Ask HN: Legalities with creating a startup? - <AUTHOR>

Hi HN, I've been lurking and reading posts for a while, but finally decided tonight to make an account and my first post. A few days ago I came up with a marketable service, and have since decided to make a startup, but I'm unsure as to what I need to do legally in order to make this legitimate. I'm sure that part of this is surely relative to the state I live in, but are there some de facto tax forms or something I should be filling out? I'm very new to anything like this, and am willing to accept any sort of resources available. Thanks! <comment><USER2> If it is truly a service with no actual product, you need to incorporate, A good accountant will charge you around $500 to set it up and can guide you to the best set-up for what you will be doing. If you have to build something first then build it before you do anything. If you can't swing $500 then there are some online sites that will do it for cheap, just understand that they provide no legal or accounting advice. If you go that route, be safe and file an SCorp, you can change it later, but it is the best one for the little guy just starting out. You may need to get a local business license, depending on what you are doing.

<comment><AUTHOR> I plan on offering both a product and a service related to it. After reading a little, a LLC seems like the best option for me. The articles of organization only run for $125 in my state, and it doesn't appear I need to fill anything else out other than that.

<comment><USER2> be careful, with an LLC you will be responsible for paying 15.3% more taxes than an S-Corp. The S-Corp is the only one that reduces employment tax liabilities. As well, if you ever think that you will entertain bringing on investors you will have to form a S or C and buy out the LLC.

<comment><AUTHOR> Ah, interesting. I assume that this is the only major difference between S-Corps and LLCs? I hadn't even heard of them until you mentioned, I'll look into it further.

</comment></comment></comment></comment><comment><USER3> The Nolo Press catalog contains several helpful books on the topic. (I've no affiliation or stake in them - just like their stuff.)

<comment><AUTHOR> Wow, taking a look and it seems pretty comprehensive. Thanks, this is probably going to make for good reading material.</comment></comment>


Ask HN: any successful start-ups started by non-technical founders? - <AUTHOR>

Please let us know which companies are successful today that were started by non-technical founders. <comment><USER2> It's a bit of a stretch, but you could put Jeff Bezos into this category. He's obviously a very smart and generally technically-inclined guy, but I don't think he was ever particularly involved in the technical side of Amazon.com.

<comment><USER3> More than a bit of a stretch; from Wikipedia:

" _Bezos showed intense and varied scientific interests at an early age. He rigged an electric alarm to keep his younger siblings out of his room and maintain his privacy. He converted his parents' garage into a laboratory for his science projects. [...] While in high school, he attended the Student Science Training Program at the University of Florida.... He entered Princeton University, planning to study physics, but soon returned to his love of computers and graduated summa cum laude, Phi Beta Kappa with a degree in computer science and electrical engineering._ "

His first set of jobs were also in CS, networking, etc.

I think it's no accident that Amazon is the leading cloud computing provider.

<comment><USER2> Hence my comment about him being obviously technically inclined. He has the skills of both a technical guy and a business guy; my point was that with Amazon he was playing the non-technical role, in spite of his technical qualifications.

<comment><USER3> Well ... we're getting to the point of quibbling; I just wanted to show he was more than "generally technically-inclined".

</comment></comment></comment></comment><comment><USER4> Hmm... yes Sridhar Vembu of Zoho. He wasn't a single founder though. He also acted as their offshore marketing guy in the beginning.

Atleast thats what I know from the recent Mixergy podcast

</comment><comment><USER5> Sam Morgan - NZer who created an EBay type site for himself back in the day by hiring a coder to build it. Sold it a couple years ago for $750M or so.

</comment><comment><USER6> I think what you are seeking is technology start-ups founded by non-technical founders -- not just start-ups in general.

</comment><comment><USER7> Wikipedia, Xing

</comment><comment><USER8> digg, Myspace

</comment><comment><USER9> Gilt Groupe</comment>


Facebook former Messenger boss calls WhatsApp cofounder new standard of lowclass - <AUTHOR> https://www.theverge.com/2018/9/26/17906844/facebook-david-marcus-calls-whatsapp-brian-acton-low-class <comment><USER2> Is David expecting Acton to show gratitude that Facebook bestowed him billions of dollars? Did Facebook do charity or was it doing business purchasing WhatsApp? If you believe in markets, then Facebook purchased WhatsApp by paying what they considered a fair value to keep it off the hands of Google. They paid a pretty penny but it is all business.

Also, walking away from ~ $850 mil and investing time and money into Signal speaks a lot about Brian's commitment to privacy. He admits he was a sellout. He didn't mince words but David's last paragraph, Facebook being all about people but not about selling-things/entertaining/helping-find-information is disingenuous. Facebook is all about sucking in people's attention, so they can sell ads. They want to suck as much information about people as possible; entertain you as much as possible with mindless video and photo sharing. There is nothing wrong with a business making money. David shouldn't delude himself and others into believing Facebook is holier than almost any other business. I guess, he has to keep up the pretenses as an exec. sigh!

<comment><USER3> If he was so principled, he shouldn't have sold his business to a company who's principles are exact opposite of those of his own. And then be sour when they provide liquidity of said business, unable to prove his ideas, and then attacking the company afterwards.

It's obviously good he found a place where his own principles are more inline with the company.

<comment><USER4> He admits freeely that he sold out and has expressed public regret for doing what he did. He's also committed something like 1 billion dollars to charity and drives a minivan.

All things considered, seems like a pretty good dude who saw an opportunity to create enough wealth that 10 generations down the line will be taken care of and he took it. Can't say I would do any different and I doubt many others would either.

</comment></comment></comment><comment><USER5> He said "attacking the people and company that made you a billionaire..."

That was where the Facebook guy lost me. When he took credit for them becoming billionaires.

What made those founders billionaires was their own product insights, good engineering and management, and hard work. Erlang FTW. Yes Facebook converted the value to fungible stocks, but they created that value, not Facebook.

<comment><USER6> According to that Forbes article on the front page, WhatsApp was speaking to Google hence Facebook's huge offer and promises of monetization.

In other words, they'd be billionaires regardless and this guy is a prick

</comment></comment><comment><USER7> > For example, WhatsApp founders requested a completely different office > layout when their team moved on campus. Much larger desks and personal > space, a policy of not speaking out loud in the space, and conference rooms > made unavailable to fellow Facebookers nearby. This irritated people at > Facebook, but Mark personally supported and defended it.

Unless I am misinterpreting this, Brian and Jan negotiated for and received a separate working environment for the Whatsapp team where they could avoid some of the pitfalls of Facebook's open plan office and actually get work done without interruption. That David seems to be suggesting this as a criticism says a lot.

On a completely unrelated topic...I am reminded of a quote by the writer, Upton Sinclair: "It is difficult to get a man to understand something when his salary depends upon his not understanding it."

<comment><USER8> Their part of building 10 was apparently wildly different. Huge desks. Off- limits rooms (not that I ever tried to use them).

This, when FB proper was shrinking desks from 5' to 4' and removing gaps to create looooong rows.

People definitely noticed.

<comment><USER9> Noticed as in "why am I being treated like cattle?"?

<comment><USER8> Mooo. (Yes.)

</comment></comment></comment></comment><comment><USER10> This sentence right here is incredibly vague:

> Marcus also accuses Acton of "slow-playing" the implementation of a feature > that would let businesses message WhatsApp users and ultimately help with > monetization.

What does "monetization" mean? Charging more? Ads? Selling user data? If it means ads or selling user data, then that would directly violate the contract that Acton and Facebook agreed to, and thus Acton would have zero reason to implement it _at all_.

<comment><USER11> Brian advocated a particular business model for monetizing WhatsApp:

> For his part, Acton had proposed monetizing WhatsApp through a metered-user > model, charging, say, a tenth of a penny after a certain large number of > free messages were used up. "You build it once, it runs everywhere in every > country," Acton says. "You don't need a sophisticated sales force. It's a > very simple business." [0]

David is saying that Brian, though advocating for this model and against the alternative of monetizing data, didn't put in any effort to demonstrate this model was workable:

> During this time, it became pretty clear that while advocating for business > messaging, and being given the opportunity to build and deliver on that > promise, Brian actively slow-played the execution, and never truly went for > it. In my view, if you're passionate about a certain path — in this case, > letting businesses message people and charging for it — and if you have > internal questions about it, then work hard to prove that your approach has > legs and demonstrate the value. [1]

[0] [https://www.forbes.com/sites/parmyolson/2018/09/26/exclusive...](https://www.forbes.com/sites/parmyolson/2018/09/26/exclusive- whatsapp-cofounder-brian-acton-gives-the-inside-story-on-deletefacebook-and- why-he-left-850-million-behind/)

[1] [https://www.facebook.com/notes/david-marcus/the-other- side-o...](https://www.facebook.com/notes/david-marcus/the-other-side-of-the- story/10157815319244148/)

</comment></comment><comment><USER12> It's amazing how out of touch employees of advertising spyware companies like this David Marcus fellow are. I guess they have to lie to themselves that they're doing something, anything good, otherwise they'd go crazy from the cognitive dissonance.

Acton should get over his guilt, ignore the corporate attack puppies and use those billions to fight against the Facebooks of this world.

<comment><USER13> I also had to laugh out loud when I came across this statement:

 _Facebook is truly the only company that's singularly about people._

Switch of the fucking ads and the stock price goes to zero.</comment></comment>


Mario is hard, and that's mathematically official - <AUTHOR> http://www.newscientist.com/article/mg21328565.100-mario-is-hard-and-thats-mathematically-official.html

<comment><USER2> Having certain subset/derivative of a game NP-hard is orthogonal to it being difficult for humans to play.

<comment><USER3> I'd like to see an example situation to make this point. We'd need something that is "NP-hard" but which is laughably easy for a human to deal with. I've no ideas though.</comment></comment>


Ask HN: Is it dumb to line up your code eg. semi-colons - <AUTHOR> At this time this is the worst for me with CSS, I keep ligning up my colons so they're all aligned (per group eg. a class)
I also do this with arrays/general assignments (aligning equal signs) I think I understand this doesn't matter for compiling, regarding minifying these spaces would be a waste.
I do feel the "slow-ness" when I'm sitting there banging away at the space key. I use 2-character spacing instead of 4.
I don't know it looks good to me... I'm just wondering if I should get rid of the habit.
Example:
CSS
.square {

  position         : relative;

  width            : 300px;

  height           : 150px;

  display          : flex;

  align-items      : center;

  justify-content  : center;

  background-color : white;

}
 <comment><USER2> While it seems nice and neat at first, it can easily become messy because inevitably you'll end up with a long property name that messes up the style. Say you want to round the top borders. You either end up with an additional 7 space wide alignment:

        .square {
          position                : relative;
          width                   : 300px;
          height                  : 150px;
          display                 : flex;
          align-items             : center;
          justify-content         : center;
          background-color        : white;
          border-top-left-radius  : 10px;
          border-top-right-radius : 10px;
        }

Or you end up with an inconsistent alignment:

        .square {
          position         : relative;
          width            : 300px;
          height           : 150px;
          display          : flex;
          align-items      : center;
          justify-content  : center;
          background-color : white;
          border-top-left-radius : 10px;
          border-top-right-radius : 10px;
        }

If you go for inconsistent alignment, where is the cutoff? I eventually broke myself of the habit trying to align the right side. It's too much effort to manage for something trivial.

<comment><AUTHOR> Yeah that's the problem, you add a longer property and then oh no, gotta go back and bang in the space key some more. Oh man...

Even variable declarations and JSON? I don't know...

The problem too is when you work on other people's code spaced differently and no alignment at all. Damn.</comment></comment>


Brown Dog – Parts Unknown - <AUTHOR> https://medium.com/parts-unknown/brown-dog-6a8b2a65f177#.6w0srn4hc <comment><AUTHOR> First house I lived in, you could go out to the front yard and see the Sweetgrass Hills, up straddling the Canadian border, 90 miles away. Look to the west, see the mountains, shining in the morning. Unless you couldn't see them, in which case you better be indoors.</comment>


Dumbass Government - A repository and search engine of government blunders  - <AUTHOR> http://dumbassgovernment.com/

<comment><USER2> This makes me uncomfortable. Disregarding the fact that you use terms like "lamestream media" un-ironically on your blog, your point seems to be "all government is bad". The basis for this? "Look at all the stupidity."

While I agree that government stupidity abounds, it's unfair (and intellectually dishonest) to disparage it categorically. In a random I.T. department there may be broken policies carried out by incompetent people but nobody ever thinks about all the things that are working properly due to other people's hard work and attention to detail; they fixate on things with "easy" or "obvious" fixes.

People love incredible stories, and there are plenty of tales of stupidity both inside and outside of government. But you didn't call your site "dumbass human beings" because that isn't pejorative enough towards government. In this way you expose your bias and make me extremely skeptical about your politics.

<comment><AUTHOR> I didn't make the site, but I think it's a good site to have. I think the idea is that it just makes it easier for people to find examples of government making mistakes-- and government makes mistakes consistently. And I acknowledge that the plural of anecdotes isn't proper proof-- but it works on a lot of people.

Personally, I have tried to use principles to argue against government and people throw anecdotal excuses back at me. (For example: It's been proven that the existence of a minimum wage reduces employment in low-skilled workers <http://www.youtube.com/watch?v=j0c2vmFGbtk> )

There is a lot of bias in the article summaries though. :/

<comment><USER3> Civilian, the site is definitely biased, but not partisan. It's biased in favor of personal liberty and meritocracy, yes. But it's not anti-government or anarchist.

The idea behind DAG is that you can quickly spot where the trouble areas in government are, be they people or bureaucracies. If the site has wide enough readership, being named on DAG could eventually become a political scarlet letter.

<comment><USER2> You're correct that it's not "anti-government" but pretending that it has much intellectual, political, or literary merit is "anti-critical-thinking".

If TheDailyWTF.com was instead called "Dumbass Programmers" and promised to help people "quickly spot where the trouble areas in programming are" it would be simplistic to the point of tedium. The real problems are not simply a matter of someone being a "dumbass", that analysis is just self-serving pablum.</comment></comment></comment></comment>


Ask HN: Who Plays Go? - <AUTHOR> I play on http://www.gokgs.com/ sometimes, with the same name.
I'm not super incredible (maybe 2 dan). At my peak, when I was studying in Japan, I was close to 5 dan. A week before leaving Kyoto, I hooked up with a buddy (who was also visiting) to challenge the locals at a smoke-filled Go club. He was perhaps 2 dan at the time. We walked in and slaughtered the room. They could not match us. Ah, but they insisted we return the following evening.
We did.
Waiting for us were some of their strongest players. I was seated in front of Kyoto's most ruthless amateur player, who must have been a scrappy 7 dan. He was a squat old man with grizzly eyes and a staunch, "I'm gonna' mess you up" attitude. The desire for revenge in his gaze was unmistakable.
The knives came out, we threw down dragon after dragon, chase after chase, launching attack and counter-attack, the board was intense. Eyes of groups were abandoned, trades were made, and the shrewdness of his plays were like his gaze. In the end he won four out of five games, and I learned a lesson in humility. It was a great experience, would do it again in an eye-blink.
Go is such an amazing game, with a rich history, pervasive through Asia, and unsuspecting in its simplicity. It's also a great way to make friends around the world, and meet some truly remarkable people.
Any dan players care for a game? <comment><USER2> Your intro read like prose. In a few short paragraphs I felt I was reading a novel.

You have the touch. Are you a professional writer?

<comment><USER3> Not sure what you mean by prose. His writing was prose, so was yours.

<comment><USER4> You're right about his semantic mix-up, but surely you knew exactly what he meant.

</comment></comment></comment><comment><USER5> Do not play go. Just stay away it from it. I started to play go in Brazil while in high school and got addicted to it. Eventually I came to Japan to play go (I won't disclose the details because it'd be really embarrassing).

Later I came to Japan to study Computer Go in grad school. I planned to to stay for 2~3 years. It's been 7 years now. I don't play go anymore, but I do harder stuff (karaoke, clubbing, etc). It's been a sort of gateway drug for me.

PS: by the way, the reason an American 2-dan can slaughter a Japanese 2-dan is simply because the scales are different, mainly due to inflation in Japanese ranks. If you're AGA 2-dan (or say, European 1-dan) you should really upgrade yourself to 4-dan when coming to Japan.

<comment><USER6> It sounds like a good story waiting to be told, not embarrassing. So many of our lives are spent following the path society has carved out for us; it's refreshing and interesting to hear about someone who had a desire outside of the mainstream and followed to an extreme.

Did you join one of the go cram schools?

</comment></comment><comment><USER7> In the late 1970s I played both the women's world champion, and a year later the South Korean national champion in exhibition games. They both mentioned that I was about 2 kyu but experience getting bruised up by an 2 dan amateur makes me think that my rating is less than that - so I would not be a good opponent for you.

My older brother taught me to play when I was eight, and we played fairly equally for about 10 years, Then, within a year's time, I was consistently giving him 9 stones.

Also in the late 1970s, I wrote a Go playing program I called Honnibo Warrior which played poorly. I sold it cheaply for the Apple II (written in UCSD Pascal) and actually made some real money selling the source code.

<comment><AUTHOR> I've had a design in the works for a few years that is a completely network- based Go AI. The idea is nothing new. It involves multiple computers, each assigned one problem from a board position. One computer might be responsible for calculating ladders, one solves tsumego problems, one to look at influence, one to apply joseki, another for yose, and so forth. Each of submits their top ten moves, in the allotted time, to a master engine. The master engine evaluates the moves (possibly using Monte Carlo simulations) and selects the best.

The idea was more about the framework than the actual worker machines. The ability to add and remove different problem solvers on the fly appealed to me. One of the problem solvers, for example, could be your program, or GNU Go, or a program that runs ten Go playing AIs simultaneously, returning the "best" move from each.

<comment><USER8> Wow. I really dig this idea of sharded / modular network problem solvers. It would be interesting to take it a step further and let the solvers themselves negotiate their own distribution over time, CPU use, etc. - e.g. replicate all the active solvers on all the clients but allocate chunks of variable size to each depending on which evolves to be the "dominant" solver on any given CPU. You'd need an algorithm to stop Montecarlos from becoming the dominant process everywhere, probably. Montecarlo is notorious for chewing up a processor, but in various applications it often does not need to be run constantly, so the free cycles could be used for something else.

I especially like the idea that this could be applied to anything, not just Go. I did something in this direction a few years ago with an a-life data processing platform that used SOAP to shard problems to groups of machines.

At that point there are two issues, firstly the protocol becomes a bottleneck if you're dealing in large datasets, and secondly if you're dividing something up spatially you still have to aggregate your results. It would be the same if you divided it problematically for Go moves, unless each algorithm could give a "confidence" indicator that could be used reliably so that the master engine would not have to montecarlo each result set. That could be done if the montecarlo was moved to the sub-servers to test their own moves before sending the moves back complete with percentage wins for direct comparison in the master engine. It would chew up a lot more cycles and mean more machines, but it would remove the post-processing bottleneck.

<comment><AUTHOR> Architecture in a nutshell:

<http://i.imgur.com/IZ52u.png>

A list of 10 moves from 30 different machines, even using a heavy-weight protocol like SOAP, would be nearly instantaneous. I would favour a light- weight format such as JSON, though. For other applications, I agree, network bandwidth would be a possible bottleneck.

My initial idea was to have each engine return ten moves, in sequence, with the first move being most important. The moves need not be delivered simultaneously. The Master selects the lowest scoring move that was picked by multiple engines. Other ideas include weighting (the fuseki engine's input is not very important in chuban or yose), and imperative moves (death engine forces a play to save a 30 point group).

The Master would send requests for moves by submitting a board position and whose turn to play.

What I really like about the idea, though, is that anyone could develop an engine (in any language) that adheres to the protocol, and add it to the AI network. At any time.

P.S.

<http://www.whitemagicsoftware.com/software/java/jigo/>

<comment><USER8> Cool stuff. Do you already have an API for people to write their own solvers -- something that passes a board state and an interface to return ranked choices? How do you stop people on the network from overranking their own AI's choices (assuming this were an open project)?

<comment><AUTHOR> I do not have an API for solvers. There would have to be a registration system, possibly white-listed by IP address.

</comment></comment></comment></comment></comment></comment><comment><USER9> I used to be 2-4k but had trouble holding 5k* on igs a few years ago. If I started playing now I would probably struggle holding 8k.

Life, my daughter, 2 personal projects and work got in the way.

I miss the social aspect of Go, I find the internet incarnations are too sterile. I love having a tea and a chat while playing, I spend enough time staring at the screen.

Would probably play again if I found the right group.

Pushing the upper kyus would require way too much work than I am willing to commit at the moment to the game.

Love Go, it is truly eye opening.

Talking about smoke, my Go teacher "Mr No" used to smoke 200 cigarettes a day in Go clubs in Korea.

<comment><AUTHOR> That's crazy!

The scene here fizzled a bit when a few events happened around the same time, involving babies and our strongest players. I much prefer to play in person than online, for the same reasons you mentioned.

I am planning on taking a trip next year, with a stop in Korea. Any recommendations for (smoke-free) Go clubs?

</comment></comment><comment><USER10> I was once 11 kyu and improving, but I realised I was getting totally absorbed in the game. As a latent obsessive compulsive I gave it up. I'm pretty sure it was the right choice, but I retain deep respect and admiration for the game. Far, far better than chess.

Deep down I wish I still played ...

<comment><USER11> You made the right choice :)

I got to about 7 kyu, and then it suddenly hit me. Balance is key. Therefore you should concentrate on those aspects of your life which have become more urgent. I haven't played very much after that realization.

In my view, Go (or any other hobby, really) would stand in one corner of the board. Your family, personal life, and work would be at the other three corners. As the situation on the board evolves, you would choose your best play. Focusing too much on any one area would leave you over-concentrated. It would be too inefficient. You'd easily secure one corner but lose the other three.

But then, if you spread yourself too thin all over the place, trying to please everyone, including yourself, that would leave you with a vulnerable position that could fall apart at any moment. That's clearly not good either.

However, if you patiently settle your stone formations before moving on the next area, if you gain strength in one corner/side before expanding towards another, if you are fluid in your decision making process when choosing a direction (life does throw you stumbling blocks doesn't it?), THEN you'd be a wise man indeed :)

I do make it a point to participate in a local yearly tournament (five games over two days) whether I feel ready or not. One day, though, I will come back to Go in full-force.

I'm also ludwig on KGS, btw. If anyone fancies a game, you can always reach me via twitter (@ludwig1024).

<comment><USER12> With all due respect, I don't think it was the right choice at all. As I've studied go, I've learned large "life lessons" in an almost 1-to-1 correspondence. Even now, having hit diminishing returns at 5d, I still find it to be a wonderful exercise in metacognition; I can play a game to quickly see where my head's at.

That's certainly not how everyone looks at the game, but for me, go is easily the most enriching subject of study.

Just my 2c!

<comment> alan-crowe I've tried to make one of these life lessons explicit, answering a question on Reddit [http://www.reddit.com/r/atheism/comments/c1fb7/hey_ratheism_...](http://www.reddit.com/r/atheism/comments/c1fb7/hey_ratheism_how_you_do_you_come_to_terms_with/c0plymp)

How do you come to terms with death?

Learn to play Go. The game has an opening, a middle-game, and an end-game. You can take them as metaphors for the stages of life.

The opening involves playing in the corners and around the edges of the board, perhaps on the third line emphasising territory, or on the fourth line emphasing influence. Metaphorically this is childhood and education. Perhaps going for a vocational qualification, such accounting or law is like going for territory, while studying philosophy or travelling round the world is like going for influence. Or perhaps such direct parallels are over-literal. The opening moves in a game are worse than difficult; the opening is down-right mysterious. Which makes it a lot like growing up. And it creates a situation as you enter the middle game that is different in every game. Much as every adult has their own baggage left over from childhood.

Perhaps the middle game is like adult life because things keep going wrong. Your opponent invades your territory or steals the eyes from a group. You have to fight back, invade his territory or sacrifice a weak group. Adult life makes similiar demands on your flexibility and fighting spirit. If you lose your job perhaps you can find a new one with a rival company for more pay. Or change career and become happier.

The middle game may see victory or defeat, just as life may come to a premature end in illness or death. Often though one survives to the end game. The boundaries of the territories must be decided and there is still time for ingenuity and an upset. It is the time of memoirs and collected works, of playing with grand-children and of making partial amends for past errors.

If you play in tournaments there is a clock, but it is set to 1 hour, not seventy years. There is time to think about your opening, to estimate the score and plan a path in the middle game, to look for some clever moves and to save time here and there with the obvious safe play. After 40 minutes you can estimate the score again. If you think you are ahead you can try to hold onto your lead through the end game. If you think you are behind you must chose between trying to catch up with some clever end game moves or perhaps a do or die invasion. Time matters. If you are short of time you will be unlikely to be able to think for long enough to come up with clever moves. But you should be ahead, having put the time to good use earlier.

Tournament play with 1 hour instead of 70 years is the heart of the metaphor. Both the game and real life have a narrative arc and time limits. You have to manage your time and act your age, taking the big points in the opening and leaving the end-game moves for the end-game, if you make it that far.

So my advice is practical advice and not the uplifting advice that you requested. It emphasises the practical issue of getting the hang of managing a limited stock of time.

</comment></comment></comment></comment><comment><USER13> Stuck at 2kyu on KGS for two years, I've set the game aside temporarily, until my life situation is such that I can immerse myself in serious study. Love the game - got half a shelf of books including Invincible.

There's a saying, "Go is life". Learning the game will tell you an incredible amount about yourself, about determinism and chance and skill, about depth and limits and building knowledge and passing on knowledge.

For a software person there is a lot to learn about complexity and patterns. There are deep lessons about not fooling yourself, about the idea that a strategy for success emerges in surprising ways from ridiculously simple rules and facts of the underlying material.

There isn't much of a gap between Go's simple rules (alternating play, capture, ko) and software's fundamental elements (sequence, iteration, choice) in terms of simplicity, and likewise these simple rules combine to yield complexities that challenge the best human minds.

<comment><AUTHOR> Hurdling the kyu wall, for me, required a leap of insight into understanding how to use thickness for attacking. The basic idea you probably already understand: when you have a wall (or otherwise fortified position), drive your opponent's weak forces into that area. As you do so you will get another wall. If this wall faces your own position, great! If it faces an enemy position, a wall gives you the opportunity to invade or reduce the op-position.

Go beautifully combines strategy and tactics. In what other board games can you take a strategy like, "Besiege Wei To Rescue Zhao" and implement it, tactically, in various ways?

I had a conversation with a project manager. He said that we should zip the development source files over to the test machine. I suggested that the test machine should be outfitted with the repository client (CVS) because it would be simpler solution, technically. How the goal is accomplished is not nearly as important as the goal itself. Both zipping the source and executing a "cvs update" solve the problem. And both are tactical ways of solving the strategic problem: test the latest development version in an isolated environment that is similar to production.

In "Besiege Wei To Rescue Zhao" the strategic concept is to parry an attack on your forces by attacking a weak (yet slightly more valuable) enemy force. I like to think of it as the Three Kingdoms problem. Kingdom A and B are friends, but not Kingdom C. When Kingdom C attacks Kingdom B, Kingdom A can rescue B in two ways: running to B's defense or by counter-attacking Kingdom C. Counter-attacking is usually best, to avoid the least amount of bloodshed. After you've attacked a weak opponent group, you've managed to create a stronger position that you can leverage to support the group that was being assailed.

Other elements that Go and programming have in common: intuition, aesthetics, and recursion.

</comment></comment><comment><USER14> By the way Go is one of the most challenging games for AI:

<http://en.wikipedia.org/wiki/Computer_Go>

</comment><comment><USER15> I play, but not nearly often enough. I'm probably somewhere around 12k, far below _thangalin_ 's level. If there is any such thing as objective quality in board games, go is objectively the best game anyone has come up with yet. Wonderful, wonderful game. But also dangerously addictive. The fact that it's basically impossible to play a quick game doesn't help.

<comment><USER16> "there is any such thing as objective quality in board games, go is objectively the best game anyone has come up with yet"

Could you please elaborate?

<comment><USER15> I'm not sure I could. (If I could, I'd probably be able to omit the hedge at the start.) But here's the best I can do.

1\. The rules of go are very simple. (Well, kinda. Use, say, the Tromp-Taylor ruleset.)

2\. The resulting game is very subtle, in e.g. the following senses. (a) For any game, define an "increment" to be how much better you need to be than someone else in order to beat them 75% of the time. Then the number of increments between a total beginner and God is larger for go than for any other game I know of. (b) Same as (a), but this time define an "increment" to be how much better you can get with a week's hard work or something. -- That is, there's a lot to learn, and learning it really makes you appreciably better at the game.

3\. The difficulty of the game isn't simply a matter of getting better at mechanical calculations: there's a whole lot of strategy and "good taste" and so on.

4\. It seems to be an uncommonly _beautiful_ game. Now, any good game is going to have some aesthetic appeal for its expert players. But it seems as if (a) really good go players get more out of it aesthetically than, say, really good chess players get out of chess, and (b) one starts seeing aesthetic value in the game earlier in the process of getting better than with most other games.

5\. (This is, I think, mostly a consequence of #1.) It's a very flexible game: you can use a different size of board (changing how long a game takes and the tactics/strategy balance), or give one player a handicap (changing the balance between the two) while keeping the game substantially the same. This is convenient practically, and (for reasons I can't currently articulate) it seems to me that it indicates something deeper about the game: it's a kind of Platonic essence that can be instantiated in many different ways. (I wonder occasionally about playing go on a graph that isn't just a square grid. It seems like hexagonal go wouldn't be too big a stretch, whereas to make a decent hexagonal chess game you have to change lots and lots of things.)

6\. (Related to #1, #4 and #5.) It's a game that can be played with enjoyment even by total beginners: it's much more approachable than chess, for instance.

7\. Although there's a lot to learn about the game, the understanding:brute- facts ratio in what you need to learn is better than in, say, chess. You can play go very well while knowing scarcely any detailed opening theory, whereas to be any good at chess you need to learn a lot of lines.

<comment><USER16> Wow. Superb answer, just what I was looking for. I'd actually heard your point 2 repeated several times, so I guess it's a common idea.

By the way, one of the reasons I "like" Go (in a purely objective, looking from a distance without learning it kinda way) is that, from what I've heard, even average players can beat computers at the game. Obviously, this is mostly to do with accidental, mechanical facts about number of possible moves, but in an age where Chess has been "won" by computers, it is something of an appeal for me. Do actual Go players feel the same way?

<comment><USER17> Last I remember, most programs could play about 12-10kyu evenly and some specially augmented ones had hit dan levels.

Computer moves always looked unnatural to me, though, and you could often exploit this easily. I'd say most players are at least comforted by lack of computer headway into Go.

</comment></comment></comment></comment></comment><comment><USER18> I was entranced with go via "Hikaru No Go", a Japanese anime about a boy who discovers the game through a spirit seeking the elusive 'hand of God'. I am currently at 9 kyu but am trying to better my game.

Unfortunately there aren't too many Go players where I am, and this makes Go as a point of social focus difficult, as it often is in chess over here.

<comment><USER11> > Unfortunately there aren't too many Go players where I am

Put yourself on the map, just in case! <http://igolocal.net/>

<comment><USER19> Unfortunately this site doesn't accept my position. I keep getting the following:

You must mark a valid location on the Google Map.

I currently live in Bermuda and if there are any Go players out there traveling to or currently residing there I'd be down for a few games, I have a go board + stones.

</comment></comment></comment><comment><USER20> Hi thangalin,

I'm "grooviest" on KGS. I'm only 7 kyu so you'll need to up-skill me to 1 dan so I can give you a nice game (hint hint). My relationship with Go is turbulent. Currently we are in an addictive (God, it's sooo addictive) phase and she is breaking my heart. My one regret in life is that I was 30 years old before I learned how to play. All those wasted years playing chess. _sigh_ I recently moved from my native land of Ireland to snowy central Finland and one of the first things I did was find me a Go club - hello the Tengen Go Club of Jyväskylä, nice people all round.

<comment><AUTHOR> That's quite the adventure! Our time zones might not let us play in real time. Facebook has a Go playing app. I'd be happy to play a teaching game with you.

</comment></comment><comment><USER16> I've never played, but I'd be happy if someone could point me to the best place to learn.

<comment><USER19> Easiest way to pick up the basic rules and gameplay is through:

The Interactive Way to Go: <http://playgo.to/iwtg/en/>

Its also available in 32 other languages: <http://playgo.to/iwtg/>

\--

Beyond that I recommend 9x9 games, on Windows download yourself a free copy of iGoWin: <http://www.smart-games.com/igowin.html> or on OSX or Linux check out GnuGo.

\--

There's also a Linux live cd/distro with lots of learning tools by the name of Hikarunix: <http://senseis.xmp.net/?Hikarunix>

<comment><USER19> p.s.: You can find me on KGS, my user name is muloka. I'm just starting to break the 5k boundary.

</comment></comment></comment><comment><USER21> It's a fascinating game but coding seems to fatigue the same bits of my brain that coding does, so I spend my recreational time doing things a bit more brainless, like Warcraft.

</comment><comment><USER22> Hi thangalin,

Nice to see your post about Go. I'm from China and have been playing Go for more than 20 years. I started to play in high school and improved a lot in college. My current ranking is AGA 5~6D. I don't play very often recently except play turn-based games on my own web site (www.go-cool.org).

Because of my addiction to the game, I even created a variation of Go, Daoqi, which removes border of Go board and makes all positions have same importance. This new game gives players a new and different enjoyment.

I'm also a programmer and have spent a lot of time on side projects. I created a Javascript based game viewer (github.com/gcao/jsgameviewer), a Ruby on Rails application which integrates with a Go forum (<http://www.go-cool.org/app>)

Like I said, I'm happy to see your post and comments from fellow Go players. Hope I can play with you one day.

<comment><USER23> 哈,我一定在tom論壇見過你!

</comment></comment><comment><USER24> Care to explain why your level decreases without practice?

<comment><AUTHOR> Go is deep. So deep that you could spend a lifetime studying only to yourself on your deathbed still discovering new techniques and concepts.

The first ability people tend to lose after not playing is reading. That is, visualising a sequence of moves (without playing them) on the board and judging the positional value (similar to chess, but with astronomically more possibilities). Reading requires concentration, pattern matching (shape, tesuji, vital points), and guesswork.

After reading -- the tactical part -- some higher-level concepts get lost. Forcing plays (kikashi), inducing moves, estimating the value of thickness, obscure joseki, fuseki theory, and more.

There are /so/ many concepts and techniques to Go that unless you are actively studying and playing, it is nearly impossible to keep everything at the forefront of your mind.

</comment></comment><comment><USER25> I lived in China during my childhood, and one of the things that I was involuntary involved in was playing Go, my parents simply made me do it. Despite the fact that I didn't really like it, I still kept learning it for several year. And by the time when I finally convinced my parents that I was not going to or even want to be a professional Go player, I was amateur 4 dan by Chinese standard, and I was about 10 years old. I stopped playing since then, but I can still pick it up and play once in a while, maybe with a skill level of around 2 dan I guess. Look back from now, Go looks interesting, but when I was forced to learn it at the age of 7, it was all boring and dull.

</comment><comment><USER26> This whole thread makes me want to start learning how to play again. I don't think I have played more than about half a dozen games but it is by far the on of the most compelling games I've encountered.

</comment><comment><USER27> I've tried to pick it up, have not found any clubs or anything in Milwaukee, so I've had to play via computer. Due to that, I haven't been able to pick it up as much as I'd like.

<comment><USER28> Another Milwaukeean!

The little bit that I played was also online. I didn't (and still don't) know anyone that played, either in person or online, so I haven't had anyone I can just bombard with questions. Whenever I played online I just got slaughtered, and any pleas for "what am I doing wrong" generally went unanswered.

Occasionally, I'll hit up <http://goproblems.com> and I struggle with all but the most obvious answers.

Despite reading a book or two about the game, and the handful of games online, it just never clicked. But I remain fascinated by the game and am on the constant lookout for someone who actually knows how to play. It's been a while now since I last tried to play, but I'm always down.

</comment></comment><comment><USER29> I just started playing casually earlier this year and I'm about 13-15k on DGS. I really liked the players on KGS, but it's hard for me to find an hour or two of totally uninterrupted time. DGS is so perfect for the slow pace I like to play that I wrote an iPhone client for it: <http://dgs.uberweiss.net>

When I started playing, it was frustrating and confusing. Now, it's still frustrating and confusing, but it's also so much fun.

</comment><comment><USER30> I play, can't even remember how I heard of it but my girlfriend and I learned together a few months ago, I've just got another friend hooked on it too. Having SmartGo Kifu on the iPad and the free go Client from Pandanet has made it easier to learn.

Funny thing is, a co-worker caught me playing it, then while he was slaughtering me in a lunchbreak another couple of guys came out of the woodwork too ^_^

I find it very cool that there's just one piece that can be used for everything.

</comment><comment><USER31> I've been getting a little more back into go lately. Online games are hard for me for some reason and I like to play slower than most people on kgs.

Back when I was active I was an AGA 5dan (probably 6dan in japan). If anyone in SF wants an in-person game I'd love to play - shoot me an email at firstname.lastname@example.com. Our office has a couple learning go players and our janitor might be around 1 dan.

</comment><comment><USER32> I learned how to play in Taiwan and it's become my favorite board game.

I'm not very good though. Do you have any suggestions for improving?

<comment><AUTHOR> 1\. Play lots of 9x9 games against a stronger opponent:

<http://www.smart-games.com/igowin.html>

2\. Study tsumego (life and death) problems. By study, I mean keep replaying the same positions until you can identify the sequence to live (or to kill) immediately. Study problems slightly more difficult than your own rank (maybe 1 or 2 stones). Do this for 15 minutes every day for 6 months and you will be quite strong.

<http://tsumego.tasuki.org/?page=tsumego>

<http://senseis.xmp.net/?BenjaminTeuber%2FGuideToBecomeStrong>

3\. Replay master games. Don't merely click through games on the computer. Get a board. Get stones. Feel the stones in your hand and think about where you would place each move. Try to discover, for yourself, why the master played the move.

<http://www.kiseido.com/Game.htm>

4\. Study fuseki theory and master fuseki player games:

<http://senseis.xmp.net/?TakagawaKaku>

<comment><USER33>
      Do this for 15 minutes every day for 6 months and you will be quite strong.

      http://senseis.xmp.net/?TsumegoLounge

It's not at all clear from this page how you actually get to the puzzles. (Which sound like fun.)

<comment><AUTHOR> Updated with more relevant links. Also, tsumego is a Google-friendly word. (Unlike Go, which is now a programming language, too. Fortunately there is baduk and weichi.)

<comment><USER33> Thanks. That led me to this page:

      http://senseis.xmp.net/?ProblemsAndExercises

Which contains links to actual puzzles.

</comment></comment></comment></comment></comment><comment><USER34> I'm philh on kgs, but these days I mostly play in person at my university club. One consequence of this is that I don't really know my rank. We have our own ladder, on which I'm currently 15.5k, but it tends to underrank people as compared to KGS. I'm probably not above 10k.

If anyone's interested in a game, I can play most evenings, British time.

</comment><comment><USER19> I always thought this would be a great game to teach to under privileged youth and the homeless.

Its also relatively easy to put together a makeshift go board. At most all one needs is white and black paint, brushes, rocks, a piece of plywood or plastic, and something straight to make the lines.

You could even teach them how to make their own board and pieces.

</comment><comment><USER35> I've taken some interest in it and sometimes try to play against the computer, but I'm horribly bad at it.

</comment><comment><USER36> I just found out that Go is a popular game among Clojure programmers. This is how the speakers at the first Clojure conference celebrated the night before the conference.

<http://twitter.com/cemerick/status/28359615311>

</comment><comment><USER37> For the vast majority of games people play, there exists a computer opponent that can beat just about anyone.

Go is an exception. Even a moderately experienced amateur can beat the best computer opponent easily. I think this says something about the richness of the game.

</comment><comment><USER38> I play as 'adewale' on KGS and I'm currently a 9 kyu. Although, as you can see: <http://www.gokgs.com/servlet/graph/adewale-en_US.png> , my ranking tends to fluctuate.

</comment><comment><USER17> I got to about 2kyu on KGS and was very addicted. Getting beyond this apparently required me to seriously dedicate myself to studying, though, and I had to deal with my normal life. So I haven't played in over a year.

I hope to start playing again sometime.

</comment><comment><USER12> Hey thangalin! I remember seeing you on KGS a few years ago. I'm. About 2-3d on kgs and would be happy for a game.

Also, if any go players in CA are interested, next years US Go Congress will be in Santa Barbara, 1st week in August!

<comment><AUTHOR> That was around my peak, when I could battle a 4d KGS player with a flame's chance in space of winning (that is to say: slim to none).

I don't have a lot of time for real-time games. (Working, travelling, social activities, writing, saving the world, you know how it goes.) A non-real-time game would be ideal.

<http://apps.facebook.com/gothegame/>

</comment></comment><comment><USER39> I used to play a lot on NNGS and the Palo Alto Go Club in ~98 but now I just teach. Sticking with the f2f version :)

I was into the game enough that when I had a free week in a Japan, I spent it playing every day at a club.

</comment><comment><USER40> I sometimes hop on KGS, but I'm very rusty. Probably ~17k. Wonderful game. I teach it to the kids in my programming class whenever we have a few moments of free time (usually day before Thanksgiving, etc).

</comment><comment><USER41> I started playing Go at 4 with dad and played a while of IGS (the Panda net thing) and got pretty high (around 2D). But felt in love with Starcraft which is for me, GO+Chess and in real time :p

</comment><comment><USER42> I never went beyond 14-12 kyu. I still want to improve, but life is always getting in the way (also, I get pretty nervous when playing and it is discouraging). But I also love the game.

</comment><comment><USER43> I play online very rarely (about 1d on IGS and KGS ranks). Lately I've started a couple games on DGS. I'd welcome a game on DGS with anyone from Hacker News.

</comment><comment><USER44> I play (well, I have played) and agree it's an amazing, beautiful game like no other.

I only reached around 10 kyu though; don't have the time for it these days.

</comment><comment><USER45> Anyone know where I can play Capture Go at multiple levels? That is, single capture, 2-capture, 3-capture, etc? 9x9 and larger boards?

<comment><USER46> I don't know _where_ , but when you get there, I wrote an SPI HTML5/JS Goban for iPad/Safari that supports single capture and capture five on various boards:

<http://github.com/raganwald/wood_and_stones>

If you want other games like 2-capture or 3-capture, I can file an issue and add the games. And nothing's stopping you from forking, making the changes, and sending me a pull request :-)

</comment></comment><comment><USER47> Guilty as charged: I'm a go player.

Not currently active, unless you count the occasional game against Many Faces Of Go (igowin) on the iPad.

</comment><comment><USER48> I'm jedediah on KGS, and would welcome any game, though I'm a meager ~20k, as I've just started playing.

</comment><comment><USER49> i play it. it's my favorite board game: i'd say it is the best example of a well designed game :)

though i do not play it online.

my dad thought me how to play it at the age of 8. for some time i played it at a go club, but that never really caught on. now i play with a couple of friends or with my dad.

</comment><comment><USER50> I was working on this for a while: yayforgo.com.

I got a new job and just couldn't focus on it. Bummer!

Anyone want the source code?

<comment><USER22> I'm very interested in it. It looks like it is a Python web application, right? I'm a Ruby programmer and should be able to understand the code and steal some ideas if you don't mind :-P

</comment></comment><comment><USER51> there's a go club in soma. we're meeting at twitter every wednesday at 8am but have been thinking of moving a more accessible time and location and call it @somagoclub. anyone interested? (soma, san francisco)

</comment><comment><USER52> 9k KGS.

Same question as OP, but addressed to kyu players-?

</comment><comment><USER53> my dad and uncle are fanaticso, send me your contact information, i'll hook you two up.</comment>


Dropbox authentication: insecure by design - <AUTHOR> http://dereknewton.com/2011/04/dropbox-authentication-static-host-ids/

<comment><USER3> Sort of alarmist, if I understand it.†

The root of his concern is that Dropbox is vulnerable to local attackers. There is little Dropbox could reasonably do to meaningfully change this††. The Dropbox client needs to be able to authenticate itself to the Dropbox server as the price of entry to make Dropbox work. The Dropbox client is usually always running, and is in any case often running. While it's running, anything it did to prevent attackers from stealing authenticators could be circumvented by attacking the running Dropbox process.

If you think about it, this is a problem essentially shared by Google, and your bank. It is fair to critique the application for not making it even easier to revoke access to all but your current authorized machines (in other words, to make rekeying understandable and simple). But it's a UX issue, not a fundamental security problem.

† _I may not; I'm going from 'trotsky's mirror._

†† _Irony, based on previous comments from me today, noted._

<comment><USER4> Well, it's a stored authentication token mechanism, which is the same as is used by many other client-side software. However, there are two possible ways to improve the authentication:

\- use a second factor in the authentication, such as the MAC address of the primary NIC in the machine

\- limit the time that the token is valid by getting the client to periodically get a new token from the server. This prevents two clients using the same token indefinitely without detection.

Both these would be good improvements to the security of the host_id data that Dropbox uses for authentication.

<comment><USER3> A system can easily be set up to lie about its MAC address, and you can't hide the legitimate MAC address. It's a very bad secret value.

The only thing you can do, without entering the reverse engineering arms race, is to add a real second-factor key to the equation --- meaning, something a user has to remember or read off a fob. And in fact, only the fob helps you here, since malware can (and does, every day, in bank fraud trojans) capture any secret you enter.

I agree that it would be better for security if Dropbox made rekeying happen more, but they can do the cost-benefit better than I can here.

<comment><USER5> Apple has solved this pretty elegantly using just the machine id. When you purchase an app on the appstore apple creates a receipt that contains a hash of your machine id as well as other meta data. The receipt is then signed with Apples certificate.

When you launch an app you verify the receipt was signed by Apple and that the hash of the current machine id matches the hash of the machine id in the receipt.

Dropbox could generate the same sort of receipt serverside when you first sign in. From then on each time the dropbox client launches it just validates the receipt against the current machine.

<comment><USER3> This works because Apple is in the reversing arms race. Does it make sense for Dropbox to go down this path? Note that Google and your bank don't.

<comment><USER6> All my banks do. If they detect a browser/IP that I haven't used before they ask me for another piece of authentication (secret question)

<comment><USER3> I think we're talking past each other here. I thought we were talking about embedding secrets in machines. If you want a button in the Dropbox UI that tells it to freak out when your IP changes, that's fine; I think there's a good reason Gmail doesn't default that way though.

<comment><USER7> Blizzard freaks out about changing IP addresses when you sign in to World of Warcraft. I have two internet connections at home and sometimes I switch back and forth, and back when I was playing WoW, it would lock me out after each switch. I had to login to my account via the battle.net website and stell it that everything was ok.

It was extremely annoying. The last few times it happened I just didn't play for a while because I didn't want to bother with reauthenticating; that's when I realized that I didn't enjoy the game that much any more and cancelled my account.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I think those saying "this is a minor issue" are downplaying the problem here. Imagine your co-worker gets up for a 2 minute bathroom break (or you had 2 minutes in the boss' office alone, or at an associates house, etc) - <USER2> could you do in 2 minutes? Sure you could try to install a keylogger but this requires some knowledge, prior preparation and is susceptible to detection. You could copy off his private work but this is slow, not much you copy in 2 minutes.

Knowing this security hole, within seconds i could easily copy one small file (or upload it to crate, or just write down the machine hash or upload it to codepaste etc etc) and know i now have _all his private files - for life_ \- and not just files now but all future possible files (or at least until he changes his password; but how many people really do that regularly?).

Checking that 2 machines aren't using the same key would at least notify you that something had happened, although it may occur too late to secure your existing files.

Another option is tie the key with your IP address, and when a new IP address is detecting you need to enter in your credentials to get a new pass.

I think at least some hashing with create a unique computer stamp (username, OS version, mac address, processor hardware name, etc) would go a long way in making this more secure; it's not perfect (these things can be faked), but it certainly stops Johnny Amateur Hacker in gaining access to his friends/co- workers/bosses private files.

<comment><USER9> I'm sorry but I completely disagree.

Even in this contrived scenario where there's an opportunistic amateur attacker with full access to your computer but only for two minutes, any changes to Dropbox client security only marginally improve your situation. I've got a USB 3.0 flash drive on my keychain that could grab about 6GB in two minutes. How much secret data you got there anyway?

And as a naive attacker, I would probably just but a $40 hardware keylogger if I wanted to steal a coworker's data.

As for tying the key to IP, it adds only some security (doesn't help in your example where your coworker likely shares the same IP) and, moreover, it's a customer support nightmare. Trust me, I tried it once. Some people have IP addresses that change very often. You can't have them re-entering a password with every request.

</comment></comment><comment><USER10> There should never be an expectation that your data is secure on Dropbox unless you use local encryption/decryption. Your data is sent to the dropbox server where it is encrypted by their server (according to their web site) and stored. They secure the data in transit, and then again for storage, but they have access to the keys. There seems to be strong evidence that some checking is done before file transfer to see if the file you are syncing is already available somewhere on the server, and if so the file is not transferred, but does appear sync'd in your account. I noticed this personally when I placed the Access2007 Runtime installer into a folder and the 52MB file was nearly instantaneously flagged as synced. Insecure authentication of an insecure system is not really a big deal. The lack of convenience for users if stronger authentication was used is probably a bigger concern. If I have access to your local machine such that I can extract your local credential, I would easily copy all of the existing data from that machine, and could install a key logger to catch your password.

<comment><USER11> I use EncFS, a FUSE plugin, to store slightly-more-sensitive data and access it from MacOS and Linux. Works for me.

</comment></comment><comment><USER12> So, it's equivalent to nabbing someone's session by capturing their cookie.

Problematic, but not horrifying - unless you think we shouldn't use cookies either. Though absolutely, changing the password should invalidate the old one. Without that, theres no way to _stop_ the use of a distributed file.

<comment><USER13> It's even less than that, as with dropbox you cannot 'capture' someones cookie using firesheep or a sniffer, as they use TLS. The only way to steal the key is by hacking into someones computer and copying it.

Dropbox is doing nothing wrong here. _All_ computer security suffers from this issue. When your machine is compromised, security is toast and you better damn fast change all your passwords/ssh keys/...

No amount of security by obscurity will change this basic fact. The article is extremely alarmist and really doesn't tell anything new.

<comment><USER14> Well, I would argue that they _are_ doing something wrong.

You're absolutely right to say that there is no reason to do something other then just storing the key locally (since someone who has local access to the key, can presumably access your entire dropbox already anyway). But as the original author points out, the fact that changing your dropbox password does _not_ invalidate existing tokens _is_ an issue.

<comment><USER13> Agreed. Limiting key lifetime in that way is an essential feature that improves security.

But the title is worded like he found a _structural_ security hole, that's simply inflammatory and annoyed me.

</comment></comment></comment></comment><comment><USER15> Dereknewton.com's Blog:

Improperly cached by design. :)

But seriously, anyone got a mirror? Definitely curious to read this.

<comment><AUTHOR> EDIT: Original is up. Read it there, I didn't do a very good job with the formatting.

You may be able to see it in all of its html glory on [http://dereknewton.com.nyud.net/2011/04/dropbox- authenticati...](http://dereknewton.com.nyud.net/2011/04/dropbox- authentication-static-host-ids/) if you wait for a considerable amount of time for something to time out.

Dropbox authentication: insecure by design

For the past several days I have been focused on understanding the inner workings of several of the popular file synchronization tools with the purpose of finding useful forensics-related artifacts that may be left on a system as a result of using these tools. Given the prevalence of Dropbox, I decided that it would be one of the first synchronization tools that I would analyze, and while working to better understand it I came across some interesting security related findings. The basis for this finding has actually been briefly discussed in a number of forum posts in Dropbox's official forum (here and here), but it doesn't quite seem that people understand the significance of the way Dropbox is handling authentication. So, I'm taking a brief break in my forensics-artifacts research, to try to shed some light about what appears to be going on from an authentication standpoint and the significant security implications that the present implementation of Dropbox brings to the table.

To fully understand the security implications, you need to understand how Dropbox works (for those of you that aren't familiar with what Dropbox is – a brief feature primer can be found on their official website). Dropbox's primary feature is the ability to sync files across systems and devices that you own, automatically. In order to support this syncing process, a client (the Dropbox client) is installed on a system that you wish to participate in this synchronization. At the end of the installation process the user is prompted to enter their Dropbox credentials (or create a new account) and then the Dropbox folder on your local system syncs up with the Dropbox "cloud." The client runs constantly looking for new changes locally in your designated Dropbox folder and/or in the cloud and syncs as required; there are versions that support a number of operating systems (Windows, Mac, and Linux) as well as a number of portable devices (iOS, Android, etc). However, given my research is focusing on the use of Dropbox on a Windows system, the information I'll be providing is Windows specific (but should be applicable on any platform).

Under Windows, Dropbox stores configuration data, file/directory listings, hashes, etc in a number of SQLite database files located in %APPDATA%\Dropbox. We're going to focus on the primary database relating to the client configuration: config.db. Opening config.db with your favorite SQLite DB tool will show you that there is only one table contained in the database (config) with a number of rows, which the Dropbox client references to get its settings. I'm going to focus on the following rows of interest:

email: this is the account holder's email address. Surprisingly, this does not appear to be used as part of the authentication process and can be changed to any value (formatted like an email address) without any ill-effects. dropbox_path: defines where the root of Dropbox's synchronized folder is on the system that the client is running on. host_id: assigned to the system after initial authentication is performed, post-install. Does not appear to change over time. After some testing (modification of data within the config table, etc) it became clear that the Dropbox client uses only the host_id to authenticate. Here's the problem: the config.db file is completely portable and is _not_ tied to the system in any way. This means that if you gain access to a person's config.db file (or just the host_id), you gain complete access to the person's Dropbox until such time that the person removes the host from the list of linked devices via the Dropbox web interface. Taking the config.db file, copying it onto another system (you may need to modify the dropbox_path, to a valid path), and then starting the Dropbox client immediately joins that system into the synchronization group without notifying the authorized user, prompting for credentials, or even getting added to the list of linked devices within your Dropbox account (even though the new system has a completely different name) – this appears to be by design. Additionally, the host_id is still valid even after the user changes their Dropbox password (thus a standard remediation step of changing credentials does not resolve this issue).

Of course, if an attacker has access to the config.db file (assuming that it wasn't sent by the user as part of social engineering attack), the assumption is that the attacker most likely also has access to all of the files stored in your Dropbox, so what's the big deal? Well, there are a few significant security implications that come to mind:

Relatively simple targeted malware could be designed with the specific purpose of exfiltrating the Dropbox config.db files to "interested" parties who then could use the host_id to retrieve files, infect files, etc. If the attacker/malware is detected in the system post-compromise, normal remediation steps (malware removal, system re-image, credential rotation, etc) will not prevent continued access to the user's Dropbox. The user would have to remember to purposefully remove the system from the list of authorized devices on the Dropbox website. This means that access could be maintained without continued access/compromise of a system. Transmitting the host_id/config.db file is most likely much smaller than exfiltrating all data found within a Dropbox folder and thus most likely not set off any detective alarms. Review/theft/etc of the data contained within the Dropbox could be done at the attackers leisure from an external attacker-owned system. So, given that Dropbox appears to utilize only the host_id for authentication by design, what can you do to protect yourself and/or your organization?

Don't use Dropbox and/or allow your users to use Dropbox. This is the obvious remediating step, but is not always practical – I do think that Dropbox can be useful, if you take steps to protect your data… Protect your data: use strong encryption to protect sensitive data stored in your Dropbox and protect your passphrase (do not store your passphrase in your Dropbox or on the same system/device). Be diligent about removing old systems from your list of authorized systems within Dropbox. Also, monitor the "Last Activity" time listed on the My Computers list within Dropbox. If you see a system checking in that shouldn't be, unlink it immediately. Hopefully, Dropbox will recognize the need for additional security and add in protection mechanisms that will make it less trivial to gain long-term unauthorized access to a user's Dropbox as well as provide better means to mitigate and detect an exposure. Until such time, I'm hoping that this writeup helps brings to light how the authentication method used my Dropbox may not be as secure as previously assumed and that, as always, it is important to take steps to protect your data from compromise.

</comment></comment><comment><USER16> I wrote an application that verifies that a user's license key is valid. The method I use is that I have a private key on the server that takes the host ID, serial number, username, then digitally signs the data with the private key and sends back the signature.

When the software is reading the key, it verifies the signature (with the same data as sent to the server), then verifies that the host ID in the license file matches the actual host ID from the machine. If anyone attempts to change the host ID to match their computer, then the signature becomes invalid.

Dropbox could generate a signature based on their host-ID + a calculated hardware or OS installation value, then use the signature to validate the host-id in the database plus the calculated value. If the signature is valid, then the machine must be the machine that was originally validated.

<comment><USER17> Why does it become invalid if a third party sets up the computer like your customers?

</comment></comment><comment><USER18> This is no different from password authentication, Kerberos host authentication, or SSH public key authentication, SSL authentication. If an attacker gets access to your secret or private key, your security is compromised until you revoke that credential. There's nothing Dropbox can to do fix this on the client side, because an attacker can just run a modified version of the software. In order for Dropbox to "fix" this on the server, they'd have to do source address verification, which would break pretty much everyone except people who have static IP addresses. Even then, IP addresses can still be spoofed given a sufficiently sophisticated attacker. The only thing Dropbox could do is to break every device's authentication whenever a user changes their password. That might be a good idea, or it might just discourage people from changing their passwords.

<comment><USER17> Well, _my_ ssh and gpg keys are password protected;)

I agree though, there is only so much Dropbox could do. Since you can already deauth a computer, it doesn't need to be done by password resets.

I think if Dropbox detects two host_id's at the same time (not just in the same time, but both after each other in, say, double the sync period) then it should deauth the host and alert the user to what's going on.

</comment></comment><comment><USER19> I very much doubt dropbox is insecure by design. Skipjack was insecure by design. Dropbox is (arguably) insecure by oversight, or by lack of thoughtful security design.

</comment><comment><USER20> The problem is that in today world people tend to be alarmist: There is rare case where data is perfectly safe or at least just an app can't make a SYSTEM secure. Notice the upercase: it is the whole system that need to be secure. If the system is compromised, then there is nothing an app can do.

</comment><comment><USER21> The token in cookie stored by browser is portable, either. How can web apps prevent the attackers exploiting the system from stealing the cookie token?

</comment><comment><USER17> I guess dropbox could use the systems provided by the OS to securely store passwords like other applications do?

</comment><comment><USER22> How about revoking the host_id the moment is detected running on two different computers?

<comment><USER23> Given the name, I would guess the host_id is what they use to identify the computer to avoid having to deal with changing IPs/hostnames/whatever.

<comment><USER22> That's the point. It should not be possible to have two computers online at the same time with the same host_id.

<comment><USER17> I just skimmed the article: did the guy do this? It would make sense, or at least be an "easy fix" to disable a host_id if it's seen twice and alert the user to what's going on.

</comment></comment></comment></comment><comment><USER24> If someone is curious in MacOSX 10.5 and would like to check config.db, it's in a hidden folder in user's profile:

~/.dropbox/

</comment><comment><USER25> Without physical security there is no security. I don't see how this is a flaw specific to DB.

</comment><comment><USER26> I'd rather a hacker stole a revocable id/key combo than had access to credentials that were guaranteed full access to my DropBox account.</comment>


Workers Are Getting a Bit More of the Economic Pie (and Shareholders Less) - <AUTHOR> http://www.nytimes.com/2016/05/03/upshot/workers-are-getting-a-bit-more-of-the-economic-pie-and-shareholders-less.html?referer= <comment><USER2> The article notes that a greater percentage of national income is going to workers now, which may very well be true according to how the accounting is done. However, how much of that is because many large corporations are booking a great deal of their profits outside of the US, reducing the denominator in kind of an artificial way? I didn't see anything in the article that mentioned the potential effects of corporations booking profits to overseas cost centers.

The chart the NYT shows depicts worker compensation percentage of national income. I'd be interested to see what overall worker compensation and overall corporate profits look like in inflation-adjusted terms, separately.

<comment><USER3> Another possibility is to look at the compensation for upper management. C-level officers are usually paid in stock as well as cash, but the staff reporting directly to them are salaried employees.

If you actually look at the graph (presented in the same article) it does not look like "the trend is reversing" at all. It rather looks like a very clear downwards trend with a strong cyclic component. So, when the times are good, the salaried bosses might just be handing out productivity bonuses to their reports, and passing the bill to the shareholders.

<comment><USER4> > C-level officers are usually paid in stock as well as cash, but the staff > reporting directly to them are salaried employees.

A great point, but note that the writer considers C-level officers to be workers in this case. The headline might as well be _Workers Pay Probably Keeping up with Inflation, Execs Doing Great_ , but that's not really news.

</comment></comment></comment><comment><USER5> 2 observations...

1) I recall being in an investors meeting in 2007 where the downward trend was pushed as a good thing. (If you're a shareholder, you want to keep the $)

2) The last time it went back towards the workers was during the recession. This tells me that it's more of a story of corporate profit growth than how much people are able to capture. (Corporate profits have more volatility than compensation)

</comment><comment><USER6> Maybe I am cynical or naive but if more automation and other things are causing fewer jobs. And then the remaining employees are getting paid more but there are fewer paid workers overall. But that'd cause a rise in compensation of those employeed.

Shouldn't this be done differently?

Tl;dr; let's fire/automate half the workers. Pay the rest more. And worker Compensation will skyrocket!

<comment><USER7> The article cited total pay and compensation as a proportion of the economic output. It does not mention median pay increasing for workers, so the situation you're describing may very well be the case.

</comment></comment><comment><USER4> > After all, the pay for C.E.O.s and other highly paid people counts in those > compensation numbers.

Most people consider workers to be rank-and-file employees, not executives. The writer goes on to discount the effect of executive pay on the numbers, but the methodology is far less than scientific, and doesn't really justify the headline.

</comment><comment><USER8> There are no error bars on this chart, and the deviation is so small as a percentage of the total change, that we have no way of knowing if this is signal or noise, so the article is somewhat pointless.

</comment><comment><USER9> Isn't this phenomenon consistent this this?[0]

[0] [http://www.ibtimes.com/ceo-pay-corporate-executives-got- rais...](http://www.ibtimes.com/ceo-pay-corporate-executives-got- raise-2015-despite-faltering-business-performance-2359294)

</comment><comment><USER10> > _The evidence available so far in 2016 — steady growth in wages and weak > earnings for publicly traded companies — suggests that the reversal is > continuing this year._

...uhh...the evidence of weak earnings while equities continue to go up, buoyed by systemic cash-infusions by several central banks (Fed, EU, BoJ), shows the entire system is broken. I wonder what the chart would look like between corporate expenditures on payroll vs. stock buybacks since 2008. Just a hunch, but I'd guess percentage wise the investor class is doing just effin' peachy in these conditions.

Okay, I found a few numbers to kick around.

Here's one little tidbit from the article:

> _For example, average hourly earnings for nonmanagerial private sector > workers rose 2.56 percent in 2015 in a year of very low inflation_

...and for contrast, the amount of capital deployed in buyback programs recently:

> _S &P showed more data signaling that S&P 500 index members increased their > buyback totals by 16.3% to $553.3 billion in 2014, versus $475.6 billion in > 2013._

Hm.

</comment><comment><USER11> Doesn't change the fact that investment returns are still getting very generous tax treatment...

</comment><comment><USER12> Ah the fixed-pie fallacy... A foundational pillar for so much of today's political rhetoric (on the right and left).

<comment><USER13> This has nothing to do with the fixed-pie fallacy. Of course both worker's incomes and shareholder gains can both increase by growing the pie. But at any given point in time there absolutely is a "piece" that goes to one and a piece that goes to the other. And it's interesting to look at how the relative sizes of those pieces change over time and what forces can drive those changes.

<comment><USER12> We certainly agree. The voluntary, mutual, cooperation between employer and employee which creates a wage vs. profit interaction IS certainly fascinating. However, it is clear in not only the title of this submission but also the article itself that the fixed pie fallacy is at play.

</comment></comment></comment><comment><USER14> Awesome. It's great to see that things like the Fight For 15 movement and the anti-collusion lawsuit in tech are having an impact.

As wages and compensation rise, it'll also be an interesting natural experiment to measure how private R&D spending responds. Productivity growth has been historically low these past few years, and only as short a while ago as 2012 or 2013 private R&D as a percentage of GDP was, according to my google-fu, quite low, while now it's higher.

If companies and the government could somewhat coordinate to see that the working-class demand-side of the economy improves its condition while the public and private sector spend money on R&D to improve productivity, the economy could stand a chance of acting remotely healthy some year soon.</comment>


Ask HN: I have an idea,an implementation, users and want to invest.What is next? - <AUTHOR> I have been developing a side project for a couple of years and I mostly started it for fun, as a learning practice and to enlarge my developments portfolio. Of course I thought on monetize it if possible and dreamed on being my main income source but that was not the driver at all.
Now I have few users and some people approached me asking questions and I truly think the project could work. Also every now and then someone close to me says I should do something with this saying they could help in some way or another but I never get specific answers on how to make this work.
I know the project needs a complete reengineering to become commercial and although I can invest a good amount of time in it it will never be enough to make it start but I trust enough in the idea to be willing to put some money on it.
My problem is that I am a full time employee and I have always been, so I don't even know where to start. I guess my question is, what are possible ways to keep going with it? <comment> Lorenz-Kraft You probably might want to go the way almost everyone in your position is about to go: Apply for a Investment.

Not sure if you are aware, but you currently are on a investor site ... HackerNews. See at the bottom: "Apply to YC".

Of course, that's too simple explained. Preparing for such a application is not easy. Some investors want to see complete business plans and stuff. Around this whole "startup" scene, there are tons of ways you might want to go first, almost always depending on your needs (like selling your idea because you have no way to make it happen).

The most comforting way seems to be finding a partner. This partner might be there for you to prepare all the business related stuff (in case of investment) or to help you to put your project on its own feet (in case of bringing it to market on your own).</comment>


FreeBSD 10 iwn problems - <AUTHOR> http://www.daemonology.net/blog/2015-01-13-freebsd-10-iwn-problems.html <comment><USER2> Another way to disseminate this sort of information is to ask (use the error in the title) and self answer the question on StackExchange Linux ([https://unix.stackexchange.com/](https://unix.stackexchange.com/)) because StackExchange does SEO on it's answers, the content is Creative Commons, and the URI for the question and answer is likely to remain stable...more so than the typical personal website.

<comment><USER3> _the URI for the question and answer is likely to remain stable...more so than the typical personal website_

Considering that my personal website has been around for longer than stackoverflow, I'm inclined to disagree with you here.

<comment><USER2> I was aware of the possibility when I wrote what I wrote but I wrote it anyway because I was giving general advice.

The method used for discoverability is burdened by the information being siloed. Good information stuck in silos was the problem Spolsky and Atwood set out to solve. Forum threads and blogposts and pagerank are a suboptimal way to disseminate technical information (yes, I drank the Koolaid).

On StackExchange answers are open source. If the answer is wrong, anyone can edit it. This is particularly important because correct answers at |t1| can become incorrect at |t2|. Versions change.

Heck, answers can even be edited to cover corner cases. This seems a better way to handle the "duty calls" for technical issues.</comment></comment></comment>


The Cost of Free Apps - <AUTHOR> http://lukekorth.com/blog/the-cost-of-free-apps/

<comment><USER2> The goods and bads in the world of an app writer - Well written from the perspective of a programmer. Thank you for your perception.</comment>