Decentralized Naming and Certificate Authority - <AUTHOR> https://handshake.org/ <comment><USER2> I know the handshake devs/maintainers are active on here. I've heard explanations from y'all about how handshake tries to solve the squatter problem. As far as I understand those explanations:

\- Names are released at a trickle, meaning no one can buy all of them in one go.

\- Names have to be constantly renewed (it's not a buy-once-keep-forever scheme), and (correct me if I'm wrong), you can't buy 10 years out in advance.

\- A large portion of the initial names are reserved for Open Source developers, under the assumption that squatting won't be so much of a problem if they get first pick.

It's still not clear to me how this solves resource scarcity.

\- If names are released at a trickle, does this mean I might want to register a domain for a project and there literally won't be any able available for me to choose from?

\- If names have to be renewed on a year-by-year basis, is there any mechanism for archival? Won't this be strictly worse for link rot?

\- If names are released at a trickle, doesn't this create an even greater incentive for both good and bad actors to grab them as soon as they become available?

I'm mildly interested in Handshake because based on very limited research it seems in general to be an improvement over what we have. I get that perfect is the enemy of the good, I would take almost any improvement over the existing system. But at the same time, I still just don't understand how this helps solve the squatter problem -- every once and a while I ask and get an explanation, and then think about it for a while and end up having more questions.

My perspective is, we want everyone to be online. We want everyone to have their own blog, we want people to be able to create websites on impulse. And we want resilient, long-term links that can serve as permanent addresses for content. The idea of combating squatters is based on the assumption that domain names will continue to be a scarce resource. But you fundamentally _can 't_ have domains be a limited resource that are difficult to hoard if you also want random/poor elementary school kids to be able to buy them.

Handshake talks about solving Zooko's triangle: human-meaningful, decentralized, or secure. But the way I originally heard Zooko's triangle explained to me (which may have been wrong) was: human-meaningful, secure, high-availability. Am I correct in assuming that in the second version, Handshake is optimized for human-meaningful and secure at the expense of high- availability? That domains will continue to be a limited, scarce resource that are susceptible to hoarding by people with lots of money? Or are there other mechanisms here that I don't understand?

<comment><USER3> \- Names are released over the course of 52 weeks. Determined by hash(name) % 52. So at worst the name you want to register will not be available until ~51 weeks from now (Handshake launched last week!). \- Names have to be renewed bi-annually. You don't need to pay a fee, you just need to submit a transaction to prove you still have access to the private key. I don't think this will be any different than the existing DNS in terms of link rot. \- I think the main thing names being released over time does is it allows for more people to find out about Handshake and start competing for the good names before they're gone. In an ideal world, everyone would know about Handshake at the same time, and so any name that is registered has the maximum competition for it. That world is not feasible but we can get closer to it by releasing names over time. \- I've only heard Zooko's triangle described in the first way, which matches the wikipedia article on it [https://en.wikipedia.org/wiki/Zooko%27s_triangle](https://en.wikipedia.org/wiki/Zooko%27s_triangle)

Disclaimer: I'm the ceo of Namebase.io, we built a registrar for Handshake domains and exchange for Handshake coins (HNS), so I'm pretty bullish on Handshake.

<comment><USER2> If I'm understanding you, the 52 week release is a one time thing, not a continual thing? So it's not that names will be continually trickle-released it's that for the next 52 (51) weeks, they'll be trickle-released, and then everything will be out there and this will work just like normal domain registration? I was under the impression that the trickle release was just how registration would work in general.

That doesn't seem to me at first glance like it's going to be that much of an improvement over squatting, but again, I get that there are multiple goals here worth accomplishing. And it is a much simpler system than needing to go into a queue to register a domain.

Just to make sure I understand -- am I correct in saying that Handshake is not designed to solve domain name scarcity, more to decentralize it so that an organization like ICANN can't rent-seek on top of that scarcity?

<comment><USER4> Additionally to combat squatting, to register a name, one needs to go thru a Vickrey auction and bid on a name after it is released. Bidding continues for about 5 days thereafter and there are 10 days to reveal the bids.

The winner pays the second highest bid.

<comment><USER2> Wait, what?

That seems like it could have a _lot_ of unintended consequences, to the point of invalidating all of the benefits from having tons and tons of new names. I have a lot of follow questions about the potential for abuse.

From the squatter/troll angle: if I'm a troll or I'm trying to steal good names before anyone else can get them, what stops me from monitoring the current auctions and stealing domains by bidding above the statistically most likely market price for that domain? Users have to _guess_ in advance how much a domain will cost?

From the decentralized, anti-corporate angle: if I'm Comcast, what stops me from monitoring the current auctions, and blocking anyone who tries to register any variant of `comcastsucks`? With the current system, that's prohibitively expensive since there are tons of variations that I'd need to preemptively register. With the system you're describing, it costs me nothing until someone tries to register a domain that triggers my Regex, and then I just outbid them and block any domain that criticizes me, because as a company I'll always be able to trivially and safely outbid any single person.

From a general user angle: does this mean I have to wait 5 days to register a new domain? With the current system, I can set up a brand new website in a single evening, and all I need to do is find a name that isn't taken yet -- I don't have to worry someone else will see what I'm doing and snipe my purchase. With the system you're describing, I have to wait 5 days to discover whether or not I'm actually going to be able to buy the domain I want at all, and if I don't get it, then I need to repeat the entire process?

I have so many questions about this system now. There _has_ to be something you're leaving out here. I can't imagine using a DNS registrar that made me wait 5 days to discover whether or not I got to have the domain, or that made me guess how much it would cost at the risk of losing the entire domain. If there aren't other details you're leaving out, that's a strictly worse system than what we have right now.

<comment><USER3> The auctions are semi-blind. You bid, and can optionally add a blind to your bid. The network sees your combined total bid + blind, but won't know your true bid value until the reveal period. So if you want to guarantee you win an auction, just make sure your bid is greater than the highest existing total.

<comment><USER2> > if you want to guarantee you win an auction, just make sure your bid is > greater than the highest existing total.

How do I do that if other people's bids can contain blinds? How do I know what the highest existing total is -- I still have to guess everyone else's total, right?

And even if the auction wasn't partially sealed, even if it was completely public -- I don't see how my concerns above would go away. Isn't it still possible for companies who can trivially outspend anyone else to do regex matches on all of the current auctions and dominate the entire domain space? Don't I still need to wait 5 days to do something that I can do today in less than an hour?

Learning about auctions pretty much entirely, just by itself, took me from thinking, "it's not perfect, but it still seems almost universally better than what we have" to, "no, this would be a massive downgrade from our current system." I thought the point was to stop rent-seeking, not to implicitly allow every fortune 500 company and government to personally vet/block every single domain transaction.

The auction system being described here doesn't just focus on other problems other than name scarcity, it makes the name scarcity problem _way worse_. If I'm China and I want to censor this system, what stops me from monitoring the auctions and throwing a measly $2000 at any domain name that sounds critical of me in any way? What's the point of having a distributed or decentralized protocol in that scenario?

<comment><USER5> > How do I do that if other people's bids can contain blinds?

You're right, you can't. I'm not sure what "just make sure your bid is greater than the highest existing total" means when blinds are in the mix.

> If I'm China and I want to censor this system, what stops me from monitoring > the auctions and throwing a measly $2000 at any domain name that sounds > critical of me in any way?

Nothing, but there are quite a few(TM) domain names. Everything that isn't an ICANN TLD (or a future ICANN TLD, I guess--not sure how that would work) is available. I don't think a government could reliably censor all objectionable TLD's.

Furthermore, once you own a Handshake TLD, you become the registrar for that TLD. So every subdomain is yours to sell, no auction necessary. So as long as someone purchases some simple TLD and is willing to sell you some relevant subdomain, you're good. It's not really necessary to have censorthis/; you can just buy censorthis.sometld. Of course, then you do depend on the owner of sometld as a registrar, but that's not very significant given the space of TLD's available. It wouldn't be difficult to find a new registrar if something happened.

<comment><USER2> > Nothing, but there are quite a few(TM) domain names. Everything that isn't > an ICANN TLD (or a future ICANN TLD, I guess--not sure how that would work) > is available. I don't think a government could reliably censor all > objectionable TLD's.

If I understand correctly (and maybe I don't), the domain being auctioned is public. With the current system, a government can't censor everything because doing so would require them to pre-emptively grab the entire space, which is economically infeasible. With public auctions, my understanding is they only need to pay attention to the domains someone actually tries to register. So if I'm China, I don't need to preemptively register the entire space of `/tiananmen/g`. I only need to download the list of auctions every day and run a regex on that finite space.

Of course, they can't restrict subdomains, so maybe that allows people to sneak stealth TLDs through without getting censored. But (see below) it seems like actually owning TLDs is _really important_ , so I still need to navigate a space where every troll and every government and every fortune 500 company is given the opportunity to snipe every TLD I want, and it seems like that's at least an opportunity for wild price increases on TLDs.

> Of course, then you do depend on the owner of sometld as a registrar, but > that's not very significant given the space of TLD's available. It wouldn't > be difficult to find a new registrar if something happened.

Can you expand on this?

Right now, if I lose a .com domain, I can find a new registrar and set up a different domain. But all of the links to my current domain will be broken, and if I'm using that domain for email I'll have lost control of all the emails being sent there, and I'll basically be starting over from scratch.

Part of the reason I've avoided "novelty" TLDs like `.tech`, `.party`, `.amazon`, etc... in the current system is because many of them are completely privatized. The owners of those TLDs can raise prices however they want, and can kick anyone off for any reason. And if I'm tying my entire business or (even worse) my entire online identity to one of those domains, that would catastrophic.

If a registrar behind a top level Handshake domain goes bad, is there a mechanism where I can switch registrars and keep myself as a subdomain of the original TLD? If not, won't I be in the same position?

The thing that's attractive to me about Handshake is owning TLDs -- being able to own something that can't be arbitrarily taken away from me by a centralized authority. Otherwise I haven't gained anything as a user over the current system, I've just lost any regulatory price caps that might exist.

\----

I guess I can register an innocuous TLD like `danshumway`, hope the trolls don't notice and outbid me, and then use it as a private TLD I control. Realistically, to preserve privacy and avoid linking everything I do together under a single identity, I'll likely want at least 4 or 5 TLDs, possibly more. I don't think I'm atypical there. Anyone who's using a domain for their email or an identity server will want to own that TLD. Is the system designed to scale to that?

Direct question to the people behind Handshake: what do you expect the average cost of a generic 2-3 word TLD to be? A while ago I registered the domain `animalsareignorant.com` for a personal art project I'm still working on. It costs $10 a year. Are we expecting a TLD like `animalsareignorant` to cost $100? $1000? A million? I assume you've done market research on this and you're not just jumping in blind.

This isn't a theoretical question. When (at this point, if) I ever start using Handshake, at some point I'm going to register a TLD and you're going to ask me how much I want to bid for that domain. So if you expect people like me to be able to guess on the spot what the market value of a TLD is, you need to be able to point to some kind of measure that will keep that guess from being a purely blind shot in the dark.

<comment><USER6> > With public auctions, my understanding is they only need to pay attention to > the domains someone actually tries to register. So if I'm China, I don't > need to preemptively register the entire space of `/tiananmen/g`. I only > need to download the list of auctions every day and run a regex on that > finite space.

Sure, but since it doesn't cost anything to lose a bid (I believe?) if anyone tried that it'd be pretty easy to force them to spend a _lot_ of money buying domains that they have no intention of using. It also wouldn't stop anyone from registering `tiananmen.massacre`, as you noted.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> > mail became Gmail, usenet became reddit, blog replies became facebook and > Medium, pingbacks became twitter, squid became Cloudflare, even gnutella > became The Pirate Bay. Centralization exists because there is a need to > manage spam, griefing, and sockpuppet/sybil attacks.

No, centralization exists because users don't care about the protocol. Users care about the brand.

It's way easier to use FB than it is to say "choose your hosting provider. Each one has a slightly different set of features. Then link with other people you care about, all of whom may be using different providers that you need to pay special attention to." With FB, I click "send a friend request" and then move on with my day. And that's just one example.

<comment><USER8> > No, centralization exists because users don't care about the protocol. Users > care about the brand.

Brand is a proxy for the level of functionality delivered by that brand.

People didn't switch to GMail because it was a "cool" brand, they switched because the spam filtering worked, Google gives you a ton of free space (a problem at the time), and it didn't have obtrusive banner ads. This was passed on by word of mouth, and now GMail is popular.

> It's way easier to use FB than it is to say "choose your hosting provider. > Each one has a slightly different set of features. Then link with other > people you care about, all of whom may be using different providers that you > need to pay special attention to." With FB, I click "send a friend request" > and then move on with my day. And that's just one example.

Exactly my point, the UX is better and the network effect ensures that many/most of your friends are already there. It's not about branding, it's about ease of use.

<comment><USER9> > People didn't switch to GMail because it was a "cool" brand

In the early days of gmail when you needed an invite code, it _definitely_ was a status symbol to have that @gmail.com on your email address.

And at the time, the actual functionality of gmail was far less significant than the fact it was free and decoupled from your internet provider, although you're right the storage capacity on a free email was unheard of at the time.

<comment><USER10> > And at the time, the actual functionality of gmail was far less significant > than the fact it was free and decoupled from your internet provider

If that was the real draw, then people would have just stuck with Hotmail, Yahoo, and the dozen other e-mail providers.

<comment><USER11> Hotmail and to a lesser extent Yahoo were perceived as toxic, due to spam mostly. There is still a website I frequent which requests customers email to be 'preferably not a @hotmail.com address'. All the other email providers were either restricted (companies, universities, clubs/guilds etc.), poorly run, or tied you to fees (ISP provided, paid email providers, AOL).

</comment></comment></comment></comment></comment><comment><USER3> Shameless plug - if anyone wants to try using Handshake, we built a registrar for Handshake domains and an exchange for Handshake coins (HNS) at [https://namebase.io](https://namebase.io). We just launched last week but there's already been a lot of usage so it'll be interesting to see what people do with their Handshake domains when they become available.

</comment><comment><USER12> Went through the FAQ's, but still didn't understood much about how this is supposed to work alongside ICANN/current DNS system. Well, I didn't got Bitcoin the first 2 times either.

1\. "Browsing the web with human readable names is what Internet users have gotten acclimated to." => give me an example of a "handshake" domain name in this case

2\. I have some domains/sites not so popular (not in the first 100k Alexa domains). I will only hear about "Handshake" in 5 years time when Handshake completely replaced what we are using today, by which time, someone else might have "registered my domain names". What do I do? Obviously I can prove I own my .com/.net.

To site failed to answer some basic questions/concerns or give some real world use case scenarios.

<comment><USER13> > I have some domains/sites not so popular (not in the first 100k Alexa > domains). I will only hear about "Handshake" in 5 years time when Handshake > completely replaced what we are using today, by which time, someone else > might have "registered my domain names". What do I do? Obviously I can prove > I own my .com/.net.

This is one part that Handshake does not explain very well. The existing domains and tlds that icann owns will continue to work moving forward. The top 100k Alexa domains bit works like this:

For the top 100k alexa domains, the owner receives the root of the domain as a domain in Handshake (ex: the owner of `example.com` receives the domain `example` in Handshake). All `*.com`, etc domains continue to operate as they have in the past.

<comment><USER14> What happens if someone gets "amazing/" and then I pay icann to get .amazing?

</comment></comment></comment><comment><USER15> Decentralized systems generally have pretty complicated governance models and technology to support them, making it easy to get lost in the details. I've found when trying to assess things like this it's best to find a critical question and find out the details of the answer. For the case of decentralized naming, one interesting question tends to be "What happens when someone registers cocacola.com?"

Usually the answer to that question reveals whether the system is A) not in fact decentralized, or B) not compatible with laws in most jurisdictions.

Anyway, not necessarily a specific critique of this system since I don't know the answer to the question in this case. More just a useful framework I've found to assess distributed systems without getting mired in execution details.

<comment><USER3> All the existing TLDs like .com and .net are blacklisted so that only the TLD owners can register them. The claiming process for blacklisted TLDs uses DNSSEC so there are no third parties involved in the process. In addition, the top 100k Alexa domains are pre-registered so that only the domain owners can register those domains as TLDs (only google.com can register .google). That is done through DNSSEC as well.

<comment><USER16> This is useful info and should really, really be in the FAQ. Like, right at the top, because I don't think it's clear right now at all what happens to regular domain holders using them for email, their own services, intranets and so forth. If those in the current registrar system have a _reliable_ path to transition/try it out at some point that's a good start.

Edit to add: your namebase.io FAQ seems a lot more useful than the handshake one. For starters it clarifies that there is a confusing terminology difference, where I guess the handshake people are using "domain" to mean "TLD" and "subdomain" to refer to what everyone typically calls a domain. So a core offering of this system appears to be a blockchain based replacement to the $150k+ (or whatever it is these days) "get your own arbitrary TLD" thing ICANN did, "anyone" gets to register their own TLD. But that raises more questions, like where the actual hardware behind all this goes particularly for existing TLDs which are blacklisted.

<comment><USER17> > This is useful info and should really, really be in the FAQ. Like, right at > the top, because I don't think it's clear right now at all what happens to > regular domain holders using them for email, their own services, intranets > and so forth. If those in the current registrar system have a reliable path > to transition/try it out at some point that's a good start.

Seconding this. I did not pick up on that at all.

</comment></comment></comment></comment><comment><USER18> Seeing how Internet 1.0 is getting cannibalized by big business and governments, I'm hoping to see HS and other orgs start working on an offline mesh network and devise a completely new system of information distribution.

Humanity appears to be changing the public park infrastructure of the Internet into a paid-access theme park, with [them/someone else] writing the rules. It doesn't look like the righteous, tech illiterates, political manipulators or shareholder driven groups are going to relent.

The Internet used to be filled with raw data, but in the age of centralized, walled garden curating, the essence of the information superhighway has been lost.

It would be cool if they could pioneer a new way to replicate data in the age of autonomous vehicles or use the Internet to transfer volumes of data for offline nodes to broadcast and reimagine DNS and the other fundamental tools to make something like that resilient.

If they could remove most/all of the ads, marketing, monetization and censorship from the data, we might see another generation experience the raw data bliss many of use were raised on in the pre-dot.com era.

It was truly something special and felt like the world (of knowledge) was at your fingertips (instead of something slimey on the other end).

</comment><comment><USER3> PSA if you had over 15 followers on GitHub by August 2018 you were likely included in the Handshake airdrop. Basically they developed a way to give each dev in the airdrop 4662 coins each (worth a lot since current market price is $0.50[1]). These instructions walk through what the claiming process is like, which can only be done after block 2016 in a day or so [https://namebase.io/airdrop](https://namebase.io/airdrop).

[1] [https://namebase.io](https://namebase.io)

<comment><USER11> Interesting they are soliciting personalities, rather than infrastructure, sysadmins and others who might have more power to push Handshake. Leaves out a lot of the Great Old Ones too, like say a big hunk of Debian and Ubuntu developers. Or Firefox devs, who have a lot of power here. Lots of projects predate Github. When I looked, I'm honestly surprised how many followers I have there - why would you follow me personally? Rather than the projects? I wouldn't follow me. Seems rather creepy.

Edit: I see elsewhere there have been cash drops to Debian, Arch and probably some other projects. Which makes sense.

<comment><USER19> It's not soliciting personalities but rather developers who have made things useful to at least 15 other developers, at least on Github.

They also needed exposed public keys to airdrop to, which limited the airdrop to Github and the WoT strong set.

<comment><USER20> > who have made things useful to at least 15 other developers

Then why not look how many stars one's repos have? That seems a much better metric to me.

A friend of mine has hundreds of stars on their repos but only 30 followers. I have around a hundred stars on my repos but only 20 followers. Conversely, I've seen people who are into networking, have a lot of GitHub followers, and no meaningful repos at all.

</comment></comment></comment></comment><comment><USER21> First impression: Great another ICO.

Second impression: Not a wildly outlandish idea but im not sure if it's a good idea either. Decentralized and automated registrar with a concept of renewals. Nifty.

I'm not really sure how the economics here work out.. Could I scoop up a few million names early on and then hold them forever? Has that already happened? Could this enable anonymous registration? Would these things make users trust these names more or less?

<comment><USER22> The project raised $10M and then gave 100% of it away to open source projects. They receive some HNS tokens in return. There is a massive airdrop of coins to hundreds of thousands of guthub users, spreading out the money supply to people who might be the most interested in using the system. In other words, this is the least ICO-y new blockchain in a decade.

Names roll out over 52 weeks: HashName(name) % 52 = week number that a name is available. So that should attenuate squatting. Also bidding on names locks up coins for something like 2 weeks, so it's hard to bid on too many names.

<comment><USER21> Well. That's a nice publicity stunt. lets see how they get their investment back. It's nice that this project does some good. [https://github.com/handshake- org/hsd/blob/56c83ca7344def512e...](https://github.com/handshake- org/hsd/blob/56c83ca7344def512ef861f452bff91d43bc8f52/lib/protocol/consensus.js#L88)

So if I read this right

Creators get: 102mi coins

Sponsors get: 102mi coins

they are airdropping about 952mi coins to users on github to the tune of 4,246 per user.

So they're collecting about 20% of all coins initially dropped. That's slightly more then some. And at the value listed on [https://www.namebase.io/](https://www.namebase.io/) that adds up to some 102,000,000 * $0.44 = $44mi.

Ok, so it's not an ICO exactly, instead they raised VC funds which is expecting a return by selling coins.

I've just spent a few minutes looking through the website, docs, and a little code. And I have no idea how an end user will use these names. Everything polished about it is for trading coins not real world usage. Sounds like every other crypto coin.

<comment><USER19> _> how an end user will use these names_

It's aimed at open source developers who will be able to figure out how to use the system, not mainstream non-tech normies. As evidenced by the large airdrop to Github.

<comment><USER21> Most people who own domain names and run websites are mainstream non-tech normies.

</comment></comment></comment></comment></comment><comment><USER23> This has been tried. It's called Namecoin and it failed to get much traction.

I suspect that using Bitcoin instead would improve adoption dramatically instead of creating yet another token. This can be done using sidechains or something similar.

<comment><USER24> ENS is running on top of ethereum just fine

<comment><USER25> I think ENS is queried more often in a different context than DNS, since many people access it via JSON RPC over HTTP. The interface is an Ethereum contract, although records could be cached in a DNS server if the server can hit an Ethereum node upstream. The two projects feel pretty different for that reason. Handshake could be accessed over DoH potentially.

</comment></comment></comment><comment><USER26> Looks like this is similar to Namecoin?

[https://www.cs.princeton.edu/~arvindn/publications/namespace...](https://www.cs.princeton.edu/~arvindn/publications/namespaces.pdf)

<comment><USER19> Similar but attempts to solve some of the problems with it, like trademark squatting and including an on-chain market for TLDs.

</comment></comment><comment><USER27> I don't see information on how names are handled. I know Zeronet started the entire .bit (which can be purchased with NameCoin). Are there reserved TLDs for handshake?

Has ICANN said anything about .bit or .onion TLDs? I suspect TOR is big enough they won't touch .onion, but if they sell .bit, you'll then have some name overlap/conflicts.

<comment><USER28> The handshake namespace overlaps with the normal domain name system, but they reserve the top 100k domains for the current owners. My only concern is the long term sync between DNS and the old system. But I like the project and I think it's a good way forward for replacing the current centralized DNS and PKI system

<comment><USER22> I'd say it extends more than overlap: If a name is not found on the Handshake chain, the resolver "falls back" to legacy ICANN DNS. Since all current gTLDs are reserved as well as the top 100k, there won't be any overlap for a while.

<comment><USER28> That's great. I didn't know that all the gTLDs are blacklisted, I thought they only the first 100k. This should make the transition smoother

</comment></comment></comment></comment><comment><USER29> A thread from 2018: [https://news.ycombinator.com/item?id=17673922](https://news.ycombinator.com/item?id=17673922)

</comment><comment><USER30> I am actually curious because I don't fully understand how Handshake works... I believe it allows you to setup a K of N threshold signature scheme for changing DNS, which, is kinda cool, but I don't understand if this would help BGP route hijacking.

Edit: I guess this is a replacement for ICANN not the inter-carrier routing protocols, which is, interesting. Is the point here that if DNS authorities switch to Handshake for authoritative DNS it will be harder to hijack routes? I would love an explanation, sorry it I'm being dense!!

<comment><USER22> It doesn't address BGP, just DNS. You are correct about the signature scheme though. In fact, names are owned by unspent transaction outputs, exactly like Bitcoin. Meaning you can own a name with whatever weird script you want (2 of 3 before a certain date, 4 of 5 after...) you can even add scripts that allow certain keys to update a DNS resource, but a different key to transfer the name.

</comment></comment><comment><USER16> :\

As has been the pattern with all these decentralized DNS schemes, the FAQ doesn't cover the most utterly basic question: "I currently have one or more domains that I use extensively for my own life/work. How do I transfer those to try this new scheme? How much actual dollars/euros/yen/yuan/... does it cost, not mystery blockchain-whatevers but predictable real money? Does this new scheme harm me?"

Shouldn't an experimental system in particular want regular tech people with personal domains trying it out? We'd probably be more willing to give it a whirl (with fallbacks) since it's more for our own private use. But instead it's all about trademark holders and the Alexa 100k and so on, which is important too but it seems like most such domain holders would be a lot more conservative. And I've had a growing suspicion that the last part of the question doesn't get answered clearly because the answer is "you may get screwed, we are ideologues who think that people should be able to take your domain if you're not rich enough to defend it."

I mean, right now I don't in fact see the current DNS system as _horrible_. Cloudflare and others are pretty reliable registrars and companies to deal with. A .com is about $8, .net and .org both about $10. A known amount of $200 or so and I'm set for 10 years, and I consider that a good thing. I've had my domains for nearly 20 years now, they're core to my online identity and personal infrastructure. Same for most businesses, DNS sits at the center of everything. My concerns are about ICANN allowed price increases due to monopoly, and whether bad actors could somehow try to claim my domain and how I'd fight that as an individual. But I don't see answers in the FAQ to how this would help answer those. My personal domains aren't in Alexa top-whatever so it sounds like handshake will auction them off. There is a "renewal fee" after that but it's handwave-y:

> _Renewals for names are annual and cost a standard network fee_

A standard network fee of _what_? $1? $10? $100? It can vary by thousands of percent at random like so many cryptocurrencies? How long is the renewal window? Can it be paid upfront? What happens if it gets missed? Is any of this _predictable_?

I simply don't see any brass tacks implementation stuff here. It's a bunch of high level hoohah about the evils of centralization without any acknowledgement of how centralization can be useful and efficient too and how they deal with that. The word "federation" does not appear at all, which is another important approach/aspect. It sounds worryingly like a common "religious" approach where people take a tool (like decentralization) and turn it into a goal in and of itself.

<comment><USER3> There's an airdrop that gives developers on github claims. Basically if you had over 15 followers on GitHub by August 2018 you likely got 4662 coins (worth a lot since current market price is $0.50[1]). These instructions walk through how to claim the airdrop [https://namebase.io/airdrop](https://namebase.io/airdrop). This way you can easily register names to try Handshake out even if you already have websites in traditional DNS.

[1] [https://namebase.io](https://namebase.io)

</comment></comment><comment><USER31> Does putting self-signed certs on a blockchain really solve the problem?

<comment><USER32> Everyone can put self-signed cert on a blockchain. You need to prove that you control the domain. Easiest way to prove that is to ask your registrar. And if your registrar will sign this fact you don't even need to ask him. So you naturally will come to DNS and DNSSec. And all standards are already here: deploy DNSSec, put TLSA record and it's done. It's a solved problem, just not widely supported.

<comment><USER31> "prove that you control the domain"? isn't that the rub? sounds a bit circular to me at least. there doesn't seem to be any solid replacement for the existing centralized trust authorities. what am i missing?

<comment><USER32> As long as we're talking about conventional DNS, it's centralized by design. And if you want to build a better DNS, you can just use onion: domain is public key and you can even mine good domains (facebookcorewwwi.onion).

</comment></comment></comment></comment><comment><USER33> I really do not see the point. Naming not only is not important but it also causes issues with trust. I think that the solution that tor/i2p went with is much better.

</comment><comment><USER14> The only one I wanted isn't released for a whole year, lucky me

</comment><comment><USER34> They've somehow managed to make the two least optimal choices of language possible.

        The full node daemon, hsd, is written in Javascript.

A non type safe language with poor package management for consensus critical code.

        We also have a light client, hnsd, which is written in C

A non memory safe and error prone language for client code people would run on their systems as root.

<comment><USER22> Well at least you don't have to worry about package management, all the dependencies are built by the organization either from scratch or with vendored code.

Re: JavaScript, you should take a look at the code in repo, it's excellent. There is a such thing as great Javascript code and bcoin/hsd are prime examples.

<comment><USER34> I'm very aware of bcoin.

[https://npm.anvaka.com/#/view/2d/bcoin](https://npm.anvaka.com/#/view/2d/bcoin)

Many steps of indirection away we find things like this include.

[https://github.com/juliangruber/isarray/blob/master/index.js](https://github.com/juliangruber/isarray/blob/master/index.js)

        module.exports = Array.isArray || function (arr) {
          return toString.call(arr) == '[object Array]';
        };

Javascript is an absolute joke of a language.

<comment><USER6> I don't really see the problem. On any remotely modern version of Node that's just a noop. On ancient versions of Node its a very useful polyfill.

</comment></comment></comment></comment><comment><USER35> Great, what the world really needs is a hideously inefficient set of distributed DNS servers that are permanently eating 100% CPU to do their proof-of-work blockchain mining crap. The page hand-waves this away by claiming (with no good reason) that it will all be renewable energy. Just like bitcoin in China, right?

<comment><USER36> You missed what HS does. It does not run the DNS system, it extends what ICANN does. The same DNS tools and infra are still used

</comment></comment><comment><USER37> This is golden, it reminds the time when Let's encrypt started. Something that is challenging and can change a lot the direction of the internet.

<comment><USER34> Nice astroturfing.

<comment><USER29> Please read and follow the site guidelines.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment><comment><USER6> This is a great idea with one easily correctable but nonetheless fatal flaw: it's an all-or-nothing preposition. If users choose to use Handshake as their DNS roots, they will no longer be able to access websites which only exist on ICANN's root zone.

Assuming I'm not mistaken and that really _is_ how Handshake is set up (someone please correct me if I'm wrong), then IMO the whole project is essentially dead on arrival. There's no chance they're going to be able to convince millions of large websites to register on a new DNS root overnight. And even if they did somehow managed to convince 80% of websites move to the new system, users _still_ wouldn't switch over because doing so would effectively break 20% of the internet for them.

It's a real shame, because this problem would be trivially avoidable if they simply allowed the existing TLDs use the ICANN roots and confined Handshake domains to their own TLD (.handshake maybe). That way, adoption could happen slowly over time and users could switch over to the Handshake roots with no downsides. As-is though this is simply unworkable.

<comment><USER13> > If users choose to use Handshake as their DNS roots, they will no longer be > able to access websites which only exist on ICANN's root zone.

This is not true. You can setup Handshake to be your resolver, and it will resolve both domains on handshake, and legacy domains from icann.

<comment><USER6> Then what's this paragraph in the FAQ about?

> Existing TLDs and over 100,000 Alexa websites are reserved on the Handshake > blockchain. Upon removing collisions, generic, and exclusions (e.g. 1 or 2 > character names), approximately 80,000 names remain. Using the root key and > DNSSEC, domain owners can cryptographically prove ownership to the Handshake > blockchain to claim names.

Does Handshake control existing (`.com`, `.org`, etc.) domain names or don't they? If they do, then what happens when a DNS entry in Handshake's roots contradicts what's in the ICANN roots? If Handshake wins conflicts, then that breaks the internet for existing users.

<comment><USER13> I have a longer answer here [0], but in short, Handshake does not control existing domain names. They are giving the top 100k existing domain name owners control of a gtld based on the domain they own. Ex `example.com` receives `example` in Handshake's system.

[0] [https://news.ycombinator.com/item?id=22312059](https://news.ycombinator.com/item?id=22312059)

<comment><USER6> Okay, that's much better. Thanks for the clarification. I assume "com", "org", "net", "ninja", etc are also reserved then?

<comment><USER13> Yes, they are. The list can be found here: [https://raw.githubusercontent.com/handshake- org/hsd/1c2d1036...](https://raw.githubusercontent.com/handshake- org/hsd/1c2d1036b262ecb767e71a73cd91ef11c940b230/lib/covenants/names.json)</comment></comment></comment></comment></comment></comment>


A business with a difference - <AUTHOR> http://christiankvalheim.com/post/1047361816/business-with-a-difference

<comment><AUTHOR> I have been thinking a fair bit about what kind of startup I would do some day. It seems that there is two main themes around startups in the tech space. The first is to focus on bootstrapping a service and flipping it and the other one being to build large with pools of VC money and then flip or IPO it. However once in a while you get a view of a different model like the one 37signals use. It got me thinking about what kind of startup I would want to build when the time comes. I have spent a couple of years in one or the other form of startup and I think it's time to start a different trend. I'll call it the mom&pop internet startup with a social conscience. Confusing right, but consider starting a company that's your lifelong focus in our business. A company you would work for the rest of your professional life. So what would you want that company to be doing ? I came down to the following five points that described what I would want that company to do.

1\. Provide a valued payed service

2\. Create a small loyal community of users to develop the service on and on

3\. Be socially responsible

4\. Invest in new startups to help grow the space of mom&pop internet companies

5\. Transparency

My personal answers to the point above are fairly simple but will vary from person to person.

1\. Provide a digital life vault service with focus on privacy(dropbox + delicious +.. only the future will tell) as a paid service (no freeloading, but 30 days trials available)

2\. Cap the number of customers to a max of 10 000 with a small growth each year after that to keep the income in line with inflation. Invest in the community organizing meetups, giving away prices etc.

3\. Provide micro-lending through services like Kiva, etc. Being completely transparent and including the community where possible.

4\. Angel invest a big chunk of the profits and also provide help and mentoring to new companies.

5\. Provide information to the users what their money is being spent on.

I think it would probably employ 3-4 people once it's fully up and running, and dependent on the pricing and cost structure would generate between 1.2 - 2.4 million euro a year once 10 000 customers are reached with a cost structure of around 0.4 - 0.5 million eur. That would leave between 0.8 to 1.6 million eur for angel investments, micro-lending and community activities. The idea is not to revolutionize a sector of our industry but to provide a valuable service that people choose not only for the technical merits of the product offered but also for the social and community aspect of it. Consider it your local mom&pop shop you buy your coffee from each and every day. So what do you think? Is it a viable way of organizing a business and would you choose such a service if it was available?</comment>


Why Startups Die - <AUTHOR> http://www.pixelmonkey.org/2012/10/03/why-startups-die <comment><USER2> As much as people like to believe that working hard and not giving up will get them through, there's other reasons:

\- The market wasn't there, the problem was too hard to solve, etc.

\- You simply weren't good enough to solve the problem. You didn't have the right combination of skills, experience, or connections to make it happen.

These are more interesting to me as you can attempt to succeed where other people have failed. I've always had an idea in the back of my mind about getting a list of startups that failed before 2001, figuring out which had good ideas, then retrying them again.

<comment><USER3> > A list of startups that failed before 2001

Disclosure, I wrote this: <http://www.amazon.com/gp/aw/d/1416577939>

<comment><USER2> I have had it on my shelf since 2002; the book and the site before that have provided hours of amusement, thank you.

</comment></comment></comment><comment><USER4> > When startups die, the official cause of death is always either running out > of money or a critical founder bailing.

This sounds like a truism to me. Like "the brain stopped working", it's more a definition of death than an explanation of what caused it.

> But I think the underlying cause is usually that they've become demoralized.

And this, I suspect, is confusing correlation for causation. The team getting demoralized is a symptom of the company being in a poor, possibly life- threatening, state of health. Like many symptoms of real disease (e.g., diarrhea) it's something that will worsen the situation and needs to be treated. But it's not necessarily the underlying cause. If the real source of illness is something that won't resolve on its own then focusing too much on the symptoms is at best a form of palliative care. At worst, it exacerbates the situation by lulling you into believing that you're addressing the problem when you're actually allowing it to continue unchecked.

<comment><AUTHOR> To be clear, both of the quotes you have there are pg's from "How Not to Die" -- excerpted in the article but not quotes from the OP.

</comment></comment><comment><USER5> Here is why mine have died:

Running out of funding. This is a tough one to deal with, because you think you can make up funding with more work. My solution is to offer a very stage product right from the start in order to get some cashflow going in. So far it has worked.

Building something people don't want. I once spent two years developing an idea to only realize people did not want to pay for it. Two years spend buying equipment, developing marketing, etc. But I did not test the market. _I know._

Lack of sales skills. This one is really tough. As an introvert, is was really hard getting how sales work. I read book after book trying to find the magic formula. Turns out that sales skills are more about social skills than anything. So my lack of sales skills were really a lack of social skills. One good startup died due to that. But I did realize the problem, and have been working on improving my sales/social skills. So far so good...

Wrong market. Spent five years trying to sell to a market that would not buy from me. Why? A combination of lack of social skills and pricing kept me from achieving any success.

Being the lone founder. My biggest successes have been when I've worked with someone else. Having someone to split the workload makes a huge difference.

Buying too much inventory ahead of time/demand. I still have some left.

Not getting deals on writing. A good startup I was building died because I did not get a deal in writing. I went and bought some inventory to satisfy the deal, and then the buyer backed out.

I have many more... :)

<comment><USER6> Well, I have to commend you on your entrepreneurial spirit to keep trying. If you keep trying you're bound to hit it eventually (if you haven't already).

<comment><USER5> That is why I'm building nuuton. If I'm about to get lucky, then I better aim high. Thanks for the nice words.

</comment></comment></comment><comment><USER7> I hadn't seen Chris Dixon's post on what startups need and don't need before. I disagree with vacation policy being unnecessary for startups. I know some startups don't have one and I feel like it's done to create friction whenever employees want to take time off which feels a bit insidious. And it creates the feeling that some folks are freeloading. I don't think it's overly "corporate" to have a well-defined vacation policy

<comment><USER8> > I feel like it's done to create friction whenever employees want to take > time off which feels a bit insidious. And it creates the feeling that some > folks are freeloading.

It's exactly that. The idea that people are more productive if all they do is work, for 50 hours a week or more, is such an insanely stupid notion. But I hear it time and again from founders who expect employees with a 0.5% stake to put in as much time as a founder who has a 30% stake.

Even founders should keep their work hours under control--they set the tone for the company, and a workaholic tone isn't healthy. People just burn out, they feel demoralized, and it creates conflict.

Working less also forces you to make hard decisions, to prioritize and focus.

Finally, founders should be HAPPY that employees take time off. It rejuvenates them and makes them that much more excited to get back to work. And often when they're not in the heads-down grind--when their mind is relaxed--they come up with some very good ideas.

</comment></comment><comment><USER9> I just recently got out of an accelerator and the biggest thing I saw in the program was teams either able to execute or not able to execute. This makes a world of difference.

Also, figuring out your priorities as far as design first, just get something out there, etc. but whatever it is make sure everyone agrees on the time and methodology, ie design first will take longer.

Another big one, and one I got screwed over on, was finish all the legal paperwork in a program like this as early as possible. Make sure to sign your employee agreement and pay/equity agreement if you're getting it. Do this early on so everyone is on the same page and is clear about what's going on. I was cofounding and just this last Sunday got terminated after spending the last 4 months working on it. No cause or notice and almost without pay (still working on this). Always fear the worst and never think it won't happen to you.

<comment><USER10> Wow, that sounds like a really bum deal. Thanks for sharing your experience. Hopefully it will help others avoid the same fate. Keep your chin up and keep pressing forward and you will come out on top in the end.

</comment></comment><comment><USER11> > Pre-Emptive Scaling

Man, this one a thousand times over. I shudder when I think of all the work that could have been saved if these premature optimizations had never been made (I wrote a blog post on 500m row tables in MySQL about this). A little dose of YAGNI would go a long way to many startups. Also, re: Twitter and Tumblr's scaling problems: they didn't fail because of sporadic downtime. They fixed the actual problems/bottlenecks when they encountered them, and went on.

<comment><USER12> Agree 10,000x over your 1000x. On the occasions where rapid unexpected (and awesome!) traffic or growth spikes happen you can almost always temporarily patch the situation by scaling vertically (bigger/faster disk/CPU) or quick and dirty horizontally (load balancing or replication) and then have some breathing room to work out the real meaningful or cost effective scaling solution.

</comment></comment><comment><USER13> Hi I´am from Brazil, and I think most of Startup Entrepreneurs are not prepared for business, I know the practice and experience is great, but they need some methodology, best practices, fundamentals of business, case samples and advices also.

Books like "Business Model Generation", by Alexander Osterwalder & Yves Pigneur, "The Startup Owner´s Manual", by Steve Blank and Bob Dorf could be very useful.

Here in Brazil we have the recented lauched book in portuguese called "Empreendedorismo Inovador – Como Criar Startups de Tecnologia no Brasil", 25 authors, Editora Évora.

Att. @neigrando

</comment><comment><USER14> Every startup requires some level of the Jobsian RDF to exist around the founders and extend to the core team. The problem is that, for most startups, the RDF will be threatened by real-world events (nobody is using/buying/investing-in your product) and once the RDF is gone, it's very hard to keep going. That's when morale suffers. That's when founders leave. Startups die the same way because the begin the same way (and rightfully so): with a passion about an idea that doesn't necessarily conform to reality.

</comment><comment><USER15> tl:dr : dont quit

<comment><USER16> Not enough people take that message to heart. Quitting is the #1 mode of failure not just in startups but in damn near everything.

<comment><USER17> The opposite is also true. Too often people don't quit when they should because of sunk costs they've invested.

<comment><USER16> Agreed. But I just call that "being too stubborn to learn from your experiences"

<comment><USER18> It's very difficult to tell the difference from the inside. Am I just bein stubborn, or do I just need to hang on? It's essentially a matter of predicting the future, and you don't have enough information.

<comment><USER19> Having gone through this in the last six months, I found I had more than enough information, and what was standing in my way of leaving was a somewhat complicated mixture of emotions surrounding the act of leaving. Of course, a clear headed look at the circumstances let me wipe all those emotions away, and I left at the right time, and without regrets.

For devs, a great rule of thumb to keep in mind is simply this: When the paychecks stop, so do you. The odds of any startup getting anywhere drop off a cliff once the money runs out, and the founders are running around desperately, talking about commitment and challenge and reward.</comment></comment></comment></comment></comment></comment>


Arch Linux moves up to Linux 3.0 - <AUTHOR> http://www.desktoplinux.com/news/NS2477413399.html <comment><USER2> "Based in part on the minimalist CRUX distribution, Arch Linux was launched by Judd Vinet in March 2002"

Nitpick correction: Judd Vinet created Arch from scratch in 2002 based on the minimalistic ideas of CRUX, but Arch Linux was built from scratch, and pacman was written by Judd in C.

The article is also somewhat misleading -- toting this release as having a ton of new features over the previous release. Arch Linux is a rolling release distribution and any sane Archer will immediately completely update their system after a fresh install, so none of these features are really new to any existing Arch Linux user.

The syslinux installation functionality from the installer, as well as BTRFS support from the installer, is new and good to see.

Arch moved to Linux days after 3.0.0 was released. It's nice to use a distribution where you can have the latest versions of everything for testing and development. I've been using it for six or seven years and still prefer it on my desktop and (not-so-mission-critical) servers.

</comment><comment><USER3> Of all the Linux distributions, Arch is my current favorite. I especially like its init system and Pacman. It also has an incredible wiki.

<comment> steve-howard I love using Arch. The rolling release means there's no eventual super-painful process for updating; you just update everything and your system is up to date. It does break sometimes, but in recent years developments in both the installers and pacman have made it a lot easier to get a system that Just Works (for many things). I was pleasantly surprised to learn about KMS, which lets graphics drivers deal with the console/X resolution (so I don't have to remember which vga=0xsomething I need).

<comment><USER4> I'd like to hear more about the degree to which things do sometimes break and the steps that users generally take to fix them. Thanks.

<comment><USER5> If you have ever tried to install the latest version of a distro while keeping the config from the previous version, it's basically the same except spread out over time, which I find a lot more comfortable.

When something is broken after an update, either :

\- the steps to take are immediately obvious from the error message

\- it looks like a config issue, and I'll then have a look at the new config file pacman has created as file.conf.pacnew and try to merge it with my existing file.conf

\- I have no idea and google the error message with "site:bbs.archlinux.org", which 99% of the time will yield the answer quickly.

I have a few packages that are excluded from pacman updates, because they're too important for work (SBCL mainly). They will only be updated once in a while. The rest ot the updates are done depending on my work and my mood : I'll do a complete update, particularly on my home server, only when I have time for it and am in the mood to fix things,

Overall, I find it much more comfortable than always postponing installing the new version of a distro because it will be too much work to replicate my setup, and ending up stuck with outdated software.

</comment></comment></comment></comment><comment><USER6> I used Arch for years.

But in the last year, my system broke 4 times with updates mainly due to major changes in configs, wich weren't in the news.

This distro is not stable.

It's time to go back to Sid.

<comment><USER7> I was kinda with you until "to Sid".

<comment><USER6> How so ?

</comment></comment></comment><comment><USER8> Why is this news? The 3.0 kernel could very well have been called 2.6.40, would that have been news worthy?

<comment><USER9> Because Arch had to make some changes due to assumptions on their end, w.r.t kernel naming scheme. This is part of the breakage that the article mentions.

<comment><USER10> Also note that Arch is a rolling-release OS. The lastest iso (previous to the linux 3.0 one) was released on june/july last year -- that's 15 months ago.</comment></comment></comment>


Show HN: Hacking slot machines with a buttonhole camera and brute-force search - <AUTHOR> https://github.com/tensor8/hacking_slot_machines <comment><USER2> A friend "hacked" a similar betting gaming machine.

The game cost $2 to play. It loosely followed the payout rules of the TV show "who want's to be a millionaire". There were about 10-12 levels and every 2-3 wins you'd get to a checkpoint where you could cash out or continue playing for more money.

Each level was slightly harder in difficulty/time with 3 "prize/payout" levels, which changed based on how much the machine had paid out recently. You could generally win anything from $10-$40 per play.

It had about 8 different games you could play (one being sports trivia). One of the games you could choose was "spot the difference" where you have 2 images side by side and you needed to touch the screen in a set amount of time to find the 5 differences.

The method my friend worked out to "hack" the machine was to cross his eyes and merge the 2 images into one, similar to the stereogram "Magic Eye" images you can find. By crossing his eyes and merging the images into a single one - the differences stood out really clearly.

This lasted a few months with him and his friends cashing in on all the machines in the area, whenever their prize level was high. Eventually the software company worked out there was a problem with that specific game and updated their software.

It didn't pay out as high on that game. And the top prize level had to be completed in under 2 seconds. Which when you're trying to press a not-so-great touch-screen 5 times in 2 seconds, was not possible as not all presses would register if you touched it really quickly.

<comment><USER3> Anyone who hasn't used this cross eye method on a spot the difference game needs to try it, it's a very interesting experience to see the way the differences are highlighted.

<comment><USER4> Agreed, I just tried it. Two good examples for this are the ones in the Wikipedia page [0]. The size in the page is maybe a bit large, if it requires a too large angle of eye crossing: hit Ctrl - a few times to zoom out.

[0] [https://en.wikipedia.org/wiki/Spot_the_difference](https://en.wikipedia.org/wiki/Spot_the_difference)

<comment><USER5> that's amazing. thanks.

</comment></comment></comment></comment><comment><USER6> I wrote a similar program a while ago to cheat at Word Soup which is another of the games on these machines.

[http://chris-knott.appspot.com/projects/word_soup.html](http://chris- knott.appspot.com/projects/word_soup.html)

They are technically not gambling. There are two different regulations in the UK - Amusements With Prizes, which are random and you need to be 18+ to play, and Skills With Prizes which are technically skill games and you don't need to be 18 to play, or have a gambling license to run.

<comment><USER7> FYI I'm getting an "Over Quota" error when trying to access your site.

<comment><USER6> Whoops, guess HN used up my bandwidth. Here's a video on YouTube [https://youtu.be/PICrG3X8XIU](https://youtu.be/PICrG3X8XIU)

<comment><USER7> Thanks! As an amateur advantage gambler, I find all of this stuff fascinating.

</comment></comment></comment></comment><comment><USER8> Not directly related, but similar approach... Around 20 years ago. One of the eastern block countries, short after the transformation. Officially democratic but practically in a limbo between old and new system. Gambling law allows to run casinos but also a small slot machine parlors - gambling dens for poor and naive, occasionally getting rich for a short time, before they loose everything again and put in even more. Novomatic slot machines are deployed in large quantities in those places. Among them American Poker 2 (which you can play using MAME [1] if you like.) A crud machine, considering AAA games released at the time, nonetheless serves its purpose well. No one cares about 3D and shaders in those places, anyway. Two men enter the parlor. One does not speak local language at all, the other is born local but lived abroad long enough to get the weird accent. They buy a game for a minimum amount of money and lose everything fast. Not even trying to win, just passing cards at the same time noting the sequence in cell phone. Cell phones aren't allowed in the parlor but they are quick, no one sees anything, besides, they are trained in memorizing the sequence if needed. They leave the parlor "for a smoke," come back after few minutes, insert a minimum amount again and win every single deal. That must have been a really lucky smoke! They cash in a lot, leave a considerable tip to the staff and off they go. Apparently American Poker 2 is popular in whole eastern Europe at the time and, apparently, ROM version is the same everywhere. They are visiting every city big enough to have multiple parlors. They are visiting multiple countries in the region. They don't work alone, obviously. They become bold and try to cut a deal with a parlors' staff. In many places they succeed - it's a lousy job in lousy place. Especially on night shifts and they rarely visiting during the day. It's safer that way. So they come, they get a tip from the staff about which slot machine is money fat this night. It matters more for the staff then for them, it looks better in daily report. They win, share some with the staff and go to another parlor or another city. But sooner than later a pattern starts to form and some notices the behavior of two always winning regulars. Gossip starts to follow them. It's harder to get by unnoticed. In the end, maintenance crew updated the game ROM in all machines and the trick stopped to work. At least for a while. No one ever caught the lucky winners.

[1] [http://www.gamesdatabase.org/game/arcade/american_poker_ii](http://www.gamesdatabase.org/game/arcade/american_poker_ii)

<comment><USER9> There was something similar done with a machine called Jolly Card. Hacked ROMs were widespread, but they got replaced soon and chips sealed to that replacement could be spotted. But then people reverse-engineered the ROM and found a flaw in the random number generator. Smart Bulgarians managed to fit a single chip computer into a car remote, which at the time was a significant accomplishment. So, after using the remote keys to allow the device to sync with the poker machine's timer, they were able to guess the part when you can double your wins. So, after syncing, the smallest win can be increased 1,024-fold (you got a maximum of 10 doublings). They were selling this remote for 10,000 DEM, or German Marks, which was about 7,200 USD at the time. After people made millions milking the poker machines in Western Europe, the manufacturer released a fix, and the new generation of machines got a hardware random number generator.

I remember some mafia guys came to me knowing I can replicate the hacked ROMs, so, I cloned it, but I also made a hard-to-notice mark so that I can identify these machine (well, it was an extra space in some text.) Well, unfortunately, I wasn't able to find one later, but I didn't look hard for one anyway.

<comment><USER8> Funny thing you've mentioned... The guys were from Bulgaria. Maybe the same group.

</comment></comment></comment><comment><USER10> Related: there are various bots for HQ Trivia that do similar things that have come up on HN before. Here's one with a bit of a writeup: [https://medium.com/@tobymellor/hq-trivia-using-bots-to- win-m...](https://medium.com/@tobymellor/hq-trivia-using-bots-to-win-money- from-online-game-shows-ce2a1b11828b)

My general impression is that being able to screenshot and use real computing power is a fair bit easier than using OCR on a Raspberry Pi, but question parsing and querying Google is a lot harder than using a static corpus of questions and answers.

<comment><USER11> I'd previously done OCR work with Twitch streams, but the reliability of the Tesseract libraries for custom fonts had stopped me from going any further with it. Since HQ uses a standardized font library, I'd imagine character extraction would be more successful when recording from screenshots because it would likely be closer to the library's training datasets.

<comment><USER12> Counting donations and subs? I'd thought about doing the same.

</comment></comment></comment><comment><USER10> Note that this appears to be in the UK, given the branding of the machine and the poster's comments. I'm not sure what the legality is there, but it sounds like it's a less regulated form of low stakes gambling, so maybe it's practical there. I imagine whoever's responsible for the machine would kick you out in a hurry, though. I know there's some been some other rulings that make UK law pretty bad for advantage players, so it also wouldn't surprise me if this is illegal there as well.

In the US, this would generally not be called a "slot machine" \- more like a bar trivia video game from what I can find, which most likely wouldn't pay out money. US casinos and slot developers are putting some skill-based elements in their machines, but those are generally added as bonus rounds to regular slot machines. In any case, using an electronic device on a casino floor is generally not a good idea in the US. For example, in Nevada,

"NRS 465.075 Use of device for calculating probabilities. It is unlawful for any person at a licensed gaming establishment to use, or possess with the intent to use, any device to assist:

1\. In projecting the outcome of the game; 2\. In keeping track of the cards played; 3\. In analyzing the probability of the occurrence of an event relating to the game; or 4\. In analyzing the strategy for playing or betting to be used in the game,

except as permitted by the Commission."

In practice there is some leeway on this - sitting at a video poker machine, nobody's likely to hassle you for looking up perfect strategy on your phone. On the other hand, most table games dealers will tell you to leave the table while using your phone. It's fine to have a paper card with blackjack basic strategy, but not to check the same information on your phone. But in any case, the rig described here is not going to be a good idea anywhere in the US I'm aware of, and that's assuming you can even find a skill-based machine with sufficient payouts to justify trying it.

</comment><comment><USER13> FYI to author, the video that you tried to delete (quiz.gif) is still accessible. It's still in your git history and can still be viewed easily, probably don't want casino people seeing your face :P

<comment><AUTHOR> Looks like a case for <git-filter-branch>

<comment><USER13> Missed a spot with that rebase, looks like you accidentally put it back into the repo.

<comment><USER14> It is not the same. Previous one was showing his face

</comment></comment></comment></comment><comment><USER15> Unfortunately a little late for the git history wipe...

[https://github.com/tensor8/hacking_slot_machines/network/mem...](https://github.com/tensor8/hacking_slot_machines/network/members)

<comment><AUTHOR> Yeah, it's not anon: the game was retired from machines and I left the ROM out. Wouldn't recommend to do for other than fun (and tbh hourly wage would be very small), but was a fun side-project!

</comment></comment><comment><USER16> I'm shocked that there's an ostensibly skill based slot machine.

<comment><USER17> Yea, where would one find a machine like this? Doesn't really seem like a slot machine to me.

<comment><USER18> The Nevada gaming industry is lobbing heavily to legalize them. So they can target younger demographics.

<comment><USER19> If I could loose money because I'm just unskilled at something (but had fun) rather than just got unlucky, I'd absolutely use one of those machines.

<comment><USER20> It doesn't really work like that, eg if you play the quiz one, when you get past £3 the questions become ridiculous, like what is the size in cubic meteres of lake Victoria? 40040400303 40404940404 or 4940403030 etc

So it just ends up being luck really. They also pay out a fixed amount and the difficulty rapidly increases if you keep winning.

</comment></comment></comment></comment></comment><comment><USER21> > The game data files look like this; encrypted, unreadable text. Fortunately, > it turned out that they were encrypted using an xor cipher. This means that > we can fairly easily write a script to get a list of questions and answers > in human-readable, decrypted form.

I mean, it doesn't much matter how these things are encrypted - since they have to be decrypted to display the questions and answers on-screen, the code and any necessary keys will be present in the game code. You'd only need to reverse engineer the ROM enough to know where the decryption code is, and invoke that code (or reverse it and write a compatible implementation). It just so happens that the encryption is weak enough here that reverse engineering is not required.

<comment> brian-armstrong This isn't necessarily true. A lot of machines like this use a security dongle to perform decryption which means it is very hard to get the data except by scraping it while it's running (and even then, this can be quite hard)

</comment></comment><comment><USER22> If you have all the questions and answers; couldn't you just study them? It's not as fun, but probably just as effective, depending on your ability to retain useless knowledge.

<comment><AUTHOR> I tried this initially and put all 30K questions in Anki. I learnt about 97% of them, but it still wasn't good enough to win

<comment><USER23> Appreciate this is a tangent, but if you learnt almost 30K trivia questions off by heart.. have you found that has benefitted you in other ways? Like, being killer at quiz shows or University Challenge or something? :-)

<comment><AUTHOR> I got asked to be on a University Challenge team after someone saw me playing... but completely flopped when they asked independent questions at trials.

This kind of unlinked data leaks very fast, too: at my peak I had to top up with Anki for about 3 hours a day. I've forgotten almost all of it now.

A small consolation is that I can still tell you the 'exact number of gallons of water' in most major lakes.

<comment><USER24> "the exact number of gallons of water in most major lakes"

I don't think there is such a thing.

<comment><USER25> The exact numbers listed in various reference texts, then.

<comment><USER26> Guaranteed to be completely false, then. What is the point of learning this?

<comment><USER27> To win the jackpot of the machine that have them listed as answers.

<comment><USER28> Yeah, this sort of bullshit question is a go to for machines that need are ostensibly skill based but need a reliable way to break your streak if you are winning too much.

I used to be pretty good at the WWTBAM pub machine. I am a pretty quick reader so could scan read and answer the question pretty much instantly if I knew it, managed to impress a few onlookers that way (slow readers no doubt) as it seemed almost supernatural to them. My one taste of what it would feel like to be a top sports person!

<comment><USER29> This reminds me of a regular pub quiz I used to do - the guy hosting would pull out all sorts of these stupid numeric questions like "what's the distance between <tube station A> and <tube station B>?", and no point unless you got the answer _exactly_ , ie to the nearest integer.

Another time the answer to a question was "West Ham" (the soi-disant football team), and I said to my pals "write down West Ham _United_ , as this guy doesn't know anything about football and will surely insist upon it" ... and so it proved, despite howls of protest from other quizzers.

We do a different pub quiz now :)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> If you are into this kind of stuff, I'd highly recommend Kevin Mitnick's book 'Art of intrusion'. The first chapter describes how a group of engineers (I'd think somewhere in the 80s, early 90's) reverse engineered a popular Las Vegas poker machine, and managed to walk away with milions in profit.

<comment><USER31> Here's another good read:

[https://www.wired.com/2014/10/cheating-video- poker/](https://www.wired.com/2014/10/cheating-video-poker/)

</comment></comment><comment><USER32> Applaud the ambition, but please be careful. People go to jail in the US for trying to hack or cheat at gambling games.

</comment><comment><USER33> Cool project (legal/ethical issues aside)! My big question is why bother with OCR at all? Presumably you can construct a representation of the screen for each question ahead of time, and you already solve the projective transform due to the camera, so at that point why not pick some appropriate distance metric and pick the question/answer pair corresponding to the virtual image that is closest to the camera image?

<comment><AUTHOR> They mix up the answers. And sometimes choose 4 answers from a possible selection of 20.

<comment><USER33> Ah that makes sense. Thanks

</comment></comment></comment><comment><USER34> Yikes.

Using this is almost certainly illegal (cheating) in every jurisdiction, and could have significant penalties.

This video and the github repository itself could be a crime... teaching someone how to cheat using a cheating device. Heck even publicizing the video could get one sucked into the potential mess.

Intention may play a part (i.e. was there any criminal intent in making the video/code/etc). Would depend entirely on jurisdiction and the specifics of the legislation.

Sure... it's a fun/cool project with lots of tricky parts to get right/play with. But I think the author should exercise a bit more caution. If you need a lawyer to be sure that your project won't land you in jail... perhaps choosing a different project would be a good idea.

<comment><USER35> Which specific law(s) do you believe this breaks? While it is illegal for the house to cheat most places, and while a punter may break other laws trying to cheat (e.g. trespassing, tampering, etc), I'm not aware of a specific law against cheating. I'm also not aware of a law banning the distribution of materials that may help one cheat (except DMCA? Copyright?).

<comment><USER36> Depends on the jurisdiction but for example in Las Vegas ([http://www.gambling-law-us.com/State-Laws/Nevada/](http://www.gambling-law- us.com/State-Laws/Nevada/)) I believe this would fall under NRS 465.070 numbers 2, 5, and/or 7.

<comment><USER37> Well, this cheat is equivalent in operation to having a book with all the answers to the quiz and a good index. The two should be equivalently legal, and I strongly suspect someone has tried to sit at a quiz machine with a curated indexed encyclopedia, so we just have to find that precedent.

<comment><USER38> There won't be a precedent because you just can't look up into fast enough, that's why these systems can still exist even with internet search engines.

</comment></comment></comment></comment></comment><comment><USER39> Is the use of this code as described legal? If so why not milk it? If not why risk assisting?

<comment><USER40> Probably a good way to get beat up by casino thugs I'd imagine.

<comment><USER41> "I'm just curious. I saw you shuffling your checks with your right hand. Can you do that with both hands?"

</comment></comment></comment><comment><USER42> Reminds me of [https://priceonomics.com/the-man-who-got-no- whammies/](https://priceonomics.com/the-man-who-got-no-whammies/)

</comment><comment><USER7> Just FYI everyone, using any electronic device to gain an edge at any regulated gambling game is a felony in Nevada, and it is one that they take incredibly seriously. If you are caught doing this in Nevada, and they will certainly be watching for this now that this has been posted, you _will_ go to jail. I cannot speak for any other jurisdiction, but I'd highly recommend not using this in Vegas or Reno.

<comment><USER43> Any electronic device huh... time to go mechanical!

</comment></comment><comment><USER44> This is a really clever and interesting project - thanks for sharing. How on earth did you come across the ROM for this game?

<comment><AUTHOR> Many hours of searching through internet archives of dead forums. I don't think you can find it any more.

<comment><USER45> Do you plan to mirror it somewhere (e.g. throw on bittorrent for a bit)?

<comment><AUTHOR> Nah this was really just a fun side-project, just posting as proof-of-hack. Also this specific game was retired from machines. Fun as a challenge, though!

</comment></comment></comment></comment><comment><USER46> Man, I read 'butthole camera' instead of 'buttonhole camera' and was confused (and curious). I need more coffee...

[Plus I find I am not the first; including wording -- so weird...]

</comment><comment><USER44> Looking at the cpp code, could you describe the prototype/pattern image? What sort of prep do you do to make it generally recognizable as the questions/answers change?

</comment><comment><USER47> be careful with this hack and similar ones...real-life casinos have an entire SOC monitoring absolutely everything on the floor and in the parking lot.

Speaking from experience: As a young and foolish lad I was once arrested and spent four days in the frigid Clark county detention center in Nevada for stealing a set of dice from an unattended craps table over a holiday weekend. I made it about five paces from the table before I was arrested by four guards.

</comment><comment><USER48> So what should the book (following the example of "The Newtonian Casino") be called? I mean, what is actually nontrivial (pun intended) here?

<comment><USER10> For non-Brits, "The Newtonian Casino" is probably more commonly known as "The Eudaemonic Pie". It's about a group in the 70s using electronic devices to clock roulette wheels to predict the general area of the wheel the ball would fall into and make better bets.

An earlier attempt by Thorp (of "Beat the Dealer", probably the most famous blackjack counting book) and Claude Shannon (yes, that Claude Shannon) is covered in part of the book "Fortune's Formula".

<comment><USER4> This article [0] explains nicely the story of Claude Shannon et al trying to win at roulette.

[0] [http://nautil.us/issue/50/emergence/claude-shannon-the- las-v...](http://nautil.us/issue/50/emergence/claude-shannon-the-las-vegas- cheat)

<comment><AUTHOR> Yes! This was very much inspired by Shannon and Thorp. I love that story.

</comment></comment></comment></comment><comment><USER49> this probably isn't a slot machine game you'd find at a casino...

</comment><comment><USER50> Very cool! What accuracy rate were you able to achieve?

<comment><AUTHOR> Accuracy is high enough!

<comment><USER51> Would it also be a crime to just remember every question and answer in the game?

</comment></comment></comment><comment><USER52> Anybody rich yet?

</comment><comment><USER53> Raspberry Pi is slow for image processing. You can probably greatly increase speed if you take smaller images or downsize them before processing.

<comment><USER54> This is covered in the article. The image is sent to a backpack laptop for processing.

</comment></comment><comment><USER55> the rep is dated 2 years ago?

<comment><USER56> Exactly and some "peculiar" edits in the readme... Seems to be for a UK specific machine.

<comment><USER55> I guess this guy has been milking his code and is rich by now!

</comment></comment></comment><comment><USER57> So... Can you not just memorize the questions?

</comment><comment><USER58> All I have to say is that I misread this headline and experienced both disappointment and relief when I clicked through and read about a 'buttonhole' camera.

<comment><AUTHOR> V2 will be available as a custom suppository.

<comment><USER59> in which case you will need to implement a cavity-search algorithm

<comment><USER60> Depth-first, of course.

</comment></comment></comment></comment><comment><USER61> Man, I read butthole and thought this was a totally different kind of project.

<comment><AUTHOR> V2 will be available as a custom suppository.</comment></comment>


Blockchain-beater? A new approach to consensus - <AUTHOR> http://sammantics.com/blog/2016/7/27/hashgraph-consensus <comment><AUTHOR> This part makes me think that, after consensus is reached for the first X transactions, that's effectively like a Ripple blockchain. Except with no central validators:

 _Imagine a cryptocurrency, where each transaction is a statement "transfer X coins from wallet Y to wallet Z". At some point, the community will reach a consensus on the exact ordering of the first 100 transactions. At that time, each member of the community can calculate exactly how many coins are in each wallet after processing those 100 transactions (in the consensus order), before processing transaction number 101. They will therefore agree on the "state", which is the list of amounts of coins in all the non-empty wallets. Each of them digitally signs that state. They gossip their signatures. So then each member will end up having a copy of the state along with the signatures from most of the community. This combination of the state and list of signatures is something that mathematically proves exactly how much money everyone had after transaction 100. It proves it in a way that is transferrable: a member could show this to a court of law, to prove that Alice had 10 coins after transaction 100 and before transaction 101. _</comment>