My Amazon S3 Mistake - <AUTHOR> http://www.devfactor.net/2014/12/30/2375-amazon-mistake/ <comment><USER2> There are a few lessons here:

1\. Use IAM roles. AWS keys should only have access to the specific functionality they need. Best practice is to _never_ use your root credentials for _anything_ ; always use IAM users and use unique keys for each use case, so that you can invalidate and replace them easily. Every time documentation or a tutorial asks you to insert AWS keys, your response should be "let me go create a role for that" rather than "let me go look those up".

2\. More importantly, if you ever accidentally publish or leak credentials, don't try to clean it up by deleting those commits. _Invalidate the credentials immediately_ and re-issue them.

3\. Always, _always_ `git diff HEAD` before committing. Know what you're about to push up. This isn't just a security concern - the number of small, stupid things you'll catch that you'd otherwise end up fixing 15 seconds later is substantial. As a bonus, this incentivizes you to keep your commits small and atomic.

You might talk to Amazon directly - they've been known to forgive debts like these in these kinds of circumstances.

<comment><USER3> > Always, always `git diff HEAD` before committing.

I prefer to always "git commit -v", which shows me the diff while I edit the commit message.

<comment><USER4> Call me unsophisticated, but I personally find it extremely helpful to use a GUI (currently using SourceTree) to interactively review changes before committing. I use the command line for almost everything else, but this is one of those cases where a nice GUI really seems to shine.

<comment><USER5> SourceTree seems like such a complicated mess. `git gui` and `gitk` are my preference.

<comment><USER6> Try the GitHub app (which works with non-github git repos as well). It's feature list is TINY compared to SourceTree, its pretty and has a very easy to use commit interface.

[https://mac.github.com](https://mac.github.com) or [https://windows.github.com](https://windows.github.com)

<comment><USER5> I'm on Linux

<comment><USER7> No Sourcetree either on Linux :~(

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > I learned a valuable lesson here though. Don't trust .gitignores and gems > like Firago for keeping your data safe. Open source is awesome, but if you > are dealing with anything that can be scaled up to thousands of dollars per > hour – at least store it in a private repo if not on your local machine.

You learned the wrong thing :-P The lesson here is "always check what you're committing"

<comment><USER9> As an additional layer of safety, you can also commit to a local repo, or a private bitbucket repo, and give it all a nice once over before pushing everything to GH. At least this keeps your screw ups out of public scope.

<comment><USER10> Isn't that what you're doing anyways when you use a DCVS? Granted, I use mercurial. It has two components on your side, your working directory, and the actual repo. Committing moves changes from your working directory, and saves them to a branch on your local repo. Then you get the local repo to push that change to a remote one.

In essence, "committing" then is the act of pushing your changes to your local repo. Or you could, you know, just look at the changes on disk if really required.

<comment><USER11> Yes, that's how Git works. I'm not sure what fein meant.

</comment></comment></comment></comment><comment><USER12> Hell, even without making the mistake of publishing keys, I've accidentally run up quite large bills for Amazon services; backups that failed to remove old copies was a big one. Instances that were supposed to have been shut down, but for some reason it didn't happen (I don't know if this is my mistake or a bug at Amazon...probably my mistake).

I've simply stopped using Amazon for anything tinkery, because the costs of making mistakes can be tremendous. At least when I make mistakes on my own colocated server, I know it can never cost me more than the $100/month I pay to host it. And, storage is practically infinite (4TB hard disks), and I can spin up more VMs than I would ever need for tinkering in 32GB of RAM on our "spare" server.

And, when I have needed to use VM with some cloud host...Linode and Digital Ocean and similar may have dramatically smaller toolsets for managing virtual resources than Amazon (probably unworkably so for large deployments), but my mind has a much easier time predicting costs than with Amazon. After being surprised on more than one occasion with a ~$300 bill from Amazon (for running nothing but personal pet projects with no economic return), I turned everything off.

<comment><USER13> Something similar has happened to me, on a smaller scale. I was recently checking my bank account, and noticed a charge from AWS for something like $15. After further investigation, I had apparently been charged this $15 for about 6 months.

Hmm.

Logging into AWS and checking the Cost Explorer showed that I had been charged for a t1.small EC2 instance I had running, but when I logged into the AWS console, all I saw was a single "stopped" instance. There's no way I was being charged for cycles I'm not using, right?

Turns out that the instance I was being charged for was in us-west, and I had only been looking at us-east- and there is no indication within the actual EC2 panel that you have instances in other regions!

I was a bit perturbed, to say the least...

<comment><USER5> Not sure why you didn't click on "Billing & Cost Management" where you can see a complete breakdown (by resource and region) of exactly what you are being charged for.

<comment><USER12> I don't know about the previous commenter, and I don't know if the tools have improved, but when I tried to use the billing and cost management page, I couldn't figure out what was actually costing so much. It broke it down into (EC2, S3, etc.), but I couldn't figure out how that mapped out to the bill (i.e. was it the snapshots of my instances, the storage for the not running instances, the old backups in S3, etc.). It didn't seem like it was telling me "exactly" what I was being charged for.

For me, when I saw a $300 bill for _one_ running EC2 instance, a couple of halted ones, and a few hundred GB of storage for something I thought of as a "toy" project that I didn't want to invest serious time or money in, I knew I was done with AWS. A small colocated server could readily provide those resources for vastly less money (and I work on tools to manage cloud and VM resources, including a reasonably good API for spinning them up and down and such, so I don't really miss the Amazon API or UI). This was after I'd already gotten a shock from an automated backup gone wrong that ran up a huge bill. So, it took me a couple of times getting burned.

Of course, it's always been my fault for not understanding how Amazon bills for things, what services cost money (i.e. a down instance still costs money), how much things cost, and sometimes how the API works (or at least confirming that it's doing what I think it's doing, in the case of removing old backups). I'm not blaming Amazon. I'm just saying, I don't trust myself to use Amazon for anything that I'm not going to spend a lot of time and energy on, because I'm obviously not capable of using it without making mistakes when I treat it like a toy. I readily admit I shot myself in the foot; Amazon just provided the guns.

<comment><USER14> The whole billing/cost section got big improvements last year.

</comment></comment></comment></comment></comment><comment><USER15> PSA

If you're running AWS, I highly recommend for all developers and sysadmin to attend AWS free training[0][1]. While you're at it might as well get yourself certified[2].

You might have senior expertise with system operation and application deployment but sometimes, AWS approach things differently. The essence of the training is to always implement best practices, not just solving problem.

Also use the opportunity of AWS event to network with their Solution Architect. Trust me on this one. This worth more than AWS Enterprise Support.

[0] [http://aws.amazon.com/training/course- descriptions/architect...](http://aws.amazon.com/training/course- descriptions/architect/)

[1] [http://aws.amazon.com/training/course- descriptions/architect...](http://aws.amazon.com/training/course- descriptions/architecting-advanced/)

[2] [http://aws.amazon.com/certification/](http://aws.amazon.com/certification/)

<comment><USER16> Erm, is it really free? I just followed your link, which lead me to [https://www.aws.training/home?courseid=3&language=en- us&sour...](https://www.aws.training/home?courseid=3&language=en- us&source=web_en_course-descriptions_architect) ... which lead me to [http://www.globalknowledge.com/training/course.asp?pageid=9&...](http://www.globalknowledge.com/training/course.asp?pageid=9&courseid=24526&country=United+States) ... and there I find out it's $2095 USD.

Hopefully I'm mistaken... because I'd love to take it if it's free!

<comment><USER15> I just noticed that free training session seems to be limited to certain location sold by "Amazon Web Services". For example Kuala Lumpur and Bangkok are free, but other location have varying fees.

I attended 2 free session in Kuala Lumpur and Singapore back in June. I always assume its free for all. Sorry

<comment><USER17> Huh, a round trip to Kuala Lumpur is less than the course in the States.[1] Best excuse for an overseas flight I've seen lately.

[https://www.hipmunk.com/flights/WAS-to- KUL#!dates=Jan12,Jan1...](https://www.hipmunk.com/flights/WAS-to- KUL#!dates=Jan12,Jan14&pax=1)

</comment></comment></comment></comment><comment><USER18> You can use AWS IAM ([https://aws.amazon.com/iam/](https://aws.amazon.com/iam/)) to help prevent something like this. AFAIK you can create a sub-account that only has access to specific resources, such as S3, and use the keys from that sub-account.

I haven't used it much, but it looks like you can be very specific in what you allow, such as only allowing access to a single bucket with S3, or a single domain with SES.

<comment><USER19> You totally can be very specific about what actions and services an IAM key has access to. The permissions model takes a bit to get your head around (It did me, at least) but once you do, you can have very strict, precise permissions for your keys.

</comment></comment><comment><USER20> Yeah, I did that, though in my case it was a bitbucket repo I thought was private, but somehow ended up public (obviously stupid to ever be checking in the keys at all).

All I had setup was a micro S3 instance I'd been using for some toy craigslist scraping & hadn't touched for months.

Then out of the blue I get an "urgent please check your account" email from amazon. Go check the AWS console, and what do you know -- maximum number of maxed-out instances instances churning away with 100% CPU usage in every region on earth. The charges were already about to $50,000 when I turned everything off.

I wrote a very, very apologetic email to amazon, and they forgave all the charges, for which I was very grateful.

Definitely a learning experience.

</comment><comment><USER21> And please for the love of all that is secure, use IAM roles. Even for your personal things. it's not that hard and you can stop things like this from happening even with the auth credentials.

</comment><comment><USER22> If the criminals can create a bot to scan for AWS keys, I wonder if github can't create a plugin to detect the same and warn the committer or maybe limit access to this data to original committer only. It won't be 100% but I bet the bots aren't 100% either, so if it covers most of the cases it would still be useful.

Or maybe just have a script on local github pre-commit hook?

<comment><USER5> I don't think it's github's responsibility to prevent you from shooting yourself in the foot.

<comment><USER23> Nobody said it was their responsibility. If adding an optional feature that prevents you from shooting yourself in the foot makes people like github more, maybe it's worth it to them. "Responsibility" has nothing to do with it.

<comment><USER24> Would have to make it an option, because we check in various AWS keys into private repos.

Also how do you differentiate an AWS root key (bad) vs an IAM Key (good)?

<comment><USER25> Maybe you should rethink your policy either way.

In my circles, at least, it's standard practice to use environment variables.

But I would think clearly it'd be an option.

<comment><USER24> > Maybe you should rethink your policy either way.

Do you have articles discussing the cons of AWS keys in private repos?

We deploy our systems on vanilla EC2 instances, which are configured by using a server orchestration system (Ansible). So for any env variables to get set, we'd have to put them in config scripts, which are currently checked into github.

To make it clear, we only check in our IAM keys that are AWS service specific, like SES.

</comment></comment></comment></comment></comment></comment><comment><USER26> Lesson 1: Don't publish your passwords.

Lesson 2: When using AWS then use Billing Alarms[1].

It takes about 1 minute to setup and enables e-mail or SMS notifications at dollar-thresholds of your choice.

[1] [http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/...](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/create- billing-alarm.html)

<comment><USER27> The corollary to that is the first thing such people/scripts do when they have access to your account is disable Billing Alarms.

<comment><USER28> Are you sure you can disable billing alarms with just your access/secret key? I thought you would need to know the user name + password for that

<comment><USER29> Having root credentials is sufficient, and based on the fact that this guy said "apparently the s3 api lets you spin up ec2 instances" it looks like he didn't touch IAM.

Root credentials are deprecated, but can still be used and if this guy used them then yes, his billing alarms could have been disabled.

There's a difference between an admin iam user (can't do billing stuff) and the root credentials (just as powerful as username / password).

</comment></comment></comment></comment><comment><USER30> Also, if you ever accidentally leak your keys... CHANGE THEM!

</comment><comment><USER31> The same thing happened to my brother. He's been teaching himself software development for a while, and learned the same painful lesson about securing your keys. This was despite the things he did right, like:

1\. Used IAM roles (but he didn't lock down it's permissions nearly enough clearly)

2\. Used two factor authentication.

[http://snaketrials.com/2014/11/11/espionage/](http://snaketrials.com/2014/11/11/espionage/)

[http://snaketrials.com/2014/11/12/espionage- update/](http://snaketrials.com/2014/11/12/espionage-update/)

I should note Amazon forgave the money his account owed, given it was his first time making this mistake on their systems. Amazon told him the servers were probably being used to mine bitcoins.

edit - Oh, and on his blog he says it was $2000 over 12 hours. It turned out to be $5000 over 2 hours!

</comment><comment><USER32> This seems to be bad design on Amazon's part as well. There should be some kind of manual thresholding in place to make sure this doesn't happen.

<comment><USER21> There is, hence the emails and phone calls that were missed.

<comment><USER33> Amazon also places limits on all of its services. I would think one of the reasons for these default limits is to help with cases of abuse. You can learn more about them at [http://docs.aws.amazon.com/general/latest/gr/aws_service_lim...](http://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html)

</comment></comment></comment><comment><USER34> I must be very old or very paranoid, but I wouldn't for one second think of developing from scratch using only public infrastructure.

If I want to learn rail, I'd start by installing it and running it on my local PC. What's the point of relying on heroku, aws, etc for just everything? What's the point of using github as the main hub for everything? I'm synchronizing stuff to github explicitly and carefully, my casual, day-to-day operations are all running on my own hardware, network and services. Even my most simple websites run first at home, then are sync'ed to the web after I've checked everything works fine.

</comment><comment><USER35> Some old man Java rambling for you. :) (I am ex-Rails actually)

one of the big things about Java that at first I thought was tedious but now have come to love is the build process. By creating the "built" project in a new folder, it is like you are guaranteeing that only stuff you manually specify to be in the production code actually makes it in.

i know .gitignore is supposed to handle this but it just seems dangerous to rely on source-control related filters when there is really sensitive security info involved.

in node i've used grunt & really like that model. The idea being that you have the project run a build then check that into a "build" branch in git & deploy from there. it's also nice because i can uglify etc. if i'm not worried about preserving the source.

I guess for distributed coding this is tough because you want your peers to have access to the raw source + build instructions, but if I were working on a really security-sensitive project (I do enterprise so I'm starting to understand the need for extra precautions) I would probably only distribute code that goes through a (perhaps even thin/transparent) build process & then figure out a way to integrate changes back into the source branch.

I know it must sound like overkill to the open source world & especially for Rails projects, where there ordinarily is no build stage, but it seems like there is some level of danger in distributing a source control repo where you are relying on you + any collaborators to properly configure .gitignore and never accidentally check anything sensitive into the repo. I am decent with git but no expert, i still sometimes accidentally stage things I shouldn't when initially checking in a .gitignore -- and i have much more faith in myself than some of my peers, hah.

<comment><USER36> > The idea being that you have the project run a build then check that into a > "build" branch in git & deploy from there.

This doesn't at all solve the OP's problem, you shouldn't be putting your build under source control in lieu of your source code.

<comment><USER35> well the way that it works in Grunt is actually that you have your source branch and then there is a separate build branch -- so the source is still versioned, but only the artifacts from the "build" branch are presented to public / pushed to your server, whatever.

i just appreciate the security builds add. In enterprise coding the paradigm is very simple -- pretty much keep whatever u want in source, but only built artifacts are ever deployed to the servers. In a closed-source setting this is perfect.

I understand what you mean though it doesn't really solve the issue of distributed, open-source development. (I guess no one would really make a public repo unless they wanted to share, huh?)

</comment></comment></comment><comment><USER37> I think a lot of the comments here are good - but a thing to keep in mind with github is that their free repo hosting is by default - public. Which means that your code is indexed and searchable - by anyone visiting github including anonymous users. They do give you free private repos if you are a college student or professor.

I am a big advocate of self hosting - not because services like github suck (in fact I'm a big fan of github, bitbucket and other services) but you have more control over your own code (that and you can setup private repos).

Here is a small list of self hosted solutions (I forked indefero into srchub - many don't like the google code feel but I personally like it for the simplicity and the fact I can easily fix/modify/add on to it): [http://softwarerecs.stackexchange.com/questions/3506/self- ho...](http://softwarerecs.stackexchange.com/questions/3506/self-hosted- replacements-for-mercurial)

<comment><USER38> FYI, bitbucket and possibly other services offer private repos for free (in order to compete with GitHub).

<comment><USER37> tl;dr; free services are fine - just make sure you have backups of all your data

For most individual projects - they are probably good enough. However, the thing to keep in mind is that for free they usually limit features (I think bitbucket limits the number of developers) or remove features all together (google code removing downloads support, github did at one time but reintroduced it). I'm not saying that I think they should be offering everything for free and shouldn't take away features - they have to make money - but in my opinion always have backups and a plan B in case you need to jump ship.

I was a huge google code fan (the design isn't Web 2.0 with social integrations - but I prefer functional over design) until they pulled the plug on downloads support (which for most Linux people isn't a big problem - a make && make install and it's compiled AND installed - for Windows it's not that easy). Which forced me to self host - I do mirror many of my public projects on github but in the event github management decides to remove/reduce a feature I won't be struggling to find a new "home" for my ~100+ projects.

Also - if you look at the issue tracker for google code it's pretty obvious that Google is no longer supporting or even monitoring it (several spam issues have been appearing). I don't have a crystal ball - but my best guess is that Google will pull the plug on Google Code as well. And it would make sense - most people have already "fled" Google Code for github/bitbucket etc.

With that said - let me put on my tin foil hat and say that even if we ignore any potential future issues there could be potential privacy issues if you upload your code to a private repo hosted by someone else. I'm personally not the type to snoop, but that might not stop some lowly intern from getting curious. Or even some bug on their site that makes private repos public (for a short time anyways). Did you hear about the time that Dropbox made passwords optional for four hours [1]?

[1] - [http://techcrunch.com/2011/06/20/dropbox-security-bug- made-p...](http://techcrunch.com/2011/06/20/dropbox-security-bug-made- passwords-optional-for-four-hours/)

</comment></comment></comment><comment><USER39> There really ought to be a way to _cap_ your bill. Alarms aren't enough when large bills can be run up overnight.

<comment><USER40> And what would the action be when that limit is reached? Terminate all your EC2 instances? Delete your objects from S3/Glacier? Destroy all your RDS/DynamoDB/SDB tables? Disable your CloudFront CDN assets? Stop returning DNS answers from Route 53?

This blog genre would then be "Amazon deleted all my stuff and ruined my business because they didnt think I'd pay $26". As the story notes they tried to reach out multiple times using multiple contacts. There are also existing tools for setting up specific billing alerts if you really want to take some action at $26.

</comment></comment><comment><USER41> I documented a similar experience just over a year ago[1].

I ended up helping give a talk about my experience at the Amazon Summit in Sydney. I hope I made a good cautionary tale to the devs/ops/managers attending.

[1][https://news.ycombinator.com/item?id=6911908](https://news.ycombinator.com/item?id=6911908)

</comment><comment><USER42> In addition to the steps mentioned above, one thing that has kept me safe from my own heedlessness is to never, ever store credentials in a source code tree.

If your project is reading credentials from a file, rewrite it so it reads them from environment variables.

Most IDEs make it very easy to do that, and Python's virtual environments can do that work for you. Yes, it takes more effort, and sometimes it will be a little convoluted[1].

However, it's well worth the effort as you will have a system that you can put your faith in rather than having to double check every time in order to make sure you're not about to inadvertently commit your API keys.

[1] Example of my own: Pycharm does not read variables stored in a virtual environment's configuration, so I have to set them twice.

</comment><comment><USER43> > Unfortunately the Rails tutorial is pretty bland so about half way through I > decided to snoop around to see what my options where. Somehow, almost by > chance I ended up a subscriber on Lynda. Lynda only has one Rails tutorial, > but its pretty in depth and is backed by a five hour Ruby tutorial.

I had the situation in reverse. I found the Lynda.com rails tutorials first (in 2011) and I found it lacking compared to Rails Tutorial. I'm not sure what's the situation now, from Lynda.com website it seems the author (Kevin Skoglund) has updated the tutorials for Rails 4.

</comment><comment><USER44> I thought new AWS accounts came by default with a 20 instance limit...

<comment><USER45> Yes, but 20x the largest instance option is expensive. The limits at Rackspace Cloud are a bit more sane, they limit the total "size" instead of number of instances. So you can run many small ones without hitting the default limit, but not as many large (expensive) ones.

<comment><USER44> The author just mentioned that there were 140 servers in his account. I do know how expensive the servers can be.

</comment></comment></comment><comment><USER46> > Actually hooking into the API was very straightforwards, and didn't take > more than an hour to set up.

I have learned that if this is the case, I'm doing something wrong with my AWS setup.

<comment><USER47> Yours is a great observation! With great power comes great responsibility. If you find that you got great power but don't feel you got great responsibility, then chances are you are doing it wrong.

</comment></comment><comment><USER48> I used some app to upload a 250GB archive to Amazon Glacier. Turns out the app was having difficulties uploading it all at once, and its queue functionality sucked. I explained this to Amazon, since they were suggesting that I use that app to begin with. Turns out I ended up using terabytes of data usage just getting everything up to Glacier because the app was faulty. They tried to bill me something like $1500, but I never paid for it and just had my data removed immediately.

</comment><comment><USER49> Maybe Github can reject commits by default that contain phrases of magic keys/known strings and file combinations that contain passphrases.

<comment><USER50> I'd rather Github not become the Gmail of version control.

<comment><USER51> Github is already the Gmail of version control. Isn't this the reason the attack is possible? Every file is automatically indexed for search.

<comment><USER50> Yes. However I meant that I don't want Github to start developing features that involves scanning and applying AI to codebases and their users' behavior, because I think it's a temptation they start marketing that data.

E.g., "Buy our engineer intelligence subscription! Find out if your job applicant is a ninja or noob!"

I suppose there's an argument that the data is already public and anyone could apply that analysis, which is true. But the difference is that Github is not profiting from this; their feature development will continue to focus on private repo owners as their customers (whose interests are pretty much aligned with public repo owners).

</comment></comment></comment></comment><comment><USER52> Is it not possible to setup some sort of dollar value or bandwidth maximum and freeze the account upon reaching that value?

<comment><AUTHOR> I wish!

$100/mo cap would save a lot of these accounts from being hacked. My mistake was not unique, and if you browse around on Google you will find other authors who have had the same issues.

</comment></comment><comment><USER53> mildly sensational conclusion. his real lesson should be "this is how i learned how to use github."

<comment><USER54> Agreed. But the discussion here on Github is pretty good and tells us that it's happened to quite a lot of people. So the headline might be a bit sensational, but it's a real problem.

<comment><USER53> definitely. but he's blaming it on learning rails in a way. this is coming from someone who did this at one of their jobs. i accidentally committed AWS keys, and we had dozens of servers launched on our account in minutes. was insane.

</comment></comment></comment><comment><USER55> Is there an easy way of putting a strict limit on the amount of money I'm willing to spend on AWS?

<comment><USER56> I haven't seen anything about limits, but they do let you set alerts when you pass a user-specified spending threshold.

</comment></comment><comment><USER57> The expensive mistake was to use Amazon at all. An own domain name costs about $1/month, an OVH root server less then $10. Install a minimal Debian and Linux Containers on it, and expand your own cloud, if you need it, e.g. by extending with cheap Hetzner servers.

<comment><USER41> Regardless of what service (AWS, Linode, Rackspace, OVH) if you leak keys or passwords you have the potential for costs incurred by malicious users.

I have not used OVH, but a quick perusal of the OVH API[1] suggests that you could invoke plenty of commands that would incur costs.

[1] [https://api.ovh.com/console/#/order](https://api.ovh.com/console/#/order)

<comment><USER58> But your app would not have any keys. You would give it a server and that would be it. There's no API use in a toy project, and so no way to leak account authentication.

</comment></comment></comment><comment><USER59> Amazon has been really proactive in protecting against these kinds of things. They seem to be searching the web constantly for API keys, because they'll send you emails that say "hey we found your key here, you better do something about that".

</comment><comment><USER60> The same thing happened to me. Almost exactly. Rails again. S3 bucket for images. Following along with 1monthrails this time. Pushed the key, fell asleep, awoke to Amazon warnings and a $2000+ bill. Also removed.

I wonder how often this happens. Are they mining bitcoins?

<comment><USER61> It would be really stupid to mine bitcoins. I assume they were mining litecoins or some other more GPU/CPU friendly coin.

<comment><USER62> Why ? It's slow but it cost them nothing ...

<comment><USER61> Because they can make money much faster with litecoin.

To illustrate this, EC2 GPU instances have a NVIDIA Kepler GK104 with 1536 cores, so that is like the GTX680. It gets 120 MHash/s on bitcoin, which translates to 2 cents per month.

It gets 207 kHash/s on litecoin, which translates to 32 cents per month.

I think on vertcoin you could get 90 cents per month.

<comment><USER62> Wow the effectiveness of GPU for mining Bitcoin has dropped dramatically since last time I looked at it (admittedly a couple years ago).

If I remember well you could make a few hundred bucks a month with just one high end ATI graphic card.

</comment></comment></comment></comment></comment><comment><USER63> There seems to be some serious confusion here if this dev thinks you can spin up EC2 instances with the S3 API.

Perhaps one lesson here aside from keeping keys outside of public repositories is to learn how an API works (IAM, arns, etc) before using it.

</comment><comment><USER64> I've said this before, but AWS billing support is usually quite sympathetic to your situation if you've made a mistake. They've dropped $120 in spot instance charges I had which went way over what I expected.

</comment><comment><USER65> "Turns out through the S3 API you can actually spin up EC2 instances"

Can you really use the S3 API to spin up EC2 instances? or is the guy just mixing the fact that the credentials he used for S3 can be used for other AWS APIs ?

<comment><USER15> > Can you really use the S3 API to spin up EC2 instances?

No. My guess would be credential with allow:* service access.

</comment></comment><comment><USER66> I'm not at all surprised to learn of bots cruising github looking for keys. I think a good lesson is that if you ever accidentally expose your API key - revoke or delete them immediately and generate new key.

</comment><comment><USER67> I'm surprised no one else mentioned the Heroku mistake of putting config in a file instead of an environment variables. Settings like API keys should always be in env vars on Heroku, not in a config file.

<comment><USER42> If I understand you correctly, Heroku does make that possible. You can use Heroku Toolbelt or their web dashboard to add environment variables.

Adding environment variables to a file is just a convenience.

</comment></comment><comment><USER68> Damn! I know one thing for sure after reading this, I am not even trying AWS until I really really know what I am doing. For now I'll stick with VirtualBox and DigitalOcean.

</comment><comment><USER69> Had a very similar thing happen to a co-worker... accidentally pushed an AWS key to github, and over $7,500 in charges before it was noticed.

Fortunately it was forgiven.

</comment><comment><USER70> This happens very often. Like many others have recommended, disable the global AWS keys and use roles.

</comment><comment><USER38> The github help page* literally states "Danger.. If you committed a key, generate a new one." In a box. In Red.

I'm not sure how much clearer GitHub could make that.

*[https://help.github.com/articles/remove-sensitive-data/](https://help.github.com/articles/remove-sensitive-data/)

<comment><USER71> I use github every day.

I've never read nor seen that page.

</comment></comment><comment><USER72> I wonder how much crypto they mined? Probably $1 worth but still worth it for them!

</comment><comment><USER73> Always put your API keys in an environment variable or ~/.

</comment><comment><USER74> mmmh. Using s3 key/secret to launch ec2 instances ? Does anybody have the pointer to the docs for that ?

<comment><USER74> found it. [http://docs.aws.amazon.com/AWSSecurityCredentials/1.0/AboutA...](http://docs.aws.amazon.com/AWSSecurityCredentials/1.0/AboutAWSCredentials.html)

<comment><USER74> mmh. i think the author mentioned this as well: weren't these in the past just for S3 ?

</comment></comment></comment><comment><USER75> > _Over the holidays, I opted to try to teach myself Ruby & it's companion > Rails._

shouldn't it be "its"?

</comment><comment><USER76> Why do people use this? for $3000 you can run like 6 4ghz machines with 12 gb ram out of your house with like 10mbs up and 50mbs down. I seriously believe the % of customers of amazon computing that actually need it is like 1%.

<comment><USER77> Why do people use Amazon? A number of reasons.

Do I want to buy and manage servers myself? Would I pay for an additional computer to host my little toy Rails app? Will my ISP allow me to route network traffic to my personal IP with a standard plan? Most, at least that I've seen, prevent you from hosting.

For a little project something like the author of this article described, using virtual hosting is significantly easier (and more realistic). If you're going to run an enterprise operation, bringing that sort of hardware in house _might_ make sense, but a lot of larger companies are still pushing that hosting out to places like Amazon as well.

Now, if you're asking why Amazon would allow (new) customers to scale up to $3000 worth of hosting overnight, maybe that's a separate issue. But how should Amazon judge that? There are probably users who _want_ to jump straight up to that sort of scale. And evidently they did detect that the author didn't seem to fit that use case -- they actually called him about it pretty much right away.

</comment></comment><comment><USER78> why doesn't Amazon just ask you on sign-up if you're going to be mining coins, and if you say no, require specific authorization from you (outside of the usual key) to start doing so? Then until you authorize it, they can just not run mining instances on your behalf. surely it's easy for them to tell when this is being done?

EDIT: this got downvoted, but I stand by it, plus it's a question, so you could reply and answer it. In my thinking it's the same reason there's a daily ATM withdrawal limit _set by default_. You can lift it, but it's there to reduce incentive (payoff from trying to see your PIN and then stealing your ATM card.) the current policy is like the bank calling you and saying, "ummm, I hope you know you've already withdrawn $7,000 and seem to be continuing." Given that bitcoin is (literally) cash, it seems to me saner to not run bitcoin mining instances by default, unless you authorize it specifically. or can they not tell?

<comment><USER79> Bitcoin mining is not a service offered on AWS - they are spawning up EC2 instances, which are virtual machines you have root access to. From there you can mine bitcoins or do whatever else you want.

Amazon doesn't have access to the data on the instance, or a list of processes running inside of it, or similar.

<comment><USER78> I know, but even without root isn't it trivial for Amazon to unambiguously tell that this is what the VM's are doing, without looking at anything else on the instances? How can you run virtual machine instances without knowing what the CPU's and GPU's are doing? (There is no mathematical 'private computing' or secret computing over untrusted hardware, i.e. hardware run by other people, that is used in practice anywhere in the world, where for fancy mathematical reasons the operator has no idea what the CPU or GPU of the instance they're running for someone is actually computing. It's not even a cryptographic primitive people know about, and certainly not something performed by hypervisors.)

The CPU or GPU pattern of bitcoin mining must be completely unambiguous and trivial for Amazon to detect on EC2 instances. Or am I wrong for some reason?

<comment><USER54> I would think that looking at patterns on the CPU level is almost impossible. The overhead would be enormous.

For instance if you look for a magic number. Instead of putting two numbers on the stack, and perform an addition you now have to have a conditional jump before the addition.

Maybe I'm wrong, but at least I think it would be virtually impossible.

<comment><USER78> You're right, but I meant for bitcoin mining specifically. it's incredibly resource intensive, so it's not something you have to check for all the time, just when something seems to be behaving this way suddenly (and spinning up lots of instances, etc). When there's an obvious huge resource spike, you can just check to see if it's bitcoin mining.

If they want to be neutral and not do introspection like this without permission, they can ask the user on sign-up if they want "Protection from mining processes" where sudden activity spikes will cause them to do introspection and shut down an instance if it seems to be bitcoin mining.

EDIT: plus, bitcoin mining is the same operation over, and over, and over, and over again. You don't have to "catch" it doing a particular operation. A brief sample taken at any time will show the VM doing the same exact thing. (tons of SHA hashes.)

I'm not an expert though so perhaps I'm missing something!</comment></comment></comment></comment></comment>


Zero to Best-Seller in 4 Hours - <AUTHOR> http://www.kadavy.net/blog/posts/d4h-bestseller/ <comment><USER2> _Imagine the mainstream media using the word "hacker" for what it really means..._

That'd be very cool indeed.</comment>


Fielding notes - <AUTHOR> http://inkdroid.org/journal/2013/01/05/fielding-notes/?utm_source=rss&utm_medium=rss&utm_campaign=fielding-notes

<comment><USER2> Strange. I never connected the REST "Roy Fielding" with the libwww-perl "Roy Fielding". How odd.

<comment><USER3> Neither did I.

Some reference for others reading this: <https://metacpan.org/module/LWP#AUTHORS>

_LWP owes a lot in motivation, design, and code, to the libwww-perl library for Perl4 by Roy Fielding, ..._</comment></comment>


Ask HN: What's the best books to learn to program in 2020? - <AUTHOR> My goal? None particularly, just for knowledge/fun and this year I decided on programming and maybe getting deeper in computer science if it goes well. I'm not looking to build something meaningful right away, I'm interested in the craft, the art and all techniques a beginner can get. My math is rusty AF. Need to work on that also, already have some books to use as refresher. I'm an accountant if that helps. So for now from looking around, here are my options:
1. How to Design Programs, 2nd Edition. Uses a language they call Scheme, and is free online.
2. SICP, but this one seams to require higher levels math so it scares me. Also Scheme and free Online.
3. Eloquent JavaScript, 3rd Edition (but a friend of mine told me to avoid learning with a language that has no "type" as first language, had a simple explanation but still don't really get the meaning of this). JavaScript and free online.
4. Introduction to Computing Systems, 3rd Edition. This one is more technical as it dives into how a computer works before teaching how to program in C and C++. I really like the approach but I'm afraid of the difficulties that will come with it.
5. Anything Python, as everywhere it is suggest to beginners.
If you have any suggestions on how I should tackle this, other books to suggest, road-map, whatever don't hesitate to comment, I'm open to anything, what would you do if you were me?
Thanks. <comment><USER2> I'd start with Python. With the exception of (3), all the other resources you've mentioned are - to me - about getting conceptually better at developing. Mentioning your background does help, actually. I'd recommend 'Automate the Boring Stuff with Python'. That way you'll learn while also seeing how tangible the benefits can be. [https://automatetheboringstuff.com/](https://automatetheboringstuff.com/)

I'm also adding a link to an article I've written a while back for non- developers looking to get into coding: [https://code.likeagirl.io/making- coding-skills-useful-as-a-n...](https://code.likeagirl.io/making-coding- skills-useful-as-a-non-developer-1aa5649e175)

</comment><comment><USER3> If you have no experience with programming, then m start with one of the head first books. Any head first book is designed for complete beginners, and I have heard very good feedback for them via my friends in other disciplines who used them to learn programming. For someone just starting, SICP is too advanced for self study. You can also try one of Manning's in action books all of which have some real world projects, in a language of your choice.</comment>


Tips for New Managers - <AUTHOR> https://medium.com/@pgscandeias/7-tips-for-new-managers-d2adb6706a0e <comment><AUTHOR> Hey HN, OP here. As a programmer, getting promoted to people manager taught me how poorly prepared I was. I think being a good individual contributor is not enough preparation for management roles, so I wrote a cheat sheet with the 7 most important things I wish I knew back then. Hope it's useful for someone!</comment>


Ask HN: Should I buy an Intel MacBook now, or wait for an ARM version? - <AUTHOR> I was about to buy a MacBook Pro 13" as my personal laptop, but I am confused after WWDC's announcements yesterday. I want to use this machine for ~5 years at least.
If I buy the Intel Mac, will it get obsolete after a year w.r.t. software? As in, will new software stop working on Intel machines within 1-2 years?
If I wait for the ARM Mac, I see 2 risks:
(a) Most software won't work (well) for a while unless Rosetta 2 works magically well (I am not optimistic).
(b) The first version of the hardware will probably be bad. <comment> noah-kun On point "a", Rosetta 2 will work perfectly if Rosetta 1 is any indication.

On point "b", the "first version" of the hardware was over 10 years ago.

<comment><USER2> I would think the overlap between Rosetta 1 and Rosetta 2 is effectively zero, even when including engineers who worked on both as "overlap". It's 16 years ago, and Apple bought significant parts of the original Rosetta from a third party that now is part of IBM ([https://en.wikipedia.org/wiki/QuickTransit](https://en.wikipedia.org/wiki/QuickTransit))

So, I wouldn't use the quality of Rosetta 1 as an indicator for the quality of Rosetta 2.</comment></comment>


Four epic meltdowns - <AUTHOR> http://pastebin.com/EmM6sZnR HN contributor at-fates-hands mentioned he knew of five different cases of a developer "melting down" in epic fashion. I and others prompted him for the stories. The first story is in the original thread: https://news.ycombinator.com/item?id=5577734 <comment><AUTHOR> HN contributor at-fates-hands mentioned he knew of five different cases of a developer "melting down" in epic fashion. I and others prompted him for the stories. The first story is in the original thread: <https://news.ycombinator.com/item?id=5577734>

<comment><USER2> Makes me wonder if you're based in North Korea...</comment></comment>


CES Revoked an Award for a Female Pleasure Device for Being 'Immoral' - <AUTHOR> https://motherboard.vice.com/en_us/article/pa5ngn/ces-revoked-an-award-for-lora-dicarlo-vibrator-female-pleasure-device-for-being-immoral <comment><USER2> Correct me if I'm wrong, but they were to be given an award that was then revoked, correct? They weren't banned from the show floor, were they?

If so, then this isn't really the obvious double-standard the article makes it out to be unless the male sex products are winning awards without the "no sex products" rule being applied to them as well. If anything it seems in line with their push to have sexual things present but not featured.

<comment><USER3> _A month later our excitement and preparations were cut short when we were unexpectedly informed that the administrators at CES and CTA were rescinding our award and subsequently that we would not be allowed to showcase Osé, or even exhibit at CES 2019._

Per their blog.

[1] [https://loradicarlo.com/pages/cesgenderbias](https://loradicarlo.com/pages/cesgenderbias)

</comment></comment><comment><USER4> wonder if abusing on the marketing material on purpose to be 'banned' is a marketing strategy nowadays. It surely got them a spot on HN after all!

<comment><USER5> There's no mention of any marketing material "abuse" in the article _or_ CES's initial and revised statements. According to them, there simply wasn't a category for their product.

However, female sex toys have been demoed in the past at CES [0]... maybe just the award people are prudes? Have sex devices won awards there before?

0\. [https://www.geekwire.com/2017/ces-strict-rules-adult- content...](https://www.geekwire.com/2017/ces-strict-rules-adult-content-sex- tech-exhibitor-never-problem/)

</comment></comment><comment><USER6> Thank god for these pioneers.

I'm surprised by CES's response - when did teledildonics become a moral issue?</comment>


The Man Who Made Gmail Says Real-Time Conversation is What's Next - <AUTHOR> http://www.readwriteweb.com/archives/the_man_who_made_gmail_says_real-time_conversation.php

<comment><USER2> The difference between IRC and everything else is the organization of it all.

It's hard to track and organize real-time conversations.. they start off in one place and end up in another. And then even if that's fine, it's impossible to then categorize the results in any meaningful way that makes it easy for _others_ not a part of the original discussion to go back and view the details of the (large) conversation.

The nature of emails and other "turn-based communication systems" makes people tend to make each individual "element" of the thread a standalone entity. A single has way better odds of making sense on its own than a single IRC message...

<comment><USER3> They're very different forms of communication, suited to different uses. It's like telephone vs letter. Each has its place.

</comment></comment><comment><USER4> The idea of real time communication is similar to IRC, but remember that it's just a protocol. The big difference here is what you can do with how that data is presented to users.

There are some really neat things you can do with HTTP and a browser that IRC clients lack. The whole rendering a page with text, images, and markup together adds a lot to the experience that you just don't get with IRC. Great job friendfeed - it looks like this brings together the strengths of each.

<comment><USER5> Look at Adium (which is IM, but I don't think IRC) and Colloquy (IRC and SILC) on OSX. They output chat to XML which is then 'themed' with XSLT into HTML to display in a Webkit frame.

It sounds really convoluted, but it's presented in HTML form. and you _can_ use images etc.

</comment></comment><comment><USER6> Of course, real time is a better form of communication.

But then, why don't we just stop using emails, just do video conference, or better yet face-to-face meetings?

Because there are other limiting factors. For example, no one has the time to have real-time conversation all the time. Real-time also limits the amount of people you can effectively communicate with.

That's why we have email/forum/tweet, because they serve different functionality.

Thus, real-time communication will never replace static communication as long as such intrinsic logistic limits exist.

</comment><comment><USER7> push news:// & irc:// to the masses through jabber/json rendered in browser...

<comment><USER8> mibbit covers IRC, but you can clean up usenet now that google wont implement even the most rudimentary forms of spam blocking.

</comment></comment><comment><USER9> I still think the Friendfeed site does a poor job of getting across what it does and why it's useful. This readwriteweb article is better. They need some real-life examples, not just waffle about family and work groups. Can I use it instead of a blog, or is it as well as? If I can see the comments other friends are making elsewhere then do my comments on FF get pushed out to those things I'm on, e.g. twitter? That kind of thing needs to be covered, and without me watching a video or screencast.

</comment><comment><USER10> The Man Who Made the Postcard Says "Telephonic Conversation" is What's Next

</comment><comment><USER11> So when will Google officially make this their social network?

<comment><USER12> The Brazilians will just take it from us again :)

<comment><USER8> I tell my chinese friends I'm on QQ (their local AIM/Y!IM conglomerate) and I tell my brazilian friends I'm on Google's Urkut :-P

</comment></comment></comment><comment><USER13> I don't believe a chat room is what's next.

</comment><comment><USER14> > flowing, multi-person, real-time conversations.

In other words, IRC? Every "next big thing" communication medium has been trying to replicate the IRC experience for the past 15 years.

Twitter is the closest, it even has # and @ modifiers - I mean come on, this is getting pretty ridiculous. A stand-alone twitter client that shows a message from everyone that is posting to #topic and @messages directed to you? Last time I checked, that's IRC.

Pretty soon all of us will get our childhood wish and everyone in the world will be on IRC.

<comment><USER15> And blogging is basically just a .plan file...

<comment><USER16> Come on Paul. IM is hardly ancient geek history.

<comment><USER15> My point is not that they are the same, but that details matter a lot, and that just because there are parallels between two things, it does not make them the same thing. My .plan example was not made up -- that was an actual criticism from the early days of blogging (according to Jason Shellen, who was part of Blogger).

<comment><USER16> (Just read Jason's piece the other day, actually. You can't leave comments on a .plan ...)

I agree that details matter a great deal. In any event, the comment specifically questioned the temporal aspects of the analogy. Wishing you success in your endeavors.</comment></comment></comment></comment></comment>


Ask HN: How to find good project manager? - <AUTHOR> Looking for tips or suggestions on how to find capable project manager? <comment><USER2> Post an advert on Glassdoor:

[https://www.glassdoor.com/post-job](https://www.glassdoor.com/post-job)

Use keywords in the job description that are relevant to your industry.

State the years of experience and any qualifications you would expect an applicant to have.

LinkedIn is another avenue to explore.</comment>


Did Google launch a new algorithm change in January of 2011? - <AUTHOR> http://site-press.com/blog/2011/01/29/did-google-launch-a-new-algorithm-change-in-january-of-2011/ Earlier this week, Google's Matt Cutts announced they will be releasing a new on-page spam detection technique to reduce the amount of content spam we see in Google. <comment><USER2> Yes: <http://news.ycombinator.com/item?id=2152286>

Also, NSFW - the site popped up an "Adult Finder" window.</comment>


How not to sync your blog to your Rails app (woes with PubSubHubbub) - <AUTHOR> http://blog.aisleten.com/2010/03/20/how-not-to-sync-your-blog-to-your-rails-app/ <comment><USER2> I had this problem recently. And the solution was really simple.

My goal was to display in an Rails App the latest entries from a wordpress blog.

In the end I used this <http://code.google.com/apis/ajaxfeeds/documentation/> which worked perfectly, without any hacks in Rails.

You can check it out on www.2performant.com at the bottom. It's all javascript.

<comment><AUTHOR> Nice. That's definitely an attractive option.

</comment></comment><comment><USER3> I mentioned it in the comments on the article, but I typically just make my Wordpress blog use the same database as my Rails app. Then in the Rails app you can create a BlogPost model or whatever to use anywhere in your rails app.

You can either install the WP app on the same server as your Rails app, or you can just create a custom user and SSH tunnel for your DB between the DB server and the WP server.

</comment><comment><USER4> If you figure it out I'd like to hear more -- have a project that I want to use PuSH with but I haven't started it for this kind of reason exactly.

<comment><USER5> Julien from Superfeedr here. Please get in touch wit any issue/question you may have. I'm sorry Micah had so many issues and I'll try to help him find his way.

</comment></comment><comment><USER5> Micah, I'm sorry the experienced wasn't as smoothed as expected. We can definetely help. I left some comments on your blog. Please get in touch.</comment>


"My iOS app is being pirated. Over 90% haven't paid for it. What can I do?" - <AUTHOR> http://www.reddit.com/r/gamedev/comments/hs5y5/my_ios_app_is_being_pirated_to_the_point_where/ <comment><USER4> Let me condense the conversation for you: Blah blah blah, free marketing, blah blah blah, wouldn't have bought it anyway, blah blah blah, DRM never works.

Then you move your code to the server and this never bothers you again. This defeats piracy so well it _works in China_.

<comment><USER5> when did you turn into such a know-it-all patio? All I see from you is arrogant one liners for the last few months.

It's been interesting seeing how your (modest) success has turned you into an asshole - shame really.

<comment><USER6> Patios statement was that moving to SaaS model removes piracy.

I see no asshole-ish nature and I'd bet it's 100% on the money, though I've never sold downloadables so I can't speak from experience.

Let's stay above name calling. We're all adults here.

<comment><USER7> And how could he move into SaaS? It's a simple game, not a business app.

I think patio's advice doesn't help at all in this particular case.

</comment></comment></comment></comment><comment><USER8> In other piracy discussions I've always viewed piracy as organic-marketing.

Meaning if you wanted to nurture the piracy (e.g. no DRM, easier install paths, etc.) you would probably get your software in the hands of more people and just redirect what you would have spent on marketing to keeping it in the bank and track the piracy as marketing costs.

I'll admit that is a rosy way to look at it, but I'm definitely one of those "The people that pirate your software, never would have bought it in the first place" believers.

Look at Windows, remember when 95/XP had 96% domination of the world's computers? That only started to come down when they got draconian with their DRM/activation/genuine windows/etc. I saw about half my friends move to Mac/Linux in that move (techie crowd) and I have to imagine they likely moved friends/family to their new platform of choice in the process.

The people that were never going to be their customers went looking elsewhere for alternatives.

Imagine how many of those pirated copies of Windows ran legit copies of Office or IIS (or any Windows-specific software) that were paid for as the result of the machine operating in a Windows-only environment.

Them Microsoft clamped down on those users and squeezed them all out of the eco-system completely. No ancillary sales anymore from those folks; they are now permanent customers of other platforms.

It seems to me that if you can accept that your software will be pirated up- front, you can get some mileage out of it.

Put a mechanism in your game to check for announcements on a web server and display them. Maybe your game is 90% pirated, but when you released your NEXT game (or piece of software) you are suddenly announcing the release to 9x the audience you would have had if it wasn't pirated so heavily.

You suddenly have direct access to all those customers that didn't cost you Google Adwords money or SEO to find. They already like what you do, they pirated your game.

I really see this as an opportunity for this guy (and anyone facing the issue) if you stop thinking about every pirated copy as a lost sale... just like I wouldn't think of every egg I eat in the morning as a chicken I murdered.

They were never your customers and those eggs were never full-grown chickens.

<comment><USER9> > I'm definitely one of those "The people that pirate your software, never > would have bought it in the first place" believers.

I think that's only true for _X%_ of the people who pirate. Pro-piracy groups like to assume X=100% (that people who pirate would never be persuaded to purchase a copy), anti-piracy groups assume that X=0% (that _every_ pirate can be persuaded to purchase a copy). The truth is that X is probably somewhere in between.

Unfortunately there's no public data about what X really is, or even anything that could narrow down the range a little bit.

<comment><USER10> > The truth is that X is probably somewhere in between.

X depends a lot on the particular piece of software, the target market, and the context in which it's available. There won't ever be any generalized data.

One interesting test would be to offer an app for a ridiculously low price, like $0.01 and see how many people don't bother to pay even that.

<comment><USER11> A dollar _is_ a ridiculously low price, really. (Not that you're wrong.)

<comment><USER10> I would say that depends on the App. And of course, my point is that from the point of a consumer $1 is still enough to be perceived as being worth something (a snack or a bottled drink, perhaps).

</comment></comment></comment></comment></comment><comment><USER12> Judging from the other comments here this may be a surprisingly unpopular opinion, but if you're pirating an app that costs _one fucking dollar_ you should be ashamed of yourself.

<comment><USER13> I'm not arguing for or against piracy but keep in mind that even at one dollar these apps can easily add up to a lot. My younger sister, for example, wants to download every cool looking app that she sees in the app store, be it useful or not. Add to that the huge influx of crappy $.99 apps that are not worth even a penny and you have enough incentive for people, especially teenagers with limited budgets, to pirate these cheap apps.

I think in order to solve the problem, it's important to see and understand all sides of the equation, even the ones we don't agree with.

<comment><USER14> It's almost as if people can't have everything they want! How unfair!

</comment></comment></comment><comment><USER15> I wonder. Since there are code snippets that can check to see if an app has been cracked/pirated, perhaps there is a way to inject an overlay serving ads on those who pirated. They can't exactly write a negative review on itunes because you can't rate an app unless you've purchased it.

<comment><USER16> It's always the same game of cat & mouse with pirates.

Most pirates on iOS are simply using one of the free tool and don't go far beyond that. I have implemented a technique for detecting pirated app and used it now in many apps: since then the piracy rate went down to zero which convinced that most pirates on iOS are simply using a tool and don't know what to do if the app they try to crack fail.

I am sure that a true pirate will find way to bypass my security check but so far after more that a year of implementing my solution in all my released app I didn't find anymore pirated copy.

If anyone is interested to learn what can be done, send me an email.

<comment><USER17> _> If anyone is interested to learn what can be done, send me an email._

Are you checking that the Mach-O binary is encrypted? I'm not aware of that being worked around by any of the automated tools (and it an approach that is widely discussed).

<comment><USER16> That is one of the approach but I combine it with a few other useful ones.

</comment></comment></comment></comment><comment><USER18> I'd like to point this out:

<http://blog.wolfire.com/2010/05/Another-view-of-game-piracy>

To quote:

 _The highest estimate I've seen is that 10% of worldwide iPhones are jailbroken. Given that there are so few jailbroken phones, how can we explain that 80% of game copies are pirated?

The answer is simple -- the average pirate downloads a lot more games than the average customer buys. This means that even though games see that 80% of their copies are pirated, only 10% of their potential customers are pirates, which means they are losing at most 10% of their sales._

<comment><USER19> That logic doesn't actually add up, though.

Let's say 100 people own iphones, 10 of which are jailbroken. 9 of the jailbroken phones have downloaded my game, and one of the 90 non-jailbroken phones has paid for it. Maybe, if they couldn't download illegally, none of the 9 would have bought it, meaning I have lost 0% of my sales. Or maybe all 9 would have bought it, meaning I have lost 90% of my sales.

It doesn't matter if only 10% of "potential" customers can download a game illegally, it matters what % of _likely_ customers do it. And for some developers that will be much higher than average, for others it will be much lower.

<comment><USER18> You're not wrong that "some customers are harder to sell to than others." But that's a problem anyone trying to sell something faces.

Also worth noting is that he talks about the disproportionate number of games pirated to games sold across the board. What can you take from that? That pirates are far more likely to pirate a larger number of games than customers will buy.

That's hard to prove, but if there are really that many more pirates in so many games, it certainly makes sense.

</comment></comment></comment><comment><USER20> Wait, 90% of users pirating it? I just don't buy it. How many iPhone users jailbreak their phones? 5%? less probably? So those few users are 90% of your user base? These numbers just don't seem right. I would bet the real reason he saw a peak of traffic is something else. He bases his conclusions on how many people click a button, which presumably loads a URL on his server. It could be something as stupid as Google having found the hidden url somehow and indexed it.

<comment><USER21> I estimate 90% of the people who use my app have pirated it. That is based on server communication with the app that would not be easily duplicated by outside sources like Google crawlers. There is some margin of error: Each purchased copy is able to be installed on up to five devices, for example. But I find it to be still fairly telling.

What is more interesting is that I noticed a dramatic drop in sales when it started to be distributed on the pirate websites. I'm not quite sure what to make of that, but it does give some indication that piracy did affect me.

For what it is worth, my app appeals to the geek crowd. From the data I have been able to acquire, I would say the majority of my users, including legitimate ones, are running jailbroken devices. That may help skew the piracy rates towards the higher end.

Ultimately, I'm not worried about it. I wasn't banking my livelihood on the success of the app. It has made enough money to recoup my time investment, which is an added bonus. I do feel for the users who did pay for my app, however. I do feel that piracy has prevented me from spending more time making the product better for them. That is the real unfortunate side.

</comment></comment><comment><USER22> There actually is a way to avoid piracy of iOS apps: build an app that requires server-side computation/algorithms of some sort and combine that with the signed receipt capability of in-app purchases. Basically this makes it possible for you to be sure that only a single user of your application is using a single in-app purchase at a time, by validating the signature each time the user launches the app with Apple.

</comment><comment><USER23> Learn from this. Piracy offers valuable lessons to the budding entrepreneurial programmer. You learn about: consumer behavior, the nature of black markets, iOS piracy tools and techniques.

Quick story: A friend of mine, Carl Lydon, created www.chamberofchat.com, which is an 3D chat-room for Harry Potter Fans that became popular in the early 2000s. This chat-room was promptly infiltrated by a nefarious hacker who assigned himself moderator status and began spewing filth, casting elimination spells, and harassing innocent chatters. At first Carl freaked out but got a hold of himself and re-built a few key modules of his multiplayer log-in code. By the end, the hacker went away, and Carl learned more about security than he _ever_ could have from any one else. A gold-mine of lessons. A fine-art school graduate, he now makes a fortune programming multiplayer online games. Piracy is a gift.

(edit formatting)

</comment><comment><USER24> For a seond I thought he was selling a distributed denial of service attack app. Anyway, avoid clicking this if you don't want to get into one of those stupid 'piracy isn't stealing' arguments with people who make them totally po- faced as if it hadn't been said ten million times already.

</comment><comment><USER25> Build a free version of your app. I suspect some of the pirates want to try your app for free.

</comment><comment><USER26> This guy had made a bookmarklet for the same thing a short while back - <USER2> think he showed it off on HN too. (not sure - haven't tried looking for the link) You can get it out here - <http://erkie.github.com/>

</comment><comment><USER27> This post and the attention it garnered will bring him more customers than he'd hoped for (customers who will think about what he said, and maybe pitch in that dollar). Whether it was intentional or not, it's a clever marketing ploy I find.

</comment><comment><USER28> How are they pirating it.. unless they jail-break their phone?

I don't do iphone apps, but I was under the impression Apple controlled the distribution?

<comment><USER29> I'm not sure if it works anymore. But with the App Store you can download on anyone's device after you pay for it once. For example, I buy Angry Birds, and then I log in on your phone and install Angry Birds on it as a free update. Then I log out of your phone, and Angry Birds is still installed.

I didn't even know it was possible and I did iOS development. Then I saw someone do it and had a WTF moment. He just said that's how everyone he knows 'shares' apps. One guy gets it, and downloads it on everyone else's phone.

<comment><USER30> The trick is that a particular iPhone can't run around to different people's computers slurping the apps they bought on different iTunes accounts. It can only sync with one computer/iTunes account.

For example, my spouse and I could use the same purchased apps (if we used the same stuff) since we share a single iTunes account and library. I could not sync with my next door neighbor and use all their apps at the same time as I use my own.

<comment><USER29> I think we're describing different things. You're talking about syncing apps with a computer. Sharing libraries between spouses and stuff like that.

I'm talking about this set of steps (on an iPhone/iPad):

1) Go to Settings App

2) Log out of iTunes

3) Log in as Person B

4) Launch App Store

5) Download an app that Person B previously bought. This is a free update.

6) Go to Settings

7) Sign out of Person B's iTunes account

8) Log back in as myself

9) Voila! Launch pirated app which is still on my device without having to jailbreak my phone.

This of course doesn't allow me to update the app because it requires I login as the other person. And yeah, I probably can't sync this rogue app to my computer. But for games and most apps, this is enough. If an app is worth pirating it's probably good enough without the updates. And I turn off app sync because it's annoying. If I really lost my apps I'd just reinstall the ones that mattered.

NB: I don't do this myself. I'm sure if there was a more 'secure' way without being horrible Apple would have done it. Getting apps onto a device for development was/is horrific.

<comment><USER31> Is Steam horrible? As far as I know you can log in as another account and download games the other account has and play them, and if you log back into your account the game data doesn't go anywhere (so if you buy you don't have to redownload) but you can't launch them from the steam client. Why didn't Apple do something similar?

</comment></comment></comment></comment></comment><comment><USER32> you give away 9 copies to sell 1.

Perhaps you need to give more away and make it easier and then you'll sell more?

</comment><comment><USER33> ON A SIDE NOTE: <http://www.netdisaster.com/> did the exact thing but got shutdown for Phishing. Isnt this the exact same thing?

</comment><comment><USER34> Sorry, bud. That's the cost of doing business in software.

Yeah, I guess you could dedicate tends of thousands of dollars to 'combat piracy' or some such nonsense. But time an time again as indie creators find out, you treat them kindly but otherwise ignore them.

Of course, that you're on Reddit and HN, you have breached the first barrier: obscurity. If I had an iDevice, I'd try it out.

<comment><USER28> I wish EA would figure that out. I won't buy another EA game because of their DRM. Not so much that it has it. but it's garbage.

I was one of the idiots that brought a legal copy of Dragon Age 2. Only to be locked out of my account (and game) for a 1/2 week due to the DRM.

</comment></comment><comment><USER35> Charge 99 cents and hope it goes viral!

<comment><USER36> The application already costs 99c and arguably the bookmarklet the author created did go viral (to the point where I'm still having friends send me links to the asteroids 'web site killer' every few days).

One question on my mind is whether the stats are legit. If it's not some quirk in Apple's reporting system, maybe someone is maliciously hitting the link to the 'site of the day'. Wonder what the logs for that webserver look like - <USER3> every user agent an iOS device as expected?

I haven't spent much time digging into the iOS app pirating community, but my expectation is that users are less likely to pirate if there's a free version of the app. What exactly does prompt someone to crack a 99c app and make it available to other users? Why would someone go through the trouble to get it that way when it's so cheap?

<comment><USER28> You will never win the fight. So chalk it up as cost of doing business.

And everything is pirated. I once had a friend of mine hand me a pirated copy of the PDR (the Physicians Desk Reference on CD). I still have it.. though it's out of date by now.</comment></comment></comment>


YaCy – Peer to Peer Search Engine - <AUTHOR> http://yacy.net/ <comment><USER2> The project is solid technically, but, IMHO, lacks performance compared to mainstream search engines, and suffers from very poor UX/design (too many knobs).

A few years ago, I did setup a node at home to help the network but gave up a few months later, the computations/network crawls being too intensive.

</comment><comment><USER3> Maybe someone with some technical background on this project can answer... what is to keep someone from poisoning the results?

For example, intentionally returning a result for a search term that is not accurate or even spamming results by returning irrelevant pages.

<comment><USER4> Nothing prevents you from showing your own results. You can promote your own website in your search. It is expected, though, that the majority of the nodes will not show malicious content.</comment></comment>


Former founder of Wunderlist wants to acquire it back from Microsoft - <AUTHOR> https://twitter.com/christianreber/status/1169985802421592064 <comment><USER2> What did the founder expect would happen when he sold the company. Obviously Microsoft wanted to remake a Wunderlist app to be apart of their Office 365 portfolio.

Why else would they have bought them

</comment><comment><USER3> Microsoft paid more than 100 million dollars to kill this.

<comment><USER4> What was so great about Wunderlist? For $100MM, I think the previous owner could build a new one... it's just a to-do list. If you built one for your school project, you'd probably get a C+ due to lack of originality and difficulty.

<comment><USER5> It's way easier than trying to use Outlook for that purpose. Tbh I don't even know how to share tasks in Outlook.</comment></comment></comment>


MCServer (the open source Minecraft server) reaches the 5000 commit milestone - <AUTHOR> https://github.com/mc-server/MCServer?5000

<comment><USER2> Thanks for the note. Had noticed that Bahir promotet his MCnext server, but did not know about this.</comment>


Ask HN: Do you want to price your inbox? - <AUTHOR> You can hide your email behind a contact form, where you set the price for people to contact you. You give people this link, and they never have your email. If you're okay to talk more, you can write them back, if they left their mail ( or their link ).
Does this sound like a futuristic utopia to you?
It's actually here: https://a-rtefact.com
And no, it will never look slick. Sorry. Go to any other site if you want slick design. Hopefully this works and is secure, and is useful. That is the aim. <comment><USER2> Couldn't this functionality be implemented at the level of the MTA, for example by a milter that autoresponds with payment instructions to any sender who attempts to contact the recipient without having paid? Then users wouldn't have to look at your web page at all and you wouldn't have to apologize to HN readers for its appearance.

An MTA level solution also avoids the obvious potential problem of creating an aftermarket for high value email addresses. Enterprising brokers could acquire them initially by paying the money to solicit a reply, and then they could recover their investment by selling the email address at a discount to whoever else wants to contact the recipient.

</comment><comment><USER3> Posts without URLs get penalized, so you'd be better off posting this with a link, then adding your text as a first comment in the new thread. Good luck!

</comment><comment><USER4> I can see uses for this if you want to cut down a lot on how many people contact you. But it seems like it could accidentally become a barrier to those who are unsure of themselves or have easier options than dealing with you.</comment>


Tempe police investigating self-driving Uber car involved in deadly crash - <AUTHOR> https://www.abc15.com/news/region-southeast-valley/tempe/tempe-police-investigating-self-driving-uber-car-involved-in-crash-overnight <comment><USER2> [https://news.ycombinator.com/item?id=16619917](https://news.ycombinator.com/item?id=16619917)

1400+ points</comment>


Contenture is No More - <AUTHOR> http://www.contenture.com/

<comment><AUTHOR> It was an exceptionally simple and bright idea - pay to opt out of seeing ads on participating sites - and it is really sad to see them shutting down.

" _Without any large publishers, the economics just don't work._ "

<comment><USER2> Wouldn't "how are you going to get websites on-board?" be the number one question that any investor or founder would need answered?

</comment></comment><comment><USER3> I'm sad to say I'm not very surprised by this. The problems involved in this kind of start-up are not technical, and this was a mostly technical solution.

</comment><comment><USER4> Shoot. I really like this guy. And thought this was clever. Is it too soon to quit? Or is this really sucking down too much time and money to keep it goin?</comment>


Celery Distributed Task Queue Client/worker in Go - <AUTHOR> https://github.com/shicky/gocelery <comment><USER2> If it meets the guidelines, this might make a good "Show HN".

Show HN guidelines: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)</comment>


Document control - how hard can it be? - <AUTHOR> http://www.woobius.com/scribbles/posts/0007-document-control.html

<comment><USER2> Being an architect, I'm used to dealing with thousands of documents on a project. The only meaningful way I've discovered to organize those documents is by the flow of work they are being used on, which is what we do. It is especially important when dealing with multiple companies on a single project. Folders and nested folders are a paradigm of the low-productivity windows way - we tried this, it never works well. But document management is really only a small feature of a larger integrated application that guides users through the larger workflow of getting projects done.

<comment><USER3> Oh, hmm. It would be kinda cool to separate the document management from the workflow ... like, build a document management system with an API, and then create various user interfaces that could interact with it according to different applications.

<comment><USER2> I think that is the future - many smaller apps integrated together as features within a larger comprehensive application. Integration is the key to really getting productive as opposed to having multiple disconnected apps.

</comment></comment></comment><comment><USER3> So, I posted my comment on the site, since I happened across this from "that other" forum.

But I've been playing around with this idea for a while, and I'd love to get some HN feedback on it.

<comment><USER4> Hey, Daniel Tenner here (author of the article), and one of the technology guys behind Woobius.

We hit the same problem with folders-within-folders getting too complicated, but we tried a subtly different solution. All of us use tags in things like GMail, but the funny thing is, we end up using them like folders (in fact, I have my tags in gmail mapped as folders in Mail.app).

So what we did on Woobius is we implemented folders, but we restricted them to one level. So far, a handful of people have requested folders-within-folders, but the majority seem happy with the system as it is, and the big advantage of getting rid of that messy folder hierarchy is that it's made the system look a lot simpler and quicker to use.

Would love to know your thoughts on whether that works for you.

I'll add this reply onto disqus as well.

<comment><USER3> Eh, not really.

Treating tags like folders isn't really bad; you might not be using them quite to their fullest extent, but you're also not really limiting yourself when it comes to categorizing data.

...which is where the single-hierarchy folder system wouldn't work, because it does create a limit.

I like to think of it this way: currently, the paradigm (I hate that word) is that you have a folder -- a category -- which owns lots of files. What I want instead is to have a file which owns lots of folders -- or categories.

The one client I mentioned in my Disqus response is doing some energy research, government contract and all that. They really need to keep things well-organized, and they need to be able to organize drawings, specs, notes, graphs, test data, etc. etc. by project, by contributor, by date, by revision, by ... etc. etc.

Another client is a doctor's office, and that's probably all I need to say about that. :-)

So, no. While a one-deep hierarchy solves some problems, it's still clutching on to a silly way of organizing things, without actually providing the flexibility of a really intelligent tagging system.

<comment><USER5> Ultimately a folder (or a tag) is just another piece of metadata, like the ones you listed-- project, contributor, date, revision, etc.

The core issues are input (how do I get this metadata attached to the content? dragging to a folder, document analysis, filesystem metadata, tag autocomplete) and retrieval (how can I quickly sort and filter to find the document(s) I need, based on some set of metadata criteria?)

Whether or not that metadata has a hierarchical structure (a taxonomy/vocabulary), and whether that structure is controlled (e.g. only privileged users can create new terms) is secondary to the question of speedy, usable input and retrieval.

<comment><USER6> I worked with Documentum document management systems. Tags are critical to being able to retrieve a document once it's scanned in. The problem, of course, is mis-tagged documents.

<comment><USER5> mis-tagged is the same as mis-filed. This is where having a controlled vocabulary makes sense, or at least a periodic orphan cleanup process.

<comment><USER3> Right, mis-tagging is a _process_ problem, not a software one. At least, I can't think of a software way right now to solve that.

...Although, like you mention above, being able to find documents quickly can make it much easier to handle. For example, the UI should give you the ability to show all documents modified in the last N days, by user X, etc.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Having to work with and ditribute hundereds of documents to dozends of people every day - woobius is the best!

<comment><USER8> Care to mention why?</comment></comment>


Ask HN: Recommended books or resources for genuine small businesses - <AUTHOR> My wife is a bonafide small business owner.  She runs an interior design business as sole proprietor with a handful 1099 contractors on staff to help with errands and junior design work.
She is at a point where her business is thriving, but she is struggling under the weight of her growing business.  She is a creative.  She's great at that part.  My expertise is in growing startups quickly, which is frankly useless to her.  At best my ideas are overkill, and it's hard for me to shift my mindset since I don't know small businesses.
Can anyone point me in the direction of some tried-and-true small business frameworks?  A good book or two would go a long way. <comment><USER2> SBA ([https://www.sba.gov/](https://www.sba.gov/)) has a lot of resources. Also SCORE ([https://www.score.org/](https://www.score.org/)) has retired volunteers that can mentor.</comment>