18yo arrested for reporting a bug in the new Budapest e-Ticket system - <AUTHOR> https://blog.marai.me/2017/07/24/18-year-old-arrested-bkk-tsystems-e-ticket/ <comment><USER2> I remember coming across a serious bug in a site that belonged to a top multi- billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found.

Protection from this kind of blame-shifting and misdirected retaliation should be guaranteed by law. Until it is, bugs in critical and important infrastructure will go on unreported, and remain available for malicious actors to exploit.

<comment><USER3> I'm having trouble understanding what exactly an org's thought process is when they elect to prosecute someone for reporting a security issue.

Would they also prosecute a person who told them one of their doors was left unlocked after-hours?

A normal person's reaction upon being told "You left your keys in the lock" is usually gratitude, not calling the cops.

EDIT: Is it suspicion? "Hmm...this person found an unlocked door, which means they were clearly trying all the doors. Don't like that. Who knows what else they found but didn't report." Which is understandable, but clearly counter- productive. If the person was a malicious actor, they obviously wouldn't go to the trouble of reporting in the first place.

<comment><USER4> My guess would be:

\- BKK is the client of T-Systems. They have a contract for the development and maintenance of this system which might contain clauses about liability or indemnification in cases of hacking, security bugs, negligency, etc.

\- This guy reported it to BKK who obviously don't have any technical knowledge

\- BKK (the client) forwards the email to T-Systems (the contractor): "What's this about? Looks like hacking or something."

\- Now T-Systems has two options: 1. Blame it on the guy, or 2. Take the blame for overpromising and screwing it up, possibly taking a financial loss of an unkown amount (depending on the contract and how widespread exploitation was)

<comment><USER5> That's unlikely. Every if you don't develop the system on your own and buy it from a third party (be it T-Systems or someone else), you still need technical expertise to prepare the requirements, evaluate the proposed solution (possibly proposals from multiple vendors) and do then do acceptance testing. So the "BKK obviously don't have any technical knowledge" claim is bogus.

It's possible the particular BKK person dealing with the report does not have technical knowledge, but that's more a fail on BKK side as they let incompetent people to deal with reports of security incidents.

But I'd bet it's merely a matter of covering broken shit and shifting blame. BKK is (probably?) a public company, managing transport in the capital city. They manage a lot of money, and it's not uncommon to funnel lucrative contracts to friendly companies, even if it increases price and the quality is dubious. Whoever came up with this project / awarded the contract / accepted the solution is probably scared people might start digging into the details. Better blame the problems on a hacker!

<comment><USER6> > Every if you don't develop the system on your own and buy it from a third > party (be it T-Systems or someone else), you still need technical expertise > to prepare the requirements, evaluate the proposed solution (possibly > proposals from multiple vendors) and do then do acceptance testing.

I don't think this is true. When you buy a house, do you have to be able to do the specification and evaluate? This is a good analogy, because T-Systems have delivered similar solutions to other clients, what they needed here is a little bit of tailoring and integration (which is not the part that failed).

<comment><USER7> It is common for a typical western government to have domain specialists, working directly for them, to help write the contracts and requirements for their external contractors and vendors.

</comment></comment></comment></comment></comment></comment><comment><USER8> That's how the DMCA works. Remember the guy who gave a talk about Adobe's PDF creator which purported to produce "secure" documents (required a password) but the feature was easily bypassed.

Adobe had him arrested the day after he gave his talk.

Link to a Wired article here: [https://www.google.com/amp/s/www.wired.com/2001/07/russian-a...](https://www.google.com/amp/s/www.wired.com/2001/07/russian- adobe-hacker-busted/amp)

EDIT: I have a terrible memory-- thanks to the folks who replied to my comment with corrections.

<comment><USER9> > Adobe had him arrested on the stage as he gave his talk.

I was there!

The FBI arrested him in a hallway, 1 day after his talk. Dmitry at first thought it was a joke put on by a Defcon prankster.

During his talk, the panel moderator asked Dmitry to pause for a minute... and said "Would you mind saying 'Can you tell me where are the nuclear vessels in Alameda'?" Dmitry was confused by this request and said, in his Russian accent, "I do not know where the nuclear wessels are in Alameda?" The mostly American Trek-familiar audience had a good laugh, and Dmitry continued with his talk.

<comment><USER10> I'm confused by his request as well, I can't understand why he asked it. Any context?

<comment><USER11> A scene in Star Trek IV.

[https://www.youtube.com/watch?v=kvkYTJYcYzY](https://www.youtube.com/watch?v=kvkYTJYcYzY)

</comment></comment></comment></comment><comment><USER12> A few years ago I also found a serious bug in a debt collection agencies web software. I ordered a phone and neglected to pay import tax and was chased by the agency. I found their website and saw that they developed their management software in-house and made it available for purchase for other agencies.

They offered a demo which I used to navigate around, in the demo was a reporting tool which essentially allowed you to send raw SQL queries to an AJAX endpoint. Something along the lines of:

[http://demosoftware.com/reports/ajax.php?sql=SELECT](http://demosoftware.com/reports/ajax.php?sql=SELECT) * FROM debts

I switched out the demo software domain name for the live version and it worked, not only could I query the database there was no authentication preventing me hitting this end point.

At this point I was left with a dilemma, do I "erase" my debt, do I disclose the bug and pay the debt, or simply pay the debt and move on. I chose to pay the debt and move on due to fear of any recriminations. However it has left me uneasy ever since knowing that this company have such bad security and any debtors they are chasing for payments potentially will have all of their personal data leaked.

<comment><USER13> You don't erase just _your_ debt, you open up Tor browser and drop the entire database. That'll teach them for next time.

<comment><USER14> _> you open up Tor browser and drop the entire database_

Apart from being a federal crime (CFAA), it would be rather obvious by the logs that a user was testing SQL injection on the demo system minutes before the production system was vandalised.

A better option would be to pay the debt, and then let them know you found a potential issue on their demo system. Let them connect the dots between demo system and production system. If they can't make the logical leap, then they deserve whatever someone else does.

<comment><USER13> Well obviously if you do that you wouldn't be testing the SQL injection for your main connection to begin with.

I'm not arguing against paying the debt - I would pay it in either case. However leaving such a vulnerability exposed is so bad they deserve to get their entire database dropped (and in this case I hope they _don 't_ have backups).

<comment><USER15> > However leaving such a vulnerability exposed is so bad they deserve to get > their entire database dropped (and in this case I hope they don't have > backups).

I understand the feeling here, but no, they don't deserve to get their assets destroyed because of a lack of care.`

<comment><USER13> Why not? Destroying the company means they won't be there anymore to put everyone's PII at risk.

<comment><USER15> Because private property is a cornerstone of a free society?

You can't just destroy someone else's property because you have some personal anarchist notion of justice.

If they are really being negligent then they should face the proper penalties.

<comment><USER13> Well the issue is that there are no penalties. Only free money for lawyers and nothing for the people who got their PII stolen.

Dropping the DB means there's no more PII to leak, makes a pretty good financial penalty for the company and doesn't make millions for useless lawyers. That sounds like an acceptable solution by my standards.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> In my country, the laws are draconian and totally against this kind of responsible disclosure. But being a good guy, whenever I find something I write a strongly worded email explaining why the company's IT department messed up, how to test said mess-up, and how they can hire my company to ensure these kinds of stupid things don't happen again.

I've reported several of these issues, sometimes all I get is single reply months later saying: "fixed".. mostly, nothing.

Once I found a SQL injection in a courier service's (very broken) web portal. This was very serious because any idiot could drop all the tables, so I sent an email to the most important worded member of their tiny, yet already bureaucratically structured team. I followed up several times because I knew someone saw my email (I embed beacons in my emails) but gave up after the sixth time. Three months later someone else replied saying "thanks Amin, we've fixed it"

On a separate occasion, a large government agency's emails routinely ended up in my spam folder. It was a huge problem, and they acknowledged it and said they couldn't figure out what was wrong. I took five minutes and found the problem to be a misconfigured server on the domain. The server sending the email thought it was `server-a.governmentdomain.com` but there were no DNS entries pointing the subdomain to the server. I reported this problem with clear instructions to test and fix the issue, but I was called despite the instructions, multiple times, to explain the issue with my words over the phone. This was 2 years ago, last I checked, the issue was still present.

<comment><USER17> How do you embed beacons into your emails?

<comment><USER18> <img src="[https://my.server.net/beacon- uuid.png"](https://my.server.net/beacon-uuid.png") height=1 width=1 />

</comment></comment></comment><comment><USER19> Two takeaways, one from this and one from my other past experience.

First, when testing whether you can change a price and have a transaction go through successfully, RAISE THE PRICE. If you lower the price the affected entity may come back and say "See??? He's STEALING from us! Lock him up!" If you've overpaid for something through their web interface that complaint and issue goes completely away.

Second, if you're going to suggest that they contact you for assistance in fixing it also suggest other options. My typical handling for this is with hacked websites, so I'll basically say "Your website has problems X, Y and Z. You should work with whoever you have working on your site to resolve these. If you don't have anyone I may be able to assist you, or I recommend talking with a firm like Sucuri.net which has dealing with and preventing issues like this as their primary business. (My only link with Sucuri is having seen some of their folks do presentations at trade shows.)"

<comment><USER20> 3rd takeaway - don't do this in turkey unless you want to end up in a literal Turkish prison.

<comment><USER21> 4th takeaway - the Budapest metro system doesn't quite go that far...

</comment></comment></comment><comment> angus-g Side note: this page gives me the weirdest Firefox behaviour I've ever seen: [https://gfycat.com/HandyRapidJabiru](https://gfycat.com/HandyRapidJabiru)

<comment><USER22> I am having this exact issue.

\- Firefox 54.0.1 (64-bit)

\- Arch Linux 4.11.5-1-ARCH

<comment> angus-g I'm on the 4.11.9-1-ARCH kernel, but same Firefox version. I'm only able to reproduce with the Zotero addon enabled, are you using it too?

</comment></comment></comment><comment><USER23> We've seen two[1] cases[2] of this in Denmark in the last couple of years surrounding systems that kindergartens are using. The second one is currently (still) being investigated, but the first one was rightfully concluded earlier this year with the "hacker" being acquitted.

In both cases, it was dads of children in the institution that noticed the bugs when they were rightfully using the system and were ignored when notifying the responsible party about it until they "shouted it so loudly" that they couldn't be ignored anymore, in which case they were reported to the police for hacking.

Links below are in danish, but they can probably be translated if needed.

1: [https://www.version2.dk/artikel/boernehavehackeren- frifundet...](https://www.version2.dk/artikel/boernehavehackeren-frifundet- landsretten-1074257)

2: [https://www.version2.dk/artikel/interview-hacker-tiltalt- jeg...](https://www.version2.dk/artikel/interview-hacker-tiltalt-jeg-totalt- uskyldig-1077581)

<comment><USER24> Translated to English:

1: [https://translate.google.com/translate?sl=auto&tl=en&js=y&pr...](https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=https%3A%2F%2Fwww.version2.dk%2Fartikel%2Fboernehavehackeren- frifundet-landsretten-1074257&edit-text=&act=url)

2: [https://translate.google.com/translate?hl=en&sl=da&tl=en&u=h...](https://translate.google.com/translate?hl=en&sl=da&tl=en&u=https%3A%2F%2Fwww.version2.dk%2Fartikel%2Finterview- hacker-tiltalt-jeg-totalt-uskyldig-1077581)

</comment></comment><comment><USER25> _" this outrageous move from the police brought about fierce reaction resulting in tens of thousands of 1-star reviews on the facebook pages of the companies involved"_

In the old days, protesters used to physically go and picket in front of company offices. These days, protesters leave one-star reviews. I wonder which is more effective.

<comment><AUTHOR> Yep, a few people were frowning, especially since the democracy is in pretty bad shape in Hungary right know. However, in this case it works: it will be seen and remembered longer this way. Also, there were quite heated discussions on facebook, the case received a lot of attention even from non-tech people, the guy will be represented by the lawyers of a human rights association, etc.

And actually there will be a protest in front of the office of the Public Transport Authority tomorrow. But I think in this case, the online petitioning worked pretty well.

<comment><USER26> "democracy is in pretty bad shape in Hungary right know"

I thought that Hungary has a democratically elected government. Did I miss something?

<comment><USER27> "Democratically elected government" does not imply "democracy is not in bad shape".

<comment><USER28> We have several examples of such situations right now.

</comment></comment></comment></comment></comment><comment><USER29> Although deeply unfair, this is not unusual, there have been many reported cases of companies shooting the messenger.

Unless the company concerned has a well documented and trusted bug bounty procedure, it can be very risky to report a bug in a system, if it involves any kind of hacking.

What happens is once the "bug" is reported, someone inside the company asks "How did this happen?". Now the person responsible has 2 options, admit it was their fault and the vulnerability exists and risk being accused of incompetence, or say that the system was hacked.

Human nature being what it is, one tends to complain of being hacked, thus snow-balling effects, which lead to the arrest of an 18 year old just trying to help.

My advice: Don't report these types of bugs at all, or if you really feel you must, report anonymously.

<comment><USER30> One thing that solves this is stating the obvious, something getting hacked means someone was incompetent.

<comment><USER24> Indeed, I fail to see the distinction. Perhaps "hackers" have some kind of mythical superpowers in the eyes of the common folk.

"There was nothing I could do boss! He's a hacker!"

</comment></comment></comment><comment><USER31> > the poor 18 year old 'hacker' who was stupid enough to email them

s/stupid/trusting/. There's no reason to think this guy isn't bright, and he's faced enough trouble without piling on.

<comment><USER32> I believe the author meant it to sound sarcastic

<comment><USER31> It's definitely a jab at the company, but seems to cast a little shade too on the bug-finder. Cf the lede "The amount of stupidity in this story warrants that this is going to be somewhat long". That might not be the author's intent! I hope they'll see this as helpful.

</comment></comment></comment><comment><USER33> Sounds a lot like what happens here in India [1].

Also, if such behaviour is systemic, how should we bring about the paradigm shift in handling such events? Such incidents will happen more often across the world as e-governance becomes more predominant.

1 - [https://thewire.in/119578/aadhaar-sting-uidai-files-fir- jour...](https://thewire.in/119578/aadhaar-sting-uidai-files-fir-journalist/)

</comment><comment><USER34> > We knew that they have been working on an NFC/smart card based system for > around 4 years, without any visible result despite having spent over 4 > million EURs.

The public procurement process for the current system called RIGO was indeed 2013 but the whole process is much, much older than that. A more than 300 page feasibility study was published in 2011 [https://www.bkk.hu/apps/docs/megvalosithatosagi_vizsgalat.pd...](https://www.bkk.hu/apps/docs/megvalosithatosagi_vizsgalat.pdf) And a completely different system, called Elektra was announced in 2004 with a 2006 deadline.

This whole clusterfuck with RIGO starting in less than a year was absolutely unnecessary since the 2011 study already suggested supporting contactless credit cards so once RIGO starts the only ones using this online ticket purchasing system will be those who have a credit card but not a contactless one. This is a (very) rapidly shrinking audience.

</comment><comment><USER35> The list of bullet points of the egregious flaws in the software just get worse and worse. It's crazy how I thought the first one or two would be the worst since, but it just got worse.

<comment><USER36> It's 20 freaking 17. How can people release software with these totally elementary mistakes? Just one is bad enough, but... admin/admin?? This is easily worthy of a Daily WTF article to itself.

And this software was written by a professional contractor - pretty sure you'd get better quality from a kid fresh out of university, because on my course, it was drilled into me - NEVER TRUST THE CLIENT BROWSER!

Companies need to understand, if they want an internet presence, no matter how strong the laws are in their own country, laws don't stop a crime in progress, especially when all they need to do is send a fairly simple message to the website. Computers are dumb, they do what they're told. Giving anyone the loophole to tell them to do something you didn't intend is asking to have it exploited.

Going after the messenger will solve nothing. The guy who discovered the payment flaw could easily have kept quiet, letting others discover it, or quietly told his friends, who tell their friends, ad infinitum, and suddenly the whole country is buying valid passes for a penny, costing the company a hideous amount of money. Prosecuting the whistleblower will actually hurt their bottom line.

<comment><USER37> "NEVER TRUST THE CLIENT BROWSER!"

Isn't it mostly in multiplayer game programming where this gets said over and over "Never trust the game client" even though it should be said in all aspects of programming really

<comment><USER36> I would have ended at 'client' but figured it could extend to the human (although that's true too). But yes, there is still so much naivety in implementing distributed or client-server systems that they should trust input from remote sources.

</comment></comment></comment></comment><comment><USER38> The software industry better start investing more in educating the general public/government officials about how web applications work, or this is only going to get worse with technologies like WebAssembly in the hands of similar companies. If anything, people need to understand that these endpoints _can_ be accessed without a browser, and we can't be arresting people/hauling them in for questioning for sending _bad data_ to such an endpoint. After all, what does "bad data" even mean in such a context ?

Also, a question: does the EU have the legal concept of "fair use" ? I would have thought that messing around with a web application would fall under fair use, given that the web application can, and probably will, be stored on a person's computer. A computer that they (also probably) personally own, I might add...

</comment><comment><USER39> This sort of thing teaches people to exploit or ignore rather than report. Anyone who reports should be commended, even if they did real hacking (which using dev tools on a web browser is not.)

Someone's going to probe your system; you should be glad to hear about it in email rather than in the news or your accountants or from angry customers.

</comment><comment><USER40> Someone pointed out to me the other day that just connecting to a poorly configured system is illegal in some places (Finland in his case). A form of trespass he said. This was a ship in international waters registered in Russia Federation so not sure whose law applies lol. Perhaps if there were more cases where full advantage was taken of such incompetence with spectacular newsworthy results then people would be more appreciative of the work we do and the laws changed to protect whistle-blowers and activists generally.

</comment><comment><USER41> > someone found out that the admin password was adminadmin and managed to log > in using that.

Wtf ,I thought I was bad at my job.

<comment><USER24> Conversely, the person who set it to adminadmin probably thought they were doing a great job.

</comment></comment><comment><USER25> _" if you just typed in the url (shop.bkk.hu), the site just wouldn't appear. At first I thought they've taken it offline, but it turns out that they just didn't set up the http -> https redirection. And it was left like that for days. If you just heard about it, you couldn't use it. You had to click a link (normal users won't figure out to put an https in front of the host name, even I didn't think of it)."_

I'd really like to know which of these is the better solution.

It seems to me that if people go to the http address, they could be redirected to an attacker's address with a simple MITM attack. So there's an argument to be made for not using http at all, even for a legitimate redirect, because it can be so easily MITM'ed.

On the other hand, if the http address is left unused, then people who try it anyway and it fails will be confused. For this solution to work, it seems the users have to be educated to always and only use the https address.

For these reasons, the whole separate http/https scheme seems broken by design.

What's the consensus from the security community as to the right setup here? Am I missing something, or is there a better way?

<comment><USER42> Not having an http site doesn't help in a MITM scenario as the attacker will happily serve up an http site even if you don't.

<comment><USER43> The only solution is to always go for the HTTPS resource disregarding any suggestion. On browsers a strict configuration of Smart HTTPS [0] covers that, for everything else I think the best solution would be to intercept all HTTP traffic, request the HTTPS counterpart (and decide if falling back on failure is acceptable instead of just dropping the connection), then serving locally the decrypted response. Worse than properly requesting the right one from the start but harder enough to exploit.

[0] [https://mybrowseraddon.com/smart- https.html](https://mybrowseraddon.com/smart-https.html)

</comment></comment></comment><comment><USER44> When I was in Budapest a few weeks ago, I heard from multiple locals that the metro system was owned by some sort of mafia. I wonder if that explains the subpar security and overreaction to the bug report.

edit: a few weeks ago, not this past summer that is still occurring

<comment><AUTHOR> I'm not aware of any actual mafia. They were almost certainly metaphorical and they must have been just bashing the local government. Because what they do is really a shame. One of the lines is de facto in a life threatening condition. Trains caught fire multiple times. Instead of being replaced, the 40 year old cars are being refurbished/modernized. This has something to do with the EU (they gave money for this, but not that). There was a tender, but miraculously it was the Russians who won it, despite their offer was quite a lot more expensive than that of the Estonians. And of course, as it happens with corruption, they failed to deliver a properly working version, so after a few weeks of testing, the first few trains were sent back.

About the security (or rather the extremely low quality) of the eTicket system: that was developed by a 3rd party that belongs to the Deutsche Telekom group, and that company is indeed quite a high profile system integrator working with a lot of large companies, banks, etc. So it's a bit of surprising (even if corruption is involved) that they released it in this form. Actually I'm surprised by these bugs even for a prototype that was forcefully pushed out of the door, because you just never do these things in the first place.

<comment><USER45> > Instead of being replaced, the 40 year old cars are being > refurbished/modernized.

Age seems like a bit of a red herring to me. Here in San Francisco BART cars are about that old, Muni runs 90 year old Italian trams and American ones that are close to 70 years old. And, of course, the cable cars. BART bears about the worst of it because many parts are no longer available.

<comment><AUTHOR> Interesting point. Don't forget that this is 40-50 year old Soviet technology :). And cars are actually in pretty bad shape, well over their planned lifetime of 30 years (AFAIK). Full of rust, sometimes catch fire. The drive system is also problematic, because it doesn't have regenerative breaking so the cars heat the tunnels quite a lot which is pretty bad during the summer.

They are in such a bad shape and/or hard to rebuild that not much remains of the original during the refurbishment.

<comment><USER46> Actually the Russian company and the tender has received attacks that the cars are actually new, only some identifiers have been transferred from the old cars, as Metrowagonmash had a dozen or so surplus cars of the type the used cars were supposed to be upgraded to.

</comment></comment></comment></comment></comment><comment><USER47> >Didn't any of the engineers on the team tell their managers that something isn't right? I find it hard to believe.

Or, the managers knew full well the system was shit and they had no time to fix it, but 80k/month is 80k/month.

<comment><USER48> This is Hungary we're talking about, more likely it was 24k or less.

<comment><USER47> The article says

>BKK pays T-Systems 80kEUR/month to operate this system.

If you were offered that, would you turn it down because you can't actually deliver a secure system in time?

<comment><USER48> Oh, I missed that part, I thought you were talking about programmer salaries :)

</comment></comment></comment></comment><comment><USER49> All I can think about, what a shame can this be for the developers releasing this software. There must have been a bunch of people working on this and wasn't there no one to say this is wrong?

</comment><comment><USER50> this reminds me of a dark joke.

a rabbit was detained by the secret police. the interrogator asks him, "what are you?" the rabbit says, "rabbit"

They torture, beat, and electrocute him for days.

Then, the interrogator asks him, "who told you you're a rabbit?"

</comment><comment><USER51> Once there was this website which offered phone number to location service.

They had a form you could try the demo where it sent an SMS to verify and only allowed one query.

If you looked at the source of the page it had hidden fields to override the SMS verification and allow multiple queries.

I freaked out some friends for the day and nearly contacted a journalist but lost interest after some weeks.

I could have had my 15 minutes of fame or be on some list, or both.

It's alright, had some fun.

</comment><comment><USER52> Actually he exploited the bug and purchased a ticket for the fraction of the price and than reported it to the public transportation company. The company that runs the infrastructure (not the public transportation one) followed its internal policy and Hungarian law reported the incident to authorities. Police brought in the guy for questioning.

<comment><USER53> By purchasing the ticket, he was confirming the vulnerability. I am sure he knew that they would cancel the ticket when he reported it. I don't find any wrong doing here.

<comment><USER52> And you think that this is going to be enough at the court?

Have a look at this list, many of them thought they are not doing anything wrong:

[https://en.wikipedia.org/wiki/List_of_computer_criminals](https://en.wikipedia.org/wiki/List_of_computer_criminals)

The point is that we live by the law, not how you feel about a certain action. I agree that the law is a bit problematic but regardless we cannot cherrypick which law to follow and which not.

<comment><USER54> Yes, that should be enough. You won't get into any trouble if you break a window when the house is on fire. This time, the site was on fire.

</comment></comment></comment></comment><comment><USER55> We had a similar case - National security authority(NBU SR) of a neighboring country got their public web infrastructure hacked after guessing credentials (nbusr:nbusr123). In the end, guys got free after trial because police were unable to unambiguously identify them.

</comment><comment><USER6> Open-source implementation of the password cryptographic method. [https://github.com/moszinet/BKKCrypt](https://github.com/moszinet/BKKCrypt)

</comment><comment><USER56> All I want to say is something off topic,but the only vacation I've had away fro m the kids and with my wife was a week in Budapest, and I miss it. Such a beautiful city, so romantic...and I rode the metro everywhere.

ahh Budapest.

:-)

<comment><USER56> not to mention the US dollar spends well there. I felt rich and I am just a potdoc

</comment></comment><comment><USER57> The Hungarian Government Incident Response Center (GOVCERT_Hungary) provides the opportunity to report security vulnerabilities for everyone in an anonymous manner: [http://www.cert-hungary.hu/node/397](http://www.cert- hungary.hu/node/397)

Better late than never...

</comment><comment><USER58> I wonder if the outcome would have been the same if instead of marking the price down from 9500HUF to 50HUF it was 9499HUF, the test would have still proved the issue.

</comment><comment><USER59> As a Deutsche Telekom client, I can say that this quality level is par for the course for T-Systems. Not surprised at all.

</comment><comment><USER60> Just don't bother with companies who don't have a bug bounty system in place.

</comment><comment><USER61> I thought some CERTs were now doing the reporting as way to shield security researchers from this kind of things ? Or did I hear wrong ?

</comment><comment><USER62> THIS --> "someone found out that the admin password was adminadmin and managed to log in using that."

</comment><comment><USER63> A sure-fire way to let vulnerabilities go unnoticed and unfixed.

</comment><comment><USER64> is HN hugging shop.bkk.hu to death?

<comment><USER64> visiting [https://bkk.hu/](https://bkk.hu/) (and watching the dev console) shows that they obviously develop their page http-first (various resources won't load in firefox due mixed http(s))

<comment><USER64> and after switching to english the search on the top of the page is broken

<comment><USER64> check robots.txt -> wordpress... seriously?

</comment></comment></comment></comment><comment><USER65> The price of a ticket was client-side authenticated!? I can't fathom the level of incompetence required to do something like this...

<comment><USER66> "Budapest's new e-ticketing system uses state-of-the-art JavaScript to deliver a smooth user experience, combining a great React front-end with a micro- services node.js backend!" \- marketing blurb I just made up, needs more buzzwords though.

<comment><USER67> ...stateless cloud interactive real-time connection through highly sophisticated authentication featuring dual way private/public key encryption services with single use time-limited tokens ...

<comment><USER68> Don't forget the blockchain! It needs more blockchain! ;-)

<comment><USER69> Also wouldn't mind some "cyber" in there :D

<comment><USER67> ... cyberspace with optional IoT interfacing ...

(I had completely forgotten IoT)

</comment></comment></comment></comment></comment></comment><comment><USER70> Not just reporting it, but having actually exploited it to confirm before reporting it, even if just to test. That was the wrong move.

What should have been done was the second he had the thought that such a vulnerability could exist, he should have notified them that he believes that there is a possibility for one to alter the site code locally to gain unfair pricing, and to ask them if either he could check for them or if they could check using his proposed method.

The second you actually test without permission, you've committed a crime. Jury/court might look at intent later on, but for now, you've committed a crime and are thus subject to arrest.

<comment><USER18> How do you know if the server validates the price or not, without testing it?

Do you report every site that uses HTML forms for being insecure?

</comment></comment><comment><USER71> Not really related to the technological side of the story, but I had a horrible experience with the international trains from Budapest. So they don't need a broken electronic system to provide a horrible service ;)

My parents went to buy a ticket at the counter. The lady behind the counter didn't speak English (which is totally OK). Her only communication was a 'go away' movement with her hand, after which she ignore us and signaled for the next customer in line to come to her.

Luckily a colleague of her helped us and gave us careful instruction on the time and platform of the train. After we took the train and sat for a few hours, the conductor of the train came and notified that our tickets were invalid. We argued for some time since the lady behind the counter told us this was the right train. The conductor became mad and told us that we had to pay him 50 euros in cash for some unknown reason (presumably to buy a ticket for the train we were on, but his English was very limited). Note that this was a normal train and there was no shortage of seats. In the end, we chose to get out at the next stop, and take the next train, which was about 3 hours later.</comment>


Heroku = down - <AUTHOR> https://status.heroku.com/incidents/548

<comment> the-kenny Seriously? Why are there multiple posts like "xyz is down" on Hacker News every other day? Isn't there "downnews.net" or whatever?

<comment><USER2> I'm tired of these posts too.

</comment></comment><comment><USER3> Strava.com is down too. It seems that Amazon is having troubles with AWS.

</comment><comment><USER4> Heroku is claiming that the issue is resolved. Our site is still down.</comment>


Ask HN:  Beyond illustrated fiction:  novels with video clips? - <AUTHOR>

Why don't we see novels with video clips? <comment><USER2> <http://vook.com/literature-and-fiction.html></comment>


A Response to President Xi Jinping - <AUTHOR> http://www.nytimes.com/2014/11/13/opinion/a-response-to-president-xi-jinping.html?_r=0

<comment><USER2> I have noticed a pattern of negative coverage of China by the New York Times from "hacking from China" (often indirectly implicating the government), to currency manipulation, to goods dumping. I'm concerned that I may be consuming a warped perspective. It seems like the New York Times is creating a case against China. Is it merited?

It's important to make a strong effort to substantiate negative claims. So, it is in that spirit that I ask: is the criticism raised in this article fair? Does China have an anomalous record on freedom of the press by comparison to other nations of similar development (BRIC, APEC, etc)?

<comment><AUTHOR> > Does China have an anomalous record on freedom of the press by comparison to > other nations of similar development (BRIC, APEC, etc)

Is that the right point of reference? Maybe a more reasonable point of reference would be "the top 10 nations by GDP." In that case, you'd be comparing it to Japan, United States, England, France, etc. I suspect their record on freedom of the press is significantly worse, however I think I also consume biased information.</comment></comment>


Make This Amazon Charade Illegal - <AUTHOR> https://splinternews.com/make-this-amazon-charade-illegal-1822511600 <comment><USER2> There's probably not a lot of leverage for the Federal government to interfere in basic state and local budget issues. DC's efforts in the past to use federal funding to influence state behavior has had mixed results. And there's probably not much will in Washington to do anything about it anyway. Unfortunately, that only leaves local agitation as the remaining viable option.</comment>


Google making app that would identify people's faces - <AUTHOR> http://www.cnn.com/2011/TECH/mobile/03/31/google.face/ <comment><USER2> Wasn't this always expected to be the point of Google Goggles?</comment>


Metacrap: Putting the torch to seven straw-men of the meta-utopia (2001) - <AUTHOR> http://www.well.com/~doctorow/metacrap.htm

<comment><USER2> Conclusion, strongly in favor of practical metadata:

"... Metadata can be quite useful, if taken with a sufficiently large pinch of salt. The meta-utopia will never come into being, but metadata is often a good means of making rough assumptions about the information that floats through the Internet.

"Certain kinds of implicit metadata is awfully useful, in fact. Google exploits metadata about the structure of the World Wide Web: by examining the number of links pointing at a page (and the number of links pointing at each linker), Google can derive statistics about the number of Web-authors who believe that that page is important enough to link to, and hence make extremely reliable guesses about how reputable the information on that page is.

"This sort of observational metadata is far more reliable than the stuff that human beings create for the purposes of having their documents found. It cuts through the marketing bullshit, the self-delusion, and the vocabulary collisions.

"Taken more broadly, this kind of metadata can be thought of as a pedigree: who thinks that this document is valuable? How closely correlated have this person's value judgments been with mine in times gone by? This kind of implicit endorsement of information is a far better candidate for an information-retrieval panacea than all the world's schema combined."

</comment><comment><USER3> I think "2.5 Schemas aren't neutral" is a valid point, but I don't understand the proposed (conflicting) hierarchies at the bottom. Why are we trying to place these things within a taxonomic tree? That doesn't seem to be an accurate depiction of any real attempts to build a DTD.

</comment><comment><USER4> Some good points in here; even better is this from Clay Shirky: [http://www.shirky.com/writings/ontology_overrated.html](http://www.shirky.com/writings/ontology_overrated.html)</comment>


Kids playground built from discarded wind turbine parts (2017) - <AUTHOR> https://lifeandsoulmagazine.com/2017/11/12/wikado-playground-kids-playground-built-from-discarded-wind-turbine-parts/ <comment><USER2> Aren't wind turbine blades made of generally annoying/nasty stuff such as various interesting epoxy components and glass fiber? I've seen how sick working with manufacturing can make people, so I'm not sure I'd want kids exposed, since they'll crawl around on them and touch them, likely wearing the material down and releasing small particles that may get into the skin or airways.

</comment><comment><USER3> An NPR article on the topic: "Unfurling The Waste Problem Caused By Wind Energy"

[https://www.npr.org/2019/09/10/759376113/unfurling-the- waste...](https://www.npr.org/2019/09/10/759376113/unfurling-the-waste- problem-caused-by-wind-energy)

"...Ninety percent of a turbine's parts can be recycled or sold, according to Van Vleet, but the blades, made of a tough but pliable mix of resin and fiberglass — similar to what spaceship parts are made from — are a different story.

'The blades are kind of a dud because they have no value,' he said.

Decommissioned blades are also notoriously difficult and expensive to transport. They can be anywhere from 100 to 300 feet long and need to be cut up onsite before getting trucked away on specialized equipment — which costs money — to the landfill. ..."

<comment><USER4> In that case using them for playground and similar projects sounds like a brilliant solution.

</comment></comment><comment><USER5> Airplane Park in San Francisco used to be a literal airplane. It was a F-8 Crusader jet with its guts scooped out.

[https://sfrecpark.org/project/larsen-park-jet- playground/](https://sfrecpark.org/project/larsen-park-jet-playground/)

<comment><USER6> Submarine park featuring a decommissioned submarine:

[https://www.atlasobscura.com/places/holbrook- submarine](https://www.atlasobscura.com/places/holbrook-submarine)

</comment></comment><comment><USER7> Maybe we should start (or better return to) making the blades from wood.

[https://www.lowtechmagazine.com/2019/06/wooden-wind- turbines...](https://www.lowtechmagazine.com/2019/06/wooden-wind- turbines.html)

</comment><comment><USER8> I know that material fatigues over time, but 225,000 tons of turbine blades annually sounds excessive. Why so much waste?

Couldn't older ones be retro-fitted with newer rotating internal components to extend the life of the structural components and the blades? I just can't see such a massive structure being discarded just to be replaced with a unit which is probably very similar.

<comment><USER9> I posted separately a link to a YouTube profile of the architect. He mentions later in the video that the blades are taken out of service when hairline cracks are found in them.

</comment></comment><comment><USER9> I was curious how the playground looked in use, a question well-answered by this profile discussing the project that I found on YouTube: [https://youtu.be/V4C4RQcyrSo](https://youtu.be/V4C4RQcyrSo)

</comment><comment><USER10> Wish we could do something similar with solar cells. Seems to me, that some sections could be used to make streamlined coffins -- so you can slip into the afterlife a little faster. Maybe a blade tip could be placed on a turret of a ship, so as to generate a little extra push, in much the same way sails did a century ago. I suppose that such material would make excellent berm material when constructing levees. The list goes on...

<comment><USER11> Solar cells strike me as highly recycleable. [https://www.veolia.com/en/newsroom/news/recycling- photovolta...](https://www.veolia.com/en/newsroom/news/recycling-photovoltaic- panels-circular-economy-france)

</comment></comment><comment><USER12> It looks nice and I can appreciate the story, but saying « discarded » makes it sound like it has no value, but Scrap structural steel definitely does.

> designed the Wikado Playground to address the issue of saving out-of-service > wind turbines from landfill.

Nononono.

<comment><USER13> Wind turbine blades, such as those used on this playground, are typically not recycled and have little scrap value. Their structure is primarily of fiberglass, some with carbon fiber, often with foam and balsa wood as well. There is some metal, typically in the lightning protection system (copper and aluminum) and blade root (blade studs, covers, possibly a steel blade root insert), but they do not comprise the majority of the structure. On decommissioning it is relatively common for blades to be shredded and landfilled.

<comment><USER14> I've just read some book proposing to make the blades out of natural fiber materials such as bamboo. There seems to be quite a lot of research going on.

Edit: The article does indeed appear to talk about composite materials.

> According to research, there will be, at current growth rates, 225,000 > tonnes of rotor blade composite material produced annually worldwide

<comment><USER15> > _> According to research, there will be, at current growth rates, 225,000 > tonnes of rotor blade composite material produced annually worldwide_

My heart hurts when I re-read this as "225,000 tonnes of rotor blade composite material landfilled anually worldwide N years from now", N being the average lifetime of a wind turbine.

<comment><USER16> Is that better or worse than the X tones of carbon emissions diverted?

Will any of the composite materials breakdown over time and leach in to water supplies?

<comment><USER15> For the problem of global warming itself, given positive EROI, it's better to have those turbines and emit that less carbon. But for the problem of not running out of resources, it may be worse.

In a way, under existing economic regime you can pretty much consider renewables as non-renewable energy sources. A wind turbine doesn't burn non- renewable fuel, but it does "burn" non-renewable construction materials. Of course, climate change is the more pressing problem now, but I'm not 100% sure _how much_ more pressing, given the exponents involved in all of this.

Most of all, just thinking about how even renewable energy is entirely embedded in our process of transforming raw resources into waste (with a little bit of economic value extracted in the middle) just breaks my heart.

<comment><USER6> _Most of all, just thinking about how even renewable energy is entirely embedded in our process of transforming raw resources into waste (with a little bit of economic value extracted in the middle)..._

This is really just the second law of thermodynamics making its presence felt (not to imply that we're anywhere near close to some kind of entropic limit in the construction of wind turbines, but as a rule of thumb: in the process of doing useful work, things degrade).</comment></comment></comment></comment></comment></comment></comment>


Woman Receives the World's First 3D-Printed Skull - <AUTHOR> http://www.lernabit.com/blog/post/woman-receives-the-worlds-first-3d-printed-skull <comment><USER2> Is 3D printing really enabling this? If they can make the measurements, I have a hard time believing that an experienced machinist couldn't fabricate the parts necessary. This seems more like a victory of measurement technologies that allow the requirements for a replacement skull to be precisely mapped, than a triumph of 3d printing. (Though I do admit that 3d printing would probably be a lot cheaper than machining.)

<comment><USER3> Absolutely. No "experienced machinist" can reasonably make this part within spec. The time and cost for a CNC / operator / programming is exorbitant and simply beyond the reach of most people.

3D printing in this context allows for the fabrication of complex geometries that would be incredibly resource intensive otherwise.

You're correct in proposing that measurement techniques have enabled for this. But what good are the measurements if your tools do not allow for you to produce anything meaningful from the data?

</comment></comment><comment><USER4> I'm curious to know how they then attach that skull to the rest of her body. Is there a skin transplant that somehow lives on top of plastic? Do they just screw it into other bones to hold it into place? But what about the juncture, and how can you ensure nothing gets in at that juncture?

<comment><USER5> Not a skin transplant, just the skin. "It is almost impossible to see that she's ever had surgery"

<comment><USER6> so they've got it all stashed, and they just flop it back on???

<comment><USER7> My wife, a surgical technician, hasn't done surgeries like this before but has mentioned how for other procedures (on the face, perhaps) that they fold back the skin and then 'flop it back on'. It is crazy when she talks about stuff she's seen/helped do.

I like to picture surgery to be very similar to working on a car, except the pipes, wires, manifolds, etc are made of organic stuff.

<comment><USER4> But in this case how would the skin get fresh blood?

<comment><USER5> The blood vessels all run within the scalp, which is part of what helps it be loose. Some run up the side and some come out next to the eyes, and nothing has to go through the top half of the skull.

</comment></comment></comment></comment></comment></comment><comment><USER8> To be clear, they mean the first 3D-printed skull _to go in somebody 's head_. We've all given people 3D-printed skulls before.

</comment><comment><USER9> Related story about construction worker in China having half his skull replaced with 3D printed titanium. [http://shanghaiist.com/2014/09/16/man_recovers_after_3d-prin...](http://shanghaiist.com/2014/09/16/man_recovers_after_3d-printed_skull.php)

<comment><USER10> There have been several patients who had had custom implants designed using CT scans of their skull, then 3D printed and surgically attached to replace part of their skull: one nice report is [http://thescipub.com/PDF/ajeassp.2011.169.174.pdf](http://thescipub.com/PDF/ajeassp.2011.169.174.pdf)

</comment></comment><comment><USER11> > _" The operation was performed by a team of neurosurgeons at the University > Medical Centre Utrecht and the university claims this is this first instance > of a successful 3D printed cranium that has not been rejected by the > patient."_

Oh man... having a skull implant rejected is horrifying. Having an arm or something rejected is one thing (you probably just go back to how you were going to be otherwise, more or less), but are there any backup plans if your body rejects a skull implant?

<comment><USER12> Only donor tissue/bone is rejected. Non organic matter is not.

</comment></comment><comment><USER13> Hopefully it's tough enough that she doesn't get killed by something dumb like a dictionary falling on her head.

<comment><USER14> I do wonder its relative strength to a human skull

</comment></comment><comment><USER15> It seems mean to give her a transparent skull, if that's the final product! I mean, it's pretty cool but not if you want to feel "normal" :)

<comment><USER16> I'd like to think they preserved her scalp / kept it in circulation and returned it to its position, but I have no idea if skin can be kept alive across this surface. Maybe that's what those holes in the printed piece are about, though? Or are you concerned that even with skin on top it'd alter the appearance due to different subsurface scattering?

Edit: Some additional info (note the English captions): [https://www.youtube.com/watch?v=IXcz3OdHSHk](https://www.youtube.com/watch?v=IXcz3OdHSHk)

<comment><USER17> Yeah, I'd be incredibly shocked if they didn't preserve the scalp.

On the other hand, if she did have an exposed skull, I think there's like half a century or more of media which says you pretty much have to leave it transparent. You can always wear a wig or a baseball cap, but how else will people know you as an incredible (evil) super-genius without the exposed brain?

<comment><USER18> The obvious counter-argument is you couldn't walk in bright sunlight. Beam of light at the wrong angle...

Then again that's probably why supervillains have dark lairs.

</comment></comment></comment></comment><comment><USER19> I wonder what are all the holes for.

<comment><USER20> A little more here:

[http://www.anatomics.com/products/cranial- implants/acrylic/](http://www.anatomics.com/products/cranial- implants/acrylic/)

</comment></comment><comment><USER21> As an invisalign (also 3d printed, clear plastic) user, I wonder if she has to take it out when she thinks?</comment>


Ask HN: What are some methods you've used to increase your learning capacity? - <AUTHOR> I'm excited by knowledge. Knowing how things work, or don't work has always excited. More than anything else. Lately I'm coming face-to-face with the fact that there's too much knowledge in the world and I can only know so much. Nevertheless I want to learn as much as I can.<p>But here's the thing: I feel that I've reached peak learning capacity (with my current methods) and I'm looking for new ways to enhance it. What methods have you used to increase your learning capacity? Have you taken on a traditionally youthful program (math is considered one of those) and succeeded? How did you do that? <comment><USER3> I heard an argument once that made me try a 3 month experiment in my Japanese studies. The argument's core is summarized here:

 _" It's easier to learn something after you've already been introduced to it."_

What is meant by that is that it is better to learn 20 of 100 things than 10 of 10 things and that after being introduced to 100 things the other 80 things will be learned more easily as you've now been introduced to them. Introducing yourself to new things, therefore, is more important than actually learning about each individual thing.

So after five days of study the comparison might look like this:

        20/100 | 45/200 | 70/300 | 100/400 | 135 / 500 (learned 135 things, introduced to 500 things)
                          vs
        10/10 | 20/20 | 30/30 | 40/40 | 50/50 (learned 50 things, introduced to 50 things)

I drastically increased my daily vocab study from 5 kanji/10 vocabulary words a day to 50 kanji and "hours of vocabulary" a day (200-300~ words on average). I'd fail to remember 70-80% of it (and this was tracked on Memrise quite well). But remembering 20-30 vocab words/day was already twice as fast as remembering 10 vocab words a day. This had a knock-on effect: the more kanji and vocabulary I learned the easier it was to learn new kanji and new vocabulary and so that 10-20% would slowly increase until I was remembering 30-40% each day. The vocabulary and kanji I learned during this time are also the ones I remember best and can recall without prompting.

I now use this method of "completely drowning yourself even after you think you've already drowned" when learning anything. Whenever I get to a point of "OK, I think that's enough studying for today. I couldn't possibly remember more than this." I take however much time I had just studied for and, time permitting, continue studying for that length of time again. Without fail - <USER2> learn more than I thought I could.

This also helps identify "problem topics" that I can delve more into, focus on, or even put off entirely to come back to it later. Sometimes understanding what comes after brings enlightenment on the things meant to come before.

The only issue with this study method is that being wrong _almost all the time_ can be very demotivating. You have to keep in mind that that is the point! You'll be wrong most of the time - best get used to it.

</comment><comment><USER4> For me, taking notes (short notes) while sticking to the bottom line of why im reading or watching a video.

For example, iv been reading alot about k8s. Why? To learn how to deploy apps with it.

All that adding nodes, maintaining is quickly skimmed.</comment>


A Fervent Defense of Front-running HFTs - <AUTHOR> http://www.chrisstucchio.com/blog/2014/fervent_defense_of_frontrunning_hfts.html <comment><USER3> I think this article does a good job of illustrating why its so hard to have an open dialog on this subject.

Start with asking "What is front running."? The market's definition would not include what HFT do. But bring this up to someone without knowledge of the public markets and their first reaction is to say, hey this is front running, it must be wrong. "Front Running" has a specific definition and it only relates to a broker and their own clients. You trading before me because you are faster is not front running. You understanding my flow is not front running.

You can then ask "What is public information". The fact that everyone can see any tape they pay money to see so there doesn't seem to be any one acting on "insider knowledge."

Now tell people that HFT's will use their fast machines to change their orders due to a change on one exchanges tape before the main NBBO tape is updated and some people will claim that this is obviously wrong.

The other argument I've seen made here is that trading on "insider knowledge is obviously wrong." Well it isn't obviously wrong and the entire commodities market assumes that anyone can trade legally on insider knowledge. Imagine you are the biggest producer of oranges. You know that you are going to have a bad crop so you but some orange futures so you can meet your demands. This is insider information you've traded on and its the way the market is intended to work.

</comment><comment><USER4> This is great - it hits major topics that should be part of this debate. It's long, and it's a bit complicated... but so is the issue.

Some things you should be thinking about after reading this:

* What exactly constitutes front running? Does trading based on public data (albeit in expensive feeds) constitute front running?

* Large trades are almost all traded through algos. Are those algos better than proprietary "market making" algos? Why?

* What is adverse selection? How do dark pools contribute? Who benefits and who suffers?

Read more articles like this. Be suspicious of "simplified" discussions.

<comment><USER5> I have some questions based on yours:

* What constitutes public data?

* How likely are the types of front-running HFT algos that are discussed in this article to be the old, traditional players?

* What are the ethical (lol) rules against front-running your own customers if you're a market-maker? How could your customers even find out? What happens when the proprietary information is that a customer has just placed a large trade, and you drive up the price before it even hits the market? How is this fundamentally different than the commission these firms already charge?

<comment><USER6> _What are the ethical (lol) rules against front-running your own customers if you 're a market-maker? How could your customers even find out? What happens when the proprietary information is that a customer has just placed a large trade, and you drive up the price before it even hits the market? How is this fundamentally different than the commission these firms already charge?_

Market makers are generally proprietary firms that trade their own money, and don't have customers.

Brokerages (ie: Scottrade) have customers and it illegal for them to front run their customers.

<comment><USER5> I'm not thinking retail brokerages -- I'm thinking investment banks like Goldman. Often the big i-banks have both prop trading operations and the ability to fill large orders for institutional clients (e.g. a pension fund looking to buy $1 billion of Apple stock).

<comment><USER6> For them, they have a fiduciary duty to their clients to act in their customers' best interest. So, if their clients asks to purchase, for example 100,000 shares of AAPL, it would be illegal for them to first drive up the price.

</comment></comment></comment></comment></comment><comment><USER7> I've been following (sort of) the back and forth on this and find it quite interesting. Here's a question though: what happens when the "whale" is really something like an index fund that, ultimately, is composed mostly of retail investors? Aren't they getting ripped off in that case? This isn't a rhetorical question, I'm curious to know how it plays out.

<comment><USER8> Here's the CIO of Vanguard (who run some of the biggest index funds in the world) saying that HFTs cut costs:

[http://www.cnbc.com/id/49434073](http://www.cnbc.com/id/49434073)

</comment></comment><comment><USER9> > Predatory traders detect information and split the profits with the > counterparties (taking a cut in the process)

No. No they do not. They detect the information, and extract part of the value without improving the situation of the seller.

The seller was going to get filled at $21 in either case, the only difference is that the front-runner bought and resold those shares to the "whale" buyer.

This intellectual backflip is premised upon two mutually exclusive things happening:

1) the predator trades on information that there is demand coming and 2) in the counterfactual for the seller, that demand may never have come.

But because the front-runner is cutting the line, they only place trades once the demand is in the order book.

As a work of acrobatics, this is impressive. As an intellectual work, it is saddening.

<comment><USER10> _But because the front-runner is cutting the line, they only place trades once the demand is in the order book._

There is no "cutting the line". If the demand were already in the order book the trade would have occurred.

Please go read the tutorial before commenting further - you demonstrably do not understand how a matching engine works.

<comment><USER9> I re read your article, and it appears I took information from your headline and assumed it into your examples. I think you're talking about plain vanilla market making and speculation. Nothing in there is what I would consider predatory or HFT or front running.

These things exist, per my best reading of the wsj, and you said you were defending HFT but as best I can tell merely defended computerized market making and speculation.

<comment><USER11> The thing that is being called "front running" here involves multiple exchanges. There is no cutting in any single line. There is more then one line, and you can be in multiple simultaneously. In some cases, traders may go through one line and then complain that HFT traders went and got in the other line. In order to call that "cutting in line" and be well founded, you need to come up with some framework for how that "line" works - it does not fall trivially out of the actual lines in the two exchanges.

</comment></comment></comment></comment><comment><USER12> Why isn't HFT front-running? Let me attempt an explanation without relying on legalistic constructs.

Customers pay brokers a commission to execute their orders. This involves a customer trusting a broker with their confidential order information. Until an order goes to the exchanges, only the customer and broker know about it. The order is material non-public information.

Brokers have a fiduciary obligation to look out for their customers' interests. This applies even when the customer's interests conflict with the broker's. For example, suppose a broker holds Tesla stock. A knowledgeable customer calls the broker, seeking to sell 2 million shares. This would depress Tesla's stock price. Front-running would involve the broker selling his shares first, and then the customer's. This violates the broker's fiduciary obligation. That is why it is fraudulent and thus illegal–an _explicit_ trust relationship would be ruptured.

Across the trading floor from the brokers are us market makers. We trade our own capital. We also have no customers and thus no fiduciary obligations. Our income comes from the bid-ask spread (and liquidity-provider rebates from exchanges). For example, here is how a phone call might go:

COUNTERPARTY: "2 million Tesla?"

MARKET MAKER: "209 at 210."

COUNTERPARTY: "Buy 2 million Tesla for 209."

The counterparty is looking to buy _or sell_ 2 million shares of Tesla stock. They do not specify which in advance. The market maker says they will buy at $209 or sell at $210. The customer then confirms that they want to buy, and will buy at $210.

An order, when properly executed, does not betray its owner's intentions. This applies as much in the meat space as in HFT. For example, here is how one would _not_ place an order:

COUNTERPARTY: "I am looking to sell 2 million shares of Tesla stock at whatever price you'll give me. My wife just left me for a Brazillian stripper and I'm halfway through my handle of morning vodka."

This guy won't get 209 at 210. He might not even get 200. This isn't the market maker front-running a customer. It's a liquidity provider protecting his book and bottom line. This adversarial relationship is efficient - <USER2> keeps markets from getting too clubby.

There are valid critiques against HFT. (My pet is that HFT has no obligation to continue providing liquidity in adverse market conditions. This means they can pull out when the seas get rough, i.e. precisely when liquidity is needed. Traditional market makers cannot do that.) "Front-running" is not one of them.

<comment><USER13> _Until an order goes to the exchanges, only the customer and broker know about it. The order is material non-public information._

The problem with your argument is that it doesn't address that certain companies have paid money to co-locate their servers in the same datacenter as the exchanges. This is unethical because:

T + 0.000 seconds order is sent to an exchange

T + 0.001 seconds order is received by colocated companies

T + 0.090 seconds order is received by non-colocated companies

For the first 90 milliseconds, the exchange has engaged in "selective disclosure" which means the order is still material non-public information after it has arrived at an Exchange. For colocated firms to then act on that material non-public information is unethical at best.

Citation on "selective disclosure":

[http://www.investopedia.com/exam-guide/cfa-level-1/ethics- st...](http://www.investopedia.com/exam-guide/cfa-level-1/ethics- standards/standard-nonpublic-information.asp)

 _Selective disclosure? When information is disclosed selectively, i.e. just to a handful of investment analysts, or perhaps on a conference call, or in an email, the information may still be regarded as nonpublic. Companies are bound by specific procedures designed to make the information truly public and to ensure a system of fairness in which all market participants are given a chance to act on the information._

<comment><USER8> If people couldn't pay to co-locate with the exchanges they would still compete for latency reductions. They would try to get in the building across the street. Or the one two blocks away. Or the one with a direct fiber connection.

Being able to pay to co-locate with the exchange actually serves to democratize things because it puts everyone on a level playing field where they pay the exact same cost for the exact same access.

</comment></comment></comment><comment><USER14> I think there is a lot of nuance being left out in these types of defences which are misleading. For example,

> Note that the market maker at no point had the ability to change any order > in response to Big Joe.

But they sort of can, specifically the canonical example in Lewis' book is that HFT market makers change their standing order on other markets faster than it takes the orders of buy/sellers taking liquidity to hit that venue. That behavior isn't what a reasonable person would expect by default.

There is no mention of things like flash orders (which no longer exist in US equities?), hide-not-slide, payment for order flow, maker/taker, etc, all of which are potentially problematic and deserve discussion.

In short these defences are nearly as simplistic as the attacks they attempt to counter.

<comment><USER15> Agreed. But the difference is that the people defending them are not trying through public perception, or regulation to change the current system. If they are not asking for change, why should they be held to a higher standard than the attackers.

For all of the potentially problematic items mentioned, there is an equally problematic issue on the liquidity taker side. Invisible order books, iceberg orders, preferred router agreements, and large block rebates are all "features" that the markets provide to give advantages to the large institutional investor that harm the rest of the market but they aren't mentioned in the Lewis book, and are never referenced by folks trying to defend "the little guy".

</comment></comment><comment><USER16> > If we had no price discrimination, perhaps because of a regulation requiring > market makers to leave their quotes out in the market for 60 seconds, then > ... [t]he net result is that Big Joe would pay more to trade and Little > Billie would pay less.

The debate about HFT is largely about who gets to benefit from new information. Suppose someone does a lot of research and discovers that a firm is undervalued. Should they get to profit from the information, at the expense of current stockholders? Or is it better for stockholders to quickly figure out that their holdings are worth more? HFT helps the stockholders in this case, because it moves the price faster to its eventual higher equilibrium before the researcher can buy up many shares at the (low) current price. The researcher may have expended a lot of time and effort to get this information, and with the existence of HFT their work may not be sustainable.

Contrast this with someone who accidentally discovers public information that could be profitable, or someone who engages in insider trading. In both these cases it's hard to argue that we as a society should create rules that let them profit at others' expense.

In other spheres of life (software patents, copyrights), the law over-protects dubious discoveries and creations. Is information related to stock pricing different? Are we under-protecting it, such that we should let someone with new information collect more profit than they can today?

</comment><comment><USER17> I'm not buying it. Healthy markets are markets where everyone has access to the same information. HFT by definition means some traders have more access to information than others. This is fundamentally unfair and bad for markets and the economy. I don't see how HFT is any different then insider trading and everyone agrees that should be illegal.

<comment><USER18> _Healthy markets are markets where everyone has access to the same information._

If I want to sell 100,000 shares of Yelp (which is a multi-million dollar transaction), the fact that several million dollars of Yelp is about to hit the market is a really, really important bit of information. I have a reason to hide that from the rest of the market at least until I can complete my sale. HFTs profit by ascertaining my intentions faster than I can complete my intended action and then broadcasting my intentions to other market participants via the ticker tape, whereas previously my intentions were proprietary information locked in my head.

An argument against HFT is, necessarily, an argument that I should be allowed to benefit from material non-public information about the near-term state of trading in Yelp.

<comment><USER19> That's _private_ information. It is an important distinction. You're saying the market should have a right to know whether I plan on selling my shares next year.

<comment><USER18> I'm saying that if anybody can successfully predict your intentions for next year based on your observable actions to date then they have a right to the fruit of those labors, and that you don't have a cognizable interest in "Prevent that person from telling the rest of the world about my intentions for next year", even though that might lead to you making less money than you would but for our friend who reads actions well.

<comment><USER20> >I'm saying that if anybody can successfully predict your intentions for next year based on your observable actions to date then they have a right to the fruit of those labors

I don't see why this is so. If I have decided through some analysis that I am going to sell X shares at some date, why shouldn't that information be private? Front-running my _behavior_ is essentially front-running my analysis. It would be unethical to hack my computer and read my analysis for yourself, so how is analyzing my behavior to get at that same information any different?

<comment><USER21> If you're buying a million dollars of Yelp (as posed in this hypothetical), then it's going to take some time (microseconds, minutes, months, etc) for people to realize that. For as long as no one catches on, the person making this large order has a tremendous advantage because supply-demand is misunderstood by everyone else. The market can't fairly price the stock as a result. The HFTs are saying they'll pay the money to get order info in nano- seconds so they can design algorithms to recognize these large orders and react appropriately. They make money being a middleman but the benefit for the rest of the market would be seeing a price change and also for small orders to be filled at a fairer price to supply-demand.

<comment><USER20> >For as long as no one catches on, the person making this large order has a tremendous advantage because supply-demand is misunderstood by everyone else

Why is the market entitled to knowledge that I'm currently in the process of making a big order? This knowledge being disseminated clearly doesn't benefit me. Should I not be entitled to the sole benefit of my reasoning in deciding to make a big order? Furthermore, how does this knowledge being disseminated mid-order rather than after the full order has completed benefit the market as a whole?

<comment><USER11> Not that I think any of this outright determines how the argument should go, but a couple points:

Your knowledge _that_ you're placing an order of size X, and _why_ you're placing an order of size X, is always going to be more precise than what's gleaned from observing your behavior, and thus you'll still have an advantage.

 _" Furthermore, how does this knowledge being disseminated mid-order rather than after the full order has completed benefit the market as a whole?"_

For a large enough order in a sufficiently illiquid market, "after the full order has completed" could be days later. More things being priced in means more accurate prices, and that seems to be of some benefit to "the market as a whole." Though to be sure, the longer time frame isn't terribly relevant to the "predatory traders" across exchanges that Chris had been discussing.

Edited to add: Also, the market doesn't learn anything about _you in particular_ \- orders are anonymous. What we learn directly is "a trade happened for X lots at $Y", along with possibly which side was the aggressor (depending on the exchange).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> TL;DR: Defending HFT's argues for rewarding market participants who simply jump in front of the line b/c they see other people doing it, at the expense of participants who have worked hard to decided which line to get into.

Here's a more fundamental question to ask:

What kind of behavior do you want to reward in the stock market?

If you view the stock market as a bunch of numbers that wiggle around, where "information" is conveyed by the actions of other people participating in the market (ie, what they're buying and selling), then the HFT's play a legitimate role in spreading that information around.

If you view the market as a place to buy and sell businesses (equivalently - shares of businesses), where capital is allocated to businesses commensurate with the value they provide to society, HFT's are parasites on the effort of others.

There are participants in the market that spent an enormous amount of time, diligence and thought into deciding allocating capital to businesses according to the value they ascribe to the businesses. For these participants, the signal they send by putting out their orders is currently taken advantage of by other participants who spend enormous time, effort and money into trying to "tap into" the result of the efforts put forward by the first group and rush to another exchange to buy up that company before anyone else gets there.

So: Do we really want to reward all of the effort spent building faster machines, communication links, and algorithms to jump right in front of someone in line? Or do we want to reward those people who are actually determining which businesses have intrinsic value and which do not?

It's easy to hate Einhorn or Ackman b/c they're rich. What's important to keep in mind is that they are custodians of and act on behalf of thousands, probably even millions of other people to improve their financial situation. Pensions, endowments, sovereign wealth funds, etc make up the bulk of the funds that Einhorn, Ackman and others invest. The fact that they're rich an indication of their legitimate hard work at researching and allocating capital and enhancing the financial well-being of their clients. (Note: yes, there are always bad apples that get rich by illicit (read: insider) means, but that is an exceedingly small amount of participants and over time they usually get caught).

Warren Buffett has often said that a perfectly good stock market would be one which is open only one day a year, where participants put up orders based on the value they actually ascribe to a business. If those orders cross, then trades occur - all in one day.

Makes you wonder what would happen to society in that market. Would people would be able to find a way to channel all the frenetic activity currently employed in chasing prices and watching others' actions into a more productive endeavor?

<comment><USER23> David Einhorn is a hedge fund manager, not a mutual fund manager. Vanguard, one of the world's most reputable mutual fund managers, is on record as saying that HFT has improved their cost to trade.

That was an easy point in your comment to respond to. The rest of it doesn't appear to have been based on Chris Stucchio's post at all; you could just as easily have posted it in every thread on HN about HFT. I must be missing something; what is it?

<comment><USER10> My attempt at a charitable interpretation of Jalopy's post is that he is saying it's actually a bad thing to transfer wealth from informed traders. This is because David Einhorn has demonstrated great competence at trading, and if HFTs predate him it reduces his incentive to continue transmitting useful information to the markets.

I find this to be an argument I can't dismiss easily.

I've added a link to your comment to the original post. It's important to spread this idea as well.

<comment><USER22> Thanks - you captured a good part of my argument. I'd make a small correction though. I don't consider it "trading" as much as "investing".

As a former quant trader and a current (and forevermore) value investor - there is a big difference.

</comment></comment></comment></comment><comment><USER24> reading about the stock market is always kinda disgusting to me. "If a speculator believes AAPL is undervalued, he buys a bunch of shares of AAPL. This drives up the price until AAPL is no longer undervalued - then the speculator can sell his AAPL and reap the profits." \-- the part after the dash shocked me :) seems like the entire purpose of the market is speculation? does anyone actually invest in companies any more? :D

i did like reading this, informative. gave me a nice other perspective on HFT.

however: (a) Goldman Sachs does not have it's own HFT outfit? they are the "helpless victims" here? sounds a little unbelievable. (b) why is it exactly socially beneficial that some HFT company performs this "robin hood" act (lol)? particularly if it exposes us all to the risk of market volatility due to mindless algorithms performing enormous, senseless trade volumes with each other?

all in all, i'd vote for that very small tax on trades, just to get rid of this as-yet-unseen level of speculation.

<comment><USER24> p.s. how does moderation on this site work? i have been downvoted, and i wonder - is this an act of some admin moderating, or do users with sufficient karma get a downvote button and one of them simply dislikes my comment?..

<comment><USER25> > ..., or do users with sufficient karma get a downvote button (...)?

Yes, they do. I always forget the threshold, but there is one. Check the 4th point in the FAQ: [http://ycombinator.com/newsfaq.html](http://ycombinator.com/newsfaq.html)

<comment><USER24> thanks!

</comment></comment></comment></comment><comment><USER26> As I understand it, the main issue with HFT are two fold:

* some cases of insider trading at under-a-microsecond rhythm, that sound like faster-than-light favoritism but are actually covered by existing legislation (you just need to update judges and the SEC on basic technological feasibility);

* dangerous unmanned behaviour -- flash-crashes.

Front-running has always been presented as controversial at best, i.e. taking cents from people who could spare dollars; more often illustrative of finance's excess (spending the GDP of a large country to establish even faster lines between cities already well connected, not that makes any more sense than blaming Formula 1 racing for going above the legal limit).

I understand his passion, and the "I'm a geek and I work for a small company facing Goldman" inferiority complex must be crushing -- he writes himself 'A _fervent_ defense'. However, that seems to be missing the key issues most people have with such technology left unmonitored.

</comment><comment><USER27> If HFTs liberate access to price information, then does that make them the "open-source software" equivalent of our current economic operating system? That is, in the same sense that OSS delivers bundles of information about how to do various computational tasks efficiently via source code, HFTs deliver bundles of information about how to value companies efficiently via the ticker tape.

In the same way that the source code reveals the genius of the programmer's understanding, the excellance of an HFT is revealed by the report of the ticker tape.

</comment><comment><USER28> I'd be more impressed by a "fervent defense of HFT" from somebody who isn't in the business.

<comment><USER10> Do you disagree with my arguments or are you appealing to the genetic fallacy?

Not that it matters - I left HFT a long time ago.

</comment></comment><comment><USER29> TL;DR: Stucchio thinks that front-running people is fine in circumstances where it's not prohibited by law. It's legal, therefore morally right, is his argument.

Other people (including very many securities regulators) think that the problem here is that the law is missing a prohibition.

<comment><USER5> You'll find this attitude (it's legal, therefore it's morally right) is very prevalent in the investment finance industry. It's as if these guys lack a moral compass of their own...

<comment><USER15> That sort of smear may or may not be true, but it isn't what is happening in this case. What is happening in this case is that 2 groups (large liquidity purchasers and liquidity providers) have a natural antagonistic relationship with each other. Purchaser always want to lower the price and providers want to raise it. This is good for the markets operation.

But there is a PR/Power imbalance currently in the market. The large purchasers have tons of money had influence. They are using it to smear the sellers of the product they want. The sellers happen to be an easy group to smear (they are highly technical, secretive, and operate in a world that no one seems to understand).

If anything is immoral in all this is that they are actively trying to obfiscate what is happening in the markets and thereby spreading fear.

<comment><USER30> > The sellers happen to be an easy group to smear (they are highly technical, > secretive, and operate in a world that no one seems to understand).

Once you understand what it is that they are doing, it's pretty clear that it's wrong.

Unfortunately, they like to muddy the issue. Hell, the OP does that every time it comes up on HN by asking people to explain what their problem with it is using obtuse industry jargon (e.g. "which part of FIX/OUCH enables front running?").

<comment><USER15> This is a really late reply, and probably futile in any case, but your comments on this subject make me think you don't actually understand "what it is that they are doing". When people try to explain it to you , you accuse them of using "obtuse industry jargon". Yet you've left them little choice.

An analogy (flawed as they all are) is if you came onto these forums and claimed that udp networks were evil and a tool whereby network consultants got rich on the back of "regular internet users". To back this up you pointed to some articles in People that claimed "Don't trust your UDP network, it might delete your traffic!" When anyone who actually understood networks said something like, "well it's nuanced, error checking is valuable in some cases and not valuable in others" you said, "DON'T MUDDY THE WATERS WITH YOUR JARGON!"

At this point, because networking is such a widely dispersed information set, and there aren't any high profile authors backing up your assertion that "UDP IS DANGEROUS IT LOSES PACKETS!" members of this forum would start down voting you into oblivion and making cogent arguments about why you are so very, very ignorant.

The only reason this hasn't happened yet is that knowledge of electronic trading systems is not as widely disseminated and every one with a 401k and a DSL modem thinks they know what electronic trading is about.

I will tell you this much, everyone who has ever actually traded electronically sees your comments and thinks of you as the "UDP is evil" guy. That we are in the minority means that we can't just laugh at and/or ignore you like we could if you were claiming nonsense about networks. For all I know you are a senator. So with that said, ask a straight forward question, I will answer it without any equivocations given that they aren't covered by IP agreements.

</comment></comment></comment></comment></comment><comment><USER30> >Predatory traders break this information advantage. Instead of Goldman, David Einhorn or other informed traders gaining the full benefit of their information, predatory traders detect that information and split the profits with the counterparties (taking a cut in the process). Predatory traders improve market efficiency by turning information about market demand into price movements. They are simply criticized because the price movement happens before the whale actually wanted it to.

This is the exact same defense used against insider trading and front running in general.

There is __nothing __special about HFT in this respect, other than the fact that it is currently still legal.

Edit: downvoting without responding. classy.</comment>


Chrome for Android may start disabling JavaScript on 2G connections - <AUTHOR> https://www.androidpolice.com/2018/08/23/chrome-android-may-start-disabling-javascript-2g-connections/ <comment><USER2> Looks generally harmless. Only worry I would have is sites that don't rely on JS but use trackers and users get the bottom UI message. On the other hand, this could detract users with spotty connections from sites that require JS be loaded to perform any interaction on the sites.</comment>


Why Microsoft Is Willing to Pay So Much for GitHub - <AUTHOR> http://feeds.harvardbusiness.org/~r/harvardbusiness/~3/KO-IS2PbrLI/why-microsoft-is-willing-to-pay-so-much-for-github <comment><USER2> MS paid that much for GitHub because it was a bargain. Their market cap is about $770 billion, after the acquisition announcement they're stock is up 2%, which paid for the acquisition and then some. And the $7.5b given to Github wasn't in cash, it was completely done in MSFT shares.

In return they get access to millions of developers who've never tried .NET, Windows, or Azure. Even just converting a small fraction of those is billions in added revenue.

<comment><USER3> For me, its actually a really good thing. I've been on the .NET stack my entire career. I love using it (obviously, since I'm use to it). But, there's always been a lingering worry that time may be up for my skillset (at least for non-government work).

The move, seems as if Microsoft is really pushing hard to make .NET the defacto developer platform of the web. Or at least, focusing on making it very compelling to use. Not just for old work, but going into the future.

</comment></comment><comment><USER4> The author gives a very one sided picture why such investments make sense. Well, he earns a lot of money in this business.

I would be more interested how many of these acquisitions are successful?

I remember Nokia buying Navteq for €5.7 billion (US$8.1 billion) in 2007. And selling Here for €2.8 billions in 2015 (US$3.1 billion, US$2.9 billion according to another source, I didn't check the exchange rates, 200 million seem to be peanuts in the context). Inflation-adjusted the numbers would look worse.

Burning more than half of the acquisition value did obviously not save Nokia's mobile business on the way.

While we are at it Microsoft bought Nokia's mobile business just to close it down 3 years later and writing off US$7.6 billion.

Google bought Motorola phones for US$12.5 billion to sell it off for US$2.91 billion.

All this demonstrates is that corporations have immoral amounts of money to gamble with. The little droplet we can contribute to avoiding this is trying to spend our peanuts in favor of smaller businesses. (Yes, I still have a Skype, a LinkedIn and a github account)

<comment><USER5> I think that is what the author means as strategic vs. financial. For example, buying a company for its list of customers, to eliminate them as a potential threat, to get some IP/technology they have, etc.

You are right that the large tech companies have extremely large bankrolls to just do what they want in a sense.

If you view it from their perspective, a success might mean they get access to 1000's of companies using GitHub to try and sell Enterprise hosting, development tools, etc. to. All it cost them was $7.5B in stock.

</comment></comment><comment><USER6> > Microsoft is not paying $7.5 billion for GitHub for its ability to make > money (its financial value). It's paying for the access it gets to the > legions of developers who use GitHub's code repository products on a daily > basis (the company's strategic value) — so they can be guided into the > Microsoft developer environment, where the real money is made.

This reaspm makes the most sense to me, re: why Microsoft purchased GitHub.

</comment><comment><USER7> Atlassian + AWS was a threat to Azure. Enterprises refused to pay for both TFS and Alassian licenses. This is a headshot at Atlassian to create a MS monopoly in enterprise version control.</comment>