(1) Keep it simple, (2) make it something you'd actually use, (3) iterate. - <AUTHOR> http://prog21.dadgum.com/80.html?repost

<comment><USER2> "Make it something you'd actually use" is of great value to a budding (aimless, excited) programmer, but staying too long in this mindset leads to a glut of products and services serving the same purpose for the same market. The highly-upvoted "Hello Ladies" video with patio11[1] really drove home the point that products for people who aren't programmers have tremendous value. This post is good advice to get started, but once new programmers begin to feel comfortable with their abilities, it would behoove them to empathize with people who _aren't_ like them and try to make something others would appreciate.

[1] <http://news.ycombinator.com/item?id=2371965> \-- this comment does not reflect the opinions of patio11

<comment><USER3> +1. I never really liked the "build it for yourself" mantra. If this were true, we'd have tons of programming IDEs and project management software. What programmers and entrepreneurs really need to serve are markets where programmers are under represented. I'm talking about agriculture, natural resources, transport, finance, manufacturing, etc.

<comment><USER4> > If this were true, we'd have tons of programming IDEs and project management > software.

Your assuming programmers' only interests are programming related. I'm currently building a site that sells trail mix and another to organize gear lists for backpacking. This is because I am involved in those spaces and I would like to improve the experience for the people I share it with.

I'm sure there are many programmers who are interested in agriculture, natural resources, transport, finance, and manufacturing.

<comment><USER3> I'm not saying programmers don't have other interests, just that programming is usually their main interest which leads them to build products targeted at programmers (there's quite a lot of empirical evidence to back this observation: just look at all the "Show HN" we're getting here). I think it takes at least a conscious effort to get interested by say agriculture, unless you were raised on a farm :). More people need to make that conscious effort. Interdisciplinarity is where the real money is at.

<comment><USER5> Yeah, solving a personal problem is not the be all and end all. If you want success, you could always spend some time in an industry like farming. It'd take time, and probably would mean a year or 2 working in the industry to truly understand the problems that exist, but once you find a solution to a common problem that'd sure be one business where there is serious income potential. Of course not many hackers (if any) would take such a route...

A $99/month service is milk money to a farmer (not sure if pun is intended).

<comment><USER6> I do software development by day and have a cash crop farming operation on the side, so I have familiarity with both industries. I think an agricultural- based software startup would be mighty interesting.

However, the bulk of my problems on the farm are related to interfacing with third-party businesses. They have no incentive to improve their processes because the average farmer is 55 years old and would rather bang a hammer than bang a keyboard, and I cannot improve my processes without direct access to their data.

Your advice is sound, but personally I have found it to be not a very inspiring place for a startup yet. The low hanging fruit, at least as far as my operation is concerned, I find is already solved well enough. As some of the older farmers who fear computers move into retirement, however, I think the landscape will quickly change and some big opportunities will rapidly appear. I am looking forward to it.

</comment></comment></comment></comment></comment></comment><comment><USER7> I completely get what this cat is saying.

I initially learned programming to help me automate some tedious duties when playing role-playing games (this was many moons ago).

The first non-trivial program I write in a new language is always related to my favorite RPG.

<comment><USER8> Out of curiosity (I have no experience with RPGs aside from a bit of AD&D2 15 years ago), what kinds of tools do you make? Character generation, that sort of thing?

Incidentally, the title of this HN post sounds like a good strategy for developing just about any product.

<comment><USER7> I played Traveller, so it was a bit of everything: character generation, planet and system generation, space craft generation, hell, they even had a half-dozen "alien languages" that you could create programmatically.

Good times.

</comment></comment></comment><comment><USER9> The title says it all. I've been working on a project for quite some time when it suddenly dawned on me (as target release date after release date kept slipping) that what I am actually building is an assembly of many functions and that I should (1) break each of those functions down into individual components (2) because they are something I already use and so do others, (3) release each of those components with the first part and then add-on as the next is complete... finally ending up with what I had in mind in the first place.

Another good quote I saw recently was how we mix up the Minimally Viable Product and the Desired Viable Product. Funny... we can read and study all we want but it takes a while to sink in and be applied, doesn't it?

</comment><comment><USER10> Reminds me of the first project that was entirely my own idea, at age 14 or so, a system to manage customer accounts for my paper route. Written in TI99 BASIC. Data file saved to a cassette tape. It worked, but I ultimately realized that it was much easier to just use a paper ledger so I didn't really iterate on the solution. I could update the accounts on paper in the time it took the computer to load the program and data from the cassette.

</comment><comment><USER11> I was using Photoshop to pick colors from design PSD´s and PNG´s. Then I found two nice color libraries, added my boring app framework and created this - <http://teppefall.com/products/colorspace>.

The problem is risk.. do you spend a $1000 on good sales copy and some Adsense when you might only get $900 back short term ? Your product is good, but is it good enough?

</comment><comment><USER12> Previous discussion at <http://news.ycombinator.com/item?id=1724074></comment>


Beware of the social ideas - <AUTHOR> http://joel.is/post/5961172449/beware-of-the-social-ideas <comment><USER2> Nice article. AFAICT, "social" is a bit like TNT. If you don't know how to handle social/TNT and you're handling social/TNT, you're in deep shit. If you mention social/TNT, you better have a strong argument for why you are able to use it correctly. I've heard _very_ well connected and regarded folks say "when we get to scale, we can monetize easily...". The question back is always "awesome! when can you come back with proof? Say 50k users and growing?" Carrying the analogy forward too far, there are some applications that are 100% dependent on explosives, but they're few and far between (see Fireworks), but I hear tons of people talking about social applications as though they're super-common and easy. More often than not TNT/social are added to existing applications to enhance the application: see Mining or Music; rarely are TNT/social used to build stand-alone applications (see Fireworks, Facebook, Twitter).

I'm definitely in favor of the article's advice to: build a tool you'll use, get others to use it, figure out how to add network effects, then figure out how to add social. Much less risky and, probably, much _more_ satisfying.

From TFA:

        my latest venture is Buffer,
        a new Twitter application.

I appreciate the author's points on adding-social and I'd certainly be curious about his perspective on building an applications that is 100% dependent on a capricious social network.

</comment><comment><USER3> The problem which I faced while trying to bootstrap a social product is that without some previous reputation/success, getting traction for your startup is very tough, and at times even demoralizing. It's better to focus on a single user product which is not dependent on a network effect for success...

<comment><USER2>
        getting traction for your startup is very tough,
        and at times even demoralizing.

Amen, sister! It can be even worse when relatively non-social folks build a social startup. It isn't uncommon for someone to realize that they aren't actually users of social media _only after_ they build a social application. Nothing worse than building something only to realize that you have to convince other people to use it when _you_ aren't interested in using it.

</comment></comment><comment><USER4> Very well written. This is something that has been obvious to me for a long time, but I've never been able to explain it in such a simple and clear way before.

I'm saving this article to show to the next person who approaches me to work on a social startup.

</comment><comment><USER5> I totally agree. The best case scenario is to make a product that is useful for 1 user, but becomes even more useful as more and more users use it. The best example is FourSquare. You can check in, and earn badges, but as you tell more and more friends about it, those badges become a bigger status symbol. Yet even without any friends, it still feels good using it

<comment><USER6> I also agree with the article but FourSquare seems to me more like a counterexample rather than the best example. Its utility is arguable even after the network effects, let alone without them.

<comment><AUTHOR> Yes, Foursquare would be a "social" idea in my mind. However, Dennis Crowley has had an exit previously, so I think it makes social ideas easier for him to pursue. I think social ideas with network effects are very difficult to succeed with when you're a first time entrepreneur with no track record.

<comment><USER7> How is FourSquare doing nowadays? I never used it, but it was a big deal about a year ago and I haven't heard much from 'em since (I'd pretty much forgotten about them).

With competition from facebook checkins, isn't FourSquare more or less doomed right now?

<comment><USER8> I just did a quick analysis with Google Insights for Search and posted the results. To me, it looks like 4sq is flat since April globally, and down 30% from its peak in Aug 2010 in the US:

<http://yak.to/tech/p.bf/Has-Foursquare-peaked>

</comment></comment></comment></comment></comment><comment><USER9> Don't forget that Facebook started as a "tool" - essentially a preseeded online yearbook. Social ideas are fine as part of your vision, but they are essentially impossible to bootstrap without being useful in other ways first.</comment>


One Item Todo List - <AUTHOR> http://metacircus.com/writings/2011/10/17/one-item-todo-list.html

<comment><USER2> What's funny for me was the first time I saw Trello, I looked over to my left and that is exactly what I saw (albeit minus the advanced features of discussions etc.).

I have wide post-it-notes arranged in 3 columns indicating status; Done, In- Progress, Todo.

That and a pen and paper keep me ontop of my TODO.

I also attempted to keep track of my days work using a log post in Gollumn, I tried for a few weeks but that never seemed to stick.</comment>


After the Strongman - <AUTHOR> https://newrepublic.com/article/147369/strongman-zimbabwe-robert-mugabe-democratic-era <comment><USER2> I am afraid that most of the world is stuck in Tyrant - Aristocracy loop not unlike ancient Greece polices.

This way, unfortunately, you know what will be after the strongman and the step after that, too.</comment>


CSS Properties Index - <AUTHOR> http://meiert.com/en/indices/css-properties/

<comment> jarek-foksa There is also another list which focuses on vendor-prefixed properties: [http://peter.sh/experiments/vendor-prefixed-css-property- ove...](http://peter.sh/experiments/vendor-prefixed-css-property-overview/)

</comment><comment><USER2> [http://svn.webkit.org/repository/webkit/trunk/Source/WebCore...](http://svn.webkit.org/repository/webkit/trunk/Source/WebCore/css/CSSPropertyNames.in)

[http://mxr.mozilla.org/mozilla- aurora/source/layout/style/ns...](http://mxr.mozilla.org/mozilla- aurora/source/layout/style/nsCSSPropList.h)</comment>


Is there a seed bubble? - <AUTHOR> http://www.philmichaelson.com/fundraising/is-there-a-seed-bubble/

<comment><AUTHOR> If anyone has stats on angel funds and fundings, please let me know. I'd love to firm up the assumptions in the main equation. I'm looking for:

1) Number of "seed" funds & average size of fund

2) % ownership a seed investor likes to have at exit & time to exit

Thanks!</comment>


Russians Engineer a Slot Machine Cheat that Casinos Can't Fix - <AUTHOR> https://www.wired.com/2017/02/russians-engineer-brilliant-slot-machine-cheat-casinos-no-fix/ <comment><USER3> I see a lot of complains why this is illegal. It is illegal, as anything that it is illegal, because the law says so.

As, for example, in Nevada:

"NRS 465.075 Use of device for calculating probabilities.

It is unlawful for any person at a licensed gaming establishment to use, or possess with the intent to use, any device to assist:

          1.  In projecting the outcome of the game;

          2.  In keeping track of the cards played;

          3.  In analyzing the probability of the occurrence of an event relating to the game; or

          4.  In analyzing the strategy for playing or betting to be used in the game,

except as permitted by the commission."

[http://www.gambling-law-us.com/State-Laws/Nevada/](http://www.gambling-law- us.com/State-Laws/Nevada/)

<comment><USER4> The irony here is it's only illegal to beat the games because the casinos figured out how to rig the democratic process to get favorable laws passed. If we put it to a vote, what would the public think was more unethical, using a mechanical device to count cards or using lobbyists to make sure you can't lose?

<comment><USER5> If a casino could lose money, you'd either have only small, locals casinos, or none at all. Votes are rarely referendums on ethics.

In this case we'd (and by we, I mean Nevada residents) compare two scenarios: a world without the big Vegas casinos (and their tax revenue, their employees, the good stuff), or a somewhat rigged world with the casinos.

<comment><USER6> What a defeated view. Hopefully one day those Nevada residents may see a horizon beyond the sprawling parking lot of a casino.

<comment><USER5> If there is an industry that can profitably offer better jobs/economic incentives to Nevada, then I think you would see that industry gain power and relatively weaken the grip of the casinos on Nevada.

So maybe in 5 years we'll be complaining about how Nevada residents can't see beyond 'rigged' tech jobs that don't pay as much as the Bay Area...

</comment></comment></comment></comment></comment><comment><USER7> I would like to know what is morally wrong in defeating a system designed to beat you. Designed to (almost) always win. The Casino is the one that cheats because the odds are not completely random, as they should.

<comment><USER8> They aren't charging the defendants with a 'moral' crime. I'm not sure what their exact charges are, and they depend on minutae like the article said: "crossing state lines makes it a felony conspiracy to commit fraud". Gaming regulations are written to favor the house. You're correct that we wouldn't expect them to be charged with "tampering with a gaming device" because they never touched it, and they got comparatively light sentences (2 years) compared to Nevada where you can easily get 5-10. Some states may have a new law like "using a computer to manipulate a gaming device" or similar. I think they put that one on the books so that you can't cheat roulette by calculating the trajectory of the ball, or identify unique variances in cards. Regardless, you can expect the laws everywhere to catch up after this incident.

I disagree that the "system is designed to beat you" or that the casino "cheats". The casino is there for entertainment. If you don't use it in moderation it can ruin your life just like any other vice: alcohol, drugs, sex, etc.

If you have $1000-$5000 (or more), you can fly out to Vegas for the weekend, have a really good time (gaming is only part of that), fly home, and you've got a significant chance that you'll either win or break even. You might also lose, and that's the excitement cycle that is gambling. But even if you lose you can also have a good time at a show/nightclub/concert, every kind of themed bar, meet women, etc, so if you discard "winning money" as the primary objective, gambling isn't designed to beat you.

If you go to the casino every day after work, don't be surprised that you will not win anything, or that it might escalate just like any other drug (spending more, not happy when you win, etc).

What shocks me is that these guys have the technical prowess to reverse engineer the game/PRNG, but they didn't have the sense to slow down their pace, or reverse engineer the casino management system to avoid detection (or they didn't think to hide their iphone from the start, they said the first guy was holding it right up to the screen, when $100 spent on a clothing alteration would have allowed him to hide it). If you're going to fly internationally to commit a crime, you should know who you're up against and use adequate countermeasures.

<comment><USER9> >> "crossing state lines makes it a felony conspiracy to commit fraud".

I don't see any fraud though. Sure, they found a system to beat the slot machines, but I'm not sure how that's fraud. What if some guys think they're really good at playing poker and they take a trip to a casino to play?

At what point does playing smart become fraud? or cheating? When does counting cards in blackjack become cheating? When you get too good at it? This whole area seems rather strange.

<comment><USER10> The big factor here is that casino's specifically forbid the use of devices intended to affect the outcome of the game. You go to a casino, you have to play by their rules. If not, they can argue you are attempting to defraud them.

Counting cards is a much better example of "playing smart", and it is not actually illegal - although casinos will ban any player they suspect to be counting they will likely not be charged with a crime. But once you bring a personal implement in to the situation, it very much becomes a prosecutable crime.

<comment><USER9> >> The big factor here is that casino's specifically forbid the use of devices intended to affect the outcome of the game. You go to a casino, you have to play by their rules. If not, they can argue you are attempting to defraud them.

I understand that they may kick you out for being too good (he must be "cheating"). And the argument about using a device to aid you might be a more concise definition of cheating of some sort. But I've never noticed any posted rules that one would reasonably be expected to know about. And the use of the term "fraud" is important because then it becomes a legal issue with big consequences beyond getting kicked out or banned from a particular casino. OTOH a casino doesn't need to post the law for people to read. Does the law defer to the casino rules? That wouldn't be appropriate IMHO.

There are "house rules" and there are laws. I'm kind of wondering where those lines are and what specifically these guys did that constitutes a felony. What specific aspect of their scam was illegal. I'm not disputing that it was dishonest and in effect a scam of sorts.

<comment><USER11> IANAL but there are a few things in this matter that seem to be common knowledge. How these things will apply to a specific instance is for lawyers to discuss. The law, at least in Nevada, does defer to the casino's right to do business with whomsoever it chooses. The law does not permit the casino to beat a card counter up (like in the movie "Casino") but they can insist that such a customer leave and never come back, and in those cases at least in Nevada, when such a customer tries to return, they may become a trespasser [1].

[1][http://www.pandullolaw.com/Criminal- Defense/Trespassing.aspx](http://www.pandullolaw.com/Criminal- Defense/Trespassing.aspx)

</comment></comment></comment></comment></comment></comment><comment><USER12> Saved you a click: the internal state of some slot machines' PRNG can be predicted after observing a few of its outputs.

<comment><USER13> The slot in question an Aristocrat MAV500 mark VI is 32-bit and is no longer in production.

It's as random as much it can be made so in that range of 2,147,483,647? I'm not a programmer I'm not sure how a stop symbol or blank is chosen when programming a slot theme.

Newer slots are 64-bit and have larger virtual reels.

Some slots now even use a product called quantum randomness supposedly true randomness. [https://comscire.com/](https://comscire.com/)

<comment><USER14> The CPU architecture bit size (32-bit) has no impact on the random range. You can implement an arbitrary length RNG on any machine.

Based on the article it seems that the flaw is that the machine uses the timing of human interaction as a significant seed source. This works well enough for unaware people, but as evidenced here is super easy to exploit once the knowledge is out there. Using time (e.g. the time the program started) as the PRNG seed is a very common security flaw. Otherwise experienced engineers keep making this mistake even in 2017.

<comment><USER15> I don't think that is what the article said. Where do you read that the machine uses the user's timing to seed the PRNG? It talks about timing the button presses but my understanding was that that was only used after the PRNG was cracked. The PRNG is cracked by measuring the timings of on screen cues. These cues are essentially outputs from the PRNG. There is nothing that indicates the user's timing is used as a seed as far as I can tell.

<comment><USER14> I assume you understood that by timing I didn't mean seconds from 1970. Beyond that this seems to be getting into semantics territory on how we define 'seed'. To be clear, I agree with what you're saying about the PRNG flaw.

We can probably agree that PRNG is a function that takes an input and produces an output. I guess you take issue with me calling this input the seed. My use is probably a simplification indeed, but I thought one that doesn't change any principles. Because the user's interaction timing is crucial, it seems pretty clear to me that the exploit is about influencing the input of the PRNG. We can call this input something else, e.g. internal state. Or we can call it the seed.

<comment><USER15> The seed of a PRNG is a pretty well defined thing.

<comment><USER14> Successful communication depends on participants understanding eachother. You'll notice that the context of my comment was replying to a person who stated that they are not a programmer. Filling my post with unnecessarily precise lingo would work to undermine my goal which is to convey a basic idea.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> At what point does a scheme like this go from just being a way to outsmart the slot machine to felony fraud? I know you are allowed to use those blackjack cheat cards at the tables in Las Vegas but what if I started using a calculator and my own crazy algorithm? Is that fraud? What if I had an ear piece and hidden camera glasses to stream video to some blackjack guru outside in a van? I'm guessing that would be fraud. Is it the fact that he's using an outside source to determine his actions?

<comment><USER17> Here is a section of the Nevada gambling fraud law that hits close to a method that involves button timing:

>7\. To manipulate, with the intent to cheat, any component of a gaming device in a manner contrary to the designed and normal operational purpose for the component, including, but not limited to, varying the pull of the handle of a slot machine, with knowledge that the manipulation affects the outcome of the game or with knowledge of any event that affects the outcome of the game.

In general you are not allowed to do anything clever in a casino. It isn't stated as such, but the actual crime is winning consistently. If you walk into a casino certain that you will not be providing the house with their cut then you will almost for sure run up against some law. Extra laws will be generated as required by the governments involved.

<comment><USER18> Key word being "knowledge".

Seems like you are free to believe in any fantasy about you having an edge over the house, except when that belief happens to be true. The mere thought of having a streak of luck would make winning illegal. If thoughtcrimes were animals, this would be a cute little kitty.

<comment><USER19> > Seems like you are free to believe in any fantasy about you having an edge > over the house, except when that belief happens to be true.

This is a pretty common pattern in "intent" crimes. As a simple example: attempted murder requires a potentially-effective plan. Shooting at someone and missing is attempted murder, burning a voodoo doll of them is not - <USER2> matter how sincerely you expect it to work.

It does produce an odd situation where stupidity becomes a legal defense, but the basis for it is pretty understandable. It's not criminalizing being right, it's decriminalizing being wrong, presumably because it's too hard to define the boundaries of whether something useless was done with real intent.

<comment><USER20> I would argue that burning a voodoo doll should at least count for intent to harm.

Lets say I am completely mistaken about how chemistry works and I think that adding salt to wine will somehow make it a deadly cocktail. With intent to kill you I make such a concoction and serve it to you.

In that case I should still be able to be punished under the law.

<comment><USER21> 1991 article by David D. Friedman about this topic: [http://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?articl...](http://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1565&context=facpubs)

<comment><USER22> The article assumes rational behavior with regard to everything except which methods of committing crimes are possible and concludes that punishing impossible attempts creates a rational disincentive to all attempts.

It's right in a game-theory sense, but not a practical one. Proving intent to a jury is based on circumstantial evidence. Shooting a gun at someone is strong evidence of intent to murder because it is widely known that guns are lethal. Countering the weight of that evidence would require very convincing evidence that the shooter did not believe his actions would be lethal. Proving that someone believed burning a voodoo doll would be lethal would be very difficult since it is widely known that burning voodoo dolls is not lethal. Even apparent evidence that the voodoo practitioner had a genuine belief is easily played off as an act, and in criminal law, the benefit of the doubt goes to the defendant.

There's also the matter of people having mistaken beliefs about the probability of punishment.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> For the german speaking; here's a documentary about a guy who did this in the late 70ies in Germany - without an iPhone, just by developing a feeling for the (back then) mechanical machines.

[https://vimeo.com/169617086](https://vimeo.com/169617086)

Fun fact: §263a StGB (German penal code) was in part created to combat this kind of externally assisted prediction for slot machines. It is now punishable with up to five years in prison, if you just create or distribute the software up to three years.

</comment><comment><USER24> Funny (and sad) how something that could be praised as an ingenious trick a hundred years ago is now considered a crime that state spends serious effort to pursue.

Cannot resist to reference an older perspective (from Smoke Bellew):

[http://www.online-literature.com/london/smoke-bellew/4/](http://www.online- literature.com/london/smoke-bellew/4/)

<comment><USER25> That was a great story. A little long but still great.

</comment></comment><comment><USER26> A quick search of the inestimable comp.risks archives revealed this:

[http://catless.ncl.ac.uk/Risks/15/80#subj2](http://catless.ncl.ac.uk/Risks/15/80#subj2)

 _Montreal -- Daniel Corriveau said he hopes that his 'victory over the system will give hope to others.' The computer analyst and his family received more than $620,000 [1C$ = U$0.75], including interest, from the Montreal casino yesterday, weeks after they overcame odds of one in six billion and beat an electronic keno game three times in a row."_

The author explains the following key points:

o Corriveau used an "antique 286" computer to analyse 7,000 combinations from the keno game, [which uses an electronic pseudo-random number generator].

o Corriveau noticed that the electronic game was repeating numbers in a predictable pattern.

o Corriveau and several family members bet on what they predicted would be due to come up; they won three times in succession.

I had originally seen an article speculating someone power cycled a keno machine after recording the winning numbers, with the assumption or knowledge that the random number generator reseeded with a 0 on cold boot. I'm not sure if that's just me mis-remembering the details of this case, or another one altogether. If anyone has a link to the second case please let me know.

</comment><comment><USER27> Figuring out the pattern of a pseudorandom device used for gambling reminds me of Michael Larson, who learned the patterns used on a TV game show in order to win a lot of money. See [https://en.m.wikipedia.org/wiki/Michael_Larson](https://en.m.wikipedia.org/wiki/Michael_Larson)

</comment><comment><USER28> > Allison notes that those operatives try to keep their winnings on each > machine to less than $1,000, to avoid arousing suspicion.

This is likely to be because they're trying to avoid the automatic W-2G that's generated for slot winnings over $1200. Basically if you're playing anonymously on a slot machine, any payout of $1200 or over on a single spin will generate a human interaction. Unless you're playing at fairly high stakes (say, over $100/spin), this is normally rare enough that hitting several $1200+ results in a short time span would be very suspicious. Keeping every win under $1200 allows a person to play as anonymously as you reasonably can in a casino.

</comment><comment><USER29> The "And Casinos Have No Fix" part of the title seems exaggerated; if nothing else, it appears that only a small subset of 5+ year old machines are affected.

<comment><USER30> From the description of the attack it seems like the only reason other machines aren't affected is because the Russian group running this hasn't gotten their hands on those machines.

<comment><USER31> Sort of maybe. It sounds like the slot machine makers are being cheap with their machines. There are such things as hardware RNG that will produce a truly random number, it's just that for most applications they're overkill. This seems like an instance where not only aren't they overkill, they're almost mandatory. They talk a bit about using encryption to protect the PRNG algorithm, but that's just a bandaid, at best it buys them a little bit of time, but ultimately it will be cracked the same way.

A hardware RNG is actually pretty cheap to make, there are actually open source (as in the circuit diagrams are available) ones floating around the internet that you can build for less than $20 worth of parts. The manufacturers probably don't want to go that far because a) compared to most of the parts in the machine it's a fairly expensive piece so it will cut into profits, b) hardware RNG function a bit different from a PRNG so properly integrating one requires a certain amount of skill, c) it isn't their problem really, they already got their money, it's the casinos that are losing, and d) it's simpler to just prosecute the handful of people doing this (for now).

<comment><USER32> e) it's much harder to be sure a hardware RNG actually does produce random outputs compared to a PRNG

<comment><USER31> That was somewhat covered by point b, but yeah, in terms of verification it's tricky to determine if a hardware RNG is actually, you know, random. The other part that makes it tricky is that most hardware RNGs don't produce enough entropy to keep a system fed during active usage so you typically need to use their outputs as inputs to more traditional PRNGs or to periodically re-seed a PRNG which was actually the main thing I was thinking about with point b.

</comment></comment></comment></comment></comment><comment><USER33> Don't know what PRNG they use, but for the Mersenne Twister (MT19937, which was considered state of the art the beginning of this millennium) for example you can deduce the state after 600 or so observations (of 32 bit words), and then predict what it'll deliver after that. See [1] for details and some good background on PRNG, if possibly a bit biased (she's promoting her PCG family).

For gambling purposes, probably makes sense to use cryptographically secure PRNG :-)

[1] [http://www.pcg-random.org/predictability.html](http://www.pcg- random.org/predictability.html)

</comment><comment><USER34> That is a very interesting article.

I disagree with the characterization of the crews as "cheaters". They didn't cheat. They turned a game of chance into a game of skill, then excelled at that skill. Of course this has happened to other games as well, such as with card counting in blackjack, which is also inaccurately described as cheating when it's actually mastery of the game.

</comment><comment><USER35> Change to roulette, chaos theory, and physicists -- using 8bit hardware in shoes -- and you get the fascinating book "The Eudaemonic Pie" by Thomas Bass. Highly recommended.

<comment><USER36> Came here to say the same thing. Brilliant book. A team of physicists created a computer to track a roulette ball and wheel with sufficient accuracy to gain a whopping 40% advantage over the house. Their hardware was never reliable enough (in terms of not catching on fire, the predictions were good) to make much money. Doyne Farmer, a member of the team basically invented the field of chaos theory, then went on to make a fortune on Wall Street.

<comment><USER35> I actually interned at Los Alamos Natl Lab at the Center for Nonlinear Studies while Doyne was there (late 80's - dating myself - before The Prediction Company). Cool guy! He had a nifty custom piece of hardware board for cellular automata in his computer that at the time blew me away. Was a cool job... got to write code that ran on things like Cray YMP supercomputers. Had a Thinking Machines CM-1 as well... (like in Jurassic Park with the blinkenlights).

</comment></comment></comment><comment><USER37> By " _Can 't_ fix", they mean " _could_ fix by putting in new slot machines whose PRNGs aren't crackable, but _choose not to_ because it wouldn't be cost effective".

Why don't slot machines use true random numbers? They could still skew the results however they like.

<comment><USER38> why can't they simply update the firmware?

A secure PRNG can be made trivially.

<comment><USER39> sure it can.

Now, implement it on a system from 2008 whose source and tooling has been scattered to the winds.

<comment><USER40> tons of people are working on video game console emulators, and that kind of people could do that easily...

</comment></comment></comment></comment><comment><USER41> The true fix is just to replace the machines. As they said the newer machines have encryption to hide the PRNG. Obviously some places can't do that, and the company is not doing it for free. So technically the casinos cannot fix the compromised machines themselves, but they could just replace them.

<comment><USER42> If I know the PRNG and the encryption then I can predict the outcome of the encrypted PRNG.

The encryption community has dealt with this issue for a long time and there are a lot of useful approaches, and many ways to fail.

<comment><USER43>
      >  If I know the PRNG and the encryption then I can predict the outcome of the encrypted PRNG.

I assume they are mixing the PRNG output with a secret key using some encryption algorithm. Given the cyphertext (observed spins) + the algorithm, you still can't predict numbers until you discover the key.

<comment><USER42> Depends on the algorithm. Many encryption schemes are vulnerable if you know the cyphertext and can guess the plain text.

This is one of those cases where if they knew what they where doing the PRNG would be fine as is. So, you can't just and wave some undefined encryption scheme and assume they will implement it correctly.

<comment><USER44> Any cryptographic hash function works as a key derivation function (KDF) or cryptographically secure pseudo-random number generator (CSPRNG). Even ones with broken collision resistance are probably still suitable-- you could just take the bottom bits of MD5(secret_key + counter) and that would be enough.

<comment><USER42> Very much no. If I know the hash function will always map input X > Y for all machines and I can guess say 100,000 possible states for the PRNG based on for example the time stamp then:

Hash those 100,000 states, compare the output of those hases to the observed output to find the actual PRNG state. Then always know the hashed output of the PRNG.

PS: Read [https://en.wikipedia.org/wiki/Cryptographic_hash_function](https://en.wikipedia.org/wiki/Cryptographic_hash_function) Now if each machine used it's own hidden salt then that would be a real option. But, cryptographic hash does not imply an unknown salt.

<comment><USER44> With a secret state of 128 bits or more, you can't brute force it before the sun burns out.

<comment><USER42> Edit: You said secret_key aka hidden salt, but if I can get that key by say access to the machine then it's not necessarily hidden.

I am pointing this out because the assumption is a poor PRNG used by incompetent team in the first place. Saying just do X, when it's possible to do X and still have a problem is not an actual solution. It's equivalent of saying just be competent.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER45> Somebody play a tune on the world's smallest violin. People kill themselves because of casino normalizes self destructive behavior. So a bunch of impoverished engineers figure out a way to beat an outfit that profit's off from ripping people off. More power to them. I hope they take out all the fucking casino's ripping people off. Not that I condone hacking but casino really doesn't even register on my empathy list. Fuck them.

It should be legal to burn money also because people love doing it at a swanky place like casinos. At least you won't see people get addicted to dousing your cash with gasoline and throwing a cigarette at it.

I just thought of it and it seems quite exhilarating at the prospect....but it is safer and less addictive than gambling in casinos.

</comment><comment><USER15> > As Hoke notes, Aristocrat, Novomatic, and any other manufacturers whose > PRNGs have been cracked "would have to pull all the machines out of service > and put something else in, and they're not going to do that."

This just goes to show that despite the money the casinos are losing to this Russian group, they are still making so much money off the people _they_ are cheating that it's not worth fixing the problem.

Why our governments protect the jerks who steal money from the less intelligent members of our society is beyond me. That there are laws that support casinos is no justification. Casinos are themselves a scam and should not be protected against scammers at the expense of tax payers.

<comment><USER3> > Casinos are themselves a scam and should not be protected against scammers > at the expense of tax payers.

In Sweden casino gambling, and other types of gambling, is owned by the state. The state keeps the money from the gamblers. It is like an extra tax that people can choose by themselves. In Spain it is similar for Lottery, it moves a lot of money in Christmas and the state keeps the profits. Any country can achieve similar results applying high taxes to gambling.

I think that forbidding gambling is an error, as it just moves it to more unsafe locations and opens good business for criminal organizations. Standards that regulate gambling are a better solution, it reduces gambling addiction creating less attractive gambling games, it forbids to loan money to gamblers while they are playing (that is really important), and in general keeps gambling in check.

Disclaimer: I have worked in the gambling industry, and I will probably do it in the future.

</comment></comment><comment><USER46> "Casino is entertainment for which you pay a probabilistic fee proportionate to your spend". Ok, a bit of a stretch, I personally think. I honestly think that people gamble on things like slots because they don't have an educated sense of probability. I'm not sure the transaction is quite as clean as buying a cinema ticket and trading cash for entertainment.

"These guys were right to do it". I think the edge exists because it's ultimately illegal. I think it's tantamount to an illegal distribution of cash from a casino to a mob. Would it be any different if they hacked their bank account?

<comment><USER47> > I honestly think that people gamble on things like slots because they don't > have an educated sense of probability

I once became an investor on a BitCoin gambling site. The operator let you either gamble, the normal route, or invest and receive a share of the payout. He was extremely clear about the house edge.

I went into the chat room and asked people: why do you gamble if you know the odds are against you. The most canonical answer I received:

"Maybe I believe my luck has an edge on the house"

</comment></comment><comment><USER48> I wonder if there's enough variation in how people pull the handles and push the buttons that they could be used to partially re-seed the PRNG frequently enough that it the seed can't be determined by a video?

<comment><USER12> That's the technique Linux uses, it feeds keyboard and mouse timing events into one of its entropy pools. I can't see why they wouldn't do this for slot machines.

<comment><USER49> The article mentions newer slot machines, "whose PRNGs use encryption to protect mathematical secrets" \- so new machines are already considered secure.

      Aristocrat, Novomatic, and any other manufacturers whose PRNGs have
      been cracked "would have to pull all the machines out of service
      and put something else in, and they're not going to do that."

So they could be fixed, it's purely a financial decision.

      as long as older, compromised machines are still popular with customers,
      the smart financial move for casinos is to keep using them and accept
      the occasional loss to scammers.

<comment><USER50> Seems like using a radioactive decay RNG would also help, no?

<comment><USER51> sure, but are you gonna put a tiny bit of radioactive material in every slot machine? Not to forget that the RNG would have to be restocked if the material ever runs out

<comment><USER31> Pretty sure the half-life of most things that would be used is already longer than the MTBF of just about every other part a slot machine.

</comment></comment></comment></comment></comment></comment><comment><USER52> Since the title says "Can't Fix": Isn't it fixable by injecting some entropy into the PRNG for every roll like button press durations in nanoseconds, temperature, hardware quantum based, ...?

<comment><USER8> you'd have to do a hardware mod, and gaming is a regulated industry. so every mod you do has to be submitted to a state or nationwide gaming regulatory authority, takes months (at least) to get approval, and costs easily $100k.

Not to mention full regression testing on the statistics of the game. You would have to "re-prove" the validity of the RNG , which requires another QA cycle, statistical expert, and game designer (to ensure that the frequency and distribution of wins matches the specification sheet)

<comment><USER52> Button timing might be doable with a software change only. Doesn't solve the other testing procedures of course.

But what would be the difference with other casino software bugs then, are those also "Unfixable" then?

<comment><USER8> there aren't many other software bugs in casinos that affect the money. They're usually graphics-related or crashes, and they usually just restart the machine and write a bug report.

If they are related to money, they pull the machine out of the field until a new software version is fixed. A gaming company I used to work at had an issue with multi-jurisdictional machines that worked in Mexico but could display english or spanish. The machines could also change denomination, say from $0.05 to $0.25. There was some bug where if you reset the power, you could get it to bump your credits up from 20 nickels to 20 quarters (or might have been 20 pesos to 20 cents), it was something dramatic and easily exploitable that was fixed promptly.

</comment></comment></comment></comment><comment><USER53> Reminds me of the first chapter of Kevin Mitnick's 'The Art of Intrusion' [0]. The first chapter tells the story of (I believe) American programmers who reverse engineer the PRNG on a poker machine, so they could predict when the machine would deal the next royal flush.

[0] [https://www.amazon.com/Art-Intrusion-Exploits-Intruders- Dece...](https://www.amazon.com/Art-Intrusion-Exploits-Intruders- Deceivers/dp/0471782661)

</comment><comment><USER54> > A finger that lingers too long above a spin button may be a guard's only > clue that hackers in St. Petersburg are about to make another score.

Seems like this is easy for the scammers to work around. They could calculate the average time it takes for the scammer to lift his hand from his lap and press the button, and then use that time instead of .25 seconds. Would be less successful, but would seem to be almost impossible to detect.

</comment><comment><USER55> Kevin Mitnick wrote about a similar hack over a decade ago: [https://www.ethicalhacker.net/features/book- reviews/mitnick-...](https://www.ethicalhacker.net/features/book- reviews/mitnick-the-art-of-intrusion-ch-1-hacking-the-casinos-for-a-million- bucks)

I knew some of the people involved and actually saw some of the code if anyone's interested.

</comment><comment><USER56> Similar idea...

[https://en.wikipedia.org/wiki/Michael_Larson](https://en.wikipedia.org/wiki/Michael_Larson)

<comment><USER57> Great article and HN thread about this guy:

[https://news.ycombinator.com/item?id=9570713](https://news.ycombinator.com/item?id=9570713)

</comment></comment><comment><USER58> There is a fix and it is not crazy. The gist is they were able to brute force the PRNG of the machines and predict their future state. Hardware RNG is thr answer. In crypto it is obviously bad if someone can predict anything about your random values (keys / IVs). A hardware RNG, "cryptographically strong" RNG algorithms, and resetting the RNG very often make this problem go away.

<comment><USER59> The problem is that you cannot add a hardware random number generator to existing machines and the cost of buying a new machine is high enough that casinos do not want to do it.

If the scammers get too big the casinos will replace the compromised machines and the scam ends. The scammers seem to know this: they are targeting more an more casinos around the world in an apparent effort to make sure it is worth the risk.

Actually you don't need hardware random number generators. There is enough variance in human input to feed a cryptograhic random number generator. The code to add this probably wouldn't be that hard to write (they might be 8 bit CPUs or some such limit that makes it impossible though). However all code changes have to be certified by regulatory bodies (for good reason) which makes it not worth the effort to fix old machines.

<comment><USER58> That is fair enough. For older machines I have no idea what the answer is. I just mean designing this securely is not too hard. Hardware RNG is cheap, though. You are right though, these old machines do present a pickle.

</comment></comment></comment><comment><USER60> Curious how they screwed this one up - did they just have no proper random source? Nothing like modern operating systems use, like disk latency? If you're in the business of doing random numbers, you'd think you'd embed a cheap hardware based random number generator, even if it was extremely limited, just to seed a CSPRNG.

<comment> mark-r I'm guessing that proper hardware random sources, or the operating system entropy generators, are harder to verify by gaming commissions so they didn't get used. The article does mention that more modern software uses cryptographic generators that can't be predicted.

</comment></comment><comment> mark-r The title is a bit misleading (clickbait?) - the problem can certainly be fixed, and the article even goes into some of the ways. It just isn't cost- effective. Retiring the problematic machines would do it.

I wonder if they can change the amount of money you play for in those machines, so that it's no longer worth it to try to cheat them?

</comment><comment><USER61> It looks to me like a PRNG is fed once and never reseeded. That's the only way that simply observing the spin would tell about the outcome. In fact I'm surprised it doesn't just "produce" the outcome every time the button is hit simply from a few bytes of the prng.

<comment><USER57> As was said elsewhere in the thread: It seems that the organizer of this affair does not want his hired hands to figure out what's going on, telling them instead it's some computer magic they calculate real-time.

</comment></comment><comment><USER62> "Since code isn't prone to sudden fits of madness..."

Lol, I just can't stop laughing at that one.

</comment><comment><USER63> Why is it so difficult to create randomness? Input from microphone or even variations in electricity input should be more than enough, no? Why is it such a huge struggle, I don't understand, especially in machines that depend on the randomness.

<comment><USER64> Those would be random, but not necessarily uniformly random (an input from a mic in a casino is going to register very loud noises often).

<comment><USER57> Even so, how would one go about defeating such RNG?

<comment><USER65> Oh I get it! If you can't prove that it's predictably random then you can't prove the outcome (house advantage) and then the casino won't buy the machine. Am I right?

</comment></comment></comment></comment><comment><USER66> Really funny piece. It really feels like one of those Order vs Chaos battles, with Russians on the Order side. Guys found the order in randomness, I'd like to see the math behind their operational methodology. Also, why iPhone?

</comment><comment><USER67> After reading a bit about it, it seems very difficult (impossible?) to get a true random set of numbers. Anyboyd here on HN that has some insight? Are there interesting hardware or random-number-as-a-service things going on?

<comment><USER68> There are a lot of people who make hardware random number generators:

[https://en.wikipedia.org/wiki/Comparison_of_hardware_random_...](https://en.wikipedia.org/wiki/Comparison_of_hardware_random_number_generators)

</comment></comment><comment><USER69> It's still unclear how the organization broke the PRNG in the first place. Were they somehow able to get their hands on a machine for hardware analysis? Or did they just have their "operatives" play slots and capture video which they then manually analysed for patterns?

Offloading the computation to a remote server is a smart idea though. There is a lot of cool stuff happening in the game cheating space.

<comment><USER70> Yes they did. Says so in the article.

<comment><USER69> Ah, must have missed it.

</comment></comment></comment><comment><USER71> I like how the guys were described as "scammers" and "cheaters"; the same adjectives could be used to describe the casinos.

</comment><comment><USER72> I would think that having 2 PRNGs and then switching between them would ruin this strategy.

Obviously this would cost money for retrofitting, but all new slots could employ a new design, getting rid of this problem over a few years.

Not a perfect solution, but at least it's a medium to long-term fix.

<comment><USER73> They already have a fix (better PRNGs), they just don't want to pay to implement it.

"Use 2 PRNGs and switch between them somehow" sounds kinda like "roll your own encryption." This stuff is hard to get right, and iterating on quick-fixes without a deep understanding of the problem seems unlikely to do anything except introduce minor roadblocks for the attackers.

</comment></comment><comment><USER74> Abusing humans desire to pattern find and take risks for profit is bad. Casinos are bad. If you could weaponize gambling and spread it in an enemy nation, you'd do much to hurt it's GDP. I made a video about why gambling sucks.

</comment><comment><USER75> Anyone interested in how the gambling industry makes their billions mainly from slot machines, and how they engineer them to hijack people's dopamine systems should read Addiction by Design (MIT Press, 2012).

</comment><comment><USER76> I get that creating a genuine random number generator isn't easy, but surely this points out that it's something the slot machines should have rather than a PRNG?

</comment><comment><USER77> How does that encryption work? Is like those sha-256 circuits used in Bitcoin mining? Is it possible to modify the affected machines to allow encryption?

<comment><USER78> Yes, using SHA-256 you can create a cryptographically secure PRNG. See [https://en.wikipedia.org/wiki/Cryptographically_secure_pseud...](https://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_generator)

</comment></comment><comment><USER79> Not knowing much about video jamming, is it possible to block this hack by attacking the cameras?

<comment><USER69> I read a paper on such a technique a while back. The CMOS sensors in smartphones are very sensitive to a certain band of infrared. I think it would be possible to set up a system that automatically detects smartphone location and splashes its general area with infrared. With a good controller and motor setup, you could probably have a single jammer that can alternate between multiple phones.

<comment><USER80> And can be blocked with a small piece of infrared filter film.

<comment><USER69> It depends on the threat model I guess. Whether or not such a system would work in a casino environment, I don't know.

</comment></comment></comment></comment><comment><USER81> This is the sort of use case that initially got me excited about Google glass.

</comment><comment><USER82> I don't see why this is illegal, any more than counting cards in blackjack.

<comment><USER36> It's illegal because there's a law prohibiting the use of electronic devices to gain an advantage. If you could study the patterns offline sufficiently that you could use the same technique _without a device_ in the casino, it would be legal.

</comment></comment><comment><USER83> I don't understand why this is wrong/illegal.

<comment><USER8> because it's a threat to their business ?

<comment><USER83> I mean sure, the _business_ can kick them out, ban them, whatever, that's fine. I have no problem with that.

What I have a problem with is the implication that using public information to succeed at something without any malicious interference in its operation could be a _criminal_ matter.

</comment></comment></comment><comment><USER84> _Slot machine outcomes are controlled by programs called pseudorandom number generators that produce baffling results by design._

goddamnit wired. You're as bad as IT World. I don't know why I keep reading your trash.

<comment><USER85> They do an ok job of going on and explaining the limits of a PRNG. They're trying to target this to the broader market...

<comment><USER86> I generally agree, but "baffling results" is just plain stupid. Might as well start talking about internet "tubes".</comment></comment></comment>


Easiest way to receive files from Anyone - <AUTHOR> http://tips.populr.me/send-us-a-file

<comment><USER2> Much thanks for the Shout out to Populr.me! Crazy to think that YouSendIt is the defacto way that people send big files... I thought surely there were a lot of options, but not the case when I googled (drop.io had some cool traction until FB bought them and mothballed it)

Anyways, we launch in Oct so hopefully peeps will get some mileage out of this

<comment><USER3> Interestingly, you capitalize the same way as the person who submitted the link, and both you and the submitter are new accounts.

<comment><USER4> Hi, I'm one of the founders of populr. I know both of these men personally. Don't worry, they are not the same person. A quick google search can probably allay your fears.

</comment></comment></comment><comment><USER5> I thought the easiest way to was a post office address and let peole mail them to you, certainly safer.

I'm not also sure I would like to recieve files from anyone.

</comment><comment><USER6> Looks awesome. Would be great for file submission competitions.

<comment><USER7> Yes, this makes it dead simple. You can create a competition in less than a minute.

1\. Find a similar form template from JotForm gallery <http://www.jotform.com/form-templates/search/contest>

2\. Add an upload field and dropbox integration in it.

3\. Add the form code to Populr.me POP

</comment></comment><comment><USER8> This is pretty cool. Love the Dropbox integration!

</comment><comment><USER9> sweet</comment>


How to Name Your Open Source Project - <AUTHOR> https://forrestbrazeal.com/2016/05/13/flowchart-how-to-name-your-open-source-project/ <comment><USER2> "Backpfeifengesicht" is neither long, or weird, or hard to pronounce. Although I wouldn't recommend using it as a project's name. ;-)

I'm missing the state "doesn't return a gazillion false hits when googling". Come on, it's really not that hard to pick a mostly google unique name.

<comment><AUTHOR> I'm legitimately curious what your standards are for long, weird, hard to pronounce names.

False hits are definitely a huge issue. Google Go is the worst offender I know of in this regard.

<comment><USER2> I speak German so a complete ordinary[ _] German word doesn 't scare me. ;-)

Go was also a bad choice as there was already another programming language with the same name. IMO it was quite a dick move to claim that name.

[_] It's in the process of becoming outdated though</comment></comment></comment>


A Spellchecker Used to Be a Major Feat of Software Engineering - <AUTHOR> http://prog21.dadgum.com/29.html <comment><USER2> <http://www.norvig.com/spell-correct.html>

A simple Python based spell checker along with some discussion of probability and the pitfalls of doing things the naive way.

<comment><USER3> Norvig's code solves an even more difficult problem, spell _correcting_. But yeah, good read nonetheless.

</comment></comment><comment><USER4> I remember bloom filters (<http://en.wikipedia.org/wiki/Bloom_filter>) been good for this sort of thing.

<comment><USER5> Thanks for this link. Much more interesting than the article.

<comment><USER6> Definitely. I enjoy reading about these data structures/algorithms.

Seems a lot of these cool things came out in the 80s due to the limits of memory/computational speed.

</comment></comment></comment><comment><USER7> Looking up a word in a dictionary is only part of what a spellchecker does. The other part is offering suggestions. This one is still not easy, especially if you want it to give reasonable suggestions for all languages. For example, the algorithm vim 7.0 uses (based on tries) was first described in a research paper but was not implemented until Bram Moolenaar did it, because the implementation was hard.

</comment><comment><USER8> Random side note... justin.tv's spellcheck problem is a fun one... <http://www.justin.tv/problems/spellcheck>

</comment><comment><USER9> I don't get what the big deal is. As long as the document you're checking fits in RAM, then you can just sort the words alphabetically and then check them in a single pass through the dictionary. If you really need random access, use a B+ tree.

<comment><USER10> Where do you plan to store the dictionary for reference?

<comment><USER11> Gzip compression will achieve around 6x compression on a sorted wordlist. So even the 2008 wordlist of 240K words would reduce to about 400K. Cut the list in half or more, use a compression better suited for a sorted wordlist, and you could have a useful wordlist that would fit temporarily in RAM even in 256K machines.

<comment><USER12> Perhaps you should do a <http://de.wikipedia.org/wiki/Burrows-Wheeler- Transformation> first?

</comment></comment></comment></comment><comment><USER13> It still is I think. Nothing seems to compare to Google's spell check.

<comment><USER14> Yes, and in some situations, you can easily tap into googles spell check for you own automated needs.

</comment></comment><comment><USER15> It was just as trivial then, in decent languages, as it is now. Conversely, if you make your data set large enough (say, the whole web as a corpus, not /usr/share/dict/words), the same problem is just as hard today.

</comment><comment><USER5> Executive summary: "programming was harder when there was less abstraction".

I was hoping for a discussion of some algorithms, but instead I just got a long winded "wow, progress is amazing" rant.

This post has inspired me to start a new blog where I state the obvious and then submit it to every social news site. My first article will be "the sky is blue" except I will explain that in 1000 words or more. With ads.

<comment><USER16> now that you've given away the summary, i'm not going to read your post. and i was planning to click on lots of ads.</comment></comment>


An experiment in gratitude - <AUTHOR>

I don't know about you but most of my software projects would have been impossible without heavy reliance on open source software.
Over the years, every time I npm/brew/cpan installed a package, I also wished I could somehow thank its author/s.  The had just saved me days/weeks/months of work.  Of course, I never got around to it.
With the launch of my last project, I decided it was time for change.
I tracked down the authors of the packages that were critical to the project, sent them a nice thank you email and snail mailed them a box of craft chocolate as a token of my gratitude and appreciation.
The response has been so great that I am inspired to carry on.
So, I plan to send a box of chocolate to ~100 open source authors over the next year.  Roughly 2 authors / week.
I want a low key, yet tangible gift so I have chosen a "year of chocolate" boxes from Askinosie Chocolate [http://bit.ly/1HpQGrH].  Chocolate is informal and easy to share with others.  The folks at Askinosie are awesome in their own unique way. They share their profits back with the cocoa farmers and I figured their award winning craft chocolate would be a hit with most people.
I am aiming for lone/small team authors (eg petka / bluebirdjs) vs the more established projects that are already well recognized (eg react, backbone,… as awesome as they are).
Has there been a library that was critical to your project and you'd like to thank its author(s)?  Feel free to suggest ideas.  I will post my progress on HN every few weeks. <comment><USER2> Flattr and Gratipay work on this: repeatedly show support/gratitude to people (Gratipay is mostly oriented on software, Flattr is more broad).

[https://flattr.com](https://flattr.com)

[https://gratipay.com](https://gratipay.com)

Then there's Patreon, but I don't immediately see any software-related stuff there, mostly other creative things (videos/music/drawings etc).

\</comment><comment></comment><comment></comment><comment></comment><comment>----

EDIT: a few examples from Flattr:

NoScript: [https://flattr.com/thing/42724/NoScript](https://flattr.com/thing/42724/NoScript)

Open Street Map: [https://flattr.com/profile/openstreetmap](https://flattr.com/profile/openstreetmap)

EFF: [https://flattr.com/profile/EFF](https://flattr.com/profile/EFF)

AdBlock: [https://flattr.com/thing/118424/AdBlock-For- Chrome](https://flattr.com/thing/118424/AdBlock-For-Chrome)

WikiLeaks: [https://flattr.com/profile/WikiLeaks](https://flattr.com/profile/WikiLeaks)

<comment><AUTHOR> Thanks for the suggestions. I started contributing to gratipay recently.

</comment></comment><comment><USER3> I think the companies that profit on the back of all the OSS should give back too. They should donate respectable cash amounts for projects that are not already bankrolled and rely on people working in their spare time. Of course most companies wont. But it only takes a few to make a difference.

</comment><comment><USER4> The fine folks at Eldarion have saved me a lot of time with eldarion-ajax: [https://github.com/eldarion/eldarion- ajax](https://github.com/eldarion/eldarion-ajax)

Just use a few data attributes and you've got AJAX support in your web app.

Update: Not to mention all their work with the Pinax suite of Django packages: [https://github.com/pinax/](https://github.com/pinax/)

<comment><AUTHOR> Thanks for the suggestion. I will try to track the authors down and contact them.</comment></comment>


Perth's first ocean rubbish bin is sucking plenty of plastic out of the sea - <AUTHOR> https://www.abc.net.au/news/2019-02-17/perth-seabin-invention-sucking-cigarettes-and-plastic-from-ocean/10800792 <comment><USER2> Reminds me of Mr Trash Wheel in Baltimore's Inner Harbor [https://www.baltimorewaterfront.com/healthy-harbor/water- whe...](https://www.baltimorewaterfront.com/healthy-harbor/water-wheel/)</comment>


E-Mail Surveillance Renews Concerns in Congress (2009) - <AUTHOR> http://www.nytimes.com/2009/06/17/us/17nsa.html?pagewanted=all <comment><USER2> I think several "political analysts" on tv owe Snowden an apology for saying his claim of being able to read the President's email was grandiose, given this prior proof.

And just imagine what unsupervised contractors do.

</comment><comment><USER3> At today's hearing, Rep. Himes was focused on the risks of collecting the data _even assuming_ good processes and oversight for legitimate access. In response the NSA said that there hadn't been any examples of people ignoring processes and getting improper access. But here's at least one ...

</comment><comment><AUTHOR> To preempt confusion: the old title was

 _' NSA analyst "improperly accessed" Bill Clinton's email [2009]'_

That's what the early comments are replying to.

</comment><comment><USER4> I thought he only sent 2 emails, or did he have a separate personal email account?:

[http://www.salon.com/2011/02/17/bill_clinton_2_emails_presid...](http://www.salon.com/2011/02/17/bill_clinton_2_emails_president/)

<comment><USER5> This incident didn't occur during Clinton's presidency.

</comment></comment><comment><USER6> _Because each court order could single out hundreds or even thousands of phone numbers or e-mail addresses, the number of individual communications that were improperly collected could number in the millions, officials said._

Hey Google, Facebook at al, what say you?

</comment><comment><USER7> Hey Bill,

Here are the nuclear launch codes:

nhERB3kDBdg7vVSZ Q4MKgBcPkgS4MqtU fdsAbGzOnOf8d2Ep

Hope all goes well. Good luck with the free world. Say high to Hillary.

George

<comment><USER8> Wouldn't Bill be sending them to George?

<comment><USER9> We've had two George Bush's; but, I think the context suggested you're right.</comment></comment></comment>


Snowden reveals GCHQ spy programme with link to Scottish police - <AUTHOR> http://www.thenational.scot/news/us-whistleblower-snowden-reveals-gchq-spy-programme-with-secret-link-to-scottish-police.18661 <comment><USER2>
      Metadata includes who a surveillance target is calling,
      emailing, what websites they visit, and, when location
      data is available, a person's movements.

That an impressive definition of "metadata". To the defenders of these efforts i continue to point to the common trend among these agencies: expansion. First the definition of terrorist expanded without merit. Then the application of spy tracking data expanded similarly. Now metadata, the comfy term these agencies have used to limit public outcry, is expanding as well.

This is a frustrating time we live in. Far too few are taking the necessary steps to prevent this serial erosion of, what just some years ago, was common privacies and judicial rights.

<comment><USER3> Let's say you tear down the FVEY agencies. Enemy nations can then go rampant. If we collect, then it's obvious they must as well and they have less laws than we do limiting what we can do.

Having been on both sides, it is difficult to see the good they are doing, because they are shrouded in secrecy due to necessity.

<comment><USER4> Indeed. It's true to say that there would have been a lot more terrorist attacks, and more serious organised crime, were our security services not using the bulk surveillance data sets for their analyses.

Of course, none of the details can be revealed for operational reasons, so the more paranoid fill in the blanks with 1984-style dystopian fantasy. It's unfortunate, as they really are doing good work.

<comment><USER5> "It's true to say that there would have been a lot more terrorist attacks"

Why is it true to say? I doubt there would have been more terrorist attacks. They definitely would have mentioned at least one such planned attack that was stopped as it is in their best interest to change public perception.

[https://theintercept.com/2015/11/17/u-s-mass-surveillance- ha...](https://theintercept.com/2015/11/17/u-s-mass-surveillance-has-no- record-of-thwarting-large-terror-attacks-regardless-of-snowden-leaks/)

<comment><USER6> Would they? Acknowledging attacks could give clue to operations in play. They're certainly not going to risk sources and or collection that's proven valuable. And to be fair there have been a good amount of publicly acknowledged plot disruptions.

[http://www.foxnews.com/story/2007/09/05/german-police- arrest...](http://www.foxnews.com/story/2007/09/05/german-police-arrest-3-in- plot-to-attack-americans.html)

[https://en.wikipedia.org/wiki/List_of_unsuccessful_terrorist...](https://en.wikipedia.org/wiki/List_of_unsuccessful_terrorist_plots_in_the_United_States_post-9/11)

<comment><USER5> Except for this German one, I haven't found another story on that Wiki page that wasn't clearly some other source.

<comment><USER6> Except you can't prove that. Are they going to directly say, Satelite XYZ in geostationary orbit was monitoring data link 111322, during which we captured intelligence on platform 2342342 which resulted in a lead then passed on to domestic intelligence agencies. Nope, not going to happen. Everyone here likes to talk about the government and their parallel construction when it supports a negative notion, yet forget that it's also a legitimate tool to protect origination sources.

<comment><USER7> There is no need to prove someone's claim false, they must prove it true.

eg: Except that the government has claimed that they have foiled attacks and those claims have been shown to be bullshit.

So, given that they have made these claims and they are false, what conclusions should we draw?

A. The government gave us false information to reassure us that their blanket information gathering programs work, they cant tell us operational details or made some other mistake(even though operation details of various programs leak like a sieve.)

B. Their argument is specious, and someone made a list to prop up a program they do not have evidence for.

<comment><USER8> Should by your own logic of There is no need to prove someone's claim false, they must prove it true." apply to their comment to?

Just trying to understand as Point A and B lack the same evidence.

<comment><USER7> All claims need evidence to support them, its just that the poster said that the government is doing great work, too bad we cant show or prove that they are(citation needed, big time.)

There is no need to argue for balance in the discussion to protect our government, they clearly can operate these programs without our approval or understanding.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> One of the more concerning matters on this is that the BBC, for some reason, are choosing not to report on this at all. Gone are the days when the BBC were the most trusted and reputable news source. [http://www.bbc.com/news/scotland](http://www.bbc.com/news/scotland)

<comment><USER10> Meh. Its not clear to me this is news - its secondary reporting about an Intercept article that doesn't appear on the intercept front page nor on any other Scottish newspaper.

<comment><USER11> And it's not even the main theme of the Intercept article, which focuses far more on the intelligence agencies collecting far more data than they actually had the capability to use and failing to read harvested emails of identified suspects. [https://theintercept.com/2016/06/07/mi5-gchq-digint- surveill...](https://theintercept.com/2016/06/07/mi5-gchq-digint-surveillance- data-deluge/)

</comment></comment></comment><comment><USER12> > _... and more serious organised crime, were our security services not using > the bulk surveillance data ..._

In the unlikely case these aren't pranks, they would almost certainly be GCHQ astroturfing accounts. Of course, the astroturfing itself is of so poor quality that they probably outsourced the job to either some apathetic social media/perception management firm, or clueless interns.

I could easily see a social engagement platform that's primarily used to spam Disqus comment sections also having support for HN, just for the sake of ticking the box.

<comment><USER4> Anyone who disagrees with you must either be joking or astroturfing? How impolite.

<comment><USER12> > _Anyone who disagrees with you must either be joking or astroturfing? How > impolite._

More like anyone who creates two fresh accounts within minutes of each other, one replying to the other in agreement—is either astroturfing, or trying to make it appear as if they are.

Personally, I think you're just a decent troll. If so, at least it was creative.

<comment><USER4> There was nothing trollish at all in my earlier comment - you just wish not to believe it.

<comment><USER12> > _There was nothing trollish at all in my earlier comment - you just wish not > to believe it._

You're correct in that I do not wish to believe that astroturfing either directly or indirectly commissioned by GCHQ could be so incompetent. It sullies their good name.

Granted, what you're doing would actually qualify as somewhat competent if the goal was to simply to derail meaningful discourse.

<comment><USER4> All these accusations of trolling and astroturfing are completely off topic. If anyone is trying to derail the discussion here, it's you.

<comment><USER8> it seems like a lot of people here are in a feedback loop, only upvoting / listening to what they think fits. Everyone's quick to believe they know it all, when in fact that is the very issue the arguments are about.

I get why you used a throw away. I'm not against civil discussions, I just hate when people don't use logic and take all evidence with a grain of salt. I don't for a second doubt parts of the govt. are hiding valid evidence for the conversation any more than the media is lying to sell their narrative too. Bottom line is the media has the upperhand, they can make baseless claims and choose what to say knowing damn well that the Govt. can't refute it.

<comment><USER12> There's nothing wrong with throwaway accounts or opposing views; both are perfectly welcome.

What's problematic is when there's two throwaway accounts created at the same time, replying to one another in agreement, using the same writing style, and advancing same the narrative that's worded as if it's straight out of a public relations office.

HN has seen at least one NSA employee and one American intelligence community member posting in the wake of Snowden, and both were overwhelmingly treated with respect by the community despite their views. I myself often express views here that are staunchly anti-Snowden in nature.

The throwaway accounts you're defending received such hostility because they were perceived as being insincere due to their suspicious posting behavior. It was not due to their views or opinions.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> It would have been interesting if this had come out before the Indyref. What _did_ happen to Willy McRae, anyway?</comment>


5G Network Architecture – A High-Level Perspective [pdf] - <AUTHOR> https://www.huawei.com/minisite/hwmbbf16/insights/5G-Nework-Architecture-Whitepaper-en.pdf <comment><USER2> I just skimmed this, but it seems to be yet another marketing piece covered in technical jargon to tell a "world changing" story. It does not, however, say anything about 5G coverage differences from 4G, how the physical infrastructure is deployed or it's practicality to coverage and usability by the end devices that are the underlining support to this revolution.

<comment><USER3> I see there any doc/ site / book which you have seen that covers 5G properly?

<comment><USER2> So far, no. Though, I haven't made much of an effort to seek it out. I help run an ISP with a WISP department, so we get to play with RF from 600 MHz to 84 GHz a lot. I have yet to see any "tech" article stop the bullshit and reference the obvious: MM wave doesn't penetrate thick rain at any sort of distance let alone buildings. It's also not very good at multiple client handling as to keep the bandwidth they're touting, you need a lot of dedicated spectrum per client.

I haven't seen anything to address this point. Which means they're doing the same shit cable companies do with the whole "up to" crap. Sure, it'll do gig... if you're standing directly under the AP nested in some light post or telephone pole (OMG, "smart" street lamps?? Our city is so progressive!), in plain site of the thing and be the only one there.

Personally, and like I said, I don't seek out documentation to be proven wrong here; but I see 5G's _real_ revolution to be the secret sauce to the OneWeb or Starlink satellite ambitions; or at least I hope it to be.

Anyhow, as you can tell, I'm a little edgy with all this 5G stuff. All the bullshit about it is spreading false information to people who need/have to be factually educated. Lots of rural areas passing up broadband plans that are real for the promise of "smart" 5G street lights and all the "coolness" it gives politicians come re-elections. Meanwhile, the solution isn't real, broadband stays monopolistic and progress stagnates.

There's a lot to 5G on the software side I'm intentionally not mentioning here. But, that's not the part of 5G people are salivating over.

<comment><USER4> > OMG, "smart" street lamps?? Our city is so progressive!

Already got them, kinda. They are radio controlled which allow for them to be for granular controlled to reduce power usage and thus money.

It's all good until the system fails and almost everyone is left without any street light (the main road still we're lit as they were on a different profile or something but all the other streets were in darkness until around midnight. I've only noticed the single failure in the years it has been running though)

<comment><USER2> I'm specifically referencing street lamps that are being prototyped and shown off at conferences with embedded 5G RF chips in them.

Anything to aid in power conservation is something I'd go for and not mock. Maybe needs some improvement as you mention, but not an idea I'd treat so harshly as above. Haha.

<comment><USER4> Oh I know. I was just having a giggle about "smart all the things".

The radio control street lights have mainly been a success. As I say only one failure in my area that I know of but when they do fail, it fails spectacularly.</comment></comment></comment></comment></comment></comment>


Linode under DDoS - <AUTHOR> http://status.linode.com/ <comment><AUTHOR> 3 data centres are reported to have degraded performance + impact on DNS, Linode manager and API.

</comment><comment><USER2> My London linode has been down for almost 4hrs now.

There was a problem ten days ago too.

</comment><comment><USER3> Second DDoS within two days.</comment>


How many of you would use a digital library? - <AUTHOR>

I mean a true digital library that has non-public works that haven't been expired yet. I've been working out a legal contraption in my mind combined with some locative ideas, and I might have some ideas for working it out. Anyway, this would be an ad supported venture.
I'm not certain how I'd make the media accessible, I definitely don't want a scribd situation, and I want to leave the option of downloading for use on PDAs and other devices.
I guess my question is...should I bother? I came up the idea out of pure frustration in trying to find a Gore Vidal novel I wanted on the internet. Now I'm getting a damn library card tomorrow (today technically).
If you would make use of this, how frequently would you do so? <comment><USER2> That would depend on the way it was set up... In my view, it would require a few specific ingredients:

1\. Standard formats (PDF, txt, html, etc... heck... even chm e djvu)

2\. Offline access (PDA, laptops, etc...)

3\. Printing

4\. Sharing (iTunes like)

5\. Easy searching within a given volume and across volumes (google books)

Of course doing all of this while preventing rampant copyright violations is the tricky part. O'Reilly doesn't seem to be doing too well (on the copyright part at least) with their safari online project. You can pretty much find any of their books you want if you know where to look. Apple seems to be doing a good job with iTunes. Maybe it's time to have someone doing the same for books. There are several websites online that try to do this, but the legality of the works they have is ofter fuzzy. I've been tinkering with the idea of making a "del.icio.us" or "arXiv" type of site where people could place links to books (mostly technical) that are currently out of copyright. Wherever possible, links to online bookstores where you could buy the book would also be provided.

<comment><USER3> It would be possible to clearly watermark a PDF file with the serial number of the person who checked it out of the library. That way if it is leaked it shouldn't be too difficult to find the person who leaked it.

I would definitely use such a library if it existed, provided that it wasn't too expensive and had novels or books I could not find at my local (and free) public library.

<comment><USER2> I'm guessing that it would also not be too hard to remove the watermark... just like people did with iTunes. On the other hand, that doesn't seem to have hindered Apple's revenue stream.

</comment></comment></comment><comment><USER4> It's an interesting idea, but I don't think any significant number of people want to do general reading on computer screens.

This is why there's a market for i-ink style screens.

You might get some traction if you provided a service that easily integrated with the ebook readers already out there (sony/kindle) and provide for people to "buy" them with deep discounts and a monthly subscription (like cell phones), or rent them for even less.

For heavy-readers $50/mo for netflix style "borrowing" of books over the internet plus an ebook reader may well be worth it.

<comment><AUTHOR> I'm not certain how I want to do it yet, as far as payment or lack thereof goes. I definitely want to provide for ebook readers.

Personally I do tons of reading on my (blurry :( ) CRT screen, so I've never had much issue with that.

</comment></comment><comment><USER5> I (like many here I guess), already have this, at least as far as technical books are concerned - it's called Safari Books. That coupled with an iPhone means that you have a massive collection of technical works in your pocket all of the time. It's brilliant. I finally have a solution for what to do when I'm at a party and I need to know the correct grammar for K&R style C.

It would be nice to have the same service for non-technical books. Amazon's Kindle service is not bad, but it's not really a library, you have to purchase each book...

</comment><comment><USER6> I would give a lot for something like Google Books, but with a possibility of subscription, not buying from Amazon or some publisher. Don't think it's legally possible though...

<comment><AUTHOR> I'm a law geek as a secondary to my computer geekery, I'm thinking of ideas. :)

</comment></comment><comment><USER7> How would your service differ from Scribd?

<comment><AUTHOR> It would actually have all the books a standard library would have.

Like Gore Vidal.

</comment></comment><comment><USER8> Why not post a poll - Yes/No/Unsure?</comment>


House GOP refuses to renew election security funding - <AUTHOR> https://www.washingtonpost.com/business/economy/house-gop-refuses-to-renew-election-security-funding-as-democrats-fume-over-russian-meddling/2018/07/18/20761f88-8abb-11e8-8aea-86e88ae760d8_story.html <comment><USER2> Per the article, almost $4 _billion_ has been spent on this already. How about an accounting for what progressed from that spending?</comment>


Ask HN: Technologies to create a brand new JavaScript application? - <AUTHOR> I am an experienced Java developer and want to get into JavaScript development by writing a brand new application.
My current understanding is that I can use NodeJS with ExpressJS on the backend and use ReactJS on the frontend.
Please let me know if I am on right track. Also, please suggest some good book or blog for these topics. <comment><USER2> That'll work fine. There are many different approaches to javascript apps. You can go angular, react, ember, etc on the front end, then node, ruby, python, php, java, javascript, etc on the backend. All will work fine in 90% of cases. People have their preferences for which has the best organization, speed, documentation and whatnot, but the most important thing is that you use one that you want to be using, so that you remain excited enough to learn them. My suggestion is to do a RESTfull backend, so that you get started out using a good interface between your back and front ends. Have fun!

</comment><comment><USER3> In the backend, I would personally recommend to indeed go with ExpressJS over KoaJS, the "callback-less" successor to Express. I tried working with koa, but error handling is an absolute mess when using generators.

</comment><comment><USER4> May I suggest Meteor JS [https://www.meteor.com/](https://www.meteor.com/)

It is powered by NodeJS but abstracts it away.

MeteorJS gets you up and running fairly quickly. Deployment isn't too complicated using Meteor Up (MUP). That being said, I have not built a MeteorJS app that has scaled to millions of users - only smaller webapps.

Good luck and have fun with it ^_^

</comment><comment><USER5> i enjoyed this [https://github.com/banderson/generator-flux- react](https://github.com/banderson/generator-flux-react)</comment>


Anti-stress browser game for positive feelings and pleasant relaxation - <AUTHOR> http://blocks.ovh/?startit <comment><AUTHOR> BLOCKS, a minimalist browser-based puzzle. Hope you like.

</comment><comment><USER2> Neat stuff! Fast loading, and calming. Great work.</comment>