Just Enough Piracy Can Be a Good Thing - <AUTHOR> https://sloanreview.mit.edu/article/just-enough-piracy-can-be-a-good-thing/ <comment><USER2> To me, the strongest case for "Just enough piracy" has less to do with competition, and more to do with preserving dead media. There is so much media out there which is out of print and not available to stream, and would be completely inaccessible if not for piracy.

<comment><USER3> There are so many works that are a crazy tangle of copyright that make it quite impossible to legally get a hold of them.

Shows where individual characters have their copyright held by various estates (where the original copyright holder has been dead for fifty years), the music rights have reverted back to various production companies, and the distribution rights have been sold and split and re-sold so many times the only way to discover who owns them is to let yourself get sued.

<comment><USER4> I would love a system semi-similar to trademarks. If a copyrighted work is unavailable outside the second-hand market for three consecutive years, noncommercial redistribution becomes legal.

Sane trademark expiration could end up making this partially moot, however.

<comment><USER5> As you note, trademarks are potentially permanent. So even when they copyright of a work expires, the characters, may still be locked up under trademark protection.

</comment></comment></comment></comment><comment><USER6> Ironic coming from an MIT blog. Do they remember that Aaron Swartz committed suicide after being arrested by MIT police for "pirating" PDFs from MIT's JSTOR?

<comment><USER7> "MIT police" is a misnomer. They were just police, assigned to MIT.

MIT also declined to press charges for trespass when asked by police.

<comment><USER8> "MIT police" is absolutely not a misnomer: they are a civilian police force tied to the University, with their jurisdiction set to the bounds of MIT property.[0] Their website is a .mit.edu address.[1]

Your second statement is misleading, in that MIT did not decline to press charges, they just declined to press charges with regard to criminal trespass and breaking-and-entering.[2] Interestingly, the MIT police arraigned Swartz on precisely those charges; it was only later that the charges under the Computer Fraud and Abuse Act were used.[3]

Further, MIT insisted on seeking time-behind-bars for Swartz! From the Wikipedia article for US v Aaron Swartz: 'Marty Weinberg [Swartz's lawyer] said he nearly negotiated a plea bargain in which Swartz would not serve any time. "JSTOR signed off on it," he said, "but MIT would not."'[4]

So, all-in-all, I would say it is pretty ironic coming from an MIT blog.

[0] [https://en.wikipedia.org/wiki/Massachusetts_Institute_of_Tec...](https://en.wikipedia.org/wiki/Massachusetts_Institute_of_Technology_Police_Department)

[1] [https://police.mit.edu/](https://police.mit.edu/)

[2] [https://web.archive.org/web/20150912185122/https://www.polit...](https://web.archive.org/web/20150912185122/https://www.politico.com/blogs/under- the-radar/2011/07/mit-also-pressing-charges-against-hacking-suspect-037709)

[3] [https://en.wikipedia.org/wiki/Aaron_Swartz](https://en.wikipedia.org/wiki/Aaron_Swartz)

[4] [https://en.wikipedia.org/wiki/United_States_v._Swartz](https://en.wikipedia.org/wiki/United_States_v._Swartz)

<comment><USER7> What I said:

> MIT also declined to press charges for trespass

What you said:

> they just declined to press charges with regard to criminal trespass and > breaking-and-entering.

Where is the misleading nature of what I said about pressing charges?

<comment><USER9> You're technically right but it sounds like they went farther than just charging him for trespassing. You make it sound like they didn't even charge him for trespassing.

</comment></comment></comment></comment></comment><comment><USER10> I'll go several steps further: intellectual property is an invalid form of ownership and shouldn't exist at all. Piracy is always a just action because the monopoly over information given to people by the state is morally wrong.

"Intellectual property" is fundamentally different from classical property because information is not an exclusive good. If I hold an apple, you cannot hold the same apple, but we can both hold a digital copy with the same information.

There is no evidence that intellectual property is necessary for innovation or creative endeavors. There are many many ways to monetize creation including but not limited to subscription, donation, live shows, advertisement, and commission. [http://www.dklevine.com/general/intellectual/againstfinal.ht...](http://www.dklevine.com/general/intellectual/againstfinal.htm)

<comment><USER11> This is terribly naive. When digital replication is easy -- as it is with arts like music or software -- piracy destroys innovation and hurts creators who want to earn a living by selling their creations. It's not like the farmers or the apartment owners are going to let people "pirate" a warm place to sleep or a good meal.

IP haters often point to people who've successfully managed to encourage pseudo-piracy and made money. The Grateful Dead, for instance, let people freely copy mix tapes of their concerts and made their money on gate revenues. (They didn't let people in for free. Nope. )

If digital piracy is unchecked, then it forces artists to dream up other ways to make money. This creates inefficiencies and it just isn't fair to those who just want to sell their creations without holding a concert or drumming up some other scheme to get people to pay. Most "open source" companies spend endless hours trying to concoct ways to open source just enough of their product while forcing enough people to pay so everyone can eat.

I've found that most of the people who speak like pitaj are in universities and they make their money through some mixture of outrageous tuition bills that can't be dodged or government funding from taxes that can't be escaped.

There's no such thing as a free lunch.

<comment><USER12> The vast majority of human expression was created before the concept of "IP" existed. The business models we've had in the last few hundred years are the aberration, not the other way around.

Creators aren't entitled to a "fair" world. Nobody is.

Speaking of "fairness": How is it "fair" that someone should be entitled to profit again-and-again from a single act of work, just because that work was "creative"? Shouldn't the laborers who carried the stones to build a bridge be entitled to an ongoing royalty paid by everyone who crosses?

<comment><USER13>
       just because that work was "creative"?

That's where the IP theory all falls down. Originality or uniqueness doesn't exists, creation is all about recreating from what you learned from others. Creation is stealing in a moral and respectful way. Protecting your creations with IP laws is immoral and unrespectful against your public and previous artists you took from

<comment><USER14> That's a straw man. Copyright doesn't prohibit someone from learning from your work. It prohibits (in the US) five specific acts: reproduction, preparation of derivative works, distribution of copies, public performance, and display. You don't need to be able to define a work of purely unique expression. All you need to be able to do is define when a work is sufficiently original that it's not a derivative work or reproduction.

<comment><USER13> 1\. Protecting with IP ¡= Copyright

2\. I didn't say Copyright prevents others from learning

3\. A work is never sufficiently original, it's always a derivative

</comment></comment></comment></comment></comment></comment><comment><USER15> > In this case, HBO charges cable operators, such as Comcast, a monthly per- > subscriber fee, corresponding to the wholesale price, and each cable > operator decides on its own margin, which determines the final retail price.

There are so many holes here. Lets see how difficult an accounting analysis of piracy is, because interpretations of an absence of data could lead to opposite conclusions.

HBO is now owned by AT&T, some of whose Internet subscribers pirate HBO shows, so how does AT&T account for that in its books? Is that a "loss"? Is it passing on surplus to the consumer?

The answer is it doesn't. There's no such thing as a GAAP piracy charge. Nobody would believe it. Estimates from industry lobbies of the cost of piracy have never shown up in a finance charge the same way that say a "goodwill writedown" has.

Conversely, content pirates value their fast Internet connections and pay more for better speeds! You will _never_ see a major corporation attribute revenue to an illegal activity, so that value is/was permanently _unmeasurable_.

What about changes over time? There are so many confounding disruptions in the creative content business. Game of Thrones, the article's leading example, was _itself_ a disruption in the content business! It's really hard to do a cause and effect here, because the most attractive interpretation--post hoc/now was caused by the past--is going to be the least durable.

This piracy analysis stuff is really abstract and often misses the point. The best thing you can personally do to support creative work is to pay for it!

Although what is really debated here is the role of middlemen in discovery, profit-maximization, etc., so I personally do something a little different: I make an effort to pay for _new_ creators most of all, because new creators are worst represented in corporate and mass-consumer interests.

</comment><comment><USER16> "Online piracy is like fouling in basketball. You want to penalize it to prevent it from getting out of control, but any effort to actually eliminate it would be a cure much worse than the disease."

[https://slate.com/business/2012/01/sopa-stopping-online- pira...](https://slate.com/business/2012/01/sopa-stopping-online-piracy-would- be-a-social-and-economic-disaster.html)

When I was a poor college student I pirated a lot of stuff. Now that I'm a wealthy engineer I've gone back and bought all the stuff I pirated and wanted to keep watching or listening to.

</comment><comment><USER17> Piracy has always been about the balance between price and convenience. Since Netflix can't produce Game of Thrones, and HBO can't produce Stranger Things, they experience no real competition in regards to _product_. They are selling you convenience under the guise of a product. If you want to watch a show, you have one place you can find it (in the scope of streaming, sure you can spring $20 a season on amazon, but there is a reason the streaming industry exists in the first place). This is where piracy steps in, it provides competition on _product_ under the guise of _convenience_.

</comment><comment><USER18> Bill Gates is perfectly aware of the fact that a good part of Microsoft's employees started learning about computers on illegal copies of Windows, for example. And it couldn't have happen otherwise - at least for non OECD or 1st world countries.

<comment><USER19> Whole countries started to be Microsoft clients from having installed pirate Windows and Office on every PC. At least two generations of coders were nurtured on that ("Developers! Developers! Developers!"). Also hordes of other professionals like designers and animators (Adobe, Autodesk etc).

<comment><USER18> Correct, my people too (Romanians)

</comment></comment></comment><comment><USER20> At a certain point - people are weighing the cost of the good (cable bundle, HBO Now, etc) vs the moral guilt + expected value of litigation (costs of piracy). When the cost is not absurd, (seems like most people are willing to pay $10-$15 a month), the decision is pretty clear (i.e. buy Netflix).

The middle man taking a cut is the problem. It jacks up the price to a point where it's too high - and piracy becomes extremely attractive (especially when it is __more convenient __to pirate a good than to buy it).

To me, the article is really describing why middle men in this supply chain harm both the creator and the consumer. That's why applying pricing pressure in the form of piracy actually benefits both the creator and consumer (and could potentially even help the middle man find the profit maximizing price, although that depends on the "Just Enough" piracy level).

But isn't this kind of true much of the time? Removing a superfluous middle man will reduce costs and make everyone better off. But unfortunately, the middle man often provides value - they aggregate lots of content and own the customer experience.

Businesses and technologies that attack the middle man are very interesting. Shopify for e-commerce is potentially another example.

</comment><comment><USER21> In esports, piracy was essential for the Starcraft: Brood War competitive scene. Players around the world, and specifically PC Bangs in S Korea, installed pirated copies of the game on their various machines, allowing numerous patrons to play at once. This piracy was part of a multi-factorial exponential growth in the popularity of the game there, and led to fame/success for Blizzard's SC2 release a few years later.

<comment><USER22> While that's true to an extent, you could also say that Blizzard learned its lesson with Starcraft and Diablo 2 piracy and designed future games like World of Warcraft and Diablo III such that you had to connect to Battle.net to authorize your copy, even if you only wanted to play offline (Diablo 3).

A full-featured copy of Starcraft will be playable 50 years from now, regardless of whether Blizzard is still around or not. You can't guarantee that for most games these days.

<comment><USER23> > Blizzard learned its lesson

> you had to connect to Battle.net to authorize your copy, even if you only > wanted to play offline

Didn't work for me. This is one of the major contributors to me giving up on gaming. That and pay to win. IMO I should be able to buy a single player game that's all inclusive and not have to be connected to the internet to play it.

<comment><USER22> Same here, although my gaming is limited to FIFA and the Borderlands series. FIFA IMO is unplayable now because the whole experience is built around Ultimate Team which requires buying "cards" for the top players. The game would be unrecognizable to someone who last played say, Fifa 2010 which still had a standard team-based play structure without these additional in-app payments.

</comment></comment></comment></comment><comment><USER24> "companies and platforms can make gains through a positive network effect (the more people use the product, the more valuable it becomes) and consumer learning (pirate users may learn about the product and buy the legal version later on)."

IIRC, when China was opening up and Windows and Office were listed at the top of the Most Pirated charts, Bill Gates commented that he thought it was OK because it is essentially starting market saturation, i.e., getting the Chinese hooked on Windows products.

I'm not sure it worked out so well that way. Anyone have any current data on how well MS is doing vs other software platforms in China?

<comment><USER25> Piracy basically shaped Brazil's video game industry [1]. I'd say the market we have right now would not be the same if it wasn't for a whole generation (or more than one!) getting hooked to games that would never be accessible if it wasn't for piracy.

It is anedoctal, but I never bought an original game until my late teens. When I finally had the means to buy original copies and support content creators, I did. If I don't want to pay for a game that I find too expensive or not worth, I don't download it anymore, since I already have so many options to choose from.

[1] [https://www.redbull.com/nz-en/the-history-of-video-games- in-...](https://www.redbull.com/nz-en/the-history-of-video-games-in-brazil)

</comment></comment><comment><USER26> I believe we can clearly see how not having enough piracy can hurt technological advances in Japan. Since Japanese people don't download illegal stuff streaming services are not as developed there as in the US. For example, you can't find as much Japanese music on Spotify.

<comment><USER21> I don't follow...are you claiming that no piracy leads to less streaming services? Couldn't one easily defend the opposite, that a lot of music on streaming services would drive users to get free versions via piracy?

<comment><USER26> I believe streaming services are a response to piracy and I know a lot of people that stopped using torrents because of Netflix and Spotify.

</comment></comment></comment><comment><USER27> I would be happier paying for media if I just received what I wanted. Instead, I see ads I don't want to see, often disturbing ads since violence is so much a part of media these days, or just sloppy guesses based on guessificial intelligence. These interruptions are focused on distracting me at any cost, with the belief that's the only goal ("killing time" is a phrase that's often used). As well, all the media companies are biased toward their own offerings, so it's inherently filtered. From what I understand about well-organized privacy, it has none of these issues.

</comment><comment><USER28> Wherever you come out on the authors' core argument, this is an important perspective to consider. Companies need to open their minds about phenomena they ultimately can't fully control. Seeing piracy as an issue with some level of nuance, rather than attacking it without context, is simply more productive.

</comment><comment><USER29> Every industry whose product can be replicated very cheaply like fashion or food get absolutely no protectionisms.

The reason the 'copyright' industry has protections is because their rapid change in media. Theatre -> VCR-> DVD -> blueray -> digital. They have been able to reproduce their product at extreme lost cost and charge people over and over produced large sums of money.

They used that money from their golden age to lobby for protections they shouldn't have. These protections will go away in a few decades, possibly sooner.

<comment><USER30> > These protections will go away in a few decades, possibly sooner.

I doubt it, Walt Disney died over 5 decades ago, yet Disney is still plenty busy lobbying for more copyright extensions [0].

Considering how much money they have available, and are still making, I'd be really surprised if they didn't manage to drag this on for pretty much forever. Especially considering they are not the only powerful entity lobbying in that direction.

[0] [https://en.wikipedia.org/wiki/Copyright_Term_Extension_Act](https://en.wikipedia.org/wiki/Copyright_Term_Extension_Act)

<comment><USER31> There hasn't really been movement for another extension and it's already "late" in terms of keeping the status quo forever: the Bono act was in 1998 and tacked on 20 years, so some works actually entered the public domain in the United States at the start of 2019.

</comment></comment></comment><comment><USER32> I have a bigger problem with how IP law is written and enforced than the actual notion of IP law. It doesn't seem unreasonable to me that IP should enjoy some protections, however, the current enforcements are in many cases downright abusive to consumers and smaller creators alike.

<comment><USER33> What about the use of taxpayer funds to enforce ownership of ideas? That seems like putting wrong incentives in place. If the state effectively enforces ownership of ideas, then the cost of enforcement is paid by almost nobody who benefits from that enforcement. It's going to distort markets big time.

</comment></comment><comment><USER34> I pay netflix but still use popcorn time because its simpler. I think media should consider a patreon-like service: pay for a virtual ticket to watch our show legally and with clear conscience, but watch it anywhere it is convenient.

</comment><comment><USER35> For future digital archives pirated material is a really good thing! Most commercial distribution of modern media usually has protection in the form of Digital rights management DRM. That means that libraries and archives cannot copy, convert and preserve the media information. With pirated material digital archives can do their work. Thus what is not legal and bad right now, may very well be looked very favorably upon in the future. I do not defend piracy in general and think that creators should be paid.

Also do current digital media services even compensate artist and creators fairly? Most artists cannot live of income solely from Spotify they need todo concerts.

</comment><comment><USER36> This episode of "The Giant Beast That Is The Global Economy" covers piracy and discusses the negative side (potential loss of profit) as well as the positive side (it forces innovation to keep ahead of the pirates).

[https://www.amazon.com/gp/video/detail/B07NVVRV7F/ref=stream...](https://www.amazon.com/gp/video/detail/B07NVVRV7F/ref=stream_prime_hd_ep?autoplay=1&t=0)

</comment><comment><USER37> Just enough copyright is also a good thing. But the current duration is way too long.

</comment><comment><USER38> Maybe content creators should give away more stuff for free?

20% of downloads per month or something? Or a lottery?

Or maybe this indicates that their prices are too high?

If 50% of the viewers pirated, maybe a 50% lower price would be good? Maybe another value...don't know.

</comment><comment><USER39> _Arrr..._

(that's probably enough)

</comment><comment><USER40> "Please give me an excuse to justify stealing tv shows."

<comment><USER41> I can't agree more. People here often think in terms of open source software, Red Hat, and so on and so forth without realising that Netflix, HBO and the likes have built empires on top of intellectual property...of the content they have. Whining because you don't have access to your favourite series unless you pay a fee doesn't justify having stuff for free.

That the copyright laws are outdated given the current technological landscape is something we can agree on. That its replacement should be the law of the jungle, well, count me out from that.

<comment><USER42> Content companies have repeatedly demonstrated that they do not care about cultural preservation.

Just as one example, the original versions of Star Wars shown in theaters are essentially lost now. Lucas re-cut them for home release and added horrible color grading, CGI, and even plot points. There isn't a franchise much more culturally important than Star Wars, and they can't even preserve that.

It took the (copyright-infringing) work of individual fans to try to re-create them as best as they can, and they've done a very good job. But those original prints are sitting in a warehouse somewhere, rotting away, never to be scanned in the quality available today.

<comment><USER43> 99.99% of pirates don't give a shit about "preserving culture" and just want to do the mental gymnastics necessary to rip off content creators

<comment><USER42> I just can't sympathize with the giant content monopolies until they stop with the bullshit. A lot of content is region locked, so you can't even stream it at all without a VPN or good old-fashioned piracy. They regularly pull content from one streaming service once the contract expires, and it gets moved to yet another streaming service.

I think making moral arguments about piracy is a mistake. If these companies really cared about it, they would make it more convenient to stream than to pirate. And it was going in a good direction with Netflix up until everyone decided they needed their own streaming service with exclusive content.

<comment><USER44> Bingo - every argument about a company's right to money falls through when companies simply don't care about consumers being able to consume their content in a reasonable manner.

For eg - instead of making a website available directly to people overseas they instead license to a local monopoly that puts it on inferior systems that are mega overpriced simply because the content is not "local"</comment></comment></comment></comment></comment></comment>


Ask HN: Best way to search and collect platform-agnostic podcast links? - <AUTHOR> I'm looking to introduce my parents to some podcasts I've been listening to in an effort to expand their minds and stave off their inevitable senility (kidding [kinda]).
I listen with the terrible Apple Podcasts app (open to suggestions here too), but my parents use Google and so I'm not going to link them to the Itunes page.
However, I can't seem to find a good search engine that will allow me to search "Philosophize This!" and get back links that they can use to subscribe and start listening easily.
Does such a service exist, or is there a better approach I can use? <comment><USER2> [https://gpodder.net](https://gpodder.net) allows you to synchronise various (partially/non-overlapping) podcast lists to multiple devices and easily add new podcasts you don't find on the service's website. So you can actually just set up compatible podcast clients on the devices of your parents and let them enjoy new episodes without even bothering them with the actual links and the whole process of subscribing to new feeds (unless when they explicitly want to do it either through the client or manually on the website).

<comment><USER3> there are clients for meego, webos, symbian, maemo, and a native client for osx, but no ios client ?

[https://gpoddernet.readthedocs.io/en/latest/user/clients.htm...](https://gpoddernet.readthedocs.io/en/latest/user/clients.html)

nonetheless it looks like there are some possibly decent curation / search features, certainly better than the apple podcasts app / itunes.

</comment></comment><comment><USER4> I'd recommend Pocketcasts as a multiplatiform podcast app. It has recommendations, trending, and search. If you want to leave it you can export an OPML file with your subscriptions.

It's not free (pay once per platform, including web app), but worth it to me because I'm a podcast junkie. I was using it on Android for a year, switched to iPhone, and all my subscriptions are there.

I switch back and forth between the web app and iOS frequently, and it syncs across them.

</comment><comment><USER5> Podcast Addict [1] is great, has a search feature and is awesome on Android. Free too.

[1] [https://play.google.com/store/apps/details?id=com.bambuna.po...](https://play.google.com/store/apps/details?id=com.bambuna.podcastaddict&hl=en)

</comment><comment><USER6> There's a podcast search engine called Listen Notes: [https://www.listennotes.com/](https://www.listennotes.com/)

I just tried a search for "Philosophize This!" and it did indeed find some episodes, and you can even play them right on the page.

<comment><USER7> I'm the maker of Listen Notes. Thanks for sharing Listen Notes here :)

Early this year, I was hoping someone could build a very basic podacast search engine that allowed me to search the whole internet's podcast episodes -- searching meta data is good enough; no fancy AI needed. I didn't want to subscribe yet another podcast -- I've subscribed to way too many podcasts already... I wanted to find episodes, listen, then move on.

Of course, I couldn't find such podcast search engine, so I built Listen Notes. The first prototype of Listen Notes was indeed a "I can build this in a weekend" type side project :)

</comment></comment><comment><USER8> Can't recommend PocketCasts enough, it's really all you need.

One of the nice things about it is it will sync episode progress across devices, so if you pause on one app, you can resume playback on another.

<comment><USER9> I've used PocketCasts for quite a while now and would move away from it if there was a decent (cross-platform) alternative. It has some serious problems downloading (I think it actually hits their mirror of all podcasts, and the downloads will stall out for several minutes at a time). And for some reason streaming a podcast is the app's worst fear and it has a UX to do everything it can to stop you from doing it.

</comment></comment><comment><USER10> I use PocketCasts on iOS and web. If you both switch to a platform-agnostic option like that, then sharing should be easier.

<comment><USER11> Pocket Casts is great. Platform-independent listen progress sync alone is worth the few bucks it costs.

</comment></comment><comment><USER12> I'm not sure I understand your Q, but if you are looking for basically a subscribe link that will work for your parents on Android, just find the RSS feed for that podcast (should be easy enough), and then plug it into this service: [http://subscribeonandroid.com](http://subscribeonandroid.com)

It will create a link that will subscribe them on their chosen podcast app on Android. If they haven't chosen an app yet, it will provide them a list of options.

Hope that helps.

<comment><USER13> This obviously works, you can even use iTunes as the source of the RSS feeds, there's not really anything proprietary to how Apple did podcasts, its just a database of the RSS feeds - just right click the podcast search result in iTunes and click "Copy Podcast URL".

However, copying RSS feed links is a pretty terrible way to discover content. Most normal people want a search or recommendation engine of some kind (you liked x, you will probably love y), which is why virtually every podcast app offers access to searching some kind of RSS feed database of podcasts within the app.

If you were to go with your approach, I'd personally still consider using iTunes as the search engine for the RSS urls, most podcast app makers seem to agree Apple's database is pretty much the most complete out there, probably largely by dint of being the first to really focus on building a database of these feeds.

As to format: virtually every podcast feed in existence is constant bitrate MP3 (confirmed by several different podcast directory maintainers), so this isn't really a concern. There are various technical reasons why historically podcasts have had to avoid VBR/other audio formats. CBR MP3 is guaranteed to playback without issue on almost anything, including your car stereo from 10 years ago.

<comment><USER14> I just really hate that there doesn't appear to be any way of getting RSS links to podcasts from Apple's database using just a browser. I have no other reason to have itunes installed and won't be installing it just for this.

<comment><USER15> You can use this service to extract the RSS link from iTunes podcasts.

[http://itunes.so-nik.com/](http://itunes.so-nik.com/)

<comment><USER16> I use this all the time! A lot of podcasts hide their RSS feeds for some reason. Either that or they're using SoundCloud, and they really don't make feeds easy to find over there.

</comment></comment></comment></comment></comment><comment><USER17> Pocket Casts is by far superior in my experience. Will cost you $9, but worth it.

</comment><comment><USER18> [https://www.overcast.fm](https://www.overcast.fm) \- search bar at the top, finds podcasts.

free app available, though it's iOS only. Syncs with web version though.

<comment><USER3> overcast also supports audio file uploads landing in an "uploads" playlist; if the OP wants a super low-friction way to seed the parents' listening, that could be one way. just grab the mp3 versions of a few episodes and drop them in there, don't have to mess with getting them to subscribe to things.

an annoying misfeature I have noticed with a lot of podcasts is that the feed URL only includes the latest N (usually 100) episodes, and if you want to listen from the beginning you have to do so "by hand" by visiting each episode's web page and either downloading the episode or listening in the browser. For one podcast with a predictable URL format for episodes, I pieced together an .xml file by hand that referred to all the episodes. It was super janky but I was able to pretend that it was the actual podcast's URL just fine.

</comment></comment><comment><USER19> On Android, AntennaPod is open-source and provides integrated search of iTunes, FYYD, and gpodder.net . You can also copy/paste a URL, for example if you were to find the URL for them and send it to them.

Its interface takes a little getting used to, and search results don't always hit (which I view to be a matter of the sources searched, rather than the app).

That said, it's a quite solid app. And free of crap-ware.

<comment><USER20> Seconded.

AntennaPod supports the two ways I want to add a podcast: search and by url. Haven't run into the problem of it not finding anything either (but if I did, I agree that it's not the app's fault).

Recommend it 100%.

</comment></comment><comment><USER21> [https://www.podchaser.com](https://www.podchaser.com) is a sort of IMDB for podcasts, if that helps.

</comment><comment><USER22> I used to use itunes.so-nik.com to extract podcast urls but it looks like it's down right now. Thankfully they posted the code on github so you can just run the PHP script yourself:

[https://gist.github.com/christophermoura/d02370349c9f06e597f...](https://gist.github.com/christophermoura/d02370349c9f06e597fa36a922732ede)

</comment><comment><USER23> [https://www.audiosear.ch/](https://www.audiosear.ch/)

"Audiosear.ch is a one-stop search and recommendation engine for podcasts. We transcribe, timestamp, tag, cluster, and collect ratings and reviews for thousands of shows."

<comment><USER24> They're shutting down soon though, so probably not the best recommendation.

</comment></comment><comment><USER25> I would highly recommend signing up for [http://banter.fm](http://banter.fm) . It's limited to a small group right now, but once they launch, your parents are going to love it. Very easy to consume and engage.

<comment><USER26> Can you explain what it does? I signed up for the beta, but there isn't much explanation on the site and I haven't received an invitation yet.

<comment><USER25> It's a social network for podcasts which helps me discover new and interesting episodes without actually subscribing to those shows; I really enjoy being able to discuss each episode with my followers. Banter is also a sexy podcast players that makes listening to shows enjoyable.

</comment></comment></comment><comment><USER27> I started using [https://www.breaker.audio/](https://www.breaker.audio/) (iOS & Android) I really recommend it

</comment><comment><USER28> Maybe Stitcher? It has a web app: [https://app.stitcher.com/](https://app.stitcher.com/)

</comment><comment><USER29> Pocketcast's search is pretty great. Check out this screenshot of searching for "Philosophize This". [https://goo.gl/EM2wdj](https://goo.gl/EM2wdj)

In order to subscribe, you just click on the + button.

[shameless plug follows]

I am working on a revolutionary new podcast app, Voce. It's a podcast player that unlocks multimedia content buried within your favorite episodes and makes expert curated show notes available in real time.

Check it out here: [http://voceapp.com](http://voceapp.com)

</comment><comment><USER30> BeyondPod is good on Android.

</comment><comment><USER31> Breaker.audio

</comment><comment><USER32> libsyn</comment>


Did Qatar pay a billion dollar ransom? - <AUTHOR> https://www.bbc.co.uk/news/world-middle-east-44660369? <comment><USER2> So did they or didn't they? Are they asking the readers? Is this our homework assignment that we are supposed to answer and turn in to the bbc?

Can the news start reporting on facts?

Read the article only to find out that we don't know who the kidnappers are, if and how much they got, how much cash qatar sent to iraq, etc.

Whenever I read articles like this, it leaves me angry and wanting to never read anything from the BBC again. What's even more frustrating is that the BBC is government funded and not dependent on advertisers and they have no reason to clickbait.

<comment><USER3> It's an interesting story. The only reason the information is out because a government hostile to the parties released the information.

<comment><USER4> How do you even authenticate the info if it's from a hostile government?

<comment><USER5> Qatar not denying it is half way to authenticating it.

Audio recordings get you 90% of the way.

Carefully checking transcripts and metadata for errors gets you further still.

Managing to get the same transcripts from the intelligence agencies of another country (either legitimately by asking, or covertly through "journalistic contacts") takes you to 99%...

You can never be 100% sure, but presumably the above met the BBC's standards for reporting.

</comment></comment></comment></comment><comment><USER6> This story reminds me of a book that I read a few months ago called "Never Split the Difference". It's a negotiation book by a former FBI hostage negotiator. I think the context of that book offers some color to this story, and I'd highly recommend it.

EDIT: I think the contextual question that arises from that book is: How does the idea of "the enemy of my enemy is my friend" play out in multi-sided negotiations with such high stakes?

<comment><USER7> Could you provide a short summary? I've never heard of it.

<comment><USER6> It lays out many of the basic principles by which the FBI negotiates with kidnappers. The author writes that the book is meant to first lay out the foundations, and then build on them to give the reader a toolbox (arsenal?) of negotiation strategies. An argument in the book is that these strategies work in business as well - I find this argument compelling. The title of the book is in reference to the fact that you can't split humans. The job of a hostage negotiator isn't to get half a human back by compromising. The negotiator has to get 100% of what they want, or the mission is failed.

<comment><USER8> But I'm vaguely remembering several occasions where hostage negotiators do take less than 100% of their goal. Examples are where they initially secure the release of "weaker" hostages, such as those in need of medical attention, elderly, etc... In those cases, I'm guessing that's an easy win for the negotiators, since I doubt a hostage-taker necessarily wants a hostage that can't readily move, or dies on them unexpectedly, without having gained anything from a release/bargain. (grim topic...)

<comment><USER9> That's more to start the release and get the idea of releasing hostages into the kidnappers heads. Once they have released one it sets the stage they can release them.

<comment><USER8> yes, good points (along with user zck). My point is that it's a bit misleading to say these types of negotiations are all or nothing. There are incremental steps that work towards the ultimate 100% goal, which are valuable on their own, without reaching 100% goal. Clearly achieving 100% of their goal is always the objective, but I don't see "splitting the difference" as being contrary to that.

Example:

FBI: release all the injured hostages, and as a good faith measure we'll turn the water back on.

HOSTAGE TAKER: I'll only release 3 critically injured if you turn the water on now.

(some back and forth, where the hostage taker offers the 3 critically injured + 1 child, and doesn't seem willing to move their position any further, and precious time is being lost for the critically injured)

FBI: Ok, the water is back-on, we're waiting to receive the 3 critically injured + 1 child.

I'm no expert, so possibly that's not how it would go. Would the negotiator only take their initial offer while risking the lives of injured hostages? But the "all or nothing" label belies that there surely must be some back-and- forth with compromises along the way.

Of course you're never splitting humans, but you are splitting groups of humans, and perhaps plenty of other differences.

</comment></comment></comment></comment></comment></comment><comment><USER10> > _These were obtained by a government hostile to Qatar and passed to the > BBC._

How long until governments with access to required backdoors just start openly blackmailing citizens of "hostile" countries?

Without a doubt it's already happening. Resist all back doors.

<comment><USER5> Bet that government was the UK, as part of the Five Eyes program, which has significant surveillance hardware in the middle east.

Almost certainly the USA used that equipment and grabbed those transcripts to give to close ally Saudi Arabia, who used them to turn states against Qatar.

The first world war was caused by the killing of a duke, the third world war will be caused by a clumsily worded text message from a president to his wife, misinterpreted by another powerful nation state.

<comment><USER11> There must never be a third world war, it would imperil human civilization itself. There can never even be a total war between two major powers anymore. Our weapons are just too awful.

Unfortunately I'm not sure that our politicians self-preservation instincts, strong as they may be, trump their egos (sorry for the pun.)

<comment><USER5> I'm of the belief that a world war today, which immediately launched all existing weapons to cause as much damage as possible, probably wouldn't wipe out the human race.

As soon as you launch that many weapons, and kill such a high percentage of people, you eliminate the possibility of manufacturing new weapons, so the war would be instantly over.

And I believe that despite others simulations to the contrary, there will be small groups of people who will stay underground for years, surviving on tinned etc. food. After 5-10 years, radiation levels will still very high, but most dust will have settled, and the skies clear enough to start to grow crops and rebuild.

Humans, as well as many other creatures, will become more radiation hardened over generations, and given the bountiful supplies of tech and resources left over from our civilization, will be able to quickly repopulate the world.

<comment><USER11> I agree fully, it's absurd to think of wiping out the human race. There is basically no disaster that would leave the Earth intact but wipe us out. We're the most adaptable species the world has ever known and we're everywhere.

I said civilization would collapse in a dire nuclear war scenario, which is not the same thing. Advanced civilization itself may actually be quite fragile - we see glimmers of that fragility now and again when government / order / utilities break down for prolonged periods.

</comment></comment></comment></comment></comment><comment><USER12> > These were obtained by a government hostile to Qatar and passed to the BBC.

Israel?

<comment><USER13> saudis?

<comment><USER14> Emiratis ?

</comment></comment></comment><comment><USER15> How did Hezbollah AND fundamentalist Salafi groups end up with the money? In my limited understanding those two groups don't like each other. Or is that enough money for them to put aside their differences?

</comment><comment><USER16> If Qatar wanted to support terrorism, it's plausible the terrorists could pretend to kidnap those people. The hostages would suffer voluntarily due to religious reasons to make it look legit.

<comment><USER7> There's a lot of underhanded ways to fund terrorism that don't involve having your family kidnapped, like the US did with the Taliban by calling them freedom fighters or something against Russia - see also Rambo. It's easy for rich people or even a country to 'lose' money.

</comment></comment><comment><USER17> I stopped reading at this bit:

"These were obtained by a government hostile to Qatar and passed to the BBC."

Uhuh. So... how did you verify them?

<comment><USER18> Uhh RTFA?

"Qatari officials accept that the texts and voicemails are genuine, though they believe they have been edited "very selectively" to give a misleading impression."

</comment></comment><comment><USER19> This is why government by royal families doesn't work. When the state and the family are the same thing, the inevitable family crisis become a national crisis. A billion-dollar ransom that then sparks a trade war? This is a group of families fighting a petty grudge match against a background of slight religious differences, reminiscent of the worst of the Tudors.

<comment><USER20> I think it only matters what type of people are in charge. Democracy won't protect your country, only whether those who have taken an oath to defend the rule of law, their country, and their vote, actually do. See recent events.

[https://www.washingtonpost.com/opinions/trump-replaces- natio...](https://www.washingtonpost.com/opinions/trump-replaces-national- pride-with-personal- vanity/2018/07/16/d8c8605e-8927-11e8-8aea-86e88ae760d8_story.html)

<comment><USER21> Good systems are resilient to bad leaders. See the Roman Empire or England for example, neither has any shortage of bad emperors/kings and both avoided violent regime changes or subjugation by a foreign power for many hundreds of years (and counting in England's case)

<comment><USER22> I'll go further and say that if there is a system, it's precisely to be resilient to bad leaders. If leaders can effectively lead, why have a system over them ? e.g. a system that works when everyone acts out of good will is redundant.

<comment><USER23> > If leaders can effectively lead, why have a system over them ?

Do you mean, 'if the leader is perfect, why not give them absolute power?' The problems with that question seem obvious to me.

<comment><USER24> Which is why the OP proposed that (rhetorical) question... we have systems in place _because_ we can't expect perfection, nor should the system require all actors to be acting in good faith to function.

So far I haven't seen any evidence that this has not been the case in the US (that the system of controls has failed or has been circumvented). Unless of course you take rhetoric at face value over measuring real-life actions and realistic outcomes, as is popular in partisan politics these days.

</comment></comment></comment></comment></comment></comment><comment><USER25> Are they launching another world cup bid?</comment>


Amazon EventBridge is generally available now - <AUTHOR> https://aws.amazon.com/blogs/aws/amazon-eventbridge-event-driven-aws-integration-for-your-saas-applications/ <comment><AUTHOR> But no Cloudformation and CDK support yet!</comment>


Show HN: TANX – WebGL online tank battle game - <AUTHOR> https://tanx.io <comment><USER2> Wish the WASD was lined up with the skewed layout, feels "crooked" to me

</comment><comment><USER3> Nice!

Just needs some bots for when there's no one else around.</comment>


Show HN: Interactive ES6, ES2016, ES2017 cheatsheet – 47 runnable code samples - <AUTHOR> https://es2017.io/ <comment><USER2> Hugely helpful, many thanks.

Please be aware though that this page caused my laptop fans to go absolutely nuts & get VERY hot.</comment>


Mark Cuban Is Wrong: The "People" Don't Want Net Neutrality, Elites Do - <AUTHOR> http://reason.com/blog/2014/11/14/mark-cuban-is-wrong-the-people-dont-want?n_play=546668fae4b03c653a24bcdd

<comment><USER2> Wait wait wait. So we're seriously taking the Ayn Rand Objectivist argument seriously on the Net Neutrality debate?

If you want a good reference on why this is a bad idea please watch: [https://www.youtube.com/watch?v=_8m8cQI4DgM](https://www.youtube.com/watch?v=_8m8cQI4DgM) Last week tonight makes a good summery of just why this is dumb.

<comment><USER3> what does that link have to do with net neutrality?</comment></comment>


Submit shameful recruiter actions to - <AUTHOR> http://shame.heroku.com/

<comment><USER2> This is an interesting app, but I fail to see the use of it after I forward my spam onto the service. I can't click on the submissions to see what other types of spam there are or what other people consider 'recruiter spam'.

There's also a privacy issue with displaying other people's full names (probably pulled from the email headers).

Without any feedback about the submission, it would be easy to game the system and skew the results by forwarding emails to the email address listed.

Lastly, IMHO there's a bit of spamminess to the whole service because now the service now has now verified email addresses. Who's to say that the service wasn't setup by another recruiting agency looking to increase their cold-call database?</comment>


Tarsnap email confirmation bypass - <AUTHOR> http://www.daemonology.net/blog/2015-09-04-tarsnap-email-confirmation-bypass.html <comment><USER2> The value of writing comments intended for your future self was confirmed in a strange way for me: I once found myself googling some faintly obscure question of systems programming, and soon found an article that answered my question perfectly. At that point I noticed with considerable surprise that I was reading a web archive of a Usenet posting I had made myself, some 10 years prior - of all the people to randomly run into on the Internet, your past self is one of the strangest.

<comment><USER3> That's happened to me, but unfortunately I've mostly found my old questions, not my old answers!

<comment><USER4> I've had this happen to me a few times, but usually it's "I've answered this before for someone else, and now I have the same question. What was my answer again?"

</comment></comment></comment><comment><USER5> There was a paper a couple years ago out of Microsoft research (if I recall correctly), that looked at a number of vulnerabilities in OAuth as used by Facebook, Twitter, and a few others. The ah-hah moment for me, though, was that they identified these vulnerabilities by turning the usual view of a web app inside-out: instead of viewing the client/browser as one endpoint on a communications channel, they treated the browser as a _de facto_ man-in-the- middle. For OAuth, it is responsible for passing along messages between the OAuth provider and the authentication requesting website. In the case described in this article, the browser is just a MITM for a server sending messages to itself.

<comment><USER6> I haven't seen that paper, but it strikes me as being exactly the right model. A lot of vulnerabilities on the web seem to arise from the tension between the goal to require as little persistent state as possible to serve requests, and the browser as a public channel that any non-persisted state must be sent across.

</comment></comment><comment><USER7> I love writeups like this, and enjoyed the level of detail Colin provided.

I take away a different lesson, though: even simple web security is easy to get wrong, even for a very smart, very talented developer. I'm not sure what the solution is, though.

As for the comments, while I don't take a hard line here, I agree with Bob Martin's quote: "Every time you write a comment, you should grimace and feel the failure of your ability of expression." Wherever possible, you are better off rewriting the code and variable names to clarify _in the code itself_ whatever you wanted to say in the comments. It's hard to say how to accomplish that here without knowing more about the code, though. And it may have been so difficult that a comment was the right choice.

<comment><USER8> Code can only tell you about the implementation - never the intent. Taking an example from my code yesterday:

        $config->{template} = $container->template;

There's not much can be clarified here, I don't think. But it tells you precisely nothing about why it's required in this instance.

(There's no spec for the file format - all have the `template` key in the `container` section but some also have it in the `config` section. Since I can't change these files, I have to deal with the duality. But you'd never be able to guess that from this code without a comment.)

<comment><USER7> > Code can only tell you about the implementation - never the intent.

Maybe in some purely technical sense this is true, but in a meaningful one it isn't. At an absolute minimum, names reveal intent -- which is why naming is so important.

Regarding your other example, you are always free to wrap what you don't control in objects that have the intention-revealing semantics (read: correctly named behavior) that you desire.

It's impossible to tell from that single line of code if there are other options as well (the surrounding context is missing, and that's where meaning comes from), but you always have some options. I'll grant that in some cases the cure is worse than the disease -- that is, the changes needed to truly reveal your intent in the code would lead to over-engineered complexity. But typically I find that is not the case.

<comment><USER9> Naming at the higher level is important (type names). But locals, eh, it's unlikeky that you can comprehend lines without the full context, as you say. And our working memory is limited. So might as well use 1- or 2-char names and keep the code less and thus more easily kept in-head. If this is confusing, there's probably too many locals, so setup new scopes (either by nesting or via separate functions).

<comment><USER7> I agree higher level names are far more important.

But I think clarity at the local level is nice, too. Let's say your function takes a name, sanitizes it, and then does some other processing, perhaps storing it. I think this makes the code more immediately clear than 2 character names:

        function storeName(name) {
            safeName = sanitize(name);
            // do other stuff that works with safeName
            //...
        }

<comment><USER9> In that case it's better to rebind name instead of introducing a new binding - it makes it impossible to misuse it. I hate languages that don't let me rebind (or sometimes, not even shadow).

</comment></comment></comment></comment></comment></comment><comment><USER10> Lesson of the day: Hidden form values are not hidden from the user, they just aren't plainly visible to the user on screen.

Never "hide" sensitive data in those hidden input fields.

</comment><comment><USER11> I love that colin got trapped by his weirdly pedantic obsession with Canadian invoices. I hope the next bug involves picodollars.

<comment><USER12> What you call a "weirdly pedantic obsession" is me trying to not break the law.

</comment></comment><comment><USER13> > That last part is ultimately the most important lesson from this: Comments > matter!

In most cases, logically granular commits with good commit messages, and a knowledge of `git log` and `git blame` etc, is better than leaving comments. Comments can easily get out of sync with reality (see [https://twitter.com/nzkoz/status/538892801941848064](https://twitter.com/nzkoz/status/538892801941848064) ) and create a lot of noise that make reading the code harder (especially when the comment and code contradict each other).

I only leave brief comments where some code is necessary but at a glance doesn't look right, or has a non-obvious reason. But first I find a way to make it look right or be obvious.

<comment><USER9> Comments are helpful as an overview of a module, briefly outlining what the goals and major ideas. I'm currently starting to work on a large project, all in C, heavily manually threaded, with essentially zero comments. It's open source so I can't complain, but boy does it make figuring things out difficult. Especially in C, where so much code is pushing bytes and pointers around, that there could easily be unintended functionality that might not be desired.

Getting devs to write separate documentation is more difficult than comments, and is more likely to get out of sync. Better if they write some general overview inline. (On the opposite end, I also recently reviewed a project that has almost no comments, except on calls to malloc and free, with comments "get some memory" and "release memory".)

</comment></comment><comment><USER14> Does he mean "token" instead of "cookie"?

<comment><USER12> A token is something you are given so that you can give to someone else. A cookie is a token where the "someone else" is the person who originally gave it to you.

I meant cookie.

<comment><USER14> > it sends that cookie to you as part of a URL in the confirmation email

This certainly isn't a web cookie in the sense that I'm used to (a cookie would be a part of the HTTP header, and you can't specify that header in a URL). It is more like a token as I understand it. Maybe what you are describing is how the web cookie term was started (based on the behavior of generating a thing that someone else gives back to you) but it doesn't sound like a cookie at all to me.

<comment><USER12> Yes, HTTP cookies are so named because they're... well, cookies. The concept is more general and was around long before HTTP though.

</comment></comment></comment></comment><comment><USER15> tl;dr

a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie/token being hidden, but present in the HTML code.

also, there is no bug bounties for the tarsnap website, only for tarsnap code.

<comment><USER12> _a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie /token being hidden, but present in the HTML code._

That's a decent summary, but I didn't think I was all _that_ long-winded...

<comment><USER16> Maybe the guy who found the bug won't get $1000, according to your rules, but he definitely deserves a cookie.

<comment><USER17> Please don't turn this place into a pun-fest.

</comment></comment></comment></comment><comment><USER18> thankyou x</comment>


How to leave as a technical co-founder - <AUTHOR> http://pastebin.com/a3qkaPBu <comment><USER2> I have no idea, but I know that I will face this exact situation in a few years.</comment>


Rust implementations of abstract algebraic structures - <AUTHOR> https://gitlab.com/ornamentist/un-algebra <comment><USER2> In my opinion, the best way to learn about abstract algebraic structures is to sit down with a book and write some proofs. That's the purpose of these structures, to provide a minimal language for describing the behavior of mathematical objects for the purpose of exposition or proof. For example, prove that given any element g of a finite group G that there exists a positive integer k such that g^k is the identity element.

"Implementing" (with big scare quotes) algebraic structures by essentially implementing what appear to be "interfaces" (or traits or type classes or ...) might give you a brief "aha!" about what an abstract algebraic structure is on the surface, but won't give much insight or practical use beyond that. Critically, one of the many hugely lacking aspects in this approach to implementing these structures in a language like Rust (or Haskell or ...) is that one needs to prove that these interfaces satisfy the axiomatic laws of the structure.

I maintain a library that allows one to compute with groups of permutations. The entire library—thousands of lines of fiddly code—is dedicated to one and only one algebraic structure (the group) on one and only one kind of object (the permutation). Countless papers have been written about just this combination, and should give you some appreciation for the depth of this subject. Slapping on a "identity" and "mul" implementation to a "Permutation" object doesn't do justice.

<comment><USER3> As you say, the big problem is you can't express rules. I don't think that rules out using code to understand these things, but you're better off starting with something like LEAN.

<comment><USER2> It's one of the issues. The other is that you quickly will want to work with these algebraic structures as objects themselves. When the algebraic structure is encoded as a protocol, you won't be able to manipulate them as first-class values. For instance, you'll want this if you want to do things like factorizing groups, constructing products (like the semi direct product), computing graded algebras, computing homomorphisms, constructing Groebner bases, etc.

<comment><USER3> Yeah, you need dependent typing to do that in a programming language. But as cool as dependently typed languages are, developing serious software in them remains a bit of a research problem. Idris is closest, but it also less convenient for actual proofs.

</comment></comment></comment></comment><comment><USER4> Looks very nice and straightforward. Otherwise, seems similar to alga: [https://docs.rs/alga/0.9.2/alga/](https://docs.rs/alga/0.9.2/alga/)</comment>


Limiting passwords to 12 characters is "secure enough" - <AUTHOR> http://forums.stardock.com/439802 <comment><USER2> If a 12-char password is "secure enough" today, then a 16-char password is obviously even more secure and future-proof. Not to mention a 30-char password, or a password that contains more special characters than what your dumb webapp allows.

Not to mention that a 30-char purely alphabetic passphrase such as xkcd.com/936 is so much easier to remember (i.e. less likely to be written on a post-it note) and type into today's mobile devices (i.e. more likely to log out properly, because it's easier to log in the next time) than a 12-char password with two numbers and one symbol in it. What I'm trying to say is that _there is more to password strength than the time it takes for a botnet to brute-force it_. Humans are the weakest link in most security systems. If you want strong security, you need to design your system so that humans can interact with it without too much mental strain.

Nowadays, anything less than [\x20-\xFE]{8,64} is just a lame excuse for storing passwords in a plain-text VARCHAR field without proper escaping. Therefore, if your password policy as any more restrictive than [\x20-\xFE]{8,64}, I'm going to assume that you store my passwords in a plain- text VARCHAR field without proper escaping.

<comment><USER3> Here are two real world issues that could arise

[http://vbuterin.blogspot.ca/2011/08/password-strength- rebutt...](http://vbuterin.blogspot.ca/2011/08/password-strength-rebuttal- to.html)

I think some cryptographers and security people have given rebuttals as well but I can't find them at the moment.

<comment><USER2> Interesting, but I think the author is focusing too much on the desktop experience. Try typing 'Tr0ub4dor&3' vs. 'correct horse battery staple' on a phone. Having to shift between alternate layouts every other character is not only annoying but also makes you prone to forget which character you were trying to type. With a full-size keyboard, on the other hand, you can rely on muscle memory to get it right without even thinking. As for shoulder surfing, I find it rather difficult to shoulder-surf someone who is typing on a glossy 4-inch screen, and you can always choose unusual words/spellings to throw off people who try to guess. Corrupt hearse buttery scalpels!

<comment><USER3> I agree that it would be a better system for phones. I'm not sure about full size keyboards. Muscle memory will allow you to learn the password with only simple characters more quickly but eventually both will be learned. Then the only factor that matters is how accurately the user can type. I don't think muscle memory could ever get 100% accuracy for typing one character correctly. Anything less than 100% and longer passwords will be worse. If you type a key correctly 99.9% of the time then you will lose about twice as much of your time to wrong password entries with an 11 vs 20 char password.

</comment></comment></comment></comment><comment><USER4> As I see it, character limits aren't so much about security, as just a dumb way to be hostile to the user. All of my passwords are site-specific unique passwords generated by a password manager. I don't care if you store plain- text passwords, because if someone steals passwords out of your database then they already have all the access that my password to your site would've given.

But if a site rejects the password that my password manager generated (16 chars [a-zA-Z0-9]), then I have to work around it, make a password manually, and it's generally a pain in the ass that shouldn't be necessary. And since I'm doing it right and these sites doing it wrong, I'm not inclined to be forgiving.

<comment><USER5> Isn't there research out there that proves long sentences and phrases are better than any random alpha numeric password

<comment><USER6> No. And preliminary research suggests that they are easier to crack.

[http://arstechnica.com/security/2013/01/grammar-badness- make...](http://arstechnica.com/security/2013/01/grammar-badness-makes- cracking-harder-the-long-password/)

Legitimately randomly generated passwords still win, as long as the server uses a salt with bcrypt or iterated hashing like PBKDF1 or PBKDF2.

</comment></comment></comment><comment><USER7> Ah, yes, there's nothing quite like a condescending representative entirely out of his depth telling you to "do the maths" to show your customers that you really care about their security and privacy. I wish you good luck in getting them to listen to you.

<comment><USER8> That entire thread was cringe-worthy. At least the last company I reported something similar to came back with "our developers are looking into the problem, and we will probably switch out the login scheme in the next few weeks". Whether they actually did it or not, who knows, but at least they acknowledged it.

</comment></comment><comment><USER9> This is far from the worst offender.

Banks are typically the worst. All sorts of gimmicky password requirements. 8-12 characters. Must have one capital letter. Must have one number. No special symbols.

So "I can't believe it's not butter!" won't work, yet that would probably be a pretty secure password, and be entirely rememberable. In fact I could come up with a silly pun-filled sentence for each site I visit and make passwords fun again.

<comment><AUTHOR> The poor state of bank passwords is fresh in my head from working on taxes tonight. It's kinda sad that the message boards I use for non-sense are probably more secure than my banks with respect to password handling.

That said, I don't think Stardock gets a free pass just because a lot of banks suck at it.

<comment><USER9> Nobody gets a free pass. Didn't mean to imply that. They all suck, it's just a matter of venting :)

</comment></comment></comment><comment><USER10> Even if they were brute-forcing, a new GPU cluster can do 350 billion guesses per second. [http://arstechnica.com/security/2012/12/25-gpu-cluster- crack...](http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every- standard-windows-password-in-6-hours/) That means an average of 78 days to crack an individual password, even with no heuristics about which passwords are more likely.

<comment><USER11> The first step is to convince them that the database is not actually failsafe if even companies like Linkedin can't do it. Then convince them that it matters if the password leaks (you should use unique ones anyway, but everyone knows that not everyone does). Only then this kind of offline brute-forcing is an argument.

</comment></comment><comment><USER12> When I complained to my bank about their 12 character limit they told me...

 _"12 characters is already hard enough to remember."_

Sigh.

<comment><USER13> I would have just responded - "You know 'Lord of the rings' the movie, right? The title of that movie is a 17 character password. Is that hard to remember?"

<comment><USER2> It is kinda hard to remember if you need to pepper it with numbers and special characters to comply with the bank's rules.

        L0rd_ofthe$Ring5

</comment></comment></comment><comment><USER14> Get a whole heap of passwords from random.org. Create a text file with the sites you use with the usernames/passwords. PGP Encrypt the whole ensamble with a good strong password. The only one you really need to remember.

Forget your password? Once you reset via email, as soon as you get access to that encrypted file, get a new random password and reset it again. Save the new password in the encrypted file.

Password managers often connect to the internet to retrieve your passwords so if you lose your access, you're SOL. I also wouldn't trust a browser plugin as that may be prone to compromise. Backup to your laptop or something if you need to take it with you, but keep it encrypted until needed.

Forget the password to the encrypted text file? Throw your life away and start a new identity.

Edit: Pointed out below (and I agree whole-heartedly) use /dev/u(a)random

And idupree's points are spot on.

<comment><USER15> (my tinfoil hat mode: I don't even have any important secrets but I believe in knowing how to protect them)

Use /dev/urandom, not a website. Make sure you have configured your text editor not to automatically save any backup files, cut buffers, or the like, and never write it to disk in unencrypted form. (I use vim >= 7.3 and its blowfish encryption; see encryptedvimrc and random_alnum in my scripts <https://github.com/idupree/scripts> ) If you copy/paste passwords, make sure you don't have a clipboard manager that persists recent history to disk. Also, encrypt your filesystem in case you screw up on any of the above. If you have swap, make sure that's encrypted with a generated-per-boot-from-urandom key generated after loading last boot's stored entropy from the disk. (A dedicated password-managing program might do some of these things for you. I haven't looked into their security methods yet; have you?)

If you can, use an email provider for your acct-registrations that uses decent security practices; use a high-entropy password for it; use different email addresses for every site, to make it harder for social engineering attacks (someone calling, say, Amazon or Apple's call center pretending to be you). The latter is probably hard unless you use your own domain or think '+' addresses are sufficient. If you use your own domain, you're vulnerable to your registrar or your account with them or your DNS being compromised, but you should have rigorous passwords and good registrars here because losing your domain name stinks. If malware gets on your computer, it can watch you and steal your passwords, so keep your system and browser up-to-date with security updates, disable riskier parts of your system that you can live without, prefer OSes/systems that are more on top of their security, and don't make enemies.

I don't understand why password managers like OnePass store passwords online; everything else they're doing as browser plugins is fighting the good fight. (True, there are risks of giving the browser the ability to access your passwords at all; but they're probably less than the risks of password reuse and low password entropy, and greater convenience means more people will use the system for more sites. Firefox Sync is the only consumer-friendly online storage that I've seen and consider well-engineered-&-documented enough to consider trusting. Tarsnap and Tahoe-LAFS also meet everything but the "consumer-friendly" bit there, and have a somewhat different focus. It may be worth considering encrypted online mirrors legitimate (online _mirrors_ , not sole copies) for the sake of people who don't do backups, have multiple devices, and/or have their disk fail or device stolen.).

<comment><USER16> I think you mean LastPass or 1Password.

Startup idea: the email equivalent of 1Password.

You give each site a completely unique, distinct yet valid email address. They forward to your real email address and vice versa.

This way if one email is compromised you know where the spam is coming from plus it reduces email tracking and correlation.

<comment><USER17> At least the last time I used it, Google Checkout had an opt-in feature that would create a unique unguessable email address the first time you purchased something from a shop, and this email address would be proxied to your GMail account.

<comment><USER16> While that is nice, I was thinking of a more distributed model (not necessarily hosted by Google)

</comment></comment></comment></comment></comment><comment><AUTHOR> Stardock deleted the thread after it started to get some attention. Here is a partial screen capture: <http://i.imgur.com/R5gs8HC.png>

Unfortunately, it's missing some of the newer (and frankly, ignorant and cavalier) replies from their tech support guy.

</comment><comment><USER18> Reading comments in this thread have been very enlightening. I am wondering if there is a best practices or guidelines for password storage for web service operators.

I currently manage a web service that has about 1,000 registered users. I have taken the most restrictive path to storing password in database except I need to make sure user/password database is portable from one host to another. Reading the comments, I am getting the impression that such portability may not be a good thing. But then how can I migrate from one host to another or restore backups?

Are there documented good practices for storing passwords in database that also allow portability.

<comment><USER19> Simple rules for the bare minimum

\- never store plain text password \- never store direct hash of password \- use a salt (must be stored) and hash password and salt

Ideally salt and hash of password/salt are in different databases.

Avoiding MD5 is recommended, but if you are at the point of worrying about that, you have bigger issues.

<comment><USER13> I agree with everything you said except the "store in two different databases" line. If someone has compromised your system responsible for handling authentication then presumably they'd have access to both databases regardless - unless you've designed some kind of complex API for generating the salt and secured that API behind a whole different set of security and authentication (which almost everyone is too lazy to do).

The salt is just there to stop rainbow tables being generated, and if you're really evil to add computational overhead, it isn't meant to be used in a game of hide and seek.

</comment></comment></comment><comment><USER20> I'm not so sure anymore about the password length limitations (or any other weird password requirements for that matter).

For the longest time I was wondering why my bank would ONLY allow a 5 digit password, alphanumerical only and it MUST contain at least one letter as well as one number, while they let you choose your own username completely free of any restrictions, including special characters. After thinking about it for quite some time, I remembered all these sites where your password had to be as least 6 characters (now 8 seems to be a general minimum).

By forcing users to use EXACTLY 5 characters at least you cannot use the SAME password your already using for your mail and whatnot, except for the fact that there is nothing preventing your from simply dropping the last character (but you sure would NEVER do that, would you ;-), assuming of course you already have letters as well as numbers within the first 5 characters.

While 5 characters seems extremely weak, If you get it wrong 3 times, your account is locked. Locked as in "you have to call them and identify yourself with A LOT OF DETAILS about your account and transactions" to unlock it and reset your password.

I have no idea how they store passwords and it doesn't really matter to me, while it probably should. They are a BANK and if they get hacked and their customer password database gets compromised, I am sure they will have worse problems to take care of.

What I would really like to see is their evaluation of security versus added support work for locked accounts.

<comment><USER17> You are incorrect. The policy is that users get locked out after 3 attempts... until attackers get smart enough to bruit force through the usernames, 3 wrong passwords each.

80% of the customers getting locked out of their bank accounts at 5 PM on a Friday only happens once before the bank changes policies to something that allows the attackers to perform a rate-limited attack on the 5-character passwords. The new lockout policy goes into effect before the bank can force everyone to upgrade their passwords.

GAME OVER

</comment></comment><comment><USER11> They deleted the topic. Nice way to treat your customers...

</comment><comment><USER21> Skype Passwordlimit: 12 Charakters. Windows Live Passwordlimit: 16 Charakters. Paypal Passwordlimit: 20 Charakters. It's stupid to put this limit on passwordinputs that should get hashed anyways. Twitter, Facebook, Google Password Limit: >100 Charakters.

</comment><comment><USER11> Added a rather lengthy comment, hopefully convincing them a bit. Let me know if I should edit anything! My username there is the same as here.

<http://forums.stardock.com/439802/page/1/#3315302>

</comment><comment><USER22> In theory it is secure enough - you should not be allowing a password attempt every second on an account and unlimited attempts per day per account.

But of course we should be using pass-sentences by now.

<comment><USER7> > I'm not concerned that someone is going to brute-force my password

Please read the article before commenting. The OP's concern is that all of the passwords are sitting in plaintext in a questionably-secure database somewhere.

<comment><USER22> I stand corrected, there is absolutely no excuse for plaintext passwords.

</comment></comment></comment><comment><USER23> Bill Cheswick, of the "Firewalls and Internet Security; Repelling the Wily Hacker" fame, gives a great talk called "Rethinking Passwords" calling for a better solution:

<http://www.youtube.com/watch?v=KRVRlhrLKkI> [video, 22 min] <http://web.cheswick.com/ches/talks/rethink.pdf> [slides]

</comment><comment><USER24> I blogged about week ago: Some funny stuff for a change: I told my colleagues that we receive at least 5000 "hack attempts" aka failed logins daily to any of our public Internet facing servers. One of my colleagues just said to me: "Well, you're having such a ______password policy, that maybe those are actually failed login attempts and not hack attempts at all." - It really got me laughing. Yes, passwords, especially long complex and random ones are painful for users. Here's password of the day (opening and closing quotes aren't included in the password):"^j'lb#K-€3, <_úgWJdXå(n_6=41Bµ%cj!" Btw. Good luck guessing the password or finding it out using SHA-1 hashs or so. I know it's possible, it just might take a while. ;) p.s. This password still got less than 256 bits of entropy. I never really intented anyone to actually remember the passwords. I personally consider passwords as "shared secret", which is just a blob of random bits.

<comment><USER25> Passwords have been compromised before by being captured in server logs that ended up being accessible.

If you are logging failed password attempts anywhere, then you've got a security hole.

Here's the details on the breach I'm talking about <http://ieeelog.com/>

</comment></comment><comment><USER26> What about 5 characters? Saw this today on a product that claims "We use advanced technology in a security–rich environment"

<https://twitter.com/humbit/status/297417037989429248/photo/1>

</comment><comment><USER27> I've seen worse. There's a UK company called The Train Line ( <http://www.thetrainline.com/> ) that handles money, and limits passwords to 10 chars with no punctuation characters.

<comment><USER28> I don't understand why you are so upset. Just edit the HTML and set maxlength to anything you want. It will seal a deal. :D

<comment><USER27> As far as I can tell, it's checked on the server side too. But I might have another go at it tonight to be sure. The worst that could happen is that I get a longer, more secure password ;)

<comment><USER29> The worst that can happen when you mess with form field lengths: no validation on entry to the database, but validation later when pulling it out to check it, so you're now locked out of your account.

<comment><USER27> Interesting, I didn't know that. So the worst that could happen is that I'd be locked out of their horribly insecure site and forced to use something better. I don't re-use passwords, and I declined to let them store my credit card details, so when they get hax0red, I won't lose anything worth stealing.

</comment></comment></comment></comment></comment><comment><USER30> Even "Microsoft Accounts" have a 16 character limit on their passwords.

</comment><comment><USER31> ..and now the thread has been deleted after some further criticism...

<comment><AUTHOR> Here is a partial screen capture: <http://i.imgur.com/R5gs8HC.png>

Unfortunately, it's missing some of the newer (and frankly, ignorant and cavalier) replies from the tech support guy.

</comment></comment><comment><USER32> I've added a comment, please verify.

<http://forums.stardock.com/439802/page/1/#3315287>

<comment><USER11> Read it, seems good to me. I added a comment as well (not in response to you).

</comment></comment><comment><USER33> Security red flag: passwords are "secure enough."

</comment><comment><USER34> Technically, if they are using bcrypt hashes with a high enough work factor, and salt then with something like UserID, then 12 characters is pretty damn secure even if their whole DB gets leaked.

Of course, there's no good reason to limit passwords to any length.

<comment><USER35> Again, the point isn't about whether 12 is enough. It could have been 64 and the point would still stand. The OP's point is that limiting password length (to anything less than 1000 or so) is usually done to be able to set a maximum length on the password column of a database. Password hashes, on the other hand (including bcrypt), produce fixed-length hashes, regardless of the input size.

<comment><USER36> bcrypt has a 50 char limit. You could always prehash(sha256) the password before passing it to bcrypt.

<comment><USER37> It's 72 actually. I thought it was 56 as mentioned on the original [?] BCrypt website[1]. A thread[2] on security/stackexchange discusses a workaround for the 72 char limit. See <https://gist.github.com/4690368> for a simple test case that shows the >72 char truncation.

The source provides a hint:

        /* Schneier specifies a maximum key length of 56 bytes.
        * This ensures that every key bit affects every cipher
        * bit.  However, the subkeys can hold up to 72 bytes.
        * Warning: For normal blowfish encryption only 56 bytes
        * of the key affect all cipherbits.
        */

[1] <http://bcrypt.sourceforge.net/>

[2] [http://security.stackexchange.com/questions/21524/bcrypts-72...](http://security.stackexchange.com/questions/21524/bcrypts-72-character- limit-and-using-it-as-a-general-digest-algorithm)

</comment></comment></comment></comment><comment> guard-of-terra Passwords are bullshit. We should have a start-up about having a better way of keeping your digital identity other than hundreds of logins/passwords, but obviously everyone is too busy with figuring out better ways of sharing lolcats.

Not that lolcats are bad. They are good. It's just they aren't fun anymore once your identity is stolen. Or your mom's.

<comment><USER38> "better way of keeping your digital identity"

We'll get you a seared flesh barcode, for your birthday, on your forehead. Hands-free Facebook logins for life! Are you excited?

<comment> guard-of-terra It's actually not very safe.

</comment></comment></comment><comment><USER38> If your password is 100,000,000 characters long, that's simply a waste of bandwidth, CPU time, space on the disk * millions of users * 1000s of iterations = money flushed down the toilet. And remember web servers have timeout parameters spread across half a dozen config files. You're just asking for trouble. Not worth it. To protect one self-important nitwit's video game password? Even your million character password could be sniffed or worse, the attacker might offer a hot apple pie with ice cream.

<comment><USER39> that isn't the point. the point is if there is a limit on character length, its a clear indication that the passwords aren't being properly handled.

<comment><USER38> Let's see you implement it then smartypants. So you can learn the hard way why there is a limit. You think you're smarter than the biggest technology companies on the planet? It's a clear indication of nothing but your own little vendetta driving you crazy.

<comment><USER40> If you can't handle arbitrary-length strings, you pretty much don't know how to program. Really.

</comment></comment></comment></comment><comment><USER41> Any user input needs to be filtered, sanitized, validated and limited. Please be my guest and pass any user input to your magic hashing function, don't cry about it later because due to some special circumstances / framework bug / language bug / buffer overflow / extra hidden utf char, your magic function opens a huge security hole. oh oops.

<comment><USER42> Um what? If your hashing library hasn't been tested with a arbitrary sequences of bytes you have bigger problems than limiting user input to 12 characters.</comment></comment>


Ask HN: What are some good sites to buy a (used/new) car? - <AUTHOR> Are there any startups or other in this space that aren't the usual incumbents? <comment><USER2> Great question. Invariably when researching different models you come across the forums where some critical part of the car has failed costing the owner thousands to repair, and yet after a while it becomes clear that every model has its share of lemons. So then you are back to cobbling together information from a bunch of distributed sources which is a pain, and prone to bias from fans of particular models etc. I would love to see something in this area and even better, a startup that can undercut the ridiculous mark up of second hand cars from dealers, but still offer cars that are guaranteed not to be lemons.

</comment><comment><USER3> For used, checkout [https://www.cargurus.com](https://www.cargurus.com) and [https://www.carsforsale.com](https://www.carsforsale.com)

<comment><AUTHOR> Thanks!</comment></comment>