In Hours, Thieves Took $45 Million in A.T.M. Scheme - <AUTHOR> http://www.nytimes.com/2013/05/10/nyregion/eight-charged-in-45-million-global-cyber-bank-thefts.html?pagewanted=all <comment><USER4> > "With five account numbers in hand, the hackers distributed the information > to individuals in 20 countries who then encoded the information on magnetic- > stripe cards. On Dec. 21, the cashing crews made 4,500 A.T.M. transactions > worldwide, stealing $5 million, according to the indictment."

If true, that's hilarious. Seriously, ATM reading magnetic stripes? What century are we, again? It seems I've traveled backwards in time. Either that, or it's a new Terminator movie plot.

I haven't seen a credit or debit card without a smartcard (which requires a PIN) in Brazil in more than a decade now. Not sure if it would have stopped this particular attack, as the magstripe readers are still there because of foreign _credit_ cards. However, there are stricter restrictions on foreign money withdrawals which are enforced regardless of the originating bank.

<comment><USER5> US debit cards just require magnetic strip and pin to withdraw from ATMs.

<comment><USER6> That's the biggest problem.

If the US would switch to chip and pin then all those countries that already use chip and pin can turn off the magnetic strip by default. Right now they need to leave it on as the US is common travel destination.

Chip and pin isn't 100% secure either but it would stop a large number of skimmers.

If you don't travel and you live in a country with chip and pin have your bank disable your magnetic stripe. Even if someone were to skim your card the bank will not authorize a transaction via magnetic stripe.

<comment><USER7> Chip and pin pushes more burden onto the consumer. I am well protected now with mag stripe - why would I want to place more of a burden on myself to keep a PIN safe when the law currently protects me for unauthorized charges?

</comment></comment></comment></comment><comment><USER8> Here is the original Government press release:

<http://www.justice.gov/usao/nye/pr/2013/2013may09.html>

I could not locate a copy of the actual indictment, so if somebody could find a link to it I would appreciate it.

I was curious to how they were caught. That they only caught the runners (the guys going to the ATM's with cards) and not the group leaders or the hackers suggests they were caught via traditional ID methods via ATM cameras[1], mobile phone or car license plates.

The other evidence to support this theory is that the runners in other countries were not arrested or charged at the same time. If law enforcement took these guys down from the top, you'd think they would be able to also ID the runners in other countries.

Instead, only the group of runners organized around New York were caught - <USER2> people, out of a group that would number at least 50 or more.

I also don't understand the money laundering charge. The defendants deposited $150k in $20 bills into a Miami bank and then used the account to buy a car. That isn't doing a very good job of hiding the source of funds, if that is what their intention was.

Seems very amateur and unworthy of a professional criminal organization - <USER3> likely it was the proceeds of a cut that one of the runners got.

[1] During the Boston Marathon Bombing manhunt the Feds released pictures that were taken from an ATM showing Suspect #2 (later identified as Dzhokhar Tsarnaev):

<http://i.imgur.com/0ZF7ud9.png>

From the pictures you can see that ATM's take a photo when the user is approaching and while they are using the ATM (the first picture seems to be triggered by the door being opened). The quality is surprisingly good.

<comment><USER9> Surprisingly good quality? Maybe compared to 1980s QuickieMart VCR cams.

<comment><USER10> I'm surprised it's not 1080p or similar quality yet. That technology is so cheap these days; I'm sure it'll be a few more years before all security cams are recording in HD as the norm.

<comment><USER11> I would guess that has as much to do with storage and bandwidth as it does camera quality.

<comment><USER12> and most atms are 1990s technology

<comment><USER10> Good point. I know how reluctant financial organizations are when they have to actually spend some of their own money to upgrade something.

</comment></comment></comment></comment></comment></comment><comment><USER13> And just a few days ago people were discussing how that ATMs prefer to just give you money and overdraw an account rather than deny you cash when you go overdrawn. I guess this is the result? Systems that are only synced once an (hour? day?) provide a window to let thieves do a coordinated hit on different network partitions.

<comment><USER14> > In the first robbery, hackers were able to infiltrate the system of an > unnamed Indian credit-card processing company that handles Visa and > MasterCard prepaid debit cards.

> The hackers – who are not named in the indictment – proceeded to raise the > withdrawal limits on prepaid MasterCard debit accounts issued by the > National Bank of Ras Al-Khaimah, also known as RAKBANK, which is in United > Arab Emirates.

<comment><USER15> Right - but there is a difference between the "Withdrawal limit" and the "Account Balance" - Just because you have a $50mm withdrawal limit, doesn't mean you have a $50mm account balance.

<comment><USER16> This is guessing, but perhaps the withdrawal limit of a pre-paid card acts as the account balance.

</comment></comment></comment></comment><comment><USER17> From an engineering point of view, the mere fact that these people were able to withdraw millions of dollars from _five accounts_ in multiple locations simultaneously is just absurd. Even if these guys had direct access to the database to be able to change the withdrawal limits and balances of the cards, any engineer with half a brain in charge of designing their back end would create a separate system that monitors transactions and does both security and reality checks.

Same card being used within seconds at two locations 5 miles apart? Probably something funny going on. "Deposits" of millions of dollars on a single pre- paid card in a day? Might be unusual.

These banks deserve to lose every dime they have to lose if they are this stupid, or are hiring such inept IT people.

<comment><USER18> Banks must hire among the most inept IT people of any industry. Every time I log into PNC, I literally switch tabs and try and "do something else" for at least a minute, because that's how long it takes their Virtual Wallet bullshit to load. At least, that's what the site says it's doing. Loading. Only they have "HTML5" emblazoned in huge letters on the page, for some unknown reason, which inevitably makes me wonder what the fuck is taking so long then. Let me guess, your SOAP requests are 3 miles long. Uphill. Through the snow.

<comment><USER19> In my country theres a foreign worker scam that allows Indian companies to fly in the worst IT staff complete with fake resumes and pays them $6/hr for a year to screw up their website with dozens of SSL certs and slow security theatre that pretends to do something but is just a little flash to watch while you wait forever to load their junk software.

major banks here all made at least a trillion in profit last year but couldnt be arsed to pay for legit IT staff. now we all suffer paying tax dollars to track down all these thieves who easily fraud their faces off with the terribad security and poor code quality

</comment></comment></comment><comment><USER20> I work for a financial institution. This problem is due to complete ignorance of banks on best security practices. Their global ATM lacks simple velocity checks. Such can never be made in real-time as data has to be aggregated globally to detect the total money flows from certain financial institutions, but given the manual handling of ATM withdrawals, a minute delay would be acceptable.

Simply sum all withdrawals, not per card number, but per financial institution (per BIC-code), and measure the money flowing out per time unit. If it exceeds a multiple of X times the average for what's normal on that day, raise an alarm to investigate manually.

Such velocity checks would never work if only looking at withdrawals in a single ATM and still not good enough if they would measure all withdrawals in a single banks all ATMs as there are so many banks.

Banks need to cooperate in developing a global anti-fraud system. Unfortunately they still use COBOL and don't lose enough money on these things to find the motivation to do it.

<comment><USER21> Out of curiosity, are there financial institutions that are actually still using COBOL?

</comment></comment><comment><USER22> It makes me peeved when these reports omit the names of the parties that were compromised in the intent of "protecting" their name. If I was a customer of one of the banks that got broken into, I think it would be my right to know that they're insecure so that I could put my money elsewhere.

<comment><USER23> It tells you RakBank in the article and the wire service has the other bank

> Prosecutors said the scheme involved attacks on two banks, Rakbank, which is > in the United Arab Emirates, and the Bank of Muscat in Oman.

[http://www.smh.com.au/it-pro/security- it/massive-21stcentury...](http://www.smh.com.au/it-pro/security- it/massive-21stcentury-bank-heist-cyber-thieves- steal-44m-20130510-2jbf1.html#ixzz2Sr1hnrj7)

edit: Oh, the NYTimes version of this story says it's a US based credit card processor name withheld [http://newsdiffs.org/article- history/www.nytimes.com/2013/05...](http://newsdiffs.org/article- history/www.nytimes.com/2013/05/10/nyregion/eight-charged-in-45-million- global-cyber-bank-thefts.html) Other versions say the foreign banks themselves were the credit card processors <http://mashable.com/2013/05/09/atm-hackers/>

<comment><USER24> I've done a bit of digging and if you look at the RAKBANK prepaid portal [0] you can see the service is powered by ECS which is based in India [1], with offices in the US, UAE and Singapore.

Not sure about the other one, the bank of Muscat site is a bit crap, didn't find mention of the processor in the T&Cs or description of the cards [2].

[0] [https://www.rakbankprepaidcard.ae/CustomerPortal/WebPages/Lo...](https://www.rakbankprepaidcard.ae/CustomerPortal/WebPages/Login.jsp) [1] <http://www.electracard.com/contact-us.php> [2] <http://www.bankmuscat.com/cards/prepaidmain.shtml>

<comment><USER25> More importantly electraCard is certified PCI compliant by Control Case [0]. I think, this is the primary reason electraCard's name is not on the news; it has been certified secure by the payment industry standard [1]. Either Control Case failed to perform audit properly or the hackers had some serious skills.

[0] <http://www.controlcase.com/> [1] <https://www.pcisecuritystandards.org/>

</comment></comment></comment></comment><comment><USER26> The credit card companies are making billions in profit. One way of increasing the profit is by using 40 year old technology like magnetic strips instead of upgrading the hardware. 45 million may sound like much, but it's much cheaper than ensuring that every credit card reader in the world only uses chip readers.

I am sure that the crew here att HN could come up with 50 better solutions to security than the magnetic strip and a string of numbers.

<comment><USER27> I thought that little SIM chip in my Visa Debit card from my Credit Union here in the States was just for show until I was forced to use it everywhere I went in Vancouver, Canada.

I guess they've either been stung enough by fraud up there that they switched over from stripes, or they're just a bit more forward thinking than we are.

</comment></comment><comment><USER28> Piece of advice: don't take pictures of yourself committing a crime.

<comment><USER29> Those are just cashers... you have to be stupid to take that job.

This reminds me of a Canadian syndicate from a few years back... never caught the top guy (rumored to be British).

Any followers of the Pink Panthers out there?

</comment></comment><comment><USER30> I really wish people would stop linking to mobile sites on aggregators... mobile users will get the mobile version anyways.

<comment><USER31> I wish they would only link to mobile sites. Mobile sites regardless of the device are usually ten times easier to read.

</comment></comment><comment><USER32> Just follow these 3 simple steps for safe online banking:

[http://www.theonion.com/articles/after-checking-your-bank- ac...](http://www.theonion.com/articles/after-checking-your-bank-account- remember-to-log-o,32260/)

</comment><comment><USER33> This attack was done by people who are rather sophisticated. This is not some kind of script kiddie operation.

These people have international reach, were able to recruit people to run the ATMs for them, and the ostensible "ring leader" was assassinated.

Either organized crime and/or former government agents with cyber security and cyber-spying training.

</comment><comment><USER34> I wish that my bank would let me set a message to pop up whenever withdrawals over a certain amount (or percentage) are made. If we can't be secure, I'd at least like my would-be-account-ruiners to know "LOL STUDENT ACCT". What would be even better is if every time I accessed an ATM it would snap a photo (so many are all recording video anyway) and put it into my account mailbox to view the same way I view checks. That way I could track my facial expression over time as I watch my account go from $XXXX to $XX every time the rent is paid and chart it along with other personal metrics. On the off chance that someone does steal my card/pin/... at least I would be able to shame take a moment shaming them in Photoshop out of... grief?

\---

This actually got me thinking about a relatively straight-forward way to make ATMs more secure. Many ATMs have cameras and are, presumably, recording each time someone makes a transaction. I don't know exactly how the system works, but here's what I think:

\- People who use ATMs should pretty much expect to be recorded in some fashion for security purposes, even if it's just a camera in the corner of the room.

\- By using an ATM most people, even the privacy-conscious, would agree to this amount of surveillance. If not, they are welcome to visit their bank during regular business hours, in a ski mask if they prefer, or better yet use the inside of their mattresses instead.

\- Adding a camera to a device, particularly one like an ATM, is trivial to implement and should only make a slight difference in cost.

\- This camera could also be sensitive to infrared or other bands in order to defeat the ski-mask (thieving) or eye-patch/bandage (handicapped or disfigured) crowds.

\- The software could be made such that it only proceeds with certain actions IFF it recognizes that the camera is not being blocked, that it recognizes a face, and that the face is not being spoofed by a Polaroid or something silly.

\- ATMs are networked and should be capable of uploading medium resolution photos. Assuming reasonable policies could be maintained, the photo could be sent over the wire directly to your card-issuing institution and then routed to you, perhaps with a 7-days-til-self-destruct mechanism. Obviously _you_ could archive these if you wanted, but the point is that banks/credit companies would treat it the same as security footage, i.e. data glut that's only useful while it's fresh.

\- As soon as you are made aware of some sort of fraud, you can simply report the transaction, with identifying snap, to the bank (who will hand it over to authorities).

I'll leave the potential problems of this system to your imaginations, but it seems to me like a fairly easy to adopt solution to small, regular ATM theft. Obviously a coordinated attack could perhaps find some sort of exploit, but maybe it could deter the small-timers enough to be worth it.

EDIT: I am aware that this doesn't solve any of the particulars in the article, but I still think it's "on topic" since we all like tech, and ATMs are tech :)

<comment><USER35> > _I wish that my bank would let me set a message to pop up whenever > withdrawals over a certain amount (or percentage) are made._

ING Direct does exactly this!

I get an email (text messages possible too) every time I make a purchase over a certain amount that I've chosen. You can set the limit as low as $1 if you really wanted to, so you can be notified of literally every single debit card purchase.

This forward thinking is one of the many benefits (no fees _EVER_ being another) I've enjoyed and why I love banking with them.

Online banking is definitely the future, or at least will grow to be a much larger part of it.

<comment><USER36> Simple alerts via their iPhone application of every debit card transaction made -showing the places name, and a location on a map at the same time.

Because there is no cut off, other than turning off notifications, this sounds like it could be annoying. But in practice, it's just nice, and gives you a sense of security.

And when looking back over transactions at the end of the month - the maps are dang handy for jogging my memory…

<comment><USER35> > _And when looking back over transactions at the end of the month - the maps > are dang handy for jogging my memory..._

Whenever I get an email from ING about a transaction or deposit (one that isn't totally obvious) I do this:

      Click "Forward".
      Delete all text/images.
      Write a few words about the purchase or deposit.
      And send it to myself.

That way I can look back in Gmail at any time and know _EXACTLY_ what I spent that money on. This is helpful because sometimes knowing _WHERE_ I spent money doesn't tell me _anything_ about I actually purchased.

For example, I have a Debit Card Purchase of $10 at Farhad Monadjeem. What in the _HECK_ is that???? Oh, that's actually the car wash at Mobil; the owner's name I suppose. This system is also great for online purchases, so I don't have to login to various websites to see what item(s) I purchased; it's all in my email.

Easy and extremely effective!

</comment></comment></comment></comment><comment><USER37> Wtf - 3000 ATM withdrawals in the same card and no alarms go off? Presumably there is a "ignore flags flag" they set too!

So this just reminds me of the Microsoft paper a few months back - the problem is not robbing the electronic bits, the problem is getting them out of the financial system.

In the traditional bank transfer they need a money mule stupid enough to transfer to a Russian bank. In this one the people with the (inside) knowledge to uncap 12 cards needed to find 100 guys walking up to atms, plus their supervisors and contacts.

So it seems either you can rob a bank but need an idiot to help you get it out the country, or you can rob a bank and need a guy who happily sends hooded killers round to your place.

All for what Zuckerberg sees as small change.

</comment><comment><USER38> Can someone explain to me how they were able to withdraw so much money with only a few prepaid accounts? I'm assuming that the even though the prepaid accounts had a small balance, ATM machines let them withdraw as much as they wanted??

<comment><USER39> According to the article, they hacked into the prepaid card vendor's system and increased the balance.

</comment></comment><comment><USER19> This is just one of many cashout crews at the bottom of the crime pyramid that got caught. The masterminds are prob in Russia/Ukraine and wont be extradited so long as they arent stupid enough to go to a country on vacation that has extradition treaty with the US or they will find themselves getting kidnapped by feds to stand trial in the US, for a middle east bank heist because USA polices the world and your taxpayers cover the millions it will cost in flights and court fees/investigation

</comment><comment><USER40> Even though this is really sad from IT point of view, I kind of like that there are people who always forces IT to be better and better. PS: I personally think that human made systems will never be absolute secure anyway.

</comment><comment><USER41> Does it concern anyone else that the chairman of Security Innovation Network uses the phrase "cyberspace".

Well anyway, I'm just going to take a little trip on the Information Superhighway, I'll be back later.

</comment><comment><USER42> What impresses me most about this is just how incredibly well it was orchestrated, especially considering the number of moving parts and participants. Some top-notch project management there.

</comment><comment><USER43> ...was expecting to hear of brand new ATM Scheme implementation :)

</comment><comment><USER44> > _then encoded the information on magnetic-stripe cards_

See the problem?

</comment><comment><USER45> And that's where <http://solinkcorp.com/> comes into play.

Shameless plug: Brother's Canadian startup

</comment><comment><USER46> I'm always amazed at how many ATMs I have seen with their cables showing on the back. Wonder how many get cracked that way.

</comment><comment><USER47> The people who should suffer and eat this loss are the people responsible for letting it happen. Sadly, this will not happen, and the loss will be socialized (and profits capitalized) across the entire people through the form of raised insurance rate policies.

It's the system of insurance that is broken, not the fact that dumb corporations are doing stupid things and losing other people's money.

Socialism doesn't work in any system that you implement it in. When you separate the consequences from the actor, the rational actors will behave in a maximally self-interested way and screw everyone else. When all do this, the nation falls back 100 years. Not remedied, the nation falls back 1000 years.

<comment><USER11> Huh? So you want the head of security at the hacked bank to pay for the losses personally?

<comment><USER21> He means the bank should take responsibility and chalk up the stolen cash as their loss. What's more likely to happen though is that the bank will pass the cost of the loss on to customers (in the form of increased prices).

<comment><USER48> Well of course they're going to raise prices. They're a business. This isn't happy fairy land; their cost of doing business went up, so their prices will have to go up. If businesses didn't increase their prices to match an increase in cost of goods sold, they'd quickly go out of business.

<comment><USER49> NO. This is where you're wrong. This is a business; their goal is to get money: ALL the money, at all times. If they could raise prices and make more money, they would have done it already. They're _not_ sitting on their laurels saying "We have enough money!" only to be shaken from complacency and driven to change their price schedule because of an unexpected expense.

This money comes straight out of their value as a business. It is a loss to the shareholders.</comment></comment></comment></comment></comment>


Magic Leap One will ship this summer with Nvidia Tegra X2 processor - <AUTHOR> https://venturebeat.com/2018/07/11/magic-leap-one-will-ship-this-summer-with-nvidia-tegra-x2-processor/ <comment><AUTHOR> From the article:

Ahead of the demonstration, Magic Leap and AT&T announced today that the cellular carrier will be the exclusive wireless distributor of Magic Leap One devices to U.S. consumers, and is investing an unspecified amount in the company. Despite an earlier claim by Magic Leap's CEO that the line between developers and enthusiast consumers had blurred, an AT&T statement appeared to rule out consumer shipments in 2018, suggesting that developers will get access first.</comment>


Hacking with private APIs on iPad - <AUTHOR> https://rambo.codes/ios/2019/01/11/hacking-with-private-apis-on-ipad.html <comment><USER2> JSBox source code: [https://github.com/cyanzhong/xteko](https://github.com/cyanzhong/xteko)

 _> JSBox is not only a full-fledged environment for standard JavaScript, but also provides many utilities: safe environment to run JavaScript natively ... editor to write JavaScript, multiple themes, auto completions and snippets... VSCode extension ... APIs to interact with iOS ... Almost all the cool tech in iOS: Today Widget, Action Extension, 3D Touch, Home Screen_

Discovery is non-existent on the App Store. Other than blog posts, is there a good way to find new scripting/dev environments as they are released for iOS?

[https://scriptable.app](https://scriptable.app) is another JS runtime.

[https://codea.io](https://codea.io) is a Lua runtime.

<comment><USER3> Pythonista is as it sounds.

<comment><USER4> Pythonista is fantastic, especially if you get StaSH — a shell and basic userland written in PyPy to replicate as many POSIX tools as possible.

<comment><USER5> I second this. You can easily invoke Cocoa classes and swizzle methods with it. My eldest figured out how to snapshot a WebView inside Pythonista that way.

</comment></comment></comment></comment><comment><USER6> I know this is a silly comment but: 12" iPad Pro made my brain skip a frame.

12.9" rounds up to 13". I carry both a 12.9" iPad Pro and a 13" MBP, and they are practically the same size, the iPad is slightly bigger on the small dimension and the MBP noticeably wider on the large one, due to the different aspect ratios. Picked up the iPad to use with Duet, and have been pleased with the combo, nice to have two full screens to work with while coding.

Ok, nit picked. ;-)

<comment><USER7> All 13" MacBooks are actually 13.3", 15" are 15.4".

<comment><USER6> Which round down to 13" and 15" respectively, which is my point.

12.9" is awkward, 12" more wrong than right, I'd call it the 13" iPad if I had to pick one, but it's branded as 12.9".

</comment></comment></comment><comment><USER8> I use Continuous [1] for C# and F# coding on my iPad Pro. It implements a lot of Native iOS libs like UIKit, SceneKit, SpriteKit, Foundation, and CoreImage, but I am not sure if it can do what the article here does with Pythonista, which I also use on my iPad Pro. It has code completion and debugging, and code changes update very quickly for interactive development.

[1] [http://continuous.codes/](http://continuous.codes/)

<comment><USER5> I'm pretty sure Frank (the author) had some samples of how to fish out private frameworks. Apple does frown on that a bit, but since they're usually exposed to the sandbox as read-only, you should be able to do the same.

<comment><USER8> Thanks, I'll have to check that out. I am not beholden to any OS or platform. I have Windows 7 (at work), Windows 8.1 and 10 (at home), Linux, and an iMac and iPad, and I am amazed at how great the developing and coding experience can be on my 2015 iPad Pro. My other notebooks are all four-plus years old, but I have heard the latest iPad Pro is even faster and more capable for serious work. The Smalltalk/Pharo environment is pretty amazing, but coding F# on the iPad with Continuous is close to it.

</comment></comment></comment><comment><USER9> Swift Playgrounds example doesn't work on 12.1:

assert(Bundle(path: "/System/Library/PrivateFrameworks/AvatarUI.framework")!.load())

Error: Unexpectedly found nil while unwrapping an Optional value.

<comment><USER10> This framework doesn't exist on my iPad. Either Apple has removed it from non- Face ID capable iPads, or dropped it altogether.

<comment><USER4> Yes, the framework isn't installed on devices that don't have the Face ID camera — because there's no use making Memoji (what AvatarUI.framework is for) without it.

</comment></comment></comment><comment><USER11> This is the number one thing that turned me off of the Apple development ecosystem. Their absolute insistence on providing headers-only distributions of their libraries. It makes absolutely no sense. They're not protecting some closely guarded trade secret here, it's just a bunch of Objective-C UI code. And then the moment you need to change the color of something... or change the most trivial implementation detail in a base class, you're left completely starting from scratch.

</comment><comment><USER12> They're undocumented APIs, not private APIs, they will eventually be documented anyway.

<comment> ben-schaaf What's the practical difference on a proprietary platform where you can't just look at the source code to find out what it does?

<comment><USER10> Undocumented APIs are exactly that: you are free to call them, but there isn't any information on how to do so (for iOS, this is often POSIX or Mach functions). Private API is intended to be used by Apple exclusively, and is indicated as such by not being in /System/Library/PrivateFrameworks, or included in a usual framework but not intended to be called–either by prefixing the method name with an underscore or not being included in the class's documentation. Private API is occasionally opened up to third-party developers, but this is usually quite rare.</comment></comment></comment>


My Google Internship - <AUTHOR> http://www.goldsborough.me/google/internship/2016/11/18/01-57-54-my_google_internship_/ <comment><USER2> I love reading accounts like this. As someone who had an internship in high school, I'm always happy to hear what other people's experiences were going into and out of the process. I think my immediate reaction is that Google creates an environment that simply doesn't exist at most other places.

I interned at two companies in the defense industry. You could argue that our experiences were different because of security, but I disagree. The environment you described sounds like an absolute heaven: you have challenging, fun work, and have extremely well placed and delivered benefits. At both of my internships, the problems were hard. They weren't particularly fun to solve so much as they "had" to be solved and I was the only one to solve them. I got similar rewarding experiences completing tasks, though everything I did had to be "on the clock." As soon as we stopped working, we were expected to stop billing or move to some other task.

The offices were dull, boring, and expensive to spend time in. Your internship had availability of food and technology that kept you happy. Neither of mine did this. At one internship, we had a free snack room. That's it. If we wanted to eat lunch at the cafeteria at my second internship, we could at great personal cost. We were stuck with "hand me down" hardware that was a menagerie of hardware pulled from random places throughout the building. If you were given a bad keyboard on day one, too bad -- it was yours forever.

I complain like this because you had the exact opposite of the experience I had. Your experience is an irregularity, at least compared to what I've seen. This all comes down to culture, I think. The Google corporate culture is modern, focused on employee happiness, and focused on diversity. Things like getting your own hardware choices and free food go a long way to adding goodwill, and failing to take basic measures like that shows what I consider to be a lack of caring.

I wish more companies would copy Google on how they treat their employees and interns. Even if it might seem a bit cheesy to go after the low hanging fruit, employee happiness goes a long way to building a thriving, mutually beneficial relationship between an employee and a company.

Seeing a post like this makes me feel like my internship hosts haven't cared in the slightest. That's pretty painful, if I'm brutally honest.

<comment><USER3> One one side: yes.

And BTW - this has nothing to do with defense industry, it's just 99% of business is like this.

Business could do a lot more to make a more fun environment.

On the other hand ...

Google is a 'de-facto' monopoly, and they print money. They are super, super rich, and literally have billions more than they know what to do with.

So it's easy to justify a lot of extra expenses. And these things can be expensive.

Lastly - let's not be so naive. Much of the reason many of these things are offered is so that you 'never have to leave the office'. 'Free lunch' was a cold, hard, Google style calculation: the time it took to 'drive to resto and back' was wasted time, it was cheaper to give people food than have them waste this time.

Years ago, my friend interviewed at Google, and they lauded all the 'free clothes' that you could take, which were often used 'the next day' as employees 'stayed the night'. Sleeping over at the office was a relatively common practice, and as such, there's going to arguably be some pressure to work insane hours. Which is completely against the law. We lambast conditions in factories in China, and just because Google workers earn a bit more does not mean that the practice is any less problematic, when the vast majority of the surpluses are going to 'the factory owners'.

<comment><USER4> > 'Free lunch' was a cold, hard, Google style calculation: the time it took to > 'drive to resto and back' was wasted time, it was cheaper to give people > food than have them waste this time.

No, it's not. If it was, all companies would do it. And they would probably just give away sandwiches and call it a day instead of setting up dozens of gourmet cafeterias with different themes and chefs at the helm throughout their campuses.

Google loses millions of dollars every day in free food.

Why do they do it? Because that's how the company started and even after the IPO and the accountability that came with it, the founders stuck with their decision to put the employees first and the shareholders second

<comment><USER3> "No, it's not. If it was, all companies would do it."

No, this is false.

Google employees productivity, as measured in earnings/capita, is significantly greater than most other companies.

Google does not 'lose money' on the policy, if it was a 'net loser', they would end it.

It's effectively part of the total incentive package.

If it costs them $20/day per person, that's an extra $4K/year per person, if it increases productivity by only 2% it's an obvious winner based on that easy calculation alone.

Google has billions of dollars they don't know what to do with, and their effective cost of capital is very low. Anything they can do to materially lift output - that doesn't cost zillions - is probably worth it.

</comment></comment></comment></comment><comment><USER5> I love reading accounts like this. It's fun and well written and I enjoy the photos too.

I work in a cube farm of grey cubes on boring LoB applications. I know I'll never be skilled enough (or, more correctly, I'll never be ambitious enough to become skilled enough) to work at Google et al but it's really fun to sample the experience from the outside. :)

<comment><USER6> I really hate reading people believe they aren't skilled enough or won't be good enough to work at Google. When you realize all of the toys are part of an extremely successful strategy to keep you at the office as long as possible, and that Google is a huge company that has to hire thousands of people every year, you realize that this view that Google is "the best place to work" or that everyone who works there is a genius is silly.

While some of the most intelligent people I know work at or have worked at Google at some point, I know just as many Googlers I would describe as incompetent company men incapable of seeing beyond a PR line. Please don't ever get the impression that Googlers are somehow above you, because they're not. They're just people doing jobs.

You probably deserve more credit than you give yourself, and hey, humility is a virtue.

<comment><USER7> > When you realize all of the toys are part of an extremely successful > strategy to keep you at the office as long as possible

Ugh, I can't believe how often I see this repeated with zero evidence to support it.

I work at Google. The office is a ghost town by 6:30. The work life balance on every team I'm aware of is _great_.

Saying the perks are some underhanded strategy to keep people around hugely insults the intelligence of the people working here or at any other office for that matter. Do you honestly think there are people that are like, "God, I'm miserable! I've been here 16 hours and I hate my life but I just... can't... stop... playing foosball!" Damn you, Google, and your nefarious perks!

No, that doesn't happen.

The reality is that skilled software engineers are in very high demand and companies compete very hard for them. Salary is part of it but perks are a huge component. No matter how much cash you make, for eight hours of the day, you are not spending it on fun leisure, you are at work. So companies understand now that they have to make the workplace appealing too to keep talent.

They also find, no surprise, that happy, stimulated people are productive, creative people too.

> Please don't ever get the impression that Googlers are somehow above you, > because they're not.

I totally agree.

<comment><USER8> > skilled software engineers are in very high demand and companies compete > very hard for them

I keep hearing this but when I ask how to identify skilled engineers things get confused. ;)

<comment><USER9> It's mostly about keeping the ones you already have.

</comment></comment></comment></comment></comment><comment><USER10> Nice writeup. My favorite part is

>> simply practiced interview questions for about three to four months, every day, from morning till night. I then had three phone interviews around November, which I passed.

It's interesting (& funny) to see both high schoolers and experienced people spend similar amount of time (~several months) practicing for these types of technical interviews.

<comment><USER11> What it should be, is sad. These types of questions are often very different from actual work. The fact that you have to study or train for an interview process specifically, is absurd. Just being qualified for the job, should suffice.

<comment><USER12> Actually its good. If you study for months on interview questions to be able to pass the interview, you have "gamed" the system to get in and will likely be washed back out in 1-2 years depending on the mercy if your leadership team. People who spend the night before brushing up on their CS and passing the interview are those that actually pass (and stay and grow) and that is who the company really wants. Its just hard to weed out people who are very determined to game their way through.

<comment><USER13> ...or the people willing to put that much effort into "gaming" the system as you call it are those most likely to put in the effort to succeed and thrive on the job, and are therefore precisely who Google is looking for...

</comment></comment></comment></comment><comment><USER14> > It's Googley to stand up for diversity and inclusion, such as protesting > against binary gendering on toilets

So if I support binary gendering on toilets, I'm not welcome at Google? Why has it become necessary to subscribe to a particular set of political beliefs in order to work for Silicon Valley firms?

<comment><USER15> I don't think 19guid has a problem with using a toilet or being an asshole. I think the question is why is dissent from specific political views looked down upon?

I have been in Silicon Valley for almost a year now after moving from the Midwest. I have been able to talk freely with my coworkers about some of my conservative views. Yet when I have shared what would count as "traditional values" on internal forums I have been on the receiving end of redicual and name calling.

I very much would like to hear a thoughtful response on why Silicon Valley is so unaccepting of political dissent.

<comment><USER16> You have a good point. A friend of mine works at Yahoo and he regularly gets emails from management encouraging everyone to show up at the Yahoo booth at Gay Pride Parade. Sure, Yahoo wants to be at Gay Pride Parade because they want to be seen as an open and accepting place. If Yahoo does not participate, it looks bad because every other big company (read: Yahoo's competitors) attends Gay Pride Parade too.

But now we have a problem. What if there are conservative employees who do not support gay marriage rights? Should their opinions and feelings not count? If Yahoo is an open and accepting place, then it should be just as acceptable for a manager to send emails to employees inviting them to Straight Parade, or to "Anti Gay Marriage" Parade. But if that were to happen, the manager would be fired immediately.

Being against Gay Marriage rights is a political opinion, just like being FOR Gay Marriage rights. Isn't it discriminatory that a company like Yahoo is only allowing one opinion to be heard? In fact, isn't it problematic that Yahoo is promoting ANY political opinion in the first place? For Yahoo to remain an accepting and open work place, it should either have no political agenda at all, or it should promote all political opinions equally.

<comment><USER17> There are several things to unpack here, but I'm going to stick to one.

The primary difference, in practice, between something like Gay Pride and something like "Straight Pride", would be the power dynamic between the two.

Historically, and even to some extent currently, the people with more power have been those who would be in the latter parade.

"Punching up" is what it's called when you are challenging a group more powerful than you - "punching down" is more commonly referred to as "bullying".

<comment><USER18> This is the usual story, but power is more complicated than that. "up" and "down" assume a linear dimension.

> Historically, and even to some extent currently

Surely only the current situation matters? Why should the people now care about the power dynamic of the past?

<comment><USER17> Sure, it's not necessarily one dimensional, but it also doesn't just scale in terms of total magnitude summed across all dimensions (e.g. a bit of power in 50 axes is not comparable to the same quantity of power in one axis).

The reason to care about the dynamic of the past is that people are influenced by the past - in particular, people's actions in the present are often based on things that they did or that were done to them in the past.

Specifically, here, the reason to care about the past is that, even if/when we reached a point of equilibrium, where a subset of people were no longer in a minority of power, there would still likely be X Pride events for a while after, because the feeling of needing/wanting such things would not go away overnight.

<comment><USER18> > it's not necessarily one dimensional

Or even multidimensional. a "sum across all dimensions" doesn't make sense to me.

We are talking about something (power) that differs across contexts, locations, times etc. Power is as complex as our (human) social organisation, an is not amenable to linear algebra.

> people are influenced by the past

Unless that is is a result of holding this belief; People are _never_ influenced about the past, only by their subjective, current beliefs about the past. It would make more sense to consider what people believe now.

Marxist historical analysis has fallen out of favor for a good reason.

> would not go away overnight

Desire for power will never go away.

The "subset of people" is biased towards how you do your grouping; For example, that I, a white man, am naturally grouped with white slavers of the past, such that modern black Americans have something to resent me for.

Your narrative here relies on these kind of groupings in order to talk about "a point of equilibrium" and "no longer in a minority of power" \- you need to identify a group as the same over a period of time in order to make these distinctions.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Sorry, it seems like some kind of pseudo-utopia for people who want to feel special and intelligent all the time. People in silly spaceship themed rooms, meditating or hacking upside down, or maybe in sensory deprivation chambers for deep focus? It all screams: I'm entitled to coddling and acceptance--nay, encouragement of my eccentricities--cause I'm special. I just don't know if that's healthy or necessary, if Google is so successful in part due to this, or despite it.

<comment><USER20> So you think that everyone dressing like an IBM'r in the 70's is better its the eccentrics, hackers and od balls that often can produce the ground breaking work

<comment><USER20> Never thought id get down voted on here for standing up for "hacker" culture.

And BTW one of the worlds leading IBM experts (ie IBM used to get him to give talks ) to used to meditate in his own home made flotation tank - he one saved a quarterly billing run that was measured in hundreds of millions.

</comment></comment></comment><comment><USER16> Cool article. But I always find it funny how people try to convince you that so-and-so in their company is a big shot ("our director, the fourth highest rank at Google, after CEO, SVP and VP"). Trust me, outside of your company, that person is quite irrelevant. For most people, that person is just someone working at a big company.

<comment><USER21> Hey now, at least the naming hierarchy makes sense. My favorite example is finance, where VP is such a meaningless title that Goldman Sachs argued _in court_ that it doesn't carry any weight.

[https://www.bloomberg.com/view/articles/2014-09-04/goldman-s...](https://www.bloomberg.com/view/articles/2014-09-04/goldman- sachs-just-says-vice-president-to-be-polite)

</comment></comment><comment><USER22> Jesus christ, there is a lot of jealousy in this thread. I don't have anything interesting to add to the conversation but I am in awe with how much you've been able to accomplish in life already. Good job and I look forward to seeing what else you put out in the world.

</comment><comment><USER23> It's already insane that you got an internship (at Google too!) in your first year of college, but you seem to have done extremely well there too.

Nicely done! Seems like you're well on your way to being a very successful engineer.

<comment><USER24> And what's next in the path of a very successful engineer? 10 years down the line? 30? 40?

<comment><USER25> Writing snarky comments on HN seems to work for most people.

</comment></comment></comment><comment><USER26> Great read.

However, he lost me at

> Googley to stand up for diversity and inclusion, such as protesting against > binary gendering on toilets

Is it Google's business? Why should Google be involved? Why cater to 0.6% of the population, at the expense of convenience for the 99.4%?

At my last job we had "non-binary", "all-inclusive" bathrooms. They're just awkward. Not the stalls themselves, but having to share the bathroom with females, who would also rather have their separate, female bathroom.

<comment><USER27> Yes, it is, but I think the implementation matters. In my building on the Google Kirkland campus, we have men's and women's bathrooms in a few different places, and also one place where there's 5 single-occupancy unisex bathrooms and one mother's room. It's great! It doesn't take any space away from the other bathrooms, and it accommodates people who are uncomfortable in the cisgender multi-person bathrooms for whatever reason (maybe they're somewhere in the QUILTBAG or maybe there's totally unrelated physical or psychological reasons they prefer single-occupancy restrooms).

My understanding is that we're not trying to strike down all the barriers and make all toilets unisex, but there definitely are people who are working to make sure that every building has at least one of those unisex single- occupancy bathrooms, for people who need it. It doesn't cost Googlers anything except at most a couple of conference rooms.

<comment><USER26> Honestly, its largely a non-issue. Presenting people with choice and accommodating e.g. mothers is common sense.

It is the fact of _protesting_ such matters at work that threw me off in the first place. Opinions shouldn't be crammed down people's throats.

<comment><USER17> If the protest was about the lack of such choice, at the time, then this is still compatible with what you're suggesting is common sense.

</comment></comment></comment></comment><comment><USER28> Really well written...an interesting read.

On this though: _" On my last day, my team got me some cake and gave me some very sweet farewell gifts, such as the potato below."_

What's with the potato? Is that some inside joke at Google?

<comment><USER29> I think potatoes are just a joke in general. They're just... there.

<comment><USER21> I think this is why Dwight Schrute owned a beet farm, also. He could have farmed anything, but beets are just inherently _funnier_ than wheat or soybeans.

</comment></comment></comment><comment><USER30> Love how they docked you for Work/Life balance. Grats on the productivity and keep up the building. :)

</comment><comment><USER31> The fine article describes exactly the environment one would expect of people who run the worlds largest search engine but who still couldnt see a Trump victory coming a mile away. People living in a well cocooned safe space. A superb fit for university students.

Pretty much consolidates my view that AlphaGo was Google's IBM Deep Blue moment ie now past their peak. Their future products and services are going to be increasingly as distant from reality as the people themselves are, and thus much less useful or profitable.

</comment><comment><USER32> It's good that you found it enjoyable, but something worth keeping in mind beyond the fun-and-games atmosphere is whether you are in agreement with the company's overall direction and goals (and the fact that you are essentially contributing to that effort by working there); it reminds me of this article with a very much opposing view:

[https://news.ycombinator.com/item?id=7689897](https://news.ycombinator.com/item?id=7689897)

<comment><USER6> It's not so much Google employees would tell you they agree with Google's goals and direction, but that they have an incredible cognitive dissonance about what direction that is.

Most Google engineers will tell you that Google is trying to make the world a better place, rather than the reality that Google is trying to make incredibly large amounts of money at the expense of anything that gets in their way.

</comment></comment><comment><USER33> I'm curious about the negative on work/life balance. Did they really talk about how to improve it, or was it tongue-in-cheek?

<comment><AUTHOR> Well, they did mean it for real. They didn't directly give me feedback on how to improve it, other than "go home, man". It's a personal choice in the end :)

<comment><USER34> For a defined 3-month internship where your primary goal is to suck up as much experience as possible at a young age during said internship, I think you can give insane work hours a pass and just accept that they're making the most of the short-term opportunity. Just don't let it become habit in a fulltime job and you'll be sweet.

<comment><USER35> Even for a 3 month period, I think 16 hours is overkill. I would say 12 hours is the upper limit. This is just my opinion of course.

In any case, good on Google for warning people about that, especially younger interns/employees. Some people just get into the lifestyle and end up realizing what they lost way too late. Work isn't everything. It's important to wind down by doing things _other than what you do at work /school_, such as exercise, meditation, or a just developing a hobby in general.

<comment><USER36> Sometimes I like to do 16 hours one day and 0 hours the next.

</comment></comment></comment></comment></comment><comment><USER37> Hey--congrats on a really successful internship! I'm glad you had fun, and maybe we'll see you when you've wrapped up your studies, too. :)

</comment><comment><USER38> Read you resume. Un-fuckin-real. wow.

<comment><USER39> Geez. You weren't exaggerating.

</comment></comment><comment><USER40> Incredible maturity at your age - Google does a great job at finding talent.

</comment><comment><USER41> > I spent around three days on my presentation, mainly because I did it in > LaTeX instead of PowerPoint, as any sane person would in about one tenth of > the time.

This was the only part I could completely identify with. Perhaps even using Google Slides would have been acceptable! But what geek could resist the allure of Beamer... :)

</comment><comment><USER42> The volume of people hung up on bathrooms should illustrate, to anyone on the fence, how virulent transphobia is. Framing it as a political question rather than a question of basic rights is quite dark.

For context, they'll have a hallway with a dozen single bathrooms. They're not even mixing genders. But folks are so obsessed with their own fears of the unknown that they happily jump on any excuse to deny trans personhood.

For context, trans people are less likely to be predators or violent, and much more likely to be the victims of violent crimes.

[https://www.ovc.gov/pubs/forge/sexual_numbers.html](https://www.ovc.gov/pubs/forge/sexual_numbers.html)

</comment><comment><USER43> Glad you had a good time. Any concerns about working on personal projects using Google resources (whether or not you used their laptop, you used their building, wifi, snacks, etc.). Wouldn't they own the IP? (if they wanted to pursue it)

</comment><comment><USER44> Kind of ridiculous IMO that Google does not extend offers before leaving the internship. In cases like this, it really does not make sense.

<comment><AUTHOR> In that midpoint form I mention there's a box you can tick if you want to do "conversion" interviews at the end of your internship. Since I still have two more years of uni I didn't tick that box.

<comment><USER45> IMHO you're on the right track. Just try to get some fun while you're in the university because you ain't gonna find that environment (parties, girls, friends, etc.) elsewhere. Even if you do find something similar, sure as hell won't be the same.

<comment><USER34> Agreed. Don't let uni just be a gateway to employment. It's also a really good young adult experience where you can form social networks trivially easy that will serve you well into the future. It's your last hurrah of the innocence of no constant commitments and obligations before fulltime work too.

</comment></comment></comment></comment><comment><USER46> Interesting, well written. Gives a window on how a corporation manages relationships with young smart people, and the actual psychological impact it has, the effectiveness. Thank you.

Nitpicking: "Disclaimer: All opinions expressed below are my own." ??? Who else? How does poor legalese help your story? I swear: nobody will sue you.

<comment><AUTHOR> I learnt to be very careful about anything that's about Google and not from Google :)

</comment></comment><comment><USER47> You mentioned that you took some MIT OCW courses, did you actually do the psets and quizzes?

<comment><AUTHOR> No, I mainly used OCW to go deeper into more advanced dynamic programming and hashing techniques. I was more involved in the Princeton courses and especially Cracking The Coding Interview.

<comment><USER48> Mind referencing more (all? :D) of the resources you used?

</comment></comment></comment><comment><USER49> Instead of Google cherry-picking all of the talent out of the pool, why not let them pay corporate taxes, so we can spend the money on education?

</comment><comment><USER49> If only institutes like CERN had such good HR/recruitment techniques as Google, this world could be a better place.

<comment><USER50> Not sure how the experience is like as a CERN intern, but you can surely do internships there as a student: [https://jobs.web.cern.ch/join- us/students](https://jobs.web.cern.ch/join-us/students)

\-- If someone happens to have experience with interning at CERN, I'd love to hear about that :-)

<comment><USER21> Second hand, but the CERN interns I know were over the moon about it.

Obviously they didn't have the perks of Google because they don't have the sheer cash flow, but they both described it as a fun and interesting place to work, with an entertaining social side among the employees.

</comment></comment></comment><comment><USER51> What languages did you find yourself coding in?

<comment><AUTHOR> Web stuff, Python and Go

</comment></comment><comment><USER52> I must admit I'll drown a bit if I check all the comments, so I'm not sure if this has already been said.

IMHO, the author is playing the "I like you very much and I'm going to be agreeable with just about everything you say and do, so you won't go wrong if you pick me to come back" game. At least they're demonstrating they have a good understanding of social networking.

This reads like it's supposed to be an experience review, but it's incredibly over-positive and unbalanced/unfair. There are no real negatives mentioned. So I can only experience it as "I want to come back very much".

That the author has gone to this extent (and only mentioned their successes) suggests either insecurity (impostor syndome) or - likelier - fear they won't be accepted back. The author did mention that their reviewers showed them some instances where they went wrong, I'm wondering if this is the main reason for this or whether it was simply the overwhelming environment.

\--

On another note, since everyone's added their opinions of actually working at Google I might as well join in.

First of all, I took a look at the link noted in [https://news.ycombinator.com/item?id=13086051](https://news.ycombinator.com/item?id=13086051) and I don't agree with any of the points raised in there; most of that article can be adequately explained as conspiracy theory and provocation/incitation, I don't think the points they raise (and attempt to inflame) have much substance.

That said, I do have some concerns of my own.

The issue that's likeliest to have the biggest practical impact for me personally is that I have absolutely no foundation in math, due to the fact that I was born with severe learning difficulties that I only began to correctly identify around 18-22 and which I'm still in the process of learning how to counter for (I'm 26 now).

This means that while I'm well-developed in more areas today than ever, math is an area I'm so far behind on I have zero incentive to catch up because I'd have so much foundational stuff to deal with. For example, I was at the supermarket a few months ago basically pushing all the buttons on my calculator as I couldn't remember what operator(s) to use to figure out how many onions I could buy for the amount of money I had. This wasn't a cognition problem - it was simply the fact that I am _that ignorant_ about math as a subject.

Tackling that to get a compsci job just doesn't seem like a good use of my time since I'll be 40 in a bit over 10 years and it may take me that long (or longer) to catch up. Normal kids to start to learn rudimentary math concepts around 8 or so after all. (I tried, but none of it never made any sense.)

So I definitely appreciated all these pictures, knowing I'll never be likely to call a place like this home.

I most also admit I'm more than a little jealous at the "nearly free" store - I could certainly do with changing my trend of having computers that are always 10 years old (my very limited disability support pension prevents me from legally getting a job, while diagnosis and ongoing treatment are unbelievably expensive!). Consistently old tech is one of the major reasons I haven't been able to springboard myself off of my pension and get a job - I've always been incredibly fascinated with animation, the visual arts, 3D, etc, and I'm on computers that swap like mad if I have more than 3 or 4 browser tabs open.

Beyond these issues, there's the very tricky problem of the fact that Google isn't a startup, and I can't say I'm too enthused by the fact that it's generally frowned upon to want to define your own job title - I can see this stifling a lot of innovation (Google Reader, Google Wave, etc) that isn't an immediately apparent hit.

For perhaps obvious reasons I've grown up always looking at the long view, and Google's corporate culture seems to have a very short attention span.

Nobody is likely to ever read this but I thought I'd leave this here as a real-world example of why someone might not be a good fit for an environment like Google.

If someone from Google ever wants to prove me wrong I'd be very happy to hear about it! :D

</comment><comment><USER3> "It's Googley to stand up for diversity and inclusion, such as protesting against binary gendering on toilets"

This is BS.

99.99% of the world is find with the 'binary signage' on toilets, and it is absolutely not 'anti trans' or 'anti anyone else' frankly, to do so.

BTW - this is not like a 1960's movement - you're not in the 'right side of history' here. 'Binary Gender' is, and will always be normative, simply because almost everyone is binary, and is fine with it. The number of people who actually have issues with 'binary' is very, very small. Even most people who are trans are _still_ 'binary' (!) i.e. they identify as one gender or the other, not anything in between.

I somehow doubt that 'it's Googley' to be this, this may be a little bit of a stretch, or 'mis-articulation' by the author.

Though I don't have a problem at all with someone who is 'anti gender binary' (I don't really care) - I _do_ have a problem with a company that pushes social extremism as part of their culture. It's just more evidence of the culty behaviour at Google.

I make a hobby of studying cults. I used to go into the Scientology clinic to 'take the test' and kind of debate with them, to get an understanding of how they are. I used to read a lot of their stuff - not for the 'knowledge' but to grasp the nature of the organization.

These kinds of 'ideals' are actually far more about creating a coherent group, than projecting any ideals.

Google is a good company, generally, but they do some nefarious things with our data. One of the great things about having a 'we are morally superior' cult, is that any decision made by Google that can feasibly be considered unethical - won't be, using the internal logic of 'We don't do evil, so, what we are doing cannot be evil'.

Anyhow, it takes working at several companies for a while to start to figure this out.

<comment><USER53> For someone who doesn't care much about toilet signage, you sure care a lot about toilet signage.

<comment><USER3> You misread, or I miscommunicated my statement: I don't care about 'signage'.

If Google has a practical reason to have special signage, all the power to them.

I care about the 'social ethos unwittingly imbued on people' as a function of an aggressive culture.

The signage is an artifact of the culture, as implied by the author it's 'Googly', i.e. 'these are the values that we must have' \- which may have nothing to do with the workplace, but more to do with projecting ideology.

If an Atheist was required to have 'morning prayer' at a company ... would this be acceptable? I mean, why should an Atheist care? It's just a bunch of words that would effectively have no meaning to them? Of course, it wouldn't be right to have 'prayer', per say, as a 'cultural requirement' unless it was a religious org, or special in that manner. Imagine being the only one at your company who 'doesn't do it' ... you'd be the Black Sheep surely.

Google may have an over-representation of people with gender ID issues, and may very well just have some pragmatic solutions, like 'individual bathrooms' that are just marked as 'bathrooms'. This seems like a rather good solution to me, and avoids the ideological issues entirely. There's no argument needed, anywhere. But to specifically foster 'anti gender binary ideals' as part of the culture is wrong.

My guess is the author is projecting is own ideals onto what 'Googly' means.

Ask someone 'what Burning Man means' \- and you get 1000 different answers. Most of them 'authoritative'. :).

<comment><USER54> You sound like you're the one grappling with "gender ID issues".

<comment><USER3> There are other places for trolling and ad-hominem.

Moreover, you're likely unwittingly helping me make my point.

</comment></comment></comment></comment></comment><comment><USER55> >>For most people, this means coming to work some time between 9 and 11 AM (breakfast ends at 10 AM) and leaving between 5 and 8 PM (dinner starts at 6:30 PM). My schedule was a little different: I came to work between 9 and 10 AM and left between 12 and 2 AM. Yes, you read that right. I spent a lot of time in the office, to the extent that my co-workers asked me if I lived there.

This is the kind of devotion to work/study, I wish I could emulate. Especially, given his age, working for 8 hr on company work and then 6-8 hr on your personal work/study without getting distracted is amazing. He should, and he indicated would (which is good), not ignore the work/life balance.

Congrats and thanks for posting.</comment>


Scientists Trace Society's Myths to Primordial Origins - <AUTHOR> http://www.scientificamerican.com/article/scientists-trace-society-s-myths-to-primordial-origins/ <comment><USER2> How do we know these actually relate to the same original story and not to, say, the fact that there weren't quite so many things to do back then but look at stars and hunt, so there would be a lot of random stories about starts and hunting, along with other common elements of daily life?

<comment><USER3> Isn't the answer to this the same as the answer to Jung's hypothesis?

> "Myths are first and foremost psychic phenomena that reveal the nature of > the soul," Jung argued. But the dissemination of Cosmic Hunt stories around > the world cannot be explained by a universal psychic structure. If that > were the case, Cosmic Hunt stories would pop up everywhere. Instead they are > nearly absent in Indonesia and New Guinea and very rare in Australia but > present on both sides of the Bering Strait, which geologic and > archaeological evidence indicates was above water between 28,000 and 13,000 > B.C.

(So, the absence of Cosmic Hunt stories in New Guinea, Indonesia, and Australia would seem to be a counter to your hypothesis, unless for some reason we could explain why people in those regions thought less about stars and hunting.)

<comment><USER4> >the absence of Cosmic Hunt stories in New Guinea, Indonesia, and Australia would seem to be a counter to your hypothesis,

Following the genetics metaphor, the distinctiveness of the myth story in that region of the world is due to the isolation of the Australian continent that doesn't allow for a free-flow of genetic information from the rest of the world and therefore shows a loss of "cultural variation" because only a few "founders" whose consciousness at the time of their progeniting is not representative of the diversity of the global human consciousness. (Founder effect, [https://en.wikipedia.org/wiki/Founder_effect](https://en.wikipedia.org/wiki/Founder_effect))

Applying Biology/genetics as a metaphor for the transmission of human culture and ideas is actually an very dangerous and subversive idea, for instance, following this logic, the most popular religion or dominant culture is not necessarily the most useful to the host genome, but the best viral "meme" that can replicate itself while balancing its own replication vs. the viability of the host (e.g., a malaria that allowed the host and its transmission vector to slightly evolve partial defenses against it so that it too can survive and replicate or the benign Herpes simplex virus that has 90% penetration rate).

Human culture/consciousness has lots of garbage, "non-coding" regions that a virus can replicate its repeat sequences onto the collective consciousness like say Kim Kardashian's sex tape in our non-coding region for entertainment, but mutating the essential "coding" regions is trickier, like knocking out the urge to procreate (see the downfall of the Shakers variant).

Perhaps a much more hopeful idea is that should a virus really turn from benign to virulent, evolutionary pressure bears down on an otherwise complacent population to select for the best defense against it; until this cultural idea is eliminated or the specie is and thus the cycle repeats as Nature allows for the next host or the virus take over the vacated niche.

<comment><USER5> > for instance, following this logic, the most popular religion or dominant > culture is not necessarily the most useful to the host genome, but the best > viral "meme" that can replicate itself while balancing its own replication > vs. the viability of the host (e.g., a malaria that allowed the host and its > transmission vector to slightly evolve partial defenses against it so that > it too can survive and replicate or the benign Herpes simplex virus that has > 90% penetration rate).

Many religions (in particular Islam and Christianity) strike me as being just that. They have features that make them viral (through proselytising, and sometimes forced conversions), and make it hard for their hosts to get rid of them (due to social pressure and penalties against apostates). These features are integral to the success of the religion, and are hidden under mythological/theological disguise.

The myths act as a vector, and these "features", which are behaviours that can be very complex (running a religious court system, enforcing those laws, proselytising), are effectively the payload of the virus. They turn society into a machine to spread the religion further and protect it, even if this comes at the cost of other achievements (technological progress, greater equality between demographic groups...).

</comment></comment></comment></comment><comment><USER6> Here's a link to one of the author's academic papers with detailed description of methodology:

[https://halshs.archives- ouvertes.fr/halshs-00932197/file/A_2...](https://halshs.archives- ouvertes.fr/halshs-00932197/file/A_2013.10._A_Cosmic_Hunt_in_the_Berber_sky_- _Les_Cahiers_de_l_AARS_16_93-106.pdf)

</comment><comment><USER7> Makes me think of Joseph Campbell's work on the Power of Myth[0].

[0] [https://www.youtube.com/watch?v=aGx4IlppSgU&list=PLePFb3rlFb...](https://www.youtube.com/watch?v=aGx4IlppSgU&list=PLePFb3rlFbw4G1aPfn-9HIH5epz0vFXKq)

</comment><comment><USER8> Look at the actual tree chart "Genealogy of Myths". There are numerous Algonquian, Iroquoian, and Inuit examples from northeastern North America, a number of examples from southeastern North America, and a small cluster of cultures from Siberia and the Russian Far East. A common myth transmitted through North America and possibly the Russian Far East is very plausible—we have multiple lines of evidence of cultural transmission among the preColumbian cultures of North America, including language, technology, and other beliefs.

Outside of that sphere? There's two Tuareg examples from North Africa, two Basque examples, and the Greek myth, which is represented by four(!) individual writers. It's certainly possible that there was some transmission of this myth around the Mediterranean, but... The Greek myth is apparently closely related to the Ojibwe example from the Great Lakes region(?). Let's also note that there is no other evidence of any cultural transmission between these groups and North America before the modern era. This is very implausible.

Cultural practices can be invented as well as transmitted. How implausible is it that these represent independent inventions? Well, it's _very_ common to relate constellations to animals, heroes, or divine beings. The constellations naturally follow each other through the sky, over the course of a night and over the course of seasons. Hunting was a primary subsistence activity in every pre-agricultural culture. These are not ideas that are hard to tie together.

Note also the likelihood of chance resemblances between languages. [http://www.zompist.com/chance.htm](http://www.zompist.com/chance.htm)

<comment><USER9> It's not unreasonable that there should be similar stories, given the ubiquity of hunting culture and the brilliant night skies. But consider the number of visible stars and the possible patterns they might be grouped into, and the number of possible interpretations of those patterns. It seems highly unlikely that both the Greeks and the Iroquois would independently group the stars we call Ursa Major into a single constellation associated with a bear. To the modern eye, it looks nothing like a bear, and the stars comprising it might be split into any number of combinations to make other constellations. It seems much more likely that either there was some kind of communication between the two cultures, or that they shared a common mythological origin that preceded both: the article's 'proto-myths', accompanied by proto-astronomy.

<comment><USER8> Ursa Major is a very common constellation. It's identified in many way by many cultures: it's also common it identify it as a plow, cart, or wagon. To me it's just the Big Dipper.

This is sort of like the birthday problem in statistics: It's overwhelmingly unlikely that two specific cultures would at random choose precisely the same identification. But it's extremely likely that of all cultures, there are two would choose the same identification.

Real evidence of cultural contact between Ancient Greece and the Ojibwe would be a major breakthrough. But this is just random similarities.

</comment></comment></comment><comment><USER10> Great article - I shared it with a WeChat history group here in China, and the reception was great. It's being deployed to Chinese world history students this week. Also, lovely to see some leading work from the Sorbonne. Yay France!

</comment><comment><USER11> > Reptiles, immortal like others who shed their skin or bark and thus > rejuvenate, are contrasted with mortal men and/or are considered responsible > for originating death, perhaps by their bite. In this context, a person in a > desperate situation gets to see how a snake or other small animal revives or > cures itself or other animals. The person uses the same remedy and succeeds.

Interesting. In the epic of gilgamesh (one of the oldest tales preserved in written form) it is the protagonist who seeks immortality and then has the plant which is supposed to grant it stolen by a snake which then sheds its skin.

</comment><comment><USER12> I don't see the connection between biologists analyzing DNA (very precise and objective) and someone analyzing different versions of stories. With stories, which aspects you focus on and how you score similarity are highly subjective.

Can anyone who knows about the technique elaborate?

</comment><comment><USER13> Looks more like cold reading to me.

And to make it worse they would have been translated with a modern viewpoint.</comment>


Should I get a Raspberry Pi or an UDOO? - <AUTHOR> http://www.hackthings.com/should-i-get-a-raspberry-pi-or-an-udoo/

<comment><USER2> Raspberry Pi is a much more proven platform for serious hardware developers

<comment><AUTHOR> Are you saying proven because it is built better or proven because it's been around for longer and has more documentation ...etc?

I find UDOO (ideally) as a great platform to start, given that it seems to come with a lot more connections to hardware. However, the lack of any documentation makes it a bit hard to start.

Although, they do have a skematic for the tech, so technically I should be able to figure it out ... if only I had a spare day or two to spend on it :(

<comment><USER2> I would say mostly the latter (been around longer, more docs, etc). Power consumption on RP kind of sucks though</comment></comment></comment>


China to Launch Initiative to Set Global Data-Security Rules - <AUTHOR> https://www.wsj.com/articles/china-to-launch-initiative-to-set-global-data-security-rules-11599502974 <comment><USER2> It'll be interesting to read the sections on code and technology sharing.</comment>


Ask HN: How will software contractors be impacted by recent changes to CA AB5? - <AUTHOR> California AB2257 [1], which is in effect immediately as of September 4, is a substantial revision [2] to CA AB5. Does anyone know how these new changes will impact software contractors?<p>[1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201920200AB2257<p>[2] https://www.calpeculiarities.com/2020/09/08/ab-2257-sweeping-changes-to-ab-5-independent-contractor-law <comment><USER2> I'm not an expert on any of this, but I've been keeping a close eye on the legislation as I make most of my income as a contractor. From what I can surmise, there is still a lot of confusion among everyone, including lawyers, on how the language in the bill should be interpreted. They are supposed to be having webinars to help the public understand the impact it will have on them, but I have no idea when those will be or where they would even post that information.

Sorry I can't help you more, but keep an eye out for any info on the webinars.</comment>


Ask HN: Why does Apple say 0.99 cents but charges me $1.00 on my statement? - <AUTHOR>

<comment><USER2> Because they know you suck at maths.

</comment><comment><USER3> Wow, they're overcharging you more than a hundred-fold?!</comment>


Ask HN: Where to start reading on security? - <AUTHOR> I'm a CS student right now thinking about specializing in security. The problem I have, however, is that I don't know enough about security to know on which particular areas of security I want to focus. I only know enough to realize that it is in of itself a quite diverse field.<p>My question for all the security guys that hang around here is this: what books or blog should I start with if I want a general introduction to the field? I could just wait for the intro level course at my university, but I like to give myself a head start (especially on introductory courses) as I find that the repetition of teaching myself and being taught in class gives me a much more solid foundation in the material. <comment><USER2> You're looking for this page on HN:

<http://news.ycombinator.com/user?id=tptacek>

Particularly the link that says "reading list."

<comment><AUTHOR> Awesome, thanks a ton. The Amazon link is pretty much the mother lode.

<comment><USER3> To it, I would probably add "The Tangled Web" by Zalewsky.

</comment></comment></comment><comment><USER4> I really liked the "Stealing the network" book series. While it is fictional, the attacks are very realistic and there is much to learn from, even if its a bit outdated.

For me, understanding the attacker mindset is what makes a good security professional.

</comment><comment><USER5> I enjoy listening to the Security Now podcast with Steve Gibson. He gives a great overview every week of the security issues/patches/exploits and also goes in depth into a variety of security related topics. His explanations are always easy to understand and interesting.

<http://www.grc.com/securitynow.htm>

<comment><USER6> It's hard to say this without sounding like one of those condescending security people, but I highly recommend avoiding that guy.

<http://attrition.org/errata/charlatan/steve_gibson/>

To balance that with something constructive, if you are already comfortable with software development, I'd suggest checking out these to get started with playing around:

[https://www.corelan.be/index.php/2009/07/19/exploit- writing-...](https://www.corelan.be/index.php/2009/07/19/exploit-writing- tutorial-part-1-stack-based-overflows/) \- Part 1, they go to 11.

<https://google-gruyere.appspot.com/> \- for web app sec

<comment><USER5> Those are some great links. Do you follow any security related podcasts? I don't work in security but like to stay relatively up to date.</comment></comment></comment>


XCode Server for Developer Collaboration in Mavericks - <AUTHOR> http://www.apple.com/osx/preview/#server

<comment><AUTHOR> This could be a bundled Gitorious, but I didn't see it in the open source software list.</comment>


South Korea rules pre-installed phone bloatware must be deletable - <AUTHOR> http://www.zdnet.com/south-korea-rules-pre-installed-phone-bloatware-must-be-deletable-7000025533/

<comment><USER2> I love how it seems like any country but the US has relatively sane consumer protection laws.</comment>


Android Steals Market Share from iPhone - <AUTHOR> http://www.readwriteweb.com/archives/android_steals_market_share_from_iphone.php?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+readwriteweb+%28ReadWriteWeb%29 <comment><USER2> I love seeing the same data repeated over and over and over with no new analysis over the last time I read it. Especially when the data has been available and has been being talked about for a month now...

<comment><USER3> How did they manage to get the figures for May a month ago?

edit: deleting this bit as I extrapolated a trend wrongly, got my years mixed up.</comment></comment>


Ask HN: What is "Windows xp Vienna edition"? - <AUTHOR>

This just popped up on Google+: https://plus.google.com/110874052187807174275/posts/GhskmTWHayx it refers to an allegedly free downloadable xp install with a specific skin all sp integrated. Is this legit? Anyone looked into it to use for example in a VM image? <comment><USER2> the getintopc.com claims its a "license: free trial" so whatever that means referring to xp</comment>


A Call to End the Use of "Lol"  - <AUTHOR> http://thoughtcatalog.com/2010/stop-saying-lol/

<comment><USER2> I thought "lvml" sounded like a markup language, but it turns out that emotionml already exists and should fit our needs. [http://www.w3.org/2005/Incubator/emotion/XGR- emotionml-20081...](http://www.w3.org/2005/Incubator/emotion/XGR- emotionml-20081120/)

Therefore, to fight back against the vagueness and possible misinterpretation of Internet slang, I propose that in the future "lol" be replaced by something like the following:

      <emotionml xmlns="http://www.w3.org/2008/11/emotionml">
        <emotion>
          <modality mode="face"/>
          <category set="everydayEmotions" name="amusement" confidence="0.8"/>
          <link role="experiencedBy" uri="file:john.vcard"/>
          <link role="expressedBy" uri="file:johnsParty.avi" start="10s" end="15s"/>
          <link role="triggeredBy" uri="file:guestList.xml#numberOfGuests"/>
        </emotion>
      </emotionml>

<comment><USER3> all the cool kids are using emoSON these days.

</comment></comment><comment><USER4> There is actually no other word in literary language that conveys the full meanings of lol. It is here to stay!

</comment><comment><USER5> lolz, if anything "lol" is gaining traction among the internet generation. I work with a bunch of geeks my age or younger, and several of them actually say "lol" irl when they think something is funny, usually accompanied by actual laughter.

<comment><USER6> Among non-geek german kids "lol" works almost like a normal adverb in everyday conversation...

</comment></comment><comment><USER7> Even better than this article is the author's call in the comments to stop using "fag" and "faggot" and replace it with "sag" and "saget"; references to the Full House character.

"You're such a saget"

I could get used to that.

</comment><comment><USER8> I have spent way too much time in ironic internet communities and "lol" is still popular. Tone is mainly an issue of character development. The cool people will understand when you are being ironic based on knowing who you are. This is only possible in actual communities with a limited number of regulars where people pay attention to usernames, avatars, and individual posting styles. In places like Reddit or HN where you are effectively just another anonymous poster, that character development is sort of impossible, restricting your communication options to something generic and official. If there was any interest in changing this, allowing us to add an icon next to our posts would dramatically increase user recognizability on HN.

On the SomethingAwful forums, only the lame (but very popular) boards such as "General Bullshit" require that you type with proper capitalization and punctuation, and will actually punish you if you use "lol". The relaxed and more communal boards typically type in all lowercase and acronyms are common. Yes there's a hint of irony in even using the acronyms but they are still not going anywhere.

</comment><comment><USER9> Back in '95 when my wife and I were dating, we didn't have a lol. Most of the campus was vt220s hooked up to a VAX, local chat was done with a DCL command called 'phone'. To simulate laughter we would mash random characters from the home keys. The longer the string, and the farther out from the home keys, the harder the laugh.

I don't know, I still think it's a more expressive way to laugh in a terminal.

<comment><USER10> Not a LOL but you got a giggle out of me.

</comment></comment><comment><USER11> You do not, and you ABSOLUTELY DO NOT question tradition. Today it's 'lol', tomorrow you'll want to end christmas.

</comment><comment><USER12> Am I the only one who finds LVML weird ?

</comment><comment><USER13> I lol'ed when it was still cool.

</comment><comment><USER14> lol

</comment><comment><USER15> tl;dr: lol -> lvml

</comment><comment><USER16> lvml

</comment><comment><USER17> roflmao

</comment><comment><USER18> At first I was like huh? But then I LoL'd!</comment>


Why 'Be Passionate' is Awesome Advice - <AUTHOR> http://don.blogs.smugmug.com/2010/11/10/why-be-passionate-is-awesome-advice/

<comment><USER2> I posted this yesterday on the Inc thread but it got lost in a sea of comments so I'm reposting it here (with modifications for context):

I think passion is generally stupid for a couple reasons. First off, we use it as a defense mechanism. "If I am passionate, I won't care about failure because I'll be doing what I love!" Not only will you have a hard time pivoting or calling it quites all together but this mentality already sets you up for failure on a bunch of other levels.

Secondly, how many people have been passionate about their projects that ended up failing? We tell ourselves to be passionate because Zuck was passionate about Facebook or the Groupon guys were passionate about their project, if we're passionate about ours WE CAN'T FAIL!

We don't need passion to succeed, we need brains to succeed. Think critically about what you're doing and you'll be way better off then loving your dumb idea into the ground.

# End paste

Based on the authors article, I get that he was in the "I'm passionate and I don't really care about success" category. Well, if that's what you want then go ahead -- you were lucky and kind of successful (by some standards), not everyone gets that. But most people actually DO want success, so you shouldn't let your silly passion get in the way.

<comment><USER3> Out of curiousity, have you tried doing something on your own that you were not passionate about? I know that my efforts when my heart wasn't totally "in to it" felt really... crappy. Despite all of my best efforts and intentions.

Passion is the fuel that you burn when attempting a startup. If you run out of passion, you run out of gas... and it's hard to get far when you've got no gas.

Dig?</comment></comment>


500000 server, router, and IoT passwords leaked - <AUTHOR> https://www.zdnet.com/article/hacker-leaks-passwords-for-more-than-500000-servers-routers-and-iot-devices/ <comment><USER2> Why for kreisch sake is anyone still using telnet for anything?</comment>


Ask HN: Notebook Recommendation - <AUTHOR> I am looking to get a new notebook/laptop/.. next year and I am not sure what to get. The thing is that my current one is working just fine but the manufacturer, MSI, no longer provides drivers and I have some fan issues due to that as well as I sometimes experience lagging when the bus on the motherboard is beig used up to the limit. So the next one should be made by manufactuer that will provide drivers for at least 10 years after purchase and it should have a solid motherboard with plenty of good/high performing parts so I can do things on the background and not have my usb mouse lagging or things like that.<p>So which manufactuer would you recommend and which chipset/motherboard configuration? <comment><USER2> I can recommend Thinkpads. I am very happy with my T495.

It is a solid piece of hardware, really nice keyboard and probably has the best support for Linux. I heard they used to send their new laptops for free to kernel developers to ensure solid support.</comment>


StumbleUpon sends more traffic to US websites than Facebook - <AUTHOR> http://gigaom.com/2011/07/05/stumbleupon-unseats-facebook-traffic-driver/

<comment><USER2> how is this possible? I don't know anyone who uses StumbleUpon... do you?</comment>


Google Faces Age Discrimination Suit - <AUTHOR> http://www.theregister.co.uk/2016/10/06/google_faces_age_discrimination_suit/ <comment><USER2> "I want to stress the importance of being young and technical," he said. "Young people are just smarter. Why are most chess masters under 30? I don't know. Young people just have simpler lives."

I imagine that lawsuits not far off.

</comment><comment><USER3> I'm very interested to see how Google will defend themselves in this suit and what numbers they'll show to prove otherwise.</comment>


Hacking Team steals €10K in Bitcoin, sends to Kurdish anticapitalists in Rojava - <AUTHOR> http://arstechnica.co.uk/security/2016/05/robin-hood-hacker-rojava-syria-bitcoin-donation/ <comment><USER2> Title should actually be 'Hacking Team hacker' (as in, the guy who hacked Hacking Team - 'Phineas Phisher').

</comment><comment><USER3> Will be interesting to find out where this was hacked from. Based on his previous hacks and ideology he doesn't seem the type to steal from an exchange, however a tor based market or other shady online enterprise, perhaps even blackhats who steal bitcoin have been hacked.</comment>


BlueSteal: Popping GATT Safes - <AUTHOR> https://www.twosixlabs.com/bluesteal-popping-gatt-safes/ <comment><USER2> So to be fair I find the idea of a "blue tooth connected gun safe" to be something of a weird product to begin with. I think that because I believe a gun safe serves two purposes; Keeping kids (and others in the house) from getting access to a gun, and making stealing the gun more difficult or less useful.

That said, given that I have been approached by, and on occasion done work for, manufacturers who wanted to add some additional "techno" flair to their existing product, I have seen requirements documents which were painfully thin on measurable security requirements. It does not surprise me at all that the implementation of this system was functional and from a security perspective quite flawed. What would surprise me is that the company learned from that and actually upgraded their requirements generating process.

</comment><comment><USER3> Pretending to use encryption when you don't is pretty damning. Everything else can be blamed on incompetence but it seems hard to imagine that they thought they were using AES256 when they aren't.

<comment><USER4> I have always believed ALL the BlueTooth connections are encrypted strongly too. And this is why I thought BlueTooth keyboards are safe while common non- BT wireless keyboards can be easily sniffed by a neighbour.

<comment><USER5> Bluetooth <> Bluetooth. There are (about) 37 distinct profiles [0]. One of these is HID (Human Interface Device Profile) Keyboard and keypads must be secure. For other HIDs security is optional.

[0] [https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles](https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles)

</comment></comment></comment><comment><USER6> What kind of a world do we live in where a gun safe requires a firmware update to patch a security vulnerability?

<comment><USER7> Don't trust electronic locks.

Years ago I got a safe that wasn't one of the top-end models of its line. In particular, the manual said that it only had one combination slot.

But other models had more premium features, such as multiple combinations, "master" and "slave" combos, etc. -- I acquired the manual for them, and sure enough, these features were present on my cheaper model, with default combinations. My guess is that anyone could walk up to one of these safes in someone's home and open it within seconds.

I assume this is well known in the industry. I also have to assume that there are additional hidden combinations, meant for manufacturer convenience, or put there with a wink and a nod to the police, or installed by unscrupulous firmware engineers.

<comment><USER8> Exactly. This sort of thing is why nobody who owns or uses guns has much interest in so-called "smart guns". A real security audit on what they're supposed to accomplish and how they would physically work will show that it's not a very effective idea.

</comment></comment></comment><comment><USER9> BLE isn't actually totally secure in any mode except OOB pairing, which is only supported on Android, and only via NFC.

Kind of ridiculous really. I'm pretty sure they didn't make any attempt to fix the issues in Bluetooth 5 either.

<comment><USER10> What can you do to ensure security on a BLE connection? Do your own key exchange and encrypt on top of the BLE layer?

<comment><USER9> Yeah the only way really is to totally reimplement your own key exchange and encryption on top of unencrypted BLE. That is an absolute mountain of work though, unless you happen to have an uncharacteristically powerful BLE device. I seriously doubt anyone would ever attempt it. Maybe Google would, but last I looked at their IoT stuff they still hadn't got around to supporting BLE at all so...

I think the best compromise is to use "just works" pairing which doesn't have any flaws that I know of, but allows MitM by design. And then add a QR code so you have at least some vague protection against connecting to the wrong device.

Oh also there is a 'numeric comparison' authentication method but it requires your device to have a screen, which is not very common.

<comment><USER10> Okay so I'm implementing a device which connects to Wifi, and I'm using BLE to hand off Wifi creds from a phone app to the device. This is based on the esp32 chip. They actually have something similar to what I described that they call "blufi" but it's poorly documented and seems difficult to use:

[http://esp-idf.readthedocs.io/en/latest/api-reference/blueto...](http://esp- idf.readthedocs.io/en/latest/api-reference/bluetooth/esp_blufi.html)

Right now I'm just using the "just works" pairing as you've described. A QR code might be a good addition to that, though the product then needs a unique sticker for each device which is kinda lame. Without the QR code, the threat model is basically someone eavesdropping on the connection and discovering the Wifi credentials when the user first sets up the device. Not the worst but still not great...

<comment><USER11> Why use BLE instead of wifi? That's what most devices do (especially with the ESP8266, which doesn't support BLE).

<comment><USER10> That's a good question, actually. As far as I'm aware, it's not particularly well supported to programmatically connect to another access point, but that may have changed recently.

But that aside, using BLE seems like a better user experience. There's no changing of the user's currently connected access point, and it _might_ be faster, though I haven't tested.

If I can make the setup over Wifi completely transparent to the user then that would be acceptable for me. I actually don't own any ESP8266-based devices, maybe I should buy one and see how it is.

<comment><USER11> I don't think the ESP8266 wifi story is different from the ESP32, but it might be. You do have to connect to another access point, yes, but if you have an Android app, the app can handle that itself. I think the iOS UX is a bit worse, though, so BLE might be worth it there.

A lot of firmware for the ESP8266 has been using the access point method, and it's worked great all the times I've tried it.

<comment><USER10> Yeah the Wifi story is pretty much the same between the two chips. I agree about Android, I don't think I'd have much problem configuring it there, but my first focus is on iOS. There seems to be some better support for that in iOS 11 though:

[https://developer.apple.com/library/content/qa/qa1942/_index...](https://developer.apple.com/library/content/qa/qa1942/_index.html)

So that might be a good option in the near future!

<comment><USER11> Ah, great, because when I last looked at an iOS device, the user had to switch between the WiFi network manually, which was a hassle.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Very informative walk-through of a BT security analysis. Thanks for including links to tools and clear code snippets.</comment>