Ask HN: PHP Tricks and Best Practices? - <AUTHOR>

Hi everyone,
I have scoured the YC forum for a post on great PHP tricks and best practices, but found nothing.  Maybe I'm not looking hard enough, but I would appreciate it if anyone knows of great sites or tutorials.  I use CodeIgniter (excellent classes, typical MVC setup) and jQuery (uses a lot of method chaining, huge fan of this).  But I still find myself writing a lot of native PHP for my app.
For example, I wasn't aware of the list() function until someone was helping me write a method to convert times.  I've noticed when working with another programmer on a project that he's using sprintf() instead, and it surprisingly makes the code a lot cleaner.  I'm finding myself doing more algorithm-style methods, dealing a lot with arrays and a bunch of if's/conditionals (tertiary if's are great!).
Just using these as examples, I feel like there should be a cheatsheet of best practices and ways to minimize the amount of native code written somewhere but I'm not seeing it =]
*Edit: I'm going to open up CI's class files and look at how they wrote everything.  Perhaps a good way of doing this is to look at other frameworks?  Any suggestions there? <comment><USER2> You should learn how SPL (standard PHP library) works. Most PHP developers don't even know it exists! In my opinion its one of the most powerful parts of PHP if you can learn to use it correctly.

<http://us.php.net/spl>

<http://www.php.net/~helly/php/ext/spl/>

The documentation on php.net is pretty lacking. Heres are some tutorials and examples:

<http://www.phpro.org/tutorials/Introduction-to-SPL.html>

[http://devzone.zend.com/article/2565-The-Standard-PHP- Librar...](http://devzone.zend.com/article/2565-The-Standard-PHP-Library-SPL)

<comment><USER3> For some more SPL examples, read through the source of the KohanaPHP framework (<http://www.kohanaphp.com>). The framework was originally a fork of CodeIgniter, but has evolved into a completely new and powerful framework -- completely written in PHP5. The framework source is very well written and has some excellent examples of using SPL and OOP along with some nice helpers and libraries.

</comment></comment><comment><USER4> Something that took me a number of projects and maintenance type work to realize is to use "helper" functions wherever possible.

For example, a profile link:

        <a href="/user/profile/<?=$user->id?>"><?=$user->name?>

Write a simple function:

        function user_profile_link ($user) {
            return 'profile">$user->name';
        }

And use it:

        <?=user_profile_link($user)?>

I used to think the extra code upfront wasn't worth it, but after dealing with a bunch of 300+ line templates for a while, I can tell you that it definitely is.

Also, you can see a use of string interpolation (a common use case for sprintf), ie "count is: $count"

<comment><USER5> So is anyone using Smarty anymore? Or is this short form php now all the rage? Just curious because I'd update if it was.

<comment><USER6> I could never understand the advantage of using a templating system inside another templating system. Smarty has loops. PHP has loops. Did I miss the train?

<comment><USER7> Smarty produces slightly cleaner code but is worthless otherwise IMHO.

</comment></comment></comment></comment><comment><USER8> This is a bit of a specific one, but the array_shift function is really slow on large arrays. The workaround I found is to use array_slice and unset the array index afterward.

Overall though, I find out about a lot of cool things just from the comments on the php.net site. For example, I learned how to use pcntl_fork from the socket_accept page, and then I found out about socket_create_listen from one of the process control pages.

My approach is basically just to figure out what I want to do on a higher level, and look for sample code on all the individual parts. Then who knows, I might discover something amazing.

</comment><comment><USER9> If you want to review very clean code you should better look at the Zend Framework. It's very good object orientated PHP 5 Code.

</comment><comment><USER10> Have you looked through this: <http://codeigniter.com/user_guide/> ?

It has a lot of a lot, so you don't have to write so much native PHP. Even Rasmus recommends it as his "framework" of choice (although he does not "like" frameworks).

</comment><comment><USER11> Some of the stuff you've mentioned is really good old-school stuff, like list and sprintf, that's fallen out of vogue.

With regard to suggestions to check out Zend Framework, my advice is: Don't.

<comment><USER12> I'd say check it out - to read - but don't use it. They've got some interesting things in there, like OpenID implementation that's worth a read.

</comment></comment><comment><USER13> fluent expressions (when uses appropriately) can be great for constructing DSLs. Also any time you see boiler plate code take the time to refactor to eliminate it - often times figuring out how to do that will make new abstractions apparent. As a matter of practice search for the coolest things you can do in python (list comprehensions etc.), lisp and ruby and figure out how to do things in a similar way (if possible) in php.

Such as:

      //python version:
      noprimes = [j for i in range(2, 8) for j in range(i*2, 50, i)]
      primes = [x for x in range(2, 50) if x not in noprimes]

      //phparrayplus version:
      $noprimes = xR(2,8)->for_each('xR($x*2,50,$x)->out()')->flatten();
      $primes = xR(2,50)->diff($noprimes);

      //common lisp:
      (loop for x from 0 to 100 if (> (* x x) 3) collect (* 2 x))

      //phparrayplus version:
      $C = xR(100)->if_only('($x*$x) > 3')->for_each('2*$x');

      //factorial in phparrayplus, nothing else to compare this too  - just cool:
      function fac($n){
        return xR(1,$n)->reduce('$x*$y');
      }

<comment><USER14> Is "phparrayplus" a library you wrote. If so, where can it be had?

<comment><USER13> yes, it should be available next week on <http://code.google.com/p/phparrayplus>

</comment></comment></comment><comment><USER15> I've had trouble for a while now with chained ifs, as in:

      [CHUNK A]
      if (chunk a succeeds) {
          [CHUNK B]
          if (chunk b succeeds) {
              [CHUNK C]
              if (chunk c succeeds) {
                  echo 'yay!'
              }
              else {
                  echo 'boo!';
              }
          }
          else {
              echo 'boo!';
          }
      }
      else {
          echo 'boo!';
      }

This gets messy if there's anything interesting in those chunks. Instead, take advantage of short-circuiting and put those chunks in functions. Then you can rewrite the above as:

      $success = do_chunk_a();

      $success = $success && do_chunk_b();

      $success = $success && do_chunk_c();

      echo $success ? 'yay!' : 'boo!';

Also, use the ternary operator EVERYWHERE YOU CAN - you'll clean up so much code with it.

<comment><USER16> even better is:

        $success =
            do_chunk_a() &&
            do_chunk_b() &&
            do_chunk_c();
        ...

</comment></comment><comment><USER5> Don't look at other frameworks. I did that and found it a complete waste of time. The best I found was to loosely follow the Ideals of a framework you like. I say loosely because frameworks always have the best intentions but they can't be built for everyone. So sometime I've had to cheat. I've seen code where somebody has made a work around instead of cheating and it's a mess.

Other than that my personal preference is to use jquery for form submits and manipulation, smarty for templating and everything is tied together following MVC ideals. Class inheritance is where it's at too. Simple one is that your Page class inherits the functions in your DB access class which inherits your config class. Silly I know but it works great for me. Which in the end is the point.

<comment><USER5> Oh and also sometime I stop writing features and review the code base thus far. This allows me to bring everything up to snuff with the the latest Ideas I may have had. I've rewritten my own code about 20 times and it's now the way I like it.

</comment></comment><comment><USER17> If PHP is your choice and not the result of prior mismanagement, then I would immediately schedule a two-week vacation. Rent a suite at a hotel with no internet service. Bring your laptop. Pick a language: Scheme, Groovy, Python, Ruby, Clojure, scala, Haskell... and implement something fun for twelve days. Do nothing but immerse yourself in the language. Take a couple days of rest. Then return to work freed of the huge mistake that is PHP.

</comment><comment><USER18> More a trick than a best practice, heredoc

[http://us.php.net/manual/en/language.types.string.php#langua...](http://us.php.net/manual/en/language.types.string.php#language.types.string.syntax.heredoc)

You should recognize this immediately if you have done any unix shell scripting.

I use it to spit out large pieces of HTML.

</comment><comment><USER7> Write your own collection of object oriented php classes or use someone else's. This will speed up your projects a ton. I tend to stay away from frameworks unless it is commissioned work that involves a lot of boiler plate code (forum, blog, etc.).

</comment><comment><USER19> I think it would be a better idea to look at an application than a framework. It will likely match your future work better.

MediaWiki has in my experience a very well-written codebase, so I would designate it a good candidate for code-reading.

</comment><comment><USER20> if speed of execution is relevant, just use echo (which takes any number of arguments), and single quoted strings (concatenating, or parsing double quoted strings is slower):

function user_profile_link ($user) { echo 'profile, '">', $user->name, ''; }

</comment><comment><USER21> list() isn't a function, it just looks like one, just like array() looks like a function but isn't. There apparently wasn't enough syntax to spend on making things like this less ambiguous, but now we do have \ as a namespace separator.

</comment><comment><USER22> Cool PHP trick: write a compiler from a better language to PHP and write your code in that ;)</comment>


Sharing 3D models via the browser - <AUTHOR> https://sharemy3d.com/ <comment><USER2> Or you know, [https://sketchfab.com/](https://sketchfab.com/).</comment>


Open-RethinkDB meeting notes - <AUTHOR> https://docs.google.com/document/d/13TsZoWckcvJpprpL1zU54xsf0Zqm8mfmLkCHZcZbTMI/edit <comment><USER2> I am not a stakeholder, but I just wanted to congratulate you on keeping the momentum going on the Open-RethinkDB project. I've seen several attempts to restart a stalled/dead OS project in the past, so I realise how much energy it takes to keep the ball rolling after the initial flurry of activity/outrage/frustration etc.

RethinkDB is something we were looking at for a large project. In one way I am glad we didn't choose that platform for it, but in another way, the efforts by the open source community to keep it alive has given me confidence to revisit the platform for future projects.

<comment><USER3> > RethinkDB is something we were looking at for a large project

From the comments in HN it feels like this was always the case for RethinkDB; folks looking at it, admire it, thinking about using it in their next project but, for one reason or the another, never ending up using it. Which is really a pity.

I don't know about the others, but I am really curious to know why you ended up not picking RethinkDB for your project.

<comment><USER4> We were considering RethinkDB for a mobile project, but ended up using Postgres on the backend and Realm in the apps with a custom REST API in between. This worked out really well for us, apart from all the work on implementing our own REST based sync (this was before Realm launched their backend product, which might have made a lot of that work unnecessary).

The reason we ended up with Postgres over RethinkDB was that our data model was very relationship heavy in ways that were easier to represent in a relational database than with RethinkDB's document model.

<comment><USER2> +1. To expand on my own post above - one of the biggest things that scares me away from NoSQL solutions, apart from the fact that the schema is not 'set in stone' and can be changed anytime by anyone, is the relationship aspect.

Because we build business and ERP extensions most of the time, the requirement for multiple joins across sometimes up to 7 or 8 tables was what I found difficult to manage in NoSQL data stores. Foreign keys, LEFT OUTER JOIN, SELECT DISTINCT, GROUP BY etc. are all second nature to me in SQL, but totally Greek to me in NoSQL.

<comment><USER5> RethinkDB has joins and I found its grouping to be straightforward and super powerful. Selecting distinct values is as simple as putting _.distinct()_ at the end of your ReQL. While it doesn't have foreign keys, any value can act as one as long as it holds a tables primary key (or other indexed fields), in which case you can do _db.table( 'other_table').get(primary_key_val)_ (or _getAll(foregin_key_val, {index: 'my_index'})_ if not the PK, but otherwise indexed).

Granted, it won't validate that the keys exist, however (since its schemaless at the DB level), so nothing will prevent you from inserting a document with foreign keys that are invalid, but from a querying point of view, foreign keys are easy. Would be nice if you could set insert/update-checked constraints though.

<comment><USER2> Useful cheat sheet. I've bookmarked for later study and research. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER6> It's great to see that getting to an open source foundation is a top priority! As a member of the CNCF's technical oversight committee (and as someone who personally loves RethinkDB), I would love to champion RethinkDB for the CNCF -- but it matters much more to me that it gets to an open source foundation than it is that it lands at the CNCF in particular. RethinkDB team: please reach out to me or to any other CNCF TOC member if we can help!

<comment><AUTHOR> From an outsider's perspective, CNCF seems like it would be a great fit for a project like Rethinkdb: it looks to have the forward momentum Rethink needs right now, and the proximity to other high profile projects like Kubernetes could encourage adoption.

<comment><USER7> I would love to see a RethinkDB Operator created[1]!

[1] [https://coreos.com/blog/introducing- operators.html](https://coreos.com/blog/introducing-operators.html)

</comment></comment></comment><comment><USER8> For those involved, any word on when they'll be putting up a post-mortem on how they ended up shutting down?

<comment><USER9> I am also really curious, and think it could be a valuable asset to the greater startup community. The best tech/product and design doesn't always win.

</comment></comment><comment><USER10> yep good to see clear info about the future so soon after joining stripe!</comment>


I reported a critical bug and now they started a police investigation on me - <AUTHOR> https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i_reported_a_critical_vurnability_in_the_kyc/ <comment><USER2> In 2008, in Poland, a guy was accused of breaking past security of a computer system, by putting "' or 1=1" in an input field of a website. He was acquitted, and the court famously stated that "you can't break past something that doesn't exist".¹ Ideally, this kind of logic should work in other countries; but I'm not very optimistic.

¹ [http://prawo.vagla.pl/node/8154](http://prawo.vagla.pl/node/8154) (in Polish, sorry!)

<comment><USER3> That makes for a good soundbite, but it's not actually useful. You could say that about any exploit: if you get past security using it, security didn't exist, but you're still potentially doing something worth criminalizing.

I think a better solution would be to legally protect anyone that's honestly reporting a vulnerability; make companies liable for those vulnerabilities; offer a failsafe reporting mechanism to the government in place of the company, in case they just ignore it; and guarantee that reporting a vulnerability can't ever be used against you in any kind of criminal or civil trial.

<comment><USER4> "but you're still potentially doing something worth criminalizing."

I had a bit of a think about this. We have an input field, something that invites anything that one might type into it. The input field might constrain what is typed in and the programme behind it might decide to believe the content or not.

Does the input field make it clear that it considers some sorts of input as invalid? I can't recall seeing any login related field that specified its input requirements - that is sometimes part of the "security"(through obscurity) of such things.

IT related security as it relates to logins might be unfairly compared to a front door and keys and other physical security devices. However, few of us have access to enough steel and concrete and other fancy materials for physical security to make this comparison stand. We do have access to wealth of IT security which is freely available. It is bloody complicated but freely available. You do need to be able to sift the good advice from the bad but it is available.

The final bit of the puzzle revolves around responsible disclosure. This is not something you see in the world of safes and front doors. It is an established industry practice in IT, in an industry that is very, very young but one which moves very, very quickly.

Even if the login fields specify that unauth. access is naughty I would argue that given that the tools are freely available and that any reasonably competent developer should be able to sanitise input, then you can't complain if someone types in complete crap.

IT is still discovering Engineering but it has so many more resources for instruction and guidance than bridge builders and boiler makers had in the early days and it moves so fast. Do you have any idea how dangerous steam trains were in the early days? Steam is a bloody powerful thing under pressure. Do you have any idea about resonance and concrete cancer? IT is still having its Tacoma Narrows and ... hah ... Millenium Bridge (hard found lessons can be ignored to this day) things happen.

I'm no lawyer but I suspect the world of m'learned friends will catch up eventually. Until then we will read of silliness like this.

<comment><USER5> Typically the main thing in anti-hacking laws is _intent_ more than actual actions. So if a person by accident causes the system to fail, then they are not guilty, but if they intentionally input something that breaks things then they are guilty. These can be technically very similar events, but legally worlds apart. And if your input is 'or 1 = 1 then that is fairly strong indicator about your intent.

<comment><USER4> What I didn't put in my comment above was that a sufficiently competent engineer might be considered negligent if they failed to allow for say people typing any old rubbish in.

Have you ever jumped up and down on a bridge or other structure? You probably weren't deliberately testing its strength, just idly messing around. You certainly didn't want it to fail (but what if it did?) I'll put money on it that you have done this at some point in your life because we all have at some point.

Were you a hacker? Are you a criminal? What makes adding 'or 1=1' a hack/crack and mucking about? and at what point is it criminal to not be able to filter out crap on input?

<comment><USER5> The difference between jumping on bridges and SQLi is that at least in these parts of the world I would find it absurd to think that bridge would really fall by jumping on it; on the other hand anyone trying out SQLi knows that it can actually succeed, even with a quite high chance.

Also we have building codes etc that regulate construction work, which gives me such confidence on bridges etc, but there is not equivalent for computers. Maybe there should be (that is another discussion) but that does not affect people doing things today.

Furthermore, even in case of criminal negligence (/lack of due diligence or something along those lines) two wrongs do not make a right; abusing such negligence can still be illegal too.

<comment><USER4> "Also we have building codes etc that regulate construction work" by that statement I'll assume American.

Are you familiar with this: [https://en.wikipedia.org/wiki/Millennium_Bridge,_London](https://en.wikipedia.org/wiki/Millennium_Bridge,_London) ? (also see Tacoma Narrows for the classic example - wind loading, rather than people but resonance is resonance). Bridges do fail when people jump up and down on them or at least cause resonance based effects by simply walking in lock step.

You might be unfamiliar with resonance, which is a right bugger to deal with but Sir NF and co designed a bridge which was a suspension(ish) job but looked flat. It looks lovely but I recall looking at it and having misgivings (easy to say now). To me it screamed transverse loading, which isn't the normal thing that an IT bod shouts about.

He (Sir Norman Foster) had a part to play in this beauty amongst others: [https://en.wikipedia.org/wiki/Millau_Viaduct#/media/File:Via...](https://en.wikipedia.org/wiki/Millau_Viaduct#/media/File:Viaduc_de_Millau_1.jpg) \- the WP article does not really do it justice at a glance.

"Also we have building codes etc that regulate construction work ... but there is not equivalent for computers." \- My point exactly. There should be, and then perhaps m'learned friends could then get involved to debate the matter with something to work with. At the moment it is bollocks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> While Sentinel is handling this in an extremely amateurish way, the way this was handled by the person reporting the bug also was done quite poorly.

1) He should have attempted to access his own data via an alternative method. He could do this via an incognito session and a proxy, or just tell them he checked with a different machine, etc. Or, at bare minimum, stopped after the first time. Instead, after the first check, he proceeded to download at least one and potentially two sets of people's information that he knew was intended to be confidential. After already confirming that this was broken. This isn't the right way to go about it.

2) This was discussed in a public communication medium when there was little time given for Sentinel to handle it. Public disclosure to force action is a valid strategy, but almost all professional security researches provide time for the company to resolve the issue, rather than doing it within a day.

3) The CEO's report that only 21 people were affected might be totally accurate - webserver access logs would make it quite simple to determine how many people had their data viewed by users other than themselves. Thousands of people being vulnerable does not mean thousands of people were affected by someone other than themselves viewing their data.

Primarily due to how 1) was handled, he 100% should be speaking with the relevant authorities. He now has confidential information about 2-3 individuals he should not have. If that information is used for fraudulent purposes, he should be on the radar of the authorities. He shouldn't be charged with anything just for having seen it, but we cannot let reporting a vulnerability be a get-out-of-jail-free card, otherwise you could exploit something for profit, and then report it, and have nothing happen. If he had only verified this happened with his own personal data, there would be no need for this, but that isn't how he handled it.

By no means am I defending Sentinel, we need to make sure that we also inform people on how to handle security issues like this /responsibly/ and without causing even more damage.

<comment><USER7> The person reporting the bug is not a professional bug hunter, he is a user.

About 1) - an incognito session wouldn't have had any impact on the situation. It's still the same IP the request comes form. Or a proxy? He's a user, not a security expert.

2) He did report it to Sentinel directly over non-open communication channels: [https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i...](https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i_reported_a_critical_vurnability_in_the_kyc/dtukzcv/?context=0) This is also clear from the text, I don't know where you got that from.

3) He didn't dispute that 21 people were affected. He disputed the number of 2000, because he tried numbers over 6000 - and since the id is apparently just an increment (which in itself is already a problem) the number is likely to be false.

From my POV he didn't do anything wrong. He noticed a possible bug, verified it and notified the company. Quite on the contrary - if he _had_ used a proxy and the authorities would've started an investigation to follow all requests it would've looked a lot worse for him.

<comment><USER6> > The person reporting the bug is not a professional bug hunter, he is a user.

I am aware. This is why I said we need to make sure to attempt to inform people on how to handle these responsibly.

> an incognito session wouldn't have had any impact on the situation. It's > still the same IP the request comes form. Or a proxy? He's a user, not a > security expert.

An incognito session would mean he is not using his previous session to gain access. Authentication is more frequently tied to a session than an IP address - this is why you are still logged into HN if you change from your home network to a public wifi, or turn on a VPN.

> He did report it to Sentinel directly over non-open communication channels: > [https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i...](https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i..). > This is also clear from the text, I don't know where you got that from.

He previously provided a link to a telegram chat specifically with 'You can verify what I said in the chat here'. He has since edited the post and is now claiming differently.

> He didn't dispute that 21 people were affected. He disputed the number of > 2000, because he tried numbers over 6000 - and since the id is apparently > just an increment (which in itself is already a problem) the number is > likely to be false.

He disputed both.

>From my POV he didn't do anything wrong. He noticed a possible bug, verified it and notified the company.

Your POV is dangerous. I am not saying he needs to be blamed, but this is quite clearly the incorrect way to handle a data breach and we should educate people on how to do it better.

> Quite on the contrary - if he _had_ used a proxy and the authorities > would've started an investigation to follow all requests it would've looked > a lot worse for him.

Not if he only accessed his own data, which is part of my point. When looking for security holes or verifying they work you should /NEVER EVER/ purposefully access the data of anyone else. In some cases this is unavoidable - bugs can leak random data, you can't always set up a reproduction environment, etc - but in this case it was totally avoidable.

He should not be prosecuted. He should be educated. Everyone else should also be educated. The point isn't to berate him. He should be in contact with the authorities because he now has access to privileged information, and for all parties' good they need to be aware of who has access to that data so they know who they should speak to if it is used maliciously.

<comment><USER7> > An incognito session would mean he is not using his previous session to gain > access. Authentication is more frequently tied to a session than an IP > address - this is why you are still logged into HN if you change from your > home network to a public wifi, or turn on a VPN.

Yes, that you were aiming at the authentication session hadn't come to my mind as the vulnerability was access without authorization. In the case of a private session or proxy he'd still require a spam mail, create a separate account etc.pp. to just test this explicitly.

> He previously provided a link to a telegram chat specifically with 'You can > verify what I said in the chat here'. He has since edited the post and is > now claiming differently.

That is indeed bad.

> He disputed both. >> Later, The CEO, Roy Lai, confirms 'only' 21 people of > 'over' 1000 were affected. I tried a fileId of over 6k and it works so you > do the math, there were definitely more than 2k.

Unless he edited that as well he disputed the total, not the part.

> [...]

I concur, what seems to actually have happened is quite worse than the version I read.

<comment><USER6> > Later, The CEO, Roy Lai, confirms 'only' 21 people of 'over' 1000 were > affected.

6000 is over 1000. 10000 is over 1000.

If anything the CEO would want to increase the second number. 21 out of 1000 is a worse ratio than 21 out of 10000 :)

</comment></comment></comment></comment></comment><comment><USER8> It was removed from reddit, but Google cached it so here goes...

[http://webcache.googleusercontent.com/search?q=cache:6ZVRmK2...](http://webcache.googleusercontent.com/search?q=cache:6ZVRmK2WWDkJ:https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i_reported_a_critical_vurnability_in_the_kyc/&num=1&hl=en&gl=de&strip=1&vwsrc=0)

<comment><USER9> Proper archive:

[http://archive.is/j2Ucu](http://archive.is/j2Ucu)

[http://archive.is/LLyDe](http://archive.is/LLyDe)

</comment></comment><comment><USER10> I feel like people ought to be able to sue companies that store their private information in such insecure ways. Maybe that'd flip the balance on these gross cases.

<comment><USER11> Oh, you mean companies like Equifax and Experian who leaked all our PII like a sieve?

If only there was a government protection agency in charge of investigating them... Oh, never mind: [https://www.reuters.com/article/us-usa-equifax- cfpb/exclusiv...](https://www.reuters.com/article/us-usa-equifax- cfpb/exclusive-u-s-consumer-protection-official-puts-equifax-probe-on-ice- sources-idUSKBN1FP0IZ)

</comment></comment><comment><USER12> I made a comment in a similar that if you are going to do any door knocking make sure you understand the legal ramifications.

Also before you are going to blame the company their hands might be tied the PoC for the issue was accessing personal information which likely includes financial information and identity verification of other people. It's quite possible that it's their legal obligation to report this to the authorities and likely also was the CYA legal advice given to them by their legal team.

Like sure you may think you did the right thing but the person who's info you've downloaded might think differently.

</comment><comment><USER13> Sigh. The old "expose the incremental primary ID of the record in the URL" thing again?! Shouldn't this be taught as a 'no no' in WebDev 101?

Happens at the top of the chain too, I remember back in 1999/2000 when the Australian government released their website to enable online registration of businesses for in new GST (Goods & Services Tax), it was discovered within a day that anyone could simple trawl through the site and increment the ID at the end of the URL to view the business (and bank) details of every single one of the thousands of business that had registered.

In fact, IIRC, someone wrote a script that trawled through the site and obtained the information for thousands of registrants and put it into a spreadsheet which he emailed to the Australian Tax Office as his evidence. I believe instead of being rewarded, he was reprimanded and warned for doing do.

<comment><USER14>
      someone wrote a script that trawled through the site and
      obtained the information for thousands of registrants

Pro Tip for avoiding getting sued when you report a vulnerability: Tell them you made two accounts and managed to access one from the other, so you've proved the vulnerability without seeing any other customers' data.

If you download more private data than you need, you're liable to activate someone's oh-shit-is-he-blackmailing-us sense, sending them scrambling to defend themselves.

<comment><USER15> Don't just tell them you did, but _actually_ create two accounts and only access your own data. Don't try to access others' data. When changing IDs try to stick to ones you know you own on other accounts. If you're lazily trying the ID "1" and it works, or for example you find a /list endpoint which outputs everyone's data, then stop there and report immediately before doing any further testing.

Financial companies are unlikely to be receptive to unsolicited penetration testing and more likely to come down hard because of a need to demonstrate compliance, the same goes for any healthcare related sites. There's a reason you rarely see them popping up on lists of bug bounty programmes.

</comment></comment></comment><comment><USER16> 1\. Be proactive in the police investigation including with the prosecution. Help them to understand that lack of security does not mean you violated their security.

2\. You're not dragging these guy's name through the mud hard enough. That should have been in the title of this post.

3\. Now that the hack has been exposed to the public, you might as well tell everyone as far and as wide as possible. It's your duty to tell people their identities are at risk, and provide contact details so people can complain about their exposed personal data being leaked on the web.

</comment><comment><USER17> The "attack" (meh) is similar to weev's AT&T hack [https://en.wikipedia.org/wiki/Weev#AT&T_data_breach](https://en.wikipedia.org/wiki/Weev#AT&T_data_breach) but crucially, I think, OP can demonstrate good intent. (Or at least it doesn't seem that OP demonstrated bad intent. Weev downloaded lots of information and called journalists).

OTOH Sentinel Chain might have obligations regarding data breach (depending on where they are based) and they look Real Dumb right now. This might explain some of their aggressive response.

One of the reddit comments makes the (reasonable) point that OP (u/notarealhacker, presumably not a security pro) could have validated insecure access to just their own data from within some pristine sandbox environment. That's fair enough but when I see reports from actual security folks that IMHO go too far in this respect (the DJI bounty mess [http://www.digitalmunition.com/WhyIWalkedFrom3k.pdf](http://www.digitalmunition.com/WhyIWalkedFrom3k.pdf) comes to mind) it seems hard to make that argument against a non-expert who appears to have acted in good faith.

It's not clear to me what jurisdiction @narh is in but here's to hoping a lawyer can mount a Good Samaritan defense if it comes to that.

<comment><USER2> DJI bounty thread on HN: [https://news.ycombinator.com/item?id=15721268](https://news.ycombinator.com/item?id=15721268)

</comment></comment><comment><USER18> This is from yet another flaky "initial coin offering" operation, "Sentinel Chain".

</comment><comment><USER19> I wouldn't worry if I was the OP. By the way cryptocurrency and ICOs are progressing the odds are greater that they will be in handcuffs before the white hat.

</comment><comment> Stefan-H Assuming the poster is telling the truth, and they only accessed a couple other download IDs to prove their point, then they will likely be ok. But if the poster instead wrote a quick script to wget incrementally to see how high they could go, then they have gone beyond simply verifying the vulnerability.

I recall a similar case where the person who found a vulnerability in a banking site was shocked that legal recourse was threatened. They were later shown to have enumerated all possible account details.

<comment><USER20> > I recall a similar case where the person who found a vulnerability in a > banking site was shocked that legal recourse was threatened. They were later > shown to have enumerated all possible account details.

That still leaves us in the position where they were better off stealing the details but keeping quite about the vulnerability. We really need to move to a point where there are zero disincentives to disclosure.

That bank deserves everything they get next time there is a problem.

<comment> Stefan-H A metaphor for you: If an individual finds that a door is unlocked, they should feel the right to search the whole house and catalog all the person's belongings?

I fully agree that there should be zero disincentives to RESPONSIBLE disclosure. Fully copying down a database, for example, to prove that there is weak authentication would not be responsible disclosure and opens the data to significantly more risk than the vulnerability alone did.

</comment></comment></comment><comment><USER21> I am surprised that people still report bugs when there isn't an official bug bounty/bug reporting program in place that explicitly promises to avoid legal action against anyone who reports while following the rules of the program.

When there's no such program in place you either move on or do your best to disclose as publicly and anonymously as possible (tip to journalists or, worst case, open a new twitter account while behind 7 proxies).

<comment><USER22> the OP is likely not a security professional. Is it really surprising that he/she did not expect this result?

<comment><USER4> "the OP is likely not a security professional"

What exactly is a security professional? I'm CREST accredited - do I count? Perhaps. I'm quite handy in the ways of IT (been doing it for 25+ years) That does not have the same cachet as my Civil Engineering quali. that is accredited but not time served. I would probably still be trusted to design a (very small!) bridge or dam or road section. I can survey proficiently etc. In short I could probably still design stuff that people would be willing to put their lives on the line with.

What gives people the sense that a pro. is in charge of something in IT? IT buggered it up early on with "industry" qualis. MS with their MSCEs and all the other worthless crap.

We lurch from snag to snag. It is bloody ridiculous.

We need Engineers with a capital E to stand up and get a fucking grip.

</comment></comment></comment><comment><USER23> The result should be that all vulnerabilities in this corporation's system should be sent anonymously to the public. They have shown manifest malice and contempt for security at multiple levels, so no kindness should be shown to them again.

As this is a shady coin offering, the veil should be pierced. The same discourtesy should be shown to future corporations run by the same people.

</comment><comment><USER24> Most likely the KYC laws themselves forced Sentinel to report this case. If he admitted in writing he accessed another user's confidential documents, that constitutes a data breach. Pretty sure Sentinel has to report that in order to comply with the regulations.

</comment><comment><USER25> Anyone notice all the comments are deleted on the Reddit post?

<comment><USER9> Yes, and it appears my cache was overwritten, unrecoverable. Google's cache also does not contain the proper post either.

<comment><USER26> archive.is has it:

[http://archive.is/QNwiL](http://archive.is/QNwiL)

</comment></comment></comment><comment><USER27> This is why America is still behind in cyber security and cyber warfare. Instead of rewarding people like this and/or hiring them into the NSA, we punish them.

<comment><USER28> We have a long history of hiring thieves/hackers in professional security. Actually, for these guys a highly publicized criminal trial in which they serve time is just good marketing.

Consider Kevin Mitnick for example.

<comment> FLUX-YOU This was true when Law Enforcement had no idea what was going on. It is NOT true today, and thinking you'll get an employment deal is foolish.

If you need proof, go ask [https://twitter.com/MalwareTechBlog](https://twitter.com/MalwareTechBlog) what happened to him after kicking WannaCry in the teeth shortly after it became a big deal.

</comment></comment></comment><comment><USER29> I'm not defending the Sentinel in any way, but maybe the author could've avoided downloading other people's passport information. An alternative way to confirm the vulnerability would have been to only access their own data from private mode or through VPN. That way they could prove that the vulnerability exists without getting implicated in an unauthorized access charge.

<comment><USER30> That's a great thought! I can see exactly how you got there. Surely the author could have proven their point just as effectively while still respecting all the privacy of others, right? Clearly Sentinel is a professional organization that would have responded appropriately!

What's unfortunate about this scenario is that it shows a company reacting in fear. We can see denial, minimization, legal threats, and attempts to silence. These are the signs of an immature organization that cannot be trusted to react professionally to the sort of approach you wisely describe.

Consider. I am a reasonable person under a lot of stress, betting a lot on technologies I don't fully understand or control. Some rando claims my technology is incredibly reckless with a lot of people's personal information, and their proof is that they can view their own docs. Of course they can see their own docs - that's the point! There's no issue here at all...

Does that sound like a plausible scenario to you? Because it's painfully realistic to me. There's a reason I use an identity that's difficult to trace to my legal self when reporting vulnerabilities to companies that I can't trust the maturity of.

<comment><USER31> Telegram is not the organization in question here - they were just named as a medium for communication about the organization that had the vulnerability.

<comment><USER30> You are correct. I'll fix my comment.</comment></comment></comment></comment>


Faxpapers: A 1930s Technology That Delivered Newspapers via Radio - <AUTHOR> http://gizmodo.com/faxpapers-the-lost-dream-of-delivering-newspapers-thro-1682383694

<comment><USER2> That's fascinating. But what was the modulation scheme? What was the printing mechanism? Achieving this, stand-alone without user intervention in a 100% analogue system sounds like a story worth a bit more technical detail..

<comment><USER3> I think the radio facsimile (the "proper name" for fax-by-radio, still used for weather bulletins sent to ships at sea) page on Wikipedia [0] should shed some light.

I remember writing a "wefax"decoder for the Atari 800XL that grabbed these weather facsimile signals off a shortwave radio. The code was published in a magazine, though the name escapes me at the moment. I thought it was pretty amazing, as a kid, to see images appear slowly on my screen while listening to the dulcet tones (ha!) of the wefax audio stream.

[0]: [http://en.m.wikipedia.org/wiki/Radiofax](http://en.m.wikipedia.org/wiki/Radiofax)

<comment><USER4> Antic?

[http://www.atarimagazines.com/v5n5/wefaxinterface.html](http://www.atarimagazines.com/v5n5/wefaxinterface.html)

Was that it?

<comment><USER3> Holy hell, yes. You just made my night. Thanks for finding that!

<comment><USER4> Thank YOU for writing that. I thought your post said you 'read' an article. Nope, you 'wrote' that? Fascinating :)

<comment><USER3> Sorry, but as much as I'd like to take the credit, I didn't author the article... By I "wrote" I meant I typed it in. I can see how my choice of words gave that impression, though, and I feel awful! I am truly sorry!

<comment><USER4> No problem! :) I had loads of fun typing in code from those magazines as well, but never attempted anything with external hardware stuff.</comment></comment></comment></comment></comment></comment></comment>


Run a C program bare metal on an ARM Cortex M3 - <AUTHOR> https://jacobmossberg.se/posts/2018/08/11/run-c-program-bare-metal-on-arm-cortex-m3.html <comment><USER3> Nice, there aren't really that many guides on bare-metal programming. In general the difficult part is finding the Memory Maps across all the data- sheets and programming manuals. ARMs being SOC's these might change across development boards.

Super appreciate this article, might dust off my of Pandaboard again :)

</comment><comment><USER4> I'm just getting started with STM32 and this was very informative. I especially liked that you chose a minimal example and walked through the tool chain in detail. It's important to be able to read the compiler output for debugging and optimization and this presented it well. Thanks!

However, why not mention or explain the widely available and extremely affordable ST-link2 or the ST Discovery boards? I suspect that for people just getting started with STM32 these would be more common.

</comment><comment><USER5> I would like to see version of rust language implementation on ARM CPU like [https://os.phil-opp.com/](https://os.phil-opp.com/)

</comment><comment><USER6> This is excellent tutorial! I wonder if there is similar tutorials for C++11. It would be great to see more information what to do and don't if you want to run your code on bare metal.

<comment><USER7> Rule #1: Do not use C++11. (To be fair, this may depend on which metal - <USER2> language could be perfectly usable on larger systems, but those could be much, much more difficult to program at the bare metal level in the first place.)

<comment><USER8> it would help me alot personally if you gave some context here? i'm on a project where i'm tooling along happily in C and a new contributor really thinks we should do it in C++11...and arguably some of the things that we're currently doing would be somewhat cleaner. "I've always thought C++ was a mess" is not useful counter. do you have to bring in more runtime? does it require more messing about with stacks?

<comment><USER9> I honestly think that, at this point, it's often a matter of taste, rather than technical. What tool do you think will make you more productive and interested in the project?

I personally don't think there's anything wrong at all with using c++11 (or any version) on devices like this, so long as the compiler you need to use provides a stable implementation of it. The new language features of c++11, like constexpr and move semantics, and the static meta-programming contraptions that are readily at hand in the STL can all be very helpful to create manageable and fast embedded systems.

Though it usually isn't a free for all. These things are commonly avoided:

* Exceptions (in many cases this alters the call-return sequence, which can increase code size, and add overhead that may not be acceptable)

* Most of the STL (because either a feature requires exceptions to use safely--like containers, or perhaps because the feature doesn't fit into your code section, or just takes up too much of it to be worthwhile)

* RTTI (which can increase the size of a vtable)

[https://news.ycombinator.com/item?id=12138374](https://news.ycombinator.com/item?id=12138374)</comment></comment></comment></comment>


Helium discovery a 'game-changer' - <AUTHOR> http://www.bbc.com/news/science-environment-36651048 <comment><USER2> Discussion of news: [https://news.ycombinator.com/item?id=11992431](https://news.ycombinator.com/item?id=11992431)</comment>


Rocket Internet (DE) Successfully cloning business models before they go global - <AUTHOR> https://translate.googleusercontent.com/translate_c?depth=1&hl=nl&ie=UTF8&prev=_t&rurl=translate.google.com&sl=nl&tl=en&u=http://datanews.knack.be/ict/the-clone-wars-hoe-rocket-internet-succesvolle-webbedrijven-kopieert/article-normal-561109.html&usg=ALkJrhguBi3U_gWR-vsDoZCBv9d7FL1Ogg

<comment><AUTHOR> tldr;

Cloning companies from USA ( to competitive) or China (to complex) before they expand. They invest heavily in marketing

Some success stories:

CityDeal got taken over by Groupon for 100 million €

Zalando, Zappos clone in the EU (very popular)

Currently has 60 companies in their portfolio.</comment>


Ask HN: Online Certificates or Degrees for IT Managers - <AUTHOR>

I'm looking for that "edge" to add to my resume to show that I have technical and managerial experience and knowledge.
My current situation only allows me to do online courses/programs.
What (online) programs are recommended that would be beneficial for my career that would give me hard and soft skills as a manager? <comment><USER2> I don't think you'll get "soft" skills as a manager with an online degree, but you can get several other useful skills.

I did a Masters of Management in Technology in my country and I recommend it (though it didn't help me as much as I expected, experience in similar positions is a requirement for making the jump), in the U.S. there are several online equivalents, some of them free and some paid, for example:

The University of Chicago - Illinois has an online Master of Science in Management Information Systems

[http://www.uis.edu/cbam/online/mis/](http://www.uis.edu/cbam/online/mis/)

Harvard has the Extension School which allows you to get a degree (mostly?) through online courses

[http://www.extension.harvard.edu/degrees- programs/management](http://www.extension.harvard.edu/degrees- programs/management)

This one from Michigan State sounds promising:

[http://www.michiganstateuniversityonline.com/programs/master...](http://www.michiganstateuniversityonline.com/programs/masters- degree/ms-management-strategy-leadership/)

A list of online masters:

[http://www.geteducated.com/online-college-ratings-and- rankin...](http://www.geteducated.com/online-college-ratings-and- rankings/best-buy-lists/best-buy-online-masters-management-administration/)

Edit: U.S. News has a ranking, which has Indiana University as the best online program

[http://online.iu.edu/](http://online.iu.edu/)

list

[https://edocs.uis.edu/rhadi1/www/2015bestOnlineGradBusinessP...](https://edocs.uis.edu/rhadi1/www/2015bestOnlineGradBusinessPrograms.pdf)

Plenty of choices :)</comment>


Start-up Idea: Selling Experience - <AUTHOR>

I currently manage an investment blog called My $10,000 (www.my10000dollars.com).  Over the course of my blogging days, I've learned that my interview series are by far the most popular and interesting posts.  This led me to an idea - selling experience.
What if we created a platform that allows people with various experiences to "sell" their experiences?  If you were an aspiring mountain hiker who wanted to conquer Mount Everest, would you be willing to pay some fee to talk to someone who's had an experience climbing the mountain?
Or if you were an investor who's lost most of his/her retirement fund in the financial crisis, would you want to talk to someone who went through the same disaster but recovered from it?
Haven't thought through all the details on execution, but I'd thought I would share the thought and seek your input.
Why am I sharing this with the public? Well I have other endeavors I'm pursuing and won't be able to focus on it even if this idea was viable, so why not share it with others who could potentially take this and run with it, right? :) <comment><USER2> Chicken, meet egg.

This has the problem of being near worthless until you have both a large pool of experts and a large pool of paying customers who want that expertise. It's got pretty much all of the problems of the question/answer sites (which StackOverflow seems to have proved convincingly _can_ work, though it's pretty rare that it does), and few of the benefits to you the developer (the benefits you lose include all of the viral elements, all of the SEO, and anything else that comes from having a huge bunch of useful user-generated content that is publicly accessible).

That's not to say it can't work...I just don't have any good advice to offer on avoiding being a dead zone that attracts no search traffic, has little incentive for people to signup until a bunch of others have already done so, etc.

<comment><AUTHOR> Everything is near worthless if you can't market your product right. What would eBay be without the sellers or the buyers? Similarly, how did Yahoo Answers and AnswerBag successfully launch their question/answer sites? Without the proper distribution, it becomes the "dead zone" you speak of. However, the evidence is clearly there that these sites could work (Yahoo Answers, Answer Bag, StackOverflow, etc).

Now as far as this particular idea on selling experience, I would imagine the traffic and activity would start from the ones interested in selling the experience. The interests need to start with people with valuable experiences who may show interest in trying out the service to see just how profitable they could be by sharing their unique experience. Then this can spark interest in the "buyers" who may find the right experience/knowledge they were looking for.

If you get the right distribution, I believe it can overcome the challenge you speak of. The question I would ask you is: "If Google launched this service tomorrow, would you think they can make it successful?"

This said, I would agree that it would be a challenging start-up if you do not have the right plans/capability to scale up.

<comment><USER2> _Similarly, how did Yahoo Answers and AnswerBag successfully launch their question/answer sites?_

This is why I explicitly brought up answer sites. Your idea doesn't get the benefits of those kinds of sites, because publishing the expertise limits your ability to sell it (and makes it into another answers site). If you don't publish it the site does not become incrementally more valuable every time a question is answered, as Stack Overflow or Yahoo Answers does. It _always_ remains a place where someone can buy expertise from someone they don't know, with qualifications that may or may not be accurate, for a price that cannot be compared.

My point is that your proposal seems like it would have all of the negatives of starting a new answers site, but none of the long term benefits. Answers sites start off with these problems, but may eventually overcome them as more and more questions get answered and the pool of regular readers and submitters grows, but yours would have these problems forever. Your site doesn't get bigger, stickier, and more powerful, when you sign on new users and new experts.

I'm not saying you can't do it, or that it won't be successful. I don't know. As Paul Buccheit says:

Limited Life Experience + Overgeneralization = Advice

I simply don't see how you (or even Google, who have retired their own Google Answers) could overcome those barriers and reach a self-sustaining business.

As someone that connects industry specific knowledge to people that need knowledge, and perhaps has tools that make that task easier, you could very well have a lucrative consulting gig. But, I don't know that you'd have a startup.

But, what do I know? I build systems management software.

</comment></comment></comment><comment><USER3> I think this is an interesting topic, but at the same time feel it will be hard to profit from. It seems as though this idea will be more of a conulting hub, where you generate these topics of experiences and share it with your audience. Take for example, Steve Vincent, who commented on Bernie Madoff's lifestyle in prision. Small niche, yet can be very profitable.

<comment><USER4> Interesting example, I had never read that. Here it is: [http://www.prlog.org/10272725-prison-consultant-vincent- stev...](http://www.prlog.org/10272725-prison-consultant-vincent-steven- oberfest-predicts-madoff-will-be-safer-in-prison-than-stanford.html)

</comment></comment><comment><USER5> I hate to rain on your bonfire, but here's what you're up against to profit from this: I took your two examples & threw them into Amazon (UK):

Quest for Adventure by Chris Bonnington (Paperback - 19 Sep 1991) 23 Used & new from £0.01

Return to Go (Hardcover) by Jim Slater (Author)

12 used from £0.25

So besides the critical mass issues raised by other commenters, your information providers would have to be either cheaper, more experienced (neither realistic), or somehow provide a far richer experience than these two well-regarded examples. That's a big hurdle & it doesn't scale well.

</comment><comment><USER6> Seems more like one-on-one mentoring. <http://schoolofeverything.com/>

</comment><comment><USER7> I think it could work a bit like 99designs. Someone posts a request for an expert on something ("I like to get advice on climbing the everest and offer 100 dollars for it") and different experts "bid" on that offer by posting their cv or something else to proof they're experts. hen and egg problem non the less.

</comment><comment><USER8> If you haven't seen it yet, you may find the I am A Subreddit interesting: <http://www.reddit.com/r/iama>

A lot of them are not really what you're talking about, but some are. "I am a Tax Researcher: Ask me anything" and the like.

</comment><comment><USER9> Individuals who want to sell their experiences and expertise are generally called "consultants". A marketplace for whate are essentially dilettante or part-time consultants seems hard to regulate and verify.

</comment><comment><USER10> So this would be like consulting, but about things that only other people actually know about. So... specifically, management consulting?

</comment><comment><USER11> Isnt this what Yahoo Answers and countless competitors has already done, from the other side of the equation?</comment>


Ask HN: sites for getting alpha testers - <AUTHOR>

Hi, my site is in private alpha and we are looking to recruit alpha testers to provide feedback/report bugs and more importantly add content.  Are there sites that make it easy to recruit paid and unpaid alpha testers for web 2.0 sites? <comment><USER2> We're preparing to launch our private alpha in a week and a half at a local conference. Starting with friends and collegues is a good idea, we strongly believe. At least we're thinking this way because we're in an incubator, and launching at a conference for innovators and entrepreneurs.

</comment><comment><AUTHOR> Interesting...I assumed that since Mechanical Turk is pitched as a cheap solution for baseline intelligent labor, the quality of people who are part of the network is very low. As a bit of context, we need users who are willing to write reviews of online authors and bloggers. Do you think the people at Mechanical Turk can write intelligent reviews of David Brooks or Steven Levitt?

<comment><USER3> _'baseline intelligent labor'_ , _'the quality of people who are part of the network is very low'_

Some mighty elitist assumptions there.

Don't assume anything. Do the actual work of checking it out for yourself. You could be surprised.

<comment><AUTHOR> Sorry reading that post again, it was a little elitist. We've had a lot of trouble using services like Craigslist and I thought that the same type of people would be on Mechanical Turk

</comment></comment></comment><comment><USER4> Why not post a link here on Hacker News?

</comment><comment><USER5> Amazon's Mechanical Turk (mturk.com) would be one place for you to look.

</comment><comment><USER6> depending on your website kind, forums (like digital points) can be a good place to find cheap testers (if your site is a non-brain application)</comment>


It's a startup. Why are you here? - <AUTHOR> http://betashop.com/post/83367408084/its-a-fucking-startup-why-are-you-here-were-here

<comment><USER2> discussion from 2 days ago - [https://news.ycombinator.com/item?id=7619439](https://news.ycombinator.com/item?id=7619439)</comment>


Wiby – The Search Engine for Classic Websites - <AUTHOR> https://wiby.me/ <comment><USER2> A gateway to the retroweb. Thank you for this- now I can just keep clicking surprise me. Will be fun to pull these up on some of my old SGIs when I get home.</comment>


How to cool your home server (the wrong way) - <AUTHOR> http://blog.maxmackie.com/how-to-cool-your-home-server-the-wrong-way

<comment><USER2> Heh I had to do that on particularly hot days with my old desktop in Nicaragua.

<comment><AUTHOR> Well despite being in Canada and it being in the -20's, my computer still found a way to overheat. Going to have to get a new heatsink eventually.</comment></comment>


Ask HN: Is it still possible to earn a living with an ad-supported blog? - <AUTHOR> <comment><USER2> It's better to use a blog to promote your own product. You can make a living with ads, but you will need an order of magnitude increase in traffic, which isn't easy.</comment>


Sotirov and Applebaum's (redacted) Internet vulnerability, published tomorrow at CCC - <AUTHOR> http://events.ccc.de/congress/2008/Fahrplan/events/3023.en.html

<comment><AUTHOR> Getting sick of Internet-ending vulnerabilities yet? Of course not! Especially when there's a redacted abstract to pick apart and guess on!

A slice of context: neither Sotirov nor Applebaum would bank their reputations on a publicity stunt; they're both well-respected.

Is it SSL? Then why does the redacted text say " _even_ so-called secure...". Is it a js/DOM issue? Then what's the word "infrastructure" doing there?

I'm feeling mildly Thawte about this. The attack was impractical before, exploits known weaknesses, but is possible now that [redacted], and leaves a criminal in possession of something. Known weaknesses that haven't been probed well feels maybe RNG-y. Maybe you can request a zillion personal Thawte certs and bust a pool of entropy.

</comment><comment><AUTHOR> Some more interesting context, this time by HD Moore from Metasploit/Breakingpoint:

[http://www.breakingpointsystems.com/community/blog/Attacking...](http://www.breakingpointsystems.com/community/blog/Attacking- Critical-Internet-Infrastructure)

</comment><comment><USER2> Some more hints: <http://events.ccc.de/2008/12/30/the-cat-is-out-of-the-bag/>

</comment><comment><USER3> Prepare to be astonished.</comment>


Data Structure Visualizations - <AUTHOR> http://www.cs.usfca.edu/~galles/visualization/Algorithms.html <comment><USER2> Quite interesting.

When playing with the B+ tree, I added about 30 values, including the same value about 3-4 times. Apparently, you cannot delete the last of those repeating values. Seems to be a bug.

No wonder the B+ trees are considered as one of the most complex of widely used data structures.

</comment><comment><USER3> Thanks for linking this. Spent my weekend implementing a reverse string function in MIPS and it never struck me that I could do it recursive instead.

<comment><USER4> > Spent my weekend implementing a reverse string function in MIPS

There must be a story behind this.

<comment><USER5> Homework assignment?

<comment><USER4> On reflection that's probably it :-P

</comment></comment></comment></comment><comment><USER6> Credit to ex usf professor Galles! These visualizations are a huge help with a number of different and complicated algorithms/concepts!

</comment><comment><USER7> Thanks a lot for this, I feel like having a visual tool to learn/teach this kind of stuff is never a bad thing.

</comment><comment><USER8> the n=4-Queens visualisation is excellent.</comment>


Show HN: Open Source website to learn anything with maps - <AUTHOR> Hey everyone.
Today we released a new update to our website where we completely redesigned the website from scratch and now anyone can come in and add resources and links of their own.
The goal of the website is to visually present the most efficient paths for learning any topic on Earth.
Would really love to hear your thoughts and feedback. It's also Open Source (https://github.com/learn-anything/learn-anything) so if you know a little React, we would love to get any help we can get. Thank you.
The website can be seen live here: https://learn-anything.xyz/ <comment><USER2> Wow, great concept! Here's some feedback :)

For the landing page − I like how uncluttered the design is, and how it serves one specific purpose. I very intuitively went to the big input box and started typing things I wanted to learn about, expecting to be presented a list of resources. On the down side, perhaps the hamburger menu is not intuitive enough, and makes some essential information from the « About » page too hard to access? More on this below...

Regarding the Presentation of results / the map − I felt a mixture of enthusiasm and overwhelm when I was presented the map. I was sure what the connections between the map items meant and similarly confused about the « + / \- » next to each of the resources and some of the icons (didn't find the legend immediately). Also, here's a bug: right after clicking one of the suggestions when typing « elm » on the landing page, the list of suggestions was still appearing over the map when it loaded. Here's a picture demonstrating it: [https://i.imgur.com/KJkssYx.png](https://i.imgur.com/KJkssYx.png)

When I found my way to the well hidden « about » page, I could gradually learn more about how the map was constructed and how to interact with it. To avoid the initial confusion, it would have been helpful to be introduced to the map with a 3-4 steps tutorial made of a few sequential tooltips explaining me how it is laid out and how I can interact with it. Each tooltip could have a « Got it! » button to go to the next tip / explaination, and probably a « skip tutorial » link for the returning visitors who cleared their cookies.

Overall I think this is a very usefull website, with a user-friendly workflow to search and add resources, that could be better introduced to with the aforementioned interactive tutorial. If you want more feedback, feel free to submit your site to Usability Testing Exchange, [https://usability.testing.exchange](https://usability.testing.exchange) — that's a free people-help-each-other-with-feedback place I'm helping to get started.</comment>


Show HN: Wishjoin - Share your wishes  - <AUTHOR> http://wishjoin.com WishJoin is a service that enables us to have wishes, goals and activities with people <comment><AUTHOR> It's a new social network. people can share their wishes, goals, activities and join each other.. Wishjoin helps to people to build tomorrow rather than past.. People can wish for same thing and make it real together.. It's awesome to wish together.

</comment><comment><USER2> <http://wishjoin.com/how> this should help the people : )

<comment><AUTHOR> blog also can help <http://blog.wishjoin.com/></comment></comment>


Is M-Pesa Kenyan or British? (2017) - <AUTHOR> https://www.iafrikan.com/2017/12/04/m-pesas-origins/ <comment><USER2> It's interesting how SIM hijacking is a serious attack vector for the likes of Twitter, and every month brings a front-page HN article on how SMS is worthless as a form of 2FA, yet in more corrupt and lawless parts of East Africa the phone companies can secure an entire banking system based on phones.

<comment><USER3> The two use cases (2FA via SMS and M-Pesa) have different threat models and use different parts of the technology stack.

2FA via SMS requires a private channel, but SMS wasn't built to be end-to-end encrypted (although it could be, using the SIM's processor, such a proposal will be shot down by the state actor members of the relevant standards body. See the less-than-perfect security profile of 5G), and so whenever a message is diverted within the system, somebody else can take over.

M-Pesa requires message to be trustworthy, and the SIM app can sign them with a key that resides only on the chip. The transactions are probably not very private (so it might be possible for an eavesdropper to figure out that user A sent X currency units to user B) but that's not a make-or-break requirement for the system to do its job (unlike for 2FA via SMS).

<comment><USER4> What if you lose your phone? Is there some sort of recovery mechanism to get your money?

If so, wouldn't it be possible for criminals to social engineer this recovery process, similar to how they use social engineering to steal numbers in the US?

<comment><USER5> If you loose your phone then you must walk in to the nearest office of your mobile phone network provider. And there are many across the country (Ghana). No one can do it on your behalf, and you can't do it over the phone or online. You have to physically go to their office with with a valid ID to recover your SIM card.

Even if you don't get to recover your SIM card early enough, anyone with access to your phone must know your wallet PIN code to be able to make transactions

</comment></comment></comment></comment><comment><USER6> "Kenyan" and "British" are poorly defined categories. They are not mutually exclusive. M-Pesa is a large and complex thing (company, product, service, cultural or economic effect, why not all of those things!)

So the answer is null.

And since people get so hung up on bs about categories, they will argue about it from an emotional instead of a rational perspective. Those arguments will be endless as (see first paragraph) there is no correct or provable answer.

It is important to do this analysis and remind ourselves of these facts whenever a poorly defined question arises involving complex systems (like culture, society, economics or politics).

<comment><USER7> M-Pesa was a foreign commercial product.

Even server infrastructure was hosted offshore until relatively recently[1]

[1] [https://cointelegraph.com/news/m-pesa-shuts-down-as-they- mov...](https://cointelegraph.com/news/m-pesa-shuts-down-as-they-move-servers- from-germany-to-kenya)

</comment></comment><comment><USER7> G-Cash, in the Philippines, was the first mobile based money transfer platform. It was launched in October 2004, a year before M-Pesa.

There have been many attempts to replicate M-Pesa's extraordinary success. M-Pesa in Kenya is a significant outlier in the mobile money space.

[Edit: assumed M-Pesa founding date of 2007 in wikipedia was when M-Pesa launched. It actually launched pilot in Oct 2005. Exactly one year after Philippines system]

<comment><USER8> There's a lot of other *Pesa systems in East Africa and they all are relatively successful: TigoPesa, HaloPesa, AirPesa, etc etc. Everyone talks about M-Pesa because it was first in East Africa but at this point, it's a commodity.

<comment><USER9> One thing that has always impressed me about these systems: I've never read a story about a corrupt manager of the deposited funds betting them on the stock market and losing them. That's something we in The States have had a hard time preventing and worked hard to legislate against. And still, in a very rough parallel, we utterly failed at it during the housing bubble.

So if my conception of the situation even makes sense, how have M-Pessa and equivalents avoided this pitfall?

<comment><USER8> They haven't. I just got my 10gb package stolen by voda today. The company is dishonest and no one around here trusts them. People might get money through M-pesa, but they convert it into cash asap.

</comment></comment></comment></comment><comment><USER10> Definitely British. Vodafone started the same service in Fiji, where they call it MPaisa (paisa meaning money in Hindi). A competing service by rival Digicel is called Mobile Money.

</comment><comment><USER11> Following the money is an unconvincing argument that leads to publicly traded companies being mostly nationless, Nissan being primarily French, Jaguar being primarily Indian, and WeWork being fully Japanese.

<comment><USER12> >WeWork being fully Japanese

Is it not Saudi Arabian?

AFAIK they poured multiple billions into SoftBank, which poured those billions into Uber, WeWork and others.

<comment><USER11> Ah, but they got their money from zooplankton.

</comment></comment></comment><comment><USER13> [https://owaahh.com/the-age-of-mpesa/](https://owaahh.com/the-age-of-mpesa/)

This gives a more succinct history. The idea was that of British citizens working for Vodacom(Safaricom) in Kenya.

</comment><comment><USER14> Safaricom is good at sales and marketing in East Africa, not at innovation from inside of the company. They do use some clever partners though at times, and the combination can be pretty good. They've obviously taken M-pesa and grown it into a mature product - listening to their clients, but primarily from a sales channel.

</comment><comment><AUTHOR> Here's a 2015 discussion on the topic, linked to M-Pesa's Wikipedia page: [https://news.ycombinator.com/item?id=10612723](https://news.ycombinator.com/item?id=10612723)

 _M-Pesa – a mobile-phone based money transfer and microfinancing service_ : [https://en.wikipedia.org/wiki/M-Pesa](https://en.wikipedia.org/wiki/M-Pesa)

 _70 points by melenaboija on Nov 23, 2015 | 37 comments_

Top comment:

 _mhogomchungu on Nov 23, 2015

Tanzanian here.

I think calling the service "M-Pesa" is misleading since a lot of other people are offering the same service.

Here in Tanzania,

"M-Pesa" is the name for the service offered by vodafone,a mobile communications company.

"Tigo Pesa" is the name for the same service offered by tigo,a mobile communication company.

"Airtel money" is the name for the same service offered by airtel,a mobile communication company.

"EzyPesa" is the name for the same service offered by zantel,a mobile communication company.

For the above reasons,i generally call the service offered by these companies as "a banking service managed by mobile phone companies".

"Sim banking" is the name of the service offered by a "traditional" bank called crdb[1] so a more generalized name that accommodates both traditional banks and cellular network operator banks is in need.

Most traditional banks are also offering the same service.

The only thing they all have in common from the user's perspective is that the services are offered through ussd codes[1] meaning they are not tied to mobile phones and they work with any device that supports ussd codes.

I have an application called ussd-gui[4][3] that i use to manage by money at vodafone "bank" using a mobile broadband modem on my linux system.

[1] [http://crdbbank.com/tz/alternative- banking/simbanking.html](http://crdbbank.com/tz/alternative- banking/simbanking.html)

[2] [https://en.wikipedia.org/wiki/Unstructured_Supplementary_Ser...](https://en.wikipedia.org/wiki/Unstructured_Supplementary_Ser..).

[3] [https://github.com/mhogomchungu/ussd- gui/blob/master/icons/u...](https://github.com/mhogomchungu/ussd- gui/blob/master/icons/u..).

[4] [https://github.com/mhogomchungu/ussd- gui](https://github.com/mhogomchungu/ussd-gui) _

</comment><comment><USER15> where does the profits go? the party receiving the profits is the owner

</comment><comment><USER16> I found this statement interesting:

"If you see the document I sent to @SafaricomLtd you will understand that. All they did was code!"

</comment><comment><USER17> Yes.

</comment><comment><USER18> It was made here in India, Pesa literally means money

<comment><USER19> Pesa means money in Swahili is well, as stated in the first line of the wikipedia page: [https://en.wikipedia.org/wiki/M-Pesa](https://en.wikipedia.org/wiki/M-Pesa)

<comment><USER20> Wonder what the etymology is on that? Seems close to 'peso', but that wasn't really where the Spanish were hanging around, so maybe it's just a coincidence?

[https://en.wikipedia.org/wiki/Paisa](https://en.wikipedia.org/wiki/Paisa) seems to indicate it's possibly from the Portuguese.

<comment><USER21> _> that wasn't really where the Spanish were hanging around_

For a while, Spanish currencies and conventions acted as reference for most of the trading world operating across oceans, regardless of Spanish presence. It was a bit like the modern USD.</comment></comment></comment></comment>


A 3D Printed Spaceship On The Scale Of A Human Hair? Hello Nanoscribe 3D Printer - <AUTHOR> http://singularityhub.com/2013/03/17/a-3d-printed-spaceship-on-the-scale-of-a-human-hair-hello-nanoscribe-3d-printer/

<comment><USER2> I was curious to know how much that printer costs, and how much the objects printed with it. I suspect the answers to both of these questions would not be terribly attractive right now.

Still, there's always a good chance that today's high end products will be tomorrow's consumer grade products.</comment>


Bitcoin may be following this classic bubble stages chart.  - <AUTHOR> http://www.forbes.com/sites/jessecolombo/2013/12/19/bitcoin-may-be-following-this-classic-bubble-stages-chart

<comment><USER2> But, THIS time everything is going to be different! Because of Bitcoin's paradigm-shifting, gravity-defying, game-changing properties, the normal rules of bubble economics and financial regulation no longer apply! The Brave New World has arrived! /sarcasm

Seriously though, Bitcoin is going to enjoy its glorious rise for only as long as the politicians/regulators/law enforcement fail to realize the true extent of the threat to their power, IF Bitcoin's intended properties are allowed to continue unrestricted. Once all these players wake up, the crackdown will be a lot fiercer than anything ever done against P2P file-sharers. Napster threatened just one industry, Bitcoin is taking a swing at our entire political and economic system.

It is just a matter of time before every Bitcoin exchange is forced to turn in all their records to IRS, the transaction histories are fully outed and the main benefits of using Bitcoin are minimized. The regulators have no reason to leave alternative currencies alone vs. crack down like they've done to the likes of the Liberty Dollar ( [http://en.wikipedia.org/wiki/Liberty_Dollar](http://en.wikipedia.org/wiki/Liberty_Dollar) )

At the end of the day, any currency is only as viable as the enforcement power behind it, which ultimately means "people with guns". Bitcoin has none of it and US Dollar has the largest world power behind it...

</comment><comment><USER3> The Bitcoin 40,000 comment by the Winklevoss twin ([http://mashable.com/2013/12/16/cameron-winklevoss- bitcoin/](http://mashable.com/2013/12/16/cameron-winklevoss-bitcoin/)) is actually similar to the 1999 book "Dow 40,000: Strategies for Profiting from the Greatest Bull Market in History"

</comment><comment><USER4> My feeling everytime I read a paper about btc: everybody watches with interest but nobody has the slightest clue of what this will become in the mid & long run

<comment><USER5> We kind of do.

The tendency is to say that it either incorporates a lot and becomes very valuable and the de-facto international store of value and currency (as well as representing a number of assets such as stock or estate property) or it goes to zero.

It's volatility is certainly decreasing as times goes by and the big picture is certainly positive as things stand although I agree that it would take a simple coordinated move to ban it in the western world to take it down.

Yet this has not happened yet and I can't stop but wonder why given what it has happened to Liberty Reserve and we have seen coordinated moves for far less (Kim Domcom with Mega for instance).

It would be enough for it to be regulated such that tax or vat needs to be added and bitcoin would immediately be heavily affected.

Furthermore we do not know who created bitcoin and their real motive.

In my view it is much better than the current central bank situation but it seems there is a side of it that means it has no one accountable.

Should mining ever get compromised (if it is not already) it is not really clear to me that we would even notice.

</comment></comment><comment><USER6> This is because I don't know anything about reading the tea leaves in a market graph like this... but does the (somewhat) significant dip near the top (where it bounced twice to $1200+) make this different from what the author is trying to fit?

</comment><comment><USER7> Last time it bubbled, it followed this exact chart, but on a smaller scale.

</comment><comment><USER8> I can't flag anymore but please don't give this clickbait Forbes rubbish any traffic.

<comment><USER9> How else would I have seen the correlating bubble graph to the bitcoin chart if not for this Forbes link today?</comment></comment>


6px Shuts Down - <AUTHOR> https://6px.io <comment><USER2> > We started 6px to give every company and individual access to quick, easy, > affordable and reliable image processing capabilities in the cloud.

Im not sure a company that shuts down after 3 years is particularly 'reliable'.

> While 6px became the primary tool for image processing in the cloud for many > amazing products and people

Hopefully, at least _some_ of those will learn the lesson here: anything you don't control is a risk to your operation, and anything that's not a commodity/standardised thing, is a huge risk when you don't control it.</comment>


Android Tethering on Linux - <AUTHOR> http://www.linuxstall.com/android-tethering-using-android-to-access-internet-on-your-linux-machine/

<comment><USER2> You don't need to do any of this or need root access, i've had 3 android phones (hero, desire, galaxy SII) and I've never had to do any of this. Just plug it in and select USB tethering and it is recognised by ubuntu as an ethernet adapter.

<comment><AUTHOR> You will need root access to the phone (for old Android versions, Froyo (Android 2.2) and beyond can do it natively). I agree that most Linux distros will recognize it automatically as soon as you enable USB tethering but there are some distros which will not do the same, in that case you will have to follow the steps given above.

<comment><USER2> Fair enough, did you add the bit to the start of the article about 2.2 or do I just suck at reading and comprehension(in which case apologies)

<comment><USER2> My bad, sorry, looks like i need to work on my reading skills. Comment withdrawn.

<comment><USER2> BTW the HTC Hero supported tethering since Android 1.5, hence why i was confused. I didn't realise it was vendor specific before 2.2 because it seems all factory unlocked HTC's(and some carrier locked ones) have supported tethering since 1.5 without rooting.

[http://insidesprintnow.files.wordpress.com/2009/09/hero_gsg....](http://insidesprintnow.files.wordpress.com/2009/09/hero_gsg.pdf)

Lol, had to look it up for my own piece of mind, i was sure i could remember tethering on my old Hero back in the day.

<comment><AUTHOR> Two way comments dude, two way comments! hahaha :D</comment></comment></comment></comment></comment></comment>


GitHub restricting Iranian civilians access to its free services - <AUTHOR> As of July 25th, GitHub abruptly restricted Iranian (and some other countries) users access to its free services depriving them of even accessing their own private repositories. Not only this is against the nature of open communication/collaboration, but also people can't even download a copy of their code as a last resort (e.g. moving to some other service provider)
You can find a sample article written by one of the fellow Iranian software developers here:
https://medium.com/@hamed/github-blocked-my-account-and-they-think-im-developing-nuclear-weapons-e7e1fe62cb74 <comment><USER2> Recent related discussions:

[https://news.ycombinator.com/item?id=20531039](https://news.ycombinator.com/item?id=20531039)

[https://news.ycombinator.com/item?id=20526039](https://news.ycombinator.com/item?id=20526039)

[https://news.ycombinator.com/item?id=20493699](https://news.ycombinator.com/item?id=20493699)

</comment><comment><USER3> It's US law, they don't have a choice.

<comment><USER4> It's Iranian government behavior.

</comment></comment><comment><USER5> edit. removed</comment>


SpaceX launch webcast - <AUTHOR> http://www.spacex.com/webcast/?#

<comment><USER2> They just aborted the attempt for today

<comment><USER3> Launch team is probably not happy their stress is prolonged for another 24 hours.

Then again, their boss is Musk. Lucky bastards.

<comment><USER4> ...Which makes sure their stress is prolonged far more than 24 hours, at least according to my friends who work there.

</comment></comment></comment><comment><USER5> Looks like they won't go to space today. [http://xkcd.com/1133/](http://xkcd.com/1133/)

<comment><USER6> Did the part where lots of fire comes out start pointing toward space?

<comment><USER5> No, that would be a bad problem. This was only a little problem.

<comment><USER7> The door to the box that holds the air that makes your voice sound funny didn't work. Maybe it will work tomorrow and the part of the space car that falls of first will come back without crashing.

</comment></comment></comment></comment><comment><USER8> Any word on if they're going to do any testing of landing the first stage on this launch? It looks like they're using the first stage landing legs.

<comment><AUTHOR> Yes, they'll be making another flyback and ocean landing attempt -- this time closer to shore and hopefully with a better signal to receive uncorrupted video! (The last time, the plane they were receiving the booster's telemetry from was too far from the landing site to get a clean signal).

<comment><USER9> Actually, some people on nasaforums.com made unbelievable progress in reconstructing the original landing video from the original raw corrupted stream. Here's the progress made so far:

[http://youtubedoubler.com/?video1=7m8H8OlJ3o8&start1=0&video...](http://youtubedoubler.com/?video1=7m8H8OlJ3o8&start1=0&video2=lBgVTWbtgVQ&start2=0&authorName=mhenderson)

<comment><USER10> That's amazing.

<comment><USER11> I peeked in at the discussion about trying to recover more of the stream. It was pretty neat. Some of those folks really know their stuff when it comes to the bit-level details of video encoding. As I recall, a bunch of the errors in the stream ended up being fairly regular and identifiable/reversible with human intelligence, like repeated sequences of N flipped bits every M bits.

<comment><USER10> The fact that they could look at the raw data and figure that out is really awesome. Shows you artificial intelligence has a long way to catch up.

</comment></comment></comment></comment></comment></comment><comment><USER12> Launch aborted - possibility of trying again in 24hrs

</comment><comment><USER13> Scrubbed. :( I guess we wait until tomorrow.

</comment><comment><USER14> Launch is scheduled for 15:08 PDT. (18:08 EDT)

EDIT: Launch has been pushed back an hour, to 16:01 PDT. (19:01 EDT)

<comment><USER15> Actually they're targeting 16:01 PDT (19:01 EDT). Just pointing that out so people don't miss it.

[http://new.livestream.com/spacex/events/2980259/statuses/544...](http://new.livestream.com/spacex/events/2980259/statuses/54430293)

</comment></comment><comment><USER16> Launch just got aborted again.</comment>


Facebook working on subscriptions for publishers - <AUTHOR> http://www.foxnews.com/opinion/2017/06/15/news-corp-ceo-almighty-algorithm-fake-news-and-other-consequences-google-amazon-and-facebooks-relentless-focus-on-quantity-over-quality.html <comment><AUTHOR> From the article: " To be fair to the F, we are involved in an advanced discussion with Facebook about the creation of a subscription mechanic that would benefit news organizations and journalists – perhaps generating enough revenue for the industry so that journalists do not become a modern mendicant order."</comment>


Ask HN: How to type better one handed? - <AUTHOR> I recently broke my right hand and luckily I'm cack-handed so it's not been too much of a struggle getting by.
However typing has become something of a monumental task and I have another 5 weeks of this.
I code on OSX, and work in an office so using dictation tools is out of the question.
Does anyone know of any tools that may make my work life easier for the next 5 weeks? <comment><USER2> There used to be patents on Half Qwerty keyboards, but I think those died, so there should be options of either physical keyboards (might be a bit expensive for only a couple of months use - but I guess you could donate it to a local school after you've finished with it) or software half qwerty keyboards.

There are dvorak layouts for one hand.

</comment><comment><USER3> Sticky keys. Most mainstream operating systems now have an accessibility setting where double-pressing modifier keys (shift, ctrl, etc) will cause them to stay active for an extended period. This should save you some contortions when typing uppercase letters, keyboard shortcuts, etc.

</comment><comment><USER4> One idea: use the mouse and a "virtual keyboard", "software keyboard", or "on- screen keyboard", an entry device where you point the mouse and click keys. There is a virtual keyboard built in to Windows, don't know about OSX.

</comment><comment><USER5> Pair programming?</comment>


Why We Should Send All Our Politicians to Space - <AUTHOR> https://singularityhub.com/2017/08/21/why-we-should-send-all-our-politicians-to-space/ <comment><USER2> There should be a live feed of our planet from space available online, on a TV channel globally, and on an app that does nothing else.</comment>