CloudFlare Is Enabling SSL by Default - <AUTHOR> https://www.cloudflare.com/ssl#universal_ssl <comment><USER2> It shows me Expired SSL in red under the SSL options, even though I have a free account and the Flexible SSL option, which doesn't seem to work. Is that supposed to happen?</comment>


The Three Questions: Culture Biosciences - <AUTHOR> https://dalton.substack.com/p/the-three-questions-culture-biosciences <comment><AUTHOR> Hello HN, I am the author of this - it's part of a series of short posts about startups I that worked directly with at YC. This is the first one I have posted one to HN.

Let me know if you have any questions. Also I would love to hear if you are working on something ambitious like the Culture Biosciences founders are!

<comment><USER2> Hello HN! Will here, CEO of Culture Biosciences. Happy to answer any questions you have.

<comment><USER3> Is Culture currently profitable? If not, how do you plan to be? When biotech companies fail, a lot of institutional knowledge tend to be lost so it is a great tragedy when one does.

The Y2K overshadowed the bubble for biotech companies, but similarly a lot of companies were hyped up but in the end achieved nothing. Not on the Theranos Level of failure but basically flops. A lot of basic research lead to dead ends, so funding and finances are pretty important.

</comment></comment></comment><comment><USER4> The story of how AWS started is a common misconception. Yes, it began with S3, but it's just not true that Amazon externalized its internal application hosting technology.</comment>


New 'Meow' attack has deleted almost 4k unsecured databases - <AUTHOR> https://www.bleepingcomputer.com/news/security/new-meow-attack-has-deleted-almost-4-000-unsecured-databases/ <comment><USER3> Works great. You can already find questions on Stack Overflow from people getting their database deleted

[https://stackoverflow.com/questions/63067062/elastic- search-...](https://stackoverflow.com/questions/63067062/elastic-search- indexes-gets-deleted-frequently)

Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

<comment><USER4> I'm working on a personal project and not at all related to my work. I accidentally kept ports open :facepalm, sorting things out now :)

<comment><USER3> Recommend to setup two subnets in your project. One public and one private. This prevents this sort of issues, instances in the private subnet simply don't get a public IP, they can't be reached over the internet.

For reference, the standard practice in a company is to have a (third) separate subnet for databases, with zero internet access (no NAT gateway). Connection must be explicitly opened from/to database clients. It's a nightmare to manage on premise but it works really well in the cloud with firewalls allowing traffic based on instance tags.

<comment><USER5> > Recommend to setup two subnets in your project. One public and one private.

This is very good advice. We recently had a uni project where we had to use a MongoDB database. Somebody just apt-get installed a mongodb onto a DO droplet called it a day. Two days later the only remaining records prompted us to transfer x amount of BTC to a adress that was store in our DB. It just contained dummy data, but it is worrying that something like this apparently happens to lots of companies as well.

The only thing I find weird is that ElasticSearch itself does not offer a way to handle authentication, it was just enabled by a plugin that was paid (it seems like its free now).

<comment><USER6> > The only thing I find weird is that ElasticSearch itself does not offer a > way to handle authentication, it was just enabled by a plugin that was paid > (it seems like its free now).

"Wierd" is an interesting euphemism for "irresponsible." Defaults are very important. Insecure by default is insecure for 90+% of deployments.

<comment><USER7> I have _some_ sympathy for ElasticSearch and Redis, having designed/built their software under the assumption it isn't ever intended to be publicly accessible over the internet.

I have a bunch of fairly important personal documents in a filing cabinet with no lock. And I'm perfectly fine with that. I wouldn't keep it in my front yard, because that's obviously stupid, but keeping it inside behind my locked door and upstairs in my office? A perfectly acceptable risk (for me and my files).

I do agree that ElasticSearch do a quite poor/irresponsible job of pointing out their cabinet has no lock. I think Redis do a better job, but are seriously let down by all the internet tutorials that just say "sudo yum install redis" as a minor intermediate step in getting example-todo-list-de- jour working - without even a footnote explaining that anybody who actually visited the redis site now has instructions on how to p0wn your box. ( [http://antirez.com/news/96](http://antirez.com/news/96) ) I do think the "Securing Redis" section of this page - [https://redis.io/topics/quickstart](https://redis.io/topics/quickstart) \- deserves to be much closer to the top - I'd have put it before the how to download/install/start instructions myself (though I _think_ recent versions of redis only bind to localhost in the default config, maybe?)

<comment><USER8> If your assumptions are repearedly demonstrated invalid _they are wrong._

Change them.

<comment><USER7> Personally, I reckon that applies at least as much (if not more) to the devs installing random software packages onto internet connected and un-firewalled servers - as it does to database developers who document clearly that their software is not intended and is actively unsafe to install on directly internet connected servers...

Cave ne recipiens donum...

<comment><USER8> If a thing should not _be_ run in a given configuration then it should not be _runnable_ in that configuration.

The vendor / developer has both awareness and capability to ensure this.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways.

If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which wouldn't otherwise have been secured which are now spared from not only destruction but theft.

<comment><USER10> It's also easy to get bitten by Docker. You can secure your server with iptables/ufw only to discover that docker happily punches through your firewall and you need to filter on the DOCKER-USER chain - and even that was broken: [https://unrouted.io/2017/08/15/docker- firewall/](https://unrouted.io/2017/08/15/docker-firewall/) [https://github.com/docker/for- linux/issues/690](https://github.com/docker/for-linux/issues/690)

<comment><USER11> Seriously this is the most annoying thing ever, especially if someone on your team things you need to expose the ports to redis in a docker compose. I've come back from a weekend where my redis instance was being used for crypto mining.

Anything that is insecure by default in 2020 should be killed off IMO.

<comment><USER12> Secure by default is super onerous though. What if I just want to try out something before committing to it, do I really need to jump through a bunch of security hoops?

<comment><USER13> Then you just pass the `--disable-all-security` flag. (Or whatever similar method the project you're using exposes to allow that.) Secure-by-default doesn't have to be complicated; it's just a way to ensure people don't shoot themselves in the foot without comprehending what they're doing.

<comment><USER9> Thank you for this reply; it's my favorite post in the entire discussion. It illustrates perfectly why insecure defaults are a terrible way to implement "tutorial mode".

</comment></comment></comment></comment></comment></comment><comment><USER14> This reminds me of "crackit"[0] from a few years ago with Redis. A lot of folks kept their Redis server bound to 0.0.0.0 with no firewall or published port 6379 by "accident" with Docker and by default Redis uses no password. It was a lot worse than meow because with some Redis configuration magic anyone could inject their own SSH keys onto the server.

This article says Redis is affected but I would be curious to see which version of Redis was being used because they changed their default configuration after crackit was wide spread.

[0]: [http://antirez.com/news/96](http://antirez.com/news/96)

<comment><USER15> Yeah one thing though with Docker is that in some cases it injects its rules into iptables _before_ the firewall application's.

I was using arno-iptables-firewall and this suffered from that, docker containers would be world accessible. In general I only bind them to localhost anyway, but I figured this out when testing. It doesn't seem to happen with UFW.

But I can imagine some people know how to set up a firewall but then just assume it works and don't check. This is the kind I do feel sorry for, at least they tried to protect it.

</comment></comment><comment><USER16> This is what happens when you lay off all of your sysadmins because "the cloud", move that role to devops and then downsize that to a subduty of a developer.

<comment><USER17> I've seen just as many sysadmins do this as developers. It's not a question of job title as a psychological pitfall (people who are looking for things to succeed don't ask when they should fail) and companies not specifically retaining people with security experience because they cost more.

<comment><USER18> It can be though. Downsizing and getting rid of specialists certainly hurts companies. There are only so many hours in the day and that desperate guy working 14-16 hours a day because of covid downsizing is eventually going to eff up no matter how talented she is.

<comment><USER17> I'm not sure exactly what you're disagreeing with. My point was just that it's not useful to direct criticism at a job title when there are so many examples of failures by people with any given title. I've seen people who are ostensibly pen-testers or auditors blithely telling others to click through important warnings or have a root-on-all-machines password to make their work easier.

Downsizing and other false economies are definitely a contributing factor. Security and reliability are easy to dismiss as expensive overhead until they suddenly aren't.

</comment></comment></comment></comment><comment><USER19> Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

<comment><USER20> I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to their owner? Sure. But that is far from all of them.

I also just think it is a little uncharitable to wish harm on people simply because whoever did their IT was inexpert at their job? Like, how does the local mom and pop correctly evaluate a person's IT chops? The nephew says they can set up their website for cheap, and they want to be nice, so they give him the job. Turns out he's a newb and later their database gets deleted and you are on here saying that's a good thing? Hrm. I don't agree.

<comment><USER21> It can definitely have real world consequences, but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? The company could take a huge financial hit and people might lose their jobs because of their practices being exposed.

<comment><USER20> Sometimes the best path forward does harm, sure. It's just hard for me to agree that deleting these databases is the harm-minimizing path. One example of a less harmful path that comes to mind immediately is installing a random password on the unsecured database and emailing the domain owner the password. That would cause downtime but it would limit the irreversible damage. You could even say that you will delete the database if it is found again with an unsecured password, if you wanted to add some stick to your carrot. It does not seem like this attack has harm-minimization in mind.

<comment><USER22> What you propose is illegal in most 1st/2nd world countries. In mine, the company could thank you and then put you straight to jail for 30 years. Unfortunately very few small businesses run sade reporting programs and often react with attack.

<comment><USER23> So is deleting a database.

Putting a password and emailing the admin would solve the password problem.

But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.

<comment><USER24> How about simply emailing the admin to tell them their database is unsecured? Oh, but that would be benign; I'm sure vandalism is so much more fun.

<comment><USER25> It's easy to say "you could have just emailed them" when you are not the one doing this for years without things getting better. Often admins flat out ignore you. Even if not they usually do nothing. And if they do something it takes ages.

<comment><USER24> I don't doubt that for a moment; I have also reported issues of various kinds -- not this specific one -- that have gone unresolved for ages.

That still doesn't justify vandalism.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; [https://legal- dictionary.thefreedictionary.com/Willful+damag...](https://legal- dictionary.thefreedictionary.com/Willful+damage)). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "now they'll learn." What's a real world parallel for this? If an organisation is putting its customers at risk, you can report them. In these cases, companies with insecure data stores are putting their customers at risk by exposing their data. Is there anyone you can report them to? Is there any organisation that will hold them accountable to actually make changes?

I'd also note that not all DBs contain other people's data. Those have no moral concerns with bring public. There is a risk that someone will destroy it, but I'd say that's the same risk taken with public art or something. Yes it's public; yes someone can destroy it; yes it's illegal for someone to destroy it (even though it's public); no, the fact that it's public is not illegal.

<comment><USER27> > It's illegal in the real world, and should be illegal in the digital world

It is illegal in the USA. And is easily an arguable civil case as well. The problem is identifying the perportrator.

Organizations are only way to hold poor actors accountable. Bad PR and going out of business cause data critical to operations has all been deleted are strong incentives. Unfortunately businesses typically lobby for harsh laws, tyrancial surveillance rather than the expensive and difficult process of improving their operational security.

<comment><USER26> Bad PR works to an extent, but bad PR can be combatted with good PR, not necessarily with changes. I think an independent regulator would be useful; one that can testify that a company is following best practices for data, etc. Although if the regulators don't have any teeth, or if they don't have a clear benefit for companies to allow a regular, comprehensive, internal audit, it definitely won't gain any adoption.

</comment></comment></comment><comment><USER28> The part that confuses me here is that everybody seems to take in stride that all these public-facing databases are already tracked and indexed. Like, how does [https://www.shodan.io/search?query=meow+indices](https://www.shodan.io/search?query=meow+indices) know all this? What am I missing here?

Is this attack literally "attempt access each database listed on shodan.io and destroy it if that works"?

I might be missing some major aspect (I certainly hope so), but isn't this like wondering why all those fireworks that people keep storing on the streets were eventually set off by some kid with a mask? Why isn't the question "why didn't this happen sooner"?

<comment><USER29> It has already happened in the past. Repeatedly. There's news coverage about this at least once a year. And it doesn't require using Shodan as there are plenty of open-source tools for scanning the Internet nowadays.

For example, this was from the same news website a few years ago:

[https://www.bleepingcomputer.com/news/security/massive- wave-...](https://www.bleepingcomputer.com/news/security/massive-wave-of- mongodb-ransom-attacks-makes-26-000-new-victims/)

I've also written about it many times:

[https://blog.shodan.io/its-the-data-stupid/](https://blog.shodan.io/its-the- data-stupid/)

[https://blog.shodan.io/its-still-the-data- stupid/](https://blog.shodan.io/its-still-the-data-stupid/)

[https://blog.shodan.io/the-hdfs-juggernaut/](https://blog.shodan.io/the-hdfs- juggernaut/)

[https://blog.shodan.io/elastic-data-exposure-grows- to-3-2-pb...](https://blog.shodan.io/elastic-data-exposure-grows-to-3-2-pb/)

<comment><USER28> Jeez, that's a pretty impressive dumpster fire. And it's been going for half a decade. Kudos for keeping track of it and periodically doing your part in reminding the world.

</comment></comment></comment><comment><USER30> Is there an inexpensive service out there that does "mock" attacks if you give it a bunch of host names and ports? I know it's something you could create yourself but would be nice to have a third party try to connect to your databases and immediately alert you if it was able to gain access.

Would especially be useful if you were tinkering with firewall/security settings and accidentally opened something up.

<comment><USER29> Shodan Monitor will do it and if you're only keeping track of <= 16 IPs then you would just need the membership which is a one-time payment of $49 (i.e. no subscription cost) for a lifetime account upgrade ([https://www.shodan.io/store/member](https://www.shodan.io/store/member)). You just provide an IP/ network/ domain and we'll notify you if anything changes or becomes vulnerable. It's basically Google Alerts but for network ports:

[https://monitor.shodan.io](https://monitor.shodan.io)

Disclaimer: I'm the founder of Shodan.

<comment><USER30> Thanks that's exactly what I was looking for. I didn't want an open source DIY option because I am lazy and just want to plug in Ips and ports.

Also just curious, what's your annual revenue like?

<comment><USER29> We don't share revenue information but we've seen steady growth for the past 10+ years. All I can say is that Shodan is a profitable, bootstrapped business with >3.5 million users, 80%+ of Fortune 100 and thousands of universities (we let them setup monitoring for free for up to 120k IPs).

</comment></comment></comment></comment><comment><USER15> It's not necessarily 'deleted', these Script Kitties just replaced some data with more valuable stuff. You can never have enough meows!

But seriously, these guys are doing us a favour. You can bet the affected companies will not expose customer data again.

<comment><USER31> > You can bet the affected companies will not expose customer data again.

I hope so, but I seriously doubt that. Having open databases is extreme incompetency.

<comment><USER32> If this keeps happening weekly, they'll fix it. Maybe there should be a government Agency for Deleting Publicly Exposed Databases that's likely to hit any that you stand up within a week. Also, make having had a publicly exposed database deleted something that is in the public record, and highly prejudicial evidence in civil liability cases.

A Department of Botnet-Suseptible IoT Device Bricking would be useful in the same way.

</comment></comment></comment><comment><USER33> Cats like knocking stuff off tables.

<comment><USER34> Brilliant!

</comment></comment><comment><USER35> If a business or org is careless enough to leave their data exposed, they deserve to be punished like this. I'd rather have my sensitive data deleted by hackers than exposed by hackers.

</comment><comment><USER36> ELI5:

Way back in the early 2000s I was a young mid level developer and we had a SQL Server backed solution. There was a wide spread attack on Sql Server installations that didn't change the default blank SA password. We were one of the companies that didn't.

But, even then I knew not to have a publicly accessible database server. We just didn't give the server a public IP address. Nothing fancy. We weren't affected but I immediately changed the password.

Fast forward to 2018. The company I worked for was just starting to ramp up an in-house development staff led by a new CTO. Everything had been outsourced to a foreign agency. They had a publicly accessible ElasticSearch cluster. I wasn't on the team responsible for it, but I know that the architect on the team knew better. Even though he didn't setup the original cluster, he knew it was insecure and just didn't prioritize recreating it inside our VPC.

Of course we got hacked and someone deleted everything in it. Then they decided to go ahead and recreate it inside the VPC. Luckily we didn't use ES as a primary store and we were just offline all day while we ran the process to repopulate the cluster from our Mysql database.

Why do people keep making the same mistake? I was definitely not any world class software architect at 25 years old, but even I knew to be cautious about giving servers public IP addresses unnecessarily.

<comment><USER37> Because you're completely wrong; what you're advocating is nothing more than security by obscurity. An address is just an address; it tells you where something is. If you don't have a firewall in place, then any attacker who cares enough to actually route a packet to your internal servers can access them. If you do have a firewall in place, then an attacker gains nothing from knowing the address of a server they can't send any packets to. Private networks add a huge amount of complexity with its own security holes (they're easy to scan once you're inside them, a lot of operating systems treat them as somehow "safer" than the public internet...). They do more harm than good.

<comment><USER36> You realize you can't get to a private IP address over the Internet right? It's kind of how that whole TCP/IP thing works.

You know a "private IP address" isn't one that's not known it's one that not routable over the public internet.

RFC 1918 was written in _1993_

<comment><USER37> > You realize you can't get to a private IP address over the Internet right?

Of course you can - most end users have private IP addresses these days, yet they somehow manage to communicate with people on the internet.

A private IP address is of course not routable directly on the Internet. But routers route, and can certainly route a packet from the public internet to an RFC 1918 private address. If the routers on the edge of your RFC1918 network do not have firewalls in place, then they will happily route packets to your internal servers and you're no better off (against a serious attacker; a script kiddie might ignore you as too much effort, sure) than if you used public addresses. If those routers do have firewalls in place, then you're also no better off than if you used public addresses.

<comment><USER36> In the case of the attack in question - how would they have initiated a command to erase the ElasticSearch cluster from the Internet?

Any NAT would be stateful and the communication would have had to be initiated from the cluster.

Not having a public IP address is not about "obscuring" the IP address. It's not like so said why didn't they have ES listening on a non standard port.

<comment><USER37> > Any NAT would be stateful and the communication would have had to be > initiated from the cluster.

Only if the router is configured that way - and you don't need NAT to configure it like that. If the router is open then you just set the destination address to the address of the server you want it to go to. (As for getting it to the router you either find a way onto the same segment, explicitly specify it as a routing hop, use ip-in-ip...).

NAT is not a security mechanism. Often the same device does both, but they are separate functions.

> Not having a public IP address is not about "obscuring" the IP address. It's > not like so said why didn't they have ES listening on a non standard port.

It's exactly like that!

<comment><USER36> _Only if the router is configured that way - and you don 't need NAT to configure it like that. If the router is open then you just set the destination address to the address of the server you want it to go to. (As for getting it to the router you either find a way onto the same segment, explicitly specify it as a routing hop, use ip-in-ip...)._

So if someone purposefully for some reason goes in and configures their router to map a port to a specific internal IP address to allow internet traffic to their ES cluster it isn't secure? Isn't that kind of stretch? If I posted the root credentials to my AWS account and turned off MFA that would be insecure also. Does that also mean I'm depending on "security through obscurity"?

 _It 's exactly like that!_

So am I also "obscuring" my IP address when I am testing an API locally and I configure it to only listen on 127.0.0.1:3000? Oh no, I just told you my IP address!

Everything you mentioned could only be done if an inside malicious actor purposefully made it insecure.

<comment><USER37> > So if someone purposefully for some reason goes in and configures their > router to map a port to a specific internal IP address to allow internet > traffic to their ES cluster it isn't secure?

That's not what I'm talking about. Suppose your router receives a packet whose destination is that internal IP address. Then it's going to send it there, unless it's configured to block that traffic.

> So am I also "obscuring" my IP address when I am testing an API locally and > I configure it to only listen on 127.0.0.1:3000?

No, quite the opposite. Listening only on the loopback interface is a real security mechanism. Binding to 127.0.0.1 achieves that (though there have been bugs in the past; binding explicitly to the loopback device is better).

> Oh no, I just told you my IP address!

That's exactly my point! The address doesn't matter, the actual network routing is what matters. Same thing if you're running an actual airgapped network: what makes it safe is the fact that it's physically disconnected, not that you used particular addresses on it.

Real-life example: the UK military's internal servers have real IP addresses in the 18.104.22.168 range. Probably some of them are insecure. But it doesn't matter because, even though they have public IP addresses, you have no way to send packets to those IP addresses, because they've got proper firewalling in place. It's no different from if they were running a private network - <USER2> that it means they don't have to mess around with NAT, if someone connects from a VPN they don't have to worry about address collisions.... IPv6 works the same way.

<comment><USER36> _That 's not what I'm talking about. Suppose your router receives a packet whose destination is that internal IP address. Then it's going to send it there, unless it's configured to block that traffic._

What router is set up by default to route traffic _from_ the internet _to_ a private IP address unless the traffic initiated from the private IP address? Someone would have to _purposefully_ configure their router to do it.

Of course someone can purposefully configure an insecure system.

<comment><USER37> Any router designed for professional environments won't second-guess your networking setup. Either it will route everything by default or it will deny everything by default and route only those routes you've specifically added, but either way it's not going to do anything differently just because one side or the other is an RFC1918 private address.

<comment><USER36> I understand that. But, we are talking about defaults. The reason the exploits that this submission is talking about took place is because too many people didn't change the defaults.

Assuming people took the sensible leap that private resources equal private IP address, they are not going to then go out of their way to configure their router to route their private resources.

As far as "route everything" how is it going to know _how_ to route from a public IP address to your ES server unless you specifically tell it?

I'm sure no one who got hacked went out of their way to configure their router to make their ES cluster publicly accessible.

<comment><USER37> > Assuming people took the sensible leap that private resources equal private > IP address, they are not going to then go out of their way to configure > their router to route their private resources.

That works until you have a legitimate need to expose a few of those private IP addresses publicly (which is bound to happen sooner or later). It's a bad idea to rely on the same thing to carry two subtly different meanings - especially when one of them is security-critical.

> As far as "route everything" how is it going to know how to route from a > public IP address to your ES server unless you specifically tell it?

The router knows how to reach the ES server (it has to be able to send packets to that server if it's providing that server's connection to the internet). So if someone on the outside does `route add <ES server> via <router>` (or, these days, slightly more sophisticated alternatives) then they have access to the ES server same as if it was just on the internet. A few years back this was a big source of vulnerabilities - organisations assumed that their servers were safe because they didn't have public addresses, but nothing was actually stopping people sending packets to those servers if they figured out (or guessed) what the addresses were.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER38> I can't believe people are victim blaming the db admins for not knowing about vulnerability. What good comes of destroying the db instead of talking about the vulnerability to the open source projects? Coincidentally shodan; that I've never heard of.

<comment><USER39> There's a difference between a vulnerability, and a common misconfiguration that usually comes from a "make it work first, security later" mindset.

The good that comes from destroying the DB is:

a) the data is no longer exposed to the Internet, where more malicious actors could take it, affecting the customers of the incompetent company

b) ignoring it stops being a viable option - leaking your customer's data all over the place often doesn't have sufficiently obvious and severe consequences for the company doing the leaking to discourage it. Disruption that breaks production will get their attention, and they likely will secure their database in the future.

(No moral or legal judgement regarding this action, just answering the "what good comes of it" question.)

Edit: Also, someone commented further below on the difficulty of doing it the right way - it's hard to contact the companies, and it's even harder to get them to actually listen and fix it instead of ignoring it or trying to "shoot the messenger". This approach may be wrong and/or illegal, but it it much likely to actually draw the attention of the right people, and prevent them from simply ignoring the problem.

The companies running those open databases aren't just victims; they're also perpetrators of privacy violations. In many cases, they're even collecting data for a purpose that the data subject receives no benefit from.

<comment><USER40> So, you've answered "what good comes of it".

For completeness, would you mind answering, "what bad comes of it?"

</comment></comment></comment><comment><USER41> I think that this is an instance of ethical hacking. They hurry up to remove any and all instances of PII before some hostile actor scrapes them while at the same time punishing the people who leave their servers open without caring for their costumers.

To whoever is doing that: you are doing god's work, please keep it up.

</comment><comment><USER42> Search engines like shodan.io make it trivial to discover unsecured databases exposed to the Internet.

<comment><USER43> What I don't get about Shodan: Why aren't all unsecured databases found instantly (at the moment Shodan went online), but recurring attacks/dumps like this one that rely on it? Do they update their crawl data in waves?

<comment><USER44> One real limitation is getting data out of Shodan. Having done a few different projects that involve large-scale use of Shodan results (e.g. several hundred thousand records), this kind of thing usually ends up costing $300 for either export credits or a service plan. Sure, $300 isn't really _that_ much to cause millions in damage, but I think it's a big factor in why we don't often see Shodan used for huge-scale malfeasance. You both have to put up the money and in paying you probably give up some identification info, and I don't know if Shodan has complied with law enforcement in the past but I can sure see them getting a warrant for "the person who just spend hundreds to export and/or query every unsecured MongoDB."

Also, as a bit of an aside, the relationship between "export credits" and "query credits," and the export system and API of Shodan, are extremely confusing and just a bad bit of product design. Each one seems to be capable of things the other isn't, but they're priced on totally different systems.

But really it's mostly just a matter of motivation, I think. Pulling even just thousands of entries from Shodan, writing some software to use them, and then running it in a reasonably deniable way, takes effort and is pretty slow (why we see this going for multiple days). It's not a huge amount of effort but it's enough that "script kiddie" types don't really seem to do it, you need to be motivated and spend the time on it.

Contrary to security urban legend it seems like the number of people who are highly motivated to purely cause damage is not actually that large, people only put in the time if they can figure out a way to gain from it... and just deleting data doesn't really achieve that. You've got to figure out a way to hold it for ransom and/or collect and leverage sensitive data. We've seen both happening on various scales with this kind of unsecured database and we'll probably see more of both as we go forward... but keep in mind that in the ransomware game, encrypting computers is both easier (established off-the- shelf ransomware can be purchased) and probably shows higher returns, so the "professionals" aren't spending a lot of time messing around with exposed databases.

<comment><USER29> We're actually getting rid of export credits because it's caused confusion over the years. We now just have query credits to download data/ do searches, and scan credits for users that want to request on-demand scans. We announced this change in the most recent Shodan Update newsletter. You can already use our new website ([https://beta.shodan.io](https://beta.shodan.io)) to download data using your query credits.

Export credits were the first way I tried to monetize Shodan and it became a legacy system that lots of companies used so I was hesitant to get rid of it until something better was in place.

I'll also add that the API was purposely not designed for downloading lots of search results. The API is designed for security operations center (SOC) use cases. Companies that need large-scale, bulk access to our data would need to check out our enterprise platform ([https://enterprise.shodan.io](https://enterprise.shodan.io)).

<comment><USER44> This is what I've assumed, but it's in a pretty uncomfortable place right now as e.g. the documentation often refers to export credits with a broken link.

The API is somewhat unsuitable for exporting large volumes because it seems remarkably unstable as to ordering, it suggests that you can do paginated requests but the second page tends to have 30% overlap with the first page.

I 100% understand the product motive to move large exports to an "Enterprise" feature, but it's rather disappointing because as a small-scale independent operation I don't expect to be able to afford it, and that would go for a lot of productive people in security research. But then, that's capitalism.

<comment><USER29> I decided that a broken link is better than having people spend money on something that will be deprecated. We're obviously working on cleaning up those broken links but it's an easy thing to explain if anybody emails firstname.lastname@example.com

The ordering is based on timestamp and it can happen that new results were indexed in between your 1st request and 2nd request which creates an overlapping result. A 30% overlap is unusual and sounds like it's for a query with many results.

Finally, most researchers don't actually need to download data. They could just use our free API and facet queries to get the information without downloading the actual data. This entire website is powered by a free API key that uses facets:

[https://exposure.shodan.io/#/](https://exposure.shodan.io/#/)

I think a lot of researchers go into the default mode of "I want to have the data" but using facets is way easier, faster and doesn't cost any money at all. And you can navigate the available facets using our new beta website (another area we're trying to make things a bit clearer). For example:

[https://beta.shodan.io/search/facet?query=http&facet=http.co...](https://beta.shodan.io/search/facet?query=http&facet=http.component)

Note that we provide free upgrades to universities/ students/ professors as well as routinely work together with researchers so we're not trying to push them into the enterprise product. We also let universities monitor up to ~120k IPs for free using Shodan Monitor ([https://monitor.shodan.io](https://monitor.shodan.io)). But the use cases for researchers are few and we figure that if you need lots of data then you can send us an email.

</comment></comment></comment></comment></comment></comment><comment><USER45> Meh. Maybe it'll get devs to pay attention to database security.

</comment><comment><USER46> Why is mongodb seem to show up alot with this. Does their default set up hide some unsecured users? Its been a while but I dont remember that being in there.

<comment><USER47> No, their default sets up no authentication at all IIRC. Combined with Dockerized installations punching through some firewall setups (as discussed elsewhere), you'll get meowed.

<comment><USER29> By default though, MongoDB will only listen on localhost and I believe it'll show you a big warning on boot up if you don't have authentication configured. They used to listen on 0.0.0.0 by default but that was fixed many years ago.

And this issue doesn't just affect MongoDB - imo since the "webscale" days it's been a favorite to knock on but the public exposure of data happens across many technologies. Here's a comparison with a few others:

[https://blog.shodan.io/elastic-data-exposure-grows- to-3-2-pb...](https://blog.shodan.io/elastic-data-exposure-grows-to-3-2-pb/)

</comment></comment></comment><comment><USER48> I wonder if you can find a remote code execution vulnerability in client libraries for one of these databases, and set up a few honeypot databases... you might be able to catch who's doing it and retaliate. The legalities of doing that are certainly questionable, but then again, so is this.

</comment><comment><USER49> If this turns out to be an effective lesson on security, systems should implement their own meow to protect their users.

E.g. A database That intentionally removes itself if the default password/an insecure password is used, with an easy-to-follow guide in error log on how to properly configure it.

<comment><USER50> If memory serves, Postgres will only listen on 127.0.0.1 unless the admin password has been set.

All software should work like that.

<comment><USER51> MongoDB listens only on localhost by default since 3.6 (2017)

<comment><USER50> You are allowed to judge people for taking far, far too long to do the right thing.

It indicates a pattern of poor judgement, which speaks to trust. You know they are going to let you down each time a new issue comes up.

Faulting people for being cautious around such bad actors (which I'm not saying you're doing, but the response will) speaks to _your_ judgement, not the vendor's.

</comment></comment></comment></comment><comment><AUTHOR> [https://arstechnica.com/information- technology/2020/07/more-...](https://arstechnica.com/information- technology/2020/07/more-than-1000-databases-have-been-nuked-by-mystery-meow- attack/)

</comment><comment><USER52> Seem like this could be easily reconfigured to do the opposite. Leave the databases but overwrite all the existing data then write dummy data until disk is exhausted. Does that cross another ethical line?

<comment><USER53> You mean, to make data recovery impossible?

<comment><USER52> Or just to run up costs, which is the potentially new ethical line.

</comment></comment></comment><comment><USER54> So why is the attack being called Meow?

<comment> phoe-krk Seems like all that's left of a database after the attack is some generated indices or other data structures with their names ending with "meow".

<comment><USER55> Clearly fans of "Super Troopers" / BrokenLizard.

<comment><USER56> Meow why would you say that?

<comment><USER57> Probably because a bunch of stoners are putting a password on their database right meow.

<comment><USER58> Meows right!

</comment></comment></comment></comment></comment></comment><comment><USER59> Not to be disrespectful it is there a more reputable source that doesn't jackhammer ads down the users throat every other paragraph?

<comment><USER60> If you see ads on that page you are interneting wrong. I'd really encourage you to install an adblocker.

</comment></comment><comment><USER61> It took way too long. When you have a company that builds a great product with no security whatsoever and makes their business model based on selling the security module on it and changes their behavior only when threatened by a competing open source product, you have to wonder when the catastrophe comes.

Note I don't blame anyone, it was just bound to happen.

</comment><comment><USER62> Is it legal to access them if they are unsecured?

<comment><USER63> Legality is determined by permission, so no.

<comment><USER64> Do you have permission to access HackerNews (:rolleyes:) ?

You access it because it's publicly available...

</comment></comment></comment><comment><USER65> Lets return the computers back to sysadmins ;-)

</comment><comment><USER66> After having read a number of articles talking about data leaks on a gigantic scale, I decided to check it out. Because shodan is not free to use/behind a paywall, I wrote a simple windows console tool which scans all known Azure subnets for unsecured elasticsearch instances and logs the results. I was baffled by the amount of instances this tool found within the first few hours :( To say that security in IT is getting out of control would be an understatement...

<comment><USER29> Doing aggregate queries is free - only if you want to download actual data do we start charging money. You could just do the following via the CLI using a free account:

$ shodan count product:Elastic org:Azure

This entire website is powered by a free API key: [https://exposure.shodan.io](https://exposure.shodan.io)

</comment></comment><comment><USER8> Any statements by Shay Banon?

Crickets AFAICT: [https://twitter.com/kimchy](https://twitter.com/kimchy)

Also: [https://twitter.com/elastic](https://twitter.com/elastic)

</comment><comment><USER67> People are talking about more responsible disclosure. Is it feasible to even track down the owners of 4,000 different unsecured databases, much less go through the whole process with them to ensure the database is properly secured?

<comment><USER47> Some of these attacks leave a calling card sort of thing, e.g. a database with a document that says "hey, lock your stuff up".

That's more or less the best you can do without unreasonable effort, and there's no guarantee the database's owners will ever see the extra database unless you also destroy stuff on the way to make them pay attention...

</comment></comment><comment><USER68> Given some VPN's and other secure services that got used in Hong Kong turned out to have open logs as just resold services.

So one wonders how many people will be positively effected by this.

</comment><comment><USER69> This is bad when it comes to personal data, like the VPN provider that claimed not to be logging. Companies should spend every effort to secure people's data, and can face large fines in the event of a leak. In erasing the data, Meow is also erasing the evidence of their crimes. Instead, Meow should ransom the data and set a fine proportional to the company's size, revenue, the sensitivity of the personal data, whether that personal data should have been collected in the first place, whether that data should be public-facing, etc. Then Meow can be made a public service, perhaps paid with taxpayer money, and bring about justice.

</comment><comment><USER70> Can someone how/explain why databases are left open?

<comment><USER29> Short answer: cloud images with poor defaults. I've written about this a few times before and the problem hasn't really changed since the article was posted:

[https://blog.shodan.io/its-the-data-stupid/](https://blog.shodan.io/its-the- data-stupid/)

</comment></comment><comment><USER71> I wonder about the motive. Why would anybody do this without blackmailing or even telling people. Maybe it was a frustrated sysadmin... :/

<comment><USER72> why would anyone want to have their work be talked about all across the internet and become part of internet history??

<comment><USER71> Fair enough!!

</comment></comment></comment><comment><USER73> on the UFO VPN leak:

> "In this server, all the collected information is anonymous and only be used > for analyzing the user's network performance & problems to improve service > quality. So far, no information has been leaked."

I can't see how you can keep enough info to analyse an individual users service, without keeping logs on their access details (source/target IPs). What BS.

</comment><comment><USER40> Hippocratic Oath: "First, do no harm".

<comment><USER74> And the Hippocratic oath applies to online vigilantes how, exactly? Right now, I think these actions are causing more good than twenty years of lacklustre legislation have done, worldwide.

<comment><USER40> That was aimed at everyone on this thread that feels comfortable with deleting databases that they don't own.

Vigilantes make their own choices, but professionals are judged by their reputation. As I've said elsewhere, I challenge anyone, especially professionals, to tweet "I will delete your data if you don't secure it" and to add it to your resume/CV as a strength.

</comment></comment></comment><comment><USER75> Might be very immature of me but attacks like this still make me crack up as if I was still a teen in YouGotPwned web times.

</comment><comment><USER76> It's 2020, where security should be at the forefront of almost any tech endeavour. It's not something to think about afterwards, not any more.

If, given the frequent and public attention to hacked data, you aren't thinking about how to make sure your data is safe, there really can't be any sympathy when you get hit by an attack that relies on zero security applied to your database.

C'mon, do we as an industry really learn NOTHING from all the hacks we've lived through ?

</comment><comment><USER77> I've got some Heroku projects, which don't have a static ip. How do I protect myself against this?

<comment><USER78> Simply set a secure password on any DB instances exposed to the internet.

<comment><USER77> Ah, I see. So no need to find a static IP to use :) Thank you.

<comment><USER79> I mean, if the database is not directly available on the internet, that would be a great help as well.

<comment><USER78> Agreed, password is the bare minimum.

</comment></comment></comment></comment></comment><comment><USER80> I wonder what proportion of these are just PII that should never have been collected in the first place?

</comment><comment><USER81> What exactly does "unsecured" mean in this sense? The article never explains the attack

<comment><USER51> Started up exposed to the internet and listening on 0.0.0.0...

...and also not enabling a password

</comment></comment><comment><USER40> If you really believe this action is warranted, as I've read on this thread, I challenge you to tweet under your real name "I will delete your data if you don't secure it", and add it to your resume/CV as one of your strengths.

</comment><comment><USER82> There's some gray hat job well done here.

</comment><comment> kalium-xyz I wonder if its going after RATs, heh

</comment><comment><USER83> Seems like kind of a public service

</comment><comment><USER84> How do they determine 'almost 4k'?

<comment><USER85> Shodan and BinaryEdge search results

</comment></comment><comment><USER86> HTTP Delete makes a come back in spectacular fashion

</comment><comment><USER87> why are only meme databases affected?

</comment><comment><USER88> Already waiting for meow(two)

</comment><comment><USER89> I prefer this over having data stolen.

Also as a rule of thumb never ever expose anything but port 80 and 443 if hosting a webapp.

If you must expose services other than http/s then be sure to not leak its version, have it secured properly and _always_ up to date. The user running such services should also be a non privileged user, the daemon chrooted, and the OS should have appropriate process and filesystem permissions in place.

<comment><USER90> >I prefer this over having data stolen.

Okay, and I prefer being waterboarded over being drawn & quartered. But it doesn't mean I support the practice of waterboarding, since there's another option, namely just not waterboarding in the first place.

This contrarianism is so strange to me. Data not being deleted by a bad actor is preferable to having it deleted, and I would think that would be the main takeaway here, rather than this weird descent into counterfactuals. Where does the impulse come from to bypass the normal answer, treat it like a trick question and go into contrarian mode by measuring it against counterfactuals? I think when you do that you lose sight of the most important thing here, which is the fact that data is being wantonly deleted and that it is bad that this is happening.

</comment></comment><comment><USER91> Damn, last week we were wondering where did our data went and why there are so many meow indexes! We were meowed !!!

<comment><USER15> The cat's out of the bag now!

</comment></comment><comment><USER92> Why must some people insist on being assholes?

<comment><USER93> > Why must some people insist on being assholes?

The ones leaving giant databases unsecured? At least they are being taught an important lesson.

<comment><USER94> My blame scale for breaches, most to least:

1) the cultural and economic forces driving everything online way before that's anything like a good idea,

2) companies storing more than they need to,

3) the people who left it unsecured (bigco, tech startups, and anything _very_ sensitive),

4) the people stealing data,

5) the people who left it unsecured (Smaller shops that've been made to feel they must be online),

[large gap]

20) someone who simply deletes all the insecure data (assuming they didn't also steal all of it)

<comment><USER90> Why is the person doing the deleting so low, relatively speaking, in your ranking of people's responsibility for them doing the deleting?

Also, do you think that this person or persons would refrain from deleting the data if they had the opportunity, but it qualified as a "good idea" to keep online? I.e. they might review, say, medical records, spend some time thinking to themselves whether it was 'necessary' to be online, and then decide to delete or not delete depending on their judgment?

<comment><USER32> For me, it's because the odds of this person showing up quickly approach 1 as time approaches infinity, and that person's effect would be nil if it weren't for necessary causes 1) through 19).

Blaming the person that hacked you is like blaming the individual rock that sinks your boat when you navigate too close to a rocky shore. The rock may have done 100% of the damage to your boat, but if it hadn't been that rock, it would have been another one.

<comment><USER92> I was hacked using what at the time was novel (but is now a known exploit): someone claiming to be me transferred my SIM card to a new phone, over the phone, which then enabled them to defeat my 2FA (which of course I've now removed ALL cellphone recovery from).

Are you saying that it's my fault for either picking an insecure provider (T-Mobile, who I absolutely bitched out and told them to put a note on my account to not permit any SIM transfer without me physically being in a store under a camera), or for not staying abreast of the very latest in social- engineering exploits that assholes were using to try to steal bitcoins, and manage my security accordingly?

</comment></comment></comment></comment></comment></comment><comment> Pick-A-Hill2019 Or 'Meow, I'm a Frog'

</comment><comment><USER95> How does this work?

Will it affect MySQL databases accessible from the Internet but secured with a long random password?

<comment><USER96> Don't expose MySQL databases to the internet. Just don't. Stick an API layer in at the very least with key based auth, and only the bare minimum capabilities allowed for the user.

That said, if you'd read the article you'd see that so far only unsecured MongoDB, Elasticsearch and Redis installations are being attacked so far.

<comment><USER97> I'm doing my first web project (self-taught), which is the prototype for an offering me and a partner are developing to become a startup. I was about to start deployment (for the first time in my life) this week, but now I'm afraid. It's a flask app. We serve users forms (POST), then I use this input to run calculations on the server through a python script which makes queries to a MySQL db, then I return results to browser my listing a result-array dynamically using a Jinja template. Is this unsecure? Any tip or accessible reading material to help me understand this matter? We don't store credit card info or other sensitive information for now, because we didn't reach any clients yet, but final version should have at least login functionality. Any light/knowledge/consideration will be much appreciated!

PS: I don't know exactly what you mean by "Stick an API layer in at the very least with key based auth" because I never used an API before and didn't know I would need something like this.

<comment><USER98> >PS: I don't know exactly what you mean by "Stick an API layer in at the very least with key based auth" because I never used an API before and didn't know I would need something like this

Don't allow access to `mysql -h hostname` from WWW. Instead, keep your MySQL server accessible only by machines you control in the same security group/network/etc. To get access to the database from the public, create an API that allows predefined queries only to users you've authorized. This API would also be hosted within the same security group/network/etc. The public never gets direct access to the database, yet gets the predefined access they need.</comment></comment></comment></comment>


Implementing Levenshtein Automata - <AUTHOR> http://fulmicoton.com/posts/levenshtein/ <comment><USER2> FWIW, my Dictomaton Java library also has support for Levenshtein automata (besides finite state dictionaries, perfect hash automata, and String mappings based on perfect hash automata):

[https://github.com/danieldk/dictomaton](https://github.com/danieldk/dictomaton)

<comment><USER3> > besides finite state dictionaries, ..., String mappings based on perfect > hash automata

I'm implementing a similar library in Rust. One of the key things I've found missing in Daciuk's great work on the topic is the handling of the registry. In your code[1], it looks like you're using a straight a hash table. I thought you'd like to know that I've had great success sacrificing complete DFA minimization in exchange for a small _constant_ memory overhead by using an LRU cache of only some classes of states.

My code still needs a good deal of polish, and I intend to write a blog post, but I bet you can make sense of the general strategy from the code and reuse it.[2]

N.B. Lucene's implementation permits sacrificing complete minimization, but they don't use an LRU cache and I think still permit the registry to grow without bound.

[1] - [https://github.com/danieldk/dictomaton/blob/master/src/main/...](https://github.com/danieldk/dictomaton/blob/master/src/main/java/eu/danieldk/dictomaton/DictionaryBuilder.java#L292-L296)

[2] - [https://github.com/BurntSushi/fst/blob/master/src/fst/regist...](https://github.com/BurntSushi/fst/blob/master/src/fst/registry.rs) (The data type is a map from node hash to LRU cache. That is, there is a small LRU cache for each bin in the map.)

<comment><USER2> Interesting, thanks for the pointers! I'll look at it when we are done moving :).

BTW, for those who are interested, Jan's code is also available online:

[http://galaxy.eti.pg.gda.pl/katedry/kiw/pracownicy/Jan.Daciu...](http://galaxy.eti.pg.gda.pl/katedry/kiw/pracownicy/Jan.Daciuk/personal/fsa.html)

[http://galaxy.eti.pg.gda.pl/katedry/kiw/pracownicy/Jan.Daciu...](http://galaxy.eti.pg.gda.pl/katedry/kiw/pracownicy/Jan.Daciuk/personal/fadd.html)

His FSA utilities and the fadd library are used in the Alpino parser:

[http://www.let.rug.nl/vannoord/alp/Alpino/](http://www.let.rug.nl/vannoord/alp/Alpino/)

</comment></comment></comment><comment><USER4> So what's the best OSS search autocomplete these days? Solr's, Elasticsearch's, Linkedin CLEO?

<comment><AUTHOR> You can add Duck Duck go's implementation to your list [https://github.com/duckduckgo/cpp-libface](https://github.com/duckduckgo/cpp- libface).

</comment></comment><comment><USER5> Great write-up :-) I hope you'll considering explaining that last bit of code some more later? I think there may be something missing from the parenthesis here:

         Well the trick here is to normalize our states into two parts

        * a global offset that is the minimum offset of the states
        * the shape of the shifted states (we already saw that there was around )

        With this parametric DFA, transition will tell you, given a "shape", what shape to transition two, as well as how much you should add to the global offset.

</comment><comment><USER6> This is a great implementation, thanks. For those of you who need this to be fast and achieve the theoretical bounds, you may want to do something like this using a finite-state transducer toolkit. Here's an example with OpenFst: [http://www.openfst.org/twiki/bin/view/FST/FstExamples](http://www.openfst.org/twiki/bin/view/FST/FstExamples) (halfway down under "Edit Distance"). (And OpenFst has a Python wrapper now.)</comment>


A low-resource quantum factoring algorithm [pdf] - <AUTHOR> https://eprint.iacr.org/2017/352.pdf <comment><USER2> From the abstract: "The new time complexity is asymptotically worse than Shor's algorithm, but the qubit requirements are asymptotically better, so it may be possible to physically implement it sooner."

This is a nice result that shows how to speed up the best-known classical factorization algorithm using a quantum algorithm for one of the steps. Importantly, it does it using _asymptotically fewer_ qubits than Shor's algorithm requires. However, the overall algorithm in the paper is still subexponential, not polynomial like Shor.

</comment><comment><USER3> So to factor a 2048-bit number, Shor's algorithm would need about 4000 qubits, and this algorithm would need about 126 qubits (log(2^2048)^(2/3)). I wonder which would finish first: waiting for a 4000-qubit computer, and then factoring in exponentially faster time, or waiting for a 126-bit qubit computer, and then waiting for the sub-exponential algorithm to complete? :)

<comment><USER4> Well, since the difficulty of constructing (general purpose) quantum computers seems to be exponential in the number of bits, waiting for a 4k-bit one is likely the slower option.</comment></comment>


When technically right is wrong: Kilobytes - <AUTHOR> http://omar.io/2017/01/16/when-technically-right-is-wrong-kilobytes.html <comment><USER2> "I've also opted to forgo the naming outlined in IEEE 1541; at least until it's more widly adopted and people stop thinking of dog treats or Middle Eastern food when they hear 'kibibytes'."

How will it ever be more widely adopted if projects like yours don't actually adopt it?</comment>


Get ready for the YC interviews: make sure you know the partners - <AUTHOR> http://yc-partners.s3.amazonaws.com/index.html

<comment><USER2> TL;DR: Harvard, MIT, Yale, Stanford, Stanford, Oxford, Yale, Cambridge, MIT, Stanford, Harvard. It is difficult to tell if this is an indication that YC overwhelmingly prefers people from extremely prestigious name-brand universities, or only people from said universities have any chance of being "connected" enough to get into YC.

<comment><USER3> I think it's more that several of the founders of YC were part of the MIT/Harvard community, so it grew from there. The participants in YC are much more diverse than the YC partnership.

</comment></comment><comment><USER4> Very cute.

Two thoughts-

1- I might suggest that if you're encouraging people to study/memorize the names for YC interviews, you provide a downloadable/clippable version, that they can paste into standard flashcard tools.

2- You're loading Zepto externally through cloudflare, but calling it as an inline script. This is causing an issue where Zepto can't initialize, as the external JS hasn't loaded yet. There are a number of ways to fix this, but it renders the site unusable in chrome for me (Although it works in other browsers)

<comment><AUTHOR> 2\. Thanks Colin, I've fixed that!

</comment></comment><comment><USER5> Robert Morris is a very very very serious guy in his field. I wish I could interview with him to chat a little bit about exokernels!

</comment><comment><USER3> There are also YC alumni walking around in the waiting area before the interviews, usually -- probably identifiable by YC clothing items (sweatshirts, t-shirts) or by generally looking less nervous than applicants...

And there are a couple more YC employees usually present, handling scheduling and logistics.

</comment><comment><USER6> Some extra notes: Justin Kan is currently one of the founders of another YC company, Exec. RTM is the eponym of the "Morris worm" believed to be the first Internet worm (you note this a bit with the discovery of buffer overflow).

</comment><comment><AUTHOR> Good luck everyone for the interviews! We've made that for us to prepare but we thought other people will be interested too, so we've quickly made this website (works well on your phone as a full screen app!)

</comment><comment><AUTHOR> Is it fun to come before your interview and hang out with another applicants or everyone is so stressed (fixing the demo!) ?

</comment><comment><USER7> I know that you shouldn't mix Jessica Livingston with secretary - many people do, they say.

</comment><comment><USER8> i put together my own little version:

<http://vicapow.clickb.in/investor/partner/person/yc>

</comment><comment><USER9> Pretty smart page :) Whoever did that deserves their YC spot!

</comment><comment><USER10> Do all these partners give interviews?

<comment><USER11> AFAIK, only PG, Harj, Jessica, Garry, PB, Geoff, Sam, and maybe RTM and/or Trevor?

<comment><AUTHOR> There are 3 tracks (fyi).

</comment></comment></comment><comment><USER12> pg needs a better press photo than the one where he looks surprised at being asked a stupid question.

<comment><AUTHOR> we like this face!

</comment></comment><comment><USER13> Well that's a nice panel.</comment>


How to avoid supporting sexual predators - <AUTHOR> https://blog.valerieaurora.org/2019/08/23/how-to-avoid-supporting-sexual-predators/ <comment><USER2> Sexual predators are bad. I think we can all agree on that. But I have real problems with this author's position.

If you blacklist someone based on allegations someone posted on the Internet, how's the guy (or gal) supposed to clear their name if they didn't do it?

Has it never crossed your mind that there are a number of reasons a person might make or spread false allegations, especially against company leaders? And especially if there are people like you, who seem quite willing to believe any allegation, and inflict what punishment they can, if it comes up in a Google search?

Also, the author doesn't really understand how things like equity, board seats, and voting rights work. Those aren't things a company can just take away from its owners, even when those owners are revealed to be sexual predators. They're legal obligations the company's locked into. It's _much_ easier for a company to fire its CEO than it is for the company to take away his (or anybody's) shares.

The company can't just take away a shareholder's stock even if that shareholder's, say, _criminally convicted of raping dozens of people_. That stock might be seized if it was the proceeds of the crime, or to pay things like fines, attorney's fees, court-ordered restitution to victims, etc. _But that 's not the company's call_. Whether that happens -- whether it even _can_ happen in a given situation -- is a decision that's made by the laws and courts. Which _do_ have plenty of experience dealing with false allegations, and the know-how and resources to thoroughly investigate claims.

The legal system definitely has its own rough edges and doesn't always work perfectly. But it seems a whole lot fairer than just using whatever shows up when you Google someone's name when you're trying to answer a question like, "Okay, should we as a society try to ruin this guy's life?"</comment>


Founderdating - Next event in SF October 28th - <AUTHOR> http://founderdating.com/second-bay-area-event-announced-october-28th/ The first event was a huge success.  The next event is Oct 28th in SF.  Apply now.  Because your day job sucks!!! <comment><USER2> Yes I attended the previous event and met some interesting entrepreneurs

</comment><comment><USER3> Has anyone attended this event in the past? Is it actually useful?</comment>


SproutCore 2.0 Beta 2 Released - <AUTHOR> http://blog.sproutcore.com/sproutcore-2-0-beta-2-released/

<comment><USER2> Anyone actually using SproutCore for anything? Care to comment on your experience?

<comment><USER3> We're using SproutCore 1.6 and TemplateViews for a medium size app, and in many ways, it feels like the early days of any framework- there are a lot of nice features, but you have to be willing to dig into framework code and bend it to your will. SC 1.x has a lot of really great ideas, but they're buried deep in a huge system that is, in many ways, inflexible.

SC 2.0 seeks to change this, by making the framework much more modular (think Rails 3) and trying to do less. KVC/KVO really pay off on larger apps by allowing the data to drive the app instead of you having to write a lot of boilerplate code to push data and UI elements around as changes are made to the data. Statecharts are really useful for giving structure to a complex client-side codebase- I highly recommend using them.

I have only looked at Backbone briefly, so I can't comment on how it compares on a real app. But my gut is that it boils down to this: with Backbone you will be writing more framework-level and boilerplate code, which may seem more explicit, but will also be harder to maintain. With SproutCore, you will be relying on the framework to do more, but you will have to understand the framework in order to take advantage of what it offers you. And since SC 2 is still under heavy development, you should be OK with adapting to change as the framework matures.

<comment><USER4> Has the documentation situation improved much in the last year? I tinkered around with it a few times and it really felt close to being great. But... aside from the 2 or 3 intro tutorials, I found the docs really lacking. I only made actual progress by reading the framework code.

Any suggestions on the best way to come at it?

<comment><USER3> The docs have gotten a lot better. In particular, the guides site has a lot of really useful content:

<http://guides.sproutcore.com>

You will probably still have to look at the API docs (and read some source) from time to time, but the core team is taking documentation a lot more seriously now.

<comment><USER5> I think those are for Sproutcore 1.x. The 2.0 docs are still sparse and still here: <http://guides.sproutcore20.com/></comment></comment></comment></comment></comment>


Cruzerlite lost nearly $30k because someone posted an unlimited promo code. - <AUTHOR> https://plus.google.com/+JoelMichael/posts/XoYzcjcvNCs <comment><AUTHOR> Some discussion on Reddit here[1]. Apparently they were warned about their poor coupon code implementation before, and still kept using it; sending out coupon codes to customers that could be used an unlimited number of times by anyone to get completely free cases.

A good heads up to any startups out there to be careful about how they do coupons and promotions. Now a small startup is out $30k, and is left to beg and make passive aggressive pleas on G+.

[1]: [http://www.reddit.com/r/Android/comments/1pmlii/cruzerlite_l...](http://www.reddit.com/r/Android/comments/1pmlii/cruzerlite_lost_nearly_30k_because_someone_posted/)</comment>


Vim and I and what my ideal Editor would look like - <AUTHOR> http://bitboxer.de/2010/08/07/vim-and-i/

<comment><USER3> I'm a bit confused about some of the things he says are missing.

* _Command line mode to open/edit files without touching the mouse_

Is this from inside the editor? What's wrong with ":e <filename>" ?? If it's from outside the editor it's an OS issue. What am I missing?

* _Good default shortcuts for copy and paste and other standard operations_

I can't talk to the defaults, there there are half a dozen ways of picking up one piece of text and putting it somewhere else. If it's a single line you're interesting in, for example, then just "yy" will copy it, search or move to your new location, then either "P" or "p" depending on whether you want it before or after.

* _Easy way to record and replay macros_

What's wrong with the "q" command?

It sounds like he hasn't yet really found half the things vim does. I fully agree that it takes a long time to become a vim master, and the commands require study - they aren't "discoverable," but it sounds like he just needs to pick one of his gripes and figure out how to solve it. Then move on to another.

<comment><AUTHOR> Sorry, that sentence was wrong. I corrected it. The list is not a list of missing things. It is a list of things I want in my ideal editor.

And to copy and paste: yy and P are not what someone would expect when starting a text editor. Shift+Cursor to select text, Cmd+c/Cmd+p to copy/paste, Cmd/z to undo. Those are the system defaults on my Mac and my editor should use the same keyboard shortcuts.

<comment><USER3> * _Sorry, that sentence was wrong. I corrected it. The list is not a list of missing things. It is a list of things I want in my ideal editor._

Oh. OK.

* _And to copy and paste: yy and P are not what someone would expect when starting a text editor. Shift+Cursor to select text, Cmd+c/Cmd+p to copy/paste, Cmd/z to undo. Those are the system defaults on my Mac and my editor should use the same keyboard shortcuts._

Hmm. Well, I'm not really trying to defend vim - I have no stake in it - <USER2> the key sequences you describe are not what I would expect as defaults. Not least, I don't think anyone who comes to vim for the first time would expect h, j, k, and l for movement, or their upper-case friends, or key sequences like e, b, _etc._

The key on vim are different. If you want to set up defaults to match what you've used in the past, and what you think people will expect, then you can.

I personally find the key sequences you describe for cutting and pasting enormously slower in bulk that the ones I use in vim. They are what people have become accustomed to in other editors, but that doesn't mean they're faster or more efficient.

There is a trade-off. We actively prevent people from overly customising their editors because we have less time hacking out code than we have collaborating. We lose in straight efficiency of writing code, but we gain in being able to sit at any console and work immediately.

Recognising that there's a trade-off is most of the battle. Deciding where to draw the line isn't easy, but is the minor part once you know there's a line to draw.

And vim isn't really a "text editor". "Word" is a text editor. "vim" is a tool for producing code. Its interface is occasionally user-hostile and is completely undiscoverable. If you want something "more standard" and "more discoverable" then it's not vim.

On that we no doubt agree.

</comment></comment></comment><comment><USER4> What you expect as defaults can be quite subjective.

Having worked on Vi/vim for over 20 years on a variety of systems, I actually expect _other_ apps to behave like vim. I too have used a Mac for over 10 years but use vimperator on my FF browser, use file managers and other apps that allow for hjkl and other vi-ish strokes.

I am not sure the defaults you mention for C&P and Undo were around when Vi was written. So expecting Vi to behave as a Mac app may not be very fair. I've tried MacVim, but i prefer using Vim inside a Terminal in Screen.

</comment><comment><USER5> So, his ideal editor is Emacs with CUA-mode?

<comment><AUTHOR> I tried Emacs last year. And yes, with CUA mode. And I didn't like it. MacVim feels a lot better and more natural to me. Even with the copy and paste problem.</comment></comment>


Help, my iPhone app made it into the New York Times, what now? - <AUTHOR> http://www.nytimes.com/2010/07/03/technology/03atheist.html?_r=3&hp So I have this app that has been steadily bringing in a tiny amount of passive income & then suddenly today I saw a huge spike in sales. I googled around a bit & it seems my app has made it into the paid Top 100 & the NYT has mentioned it.
My dilemma: this attention comes at a pretty bad time, because I'm working on a new venture & I really need to focus on that one.
Should I focus on the new venture & let this spike die out? Or should I try to use this spike in media attention now, & if so: how? I'm torn between long-term focus & short-term profit. <comment><USER2> 3\. ...

4\. PROPHET

What issue to you see arising from this exposure?

<comment><USER3> I assume you meant "profit". "Prophet" is probably not the way the OP intends to go, what with the atheism and all.

<comment><AUTHOR> Isn't profit == prophet a valid statement most of the time? ;-)

<comment><USER4> It's always a VALID statement, it just happens to be TRUE in this instance ;-)

</comment></comment></comment></comment><comment><USER5> Congratulations on your newfound fame. But I can't help but notice something startling in the article.

Do people _really_ still use the anthropic principle as a real argument? That's so silly it's almost sad. It's the logical equivalent of a double-ended knife; any non-trivial universe or solar system or planet is discarded by that misguided notion.

</comment><comment><USER6> \- you probably won't get so much visits from it

\- promote the story to bloggers/other press who may want to do a similar story on it. Offer them your own phone nr. and phone nr.s of other developers of these apps, make it easy for them.

\- keep an eye on your stats, if you don't have real-time stats, install them for a week or so.

\- make sure the site is up.

\- perhaps add a message to your site "welcome nyt readers" trying to convert them

<comment><AUTHOR> Any suggestions for a good real-time stats package?

<comment><USER7> I use appFigures.

<comment><AUTHOR> I don't think AppFigures qualifies. What I'm looking for is a tool that detects intra-day traffic spikes. Both AppFigures & Google Analytics arrive one day late at the party.

<comment><USER7> Ahh, I see, you're looking more for a flurry type thing: <http://www.flurry.com/>

Lots of the Atlanta Shops use that.

<comment><USER4> Flurry isn't real time though, is it?

<comment><USER7> "Flurry Analytics provides accurate, real time data to developers about how consumers use their mobile applications, as well as how applications are performing across different handsets. Application developers receive aggregated usage and performance data, as well as robust reporting and analysis tools. With this data, developers can identify issues and opportunities, create a more informed product roadmap, increase retention and grow their user base."

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Congratulations!

1 Put "as featured in the New York Times!" with the best quote about you from the article at the top of your app store description.

2 Consider temporarily dropping your price and trying to convert more of the people that check out your app after reading the article.

</comment><comment> the-kenny Can't read it. I don't want to register.

<comment><USER3> I can read it just fine, I'm not registered with the site.</comment></comment>


RoboPoker: Your bot versus others - <AUTHOR> http://robopoker.org/about/

<comment><USER2> Looks like fun. Too bad the reddit discussion shows that it's all about guessing random.shuffle's seed. And the code hasn't been touched in a few years.</comment>


Startup Founders – Are You In Rush To Start A Startup? - <AUTHOR> http://www.adeologue.com/adeologue/2008/04/startup-founder.html

<comment><USER2> I hate to say this, but I'm also in a rush to start a/some startup/s.

Some have the following ideology with relation to startups: you snooze, you lose.

The fastest products to the market are not always the best, but they are what they are: the first products to the market.

Search for a HN post made the other day about your 1.0 and what features you should launch, and timing launches. Very insightful. _Edit:_ here it is. <http://news.ycombinator.com/item?id=175249>

For now, I'm staying undecided on this, and I'm going to see if there's a moment where I just say - Let's make this 1.0. Maybe that will be the right time. And yes, I realize that start != launch, but they're all the same idea.

<comment><USER3> I actually believe that there is a "rush" from the market opportunity standpoint, which explains why I am spending time on YCNews to learn about the ongoing activities from a younger generation of entrepreneurs (even though I myself am much older than a typical YC applicant). I have been writing about the two corner stones of this unfolding trend, "narrowcasting" which is the ability to profitably distribute customized products and services to a small population of customers, and "entre-sumers" which is the perfect union between the creator and the consumer of technology.

My personal opinion is that for the younger generation of entrepreneurs, there is no better time to start startups than now.

<http://gigaom.com/?s=denny+miu></comment></comment>


Building React Native apps can't get any easier - <AUTHOR> http://reactcentral.com <comment><USER2> That's cool. I'll send you guys an email about it.

<comment><AUTHOR> Glad you liked. Yes, just shoot us an email on firstname.lastname@example.com

Thanks

</comment></comment><comment><USER3> I found it really useful. Well done!

<comment><AUTHOR> Oh nice. I'm glad you liked :)</comment></comment>


Richard Hamming: You and Your Research (1986) - <AUTHOR> http://www.paulgraham.com/hamming.html <comment><USER2> I think this is good reading. I like the advice on drive and hard work, I think the amortization example is perfect. I recommend Hamming's book _The Art of Doing Science and Engineering_ which goes on in this vein for many chapters, and ends powerfully by showing how little mathematicians understand what they're doing when they do it.</comment>