Auroracoin – Forked and Game Over - <AUTHOR> https://bitcointalk.org/index.php?topic=546338.0 <comment><USER2> I am disappointed by you guys. No proof was given anywhere. This is just scaremongering. No matter who BitcoinEXpress is, he didn't give proof.

This was a planned hard fork, as you can see on the Auroracoin forums[1]. The fork was planned on block 5400, which happened today[2].

[1] [http://forum.auroracoin.org/viewtopic.php?f=8&t=129](http://forum.auroracoin.org/viewtopic.php?f=8&t=129)

[2] [http://blockexplorer.auroracoin.eu/block/74546cee7f93595d36a...](http://blockexplorer.auroracoin.eu/block/74546cee7f93595d36a4fb0f4fe62739ca5bced85eb4e368e4c6fee960e73476)

<comment><USER3> I was looking for more information, but I can't find a site that has a visualization of the forks in the blockchain. Something like this, but with real numbers and more information: [http://imgur.com/WNmNtaH](http://imgur.com/WNmNtaH)

Is there a visual representation available?

<comment><USER2> Not that I know of, but you'd be welcome to make an app out of this!

I'm not sure it would be very profitable, but it definitely would be helpful :)

</comment></comment></comment><comment><USER4> I read a bit through the forum discussion and the part I find fascinating is that new cryptocurrencies, with low hash rates, are seen as targets ... and that there are high-hash-capability persons and organizations that will attempt to "break the bank" so to speak ...

Which leads me to conclude that any new cryptocurrency would need to be launched by an organization that had the computing power to defend the currency (assuming it follows resource-intensive mining paradigms like bitcoin et. al)

Can anyone comment on this interpretation ?

<comment><USER5> > " _Which leads me to conclude that any new cryptocurrency would need to be > launched by an organization that had the computing power to defend the > currency (assuming it follows resource-intensive mining paradigms like > bitcoin et. al)_ "

So, you're saying that there should be some kind of powerful institution that is capable of defending the currency against manipulation attempts if necessary and thus ensures a reasonable level of stability in said currency? This concept seems somewhat familiar, you might even consider it a crypto currency's _Central Bank_.

What I find funny w.r.t. to BTC et al. is that people are slowly starting to find out that living in the currency equivalent of the Wild West is not as much fun as it sounds at first. First, there were calls for more government regulation and a higher level of accountability on the side of infrastructure operators and now even the idea of some entity defending the currency against attacks seems like an attractive prospect.

My prediction is that at the end there will be an epiphany that our real world currency system is constructed the way it is for a reason. It may not be perfect, it certainly has some major flaws but at the end of the day it's still better than the alternatives.

<comment><USER6> I'm no fan of Bitcoin, in principal. I agree with you; it's flawed as hell long term, for multiple reasons I won't go into here. But boy, is it ever nice to work with. Several of the companies I have business with now support BTC payments, and all I do is click on the link, which opens up my Coinbase account with all the fields pre-filled, hit one more button and it's done.

Not easier than, say, Amazon, where I buy something every week at least, have my card information saved and make sure I keep it updated when it expires, etc. But, if it's a new place, where I just have to make a one-time payment, I'll choose BTC every time if it's offered.

<comment><USER7> >I'm no fan of Bitcoin

>I'll choose BTC every time if it's offered

I hate to break this to you, but you _might_ be a fan of Bitcoin

<comment><USER6> Lot's of things are bad for the world, but personally convenient for me, so I use them. I'm not saying it's one of my better qualities. :D

</comment></comment></comment></comment></comment><comment><USER8> This is "just" a scheduled hard fork that went bad. The developers made a backwards incompatible change to the protocol and presumably, a sizable part of the network forgot or refused to update their client.

While altcoins are more vulnerable to 51% attacks, 51% attacks do not result in hard forks. Hard forks can only happen when two or more incompatible clients are simultaneously used by the network participants.

51% attacks are easier to pull off during hard forks because the network's hashing rate is essentially split between the chains but there is no evidence that such an attack has occurred.

</comment><comment><USER9> Forum threads have announced 47 of the last 2 altcoin fatalities.

</comment><comment><USER10> Everybody knew that it's going to die, no surprise.

Though I'm not disappointed: I made over 20000% on AUR.

<comment><USER11> This casually written comment sums up most of what I think of cryptocurrencies in general.

<comment><USER12> If you'll permit me to put words into your mouth, I think that you're expressing your disdain for this mindset.

Currency needs to be stable in order to have long-term prospects. The dollar is stable because everyone believes that the dollar will be around in some shape or form in 10, 20, 50, 100 years. I'm currently investing in a retirement fund whose outlook is focused on 2055. Many other people are doing the same.

If you don't have this stability, your currency isn't really a medium of exchange; it's a commodity to be speculated on. And, well, as long as you GTFO of the commodity, it's perfectly fine if its value plummets or goes to zero. But something of this form will never become a currency because everyone thinks like this. It's just going to be a way for smart people to separate fools from their money.

<comment><USER11> The root comment on this thread wasn't taking advantage of the instability of Auroracoin; it was taking advantage of a gold rush of other opportunists and the certitude (reasonable, and, as it turns out, correct) that the Auroracoin experiment would fail, leaving anyone who bought and held the instruments holding the bag. In other words, a pump-and-dump scheme.

<comment><USER13> Is it similarly immoral for an investor to put money into a startup that they "know" (highly suspect) will fail?

No one knows what will happen, even if they claim they do. The options aren't only "know it will go up" or "know it will go down". That was my point that you were so dismissive of.

<comment><USER11> That's an interesting and, I think, complicated question. It's easy to uncomplicate it though; for instance, posit that the "investor" not only "invests" but also talks the "investment" up. Deliberate deception for profit has another name: fraud.

<comment><USER12> I think that's what a lot of these alternate cryptocurrencies are doing. People get in early and hope that there are enough fools who get in late to sell their massive holdings to them. Then these same people try to do the same to other people down the line. Eventually, it becomes clear that there are no more people to buy into the alternate currency, and the entire thing shits the bed.

I'm not sure where you draw the line between a "currency" like this and Bitcoin, but I think it's important to look at what the bulk of transactions are for. Bitcoin, despite rampant speculation, is still _used_ for some things - avoiding Paypal, drug transactions, etc. Litecoin is more on the speculation side, but still has a fair amount of use. Dogecoin has its use on Reddit. But a lot of these other coins are only for speculation, and it's basically gambling to put money into them and hope that you get out before everyone goes "Well, that's all, folks! We're done here!"

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> I don't understand. Why is this game over?

<comment><USER15> Think of it this way, you create a bunch of purple 20 dollar bills and convince most(51%) of the population that your purple bills are the only legit ones. So people begin transactions with only the purple bills and green bills are worthless outside their little town(subnet)... but then someone else splits up these people again and convinces 51% that red bills are the only legit one.

So now we have this mess where transactions and various business deals were made with green, purple and red bills and everyone is arguing about which color to accept.

There's no sensible way to resolve this without nearly two-thirds of people being screwed... so you need to wipe everything out and start from the beginning. Which is lost resources for almost everyone.

So there's no good ending. Any solution to this will cause over 50% of Auroracoin-holders to lose everything.... this is absolute worse-case doomsday scenario, assuming someone did a 51% attack with their own blockchain that may or may not be based on the original. If it's a fork of original, those who didn't trade and have their coins in offline wallets will be on all forks.

<comment><USER16> That's an exaggeration. People who haven't traded since the fork haven't lost anything. If it's caught quickly and resolved, only some of the people who did trade since the fork lost something.

An obvious workaround would be for the major exchanges to make sure they're on the same fork and stop all trades if anything goes wrong, until it can be fixed.

Of course, the secondary effects from loss of reputation are a big problem.

<comment><USER15> So, there are some caveats here.

 _> >People who haven't traded since the fork haven't lost anything. If it's caught quickly and resolved, only some of the people who did trade since the fork lost something._

T̶h̶e̶ ̶p̶e̶o̶p̶l̶e̶ ̶w̶h̶o̶ ̶h̶a̶v̶e̶n̶'̶t̶ ̶t̶r̶a̶d̶e̶d̶ ̶s̶i̶n̶c̶e̶ ̶t̶h̶e̶ ̶f̶o̶r̶k̶ ̶w̶o̶n̶'̶t̶ ̶l̶o̶s̶e̶ ̶a̶n̶y̶t̶h̶i̶n̶g̶ ̶_̶I̶F̶_̶ ̶t̶h̶e̶ ̶f̶o̶r̶k̶ ̶t̶h̶e̶i̶r̶ ̶c̶o̶i̶n̶s̶ ̶a̶r̶e̶ ̶o̶n̶ ̶i̶s̶ ̶t̶h̶e̶ ̶o̶n̶e̶ ̶c̶h̶o̶s̶e̶n̶ ̶a̶s̶ ̶l̶e̶g̶i̶t̶. Also, the people who keep coins in exchanges _(against advise to do otherwise)_ , if the exchange is operating on a losing fork... all costumers are kinda screwed.

But you're right that if action is swift enough and some authorative-group of people can say _" use this fork and ignore the other two"_, then minimal damage will be done.

If this is not dealt with early enough.... ever second that goes by all kinds of transactions are taking place and if all major exchanges are not on the same fork, the exchanges running on a losing fork(and all its costumers) are in for some bad times. My guess is they'll probably have to pick the fork that has the most exchanges running on it. Or, if what I've read is correct and Auroracoin is premined... then those premined coins must be rescued.

We'll see in the days to come what ends up happening...

EDIT: To those who replied below me, you're right. If you haven't traded your coins are on all forks.

<comment><USER17> If someone hasn't traded since the fork, their coins are on both forks and it doesn't matter which fork is chosen.

</comment></comment></comment></comment></comment><comment><USER18> It's FUD guys. Scare tactics to make you dump your coins so scammers can buy low. Just please be sure to update your wallets.

</comment><comment><USER19> It was just one person who stated there was multiple forks, it was several posting on Reddit and Bitcointalk. A few them are developers. The hash rate jumped instantly from 1.6 GBS to more than 50gbs in a matter of a minute or two. There were clearly multiple forks for a time.

</comment><comment><USER20> coinmarketcap.com charts over 190 altcoins.

30 day chart:

[http://coinmarketcap.com/aur_30.html](http://coinmarketcap.com/aur_30.html)

7 day chart:

[http://coinmarketcap.com/aur_7.html](http://coinmarketcap.com/aur_7.html)

<comment><USER3> Yes, it's sinking, but this drop is caused by another problem.

The pessimistic interpretation says that this is caused by a pump and dump scheme.

The optimistic interpretation says that Auroracoin was heavily (50%) premined. The premined coins were stored and the amount was approximately 100x the amount of the new coins. In the last 4 days they started to distribute the premined coins to the Islanders. So the amount of circulation coins increased heavily, and the price dropped. It's like inflation.

I don't have the actual numbers, but I think that the distribution of the coins was unsuccessful. If it were successful the price would have fallen even more.

</comment></comment><comment><USER21> Just FUD, it's a hard fork, bitcoin has passed for this situations

</comment><comment><USER22> dogecoin faced some issues like this, but community is strong and people promptly update their clients when announced .

</comment><comment><USER23> phpBB threads are so painful to read.

</comment><comment><USER24> Linkbait garbage. I don't like AUR much either, but this title is linkbait garbage.</comment>


Ask NewsY - How to handle early founder severance - <AUTHOR>

<comment><AUTHOR> The startup I'm working on had an interesting start and we have 7 'founders' involved. Only 5 are really contributing anything to the project even though the others somehow seem to feel that they are entitled to a share in the profits. At this point it's not much of a problem but when we get funding I'd like to make them an offer to leave and give up their rights to the company. I'm thinking of offering 1% of the profit from any company sale or an option on 1% of the publicly available shares if we go public. (That's for each of them so basicaly give away 2%) Do you think this is a good move? Has anyone dealt with something like this before?

</comment><comment><USER2> do it now. when the money is on the table they will get greedy and this may potentially keep you from funding. ie legal issues.</comment>


Hardest captcha ever? - <AUTHOR> http://random.irb.hr/signup.php <comment><USER2> The hardest captcha I've come across is the audio one used by Google on <https://www.google.com/accounts/NewAccount>. Click the little wheelchair icon to hear it.

It's so hard to decipher, it almost comes across as a cruel joke at the expense of blind people.

These are much easier, in that I can actually understand them.

<comment><USER3> Once at MIT a blind student was showing me his screen reader. I couldn't make sense of the sounds at all, and asked if it was in some special code. He said no, it was normal language, just really fast. He had it read the current line on his terminal (this was late '80s). I could see the words it was supposedly reading, but I still couldn't map them to the brief burst of sound that came from the screen reader.

So maybe if you've been blind a while, the audio captcha isn't so hard to decipher. Keep in mind they have to make it hard for speech recognition software to decipher too.

<comment><USER4> (Was it Sam H.?)

When I was at MIT I had a lab partner who was blind for I think 6.002 or 6.003. I remember that one side-effect of using a screen reader was that he easily "recited" code, which I don't think most sighted programmers could do fluently.

Of course, in order to understand what he was reciting, my only hope was generally to try to type it into a text editor, format it and look at it. (And it's also hard to transcribe code being read to you.)

<comment><USER5> My mom and I used to take turns reading the code listings from magazines like Compute! and RUN to each other and typing them in. It took forever. I definitely find it harder to do that with punctuation heavy languages these days (not that I'm typing much code in from magazines anymore).

<comment><USER6> This is a classic example of how the culture of home parenting, and individual choices made by the parent, has a big impact on kids. Having your _mom_ , of all people, reading code listings from a software magazine, typing them into a computer with you, pretty much puts you into the top 1% percentile in terms of parental engagement in their child's intellectual development. Race itself is irrelevant compared to this. Nationality itself is irrelevant to this. What the parents do: extremely relevant.

<comment><USER7> True, but race and nationality are pretty relevant as to whether you have a mom who has convenient access to software magazines and computers to type the code into.

<comment><USER5> I don't think mkramlich was meaning to imply otherwise, because the relevancy of parents' involvement doesn't just apply to technology. Engaged parents who involve their kids in engine rebuilding or animal husbandry or child rearing or anything else that requires years, effort, and guidance to master are most likely are in the top 1% in terms of intellectual development.

Technology and computers wasn't my mom's hobby or profession (she's actually a seamstress -- and I learned the basics of sewing from her) so it wasn't like she was introducing me to her interests; however, when my son gets older (out of diapers), I plan on spending time with him teaching about my major interests and learning new things with him that's he's interested in, independent of what that may be.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I don't think it would be hard to do, in fact, they reverse the whole point of a CAPTCHA.

A CAPTCHA is supposed to be a task that is easy for humans, but difficult for computers. High-level mathematics is difficult for humans but easy for computers.

They do have some success of telling computers and humans apart, though.

<comment><USER9> High-level mathematics is difficult for humans and provably impossible for computers.

<comment><USER10> What kind of high-level mathematics is _provably_ impossible for computers, but merely difficult for suitably-trained humans?

If you're thinking of either of Gödel's incompleteness theorems, you may be slightly mistaken about what they say. In general, a human operating by rigorous standards of proof is no more able to prove the completeness and consistency of certain formal systems—using the tools provided by those formal systems—than a machine can.

If, as a human, you somehow prove the consistency of these particular formal systems, you run smack into Gödel's second theorem: _For any formal effectively generated theory T including basic arithmetical truths and also certain truths about formal provability, T includes a statement of its own consistency if and only if T is inconsistent._ Thus, any proof of consistency is self-defeating, whether it's made by neurons or silicon.

Really, math doesn't care what parts of the periodic table you use to prove things. :-)

</comment></comment></comment><comment><USER11> Most of these are really easy. I got a partial derivative of a constant. And honestly, if you can't answer basic math questions, you probably have no use for a quantum random bit generator.

<comment><USER12> I'm not sure I'd consider calculus to be a basic math question, except in the context of uses where you have a real need for this level of randomness.

<comment><USER13> <semi-sarcastic-rant />This is what [one of many things] is wrong with the educational system! Sure it's amazing that public schools have collectively taught people basic algebra (in theory), but we should set the new bar to Calculus and just keep pushing it up every so often. (I think Bayesian stats are more difficult than straight-up calculus though I'd like to see a public familiarity with both...)

Calculus has been around for a pretty long time, there's plenty of good material out there to learn it and people who understand it to teach it, there's no real reason it shouldn't be required curriculum these days.

<comment><USER14> I would NEVER put calculus into required curriculum. Calculus is far less important than some simple number theory, logic, and the ability to think about abstract problems creatively. The tragedy is that we push towards calculus (which is really just advanced arithmetic until you get to, say college, real analysis) at the expense of these other skills.

<comment><USER13> While agreeing with the sister-child I'll also say that yes, other math and thinking skills are also important, but there's no reason we can't have those and calculus too. Throw out some of the more useless things like PE, get rid of certain requirements like art, maybe take away a year or two of the "read books most of the class doesn't care about and write essays hurriedly read over by the prof to later be never read again" English classes.

Even just removing one required semester (half a year) of PE and one required semester of English (which shouldn't be very controversial) frees up two semesters, which for a high school level accommodates Calculus just fine. I'd love to see mathematical analysis courses taught at the high school level too (especially since many grown adults are under the impression math in general is like the algebra they did in high school) but that might be getting ahead of ourselves.

I also don't see why you can't teach number theory et al. throughout all the math courses. I never had a formal trigonometry course because it was taught along the way.

<comment><USER15> While I agree with your overall idea of removing extra classes from high school, you do realize that most graduates need at least 2 more semesters of English? Plus the failure rate of College Algebra is pretty staggering.

</comment></comment></comment></comment></comment></comment><comment><USER16> The real WTF with this captcha is that to get a new one they recommend you reload the page, which will clear out everything you just typed into the form (since you probably typed that all before getting to the captcha), which is retarded.

If you try to be smart and just put in a known wrong answer in hopes that it'll keep the form data and give you a new question, you get dumped to a validation page which tells you you're wrong and then tells you to go back and reload the page, which is also retarded. You still come out ahead because when you hit the back button you should get a new captcha and the browser should have saved your form data, but man, this page belongs in the UX hall of shame regardless of how you feel about math in your captchas.

</comment><comment><USER17> Sounds like a great way to stock up on fake accounts submitted by people who just want to know if they got the question right

<comment><USER18> i even made a typo in my login handle >_<

got the question right though.

</comment></comment><comment><USER19> Isn't using math questions to stop bots(computers), a bit like trying to stop tanks with barbed wire?

</comment><comment><USER20> Dumbest CAPTCHA ever.

It's a math problem - which computers are great at - in highly readable text; which they're pretty good at. I expect someone talented could break it in an automated fashion in a day or less.

I don't know why they don't just throw up an fairly large image of a bunch of animals, then say "Click the cutest kitten" or something that's purely subjective, and relies on human recognition abilities rather than computational ones. Maybe two of those in succession in case a computer gets lucky? Using the same method recaptcha does. Show two images, one with a known heat-map of clicks showing where people think the kitten is, to test them, and another one for them to develop the map on the new picture for future tests.

<comment><USER21> Hmmm, perhaps this is the first of many in a dystopian future of human CAPTCHAs... "Please solve this equation in 200ms or less. Sorry, no humans allowed."

<comment><USER22> Actually, that's a fascinating idea that could be put to a different purpose.

Spambots try to spew spam as quickly as possible, right? I wonder how effective it would be to flag those who fill out the signup forms _too quickly_ as likely spammers and check up on them or impose extra limitations until they had been using their account for a while without spamming?

</comment></comment></comment><comment><USER23> Actually I find that much easier than blurred text on random lines in the background

</comment><comment><USER24> Ha, by this logic, a large majority of the current world population aren't humans :)

<comment><USER25> Well, to be fair the easiest captcha's are easy high school level equations and (as someone else already pointed out) if you can't solve these you have no business obtaining an account for extremely high quality quantum random numbers. (I believe they provide about 7.8 or 7.9 bits of entropy per byte)

<comment><USER26> I buy _my_ random numbers from a guy in the alley behind my building. He says they fell off a truck.

</comment></comment></comment><comment><USER27> Am I the only one saddened by the fact that this would have been a piece of cake back in high school/college, but can't remember how to do them (integrals) anymore? :(

<comment><USER28> The notion of "use it or lose it" is always disappointing, but honestly if you learned them once you can learn them again.

<comment><USER29> >if you learned them once you can learn them again

I doubt this personally. I didn't have any problems with the partial differential I was set. I mean on a general level that something once learnt can be relearned.

<comment><USER28> You may not be as sharp at it as you were when you spent hours pounding it into your head on a frequent basis, but it's surely within a person's grasp. At least as far as math goes; something like language fluency may be another story.

</comment></comment></comment></comment><comment><USER30> It's a reverse captcha! If you answer too quickly it knows you're a computer.

</comment><comment><USER31> No

This can be automated with <https://github.com/mathgladiator/tutor>

I'd have to spend some time working on adding OCR support, but overall totally doable,

</comment><comment><USER32> I could easily write a captcha breaker for this...It's much simpler to do than one with fuzzy characters.

</comment><comment><USER33> I run "algorithmist.com" and was getting quite a bit of spam with using only recaptcha. I was looking for something mathy.. I ended up giving mathcaptcha a go first and it seems to work well to stop the spam, but I was ready to create my q/a with algorithm questions, with the benefit that if you can't answer basic algo questions, you shouldn't edit the wiki anyways!

</comment><comment><USER34> The required value seems to be a small integer. A bot trying zero each time, IMO, has good odds passing the captcha.

</comment><comment><USER35> One thing that's occurred to me -- there's obviously an asymmetry of effort in captchas. Reliable proof that someone is human is very hard. What about reliable proof that something is not human, but an automaton? Can we make this stronger, and make it reliable proof that something is a particular automaton?

It seems to me, the answer is Yes. This is actually very powerful and useful for security. (Even if you can only count on the first time it's answered.)

<comment><USER36> Requiring that people access your site over TCP/IP is a reasonably good way to weed out clients that don't involve computers at all.

Bots are user agents that don't have a human operator; browsers are user agents with a human operator. Both bots and browsers involve computers. However, as browsers can automate some tasks, and bots need human interaction at least to program them in the first place, there is a blurry line between bot and browser. CAPTCHAs try to force a certain amount of human interaction. The only reliable way to prevent human interaction between sending a request to and receiving a response from an unknown user agent is to require a response so fast as to preclude human intervention.

</comment></comment><comment><USER37> Hmm. I see captcha's harder than that every day on numerous sites; with a lot of 'normal' captcha's you sit staring for minutes and then kind of gamble (like an OCR bot) to what it says. At least the formulas are clearly readable and there is a one correct answer to each of them, while this <http://bit.ly/gKPgKH> I cannot read (Google).

<comment><USER38> chithersom

</comment></comment><comment><USER39> Stack Overflow should use a tougher version of it. Will weed out some noise.

</comment><comment><USER40> I thought it _had_ to be static, but no: the captcha actually changes at each page reload.

At least it will weed out the non-mathematicians easily...

<comment><USER41> Hardly. You can just type it into WolframAlpha, that works perfectly. (Which is quite funny because you are letting the computer solve something that's supposed to keep computers out.)

You don't even need to learn any fancy syntax, "derivative of" works great. (High school math homework would be so much easier with WolframAlpha.)

</comment></comment><comment><USER42> Actually, the captcha is quite easy to extract (and solve), so it will probably filter out humans, not bots :)

</comment><comment><USER43> This looks like the derivative of a constant value, which is always going to be zero. I reloaded the page several times, and each time, no matter how complex the formula looked, it was always a constant.

Still, it is cute.

</comment><comment><USER44> I've seen harder (limits of converging sequences, etc), but wolfram alpha made them harder for humans than for automated scripts.

My captcha was to find the least zero of this polynomial: [http://random.irb.hr/latexrender/pictures/c46ad0f30d7575c609...](http://random.irb.hr/latexrender/pictures/c46ad0f30d7575c609d863329f5e59f7.gif)

and all I had to do was to OCR the formula: [http://www.wolframalpha.com/input/?i=x^3+%2B+3x^2-4x+-12+%3D...](http://www.wolframalpha.com/input/?i=x^3+%2B+3x^2-4x+-12+%3D%3D+0)

</comment><comment><USER45> I like that captcha because I can do it in my head which makes me feel special. Too bad there isn't a button just to check the captcha for those of us who don't want to sign up for an account.

</comment><comment><USER46> This brings to mind a recent article about solving the "hacker news problem". It occurs to me that requiring an entrance exam of some sort could weed out users unprepared to constructively contribute to any domain specific online forum.

<comment><USER46> Well imagine my surprise when I saw an article about an event using just this sort of weeding on page 2 of hacker news...

<http://news.ycombinator.com/item?id=2288469>

</comment></comment><comment><USER47> Hardest Captcha for a human: Maybe Hardest Captcha for a machine: Not so sure !

You can just pass the equation in Wolfram Alpha directly and you have your answer! The font is crystal clear and the equation is quite simple.

</comment><comment><USER48> The questions it generates are all trivial with a little bit of math knowledge. Finding the roots of polynomials that are already factored. Multiplying a series of factors, the last of which is zero.

</comment><comment><USER49> That's funny. I wonder if that encourages people who otherwise wouldn't sign up. It obviously self selects your clientele. I might need to implement a "2 trains leave" problem for my captcha.

</comment><comment><USER50> I think most of the answers are zero, and that this is largely a joke.

</comment><comment><USER51> I found an exploit ;-) <http://www.wolframalpha.com/examples/Calculus.html>

<comment><USER52> Nice, but if you can get it into Wolfram Alpha and back, you're probably human. :)

<comment><USER53> Or you can write a simple OCR program that can send HTTP requests.

<comment><USER51> OCR + LaTeX, have fun!

My scanned books can't tell VV and W apart...

</comment></comment></comment></comment><comment><USER54> After a few reloads, I got this captcha:

\- 2 + 1 - 0 + 0 * 0 + 3 - 3 = ?

</comment><comment><USER55> I got to compute a derivative. In the spirit of reCAPTCHA, wouldn't it be more appropriate if the Captcha consisted of symbolic integration?

</comment><comment><USER56> Why is this here? This is easy to a)break b)solve IF you a)finished high school maths(australia) b) know about pythons ocr libraries.

</comment><comment><USER57> Haha this is seriously awesome... almost makes me miss doing hours and hours of calc every day :)

</comment><comment><USER58> Bit pretentious, bordering childish. Also easy to crack WolframAlpha if you don't know the math

</comment><comment><USER59> i got one of the easier ones and was confused about why this would be difficult for machines to beat.

[http://random.irb.hr/latexrender/pictures/bba40bf17043b0ced7...](http://random.irb.hr/latexrender/pictures/bba40bf17043b0ced791685dcba29dad.gif)

</comment><comment><USER60> The irony is that it would be easier to solve the captcha using programs like Mathematica.

</comment><comment><USER61> I tried a few, and it looks like most (all?) of them can be answered by wolfram alpha.

<comment><USER62> ...which sort of defies the reason the CAPTC_H_A was put there in the first place - great!

</comment></comment><comment><USER63> huh, got in on my first try... 0/0x[... 0 duh :) Most are easy, but maybe scary looking to people not inclined to math?

</comment><comment><USER64> Of course not the hardest. <http://brad.livejournal.com/2331278.html>

<comment><USER65> That's a blog entry linking to TFA.

</comment></comment><comment><USER6> "Here I am, brain the size of a planet, and they have me solving captchas. If anybody needs me I'll be over in the corner rusting for the next, oh, one million years."

\-- Marvin the Paranoid Android (with liberties taken)

</comment><comment><USER62> I just use <http://www.random.org/> instead and do not have to go through all that hassle.

</comment><comment><USER66> As a side question, why are captchas using alphanumerics? Any reason why you can say, what is 1+1?

And flip the terms and answers for each captcha.

Is it because a person can't solve 3+8?

<comment><USER67> Because a computer is very good at solving basic maths questions?

All this does is simplify the captcha for machines to solve, whilst complicating it for humans (basic maths is easy for most but it's still one more logical step then 'type out the 5 letters you see'). Instead of 26 upper and lower-case characters, and often just a random string (so we can't make a best guess vs a dictionary), we now just have ten characters and maybe 2-4 mathematical operators and it must make sense (it can't be "42+-" for example).

<comment><USER66> As you stated: If computer wanted to hack it - sure it is easy enough. But I was looking for a easy way to do some verification.

I asked this because I was creating a reddit clone and wanted a captcha system. I detest the ones that exist right now.

<comment><USER68> The point of most captchas is to stop someone from writing a program that abuses your system. If you're not doing that, what exactly are you "verifying"?

<comment><USER66> I want to make sure a person votes only once. But if they want to game the system fine as long as they are willing to submit a captcha

For another website, I used to store the IP address and do checks but for a simple system that seem to be overkill.

All of the websites have no user accounts.

Is there another way to do this? Where you want some voting to happen but with no user accounts. And you want it to be dirt simple.

<comment><USER68> Ah, I get it. You are using a captcha not for its resistance to automation but as a way to make a user pay (with time) for an action.

If you start with the assumption that no one will try to attack your site, then you don't need a captcha at all. You can give the user any annoying/time- consuming task (e.g. "click a square ten times"), or you can insert an inconvenient delay in vote submission. However, people may object less to the inconvenience of something that looks like a captcha, because they are used to them.

Needless to say, almost no one uses captchas for this purpose. Instead, they use captchas to make their sites more resistant to automated abuse -- as you almost certainly will need if your sites become popular.

<comment><USER66> Thanks, these are great ideas. I never thought of doing this way.

The site dos not take in user generated content that is immediately displayed. The data is first curated and verified so the attack will be a bit harder. So there is fresh (delayed) content constantly.

That is exactly the reason of the captcha: to give a person something to do that wastes a bit of their time and that is familiar to them.

Yes, in other sites I have used captchas to prevent automated abuse.

</comment></comment></comment></comment></comment></comment></comment><comment><USER69> I reloaded the page and got something like 4 * -1 - (-4) = ?

A subsequent reload sent it back to a more complex formula.

</comment><comment><USER70> WAIT, this captcha seems like its inverse, easier for computer than human to answer.

</comment><comment><USER71> What answer does it want?

I got "-6-7x7". Does it want proper order of operations applied, giving -6-49=-55? Or does it want it the silly way that most (I suspect) people are going to do it, left-to-right without respect to order of operations, -13x7=-91?

(oops, the asterisks give italics rather than multiplication!)</comment>


Google AMP links will convert back to regular ones when sharing on iOS 11 - <AUTHOR> https://www.theverge.com/platform/amp/2017/8/23/16193584/ios-11-safari-google-amp-sharing-url-scheme <comment><USER2> Isn't the canonical URL in a meta tag a requirement of AMP?

Edit: to clarify, i find this part of the article quite odd (assuming my understanding about canonical URLs in a meta tag is true):

> What's more, AMP URLs aren't standard — an AMP link for say, The Verge, > looks different from that of another publisher — so Apple is presumably > doing some work under the hood to find these canonical URLs.

<comment><AUTHOR> That's what I thought</comment></comment>


Jared Kushner Runs Windows on a Mac? - <AUTHOR> https://www.washingtonpost.com/posteverything/wp/2017/03/30/i-worked-with-jared-kushner-hes-the-wrong-businessman-to-reinvent-government/?utm_term=.fc8ae2ef87e0 <comment><USER2> I love WaPo. I hate Jared Kushner and Donald Trump. But this article begins with the attitude that I often find among laypeople who still put Apple on a pedestal: a bizarre combination of misinformation and elitism.

> _The computer was a recent-model Mac, but when I turned it on, it was > inexplicably running Windows._

> _"So he was basically using a $2,500 desktop as a monitor?" I said. The IT > guy shrugged._

> _On the other hand, why did the newspaper's owner need a $2,500 monitor? How > was it anything but a vanity object?_

As anyone with the most basic understanding of computer hardware knows, this is completely wrong.

Also, as long ago as 2012, The Verge acknowledged wrote an article titled, "MacBook Air with Windows 7 review: the ultrabook to rule them all?"[1]

1\. [http://www.theverge.com/2012/2/10/2787484/macbook-air- with-w...](http://www.theverge.com/2012/2/10/2787484/macbook-air-with- windows-7-review-the-ultrabook-to-rule-them-all)

</comment><comment><USER3> My previous 2 laptop were MacBook Pros - running windows. Good hardware is good hardware. (Then new MBPs weren't suited to my needs so I'm currently using a new Dell XPS15.)

</comment><comment><USER4> Both my Mac Pro and my Mac Book Pro run Windows 10. I don't feel guilty.</comment>


Affordable housing activists try to thwart cutthroat real estate capitalism - <AUTHOR> https://www.latimes.com/california/story/2019-10-21/affordable-housing-activists-push-back-real-estate-capitalism <comment><USER2> All they really need to thwart is the fed's free money policies and banks ability to give people mortgages at 50% DTI and 1% down.

<comment><USER3> Unfortunately it's a little more complex than that.

<comment><USER2> Not really.

<comment><USER3> It certainly would help but not any of the other issues that relate to the industrial complexes, the Landlord-Rental-Development complex, along with other parts of the finance complex.</comment></comment></comment></comment>


Tesla ends Model 3 shipments to China as Shanghai Gigafactory production begins - <AUTHOR> https://cleantechnica.com/2019/10/01/tesla-ends-base-model-3-shipments-into-china-as-gigafactory-3-production-comes-online/ <comment><USER2> Will Shanghai factory be able to produce the same number of cars as the US factory?

<comment><USER3> Relevant wiki articles[1][2][3].

[1] [https://en.wikipedia.org/wiki/Tesla_Factory](https://en.wikipedia.org/wiki/Tesla_Factory)

[2] [https://en.wikipedia.org/wiki/Gigafactory_1](https://en.wikipedia.org/wiki/Gigafactory_1)

[3] [https://en.wikipedia.org/wiki/Gigafactory_3](https://en.wikipedia.org/wiki/Gigafactory_3)

</comment></comment><comment> ga-vu *Begin rumors of China backdooring Tesla cars

<comment><USER4> No need to. These Teslas are for domestic use, and they already have enough data of every Chinese citizen.

<comment> ga-vu Begin rumors of "China has stolen Tesla technology" then</comment></comment></comment>


Show HN: Answer to the Arms Race of OpenTable Restaurant Reservations - <AUTHOR> http://www.tablesweep.com/

<comment><USER2> Pretty cool, nice interface. A new era of high frequency restaurant reservations emerging? Perhaps purchased reservations can be bundled and sold as an investment vehicle.

<comment><AUTHOR> Thanks :) I'm working on improving the UI a little more, as well as provide a little more clarity. It's checking OpenTable every minute (and will attempt to book it right away if it's available) even though the UI doesn't show it. I'm even thinking of showing a persistent progress bar or Ajax spinner just to get that motif across.

I wrote a program too for Momofuku Ko. I'll add in more adapters depending on user interest.

I also wrote the program partly in response to [https://news.ycombinator.com/item?id=6101161](https://news.ycombinator.com/item?id=6101161)</comment></comment>


Fake News, Facts, and Alternative Facts - <AUTHOR> https://www.edx.org/course/fake-news-facts-alternative-facts-michiganx-teachout-2x <comment><USER2> Interesting course, but very interesting web portal. Thanks for posting!!</comment>


Ask HN: What is the most accurate 3D indoor positioning method in small spaces? - <AUTHOR>

I am working on an idea which requires three dimensional location data from somehow "tagged" smallish objects (around the size of a brick) moving within defined spaces of 5-20 cubic meters. What are some standard solutions for this kind of projects? Where to start? Can it be done affordably?<p>The needed frequency of updated positions is around 100hz and accuracy of 1cm or better would be ideal. If you have done something similar to this, I'd be more than happy to hear! Computer vision and use of cameras is something that I'd rather avoid. <comment><USER2> Other than computer vision, the most accurate positioning method is "ultra wideband" (UWB). It's possible to get close to cm accuracy, but it can be expensive. There is also a calibration problem: if the readers get bumped or moved, then you may have to recalibrate the system. UWB uses time distance of arrival instead of RF triangulation, so it's extremely accurate, and you can get to 100 Hz.

You can check out a few examples: [http://pluslocation.com](http://pluslocation.com) [http://www.timedomain.com/](http://www.timedomain.com/) or google for: ultra wideband real time location

If you have specific questions I'd be happy to help - contact info is in my profile.

</comment><comment><USER3> Why do you want to avoid computer vision ?

If the space is unobstructed and the objects are visually distinctive it should be fairly easy to do this with a pair of cameras with known position and orientation.

100 Hz is pretty fast but that's mostly a question of how much processing power you're able to throw at the problem.

I've done some work with 3D object tracking. If you'd like to discuss this further my contact info is in my profile.

</comment><comment><USER4> Have you looked into wi-fi triangulation?

Here is one example:

[https://www.navizon.com/product-navizon-indoor- triangulation...](https://www.navizon.com/product-navizon-indoor- triangulation-system)

If you went ultrasonic, this part can provide "0 to 765cm (0 to 25.1ft) with 1cm resolution" at 10 Hz

[https://www.sparkfun.com/products/9495](https://www.sparkfun.com/products/9495)

</comment><comment><USER5> If you have line of sight and can use fixed beacons whose position is known apriori, ultrasound is a good bet. However, if you need to track multiple objects within a defined space, things get tricky with ultrasound. Also, if 100hz is a strict requirement, ultrasound is not a great option due to issues such as signal attenuation in the environment.</comment>


Flippaper: Draw your own pinball in real time - <AUTHOR> http://www.flippaper.org/ <comment><USER2> This is a nicely polished-and-optimized hardware version of the UI in Stephen Lavelle's Plingpling. [0] I have a prototype sitting around of a directly inspired "draw-to-physics" thing myself.

[0] [http://www.plingpling.org/](http://www.plingpling.org/)

</comment><comment><USER3> That's not working for me, but "Pinball Construction Set" was a hell of a thing ([https://en.wikipedia.org/wiki/Pinball_Construction_Set](https://en.wikipedia.org/wiki/Pinball_Construction_Set))

</comment><comment><USER4> This is an art project, not a product.[1] As an arcade machine, it's at least 20 years too late. But it has potential as a casual game for tablets or very fat phones.

[1] [http://sewergadget.tumblr.com/exhibition](http://sewergadget.tumblr.com/exhibition)

</comment><comment><USER5> Hey there, I'm Roman Miletitch, co creator of Flippaper with Jérémie Cortial. Glad to see us on hacker news! If you have any questions, I'm here to answer.

Just one comment already. While the pinball was indeed the thematic, the point was to have a gameplay that would take drawing as an input (or any colored stuff actually), and output on top of it. While not new, the fact you're both the game designer and player is a fun & sometimes weird experience.

And yeah, it's an art project indeed. While we're aiming later for an app on smartphone, we wanted first to keep the physical aspect. This spawned many new way of playing Flippaper (ending up with one guy playing his T shirt because it had the right colors).

</comment><comment><USER6> I thought this was a finished game I could play right now in the browser!

</comment><comment><USER7> I was hoping that this was something I could buy for my son's tablet. That would be awesome.

</comment><comment><USER8> not exactly "realtime" if you press "scan" but still, I love the idea

</comment><comment><USER9> The 80s vibe of creating shitty useless junk to buy because we didn't have what we really wanted, smartphones and tablets, was a nice touch.

<comment><USER10> Haha that's an amusing idea. Definitely were more of those toy commercials back then.</comment></comment>


Teaching Discrete Mathematics via Primary Historical Sources - <AUTHOR> http://www.math.nmsu.edu/hist_projects/#Quick <comment><USER2> One of my preferred links in HN in a long time.</comment>


Google Chrome Now Syncs Typed URLs and Browsing Sessions - <AUTHOR> http://chromestory.com/2011/05/google-chrome-to-sync-typed-urls-and-browsing-sessions-now-in-chromium/

<comment><AUTHOR> I should have pointed out in the title that these features are available in Chromium and not yet in Google Chrome.</comment>


A rift in the NTP world - <AUTHOR> https://lwn.net/SubscriberLink/713901/7bb511312e996566/ <comment><USER2> I see the strapline of NTPsec on Github is: "ntpsec/ntpsec: The NTP reference implementation, refactored".

So is it or isn't it?

A few quotes from ESR from here [http://esr.ibiblio.org/?p=6881Interesting](http://esr.ibiblio.org/?p=6881Interesting)

> tossing out as many superannuated features as I could

> full of port shims for big-iron Unixes from the Late Cretaceous

> I do have an an advantage because I'm very bright and can hold more complex > state in my head than most people [speaks to attitude :)]

> This differs dramatically from the traditional Unix policy of leaving all > porting shims back to the year zero in place because you never know when > somebody might want to build your code on some remnant dinosaur workstation > or minicomputer from the 1980s.

> Yet another important thing to do on an expedition like this is to get > permission – or give yourself permission, or fscking take permission – to > remove obsolete features in order to reduce code volume, complexity, and > attack surface.

> Then ntpdc was deprecated, but not removed – the NTP Classic team had > developed a culture of never breaking backward compatibility with anything.

> I shot ntpdc through the head

I don't know the facts in the case at all, but I can imagine if you were the existing maintainer, you'd find this language and attitude incredibly difficult to take. And after all if you're not being paid to work on it, why should you swallow your pride?

<comment><USER3> > I see the strapline of NTPsec on Github is: "ntpsec/ntpsec: The NTP > reference implementation, refactored".

> So is it or isn't it?

It's technically correct since they started from the reference implementation then "refactored" it.

They're skirting real close to claiming they are the reference NTP implementation but not quite doing that, just leaving the door open for misunderstandings.

<comment><USER4> The concept that your protocol is defined by a "reference implementation" and not a well-written specification is moronic. Someone should be able to articulate unambiguously (with words) what the NTP protocol is and what it does.

<comment><USER5> That's how the majority of software on the internet is written, including Python and Ruby for much of their time.

<comment><USER6> Would people claim that Python and Ruby have "specifications", though?

<comment><USER7> Ruby at least has an ISO standard; it's not exactly current with today's Ruby, though.

</comment></comment></comment></comment></comment></comment><comment><USER8> From the article:

 _Most of them, [Sons] said, "are older than my father.... [and] are not always up to date on the latest techniques and security issues." [...] Sons suggested that they "should be retired."_

That is incredibly asinine and discriminatory to boot.

From the NTPsec project manager's comment:

 _The main point of contention that caused the fork was BitKeeper vs Git._

I can't believe that arguing over VC tooling is what caused the fork. Why not just compromise on this, use BitKeeper for long enough to get on the maintainer's good side, and helpfully offer to convert to Git later? This is how ESR got GNU Emacs development migrated from Bazaar to Git, and it seemed to have gone pretty well for all involved.

<comment><USER9> That's simply not what I said; I was misquoted. Please watch the original video.

[https://www.oreilly.com/ideas/the-internet-is-going-to- fall-...](https://www.oreilly.com/ideas/the-internet-is-going-to-fall-down-if- i-dont-fix-this-susan-sons?imm_mid=0eb1c1&cmp=em-webops-na-na- newsltr_security_20161129)

It's amazing* how many people here are willing to roast me over a third-hand account of my opinions, when I've already offered to answer questions directly.

* Not actually amazing, fairly typical of internet commentary, really.

<comment><USER10> To save effort on finding the relevant segment of a 17+ minute interview, I have attempted to transcribe a portion. See also [https://www.oreilly.com/ideas/susan-sons-on-maintaining- and-...](https://www.oreilly.com/ideas/susan-sons-on-maintaining-and-securing- the-internets-infrastructure) with some portions transcribed (inexactly); add ~20s to the times below to match the podcast timing.

(5:26) [O'Reilly interviewer] Mac Slocum: Related question on this: how can the Internet's infrastructure remain up to date and secure, particularly when it's distributed like this?

(5:33) Susan Sons: So the really terrifying thing about infrastructure software in particular is when you pay your ISP bill, that pays for all the cabling that runs to your home or business. That pays for the people that work at the ISP. That pays for their routing equipment and their power and their billing systems and their marketing and all of these wonderful things. It doesn't pay for the software that makes the Internet work. (5:54) That is maintained almost entirely by volunteers. And those volunteers are aging. [Um.] Most of them are older than my father. And [um,] we're not seeing a new cadre of people stepping up and taking over their projects, (6:10) so what we're seeing is ones and twos of volunteers who are hanging on and either burning out while trying to do this in addition to a full-time job, or are doing it instead of a full-time job, or should be retired, or are retired. [Um.] And it's just not giving the care it needs. (6:27) And in addition to this, these people aren't always up to date on the latest [um] techniques and security concerns of the day. And the next generation isn't coming up. I recently started a mentoring group called the #newguard that takes early and mid-career technologists and we cross-mentor and then we match them up with the old guard who are maintaining and who built this software to try to help solve that problem. But in the meantime there's still not enough funding going in this direction. And there's not enough churning happening. [Um.] And it's a really tough thing because there's a certain amount of what I call "functional arrogance" involved. [Um.] I don't have a certificate of "Susan is good enough to save the Internet" anywhere. I don't know who hands those out.

(7:08) Slocum: Sure.

</comment></comment></comment><comment><USER11> _Searching for additional funding, Stenn contacted the Internet Civil Engineering Institute (ICEI) and began working with two of its representatives, Eric S. Raymond and Susan Sons._

 _Stenn said in a phone interview, "Then all of a sudden I heard they have this great plan to rescue NTP. I wasn't happy with their attitude and approach, because there's a difference between rescuing and offering assistance. [Their plan was] to rescue something, quote unquote, fix it up, and turn it over to a maintenance team."_

 _Most of them, she said, "are older than my father.... [and] are not always up to date on the latest techniques and security issues." Many are burning out from trying to maintain critical code while working full time jobs, and Sons suggested that they "should be retired._

Wow. Keep away from the ICEI I suppose.

<comment><USER9> I highly recommend that you watch my interview with Mac Slocum (video here: [https://www.oreilly.com/ideas/the-internet-is-going-to- fall-...](https://www.oreilly.com/ideas/the-internet-is-going-to-fall-down-if- i-dont-fix-this-susan-sons?imm_mid=0eb1c1&cmp=em-webops-na-na- newsltr_security_20161129) ) to find out what I actually said, rather than listen to a reporter saying what someone else said I said. I was misquoted.

</comment></comment><comment><USER12>
        Several years ago, the project's inadequate funding became known in the media
        and Stenn received partial funding from the Linux Foundation's Core
        Infrastructure Initiative, which was started after the discovery of how the
        minimal resources of the OpenSSL project left systems vulnerable to the
        Heartbleed vulnerability.

No no no no. Yes more funding and resources are good for these things but Heartbleed did not come about because of that. It came about to due broken development practices and the developers focusing on adding more features rather than working through the issues people had reported in their bug tracker.

The work done in NTPsec echos this in what seems to be a repeat of OpenSSL/ LibreSSL with NTP/ NTPsec.

Yes forking is the "easy way out" in these circumstances and it's a shame to see efforts split in such projects but in reality it's often what's needed to get things moving in the right direction.

<comment><USER9> This is pretty much what happened. We spent a few months working with Mr. Stenn, and ultimately he did not agree to pursue strategies to correct the underlying problems that caused NTP's security and stability issues. Simply patching known vulns and moving on would have been a temporary solution: more vulns were lurking. NTPSec was born to give the code base another chance, to evolve with a different strategy. In the end, I tend to feel that this is a strength of OSS: different groups are free to do things different ways, and if people are paying attention, software quality should win out.

Since Eric and the rest of my team started working on the NTP code base in early 2015, we've eliminated over 50% of its vulnerabilities _before they were disclosed_ simply by applying good software engineering practice where it hadn't been. In the year before my O'Reilly presentation, it was more like 80 or 85 percent. Everything we hadn't eliminated by disclosure or discovery time was fixed promptly.

There are other NTP protocol implementations besides NTP classic or NTPSec that are worth considering for some users. However, we felt that refactoring the reference implementation was necessary due to its use in many less- mainstream, but often highly-critical (in a life-critical or economically- critical or critical-to-scientific-research sense) applications. The non-NTP- related implementations don't always do what high speed trading houses need, or scientific installations built on aging but extremely precise equipment need, or controls system interfaces need, and on and on and on. We just didn't have a drop-in replacement available for all of the things that weren't web servers, workstations, and other commodity applications.

The "rift" article is now subscriber-only, so I can't respond there to its many inaccuracies (I was passed a PDF by someone who cached it, this is the only way I was able to read it). I was never contacted about it by the author, and I don't feel it was a fair treatment of the subject. That's okay. I learned a long time ago that fixing a mess will make some people thank you and some people angry with you. It wouldn't have become a mess by the time I found it if there weren't a cost to fixing it. People who fear controversy will have a hard time making a difference in the world.

I'm at work, but I'll do my best to answer any questions fired at me today on this thread. If there's something you want to know, ask!

<comment><USER13> NTPsec advocates keep saying "eliminated 50% of vulnerabilities <<<before they were disclosed>>>", as if there were another meaningful way to eliminate vulnerabilities from a codebase.

Can you provide a breakdown of the vulnerabilities NTPsec HAS and HAS NOT been vulnerable to, along with their severity (low: degrades time service, medium: provides a practical vector for corrupting integrity of time service, high: compromises integrity of the server itself) and whether they're exposed (a) in the default configuration, (b) in a configuration run widely on the Internet, or (c) in no configuration actually known to the project maintainers?

You clearly have the list somewhere, because everyone involved in the project has this statistic ready to quote.

If you don't have the severity and exposure breakdowns, that's OK. Post the list anyways. Maybe it'll be obvious what the severity and exposure is.

This business of counting vulnerabilities and claiming victories has been a problem for software security for two decades now. Ops people don't care about the vulnerability count, if the vulnerabilities left exposed in the codebase are the ones that get their servers popped.

<comment><USER9> I'm sorry if I wasn't clear, I meant "before they were disclosed to NTP classic or NTPSec". In other words, by simply improving on the software engineering practice, we eliminated classes of vulnerabilities without having to track them down individually. This is pretty common with ailing code bases, though often overlooked. I'm at work right now, so I don't have a comprehensive list handy. Going through NTP classic vulns and seeing how many never impacted NTPsec would recreate such a list.

The severity varies (many weren't that big, some were)... the point of claiming the victory is to demonstrate that I'm not just having a fuss about testing code, using static analysis tools, using an accessible code repository, refactoring for lower attack surface and better separation of concerns because they are beautiful in abstract. I like results. NTPSec, and before it the temporary "rescue" team _, have been slowly chipping away at the big picture mess, making the code safer and more maintainable, because it 's likely to remain in service for another decade or two.

Every time 14 vulns are disclosed and we are already immune to half of them, we get to put twice the effort on the half we do need to deal with, if even we need that much. We aren't just firefighting, NTPSec can develop proactively. That means something for our users.

_ lots of personnel overlap here...the main difference being pre- and post- fork and where the funding came from, probably not interesting to most people.

<comment><USER13> No, I understood your meaning. I'm saying: that's what every code refactoring does. I'm saying that since you can't claim credit for eliminating vulnerabilities that are already disclosed, the emphasis you place on precluding vulnerabilities is strange.

Can you provide that list of vulnerabilities now? You're obviously keeping track of them, that being part of the premise of the project. I know you don't have them broken down, but we can help with that.

<comment><USER13> How about this: before I put the effort in to generating the list myself, can you at least promise to confirm that I have the complete an accurate list once I do, and to fill in any gaps?

</comment></comment></comment></comment></comment></comment><comment><USER14> ESR seems to have a long track record of being involved in these types of events. There are obviously a number of possible conclusions to draw:

      - ESR is so productive and involved in so many things that this is actually a normal drama ratio
      - ESR only involves himself in critical issues with high potential for drama
      - ESR brings the drama

I can't rule out either of the first two, but years of data points lead me to believe it's the third.

<comment><USER15> I agree that it is very likely to be the third. Just have a read of some of ESR's articles. Eg:

[http://esr.ibiblio.org/?p=129](http://esr.ibiblio.org/?p=129)

" American blacks average a standard deviation lower in IQ than American whites at about 85. And it gets worse: the average IQ of African blacks is lower still, not far above what is considered the threshold of mental retardation in the U.S. And yes, it's genetic; g seems to be about 85% heritable, and recent studies of effects like regression towards the mean suggest strongly that most of the heritability is DNA rather than nurturance effects. "

ESR's famous melodramatic-response to having his CML2 ("Eric's configuration markup language for kernel building") patch rejected by Linus is also quite telling about his self-perception and his perception of other people and his interaction with anyone who would have an opposing viewpoint to his.

<comment><USER16> How does the quote show that he "brings the drama"? I mean, that's on his own blog. It's not like he's exporting that. It's not like he's going up to black people and saying "you're almost retarded."

I think the CML incident and the time where he yelled at some Debian developer about "our tribe" are better examples, because at least there he's going into other people's spaces and actually confronting them.

<comment><USER17> Because what good can come from discussing that topic? The only reasons to broach it are to a.) troll and/or b.) agitate for some horrific policy proposals.

He's not an academic researcher. Don't you think it's odd for some old white guy to get worked up over minority test scores? Why write about this rather than basically anything else? Either he's a troll or profoundly unaware about how bringing this line of argument up may make people feel threatened. There are a lot of things that simply don't need to be discussed. It's like graphically describing your partner's episiotomy over dinner. Some things just inspire a visceral reaction.

<comment><USER16> It's odd, sure, but it's his blog. People blog about whatever they're interested in. He could have all kinds of reasons for being interested in that which aren't trolling or policy.

Here's an unflattering guess why he might be interested in this: he has cerebal palsy. Despite that, he still is a fairly smart (even if crazy and/or racist) guy. He might be extremely interested in differences in human intelligence for that reason. To figure out why he still has above average intelligence while most other people with his birth defect don't. That could explain a lot of his crazy beliefs and his narcissistic "I'm a super unix hacker" routine.

Why does he have to be an "academic researcher" to have opinions about race that he wants to talk about on his blog? Or for that matter, any topic? Do you have an anthropology degree to assert your opinion that his blog may make people feel threatened, or are you just another guy on the internet with an opinion?

</comment></comment></comment></comment></comment><comment><USER18> If you're looking for a simple security-oriented ntpd, I can't recommend OpenNTPd enough. It's cross platform and available for most Linux distros in packages.

[http://www.openntpd.org](http://www.openntpd.org)

I have a much higher trust level for OpenBSD on security issues than I do with either of these projects.

<comment><USER19> Just remember not to use OpenBSD or OpenNTP for time servers, they can only be used as clients.

(This is because neither supports leap seconds, so using them as servers will cause clients to desynchronize. Their belief that we don't need leap seconds is quite irrelevant: Right now we have them.)

<comment> iso-8859-1 What do you mean when you say "we have them"? Because they are in UTC?

RFC5905 (NTP 4) notes:

        The goal of the NTP algorithms is to minimize
        both the time difference and frequency difference between UTC and the
        system clock.  When these differences have been reduced below nominal
        tolerances, the system clock is said to be synchronized to UTC.

Since nominal tolerances are not defined in the standard, a server would still be NTP conforming if it smeared the leap second.

<comment><USER19> > What do you mean when you say "we have them"? Because they are in UTC?

They are part of the time standard used by the entire world. BSD doesn't like them, fine, but pretending (in their code) that they don't exist is not the correct approach.

It works more or less fine for clients, but not for servers.

> a server would still be NTP conforming if it smeared the leap second

Not really. Consider the situation if a client is speaking to multiple servers, some normal servers, some buggy BSD servers.

Consider a client that manages to do a mixture of correctly applying a leap second, while also doing time smearing because an upstream source is doing time smearing.

BSD is simply doing the wrong thing here. (My understanding is that BSD time servers are not permitted in the ntp pool because of the problems they cause.)

<comment><USER20> Of course you shouldn't mix servers that handle and ignore the leap second in one pool, so OpenNTPD servers aren't accepted in the ntp.org pool. Doesn't mean you can't run OpenNTPD as an internal server for your machines :)

[http://marc.info/?l=openbsd- misc&m=143544318718489&w=2](http://marc.info/?l=openbsd- misc&m=143544318718489&w=2)

</comment></comment></comment></comment></comment><comment><USER21> And the winner of the battle between NTP (classic) and NTPsec is... chrony

[https://chrony.tuxfamily.org/comparison.html](https://chrony.tuxfamily.org/comparison.html)

<comment><USER8> There's lots of good things chrony does that NTP doesn't and vice versa, but since chrony doesn't support Windows (roughly a third of the server market), I wouldn't claim that it's the clear winner.

<comment><USER22> Doesn't Microsoft have their own NTP implementations for use in the Windows world? IIRC, it's called Windows Time Service and it's included with Active Directory.

At a previous job, we pointed our in-office linux dev systems at our Windows domain controller and never had any issues with time synchronization. Since this was back in this embrace-and-extend days, I was pleasantly surprised by how interoperable MS was when it came to NTP.

<comment><USER8> I support scientific computing, so depending on the application I will replace w32time with ntpd, which offers better accuracy and built-in support for reference clocks.

That said, I didn't realize that the w32time service got a _lot_ better in Windows Server 2016:

[https://technet.microsoft.com/en-us/windows-server- docs/iden...](https://technet.microsoft.com/en-us/windows-server- docs/identity/ad-ds/get-started/windows-time-service/windows-2016-accurate- time)

It looks like Microsoft added support for NTPv4, and w32time now boasts 1-ms accuracy, which is at least a factor of 10 better than the previous Windows Server release.

</comment></comment></comment></comment><comment><USER23> _[...]began working with two of its representatives, Eric S. Raymond[...]_

Usually signals the start of much drama.

</comment><comment><USER24> The presentation mentioned was where I learned of the project. It sounded very very strange to me. Script kiddies who don't what what NTP does, only that it's good for DDoSing? What what that about..?

I wasn't surprised to learn that the project one year later was caught up evaluating Rust vs Go. That's great and all, but it's not saving the Internet from "meltdown".

Anyone who needs a modern ntpd and doesn't need the refclock stuff should probably just go with chrony.

<comment><USER25> > Script kiddies who don't what what NTP does, only that it's good for > DDoSing? What what that about..?

There were several large reflection issues in ntpd in the past few years which led it to become a popular DDoS method. Reflection is the big winner lately.

No need for a botnet, just scan UDP services, find ones which reply with large packets or a series of packets and then spoof your IP (easy from many VPS and dedicated server providers) and flood out requests for those large packets.

You can get amplification of 100x as much traffic with only a small request and it's quite challenging to trace back to the original source due to the spoofed packets.

<comment><USER26> I'll bite. Which large VPS / dedicated server providers don't implement BCP38?

<comment><USER25> I'd rather not name and shame, but suffice to say a quick test with hping shows this is currently working on a number of my servers, some on larger, some on smaller providers. And all it takes is 1.

You definitely have to hunt around if this is something you want and the number does seem smaller than I remember it being so many more are probably implementing it since I last checked, but still not all.

</comment></comment></comment></comment><comment><USER27> What's the status of phk's ntimed? The planned release dates on [http://nwtime.org/projects/ntimed/](http://nwtime.org/projects/ntimed/) were quietly shifted from 2016 to 2017 a few weeks ago, and I'm not seeing much happening at [http://phk.freebsd.dk/time/](http://phk.freebsd.dk/time/) .

<comment><USER28> I expected it will be like that as I've read how PHK wrote about it.

Whoever comes to some big project sees only the small part of it that he immediately understands, and it appears to him as he can do it "much simpler." Yes he can, if he just does that small part. The problem is, the big projects actually do more. If you don't need the big project, you can use the small simple project too. Everybody has fun making something small. Maintaining something big -- that's the hard part, and we see from the article we comment to, it's again what the "saviors" want to avoid:

"[Their plan was] to rescue something, quote unquote, fix it up, and turn it over to a maintenance team."

<comment><USER29> From what I understand of ESR's claims, much of the removed functionality is support for older platforms. Unlike NTP Classic, he asserts POSIX and C99. Apparently, this has drastically reduced complexity/size.

Of course, I haven't worked on the NTP code. But given the described circumstances, I'm willing to entertain the argument that older features now cost more to maintain than they are worth.

<comment><USER28> Sorry, you fully missed the topic here. There was another "liberator" who did his own, "NTP (minus most of it) from the scratch" effort -- PHK, not ESR. See the posts in the thread please, specifically, the one by gpvos for the link.

The problem is, none of these "liberators" actually improves NTP, and none can (by default from their goals) provide a "better" NTP but only a small subset, typically even less tested. And everybody of those gets some funding and a lot of the attention, instead of the real maintainers of the darned NTP.

Doing big, widely present and very compatible and long-lived projects is hard. Very hard. And the maintainers should be helped, not blamed.

<comment><USER30> As an outside observers - and ignoring the whole drama aspect of ESR - you say "very compatible".

Does "very compatible" mean "wider compatibility than POSIX and C99"? If so, that's a very ambitious goal, but is it worth in this age?

<comment><USER28> It's very clear that I don't consider as positive contribution anybody not willing to commit to the support of the big project but who promotes his quasi-solution as discarding the existing feature set and the existing compatibility and then running away.

If somebody complains "the source is not up to the current security standards" that doesn't mean that anything has to be discarded to work towards that goal.

And if somebody wants to make the source compiling _only_ with the most recent compilers and only for the small subset of the previous platforms he obviously has another agenda than improving the security, or actually helping the project. It's just enforcing his taste to the people who never asked for that.

For my personal experience, at my previous work I was able to "just use" NTP, and I know that on these platforms I still can't use any of the alternatives. I admit I surely have another perspective than the average Linux user who doesn't really care what keeps his time in sync as long as it "looks right."

<comment><USER31> Sometimes dropping older platforms is a sane approach. In this case, however, I would expect even MIPS R4000 running IRIX and PPC 603 AIX boxes to still be able to keep their internal clocks in sync the same way my Xeon machines do.

<comment><USER28> Also worth considering "NTPsec has removed lots of stuff that has zero reported bugs in them, like sntp, the ntpsnmd code, and various refclocks."

And reading this comment:

[https://lwn.net/Articles/714279/](https://lwn.net/Articles/714279/)

"in general all the other NTP implementations likewise lack broad support for all the various reference clock hardware and drivers. This is why ntpd is still used so heavily as stratum 1 servers."

And, additionally.. are the servers running Windows a small and obscure base?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> Ugh. Why can't people just act civilized to each other? I can't believe this type of empire building goes on even for projects as auturistic has NTP.

<comment><USER33> There are a large percentage of people for whom power games are more important than getting things done. See narcissism, cluster B, etc.

Those people are toxic, and removing them from your community makes everything better. If you can't do that, ensure that the only topics of discussion are reality based, and focussed on getting things done.

I'm not saying the people here meet those criteria. But it does answer your question.

</comment></comment><comment><USER34> I wonder how much the funding of NTPsec plays into this story? Funding is tied to the need for a project. If a project can claim an exaggerated need, then they can get more funding. So you end up with a conflict of interest when you hear one side's version of of reality.

</comment><comment><USER35> Par for the course for Raymond: make a big noise, little motion, claim credit.

Stenn just gets things done.

disclaimer: have known Stenn since the 90s, Raymond casually since the 80s.

</comment><comment><USER4> Why not get rid of NTP altogether? For servers, they ought to be able to accept a hardware time and frequency inputs. Typically this would mean a 1 Pulse-Per-Second (PPS) signal and a 10 MHz signal. You might also want some kind of serial signal that describes the date and time to label the last second pulse.

Why don't any professional servers come with this kind of connection built-in? Why can't I synchronize my Xeon chip's clock to my own reference frequency?

<comment><USER8> 1-second-per-second is a difficult engineering challenge:

[https://rachelbythebay.com/w/2014/06/14/time/](https://rachelbythebay.com/w/2014/06/14/time/) (associated HN discussion - [https://news.ycombinator.com/item?id=8066915](https://news.ycombinator.com/item?id=8066915))

Here's a choice quote from the NTP FAQ ([http://www.ntp.org/ntpfaq/NTP-s-sw- clocks-quality.htm](http://www.ntp.org/ntpfaq/NTP-s-sw-clocks-quality.htm)):

 _Unfortunately all the common clock hardware is not very accurate. This is simply because the frequency that makes time increase is never exactly right. Even an error of only 0.001% would make a clock be off by almost one second per day. This is also a reason why discussing clock problems uses very fine measures: One PPM (Part Per Million) is 0.0001% (1E-6)._

And if you want to delve into the physics, you'll enjoy this tutorial by John Vig (U.S. Army Communications-Electronics Command):

[http://www.am1.us/Local_Papers/U11625%20VIG- TUTORIAL.pdf](http://www.am1.us/Local_Papers/U11625%20VIG-TUTORIAL.pdf)

<comment><USER4> That might have been true awhile ago, but today you can get GPS-disciplined oscillators that can produce 1 PPS accurate down to tens of nanoseconds. By accurate, I mean "replicates what the NIST or USNO atomic clocks indicate."

</comment></comment></comment><comment><USER36> I read through some of the blog posts related to language choice for NTPSec (helpfully provided in LWN comments).

[https://blog.ntpsec.org/](https://blog.ntpsec.org/)

I can't help but wonder if there are other options, most notably C++. Don't get me wrong, I have a well developed loathing of C++ based on past experience, but it seems like a category fit and people I respect have said good things about the latest versions. Nim would also seem like a pretty good fit technically, though I could well understand if its relative immaturity and lack of developers (another recent story here on HN) cause it to be deemed inappropriate for this situation.

</comment><comment><USER37> " _[Sons] has since become president of ICEI; she described herself in the presentation as having "moved on" and is no longer involved with NTPsec on a daily basis._"

" _Already, where once only Stenn was looking for support, now Raymond is in a somewhat similar position, as NTPsec has lost its Core Infrastructure Initiative funding as of September 2016._ "

So, a drive-by fork.

BTW, had anyone used any project that ESR is heavily involved in? The only things I know about are NTPsec, fetchmail and his attempt to hack the Linux kernel build system.

<comment><USER38> According to ESR, if you use a mobile phone, you're using his code (I assume this to refer to gpsd).

<comment><USER37> " _GPSD is everywhere in mobile embedded systems. It underlies the map service on Android_ [4.0 and after?] _phones. It 's ubiquitous in drones, robot submarines, and driverless cars. It's increasingly common in recent generations of manned aircraft, marine navigation systems, and military vehicles._"

Interesting, thanks.

</comment></comment></comment><comment><USER39> why was the buildsystem changed to waf? ugghh. ntpsec wants to lower barriers to entry just use/update autotools.

<comment><USER40> I have no experience with waf, but I have some with autotools, and 'barrier to entry' is a good description of autotools. Also 'barrier to progress,' 'barrier to happiness' and 'barrier to sanity.'

<comment><USER41> CMake is the usual choice of developers who don't want to deal with autotools these days. Making people learn yet another build system is not going to be popular.</comment></comment></comment>


Tackling Creative Roadblocks - <AUTHOR> http://4ormat.com/ecr/tackling-creative-roadblocks

<comment><USER2> If I could add something to this list, it would be to stop judging people (sounds religious) because everyone is different. Hence, surrounding yourself with different people makes you realize new markets, and helps you come up with different ideas. Most people have a simple side to them so identify it, and mass produce their simple solutions in a concrete fashion.

Smiling usually helps in the initial introduction to meeting different people :)

</comment><comment><USER3> Great reminder that the "inability to start starting" is often caused by indecision and the anxiety of picking the right path, i.e. Fear, Uncertainty, and Dread. Great post.

</comment><comment><USER4> Lesson learned - work naked, be productive. Words to live by.</comment>


Ray Kurzweil Law of Accelerating Returns - <AUTHOR> http://www.businessinsider.com/ray-kurzweil-law-of-accelerating-returns-2015-5 <comment><USER2> Kurzweil's argument is that the acceleration of the acceleration is increasing ..there is a math proof of this somewhere, but can;t find it</comment>


If we lived in a Bitcoin future, how big would the blockchain have to be? - <AUTHOR> https://hackernoon.com/if-we-lived-in-a-bitcoin-future-how-big-would-the-blockchain-have-to-be-bd07b282416f?source=rss----3a8144eabfe3---4 <comment><USER2> The author is commenting over in [https://www.reddit.com/r/Bitcoin/comments/7hrqbe/i_wrote_a_p...](https://www.reddit.com/r/Bitcoin/comments/7hrqbe/i_wrote_a_piece_visualizing_how_big_the/)

</comment><comment><USER3> It's an interesting read, and the author links to more information on changes that can keep the cost down in the future. But my one quibble is that they also wrote

"There are also some holes in my napkin math. For example, by the time Bitcoin reaches this level of adoption, the cost of technology will probably have dropped and won't be as insane as I previously outlined"

Probably??? Is the author expecting Moores law to end today?</comment>


Federal officials take down 132 websites in 'Cyber Monday' crackdown - <AUTHOR> http://thehill.com/blogs/hillicon-valley/technology/269333-feds-take-down-132-websites-in-cyber-monday-crackdown

<comment><USER2> _As part of the operation, federal law enforcement officers made undercover purchases of products such as sports jerseys, DVD players, clothing and jewelry from websites suspected of selling counterfeit products. If the copyright holders confirmed that the products were unauthorized, ICE obtained a court order to shut down the sites._

I am confused due to the way this is worded. Does this mean that sites selling second-hand, authentic goods (not counterfeit) could be taken down if the copyright-holder did not "authorize" the site to sell their goods?

<comment><USER3> If they were selling them as "new", sure.

<comment><USER4> Can the MPAA stop someone from selling a sealed DVD as "New" then if they bought it from Best Buy first?

<comment><USER5> In the US, they probably can't. If the DVD is imported, they almost certainly can.

[http://en.wikipedia.org/wiki/Omega_S.A._v._Costco_Wholesale_...](http://en.wikipedia.org/wiki/Omega_S.A._v._Costco_Wholesale_Corp).

Omega was able to successfully prevent Costco from selling genuine, certified authentic Omega watches intended for different foreign markets as "new Omega watches" in the US.

So yes, if you bought a sealed DVD from a Russian Best Buy equivalent (ignoring the region coding issues) and sold it in the US, you'd probably be in trouble.

</comment></comment></comment></comment><comment><USER6> Why not take down eBay then? I'm sure officers could easily fulfil the same criteria of being able to buy "counterfeit" goods from there. Amazon too no doubt. Letting authorities get away with this sort of shoot-first approach is a very slippery slope. The Dot Com debacle is simply a bigger version.

Sure - these may be bad actors, but we don't really know that do we. Where is the due process? Where is the investigation uncovering a warehouse full of goods? Can any of us trust our business to a .com domain name any more?

<comment><USER7> eBay has its own takedown process and follows US law because they are US- based. They only seize domains for sites that are outside the US (but their domains are registered in the US) and do not respect US laws. There are still huge due-process concerns, though.

<comment><USER6> eBay has plenty of foreign sellers, but yes, they work with the authorities, not against them. So, I have to say, did MegaUpload and Kim DotCom. What's a foreign business to do?

The underlying issue is that a .com domain name is no longer safe, and I suspect the new top level domains will be in the same bucket.

</comment></comment></comment><comment><USER8> Once seized, they generally point them at the server at 188.8.131.52 which hosts their seized image. Thus using a simple reverse IP lookup we can see a list of all seized domains: <http://viewdns.info/reverseip/?host=22.214.171.124>

<comment><USER9> wow that's pretty cool. Looks like everything from that list was in November. Also looks like the majority of the sites were selling prescription drugs.

<comment><USER10> those dates do not reflect when a site was initially seized. For instance, Filespump.com was seized in 2012 and lulzsec.com was seized in March. Both say November according to this list.

<comment><USER8> Dates are when the domain was last checked by the site.

</comment></comment></comment></comment><comment><USER11> What about those folks who bought from these sites in the preceding days and weeks before this action was taken? Shouldn't sites be taken down as found, instead of waiting for a "special" day, if they allegedly violate laws.

<comment><USER12> They know full well that these take-downs are nothing but token gestures. That means two things: 1) theatrics are emphasized. Taking them all down at once is more theatrical. 2) If they take down sites weeks before a major shopping holiday, they will be back _well_ before the holiday hits. They are doing the equivalent of spritzing febreeze around the apartment right before people come over to visit.

<comment><USER13> I'm not sure how valid your argument is. Christmas is almost a month away, and that's plenty of time for these websites to spring back up.

<comment><USER12> Well I suspect the idea is most people buy things before Christmas, not during. The perception seems to be that the single largest online shopping day in the "before Christmas" season is this "Cyber Monday".

Maybe the most active shopping day is the second Tuesday of December, or something else relatively obscure, but since theatrics are valued it would still make sense to hit on the day most people think of as "the big day".

</comment></comment></comment></comment><comment><USER14> > It is the third straight year that the government has seized websites on > "Cyber Monday"...

Did not know this.

> ICE's _Homeland Security_ Investigations unit coordinated with officials > from Belgium, Denmark, France, Romania, the United Kingdom and the European > Police Office to take down the sites.

A great example of mission creep. Counterfeit goods have nothing to do with terrorism.

<comment><USER15> ICE stands for Immigration and Customs Enforcement.

<comment><USER16> Still mission creep, though.

<comment><USER17> Counterfeiting has always been part of ICE's mission and the "homeland security" dig is a cheap shot, since ICE got absorbed into DHS; it wasn't an effort spun up by homeland security.

<comment><USER18> ICE is a merger of the former INS and Customs. Prior to DHS Customs had nothing to do with immigration, and that job is now split between ICE and CIS for reasons that don't seem apparent.

</comment></comment></comment></comment></comment><comment><USER19> Be nice if they could pay a bit more attention to the things that matter to the little people, like fraud and spam.

</comment><comment><USER20> If they have the ability to do this, then what would SOPA have bought them?

</comment><comment><USER21> Do the websites allegedly selling counterfeit products have any way to defend themselves? Or does the copyright holder just say, this is mine and they get shut down without any verification.

<comment><USER7> They can sue to get the domain back, but it's usually not worth it. Or if you're lucky they'll give the domain back after a year: <http://www.techdirt.com/blog/?company=dajaz1>

</comment></comment><comment><USER22> Whatever happened to innocence until proven guilty?

<comment><USER18> Doesn't apply at the border

</comment></comment><comment><USER23> Not sure what they achieved. Tomorrow the same people will register another 132 domain names and continue operating as usual.

<comment><USER24> But they're down today, on the (if you believe the hype) biggest online shopping day of the year.

<comment><USER21> It's like busting the drug dealer on the corner. Taking down small level offenders, doesn't solve the problem.</comment></comment></comment>


Owing Graph Minimization - <AUTHOR> http://anthony-zhang.me/blog/owing-graph/index.html

<comment><USER2> I'm confused. The article seems to require that people pay whoever they owe, as opposed to whoever is owed money. It seems we can simply sort the people by the amount owed, then have the person at the top of that list pay the person at the bottom, and repeat until all debt is resolved. This is an nlog(n) algorithm (for the sorting), and creates at most n edges (since, for every transaction, someone either pays back everything they owe, or someone gets paid everything they are owed).

Is there something I'm missing?

<comment><USER3> > The article seems to require that people pay whoever they owe, as opposed to > whoever is owed money. It seems we can simply sort the people by the amount > owed, then have the person at the top of that list pay the person at the > bottom, and repeat until all debt is resolved.

You could, but that's a solution to a different problem, not a different solution to the same problem. (Which is the _right_ problem to solve is a social/customer/domain issue, rather than a technical one.)

<comment><USER2> How is it different? By the definition of equivalent in the article:

> when everyone in either graph pays the amounts they owe everyone else, they > end up with the same amounts in the end.

It seems my algorithm also accomplishes that goal. I'm not sure that my algorithm is optimal, but I do think it's a good approximation and is somewhat simpler than the approximation in the article.

<comment><USER3> > How is it different?

On review of the problem statement, it does appear that you are solving the problem they say they are solving, which appears to lack some of the constraints that seem to apply to the problem they are _actually_ solving. (I suspect that the _intent_ here was to show something about graph algorithms and so the problem statement is just insufficiently constrained, but its possible that the stated problem really is the interesting problem, and that the solution is unintentionally overconstrained because someone thought of a too-clever graph algorithm.)

</comment></comment></comment></comment><comment><USER4> The output list makes the tuples different than the input... there is no way that john suddenly owes beryl 25 for example.

I don't see an explanation for this in the text - but a directed edge seems to switch from a semantic of "owes" to "is owed".

</comment><comment><USER5> Another way to think of this problem is find a feasible flow in a complete graph that satisfy all vertex demands and using minimum number of edges.</comment>


Ask HN: Apache Kafka applications to study? - <AUTHOR> I'm building an application using Apache Kafka, please suggest some open source application which I can study to understand how they use Apache Kafka. <comment><USER2> [https://github.com/Graylog2/graylog2-server](https://github.com/Graylog2/graylog2-server)

I've never used Kafka, I just went to [https://kafka.apache.org/powered- by](https://kafka.apache.org/powered-by) and searched for 'open source'. Another source is to search for the topic on github [https://github.com/search?utf8=%E2%9C%93&q=topic%3Akafka&typ...](https://github.com/search?utf8=%E2%9C%93&q=topic%3Akafka&type=Repositories)</comment>