I found Prezi's source code - <AUTHOR> http://blog.shubh.am/prezi-bug-bounty/ <comment><USER2> My $.02 on this is that Prezi should have not awarded the researcher the cash under the bug bounty program, however they should have given him a reward anyway. Awarding the money as part of the bug bounty wouldn't be fair play under the rules of that program, but he potentially saved them a TON of money and problems. As such, he should be rewarded somehow. Further, had he been less than honest, he may have been able to leverage the code itself to find more than one $500 bug.

I think Prezi should have done something like this:

* Acknowledge the problem and the seriousness of it

* offer a reward, but not under the bounty, just a "thanks"

* Have him sign an NDA about the source itself, and the specific details of the issue, and the amount of the award

* Allowed him to write up the experience should he choose (good PR for prezi)

* (maybe) offered a contract for the researcher to find more such issues, or announced a different program as a result of it.

The reasoning behind doing it outside the program is that Prezi needs to walk a fine line between saying "just attack everything and we'll pay you!", "we are too process driven for our own good", or they end up getting bad press from people who tried to follow the rules not getting anything, but cheaters are getting paid.

<comment><USER3> >Further, had he been less than honest, he may have been able to leverage the code itself to find more than one $500 bug.

I'm not sure I agree with this particular argument, it essentially reduces the concept of a bug bounty to blackmail. This mindset is not a constructive one.

The tester should get rewarded for their hard work and helpfulness, not the decision to follow the law.

<comment><USER4> I think he meant scan the source code for security issues and then report those bugs one by one ...

<comment><USER2> That is what I meant, I should have been more clear.

<comment><USER5> How is that dishonest? It sounds like a great way to improve security and get bounties.

<comment><USER6> I'm sure (paying) customers will be totally fine with Prezi's source code being available to anyone that want to try to hack the site.

<comment><USER5> I fail to see how that has anything to do with honesty. The source was leaked accidentally.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> It _was_ out of scope. The rules are pretty clear: [http://prezi.com/bugbounty/](http://prezi.com/bugbounty/) and he broke at least two of them.

And it seems like he knew it was out of scope when he submitted it too: "I had spent a total of 2 hours sifting and crawling through their services which were _in scope_ , but wanted to see if I could locate any _other_ subdomains..."

Now I think Prezi should probably have paid him anyway because that's a pretty boneheaded error and I'd be very grateful if someone politely pointed it out to me... but they aren't obligated to. You can put your pitchforks down.

<comment><USER8> So because it was out of scope it means that it could not have harmed the company so he should have just left it there?

<comment><USER9> You're not entitled to a bounty just because you found a bug. Some companies offer these bounties and it's good that they do, but that doesn't mean every company is obliged to offer them, or that a company that offers bounties for some bugs is obliged to offer them for all bugs.

<comment><USER10> How about a moral obligation? Honestly, it sounds like if a taxi driver returns a bag full of cash to the owner, it is perfectlly alright if they just say "Thank you" and walk him to the road. Legally: nothing wrong, morally: being a greedy asshole.

<comment><USER11> That's an interesting point of view. I consider it being a greedy asshole when you feel entitled to a reward for doing the right thing.

<comment><USER12> It should absolutely be in the interest of companies to reward security researchers who find flaws in their systems. Otherwise, they will be screwed by the less scrupulous.

<comment><USER11> We are talking about different things. Sure it's in the company's best interest, just as it is in the interest of someone that loses their wallet to offer a reward. That said, when nothing is offered up front (possibly because the problem is unknown), to feel _entitled_ to a reward and disgruntled when one isn't offered is not what I would call "moral" behavior, as brought up farther up-thread.

It's moral when you do it because it's obviously the right thing for everyone involved. When there's money involved, that's something else.

<comment><USER13> Just because you're complaining doesn't mean you feel entitled. If someone is rude to me and I complain about it, and I expressing that I feel _entitled_ to have non-rude interactions with this person? If I post a negative book review am I feeling _entitled_ to a good book?

<comment><USER11> But is it rude for someone to not monetarily reward you for doing something good? That's what I was replying to up-thread. To feel you deserve compensation for a good deed when there was no prior agreement as such is indeed entitlement.

This thread hasn't really been about the article for a while. It's been about someone feeling that people that don't reward for good deeds are greedy assholes, which I think sets a bad precedent. If you want to incentivize fine, but let's not confuse that with what the _right thing to do_ is.

 _How about a moral obligation? Honestly, it sounds like if a taxi driver returns a bag full of cash to the owner, it is perfectlly alright if they just say "Thank you" and walk him to the road. Legally: nothing wrong, morally: being a greedy asshole._

Edit: Fixed truncated second paragraph.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Why even have a limited scope on bounty programs? (This is not the only time I've seen that.) Is it only to limit payout? Are their legal reasons? For example, their client tablet applications are ineligible. I just don't get the reasoning.

In their position, I'd pay him the $500 and remove the idea of scope. I'm just curious if there's some counter-argument I'm not thinking about.

<comment><USER7> Well of course there have to be rules. Does spear phishing employees email accounts and using their password to access control panels count as a bug? I bet I could hack a lot of companies that way. Does being susceptible to a massive DDoS count as a bug? Cutting power to the building?

I can't speak for Prezi, but it seems like they want people to test the security of their app, but not of their employees or back office infrastructure. Maybe you disagree, but it's their bounty and I think those are fair rules.

<comment><USER15> Large tech companies routinely run pentest exercises against themselves that involve phishing their own employees. Good security has to include educating the human element as well: if you have great technical security but all you have to do to get in is ask an employee their password, you've lost.

Large companies also invest significantly in protection against massive DDoS and power cuts to the building, along with drills for earthquakes and zombie apocalypses.

<comment><USER7> I wasn't trying to say those things aren't really security problems... just that they perhaps aren't things you'd want random people on the internet attempting to exploit.

</comment></comment></comment></comment><comment><USER16> There should be some neutral third party non-profit that adjudicates bug bounties so that security researchers don't need to worry that their efforts will go to waste.

Companies could sign on to using this third party and pay a fee and put up escrow for the service. This would motivate researchers to find bugs for those companies that utilize the service, knowing payment will be impartial.

<comment><USER17> A simple option is CrowdCurity - reward programs as a service. Private or public, dollars or bitcoin payments - everything setup and managed for the companies.

[https://www.crowdcurity.com/](https://www.crowdcurity.com/)

Disclosure: I'm co-founder of CrowdCurity

<comment><USER18> You know, you are just harming yourself this way. If you must show your stuff on HN, why not post it as a ShowHN?? why do this dishonorable thing to gain attention? IMO it actually harms you.

<comment><USER18> a down vote? :O but why? i thought we were unanimously against plugs?

<comment><USER19> You didn't get the memo ? There's no such thing as a single we anymore.

</comment></comment></comment></comment></comment><comment><USER20> What is the gain in setting up a "Can you hack us?" and then make some parts out of scope?! It's not like a black hat hacker would go "Oh well, this isn't their usual domain, so It's not fair" -.-

The only thing this causes is exceptionally bad PR, or even worse for the company; someone just got access and you don't know. Access to source code is like the gold mine of finding an exploit, because you will know exactly where a vulnerability is, and you won't even have to blindly test it.

<comment><USER21> > What is the gain in setting up a "Can you hack us?" and then make some parts > out of scope?! It's not like a black hat hacker would go "Oh well, this > isn't their usual domain, so It's not fair" -.-

This suggests that anything less than perfect security is worthless. Which is better, having pentesters look for vulnerabilities in 50% of your surface area, or having pentesters look for vulnerabilities in 0% of your surface area?

Setting up a bug bounty program has a cost, both in terms of processing the data submitted and in potential disruption of the provision of services. This cost will differ from attack vector to attack vector. Having pentesters dress up as utility workers and attempt to sneak into your company offices to install keyloggers will have an extremely high cost in terms of disruption. This cost may be higher than the potential benefit of learning about the company's vulnerabilities in this area.

There are also some attack vectors that may be problematic to allow pentesters to probe due to third-party contracts, data protection laws, compliance issues, etc.

You may disagree with the particular areas a company chooses to define as out- of-scope, but to claim that having any areas off-limits renders the whole enterprise pointless is reductive and incorrect.

<comment> r-s > This suggests that anything less than perfect security is worthless. Which > is better, having pentesters look for vulnerabilities in 50% of your surface > area, or having pentesters look for vulnerabilities in 0% of your surface > area?

Is this supposed to be rhetorical?

Say you buy a really good front door for your house, and forget to put a back door on your house. I would say that testing the security of the front door is a waste of time.

<comment><USER22> You should read the rest of that post instead of stopping at the point you quoted. I think he makes a good point: There are real costs associated with expanding security, and there are points at which those costs _can_ become unreasonably high.

I think your point is too extreme. Locking your front door is most definitely NOT a waste of time, because with that move alone, you've automatically protected yourself against the subset of attackers who don't think to try the back door. Are you still vulnerable? Yes, of course. But decidedly less so. As the OP said, 50% is better than 0%.

The real conversation that should be taking place is not whether or not a limited scope should exist (it should), but how far that scope should extend given the costs of extending it.

</comment></comment></comment></comment><comment><USER23> Exhibit A of why having a scope for bug bounties is a terrible idea. What is the point of testing your app for esoteric bugs when your entire source code and passwords can be Google dorked?

<comment><USER24> Or for expanding the scope when you realize it's obviously too narrow.

</comment></comment><comment><USER25> I'm hp co-founder and CTO of prezi. We learn from our mistakes, we have changed the program: To improve the program from now on we will reward bug hunters who find bugs outside of the scope provided that they do not violate our users' information and that their report triggers us to improve our code base. We will also retroactively check to see if other reports found issues that fall into this category. More info at engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bugbounty/

<comment><USER26> This should be up-voted some more so people can see the resolution. I'm glad you guys decided to reward the bug hunter for his time as well as provide a response.

</comment></comment><comment><USER27> "Out of scope". Wow. Even more worthwhile that such a huge out of scope bug was found. These companies seem to try anything to keep from paying bug bounties.

<comment><USER28> To be fair, there was a scope set, and the author was fully aware of it:

> I had spent a total of 2 hours sifting and crawling through their services > which were in scope, but wanted to see if I could locate any other > subdomains, with the assistance of google.

While I agree that he most certainly found a "bug" (perhaps flaw would be a better word), it was out of scope. And using credentials from an employee to log in is nearly always out of scope.

<comment><USER29> That said, he could have gone "gray-hat" and used the source to find in-scope bugs. Such a resource would be invaluable to an exploit author or bug bounty hunter.

<comment><USER7> Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you.

<comment><USER30> > Legally, I don't think there's much "gray" in stealing source code that > doesn't belong to you

I thought the whole point of gray hat is that it's possibly illegal, but not downright "evil".

i.e. Stealing source code to fix bugs = gray, stealing source code to steal credit card info = black

<comment><USER31> You're right, but it will still get you into legal trouble. Not only may you not get a bounty, but they might sue or press charges for essentially copying and scanning their source code.

Generally "gray hat" and "corporation/law-friendly" don't mix, even if there are some cases that call for it.

</comment></comment></comment></comment></comment></comment><comment><USER32> Hi, I just thought I would update everyone on my experience and the last 12 hours.

At the time in which I found the bug and was not awarded for it, I was quite upset, evident from my tone in the email in which I decided that I did not want to receive any of their "swag", but rather give them some constructive criticism.

I wasn't expecting the blog post to get as noticed as it did, but as it has, I was able to observe great points on both sides of the argument of whether or not I should be received the bug bounty. These discussions were definitely required as they brought out some important issues with bug bounties today and how security issues should really be dealt with.

Prezi, has now both apologised to me and also have offered to pay me for my findings. I have updated my blog post to show this, as well as the emails exchanged between us. I'm glad that it ended this way - all within the last 12 hours.

Initially, I did not redact the developers names, and after the blog post became I had to rush to make sure that I had removed them from all places which were indexed by Google. My intention was not to negatively affect the careers of the Prezi developers affected from my findings.

I thank everyone here, and generally on the internet, for looking closer into my findings.

Thank you, Shubham

</comment><comment><USER33> Break the rules, don't get the money. Surprise!!?? After reading the entire email thread, I think Prezi comes out better off than the OP:

 _Actually we 're continuously thinking on your case and struggling on the right move. On one hand, your finding was very useful for us, and we learnt a lesson from it. On the other hand, intra.prezi.com is out of scope, and by using the credentials to log in you violated the terms and conditions of our bounty program._

...

 _In the past we turned down the bounty request of people finding issues in out-of-scope services. We had a lot internal discussions about your request: if we were about to pay, we couldn 't justify our out-of-scope decisions for anyone else._

<comment><USER34> _...if we were about to pay, we couldn 't justify our out-of-scope decisions for anyone else._

What, are we in kindergarten? Does Prezi not have managers entrusted with taking decisions? They can run their bounty program however they want.

That they choose to run it in this fashion sends several messages in addition to the obvious, "we are obnoxious miserly prats". While hackers in white hats might be hearing "concentrate your efforts elsewhere", those in black hear exactly the opposite message. Many people who might previously have admired Prezi for their innovation and paid them money for their services, have now heard a reason to find other means to create presentations. Potential acquirers and potential hires have heard that this company's management finds running a bounty program challenging.

EDIT: Maybe I'm being too harsh. Apparently this is a largely Hungarian company; it's possible there are cultural misunderstandings in play. From a (perhaps cliched?) American perspective, however, following the rules is less important than accomplishing the goals of the program.

</comment></comment><comment> nezza-_- Bad judgement call on the site of Prezi imho. He didn't abuse it and notified them immediately after verifying his finding as it seems.

<comment><USER35> And they sat on the decision until he pestered them. Not good at all.

</comment></comment><comment><USER36> What this guy describes doing (using accidentally exposed credentials to log in to somewhere) is quite a bit more than what other people have been successfully prosecuted for violations of the CFAA for. I'd be careful.

<comment><USER35> You mean that Prezi, a Hungarian company, would prosecute the author, an Australian, under an American law?

The Internet isn't just something happening in the United States.

<comment><USER37> It's a fair point, but a lot of other countries have similarly strict laws.

<comment><USER35> Hungary doesn't. I live here.

<comment><USER37> Really? According to this monograph even logging into a non-password-protected wifi network which doesn't belong to you has been treated as a case of theft in Hungary:

[http://books.google.ca/books?id=ZjBvpN0zZNkC&lpg=PA33&ots=Uq...](http://books.google.ca/books?id=ZjBvpN0zZNkC&lpg=PA33&ots=UqvV5tuTyB&dq=cybercrime%20laws%20in%20hungary&pg=PA260#v=onepage&q&f=false)

Not exactly the same situation, but it suggests that the law is fairly strict.

</comment></comment></comment></comment></comment><comment><USER38> "We're pretty sure your actions were taken in good faith". Ouch, their email response contained barely an iota of gratitude and it was almost on the verge of passing judgement on his character.

</comment><comment><USER39> So let me get it straight, someone, aware of their bounty program or not, found their closed SOURCE CODE, and is getting a T-Shirt? How much do you value your own source code? at least 10,000$ right? ;) (probably much, much more) who cares about the scope, if someone found my wallet on the street which had 10,000$ in it, I would give them a bit more than a T-Shirt, I would buy them a whole wardrobe.

Think if someone found the source code for Windows / Office / Photoshop, without any bounty program, and responsibly disclosed it to the respective companies. If he didn't walk away with nice amount of money, he could easily just put it in the nearest torrent site* without even feeling guilty (*this is wrong, and illegal, don't do it)

<comment><USER40> If you found Adobes source code, they'd probably sic the cops onto you.

</comment></comment><comment><USER40> Ignoring the bounty thing for a second, their email response "we think it was in good faith" seems... Not right to me. Am i reading that weird or did they seem pissed about him finding something like that?

He plugged a huge issue for them, and they screw him over due to "scope"... That's their choice, but it still seems bureaucratic to me.

<comment><USER41> They're talking about viewing the source code and testing the login. The author could have just reported the leaked credentials and not logged on. Testing them especially since it wasn't part of the program falls under potentially extremely malicious.

</comment></comment><comment><USER42> There should be a database of these bounty programs that can tell you if a company pays or not, sort of like a credit bureau.

<comment><USER43> [https://bugcrowd.com/list-of-bug-bounty-programs](https://bugcrowd.com/list- of-bug-bounty-programs)

</comment></comment><comment><USER44> I don't understand why companies start those bug bounties and later try to avoid paying out the rewards. If it were me, I'd book the reward amount as "spent" the minute I decided on a bug bounty hunt.

I think this is (yet another) lesson that participating in these kinds of bounty hunts is very risky and should only be done if the company is reputable (which this one apparently is not).

<comment><USER45> How is this not reputable? They are pretty clear about when they will not sue people trying to hack their systems, a bounty is a bonus.

</comment></comment><comment><USER46> Seems like Prezi has changed its mind about not paying. Prezi being a Hungarian startup made a buzz in the local media with this story and one of the leader news site reached out to them and got this reply: "Prezi: Hibáztunk és fizetni fogunk" witch means: "We made a mistake, we will pay"

They also said that they will release a blog post and they will change the bounty program, so mistakes like this will not happen again (hopefully)

</comment><comment><USER47> Wow, I hope you didn't send them your physical address after this. We often hear of companies sending the police after people trying to be helpful.

</comment><comment><USER48> Simply by logging in he could be thrown in jail. I hope some prosecutor doesn't get wind and decides to bring charges.

<comment><USER49> Why is that? Weren't the login credentials posted publicly?

<comment><USER50> If you leave your door open and someone enters without your knowledge, would you call the police?

<comment><USER51> It is closer to find someones home key in a public place and deciding to see if it opens their door or not before giving it back.

You did not enter the house you did not explore. You turned the key, the knob, and made sure the door would open a little.

Not something I would recommend, especially since the key had the address and the owner name and address attached to it.

But not as bad as someone entering the home and looking around.

<comment><USER37> The analogies are beside the point. Logging in to a system which you don't have permission to access just _is_ illegal in many countries, whether you think that it ought to be or not.

<comment><USER51> > The analogies are beside the point.

It helps decide weather or not the legal response if any is reasonable.

> whether you think that it ought to be or not.

I was not trying to comment on what I think ought to be.

<comment><USER37> I don't see how those two statements are consistent with each other. The first says you're trying to judge whether or not the law is reasonable, and the second says that you're not trying to comment on what the law ought to be.

<comment><USER51> > judge whether or not the law is reasonable

I am trying to make that judgment and help others to do so.

> and the second says that you're not trying to comment on what the law ought > to be.

If I am trying to make a judgment, if I am in the process of reasoning through something I do not know what something ought to be.

Good analogies are those that help people reason through a problem and come to the correct conclusion, not a tool to sway people to your opinion.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER52> One wonders if he wouldn't have been better[1] off downloading their app source, and using that to find 'in-scope' vulns much easier than everyone else. They might catch on if you're too effective though. Maybe a spot of plausible parallel construction.

[1] Except for the totally illegal aspect, obviously. And the not-telling- them-their-source-is-open-to-the-world bit.

</comment><comment><USER53> Presumably the goal of the bounty was to make Prezi more secure. OP found a serious security hole, without using a "violent" approach (spear phishing, cutting the power, etc). OP reported this security hole.

In a legal sense, they aren't obligated to pay. There are a lot of legal loop holes. By not paying for something that they obviously want to know, they are discouraging other security researchers to disclose "out of scope" holes. To what end?

 _If you succeed, we will give you cash. That's right; we'll pay cold hard currency into your bank account. Think of it as a thank you._ (Prezi bug bounty site)

I guess the right way to read this is as a (legal, of course) fuck you.

</comment><comment><USER54> This sends a worrying message to others - in future don't bother reporting vulnerabilities to Prezi, just obtain the source and sell exploits to the highest bidder.

It's no wonder security researchers turn to black hat methods, when they're treated/compensated like shit for their effort. "Swag" in return for your source code? What a joke

<comment><USER55> "It's no wonder security researchers turn to black hat methods" \-- this seems such a binary and pointless reduction of the options available. Yes, Prezi could have turned this into a PR and security win, and failed to capitalize; but the assumption that now the only option for a security researcher is to turn to the dark side is... pretty ridiculous.

Those who "turn to blackhat methods" do so because they want to make money and don't place a premium on the potential moral/legal/ethical issues at play in how they're doing it. They make a choice, irrespective of the shortsightedness on display by Prezi here. Don't conflate the two behaviors.

</comment></comment><comment><AUTHOR> I'm noticing yet another instance of HN modifying post titles. I originally titled this post "Finding Prezi's Source Code" specifically because I did not write the article. Now the post title reads (at first glance) as if I'm taking credit for the author's hard work.

<comment><USER56> Both titles are misleading. The title should be:

"I found Prezi's client-side source code"

</comment></comment><comment><USER57> I think they acted pretty fairly by pointing out that it's the logging in that they have issue with. Although it's not as satisfying, I think Shubham could have submitted the link and credentials to Prezi without actually accessing the repo. In particular, the report email contains the snippet "... I explored the nexus console to confirm that ..." and I can understand Prezi not wanting to encourage pen testers to explore their systems, even if they find them open to the world.

<comment><USER30> > I think they acted pretty fairly

They absolutely didn't.

I don't get how there seems to be absolutely no human side to these cases.

Guy discovers critical vulnerability and could have completely fucked the company over. Instead he responsibly reports it, and he gets back a big fuck you. How can you possibly think that's fair? The fact that it's out of scope only means they should give him an out of scope reward - much higher!

Saying he could have not checked the credentials is a bit silly, because if the credentials were invalid (quite likely), it goes from CRITICAL to MINOR.

And isn't the _entire point_ in bug bounties to _encourage_ pen testers to explore your system? Sure, you don't really want them poking around your source control, but better that than black hats.

All of the above aside. They really couldn't spare $500 for someone who could have caused $millions of damage?

<comment><USER57> > Guy discovers critical vulnerability and could have completely fucked the > company over.

We all frequently have the opportunity to cause damage, but we don't get rewarded for _not_ doing so. I think Prezi may have given the cash reward if the pentester hadn't logged in and browsed around. They probably don't want to set a precedent (take the data you find, get cash reward).

> ... because if the credentials were invalid (quite likely), it goes from > CRITICAL to MINOR.

Agreed, but either way the pentester won't be able to fix it. All he can do is report his findings.

> ... but better that than black hats.

Agreed, but if you stray outside the terms of the bounty then you're no longer guaranteed the rewards. I think the pentester tried his best to report responsibly but I don't think Prezi are obligated to give the reward, based on the terms.

<comment><USER58> _" and browsed around"_

This seems to be key. Did he just verify the credentials, or did he poke around thereafter? If the latter, Prezi has a better case but they should have stated it more clearly.

</comment></comment></comment></comment><comment><USER59> I suspect that the biggest reason is that this amazingly gigantic, critical vulnerability was so ridiculously easy to find that they cannot stand the idea of paying someone a large amount of money to "fix" it, when the fix is to simply deny access to that service from outside a LAN or whatever. Prezi thought that they found all of the easy ones. Not quite.

</comment><comment><USER60> My problem here is that the OP did not mask the names. Actually he did quite the opposite: he bolded them. This is no good. I can imagine the dev searching for his name in google and finding that post.

<comment><USER32> Hi, I'm the author of the blog post. I've masked last names from the post and PDF, hopefully meaning that they wont be indexed with that post. Thanks for bringing that to my attention.

<comment><USER60> Thanks, it is much better now.

</comment></comment></comment><comment><USER61> This is definitely out of the scope of their "bughunt", although I think the guy should be rewarded anyway.

But I'm also quite upset with the fact that OP is outing the dev. Everybody makes mistakes, no need to out any individual developer because OP is pissed at the company management.

<comment><USER32> I realised 2-3 hours after my blog post, and rushed to redact the last names from the post + pdf. I have now also redacted last names from the screenshots. Sorry about that! But thank you for letting me know. :)

<comment><USER62> FYI, You can still see the url of the user on bitbucket and from there still get a name.

</comment></comment></comment><comment><USER63> > "Anyways, they did try and get it right, by emailing me an apology as well > as responding to my constructive criticism. This blog post, is by no means > attempting to discourage people from participating from Prezi's bug bounty, > but rather just a blog post about how finding Prezi's source code was not > eligible for their bug bounty."

Passive aggressive much?

I think he should have got a bounty -- if not the official one, then a special, _bigger_ one. However, this is an odd way to conclude the post. "Oh, I'm not at _all_ trying to discourage others for participating, oh no no". Of course he's trying to discourage others. With justification. I don't get it.

<comment><USER64> Probably doesn't want anybody pointing legal fingers at him for harming Prezi or something.

<comment><USER63> Oh I see. You mean like, "Here's my experience; I decided to stop participating. But I'm not advising you to. Offer not valid in all areas. Yada yada..."

</comment></comment></comment><comment><USER65> This would be unethical and I would never do it, but the interesting scenario would have been if he'd secretly pulled the source code and used his access to it to find a bunch more bugs. He would look like a genius and pocket a bunch more money.

</comment><comment><USER66> The rules seem to allow a reward for this kind of vulnerability,

 _What's up with other vulnerabilities? ... we will consider if they are eligible for a bounty or not_

 _What is the bounty? ... we will increase it at our discretion for distinctly creative or severe bugs_

Prezi explicitly designed the rules to be flexible, so they could give the award in this case, but decided not to because "intra.prezi.com is out of scope".

The rules about scope appear to exclude vulnerabilities in 3rd-party services such as AWS, not backends, e.g., _the backends for our iPad and desktop applications are in scope_

[http://prezi.com/bugbounty/](http://prezi.com/bugbounty/)

</comment><comment><USER67> Here's the response from Prezi [http://engineering.prezi.com/blog/2013/12/03/a-bug-in-the- bu...](http://engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bugbounty/)

</comment><comment><USER68> The redacted names are kind of pointless, because they're not redacted in the images of the emails.

<comment><USER32> I redacted their names from the post and PDF only, to prevent Google from indexing and associating the blog post with them.

By doing this, future employers hopefully will not see the blog post when searching their names.

<comment><USER68> Oh I see, that makes sense.

</comment></comment></comment><comment><USER69> Here's the cached version of the commit: [http://webcache.googleusercontent.com/search?q=cache:https:/...](http://webcache.googleusercontent.com/search?q=cache:https://bitbucket.org/flash42/config/commits/1934298e907b95234dca40050a2d0f6f)

The Nexus Repositories URL ([http://intra.prezi.com:8081/nexus/content/repositories](http://intra.prezi.com:8081/nexus/content/repositories)) is still not restricted

</comment><comment><USER70> It would have been easy for him to steal the source code and blackmail them for bitcoins... companies are encouraging others to turn to the dark side by not giving fair rewards. I'm pretty sure there are lots of smart people living in difficult economic conditions who will now think twice before reporting a serious vulnerability at the risk of an unfair reward. If Synack can solve this it would be a major win for everyone.

</comment><comment><USER71> Why on earth would you ridicule the developer that made the mistake publicly? That is just utterly idiotic and irresponsible.

</comment><comment><USER72> Why not offer him the bounty in exchange for signing an NDA? If they're actually worried about not setting a precedent..

</comment><comment><USER73> Finder should receive the highest bounty possible IMO.

<comment><USER74> a unicorn tear

</comment></comment><comment><USER75> I hope he downloaded their whole sourcode. That should make locating in-scope bugs much easier.

<comment><USER76> I don't know about you, but I'm not about to proof read someone else's source code for a system I don't even know.

<comment><USER4> I'm willing to do it for $500 a bug :-)

<comment><USER77> Easy money for an unscrupulous sort

</comment></comment></comment></comment><comment><USER78> What an asshole approach [1]. Please, next time someone find a critical bug in the system, don't bother emailing them; just post it on Twitter.

[1] [http://i.imgur.com/v3W9FD6.png](http://i.imgur.com/v3W9FD6.png)

<comment><USER79> The picture says "intra.prezzi.com is out of scope". Because yeah, real attackers would _definitely_ not go looking for a back door instead.

</comment></comment><comment><USER80> Don't worry about the bounty, here, have swag that freely advertises our company. Weak. Why should anyone put up with that?

Pay him something outside the bug bounty program. Easy and cheap solution that could've avoided all this mess.

</comment><comment><USER81> A bounty program is to get 'white hat' hackers to find and report vulnerabilities. The bounty is small, nowhere near what an extortionist could charge to keep the source secret for instance.

By paying nothing for what could have been sold back to them for a huge sum, they may disaffect hackers, who could do them real harm. You become a sucker to volunteer for their 'bounty', and decide to turn to the dark side instead.

I think Prezi are very silly to be splitting hairs about this. They stuck the stick in the hornets' nest, now they are arguing with the hornets.

</comment><comment><USER82> The guy found and brought to their attention a simple exploit that could have seen valuable source code released into the wild and the guys at Prezi are debating about paying him a bounty?

Does this mean that Prezi do not value their code and don't believe there would have been any significant loss if that code became public?

Are they saying that the next person that discovers serious flaws in their security should just keep quiet - or sell it on to some hacker, where at least they can make some money from it?

Just what message are the Prezi people trying to send by nit-picking over $500?

</comment><comment><USER83> One trick to avoid stupidities like this is to tell them what you found, but not _how_.

How much is worth the vulnerability of having access to _all your source code_. Just ping me if you're interested.

</comment><comment><USER84> Silly PR move on their part. They should've given this guy some shush money to prevent this (now) PR nightmare. Shoddy security practices, shoddy marketing and PR. Tsk, tsk.

</comment><comment><USER85> In case anyone missed it: Prezi finally decided to pay him the bounty.

Still a bad move to have denied him the bounty in the first place, but good to see that they're listening to the outrage.

</comment><comment><USER86> So the question I haven't seen asked in this thread is: Why is anyone still using something other than SSH to connect to their version control system? Why is any software still using usernames and passwords stored in plain text anywhere? With SSH, you create SSH key pairs and set a passphrase on the private key... which shouldn't end up in any public place, ever.

<comment> brown9-2 Well the credentials in the properties file shouldn't have ended up in a public place ever. So if you replace username/password with a key, a human can still accidentally publicize the key.

</comment></comment><comment><USER87> This policy of limiting security assessments/bug bounties to only certain things is really stupid.

Do you really think that any extremely motivated hacker would just stick to the arbitrary terms you set.

He will do whatever it takes to get in and by limiting security research you're making yourself vulnerable in other areas not defined in that assessment request.

</comment><comment><USER88> Nexus isn't a source code repository. What you found was their internal artifact server, i.e compiled jar files.

<comment><USER89> If you look inside those compiled jar files you'll find that the code is pretty easy to read. It's certainly enough to find vulnerabilities.

<comment><USER88> But.. that can be said about any java (jar) programs class files. It is also not difficult to decipher the asm of a disassembled exe file, but to equate that with finding the source code of the program would be disingenuous.

<comment><USER90> You can drag drop that jar file into [http://jd.benow.ca/](http://jd.benow.ca/) and in two clicks you have 100% of the source code, variable names and all. It's not the same as decompiling an C executable by any means.

<comment><USER88> Having tested [http://jd.benow.ca/](http://jd.benow.ca/) I must admit it seems to do a near perfect job. Impressive and scary at the same time.

</comment></comment></comment></comment></comment><comment><USER91> Dude needs to lawyer up right now. Doing the remote login has been seen as a violation of the CFAA.

<comment><USER92> Prezi the company is in Hungary, not the US, and intra.prezi.com (126.96.36.199) seems to be in Montreal, Canada.

<comment><USER35> And the dude in question is in Australia.

None of this happened in the United States at all - it's amazing! Non- Americans also have businesses!

<comment><USER93> Not very good ones, apparently.

</comment></comment></comment></comment><comment><USER94> Having stringent terms for a bug bounty program basically means you're trying to get the community to do your team's job. Agree with @nikcub - it should be wide open, because finding this out was huge, no matter how "simple" it may have been.

</comment><comment><USER95> Prezi deserves to be boycotted for cheating Shubham out of his bounty based on stupid "out of scope" excuse.

If cracking an internal service is possible, a bug exploiting it should be within scope of any bounty program.

</comment><comment><USER96> Bug bounty program or not, I would be pretty afraid to try to log into a source code repository without authorization to do so. It seems like a lawyer could really go after you for doing something like this.

</comment><comment><USER97> The main point is the thing that OP found is really important for Prezi. I don't really understand why they have to figure out whether the vulnerability is in "the scope", or not.

</comment><comment><USER98> So, the message they are sending is "if you find an 'out of scope' bug, sell it on the blackmarket because even if it could wreck havoc, we won't pay you for it."

Nice, nice.

</comment><comment><USER99> Are bug bounties roughly the market value of security holes in software? I wonder if this guy or less scrupulous developers could make more for them on the black market?

<comment><USER40> If the exploits are for the right targets, you bet they're worth more on the black market, but with great reward comes great risk: now you're doing something that can possibly get you jail time.

</comment></comment><comment><USER100> Anyone else notice that "Adam <Redacted>"'s full name and contact info are _not redacted_ in the screen print of the email?

<comment><USER32> I removed the last names from the blog posts and from the PDF, as they could be indexed by Google. I have now also removed them from the screenshots. Thanks. My intention was not to negatively affect these developers careers.

<comment><USER101> Commendable, though you probably need to redact the bitbucket link in the screenshot too as that has Adam <redacted>'s full name as owner of the repo.

Where does it end?!

</comment></comment></comment><comment><USER90> We should start an independent bounty in btc for whoever can find and release their sourcecode into the public. I can donate 1 btc to the cause.

</comment><comment><USER102> "...and all I got was this stupid T-shirt"

</comment><comment><USER103> Didn't he not find a bug, but found company resources that had not been secured properly?

</comment><comment><USER104> Seems like acting nefarious is more profitable than doing the right thing.

</comment><comment><USER105> I say release the code in the wild! Where it already was

</comment><comment><USER106> good article</comment>


Laser-made bike lane could save lives - <AUTHOR> http://www.smh.com.au/digital-life/cartech/lasermade-bike-lane-could-save-lives-20110615-1g2oi.html <comment><USER3> I'd be afraid that the laser light could damage children's eyes if they happend to get in the way and look into the light.

Experience from Copenhagen shows that the best solution is to have the bike path on the inside of the parked cars so the parked cars function as a buffer against the moving cars.

Putting it on the inside makes it possible to make it a different level (like the footpath) so the cars cannot go into the bike lane.

37% of people in Copenhagen bike to work, so they have a significant amount of experience with bike paths: [http://www.youtube.com/watch?v=UDs83Ud6Zss&t=1m24s](http://www.youtube.com/watch?v=UDs83Ud6Zss&t=1m24s)

<comment><USER4> My personal experience shows that it's best to have no bike paths at all. I typically only use my bicycle as means of transportation here (in Vienna) and the only accidents that I had so far were at locations where the bike path crosses a street. This is also confirmed by statistics.

Compared to this, on streets I almost never have any risky situations - <USER2> on busy multilane streets. Cars see you earlier, because you ride on the same street as they do. You don't appear unexpected (for car drivers) because you overtake on the left side like everyone else. The right of way is clear, as there are no exceptions as in the case of bike paths.

In cities such as Copenhagen and Amsterdam bike paths have an advantage, because you are faster (no traffic jams) and because car drivers expect bicycles at crossings due to the high amount of bicycles. In cities such as Vienna where the amount of cyclists is relatively low most car drivers don't expect to encounter them - so even if you have the right of way on a bike path they just ignore it.

<comment><USER5> I think you are fortunate to live in a place where bicycling is already a mainstream means of transportation. However, in many places in the U.S. (Massachusetts and New Jersey come to mind for me) it's not that drivers are distracted, but rather that many do not believe that bicycles are a valid means of transportation. If you are in the lane you will encounter real hostility and agression. In these cases, I think something needs to be done to reinforce to people that bicycles have just as much right to the roadway as cars. I'm not sure bike lanes are the solution, but something needs to be done to get the number of bicyclists up to a critical mass.

<comment><USER6> Up in Vermont it has really taken off in the past 10 years. And it is people doing it for recreation, not for transportation.

The problem it seems to me is the size of the roads. Most of the time you can not cleanly get around a biker without going into the oncoming lane. On a 50mph road with bikers going 20mph you constantly have to judge the speed of oncoming traffic to see if you can safely pass or get hard on the brakes to wait. This happens a lot and is annoying.

<comment><USER5> It's annoying for the driver. It's worse for the bicyclist who has to worry about whether the driver have actually _seen_ him as he comes barreling up from behind.

But yeah, it's true that whoever designed shoulder-less roads was completely clueless to non-automobile transportation like biking, walking, or really even scooters that can't keep up with traffic.

(Incidentally, the "coming up from behind" situation reminds me of one of my biggest annoyances as a motorcycle rider: people who come barreling up behind you when you are stopped at a light and then go hard on the brakes. They are apparently clueless to the fact that many motorbikes are rear-ended at stoplights because drivers fail to note the biker. The net effect is that you need to keep staring at your rear view mirrors ready to take off to avoid getting rear ended _in case_ they actually haven't seen you. Really, the light is red. It won't hurt you to slow down gradually. So please everyone, don't do this.)

</comment></comment></comment></comment></comment><comment><USER7> _"Eighty per cent of cycle accidents occur when bicycles travel straight ahead and a vehicle manoeuvres into them. The most common contributory factor is 'failed to look properly' on the part of a vehicle driver. The evidence shows the bike simply is not seen on city streets," she said._

This can't be true. The statistics in the US say that this is 7% of accidents:

<http://www.johnforester.com/LAW/Bikeway%20Controversy.htm>

The reality is that riding on the sidewalk and turning from the wrong lanes are the big cause of bicycle accidents. Being hit from behind is exceedingly rare. Being doored is probably the main worry that a cyclist riding correctly should have.

(Using the correct lane should be the secondary concern. Don't go straight through an intersection from the right side of the right turn lane. You're going to get hit by cars turning right.)

</comment><comment><USER8> A while ago I saw an image of a guy who had built a similar device which put a laser 'bike lane' behind the bike, kind of a joke giving you a bike lane wherever you go.

Putting it in front of the bike would seem like such a minor change, but puts it from being a gimmick to a lifesaver.

<comment><USER9> I think it wasn't real (just a mockup):

<http://www.wired.com/autopia/2009/02/lightlanes-lase/>

<comment><USER10> Even this device is a lifesafer, as it builds a very patterny visual metric of the space occupied by the biker. And the human brain loves patterns. Therefore a driver will have a very easy task at lining up his car with the biker and safely overtaking him.

Combining both designs and tweaking the projected images and colors could be an incredible step forward for bike safety.

</comment></comment></comment><comment><USER11> This could really save lives. I bike to work everyday and cars usually don't recognize bikes as something that belongs on the road.

<comment><USER12> That's because bikers (even well behaved ones) are annoying to deal with. Even if you are following all the rules, I still can have a hard time getting around you if the street is busy. Pretty frustrating dealing with a bicyclist climbing a hill at 5mph on a busy main road when you don't have quite enough room to safely get around them.

That's not even counting the bicyclists who blow through stop lights, stop signs, don't stop for pedestrians at crosswalks, ride on busy sidewalks.

In my honest opinion, I don't think bicycles belong on roads (at least in city areas).

<comment><USER13> I'm a very data driven person. Here's an experiment I did that ended up changing some of my driving habits.

The important data to me is my total driving time from A to B. So, I measured my total driving time to and from work. I also noted the number of bicycles I had to pass on that journey. If the cyclists were slowing down my total commute time, then there should be a trend in average driving times with 0, 1, or 2 cyclists encountered. No such correlation exists in my data. On average, red-lights and other traffic have more impact on my commute time than do delays caused by cyclists.

My conclusion: my emotional response to a cyclist was not proportional to any measurable delay. Now I wait calmly for a safe place to pass, secure in the knowledge that, on average, it doesn't delay me at all.

(obviously your commute time could be affected differently than mine, but I encourage you to look at the actual delay, and see if your frustration is warranted)

<comment><USER12> The slowdown effect is lower on the list of concerns than the knowledge that a slight mistake on the part of either parties probably results in the death or serious injury of the cyclist. I just find driving around cyclists stressful.

The closest comparison I can imagine would be if there were no sidewalks in cities and you had to deal with pedestrians on the side of every road as you were driving.

</comment></comment></comment></comment><comment><USER14> Wow this is a great idea, I often see drivers trying to make left turns in my city and not see bikers who are coming next to them in the bike lane (they have a 2 way protected bike lane.) It can be tricky sometimes for the driver but this would give them more information.

<comment><USER15> There is a special place in hell awaiting the drivers who overtake cyclists then do a sharp left turn (I'm in the UK so this means they are cutting in front of you).

I used to do a fairly reasonable commute every day through the center of Edinburgh and the problem of car drivers overtaking and turning left was probably the single biggest danger I had.

<comment><USER16> Here in Tokyo it's Taxi drivers, with automatic doors.

<comment><USER17> How's that, can you explain?

<comment><USER16> They can open the rear doors remotely, and often do while handling money or writing something.

</comment></comment></comment></comment></comment><comment><USER18> Sure, sure, it's a great idea to shine a laser on the ground for safety.

Until all the cats in the neighbourhood start chasing you....

</comment><comment><USER19> This maybe works well when there's only one bicyclist, but what if there's a whole group, with half of them using these laser projectors? There would be a huge green mess on the road, not very practical.

Besides that, governments will never allow random citizens to make their own street marks. It interferes with traffic regulations and laws.

<comment><USER16> A very noticeable green mess

<comment><USER20> Exactly. It's not intended to be a "street mark" but an attention-getter. Bright green mess on the road? Where's that coming from? Yikes! A flock of bikes! (I did not intend to rhyme ... :-/ )

</comment></comment></comment><comment><USER21> This is a great idea. If I biked more regularly I'd want one of these.

</comment><comment><USER22> Looks great, until you ride up a hill and project the pattern into the sky!

This device will be particularly cool in foggy conditions or in smoke.

<comment><USER23> What grade did you get in geometry?

</comment></comment><comment><USER24> In downtown where cars are bumper to bumper, the location of the green laser would require a sharp downward angle to see it; which begs the question, does this just add another spot that drivers need to check now?

I can see it working in more open roads where this would be easy to see up ahead, but when space gets narrow, the visibility angle becomes tough.

Valiant effort though.

</comment><comment><USER25> I wonder how much of bicycle accidents are caused by frustration of drivers rather than not being able to notice the rider. This product might be trying to solve a problem that doesn't exist.

<comment><USER26> How does frustration of drivers cause accidents? They run over a cyclist to let off steam?

<comment><USER10> They're frustrated by a (relatively to them) slow cyclist that they can't overtake right now, so as soon as an opportunity comes in, they take their chance in a dangerous way.

<comment> mkr-hn Just yesterday I was behind a slow-moving cyclist on a winding road with no passing spots. Three cars behind me flew out into one of the many blind corners to pass with no way to be sure it was safe.

<comment><USER26> That sums up nicely why I hate cars and driving. I just don't trust normal people with heavy killing machines under their asses.</comment></comment></comment></comment></comment>


Ask HN: Buying a domain with someone else's brand in the title - <AUTHOR>

What's the legality of using other peoples' brand names in your url.
For instance http://www.googlefight.com/ http://www.google-analytics-book.com/
The first is descriptive of the service, and the second appends a product to the brand and application.
Does anyone know where/how the line is drawn?
gogggle.com? googleappengine.com <comment><USER2> Depends on whether you know a bored or up-and-coming trademark lawyer who's willing to defend you against the inevitable lawsuit. Companies with trademarks _have_ to defend them aggressively, or they can lose the right to enforce them at all. So even if they don't actually object to google-my- shmoogle.com, they may launch a suit to get the issue in front of a judge who can say whether that's infringing or not. If they don't, a genuine infringer like gooogle.com may point to g-m-s and say 'well you didn't sue them, so you've effectively abandoned your trademark and now it's free for the taking.' Unlike copyright, trademarks can last indefinitely; but also unlike copyright, if abandoned or left undefended there is no automatic or minimum period of legal protection. Also, the usual copyright arguments like fair use or parody do not apply to trademarks in the same way.

As long as you are not competing in the same market and there is little or no risk that consumers will confuse your brand with that of the famous brand, derivative brands like this will often be allowed to stand. The point of the big brand owner has been made, the big brand has been defended at law, and can be defended in future against attempts at infringement. With the examples you provide, I'd suggest a 50-50 chance of success for the first one but only a 5% chance of success for the second. There's no hard and fast rule; trademark litigation can get very hand-wavey. It has to be said that some companies launch and then switch to a plan B name...after they've accrued a bunch of free publicity by incorporating the famous brand and declaring themselves to be shocked - shocked - at the subsequent legal action. It's a nice reliable David-and-Goliath story, especially effective if the David company is some little cottage industry focused on kids/kittens/kitsch.

I'm not a lawyer, and certainly not a trademark lawyer, so don't treat this as legal advice.</comment>


The end of dynamic languages? - <AUTHOR> https://www.tazj.in/en/1448375823 <comment><USER2> I have to say, it is always quite comical to see all dynamic languages trying to shoehorn some form of static type checking.

Like the author I like Clojure a lot and somehow agree with Bob Martin who calls it "the last programming language", but the lack of types is such a handicap.</comment>


"Don't Fuck with the cats"must watch (It's not what you think it is) - node-bayarea I initially thought it's some compilation of cat videos where people mess with cats and it takes revenge. But, boy, was I wrong. It's completely different! I highly encourage you to check it out! Especially useful for the tech community and people who care about privacy in general.<p>https://www.netflix.com/title/81031373 <comment><AUTHOR> Also worth noting it is pretty disturbing, especially if you love animals. But definitely worth watching.</comment>


Summer Reminder – Drowning Doesn't Look Like Drowning (2010) - <AUTHOR> http://mariovittone.com/2010/05/154/?123

<comment><AUTHOR> It is damn scary how much actual drowning looks nothing like the way hollywood makes it seem. I hope everyone has a fun, safe summer.</comment>


David X Cohen Puzzle | The Simpsons and their Mathematical Secrets - <AUTHOR> http://www.simonsingh.net/Simpsons_Mathematics/david-x-cohen-puzzle/ <comment><USER2> It's very easy. Brute-forceable factorization problem. I would be interested in seeing if there were more elegant solutions though, I'm sure there's some optimizations, although the numbers multiplied are prime.</comment>


Will AI become conscious? A quantum physicist's view - <AUTHOR> https://theconversation.com/will-artificial-intelligence-become-conscious-87231 <comment><USER2> The quantum theory of consciousness is scientism.</comment>


In Praise of Boredom - <AUTHOR> http://reviewcanada.ca/magazine/2017/06/in-praise-of-boredom/ <comment><USER2> I'm of the opinion that it's useful to make a distinction between boredom and idleness. Idleness can be good (Bertrand Russell wrote an essay about this, which OP might be riffing off of), but boredom, in my opinion, is almost always not.

The article also seems to imply that boredom is some sort of ineffable, indescribable thing. I think it's actually quite describable:

Boredom (often described as "I have nothing to do / wear / watch / read") is a bug we encounter when…

1- a tired mind 2- attempts to find an optimal solution 3- in a cluttered space 4- with options that have poorly-defined utility-values.

The solution, then, is to…

1\. rest 2\. satisfice 3\. declutter 4\. define your utility-values more precisely

<comment><USER3> I find your definition to be somewhat lacking, at least in terms of being bored at work. While 1 makes sense, as a lot of people are tired at work, if there is actually nothing to do, 2 does not necessarily apply. Also I assume 3 does not necessarily mean physically, but also mentally cluttered, to the point that it is hard to pick something from the mush of information floating about. That is understandable, it is hard to begin working when you don't know what to do, which leads into 4. But in a work sense, a lot of the time you do not have control over what tasks you are assigned, which makes it hard to define utility values properly.

Even though I can agree that tiredness can induce boredom, the other solutions to the problems you mentioned are not always applicable or their resolutions too difficult for an already bored mind to begin working on.

<comment><USER2> I meant boredom in a general sense, where you have control over your variables (ie you're bored by yourself, with yourself, at home).

If you're bored at work, that's a little more complicated. It depends on the context you're in. Is there "nothing to do", or is there NOTHING TO DO? (I experienced the latter context when I was in the military. In that situation, the best thing you can do is maybe read a book if you have one, or meditate and/or reflect on your life). You might have nothing to do if you were say, in some dead-end minimum wage job.

But if you're working in some sort of professional setting, there's almost always something you can do. You can learn more about the organization you're in. You can build relationships with other people. You can help other people out. You can ask your manager for more work.

In the worst case, if there's really nothing you can do, and if it's bothering you, you could quit and find a better job where there are actually things to do.

</comment></comment></comment><comment><USER4> When I was a little kid and complained to my grandmother that I was bored, she would always say: "only fools are bored." I've internalized this.

Then there's Pascal:

> All of humanity's problems stem from man's inability to sit quietly in a > room alone.

<comment><USER5> How am I supposed to sit quietly when my neighbor has a bigger room?

<comment><USER4> That's what I'm saying!

</comment></comment></comment><comment><USER6> A few points in the article reminded me of this John Berryman poem (Dream Song 14).

Having trouble with the line breaks, but it's best to hear him ready it, anyway.

[https://www.youtube.com/watch?v=GpimsgfNj7c](https://www.youtube.com/watch?v=GpimsgfNj7c)

[https://www.poetryfoundation.org/poems-and- poets/poems/detai...](https://www.poetryfoundation.org/poems-and- poets/poems/detail/47534)

</comment><comment><USER7> Just in case anyone wants to read more on the subject, a friend of mine wrote a similar essay last year.[1]

Just today I was re-reading a Susan Sontag essay[2] and came across what I think is the most succinct description of boredom: "There is, in a sense, no such thing as boredom. Boredom is only another name for a certain species of frustration."

[1] [https://fallowmedia.com/2016/jun/boredom/](https://fallowmedia.com/2016/jun/boredom/) [2] [https://www.scribd.com/doc/189866321/Susan-Sontag-One- cultur...](https://www.scribd.com/doc/189866321/Susan-Sontag-One-culture-and- the-new-sensibility-1965-and-Afterword-1996)

</comment><comment><USER8> > Maybe boredom is not something we should be fleeing; it might be an > important symptom of a more general existential malaise that bears thinking > about. After all, boredom signals a problem with the world and our place in > it. The second point is one best made, to my mind, by Theodor Adorno, whose > excoriation of boredom is part of a larger, wholesale critique of modern > capitalist society. You can scoff at this, of course, but Adorno was the > first to see that contemporary boredom is a function not just of modernity > but specifically of the political constructions of work and leisure. Boredom > is ideology.

I disagree with that statement. We have it for one BIG positive reason.

Boredom = Creativity, especially with children.

<comment><USER9> I think that at least in some situation the opposite should be true, in so far a person's ability to daydream might depend on their creativity. Given a sufficiently high ability do day dream, the day dreamer is never bored, no matter how stimulus poor the environment is.

I think a good comparison would be how children have come to rely more on toy- play over imagination-play over the years (or centuries). Not long ago, kid might have had pretty fun day with nothing but a stick and a pool of mud (to use George Carlin's imagery). But if you took a contemporary child and blast them through a time-machine some fifty years into the past, they'd be massively bored once they got there (besides being somewhat shocked because of the whole being-kidnapped-and-shot-into-the-past thing). In this case, past children were more creative, but also less prone to boredom.

<comment><USER10> I'm not too sure about that. Even in the past you would have kids who had more than the other kids. Toys have been with us humans for as long as we have been around. We are always manipulating objects around us.

If you took a kid from today and shot him 50 years ago, he may have an adjustment period, but he may just find himself interacting with the environment more.

Kids in the past probably had more creative uses out of their environment but put them in the digital world and their creativity wouldn't be there.

I wouldn't say that kids at any time period in human history were ever more creative. They were just creative about different things.

<comment><USER9> Toys always have been around, sure. But their quantity, variety and complexity (note: I include video games here) has massively increased through economic development. A hundred and twenty years ago the median American child might have had a rag-doll. Seventy or so, a teddy bear. Twenty years ago, a whole collection of dolls and toy-figures.

In so far as simpler toys require more imagination than complex toys, I still think that the effective level of creativity required of children has fallen. But I think the issue you've put forward is fair enough: there's not much* reason to believe that the potential level of creativity of children has fallen. Children might have much higher creative potential than they're currently exploiting, in which case they'd be able to adapt.

*: If performance on tasks involving creativity is positively related IQ, that coupled with the Flynn effect would suggest that creativity has increased over history. I call this "not much reason" because I'm not to sure why the Flynn effect exists and I don't think the researchers are sure yet either.

</comment></comment></comment></comment><comment><USER11> The title of the review alludes to Joseph Brodsky's memorable essay -- originally, a Dartmouth commencement address that begins:

      A substantial part of what lies ahead of you is going to
      be claimed by boredom. The reason I'd like to talk to you
      about it today, on this lofty occasion, is that I believe
      no liberal arts college prepares you for that eventuality...

[https://relembramentos.wordpress.com/2009/05/24/in-praise- of...](https://relembramentos.wordpress.com/2009/05/24/in-praise-of-boredom/)</comment>


Purely Functional Data Structures (1996) [pdf] - <AUTHOR> https://www.cs.cmu.edu/~rwh/theses/okasaki.pdf <comment><USER2> I worked through the book a couple years ago, implementing the data structures in Haskell. It was an enlightening experience. One of these days I'd like to go back and pay more attention to the analysis.

<comment><USER3> I'll add that the book has a good amount of exercises, both theoretical and implementation-related. It's worth noting that the book also includes the Haskell implementations of the data structures. Not that Standard ML is difficult to understand but hey, it's a plus!

</comment></comment><comment><USER4> Please, remember that this is PhD thesis - book covers slightly more...

<comment><USER5> And for even more see [http://cstheory.stackexchange.com/questions/1539/whats- new-i...](http://cstheory.stackexchange.com/questions/1539/whats-new-in- purely-functional-data-structures-since-okasaki)

</comment></comment><comment><USER6> The next time someone argues handwavily that pure functional programming makes code "easy to reason about," consider the fact that implementing a data structure as simple as a double-ended queue in that paradigm was PhD level work.

<comment><USER7> Every implementation in Okasaki is easier than an analogous imperative/ephemeral one. Every single one.

<comment><USER8> You can build ephemeral data structures in functional languages, and persistent data structures in imperative languages. (It's just not their default idiom.)

The ease and simplicity of the book's implementations owes to pattern matching syntax more than anything else.

As an aside: pattern matching on algebraic datatypes is awesome, and just like other innovations before, like garbage collection and first-class closures, I hope to see it transplanted to more and more mainstream languages.

<comment><USER7> Yes, I know it! This is beside my point, but it is of course definitely true.</comment></comment></comment></comment>