SpaceX Is Raising $500M at a $30.5B Valuation - <AUTHOR> https://www.wsj.com/articles/elon-musks-spacex-is-raising-500-million-in-funding-11545142054 <comment><USER2> People who think Musk is eccentric/unhinged/unstable/etc should consider a much simpler possibility: He's just a regular guy, and simply does not filter himself like his peers do.

Other people in his position adopt the public/private persona and for the most part just plain shut up. They don't tweet anything than platitudes, they don't joke, they don't speak with random people on Twitter. They probably do this to minimize their downside exposure, but that might not be very effective. Bezos's bland Twitter feed hasn't stopped anyone from making into a villain.

Musk OTOH, makes Monty Python references, fart jokes, strikes up random conversations, shittalks randos etc. Ie, things normal people do. So the downside is a deluge of tusktusktusking at his "unstable" behaviour, but the upside is that a lot of people like him because he comes across like a real person rather than a PR bot.

<comment><USER3> Underlying this perspective is an implicit assumption that conventional social filtering - a practice as old as we can remember - serves no social good; that it's all just smoke and mirrors.

At the very least that's a remarkable assumption. We've been doing this for essentially ever, and it impacts all kinds of stuff. In some sense, musk is to CEO's what trump is to the presidency: all that diplomacy is just nonsense.

And - perhaps there's a kernel of truth to that; after all, the way we communicate has changed more radically than I think we really like to admit. I don't just mean the technology and the means, nor the social fashions: just read (transcripts of) old communication: I think we really _think_ differently now than a few generations back. So perhaps old norms no longer apply completely.

But I'm not quite willing to assume that without at least some careful thought. I think it's at least as plausible that trump and musk (to be fair to musk: they differ in most ways, and trump is way more extreme) simply don't communicate very strategically at all. Despite all the hot air there's little upside; it's mostly mess.

Sure, it's entertaining. And as entertainment, that's fine. But would you want to actually deal with people like that? And if the world _has_ changed in many ways, what hasn't is that you're going pretty much nowhere alone. You need cooperation and help to amount to anything constructive.

So: maybe there's a small chance this is the new norm and humanity has changed in pretty basic ways under the influence of todays pressures and technology. But there's also a considerable chance it hasn't.

<comment><USER2> Rather than looking at it in absolutes, you can look at it in terms of Evolutionarily Stable Strategy. In a world populated by PRBot CEOs, the one who speaks and acts like a real person will stand out, get attention, followers, detractors etc. In a world where everybody runs their mouth, the CEO that acts like a "Grownup" will achieve the same outcome.

Amassing a loyal army of followers (and, inevitably, an army of detractors) has worked out very well for him and could be one of the main reasons why Tesla has gotten as far as it has.

<comment><USER3> I doubt it's quite that simple, but sure: in essence that makes sense. But there's so many factors and interactions and feedback loops going on here...

</comment></comment></comment></comment><comment><USER4> Bear in mind that per-kg-to-orbit, the Falcon Heavy is 50 times cheaper than the Space Shuttle.

edit: I think thats based on programme lifetime costs, if you look at incremental costs per launch its about 12 times cheaper -see [https://news.ycombinator.com/item?id=18706930](https://news.ycombinator.com/item?id=18706930)

edit: OK maybe not the best two things to compare (although the original vision for the space shuttle was that it would launch all US payloads, due to projected re-usability). But FH is still way cheaper than any contemporary competitors, see [https://news.ycombinator.com/item?id=18706762](https://news.ycombinator.com/item?id=18706762)

edit: I've been looking at old pics of the space shuttle and lamenting that its the only thing we've ever put into space that actually looked like a proper spaceship. [https://www.bbc.co.uk/news/av/science- environment-13719297/u...](https://www.bbc.co.uk/news/av/science- environment-13719297/unique-footage-of-endeavour-shuttle-docked-at-iss)

<comment><USER5> The Shuttle was expensive, but its abilities are still unmatched. No other spacecraft has ever been able to launch a half dozen people into orbit, capture a satellite, and return it to earth for repairs. That kind of world leading, "best at any cost" mentality is what made the US so technologically dominant globally from the 1950s until recently. Falcon Heavy is definitely more efficient for getting things into orbit, but it still feels frustrating knowing that regardless of cost, we can't actually _do_ the things we used to be able to.

<comment><USER6> It's abilities at killing astronauts are unmatched too... I don't see why people still think positively of the shuttle program after all the lives that were lost. It's like people fawning over how great the Titanic was.

<comment><USER7> The shuttle failed at a number of rather important things, that one, price, refurbishment time, etc.

It still managed to do some pretty spectacular things no one else had ever done. I think that's worth something. I think the people who gave their lives thought that was worth something. I think they would rather the program be remembered for its triumphs than its failures.

</comment></comment></comment></comment><comment><USER8> While Musk has personally been a bit odd lately[0], SpaceX as a company seems to be in good hands with Gwynne Shotwell. They're launching very regularly[1], haven't had a customer-impacting failure in years[2] and they've got the market cornered. They have customers lined up for years, and continually make huge gains by reducing costs. They've got a head start by at least 5-10 years over all new entrants (Blue Origin, Electron, etc) and are massively undercutting the legacy competitors (ULA).

If I could invest in SpaceX, I would.

[0] I think he's overworked and burned-out himself out but can't recognize it. Who am I to judge- I've been there.

[1] They were going to launch about 20 minutes ago actually, but scrubbed at the last minute. They'll probably launch it tomorrow.

[2] Two failures recently were Falcon Heavy middle core doing a dive instead of a landing due to running out of igniter fluid, and the much-watched booster 'water landing' recently, where they fully recovered the booster afterwards. Both were successful launches.

<comment><USER9> _While Musk has personally been a bit odd lately_

I think Musk has shown something a little higher than eccentricity for as long as he's been in the public eye. I wouldn't want to be his friend, date him, marry him, or have him as a family member.

<comment><USER10> If we take a step back to look at what Musk has done at scale:

* Tesla has tremendously accelerated electric car deployments. I am going to count Solar City in this bucket as well. It was not a smashing success as Tesla or SpaceX are, but it helped to accelerate solar deployments.

* SpaceX proven out booster re-usability and lowered launch prices.

* Helped start open AI which is pushing limits of building machine intelligence by tackling progressively harder problems.

Whatever you think about the man, you can't ever take away those accomplishments. All of the current controversy looks so small and insignificant compared to them.

<comment><USER11> Accusing one of the divers that rescued the kids from the Thai cave of being a pedophile was where my admiration flipped to a much more measured regard.

<comment><USER12> What would your reaction be if you spent time, work and money trying to help wiht a rescue, it doesn't work out and then this guy tells you to shove your rescue sub up your ass (that's what he literally said!)?

<comment><USER13> Not calling them a pedophile?

Additionally, what kind of hubris is it to imagine you can help with a rescue you know little to nothing about, especially in a way that could be viewed as a PR stunt for one of your companies?

The proper response would have been for Elon to say: 'We were only trying to help. I am glad everyone got out ok, and respect what the divers did to make that happen. Perhaps what we built could be used in future situations and we are prepared to work with rescue organizations to see if that is feasible.'

If he had said that, everyone would have cheered him. Instead, he really began his slide off the cliff. Happily, he seems to have calmed down lately. At least, I haven't seen any serious missteps in the last few weeks.

<comment><USER14> If EMTs are treating a person who's severely bleeding and I come up and try to help I'm just going to get in the way. Musk should have let the professionals do their job. The sub was not remotely workable since it was too rigid for the cave's narrow passages, and Musk should have let it go.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> SpaceX, UAL, Ariane and Blue Origin are all doing launches today. We really need a global manifest with updated real-time links to livestreams ;)

GPS III SV01 Mission

[https://www.spacex.com/webcast](https://www.spacex.com/webcast)

New Shepard NS-10

[https://www.blueorigin.com/](https://www.blueorigin.com/)

CSO-1

[http://www.arianespace.com/mission/ariane-flight- vs20/](http://www.arianespace.com/mission/ariane-flight-vs20/)

Delta-IV NROL-71

[https://www.ulalaunch.com/missions/delta-iv- nrol-71](https://www.ulalaunch.com/missions/delta-iv-nrol-71)

<comment><USER16> I use spaceflightnow[0] to keep track of launches. Not always 100% up to date but usually updated pretty frequently, good enough for me.

[0] [https://spaceflightnow.com/launch- schedule/](https://spaceflightnow.com/launch-schedule/)

<comment><USER17> I have been impressed with how up-to-date Spaceflight Now is. I work in the satellite industry and once Spaceflight Now had an updated launch schedule before we actually got word from SpaceX that our launch was delayed.

<comment><USER16> Yeah they do an incredible job, seem to have things before certain official channels do as you mentioned. The company I'm employed with works with Iridium, so I like keeping track of how the NEXT deployment is going.

</comment></comment></comment></comment><comment><USER18> If the BFR happens they'll be unstoppable. Not because of what that rocket is but for building a company that's capable of producing something like that whilst operating a normal ongoing launch business.

<comment><USER19> Also because of what the rocket is. The military will pay through the nose for the capability to launch a constellation in days.

<comment><USER20> For the laymen such as myself what do you mean by 'launch a constellation'?

<comment><USER21> In addition to sibling comment, a real-life example is the GPS constellations. A single GPS satellite won't do you any good, but two or three (or better yet, six or twelve) will pinpoint your location. So the US DOD, et. al., threw a bunch of them up there at once instead of just one.

And perhaps not just the military. Iridium wants to replace their constellation of satellite phone satellites? Is next week okay?

</comment></comment></comment></comment><comment><USER22> [https://web.archive.org/web/20181218151517/https://www.wsj.c...](https://web.archive.org/web/20181218151517/https://www.wsj.com/articles/elon- musks-spacex-is-raising-500-million-in-funding-11545142054)

</comment><comment><USER23> Puts Elon's net worth at around 27 billion!

        TSLA 59 B * 19% = 11.21 B
        SpaceX 30.5 B * 54% = 16.47 B
        Total: 27.68 B

<comment><USER24> Eike Batista got up to $35 billion (on paper), just before he went belly up.

</comment></comment><comment><USER25> Wish I could find some SpaceX shares on the secondary markets.

<comment><USER26> > _Wish I could find some SpaceX shares on the secondary markets_

Unless you're willing and able to commit at least $5 million (at the very least, $1 to 2 million) it's not worth exploring. You're better off buying some merchandise [1] and sticking what you were going to invest in some bonds or a broad-market index.

[1] [https://shop.spacex.com/accessories.html](https://shop.spacex.com/accessories.html)

<comment><USER27> I'd even say that $5mil is on the low end of what would come up during a liquidation event. However, now there are probably more shares that have been bought and sold a few times, so there might be some more smaller investors willing to cash out.

<comment><USER26> Large investors are comprised of smaller LPs. And early investors include early employees. That said, yes, most sellers are in the $15+ million size.

</comment></comment></comment></comment><comment><USER28> $30B seems steep TBH. Consider that launch revenue last year was only $3B worldwide, and that's revenue, not profit. Granted SpaceX owns a good chunk of that, and their margins are the best in the industry, but with another player arriving at the scene soon their dominance could be short lived.

OTOH, if their Starlink effort succeeds (a big "if"), and they capture a fraction of the global $1T internet access market, this $30B could be totally peanuts. But that requires some serious faith on the part of the investor.

Still, though, if I could invest, I would. This is as close to "going to the moon" effort as it gets these days, I'd rather bypass the government money black hole and fund it directly.

Elon, maybe run an ICO for this?

</comment><comment><USER29> This increase in valuation doesn't really seem justified, at least based on what's occurred since its last one. It is roughly a $3 billion increase but SpaceX has underperformed its targets for 2018. It had a target of 30 launches this year, and has only seen about 20, roughly the same as 2017.

</comment><comment><USER30> Can someone knowledgeable chip in on how effective a satellite based broadband network will be? Will it have enough throughput? How future proof will it be? How are updates/upgrades done?

<comment><USER31> (This is all from memory as a fan, so take it all with a grain of salt and please correct me if i'm wrong on anything!)

So Starlink (the name of the network SpaceX plans to build) is different than most other satellite internet projects. While most try to put their sats in GEO orbit (which is about 35,000 km above the earth), Starlink is going to LEO (their sats are planned to be from roughly 350 km to 1,500 km above the earth, those numbers aren't typos).

Starlink is also planned to have multiple orders of magnitude more sats than any other network (mostly due to the lower orbit, since lower orbits must move "faster" relative to your position on the ground, each individual sat may only be within signal range for a short amount of time).

The latency from a "normal" GEO internet sat is on the order of a second or so for a round trip, the latency for a Starlink sat is expected to be on the order of 100ms for a round trip! They even have some plans which show that it can have SHORTER latency in some cases than ground-based communications!

Throughput is still yet to be shown entirely, but with such a large number of sats which all communicate between the others around them at any given time, and some clever routing algorithms, they should be able to get a worthwhile amount of throughput from the system.

As for future-proof-ness or updates/upgrades, the path is pretty elegant if not a little crazy sounding. Their plan is to just let them deorbit on their own after some time (I believe on the order of a year or so), and constantly replace them with new sats by leaning on the cheap launches that their rocket tech provides. Since the sats are in such a low orbit, the natural drag of the atmosphere will slowly pull them down over time, and I believe they also have self-deorbit capabilities. This solves the issue of upgrades (don't upgrade them individually, upgrade them as a group over time!), and future-proofing it with those upgrades (as the tech improves, so will the constellation over time!)

Hopefully this wasn't too rambling and difficult to understand!

<comment><USER32> Their are some downside risks to this endeavor.

For starters, there is a low utilization factor for each satellite. Humanity is concentrated onto a fairly small percentage of the Earth's surface. Earth's radius is about 6400 km, so at that low altitude you can only get so much out of pivoting your antenna's towards populated areas. Each satellite will be spending much of its time without any users (oceans and deserts), or with very few users (rural areas).

Second, there is a belief that the next billion new Internet users are going to be mobile users. So the market size of satellite Internet isn't "all the people that don't currently have Internet," its much smaller than that. In the developed world, Internet access is frequently bundled with other services, so the potential pool of flexible customers that could be wooed away from their current service isn't that large, either.

Finally, eventually the folks digging ditches are going to catch up. Once fiber gets to your premises, it will be much cheaper ber byte than satellite Internet. It doesn't matter how the last mile is traversed. Even if its fiber to an LTE tower, it'll still be cheaper per customer than satellites.

I could be wrong about the economics. Presumably they've done the numbers, and the plan still closes to profitability. SpaceX isn't the only one perusing it, after all. Nevertheless, I think there is also reason for skepticism.

<comment><USER31> >there is a low utilization factor for each satellite

So we are getting to the limits of my knowledge here, but I believe that this won't be as big of an issue simply because sats aren't JUST communicating with the ground, they are communicating with each other as well. The routing system will take sub-optimal paths (from what you'd expect) to ensure speeds stay as high as possible and latency as low as possible (with i'm guessing some tweaking of those 2 values when near the limit), and a lot of those are going to include crossing those large oceans and deserts which will keep those sats busy, and will even route toward those large underutilized areas to spread the load out.

>Second, there is a belief that the next billion new Internet users are going to be mobile users

I think this is where the concept of base stations really shine. Rather than pulling fiber to all of your cell towers, you can get those "fiber quality" speeds by just having power and a place to put the tower.

This means propping up new "traditional" cell towers is much cheaper (for customers of Starlink anyway!) and those mobile users could be using Starlink without even knowing it.

>In the developed world, Internet access is frequently bundled with other services, so the potential pool of flexible customers that could be wooed away from their current service isn't that large, either.

This is entirely anecdotal, but I'm 28 years old, and out of all of my friends and family, only my Father has cable. TV over the internet, and streaming services are taking over, and public sentiment isn't exactly high for the traditional internet service providers. Many (at least in the US) feel they don't have a choice, and if Starlink ends up being as well loved by the public at large as SpaceX or Tesla is, then I have a feeling not only will people be willing to switch, but they will jump at the chance!

Though a lot of that is assuming that tesla targets most home users(which I'm not sure if they are).

>Once fiber gets to your premises, it will be much cheaper ber byte than satellite Internet.

It may be cheaper, but it might not be as low latency! Turns out Starlink might be able to get lower latencies across continents than traditional fiber can currently achieve. Obviously it's still up in the air if they will be able to deliver on these numbers, but if they can then there might be a small portion of users who will be willing to pay top dollar for reliable low latency connections.

But taking off my fan hat, I agree that there are still a lot of unanswered questions about starlink, and if it ends up like most of SpaceX's other promises, it will be downgraded at least once in "performance", end up about 10% more expensive than expected, and a few years late, but still amazing.

It may not be the next comcast powering a huge portion of the "last mile" of the internet as we know it, but I'm hopeful it will be a great alternative that can improve things for a significant number of people, and hopefully pays off well for SpaceX.

</comment></comment></comment></comment><comment><USER33> [http://outline.com/dNX9E4](http://outline.com/dNX9E4)

</comment><comment><USER34> Valuations like this always remind me of this meme which went around when 37Signals had an absurd one of their own: [https://signalvnoise.com/posts/1941-press- release-37signals-...](https://signalvnoise.com/posts/1941-press- release-37signals-valuation-tops-100-billion-after-bold-vc-investment)

$500m sounds like a lot, but the 60:1 ratio says to me that the investors aren't confident they're getting their money back.

<comment><USER35> Perhaps SpaceX didn't want to sell more than 1.6% of the company at this time, or doesn't need more than $500 million.

</comment></comment><comment><USER36> I wish I could have invested. Does anyone know how to do it?

</comment><comment><USER37> How do you read the wall street journal articles for free?

</comment><comment><USER38> De-paywalled article link: [https://outline.com/dNX9E4](https://outline.com/dNX9E4)

</comment><comment><USER39> Evaluation?

<comment><USER40> 30.5B

<comment><USER41> I think he's saying the word is "valuation" not "evaluation"

<comment><USER42> Nah, He meant a 30.5 Billion checkup at the doctor's office ... I wonder who his insurance company is?

</comment></comment></comment></comment><comment><USER43> How much leverage is too much leverage? I guess we'll find out.

<comment><USER44> Musk is raising equity, not debt.

<comment><USER45> So if my friend pays me $10 for 0.1% equity on my lemonade stand is my lemonade stand worth 10k?

<comment><USER46> It is, according to him. The world may not believe him, but that's the statement he made. And he stands to lose up to $10 if he lied or misjudged it.

<comment><USER47> he doesn't have to believe it's worth 10k.

he just has to believe that someone else can be convinced it's worth 11k.

<comment><USER46> Right, he doesn't have to believe what he stated - "lie" was one of the possibilities I listed. But you can't claim the gesture is meaningless.</comment></comment></comment></comment></comment></comment>


Supreme Court: Raisin board unconstitutional - <AUTHOR> http://www.latimes.com/business/la-fi-court-california-raisins-20150623-story.html

<comment><AUTHOR> Non-paywalled story

[http://www.npr.org/sections/itsallpolitics/2015/06/22/416538...](http://www.npr.org/sections/itsallpolitics/2015/06/22/416538131/california- raisin-growers-get-their-day-in-the-sun)

Decision

[https://www.law.cornell.edu/supremecourt/text/14-275](https://www.law.cornell.edu/supremecourt/text/14-275)

Previous discussion on HN

[https://news.ycombinator.com/item?id=5855890](https://news.ycombinator.com/item?id=5855890)

[https://news.ycombinator.com/item?id=5476048](https://news.ycombinator.com/item?id=5476048)

<comment><USER2> Why does NPR still require Flash for audio playback in this day and age?

<comment><USER3> flash cookies are less well known to people. Even the casual "privacy conscious" web user tend to be unaware that flash drop its own flash cookies that don't clear with the browsers "clear cookies" function.

</comment></comment></comment><comment><USER4> It's hard not to sympathize with the folks who have been saying all along that Sotomayor is an extremist, in light of her views in this case, which was an 8-1 decision.

<comment><USER5> If you read her dissent, it's hard to characterize as "extreme". Slightly arcane, perhaps, and disagreeing on a fine point of the definition of a _per se_ taking, but not extreme at all and seemingly something that reasonable (and presumably well-informed-enough to be debating that technical definition) people could disagree on.

Meanwhile the case itself is being severely misrepresented in media coverage.

The raisin program, as it had been run, basically had three steps:

1\. A committee made up of farmers and others in the raisin business decide on a percentage of that year's crop to set aside.

2\. Farmers set aside that percentage of their crop, and pass it to the committee.

3\. Any profit left after administrative fees from the sale of those raisins is distributed to the farmers.

The big question was _not_ whether the government lacks the power to run this kind of program, but whether this program is the government taking private property for public use, and (if it is) whether the payment for taking the property has to occur up-front.

The eight Justices in the majority agreed it was taking of private property for public use (Sotomayor disagreed on a technical aspect of the definition, hence her dissent). But those eight did _not_ agree entirely on whether the government would have to pay up-front; five of them said yes, three others said no and that it should go back to a lower court to determine if the raisin growers were entitled to compensation (since the program was meant to, and apparently succeeded at, keeping raising prices higher -- in which case they might _not_ be entitled to any further cash payment).

<comment><USER6> > disagreeing on a fine point of the definition of a per se taking

While I agree some of her dissent is indeed technical and should not be considered extreme, there are certainly some extreme elements. To wit, from her dissent,

"...insofar as the Hornes wish to sell some raisins in a market regulated by the Government and at a price supported by governmental intervention, the Order requires that they give up the right to sell a portion of those raisins at that price and instead accept disposal of them at a lower price."

I think most reasonable people would not consider that to be ordinary government regulation; forcing farmers to sell at a particular if they wish to participate in the "free" market in fact sounds like certain horror stories you hear about socialist regimes (note: I am not imparting any judgement on President Obama here w.r.t. socialism).

<comment><USER5> Economically, if the program exists, the only sensible thing is for it to be mandatory. Otherwise you run into a situation where it's possible for some farmers to get the benefit of the program (higher prices for their crop) without paying for the program (by setting aside some of their crop) and the whole thing collapses.

Also, programs of this nature are old enough that it's really difficult to try to put current interpretations of labels like "socialist" on them; many of the people involved in originally drafting, passing and implementing this stuff would've been, by modern standards, too conservative even for the Tea Party.

(though there is a useful more-recent term to apply here: since the New Deal, farmers and ranchers have essentially been the biggest welfare queens in the United States, to the tune of billions upon billions of dollars in subsidies, tax breaks, favorable land/water rates and government-run price-fixing programs, and generally the anti-"socialism" forces in our government have no problem with requiring welfare recipients to make sacrifices in return for the benefits, so why not be consistent about it?)

<comment><USER6> I agree, existence must imply the program being mandatory, for exactly the reasons you describe. But perhaps the fact that the justices nearly- unanimously agreed on its unconstitionality means it should not have existed? You have to argue the legality of the program on the merits, not on the basis of "well, if we didn't violate the constitution, the program would not work".

And yeah, I am not trying to pass judgement using the label of socialism, I am trying to draw parallels to what people often decry as one of the evils of socialist states. I understand that these programs were not created in such a context; I certainly do not care about party affiliations or political leanings, only the direct, observable outcomes of the program.

<comment><USER5> I think it's hard to view in terms of timelessly constitutional or not; the Court's favored interpretations of bits of the Constitution have shifted back and forth widely since the Supreme Court was established.

So I suspect the strongest possible statement is that this is a program most people accepted as constitutional without much controversy at the time of the New Deal, but since then the Court's interpretation (and the political climate in the country, of which the Court is for better or worse a reflection) has shifted.

</comment></comment></comment></comment></comment></comment><comment><USER7> They talk about impact for other government seizure powers- could this have an effect on that awful Civil Forfeiture practise?

<comment><USER3> Probably not, but it might have an effect on compensation in eminent domain cases.

</comment></comment><comment><USER8> Audio: [http://www.supremecourt.gov/oral_arguments/audio/2014/14-275](http://www.supremecourt.gov/oral_arguments/audio/2014/14-275)

mp3: [http://www.supremecourt.gov/media/audio/mp3files/14-275.mp3](http://www.supremecourt.gov/media/audio/mp3files/14-275.mp3)

@ about 17:30 a discussion begins about the difference between taking records and taking other things. The defendant's lawyer argued that taking the raisins is a taking of property and taking records (in most cases) is not. He kinda had to argue that because he was pressed. Maybe it's a positive sign that the court was asking about it in the context of this decision. If nothing else, the intrinsic privacy of information in itself has value.

The prosecution crashes and burns off the line @ 25:00 the wreck continues, 48:18 ha.

<comment><USER9> I love listening to the oral arguments, there's a lot of absurd arguments in a lot of these. Helps to illuminate a lot of rulings that seem out of touch at first glance.

</comment></comment><comment><USER10> I bet some kind of indecent person will complain that patent expiry is government seizure of property. I mean, it's taking property and giving it to everyone. Come to think of it, it can actually sound like internationalist communism if you put it the right way. I expect someone will.

But yeah, this particular piece of regulation seems to have outlived its purpose.

<comment><USER8> There's no good argument to own an idea forever.

<comment><USER11> It's funny how that logic does apply to patents, but not to Disney and Mickey Mouse.

<comment><USER12> Oh, it _applies_ to Disney and Mickey Mouse, it's unfortunately just not _applied_ to them.</comment></comment></comment></comment>


Why is "test" or "QA" hated or considred "bad"? - <AUTHOR> Why is "test" or "QA" hated or considered "bad"?<p>This has been my career so far. I've received "Oh get out of that" or similar. What gives? Nobody wants their crap declared as crap before publication or what?
 fffff <comment><USER2> They're just haters. If you love QA then stick with it. Programmers aren't going to stop making mistakes.</comment>


Why Aren't Porn Stars Paid More? - <AUTHOR> http://bigthink.com/ideas/38197 <comment><USER2> I t seems to me that the author of this article hasn't thought through the issues, and has some _serious_ misconceptions. For instance: "the range of skills required by mainstream actors" seems quite naive. What about Keanu Reeves, who always always always plays the same character? One could go on at length about such actors: Burt Reynolds, Don Knotts, Patrick Swayze...

The author does come to the correct conclusion: remove copyright protection for Hollywood for increased social good.

My own, totally unsupported by evidence thought is that the porn movie industry gets used for money laundering. It's possible for criminal organizations to funnel many small amounts (some from each "soldier" each day) through on-line porn sites and CCBILL card processing. The small amount per transaction doesn't raise any banking-law flags. In aggregate, there's a ton of money to take out, and it's at least nominally "clean" money, unlike the small amounts put in.</comment>


Keep calm and code on: Productivity tools for developers - <AUTHOR> https://dev.to/marina_pilip/keep-calm-and-code-on-productivity-tools-for-developers-10o4 <comment><USER2> As someone who had to use UltraEdit once and wasn't allowed to use another editor (besides Notepad): Giant NOPE from me.

It has by far the clunkiest editor UI I ever used. I would _never_ consider it a productivity tool. On most other ones, my reaction would be rather "meh" (oh my zsh and the silver searcher are nice, actually). I'd guess that with a list of a couple of unixy tools, you'd do much better for productivity.</comment>


A Case of Stolen Source Code - <AUTHOR> https://panic.com/blog/stolen-source-code/ <comment><USER3> > …breeze right through an in-retrospect-sketchy authentication dialog…

I can't blame them for this. A surprising number of apps ask for root (inc. Adobe installers and Chrome). As far as I know, it's to make updates more reliable when an admin installs a program for a day-to-day user who can't write to /Applications and /Library.

We're long overdue for better sandboxing on desktop (outside of app stores).

<comment><USER4> It doesn't matter that much, honestly.

I only do root for administration tasks. Filesystem stuff, hardware, server config. All the goodies are in my homedir. Exfiltration is easy as that. Running bad binaries is easy as running under my username.

In the end, there's no protections of what my username can do to files owned by my user. And that's why nasty tool that:

         1. generates priv/pub key using gpg
         2. emails priv key elsewhere and deletes
         3. crypts everything it can grab in ~
         4. Pops up nasty message demanding money

works so easily, and so well.

The only thing I know that can thwart attacks like this is Qubes, or a well setup SELinux.. But SELinux then impedes usage. (down the rabbit hole we go).

Edit: Honestly, I'm waiting for a Command and Control to be exclusively in Tor, email keys only through a Tor gateway, and also serve as a slave node to control and use. I could certainly see a "If you agree to keep this application on here, we will give you your files back over the course of X duration".

There's plenty more nefarious ways this all can be used to cause more damage, and "reward" the user with their files back, by being a slave node for more infection. IIRC, there was one of these malware tools that granted access to files if you screwed over your friends and they paid.

<comment><USER5> The thing is that, at least on the Mac, there easily can be protections on what your username can do to files owned by your user. There's an extensive sandboxing facility which limits apps to touching files within their own container, or files explicitly chosen by the user. All apps distributed through the App Store have to use it, and apps distributed outside the App Store can use it as well, but don't have to.

As I see it, the problem on the Mac boils down to:

1\. Sandboxing your app is often a less-than-fun experience for the developer, so few bother with it unless they're forced to (because they want to sell in the App Store).

2\. Apple doesn't put much effort into non-App-Store distribution, so there's no automatic checking or verification that sandboxing is enabled for a freshly-downloaded app. You have to put in some non-trivial effort to see if an app is sandboxed, and essentially nobody does.

I think these two feed on each other, too. Developers don't sandbox, so there's little point in checking. Users don't check, so there's little point in sandboxing. If Apple made the tooling better and we could convince users to check and developers to sandbox whenever practical, it would go a long way toward improving this.

<comment><USER6> What improvements to the developer experience for the Mac sandbox do you think are needed? If you get access all files through an open dialog, you're almost automatically set (and with a few lines of code you can even maintain access to those files). If you do something more complicated, you can write specific sandbox exceptions (as long as you don't want to distribute on the App Store). Privilege separation is also very easy to implement via XPC (complete with automatic proxy objects).

I think most apps don't sandbox not because it's especially hard, but just because it never occurs to the developers.

<comment><USER7> As noted in another comment, the macOS app sandbox is buggy and unnecessarily rigid in its permissions/capabilities. For many classes of apps, sandbox use is highly impractical or even impossible.

If these issues were fixed I believe that sandboxing would quickly become the norm. Many of us want to use the sandbox but don't want to waste too much effort fighting it.

<comment><USER6> > For many classes of apps, sandbox use is highly impractical or even > impossible.

Worst case, you can see exactly what is being blocked in Console and then add word-for-word exceptions via the com.apple.security.temporary-exception.sbpl entitlement. You can also switch to an allow by default model by using sandbox_init manually.

Even if the sandbox doesn't work for your entire app, you can use XPC to isolate more privileged components in either direction (i.e. your service can be more or less privileged than your main app). What specific abilities are not provided that you think would help?

<comment><USER8> I don't think that this is correct. There are a lot of things that sandboxed apps can't do, even with exceptions. One such example is opening unix sockets -- a sandboxed app can only open sockets inside it's sandbox. This alone rules out a large class of apps. Shared memory is another problem. (These two currently prevent me from shipping Postgres.app on the Mac App Store)

Using sandbox_init manually sounds like it should be possible in theory, but it is way too complicated in practice. There is barely any documentation on it, and you'd need to be familiar with macOS at a very low level to effectively use it -- which is highly unlikely for application software developers.

<comment><USER6> You can allow access to a unix socket via things like:

        (allow network-outbound (remote unix-socket (path-literal "/private/var/run/syslog")))

Similarly you can allow use of shared memory:

        (allow ipc-posix-shm)

Most of the rule types are documented here[1]. Even for the ones that aren't, the error message in the logs uses the same syntax (e.g. if a unix socket is blocked you'll get a complaint about "network-outbound"). You mostly just need to be able to copy and paste.

[1]: [https://reverse.put.as/wp-content/uploads/2011/09/Apple- Sand...](https://reverse.put.as/wp-content/uploads/2011/09/Apple-Sandbox- Guide-v1.0.pdf)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I'm a bit surprised at the "personalized attention" from the attacker: that a human on the other end takes time to poke around individual machines, recognize the developer, and tailor a source code theft + ransom campaign to them. I had assumed that these are bulk compromises of at least thousands of machines and they just blast out scripts to turn them into spam proxies or whatever.

Maybe given the limited scale of this one and the obvious interest the attacker has in producing trojaned versions of popular software, this is actually what they were hoping for in the first place.

<comment><USER10> It might be as simple as an automated "look for ssh keys" in the malware. If you find an SSH key, pretty good odds it's a developer. Scan for git repos, or check their email address to see where they work and go from there.

<comment><USER11> This makes me wonder, is it easy enough to write a kernel extension such that whenever any process that tries to open(2) my ssh private key, or any hardlinks or symlinks pointing to it, it checks against a known whitelist, and if the process is not in the whitelist, a dialog pops up and asks me for my permission. Is this easy to implement?

Frankly I can only think of a small number of processes that need to automatically access the file: backupd, sshd, and Carbon Copy Cloner. Everything else should require my attention.

<comment><USER12> Alternatively, sidestep open(2) by implementing a SSH agent so that you can do creative things like [https://krypt.co](https://krypt.co) does, so the key is not laying right on your main filesystem in the first place (and possibly not even ever on the workstation).

</comment></comment></comment></comment><comment><USER13> I find this story pretty fascinating. First, it's interesting how a broad attack, such as putting malware into software used by a large number of people, suddenly becomes a targeted attack: the attackers grab SSH keys and start cloning git repositories. I'm assuming that there was a significant number of victims in this attack. Were they targeting developers? Or did they just happen to comb through all this data and find what looked to be source code / git repositories.

The other thing I find interesting is this comment:

> We're working on the assumption that there's no point in paying — the > attacker has no reason to keep their end of the bargain.

If you really want to be successful in exploiting people through cyber attacks, I guess you will need some kind of system to provide guaranteed contracts, i.e. proof that if a victim pays the ransom, then the other end of the bargain will be held.

It might seem that there's some incentive for ransom holders to hold up their end of the bargain for the majority of cases if they want their attacks to be profitable.

<comment><USER14> > If you really want to be successful in exploiting people through cyber > attacks, I guess you will need some kind of system to provide guaranteed > contracts, i.e. proof that if a victim pays the ransom, then the other end > of the bargain will be held.

You're describing a legal system and the rule of law. I'm not sure there's way to guarantee anything like you describe when there is some illegality in the nature of the process.

Trade only works when you can trust either the parties involved or the system as a whole to uphold their promises (for the system, that's that involved parties that don't uphold their ends will be punished).

<comment><USER15> > You're describing a legal system and the rule of law. I'm not sure there's > way to guarantee anything like you describe when there is some illegality in > the nature of the process.

Legal systems aren't the only way to give confidence that both ends of a bargain will be held. As one example, some darknet markets have escrow systems for this purpose. It's not too hard to imagine a way to do this with ransomed code. Reputation-based systems also provide incentives for sellers to deliver on their promises.

<comment><USER14> > As one example, some darknet markets have escrow systems for this purpose.

Those only function because the darknet functions as the system, and the punishment for not following through is that the party loses access to or prestige in that market. What entity exists that is trusted and has leverage with both the people that are ransoming (criminals) and average citizens (ostensibly law abiding)? Should _I_ trust a darknet broker to not screw me? No. They have no incentive not to, as long as their _actual_ client, the ransomer, doesn't care. For the same reason, the ransomer should not trust any legal entity, because they can not deliver the money and give it back to the victim (since _they_ are the client).

There may exist a way for this to work, but I certainly can't think of one, and what you described doesn't work either. Trust is the integral factor as I see it, and while you can have trust _within_ a criminal community, and within a law-abiding community, I'm not sure how you get that trust to cross that boundary.

<comment><USER16> A simple solution is the one you describe. A reputation system for ransomers. Time earned reputation for upholding promises.

<comment><USER14> And how do you ensure you are dealing with the same person from one transaction to the next? Any authority that can confirm an anonymous criminal is who they say they are needs to be illegal to keep law enforcement from finding out the identities, and if not they are still participating in a crime.

Again, how do you trust a criminal person or organization? By their nature, they don't follow the same rules.

<comment><USER17> Wouldn't a cryptographic sig suffice for this?

You don't need an authority vouching for you to become a 'trusted' criminal. You just need proof of identity, and a reputation established over time. Drug dealers do this all the time, even though they're criminals. Hell, it's even how legitimate businesses work - the FBI isn't going to shut down Bic for selling shoddy pens, so they build a reputation on "we're Bic and we did right by you last time".

An example: a malware group sends every target an RSA-signed demand (with public key disclosed on Pastebin or something). The few people who pay up find that they follow through, so they grow a reputation as sincere. They could even kick things off with a round of freebies - "Here's your data, here's our sig, we deleted/unlocked/whatever it for free this time to prove ourselves." I suppose they'd have to publish demands and outcomes since most targets won't disclose on their own.

There's likely a flaw in my specifics (probably around disclosing attacks and proving followthrough), but I only put five minutes into it. As long as you can prove identity, you ought to be able to build 'trust'.

<comment><USER14> > Drug dealers do this all the time, even though they're criminals.

Drug dealers and those buying from them are _both_ committing illegal acts. That changes the dynamic. Neither party can rely on the legal system to enforce misconduct. That allows an entirely criminal system to work. For example, if you don't pay the drug dealer, they'll just hurt you. If the drug dealer doesn't give you the drugs, or gives you crappy/cut drugs, you just won't use them next time. It's important to note that this transactional relationship does not begin with one party accosting the other, as in the ransomware case.

The ransomware scenario is the equivalent of being mugged in an alleyway, but only of your smartphone, and the mugger offering to give your phone back if you go to an ATM and come back with $100. The whole interaction began with an crime perpetrated by one party on the other.

> As long as you can prove identity, you ought to be able to build 'trust'.

One problem is that the identity, because it is anonymous, it worth fundamentally less for this purpose than any real identity. The ransomer could decide law enforcement is getting too close, and stop responding to all payments, or abandon the system and someone else could take it over. For any identity used just for this scam, the loss of reputation is irrelevant, and if they are using the same identity for multiple scams they are inviting more law enforcement response. There are no future consequences of mention to screwing people over, since the identity can be changed at any time.

The only thing that really protects you in any of these situations are the incentives of the criminals, but those incentives, be they economic or liberty based, are subject to very different constraints than a legally operating entity. The bottom line is that the person or people involved has started the whole relationship by showing they are willing to screw you over. Establishing trust is not _impossible_ (some people will trust), but it's very hard to do, a large percentage of will never actually trust you, and they likely shouldn't, because you don't have the same incentives or punishments they do.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> How does one realistically protect against these new attack vectors? It's all become so quick - the malware infects your machine, and seconds later your repos are cloned.

Most computers are always connected to the internet when they're on, even if they don't necessarily need to be. Airgapping isn't really used outside of very sensitive networks, but I'm starting to think we need to head towards a model of connecting machines only when really needed.

Of course the cloud based world doesn't allow for that, and perhaps I'm a luddite, but I increasingly find myself disabling the network connection when I'm working on my PC. Kind of like the dial-up days.

<comment><USER19> Have a fun laptop, a work laptop, and maybe banking tablet?

As a good corporate drone, this arrangement is kind of forced on me, but a lot of small company / startup folks totally mix the two. Might be a good thing to not do.

Sure it doesn't protect you from e.g. a tool you need for work being compromised, but it reduces the attack surface - this guy probably wouldn't have installed handbrake on his work machine.

Another thing we do specifically because medical data is, a lot of the time I'm forced to work inside a non internet connected network that I vpn and then remote desktop to. Firewall rules mean the only thing getting in from my laptop is vnc. Some systems also require plugging into a specific physical network. Overkill for most uses but it makes losing laptops fat less scary if you can keep a lot of your stuff on a more secure remote system.

<comment><USER20> > Have a fun laptop, a work laptop, and a banking tablet?

Try out Qubes: [http://qubes-os.org](http://qubes-os.org)

<comment><USER19> This is a really good thing, and thank you for showing it to me.

Something like this could be good if you wanted to rapidly switch between different compartments on a single device. It would be great for e.g. keeping a 'sensitive data' compartment seperate from a 'emails and paperwork' compartment on a work laptop.

Doing something like this is certainly better than using a single device with no seperation or just user accounts.

Psychologically, I still think that training people to use different devices for different things is more likely to stick than (account seperation on steroids). This extends to physical security - not leaving a work laptop in your backpack in a nightclub cloakroom like you might a personal device. But in the end with that reason, at a small comapany where you can avoid hiring idiots, it's up to each person to decide what psychological tricks they need to get themselves to do things.

I wouldn't trust something like this to keep high security information seperate. When some exploit that escapes Xen or (for a corp) accesses windows systems otherwise securely configured, there is nothing like isolated networks to keep your blood pressure low. For most software a service dev type people you already have this - your data lives in a data center on carefully configured production servers. But for data science type users, you see a lot of people (especially in accademida) doing work with potentially scary datasets on local laptops they probably also watch pirate TV on at home, which is a bit concerning. I guess at least if they were using qubes it would be a bit better though.

<comment><USER21> Training users has been tried for over two decades and has largely failed to hinder black hats in any significant way.

<comment><USER22> Failed on the users who took well to the training, or to those who ignored it/failed it?

Because we can always not care about those others in the context of what _we_ should do.

<comment><USER21> Failed to improve computer security overall. Users (generally speaking, not HN readers) don't have the skills/inclination/time to be proficient at managing their systems. Efforts to educate them in malware avoidance, system upkeep etc etc are failures by and large.

Technology can only do so much to "protect" users from themselves, and from miscreants. Couple this with an indifference to privacy on most of the connected population, and you've got a recipe for a world where nothing is safe.

[http://panelsyndicate.com/comics/tpeye](http://panelsyndicate.com/comics/tpeye)

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> Slightly OT: I'm a reasonably competent Mac user, I use them all day and depend on them to control my house as I'm disabled. In the event I were to be compromised, can anyone suggest a logging tool/tools that I might be able to use on my network such that I could work out what the problem was and correct anything that needs correcting please?

We are looking at four or five Macs of differing types but all running the latest OS, a number of iPhones, iPads, more Raspberry Pi's than I'm going to admit to and a number of other IoT devices.

TIA!

Also, I really wish more companies would be this forthcoming when they pwned. I think it's really good when are large company comes out with this type of mea culpa, mea maxima culpa. If professionals can get totally pwned, I really do think it tends to make ordinary users think about their security a little more. Or maybe I'm just hopelessly optimistic!

<comment><USER24> Network syslog and a Raspberry Pi with an external drive should be more than enough.

<comment><USER23> I've been doing some googling and it looks like syslog is something that I run on every machine, and then it passes the results of its logging to the Raspberry Pi for collation and possible inspection later on. Have I got the basic gist of it?

Thanks for the answer, greatly appreciated. :-)

</comment></comment></comment><comment><USER25> > I also likely bypassed the Gatekeeper warning without even thinking about > it, because I run a handful of apps that are still not signed by their > developers.

Apple really needs to fix this. In particular open source applications don't sign for whatever reason and it's clear that barring some change they aren't going to start now.

<comment><USER26> Fix what? Remove the option to bypass? Remove the warning? Lock it all down to just app store apps?

<comment><USER25> No if enough of them were signed then people wouldn't be in the habit of bypassing the warnings, there's no need to force it to be all locked down.

<comment><USER27> Users click-through any and every kind of dialog box without reading. It's one of the principles of UI design. Users don't read. Requiring the user to type in "Install dangerous program" would work.

</comment></comment></comment></comment><comment><USER28> One way to protect against this is to not have SSH keys on your laptop. I've been using Kryptonite [https://krypt.co/](https://krypt.co/) lately, which is sort of like two-factor for SSH keys.

<comment><USER29> This relies on the security of my phone OS, which I trust much less than my desktop's.

<comment><USER30> I wonder why is that? Apps on the phone are by default sandboxed and there is no way to get root (instead of running the exploit).

<comment><USER29> Lack of updates from OEMs, and a general lack of attention to security on the part of the same, at least on Android. Many devices still haven't received the patch for last month's Broadcom vulnerability, for example.

</comment></comment></comment></comment><comment><USER31> > without stopping to wonder why HandBrake would need admin privileges, or why > it would suddenly need them when it hadn't before

Seems like it's completely random that an app needs admin or not. Blender3d? No admin. Unity3d? admin. etc.

<comment><USER32> Arbitrary, rather than random. Most of the time, it's entirely up to the developer. I'm sure the percentage of applications that _actually require_ administrative privileges to perform tasks is in the single digits or lower.

<comment><USER31> > I'm sure the percentage of applications that actually require administrative > privileges to perform tasks is in the single digits or lower.

This is probably true. I'm surprised we don't get after companies for unnecessarily requiring admin with their apps.

</comment></comment></comment><comment><USER33> Great writeup!. I think a lot of developers would do well to understand both the 'right' way to respond to this sort of event, and the tools you need in order to do so. Most importantly being detailed loggging and processes for re- keying everything.

I've participated in, and run, exercises where such damage is inflicted on purpose to surface gaps in the the response processes and to fix them. I was inspired by the Google DiRT (disaster recovery) and NetFlix Chaos Monkey exercises. Both of these create not simply review processes but simulation by action, or actually doing the damage to see the process work. Setting up your systems so that you can do that is a really powerful tool.

<comment><USER34> That actually goes a step further than Chaos Monkey. I wonder how many organizations would survive that approach if it were intense enough from day #1. Better to ramp that up carefully and give people room to breathe and fix things.

</comment></comment><comment><USER35> No one has time to examine every line of source code in the 3rd party applications that we use. That being said it irks me when people don't at least isolate their sensitive material. There are many solutions available including virtualization and jails to run 3rd party applications with less risk involved.

</comment><comment><USER36> And this is why ssh keys need to be encrypted - it's a good 2nd factor that will prevent access to all your important stuff if your laptop is stolen/compromised.

ssh-keygen -p -f keyfile

</comment><comment><USER37> \- Do not install unsigned software

\- Do not install personal software on your work computer

</comment><comment><USER38> A version controllsystem which would allow the seperate safe versioning of ip central code with merge to build system would be nice.

</comment><comment><USER39> It's not particularly hard to add malware to an already compiled binary, without access to the source code, is it?

<comment><USER40> You are correct, but if you actually have the source and can compile a binary from that, it is much easier to evade detection. As you might imagine, the gnarly things you have to do to add malware to existing software often trigger detection mechanisms.

</comment></comment><comment><USER41> "There's no indication any customer information was obtained by the attacker. Furthermore, there's no indication Panic Sync data was accessed."

Read: The attacker could have accessed all that data but didn't send me an e-mail telling me that he did.

<comment><USER42> It wasn't their production environment that was compromised; it was their source code repository.

</comment></comment><comment><USER43> Meh, should all be on github anyway. Like.. Handbrake!

<comment><USER43> Handbrake is on github, people put lots of hours into it and it can be downloaded, checked and compiled. handbrake is used to transcode video - <USER2> between proprietary formats, people often put a lot of hours into the videos transcoded by handbrake, but this was binary handbrake on a mac, macs are based on unix, people put a lot of hours into unix... people put a lot of hours into the company's source code... but it too was stolen, the world is a cynical place somehow. Maybe if it all was on github the world would not seem such a cynical place and people would realize that the value is in what they themselves bring and not in the thing on github.

</comment></comment><comment><USER3> > And more importantly, the right people at Apple are now standing by to > quickly shut down any stolen/malware-infested versions of our apps that we > may discover.

The "stolen" part bugs me — even though it would be incredibly shitty to distribute cracked-from-source versions of Panic apps, I hope that Apple wouldn't prevent users from running them. I appreciate the malware protection built into macOS, but this might be an abuse of it.

<comment><USER44> Can you expand on your comment? I don't follow your logic. Isn't Apple legally culpable if they knowingly act as a marketplace for stolen goods?

<comment><USER45> [deleted]

<comment><USER46> If someone broke into the KFC vault and wrote down the spice recipe used for the chicken, we'd still call that a "stolen recipe". If part of the value of the source code is its secrecy, then its value decreases when it's made public.

Look at an example of one way the word "steal" is used in speech. If I say "Good artists copy; great artists steal", and I saying that great artists break into a building and illegally remove a physical artifact, or am I saying that they copy something for their own benefit? If one can "steal" an idea, then isn't that a "stolen idea"? And if that stolen idea is directly used to create some salable product, then isn't that a "stolen product", in that sense?

edit: The comment I responded to made the claim that source code couldn't be stolen, only copied (similar to the standard argument "it's copyright infringement, not theft", often applied to copied media). There was more, but I don't remember the wording, and I don't want to misrepresent the position.

<comment><USER47> _If part of the value of the source code is its secrecy, then its value decreases when it 's made public._

It's not necessarily true that part of the value of source code is its secrecy, though. We'd like to believe that, but it's difficult to come up with evidence to support it. Most instances where source code is leaked result in no damage to the owner, for example.

<comment><USER48> > _It 's not necessarily true that part of the value of source code is its > secrecy, though._

Pretty sure the same could be said of KFC's secret spices recipe.

<comment><USER49> I hate to be the person to post this comment, but anyway: We have pretty good evidence that KFC's recipe has been reverse engineered and/or leaked anyway. Doesn't seem to have affected its sales much.

[https://en.wikipedia.org/wiki/KFC_Original_Recipe#Recipe](https://en.wikipedia.org/wiki/KFC_Original_Recipe#Recipe)

<comment><USER50> Indeed, never underestimate the power of the brand itself.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER51> > Within 24 hours of the hack, we were on the phone with two important teams: > Apple and the FBI.

FBI, seriously? Calling the cops, over malware, as a cool independent software company?! I mean, sure, fuck malware, but what happened to "fuck the police"? :D

</comment><comment><USER52> Lesson learned: None.

You use the same machine for development of commercial, closed source software and video transcoding for most probably private use.

Your postmortem can be summarized as "[advertisement]".

I get that real security is too hard for most people. But even a few precautions can make a big difference. In order of effectiveness (least effective first):

* Don't have sensitive data mounted automatically (yes, ubuntu, your encrypted home directory is a joke).

* Don't have sensitive data on the OS-drive. Even if you are limited by archaic USB2, RAM is cheap and so is a virtual memory backed disk. Pushing your closed source into it won't take more than 30s.

* Work hard and party hard. But keep that separated. One computer for fun, one for work. The one for work should not even think about talking to external devices until it's sure the environment is friendly.

PS: I do drink my own kool-aid - I always carry 2 laptops that run 4 operating systems. My development and sysop environment is not even capable of playing a movie.

Edit: "too hard for most people" may sound harsh, but it is not meant like this. I teach OPSEC to activists in developing countries, work for a non- profit with real privacy concerns in a first world country and make real money doing audits for rather large companies. When I say "for most people" it should probably have been "in most circumstances".

<comment><USER53> i think its not too hard. its just not convenient. We need to make security the path of least recistence.

</comment></comment><comment><USER54> Why was he installing Handbrake on a work computer? Maybe he had a business need to transcode videos, in which case no problem, but was he installing Handbrake on a work computer in order to rip DVDs personally? Worse, was he perhaps doing work on a personal computer?

Folks, don't mix your business & professional lives. The cost is not worth the benefit!

<comment><USER55> Why do you think that Handbrake is only for ripping DVDs?

<comment><USER54> I mentioned _right there_ its use for transcoding videos!

<comment><USER56> Okay, then was your comment at all necessary? Why assume he was using it for personal DVD ripping when you literally provided a legitimate business use in your own comment?

<comment><USER54> > Why assume he was using it for personal DVD ripping when you literally > provided a legitimate business use in your own comment?

Because IMHO that's the most likely reason for a developer to have Handbrake installed. It's not the only reason, as I noted, but I believe it's the most likely one.

<comment><USER56> No, that's the most likely reason for _you_ to have Handbrake installed. Don't project yourself onto others.

As I already said, you provided a valid business case, at which point the rest of your holier-than-thou comment goes out the window because it could very well have been that and the OP has no incentive to say claim otherwise.</comment></comment></comment></comment></comment></comment>


Advocating for More Unlicensed Spectrum Allocations - <AUTHOR> https://bitmovin.com/advocating-unlicensed-spectrum-allocations/ <comment><USER2> The market realities and lobbying by big telecom companies will never support such proposal to convert everything to unlicensed allocation.</comment>


Military Dolphins - <AUTHOR> http://en.wikipedia.org/wiki/Military_dolphin

<comment><USER2> A friend of mine trained dolphins for the military. He would serendipitously slip it into conversation now and again.

"After college I tried pro surfing, when that didn't work I trained dolphins for the military, then I went to med school."

Turns out training dolphins is a really crappy job! Where you have to scuba dive down into pitch black ocean waters at 4am and wait to be "saved" by a rescue dolphin. That is before something else may eat you.</comment>


VentureBeat Redesign - <AUTHOR> http://venturebeat.com/

<comment><USER2> it's good to see the author profiles right on the homepage.

the design looks as if it is inspired by a combination of engadget or theverge.

also, the "VB iOS app download" is placed at a good spot, just that the iOS app reminds me of Pulse</comment>


Ask HN: Gather proof of MITM on college wifi - <AUTHOR> My college requires installing certificate profile for accessing wifi in some circumstances. HTTPS sites and apps that use cert pinning (banking stuff) reject the network without the cert; however, G Maps and HTTP sites work fine w/o using cert. I never installed anything, but a guy in IT who did use it confirmed that even with the cert, his banking app rejects the network (due to cert pinning). So, it sounds like the college is doing decryption of everyone's traffic, but I need advice on how to prove or dig deeper.
The campus website downplays the change as if it's related to piracy and stuff, but staff told me it had to do with FBI compliance and subpoenas. I guess the college has enough people using network to be considered an ISP by the gov. And the cert is supposedly only for authorizing students to the network so we don't need to enter passwords anymore. But if it's only for network auth, why does it break cert pinning? Or is that just a consequence of network auth, where everything breaks? That seems unlikely, but I'm fairly clueless here. Anyway, what the heck should I do? I'm somewhat familiar with Wireshark and the Charles proxy but haven't grasped using Fiddler very well. Thanks for any tips. <comment><USER2> A lot of corporate companies have a mitm or some form of network monitoring in place. There are a ton of products out there to do this, for example Microsoft forefront TMG. I never access personal stuff on corporate internet at work for this reason.

When I was in school, there was always some acceptable use policy for accessing the internet. While it didn't prevent some people from watching porn on the network, etc, It was implied that you should only use it for educational purpose and I doubt there is much urgency to fix something that is not school related.

If I were in your shoes, The best way to get it fix is simply raise an issue to someone in IT that you can't access a certain website/app and ask them to fix it. Bonus points if you can find a website/app that you need for school.

If there is a mitm in place, I doubt you can get them to remove it. However maybe you can get them to whitelist gmail, banking sites, etc.

<comment><AUTHOR> Inconvenience aside, I'm more concerned about the unconstitutional surveillance that's probably being performed on all students at the college. Sure, it'd be nice to check finances, but I can do personal stuff at home if I need to. If the FBI/college is monitoring stuff in violation of 4th amendment,it should be exposed to the press. But I don't want to look like an idiot if it turns out I'm entirely wrong. Is the command line OpenSSL thing the best way to go? HTTPSeverywhere has the SSL Observatory thing where you can submit certs; maybe I'll have a look there, too. Thanks for the comment!

</comment></comment><comment><USER3> You can, using openssl on the commandline, retrieve the certificate details for every site you suspect is MITMed.

If there is any evidence of MITM, go to the ACLU or EFF.

<comment><AUTHOR> Thanks! I'll give it a try</comment></comment>