Ask HN: What's the best documentation you've ever read? - <AUTHOR> <comment><USER2> It has to be the scikit-learn documentation ([http://scikit- learn.org/](http://scikit-learn.org/)). Not only its great in terms of proper code documentations with a ton of examples, but it also explains the theory behind each algorithm. You can literally learn Machine Learning just by reading the docs

</comment><comment><USER3> Any discussion on documentation is incomplete without mentioning Django

[https://docs.djangoproject.com/en/2.0/](https://docs.djangoproject.com/en/2.0/)

<comment><USER4> Came here to say this.

The thing I love about Django's documentation is the layering. From beginner tutorial through to high level overviews of the subsystems, through to detailed usage for the subsystems, through to API level docs, through to the source code - all of it is there, and all linked together well. On top of that, it's all well written, approachable, full of notes and caveats/warnings where necessary (for the level of the documentation too).

I've not seen another set of documentation that provides something at each of those layers.

<comment><USER5> The warning and caveat are the best part for me. The django team understands very well the principle of least surprise, which is why old django installs still work, the ecosystem is very well intagrated and updates are not dreaded. It strikes menthat something new like react is in version 16 (and the doc sucks) while django is much older and only reaching v2, with great docs.

<comment><USER6> I work on React. We've worked really hard on our docs, so it would be helpful to know what you don't like about them so we can improve.

<comment><USER4> I don't use React much, but from a quick look at your docs now it looks like they are much better than last time I saw them, and I can't find any major points of criticism.

I like the fact that you have the separation between getting started/tutorials, main concepts, advanced concepts, and an API reference. The notes/caveats/etc seem reasonable.

It would be nice to link to the source in the API reference, and there are a lot of mentions of APIs that could be linked (pretty much any function name in a body of text could be linked I think), but apart from that these docs look great.

That said, I haven't had to use them day after day for 6 years like I have with the Django documentation!

One thing you might want to consider for the future would be switching between versions of React. Django has a version switcher at the bottom of the screen that lets you jump between versions, shows banners when reading the docs for unreleased/insecure/old versions (in case users are linked to them), and also mentions when APIs were added in recent versions in the text.

<comment><USER6> Thanks!

* Links to source: I use these frequently in other libraries, but I don't think this would be as useful for React, because we tend to have just a few functions each with a complicated implementation (vs programming stdlibs or other frameworks where many methods are on the order of 10-100 lines calling other public functions). Also our implementation isn't that easy to understand. I wonder if you had a particular use case in mind? * Linked method names: Good idea. * Version switcher: We've thought about this and will probably add it at some point.

<comment><USER4> Not wanting to open a can of worms, and I haven't read any of the React source, but if the source isn't that useful I'd suggest the answer might be to make the code easier to understand. Developers often need to dive into the code they are using for more detailed analysis of undocumented edge cases, tracking down bugs in their own code, etc, and having an understandable framework or library is fairly critical for that.

Django does a lot of complex/clever stuff under the hood, but the source is still readable, and in most cases fairly easy to understand.

This is just my 2 cents though.

<comment><USER6> Yes, making the source easy to understand is definitely valuable (even if only for our own team's understanding).

I believe Django's "functionality/(API surface)" quotient is still much lower than React's, which means it's easier to make the source useful to a newcomer.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> MDN because it's exhaustive [https://developer.mozilla.org/en- US/](https://developer.mozilla.org/en-US/)

Jekyll because it's beautiful and the user can read all the pages at once with the previous/next buttons (at the bottom) [https://jekyllrb.com/docs/home/](https://jekyllrb.com/docs/home/)

Node.js because they propose a single page version and it makes search easier [https://nodejs.org/dist/latest-v10.x/docs/api/all.html](https://nodejs.org/dist/latest-v10.x/docs/api/all.html)

<comment><USER8> MDN is spectacular.

</comment></comment><comment><USER9> I learned a lot from the SQLite documentation. It's not only very thorough, but it's full of insightful bits of information that is not strictly necessary but which gives a deeper understanding of the engine.

It was also the first time I encountered the flow diagram type of syntax explanation which I found to be a fantastic way to grasp the details of each command. Eg [https://sqlite.org/lang_createtable.html](https://sqlite.org/lang_createtable.html).

[https://sqlite.org/docs.html](https://sqlite.org/docs.html)

</comment><comment><USER10> ZeroMQ stands out for me. [http://zguide.zeromq.org/page:all](http://zguide.zeromq.org/page:all)

<comment><USER11> Yeah. I'm pretty sure I'd benefit from reading those docs even if I never use ZMQ.

</comment></comment><comment><USER12> The best docs on the planet are now held by Mozilla on Javascript.

<comment><USER13> Agreed. I'm referring to it as the Truth

</comment></comment><comment><USER14> Vue JS docs are the best. I don't think anything beats it :)

<comment><USER5> I always feel like the author is my buddy talking to me. Sometime i have a question, then read one. There is it, the answer.

And this applies to the vue API as well. The guy just crafted in so many little things to make real life easiser. The event.once helper for example. Simple, elegant, useful.

</comment></comment><comment><USER15> PostgreSQL's documentation to me is a reference.

Complex concepts are told in a very simple and concise fashion. There is just the right amount of text for what is told, it does not make you feel dumb and instead invites you to dig deeper in a very welcoming manner.

<comment><USER16> I even suggest it as a good way to learn about relational databases, in general.

The only downside is if the reader is "spoiled" by a particular feature that's documented as standard (such as to comply with one) and subsequently has to work with one that lacks it or implements it less completely.

</comment></comment><comment><USER17> CockroachDB: [https://www.cockroachlabs.com/docs/stable/architecture/overv...](https://www.cockroachlabs.com/docs/stable/architecture/overview.html)

</comment><comment><USER18> Re-frame for clojurescript. Worth reading even if you're not using cljs but are involved in front-end development.

[https://github.com/Day8/re- frame/blob/master/docs/README.md](https://github.com/Day8/re- frame/blob/master/docs/README.md)

</comment><comment><USER19> The TeXbook, and the Exim spec.

The thing the latter gets right is that, as well as the usual long list of options with an explanation of what their effects are, it also describes in full detail what the program actually does, rather than leaving you to deduce it from the options.

So each option is normally described twice: once in an alphabetical list, and once where the operation it affects is described.

<comment><USER20> I remember the TeXbook, from back when it came out (more or less). One of those books that tells you what's going on, provides a very good summary of its context, and makes you want to read it.

More documentation back then seemed to be of higher caliber, than much if not most of what we wade through, today.

I think the people writing it had more time and resources for attention to detail. And perhaps more need. There was no generally public Internet for updates and corrections including turning your product from a pain in the ass quasi-brick to something useful. You had to get it right, up front.

</comment></comment><comment><USER21> vim, emacs, postgres, zsh, bash, urxvt, systemd, pacman

EDIT: It all depends on how you set the bar, though. There are plenty of projects whose entire documentation is a README with a few examples.

Also, what's "best", documentation that greatly explains a horrible, unintuitive interface of a program or one that hardly needs to exist because the use of the program is so intuitive, you don't need documentation? Greater effort was spent in the former, but you understand the program better in the latter.

</comment><comment><USER22> I love [https://redis.io/documentation](https://redis.io/documentation). It has a great UI too.

<comment><USER5> It scaled well too. Redis was a small tool. It's not so small anymore, but the doc is still top notch.

</comment></comment><comment><USER23> Redux is good given how small the library is. Rust stands out as well

<comment><USER19> I'm underwhelmed by the Rust docs.

The tutorial is OK-ish, but the reference docs are weak. If I have a specific question about some detail of the language, the answer is very rarely there.

Sometimes the answer is written up in the bug-tracking system or an RFC. They don't seem to have a culture where someone making a behaviour change, or a language-definition decision, is expected to update the reference manual at the same time.

<comment><USER24> Please file bugs against the reference when you have these kinds of questions, it really helps.

> they don't seem to have a culture

We actually do have that as a literal rule [1], but since we've started from a place where the reference is incomplete, we can't block everything on fully filling out every last detail. It's being actively worked on though!

1: the rule has been slightly relaxed in the last few months for reasons; now a bug must be filed, rather than writing out the literal text. They usually get done fairy shortly after though.

</comment></comment></comment><comment><USER25> Django, the Python-based web framework, has fantastic docs too: [https://docs.djangoproject.com](https://docs.djangoproject.com)

<comment><USER26> Pythons standard docs are pretty disappointing in comparison. It takes a lot of reading to encounter what you need.

<comment><USER5> And don't get me started on the stdlib doc part dedicated on asyncio.

</comment></comment></comment><comment><USER27> _The C Programming Language_

</comment><comment><USER28> The node-postgres docs are very nice. [https://node- postgres.com/](https://node-postgres.com/)

Gives you examples right off the bat to get started, is organized well so it's easy to dive deeper, and the author includes some conventions for incorporating the module into your app.

</comment><comment><USER29> I think cppreference.com is very well made. It has both the C++ and C standards in a very accessible form.

</comment><comment><USER30> QT wasn't so bad as far as I remember.

But as jolmg pointed out, some projects are just simple readme and that is more than enough. Love those. But the total opposite is also common, a wall of text that is meaningless and in the end, you have to go through the source code to get some answers...

<comment><USER31> Qt had amazing documentation around Qt 4.5. It's still really well- written—especially the old stuff—but their biggest problem is that they're awful at maintaining websites. The expected lifespan of a link to a page in their documentation is about two years.

</comment></comment><comment><USER32> Erlang - [https://www.erlang.org/docs](https://www.erlang.org/docs)

The best three entries are * Learn - [http://erlang.org/doc/reference_manual/users_guide.html](http://erlang.org/doc/reference_manual/users_guide.html) * Use - [http://erlang.org/doc/search/](http://erlang.org/doc/search/) * Go deep - [http://erlang.org/doc/efficiency_guide/users_guide.html](http://erlang.org/doc/efficiency_guide/users_guide.html)

</comment><comment><USER33> I would go with python-requests [http://docs.python- requests.org/en/master/](http://docs.python-requests.org/en/master/)

</comment><comment><USER34> [https://docs.saltstack.com/en/latest/topics/development/inde...](https://docs.saltstack.com/en/latest/topics/development/index.html)

I found some bugs and I wanted to fix them. I've done a little python in the past but I'm not entirely up to speed on the whole python ecosystem. This documentation was exceptional and allowed me to get my bugs fixed, some unit tests written and PR's merged.

</comment><comment><USER35> I've always admired Agilent's Programmer's Reference for the ESA series electronic spectrum analyzers [http://literature.cdn.keysight.com/litweb/pdf/E4401-90507.pd...](http://literature.cdn.keysight.com/litweb/pdf/E4401-90507.pdf)

</comment><comment><USER36> Racket

[https://docs.racket-lang.org/](https://docs.racket-lang.org/)

<comment><USER37> Note that all identifiers in the code examples are links to documentation.

</comment></comment><comment><USER38> I really like the elasticsearch docs. They seem to cover everything, it's easy to find what you're looking for, and they contain a lot of detail! the feature where you can switch ES version without leaving the page you're on is a nice touch too :)

</comment><comment><USER39> It's gotta be emacs for me. C-h o, and helm-apropos make it super easy to investigate anything in the system. And the help pages link back to the source code (though this isn't unique to emacs) The online docs aren't bad either.

</comment><comment><USER40> MDN, Scikit-learn, Requests, RethinkDB, Django are a few that come to my mind.

</comment><comment><USER41> Probably the Gentoo Linux documentation. Not sure how it looks like today, but back in 2005 when I started using Gentoo it helped me a lot because not only was comprehensive but also deep enough albeit clear.

</comment><comment><USER42> Best docs:

Stripe.com

Laravel.com

<comment><USER43> Laravel by far my favorite framework, but their docs aren't perfect, there's a lot of things I've needed to do, that just aren't in the docs, they're in the API though.

Everything in the api, should be covered somewhere in the docs with examples and use cases, imho.

</comment></comment><comment><USER44> I really like the Org mode manual ([https://orgmode.org/manual/](https://orgmode.org/manual/))

</comment><comment><USER45> nobody know shoes by _why

I would say it's pretty terrible at providing a reference for a new GUI system in ruby, but it's also the most fun I've had reading docs

</comment><comment><USER46> Stripe has the best API documentation, I have seen.

<comment><USER4> I used to think this, but from a recent project with them we found them to be lacking some significant details, and generally fairly shallow. We had to contact support for a lot of clarification, and that took a while with the back and forth.

</comment></comment><comment><USER47> Tech writer here. I'd be hugely thankful if you included _why_ a given set is the best in your experience!

<comment><USER48> (Off-topic: I'm considering a career change from software engineering to tech writing. I'd love to pick your brain about the field. There's no contact info in your profile, but I'm email@example.com. Thanks for the consideration.)

<comment><USER47> Just saw this. Absolutely. I'll email you.

My personal is email@example.com for anyone else in the same boat.

</comment></comment></comment><comment><USER49> The Commodore 64 User Manual. No contest.

</comment><comment><USER50> I like plot.ly's documentation - has a good mix of top level examples and specific, deep documentation.

</comment><comment><USER51> I use Matlab over Python for scientific computing mainly because the documentation makes everything easier.

</comment><comment><USER52> Qt's [http://doc.qt.io/](http://doc.qt.io/)

</comment><comment><USER53> IMHO Twilio's documentation is pretty nice

</comment><comment><USER54> stripe - hast the best api docs imho

</comment><comment><USER55> Go

<comment><USER56> Really? I thought they were horrible. I gave up on learning the language mainly because of the documentation.

<comment><USER57> I've never tried to read the Go documentation from the top down, but godoc is pretty excellent.

</comment></comment></comment><comment><USER58> PostgreSQL's is very concise, clear, to the point, but still very detailed. Has examples! [https://www.postgresql.org/docs/10/static/index.html](https://www.postgresql.org/docs/10/static/index.html)

</comment><comment><USER59> Stack Overflow.</comment>


The Design Diaspora of iOS 6 - <AUTHOR> http://thenextweb.com/apple/2012/09/19/the-design-diaspora-ios-6/

<comment><AUTHOR> The visual design of iOS 6 feels all over the place to me.

I quite like the new Lionesque "square" look of the iPod and Phone apps for example, but then on the other hand, the Messages app is still all 2007-era OSX round round round.

Also, has Emergency Call (when the phone is passcode locked) always been squeezed into one line in a tiny font like it is now?

Not really complaints, I am quite happy with my phone, just observations. Some odd things seem to be going on at Apple.</comment>


Social Justice, Ideological Hijackings, and Ideological Security - <AUTHOR> http://thefutureprimaeval.net/socjus-and-ideological-security/

<comment><USER2> This is actually a reasonably-toned article.</comment>


Windows Exploitation Tricks: Spoofing Named Pipe Client PID - <AUTHOR> https://googleprojectzero.blogspot.com/2019/09/windows-exploitation-tricks-spoofing.html <comment><USER2> Summary of the takeaway: the _GetNamedPipeClientProcessId_ function returns the PID of the process that _opened the pipe_ , not the one that is currently communicating. However, the client PID can sometimes be specified manually, and even when it can't, handle duplication followed by PID recycling can make this PID point to an arbitrary process (hence it should not be used for security checks).

<comment><USER3> So what is the use of this function?

<comment><USER4> Perhaps just for putting an informative PID in log messages?

</comment></comment></comment><comment><USER5> >It was clear that there must be some applications which use the client PID for the purposes of security enforcement. However I couldn't find any first- party applications installed on Windows which used the PID for anything security related. Third-party applications are another matter and other researchers have found examples of using the PID to prevent untrusted callers from accessing privileged operations, a recent example was Check Point Anti- Virus. As relying on this PID is dangerous I decided I should highlight ways of spoofing the PID value so that developers can stop using it as an enforcement mechanism and demonstrate to researchers how to exploit such dangerous checks.

So, _not_ a "Windows Exploitation Trick".

Even the so-called "example" with Checkpoint is nothing of that sort. They were using the PID to find the executable and verify that it was signed with their certificate. The actual exploit in the link to the Checkpoint vulnerability has to do with spoofing the cert, nothing to do with the PID.

The post is about a bullshit hypothetical "authentication" method that I have never seen anyone use in 25+ years of Windows programming.

Edit: clarify last sentence

I lost all respect for Project Zero this week.

<comment><USER6> > I lost all respect for Project Zero this week.

Aren't you being a bit... dramatic?

<comment><USER5> I respect their technical expertise, of course. So, maybe _all_ is an exaggeration :-)

<comment><USER7> I'm not sure why I'm replying to the proverbial as you seem to have made up your mind, but being the original author of the blog post I thought I'd at least try and correct some seeming misconceptions.

First off, the reason it's called "Windows Exploitation Tricks" is it's a blog post series ([1], [2], [3], [4]) of behaviors/tricks of the Windows OS that allow you to exploit security vulnerabilities, specifically logical privilege escalation vulnerabilities. If you read the introduction to [1] it outlines the purpose of the series, it's based on ways of exploiting real world vulnerabilities that I've discovered in real software whether it be in core Windows or third-parties. The rationale for writing them up is if you look for exploitation techniques and tricks on any platform almost everything you'll find it based around memory corruption, I don't look for fuzzed bugs so having a cool ROP chain is going to be much help to me and no doubt others who find themselves in this situation. So I write up interesting techniques I've discovered over my years of research to the benefit of others.

There are secondary benefits to blogging about these techniques, for example it can act as developer education. If you look at the API referenced in the blog [5], you'll not see any security warning or advice associated with it. This leads developers to misuse the functionality without understanding how the OS works. The irony is not lost on AV vendors having no clue about the security principles of the OS they're protecting from security threats. Still if you've never seen a program using the PID (through whatever means it's got that value) being used for authentication on Windows or any other OS then I can only assume you've never really looked very hard for logical vulnerabilities.

Another benefit is an aid to reporting. What I blog about in the series are not security issues in a traditional sense, instead they're chain building 'gadgets'. You might have a root vulnerability but not the means of exploiting it. In an ideal world a vendor would remove all non-essential functionality which could facilitate exploitation but we live in the real world and MS are not generally going to spend their time fixing something like this as a real security issue with a CVE etc. Therefore there's no real reporting process for me to follow to report it and demonstrate impact to MS, and as is typical if I find instances of the bug class which can be exploited with the trick they'll fix the reported bug, not the technique. However by making it very public it gets noticed by MS, for example [1] and [2] are both now fix/mitigated in the Windows 10 1903 in direct response to the blog posts.

Finally I think you don't fully understood the scope of the example vulnerability I gave. The root cause of the Check Point bug is the service 100% trusted that the PID being passed from the named pipe was a useful piece of information to base a local security decision on (see end of the "Interacting with the Service" section). It used that PID as the start of a chain of checks to determine if the process at the other side of the pipe was a Check Point trusted application. The fact that in this case the whole logic of the check was fundamentally flawed is irrelevant for the purposes of the blog post. If their certificate checks had been completely robust and it wasn't possible to either spoof them or just inject a DLL then spoofing the PID would absolutely have allowed you to exploit that vulnerability.

[1] [https://googleprojectzero.blogspot.com/2017/08/windows- explo...](https://googleprojectzero.blogspot.com/2017/08/windows-exploitation- tricks-arbitrary.html) [2] [https://googleprojectzero.blogspot.com/2018/04/windows- explo...](https://googleprojectzero.blogspot.com/2018/04/windows-exploitation- tricks-exploiting.html) [3] [https://googleprojectzero.blogspot.com/2018/08/windows- explo...](https://googleprojectzero.blogspot.com/2018/08/windows-exploitation- tricks-exploiting.html) [4] [https://googleprojectzero.blogspot.com/2019/04/windows- explo...](https://googleprojectzero.blogspot.com/2019/04/windows-exploitation- tricks-abusing.html) [5] [https://docs.microsoft.com/en- us/windows/win32/api/winbase/n...](https://docs.microsoft.com/en- us/windows/win32/api/winbase/nf-winbase-getnamedpipeclientprocessid)

<comment><USER5> Thank you for taking the time to respond. I concede that I did not think about ROP chains at all (which is sad because that's my favorite part about Project Zero and other such Windows bug exploit info dumps) and thus undervalued the spoofing techniques because they required higher priveleges.

On to the crow eating:

The first two spoofing techniques seem like OS bugs that will hopefully attract some attention from MS because of your post.

Given that making the API lie about the process ID is possible, your point about Checkpoint (haha) is also well made.

I guess I got too hung up on the "PID for authentication" phrasing and didn't pay close enough attention to what you were actually saying.That (beyond the obvious race condition between getting the PID and opening the process) there are ways for the API call itself to lie to you so you probably don't want to use the PID to get information about a named pipe client.

Man, I wish HN had a "delete all my posts so I can slink away in shame" button. I guess I'll just live with it.

cheers.</comment></comment></comment></comment></comment>


Ask HN: Are there forgotten servers out there? - <AUTHOR> I was wondering if there are "forgotten" servers out there. No longer doing anything, but still up and running.<p>Is there any way to even know? <comment><USER2> Yes - in my network admin days back in 2007, we were decommissioning our datacenter as we'd virtualized everything and as we were gutting the room we found our PABX/Voicemail server under the tiles, happily running away with OS/2\. Nobody ever knew where it was and it had been installed 13 years before. The floor was on a UPS and generator so the power had never been disconnected.

It was happily chugging away, running our shitty phone system, and hadn't been restarted in 10+ years.

Edit: This also happened to me at a utility company I worked at. We had a server that ran some critical calculations for us but nobody could recall where it was physically located. It's way worse now that everything's virtualized - the cruft just sits there for years until you suddenly run out of resources and start looking closely.

<comment><USER3> >nobody could recall where it was physically located.

ah yes, the good old "responds to pings but where is it?"

<comment><USER4> Does the ping protocol have any capability to provide location information? Because it should if it doesn't..

<comment><USER5> The usual method is to get the device's MAC address, use that to track down/identify the switch port it's connected to, then physically trace the network cable that's plugged into that switch port.

<comment><USER6> Or, if the hardware supports it, eject the CD/DVD ROM drive.

<comment><USER7> Do servers have onboard speakers these days? Can you make them beep in a distinct pattern?

<comment><USER5> Many/most servers (or the ones I've dealt with the most, anyways) have an LED that can be activated remotely -- i.e. through IPMI, ILO, etc. -- but I can't remember what's it called at the moment. It can be very handy when you're remote and need to be able to direct someone (physically present) to a specific server.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> At a place I worked we had a service that relied on a cron job running a script every hour. One day someone wanted to know where the server was so he could connect an external hard drive to it and copy some files in. Not a single person knew where the server was or even what it's IP address was. Since it had been setup years ago, everyone who had worked on it had since left the company and no one ever documented it. So somewhere either in our office or in one of three public clouds we used was a server happily running a script every hour that no one could locate or stop. We eventually found it when we moved offices and a super old Dell box in a tiny dusty closet was unplugged and the script stopped running. Now I always document the physical locations of services too.

</comment><comment> pi-rat Oh, Yes! In a previous job we developed VoIP servers (pbxes). One day a customer started experiencing some really weird problems and I was asked to debug it.

I logged into the server and started analyzing traffic, turned out that traffic on a upstream VoIP switch didn't always match the traffic leaving the server I was debugging. It was as if a identical system was getting and responding to parts of the traffic. - and after some more debugging I discovered that there was a older identical system online somewhere in their server room. Years ago - all services had been stopped, the system backed up and migrated to a new server. One day there had been a power loss, and when the servers rebooted, the old system everyone had forgotten about launched it's previously stopped services - causing the customer all sorts of weird VoIP problems.

</comment><comment><USER9> I set up one of these deliberately in younger days...

As a bored government employee in the early 1990s, I become fascinated with the WWW. I was a network admin (NetWare 2.15c), and there was a fat, unused internet pipe and several unused phone lines. I started to mess around with Linux (Slackware kernel 0.97 I think), and after two weeks I had it talking to a Hayes modem. Voila, instant ISP! A little while later I installed Slirp, and it became my personal dial-up connection for many, many years.

Before I left that job in 1995, I moved the server (headless) to a broom closet (wrong of me, I know, I know). Knowing gov't culture, no one would mess with something like that. It was up and running at least until 1998 or so, at which point I moved to another country, and when I moved back, I no longer had the dial-up number. I like to think it is running to this day.

</comment><comment><USER10> There are many (possibly apocryphal) stories about servers lost in ceilings, locked closets, etc that just kept on serving, sometimes critical services.

I think we as an industry have gotten much better about this. In the old days, as small minicomputers and micros expanded into less and less technical businesses, wiring standards and server room design guides were not well-known or followed.

Often, people just sort of winged it. Some employees are more naturally methodical, have better memories, and are longer-tenured than others. Also, many of the stories are from universities, where long-term thinking isn't guaranteed (but embarrassing stories have always been popular to share!).

A quick DDG finds this story from the University of North Carolina:

[http://www.bradleymonk.com/wp/weve-lost- server-54/](http://www.bradleymonk.com/wp/weve-lost-server-54/)

USENET archives would be a great source for more of these.

</comment><comment><USER11> This guy's server: [http://bash.org/?5273](http://bash.org/?5273)

<erno> hm. I've lost a machine.. literally _lost_. it responds to ping, it works completely, I just can't figure out where in my apartment it is.

<comment><USER12> What to do in this cases? What are the options?

<comment><USER13> Disconnect cables from each switch and see when the ping replies stop :).

<comment><USER14> Unless it's on a WiFi connection, in which case things get substantially more complicated :)

<comment><USER15> Typically you can login to the router and see machines attached, and kick/ban MAC addresses.

<comment><USER16> That still won't help you find where the machine is located though. With cables you can presumably just follow the cable when you realize disconnecting one stops the pings

<comment><USER17> Wardriving software like kismet will show your the RSSI of the AP. Is it possible with stock hardware to determine the RSSI of connected devices? Then it is just the hot/cold game. I'm sure actual radio triangulation/direction finding would be possible as well but I'm not sure how difficult that would be.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> This week I got a support call from one customer: "hey, we have a maintenance scheduled for our Dell servers, is it ok if we shut down the two pre-prod servers?" "what pre-prod servers?" [all the non-production servers were virtualized about 4 years ago] "well, there are two servers here, with pre- prod labels and running Linux; no applications are running on them"

So I guess 4 years ago somebody migrated the servers to a virtual environment and then just forgot about them. The IPs were migrated to the VMs and these servers were left without an IP address on the network connections, so apart from going to the data room and checking every machine (what they did during the maintenance) there was no way to find them. They were still up and running after 4 years.

<comment><USER19> Auditing your racks periodically is good for many other reasons. RackTables and similar tools are invaluable!

<comment><USER20> Thank you for mentioning it, didnt know about the tool!

</comment></comment></comment><comment><USER21> Oh god yes. A few years ago some labmates and I discovered that a post doc had set up an entire computer cluster of 30 workstations / associated infrastructure, colocated it at a data center nearby, then left without leaving any documentation. Everyone that knew the cluster existed left soon after, and so labmates that arrived later were running simulations on their personal laptops while this cluster sat idle. We discovered it only because my PI received a large bill for rack space and remembered it existed.

</comment><comment><USER22> Sure, happens now and then.

I work at an ISP / housing / colocation company, and occasionally hardware goes missing (nobody knows where it is anymore, it's not where it's supposed to be). Maybe some of them are broken, some might be stolen, but I'm fairly sure others are still running, not serving any purpose.

And from time to time we stumble over some virtual machine (or even phyiscal server) where nobody knows anymore what it's supposed to do; the standard procedure seems to be firewall it off, wait for a few weeks or months to see if anybody complains, and if not, shut it down, maybe archive it.

<comment><USER23> Same experience here. Servers get ordered, racked, provisioned and left powered on waiting for a sysadmin to make use of them... which quite often doesn't ever happen, because team priorities change over time, people move on/get fired, entities go through reorgs, etc.

They sit there idling and unattended, burning power and disks, until some script kiddie finds whatever default root password was used or how to exploit some random apache/ssh flaw.

At that point the possibilities are endless: bitcoin miners are quite unnoticeable in most environments, but DDOS/spam zombies, proxies, bittorrent seedboxes, botnet C&C, "warez" and http servers serving drive by exploits are fairly common.

Protip: ask your datacenter provider to power your servers down (be it VMs or dedicated gear) after racking them up. Powering them back up when you _really_ need them will only take you a minute and you'll save big on power, bandwith, security and peace of mind.

</comment></comment><comment><USER24> My father has an email account hosted by Verizon with the domain @gte.net. General Telephone & Electric merged with Bell Atlantic in 2000 to become Verizon.

My father's @gte.net email delivery has recently become spotty. After hours of phone calls with Verizon, no one at any level of support can seem to find the old GTE mail servers.

Some Googling for smtp.gte.net found this IP address, 188.8.131.52, which seems to respond to pings but not smtp traffic.

</comment><comment><USER25> I am sure there are tens of thousands if not more. Server admins are very risk averse and don't tend to turn off machines just to check if someone's using it.

And in large organizations, it's hard to keep track of who's using what and if they still need it.

Imagine working at a hospital or a bank, emailing people about a server, and everyone says it's not being used. Then you turn it off and something critical gets broken at 3am a week later resulting in an emergency. Who gets blamed, you or the people who forgot the server was being used? The people who set it up may not even be working there anymore.

</comment><comment><USER26> Years ago I shut down a start-up, and as part of some business partnership, we had a physical server hosted in some big company's datacenter. They forgot about it, and I didn't have time or incentive to drive over there to fetch one old machine. So it just kept running there for a couple years, at first just continuing to serve my failed company's website, and then doing nothing, other than serving as a personal download proxy for me. That lasted for about 2-3 years until they finally found it and shut it off, so I took it home.

</comment><comment><USER27> We came across one at work (NASA) a few years back, a server running in a far off room that no one remembered anything about. It had probably last been used by a grad student at least a decade ago, but was still up and running and doing, well, something. We eventually had it removed and turned the room into a collaboration space.

</comment><comment><USER28> My 1996 homepage is still online under its original URL. Which likely means the system hosting it is still online. Except the original ISP no longer exists, nor does the ISP that bought the original ISP.

Next year I'm going to find that system on the 20th anniversary of that page.

<comment><USER29> My first websites are still somewhat online too, as Archive.org and/or the Archive Team managed to backup the site :)

</comment></comment><comment><USER30> I've always wanted to intentionally setup servers in hidden places just to see how long they stay online. For example, putting a Raspberry Pi in the back of a rack in a server closet. Maybe run a Tor relay on it or something like that.

</comment><comment><USER31> Back in the late 80s / early 90s there was a BBS in my hometown (Windsor, Ontario, Canada) called GB Hotel. It wasn't very popular, but if all the other BBS lines were busy, it was something to do.

The owner of the BBS, handle "Kilroy" as I recall, hadn't logged into his own BBS in _years_. Nor anyone else's, for that matter.

We used to joke that he'd probably died, and Mom and Dad just left his Commodore 64 sitting there, wondering why their phone bill was twice as much as their neighbours.

</comment><comment><USER32> Seen it a few times. Company acquires another company or an employees leaves. And then you find out years later during an office refit that the PC under their desk was running a critical business process.

<comment><USER33> Once I was an intern at an air force base. In my cubicle, stuffed into a corner, was an old SGI Octane workstation. It was absolutely covered in dust and looked neglected. Its fan was very annoying to me. One day, I unplugged the machine because I figured that it was completely purposeless. Less than 2 minutes later, someone I had never seen was standing at my desk, berating me for turning off a server that ran a set of critical data reduction processes for the nearby wind tunnel.

After that I added a sign to the machine. "DO NOT TURN OFF UNDER ANY CIRCUMSTANCES." And made sure I wore headphones to block out the sound of the fan.

<comment><USER3> Should've added a note saying what it does too seeing how you did the old "power it down & wait for someone to get angry" already.

<comment><USER33> Yes, I should have. But I don't remember if I did or not. This happened in the fall of 2005.

</comment></comment></comment></comment><comment><USER34> [http://www.theregister.co.uk/2001/04/12/missing_novell_serve...](http://www.theregister.co.uk/2001/04/12/missing_novell_server_discovered_after/)

 _One of the university 's Novell servers had been doing the business for years and nobody stopped to wonder where it was - until some bright spark realised an audit of the campus network was well overdue._

 _According to a report by Techweb it was only then that those campus techies realised they couldn 't find the server. Attempts to follow network cabling to find the missing box led to the discovery that maintenance workers had sealed the server behind a wall._

</comment><comment><USER35> I know of one interesting story here. Early on in (what would eventually become a very successful) tech company's life, they acquired some collocated space for free thanks to a friend (call him Brad) of an early employee.

Eventually Brad left that particular DC operator, leaving the startup with no inside contact - but the servers stayed up for years to come (and the company was never charged for the resources).

These machines were eventually "replaced" with newer hardware in a nearby facility, but the DC operator has no idea where these old machines are physically located within the facility (thus cannot remove them), so they remain active to this very day, sitting idly by...

<comment> jon-wood If its in a DC can't they track down the MAC of whatever is responding to their IP, and then trace it to a switch port?

</comment></comment><comment><USER36> Previous company I was at had a small server setup to run a few automated tasks every morning. It must have been running for at least 10 years before a new employee asked where it was physically located.

They eventually found it covered in dust in a small utility closest. None of the fans were working either (other than the CPU/PSU) yet it still chugged along doing its job.

</comment><comment><USER37> I'm always fascinated by StorJ.

[http://garzikrants.blogspot.com/2013/01/storj-and-bitcoin- au...](http://garzikrants.blogspot.com/2013/01/storj-and-bitcoin-autonomous- agents.html)

TLDR; a SaaS system that not only auto-scales, but does so autonomously. When it has excess funds, it buys more VMs and provisions them with itself. If cashflow is low, it shuts some down. Add in the ability to create accounts (using bitcoin as currency) and you could very quickly lose the paper trail and have a SaaS owned by the Æther.

</comment><comment><USER38> There's the story about the novell server left running in a walled-off room:

[http://www.theregister.co.uk/2001/04/12/missing_novell_serve...](http://www.theregister.co.uk/2001/04/12/missing_novell_server_discovered_after/)

</comment><comment><USER39> Not really "doing anything", but related: I had to set up a voip server for a test project in 2003, which was supposed to be terminated half a year later. Being a test project, I was advised not to document anything formally, just to place it in the rack and ignore everything else. I left this job soon after.

12 years later, the phone number still is working, even though the companies phone system has been relocated to another room and was replaced by another vendor. No idea how this happened.

<comment><USER22> > No idea how this happened.

It could very well be that somebody migrated all the relvant phone numbers off the test system, and chose to preserve those numbers where they didn't know what they were needed for. Might be cheaper than risking losing functionality that somebody depends on. (Especially if the one doing the migration didn't know it was an abandoned test system).

</comment></comment><comment><USER29> I heard a company forgot about their third datacenter (second backup), as several sys-admins left the company. It was found in an old bunker below the basement of a building.

<comment><USER40> i work for a pretty large enterprisey-corp and this is very close what happened to us. Early 2000's we had a DR setup for a specific platform at a 3rd party hosting provider. Mid-2000's was major transition of infrastructure folks.. the DR site being completely out of date and never used, was abandoned and forgotten. They continued paying the bill for the 3rd party for no joke, 4 years until someone realized that it was useless hardware.

</comment></comment><comment><USER41> Intriguing question; I would think that a certain percentage of servers might have survived their owners post-mortem. Of course there could be many additional reasons for abandoned servers.

</comment><comment><USER42> AWS instances on the free tier that starts to charge your credit card after a year.

<comment><USER43> Oh, I must pay attention to that.

</comment></comment><comment><USER44> We have several gorgeous AS/400s still going strong, quietly gathering dust while they wait for the next time we need to test something on them.

I think these servers will outlive me.

</comment><comment><USER45> Well, every six months or so I review my various VPSes and I usually find at least one I'd forgotten about, so unless I'm unusually forgetful I'd say "yes" :)

</comment><comment><USER46> Apart from normal servers, lots of embedded devices probably also have integrated servers. There must be many, many of them idling away somewhere.

<comment><USER47> MOTES have an average lifetime of 5 years. Unless they are linked to a power grid and stable internet. Most of these are either broken/frozen/unreachable/out of power.

We actually study this special case in Embedded systems engineering.

</comment></comment><comment><USER48> Right after I was hired by a large portal part of a much larger telco, we were decommissioning one of our data centers. In one of the planning meetings there was a discussion about an undocumented class C range that nobody knew what was, yet had some significant traffic. I never knew what that network was or what was running there. As far as I know, someone may have lost their spam relays or their phishing hosts.

Another fun story happened years before. There was a large power outage at the data center of another large Brazilian portal. Three days later, someone calls our office, asking if we remember what kind of hardware the server was running on. The machine didn't boot and they needed to get to its console. Unfortunately, nobody knew where the machine was physically located or what did it look like. In the end, it was found inside a Cubix chassis, an early blade-like machine.

</comment><comment><USER49> I took over a job at a marketing firm once who had lost their senior developer about a year before. They had been running on luck and a whatever quick fixes their front-end developers could hack together when anything went down. Needless to say, no one had any idea where the servers where or even how many servers we had. Took a while to track them down.

Almost a year after I had thought that I had tracked everything down we had an odd error start cropping up on our sites where the domains on a couple older sites wouldn't resolve on just some computers. After digging through it we found that there was some name-server that I had missed but we still didn't know where it was until a thunderstorm killed out office router. In the process of replacing it we tracked one cable to a closet in the basement where, lo, the mystery name server was sitting.

</comment><comment><USER50> Many years ago I did a job for a big corporation with a big IT department. Servers were in the data center of course and to get one you had to fill out a lot of different forms. When the project was on fire we were allowed to bring in our own machine and use it as a server.

Later, when the project ended no one bothered to go through the whole formal process to get the machine out of the premises again. The machine was just left there connected to the network.

In the months after the project ended different departments moved into the building. Different people with different tasks. Yet the machine stayed connected. I guess no one had the courage to shut down a machine they didn't know about.

For a year or so I still used to check occasionally if I still could log into the machine. It disappeared eventually but unfortunately I don't remember how long exactly it lasted.

</comment><comment><USER29> Maybe some remember an UK website with "celebs" in the URL, in the late 1990s. (black background with small stars, website used frames)

It was probably the largest image database back then. That website had thousands of photos from every female celebrity categorized by name. The website owner collected all celebrity images from public news groups. One day the updates stopped and everyone wondered what happened. Many months later the website vanished (ca. 2002) and I read in the news that a friend found the dead body of the owner and no one paid the bills. As usual a domain grabber replaced it with a scam website shortly afterwards. I remember only a few frame-pages were backed up by Archive.org - though I forgot the URL of the website. Does anyone remember that former rather famous site?

</comment><comment><USER51> Of course there are, the question though is how "forgotten" and what is a server. There are web sites out there running on servers where they haven't been changed or updated in years. Presumably they are forgotten in one sense or another.

</comment><comment><USER52> I've got one, that I set up for a client but who decided to not need it. Still running and paid for. I imagine this happens a lot.

Edit: Now that I think of it, I 've got 3 for 2 different clients.

</comment><comment><USER53> The reason I enjoy these kind of stories is the uptime. I know it is not a real indicator of anything but I enjoy seeing machines that have been running for years. (I used to frequent a website were people actually tracked their uptimes).

One of my favorites was this one, on ARS:

[http://arstechnica.com/information- technology/2013/03/epic-u...](http://arstechnica.com/information- technology/2013/03/epic-uptime-achievement-can-you-beat-16-years/)

</comment><comment><USER54> A few years ago when I upgraded to a new more powerful box at my hosting provider I noticed half a year later the old one (which I had whiped and done some testing on after transfering) was still chugging along, serving the silly 403 page I set up. After a few days of talking to the confused support it got shut down.

</comment><comment><USER55> Relevant [http://bash.org/?5273](http://bash.org/?5273)

</comment><comment><USER56> I have a forgotten server happily chugging away somewhere, it still send me mail sometimes. it might be lonely.

</comment><comment><USER57> Yes, it happens. From the small company to a corportation, those can be: vms, old servers, racks of servers...

Having a perfect CMDB for hardware and following all procedures step by step could identify / prevent cases like that. But in reality, in normal environment it's going to happen.

<comment><USER58> I'm curious - what IS the perfect CMDB software?

<comment><USER59> My belief is that the only way to make the perfect CMDB software is for your company to write it itself. Every CMDB system winds up being obliterated into twisted machinations of the original vendor's object model to the point where the vendor can't even help their customer anymore. I've witnessed CMDB implementation projects at least a dozen times and have seen 0 actually succeed at what the customer really wanted to get out of it (because people are sold unicorns and puppies in the ITIL model that no vendor can actually deliver because it's theory ware). Almost all CMDBs or equivalent system of records database has been RDBMS based in my experience on the enterprise IT side. One exception is that Facebook has their own that's not from some random acronym vendor used with clients being pluggable such as from Chef in place of the provided ohai.

<comment> jon-wood My first proper software development job was to consolidate the 7 different CMDBs that the company had - they were an ISP/hosting provider who had done a rapid succession of acquisitions, all of which came with their own database of hardware.

Some of the data was so bad that we ended up having one guy who's job was to physically audit what hardware was _really_ in the data centres, and then attempt to reconcile that with the CMDB data.

</comment></comment></comment></comment><comment><USER60> I'd assume like 20% :-)

</comment><comment><USER61> I used to administer a website that was running on a server set up by the original site owner at a hosting company he worked at. The site kept running for 5 or 6 years after he stopped working there.

</comment><comment><USER62> Yeah, a department I worked in had over 1000 vm's up with nothing installed. That's what you get when you have high turnover, huge cash flow, and management that didn't care.

</comment><comment><USER63> Somehow this thread reminds me of Wall-e.

</comment><comment><USER64> I wonder what the Carbon Footprint of all this unused compute power is?</comment>


Show HN: Annotate and collect best links to understand any topic - <AUTHOR> http://www.searchtrack.co/download-handy/ <comment></comment>


Oil hits $139 as jobless figures stun US - <AUTHOR> http://www.guardian.co.uk/business/2008/jun/07/useconomy.oil <comment><USER2> While I generally don't give much credibility to anything I read in the gardian this story is easy to verify.</comment>


Mollom Just Gave Me An Hour A Day Back - <AUTHOR> http://www.centernetworks.com/mollom-spam-protection

<comment><USER2> The beauty of this system is that it won't lose any comments. Even the people who are forced to enter a captcha (which usually decreases the amount of comments) would rather do that than know they wrote all that for nothing.

<comment><USER3> Surely it would reduce the number of comments as it still loses some.

As the author says - a CAPTCHA solution reduces comments significantly, lets say by 50%. So if Mollom marks 10% as spam, and half of those are actually legit, 2.5% of comments are lost.

But that's not a bad price to pay for getting an hour of your life back a day.

<comment><USER2> No, you don't understand. It prompts for a CAPTCHA _after_ the user has submitted his text. So if I just wrote out a paragraph of a comment, and submit, I wouldn't want to have that paragraph NOT show up just because I'm too lazy to enter the CAPTCHA. I think the people who won't enter the CAPTCHA will be far smaller with this method.

<comment><USER4> CAPTCHAs have become difficult and frustrating. They definitely discourage participation, regardless of how they are integrated into the system.

</comment></comment></comment></comment><comment><USER5> It helped him find the Precious?</comment>


Neuromechanics of flamingos' amazing feats of balance - <AUTHOR> https://theconversation.com/neuromechanics-of-flamingos-amazing-feats-of-balance-78160 <comment><USER2> The mechanics of birds are really amazing. This reminds me of a video I saw of a shoebill hunting. The ability to move its body while keeping its head absolutely locked in place is great.

[https://www.youtube.com/watch?v=GrMDIIo8yU4](https://www.youtube.com/watch?v=GrMDIIo8yU4)

I wish we had some of the bigger birds around still so we could see them fly. Imagine a 110kg Argentavis above your head. It makes me wonder whether engineers will be able to create something to allow individuals to "fly" like one.

<comment><USER3> A lot of birds can do this. Famously, the chicken - [https://www.youtube.com/watch?v=OCdrHaOWu40](https://www.youtube.com/watch?v=OCdrHaOWu40)</comment></comment>


Ask HN: Best Options to Start Internal Security Team(s)? - <AUTHOR> Here's the situation; I work for a company and within the last month we got informed that the product I work on will no longer get exemptions for deviations from the security policy. So now my manager and their manager are canvasing for ideas on how to address this, with the end result of putting together a team to start ensuring strict adherence to the security policy. Management wants to start doing pen testing, code analysis, threat modeling, etc.
I advocated to hire an outside firm because obviously that'd be their specialty but that fell on deaf ears, because money. It'd be "cheaper" to do it in-house instead of out-sourcing it. I responded that sure in the short-term that's true, but a thrown together internal team will have nowhere near the skills an outside firm does and it'll only be cheaper until a security flaw is exploited. But alas, I don't sign the checks so an internal team it is then.
I'm under no illusion that I have these skills and I'm aware that other engineers get degrees in this field, so there isn't going to be a "here you go, this is everything you need!" answer. I'm mostly looking for enough information for it to be "good enough" (I know not the best philosophy when it comes to security, but you can only do so much right?).
#1 - Are there any tools that we can use to help automate some of this? I've used WireShark in my work to do packet traces for debugging and I've played around with Kali Linux awhile a go in my free time.
#2 - What resources would you suggest we investigate to help this internal team learn the concepts and methodologies?
I'm trying to get as much of a head start on this as possible, even it it amounts to hey we should check out these technologies. I want our platform to be as secure as possible for our end users. <comment><USER2> In the short term, it is better to outsource and have someone that knows what they are doing build your security plan. They will probably suggest ongoing consulting as well, but for cost savings it would be better to have period (quarterly or 2x/year) reviews after you have things rolling. Long term, it would be better to build this out internally, but outsourcing could significantly jump start any improvements you'll see.</comment>


Stephen Hawking: Syria's war must end - <AUTHOR> http://www.washingtonpost.com/opinions/stephen-hawking-syrias-war-must-end/2014/02/14/a71dea72-94f0-11e3-83b9-1f024193bb84_story.html

<comment><USER2> He uses emotional and ethical arguments without any specifics nor plan: "Something must be done."

Some perspective. We created crisis where children die in large numbers in Iraq by toppling Saddam. Situation of children in Iraq 'a neglected crisis' [http://www.bbc.co.uk/news/world-middle- east-22366451](http://www.bbc.co.uk/news/world-middle-east-22366451) We are not killing them but we created the environment where they die.</comment>


Uhh, Google Assistant Impersonating a Human on the Phone Is Scary as Hell to Me - <AUTHOR> https://gizmodo.com/uhh-google-assistant-impersonating-a-human-is-scary-as-1825861987 <comment><USER2> i find the phenomenon of gizmodo bloggists impersonating journalists to be much scarier. what a horrible headline

<comment><USER3> The true irony is that Duplex uses "um" and "uhh" to sound more human... Gizmodo nicely displays the need for programmed language errors

</comment></comment><comment><USER4> From a different article:

But don't expect to be able to ask the agent any random question that pops into your head. "Duplex can only carry out natural conversations after being deeply trained in such domains," a Google release points out, "It cannot carry out general conversations."

[https://www.engadget.com/2018/05/08/pretty-sure-googles- new-...](https://www.engadget.com/2018/05/08/pretty-sure-googles-new-talking- ai-just-beat-the-turing-test/)

</comment><comment><USER5> It's hard to take an article seriously when the title is so full of hyperbole. This person needs to experience what _scary as hell_ is before using that line next time.

</comment><comment><USER6> I'm more worried about AI in drones deciding who lives / dies. That's way more scary (and a little terminator'ish).

</comment><comment><USER7> Finally, computers can talk to other humans for us.

That has always been such a hassle.

Dozens of seconds of our business day will now be freed up.

Thanks, Google</comment>


Sans Bullshit Sans - <AUTHOR> http://www.sansbullshitsans.com/ <comment><USER2> I was disappointed it didn't censor "Meticulously hand crafted" or "Made with love in San Francisco". Otherwise, rather lovely.

<comment><USER3> Same with "Disrupt all the things".

<comment><USER4> Synergistic wasn't censored in my case (but leverage was)

<comment><USER5> I was happy to see Long Tail was censored, but disappointed that Marketplace of Ideas wasn't.

</comment></comment></comment></comment><comment><USER6> If you like to know about what goes into creating a font like this, check my post about it: [http://pixelambacht.nl/2015/sans-bullshit- sans/](http://pixelambacht.nl/2015/sans-bullshit-sans/)

It's mostly command line tools, so don't worry about any artistic ability (I didn't).

<comment> mark-r Why so careful to choose Droid Sans for the main font, then use Comic Sans for the substitutions? Isn't Comic Sans the property of the most lawyered-up tech company on the planet?

<comment><USER6> The difference is that I used Comic Sans in the "design" of my censorship bars — I didn't redistribute the Comic Sans font itself.

</comment></comment></comment><comment><USER7> I love it, but it let this go completely uncensored:

"This transformative change in paradigm allows us to move beyond conventional thinking and kickstart the data driven era."

Gonna go ahead and flag that as a bug :-)

<comment><USER6> Good catch. I'll put the font on Github tonight. Create a ticket (er even better, a pull request), and we'll add that bullshit!

</comment></comment><comment><USER8> Needs work. Only about 10% of the relevant terms in Weird Al Yancovic's "Mission Statement" were marked out.

[http://lyrics.wikia.com/%22Weird_Al%22_Yankovic:Mission_Stat...](http://lyrics.wikia.com/%22Weird_Al%22_Yankovic:Mission_Statement)

</comment><comment><USER9> Please add one exception - "Cloud" should be turned into "Butt", not bullshit. That's what the laws of the Internet say.

Otherwise, amazing work!

<comment><USER10> Github is hosted in the butt, so I agree with your suggestion. I'll make a bullshit pull request and upload it to the butt soon.

</comment></comment><comment><USER11> Does anyone know how well search engines cope with ligatures? If they don't I expect it won't be long before we see spam sites using ligatures as a way to hide their spamminess.

<comment><USER12> Ligatures shouldn't affect search engines, as they will index the text of the pages, not the fonts/visual representation themselves.

<comment><USER13> I assume the problem would be the other way 'round: text that says one thing to search engines, but then uses a custom ligatured font to say something entirely different to users.

</comment></comment></comment><comment><USER14> I love ligatures - to me they're like the user interface paradigm of the future, and a good example of the beauty of ligatures is the Chartwell font [1] which allows the creation of beautiful, detailed graphs with little much more than a text editor.

[1] [https://www.fontfont.com/how-to-use-ff- chartwell](https://www.fontfont.com/how-to-use-ff-chartwell)

I'd love to see more innovation in the use of ligatures in user interface and graphics work - so I'm quite happy to learn of Sans Bullshit Sans. Hopefully this will prompt the investigation of ligatures, in general, by more designers .. and we can see other uses come out of this often-overlooked feature.

</comment><comment><USER15> There are more fun replacements than versions of "bullshit".

        the agile unicorn funded an uber immersive beta below the fold.

        the [bunk] [hogwash] [stultified] an [oafish] [foolish] [foolery] [in sheer madness]

Tricky: Make sure "a" vs "an" is still used correctly with replacements.

<comment><USER16> Replace "an" with "a", assuming "a" will sometimes be pronounced "ey".

</comment></comment><comment><USER17> Bullshit-ify bookmarklet. Create a bookmark with the following code as the url and click it on any website. :)

[https://gist.github.com/geoah/b2eda5b6cb7169bbbadb](https://gist.github.com/geoah/b2eda5b6cb7169bbbadb)

ps. Chrome seems to be removing the `javascript:` part when pasting the code.

<comment><USER18> Chrome does that to make self-XSS harder.

</comment></comment><comment><USER19> I've actually read corporate "mission statements" that don't even sound like English. Like, not just a few buzzwords, but near-complete gibberish in places. What possesses people to do this?

<comment><USER20> The goal is to write something that people can rally behind but that's at the same time not divisive. So it needs emotional impact without meaning, and thus we get corporate bullshit.

</comment></comment><comment><USER21> I'd like the see a version that replaces "the Cloud" with "the internet" and "in the Cloud" with "on the internet." The meaning is 100% unchanged--try it!

<comment><USER22> Chrome extension that replaces occurrences of 'the cloud' with 'my butt'

[https://github.com/panicsteve/cloud-to- butt](https://github.com/panicsteve/cloud-to-butt)

</comment></comment><comment><USER23> Nothing happened for "It's a 5 billion dollar market and we need only 1% of it."

I think they should work on incorporating phrases too. Regardless, this is insanely great.

<comment><USER24> I like your observation, but technically would this fall under bullshit or delusion?

I guess it's a matter of definition. Does bullshit require intentionally trying to bullshit someone, or is it sufficient to speak bullshit even if you actually believe what you are saying?

</comment></comment><comment><USER25> It would be fun if the sentence "Meticulously hand crafted by PixelAmbacht" had some of the ligatures. I expected it to have but it didn't.

</comment><comment><USER26> Can you make one for art bullshit too? Like: "This eclectic multi-layered work represents the stratification of society and holds a mirror in front of us, confronting the viewer with the tensions between individual desire and societal pressures to conform"

<comment><USER27> There is definitely a need for this in the art world. There is actually a bullshit artist statement generator out there that could be grepped for inclusion.

<comment><USER27> [http://www.artybollocks.com/](http://www.artybollocks.com/)

</comment></comment></comment><comment><USER28> For even more fun, install the font and put the following in your user stylesheet:

      * {
        font-family: 'Sans Bullshit Sans', cursive !important;
        text-rendering: optimizeLegibility !important;
      }

</comment><comment><USER29> What better way to put this font through its paces than the classic _Web Economy Bullshit Generator_ :

[http://www.dack.com/web/bullshit.html](http://www.dack.com/web/bullshit.html)

</comment><comment><USER30> And here I was thinking I was the only one who noticed this :)

Now all we need is something to "bullshitize" all those scroll-down parallax websites with a nice duotone-fullscreen-photo-at-the-top...

</comment><comment><USER31> haha, favourite part is the logo satire at the bottom of the page.

</comment><comment><USER32> Not working in Chrome 40

<comment><USER33> Definitively not working in Chrome 40 on OSX, but Firefox does. Lovely idea.

<comment><USER34> It is working on OSX Chrome 40 in my case.

</comment></comment></comment><comment><USER35> If you're not willing to make the jump to a font change, you can get Cloud2Butt for firefox or chrome and it will help a little.

</comment><comment><USER36> The more interesting part for me was how they made it [http://pixelambacht.nl/2015/sans-bullshit- sans/](http://pixelambacht.nl/2015/sans-bullshit-sans/)

TL;DR version: they made a font with custom ligatures, so that the sequence of glyphs that make 'synergy' are replaced with a single 'bullshit' glyph!

</comment><comment><USER37> I didn't see anything in the spec[1] about case insensitivity- but as long as the table is being generated programmatically, covering capitalized forms could be in order.

[1][http://www.microsoft.com/typography/otspec/gsub.htm](http://www.microsoft.com/typography/otspec/gsub.htm)

<comment><USER38> True. The mapping should be in github so people could add all case variations within reason.

I'd personally add (unicorn pivot|Unicorn pivot)--> "Stinking just made BS" on to it.

</comment></comment><comment><USER39> What would be great is to be able to pass the text as a URL parameter or save the text in bsFiddle. Something like:

[http://www.sansbullshitsans.com?bs1234](http://www.sansbullshitsans.com?bs1234)

That would make it easier to share my bullshit on social media and align strategies with product synergy.

</comment><comment><USER40> My invented mission statement made it through unaltered.

"We reinterpret the existing synergistic environment to create an overarching fluidity that will encompass both the paradoxical business lexicon and the mainstream black swansong."

I hope I haven't inadvertently created some new buzzphrasing..

</comment><comment><USER41> Beware! If you have droid sans installed, this will overwrite it (make sure to name your fonts!)

<comment><USER6> Oh, nice catch. I'll fix that tonight. Edit: fixed, thanks again

</comment></comment><comment><USER17> OSX Chrome 40 64bit issue: Pasting text copied from anything that support formatting via html will retain font/size from copied text and thus BS font will not being used. Even Cmd+a and removing the text will retain wrong font.

<comment><USER42> That's OS X default behavior for rich text editing controls. You're supposed to us "Paste and Match Style" instead of just "Paste" if you don't want to retain the original formatting attributes.

</comment></comment><comment><USER43> "internet of things" gets through the b.s. filter. Kindly fix. Thank you!

<comment><USER44> Also synergy is bullshitted, but synergies not.

<comment><USER45> Yup, personally I don't see the point of doing _anything_ if it's only going to give me one synergy...

<comment><USER46> The key part of having multiple synergies is that your synergies can synergize. This makes synergistics a critical component of disruptive growth hacking, as your additional synergies will scale up non-linearly. That's why at Synrgize we're making the world a better place by constructing elegant hierarchies for maximum synergistic synergization.

</comment></comment></comment></comment><comment><USER47> Lovely! Needs a "translator" for sites along with BS counter.

<comment><USER48> Something like [https://github.com/mourner/bullshit.js](https://github.com/mourner/bullshit.js) ?

<comment><USER47> Heh, something like that, thanks.

</comment></comment></comment><comment><USER49> All I got it to sensor was 'startup' and 'flow' by pasting in all the titles from HN. So I am pretty proud that I can't come up with such things more naturally :).

</comment><comment><USER50> Great concept. Improve it by adding the plural and gerund forms of the bullshit jargon words: _synergies_ , _leveraging_ , and so on.

</comment><comment><USER24> I'm going to make a list of everyone who comments on this post as people I may enjoy working with on a future project.

</comment><comment><USER51> I tried "It's like bullshit bingo but for geeks."

Apparently it is quite happy to be described as such. :-)

</comment><comment><USER15> Also [https://xkcd.com/1288/](https://xkcd.com/1288/)

</comment><comment><USER52> missed 'synergistic' and 'mobile-first', though it did get 'leverage'

</comment><comment><USER53> why "cloud" isnt censored?

<comment><USER54> needs "internet of things" too

</comment></comment><comment><USER55> Any way to automatically apply this to techcrunch.com? I imagine not much would be left.

</comment><comment><USER56> I expected it to pick up Big Data. (not that I am against key-value stores)

</comment><comment><USER57> Seems to be missing the "digital strategist" ligature :).

</comment><comment><USER58> does not work in IE - "@font-face failed OpenType embedding permission check. Permission must be Installable."

<comment><USER6> This should be fixed now. If you download the font again, it should be installable. (If you could check and let me know I'd be eternally grateful! I don't have a Windows machine nearby.)

<comment><USER58> nope, not fixed yet, same error. fsType bit should be 0.

<comment><USER6> Yeah, that was the fix. Works fine on the Windows machines I just tested with. Did you redownload the font?

</comment></comment></comment></comment><comment><USER59> The image at the very bottom made me laugh.

</comment><comment><USER60> I think this is great to test your pitch!

</comment><comment><USER61> Caps breaks it.

<comment><USER44> That's probably quite tricky to fix as ligatures are case-sentivive. It makes little sense to have an fi ligeture applied to FI, as well. And the longer the letter combination, the more variants you'd have to include (2^length).

<comment><USER62> To be fair, you only need three to cover the vast majority of actual uses: variant, Variant, VARIANT.

</comment></comment></comment><comment><USER63> this falls victim to the scunthorp problem. e.g. the word "fragile" becomes fr<bs>.

<comment><USER64> Scunthorpe*. References to that problem always greatly amuse me, I live literally down the road.

</comment></comment><comment><USER65> That purple color is amazing!

</comment><comment><USER66> Great now every HN post appears to be the same story.

</comment><comment><USER67> Can we have one for science please.

novel

innovative

groundbreaking

paradigm shift

etc etc</comment>


Mt. Gox leak rumor - <AUTHOR> http://pastebin.com/8gbUXLN3 <comment><USER3> Before everybody gets all up in arms about how this says that they still had around 1 million BTC, remember that this lines up exactly with what Mt. Gox has been saying.

This is Mt. Gox's own accounting. It _should_ report that they still have BTC. But these are just numbers from a database. What Gox has said is that while they thought that they still had BTC, while their systems (AKA this) still reported them having lots of BTC, the actual wallets had long since been emptied.

So really, this doesn't help anybody in any ways. It could still be a hack, or it could be Gox screwing with everybody, or it could be something else entirely. It really doesn't mean anything. Other that showing that Gox still can't secure anything to save their life.

<comment><USER4> Can someone explain how these guys managed to write their software in such a way that there was zero automatic verification that what their database said matched what was in the wallets, even just a cron job that ran once a week or something? I mean, I'm assuming there's a good reason, because I can't figure out how anyone could overlook something like that.

<comment><USER5> If you have bitcoins in 'cold storage' (Gox supposedly had 99+% their BTC that way) - i.e., the keys are physically offline and not accessible remotely in any way - then I don't see any easy ways of checking if all those coins are still valid.

<comment><USER6> "the keys" are the private component of a private key/public key pair. the public key can be shared with anyone / stored anywhere, and gives you the address which makes checking ones balance trivial.

<comment><USER5> Okay, you can detect open thefts that way and Gox should've implemented that. But you still can't detect if you've lost control of the private keys - <USER2> you've split all your cold balance into many addresses of X BTC each, then you can remotely check if the addresses are still filled, however, if an [inside] attacker takes those keys and replaces them with garbage, then no auditor is going to know that the addresses aren't in your control anymore; the solution would probably be periodic (automatic?) proof-of-ownership tests on those balances.

In any case, securing BTC is hard and requires stricter controls and more discipline than securing general banking systems, as the nature of BTC makes it easier to get away with large amounts of funds. For example, you need a solid solution for multiple "write-only" offsite backups of 'cold keys' because otherwise you simply risk your assets being permanently destroyed due to a simple hardware failure, but if anyone in your company is able to singlehandedly recover&decrypt a single such backup then he can immediately abscond with all money.

</comment></comment></comment></comment></comment><comment><USER7> The full leak contains a back office administration tool used by Mt.Gox, and what looks to be complete trade logs up to and including November 2013. The leakers haven't included any personally identifiable information.

If it means anything, I've had a look for my trading activity and it's all there and completely correct.

<comment><USER8> They certainly have. The amounts withdrawn and deposited are enough to make solid connections between addresses on the blockchain. With this information it's possible to make a lot of associations between addresses you couldn't before knowing this information. From what I've read it gives the amount, account hash and the time, that's more than enough to uniquely identify them on the blockchain.

<comment><USER9> For people who had frequently reused publicly known addresses it's as good as putting their account name on the records.

I guess people didn't learn from the infamous AOL search data release.

</comment></comment></comment><comment><USER10> It is possible that MtGox lost its money by dipping into deposits and pending cash withdrawals for its own use. Then, maybe some bad investments snowballed and they couldn't recover.

This seems more likely than someone hacking them and ripping off hundreds of millions of dollars worth of bitcoins without them noticing.

There is regulation that prevents this (most of the time) in banks, but in an unregulated exchange it would be easy (and stupid) to start gambling with customer deposits and pending withdrawals.

A few months ago I set up a MtGox account, and noticed the MtGox policy of taking weeks or months to wire the proceeds from a bitcoin sale. That seemed like a red flag, and made me wonder what they're doing with the cash between the bitcoin sale and the wire transfer. I'm glad I opted out of MtGox.

</comment><comment><USER11> This is the same content posted to Karpeles' blog, already being discussed here: [https://news.ycombinator.com/item?id=7369072](https://news.ycombinator.com/item?id=7369072)

<comment><AUTHOR> Ah thanks. Poster of this HN post here. I posted it on pastebin because the original content could be removed later and I thought saving in a cache like pastebin was a good idea, so I didn't check whether original link has been posted or not.

<comment><USER12> Yeah you were quite right, the info has now been removed from Mark's blog.

</comment></comment></comment><comment><USER13> From a legal perspective for mtgox you really couldn't hope for better news, not only have their systems been tampered with but now there is undoubted proof.

Just paint yourself as the good guy amongst a scene of money launderers, hackers and drug dealers. This isn't proof of fraud, it's proof that people broke into their systems and tampered with them.

<comment><USER14> The attackers here broke in and stole a DB copy, they may not have been able to tamper (e.g.: they had access to a backup of the DB but not the running copy)

It's probably still a good part of a "we're incompetent not malicious!" defense, if that is how they decide to handle things.

</comment></comment><comment><USER15> I've loosely been following the MtGox fiasco, including previous hacking that revealed voice conversations, passport scans, etc. However, I don't quite understand the context or ramifications of this leak. Could someone give a brief description?

Much appreciated!

<comment><USER16> I took this away as a tl;dr

       Currency: BTC Balance: 951,116.21905382 <– That fat fuck has been lying!!

<comment><USER17> But in another part of the statement it says "We stole no bitcoins. There were none to steal.", which seems to contradict them having ~1 million BTC.

<comment><USER18> The balance may have been obtained from the logs, rather than from actual funds stored in the wallets.

<comment><USER14> It's a DB dump, so this is exactly what it is.

If they had the public keys to all Mt Gox's wallets whey would be able to check them for funds, but there would still be questions about who controlled the wallets and if they had found them all so it would still not be proof of fraud (but the more evidence collected the more likely there will be something confirm-able discovered)

</comment></comment></comment></comment></comment><comment><USER19> Its correct, has 20 euro balance on an account I haven't used in 2 years and forgot about until this hoopla began</comment>


Source: Apple to discontinue iPad mini - <AUTHOR> https://bgr.com/2017/05/16/ipad-mini-ipad-pro-10-5-inch-wwdc/ <comment><USER2> This is sad. The iPad mini was the one iPad that I really liked. It's incredibly light weight and about the right size to have as a useful hole in space that connects to the Internet.

<comment><USER3> Same! I was hoping to buy the new update to it next month! The 9.7" iPad feels too big for most of what I want to do with it.

<comment><USER4> Yeah, I've been waiting for an update so I can replace my Mini 2 (16 GB).

I bought the original iPad and the iPad 2 and never found a use for them, so when I needed a new iPad for work I went with the cheapest one. I actually found with the Mini form-factor I started using the thing, and now the 16 GB storage makes it a massive pain in the ass because the features that make the iOS ecosystem really seamless (iCloud) don't work with 16 GB.

Now I'm left wondering if I should get the mini 4 on this rumor...

</comment></comment></comment><comment><USER5> What the heck Apple? Do they not get that even the 9.7" size is too big for a lot of users (elderly, children). Its the perfect size, and the price difference between a iPhone 7 plus and the iPad mini is huge. I am hoping this another BGR rumor fail, but considering the lack of love Apple displayed in updates, it seems uncomfortably close to home.

<comment><USER6> Why would eldery users prefer smaller size screens?

<comment><USER5> Weight of device and easier to handle

<comment><USER7> So it has nothing to do with size, right?

<comment><USER5> Easier to handle is size based[1]. The smaller size generally means less weight than a bigger iPad of the same generation.

I am a bit worried about Apple's desire to remove the bezel since that will cause some problem and iBooks likes to flip a lot of pages if your thumb strays.

1) [edit] the iPad pro is just a no go because of its size, and the iPad 9.7 is too big for a lot of children and some adults. Remember, a lot of activities are hold it up with one hand for long periods of time while tapping with the other.

<comment><USER8> The handling issues has mostly to do with weight rather then size. If someday the iPad 9.7 has much less bezel, half as thick, and much lighter. Would that still be a problem?

I think that is where iPad is heading. Some argue Apple is obsess with thinness, personally I think both iPhone and especially the iPad has a long way to go before it is Too Thin.

<comment><USER5> Nope, the size is the big thing. Weight is a factor but the mini is a good size for holding. The 9.7 will always be more awkward than the mini. So, yes, a lighter 9.7 does not replace the mini. That argument is the same as saying a lighter 12" could replace the 9.7 which doesn't work because the 12 is painfully awkward to use.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> So every dynamic point of purchase, a ton of specialty medical equipment, as well as hardware for children and elderly would be forced to use the ipad air(which is too big and too expensive)

<comment><USER4> There is no iPad Air anymore. There's just "iPad" (which is essentially the old Air 2), and they discontinued iPad minis with less than 128 GB storage, so right now the cheapest iPad is the "iPad" (ex-Air 2).

<comment><USER10> Which is only $329.

</comment></comment></comment><comment><USER11> The article does not look credible. It has no source, no evidence whatsoever. Am I supposed to take the author's word as gospel?

<comment><USER12> Well, obviously they can't name their source. BGR isn't some random dude's blog, though; they have a solid (if imperfect) record of publishing accurate Apple leaks.

<comment><USER11> The thing is, if you read the full article, they don't even mention they have a source. They're just publishing their best guesses IMHO.

<comment><USER13> "and that's why we have heard from a source close to Apple that the iPad mini is being phased out."

</comment></comment></comment></comment><comment><USER14> As someone with an 11" MBA, it makes no sense for me to buy a full-sized iPad. I love the mini and use it for personal use and to demo my apps at conferences.

Now it looks like the 11" MBA is being phased out, and the mini also. My hope is that the bezel on the 13" laptops will continue to shrink so that the footprint ends up about the same as the old 11", and then maybe I can upgrade to a 13" laptop and a full-sized iPad. Until then, I'm in a holding pattern.

<comment><USER10> What about the 12" Macbook? It's the same size as the 11" MBA.

<comment><USER14> Insufficient ports.

<comment><USER10> How often do you need more than 1 port?

</comment></comment></comment></comment><comment><USER15> So, this isn't official, and should be taken with a grain of salt. But if it is true... well, to everyone asking how Apple could do this, "they're not selling as many of them as they would need to to get the margins they want" is probably the answer.

</comment><comment><USER16> That would suck. I've tried all three sizes and, for me, the mini one is the best. The others are far too large for me. I have the iphone 7 plus, but the mini's bigger size makes it worth carrying both around.

</comment><comment><USER17> I use a Zagg Rugged Book keyboard case to turn my iPad Mini 4 into a 'netbook' which fits into the hip pocket of the 'business BDUs' I routinely wear.

My iPhone 7 Plus is great, but my iPad Mini with the Zagg keyboard case is fabulous as a portable device for writing, remote access, etc. I'll really be disappointed if Apple cancel it.

</comment><comment><USER18> The 9.7 iPad is too big for me, I mostly use my iPad mini for reading. The 7.9 4:3 screen size is perfect for that. Android tablets have AWFUL standby battery efficiency, I use my iPad mini for a full week with a single charge!

</comment><comment><USER19> We love our iPad minis! I say this shows how out of touch Apple has become up in their ivory towers. Ultimately the market will decide their fate, but that's $499 they're not getting from us this year.

</comment><comment><USER7> Just a week after I considered buying my first Apple product, iPad Mini specifically. But to be honest, I was going to use it instead of my phone.

</comment><comment><USER20> How is the iPad mini in the same market as a plus-model iPhone? iPad mini's are _mostly_ for kids and grandmothers.

<comment><USER4> Maybe if they had an iPod Touch Plus, but that's not happening...

The iPad Mini size is perfect for watching video in bed in the evening/morning for me. iPhone Plus could probably be doable, but I don't want to carry that huge thing in my pocket all day.

<comment><USER21> I have both a 7+ and an iPad mini, the iPad is mostly used for reading in the Kindle app. It's the perfect size for that and it fits in the outer pocket of my lunch box.

It's also convenient to use for the DJI Go app for my drone, which absolutely demolishes any device battery. It's light enough so your arms won't get tired, and it spares my phone's battery.

</comment></comment></comment><comment><USER22> Makes sense. The difference between the iPad Mini's 7.9″ screen, and the iPhone 7+'s 5.5″ screen makes it hard to differentiate the two.

<comment><USER23> That 7.9" screen is twice the size of my Nexus 6P which is bigger than the biggest iphone. Its not "hard" to differentiate, its practically night and day.

iphone 6 9.4 sq inches.

iphone 6 plus 12.9 sq inches.

ipad mini 29.6 square inches

</comment></comment><comment><USER24> Flagging this for being a dubiously sourced rumor. Perhaps a title change at least.</comment>


Language as a Window into Human Nature (RSA Animate) - <AUTHOR> http://www.youtube.com/watch?v=3-son3EJTrU <comment><USER2> Please, _please,_ don't anyone follow the link to "Drive: the surprising truth about motivation" and think "Woah! I'll submit that to HN" - and then submit it.

Please, don't. It's been submitted _many_ times before.</comment>


Ask HN: How would you "try out" companies when internships aren't an option? - <AUTHOR> I never got the chance to intern as a programmer at big companies, as I never majored in Computer Science. But I'd like to get that experience of getting a feel for their workflow and environment before I really commit to one.<p>Such as, applying for several companies that you have an interest in. But your school years are well behind you, so you can't apply to internships. However, you would want to them out for a few months without needing a long-term commitment, learn the ropes of how they do their work internally. Can you substitute internships with proposing short-term contract work for them, explaining your terms and expectations? <comment><USER2> Might work, but... slow learning process. Some alternatives:

[https://www.keyvalues.com/](https://www.keyvalues.com/) may give some insight on some companies.

[https://theaccidentalengineer.com/](https://theaccidentalengineer.com/) has interviews with people at lots of companies, to see what they're like.</comment>