Ask HN: Security at my company is horrible, what can I do? - <AUTHOR> I have joined a team working on maintaining and improving an old project around 4 months ago.
The code is old and with horrible practices and no regard for security. I was OK-ish with it tho, since the app is B2B and can only be accessed via a whitelisted IP.
Now we have been told that on our product road-map we will be managing clients private keys and sensitive data that is used to communicate with financial entities.
I feel very bad about this as it could expose customers to huge risks (knowing the code-base), managers know as well.
I'm not a security expert by no means, but there are minimal stuff that can be done to remove 90% of the issues, but no one is willing to budget some time for this, and management just want to push re-writes and new features fast.
What can I do, as "the new guy" and also no formal security training.
Edit: Most vulnerabilities I saw was the possibility of one user to access and alter another's data just by messing with headers and urls. This should not be possible for a non-whitlested user as far as i can tell. <comment><USER2> In the end, the work you do reflects on who you are and to some extent changes who you are. Your spidey sense is going off. You can use this as an opportunity to grow and be more valuable to businesses that employ you.

Try writing something up about the business risks of the situation, outlining possible scenarios and how they would affect the bottom line. Explaining from a tech point of view is probably not going to get you anywhere. Focus on the business.

As part of this, document the current baseline and how it relates to these risks.

Create a plan to mitigate these risks, which may involve getting in consultants who understand the regulatory environment.

Get your management to sign off on it.

Make sure there is a paper trail for all directed changes to the baseline.

If your current business won't sign off, it's time to start looking for another job. But, you will have learned more about how to put together a business case and you will have thoughtfully advised your employer.

</comment><comment><USER3> _Now we have been told that on our product road-map we will be managing clients private keys and sensitive data that is used to communicate with financial entities_

Look up Gramm-Leach-Bliley. You may need to comply in order for the financial entities to be in compliance.

When I worked in insurance, I got annual training in both HIPAA and Gramm- Leach-Bliley. We had to comply with both. Both had information security rules.

[https://en.m.wikipedia.org/wiki/Gramm–Leach–Bliley_Act](https://en.m.wikipedia.org/wiki/Gramm–Leach–Bliley_Act)

</comment><comment><USER4> As you probably know, this is not uncommon. Project managers choose what they prioritize and security often either falls off the bottom of the priority list or is addressed by engineers who only know enough to shoot themselves in the foot.

To really shore up security, you need to raise it's priority and in a mature project that can involve a daunting shift in momentum. Developers and testers are in a rhythm of pursuing other goals.

As the "new guy", you'll have little influence to make that shift happen in a significant and lasting way.

But here's what you can do:

1\. Document your understanding and share it with the project manager. All this will do is nudge the ship a little bit, but that nudge can start a process that pays off later.

2\. Take advantage of the fact that you're new. Unlike the rest of the team, you currently only have a light impact on the rhythm towards other priorities. The project momentum may be large, and so might the momentum of more senior developers, but yours is not. Pitch your "minimal gets you 90%" work as both an opportunity to triage the most pressing security issues (buying time before a bigger momentum shift is necessary) AND as a way for you to gain familiarity and ownership of a new part of the code. You'll get exposure and commit history for some new files and will likely become a first-pick candidate for a more substantial security effort later on. They may not bite on this, but it's really the most you can make a strong case for.

Good luck!

</comment><comment><USER5> I have seen similar situations many times. In my experience managements are ignorant of the risks and are often are the worst offenders as far as lax (if any) security practices on their own PCs, etc. There is very little you can do.

Since you are not qualified to address security features, do NOT attempt to do so. That is not in your job description.

Best to document your concerns in writing (as in a hard-copy letter). Give two copies to your manager. Ask him to pass a copy up the chain of command. Keep another copy in some safe place at home.

If asked to "fix" security, point out that you are unqualified and that you are willing to do so under the direction of a suitably qualified consultant.

The reason you need to be careful is that under many jurisdictions, your company is liable for considerable penalties for failing to adequately protect client information and you don't want to become a casualty in the fallout that may come about.

<comment><USER6> > The reason you need to be careful is that under many jurisdictions, your > company is liable for considerable penalties for failing to adequately > protect client information and you don't want to become a casualty in the > fallout that may come about.

In the US, at least, proper disclosure of risk to senior leadership is sufficient to protect one's self from personal liability. Make sure you are not committing illegal acts, especially as an officer of the company. If you are not an officer, and you disclaim risk to senior leadership, you should be ok.

But, that's not always the case. If you are sufficiently worried, call a lawyer. I have been in a very similar position. Respectable lawyers have no problem spending an hour consulting with potential clients (for free) and will often times give valuable advice, even if they're yet-unretained.

I nearly sued a previous employer for firing me (arguably for whistleblowing) after I refused to be silent about illegal skirting of, and leadership's brazen refusal to implement, federally required safeguards for HIPAA, GLBA, SOX, FFEC, etc. In the nine months I spent trying to right their ship, I spent all my social capital accrued at the company - and it started it impact my reputation as a security professional. I wish I had given up (and quit) a lot earlier. Sometimes, the fight is just not worth it. Especially when non-expert execs are micromanaging know-it-alls who can't bear to be corrected by domain experts they've hired.

</comment></comment><comment><USER7> Are you certain the managers know about this and push back or have you heard this second hand? I ask because I am the founder of a saas application (see my profile for details) and one of the major concerns before buying from prospective and current customers relates to security. A lot of time is spent making sure the application is developed with the best security practices in mind. We take it very seriously. Here's the kicker: the app is only used to store test/fake data, we do not handle any production data or any of their customers' real data. Even so security is a major concern. The fact that your application is handling customer's real sensitive data, including financial data and communicating with financial entities makes me think your management should be making security a top priority, otherwise how would their customers have any faith in them? I would bet the management cares, and if they don't then there are serious problems with the company and you may want to consider leaving.

</comment><comment><USER8> Decide whether you're willing to leave the company or lose your job over this. It's not popular to say, but there are enough companies that will manage out individuals that bring up issues like this because there's no management backing and then it just becomes disruptive. It sucks. Think about it and based on that decide on how hard you want to push security issues and awareness.

In terms of best steps to actually get security flagged and addressed. Find out whether your company has a compliance or security department. If you're doing B2B, someone may be conducting a SOC2 review annually or the equivalent. These people are typically the ones empowered to do something about security and are the ones to talk to. There's also the possibility that the risks are being mitigated through another method such as a WAF. If there are no security or compliance programs you may want to chat with the sysadmins.

It's possible that the company may have decided that security was too expensive and just bought insurance as their mitigation strategy(I worked at one company who unbeknownst to me took payments but wasn't actually PCI compliant who did this). If that's the case, you're better off looking for a new job</comment>


Readability: the Optimal Line Length - <AUTHOR> http://baymard.com/blog/line-length-readability <comment><USER2> I think 80 characters per line is perfect, the same as my command prompt window. I found plenty more opinions on the subject here [http://stackoverflow.com/questions/131468/what-is-a- sensible...](http://stackoverflow.com/questions/131468/what-is-a-sensible- maximum-number-of-characters-per-line-of-code)</comment>


Mummies Take Manhattan - <AUTHOR> http://www.newyorker.com/tech/elements/mummies-take-manhattan <comment><USER2> Slightly related, I found it illuminating to google where the "X takes Manhattan" snowclone comes from.

[https://english.stackexchange.com/questions/204223/where- doe...](https://english.stackexchange.com/questions/204223/where-does-the- take-manhattan-trope-originate)</comment>


Ask HN: Can a single transistor cause an entire CPU become unusable? - <AUTHOR> Without manual intervention like limiting the number of cores or rerouting caches, is it possible that a single transistor failing might cause the CPU become unusable? <comment><USER2> Yes. Think of what would happen if a single bit in the instruction register failed, causing the wrong opcode to get executed most of the time. (There are many other possibilities.)</comment>


Ask HN: Why can't autonomous vehicles solely rely on visible light sensors? - <AUTHOR> I know that Lidar is used by most of the big players, but since it's so expensive there must be good reasons why they're opting for Lidar sensors rather than less expensive visual light cameras and sensors. Is it just that computer vision technology isn't sufficiently advanced? <comment><USER2> For example, you can bounce it off the ground under the car in front of you to "see" and measure how fast the car in front of _that_ car is moving. That can be used to anticipate collision risks that even the car in front of you hasn't seen yet (and you cannot see with your own eyes).

</comment><comment><USER3> Yes, mainly because CV just isn't there yet. Also because Lidar is better suited for the task than a camera+sufficient CV would be. The cost of Lidar is almost inconsequential anyways when compared with the total amount of building, developing, and testing an autonomous vehicle.

</comment><comment><USER4> You are not always in an area where visible light is sufficient, additionally light sensors are prone to noise related error. If all of your sensors are subject to the same errors they may collaborate on mistakes

(In before Kalman filter)</comment>


This App Will Let You Know If You've Won the Powerball Jackpot - <AUTHOR> http://lifehacker.com/this-app-will-let-you-know-if-youve-won-the-powerball-j-1797783214 <comment><USER2> It's funny because this article about winning the lottery is the fifteenth million id.

</comment><comment><USER3> "Like everyone on the planet." What planet is that, the USarth? Had to google it.

</comment><comment><USER4> Hint: you haven't won the powerball jackpot</comment>


Poor Internet for poor people: Why Facebooks Internet.org equals economic racism - <AUTHOR> http://qz.com/385821/poor-internet-for-poor-people-why-facebooks-internet-org-amounts-to-economic-racism/

<comment><USER2> "Perhaps the only way the second world and the third world can grow is to behave like they're first world nations, and demand to be treated on par with every other netizen in the world."

If I had a choice between nothing and what Facebook is offering, I would choose the something. The third world needs to earn it, not demand it. Just like the rest of the world.

<comment><USER3> The problem is this: Facebook is offering Facebook, and a few other services. What if an user does not want Facebook? If net neutrality is true, an user should be able to access anything over any carrier.</comment></comment>


Consistency Models of Cloud Storage Services - <AUTHOR> https://cloudrail.com/compare-consistency-models-of-cloud-storage-services/ <comment><USER2> I'm going to make a prediction. Cloud storage services will follow the same roadmap as SQL -> NoSQL -> NewSQL. NoSQL systems grew from the need to scale- out relational databases. NewSQL systems bring both scalability and strong consistency, and companies moving back to strong consistency. Similarly, object stores systems grew from the need to scale-out filesystems. A new generation of hierarchical filesystem will appear that bring both scalability and hierarchy, and the cloud will eventually move back to scalable hierarchical filesystems. I'm basing this prediction on recent work on scaling hierarchical filesystems by providing distributed metadata layers - [https://goo.gl/NPXLQN](https://goo.gl/NPXLQN)

<comment><USER3> As it turns out, very few software engineers can build sophisticated applications on top of KV stores.

</comment></comment><comment><USER2> Big companies work around this problem by having their own metadata store which is a (non-consistent) replica of S3/GCS' metadata.

Netflix built s3mpr to stop problems with Hadoop jobs inserting files, other jobs then starting but not finding the file(s) when they execute a listing for it:

[http://techblog.netflix.com/2014/01/s3mper-consistency-in- cl...](http://techblog.netflix.com/2014/01/s3mper-consistency-in-cloud.html)

Spotify are doing the same for GCS.

AWS have even done it for EMR - [http://docs.aws.amazon.com/ElasticMapReduce/latest/Developer...](http://docs.aws.amazon.com/ElasticMapReduce/latest/DeveloperGuide/emr- fs.html)

<comment><USER4> Even better than a replica, is using a strongly-consistent metadata store to drive the S3 metadata--use the metadata store to acquire unique S3 keys, write to S3, then transact the S3 manifest back to the metadata store. Then you do not have to deal with the problem of replication.

</comment></comment><comment><USER4> This is extremely important to think about if you're building on top of cloud services. Misunderstanding consistency models and limitations can make or break your application and cause serious data quality problems.

This seems relatively misleading, at least for S3. S3 is similar to the comments for Google Cloud. List operations are generally eventually consistent. RAW is strongly consistent. Read-after-overwrite is eventually consistent.

I can only comment on S3 because I have a lot of experience with it.

<comment><USER2> "Read-after-overwrite is eventually consistent." This means update to normal people.

<comment><USER4> Read-after-overwrite makes it clear that it's in contrast to and distinct from read-after-write. Sometimes different words mean the same thing, and you pick the word based on its context. And in this context, the readers aren't "normal people"\--whatever that means--they're engineers. Where the specific meaning of "update" and "write" can vary depending on an even more specific context.

</comment></comment></comment><comment><USER5> Am I the only one who balked when they didn't link to the 'special cases': [http://docs.aws.amazon.com/AmazonS3/latest/dev/Introduction....](http://docs.aws.amazon.com/AmazonS3/latest/dev/Introduction.html#ConsistencyModel)

The special case is 'new' vs. 'replace'.

S3's consistency has changed over time, but if you're going to pretend to be the authority on any of them, at least be accurate on the biggest of them.

</comment><comment><USER6> how does Swift behave? eg. ovh object storage

<comment><USER7> Presumably this is covered by the "Rackspace" entry, which is the last entry on the table.</comment></comment>


Push back against the Silicon Valley "Co-Founder" Fetish - <AUTHOR> http://world-startups.com/report/pushing-back-against-silicon-valley-co-founders-fetish/

<comment><USER2>
      I am starting to believe that Paul Graham may be the most dangerous man in America.

If you can't get me to read past the first sentence, you should probably change your writing style or your ideas

<comment><AUTHOR> If you are close minded, it is not my problem.</comment></comment>


Is market now closed for a new AR Glass based startup? - <AUTHOR>

Which has its own OS. Because Google is in it. It has this tendency of making its platform open. Which in turn invites all the Big Hardware companies. Also, there are many other startups already pursuing it. <comment><USER2> Not at all. You can make software that goes with your hardware to make it the easiest way to program augmented reality systems. So simple that ordinary 9 year olds can do it. Not just the gifted. That's a major differentiator that nobody is pursuing and aren't willing to pursue because they think that the language stack (they call it stack, I call it a messy disaster) they use is good enough.</comment>


The feds have resumed controversial program that lets cops take stuff and keep it - <AUTHOR> https://www.washingtonpost.com/news/wonk/wp/2016/03/28/the-feds-have-resumed-a-controversial-program-that-lets-cops-take-stuff-and-keep-it/ <comment><AUTHOR> If you've been made aware at how little evidence is necessary for the authorities to seize your cash and then the near impossibility of getting it back once its taken even if never convicted you may ask yourself who is the thief?

Interesting to see over $5 Billion a Year in Assets are now lost to forfeiture while total assets lost to Burglary have fallen below $4 Billion.

The Washington Post has been one of the few media outlets to give this issue any attention, here is a link to the past articles they've done the last few years on Asset Forfeiture. [http://www.washingtonpost.com/sf/investigative/collection/st...](http://www.washingtonpost.com/sf/investigative/collection/stop- and-seize-2/)

</comment><comment><USER2> What surprises me is how little media coverage asset seizure is getting.

Why is asset seizure not covered more by the media and why is everyone so complacent about it?

<comment><USER3> A couple thoughts: It does get a fair amount of media coverage. John Oliver did a segment on it, it has multiple NYTimes articles, big articles in the Washington Post and the New Yorker, and all the usual places. It's not really "unknown" unless you don't read the news much.

I feel like it's not talked about much outside of the media, however. We talk about burglary a lot. We lock things up and hide valuables in cars. But civil forfeiture just doesn't come up too often in daily life for most people.

Why are people complacent about it? For the same reasons they're complacent about mandatory minimum sentencing. The victims are disproportionately black and hispanic. Whether or not they're actually engaging in illegal activity, they often have ties to drugs/prostitution -- perhaps through a relative, roommate, friend or colleague. The victims may also be poor (the population most likely to be unbanked and, ironically, have large amounts of cash around). They're often profiled to be people unlikely to go out and get a lawyer or navigate the system to get their property back.

<comment><USER2> Thanks for the perspective, you made some good points. I was surprised to see there was a move towards forfeiture reform and then it swings back to business as usual. Even more surprised that, "it's not talked about much outside of the media."

Perhaps it's just one of those things we think will 'never effect' us and if it does there is not much you can do if you end up in a forfeiture situation.</comment></comment></comment>


Nokita plan: Outbid Microsofts offer on Nokia to make a secure mobile platform - <AUTHOR> http://www.youtube.com/watch?v=DbESx65M6OY

<comment><USER2> Dude is all balls and no brains. His sales pitch was that he's been to a shitload of countries, and that someone bombed a hotel that he almost stayed at once. His plan is to magically just start selling phones on 3 operating systems, and have a badass launch party. All for the low low price of $5B EUR.

Seriously? This guy shouldn't be given bus fare, let alone $5B. That "Tiny diaper for the tip of your penis" fake Kickstarter video had more imagination.

</comment><comment><USER3> This is hilarious. I love all the shots of him striding. So much purpose.</comment>


Diaspora co-founder dies at 22 - <AUTHOR> http://mashable.com/2011/11/13/ilya-zhitomirskiy-diaspora-dies/

<comment><USER2> This is a terrible hit to the team. I lost one of my co-founders at a very young age.. Brandt Cannici was his name, and we really never recovered from the loss. My condolences and best wishes to his family, friends, and the Diaspora team.</comment>


Langton's Ant - <AUTHOR> https://en.wikipedia.org/wiki/Langton%27s_ant <comment><USER2> It's fascinating how after periods of stability and chaos, the ant eventually forms "highways" of regular behavior. Aside from fluid motion/sand in an hour glass, I can't think of many analogies in everyday life for this order > chaos > order pattern.

Alongside being interesting mathematically, multi-colored Langton's Ant videos are hypnotic to watch. The patterns they make are beautiful, and I'm embarrassed by how much I find myself rooting for this "ant" to make it as far as it can. [https://www.youtube.com/watch?v=gZS7WtRE4_Y](https://www.youtube.com/watch?v=gZS7WtRE4_Y)

<comment><USER3> Watching the video, it's noteworthy that this system that works and renders in a Cartesian coordinate system is able to essentially create 60 degree rotations of a pattern without any trig function.

Given that a rise of 1 and run of around 0.577 will give you approximately 60 degrees (60.01505399), I have to wonder if there is some correlation between that approximate ratio and the number of steps required to complete the pattern.

With that thought, it's noteworthy that the pattern isn't quite right when it finally comes back to the beginning - which essentially is a little bit of rounding error at the end. That makes sense if what I'm imagining to be a correlation above is true, because a slope/offset to create a perfect 60 degrees is an irrational number.

<comment><USER4> It's on a hexagonal grid.

<comment><USER3> Doh. I went waaaay too deep in the thought rabbit hole...

</comment></comment></comment></comment><comment><USER5> Heh. Langton's Ant was the first program I wrote when I was learning to program in Cobol on a mainframe, circa 2015, while working at <BIG FINANCIAL CORP>. I daresay I read about it in The Science of Discworld, like another commenter. The Cobol ant was not animated, mind- I just wrote out the end result after a sufficient number of iterations to get the characteristic shape, as in the wikipedia image.

I had a look though and I can't seem to find the code. Shame, as I think the square grid had a very natural representation in Cobol that gave me some nice insights about the language.

</comment><comment><USER6> When trying out rust, I wrote a little langton's ant implementation[1] that runs in the terminal. It includes the extensions to multiple colors as described in the wikipedia article. Of particular interest is that I ran the simulation and looked through all results of combination of up to 6 colors and included a list of the archetypal ones in the README [2]. It would be interesting to explore ants with larger rotation cycles, but it isn't really scalable to look through the results with human eyeballs. Perhaps there is a computer vision clustering algorithm that can be used to classify them.

[1] [https://github.com/aleyan/langtonsant](https://github.com/aleyan/langtonsant)

[2] [https://github.com/aleyan/langtonsant#interesting- ants](https://github.com/aleyan/langtonsant#interesting-ants)

</comment><comment><AUTHOR> I came across while reading The Science of Discworld ([https://en.wikipedia.org/wiki/The_Science_of_Discworld](https://en.wikipedia.org/wiki/The_Science_of_Discworld)), in the chapter "Where do Rules Come From?" Learning more about the Ant was a fun little side quest.

</comment><comment><USER7> Here's a simulator I found through Google: [http://www.langtonant.com/](http://www.langtonant.com/)

</comment><comment><USER8> This, and Conway's Game of Life, are my go-to for learning a new programming language, and I've written about 10 implementations of each.

They're in this nice, happy medium of "easy enough to not get frustrated" and "hard enough to not be trivial".

</comment><comment><USER9> Previous discussion on the same: [https://news.ycombinator.com/item?id=8265482](https://news.ycombinator.com/item?id=8265482)

</comment><comment> john-radio I don't understand. How is its behavior not completely pre-determined, if it follows a static algorithm and the initial conditions are always the same?

<comment><USER10> If you want the mind-blowing read on this, it is pre-determined, and contains very little information content; only the specification of the field, the rules, the initial state (often very compressible since it's one point), and the number of iterations it runs for. Add a dash of information for the coloration if you want to specify the image rather than the raw state.

And that's how quickly "low-information states" become very superficially- rich-seeming states. You'd think all the things you can represent with just a handful of bits would all be relatively boring or regular things, but this disproves that.

I often find myself boggling at just how little math it takes for our brains to be essentially completely incapable of handling it. If you gave a human who had never seen this before all the information above and asked them to guess what it would do, the odds of them being right are basically zero. And this hardly even wading in to the shallow end of the world of math and where we can get with more bits.

There's some ways we pride ourselves on how good at math we are, and there's some truth in that. But in other ways, we cognitively fall down and go splat on even the simplest systems.

<comment><USER11> Speaking of the richness of low-information states... there's also a kind of opposite to this: a lack of richness of high-information states. Consider a beam of light entering a liquid like water. There's a great deal of noise and variation in the positions of the water molecules, but due to the low- dimension (3) of the space and the high density of the material, there is an inevitable kind of 'regularity' that makes the material act on aggregate as though it were simply a region of simple refraction, rather than a complex superposition of billions of electromagnetic interactions.

Actually, this is probably captured by the idea of randomness.

</comment></comment></comment><comment><USER12> Langton's ant will always be near and dear to my heart. It was the first program of my Intro to CS II course and also the point where I went from "Heh I think I can do this programming thing" to "Holy moly what did I get myself into?

</comment><comment><USER13> Years ago I wrote a sketch for the generalized form of langtons ant: [https://pcsedit.appspot.com/#view/mbarkhau/langtons_ant.coff...](https://pcsedit.appspot.com/#view/mbarkhau/langtons_ant.coffee)

</comment><comment><USER14> If you're curious about implementations and some nice visuals, check out Challenge #173 of DailyProgrammer [1].

[1] [https://www.reddit.com/r/dailyprogrammer/comments/2c4ka3/730...](https://www.reddit.com/r/dailyprogrammer/comments/2c4ka3/7302014_challenge_173_intermediate_advanced/)

</comment><comment><USER15> Cellular automata and the Ant in particular have always been fascinating to me because of the complexity of behavior that emerges from very simple rules. This always has made me wonder if there are similarly simple rules at the foundation of our reality.

<comment><USER16> Well...you might give this book a read:

[https://www.wolframscience.com/nks/](https://www.wolframscience.com/nks/)

<comment><USER17> As far as I know, the general consensus is that Stephen Wolfram is smart, but most what is write is crap especially in this book.</comment></comment></comment>


Young People are pessimistic about the future. - <AUTHOR> http://www.theguardian.com/commentisfree/2014/apr/15/young-people-pessimistic-future-britons

<comment><USER2> Apart from the high cost of housing in certain areas (trying getting your first home in the Cotswolds, in England - seriously not possible) I don't really feel that sympathetic. Life is what you make it.

Saying that I do wonder whether some of this can be blamed on an education system that fails to excite and instil a love of pushing boundaries, or indeed building and creating new things. Coupled with a media system that promotes celebrity and purchasing consumption instead of family and healthy lifestyle.</comment>


SSD middleware breakthrough gives up to 300% speed boost - <AUTHOR> http://www.techspot.com/news/56868-ssd-middleware-breakthrough-gives-up-to-300-speed-boost.html

<comment><USER2> [https://news.ycombinator.com/item?id=7788204](https://news.ycombinator.com/item?id=7788204)</comment>


Lifelink – The Peer-to-Peer Life Counter for Magic: The Gathering - <AUTHOR> https://itunes.apple.com/app/lifelink-peer-to-peer-life/id718605548?mt=8

<comment><USER2> How do you play it?

<comment><USER3> It's meant to be used while you're already playing Magic the Gathering or another other card game, as opposed to using dice or paper</comment></comment>


XMPP library for node.js - <AUTHOR> http://github.com/astro/node-xmpp

<comment><USER2> How is this different than <http://github.com/mwild1/xmppjs> ?

<comment><USER3> "You like Strophe.js? You bought a copy of Professional XMPP Programming with JavaScript and jQuery? You even want to use the same XMPP code for the web and node.js? Then you're wrong here: go to xmppjs."

<comment><USER4> I don't find his explanation very clear. Could you explain what's the difference?

<comment><USER5> Objectives of node-xmpp:

Use node.js conventions, especially EventEmitter, ie. for write buffer control Fast parsing, node-expat was written with this library in mind Support for both XMPP clients and components After authentication, leave trivial protocol bits to the user (later we could offer helpers for entity capabilities hashing, etc)

The other library lets you connect as a component to a XEP-0114 compliant server

<comment><USER4> Thanks, I read that part too, it still assumes you know what a component is in XMPP which I'm sure most people don't. So it's basically an XMPP client and a "component" (whatever that is)?

<comment><USER5> a component is something that plugs into the server that can receive messages on the domain and reply as anybody

</comment></comment></comment></comment></comment></comment><comment><USER6> Gaah, that's like hitching a trailer to a Lamborghini.

The point of XMPP is to be fat and semi 'standard' complaint. The purpose of node.js is to be _fast_ , at the expense of compatibility and compliance, while maintaining the simplicity of javascript.

If you want XMPP, it might be better to speed up any of its existing servers, instead of saddling Node with cruft.

<comment><USER7> It looks like a nice library for writing non-blocking XMPP clients and components in Javascript. This seems useful even if the goals of XMPP and Node are different as you claim.

This library does not saddle Node with anything. It's a library for use with Node. It's not part of Node

<comment><USER6> The point of XMPP _clients_ is to work with a server/platform infrastructure that someone else has built and has control over. Then, it makes sense to use something like Strophe.js to talk to the server in its protocol of choice.

However, if the server you're talking with runs Node.js, there is a good chance whoever behind it (if not _you_ ) is someone who is able to make sane technical decisions, like _not_ using XMPP and opting for something light weight.

The way I see, and to use another anology, is like writing a SOAP server in assembly in the hopes of getting better results.

If you want to talk with the myriad of desktop jabber clients out there, use something tried and true, and supports XMPP to the fullest (so Node is out.) If you just want a serialization and pub/sub protocol, use something more lightweight than XMPP. XML manipulation will defeat the purpose of Node, which is performance and design hygiene, very quickly.

<comment><USER8> Sometimes XMPP is a requirement. Maybe you want the federation, or you want people to be able to use their gtalk accounts.

Call me crazy but I actually think a non-blocking server with good performance and low memory usage would be a pretty nice foundation for an XMPP server. (This project is a client though.)

<comment><USER9> You're going to have trouble beating ejabberd on its native turf, and JS probably isn't going to let you beat its memory usage anytime soon, based on what I've seen in my running servers. ejabberd is considered a memory hog of an XMPP server, because it might use as much as a kilobyte for a connection's state information, vs C or Java which can go smaller due to full control over the memory. About 200 bytes is more common, though. JS would leave you with even less control over the memory and make it very easy to go ever further over 1KB/connection.

And actually, having experienced ejabberd and worked with its internals quite a lot professionally (for about two years), this is where I think Node.js would just fall down screaming. A serious XMPP server ends up having to do some actual logic that can take some actual time, like working out who is on the roster, which takes time when that may be a couple hundred people. It may still be a fraction of a second, but Node.js is either going to choke and die on the sheer overwhelming number of small little things that still have to be done synchronously, or the XMPP server would have to be manually sliced into tiny, tiny ribbons (instead of working out the roster, working out the next roster item and pushing it out) in which case call overhead would still be a problem too. And being stuck on one core is going to be really rough as you try to scale.

You aren't going to get what the XMPP world would consider "low memory usage" out of Node.js, and "non-blocking" will only get you to toy size. Which may be enough for some tasks since "toy size" is still at least tens of users before you really start hitting these problems, but based on my experience even at the medium hundreds level you're going to start hitting problems.

(The steady-state of an IM server isn't too bad and if we just assume Node.js has somehow made it to the steady state it could support several hundreds relatively easily. The problem is that a real-world IM server ends up getting these spikes that you might not anticipate if you've never worked with them, because events like going online and offline are _not_ independent, and these spikes are what will bring your server to its knees. In particular, there's the case where your IM server itself lost its network connection, then it comes back, and all the clients try to reconnect at once, hammering your server with the full login process for every connected user, full presence storms, complete reconnection of every S2S connection, every transport user reconnecting, basically everything happening all at once, and this is an enormous number of things to be stuck doing synchronously per-item. You will experience the full hell that can be brought to you by cooperative multitasking. The best part is, if your server can't take that process and actually goes _down_ , when it comes back up it gets to start all over again, probably just to crash again. To have a working IM server takes more than being able to handle the steady state, if you can't deal with these spikes your server will have trouble just getting to the steady state. There are some other spikes you can get, too. Also, you'd be surprised at how quickly users pick up on the fact that your instant messages are actually taking 2 seconds to send.)

<comment><USER8> I was actually thinking redis would handle roster duties. It's got native queries that are a good fit to that sort of thing, and it's got replication in case one instance isn't enough for the load.

There's a guy with a web chat system using Comet on node.js who claims 100K simultaneous users on one server, with fairly modest memory usage. Of course that's http. Is xmpp that much heavier?

(You've convinced me the problem is more difficult than I thought, btw.)

<comment><USER9> "Is xmpp that much heavier?"

Well, it depends. It is not commonly understood that XMPP is actually very modular. What I was citing you was the requirements for what you might call the "usual" XMPP server, what people tend to expect when they hook up Pidgin or Adium to something claiming to be an XMPP server for dedicated-client use. Huge rosters (in the hundreds is distressingly common, in the thousands not unheard of), server-to-server connections, avatars, conferences, frequent granular presence changes (some % of the users changing for every MP3 they play due to plugins), logging, etc.

On the other hand, throwing together a "shitty" web chat where no one chat room is expected to have more than, say, 20 users, where "chat rooms" are the only communication concept and rosters are more limited or perhaps nonexistent, no logging, sure, Node.js should definitely be able to scale to 100K no problem. Probably beyond with reasonable hardware.

I think you may be referring to Plurk's work, and please note I'm not calling their stuff "shitty", I'm specifically describing a minimal chat client up there. I actually don't think XMPP is all that much heavier than AIM or MSN (some, yes, but not really that bad), it's that IM has evolved past the days of ICQ. What kills you are the O(Roster Entry) elements; one guy with a 2,000 element roster (bidirectional) comes online. With XMPP, as part of the connection process you shove down the 2,000 user roster to the guy logging in, and have up to 2,000 other presence notifications to send out. And it's hard to make that entirely async; even if you do just grab the roster as a lump out of some data store, you still have to iterate over the 2000 elements of the roster to send out the presence updates, and even with GHz to play with that is going to take some time to formulate all the necessary messages. This is what would really worry me at the startup flurry I mentioned.

But like I said, you could still carry hundreds, most likely. Although even then I would observe that the value of having an XMPP server actually in- context to a Node.js process is really pretty minimal. You can still be a "part of the server" via the component protocol which is what you almost certainly really want. Let a best-of-breed do all that for you, and just implement the additional stuff you want in Node.js. Unless you're doing too many O(roster entry) things in there (which in general you aren't in a component), Node.js should scale quite well, and components can typically be sharded cleanly too (by assigning users to shards).

<comment><USER8> Ahh, ok I understand the roster issue better now, thanks. You're right, Plurk is what I was referring to.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I imagine this could become part of a non-blocking google wave server...</comment>


Vulnerable industrial controls directly connected to Internet - <AUTHOR> https://arstechnica.com/information-technology/2018/01/the-internet-of-omg-vulnerable-factory-and-power-grid-controls-on-internet/ <comment><USER2> PLC manufacturers and the controls community in general is lagging behind technologically by twenty years. It is very frustrating for a security-minded, computer-literate controls engineer to work with decade old hardware and software.

In a company I worked at, there were PLCs controlling sensitive processes, including heaters for welding plastic, connected to the company network via Modbus-over-TCP. A visitor with a guest access, nmap and pymodbus could read AND SET temperatures of any of the devices. A black hat could easily have started fires or leaked acid in our production floor.

<comment><USER3> <Rant> Worser still, they have even trouble adopting object orientation. The whole area is stagnant in a Win95 Programming kind of way. Its truly horrifying.

Worser still, even the people producing the newer tools to allow for OO, do not really test these tools, so you develop in a environment where you are basically a beta tester on a budget (TC3 - looking at you).

Nobody dares to move, to not break precious backwards compatability and devalue the experience of "experts" who for several generations simply did fall into every trap state-chart based design can provide. Means, every project runs into complexity walls at the end, there are no automatic proofers to check the state charts, there are no unit-tests (If i here the poor excuse -"But there is no hardware to test against" one more time).

In my opinion, this industry is as ripe for disruption as it gets- if you can generate and update code from a high lvl object and process description here, and proof reliability and speed + allow for user-code - the industry would throw money at you.

Half of the projects in this area are not ond budget and not on time. There is actually not even planning for that- just a factor, which usually is bigger then 2.0.

Im so sick of the excuses. You cant compare conventional coding and PLC programming. Yeah, you cant, one moved forward and the other got stuck with the lowest common denominator - due to lots of non-software guys trying to get a food in. All these fb lego-players, with no clue what they do...

</Rant>

<comment><USER4> I hear ya. The issue, though, is that the end product has to be at least readable, if not maintainable, by any half competent electrician, so lowest common denominator (ie. usually ladder logic) is as abstract as you can go. Also for most industrial controls, the system is "wide" rather than "deep", in the sense that almost everything is pretty trivial ('read inputs X and Y, set output Z if X and not Y') but there are thousands of X and Y. And finally, X etc. are tied so intimately with the hardware, which by the time the site is actually built and all the vendor packages integrated is only loosely related to the original design. So while I absolutely agree that it could be improved on significantly, the end result will still look (on the surface) quite like what we have now.

<comment><USER5> > the end product has to be at least readable, if not maintainable, by any > half competent electrician

You can get that by using Python or similar languages; you can get that by programming in something like a Haskell DSL and hiding the underlining libraries; you can get that by creating an actual DSL and interpreting it on the fly.

But C or C++ state machines manually encoded into structured code is one of the things that won't get you there.

<comment><USER4> Absolutely not. Most industrial automation engineers, let alone electricians, are unable to handle Structured Text (the standard IEC text-based programming language for PLCs), let alone Python. Haskell is not even on the same planet.

And a DSL is the exact opposite of what we're trying to accomplish: An electrician _with no prior knowledge of the system_ needs to be able to read the code and understand which switches and sensors need to be turned on in order for that motor over there to start. Having to learn an entire new custom language at 3AM when you're losing $700,000 an hour in lost production is not an option.

(Edit: I should clarify that I'm talking about mining here. High end factory automation engineers may very well be more familiar with 'traditional' languages.)

</comment></comment></comment></comment></comment><comment><USER6> My graduate project at university was about air-gap malware, soft TEMPEST and hacking on industrial PLCs (S7-300, Stuxnet and all that :P).

What terrified me most is not only the state of ICS nowadays (it's pretty much fucked), but also the fact that cyber-security vendors try to make a profit from that by shoving their products down the throats of scared managers.

And what @donquchotte says is pretty much true - on facility there I practiced, all PLC were connected via TeamViewer to company network, passwords were written on stickers and slapped on monitors. They used Modbus over TCP, plain-text packets easily viewable with Wireshark.

On the first day I accidentally broke my S7 because of wrongly uploaded configuration, it took them 3 days to find some special Siemens laptop to connect to this PLC and reset it. Also tried to play around with Metasploit and follow the work of Beresford [1,2], but the most trivial attack of mine was just flood on PLC's IP with random junk - it stopped responding to any commands.

[1]: [https://www.youtube.com/watch?v=33kouEKm0zo](https://www.youtube.com/watch?v=33kouEKm0zo)

[2]: [https://github.com/moki-ics/s7-metasploit- modules](https://github.com/moki-ics/s7-metasploit-modules)

<comment><USER7> The first time I tried to automate the S7-1200 web UI, it crashed hard when I sent a POST requests with an empty body.

These things do not belong anywhere near the internet, patched or not.

<comment><USER8> Pretty much built for someone that knows exactly what they are doing. Like they've read the manuals cover-to-cover and taken an exam.

<comment><USER9> An industrial control system that crashes when it receives an unexpected network request isn't built for someone that knows exactly what they are doing. It was built _by_ someone who wanted to expend the minimum effort possible and make contingency-handling someone else's problem.

This isn't just about hacking. A device that crashes hard when it receives a POST with an empty body may do the same thing if there's a physical glitch with its connection, or if a cosmic ray flips a bit somewhere. Devices that control industrial machinery should be more reliable than that.

If this were a hobbyist project, or a toy, that would be one thing, but these are specialized devices that cost a _lot_ of money. They're fragile liabilities that don't belong anywhere near a shared network.

<comment><USER10> > An industrial control system that crashes when it receives an unexpected > network request isn't built for someone that knows exactly what they are > doing.

Yeah - I can see even the simplest of network vulnerability scans wreak havoc on a device like this.

<comment><USER11> Its enough to just plug in a cable into two switch ports.

</comment></comment></comment></comment></comment></comment><comment><USER12> It honestly doesn't surprise me that so many PLCs are exposed directly and are not up to date. Having worked in maintenance at a large factory where we directly worked with Siemens PLCs, nobody is really prepared to make their PLC secure. Most people handling and programming those PLCs do not have a deep understanding of "Internet of things" (in Germany, the term "Industrie 4.0" is used a lot) but management is happy to jump on that topic.

You usually don't worry about anything other than the task your PLC is supposed to perform (we're in a factory after all and need to make money, so better do it quick). I don't think I can remember ever updating the firmware of any of our PLCs, most of them even rot in a storage room for a couple of years before even being put in use.

Everything is connected to the local network for monitoring purposes and if it weren't for another department strictly managing our network I reckon there would be a lot more of them accessible directly from the internet.

</comment><comment><USER13> It's hard to make money out of attacking stuff like this because you can't normally keep the system broken in a way that is easily fixable when the money shows up. Once you contact your victim they just fix whatever is broken and then ignore you. Industrial processes are unreliable enough that one extra outage might not make that much difference.

It's kind of like making programs to run on Windows 95. You don't have to worry that much about making your program reliable because no one will notice a few extra crashes.

<comment><USER14> Making money is not the only possible motivation for exploiting vulnerable industrial systems, though of course as the other reply says, there are ways to make money indirectly anyways.

First off, the damage to third parties might be extremely severe, especially in a targeted attack. Think of long-lasting power outages due to damaged equipment. Or think of environmental damage (e.g., suppose you got a nuclear power plant to vent radioactive gases, or worse, to have a meltdown).

Second, the damage to the owners of the industrial facility might be severe even if not to third parties. Here the attacker might benefit if, e.g., they are a competitor or have shorted the victim's stock.

The first case is of extreme interest to the public, don't you think?

Let's not dismiss concerns about industrial security.

<comment><USER13> Of course damage is bad but I was specifically addressing the apparent lack of interest from the criminal set.

For your first case, you failed to provide a possible. motivation. I will assume "terrorism" as that seems to be brought up as a motivation for most everything these days. There is more than one problem with this.

First, it is pretty much impossible to prove that an attack over the internet was actually carried out by any particular entity or even any entity at all. Things fail on their own. Second, it is usually easy to entirely prevent another attack. So no ongoing sense of vulnerability.

For your second example, it has always been fairly easy to damage industrial infrastructure but there have been almost no attacks of this kind. Stock market movements are not that severe in the case of even serious catastrophe much less the sort of trivial problems you could cause by attacking industrial controllers on the net.

</comment></comment></comment><comment><USER15> Put this crap all on a segregated network. It's how we did it 20 years ago, are people still making the same mistakes? Were firewalls not common even 30 years ago?

<comment><USER16> I'm an engineer for an industrial integrator. No matter how often we tell our customers to keep the industrial control networks separated, they'll still find ways to lazily screw their networks up.

A couple years ago at a Fortune 100 company, I dealt with a WinCE panel that began randomly spewing millions of broadcast UPnP packets - enough to make Wireshark lag badly. Took us about fifteen minutes to find and unplug the offending item, and the recommended mitigation from Rockwell Automation was to just disable UPnP. No patch was available for a problem that's been known since about 2006 or so, on an HMI product that is still being sold today.

Due to some terrible switch configurations on the part of the customer, the traffic made it out to the campus network and DoS'd most of their intranet servers. About 3,000 employees were sent home early for the day because none of them could read their email.

</comment></comment><comment><USER17> > A 2013 attempt (attributed to Iranians) to "hack" a dam in upstate New York > failed, largely because the dam's flood control systems had been broken for > some time.

This seems more like a satire than real world.

</comment><comment><USER18> That reminds me of VNC roulette. ([http://18.104.22.168/](http://18.104.22.168/))

It however appears to be offline but it isn't hard to create your own.

<comment><USER19> I just read up on this, it's absolutely terrifying.

So far the news stories seem to have shown unsecured x ray machines, farm equipment, cctv, maybe oil wells, bank computers, cashflow software, waste treatment plants, parking lot systems, petrol station storage tanks [1] and a Swiss water reservoir [1].

It shows everything wrong with the lack of incentives for security!

[1]: [https://securityledger.com/2016/03/vnc-roulette-feasts-on- in...](https://securityledger.com/2016/03/vnc-roulette-feasts-on-insecure- industrial-control-systems/)

</comment></comment><comment><USER20> I would like to see some authentication and encryption in the communications protocols like modbus and ethernet IP. Could be as simple as entering the same phassphrase on the client and the server. If you don't have the passphrase your requests are dropped or you can't decrypt any packets you might get your hands on.

I can't see why that wouldn't be achievable. Yes it would take some extra processing power on the PLCs and would generate a bit more heat.

It would have to be implemented by Schneider and Rockwell, who have been pushing all responsibility for security to the network level.

At least the latest schneider PLC, the m580, allows for requiring a password to connect using the programming software[0], and also some ability to restrict what client IPs can connect[1]. The m580 was released in the last two years, so everything prior to 2016 doesn't have those features and comes set up to allow anonymous upload of new firmware by TFTP.

[0]: [https://www.schneider- electric.ca/en/faqs/FA238215/](https://www.schneider- electric.ca/en/faqs/FA238215/) [1]: [https://www.schneider- electric.com/en/faqs/FA282558/](https://www.schneider- electric.com/en/faqs/FA282558/)

<comment><USER21> The problem with requiring a plaintext password is that it may slow down attacks when a device is simply connected to the open internet, but it is trivial to defeat in all other cases. Modbus RTU is broadcast, so you would just listen for the password. Modbus TCP can be defeated with ARP stuffing and man-in-the-middle attack (I've seen this automated for taking over SCADA systems).

A better solution would be a shared symmetric key that is manually programmed into all devices. However, this complicates install and maintenance. Its a hard sell when your controls are installed by contractors paid by the hour. Pretty soon everyone is setting their 128-bit key to 0x12345678 so nobody forgets it during emergency maintenance.

<comment><USER20> Substitute passphrase in my post with shared symmetric key. It is still a string you have to enter on both ends.

if the underlying mechanisms just work in every case except for key mismatch and give you a good error message in that case, requiring your contractors to enter the same string in two devices that they already have to program is going to be hard for them to justify as a great additional expense.

</comment></comment></comment><comment><USER22> When I was younger I had this friend (cof, cof) who used to war-dial 0800 numbers (telephones beginning with 0800 are national toll free numbers in Brazil) looking for modem tones.

The biggest share of toll free numbers with modem tones were fax machines and but many were 9600 baud terminal for some CLP. I guess these were remote maintenance accesses for isolated machinery - I wonder if people still do this (may be an updated version with 3G or 4G).

</comment><comment><USER23> As mentioned in the article [https://www.shodan.io/](https://www.shodan.io/) is in my book, the go-to site for this kind of thing. Anyone aware of any similar sites?

<comment><USER24> [https://censys.io/](https://censys.io/) is also very cool.

</comment></comment><comment><USER25> I can speak first hand about this. You want to know what the real problem is? Cheap motherfucking executives and boards. Full stop. I was at one time a one man miracle show for a company that had 6 branch locations, and was supporting at any given time ~50 operational PLC's in the field, among other PLC's internally for other operations...

Now, I've learned a lot about mistakes I've made, and I was never a perfect senior sysadmin, mostly because I wasn't playing the meeting room presentations/reports and politics game. So I'm not trying to make myself out to be perfect in any fashion.

That said, when I requested a full time t2 person. Denied. Requested a full time t1 person. Denied. I literally had to poach some part timer who was sweeping floors and train them myself... which did nothing to alleviate my time crunch dealing with desktop users in order to tackle the substantial infrastructure security issues, which takes time and thought (did I mention it was an open office area, so good luck getting good thinking work done...) Requested contractor structured cabling job (just horizontal)... denied...

Us sysadmins can secure this stuff, mostly through really good network policies and firewalls, etc, but if management is cost-cutting corners left and right and would rather hire some contractor-MSP type that does 1/4 the work at x3 the cost, while refusing to support internal IT teams with the tools and funding they need to get their job done properly, it's no fucking wonder insecure systems abound in the industrial world.

This is managements problem, and until the public or others start punishing them for not seeing IT and security as an investment instead of just a janitorial cost-sink, it will continue to happen.

That's the reason behind my last burnout. Now I'm happily on break pursuing my data science degree. I've been on the contractor side too, (dropped out of college after the Marine Corps to start an IT support company that is still alive today even after I left) so I've seen the inside of hundreds of companies, from fortune 500 oil to 20 man lawfirms, so I'm not just pulling this info from a couple of jobs. I saw it _everywhere_.

A good CIO or CTO should be able to address many of the technical-political disconnects, but they hardly exist. Go try asking /r/sysadmin how many of them even get a real budget. Half the time they just have to "ask" and hope they were convincing enough that management approves. Usually to a CFO or CEO since the CTO/CIO doesn't exist.

Oh, and of course they all want to immediately jump on the IoT bandwagon but still don't want to hire the people to get them out of their old technical debt, much less the new massive technical debt many IoT devices will bring!

Don't even get me started on the "big data" issues IoT and many PLC type devices bring.

edit: The key to the increase of this issue is the direct LTE connections on the PLC's, whereas you used to have a satcon to a router and everything was internal from there, that's less true these days. Even so, you still have issues with the security of that edge.

<comment><USER26> To touch on this a bit. To be a good controls guy that does PLC programming you need to have some mechanical background to understand the equipment you are controlling, you need to know enough electrical to do the wiring and parse what your sensors are telling you and you need to be a fair shake at programming/comm protocols/logic. Oh, and most control loop implementations are actually sets of differential equations with DSP inputs so having a knowledge in that stuff helps a lot when you get into the precision stuff.

If you go look at the current postings for these roles you'll find that the average salary is between $15-$25/hr, you'll be on call 24/7, and you have to work physically demanding jobs in relatively harsh environments. I've seen a few outfits that don't even offer to pay their employees for commuting time between sites, only for when they are actually sitting down and working on the boards.

</comment></comment><comment><USER27> What is the opinion on IPv6 on this kind of problem? I mean, IPv4 being often behind a NAT, I guess a LOT of devices that would be exposed are protected by a NAT.

But in an IPv6 world where NAT is no longer required, don't you fear that a lot of device might get exposed?

I know it will be impossible to scan the whole address space, but I am sure other means of discovering IPs will arise.

<comment><USER28> NAT does not prevent inbound connections.

A stateful packet filter does.

Stateful packet filters work with both IPv4 and IPv6.

<comment><USER27> I know, but I meant how NAT with IPv4 was deployed by ISP (at least in europe), which is a single IP with all inbound connection blocked.

I guess it will depend on how ISP will deploy IPv6, but where I saw it deployed, the ISP did not provide NAT by default and all allocated IP were routable and inbound traffic was not blocked.

<comment><USER28> > I know, but I meant how NAT with IPv4 was deployed by ISP (at least in > europe), which is a single IP with all inbound connection blocked.

The single IP does not prevent inbound connections. The stateful packetfilter does. This has nothing to do with NAT.

Also, NAT is not usually done by the ISP, but by the customer's router.

<comment><USER27> Most of the time the customer router is controlled by the ISP. And I don't see why you are so pedantic on this, the point is about how NAT is generally deployed, and for consumers, this is with a single IP, stateful firewall and UPnP for port forwarding. And this might change with IPv6.

<comment><USER28> No, that is how IP(v4) is commonly deployed: With a single IP, NAT, UPnP for port forwarding, and a stateful firewall.

Yes, that could change with IPv6. But it still doesn't have anything to do with NAT. Just because stateful firewalling happens on the same device as NAT, doesn't somehow make it a property of NAT. There also usually is a web interface on the same device. Now, with IPv6 that could change as well. Does that mean that web interfaces are a property of NAT? Or that it would be sensible to say "NAT is commonly deployed with a web interface"?

</comment></comment></comment></comment></comment></comment><comment><USER8> I guess there have not been any large scale or very public attacks against these computers because the people that would do this would be an enemy of every state that has manufacturing.

The disruption may be temporary as things would recover quickly, and the perpetrators would be hunted down by law enforcement and thrown into jail for a long time.

</comment><comment><USER29> I wonder if this was in response to the top comment on this HN post from 3 days ago [https://news.ycombinator.com/item?id=16237026](https://news.ycombinator.com/item?id=16237026)

</comment><comment><USER30> Is this related to this recent finding?

[https://news.ycombinator.com/item?id=16237026](https://news.ycombinator.com/item?id=16237026)

</comment><comment><USER31> How do they know they aren't honeypots?

<comment><USER32> Simple answer because they are not that clever

<comment><USER33> Speaking from experience, Siemens is the company where they ask you what is SQLite when you mention that a half-binary xml is not necessarily the best format these days.

<comment><USER34> That sounds weirdly familiar. (Hello S7 project files?)

<comment><USER33> Something related, still ACX.

</comment></comment></comment></comment></comment><comment><USER35> I wouldn't be surprised if there are some controllers work from home and use VNC to access controls!</comment>


Data-Intensive Text Processing with MapReduce (2010) [pdf] - <AUTHOR> http://www.umiacs.umd.edu/~jimmylin/MapReduce-book-final.pdf <comment><USER2> The authors mention the problem of capacity increases in storage outpacing bandwidth growth.

This is mathematical inevitability at least for spinning disks, as long as capacity increases come from density increases. When density increases by a factor n, capacity increases by n^2, because the disk surface is two- dimensional. OTOH, the tracks under the head are linear, so the same density improvement of factor n only causes a corresponding bandwidth increase of factor n.

And seek times are governed by physics and haven't really improved much at all. Accelerating and decelerating a mass just takes a certain amount of time, and the faster you do it the more noise you generate.

A Winchester drive available for the Apple II had a capacity of 5MB and a transfer rate at the interface of 5MBit/second. With that it could transfer its contents in 8 seconds, not that the Apple II could accept it at that speed. Even assuming that the real disk transfer speed was 1/10th of that would still allow the whole contents of the drive to be transferred in a little over a minute.

A current 3 Terabyte drive with a generous 200MB/s interface takes 4 hours.</comment>


Difference between A/B testing and multivariate testing - <AUTHOR> http://visualwebsiteoptimizer.com/split-testing-blog/difference-ab-testing-multivariate-testing/

<comment><USER2> Spammy shitty article. The author has no idea how multivariate testing works, he completely misses the most important aspect of it. Multivariate testing actually does not require to show every possible combination, it can eliminate many combinations using statistics.

<comment><AUTHOR> Please mind your words. Every kind of multivariate testing requires you to theoretically have data for every combination. In partial factorial or taguchi methods you simply estimate it from other live combinations. This doesn't mean you don't need data for all combinations.

Moreover, this article's intended audience is beginners. If you know about full and partial factorial audience, you probably know main differences between A/B testing and multivariate testing.</comment></comment>


Meet The Oil Shale Eighty Times Bigger Than The Bakken - <AUTHOR> http://www.forbes.com/sites/christopherhelman/2012/06/04/bakken-bazhenov-shale-oil/

<comment><USER2> My only concern is that once we realize we're not going to run out of oil for at least a couple of centuries we don't undo the great work of being more efficient with our energy.

From an investment perspective though I can't see $100bbl oil prices being sustainable in the long haul. Its just too tempting to under cut by a 'few dollars' and capture more of the market.</comment>


The Data Science loop: the day-to-day work of a data scientist - <AUTHOR> http://seanjtaylor.com/2012/09/18/the-data-science-loop/ <comment><AUTHOR> The essence of what is a Data Scientist boils down to this awesome tweet by Josh Wills (@cloudera): <https://twitter.com/josh_wills/status/198093512149958656>

Data Scientist (n.): Person who is better at statistics than any software engineer and better at software engineering than any statistician.

<comment><USER2> Echoes of A.J. Liebling:

"I can write better than anybody who can write faster, and I can write faster than anybody who can write better."

\----

Leading to a generalized strategy for success:

1) Identify two orthogonal metrics by which your work will be judged by relevant stakeholders.

2) Work / practice until you are better than anyone by at least one of those metrics (in practice, better than the large majority of your competitors).

The degenerate case involves being the best in the world by at least one of the metrics; more achievable is to be somewhere in the middle for each. To use our own patio11 as an example: be better at coding than anyone who is better at SEO, and be better at SEO than anyone who is a better coder.

<comment><USER3> Only n people are the best at something, but n^2 people are the best at pairs of things.

<comment><USER4> Actually, an infinite number of people can be Pareto optimal at just two things.

</comment></comment></comment></comment><comment><USER5> It you want to make an impact as a data scientist, it helps to prototype your ideas as a testable product. Many product managers and engineers ignore their data scientists' work because fighting fires almost always takes precedence. The recent HBR article (posted here) showed how the data scientist at LinkedIn was able to make a huge impact by running his own experiments against live users. At my company, we always provide a non-optimized prototype that can be run directly with our existing product. If the idea is good, we can optimize the code later.

</comment><comment><USER6> I would be interested to see more "low level" posts about how people approach their data analysis workflow. I do data analysis for a living and find that efficient workflow has just as much impact on your productivity and results as the choice in technologies that you use.

<comment><AUTHOR> That's a good idea; I will try and write up such a "low level" post this week. As a preview, the things that will prominently feature in the post are - RStudio, custom functions/aggregates in Postgres PL/R, and Sweave. (yes I am a R fanboy).

<comment><USER6> Would definitely like to read it!

I personally find the need to go back and forth quite a bit between different tools when working even on a single dataset. Say, i'll do some work with text part of the dataset in Python, then use Matlab for some basic quantitative analysis, then use R for some advanced statistics if I have to, port those results back to Matlab/Python for speed, then back to R to sweave, maybe some spreadsheet stuff too, etc... So for me, for every project I need to have my dataset in easily accessible format (csv/someSQL/etc) and I need scripts in every language that I use, that would communicate with the data source and get "up to speed" right away.

It's little tips like that I think people should be sharing more.

</comment></comment></comment><comment><USER7> It would be great to hear more about the communication section.

For instance is it better to offer an ambitious summary first, followed by a deep exploration into the data and methods to understand how any conclusion may have been determined?

I am loathe to put something out there might overstate a point that will be run with without a sincere understanding, but I also fear that if the details are provided first without a thorough explanation of the nuances, that there is a danger they will be used carelessly.

I suppose my question is, have others have found it preferable to start with a headline then support that headline with caveats, or to create a detective story and walk people through arriving at a conclusion?

It's little like the conundrum of TED Talks (or a much of science news reporting). A very highly produced talk will establish an argument for an important adjustment of conventional wisdom in some field, only to create new problems because to people outside of the field it sounds like the final word.

<comment><USER3> Make the strongest claim you can support.

<comment><USER7> To be honest, I think that it is reckless to disavow any responsibility for what consumers of information you produce will do with it in your own organization.

Going back to TED Talks, ridiculous analysis and comments citing a TED talk are often based on a talk that itself was not ridiculous.

I asked about elaboration on that area of responsibility because I'd assume that he had a relatively small audience of highly capable people, yet even so had more intimate contact with the specifics and had to struggle with just how to present that more full knowledge in a concise but still responsible way.

</comment></comment></comment><comment><USER8> This post completely neglects the part where data scientists derive statistical models from large sets of data in order to use them for classification, clustering or prediction purposes. Describing data science as advanced applied accounting is only true if you have to 1) analyze big datasets or 2) find hidden connections between data aka. data mining

</comment><comment><USER9> Thanks for the post, I am starting a role as a data analyst soon and am curious to hear more about two aspects of your role:

1\. How are the dynamics between engineering team, product managers and data scientists. Understand that LinkedIn's data team plays a huge role in creating and improving features (like People you may know), how is it like at Facebook, and in general other companies?

 _Engineers build things, managers make decisions, data scientists answer questions_

2\. What are the tools you use ( I see R mentioned in the thread), what books would you recommend? I mostly write in python, use D3 and gephi for visualization. Am also taking the Coursera course on Social Network Analysis (<https://class.coursera.org/sna-2012-001/class/index>) and reading the course book Easley & Kleinberg, Networks, Crowds and Markets. Thanks for sharing again.

<comment><AUTHOR> Sorry if I didn't make this clear earlier: I just posted this link to HN, I didn't write this blog post. (Incidentally I'm also a data scientist.)

</comment></comment><comment><USER10> intersections are nonsexy.

ask the hawkers who ply their wares at intersections. not only do they have to deal with traffic from the north, there is a constant barrage of traffic from the south, not to mention the incessant traffic from the east, and hey, how can we forget the speeding traffic from the west...

but the same intersections are also frequented by pedestrians from the north, and the west, the south and the east, so the hawkers' trade is lucrative.

data science is at the intersection of linear algebra, machine learning, statistics and distributed computing.

if you ask the hawkers sitting in a nicely furnished airconditioned shop at the mall, they will tell you that the hawkers at intersections aren't real hawkers, they are just fly-by-night hustlers selling a stalk of unkempt roses that will wither away, selling evening tabloid newspapers that'll be useless to read tomorrow, unhygenic ice-cream cones and candy, unhealthy street food, braids for the hair that'll snap if you tug at it, fake watches, imitation handbags, ... so if you want to be a real hawker selling real healthy food, you must open a real restaurant in a mall. you wanna sell genuine cartier watches, get a license and open a premium retail outlet in a mall. you want to hawk useful literature, open a barnes and noble bookstore in a mall...

so also the genuine statisticians will mock the data scientists as fake...oh these guys don't grok industrial strength SAS and S-PLUS, they fool around with unproven toys like R.

the genuine linear algebraists are too busy submitting academic papers to the MAA to worry about trivialities like data science.

the genuine distributed computing programmers know that data scientists operate with a very tiny subset of distributed computing - usually just hadoop or bigtable, and even that they dodge with syntactic sugar like pig, cascading and scalding. they are not even real programmers - they don't refactor their code, some of them just write ad-hoc scripts that they don't even check in to the repository, they don't do agile, hell they don't care about readability of code - they call their chebyshev decompositions "def cbd()" instead of "public static void chebyshevDecomposition( DenseDouble2DMatrix inputMatrix)", how can you trust these jokers...

the genuine ML guys work on world-changing technology like genome sequencing and autonomous vehicles, natural language processing and credit card fraud detection, not fluff like mining information out of tweets and facebook likes and linkedin profiles and foursquare check-ins.

but you see, the same intersections are also frequented by pedestrians from the north, and the west, the south and the east, so the data scientists can put food at the table and make rent :)

</comment><comment><USER11> How do you become a self made data scientist? What are the approiate books, courses, majors to study?</comment>


Die photos and analysis of the revolutionary 8008 microprocessor (2016) - <AUTHOR> http://www.righto.com/2016/12/die-photos-and-analysis-of_24.html <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=13250949](https://news.ycombinator.com/item?id=13250949)

</comment><comment><USER3> [https://news.ycombinator.com/item?id=19509810](https://news.ycombinator.com/item?id=19509810) How to open a microchip and see what's inside

[http://www.visual6502.org/images/6502/layers_index.html](http://www.visual6502.org/images/6502/layers_index.html) 6502 Images

</comment><comment><USER4> Probably the most accessible introduction to dies that I've seen. Really informative.

<comment><USER5> Dice?

</comment></comment><comment><USER6> The picture under the heading "The structure of the chip" has two arrows pointing to polysilicon regions. Does anyone know why the polysilicon region that the upper arrows points to is os much larger than the polysilicon regions that the lower arrow points to? They seem like a couple of order of magnitude larger.

<comment><USER7> I know slightly less than nothing about this topic, but I remember reading this from a while back:

"Notes for reversers Electron holes have more effective mass, and therefore less mobility. P-type regions are thus made bigger than N-type regions to compensate. The size disparity often differentiates P-type and N-type silicon."

Source: [http://siliconzoo.org/tutorial.html](http://siliconzoo.org/tutorial.html)

Maybe that is helpful...?

<comment><USER6> What a great link, thanks! I had not seen this before.

</comment></comment></comment><comment><USER8> Looks kind of like Factorio!

<comment><USER9> Nah not enough spaghetti

</comment></comment><comment><USER10> I'm curious, what could be made out of a processor in the order of 4000 transistors as here, but with entirely modern chip design and fabrication tech? What could you put out on TSMC's 7nm, presumably an extremely small wafer.

<comment><USER11> maybe the cpu in a sd card?

<comment><USER12> Apparently those are derivative of a much newer controller, the Intel 8051 (1980), heavily modified, running at up to 450MHz, and with added hardware accelerators.

[https://en.wikipedia.org/wiki/Intel_MCS-51#Use_as_intellectu...](https://en.wikipedia.org/wiki/Intel_MCS-51#Use_as_intellectual_property)</comment></comment></comment>


Ask HN: How would you design your ideal incubator? - <AUTHOR>

. <comment><USER2> A big room with a constant stream of experienced (in terms of both success and failure, developers/managers/marketers and investors) people from a range of industries to talk to. Everything else is decoration.</comment>


Make It Happen: How to find a Programmer - <AUTHOR> http://www.seattle20.com/blog/Make-It-Happen-How-to-find-a-Programmer.aspx <comment><USER2> This is a very pragmatic look from the other side it touches on a lot of fact that I think non-technical people just out right miss. Many times the business personell value the leads and skills that they posses once a product exist while the developer values the fact that they are for all intents and purpose the product. Given the lack of knowledge about the subject of technical matters, I believe that many people see a programer as a programer much the same way that one would look at a CPA or an electrician. Just pick one, and get on with it is a prevailing attitude. With that can come a feeling of you should be lucky I am including you in on my idea, and that is where things deteriorate quickly. The non-technical person believes that they are bargaining from a position of power and the technical person (the kind that can get it done) knows just how scare they are. Generally the non-technical person only finds this out after the fact. Anyway the non-technical person walks away from the experience thinking that all technical personell are difficult and have unreasonable expectation, when in fact it is they who are putting up unreasonable demands if one where to break down the value proposition. Anyway, good article that may help shed some light on the subject to those who believe they are banging their head on the wall trying to find a technical co-founder.</comment>


Edward Snowden's Half-Baked Revolution - <AUTHOR> https://www.nsfwcorp.com/dispatch/half-baked-revolution/5fd338733d2a5b16569f42d79512996b5fec2ee2/

<comment><USER2> Short version: The author knew "real" martyrs. Snowden is no martyr, thus Snowden is a clown.

There, I saved you 10 minutes and a lot of scrolling.

<comment><USER3> I would say you could skip the entire part about Ames' time in Russia and still get the message, which is that Ames dislikes Greenwald's coverage of the leaks and Snowden because Greenwald demands that everybody see Snowden as a bona fide hero. It's worth noting (and the article mentions this extensively near the end) that Greenwald and Ames have been enemies for the past few years.

Honestly I think the article could do without the comparison to so-called "real" martyrs. The point that he makes around the middle:

"But I've been frustrated as Hell watching Snowden's politics, and the politics of his diehard supporters, and the strategically flawed, manipulative decision by his handlers at the Guardian to preemptively convince the public that Snowden is a hero, an infallible "historical" figure who must be worshipped by anyone who considers themselves aligned with history."

is a good one to investigate, and I'm inclined to agree with Ames when he says

"So for me, the importance of what we've learned about the NSA spying programs doesn't hinge on whether or not I have a cult-like faith in Snowden's and Greenwald's "heroism" as "true patriots" unlike the other team's guys. But the problem has been, from the start, that Snowden's and Greenwald's network of supporters created this false consensus, and thought-policed anyone who dared deviate or think for themselves."

However the article is too long and unfocused, and I think it suffers as a result.</comment></comment>


Quantum teleportation demystified - <AUTHOR> http://blog.rongarret.info/2014/12/quantum-teleportation-demystified.html <comment><USER2> The first step in demystifying quantum "teleportation" is to stop calling it "teleportation", which is a term that is made to be misleading.

The second thing to do is to stop reading any article that ever says anything remotely resembling, "the photon/atom/whatever was teleported..." since that is a flat-out falsehood that only a ignoramus or a liar would publish.

No photon, no atom, no _thing_ has ever been "teleported" nor ever will be. Only the quantum state gets "teleported", and the quantum state most decidedly does not have the ontology of a "thing". That is why the quantum world is so weird.

Quantum "teleportation" ought to be called something like "entanglement transfer", which has the advantages of being a) fairly accurate and b) hard to use in the misleading and dishonest ways "teleportation" gets used.

<comment><USER3> > The first step in demystifying quantum "teleportation" is to stop calling it > "teleportation", which is a term that is made to be misleading.

> No photon, no atom, no thing has ever been "teleported" nor ever will be. > Only the quantum state gets "teleported", and the quantum state most > decidedly does not have the ontology of a "thing".

I used to think the same thing as you, but if you accept quantum mechanics as complete and accurate, then the quantum state describes the totality of the system. There is nothing more than the state -- no other hidden variables.

So it comes down to the philosophical question: if you can make a perfect copy of something, except you have to delete the original version in the process (see the no-cloning theorem), is the new version the original "thing"? I would argue yes, it is. It's completely indistinguishable in every way.

(Now do I actually believe quantum mechanics is complete? I'm not sure I do. But if I _assume_ that it is, then quantum teleportation is really teleportation.)

<comment><USER4> Asher Peres, one of the coinventors of teleportation, had an amusing story (with a serious subtext) about the question of what is teleported: "Later, when a newsman asked me whether it was possible to teleport not only the body but also the soul, I answered "only the soul." Even that is a gross oversimplification."

[http://arxiv.org/pdf/quant-ph/0304158.pdf](http://arxiv.org/pdf/quant- ph/0304158.pdf)

In teleportation experiments to date only some degrees of freedom are teleported. So it doesn't usually make a whole lot of sense to say "the atom" was teleported. Rather, it'll just be the quantum state associated to nuclear spin states, or electronic degrees of freedom, or whatever.

<comment><USER3> Cool article. I wonder what the maximum number of degrees of freedom that has been teleported so far is. I also wonder if it gets exponentially harder to transmit larger and larger quantum states (the only reason I posit this is because it always seems like Nature prohibits us from doing all kinds of cool things in an exponentially hard way).

</comment></comment></comment></comment><comment><USER5> "when Bob receives Alice's bits, he uses that information to apply one of four transformations to his photon. It is Bob's action that changes his photon's state into the state of Alice's original photon. And that is the _only_ time that Bob's photon changes state."

I disagree with this particular bit. The state of Bob's photon changes exactly when Alice does her measurement [1]. Why? The state of a photon is given by 2 real numbers (infinite bits). Bob receives 2 bits of information from Alice so his 1/4 operation can't change the state of the photon to an arbitrary state.

The 'magic' does happen when Alice measures her state. After her measurement Bob's photon is in one of four possible states, which are the same up to 2 swaps. The 2 bits of information are needed to find out which swaps to perform. This swapping step nicely prevents faster-than-light travel.

[1] Caveat. In a relativistic universe, ordering of events depends on the frame of reference. All arguments carry through when this is taken into account.

Edit: I should explain how this saves relativity. No measurement (weak or strong) can distinguish which pre-swap-state Bob has. You can try to be clever and ask Alice to teleport millions of photon states to Bob. But that doesn't help either because each of the four states are equally likely in the whole ensemble. So you need 2 bits of information per teleported photon state to get the correct final state each time.

<comment><AUTHOR> > The state of Bob's photon changes exactly when Alice does her measurement > [1].

No, it doesn't. If it did, then this would lead to faster-than-light communication. The whole concept of "exactly when Alice does her measurement" isn't even well defined!

> Why? The state of a photon is given by 2 real numbers

Actually they are complex numbers. But this part of your point is valid nonetheless.

> The 'magic' does happen when Alice measures her state.

No, the "magic" happens when the entangled pair is first produced. Alice's measurement changes nothing on Bob's side.

</comment></comment><comment><USER6> Ron attributes to malice here that which can be more easily explained by indifference. I think Physicists have largely given up on trying to correct media's portrayals of QM as they either see it as not being important or because they see it as tilting at windmills.

The majority of experts I know feel like it's futile to try and correct the media's representation of their field. I think QM has it doubly hard as it has all the issues of other technical field, while suffering from both the problem of its ontology being foreign to the lay-person and certain key points of its ontology are still debated within the field.

<comment><AUTHOR> In general I agree with you. But this case is different. This is not the popular press publishing this false information, it's NASA itself. I think they ought to hold themselves to a higher standard.

<comment><USER6> I guess I mentally put whatever part of NASA published this in the same category as university PR departments. You almost certainly know more about how NASA works than I do.

<comment><AUTHOR> Your analogy is not wrong, but I think university PR departments ought to be held to a higher standard too. If a university PR department issued a press release that denied anthropogenic climate change or evolution there would be an uproar. Why should it suddenly be OK to play fast-and-loose with the truth just because the topic is physics rather than biology or climate science?

<comment><USER6> I had to think a bit before responding, but university PR departments regularly report questionable findings. The two you picked are obviously highly politicized topics, so it's obvious why _that_ would cause an uproar.

I agree that they ought to be held to a higher standard, but I think that the motivation of scientists for not doing so is more out of apathy, and less out of a desire to seem more mysterious.</comment></comment></comment></comment></comment>


Training Hybrid Human-Machine Computer Vision Classifiers - <AUTHOR> http://blog.cs.brown.edu/2014/01/24/training-hybrid-human-machine-classifiers-1-24-2014/

<comment><USER2> Work on "human in the loop" classifiers have been around for a long time.

That said, this is very interesting. The real innovation here is the untrained humans feeding the expert system via simple visual identification. This requires a preestablished taxonomy to be defined, so you won't get any surprises, but it is perfect for any large scale classification that has fine differentiation (like biology).

<comment><AUTHOR> I'm working on how to seed this system without defining the taxonomy in advance too. This would enable growing a library of classifiers that would eventually be able to do a huge number of fine-grained classification, without saying what those classifiers have to be beforehand. But setting up the taxonomy in advance makes it so you don't end up training two classifiers that do essentially the same thing.

<comment><USER2> Just spitballing, could you do this by asking humans to differentiate two images that have been classified the same way?

For example, for the pocket square set, once there's a reasonable single cluster, could you randomly choose images (or ask "are these the same?") and ask what is different about the two images.

You may not get a formal taxonomy, but after enough of this, you could have something experts could work on. The problem, of course, is that without expert level insight, you'll get a lot of "that one is prettier".

<comment><AUTHOR> I've done a similar thing trying to create classifiers for scenes and buildings. It's hard to have a word for 'bottom left corner of a window with bars on it', for example. And for scenes there's no taxonomy in advance. I think it works better than expected (as good as automatic patch discovery methods), but you end up having to train a lot more classifiers because you'll get a number of redundant classifiers.

Something that might be cool is to have a step where the common people try to do the clustering, and an expert corrects them if they do something not useful. Then there'd be a back and forth between experts and crowd people. I haven't really thought that out though.</comment></comment></comment></comment>


Show HN: LilBlog – Blog Software Written in Only HTML, CSS, and JavaScript - <AUTHOR> https://github.com/milge/lilblog <comment><USER2> You should have a section of "Why not?" in your readme:

\- Google cannot crawl by default (Google is crawling JS websites now, but I bet it doesn't run JS on any website it founds).

\- Writing your posts in raw JSON is crazy.

\- If you need to write HTML you'll need an external tool, and this breaks your argument against Jekyll and other static site generators (I don't like the fact that Jekyll needs Ruby and a lot of things, but there are a lot of other static website generators with very little requirements out there).

\- Why not write raw HMTL in raw HTML files instead? This is much more "what you see is what you get" than writing everything in a big JSON file.

<comment><AUTHOR> Good idea. I'll add a pitfalls section. I usually write in notepad and copy it over. I don't write straight in JSON. Why would you need an external tool to write HTML? Sure, they help a ton, but I can get the job done in notepad.

I did consider using raw HTML files, but I wanted everything that needs to be updated in one place, in one file.

<comment><USER2> I don't like this idea, but in this case YAML is probably better than JSON (also you can keep your JSON files, since any JSON is valid YAML).

<comment><AUTHOR> What am I gaining using YAML? JSON is a well-known standard and used everywhere.

</comment></comment></comment></comment><comment><AUTHOR> Hi HN. I've used plenty of different blog platforms in the past. I've recently been looking for something dead simple. A lot of static-site generators like Jekyll work well, but I wanted something simpler that didn't have any server side requirements. So I created LilBlog. Feedback is appreciated. Thanks.</comment>


Ask HN: Does a "find me a cheap interantional adventure" service exist? - <AUTHOR>

I'm curious if such a service exists: I just want a listing of the cheapest possible international flights with no regard to the departure/return date. Essentially a service that allows me to go on an adventure for cheap. Perhaps the need could be met by a Groupon like model for airfare: cheap, last minute deals at really cheap prices.
Do airlines ever offer cut-rate prices on airfare? Is this where flying standby fits in? Is it even possible to fly standby anymore, or something equivalent to it? <comment><USER2> The only thing I know of like this is Space-A travel. (<http://en.wikipedia.org/wiki/Space-A>) Obviously, if you've never served in the military, this probably isn't that viable, though I do think this is the concept you're after.

You might also inquire with Intrepid Travel (<http://www.intrepidtravel.com/>) to see if they could help put together something a bit more random for you. I've used them before and been quite pleased.

<comment><AUTHOR> Ya, no military service here, so I guess that option is out.

I do like the look of what intrepid is offering, and will have to research them some more. Thanks for the links.

</comment></comment><comment><USER3> <http://www.qfly.com/> is pretty nice

<comment><AUTHOR> Oh, damn. That interface is almost exactly what I'm looking for, but unfortunately it looks like it's only for European airlines. Do you know if anything like that exists for American airlines?

</comment></comment><comment><USER4> try <http://www.adioso.com> \- search "<yourcity> to anywhere under <yourbudget>"</comment>


Garmin Head-Up Display (HUD) Projects Directions onto the Windshield - <AUTHOR> http://garmin.blogs.com/my_weblog/2013/07/garmin-head-up-display-hud-projects-directions-onto-the-windshield.html#.UdwMHW13ent

<comment><USER2> Looks nice. The price is not bad either.</comment>


Google Search Console Has New Tools to Help with Site Moves - <AUTHOR> https://www.searchenginejournal.com/google-search-console-change-of-address/349560/ <comment><USER2> Google Search Console can often not even read a current robots.txt file. They should fix this before making any further 'improvements'.</comment>


Hone Your Programming Skills - <AUTHOR> http://www.karrels.org/Ed/ACM/index.html

<comment><AUTHOR> I'm doing one of these per night in preparation for a contest they have at my school annually. It's a fun way to keep in shape and hone in on your C skills.

It's also fun to compare your program when you get one done with the sample solution he provides. At first my code was wasteful and took way too many lines of code compared to his solution, but as I got better at it I started writing cleaner and more efficient code, and even came up with some solutions that were more elegant than his!</comment>


Ask HN: Wht do u think of our redesigned results page? How would u improve it? - <AUTHOR> http://www.panabee.com/name-generator/cool%20picture

<comment></comment>


Fertility rate: 'Jaw-dropping' global crash in children being born - <AUTHOR> https://www.bbc.co.uk/news/health-53409521 <comment><USER2> We are bombarded daily with articles about pollution, climate change, the environment at large.

Yet, this article also paints this fertility rate drop as a problem that needs a solution.

If the global population stabilises soon and even reduces it will be very good news. The issue that will need solving is how to adapt our economic systems and funding of care and pensions. Trees don't grow to the sky and population cannot, either, anyway.</comment>


Airbnb could be banned in Amsterdam: authorities are hunting for illegal hotels - <AUTHOR> http://thenextweb.com/insider/2013/02/02/airbnb-may-be-banned-from-amsterdam-local-authorities-are-now-hunting-for-illegal-hotels/?utm_campaign=social+media&awesm=tnw.to_j0b6n&utm_source=referral&utm_content=Airbnb+may+be+banned+from+Amsterdam:+Local+authorities+are+now+hunting+for+illegal+hotels&utm_medium=copy-paste-link

<comment><USER2> I feel this is entirely justified. There are a lot of people on HN who are very much in favour of a minimum of regulation in these sorts of markets, but the Dutch government has democratically opted to put rules into place for, amongst other things, hotels and taxi services.

It's great that business like Airbnb and Uber are looking to disrupt their respective markets but that doesn't make them exempt from the laws that everyone else has to follow.

<comment><USER3> I totally agree , in case of an accident/wrong doing/Whatever ,without a proper license and a pro insurance, if you are the "client" : screwed, if you are the "landlord" : screwed. The only winner is airbnb. It would be like saying one can open a restaurant because one has a kitchen ... one just cant.</comment></comment>