50,000 hits for a post on my blog that sat in the HN top 10 for most of a day. That's like 34 hits a minute so I can safely assume I must have hit at least 10 at a time at some point during the day.

</comment><comment><USER23> We had 390 users at one point when we hit the HN frontpage for a very short time for this post

[http://statspotting.com/pgs-hidden-message-in-hackernews- alg...](http://statspotting.com/pgs-hidden-message-in-hackernews-algorithm/)

</comment><comment><USER24> I think somewhere around 6000. Is there a way to see this easily on Google Analytics?

Also you have to precise. I was removing a real visitor after 30 seconds. Some websites I know are doing it after 2 minutes... It changes your numbers a lot.

</comment><comment><USER25> 284 just from someone linking to us on a comment thread on Reddit: <http://imgur.com/M6oiypj>

my site: <http://www.flipmeme.com>

</comment><comment><USER26> 4500+ on a small "4 hour venture" project of mine. could ahve climbed to 5 or 6k, but the server crashed before. <http://imgur.com/ossUOZR>

</comment><comment><AUTHOR> Clicky's - <http://t.co/0OmbHSSwuk> (BBC Click) Our site - <http://GetInspired365.com>

</comment><comment><USER27> 30 at a time from some small subreddits on my site <http://poemr.com>

</comment><comment><USER28> Congratulations on the BBC Click feature!

Around 2500 on www.kayako.com after a particular newsletter went out to our customers.

</comment><comment><USER29> around 3000 for a half hour or so when Blink-182 pushed out content to their social channels (Facebook/Twitter) using our site. Have also had slow build up to 2800 when one page went viral. The site/app is <http://backspac.es>

</comment><comment><USER30> Nearly 1500 concurrent visitors on a blog post that got to the top of HN quite a while ago.

</comment><comment><USER31> Google analytics real time showed 22-25k during its peak daily

</comment><comment><USER32> ~3k when a Facebook app we were working on went viral.

</comment><comment><USER33> s/triffic/traffic

</comment><comment><USER34> one</comment>


Rate-limiting State: The edge of the Internet is an unruly place - <AUTHOR> https://queue.acm.org/detail.cfm?id=2578510

<comment><USER2> So, Source Address Verification is impractical because the beneficiaries are not the same as the implementers. But when it comes to rate-limiting by reflection targets a la DNS RRL, somehow altruism _is_ economically viable? Pick one!

<comment><USER3> The real problem is probably that you can break a network with source verification, but RRL is zero risk.

<comment><USER4> Do you mean something by "break" a network that is distinct from the game theoretic distinction Vixie is already drawing?

Are you talking about something specifically technical like VPN technologies, or something entirely different? It's not like the ocean of CPE devices Vixie references are all trying to advertise BGP routes.

<comment><USER3> I'm specifically not talking about CPE devices. Nobody cares about the network configuration on a 2Wire gateway.

I spent several years working on backbone DDoS stuff (I was the lead dev at Arbor Networks for Peakflow DoS, starting at version 2) and I remember large networks having trouble getting address verification working non-disruptively. Of course, the tool they had for it at the time was reverse path filtering; maybe things have gotten better since then.

<comment><USER4> My credentials involve being there when everyone hated SCO. I commented on the only other thread in this post because it's a legitimately good question: Who is Paul Vixie trying to convince here, and of what?

It seems that RRL can be applied _simply_ to other stateless non-DNS protocols. My interpretation of Vixie's argument is that adding RRL to the majority of stateless protocols is marginally less impossible to implement than global SAV.

The question of pluralities versus majorities really matters when examining _techniques_. Bringing game theory into it really seems to help. e.g. Why bother figuring out a better method than reverse path filtering, if you _require_ 2/3 of the global network to adopt the technique before the benefit kicks in?

<comment><USER3> Three thoughts.

First: Vixie is in the middle of this amplification stuff because he's one of the Internet's foremost lobbyists for the most convenient amplifier of all (DNS->DNSSEC). So maybe he's just, like: "I'm tired of responding to people's claims that DNSSEC is going to make DDoS earlier and instead would prefer to rewrite the terms of the debate so that the presumption is everyone was supposed to have this rate-limiting band-aid all along".

Second: Don't overthink it. He's got a slot in ACM Queue, so maybe he just wanted to fill some column inches. "Free associate: what am I thinking about right now."

Third: This is all pretty silly. Even if you got global deployment of address verification AND every stateless protocol was rate-limited, it would still be trivial for attackers to launch vicious, debilitating DDoS attacks.

<comment><USER4> 1) It's extremely difficult to reason about (DNS -> DNSSEC) _in terms of a DDoS_ considering how many security protocols assume NTP exists.

2) I'm not, but this was posted 18 months ago, so I'm just thinking about the "global discussion" in general.

3) The fundamental argument Vixie is making is about tradeoffs. The _impossibility_ of global SAV is an argument in favor of the _difficulty_ of widely deployed RRL. It is an argument of spending the effort on something that might be accomplished.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> What is the point of this article?

I mean this in the nicest way possible.

<comment><USER4> Protocol design is popular "these days" so everyone eventually chooses UDP, and reimplements a subset of TCP in their own protocol. (edit: not everyone needs state in their protocol, but everyone needs to implement rate limiting)

If you're unaware of a large interest in protocol design, or don't understand the cost and complexity of DDoS attacks, what point were you looking for?

<comment><USER5> The information density seems uncharacteristically light to me (compared to other Vixie articles).

<comment><USER4> If Vixie can simplify his message to Stallman-level clarity, how would that be a bad thing?</comment></comment></comment></comment>


Compromised Linode, thousands of BitCoins stolen - <AUTHOR> http://bitcoinmedia.com/compromised-linode-coins-stolen-from-slush-faucet-and-others/ <comment><USER3> " _As a respected hosting provider, I hope they do the correct thing and refund me for this liability due to their error. Many people trust Linode, and they have proven themselves as a serious contender for hosting critical sensitive operations on the internet. I would hate to not see them live up to that reputation._ "

"hosting critical sensitive operations" in particular. If you are doing "critical sensitive operations" you need a more secure solution and process which will cost you more money.

Under no circumstances can a hosting provider assume the liability for something like this.

The tradeoff you make for the low cost you pay is that you might have an issue like this because someone screws up.

You pay more for a safe to store your money (and for a safe deposit box to store your valuables) because it's important and you understand the risk involved in not doing that. If you have valuable jewelry many times the insurance company will only insure if you keep it in the safe when you are not wearing it and even the amount of days is specified when it can be out of the safe.

It's unreasonable to expect (and linode's contract clearly states as other's have mentioned) a hosting provider to have a liability over what you are paying them. Edit Add: Unless you specifically have an agreement in advance or that is what they promised or charged you for.

Before anyone reacts to this with any harsh criticism please think for a second what liability you would want for any mistakes that you make with your web startup or idea. You could either be charging zero or charging a small $5 to $20 per month charge. You might make a mistake. Are you willing to accept and even be able to insure for thousands or even millions in liability for those mistakes?

<comment><USER4> "please think for a second what liability you would want for any mistakes that you make with your web startup or idea"

It seems to me that bitcoin wallets are a relatively new and not well enough understood risk. There are very few other "files" like them, in that an attacker copying them can deprive you of their value in a way that you cant protect with backups. I feel a big part of current "internet security best practices" are about minimising the risk of getting exploited - but with a pragmatic limit to how much effort you invest mediated by the excuse of "if we _do_ get rooted, we can always reinstall and recover from backups". It'll only cost you time, and perhaps some reputation, and may put assumed-private-to-you information in someone else's hands, but it hasn't deprived you of access to any of your data. That doesn't apply to bitcoin wallets, and example like this are pointing out flaws in assumptions people are making about appropriate ways to manage them.

It'd suck to be "that guy" who provides the object lesson in why we need to think differently about bitcoin wallets to just about any other file type we might put on an internet accessible machine, but we _do_, and I don't know whether we have an answer to the question "Is there a way to secure a bitcoin wallet on a machine someone else has root access to (either your datacenter's staff with physical access, or the people with hypervisor access to the hardware your vm is running on)?"

I _think_ the answer is "if you can't trust those people, you can't risk storing your bitcoins there". There's a reason people keep their money in banks, and not in train station luggage lockers. I'm guessing inexpensive commodity VPS's should be considered closer to storage lockers than bank vaults. I suspect the finance sector and/or fortune500 companies have hosting arrangements with companies offering bank-vault grade protection and reserve bank style insurance - but sure as hell not at $24.95/month.

<comment><USER5> I don't see what's so conceptually new about bitcoin wallets. They're just plain text that you don't want people getting access to. It's no different than storing passwords in plain text: if someone copies them, they're completely compromised (until the user changes them). The solution is pretty simple: encrypt your own bitcoins with your own password (or more ideally, your private key). Then, if someone hacks your server, they don't get anything.

<comment><USER6> Sorry for asking a noob question.

But what really is a bit coin? I mean in physical existence. Is it just a file(plain text) with some data/metadata?

And stealing it means copying those files, and then deleting the source?

Which in case how is this any different than traditional bank account. My money in the bank is basically DB record. And that can be stolen.

The bank can then just say to every one 'look this transaction from db such and such is no longer valid'.

Can't bit coin do the same? I guess I'm missing something fundamental.

Can somebody explain this?

<comment><USER7> A 'bit coin' is a space on a block chain that everyone has a copy of. You lock the coin with a cryptographpic key, which you need to store. Whoever has a copy of the key can unlock the bitcoin and re lock it with a different key, such that now only the new owner has a copy of the key. Everyone can still see the entire block chain, but only one account (that no one knows the owner of) has the ability to move that coin.

So they got access to these peoples keys and transferred ownership of the coins.

Most money supplies are regulated, but bitcoin isn't regulated. No one has the ability to say 'reverse that transaction', but it also makes the currency safe from inflation and interference by money printing governments and privacy snoops.

<comment><USER8> _makes the currency safe from inflation_

There's an economic myth that inflexible supply of a commodity gives that commodity when treated as money, stability. It does not, as looking at this graph of US inflation/deflation time shows (1944 is when the dollar stopped being gold convertible):

[http://en.wikipedia.org/wiki/File:US_Historical_Inflation_An...](http://en.wikipedia.org/wiki/File:US_Historical_Inflation_Ancient.svg)

A few points:

1\. The money supply around a currency not only contains the mined/minted instances of that currency, but also liquid currency-denominated assets, like customer bank balances. So money supply is not necessarily bounded.

2\. Inflation/deflation can be considered measures of the change in demand for the currency. In times of deflation, holding money is valuable because it becomes more valuable.

3\. From the above graph, you see that during the gold standard, inflation tended to be mostly balanced out by deflation in the long-term, so long-term inflation was low. But in the short term, prices were very unstable as inflation jumped all over the place, and far more unstable even than fiat money in the past three turbulent years that we've seen.

4\. From the point of view of an economy, inflation and deflation are not symmetric; because of the value of sitting on money during periods of deflation, savers do not tend to invest their money but move money from investments to cash savings. This undermines economic activity. But in an economy with a rich range of investment opportunities, moderate inflation does not penalise acquisition of money and does encourage investment.

If you want a non-performing store of value and don't mind big fluctuations in value, gold is there and we know how to secure gold rather well. Bitcoins are another non-performing store of value with far more drastic fluctuations in value, and securing it involves the double vulnerability: physical security of storage media, information security of computations involving bitcoins. And it is much easier to accidentally lose bitcoins than gold, pirate tales notwithstanding.

<comment><USER9> > physical security of storage media, information security of computations > involving bitcoins

Only funds that you have daily access to need be vulnerable to the latter point, as physical security (air-gapping) is sufficient when you do not need to -send- funds.

> And it is much easier to accidentally lose bitcoins than gold, pirate tales > notwithstanding.

Strongly disagree. Can you keep N redundant copies of your gold? Combined with secret splitting, you could require that at least K of N secure locations be accessed.

<comment><USER8> > Only funds that you have daily access to need be vulnerable to the latter > point

I'm talking about protocol risk: e.g., the software that implements the protocol on some machine is flawed, so the cryptography can be effectively breached. Or there is some issue with the protocol, like but worse than the issue Kaminsky found with anonymity.

>Can you keep N redundant copies of your gold?

Have you ever found that your backups didn't contain what they were supposed to contain?

Gold gets stolen, but besides such things as costume jewellery, I think it doesn't often get lost.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> So, a customer service interface was compromised via stolen credentials and used to access various Linode instances. A couple questions that immediately come to mind:

1\. Can this interface be accessed from anywhere on the Internet? If so, why? If not, does that mean other systems owned by Linode were compromised as well?

2\. Why can customer service representatives access and update servers without the client being notified and with minimal logging?

<comment><USER11> Regarding #1, an update from Linode was just posted:

"Our investigation has revealed a customer support interface was used to access your account. The compromised credentials have been restricted and we are discussing policy changes to prevent this from recurring."

<comment><USER12> I'm a Linode fanboy, but we need maximum transparency on what occurred and what's being done. What support interface? How compromised? Who's credentials, etc.

<comment><USER13> Hopefully they're working on it, and will give a post mortem once they get it sorted out. I'm inclined to show patience and not demand they do anything other than ascertain the scale of the breach, alert those affected, and secure their systems at this point. Later, they can get into what happened and how they will avoid it in the future.

<comment><USER14> We can't wait for a full postmortem before Linode says anything.

Linode can't just leave us all wondering about our own security while pouring over over someone else's Pastebins.

</comment></comment></comment></comment></comment><comment><USER15> The OP's tone clearly indicates that he expects some compensation, Linode's TOS are pretty clear: _Therefore, subscriber agrees that Linode.com shall not be liable for any damages arising from such causes beyond the direct and exclusive control of Linode.com. Subscriber further acknowledges that Linode.com's liability for its own negligence may not in any event exceed an amount equivalent to charges payable by subscriber for services during the period damages occurred. In no event shall Linode.com be liable for any special or consequential damages, loss or injury._

This also provides an interesting dilemma when it comes to such events. In this case the damage is relatively easily quantifiable, he got X bitcoins stolen so the damage is X times the bitcoin value at that time. Still, it could have easily been user personal data or credit card information, which would have made an evaluation harder to make.

One of the risks of using such a platform I guess and something that anyone who does it should consider.

<comment><USER16> This is why insurance exists.

I wonder if there are any insurance providers who'd be willing to provider coverage for this sort of event.

<comment><USER3> Insurance won't insure for what they don't understand and build a risk model for. I can assure they won't understand something like this for a very long time.

<comment><USER17> I'm not sure they need to understand bitcoin specifically to build a risk model, wouldn't they just need general data on losses suffered by various internet hosts due to hacking attacks? Doesn't really matter exactly what is stolen as long as they have a corpus of data on the value of everything that is stolen in this manner. Bitcoin wallets probably fit somewhere in the payoff curve for that.

</comment></comment></comment></comment><comment><USER18> Please people (not corporations w/ staffs), _do not_ run critical systems in the cloud.

Get a dedicated server (not cheapest you can find) and secure it with:

(install in this order)

APF - <http://www.rfxn.com/projects/advanced-policy-firewall/>

BFD - <http://www.rfxn.com/projects/brute-force-detection/>

rkhunter

Ideally, install rkhunter on fresh system, right after updates, APF, & BFD. Then update the binary check-sums with this command, _if you know server is secure_ :

Update file properties: # rkhunter --propupd --sk

Run a system check to make sure it is known clean: # rkhunter --check --sk

Lastly, sign up for the security alert mailing list for your version of linux on your server.

If you want maximum security, be sure to password protect your boot loader and use an encrypted file system. _This will make it very difficult for ISP to work on your server however!_

<comment><USER4> And, I'd add "if any of this is news to you, you should _seriously_ question whether you're skilled/competent enough to be admin-ing publicly accessable servers with files (like bitcoin wallets) that can be valued in the thousands (or tens or hundreds of thousands or more)".

</comment></comment><comment><USER19> Hmm, for a customer of a cloud provider, this sort of thing will be _very_ hard to defend against.

Maybe if the customer service system had had two-factor security, this might have been avoided (i.e., customer service can access your account only if you read them your hardware token's code).

Requiring SSL/SSH client certificates even for intranet accesses might have deterred this attack.

I hope other cloud providers take note of this incident. This is a very interesting incident.

<comment><USER20> Actually not. Just use a loopback cypto FS to store the sensitive stuff. The reason they had to reboot the machine is that they just had access to the HDD where they could change the password, as opposed to having live root access.

<comment><USER21> where do you keep the key to the crypto fs?

<comment><USER18> Written on a scrap of paper in your wallet. _only_ the password and no other info should be on the scrap.

If you can memorize it, it is a bad password.

<comment><USER22> That's not strictly true. If you're careful and imaginative, with moderate effort you can commit a fair amount of highly random data to memory. You just can't expect to change it every month.

This may be oversimplified, but it's the correct horse battery staple.

</comment></comment></comment></comment></comment><comment><USER23> How many times does something like this have to happen before people learn to encrypt? Any serious business or financial data should be encrypted, period. Almost all of the major hacks we read about could have been minimized if not entirely avoided if the data was encrypted.

I just read the release from Bitcoinica where they explained that the server accessed contained _only_ Bitcoinica's "hot wallet", and that no code, services, customer data, or other wallets were stored on the server.

If this was the case, why couldn't every access to that wallet, which, assuming the above is true, necessarily occurs on other servers, run a decryption on the file first? Even if you keep the passphrase and/or secret key in plaintext on the machines that run the code, the separation should prevent this kind of rogue access as long as the intrusion is isolated as these people claim.

There is really no excuse just to have a plaintext wallet sitting around anywhere anymore (the official bitcoin client now supports symmetrical encryption). Like credit card numbers, when a wallet is accessed it should be decrypted in ethereal storage like RAM and promptly discarded; it should never hit disk as plaintext. At least the same practices used for PCI compliance and credit card data should be used for btc wallets; preferably better since there is no recourse if your btc wallet is compromised.

<comment><USER24> >If this was the case, why couldn't every access to that wallet, which, assuming the above is true, necessarily occurs on other servers

From the sounds of it, this was that other server. All it did was operate on the wallet. And if they used other servers, then those would have been the target of the attack.

And, no matter how much damn encryption they have, they rooted the box that operates on the decrypted data, thats game over. The only attacker you would be able to thwart with more encryption would be the one who is able to root a linnode VPS, but unable to extract the key or decrypted wallet from from software _running on that box_. Sure, there is probably some number of attackers in that space, but security is a game of diminishing returns, and there are different security measures to take that are a much better investment of time than stopping that small slice of people.

<comment><USER23> My reading was that the Linode with the hot wallet did not contain the software that operated on it. Perhaps it did, in which case you are right.

</comment></comment></comment><comment><USER25> I'm not really sure why people are trying to store bitcoins on a VPS in the first place. You can't process credit cards on a VPS and be PCI compliant (it's against the rules), but any moron can do what they want with bitcoins.

<comment><USER26> But all that regulation is evil and it's the freedom of bitcoin that gives it the power*

*for hackers to get away with the entertaining virtual train robberies we've seen in the last year

<comment><USER27> Show me your wallet with a good amount of cash and leave the room for a while.

Afterwards, let's talk about your comparison. Is 'can be stolen' really something that the state can protect you against? Let's discuss it over dinner. Depending on the contents of the wallet I'd pay.

On a more serious note: Your mockery, while amusing, is unrelated to the problem at hand. 'Stealing amounts of $currency from private persons' is not a new idea or something that bitcoin is supposed to change?

<comment><USER28> What state? PCI DSS is _private_ regulation.

<comment><USER27> Two problems.

1) I don't think PCI is relevant here. If you store bitcoins somewhere and they get stolen then this is, in my world, cash. It's your very own digital cash. Not a credit card. That's why I constructed a (probably poorly implemented) example of someone leaving a wallet full of shiny $currency notes out there.

2) 'What state?' WTH? Can I reply with 'What kind of question is that?' The state I'm coming from is called 'Northrhine-Westfalia' [1]. Now I'm living elsewhere and there are no 'states' here. I can offer the district 'Tel-Aviv'? The point is, 'what state' is invoking aggressive feelings towards your US- centered mindset.

1: <https://en.wikipedia.org/wiki/Northrhine-Westfalia>

<comment><USER28> Oh, FFS. I meant "what state?" as in, "why are you talking about the state?", since _you_ said:

        (...) something that the state can protect (...)

and since the PCI (which was what we were talking about) is _private_ , it doesn't make sense to talk about the State.

 _US-centered mindset_

The fuck? Firstly, I'm European. Secondly, I assumed you were talking about the State[1], not a particular state.

[1]: <https://en.wikipedia.org/wiki/State_(polity)>

<comment><USER27> First and foremost: I'm sorry. We clearly didn't talk about the same thing and I misunderstood what you wrote.

My take: Someone was mocking Bitcoins with "But all that regulation is evil and it's the freedom of bitcoin that gives it the power" and I tried to make a point saying that _no regulation is involved here_ (laws? certainly). This is a wallet, it got stolen. Your credit cards are protected, your cash is gone for good.

You invoked PCI and I was (and am) unable to make the connection, maybe again because of a misunderstanding? I'm talking cash. Bitcoins are cash in my world (or - at least their value is equivalent to cash, if you choose to sell them).

From there we went downhill and I overreacted. Yes, for me 'state' is exactly what you posted. Again, sorry for the lapse.

<comment><USER28> Well, I'm sorry for the confrontational reaction.

I invoked PCI because of the thread: the original post was from klodolph, who said:

 _(...) You can't process credit cards on a VPS and be PCI compliant (it's against the rules), but any moron can do what they want with bitcoins._

And to that gravitronic replied:

 _But all that regulation is evil and it's the freedom of bitcoin that gives it the power(...)_

"All that regulation" only makes sense if gravitronic is talking about PCI, which was the only regulation cited by klodolph.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> Update: the Linode compromise first reported was that of the "slush" mining pool (mining.bitcoin.cz), reporting a loss of 3094 BTC. Second report was the donation-funded bitcoin faucet, reporting a loss of all of its 5 BTC.

Third report is the biggest, Bitcoinica.com which is arguably the second- largest exchange. Their main site is hosted at rackspace, but their 'hot wallet' was hosted at Linode, and contained 10,000 BTC which were stolen.[1]

1: [https://www.bitcoinica.com/posts/warning-please-do-not-re- us...](https://www.bitcoinica.com/posts/warning-please-do-not-re-use-and-old- bitcoin-deposit-addresses)

EDIT: Those not following this incident on the bitcoin forums might be amused that the attacker used the stolen bitcoins to form a transaction with a size of 1337 bytes. That's probably not a coincidence, since the size of bitcoin transactions are usually under 1kb.

[http://blockchain.info/tx- index/2893660/d9804de366aa4c2a0156...](http://blockchain.info/tx- index/2893660/d9804de366aa4c2a01565c3a3c8aa2ea20baafc276dc875f80b9044841205333)

</comment><comment><USER30> > Although passwords are stored using SHA1 with a salt,

Where's the bcrypt/scrypt/whatever police in this comments thread?

<comment><USER31> I already asked in the comments of the original article how many rounds of sha1 are used. SHA-1 still isn't the best, since it yields to FPGA attacks, but a single round can brute-force all 8 character passwords in less than 2 days on a GPU. My guess is that 10k rounds of sha-1 would probably not be feasible for non-dictionary attacks without specialized hardware.

<comment><USER32> The article mentions salted SHA-1, which is much more resistant to attack.

Obviously, more rounds and unique salts per user would yield better results, regardless of the hashing scheme employed.

<comment><USER33> You can salt all you want, but an 8 character password with a single round is going to fall very, very fast. Salt, being public, has nothing to do with it.

<comment><USER34> It does however mean you have to spend two days per password, rather than two days for the entire user base, or ten minutes with a pre-existing lookup table.

<comment><USER35> No, consumer GPUs can do almost a billion SHA1 hashes per second now. We're talking seconds to minutes for "complex" passwords, not days.

<http://codahale.com/how-to-safely-store-a-password/>

</comment></comment></comment></comment></comment></comment><comment><USER36> How did the attackers know what they were looking for. I'm going to assume that it's a small minority of linode users who have bitcoins on their machines. How were just these users targeted so accurately? What tied together knowledge they used bitcoins to those VMs and their linode accounts?

Also, was the nature of the attack just that the were able to login to your linode admin panel and from their root the machines and then loot your wallets?

<comment><USER27> >Also, was the nature of the attack just that the were able to login to your linode admin panel and from their root the machines and then loot your wallets?

The way I understand it the attackers were able to get access to the admin panel and invoked some kind of 'change root password' emergency stuff. The machines were rebooted it seems, which makes sense: The interface of Linode has probably/hopefully no access to the root password. Maybe this 'Reset my root' feature (now I'm guessing) reboots the machine in single user mode or passes init=/bin/sh to the kernel to reset the password once and reboots again afterwards.

Only THEN the attacker had access. But yes, he had root. The good (if you want to call it that) part of it is that this procedure rings every alarm possible. The real owner doesn't have the password anymore, as he'll soon figure out. It's everything but sneaky.

I DO wonder why root is allowed to log in at all, though..

<comment><USER37> I disabled root login when I was setting up the server. Could my server be affected too?

Also admins that only log with ssh keys and don't use root won't be able to notice that, will they?

<comment><USER38> Probably. You disabled root login how, via the sshd_config file? If so, you're still screwed.

Even if you fully disable root, that's not going to stop the init=/bin/sh script.

Even if you fix that (securing grub?) you're still screwed because it's a virtual machine, and they can just mount the partition to another VM, and pull all your data/reset root that way.

So, maybe if you have an encrypted partition, no root access, secure grub, and real hardware (it's probably possible to dump the VMs memory by snapshotting it, then pulling the key out that way), you would be secure against attacks like this.

With a VM? No, it's not nearly secure enough for very important things.

<comment><USER27> Well, having the whole disk dm-crypted is kind of secure I guess. At least I still have no idea how I get at my ssl certification keys from startssl, although I have a dd of that drive in question from the vps provider. I was just too clever thinking of a long passphrase and too stupid to keep at least a hint around somewhere..

Total dataloss for me. But i fyou _do_ remember your dm_crypt password, I think you're safe against these kind of attacks

</comment></comment></comment></comment></comment><comment><USER39> It sucks that money was lost but I can't help but to shake my head at someone keeping something like that on a cheap VPS. It's just stupid to think that was at all safe. That's something you should do on your personal computer where you can assure your security.

I'm not really sure if the author of the article expects to be compensated but if so, he's dreaming. Just read through their terms.

Next time he won't be so ignorant as to put something so sensitive on a server like this.

</comment><comment><USER40> Bitcoinica just reported losing 10K BTC (worth $50K USD) in this same incident. \- [http://bitcointalk.org/index.php?topic=66961.msg778254#msg77...](http://bitcointalk.org/index.php?topic=66961.msg778254#msg778254)

<comment><USER17> Saw that too. In past discussions on HN, Zhoutong said he hosted it at Heroku, but apparently they keep the 'hot wallet' alone on Linode instead for some reason, and use that to enable instant withdrawals.

At least Bitcoinica is eating the loss, it's not client money that was directly stolen.

</comment></comment><comment><USER41> It's quite possible that the attacker has been using the support admin login details for much longer against Linode, without being noticed, until now.

What sort of defenses can developers put in place to protect against admin panels?

I've used these sorts of techniques in the past:

1) Separate username/password system compared to the regular website 2) IP whitelist of who may even access the admin panel 3) Failed login attempts send an e-mail alert with a log entry

Any other recommendations or suggestions?

</comment><comment> dale-ssc We install a little script that runs at boot up to page us if /.expected- reboot isn't present (or removes it if it is). Then, to reboot systems, we run expected-reboot, which is a tiny script that touches /.expected-reboot before calling shutdown.

Wouldn't have prevented this but would likely have paged this unfortunate soul when his machine rebooted unexpectedly.

</comment><comment><USER42> As a Linode customer, I'm really looking forward to hearing out their side on this issue

</comment><comment><USER40> Forum thread regarding this: <https://bitcointalk.org/index.php?topic=66916.40;all>

<comment><USER43> The comments calling for 'tainting' of stolen bitcoins and blocking their exchange will be the end of bitcoin. The anonymity of bitcoin is only due to general laziness. What happens when the market figures that out? Bitcoin's byzantine agreement is novel, but its crypto is crap.

</comment></comment><comment><USER44> This is obviously an unacceptable incident. I don't understand how the author can write:

 _Especially upsetting is that I went to great pains to keep everything as secure as possible._

When that's plainly not true. Surely having a wallet stored on a VPS is a _really bad idea_ , what with admins potentially having full access to hard drive contents? Wouldn't a PGP'd local copy be a better solution, or am I missing a trick?

</comment><comment><USER45> This reminds me of a situation when I first signed up for linode... my password on my account inexplicably changed one day(I use lastpass so no I did not type the randomly generated password wrong). I contacted support and they fixed it, but I still remember questioning why or how...

</comment><comment><USER46> I am off to store some cash in my car and put all my important docs in a bus locker. BRB.

</comment><comment><USER47> Without passing too much judgement........ it's common sense that as your revenue goes up, the time and effort put into ensuring you are on an appropriate platform should go up as well.

Because sh*t happens...... whether we like it or not. Even if the technical requirements are light and it runs fine on a tiny linode, that might not be the right place from a security or integrity point of view, depending on the value of the app.

(for me, a digital wallet worth that much, I'd want at my home..... where I can control it)

</comment><comment><USER48> The title reads like a title one would expect from the future.

</comment><comment><USER49> Since my $1,000 worth of bitcoins dropped in value to $150 over a period of weeks, I've become significantly less interested in using it as a currency.

<comment><USER40> You mean less interested in using it as a way to profit from speculation. As a currency it is not as critical that the value only goes up.

A person or merchant receiving bitcoins can easily convert them out to USDs and still lose less in fees than the same transaction would cost compared to accepting a credit card or debit card payment. For example, BTC -> USD at most exchanges is around half a percent.

<comment><USER50> It sounds like Bitcoin is doing much better in the "Medium of Exchange" side of the money coin than the "Store of Value" side.

<comment><USER51> Which is not saying much, because if you try to avoid volatility by doing a USD->BTC->USD transaction you get hit with fees that are almost as much as credit cards, not to mention the complexity.

</comment></comment></comment></comment><comment><USER52> Could this have been a vulnerability in Lish, which can be run from a browser using Linode's AJAX console?

[http://library.linode.com/troubleshooting/using-lish-the- lin...](http://library.linode.com/troubleshooting/using-lish-the-linode-shell)

I've completely ruined networking and disabled root logins on a Linode VPS, but could still access that same VPS as root using Lish.

</comment><comment><USER46> Linode compromised! That is important news that concerns me. If the headline didn't mention the BitCoin scam that HN is always pumping would it have made it to the front page? Certainly haven't heard anything from Linode :-(

<comment><USER28> Sigh. Please give me a definition of 'scam' that fits with bitcoin and not e.g. Apple or Google shares.

Hint: In a scam, there's deceit. The bitcoin devs never deceived anyone. The whole system is transparent, so if there's anyone who bought without understanding the risks, they have no one to blame but themselves.

(Note: No, I don't own any bitcoins).

<comment><USER46> Perhaps I am just cynical. I did not mean to suggest the devs were scammers. But I still believe the ecosystem as a whole reeks of pyramids and other scams and I am sick of reading about it. I also think Scientology and MLM are scams but there are people who think they are not and we can't all agree. But then I also think casinos and lotteries are scams so I am kind of outside mainstream opinion on a few things I guess.

<comment><USER28> I was probably too harsh, but frankly, just as you're sick of reading about it, I'm sick of every single thread on bitcoin having that inaccuracy. What can I say, I'm literal minded - the misuse of words annoys me.

 _But I still believe the ecosystem as a whole reeks of pyramids and other scams_

Oh, sure, that's kind of inevitable, it's a result of the lack of constraints and oversight. But personally, it's a part of why I like reading about it - <USER2> still has that feeling of a "wild west", populated by pioneers and thieves. Kinda like the Internet as a whole a few decades ago. Of course, it also means I wouldn't trust it with my money.

 _I am sick of reading about it._

Sorry, but then... why not just skip the link? There are a few topics I'm kinda sick of too, but I just ignore them.

 _But then I also think casinos and lotteries are scams so I am kind of outside mainstream opinion on a few things I guess._

Again, my literal mind jumps when I read that ; ) I can completely understand that you consider them _immoral_ and/or predatory, but there's no need to call them a scam particularly - FSM knows there are plenty of other immoral acts.

</comment></comment></comment></comment><comment><USER53> not having your wallet separately encrypted means you're asking to be robbed.

</comment><comment><USER54> The lesson repeatedly not being learned seems to be that it's not a good idea to keep wallet files on other people's servers, where you have no control over their security process.

</comment><comment><USER55> For those of us late to the Bitcoin idea, how does one "steal" Bitcoins? Is it the equivalent of copying someones private key and then deleting all their copies of the key?

<comment><USER56> No, you use a stolen private key to transfer the Bitcoins to a new public key whose private key is only known to the thief.

</comment></comment><comment><USER57> I know that bit pin is supposed to be annonomous but is there any way to get these back? I mean is there some logs or if they were signed by his account or anything?

<comment><USER51> All Bitcoin transactions are publicly logged, but they aren't reversible. So you can see who stole your money but you can't do anything about it.

<comment><USER58> There is a bunch of violent people who would disagree.

<comment><USER59> Only if those violent people can locate the thief's physical location, which they can't.

</comment></comment></comment></comment><comment><USER60> Why the fuck are people putting their bitcoins on servers that they don't control? That's just stupid.

</comment><comment><USER61> Update from linode: <http://status.linode.com/>

</comment><comment><USER62> i think bitcoin could use another layer of authentication to verify the person is indeed the owner of bitcoins.

<comment><USER63> One of the features of the next release of the bitcoin protocol is to allow things like multi-factor authentication (e.g. require a signature from the private key on your computer and your mobile phone before the bitcoins can be spent)

</comment></comment><comment><USER64> The attitude that Linode should refund the loss is a fragilising attitude. The more trust you keep pushing onto the provider the bigger everything is going to blow up when something goes wrong.

</comment><comment><USER65> LOL, bitcoin.

</comment><comment><USER66> If this was sensitive data why was it not encrypted?

Replace "bitcoin wallet" with "medical history" or "credit card numbers".

<comment><USER67> It had to be decrypted to be used. It was in use. Ergo...

<comment><USER68> It had to be rebooted to reset the root password. I see no good reason not to have a decryption key held in memory and require you to log in and enter the key upon reboot for something this important.

</comment></comment></comment><comment><USER69> The writeup of this is rather suspect. What happened is someone guessed slush's Linode account password, and used the root password reset feature from there.

What I don't understand is why does such a feature exist, why doesn't Linode require >16 character length passwords that are sufficiently random (or eschew password auth altogether), and why does slush (apparently from what I can tell) allow password auth for ssh AND allow root to login on ssh.

<comment><USER27> Yes, the writing is a little incoherent. Maybe that's the reason that caused you to miss that, in fact, someone used Linode's 'Customer Service Representative' interface to get access to his account.

Don't stop reading and comment with 'I call bullshit'.</comment></comment>


Odd Practices in Java - <AUTHOR> http://blog.jelastic.com/2013/01/31/odd-practices-in-java-guest-post/

<comment><USER2> Odd stuff are a part of Java in all levels.. But being a seasoned java guy, i can say that you don't need to bear the ugliness. You can just get the plethora of high quality libraries and all the good JVM performance and reject the weird AbstractSomethingFactoryLocatorFactoryBean shit...</comment>