Making a Statically-Linked, Single-File Web App with React and Rust - <AUTHOR> https://anderspitman.net/2018/04/04/static-react-rust-webapp/ <comment><USER3> > This is somewhat similar to what Electron accomplishes, but your backend is > in Rust rather than JavaScript, and the user navigates to the app from their > browser.

An option in the middle is webview[0] which will "appify" it by using OS- native browser lib so you don't have to carry Chromium, V8, or all the multi- process ugliness but you still get the web stack.

Also everybody, don't forget to check your Host headers when building apps running HTTP daemons locally or you'll be open to DNS rebinding attack. And if your use case can support it, a random port is nice too.

0 - [https://github.com/zserge/webview](https://github.com/zserge/webview) 1 - [https://en.wikipedia.org/wiki/DNS_rebinding](https://en.wikipedia.org/wiki/DNS_rebinding)

<comment><USER4> I just wish electron could somehow harness the fact that everyone has a browser installed.

<comment><USER3> Well, Chrome doesn't really allow chrome.dll to be easily used. Electron has deep requirements on Chromium for V8, IPC, webview, customer protocol handlers, etc IIRC so it can't just easily switch browser engines. I'd say if you want this, the Chromium project would have to prioritize a stable Chrome ABI from their shared lib which I doubt they would do. And it still doesn't solve the extremely mem-bloated approach they take to serving the web stack. So for that, the Chromium project would have to prioritize better runtime feature gating for mem reduction and maybe revive first-class support for single-process mode, which I doubt they'd do. And even then, you're carrying node.

To sum up my rant, I'm afraid the fast moving web stack, coupled with the fact only a few companies can keep up, coupled with the fact that those companies are laser focused on their own browser use case and not embeddability combine to make this incredibly common desktop use case still suck. In the meantime, just hope these OS engines stay minimal and don't fall too far behind the standards you want.

<comment><USER5> This is what makes me want to see something like Electron developed over Firefox internals.

Packaging my own browser with my code so that I am now developing toward ONE client instead of any random thing that can speak http, and at the same time, being able to take the core of my app, tweak it a little, and plop it out on the web without a complete rewrite ... that is completely amazing. It's what I've wanted since forever.

Even better would be the ability to optionally include features in my build. Like if I don't NEED WebGL, the MIDI and Audio APIs, etc, etc ... it'd be pretty nice to be able to optionally exclude those from the bundled browser to minimize size.

However, I don't want to be welded to google. Mozilla's codebase seems ripe for such a development.

<comment><USER3> > This is what makes me want to see something like Electron developed over > Firefox internals.

Tried, but abandoned presumably based on prioritization: [https://github.com/mozilla/positron](https://github.com/mozilla/positron). I was hoping Servo would help here, but from the outside looking in, the pieces are being moved into FF proper and the Servo browser's priorities have been reshifted to being a part of the VR team. Sure they're still making a general use browser (and that's quite a feat), but the embeddability game may suffer (I believe conforming to the CEF iface that was there original goal has become stale).

</comment></comment></comment></comment></comment><comment><USER6> "Because I've been obsessed with static linking for as long as I can remember and I'm not really sure why."

Glad I'm not the only one.

When I was younger, I made a hobby Linux distro that ran completely on floppies with a custom filesystem hierarchy. All the binaries were in /Programs and were statically linked against uClibc. Even X was statically linked, there was some abandoned branch of XFree86 that ran with a VESA driver and fit under 1.44 MB. I thought that I was the bee's knees.

All this was still possible ~2007. Not sure how masochistic you'd have to be to try today.

<comment><USER7> Same, although people think it's silly I find it less error-prone. The same goes for C++ libraries, only using singe-header or amalgamations because it's less to support and ABIs wont break between versions.

</comment></comment><comment><USER8> Being able to include arbitrary data inside a static binary is definitely a nice side-effect of rust and golang being able to produce static binaries.

If you're interested in stuff like this for go, I've used [https://github.com/GeertJohan/go.rice](https://github.com/GeertJohan/go.rice) with great success.

[EDIT]

"feature" -> "side effect"

"rust and golang" -> "rust and golang being able to produce static binaries"

<comment><USER9> Maybe for younger generations.

Apple and Microsoft systems have been supporting this on their native toolchains since the mid-90's.

<comment><USER8> Yes, including arbitrary data in binaries is probably as old as making binaries itself.

I think what _is_ new is that in the mid 90s you didn't have an open source, memory safe, ergonomic, strongly typed, type inferenced language that targets multiple platforms with ease, with a decent standard lib. Rust is delivering that. Golang is delivering that. I think those two are novel in that sense.

From where I'm sitting the last few decades have been ruled by VMs and the explosion of scripting languages, because no one wanted to use those Apple/Microsoft toolchains that have been around in the 90s. While those toolchains rested on their laurels (or didn't, can't tell the difference now), Java became the enterprise workhorse.

<comment><USER9> Well, Turbo Pascal, Delphi and Oberon also supported it, and they check some of those bullet points.

Many devs do actually enjoy those Apple/Microsoft toolchains.

<comment><USER10> Common Lisp as well. For certain definitions of memory safe.

<comment><USER11> The "decent standard lib" part is debatable, especially if you don't slip on the "targeting multiple platforms with ease" part.

<comment><USER10> Fair enough. Quicklisp + SBCL/Clozure is pretty solid but I suppose that wasn't the case 20 years ago.

<comment><USER11> For sure, and its standard library equivalent was very, very good for the time, just not by 2018 standards.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I turned my private website (not the one listed on my HN profile) into a single binary doing something similar to what OP is doing, except I didn't know about include_str!, only include!, so in my build.rs I first read in my static files and then I write them out as byte array declarations into intermediate Rust files which I then include! in my src/main.rs.

Thanks to this short blog post by OP I learned something that will let me simplify some of my code.

However the thing that I am doing is not completely useless, because I have been able to embed fonts, favicon and images as well with the method that I am using.

The code I have written for this is only the beginning but if anyone wants to look at my code in order to see how I did it here you go:

[https://gist.github.com/ctsrc/4c4cc05254d12bbc8937a0ea385fcd...](https://gist.github.com/ctsrc/4c4cc05254d12bbc8937a0ea385fcdad)

It's far from great but it's a start. Let me know how you would do it better :)

Speaking of Rust and websites, in Python I have fallen in love with the pyTenjin templating engine. [http://www.kuwata-lab.com/tenjin/pytenjin-users- guide.html](http://www.kuwata-lab.com/tenjin/pytenjin-users-guide.html). Does anyone know of a templating engine like pyTenjin but for Rust?

<comment><USER13> > However the thing that I am doing is not completely useless, because I have > been able to embed fonts, favicon and images as well with the method that I > am using.

FWIW there's also an include_bytes! macro to embed binary data right into the executable without going through a separate rustification step.

<comment><USER12> I actually already use the include_bytes! macro within the build.rs. Looking at the source I see that I create arrays of arrays of bytes, not just arrays of bytes as opposed to what I originally said. It was a few months since I wrote that code so I hope I would be forgiven for not remembering such details ;)

My eventual plan that I remember now was to make it so that I could reference static files (CSS, JS, icons and images, fonts) in my static HTML files and HTML templates, and build.rs would automatically include the bytes of those files.

<comment><USER12> I have now rewritten my code so that I include bytes directly in my src/main.rs like so:

        #[get("/fonts/<fname>")]
        fn fonts<'a> (fname: String) -> Result<Content<Vec<u8>>, NotFound<String>>
        {
            match fname.as_ref()
            {
                "autobahn.woff" => Ok(Content(ContentType::WOFF,
                    include_bytes!("../static/fonts/Autobahn/autobahn.woff").to_vec())),

                "autobahn.ttf" => Ok(Content(ContentType::TTF,
                    include_bytes!("../static/fonts/Autobahn/autobahn.ttf").to_vec())),

                "grobe-deutschmeister.woff" => Ok(Content(ContentType::WOFF,
                    include_bytes!("../static/fonts/Grobe-Deutschmeister/grobe-deutschmeister.woff").to_vec())),

                "grobe-deutschmeister.ttf" => Ok(Content(ContentType::TTF,
                    include_bytes!("../static/fonts/Grobe-Deutschmeister/grobe-deutschmeister.ttf").to_vec())),

                _ => Err(NotFound(format!("No such file: /fonts/{}", fname)))
            }
        }

In the meantime since I first wrote my original code, the web framework I was using called Iron [1] has become unmaintained and they now urge people to pick a different framework. I chose to use Rocket because it seemed to have the features I want and the documentation seemed good enough to get started (and it was).

For templating I found Askama [2], which I am using from git master in order to be able to use it together with Rocket. [https://github.com/djc/askama/issues/71](https://github.com/djc/askama/issues/71)

Eventually I will generate the routes for the included bytes with build.rs again. My new code is better both short-term and for when I will create said build.rs.

Thank you masklinn for your comment about include_bytes! which made me look at my code again and rewrite it.

[1]: [https://rocket.rs/](https://rocket.rs/)

[2]: [https://docs.rs/crate/askama/](https://docs.rs/crate/askama/)

</comment></comment></comment></comment><comment><USER14> You can do this in pretty much any language. Back in the early 2000's, people used to take the Perl source code and replace the main loop (you know, the part that actually opens files and reads in your "perl scripts") with the text of a cut and pasted perl script. So when the executable ran, instead opening a file, it simply ran the perl code that was nothing but a (giant) string within the perl interpreter executable. Nothing stopping you from including the code from a perl http server or other perl framework instead. I think cpanel did something like this for many years as their toolset was all perl but distributed as a single binary file.

<comment><USER15> Can of course still do this with FatPacker: [https://metacpan.org/pod/App::FatPacker](https://metacpan.org/pod/App::FatPacker)

But, AFAIK, only supports Pure Perl code, so one is SOL for most database drivers etc...

<comment><USER16> PAR[1] is what you're looking for.

 _It supports loading XS modules by overriding DynaLoader bootstrapping methods; it writes shared object file to a temporary file at the time it is needed._

1: [https://metacpan.org/pod/PAR](https://metacpan.org/pod/PAR)

<comment><USER15> Awesome, thanks for the pointer! CPAN still has lots of tricks up its sleeve, eh :)

<comment><USER14> There will apparently never be a replacement for Perl :)

</comment></comment></comment></comment></comment><comment> dr-ando If is interesting to you, I also suggest to check out my Rust crate bui- backend[0]. This is a library for building Browser User Interface (BUI) backends. The key idea is a datastore which is synced between the backend and the browser. The demo has several example frontends. The most interesting perhaps is the yew[1] framework, which is somewhat like React but in Rust. This lets you share code directly between the backend (natively compiled) and frontend (compiled to wasm). There is also a pure Javascript frontend, an Elm frontend, and a Rust stdweb frontend in the demo.

0 - [http://github.com/astraw/bui-backend](http://github.com/astraw/bui- backend) 1 - [https://github.com/DenisKolodin/yew](https://github.com/DenisKolodin/yew)

</comment><comment><USER17> I don't see the point of this. Why not use nginx which comes with startup scripts and point it to the site's directory that includes the bundle/index files?

If the single binary that just serves static files you're better off with a web server that supports https, rules, vhosts, etc and is battle tested. Not to mention that this binary you created will need startup scripts of some sort depending on the platform.

<comment><USER18> I don't see point of this either. I aware this would cost me lot of hardly obtained karma, but I feel I have to say this.

Strange how some people are obsessed with hype. I think what raised interest of this article was just word "Rust" in the title. Rust seems to be wet dream of many developers. They heard it's safe, so it will magically solve all their problems. But the usage of Rust in this case is meaningless. You could do the same with python, nodejs, java, just plain nginx or million other (and better) ways. Just first google query returned probably better solution if you like single static binary [http://miniweb.sourceforge.net/](http://miniweb.sourceforge.net/). It would be two files instead of one miniweb binary and static site compressed as 7z.

How does this thing scale? What about SSL? Do I have to put reverse SSL terminating proxy in front of it? Yes, you say? Ok, why not just use that proxy for serving those static files too (nginx does that) and skip this thing completely. What about performance? Have you tried to httperf on it?

I would appreciate if this did more then just being a single binary. Like Facebook's HipHop compiler of PHP to static executable or something like that. Sorry but this is real bullshit.

<comment><USER19> You're bashing it based on some assumption that it's being heralded as an amazing piece of tech. It's just a static binary. If you want to argue the merit of static binaries then, by all means. I personally love them, it's one of the reasons why I like Go so much. I'm sure there's a ton of people who like static binaries, and who dislike them.

There's nothing else to see here, you either like dependency-less binaries or not.

Hell, if anything, I don't see the point of your point, calling static binaries "real bullshit". Depending on the scenario static binaries are either better for you, or worse for you - it's just a tool in a bag of tools. How can that possibly be bullshit? Is a wrench bullshit?

<comment><USER18> I understand that static bundled site as rust executable is not for me. However I'm asking for who is? Specially considering my concerns about about SSL, performance.

EDIT: I'm not against static binaries per se. Only against this usage of them.

<comment><USER19> I've actually used static bundles (including css/etc) for a lot of internal applications, both at home and at work.

Basically anywhere where reducing difficulty of deployment and asset management outweighs the valid concerns you pointed out. It's really, really handy in my view.

Of course, I've got no plans or desire to run some production documentation site on this. Yet, that problem domain is vastly different than internal tooling, OSS apps, etc.

Just think of a note web app you write. Do you want your users to _have_ to manage css/template/image bundles just to use your note app? Why not just make the binary work with zero configuration/management? Plus, if you wanted - <USER2> can of course support both, allowing the user to override css files if they so desire, without having to recompile the binary/etc.

<comment><USER18> If theoretically had that need, I would first go with docker and if hw is limited, then maybe this thing I just googled out as part of research on the topic:

[http://miniweb.sourceforge.net/](http://miniweb.sourceforge.net/). It would be two files. 20k server binary and 7z with site resources. It would safe me trouble of recompiling binary.

</comment></comment></comment></comment></comment></comment><comment><USER20> Have done several sites in this exact fashion, except coded in Nim, not Rust. A reasonably sized, musl-linked, absolutely standalone executable with SQLite baked in for data storage. That's two files all told - the program and the data. Super simple deployment, I usually stuff the thing behind a Caddy server these days. Never let me down so far.

</comment><comment><USER21> I've never used rust before, but have been meaning to look into it and play around some. OP mentions the include_str! function(maybe its a function, not sure what '!' signifies here) and it blew my mind.

I'm betting that almost every language that I've used has something like this, but the succinctness of it and how it's used to keep the source clean, but still compile in the text is really cool.

<comment><USER22> Normally webservers serve files with the _sendfile_ system call for zero copy IO. If the string is statically included in the binary then it first has to copy it into kernel space to send the data. So this is actually less efficient.

In theory this could be re-optimized with _vmsplice_ , but I wonder whether that webserver actually does it because vmsplice's lifetime requirements are... complex (although a &'static str would meet those requirements). Or the binary could sendfile itself if it knew the position of the string in its binary image, but that information is not preserved by a &str.

<comment><USER23> Putting the string in the binary is really only useful for trying to do ultra- portable deployments like this imo. The overhead of copying the string into memory is pretty meaningless in the use case where you only expect a single, home-desktop user.

Now if this was a production server having to service thousands of clients than the sendfile optimization becomes much more important.

<comment><USER24> Even in production though, you can just have a step on startup which copies built-in resources to a /tmp location and then sendfile's from there.

</comment></comment></comment></comment><comment><USER25> There's a small typo on the article in /ui/dist/index.html - the script source should be '/bundle.js', not '/main.js'. I think the git repo corrected this error

<comment><AUTHOR> Thanks, fixed!

</comment></comment><comment><USER26> I do similar, except I just deploy to AWS as a static website. Super duper minimal everything.

<comment><USER27> The tutorial stops where it starts to get interesting, actually implementing any logic with the backend other than serving static files. It would have been interesting to follow through a database transaction or see some data / image manipulation.

<comment><AUTHOR> I actually agree. I extracted this tutorial from a project I'm working on developing an RTS game for school. I'm experimenting with having the game loop run in Rust and seeing if I can send render updates fast enough to smoothly run the UI in JS. It's working pretty well so far. I'm using Protobuf 3. I'd love to get capnproto or flatbuffers working eventually, but neither of them seem to have both JS and Rust support mature yet. I think the next obvious evolution from this tutorial would be to connect a sqlite db. Not sure how easy statically linking with it is though.

<comment><USER23> Are you talking about statically linking the database itself? Seems like it'd be better to keep the database separate from the binary, unless you're working with a read-only database.

For static-linking the sqlite3 library, if you're using rusqlite you can just specify the bundled feature in Cargo.toml.

``` [dependencies.rusqlite] version = "your-version-number" features = ["bundled"] ```

<comment><AUTHOR> Yeah I meant statically linking the sqlite library. Thanks for the tip on how to do it

</comment></comment></comment></comment></comment><comment><USER28> I've done this same thing before with Node using [nexe]([https://github.com/nexe/nexe](https://github.com/nexe/nexe)) and musl.

With a little bit of effort it's also possible to build and statically link native modules, eg I've had success with nodegit, uws and sqlite. (Needed to rebuild some of the node deps with musl, then rebuilding the native modules with musl, then modifying Node's node.gyp to --whole-archive include the additional .a/.o's (done in nexe), and using rollup to rewrite the .node includes to `process._linkedBinding('the registered module name')`, and then nexe builds the whole lot into a single executable.)

Nexe supports bundling resources (although less cleanly than `include_str` imo) so it can also bundle all your ui resources as well.

</comment><comment><USER29> Fossil ([http://fossil-scm.org/](http://fossil-scm.org/)) has been doing very similar for a while in plain C, it ships statically-linked and includes a CLI and a web UI. (not in React, however)

</comment><comment><USER30> I love these things. I made my resume page by piping together two small rust pograms and a bash script to get a single html, from a json in firebase, a handlebars template and several static assets.

</comment><comment><USER31> I really like this guide to get started.

Its a bit short though. I would really like to see the setup of a simple uni- or even bi-directional rpc or value binding mechanism between react and rust.

<comment><AUTHOR> The project that I extracted this from actually uses a bi-directional websocket with proto3. It's just a simple message system and doesn't have binding. The code isn't great or documented but you can check it out here: [https://github.com/anderspitman/battle_beetles](https://github.com/anderspitman/battle_beetles)

<comment><USER31> Thx! Nice.

Maybe json-api on a websocket on the same port as a transport would also be possible? Protobuf seems a bit overkill for something that is that tightly integrated together IMO. But if it works, it works.

<comment><AUTHOR> The use of protobuf is mostly to provide a schema and enforce strict[er] typing on JS.

</comment></comment></comment></comment><comment><USER32> Cool small example. It's helpful to have the actual cli commands on hand.

There's just a small typo. The script path in the HTML mount file and the router path need to be the same, but do not match. Either one needs to change:

        // ui/dist/index.html

        <script src="/main.js"></script>

        // src/main.rs

        (GET) ["/bundle.js"] => {
            Response::text(bundle)
        },

<comment><AUTHOR> What I really need is a tool to generate blog-post code snippets from actual code ;) Thanks, fixed!

</comment></comment><comment><USER33> How hard would it be to use something like this to deploy directly onto a hypervisor, like with Erlang on Xen?

<comment><USER34> Not sure about on a hypervisor, but if you're using Docker, you could do something like:

FROM scratch COPY ./bin/app /app ENTRYPOINT ["app"]

which will make a barebones image with no OS cruft. You need to make sure your binary _is_ truly statically linked though. The key being the inclusion of musl libc in in the OP's build.

I've tried this with golang and you need to pass some odd flags I can't remember off the top of my head to get it to not dynamically link gnu libc, but once working you have container images that are incredibly small.

I'd imagine with a minimal container host like CoreOS you get largely the same effect as running Erlang on Xen.

</comment></comment><comment><USER35> One reason this is nice is that certain build systems make it easy to copy 1 file or variable into a repository, so this might be easier than pushing a container to a private repository that can be somewhat configuration error prone. However personally I might still use Docker with this :)

</comment><comment><USER36> To simplify statically cross compiling Rust code for different target platforms, including musl and openssl support, check out [https://github.com/messense/rust-musl- cross](https://github.com/messense/rust-musl-cross)

<comment><AUTHOR> Was really hoping this would include Windows and MacOS support somehow, but it looks useful even without them.

</comment></comment><comment><USER37> For me, the Rust syntax is hard to look at and read. I much prefer Go which reads like C, Perl, PHP, JS or many other common languages.

I'm wondering if people who prefer Phython prefer Rust? I've been developing for 20+ years and the syntax alone makes Rust feel prohibitive to me.

<comment><USER23> To be fair, this sample of code includes macro usage (every function call that ends in an exclamation point is actually a macro). The syntax inside the macros is different from normal, legal rust syntax.

Still, I agree that Rust's syntax approaches C++ level of complexity at times. I find that writing actual statements and expressions is simple enough, but writing structs, lambdas, and function definitions requires knowing how to specify types, type bounds (if using generics), lifetimes (if using references), and Fully Qualified Syntax (for referencing types/items in other modules). And that's before actually having to come to terms with the borrow checker.

For what it's worth, once you get over the initial learning curve the cognitive burden goes down. Rust's syntax, to me, is actually visually distinctive enough that it's easy to parse out types, expressions, declarations, etc. from just a quick glance.

</comment></comment><comment><USER38> Is there something like "50% statically-linked". I'm trying to understand if static linking can be partial. I often see it done it all in or none.

<comment><USER39> Remember that ultimately, you link multiple things in, and each can be linked dynamically or statically. So, a "100% statically linked" binary would have _every_ library statically linked, a "100% dynamically linked" binary would have _every_ library dynamically linked, with all the ranges in between.

This comes up with Rust due to what's in the article:

> This part can be skipped if you don't need 100% static linking. Rust > statically links most libraries by default anyway, except for things like > libc.

Rust statically links Rust code by default, but has a dynamic link to libc. So Rust binaries are "mostly statically linked" for this reason. MUSL lets you link that final dependency, getting up to 100%.

</comment></comment><comment><USER40> I wanted to use rust for web development for a while but always struggled with just getting an OAuth2 example running in the past, has this improved recently?

<comment><USER41> Everything is always improving. Unless you let us know what you had issues with, no one can tell you if it's been made easier.

For instance, are these issues with rust you're having, or with a particular framework? Without any information, it's a meaningless question.

<comment><USER40> If this project discussed here is using react and rust together, could I just use an react example for OAuth2 to get started with? Up to some months ago, there were no examples of using any of the Rust web frameworks with OAuth2.

</comment></comment></comment><comment><USER42> Can it pass C10k?

</comment><comment><USER43> Or, you know... Python.

<comment><USER44> How do you make a statically-linked, single-file web app with python?

<comment><USER9> With something like py2exe.

</comment></comment></comment><comment><USER45> it's very rare to only run one http based server app (port 80). So you probably want to put a proxy (like nginx) infront of it, but then you could just let it serve the files.

</comment><comment><USER46> (misunderstood)

<comment><USER32> The JavaScript file is actually added to the Rust binary at compile time as a static string.

</comment></comment><comment><USER47> If you want the same thing only with C# instead of Rust you can use [https://github.com/ElectronNET/Electron.NET](https://github.com/ElectronNET/Electron.NET)

<comment> yoz-y That seems to be a wrapper around Electron, the article talks about building a web server with all of the assets bundled inside the binary as strings.</comment></comment>


Ask HN: How do authors discover when others post their articles on HN so quickly? - <AUTHOR> Curious as to how people find out their article was posted on HN and respond with lightning reflexes in the comments.<p>Do people watch Google Analytics Real-Time all day? Setup alerts? Are there other tools that everyone uses and I'm oblivious to? <comment><USER2> [https://news.ycombinator.com/item?id=12670323](https://news.ycombinator.com/item?id=12670323)

</comment><comment><USER3> Another option is that someone says they will post it, or asks to post it, and invites their friends to up vote. So the author may be standing by.</comment>


Ask HN: Why are fewer companies doing remote - <AUTHOR>

my general experience is that software startups are not doing distributed teams as much as it seemed like they used to. This is not exactly backed by data - which seems contradictory lately too.<p>Does anyone know why? Or is my experience skewed?<p>(links to reliable data would be amazing, too) <comment><USER2> Because it is a hard problem to solve. I think most good organizations make remote work an exception rather than the rule.

I think the reason is because very few people are able to manage the trials of working for a large organization and work remote. It involves being able to distinguish between when to converse via the written text and when to get ready to jump on a call or talk face to face. Consequently, it also imposes an overhead on the part of the non-remote team to assiduously convert all in- person/ad hoc conversations into text and loop the remote person in.

It also sometimes necessitates a person who is able to be high functioning and effectively independent of the rest of the team.

Now in cases where both of these are possible, I can imagine a startup letting some people do remote. Personally, I would think of this as an unnecessary overhead if I were to start an early stage startup.

</comment><comment><USER3> I have often wondered if the remote communication problem (ie the remote team members being out of the casual conversation loop) could be solved with enough bandwidth. In theory you should be able to stream the office environment between all team members.

</comment><comment><USER4> Working remote is especially hard for small startups to do because it limits speed, adds overhead, and most importantly excludes an early member from adding directly to the culture. The startups I know either do not allow remote work at all, or have almost an entirely remote team / culture (> 50%).

<comment><USER5> 100% remote can work just fine for start-ups. That way everyone gets used to the communication methods. I was part of a team that built an award winning platform that was eventually acquired. We had people scattered around the US and in India. Technologically it was a success but sales traction sucked and so we disbanded but eventually the founder located a larger company willing to buy the technology platform and he joined as their CTO to adapt it to their needs. Would we have succeeded on the sales side if we were all in one place? I don't think so but it is unknowable at this point.

</comment></comment><comment><USER6> Maybe using Google and their "trending" tool and searching for: remote software jobs

Might yield some data.

The volume (vs. quality) of remote jobs over time might be another source.

There are plenty crap Work From Home jobs. It is the high-paying software- engineer jobs that matter (from an HN perspective).

<comment><USER7> Does anyone scrape the HN Hiring threads for data on how many of them offer remote?

<comment><USER6> quite a few do.

See here: [http://hnhiring.me/](http://hnhiring.me/)

</comment></comment></comment><comment><USER8> It's horribly insecure to keep the company's source code on a computer with a connection to the Internet. For example, this is how the F-35 secrets wound up in China.

</comment><comment><USER9> I have the experience of working remotely. The biggest problem is in communication. I think that's why most companies don't accept remote.</comment>


ZeroNet and IPFS: uncensorable auto-scaling BitTorrent powered websites - <AUTHOR> https://www.turnkeylinux.org/blog/p2p-web-hosting <comment><USER2> Drawback of ZeroNet is that it can host only static pages, page can't be generated dynamically. Max size for a page is 100MB. I tried to wget and convert my 5yo wordpress blog to static files, but it currently takes 1600MB, so... zeronet is no go for me, I2P and Tor work fine. Honestly I can' think of good example what zeronet should host. Maybe plaintext pages with leaks from WikiLeaks?

<comment><USER3> They have some examples of dynamic apps, like reddit style.

See: [https://bit.no.com:43110/Talk.ZeroNetwork.bit/](https://bit.no.com:43110/Talk.ZeroNetwork.bit/)

However, how they are doing this is by having the owner's bot accept writes and perform a git merge with one big static JSON list. At least that is what I remember reading.

Which doesn't seem scalable or fast. We're trying to solve that problem with [https://github.com/amark/gun](https://github.com/amark/gun) , and hopefully will be able to team up with the ZeroNet guys at some point. I love their work.

<comment><USER4> The owner of a site is unneeded for the site to continue to work in a dynamic fashion (outside of the single 'ZeroBoard' demo that was made before the new system was in place).

Interactive sites allow users permission to sign/post in a particular directory of the site (data/userpublickey/stuff.json). They sign/publish this like the owner of the site would. The site can either access the .json files directly, or compile them into an SQLite database locally and read from that.

No bots are needed at all. AFAIK, git itself isn't used in ZeroNet at all, besides open-sourcing it's development.

Essentially, the entire site's functionality is entirely local. You can fully use any website (except those that do weird requests to outside of zeronet) without any internet connection.

Try visiting the zerotalk site, disabling your internet connection, making a post/comment, and then refreshing the page. You'll see that the comment is still there. It's just inaccessible until other users obtain the .json file you've modified.

Likewise, many sites are freely cloneable, so you can try running your own local copy and acknowledge that there isn't a bot on the backend.

<comment><USER2> >Try visiting the zerotalk site, disabling your internet connection, making a post/comment, and then refreshing the page. You'll see that the comment is still there. It's just inaccessible until other users obtain the .json file you've modified.

How does it deal with conflicts? Is that a chronological list that gets merges after sync?

</comment></comment></comment></comment><comment><USER5> Quote:

"In terms of censorship resistance, IPFS includes blacklists of forbidden content in the default distribution, though it's configurable so you can turn it off 'at your own risk'.

Personally I think all of this willful censorship stuff is just a phase to protect the protocol in its infancy. Blacklisting all forbidden content on a global filesystem is ridiculous. The only popular use case I see for that is blocking ads.

So censorship-free distributions of IPFS implementations that integrate with Tor will probably end up as the default if this ever catches on."

Unfortunately, IPFS' built-in censorship tools are _not_ meant to be optional, nor are they temporary. [https://github.com/ipfs/faq/issues/47](https://github.com/ipfs/faq/issues/47) is an FAQ entry written by an IPFS member. Quote:

"IPFS has as a strict requirement that content be able to move as fast as the underlying network permits. this rules out designs like freenet's and other oblivious storage platforms, as the base case."

"Oblivious storage platforms" are systems like Tahoe-LAFS or OFF, where storage nodes are unaware of the actual content that they are handling, usually due to some sort of encryption. Quote:

"IPFS has as a design requirement that nodes be able to only store and/or distribute content they explicitly want to store and/or distribute. This means that computers that run IPFS nodes do not have to host 'other people's stuff', which is a very important thing when you consider that lots of content in the internet is -- in some for or other -- illegal under certain jurisdictions."

So, IPFS is explicitly censorable; if enough IPFS nodes refuse to carry some content, then that content is effectively unavailable. Quote:

"users and groups can express what content should or should not be stored and/or distributed. This is required by users to (a) comply with legal constraints in their respective countries, (b) required by users with stricter codes of conduct (i.e. content that is legal but undesired by a group -- e.g. a childrens website)."

So it's possible to create walled gardens in IPFS.

What does this all mean? IPFS is awesome for making content highly redundant and highly available, _but_ it fails at being uncensorable, it fails at being oblivious, and it fails at advancing the state of security for those using it. The analogy to BitTorrent is not just facile, but also very accurate.

<comment><USER6> You can make oblivious storage (and even ORAM) on top of IPFS, without too much work actually. A critical point here is that making something oblivious by default is a nonstarter for 99% of users on the internet, because major consumer and corporate applications would never use something that (a) adds that much latency to requests, or (b) may have pushed "bad bits" to their computers. This is a design constraint BECAUSE of adoption.

The point is to establish IPFS as a base layer, and build the oblivious storage platform on top.

<comment><USER7> Which is exactly what we're doing with Peergos[1]. IPFS definitely made the right choice here.

[1] [https://github.com/Peergos/Peergos](https://github.com/Peergos/Peergos)

</comment></comment></comment><comment><USER8> IPFS does not, and does not try to, solve the sybil attack, which has been a hard problem in securing decentralised systems for the past decade or so.

So using "uncensorable" here is talking it up way too much; it will not survive attacks by nation-states. More research is needed in these security topics, and the IPFS guys don't take those seriously enough. At the very best, this is highly-resilient to random errors; malicious attackers, not so much.

<comment><USER9> However, in order to censor data, you'd have to have all the nodes connected to the target be Sybils. This would be hard. If not, I think IPFS uses gossip- style protocols to query the rest of the network if your local node links don't have the data. Correct me if I'm wrong.

</comment></comment><comment><USER9> That's not actually true. IPFS is like BitTorrent, maybe, but it's not BitTorrent.</comment>


Public Health Officials Say Social Justice Matters More Than Social Distance - <AUTHOR> https://www.politico.com/news/magazine/2020/06/04/public-health-protests-301534 <comment><USER2> This same article has already been submitted 3 other times:

[https://news.ycombinator.com/item?id=23424131](https://news.ycombinator.com/item?id=23424131) [https://news.ycombinator.com/item?id=23430489](https://news.ycombinator.com/item?id=23430489) [https://news.ycombinator.com/item?id=23447148](https://news.ycombinator.com/item?id=23447148)</comment>


Russian programmer fights Goldman Sachs and wins one round - <AUTHOR> http://blogs.marketwatch.com/thetell/2013/10/22/russian-programmer-fights-goldman-sachs-and-wins-one-round/?mod=MW_home_latest_news

<comment><USER2> If anyone's interested, I found the appeals court ruling finding him not guilty of violating federal law, and leading to his release, on PACER, uploaded to the Internet Archive so you can access it without a paywall via RECAP:

[https://ia700209.us.archive.org/9/items/gov.uscourts.nysd.35...](https://ia700209.us.archive.org/9/items/gov.uscourts.nysd.358303/gov.uscourts.nysd.358303.165.0.pdf)

The basic argument hinges on the three counts, related to three laws he was alleged to have broken: the Economic Espionage Act, the National Stolen Property Act, and the Computer Fraud and Abuse act. The third charge was dismissed by the district court because it rested on the fact that he had either accessed systems he was not authorized to or exceeded authorized access. However, he was authorized to access the source code in question, and what he did with it afterwards has no bearing on whether he exceeded his authorization, so it doesn't fall under the CFAA.

The district court did convict him on the first two counts, but the Appeals Court reversed. Their argument is that the National Stolen Property Act doesn't apply because it applies only to actual physical goods, not mere intangible ideas. Had he photocopied the source and walked out with it, or loaded it onto a thumb drive at the office and taken that with him, it would have counted as stealing a physical good, but merely uploading it to a server and downloading it onto a thumb drive later does not count.

The court further argues that he did not violate the Economic Espionage Act because the clause in question he was prosecuted under specifically requires that the "trade secret ... is related to or included in a product that is produced for or placed in interstate or foreign commerce". Since Goldman Sachs' HFT trading system entirely proprietary and internal and not produced for or placed in interstate commerce, that particular law does not apply. Apparently Congress specifically intended this restriction, because earlier drafts of the statute had broader language that merely included "proprietary economic information having a value of not less than $100,000". The fact that Goldman Sachs uses the product for interstate commerce is not compelling, it had to itself be produced for or placed in interstate commerce.

That last part is interesting. It implies that if you run proprietary, internal code that is not sold or intended to be sold in the future, you appear to lose federal criminal trade secret protections. It's interesting that they tried to prosecute him on theft, trade secret infringement, and exceeding authorized access, but not copyright infringement. From my reading even unpublished work is subject to copyright.

Neither the original conviction nor the appeals court opinion ever addressed the copyright issue. In order for him to have stolen something, it would have had to be something of value; so why wasn't he further prosecuted for copyright violation? From the documents I read (not all are available on PACER), the copyright question never even came up.

More documents from the case:

Motion to dismiss the original case in district court: [https://ia600209.us.archive.org/9/items/gov.uscourts.nysd.35...](https://ia600209.us.archive.org/9/items/gov.uscourts.nysd.358303/gov.uscourts.nysd.358303.46.0.pdf)

Government's response to the motion: [http://www.archive.org/download/gov.uscourts.nysd.358303/gov...](http://www.archive.org/download/gov.uscourts.nysd.358303/gov.uscourts.nysd.358303.50.0.pdf)

Affadavit of the investigating officer: [http://www.archive.org/download/gov.uscourts.nysd.358303/gov...](http://www.archive.org/download/gov.uscourts.nysd.358303/gov.uscourts.nysd.358303.50.1.pdf)

District court's opinion dismissing the third count but refusing to dismiss the first two: [https://ia600209.us.archive.org/9/items/gov.uscourts.nysd.35...](https://ia600209.us.archive.org/9/items/gov.uscourts.nysd.358303/gov.uscourts.nysd.358303.58.0.pdf)

List of files requested in discovery, to demonstrate that what he took was insubstantial and not proprietary: [http://www.archive.org/download/gov.uscourts.nysd.358303/gov...](http://www.archive.org/download/gov.uscourts.nysd.358303/gov.uscourts.nysd.358303.35.0.pdf)

A few of the things he had downloaded were their version of the Erlang platform, which is available under the Erlang Public License, a derivative of the Mozilla Public License. So it would be more fruitful to debate the merits of that license, not the GPL.

All of the currently uploaded items in the docket: [https://ia600209.us.archive.org/9/items/gov.uscourts.nysd.35...](https://ia600209.us.archive.org/9/items/gov.uscourts.nysd.358303/gov.uscourts.nysd.358303.docket.html)

<comment><USER3> Is he on trial again after an appeals court already found him not guilty? The article is a little unclear on that point. First it says he's suing Goldman to recoup losses, and then at the end it says:

 _Aleynikov has pleaded not guilty and is waiting for his trial in New York State Court._

Does "not guilty" refer to the trial in which he's suing them? Or is there another trial even though he's already been found not guilty (double jeopardy)?

<comment><USER4> United States recognizes a legal doctrine of dual sovereignity, so a state can try what the federal government already tried.

<comment><USER5> ...also known as "we carved yet another exception into the clearly worded text of the Constitution"

<comment><USER6> The Bill of Rights, like most of the Constitution except clearly identified provisions, wasn't originally intended to apply to the states. It was only in the 20th century that the Supreme Court started the process of incorporating provisions of the Bill of Rights to the states via the equal protection clause of the 14th amendment (which was a reconstruction amendment explicitly imposing restrictions on the states).

So the clear text of the Constitution, as the drafters understood it, did not prohibit concurrent federal and state criminal trials for the same crime. Indeed, it imposed no limits on state criminal procedure at all. No due process, no nothing.

</comment></comment></comment></comment></comment><comment><USER7> It's very clear that Goldman is trying to punish him for leaving, while sending a message to their other programmers that if they leave, their lives will be ruined. Even if this guy ultimately wins the state trial, he will never get back the years he has spent fighting it. Goldman has already won, and in this case that is appalling.

<comment><USER8> No, it's very clear what he did was wrong. He works in an industry that does not allow you to email code home or copy it off of company computers. Goldman might be a little different, but where I've worked, this was definitely a no, no, and you could easily be fired for doing it.

<comment><USER7> According to the original article, Goldman was actually violating the license terms of the open source software it had modified by _not_ releasing it. Further, while you and I may have our opinions, a judge found Goldman's actions to be so egregious that he ordered them to pay the defense costs for someone accused of stealing from them. That is exceedingly rare, and wouldn't have happened if there were any doubts about either Goldman's conduct or the intentions of the programmer.

<comment><USER9> _Goldman was actually violating the license terms of the open source software it had modified by not releasing it._

I down-voted you because people keep saying that and it is false.

The Vanity Fair article uses the qualifier "possibly" when talking about GS violating the licenses and that's because none of the major license families (BSD, GPL, MPL, etc) have a requirement to release modifications if the whole is not released outside the organization that made them. The Vanity Fair article does not say that the code was ever distributed out of Goldman.

[http://www.vanityfair.com/business/2013/09/michael-lewis- gol...](http://www.vanityfair.com/business/2013/09/michael-lewis-goldman- sachs-programmer)

<comment><USER10> And none of them have that requirement because distribution inside of an organization does not count as a distribution for the purpose of copyright law. (Though if you let people carry it out of the organization, that's a different story.)

</comment></comment></comment></comment></comment><comment><USER11> For everyone bringing up the GPL licence, strait from the horse's mouth:

> The GPL does not require you to release your modified version. You are free > to make modifications and use them privately, without ever releasing them. > This applies to organizations (including companies), too; an organization > can make a modified version and use it internally without ever releasing it > outside the organization. But if you release the modified version to the > public in some way, the GPL requires you to make the modified source code > available to the program's users, under the GPL.

[http://www.gnu.org/licenses/old- licenses/gpl-2.0-faq.html#GP...](http://www.gnu.org/licenses/old- licenses/gpl-2.0-faq.html#GPLRequireSourcePostedPublic)

Distributing the code within a company/organization does NOT constitute 'distribution', and does NOT require you to release your code.

Edit - and in the licence itself - Version 3 of the GPL

> "The Program" refers to any copyrightable work licensed under this License. > Each licensee is addressed as "you". "Licensees" and "recipients" may be > individuals or organizations. And

> To "propagate" a work means to do anything with it that, without permission, > would make you directly or secondarily liable for infringement under > applicable copyright law, except executing it on a computer or modifying a > private copy. Propagation includes copying, distribution (with or without > modification), making available to the public, and in some countries other > activities as well.

[http://www.gnu.org/copyleft/gpl.html](http://www.gnu.org/copyleft/gpl.html)

<comment><USER12> Organization seems like an odd qualifier. Certainly you have to make the code available to everyone you delivered modified binaries to, and at GPL conditions (meaning they are then free to further distribute it, per GPL)?

<comment><USER11> Not according to the GSF's website. Besides, let's face it, GS employees likely don't have any 'secret' code anywhere near their computers. It likely lives on their mainframes, and only there.

<comment><USER12> Well, it's an FAQ, it's a simplification, not the actual legally binding license.

I can't find any mention of "organization", but I do find these parts (GPLv2):

 _3\. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: [give access to the sourcecode]_

Meaning everyone you distribute a copy to, you have to give access to the sourcecode, too, or provide instructions on how to get the sourcecode.

 _6\. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients ' exercise of the rights granted herein._

Meaning distributing the program to someone gives them the full rights under the GPL.

(IANAL, so I'd be very pleased to be corrected here. Maybe the FAQ made the assumption that corporations have other means to keep employees from exercising GPL rights? Or maybe the license is _to the corporation_ as a whole, and it itself can't break the GPL unless it distributes it to different entities?)

<comment><USER11> From section 0 of the GPL v3

> "The Program" refers to any copyrightable work licensed under this License. > Each licensee is addressed as "you". "Licensees" and "recipients" may be > individuals or organizations.

And

> To "propagate" a work means to do anything with it that, without permission, > would make you directly or secondarily liable for infringement under > applicable copyright law, except executing it on a computer or modifying a > private copy. Propagation includes copying, distribution (with or without > modification), making available to the public, and in some countries other > activities as well.

[http://www.gnu.org/copyleft/gpl.html](http://www.gnu.org/copyleft/gpl.html)

</comment></comment></comment></comment></comment><comment><USER13> This type of story underscores my Icarus-inspired philosophy in business: fly high but not so high that you become an obvious target or otherwise risk getting burned.

I learned relatively early that above some level (that's not even all that high), you'll find that you're dealing primarily with people whose sole purpose in life seems to be to serve their love of money and quest for validation. They are like insects drawn to a light and about as thoughtful.

Suffice to say that when you find that you have to play harder and harder to make up for the stress of your daily work life, it's time to take a look at what you really want and why you're doing what you're doing.

<comment><USER14> Truth. I was talking stocks with my girlfriend. She thought it was too scary to get involved in something as potentially volatile as the stock market. I told her basically what you just described.

There are many people in business that are literal sociopaths. They will bury and burn any and all barriers on their path to making an increase in share price. "I will not let this company flounder on my watch!", they hypothetically say in my mind. To these mythical business people, the share price is an extension of their character. Maybe that's a bit extreme and that's not why I'm investing.

But it's why the market doesn't scare me. Too many sociopaths all want one thing: the numbers to go up.

I know I'm right too. Just rewind to 2002-2008.

</comment></comment><comment><USER15> Sergey is a good Erlang programmer.

He is active in on the Erlang mailing list. He wrote a cool C++ to Erlang interface. Here is his Github account:

[https://github.com/saleyn](https://github.com/saleyn)

I am happy for him. He is a great asset to the open source community.

<comment><USER16> Yeah, I didn't put two and two together until after reading the Vanity Fair article, but I'd been interacting with Sergey because we're using erlexec in a project:

[https://github.com/saleyn/erlexec/commits/master?page=2](https://github.com/saleyn/erlexec/commits/master?page=2)

Nice, and helpful person.

</comment></comment><comment><USER17> For those that are interested in the backstory: [http://www.vanityfair.com/business/2013/09/michael-lewis- gol...](http://www.vanityfair.com/business/2013/09/michael-lewis-goldman- sachs-programmer.print)

<comment><USER18> > during which time he sent himself, through a so-called "subversion > repository,"

i just can imagine how every FBI agent jumps when reading that there is a whole repository of subversion (or subversions?) out there.

</comment></comment><comment><USER19> _which time he sent himself, through a so-called "subversion repository," 32 megabytes of source code from Goldman's high-frequency stock-trading system._

I can't help smile at the thought of what non-CS people might mistake a " _subversion_ repository" for.

<comment><USER20> Just imagine the reactions you can get from talking about daemons reaping zombie children... Though given how mainstream gory video games have become, talking about Unix process management in public doesn't sound quite as shocking as it used to.

</comment></comment><comment><USER21> The Michael Lewis article, which is more or less required reading on this: [http://www.vanityfair.com/business/2013/09/michael-lewis- gol...](http://www.vanityfair.com/business/2013/09/michael-lewis-goldman- sachs-programmer)

</comment><comment><USER22> Aleynikov has lived in the US for twenty years and owns a house in Chicago. It sounds to me like he is an American programmer, not a Russian programmer. I don't see why his ancestry is relevant.

<comment><USER23> My parents owned a home and lived in USA for over 30 years... but they are, and will always be, Nigerian. Home is where the heart is. I wonder what Aleynikov would say if we asked him "Are you American or Russian? Or both?"

<comment><USER24> How does that make his ancestory relevant in this case to be quoted ?

<comment><USER25> It doesn't, the "Russian programmer" stuck out to me like a jibe as well. It isn't noteworthy, and strange they call it out so often.

</comment></comment></comment></comment><comment><USER26> It seems Goldman Sachs attempted to commandeer the criminal justice system to retaliate against a former employee, and succeeded in doing so. It is not in the jurisdiction of police to act as arbiters of employment disputes -- that is for the civil court system. Whatever the allegations against Mr. Aleynikov, this I am sure we can all agree on.

<comment><USER27> The fact that they initially sentenced him to 8 years in jail, has zero deterring effect. As far as I am concerned, it only strengthens our resolve to break through the politically controlled monopoly on the use of force.

</comment></comment><comment><USER28> Here is the story covered in more detail: [http://www.vanityfair.com/business/2013/09/michael-lewis- gol...](http://www.vanityfair.com/business/2013/09/michael-lewis-goldman- sachs-programmer)

<comment><USER29> Here is a page that was set up for him last year. Looks as though it hasn't been updated in a while. [http://www.aleynikov.org/](http://www.aleynikov.org/)

</comment></comment><comment><USER30> The real tragedy is how many brilliant and motivated people end up in finance nowadays and how the industry overall continues to grow into an ever greater portion of the US economy. I'm not belittling the role of finance in an advanced economy. But you would think with the incredible advances we've made in electronic exchanges and the free flow of information on the internet the role of finance would have taken a backseat. Unfortunately, Sergey is just another example (guilty or not) of wasted talent down the financial sink hole.

</comment><comment><USER4> Let me quote from Wikipedia here:

"On 8 September 2005, the Seoul Central District Court ruled that the GPL was not material to a case dealing with trade secrets derived from GPL-licensed work. Defendants argued that since it is impossible to maintain trade secrets while being compliant with GPL and distributing the work, they are not in breach of trade secrets. This argument was considered without ground."

</comment><comment><USER31> Guess the Michael Lewis story (damn, he should write more again) also explains the commits to [https://github.com/goldmansachs](https://github.com/goldmansachs) a few months ago.

</comment><comment><USER32> How is this not double jeopardy?

<comment><USER33> Double jeopardy is to conceptually prevent a person from going free, but then being tried again and convicted. The idea is "once you're acquitted, you're acquitted" That wouldn't be the case here since he was already convicted so additional trials could only benefit him.

But really it's a judge ruling that the original trial was all effed up and that a new trial would need to take place in order to do justice.

<comment><USER34> This is right in general but wrong on the specifics of this case. The Second Circuit Court of Appeals ruled on the original, federal trial. That court threw overturned the conviction entirely; it did not order a retrial.

The state prosecution was an entirely different matter, which is why they had to strain to pretend it wasn't double jeopardy. The "acts" were the same but they had decided to classify them as different, lesser crimes. In fact he had already served more time than he could have been sentenced under those, rendering the whole proceeding nothing more than a farcical publicity stunt.

<comment><USER33> Good thing I'm only friends with lawyers from grad school rather than one myself.

</comment></comment></comment></comment><comment><USER35> Umm.... let me get this straight, GS is required to pay the legal fees because he was an employee at GS? So if the company sues one of its employees, it has to pay for both sides? Really?

PS: If i remember correctly, hadn't Sergey resigned from GS by then? I thought he was just hanging around an extra week or two to train his successors.

<comment><USER36> It's actually fairly common throughout the western world that the loser of a civil suite must supply legal fees.

<comment><USER37> > _It 's actually fairly common throughout the western world that the loser of > a civil suite must supply legal fees._

It is uncommon in the United States. Which is why it's surprising.

In the last 200 years, American common law has diverged a great deal from British/Commonwealth common law, both in the law itself, and in how it's practiced.

</comment></comment></comment><comment><USER38> A lot of the comments here seem to be oblivious to the details of the original indictment:

[http://online.wsj.com/public/resources/documents/021110aleyn...](http://online.wsj.com/public/resources/documents/021110aleynikovindictment.pdf)

It pretty explicitly details how the "backup" program he wrote had flags to select what to copy and some of those flags specifically copied GS option pricing code that he had never worked on.

<comment><USER9> That's not what I see when I read it.

I see that he wrote a backup script that could backup two distinct groups of files depending on what argument he passed on the command-line.

While the indictment mentions that some of the files included stuff he didn't work on, it doesn't say he set flags specifically to grab stuff he hadn't worked on. Only that it was getting swept up as part of a larger backup operation.

It also said he ran the backup on many occasions throughout his employment at Goldman. That doesn't sound like someone who only absconded with code after he got an offer to work at a competitor.

As an aside -- I'm wondering if "the website" referenced in the filing was rapidshare. Weren't they in Germany?

<comment><USER38> I don't think your comment and my comment fundamentally agree. There are two issues at play here:

1) Did he copy propriety GS code that he had no involvement with. A lot of people seem in this thread seem to think he didn't, but as far as I can tell from the indictment it's pretty explicit that he did and I don't think that it's disputed by either side.

2) Was his intention out of malice (intention to steal trade secrets), stupidity or something in between.

The first is the point I'm making without commenting on the second.

</comment></comment></comment><comment><USER39> Question: does anyone know if software patents were declared null and void, would this case still exist? It seems he only took snippets of code and not the entire system for profit. How would this case differ if software was copyrightable but not patentable (i.e. Either you stole the manuscript or you didn't)?

<comment><USER40> Trade secrets are an entirely different category from patents. Patents require you to disclose all the details.

Trade secrets, which is likely what such software is likely to be declared to be, is, well, secret. As such, it has legal protection different than patents or copyrights.

</comment></comment><comment><USER41> Love the racial inclusion for no reason.

<comment><USER41> That was sarcasm (btw). And I was pointing out the article was pointing out the programmer was Russian for absolutely no reason. Why was it important for us to know his nationality?

<comment><USER42> I am Russian and I agree with this. Not all of us are prone to leak trade secrets, honest!</comment></comment></comment>


Tennis racket theorem – Wikipedia - <AUTHOR> https://en.wikipedia.org/wiki/Tennis_racket_theorem <comment><USER2> Classical mechanics was my favorite course in college. It doesn't get enough fame (everyone always wants to talk about quantum mechanics, because it's "weird").

Check this fun problem out: [http://www-groups.dcs.st- and.ac.uk/history/HistTopics/Brachi...](http://www-groups.dcs.st- and.ac.uk/history/HistTopics/Brachistochrone.html)

<comment><USER3> I remember seeing a list of unsolved problems in Newtonian physics; some seemed really interesting, involving infinitely-fast projectiles that can slow down to a stop in non-infinite time (implying the reverse ought to also be true).

</comment></comment><comment><USER4> You can demonstrate this very easily with your phone (all directions given assuming the phone is facing you, oriented vertically): rotating it cw/ccw will be stable (you're on the shortest axis, only the depth of your phone, probably a few mm), flipping it left-to-right will be stable (you're on the longest axis, the height of your phone, probably ~5"), but flipping it top-to- bottom will result in an uncontrollable spin, as that's the middle axis (the width of your phone , probably 2-3")

</comment><comment><USER5> This tumbling around a different axis after starting a rotation around another reminded me of something else - the problem of inertia coupling that caused several crashes of early supersonic airplanes. I would be interested to know if they are related.</comment>


Show HN: BundlePhobia – find the cost of adding a new npm package to your build - <AUTHOR> https://bundlephobia.com <comment><USER2> Nice job! The site is easy on the eyes, gorgeous and fast.

I'll definitely try it out a bit more and spread the word.</comment>


What I learned bootstrapping a 6-figure business from school - <AUTHOR> http://danshipper.com/what-i-learned-bootstrapping-a-6-figure-business-from-school?utm_source=Dan%27s+Blog+List&utm_campaign=dfc66cbced-Newsletter_nice_design_17_8_11_2013&utm_medium=email&utm_term=0_c18fe7384e-dfc66cbced-107279409

<comment><USER2> Great article man! Love all the philosophy of mind references. During my freshman seminar I had to read Consciousness Explained by Daniel Dennett, ended up switching me from going to the business school to being a philosophy major and 'Learning how to learn.'

Now that I've started learning how to program and working building a product I can't thank that professor. Whether learning what customers want, learning how to sell, or learning a new programming language / framework - it's essential to be able to pick up stuff quickly.

I hadn't thought about philosophy in awhile so thanks for reminding me the benefits of being able to clearly articulate complex ideas and make meaning out of uncertainty.

<comment><USER3> Thanks! I totally agree. Glad I could get you back on the philosophy kick, I think it's really useful for entrepreneurship.

</comment></comment><comment><USER4> "Any time you catch yourself saying, "Well look at how X big company does it." or "Well X big company tried that and it didn't work for them," please smack yourself in the face."

THANK YOU THANK YOU THANK YOU.

</comment><comment><USER5> Great post. Good practical exposition of Taleb's ideas. A lot of people mistakenly think he's theoretical.

Just chiming in to say that cargo cults were very real:

[http://en.wikipedia.org/wiki/Cargo_cult](http://en.wikipedia.org/wiki/Cargo_cult)</comment>


Hugo v0.15 releasedL Higher performance, Jekyll import, template improvements - <AUTHOR> https://github.com/spf13/hugo/releases/tag/v0.15 <comment><USER2> Highly recommended, fast, simple to install (single binary), super responsive team if you find any issues and reliable. Compared to the jekyll/octopress/ruby ball-of-twine that it replaced (which would break at the most in-opportune times for no apparent reason) the speed increase is phenomenal, there is even a mode that re-generates the site on the fly on changes with a local server, it is so fast you can't move your eyes from one monitor to another while saving or the page is already updated. Of all the static site generators that I've tried it wins hands-down.

<comment><USER3> I have not used it but one of the things I was concerned about is extensibility. I am unable to find any documentation on this. Due to it being in Go, is the recommend way to programmatically extend Hugo to make modifications in the Hugo source tree and recompile?

<comment><USER4> What would you like to do? 1-2 concrete examples please.

<comment><USER3> I have not used it so it is a bit unfair to ask for concrete examples of what I would need that it doesn't do. But in general, something like using the GitHub API (as my user) to obtain a list of recent commits to format a certain way could be an example.

But in all honesty my question was also wondering if this had a good story around runtime Go compilation since I am building a Go project that could be construed as a "static-binary generator" for an orchestration and configuration management system.

<comment><USER4> I've implemented the getJSON Feature [http://gohugo.io/extras/datadrivencontent/](http://gohugo.io/extras/datadrivencontent/) and this should be what you are looking for ;-)

</comment></comment></comment></comment></comment><comment><USER5> I love Hugo and use it for my site.

Speed didn't seem like an important feature until I was refreshing my 700 pages trying to find tweak a theme change. And now with the new 30+% speed increase in the `hugo server` command, it just got a lot better.

My favorite feature is the single, no-install, no-dependencies binary than works perfectly on all OSes. This is huge for Windows users. You may get lucky with the Ruby/Bundle madness of other static site generators on Linux, but Windows support is often lagging or non-existent. With Hugo, one binary and done.

Recommend.

<comment><USER6> I agree re: speed. In my experience, speed doesn't matter until it does: I don't care about 650ms vs. 700ms, but once it passes the threshold of me alt- tabbing waiting for blog/public/ to regenerate and I lose focus, it becomes near-unbearable.

(This probably applies to all build processes, not just static site generation.)

<comment><USER2> That's the whole 'Go' community in a nutshell, speed really does matter, even for compiles. That was the one advantage Borlands' products had.

</comment></comment></comment><comment><USER7> My current personal site is on Middleman, and I cannot update it from any other laptop other than my own personal one because of Ruby and all the dependencies. Bundle install compiles some native gems, which fail for any number of reasons, and are extremely difficult to troubleshoot (I spent 2 hours to no avail before I gave up - and this was on another Macbook!). I use Hexo ( [https://hexo.io/](https://hexo.io/) ) of a few other sites, and it is much better cross-platform, but still has occasional issues with dependencies.

I am done with Ruby static site generators. Node.js ones are much better, but it sounds like I need to give Hugo a try also. Great work!

</comment><comment><USER6> I switched over to Hugo for my personal blog and a side project from Pelican a couple months ago. The speed is unparalleled: anecdotally, it generates a couple thousand pages in ~400ms (which would take an order of magnitude longer in Pelican). However, dealing with ACE templates was like pulling teeth, and I was considering switching away just to save me the stress; I'm glad to see that they're working on improving the actual templating process (and that ACE apparently supports base templates now?)

<comment><USER8> ACE base template support was introduced in Hugo 0.14, but was now completed in Hugo 0.15 to also support using them in themes. It can really clean up your templates.

There are some cool improvements in the upcoming Go 1.6 that will make the regular Go templates a lot nicer to work with (Hugo 0.16, maybe?)

</comment></comment><comment><USER9> I'm interested to hear what folks use to kickoff Hugo for sites hosted on GitHub Pages? TravisCI, CircleCI, etc?

This considering GH pages has build-in support for Jekyll but not for other static site generators.

<comment><USER10> Give netlify a try [https://www.netlify.com](https://www.netlify.com)

It's like GitHub pages on steroids (SSL, redirects/rewrite rules, proxying, domain aliases, etc, etc...). It'll run any build tool for you (not just Jekyll) and we have built-in support for Hugo:

[https://www.netlify.com/blog/2015/10/06/a-step-by-step- guide...](https://www.netlify.com/blog/2015/10/06/a-step-by-step-guide-hugo- on-netlify)

Disclaimer: I'm a founder :)

</comment></comment><comment><USER11> Template improvements.. The go template system is..opinionated to say the least. It's my biggest pain point in the language, and I include having to write min_int64_int type functions.

Anyway, hugo's documentation, code quality and template improvements are stellar, congrats on the release.

<comment><USER12> I would love to see support for pongo2 (which is a Django style template library). Working with template inheritance would be so much easier.

</comment></comment><comment><USER13> > Hugo now supports dynamic reloading of the config file when watching.

As one just starting with Hugo and still tweaking stuff, this is probably my favorite new feature.

</comment><comment><USER14> How does Hugo compare to Harp? [http://harpjs.com/](http://harpjs.com/)

I've been enjoying Harp's ability to easily launch a web server for local development using jade + scss and compile everything to html and css before pushing to GH pages.

Any benefit of switching to Hugo?

<comment><AUTHOR> Hugo provides many of the same features of Harp.js which is also a good project.

Hugo provides a server for local development like jade.

Hugo is a bit easier to install as it doesn't have dependencies and doesn't require an existing environment.

Hugo is noticibly faster.

The big difference between the two is that Hugo has not focused on compiling all the other assets like scss, less, coffee script, etc. While this is planned for a future release today Hugo users have experienced a lot success pairing Hugo with Gulp. You can read more in this discussion on the forum: [https://discuss.gohugo.io/t/gulp-hugo-hugo- npm/1121](https://discuss.gohugo.io/t/gulp-hugo-hugo-npm/1121)

Unfortunately by introducing gulp it negates some of the benefits of Hugo's one binary install.

Hugo does provide some advanced features that I don't believe Harp provides including:

* Data file loading [https://gohugo.io/extras/datafiles/](https://gohugo.io/extras/datafiles/)

* Live data [https://gohugo.io/extras/datadrivencontent/](https://gohugo.io/extras/datadrivencontent/)

* Live reload (this is a huge feature) [https://gohugo.io/extras/livereload/](https://gohugo.io/extras/livereload/)

* Menus [https://gohugo.io/extras/menus/](https://gohugo.io/extras/menus/)

* Themes [https://themes.gohugo.io](https://themes.gohugo.io)

If you are happy with Harp and it serves your needs than there's not really a reason to switch.

The big difference is Hugo + Gulp is a workflow that works really well and has all the features that Harp provides (plus all the Hugo features). If you need a feature that only Hugo provides there really isn't a way to add that to harp.js.

I'm the author of Hugo and haven't ever used Harp so take all of this with a grain of salt.

</comment></comment><comment><USER15> Does Hugo do any of the more advanced build tasks, like image compression&inlining, sass/less/postcss conversion (and minification)? How does it fare wrt to adding javascript behavior to pages (e.g. React components), do I have to setup a separate build system for that stuff?

<comment><AUTHOR> Currently hugo has not focused on this aspect of development and many people have found success combining Hugo with Gulp. There are a few projects related to this that make it pretty easy. There's a good discussion around this on the forum. [https://discuss.gohugo.io/t/gulp-hugo-hugo- npm/1121](https://discuss.gohugo.io/t/gulp-hugo-hugo-npm/1121)

</comment></comment><comment><USER16> This is great. I'm working on a static hosting service to make the deployment story for static websites easier. It should be live in a few days: [http://statichosting.co/](http://statichosting.co/)</comment>


Criminals Are Tapping into the Phone Network Backbone to Empty Bank Accounts - <AUTHOR> https://motherboard.vice.com/en_us/article/mbzvxv/criminals-hackers-ss7-uk-banks-metro-bank <comment><USER2> Someone stole 415-867-5309 from me by forging the port paperwork. My carrier refused to do a port back.

I filed an FTC complaint and they couldn't have cared less.

Phones are a broken system.

<comment><USER3> Phone number hijacking is a real problem, especially with cell phones, and thieves use it as part of an overall identity (and retirement fund) theft approach.

For those who didn't catch it, that's a somewhat "famous" phone number.

In the 80s, there was a song by that name: "867-5309 (Jenny)" by the band Tommy Tutone. [https://en.wikipedia.org/wiki/867-5309/Jenny](https://en.wikipedia.org/wiki/867-5309/Jenny)

Neat tip: you can use your area code + this number in almost any system that asks for a phone number (especially useful supermarket "loyalty" customer tracking systems). If they ask for a name, just tell them "Jenny".

<comment><USER4> > Neat tip: you can use your area code + this number in almost any system that > asks for a phone number (especially useful supermarket "loyalty" customer > tracking systems). If they ask for a name, just tell them "Jenny".

Do you actually do this? It hasn't worked for me most places I've tried it. In a couple cases it froze/crashed their system. I always wondered what people who legitimately have this number do.

<comment><USER3> Yep, I use it all the time at the area supermarkets (works with no less than four different chains).

I predict that someday soon, supermarkets will sell my food purchase history to insurance companies, so when I buy loads of vegetables and such, I use my real number. When I buy wine & bacon -- you guessed it: 867-5309.

Tip #2: They also link purchase records based on debit card account numbers. So pay cash.

Tip #3: if the number doesn't work for your area code, try it with a different area code. (the sysadmins sometime purge a number that is being used by loads of people.) Also, if you need to provide a zip code, Beverly Hills 90210 works just fine.

<comment><USER5> > I predict that someday soon, supermarkets will sell my food purchase history > to insurance companies, so when I buy loads of vegetables and such, I use my > real number. When I buy wine & bacon -- you guessed it: 867-5309.

That won't help, your purchases can still be linked to yourself with your credit card.

<comment><USER6> With Apple/Google Pay isn't this information NOT shared with merchant, but only a transaction token ?

<comment><USER3> so they say. but the data lives somewhere, and when it has enough value it will be a commodity.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Slightly unrelated, but i'm fishing for suggestions.

I have a beef with my local Australian bank, the ING (of Dutch fame). Their login system consists of your "customer number" (printed on the back of your debit card) and a 4 digit numeric PIN. Yes, 4 digits. In 2019. To add a payee to your address book the only auth that happens is over SMS; to actually transfer money out of the account you can select any existing address book contact with no further verification.

I like their product offering (cheapest / best in class locally) but this is such a worry to me. I've repeatedly talked to their customer support about this issue (and their Twitter is full of complaints about this) but they keep giving canned responses and redirecting to their "Online Security Guarantee" [https://www.ing.com.au/security.html](https://www.ing.com.au/security.html). Any ideas how to get through to someone who understands what's going on, before I grudgingly take my business elsewhere?

<comment><USER8> This seems pretty common with a lot of banks. I've got accounts with several high street UK banks and almost all of them have some kind of reliance on SMS, maximum password requirements (like 10 letters with no symbols) or 'secret words' where you have to pick a few choice letters from an word which is presumably kept in plain text.

I can only assume they are relying more on legal recourse and insurance than data security experts and I assume that if a hack did happen I would be reimbursed but it's a bit of a worry.

<comment><USER9> With Barclays you can rely soley on the card reader and disable login using "memorable data". Lots of other banks in the UK offer card readers (of the top of my head, Barclays, Nationwide, Natwest).

</comment></comment></comment><comment><USER10> This is why we should all be paranoid over things like the Mobile Authentication Taskforce and "Project Verify" where the US cell carriers are colluding to form a new authentication/identification to replace passwords with single-factor phone identification. We know our cell accounts are utterly and woefully insecure, but expect this push to come in the near future.

<comment><USER11> > we should all be paranoid over things like the Mobile Authentication > Taskforce and "Project Verify" where the US cell carriers are colluding to > form a new authentication/identification to replace passwords with single- > factor phone identification.

There's lots of infosec paranoia is ill-based in reality but I've got to concur here. It's gotten so easy and uncomplicated to social-engineer a fraudulent port / SIM swap that there's an entire cottage industry of bored teenagers that do exactly that, in part to commandeer Instagram accounts with coveted usernames.

Basing authentication/identification on an industry that's simultaneously pathologically incompetent (fraudulent ports/SIM-swaps) and also grossly evil (selling real-time locations of all their subscribers without their consent to a phantasmagorically layered and non-auditable set of resellers and intermediaries) when it comes to security is pure folly.

</comment></comment><comment><USER12> While I agree SMS based MFA is less than ideal the real issue is telephony security. Weak security allows ANI spoofing, message interception (as seen here), IMSI catching, and who knows what else.

I stopped picking up calls from unknown numbers since its practically all spam. It'll probably never be secure but I can dream.

<comment><USER13> That's great and all, until you're applying for jobs. Or in sales/support. Or just new to an area. Or have a child at day-care.

When I'm on-call and they spoof a similar phone number (same area and exchange code), I gotta answer it.

<comment><USER14> Per quora, area code 308 probably has the smallest population of any area code, so getting a phone number based there and screening for 308 numbers would probably work well.

Honestly if google voice had a captcha system I could implement for non contact numbers, that would be sweet.

<comment><USER15> This is actually a feature on the Pixel 2 and Pixel 3: Screen your calls before answering them [0]. When you activate it on an incoming call it'll play a message for the caller, show you a transcript of their response, and allow you to respond with a few canned messages of your own. The best part is that it works entirely offline [1], so it doesn't require sacrificing your privacy. It's incredibly convenient.

For a while I'd been receiving a ton of spam calls. Eventually I caved and enabled "Filter spam calls" on my Phone app. Suddenly, all the calls stopped. I ultimately decided that this was a worthwhile privacy tradeoff for me, especially since I rarely use my phone. I only use it to occasionally interact with businesses, and as a way for close family to reach me at a moment's notice in case of an emergency.

[0] [https://support.google.com/phoneapp/answer/9118387](https://support.google.com/phoneapp/answer/9118387)

[1] [https://support.google.com/phoneapp/answer/9094888](https://support.google.com/phoneapp/answer/9094888)

<comment><USER16> Isn't this a standard google voice feature for the last 12 years or so?

<comment><USER17> I don't think google voice showed you a transcript in real time or allowed you to interact with the caller.

<comment><USER16> No transcript, but they play back the caller's introduction to you before you decide to accept or ditch the call. Again, for the last 12 years or so. That was one of the reasons Google acquired Grand Central and launched Google Voice.

<comment><USER17> Yeah they had that but this is different, more interactive and something you can decide to use while your phone is ringing. Google voice currently does not have a call screening feature like the one on the pixel.

<comment><USER16> Well, GV is interactive by some definition, but awkward. You need to listen to the headset to hear the callers introduction, then type 1 to accept the call or hang out and send caller to voice mail.

Real time transcription would be much nicer, very true. GV is apparently on a lifeline while Google is trying to push Fi. Just like Duo and Hangouts.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Motherboard/Vice is trying to load another article at the bottom of this one, but the one it wants to pull up is apparently MIA, and causes the article I actually WANT to read to cut to a 404 before I can reach the end. If you must shove additional content down our throats, can you at least make it a bit more failsafe? #notagoodlook

<comment><USER19> With NoScript ([https://noscript.net/](https://noscript.net/)) blocking their Javascript I get the whole article, no attempt to load any other article, and no 404 anywhere on the page.

</comment></comment><comment><USER20> SS7 is fundamentally broken and nobody is ever going to fix it. It's based on telcos all trusting each other in the year 1985. The sheer mass of installed equipment that nobody wants to spend hundreds of thousands of dollars to upgrade means that implementing authentication and security on top of SS7 is never going to happen. Any extensions on top of SS7 that implement something resembling proper security will thoroughly break backwards compatibility with all old PSTN equipment.

If you use SMS or anything phone network related for 2FA you're doing it wrong.

My job title has "network engineer" in it. It's time to simply disregard the existence of the PSTN and move on to modern communications methods. By modern, I mean things that are based on packet-switched IP networks, with software applications using battle tested public/private key crypto implemented at layers 4-7 in the OSI model.

<comment><USER21> Crypto attempts have been made, but now we're starting to see both industry associations (GSMA) and open source (P1 Security SigFW [1]) working on filtering and encrypting SS7.

If placed in front of the legacy equipment, that could enable operators to gradually move toward signed+encrypted signaling traffic.

Problem is that this industry can be slow to react and would probably need government/regulatory pressure to move faster.

[1] [https://github.com/P1sec/SigFW/](https://github.com/P1sec/SigFW/)

<comment><USER22> I work at a company whose customer is the Phone Company. As I complained to my manager, "We may have a two-week sprint, but the Phone Company has a two-year sprint."

<comment><USER23> :-)

Well back when I worked for BT they had quarterly sprints but this was for things like major changes to the entire system.

</comment></comment></comment></comment><comment><USER24> The entire security model of the PSTN is just broken. It's not just SS7, it's stingrays, caller id, robocalls, porting numbers, etc, etc. It's time to deprecate the entire system.

</comment><comment><USER25> How are bad actors getting access to SS7? Is SS7 being transported over public IP networks and subject to intercept? Are they bribing/hacking telecoms themselves?

<comment><USER26> At one point, one of the attack vectors was said to be by spoofing or otherwise manipulating traffic to/from a wireless femtocell. The same wireless femtocells that many operators will gladly sell or give to you for free or very little $.

I don't know how effectively that strategy still works today, but I think it speaks to the significant degree to which the phone system is completely insecure and untrustworthy by design.

</comment></comment><comment><USER27> 30yr ago on the big nations could do this. 15yr ago most nations could do this. Today organized crime or well funded companies can do this. 10yr from now small time criminals will be able to do this.

Technology trickles down really well.

This is just another instance.

<comment><USER28> small time criminals have been doing this for years? I guess its so lucrative that they aren't considered small time after executing it on a useful bank account

its rampant on instagram, which introduced non-SMS OTP just a few months ago after everyone figured out their negligence was just to data mine phone numbers

</comment></comment><comment><USER29> Wow, I really thought we were still at the social engineering scale (convincing the guy in the cell shop).

Does anyone know if Google Voice texts are also subject to this kind of attack? In the sense that they have to honor SS7 rerouting commands or anything like that.

<comment><USER30> Google Voice is, by and large, just* using Bandwidth.com's API to send and receive SMS. The same attacks still work though it is marginally harder to forcibly port or steal a number from a Google Voice account because Bandwidth passes the port auth request onward to Google for approval.

Point being, Google Voice is not a telco on its own. They rent underlying access, of sorts, and that access still relies on SS7.

* For suitably large values of "just."

<comment><USER31> What about using a service like Twilio to receive texts?

<comment><USER32> This will not work. A Twilio Number cannot receive messages from a short code. Almost every single two factor authentication code from a bank or other institution comes from a short code. No number you receive or port into Twilio is Classified as a mobile number – so they cannot receive messages from short codes.

I spoke to engineers from Twilio at the 2018 Signal conference and they confirmed - there is no technical limitation, but they would have to do a lot of work and deal with a lot of spam issues if they allowed their numbers to be classified as "mobile" and able to receive SMS from shortcodes - and they are declining to do that for now.

So whether you source a new number from Twilio or port in an existing mobile number, once it hits Twilio it is no longer a mobile number. Yes, you can receive SMS/MMS from "normal" numbers just fine.

</comment></comment></comment></comment><comment><USER5> When [https://n26.com](https://n26.com) launches in the US they could prevent this attack, unless they fool customer support somehow. In the EU they have non-SMS based 2fa and optionally send a push notification for all transactions.

Also, I'm looking for a bank that blocks all debits/transactions/transfers unless pre-authorized via app. Anyone know if that exists?

</comment><comment><USER33> Yikes! Banks need to start supporting other 2FA methods such as TOTP or U2F

<comment><USER34> Some do, but their backend systems are still vulnerable. Most folks here on HN would not believe me if I said that many of the back-end systems do not use encryption. There are still many automation jobs that use clear-text FTP on the WAN and for some jobs, even across the internet.

<comment><USER20> You think that's bad, huge banks are still doing this shit:

[https://www.reddit.com/r/canada/comments/978l87/bmo_web_bank...](https://www.reddit.com/r/canada/comments/978l87/bmo_web_banking_is_still_incredibly_insecure/)

[https://en.wikipedia.org/wiki/Bank_of_Montreal](https://en.wikipedia.org/wiki/Bank_of_Montreal)

Here's the password requirements for Coast Capital Savings:

[https://www.reddit.com/r/VictoriaBC/comments/92e7cf/coast_ca...](https://www.reddit.com/r/VictoriaBC/comments/92e7cf/coast_capital_passwords/)

[https://en.wikipedia.org/wiki/Coast_Capital_Savings](https://en.wikipedia.org/wiki/Coast_Capital_Savings)

</comment></comment></comment><comment><USER35> Meanwhile, Twilio is raking it in on the back of this broken system.

<comment><USER32> Can you elaborate? How does Twilio benefit specifically from these vulnerabilities in ss7 ?

</comment></comment><comment><USER36> And this is just another reason why SMS based 2FA is fundamentally broken.

I bank with Barclays in the UK and they give each of their account holders a PinSentry device. This is a physical device that you have to insert your card into, and then enter your pin code to unlock, you then use it to sign/verify transactions that you are trying to make.

Don't have access to the pin sentry device? Guess who can't add a new transfer recipient.

<comment><USER8> The chink in the chain for Barclays though is their mobile app on-boarding that relies on bank account information and SMS authentication which turns your phone into a PinSentry too.

Don't get me wrong, Barclays probably does it better than anyone else but I was surprised when I set up a new phone recently.

<comment><USER36> That's odd - when I installed the iOS app I either had to get a one-time-code by using a Barclays ATM, or by identifying with my physical PinSentry device ...

</comment></comment></comment><comment><USER37> Since it is tax time, when people normally discover their accounts have gotten locked by people trying their account name and passwords from the endless stream of credentials thefts, I would observe that there are several brokerages which will issue a brand new password and read it to you over the phone without a single challenge (even the useless public records questions) if the ANI on the inbound call is correct.

</comment><comment><USER38> People have lived happily alongside this vulnerability for decades.. There's also a pretty cool CLI application called SS7MAP for pentesting which is not quite that old (a year perhaps), I haven't gotten around to trying it yet.. I had forgotten. Interesting stuff.. And this is extactly why you often hear the phrase "you shouldnt rely on 2 Factor Auth."

</comment><comment><USER39> I've heard about such scams since years ago at sites like [http://whycall.me](http://whycall.me) and another similar sites. People should be aware of these kind of scams by now. Keep spreading the word and informing our family about them is the key.

</comment><comment><USER40> A popular attack these days is usage of fake roaming requests. They require nothing except knowledge of your IMEI, and IMEIs can be bought bulk online from android app devs.

That's how British MPs were, allegedly, pwned en masse in 2016

<comment><USER21> Are you sure you're not mixing up IMEI (identifiers of hardware handsets and end devices, can be often reflashed), with IMSI (identifiers on the SIM, and therefore the number and subscription associated with the SIM (simplified description)) ?

You don't need to "buy", but you need to FIND, the IMSI of the target you're going to do fake roaming (fake Location Update) request on. This is most of the time doable.

<comment><USER40> I did, thanks for correcting me.

</comment></comment></comment><comment><USER41> I am glad my bank does not use phone numbers for anything. 2FA works with a special device that is not on GSM networks, for identification they use other means (not including the phone number).

</comment><comment><USER42> off topic: how much defunct/dormant telco infra has been left laying around which could be put to use? are old copper lines between cities still there? Old mode fiber?

</comment><comment><USER43> Other than hoarding gold (edit: or cryptos, or anything similar), what is the best way to make sure my net worth doesn't just go to zero from one day to the next?

<comment><USER44> Cryptocurrencies. Its pub-priv key security for money.

Hardware wallets are really cool ex: [https://wiki.trezor.io/FAQ:Overview](https://wiki.trezor.io/FAQ:Overview)

<comment><USER45> Seems like a heavily volatile way to store your "net worth."

<comment><USER28> I guess it is ironic that stablecoins are probably the most secure way to store your money

crypto security, usually legacy underpinnings, no volatility

</comment></comment></comment></comment><comment><USER46> text-version: [https://termbin.com/9w1q](https://termbin.com/9w1q)

</comment><comment><USER47> I bet the 1A2 Key system was harder to hack

</comment><comment><USER48> Using sms or smartphones in any capacity for 2fa is dumb</comment>