Which Online Payment Solution Should Your Startup Use? - <AUTHOR> https://foundersgrid.com/online-payments/ <comment><USER2> It totally depends on your needs and what is generally acceptable. In Nigeria,for example VoguePay.com platform has been widely adopted by small businesses because of it unique features and free add-ons.

It is important to note that many businesses wants something that is easy to set up for use immediately at low cost. Being that Nigeria is still a cash- driven economy with low adoption of online payment compared to other regions, it will be a smart move to consider a payment gateway that is nearly one-size- fits-all for all card type and payment channels.

VoguePay excels here, that's why I recommend it for startups to use both for local and international payment transactions</comment>


Apache plugin turns legit sites into bank-attack platforms - <AUTHOR> http://arstechnica.com/security/2012/12/apache-plugin-turns-legit-sites-into-bank-attack-platforms/ <comment><USER2> Any suggestions on how to test for the existence of this?</comment>


Microdobe? - <AUTHOR> http://mattmaroon.com/?p=362

<comment><USER2> I find the timing of the article pretty ironic. Its interesting that you bring that up. I think you could be right that Adobe would be a good acquisition for Microsoft although merely talking about search Adobe doesn't fit will into that strategy. Microsoft is struggling to capitalize in search space and they obviously find it an important piece of the puzzle. At this moment Yahoo was their best fit in order to increase their market share. I am not quite so sure if they can do that with adobe.

Although i think a mash-up of Microsoft and Adobe technologies would be cool to see.

<comment><USER3> Adobe is clearly not going to help Microsoft with search. I'm just not sure that search isn't a bit of a lost cause for them anyway.

<comment><USER4> For enterprise search their acquisition of FAST should have a very strong impact. I wouldn't count them out for intranet oriented solutions.

</comment></comment></comment><comment><USER5> Partnering with Yahoo would have given them dominant market share in IM and Mail - which means more data to play with to beat Google out of the advertising/search market. Advertising/search brings revenue, unlike Flash or Silverlight.

I'm not sure why I'm not seeing it, but could someone expound on what "owning" Flash would even give MS, aside from bragging rights...

</comment><comment><USER6> Flash going under Microsoft control would be a nightmare scenario for me. Noooo!

<comment><USER7> It might be bad enough to get the government involved again. The government killing flash would be awesome.

<comment><USER6> Awesome? It would kill my project and many others, e.g. YouTube. I hope Adobe opens everything up before any of that happens. "In the long run, the utility of all non-free software is zero."

<comment><USER8> HTML will get native video support in the future so we won't need flash for it anymore.

<http://www.whatwg.org/specs/web-apps/current-work/#video>

<comment><USER6> Flash is good for more than just video. E.g. I think <http://samorost2.net> cannot be reimplemented with existing "open web" technologies. At least I haven't seen any compelling examples.</comment></comment></comment></comment></comment>


Is Apple charging for free apps in the Mac Store? - <AUTHOR>

I signed up for the app store last week and downloaded a free app, but have now seen a charge of 1.98 euro (or equivalent of US$2.50) on my credit card account. There was no email, invoice or anything from Apple and no indication of a purchase from Apple in my mac store account. Could this be an authorization hold? Any info on this would be great, we're looking at porting some apps to the store and can only imagine what kind of customer service nightmare this might be. <comment><USER2> Was this your first purchase? If yes this is standard change they make to assert your account is valid before you can continue. Same thing happened to me when I registered but did not even buy an app! (Same thing paypal does when you update/add a credit card.)

<comment><AUTHOR> Thanks! Why they don't tell you this is very frustrating. I couldn't find anything about this anywhere and was going to contact the App developer.</comment></comment>


ByteDance CEO "forced sale of TikTok to US buyer is unreasonable" - <AUTHOR> https://www.bloomberg.com/news/articles/2020-08-04/bytedance-ceo-says-trump-s-real-goal-is-to-kill-off-tiktok <comment><USER2> China has a stifled business climate toward US companies, pretty much give China the secrets of your business and you can do business there, we know that. But I don't recall them ever forcing a sell to another entity. More of restrictions and getting pushed out of the country like Google did, even though they are now having another go at it. How did Microsoft even get into the middle of this and not FB? Zuck has been parroting Trump's view on social media.</comment>


Bitcoin Mints New Words - <AUTHOR> http://spectrum.ieee.org/computing/software/bitcoin-mints-new-words#.Vsq3Gt5C-v8.hackernews <comment><AUTHOR> The boundaries of where any endeavour lie are never too clear.</comment>


Ask HN: How Much Alcohol/Coffee Do You Drink? - <AUTHOR> <comment><USER2> Alcohol? Almost none. Don't get me wrong, I'm not a teetotaler or anything, I just rarely drink. I drank a little more in my 20's (who didn't?) but I'd say for the past 20 years or so, I average less than 1 drink / month, and probably drink enough to get a buzz less than once a year.

Caffeine: If you poke me, I'd probably bleed pure caffeine. OK, maybe not _really_ , not anymore. On average I'd say I drink 2 or 3 cups of coffee during the day, and maybe 1 or 2 cups of green tea. And a couple of 20 oz bottles of Coke Zero spread throughout the day as well.

What I don't do, that I used to do, is consume completely ludicrous amounts of caffeine... in years past, I'd drink 4 or 5 cups of coffee during the day, then after work go to Starbucks and sit there and drink a can of Red Bull, a triple-shot latte, and maybe eat a box of chocolate covered espresso beans. And I'd do that sort of stuff 5 days a week and something similar on the weekends. Then I had a heart-attack. My doctors say caffeine is fine now, but in moderation. I don't necessarily claim that the caffeine per-se contributed to my MI, but what I believe did is the sheer stress of how hard I was pushing myself during the period. So I don't do that anymore. Not to that extreme anyway.

<comment><USER3> I'm not your doctor, or even _a_ doctor, but I don't think 2-3 cups per day + Coke zeros + green teas is considered "moderate" caffeine intake.

If I drank so much caffeine that I got a heart attack, I'd probably stay away from the stuff...

<comment><USER2> True. In relative terms though, I'm in a much better place now than I was.

That said, I probably could stand to cut down even further. What I have been slowly trying to do is move to not consuming any caffeine after about 5:00pm or so, to avoid having it affect my sleep. I read something here on HN that mentioned that even people who _can_ fall asleep after consuming caffeine late, may not experience the the _quality_ of sleep they need due to the caffeine effect. So cutting out Coke Zero after work will help with that, and reduce the total caffeine quantity a bit.

</comment></comment></comment><comment><USER4> Alcohol: Only odd-numbered years (e.g. 2017, 2019). Started this in 2012 to avoid carrying over college habits into the professional world. Works for me.

Caffeine: Used to be 3-4 cups of coffee, now its 1-2 with some days opting for matcha or black tea. Slightly lower caffeine content, with no crash, somehow.

</comment><comment><USER5> Alcohol: Maybe a few drinks a month? I love going for a beer or three after work, but the older I get the more I find that I can't tolerate the day after. It's not even necessarily a hangover thing, but more of a stomach thing. Regardless of what I drink, I'll feel a bit off for at least half of the day, so it's not really worth it for me. If anything, I prefer drinking during the week, because at least I know I'll spend that half of the day where I feel sluggish/sensitive sat down in front of a computer.

Coffee: Enough that I can go into my local coffee shop, and the nice girl that usually serves me asks me if I want my usual order. I'm more of a tea drinker (living up to the British stereotype), mostly because I can drink a few cups of tea throughout the day and feel alright, but if I've got a busy day I'll grab a large cappuccino from nearby.

</comment><comment><USER6> Alcohol: Maybe once a week. Never more than a drink or two.

Caffeine: Sometimes espresso in the morning. Not regularly. I think a juice or a smoothie does a better job of waking me up in the morning. I used to drink a lot more coffee... but I think I was more groggy until I had my coffee, than I am now with drinking it sparingly.

</comment><comment><USER7> Alcohol: Special occasions, and other than that maybe a beer or mixed drink once or twice a month. I have passed my "alcohol era" (which was still only 1x a week but much heavier drinking) because it does more harm than it's worth. I think I got a decent amount of enjoyment out of it without most of the damage (but who knows)

Coffee: Used to be everyday, now my caffeine intake is more varied (Caff+L-Theanine pills, energy drinks, lots of tea). I probably consume on average between 300-500mg a day total, spread out. Coffee itself, maybe once a week, though I plan to go back to drinking it daily. I do love coffee just lately I haven't had as much of a desire to have it.

</comment><comment><USER8> Not enough on both accounts.

If I had to give an on average/daily account.

\- 4 double shots of espresso daily; I bought a good espresso machine. \- around 1 beer every 2 - 3 days

If I have wine, I typically will drink the entire bottle because I hate leaving a bottle open. I Might do this every 3 months?

<comment><USER9> _> because I hate leaving a bottle open._

I used to share that concern until I discovered that many young full red wines are just as good, if not better, in the day or two after opening. No need for a vacuum plug either. Just plug the original cork back in. The result probably depends on the style - I typically have very full reds which already benefit from opening at least an hour before drinking.

</comment></comment><comment><USER10> Not enough. About 1 cup a day (down from 3), but my red bull has gone up by 2 cans of 12 oz, so it's about an even thing. Alcohol, I actually have to slow down my drinking, but I would say about 10 shots a month is a decent average.

</comment><comment><USER11> Alcohol: Basically none. Currently I might average 1 beer every 3 months or so. In the past I have enjoyed a nightly relaxation beer, but found it more costly than I cared about, so I cut it.

Coffee: 3-4 cups a day. Typically 2-3 in the morning, and 1 in the afternoon after work. This has gone up and down over the years, in the past I've drank a lot, upwards of a full pot. Then I developed an eye twitch. Now I'm trying to control that intake. Lowest I think I've been is 2 in the morning, 1 in afternoon.

</comment><comment><USER12> You know, if you're on HN a lot and respond to questions like this, you share a lot of valuable private information. Which is publicly accessible.

<comment><USER13> What is the danger of sharing how many cups of coffee you drink?

<comment><USER5> I think the danger is more around how much alcohol you consume, especially if you do it around professional settings like user groups and hack-nights.

If your name can be tied to a HN account, and your account of drinking at developer events matches up with local stories of "that guy that gets drunk each month" then that's enough for sway some hiring managers towards another candidate.

It's an extreme example, sure, but most people do a few Google searches to see what comes up when a candidate comes in for an interview. In my experience, I've seen some...strange things come up on peoples Twitter accounts when I've done a quick check on them, and while I try to keep my decision to purely a skilled-based one, a lot of people will have their opinion on someone swayed by their actions online.

</comment></comment></comment><comment><USER14> I'm half-asian so I'm literally allergic to alcohol ... it's a bummer that so much social interaction is based around alcohol.

<comment><USER15> Have you tried taking an anti-histamine pill beforehand?

<comment><USER14> I've tried Zantac (i.e. heartburn tablet) but never anti-histamine, is that something I should check out?

<comment><USER15> I'm not a doctor, but desloratadin allows my girlfriend (also half asian) to drink a glass of wine without getting all red.

</comment></comment></comment></comment><comment><USER16> 0, 0.

These responses seem very biased given that they are public and associated with our public identifiers (usernames). I'm curious how biased. Obviously, the people who drink very little are more willing to share than the alcoholics, but they are also more likely to take the time to respond than the "average" drinker.

</comment><comment><USER17> Alcohol: 10-15 drinks/day

Coffee: 2 or 3 cups/day

<comment><USER8> I hope you manage to turn it around once you feel that you hit rock bottom. I understand its a choice only you can make and no one can force you to do.

Best of luck.

</comment></comment><comment><USER18> Half a pot of coffee per day 500-700 grams of 80 proof on weekends, Fri evening to Sunday. 50 grams, 80 proof is 116 calories, 0 carbs.

I am on a low carb, high fat, intermittent fasting, 1400 calorie diet. So I weigh most everything, including the rum.

<comment><USER19> I have never seen someone list out their alcohol intake in grams. That's great.

</comment></comment><comment><USER20> More than is optimal for my physical health, but about right for my mental health.

</comment><comment><USER21> Alcohol: one-two times a month. Caffeine: two mate teas a day, no coffee.

</comment><comment><USER22> Alcohol: none. Caffeine: 3 English Breakfasts in the morning, and a 'red eye' (20 oz dark roast + an espresso shot) around 2pm. Worth noting: I also do a daily hard cardio workout; love to sweat.

</comment><comment><USER23> None and none.

Getting off caffeine was much harder than giving up alcohol because coffee is free in almost any office.

Getting off sugar in addition to caffeine helped my health, reasoning and sleep significantly.

</comment><comment><USER24> Coffee: 2-3 16oz cups/day

Alcohol: Depends on the kind of day. Stressful, I'll have a couple fingers of whisky. On a weekend I'll finish a bottle of wine. Usually twice a week

</comment><comment><USER25> Alcohol: usually just a couple drinks a month. A few times a year I'll drink enough to get a buzz.

Caffeine: Green tea every morning, occasionally a coffee with desert in the evening.

</comment><comment><USER26> Alcohol: Not as much since I got my car. I used to drink 1-2 beers like 3 times a week.

Caffine: 6-8 cups of coffee a day during the week, 1-2 in the weekend

</comment><comment><USER27> I only consume alcohol socially, and only a few times a month. I probably drink around 5 Cokes per day, I need to cut back.

</comment><comment><USER28> Alcohol: Depends, on average six beers a week (2 beers Friday, Saturday, Sunday) Coffee: 1 or 2 cups a day

</comment><comment><USER29> Caffeine: 2 cups of coffee when I get to work, 1 after lunch.

Alcohol: 3-4 beers 4-5 times a week

</comment><comment><USER30> Alcohol: none. Caffeine: three or four iced tea or coffee a day (well, six today so far)

</comment><comment><USER31> No alcohol. I drink lots of tea, if you want to consider it as caffeine

</comment><comment><USER32> Alcohol: once or twice a week, usually 1 or 2 pints of beer

Caffeine: 3 or 4 espressos daily

</comment><comment><USER33> Alcohol - Only socially. Maybe 1-2 beers a month

Coffee - 2-4 espresso shots a day

</comment><comment><USER34> Alcohol: 0! Coffee: one cup per day in the morning!

</comment><comment><USER35> Alcohol: 2 drinks/wk Coffee: 20-ish cups a day.

</comment><comment><USER36> Alcohol: Everyday. Coffee: Everyday.

</comment><comment><USER37> Lots. Why are you wondering?</comment>


Show HN: Twothy: 2FA Authenticator for CLI. Compatible with Google Authenticator - <AUTHOR> https://github.com/vedhavyas/twothy <comment><USER2> [https://www.reddit.com/r/programming/comments/7q2ok2/twothy_...](https://www.reddit.com/r/programming/comments/7q2ok2/twothy_a_twofactor_authenticator_for_cli/)

</comment><comment><USER3> Can you elaborate on the threat model here? Having the second factor be stored on the same device you're entering your password on, protected by a password (another example of something-you-know), seems to counteract most of the benefits of having TOTP.

<comment><USER4> I think its largely about protection from remote attacks.

Its a kind of "only allow logins from this device". This doesnt solve all problems definitely, but for some of us there is zero practical danger from our location and much higher danger from geographically remote locations</comment></comment>


The Startup Visa Act Must Be Stopped - <AUTHOR> http://www.businessinsider.com/why-the-startup-visa-is-actually-a-really-bad-idea-2010-3

<comment><USER2> The biggest issue I have with the Startup Visa Act is that if this is a person that we want to let in because of an investment, then this is a person we want to let in, period. Just give them a green card.

What this act tries to do, in a sense, is outsource the decision making (to the investors).

The biggest problem with the H1B visa is that it allows the employer to hold this unholy ax over the visa holder. It's absurd and counterproductive. These are people we should want in this country. Arguments against illegal immigration do not apply here.

So, if an investor actually invests in a startup with a foreign founder, just give that person a green card or a long visitor's visa depending on what he wants (I assume not everyone wants to move to the US). The whole talk of a successful entrepreneur is ridiculous when so many startups fail. We want that entrepreneur even if this particular venture fails.

<comment><USER3> Finally a concrete, constructive suggestion that actually makes sense.

<comment><USER4> I agree 100% in theory, but in concrete it just doesn't work. How do we determine the person is an entrepreneur we want in? It's easy to say if we are going to give them an H1B or a startup visa (whatever that ends up looking like) we should just give them a green card, but it sounds to me like a major part of this issue is who is actually doing the deciding, not only what the decision itself is.

For instance, we trust the government with software patents right now and over and over again they approve what we consider to be horribly damaging patents. We should trust them to evaluate an entrepreneur as well?

There is a reason this decision is outsourced to the employers/investors: it's actually the more free solution. Otherwise it's up to the government to determine who's/what's worth paying for, and just hoping they are right. This way we've already established a market for the person before they enter the country. It's far from perfect, but if you just give people green cards how many people do you think will suddenly want to be entrepreneurs to get their green card?

The government doesn't seem capable of regulating anything right now, so I'm pretty content to outsource the decision to investors and employers. At least that way they have a chance to get a Fred Wilson, instead of a guarantee not to.

<comment><USER5> Investors are only 10% correct at predicting startup success so I'm not sure they are the ones to be relying on for an accurate assessment.

<comment><USER6> > Investors are only 10% correct at predicting startup success so I'm not sure > they are the ones to be relying on for an accurate assessment.

We're only relying on them to identify some likely candidates. Those who work out get to stay.

<comment><USER5> so if an entrepreneur signs up, (s)he's got a 90% chance of being sent home? I wouldn't like those odds.

</comment></comment></comment></comment></comment></comment><comment><USER7> I think the startup visa is an excellent piece of legislation. I know of several startups now based here, and lots of budding entrepreneurs moving to town - just because of the Visa requirements. And with this city's links to China and India I'm confident this will be the home of the next big thing.

Of course I'm in Vancouver (BC) and these are guys being frustrated by the US process. Some of them hope to eventually open branch offices in Silicon valley so you will pick up some of the outsourced work.

</comment><comment><USER8> As Dave rightly schooled me here: <http://news.ycombinator.com/item?id=1149503>

_aditya: dude, if you can't create at least 5 jobs in 2 years with $250K in capital, you're a pretty pathetic excuse for an entrepreneur._

The article is a little too sensational, which seems to be the norm with BusinessInsider these days.

<comment><USER9> And the stuff about it being "bad for investors" is pretty rich. Sure, there are might be some funny incentives created by a Founder Visa program, but none that wouldn't be transparent, known, and probably avoidable.

</comment></comment><comment><USER10> I posted a similar analysis a few days back about this Startup Visa. [shameless self-plug] [http://vinthanedar.com/2010/02/26/my-thoughts-on-the- startup...](http://vinthanedar.com/2010/02/26/my-thoughts-on-the-startup-visa- bill-fail/)

</comment><comment><USER11> Does this mean I can't bootstrap my company?

<comment><USER7> Of course you can - you just have to bootstrap it in China or India. Then when you are succesfull, and after having created lots of jobs in China or India, paid lots of taxes to China or India and earned lots of foreign currency for china or India.

The US will then allow you to come in and buy their companies - as long as they get a few % commission to Wall st.

</comment></comment><comment><USER12> I think pg, bfeld, ericries, etc would all agree with these complaints about the Startup Visa as presently constituted. The people that wrote the bill structured it _so that it would be easy to implement as a first step_. It's not meant to be comprehensive, it is a tweak to an existing visa class that's not being fully utilized. But it will give _immediate, positive results_ that can be used to push a more effective, fair, etc version later.

Hacking Washington isn't the same as hacking computers.

<comment><USER13> So the legislative approach is to put something out there as quickly as possible and then iterate on it? Fitting.

<comment><USER14> The thing is, iterating on the legislation may not be possible.

If you are a smart, clued-in high tech founder who isn't completely in love with your initial vision, then it's possible to iterate from a potentially disastrous idea into something people will pay for.

With the Startup Visa Act, if the initial flawed piece of legislation doesn't produce some notable successes, then unimaginative lawmen who didn't like the idea in the first place will point to the initial lack of results and kill off any hope of iteration number two or three - which may be what in fact is necessary for the Act to succeed in achieving it's original aims.

</comment></comment></comment><comment><USER15> Is the Startup Visa better than the status quo?

All the criticism about the Startup Visa seems right, but still, for someone seeking a visa it's still better to have also this option than not having it.

People criticize things for not being perfect (or actually very imperfect) when what is important is if it is a step in the right direction. Does the existence of the Startup Visa make things easier for foreign entrepreneurs compared with what we have now? Yes it does.

<comment><USER11> No it doesn't. Its just another form of slavery like H1b.

<comment><USER5> It's not slavery, because slavery is not a choice. H1B holders choose to accept the terms and can choose to go home. Slaves can't.

<comment><USER16> I agree. While I take a very dim view of the H1B visa, I don't think it's helpful to liken it to slavery.

In fact, in some ways, it's not even entirely appropriate to compare it to indentured servitude, since these folks were essentially "owned" - the main difference being that they were released at the end of their term of service (the reality was pretty brutal, from what I've heard).

On the other hand, the H1B is particularly offensive in that the quid pro quo is purely visa and green card "sponsorship". The employer is allowed to bestow a government status - legal residency - that the worker could not otherwise obtain.

I'm actually kind of amazed that people put up with this in 2010, that a corporation would have that kind of power over an individual. I think a lot of it comes from a lack of understanding of what's really going on.

<comment><USER17> you can always leave your sponsor,you know, and find a better one. i did it 5 times in 5 years. felt like a runaway slave with the first one, escaped south went to new york, and i'm a free man now, my own masta

</comment></comment></comment></comment></comment><comment><USER18> A new kind of visa is just insane. An overhaul on how immigration is done in the US needs to be done. Since that won't happen, the next best thing is another band-aid. A Startup Visa.

</comment><comment><USER19> The article convinced me there are problems with the act but why must it be stopped? Should I go round with a sledgehammer destroying works of art that are incomplete too?

<comment><USER20> It must be stopped because it doesn't increase the number of green cards issued, it just reallocates them. As such, it will damage the existing system, rather than just creating a new damaged system.

To build on your analogy, it's like burning half of an incomplete work of art, to get wall space for another one.

</comment></comment><comment><USER21> Please give me a break! First, congratulations - your sensational headline got me to read the article. But, other than the "granular" problems you point out, the larger arguments are just silly.

The Act does not tip the power construct unfavorably towards investors. Any VC worth a damn is a partner not an adversary. If a VC uses conditions in the Act to exert leverage in negotiations, he is not worth having as a partner in the first place.

The Act does not increase entrepreneur risk. Every founder has to consider many different areas of risk to his business, to his family and to his lifestyle. Rather than increasing risk, the Act presents an opportunity. As with any opportunity to gain something, there is a chance that you will fail. The Act would only increase entrepreneur risk if it changed the law in that it reduced opportunity - it doesn't.

The Act is bad for (US) investors because good entrepreneurs will self-select away from the US? Come on! That is absurd and in fact the opposite should happen.

Sorry, but the article seemed for the most part insincere or misinformed.

<comment><USER22> um, I'm new to HN, but how do you downvote a comment?

<comment><USER23> You need to accumulate a certain number of points (by posting comments or stories that get upvoted). Then you get the privilege of downvoting.

<comment><USER22> Thanks for the explanation!</comment></comment></comment></comment>


Harsh Truths About Corporate Blogging - <AUTHOR> http://www.smashingmagazine.com/2009/08/09/10-harsh-truths-about-corporate-blogging/

<comment><USER2> i have had way too much experience with people who need to really grasp reasons 1, 4 & 8.</comment>


Show HN: Everyplay – Open Library of Free Marketing Resources - <AUTHOR> http://everyplay.co <comment><AUTHOR> Hope people don't mind the re-post of the same URL a few weeks later but I've changed the point of the site completely based on user feedback.

My goal is to have a huge rated high-quality collection of free marketing resources available to startups and entrepreneurs.

Dump your best marketing bookmarks today :)</comment>


Carmen Ortiz Strikes Out - <AUTHOR> http://harpers.org/blog/2013/01/carmen-ortiz-strikes-out/ <comment><USER2> I agree with the sentiment here, but some of the specific claims are certainly wince-worthy. College prank? Greatest prodigy of his generation? Little to no commercial value? All those claims are a lot more complicated than that!

Not to mention it makes it sound like Ortiz was cooking this all up behind closed doors and everyone else was shocked! shocked! to realize how the "prosecutorial misconduct" had gotten out of control, when this is the way DoJ does everything it touches and everybody knows it.

<comment><USER3> I think this is the hardest part. Ortiz is obviously disgusting, but she's not really different than anyone else in her position. These kinds of tactics are employed every day.

So what do we do? I support the demonization of Ortiz purely on the level of revenge. In a world where we typically have no agency, it's satisfying to make someone like her uncomfortable.

But on another level, it's frustrating that it's impossible to put the system on trial. It's unfortunate that by demonizing Ortiz, we play right into the hands of those who appointed her (and will appoint her successor) by making this out to be the fault of an individual. It makes it easier for them to act shocked, replace her, and be done with it.

<comment><USER4> I get that vengeance can be satisfying, but it means sending a message. And the message that US attorneys are going to hear is "don't fuck with young affluent white hackers with powerful friends".

I never met Swartz, but I'd be surprised if he'd have wanted his legacy to be people that look like him getting a pass while everyone else suffers the same as before.

<comment><USER5> There is no reason to suppose that this will be taken as a reason not to prosecute _white people_. The specific act and its context are clearly more important.

<comment><USER4> In international relations, there's a whole literature devoted to signalling: looking at how states send signals to other states. There's a huge amount of evidence showing that the signals received are very often different from the ones transmitted.

<comment><USER5> The race of the defendant isn't a salient part of this. We don't have to wait for a black Aaron Swartz to act, on the far-fetched premise that the only thing that will be noticed by prosecutors was his color. This is a far-fetched idea.

Federal prosecutors are certainly intelligent enough to understand many of the factors which make this sensitive, including a suicide, internet backing, the specific alleged crime and the open access issue. Without deciding that the whole problem is that you can't prosecute white people. So many white people are prosecuted without fanfare that this would be an impossibly irrational conclusion to draw.

<comment><USER4> Are we really going to pretend that federal prosecutors are colorblind, that aren't significant racial disparities in federal sentencing already?

<comment><USER6> Did he say anything of the sort?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This is a very intelligent, informed summary of the mounting case against the prosecutors. The author minces no words when describing Ortiz' and Heymann's strategy of charging Swartz with a battery of preposterous charges with the express intent of making any action _except_ accepting a plea bargain (and thereby pleading guilty to all charges) the only reasonable approach: "[T]hey assumed that the risk of their success even on bogus charges would be enough to pressure Swartz into accepting a guilty plea on all the counts in exchange for a reduced sentence — which is what they offered him."

But what raises the deepest concern when I read this article is that the author continues on to describe Swartz's case not as a particularly bad example of prosecutorial oppression but rather as an exemplar of justice in the United States: "The process was fundamentally corrupt and shameful. But observers of the American criminal-justice system also know that it was a common one."

What can we do about this?

<comment><USER8> This.

While Ortiz will be the convenient (and rightful, I suppose) scapegoat in this instance, she's a symptom of the problem and not the cause. There are far more fundamental problems with the DoJ, and until they're addressed (time and cost of mounting a defence, overly aggressive prosecutions, lack of oversight and discretion), nothing will change.

<comment><USER9> I know that "don't treat the symptoms! treat the root cause!" is a common, almost unassailable sentiment, but lately I've been thinking there are problems with it.

In order for it to be completely ineffective to "treat the symptom", it rests on the assumption that successfully treating the symptom will have zero effect on the cause behind it.

A good example of that is taking pain meds to mask the pain of a knee injury. So then you go and run on it, and it makes the knee injury worse. You treated the symptom, and nothing changed.

But there are definitely examples where treating the symptom _does_ help. For instance, someone is temporarily depressed because of a unresolved situation in their lives. And yet, they cannot address the situation because the depression is in the way. So, they take an anti-depressant, and then maybe they can resolve their root cause, and then maybe they can go off the anti- depressant.

Someone like an Ortiz, yes, is a symptom of a deeper problem. But I'm not convinced it is like the pain in a knee, where treating it will make zero difference. A bum knee isn't exacerbated by the pain. But the system may be exacerbated by Ortiz. A bum knee doesn't become a bit less bum from witnessing the taking of a pain med. But if the system recognizes an Ortiz downfall and receives a data point of what "going to far" is, then maybe that _would_ have an effect.

Probably not a sufficient effect, probably not enough, but I'm just pointing out that the fact that Ortiz is a symptom, is not, by itself, sufficient reason to believe that "nothing will change". Also not sufficient reason to believe that the symptom should not be treated.

<comment><USER10> I agree with your point, but treating the symptom must be done in such a way that the problem is still seen to be a problem. Another case in point was when the banking collapse hit, 'leaders' blamed things like 'excess greed' and so on, and dodged the real problem (IMHO).

I'm afraid of throwing Ortiz to the wolves, washing our hands and saying, "Well, that's that."

<comment><USER5> What was 'the real problem' with the collapse, in your view?

<comment><USER10> People smarter than I will have to figure that out. I'm talking about fairly soon after, before any investigation, we had politicians (McCain, for one) blaming "excess greed." I think this is a straw-man. The people in that job get paid to be greedy. You can't blame that, you have at least recognize that a system (regulations and work flow) is broken if it is so obtuse that people can't even know what decisions are in their own best interest.

<comment><USER9> I actually sort of see this as a real-life tragedy of the commons situation, although you kind of have to squint your eyes and wave your hands a bit to make it fit.

The "common resource" is the client opportunity. The Nash equilibrium is every employee maximizing their own bonuses. The group optimum is the health of the company. It turned out that the individual self-interest did not align to what was good for the health of the companies. And in fact, that if they had cooperated and worked for the health of the companies, the employees may have ended up with higher individual payouts. This is exactly what the tragedy of the commons is about, and it's what apparently shook Greenspan to his core. So basically, it was the (predicted (over and over again)) failure of Objectivism.

<comment><USER10> That's an interesting take. I always thought that they didn't know that their actions would result in such disaster.

I worry about the same non-effect with the gun-law blitz we're seeing after Sandy Hook. I worry that we're not attacking the problem- which may have more to do with mental health issues than gun laws.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Important part:

Prosecutors Ortiz and Stephen Heymann turned to a standard trick while pursuing the case, mounting a total of thirteen felony counts against Swartz and arguing that his college prank aimed at "liberating" a collection of academic articles with little commercial value was a serious crime. Although each of these counts bordered on the preposterous, Ortiz and Heymann clearly reckoned that at least one or two would stick during the jury-room bargaining process. More to the point, they assumed that the risk of their success even on bogus charges would be enough to pressure Swartz into accepting a guilty plea on all the counts in exchange for a reduced sentence — which is what they offered him. The process was fundamentally corrupt and shameful. But observers of the American criminal-justice system also know that it was a common one.

<comment><USER12> Thanks for highlighting that; I read the article and felt that this paragraph stood out for the right reasons.

I've read some negative comments about the article, which surprised me; as this paragraph proves, the article isn't painting Ortiz as a rogue exception to the rule.

</comment></comment><comment><USER13> > _Heymann responded by saying "Fine, we'll lock him up."_

Cruel and barbaric. This comment is horrifying.

Many people commit suicide in prison. Being under suicide watch reduces, but does not eliminate, the risk. (I know someone who was under "level 2 observation" (a member of staff within arms reach at all times) in a MH hospital. They managed to self harm so severely they needed to be transported to a general hospital for several surgeries.)

America sends many people to prison. America has awful mental health care. The care for people with mental health problems is so awful that prisons are often the largest providers of mental health treatment.

"Prisons are the largest providers of mental health treatment" should be a statement that we should only read in dystopian science fiction.

<comment><USER14> On the other hand, if saying "my client is suicidal" got defense attorneys anywhere, the only result would be that suddenly every criminal is suicidal.

<comment><USER13> Ideally you'd have mental health hospitals with a variety of security levels. Some of those hospitals are for people who pose no risk to others and who have never been involved in offending behaviour. Other hospitals are forensic, are part of the criminal justice system, and take people who are mentally disordered offenders. You have different levels or different wards - wards for people who pose a serious risk of harm to others; wards for people who pose little risk of harm to others but who are really ill and who would otherwise be in jail.

In the UK prisoners have a sentence. They serve the sentence, and then are released. A prisoner who develops a severe mental health problem is transferred to a secure[1] mental health unit (a forensic unit). They stop being a prisoner and become a patient. They get returned to jail when they are well. Some criminals are ill at the time of the offending behaviour, and get sent straight to secure hospitals. These people do not have a sentence. They just have to convince people that they're well. And once they've done that they get returned to jail to continue serving their sentence. So being a patient means things like forced medication, and a lack of information about when you're going to be released or what you need to do to get out.

I take your point though. I hope I haven't suggested that people can use mental ill health as an excuse for offending behaviour.

[1] Secure is a jargon word here, meaning units for people with some police involvement. There are plenty of locked wards, but they don't get called secure units. And there are 'section 136 places of safety' which used to be police cells (still are in many places) but which should really be somewhere therapeutic / clinical. (Section 136 is used by police to take people who are 'mad in public' to a place of safety to be assessed by a doctor.)

EDIT: Wow, wall of text. Sorry.

</comment></comment></comment><comment><USER15> This column is a little over the top in places, but it links to this interesting article on a retired federal judge who is familiar with Ortiz & co. commenting on the case.

[http://www.wbur.org/2013/01/16/gertner-criticizes-ortiz- swar...](http://www.wbur.org/2013/01/16/gertner-criticizes-ortiz-swartz)

</comment><comment><USER16> It may be unfair to single out Ms. Ortiz, she is after all only one of many federal prosecutors; but reforming the american justice system is an urgent priority, and we must start somewhere. A society where justice is widely perceived to be available only to the most powerful and well-connected is one that is primed to fall prey to any number of severe and most likely violent pathologies.

The legitimacy of the legal system is the result of centuries of work by jurists, judges, legal scholars, politicians and others; each of whom added their effort to making it so that not only they believed the law had dealt fairly with those who came before it but also that it had appeared to be fair to the rest of society. When that legitimacy is eroded, for personal benefit, for career aspirations, to please those whose favor is sought, for any reason; it takes much less effort. But the damage is subtle, people give lip service to institutions long after they have become hollow shells of their former glory.

In this country, at this time; the law is an instrument of social control, of thievery ( read the literature on civil forfeiture, if that statement bothers you ), of vengeance, and only rarely and incidentally of justice. Most of us know this. But it is one of the truths that cannot be spoken in polite society.

At this time, most of us know but are unwilling to acknowledge, that the law is an outrageously powerful instrument that acts randomly and capriciously. If you happen to be of the wrong color, speak the wrong language, or practice the wrong religion in the wrong place at the wrong time; you can be given a status equivalent to Orwell's formulation of an 'unperson'. If you happen to cross the path of someone who has access to the controls of this fearsome legal apparatus, your guilt or innocence, your rightness or wrongness; is irrelevant. All that matters is whether they decide to take an interest in your case; if you are deemed a target, all that matters is what crime can be made to fit your situation.

It would seem axiomatic, that this is an untenable situation; that once this state obtains, it will not be long before the law becomes a disreputable joke, a sad reminder of former greatness, and a jungle in which everyone is a predator and fears becoming prey.

That is why the reform of our justice system is such an urgent matter. We have eroded the legitimacy of our courts to a degree that their proclaimed fairness is a dismal jest to anyone who has been in prolonged contact with them.

We have allowed our legal system to be infected with concepts of intrinsic guilt, of theft under color of law, of monarchical privilege, of illegal truths; all of which are antithetical to a functional and free society.

<comment><USER17> Change happens behind a single event. That event becomes "the cause".

You can't change society by starting from an abstract concept like "justice".

We didnt get the civil rights movements from the concept of "slavery". We got it from a bus incident in which the conductor acted like every other bus conductor in the nation.

</comment></comment><comment><USER18> Interesting note -- the WSJ editorial report (a Fox show I doubt most HN folk regularly catch) had a segment on the Swartz case. One editor (Joseph Rago) came out strongly in his favor, speaking out against Ortiz and prosecutorial overreach.

I think it was Sun Tzu who said, "the enemy of my enemy is my friend". It's important to realize there is still a strong strain of libertarian thought on the right, that is supportive of civil liberties and is concerned about the ever-increasing power and overreach of the government.

<comment><USER19> I think that aside from a few very specific issues, no one supports civil liberties per se. They support civil liberties when their side doesn't have the presidency and oppose them when their side does have it. The real issue is executive powers, and you're obviously going to support more executive powers when your side controls the executive branch while opposing it when the other side would benefit from them.

This is why the exceptions tend to be cases where restraining civil liberties doesn't really help the President do as he pleases. For instance, the American left supports regulating and prohibiting gun ownership even under a Democratic president, while the right opposes it even under a Republican president. The same is true, in reverse, for abortion or gay marriage, with both sides split on marijuana. But when it comes to drones, wiretapping, Guantanamo, or federal law enforcement and prosecution, it's not a question of principle anymore but a question of empowering or disempowering the President and his Attorney General. Hence, conservatives will be angry at Janet Reno, but will stay mum about Ashcroft and Gonzales for eight years, or even be supportive, before coming out against Holder. Meanwhile, the actual civil libertarians haven't liked a single one of them!

<comment><USER18> I agree that each side is apparently blind to the civil liberties abuses of their own proponents. If a president named Bush were doing what Obama is doing wrt drones, wiretapping, Justice dept overreach, deportations, and zealous prosecution of Marijuana laws (even when states have clearly taken a different path), I can only guess how many HuffPo articles a week would be foaming at the mouth.

What the Left fails to seem to realize is while they may love Obama to death, the Presidency is not any one person, it is an office. Obama's extension of executive powers is inherited by the next Republican president just like Bush and Cheney's were inherited by Obama.

This is probably another downside of the hyper-partisan tone of today's politics. Obama supporters stay quiet about his abuses for fear of weakening him in his zero-sum fight with the Tea Party. But this ends-justifies-means selective outrage is not a principled stance, and in the end the next Romney type who gets in there will reap the benefit of our collective silence.

<comment><USER19> It's already happened--Clinton, not Bush, was the originator of "extraordinary rendition".

</comment></comment></comment></comment><comment><USER20> I've rarely read a more sensational and one-sided piece. At this point, the bending of facts to serve the idealization of Swartz and the demonization of Ortiz starts to seem like nothing more than throwing gasoline into the fire of an enraged lynch mob.

<comment><USER21> Enraged lynch mobs are why you have democracy and justice systems and human rights rather than the Diktat of the King, which is what we used to have before enraged lynch mobs.

<comment><USER20> It is a fallacy to assume that just because some lynch mobs took part in an effort with ultimately positive outcome (it took much more than a mob to establish democracy or justice systems), all, or even most, of them are positive.

A vendetta against a prosecutor, carried by hugely one-sided, unreflected and self-reinforcing blog-posts does not even come close.

<comment><USER21> But a vendetta against a prosecutor _because people are fed up with plea bargain abuse_ DOES.

<comment><USER20> So you propose an overzealous and exaggerated prosecution of one individual based on doubtful accusations just to drive a point home and serve as deterrent to others?

Sounds awfully like the thing you claim to be protesting.

</comment></comment></comment></comment></comment><comment><USER22> Why do they call it a prank? My impression is what was nothing of the sort.

<comment><USER13> No-one got hurt. No damage was done. If I have to chose between "prank" or "federal crime" I'm going with prank.

'Pranks' have a history in political activism - see _La Barbe_ or _Pussy Riot_ or others.

<comment><USER23> > No-one got hurt. No damage was done.

If a burglar is sneaking out of a house with a sack of stolen goods, and the police catch him and return everything to the owner, you'd still consider that a crime, right?

If so, then you agree that situations where nobody is hurt and no permanent damage done can still be crimes.

<comment><USER24> If a user gets caught leaving a library with photocopies of public, published documents, would you consider that a crime too?

<comment><USER23> No, but I don't see how that's relevant to my point.. which was merely that it's possible for a person to commit a crime without harming anyone or doing damage.

<comment><USER21> Were you making that point in the abstract, or were you, I don't know, in a thread of comments on an article about _Aaron Swartz?_

<comment><USER25> He was responding to a comment making the argument that something cannot be a crime if no damage is done and no one is hurt. He even quoted the as much of the comment he was replying to.

Please, please, _please_ , pay attention to context before accusing someone of ignoring context. It makes it very difficult for people to have nuanced debates about complex events if nobody is allowed to isolate a part of the problem independent of others.

<comment><USER13> > cannot be a crime

I don't think I said that! I did say that if I had to chose between "federal crime" or prank that I'd chose prank. But if you extended the list to include misdemeanour or somesuch I guess I could see that.

<comment><USER23> > I did say that if I had to chose between "federal crime" or prank that I'd > chose prank.

Sure, but that's a false dichotomy. The author was under no such constraint, so it was sensationalist and misleading for him to keep referring to it as a prank.

And when I say that, I'm not casting judgement here. The Boston Tea Party and the Rosa Parks protest weren't pranks either.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> > Although each of these counts bordered on the preposterous, Ortiz and > Heymann clearly reckoned that at least one or two would stick during the > jury-room bargaining process. ... Prosecutors were also revealed to have > offered a reduced sentence, but only if Swartz pleaded guilty to every > charge

This is what really hit home for me. They weren't just filing court documents in a legal strategy to get a conviction. They were telling a man to his face that they expected him to plead guilty to patently insane trumped-up charges.

</comment><comment><USER27> It is now taken as an article of truth that Ortiz drove him to suicide. Is there any direct evidence that he did it because of the prosecution or is it only assumed?

<comment><USER28> Not sure what the purpose of that question is as it seems fairly obvious that without Aaron around it would be impossible to prove with 100% certainty that the suicide was due to the prosecution.

However, I am sure you agree that it is highly-likely due to the aggressive nature of the prosecution and voiced opinions by his family and friends that this was having a very negative affect on his emotional well-being. That might be conjecture but it's better conjecture than believing he committed suicide for no new reason.

edit; I noticed you just down-voted me; I understand it's difficult to deal with being called out online. That said, I would like to point out that your implication that the burden of proof should be on proving Ortiz has some responsibility for his suicide in your insinuation that "It's now taken as an article of truth that Ortiz drove [Aaron] to suicide" is false. There has been a lot more evidence that there the prosecution was over-reaching and that Swartz was affected negatively by this than there has been otherwise. Obviously your intention by asking that question was to create an easily discredited strawman and perhaps it's a shame I gave you the benefit of doubt when I responded...

</comment></comment><comment><USER29> I'm glad the coverage of Aaron's death continues to deepen.

</comment><comment><USER30> Damage limitation action stations: 1) Protect and support Ortiz 2) If the going gets tough, throw Ortiz to the wolves 3) In either case, 'problem' solved, resume business as usual

<comment><USER31> #2 Most likely. Ortiz isn't important enough to the status quo to risk significant damage. By "unfriending" her, the state will appease the wolves, at least until the next victim appears - and they repeat the process.

</comment></comment><comment><USER32> It makes me sad how reactionary government is. Oritz was overreaching before Swartz killed himself. Why wasn't something done before someone got the death penalty for downloading a few free journal articles?

I'm happy to see the change and the backlash against Oritz, but I wish this happened sooner.

<comment><USER16> Yes. We all wish that Aaron had not reached that conclusion. We don't know what he was thinking at that moment, and whether anyone could have said something to change his mind.

My personal view is that suicidal impulses are similar to septic fever; the causes are understood, the consequences are terrible, and both prophylaxis and treatment are effective.

But, it is not always possible to reach victims when they need help.

Beng the target of an unjust and overreaching prosecution is the sort of stressor that could provoke even a strongminded person to suicide.

</comment></comment><comment><USER33> If only it didn't take a suicide to reach this point where there is finally a conversation and criticism of prosecutorial overreach and looking at the human side of the equation.

</comment><comment> at-fates-hands Wondering if anybody else is scared this is going to set a precedent for people who feel like they cannot endure a federal trial and simply opt for suicide instead.

Over the past several weeks, I've been completely numbed by all the outrage and media this event is generating. If I was a well known hacktivist and saw what has transpired here, it makes it look like being a martyr for your cause is considerably more beneficial than simply lawyering up and going through a trial.

<comment><USER34> If someone feels strongly enough about an issue to give his or her life to advance it, I'm not going to contradict that sentiment. On the scale of things, the media exaggerates far worse things (e.g. they'd have you believe that violent crime in the USA hasn't been dropping precipitously over the last two decades). Also, giving one's life for a cause is a much more ethical action than taking others' lives for that reason, but it seems quite a bit rarer.

(I know that Swartz is said to have suffered from depression which could be considered another factor in his suicide, but I'm specifically addressing this point which is unrelated to mental illness.)

</comment></comment><comment><USER35> I'm 100% behind changing the laws and punishing the overzealous prosecutor. Don't get me wrong.

But I'd like to see the millions of poor black kids whose lives are destroyed by the justice system every day get this kind of response, and not just when it's a handsome rich white kid like Aaron.

<comment><USER36> It's easier to take on a specific cause than address every systemic ill at once.

"But I'd like to see the millions of poor black kids whose lives are destroyed by the justice system every day get this kind of response"

People are taking on the war on drugs, what else is clear-cut and concise enough to address? "Poverty" and "racism" are wayyyyyyyyyyy too complex for anyone to easily identify around it, and the conditions and systems built around both are evasive enough for politicians and lawmakers to blame the systems on "a few bad eggs".

<comment><USER35> Sure. I agree, it's a hard problem. Doesn't mean it shouldn't get attention.

<comment><USER36> Getting attention doesn't always identify easily addressable factors, there's a lot to un-knot. Granted, I don't think the slactivism and internet petitionry is going to do a heck of a lot with Aaron's case either.

</comment></comment></comment></comment><comment><USER37> Ortiz will answer for her actions, perhaps not as a matter of law, but certainly as a matter of common sense and decency.

No one should be exempt from behaving like a decent human being, and one does not need to break the law in order to be fired for executing poor judgment.

</comment><comment><USER38> It reads like a parody of journalism.

</comment><comment><USER39> So serious question, what prevents Aaron's family from suing the pants off of the DOJ parties responsible?

<comment><USER38> A rule (called _prosecutorial immunity_ ) without which it would be almost impossible for the criminal law to function. Would you prosecute Bernie Madoff knowing he could tie you up in court, personally, with millions of dollars' worth of lawyers?

Even without that rule, a tort law claim against Ortiz or Heymann would probably not succeed, absent some proof that their intent was to torment him emotionally. Lessig and bizarre bloggers like Danah Boyd seem to occasionally accuse them of that, but it all seems rather groundless.

</comment></comment><comment><USER40> I hope this does not lead to another suicide. Really - this is becoming a grilling contest.

</comment><comment><USER41> What is going after one person going to achieve ? The problem is with the system.

</comment><comment><USER42> Anonymous need to get active on her. No one will make her life hell like anonymous can. She will quit by her own will.

<comment><USER42> #oportiz

</comment></comment><comment><USER43> "Her prospects look grim. Rep. Darrell Issa (R., Calif.)"...

And that's when _everyone_ should stop reading. Issa is a tea party loon.

<comment><USER44> Issa is corrupt as hell. I mean, he has a business empire that he runs from a different part of the floor on which he has his CA office. Even by the shady standards of Congress, this is pushing it. But he was on the right side of SOPA/PIPA, and he was there before it was the safe, obvious place to be. He's got brass and he's very aggressive. If I were Ortiz, I'd take him seriously.

<comment><USER45> Is corrupt the right word here? Doesn't corruption have to be linked to bribery in some form?

<comment><USER44> No.

<comment><USER45> No to what? That corruption is the right word or that it has to be linked to some kind of bribery?

<comment><USER44> The latter. Consider embezzlement, for instance. That's a case in which a person abuses their position for personal gain without expecting payment from another. Abuse that festers in the wake of successful attempts to frustrate legitimate competition or oversight is also properly regarded as corrupt, since the system intended to prevent it has been (that's right) corrupted.</comment></comment></comment></comment></comment></comment>


Sorry Apple, radio apps really aren't the same as fart apps - <AUTHOR> http://thenextweb.com/media/2010/11/25/sorry-apple-radio-apps-really-aren%e2%80%99t-the-same-as-fart-apps/ <comment><USER2> When you have ClearChannel submitting 1700 apps for all of their completely identical Golden Oldies stations it is indeed spam.

There are already several apps that aggregate streams. That is really the way to go.

</comment><comment><USER3> So they write (ok, configure) an app that just plays a single audio stream. What's the motivation here—are they working around a limitation of the iOS browser in bookmarking and playing audio, or is this an analytics anti-privacy thing?

</comment><comment><USER4> To me it's a bit of a gray area, I remember seeing something similar with sports statistics apps with separate team themed applications.

I've already seen this on the Windows Phone 7 marketplace where someone spammed separate applications for single currency conversion (USD => NZD, NZD => AUD etc) and can see why you want to remove them.

I think to get around this sort of restriction mass application submissions will really need to differentiate between applications a lot more than a single feature. Possibly content from that radio station, contents, news etc, hard to tell what will meet with approval.</comment>


CWI cryptanalist discovers new cryptographic attack in Flame spy malware  - <AUTHOR> http://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-cryptographic-attack-variant-in-flame-spy-malware <comment><USER2> Matt Green, himself no cryptographic slouch, says this is the biggest crypto story of the year: malware that included a new cryptanalytic result in its toolset. Zero-day vulnerabilities are somewhat common in malware; zero-day crypto results in malware are practically unknown.

<comment><USER3> It's scary to think that one day length-extension attacks, misusing cipher modes, and other crypto related attacks might be as common as XSS and SQL injections.

<comment><USER4> the day where we have a deep enough understanding of computer science for that sort of attack innovation to be the baseline would be a pretty amazing future (and one which is pretty unlikely to happen I think)

</comment></comment></comment><comment><USER5> This turned into a rant - possibly a rant with no informed opinions. Apologies in advance.

I think we can look at our vulnerabilities in three levels

\- open windows Backdoors left in as factory defaults, connecting 20 year old systems to Internet by slapping on an NIC. These are the blue collar computer systems running trains and factories. Replacing their systems with (OpenBSD) must be a major national priority. It will cost a fortune, and the foolish thing is to imagine we should replace like for like functionality. As someone above noted, the md5 encryption was used to maintain backwards capability with a system uneconomic to upgrade. As a society we either make that an unacceptable deal or we turn off the lights now This will disrupt a lot of industries. In both senses of the word.

\- best practises - The cloud and competitive contracting will take care of things like not upgrading your OS for ten years. Thats doing what you already do but better. The killer practises will be the ones we don't do at all. Almost no-one sends me PGP signed or encrypted email. And even if they did I have no web of trust that links them back to me. Let's see Facebook or LinkedIns social graph become a layered web of trust. Then tripwire can tell me that the server I am giving my credit card has binaries that were signed by a sysadmin who is linked to three guys I know and the binary hashed match those signed by shuttle worth. In real time. And I am just making that up. But it is feasible.

Defense in Transparency - why can't I know what binaries a server is running, who put them there and when? I can look at the locks on doors, see the quality of the mortar in the brickwork. Why can't I ask a system to tell me how secure it is and expect to get a audit able answer.

I think I am ranting. But I know we cannot trust industry certification or peer pressure. We need to get to a point where when there is no lock on a door it is clear for everyone to see, and everyone expects to see locked doors.

<comment><USER6> Securing industrial systems is a major problem. Security - when not done perfect - is a disruption into efficiency, usability, and functionality.

If you calculate the expected cost of a hack vs. the expected value of rebuilding the electronic infrastructure, in some situations being hacked is cheaper.

Further, being hacked is rolling the dice... there is a probability it won't happen. Whereas, an electronic infrastructure rebuild is a guaranteed expense... and expensive.

Then there's the Columbine mentality, "It could never happen here". That's pretty pervasive.

<comment><USER5> These days being hacked is just a matter of time for say a winxp sp1/2. The environment is becoming flooded with oxygen and we need to evovle cellular Walls.

The problem with cost benefit analysis is that it makes one core assumption. That tomorrow will be substantively like today. I don't believe in black swans but I do believe in climate change

</comment></comment></comment><comment><USER7> This increases the likely-hood that flame is state sponsored. It still seems surprising that in the wild malware would use a novel crypto result. The risk of publicly releasing the technique is fairly high. Perhaps with md5 being phased out, the technique was losing value quickly regardless. If info warfare becomes more widespread I wonder if mining malware for crypto analysis results could be a valuable research technique.

</comment><comment><USER5> I get the feeling we can judge the amount and timeline of investment by Western governments from these releases.

Like any other new capability /weapon these things will be used when they are ready (No president is likely to wait and see if bombing Iran works first)

So 2006 Bush gives the nod to ramp up the program, 2010 and stuxnet gets into the wild. Four years of development by serious people.

The md5 attack was made known in 2009 and now three years later a similar attack. We have reports of viable hardware attacks and fab-based alterations. So 2015 - the year a secure server gives up it's secrets via hardware ?

</comment><comment><USER8> With the DoD funded tactical cryptology research centers being opened at Camp Williams, UT and outside of Augusta, GA; nothing is safe anymore

This should be considered one of those watershed moments of humanity. Once again, some madmen have far more technology and power than intellect. The last time this happened, industrialized warfare led to the two world wars and a cold war that threatened us with absolute and complete destruction.

I have a feeling that this event will strike alarm bells around the world as nations race to arm themselves with the weapons of electronic warfare and destruction.

Talk about terrorism; we really need to be absolutely certain that when we go around brandishing our threats around the world from now on, we are not threatening someone that can shut down our infrastructure, or even turn our systems against us.

<comment><USER9> Just because it hadn't been knowingly done before now, doesn't mean it wasn't already a threat from state sponsors (or others). This was just a step towards an end that we all could foresee, be it from China, Russia, the U.S., or others. If the U.S. (assumption) hadn't done this, I can't imagine this sort of weapon hadn't already been envisioned by other states. It was only a matter of time.

Now that its on the surface, people (including governments) can understand its real, and have no excuse to not give it the attention that it deserves by instituting procedures and designs to properly protect critical systems.

<comment><USER10> I disagree. Experts have understood the true risk of a cyber war for over a decade, at least. The infrastructure of the United States, both public and private, is woefully unprepared for such attacks to be brought against it.

I'm reminded of a recent quote describing how getting stuxnet into Iran may have been difficult, but getting something into a US power plant would be trivially simple by comparison.

Not only is the US infrastructure not ready, but it looks like no one is actively trying to change that.

I imagine that businesses won't see the need to waste all the money until something big happens and they're forced to.

<comment><USER11> "Not only is the US infrastructure not ready, but it looks like no one is actively trying to change that."

Really? I know it's controversial, but that's pretty much what CISPA is supposed to help with.

[edit: Unclear language.]

</comment></comment></comment></comment><comment><USER12> As with GCHQ's discovery of the concept of asymmetric encryption years before it was rediscovered[1], it's always good to bear in mind that there's likely similar things being devised currently. When weakening or breaking encryption & hashing are such golden keys for certain organisations, they'd be fools to not put a lot of money into researching it.

As I've remarked a few times before, anyone devising a feasible break of RSA or a practical quantum computer would probably keep it quiet and only act on it in absolute need or deniably (like Bletchley Park in WW2). As Bletchley shows, even major operations with tens of thousands of people involved you can keep things very good secrets for decades.

[1] <http://cryptome.org/ukpk-alt.htm>

<comment> excuse-me The main defense against AES or similar being secretly broken is that people (nominally) on the same side also use it.

If NSA had discovered a flaw in AES and not announced it - then when this was innevitably discovered, there may have been a few conversations with the CIA/Secret Service/The Whitehouse/SAC etc along the lines of:

"so there is a flaw in this algorithm and you have been letting us use it all this time for our secrets?"

>"Yes but it's OK only we know about it - nobody else could have discovered it independently"

"Really? Prove it!"

This did actually happen with Bletchley park. After the war various UK/US allies were given copies of the Enigma machine and told that it was unbreakable.

</comment></comment><comment><USER13> My takeaway is that MS still uses MD5 to sign their binaries. Not really a best-practice anymore...

<comment><USER14> It doesn't matter what _Microsoft_ uses to sign their binaries, they're not the ones the signature scheme is defending against.

What matters is whether or not the attacker can find an _application_ accepts an MD5 signature and target it.

This is not a problem that can be solved by the CAs, though they can certainly stand in the way of the solution (by continuing to issue MD5 certs). The real problem is that a signature by definition is expected to be valid more or less forever. Even if the cert used to sign it expires, the signature is generally still valid.

<comment><USER13> It's a collision attack. Therefore, there must be a still-valid cert that was used to sign something (presumably) legitimate with a signature based on an MD5 hash.

<comment><USER14> I think what you said is correct... until an attacker figures out a way to violate it by changing some subtle assumption.

For example, before Dec 2008 it was generally believed that a cert signature forgery would require a second preimage attack. Then Stevens et al. proved that under the right circumstances it could be done using collisions only.

Say, did you know some x509 PKI entities keep the same keypair going indefinitely by reusing the same one every time they renew?

</comment></comment></comment></comment><comment><USER15> Wasn't one of the certificates used using SHA-1 (the other two were MD5) - could it be that this new cryptographic attack works not only against MD5 but also SHA-1 ?

<comment><USER16> As stated in the article

 _"We have developed a forensic tool for collision attacks [7] that can efficiently detect a wide range of known and unknown collision attacks against MD5 as well as MD5's successor SHA-1."_

<comment><USER15> That only specifies that their tool can detect them, not that it was detected in this case.

</comment></comment></comment><comment><USER17> CWI definitely it's an impressive research facility. Well done.</comment>


Ask HN: Is the following IP policy justified for a company? - <AUTHOR>

I work for at tech company that has the following IP policy. It looks overly aggressive to me, but I would like to get a second opinion. I am in particular worried on the parts that say "any work or material"<p>All intellectual property rights in any work or material developed/co developed/conceptualized directly or indirectly by the Employee during the course of his/her employment shall be considered 'works made for hire' under the intellectual property laws and shall belong to and be the property of the company and the employee confirms and accepts that he/she shall not be entitled to claim any rights over any such Intellectual Property. If required by the company, during or after the Employment period, the employee shall assign and transfer in favor of the company. <comment><USER2> It looks pretty standard to me. Tech companies have their IP stolen and (imho) it's hard to not be inspired in your private works by the job you're doing 40+ hours per week.

If you don't like it talk with them. It's not set in stone. Sometimes people can be reasonable =) Just don't sign it if you're not certain you'll abide by it.

Sorry, just re-read your post. Did you already sign this? I don't know if anyone else has another experience, but I'd say your 2 choices are abide by it, or look for another job. Read the contracts before you sign them.</comment>


Bloggers – 5 Mistakes and Can Make Your Blog Useless - <AUTHOR> https://medium.com/@ishanrajjha/bloggers-5-mistakes-and-can-make-your-blog-useless-4a0490afd898 <comment><USER2> I mean this in the sincerest and well intentioned way possible — you need to work on your language skills. Your writing is currently working against you; even though all of your points are valid, the way they're delivered makes it hard to get through them. I'm a non-native speaker myself so I know that it can be a struggle. However, I think it's a necessary investment if you want to work in the space you've chosen. Stack Exchange has a good site dedicated to improving English [1] as one possible entry point.

[1] [https://english.stackexchange.com/](https://english.stackexchange.com/)</comment>