Security Testing Challenge - <AUTHOR> Computer Simulation of Information Security Testing Challenge <comment><AUTHOR> Computer Simulation of Information Security Testing Challenge

Introductions:

Computer simulation of information security testing is an invitation challenge and host by China Security Operations Computer. The challenge is to test the computer information security in our computer product. China security operations computer has double mainframe computer with two operation systems. The extranet MAC address is 0C-5B-8F-27-9A-64, and the intranet MAC address is 9C-54-CA-96-8F-71. Also, the extranet is on and connect internet. All of mainframes use Microsoft windows 7 profession operation system. All of IP addresses are dynamic. Double mainframe computer set up web server during the match and binding fixed domain name www.zssoc.com. The IP address of the web server is the host's IP address.

How to challenge: (Rules and Format)

First, challengers can sign up at website: zssoc.com

Second, challengers can invade the extranet.

Third, challengers continued invade the intranet.

Finally, challengers must put the personal information in challenge folder of D disk.

In addition, challengers has to get all hacking records with screenshot and send all screenshots to email:email@example.com

The challenge has several parts in different time. And each part has one winner due to the time of sending email order. After the first part, every part will be more difficult than previous part. When each part finished, the mainframe will fix the bug and start on a new part.

Comments :( Important)

1\. After challengers' successes invade the intranet and put the personal information or resume into D disk, challengers has to send the email to china security operations computer. Email address: email@example.com

2\. Challengers must keep the way of hacking and do not public on internet and do not use other successful ways.

3\. Challengers can use any hacking technical way to hack into computer and get the information.

4\. During the challenge match, china security operation computer will maintain the mainframe.

5\. Double mainframe computers used to match the domain name binding constant dynamic change the setting of the IP address on a regular basis, so the challengers every time try to invade it need to login to this site first analyze the actual IP address before you can determine the current network address. Challenger can log on to www.zssoc.com or zssoc.com at any time to view the rules of the invading match and resolution in the host IP of the website (www.zssoc.com) tries to challenge it.

6\. All rights reserved.

Prizes:

Challenge winning: RMB ¥5000(Chinese currency) and certificate of honor</comment>


Ask HN: Submitted startup looking for feedback - <AUTHOR>

Hey guys. We've just submitted (as some of you here) the last edition of our YC application form. On quarket.com you'll find a demo video describing our project. Any opinions, advice, questions are welcome. <comment><USER2> Clickable: <http://quarket.com/>

OK, some feedback - this will sound harsh, but it's how it happened ...

I can't understand the first 10 seconds of speech because I haven't yet got used to the accent and tone. Then it's 52 seconds before I get any clue as to what it's about. I nearly gave up at 40 seconds.

Then at 1:05 it looks like things I know, and it's 1:12 before you say that it's not something I know, it's different, and I _still_ don't know what it's doing.

For someone who's looking to invest, maybe they'll sit through it, but for me, I'm out. Probably it's cool and useful and interesting, but I've got other things to do.

Finally, you might want to resubmit, putting the URL in the URL field, your request for feedback in the title, and then expand on your reasons and request in a comment. Then two things happen. Firstly, it's automatically clickable.

Secondly, you don't get penalized in the rankings for not submitting a URL.

</comment><comment><USER3> Two minutes into the video I lost interest and moved along. The entire first minute can just be cut. A lot of the video looks like a test script on your site vs a demo - do I really need to see you enter your CC#? I also don't need to be told what a picture or a description are. Why not just completely cut all that and just run the demo while explaining to me why I don't just search google maps on my android phone?

</comment><comment><USER4> I would probably only use this application if I was traveling to some place where I am not familiar with the surroundings. I don't live in a metro area either so I know everything in town already. If you could clean up and simplify how I order food/movie tickets into one screen, I might be interested in checking this app out again.</comment>


Will Google release Google branded phone this year? - <AUTHOR> http://www.blubet.com/bet/Will_Google_release_Google_branded_phone_this_year Google and Samsung are rumored to be building the phone, codenamed "Switch," Simeonov says and his posting includes what he claims is a leaked photo of the device.I say Google is just helping Samsung with Samsung product and they won't be labeled Google. What do you guys think?

<comment><AUTHOR> Google and Samsung are rumored to be building the phone, codenamed "Switch," Simeonov says and his posting includes what he claims is a leaked photo of the device.</comment>


Blue Origin successfully lands both booster and crew capsule after test launch - <AUTHOR> https://techcrunch.com/2018/07/18/blue-origin-successfully-lands-both-booster-and-crew-capsule-after-test-launch/ <comment><USER2> I really appreciate Blue Origin's methodical approach to building this system. I note that they are closer to being operational than Virgin Galactic who I consider their primary competitor.

The challenge I have with the 'suborbital tourist' economy is that while some folks will pay $200K per ride for less than 3 minutes of zero gravity, one has to compare that to the Zero Gravity Corp which gives you over 6 minutes of weightlessness (in 20 - 30 second increments) for $5K[1]

Sure there is the 'Concorde' effect where the very wealthy will all do it once so that they won't feel left out at cocktail parties but that does not seem sustainable.

My hope is that Blue Origin's plans to move into orbital flights is successful. Spending $200K to spend nearly 90 minutes (1 orbit) weightless has much more appeal.

[1] [https://www.gozerog.com/index.cfm?fuseaction=reservations.we...](https://www.gozerog.com/index.cfm?fuseaction=reservations.welcome)

<comment><USER3> Agreed. Let's say if I earned $200K/yr, and was close to "retirement". I'd consider working an extra year to take a 90 min orbit in space. I would not make that same decision for a 3 min joy ride.

<comment><USER2> Just noodling about the economics, 7 passengers at $200K each is $1.4M gross revenue. So assuming very low earth orbit (basically you just need to be above enough of the atmosphere that you won't re-enter before the end of your first orbit) that is still a very low cost for a Falcon9 launch given that the second stage is not recovered. So you need to recover both stages operationally "close" to where they lifted off so that you minimize refurbishment/transport costs.

I'm guessing that would be that the second stage provides retropulsion to get you back to nominal zero velocity over the return point.

So that would be launch, booster returns to the pad, and the second stage pushes you up enough to insure an orbit, then your orient for return. Enjoy the view etc, and then the second stage relights to cancel your velocity to 0 as you arrive over the launch facility (you'll have to scoot 1000 miles or so east as well given planetary rotation) and then separate for a parachute landing of perhaps both the capsule and the second stage booster.

Sounds pretty complex. But you would have to recover _all_ equipment if you wanted to have a chance as meeting the economics of that.

<comment><USER4> > Enjoy the view etc, and then the second stage relights to cancel your > velocity to 0

That is not feasible. Your second stage would have to be roughly as large as an entire orbital rocket in order to slow itself down from orbital speeds to zero, which means your first stage would have to be massive in order to push the second stage into orbit.

The reason every vehicle that re-enters the atmosphere uses a heat shield is because it's way easier to carry a relatively light heat shield that sheds off the speed than to carry the massive amount of fuel to shed off the same speed.

See [https://what-if.xkcd.com/58/](https://what-if.xkcd.com/58/)

<comment><USER5> If instead of a circular orbit you just went for an arc with a really high apoapsis you could probably burn a little fuel to reduce the forward momentum to zero, and then proceed to slowly plummet back to earth... which then means you need a really big heat shield as that gravitational potential energy turns back into kinetic and you smack into the atmosphere at a ridiculous velocity. Scratch that, too much Kerbal.

<comment><USER6> a tall suborbital parabola that falls back into the atmosphere at an 85 degree angle is basically the same re-entry heat as if you were to do what you described, fly the parabola, and thrust retrograde at apoapsis to cancel out the downrange velocity, then fall into the atmosphere dead vertical.

It's horizontal velocity (actual LEO velocity) that causes the heating effects a Soyuz or Dragon type capsule needs to survive with heat shield on re-entry.

</comment></comment></comment></comment></comment></comment><comment><USER7> The article glosses over what kind of rocket this is, so it's worth pointing out that New Shepherd is a suborbital booster. You can't launch satellites with it, only go up and fall back down.

Still cool though!

ADDENDUM - if you want to keep an eye on other projects, their reusable orbital booster is New Glenn. IIRC it's higher capacity than Falcon 9, maybe more toward Falcon Heavy. Last I heard they're shooting for a first test launch in 2020.

[https://en.wikipedia.org/wiki/New_Glenn](https://en.wikipedia.org/wiki/New_Glenn)

<comment><USER8> So basically, it's a very very expensive 10 minute amusement park ride with 10G's and a lot of danger? :-)

<comment><USER9> And a lot of pollution.

<comment><USER10> Get that deadly dihydrogen monoxide out of my atmosphere!

<comment><USER11> Well, let's not forget that water vapor is a greenhouse gas[0] though not quite as serious as others since it will condense out in clouds and increase albedo.

[0] [https://www.ncdc.noaa.gov/monitoring- references/faq/greenhou...](https://www.ncdc.noaa.gov/monitoring- references/faq/greenhouse-gases.php?section=watervapor)

<comment><USER12> what's the atmospheric half life of high altitude water vapor?

</comment></comment></comment></comment></comment></comment><comment><USER13> Note that this flight tested an in-space abort, firing the crew capsule's solid motor to simulate an emergency escape from the booster.

Because the abort took place after MECO, the capsule reached an apogee of 118.8km. This will likely stand as New Shepard's altitude record.

Blue Origin previously tested a transonic abort and (unexpectedly) recovered the booster. Recovery did not appear to be in question this time.

<comment><USER14> More like "in high altitude, low air pressure environment abort". This thing will never go to space. It's not designed for that.

<comment><USER13> This is false. Space begins at 100km, the Karman line. New Shepard's typical apogee is about 107km, while this flight reached nearly 119km.

[https://en.wikipedia.org/wiki/Kármán_line](https://en.wikipedia.org/wiki/Kármán_line)

</comment></comment></comment><comment><USER15> Interesting that they stated a passenger would have experienced a peak of 10 Gs, that seems excessively high for tourism. The space shuttle launches were around 3 Gs and Soyuz rockets around 4 Gs.

[https://space.stackexchange.com/a/7857](https://space.stackexchange.com/a/7857)

<comment><USER16> That's 10G during an abort motor firing. Shuttle didn't have those in the first place, and Soyuz's abort motors produced ~18G iirc.

<comment><USER17> Fuck it. Deleted.

<comment><USER18> You are being downvoted because you tried to introduce a _" does anyone else think Soviets were nasty evil people?"_ rhetoric into what was previously a technical discussion.

<comment><USER19> Also, the gp commenter seems to misunderstand what 18g would do to somebody. For an extended span of time, that's a death sentence. For just a moment, it's likely going to knock you out, but it's survivable by healthy people and it's far better than being in a rocket explosion.

</comment></comment></comment></comment></comment><comment><USER20> Completely irrelevant, but boy are those blue origin rockets ugly.

<comment><USER21> I read it somewhere that Elon Musk was since the beginning very demanding of aesthetics, in his rockets as well as cars. This has resulted in some beautiful looking rockets and cars.

Having said that I believe it's primary for rockets to be safe and efficient rather than beautiful.

<comment><USER22> That's turned out well for his rockets, but man are most (except the S) of his cars ugly.

<comment><USER23> Roadster too?

<comment><USER22> In my opinion, especially the roadster. Easily the ugliest sports car since the fox body mustang. Right up there with the MR-S.

Edit: The 1st Gen roadster. I'll reserve judgement on the second gen until it's released, but it looks a lot like the new NSX in photos. And the new NSX looked great until we saw them in real life and they turned out to be possibly the worst supercar of the 21st century.

<comment><USER24> 1st gen roadster isn't really a Tesla design, that's just a Lotus Elise body.

<comment><USER22> I mean, it is a Tesla design in-as-much as I really like the Lotus Elise and really dislike the Tesla. They specifically restyled the Elise horribly. Probably at the request of Lotus, but it's certainly a design failure imo. You're right though, they did start from a Lotus Elise.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> I stopped listening when they said "curve of the Earth"

</comment><comment><USER26> The difference between suborbital spaceflight and orbital spaceflight is like the difference between reading a book about Antarctica and going to Antarctica.

<comment><USER27> The temperature difference.

<comment><USER28> This was probably the most pragmatic transaction i've seen all week.

</comment></comment></comment><comment><USER29> Is it me or the capsule didn't land where it supposed to be? from the video looks like there was a spot for it.

Also, landing at 16mph seems a little rough? I guess the capsule is not reused?

<comment><USER30> The rocket & capsule are designed to be fully reusable.

Retro rockets fire just before landing. This is the main cause of the dust cloud that kicks up around the capsule.

Various sources on the web put the touchdown speed at 1-3 mph.

Edit: the 3mph comes from a test where they disabled 1/3 of the parachutes [1]:

 _Similar flights had been done with the same craft three times before, but this time around, one of the capsule's parachutes was disabled. Bezos said the two parachutes slowed the descent to 23 mph, as opposed to the usual 16 mph with three parachutes._

 _Just before the touchdown, the capsule's retro rocket system fired. Bezos said that brought the speed at impact down to 3 mph. The capsule was equipped with a ring of crushable bumpers on its bottom to absorb that remaining force._

[1] [https://www.geekwire.com/2016/jeff-bezos-blue-origin-test- ch...](https://www.geekwire.com/2016/jeff-bezos-blue-origin-test-chute/)

<comment><USER31> Thanks. Looks like no retro rockets on the capsule this time around to me. Wonder what the underside looks like now.

<comment><USER32> Looks the same as previous landings -- a big puff of dust. Normally everyone's showing up to claim that it looked like a hard landing, but the dust is kicked up by the retrorockets that make the landing soft.

</comment></comment></comment></comment><comment><USER14> Straight up... straight down. No orbit. Nothing to see other than "tourist" flights for people who want to see what space is like but without weightlessness.

<comment><USER33> Will it be a profitable business?

You could bootstrap the future of space flight simply by starting with a small profitable company.

<comment><USER34> It hasn't exactly worked out for XCOR or Virgin Galactic, what will Blue Origin's edge be?

<comment><USER33> XCOR filed for bankruptcy. That's not profitable.

Virgin Galactic isn't a profitable company either. They could be, of course.

My point was that you can start with a small company with a well-defined goal and product then continue to grow the vision, as long as you remain profitable.

<comment><USER34> Yeah I don't disagree here, my point was that Blue Origin's particular goal and product bootstrapping from space tourism has already been tried and more or less failed. Whereas Musk's/SpaceX's goal is to get a Mars colony going, they started with something different than space tourism and it seems to be working out.

<comment><USER33> Virgin Galactic hasn't failed yet. Someone was killed so they've been extremely cautious.

Bezos is a good business person. It's quite possible he'll run thin margins and grow the business.

</comment></comment></comment></comment></comment></comment><comment><USER35> Seems like SpaceX is a light year beyond these guys. Do they just get coverage because they're a private space corp?

<comment><USER36> SpaceX _is_ light years beyond what they are doing right now.

\-- _but_ \--

Jeff Bezos has said he plans on spending $1 Billion/year on blue origin.

Unlike SpaceX, they don't need to actually worry about money.

To put in perspective how much money Jeff Bezos has (and he is somebody who really want to do space travel): he could privately fund a manned mission to mars _and still remain the richest man in the world_.

It's just incomprehensible the resources that they have there. Blue O will almost definitely catch SpaceX.

<comment><USER37> He might as well spend $10B a year, results will be the same. Time is money, but money isn't time.

<comment><USER22> Bezos frequently speaks about efficiency of deploying capital. My guess is he doesn't believe he would get 10x results from 10x investment.

<comment><USER38> I'm sure that there is _some_ speedup when he starts spending more than $1 billion. Given that his net worth reached $150 billion it seems like it's safe to go to $2 billion/year without running out of money during his lifetime.

</comment></comment></comment></comment></comment><comment><USER39> It's been said before, but it bears repeating: Bezos and Musk are literal Bond-villains -- freaky looking billionaires building ICBMs under our very noses -- and no one is doing anything about it.

Where is the gadget-laden, womanizing secret agent who will save us?

</comment><comment><USER40> SpaceX has been a phenomenal force in space flight, but their whole philosophy has been to move fast and break things. And consumers have gotten to watch crash after crash and explosion after explosion.

Bezos is making the bet that the average person is to trust their luggage but not their life on SpaceX. If they take their time and get it right, there are huge second mover advantages here.

<comment><USER13> This comment does not deserve to be downvoted so far. SpaceX's policy is _absolutely_ to move fast and iterate constantly instead of relying on hardware 'legacy' and keeping designs static. This is a stark break from the way traditional space companies do things, and both sides have recognized that it has caused some friction with NASA as it adjusts to SpaceX's way of doing things.

Dan Rasky's (excellent) oral history videos[0] of his time as NASA's liaison to SpaceX for technology transfer under the COTS program touches on this, as does SpaceX president Gwynne Shotwell's oral history.[1]

Blue Origin's motto, on the other hand, is _Gradatim Ferociter_ : Step by Step, Ferociously. They are known for moving slowly and surely.

[0] [https://www.youtube.com/watch?v=SMLDAgDNOhk](https://www.youtube.com/watch?v=SMLDAgDNOhk)

[1] [https://www.jsc.nasa.gov/history/oral_histories/C3PO/Shotwel...](https://www.jsc.nasa.gov/history/oral_histories/C3PO/ShotwellGE/ShotwellGE_1-15-13.htm)

<comment><USER41> > consumers have gotten to watch crash after crash and explosion after > explosion.

No, it definitely deserves to be downvoted.

<comment><USER13> It's a valid point. Even though we informed spaceflight observers know that these explosions were experimental (and would've happened anyway, more violently even, when boosters were expended), the average member of the public may not be familiar with the nuances of booster recovery.

It's plausible that it could become a PR issue.

<comment><USER42> People watching videos on Youtube are not SpaceX consumer/customer. Or am I missing something?

Here is a full SpaceX manifest both past and future: [https://www.reddit.com/r/SpaceX/wiki/launches/manifest](https://www.reddit.com/r/SpaceX/wiki/launches/manifest)

As it stands right now, they are most likely the largest rocket company right now (or at least the top 2), they seem to be adding more order every other month. Not a sign of their customer base losing confidence in them.

<comment><USER13> This is true, of course, but I think the grandparent is talking about the far future. Eventually, if Musk's and/or Bezos' visions are to be realized, the average person will be a consumer — whether for space tourism, earth-to-earth transit, industry, or colonization.</comment></comment></comment></comment></comment></comment>


I Can Crack Your App With Just A Shell (And How To Stop Me) - <AUTHOR> http://kswizz.com/post/2785664228/hacking-mac-apps <comment><USER2> The most stealth cracking countermeasure I ever witnessed was the application would XOR some of its UI messages with the hash sig of the application binary file, so if you edited the application binary file directly the crack seemed to work just fine ... but then the application would gradually go insane. The cracker who finally posted a working crack was impressed with how simple and devious the countermeasures were.

<comment><USER3> Brilliant, but be careful about this. There was an article here years ago about an indie game developer who put tons of different piracy checks all throughout his game. He was pretty clever, and made it so that several didn't activate until partway through the levels — that way the crackers might miss them. Also, he didn't show any "pirated copy detected!" messages, which would have made the checks trivial to find. Instead, the application would simply crash with a cryptic error message.

It worked perfectly — the crackers missed the later checks. Anyone who torrented the game found that it crashed reliably as soon as you completed the first level. Game over.

Unfortunately, this did not generate the kind of PR he was hoping for. In fact, all this did was give the impression to everyone who pirated the game that it was a buggy piece of shit. Since there was no obvious reason for the odd behavior, they assumed it was the fault of the application. They stormed the gaming review forums and discussion boards, complaining about how the game was "shitty" and "unplayable". Nobody was keen to mention that they had pirated it, so there wasn't an obvious trend. At the time, the ratio of pirated video games to legal ones was about 10:1, so the bad feedback overpowered the good feedback by about 10:1. He was ruined.

Be careful about anti-piracy. You just might succeed.

<comment><USER4> I mentioned this game in another comment on this page, but Spyro: Year of the Dragon used this technique and it worked very well for them. It could be that this is because it was on a console and not on the PC, but who knows. The goal for them was to simply keep the crackers at bay for as long as possible to keep the sales high during the initial release of the game. The developers stated that once the game is cracked the sales drop dramatically, so the longer they can keep the game uncracked the more money they made.

Great article from the developers about this: [http://www.gamasutra.com/view/feature/3030/keeping_the_pirat...](http://www.gamasutra.com/view/feature/3030/keeping_the_pirates_at_bay.php)

<comment><USER5> I remember playing Spyro, good memories. I think there's a new one out, maybe I'll check it out for old time sake. Thanks for the positive nostalgia

</comment></comment></comment></comment><comment><USER6> The fact that most simple copy protection can be broken by someone that knows a bit of assembly shouldn't surprise anyone writing applications, and this post is just self-congratulatory silliness that doesn't actually help someone that wants to protect their software.

It wouldn't be any more responsible/ethical/useful of me to post a "I Can Crack Your Non-Mac App With Just A Copy Of IDA Pro and HexRays" tutorial. I could show you how I can press 'F5' and decompile your code back to surprisingly readable pseudo-C, but that's not going to help you secure your application, it's just patting myself on the back and showing you how cool I am.

On top of that, the author is _still_ flogging the PT_DENY_ATTACH horse, despite the fact that it's been documented over, and over, and over again as trivial to bypass. PT_DENY_ATTACH was added to meet the minimal contractual requirements Apple had to movie studios and record companies by preventing users from attaching a debugger to DVD Player and iTunes. It's not a real security solution. There's a simple open source kext (that was first implemented for Mac OS X 10.3!) that simply disables it across the board:

<https://github.com/dwalters/pt_deny_attach>

<comment><USER7>
      The fact that most simple copy protection can be broken by
      someone that knows a bit of assembly shouldn't surprise
      anyone writing applications,

But it does, which is the point of the author.

      this post is just self-congratulatory silliness

You know, some people just like to write up something they did that they think is pretty interesting. People will keep inventing the wheel over and over again and still be proud of their wheel. This kind of derogatory remarks are uncalled for. You have no idea about the thoughts or feelings of the author and have no reason to think ugly things.

If I were to respond to your comment in the same way, I would say that you were just displaying your superiority complex over someone learning the ropes. Or perhaps bitterness and jealousy over the attention this article gets, while your more advanced knowledge does not get the attention it deserves. Or ... whatever. I can come up with a number of epithets to attribute to you based on that little bit of text, all equally uncalled for.

</comment></comment><comment><USER8> Hey SeoxyS,

Another fan of your writings. I like the occasional quote you throw in there. However:

I don't agree with the way you phrased your headings. Verging on linkbait, even.

RCE is a hobby of mine and I crack all sorts of shit; it's fun and challenging. I know quite a few people who do.

This is the first time I have read such a blunt "I can crack your..."/"How to stop me" approach. It sounded very arrogant at first. No one else that I know bothers with this direct attitude. I am sure Mac devs are more than aware (Anticipating an article on this as a followup to your post).

"[...] but implementing a bare minimum of security will weed out 99% of amateurs. [...]"

I am not sure where you pulled that number from but it's false. RCE is not as difficult as you make it out to be, and amateurs can overcome the usual barriers quickly. Communities thrive on teaching amateurs the art, and they pick up these skills very quickly. I taught a few.

</comment><comment><USER9> The great danger in the fight against piracy is that it's so damn _interesting_. You can spend months playing cat and mouse with the people trying to crack your schemes, ratcheting up the complexity to insane levels, and every time you come up with a new scheme and get it working you'll feel like a million bucks because you Won(tm).

But the people on the other side feel the same way, there are more of them, and in reality, they're not actually hurting your business as badly as your delusions tell you they are - none of them were ever going to buy your shit anyway.

Add features, improve your design, fix bugs, or tweak your shitty description and screen shots in the app store (which, in my experience, will affect sales for most apps more than the first three factors put together). Literally any time that you devote to copy protection is wasted, unless you're Angry Birds (and even then I'm not sure) you're not reaching anywhere _near_ a high enough percentage of the people that would happily pay for your product to worry about the ones that would rather just take it.

<comment><USER10> I agree. The arms race of building 'better' copy protections instead of continous improvement of your product won't do you any good. I think the main key is deciding on the investment. The amount of time put into those things can be expressed in money. So this poses two questions: 1\. Would I be willing to pay the given amount to someone else to do it. If not and I still want to do it I should at least admit that this is for personal ambition and not for the product. It's OK everybody likes a challenge. 2\. Will it improve my sales? Again the money. What stands to gain from this. How much effort is OK. Perhaps the simple checksum in addition to the common cmp jne check is enough to get a few sales. But that's about it for products with a market where uncracked time is not king. Look somewhere above for the gamasutra article about game releases and the value of time. And I think the time constraint doesn't work for many products.

The idea for one of my projects was to say "if you are able to crack it you can keep it". If someone spent the time and has the ability to do it, it's fine with me. Surely this is no viable solution for most products. But I'm curious how it will work out...

</comment></comment><comment><USER11> The App Store doesn't need high levels of security on your apps. No matter how much you obfuscate, it only takes one smart person to crack it and then your app is on all the bit torrent sites.

People will buy from the App Store because they want the protection it provides and the convenience. They know when they download your app from the app store that it's not a virus, the install will be one click simple, and Apple has hand reviewed and approved the app.

I think the Mac App Store protection is designed to be just enough to stop Average Joe from copying it onto a usb stick and giving it to his friend. In the end that's really what you want.

</comment><comment><USER12> Another fairly easy way to do this kind of thing is to use the DYLD_INSERT_LIBRARIES variable. You can reverse engineer the classnames with class-dump, subclass a class and override a suitable function e.g. IsLicenseValid() to just return true; You can then start your program and insert your new subclassed class into it like this:

$ DYLD_INSERT_LIBRARIES=/path/to/your/Subclassedlibrary.dylib arch -i386 /Applications/OriginalApp.app/Contents/MacOS/OriginalApp &

And on a sidenote, I thought it was funny to see him refer to something as 'badly spelt' - I thought that 'rye' remark was a bit 'corny' (rimshot :-)

<comment><AUTHOR> I didn't know about that, that's really neat! Will need to do some research into that!

PS: I'm poking fun at myself—since I wrote the original app, including misspelling. Also, I use American english, but I do prefer to use the british form of 'spelt' or 'burnt.'

</comment></comment><comment><USER13> Meh, decoding compiled C code is about just as easy for me. I wouldn't worry about it until it becomes a serious problem. The people who crack many apps in the scene are pretty decent at it and this will not slow them down.

Edit: Actually, they're not very good at it, but this still won't slow them down much.

</comment><comment><USER14> Some people also view the windows as an invitation to throw the stones in, claiming they are too fragile to be of any protection anyway.

Next time you buy a DRM-ed book from Amazon.com, or watch a film you can not make a copy of, you can contemplate that the protection there is much better than in some Mac app.

Would that make you happier as a user ?

The way to solve this problem is to spend more time on adding more features into the frequently released newer versions of software. Cracking all the same basic reg code would get boring for a few-dollar app.

<comment><USER15> The challenge then is to write a script that automates the cracking.

<comment><USER16> But does that actually matter? As far as I can see, it's already easy to pirate any app you want. All you need is Google.

I'm suspicious that super secure DRM really stops people from pirating, especially when considering something non-essential with many (maybe worse but often free or more easily piratable) substitutes. Super secure DRM might be more effective with something really unique you really cannot get any other way like games (but those will be cracked anyway, won't they?) but some app? I doubt it.

<comment><USER15> I would actually lean the other way. If your system is far more secure than another identical system, people are less likely to bother targeting your application when they break open the other one much more easily.

It's only when you bring something unique or "better" to the table that you make it worth spending significant amounts of effort on breaking.

</comment></comment></comment></comment><comment><USER17> Well, that's more than just a shell.

<comment><AUTHOR> How so?

<comment><USER18> vim, gdb, hex editor...

<comment><AUTHOR> All of which run inside a shell.

<comment><USER19> I think you misunderstand what a shell is. All these apps run within a _terminal_, the shell merely invokes them.

The article's headline made me a little excited to see some cool bash hackery (there's a lot of functionality packed into bash, see its colossal manpage), but when I saw it was just the usual debugger/patch/etc routine I was disappointed.

By the standards of this post's title, I could say that I have written huge pieces of software with "just a shell". In fact, the foundations of modern computing could be said to have been built with "just a shell". (ie, before they had GUIs) See how silly it sounds?

<comment><USER20> There was a time I did everything in a shell...

</comment></comment></comment></comment></comment></comment><comment><USER21> A much more interesting dive into exploring a binary's internals, at DEFCON CTF difficulty -- <http://hackerschool.org/DefconCTF/17/B300.html>

</comment><comment><USER22> _$ sudo brew_

Not really necessary - <https://github.com/mxcl/homebrew/wiki/installation#sudo>

</comment><comment><USER23> The only "real" copy protection would be trusted-computing right down to the hardware. Signed binaries, with the signature database ultimately in hardware and controlled by a single party.... and even then, we'll have jailbreaks and keys leaked.

But seriously - this was interesting in and of itself, for those who don't know the tools. The whole concept of copy protection and registration is a war that can't be won. Denying unregistered people proper updates seems to me, form experience,to be the most effective deterrent - I don't like to apply updates if I'm not sure if it will cripple my app because I used a weird serial # - and nobody likes to run a "keygen" these days because who knows what it does.

In the end - all software is piratable, and usually by those who won't pay for it anyway.

With the declining price of software and mass-markets like the app-store, more people will pay. (I like a certain piece of SSH terminal software for windows - but I don't use it, because I'll be damned if I'm going to pay over a hundred bucks a seat for it - it's not THAT much better than the free alternatives. If they brought that price down to something reasonable, I'd use it all over)

</comment><comment><USER24> Near the end of the article, the author mentions that storing a digest of the binary is an effective means of protection. I've heard this before, but I've never understood how it works. There's two ways I can think of:

One is it just builds the binary, runs it through SHA1 (or whatever), and stores that digest somewhere in the installation directory. But what's stopping attackers from just changing the digest? They have access to the application, so they can know exactly how to generate the digest; all they have to do is run the bundled digest function in gdb, copy the output, and then search for it in the installation. Even if the author tried some sort of obfustication (xor, deflate, reverse, etc), such attempts would show up in the binary and could be trivially duplicated.

A second is that the digest is somehow pre-computed for a binary before it's built, then included in the binary itself. But I don't see how this is possible with secure digests. And if the method is simple enough that it's worth using for typical iOS applications, what prevents an attacker from pre- computing a digest for the cracked version?

<comment><USER25> No. Effective means of protection are when you "roach motel" the data.

The first rule of software engineering is you never let the shareware stuff do it all. Test version should not save? Rip it out. Shouldn't print? Remove printing. Chop it out wholesale.

If you do an unlocking scheme, then make it subtle. Take a hint from Unix development: dont tell the user that the code worked or not. Just take the code or whatever. Tomorrow, then tell the user if it's a bad code.

And if it's in the blacklist, don't tell the user at all, and instead start introducing subtle errors everywhere. "What, you saved it yesterday and now it doesn't open? Whoops (snicker)." Or, misalign printing so anything looks good for a draft but not 'professional' use. Or you could go the obvious route of slapping a banner on it, but that is usually easily removable.

The idea here is to be subtly annoying up to the point of just doing nasty shit to the data worked with in your program. And of course, give error codes in a form of a md5sum that tells the company if you're a pirate or not.

But as I said earlier, put the time you would protect the program instead as improvement to make your program do its task better and easier. Crackers find these to be challenges. They just crack to keep their chops up.

<comment><USER26> _"And if it's in the blacklist, don't tell the user at all, and instead start introducing subtle errors everywhere. "What, you saved it yesterday and now it doesn't open? Whoops (snicker)." Or, misalign printing so anything looks good for a draft but not 'professional' use. Or you could go the obvious route of slapping a banner on it, but that is usually easily removable"_

"Gee, I'm sure glad I decided to pirate [program], it's buggy as hell. Better warn my friends..."

<comment><USER4> Spyro: Year of the Dragon used a similar technique to great avail. Don't be so quick to dismiss this method of deterring crackers. It just needs to be done right. There are arguments going both ways on this issue so it's simply not black and white. Perhaps it works better for games than applications, but again, you'll find arguments going both ways for games and apps alike.

</comment></comment></comment></comment><comment><USER27> I personally like the idea of an application "unlocking" itself every time based on a hash of its binary. You would have to find all the places these hashes are computed -- if you missed even one place, you wouldn't be able to unlock the app.

Of course, such an app could still be cracked -- as could any app... because all you have to do is

1) purchase a legitimate copy and enter a fake name 2) take a snapshot of a working, unlocked app 3) remove all the code that cripples that state

The only way to really prevent cracking of apps that run locally is either challenge-response dongles or requiring people to provide a strongly verified identity in order to unlock the app (that way the cracker can't distribute the app without compromising the identity of the original buyer). And that is just too inconvenient for the actual buyers. Once again, security at the price of convenience.

<comment><USER28> > The only way to really prevent cracking of apps that run locally is either > challenge-response dongles ...

This doesn't really work. If you have all of the functionality running on your machine but the dongle is there to authenticate, it can be cracked by ripping out the code that does the challenges. The proper way to secure an app using a dongle is to move some key piece of functionality out to hardware instead.

<comment><USER27> good point! You need some functionality though where the response can't just be memoized by the crack. What could it be?

<comment><USER28> Depends on the application, really. I can give you an example of where I've personally considered using this (ended up going with an alternative, however): my startup's product is a hotel front desk system and we have to encrypt room keys to work in the locks; pushing the crypto off onto an external device would make it considerably more difficult to pirate the software, as you'd have to reverse the algorithm and reimplement it in software. In the end, it didn't make sense for us, but it would've been pretty solid, as the odds of you having two identical cards is monumentally slim (and would only even be _possible_ every couple of years).

</comment></comment></comment></comment><comment><USER29> People crack and hack our apps. We don't think it's worth fighting.

And moreover, we have a link on our home page that says if you email us, we will give you our apps for free. Some people take advantage of this offer, but the vast majority of users do not.

</comment><comment><USER30> I think we are exploring the wrong issue here. We shouldn't be looking for a non-crackable scheme, we should be striving to find a scheme to recognize customers who are willing to pay and reward them.

</comment><comment><USER31> I wrote labrea for similarly playing with apps: <http://dustin.github.com/2010/12/03/labrea.html>

Specifically, the PT_DENY_ATTACH thing should be possible to be, itself, denied with labrea (though in practice, I've run into runtime linker problems with that exact call that I haven't quite figured out, but I haven't put much work into it).

</comment><comment><USER32> Price your app exactly at a point where people with money will gladly pay for it instead of suffer the hassle of downloading crapware-infested copies. And let people without money copy it freely without barriers, and see it as a marketing tool so everybody use your app, not your competitor's.

That price usually is between $0.99 and $9.99 and thank Apple for showing us that lesson.

</comment><comment><USER33> I recall Intellij Idea IDE had some pretty decent protection. They used an "encrypting" class loader (of the xor variety), and also encrypted all their resource files. I have a lot of respect for the lengths they went to, though i'm not sure how much it benefitted them really.

</comment><comment><USER34> Linking statically helps too (not sure that's doable with Apple) then stripping and packing.

</comment><comment><USER35> If your a developer for Apple, presumably you are selling your apps through the app store. Apple get's a cut of the revenue for apps. So if it was worthwhile to have a more complicated DRM scheme, wouldn't Apple provide it?

</comment><comment><USER36> Crackers aren't your customers. Don't waste time/money on them.

</comment><comment><USER37> For the definition of "Shell" used by the author, isn't the title basically the same as saying "I Can Crack Your App With Just A Computer"?

</comment><comment><USER38> Thanks for writing a detailed step by step tutorial on this interesting topic. I have always wanted to learn more about this stuff.

</comment><comment><USER39> Excellent article, especially with code

</comment><comment><USER25> Gah, this is your standard 2 byte change_je_to_jne.

Perhaps, to people who program in higher languages this is not evident, but old assembly programmers know this stuff well. Even for the newer ASM programmers, we had Fravia+ (may he rest in peace) to teach us the ropes on reverse engineering and unprotecting 'nasty' code.

And those students of Fravia+ know something well: if it is viewable, executable, listenable on a device you own, you can do anything to it. He recommends taking what you would have put in for protections and make your program better by that much. Or prepare to protect the hell out of it (and release every day, munging the exe).

<comment><USER12> Oh no, I did not know that Fravia was dead. Spent a lot of time reading his stuff years ago. RIP Francesco.

<comment><USER25> Sadfully, he passed May 3, 2009.

Here was HN's article and responses: <http://news.ycombinator.com/item?id=600523>

</comment></comment></comment><comment><USER40> #ifdef DEBUG

        //do nothing

#else

        ptrace(PT_DENY_ATTACH, 0, 0, 0);

#endif

I really have a hard time taking advice on copy protection from someone who doesn't known about ifndef.

Furthermore, PT_DENY_ATTACH won't help because any cracker worth is salt will just open the binary with an hex editor and remove the call to ptrace(). The other two tips to prevent cracking are, at best, as useless as this one.

And just in case you're wondering, those three methods are equally useless on iOS.

<comment><USER28> To avoid having to modify the binary (and thus deal with checksums and the like), you can alternatively break on ptrace where the first arg == PT_DENY_ATTACH, then have it immediately return. Easy to do in GDB.

</comment></comment><comment><USER41> Amature crack for an amature protection.

</comment><comment><USER42> Read this title as a Mario Kart reference. Oops.</comment>


Here's what happens to asylum-seekers who stay in airport limbo indefinitely - <AUTHOR> http://www.washingtonpost.com/blogs/worldviews/wp/2013/06/26/heres-what-happens-to-asylum-seekers-who-stay-in-airport-limbo-indefinitely/?tid=rssfeed <comment><USER2> Mehran Karimi Nasseri's story is often misreported - he was free to leave the airport for a long time but was prevented from doing so by suspected mental illness. His eventual hospitalization finally removed him from the terminal building during which time his makeshift home was dismantled. I don't think those circumstances really apply to Snowden's case.</comment>


10 reasons to buy a Kindle 2 and 10 reasons not to - <AUTHOR> http://www.crunchgear.com/2009/02/25/10-reasons-to-buy-a-kindle-2-and-10-reasons-not-to/ <comment><USER2> I don't know why I read these articles. It's so depressing to be in Canada. I'm not allowed to watch Hulu, use an HD tivo or even try a kindle.

<comment><USER3> Yeah...try living on another continent.(i am from Lebanon)

I just ordered a Sony reader shipped from the US because i can't take it anymore. Needless to say, shipping will cost me a fortune. It's not unusual to pay more than the actual product price just for shipping.

</comment></comment><comment><USER4> Any ideas on how to solve the mental map-making problem? I've been reading on my computer for a long time. Sometimes the problem shows up, sometimes it doesn't & I still can't tell why.

 _"1. It's bad for research. I'm working on a book right now and I wanted to use the Kindle for all of my research. Sadly, this is almost impossible. The book is a physical object - you can move through it, skimming for notes and important points - and there is something in our education that gives us a sense of space inside a book. I don't quite know how to explain it, but you know how you can pick up a book and show someone what you're looking for in a few page turns? You know it was halfway through, maybe a third of the way down the page, and it was near another set of words. The Kindle is not conducive to that kind of mental map-making… yet."_

</comment><comment><USER5> #7 isn't really a reason not to buy a Kindle - like most of the reasons not to, they're just grievances, and #7 isn't even about the kindle, it's about flight attendants.

(though, "You can't explain that it's epaper and uses no current. You just can't. It's like explaining heaven to bears." is pretty awesome)

<comment><USER6> I'm not sure where he was going with that one. It has a battery. It has a microprocessor. It is an electronic device and should be turned off along with Nintendo DS the 10 year old in the seat next to him is holding.

<comment><USER7> He just needed an excuse to write: "It's like explaining heaven to bears."

</comment></comment></comment><comment><USER8> I got one yesterday and can say I'm already reading better (i.e., more thoroughly, more attentively) than I would at desktop or laptop. No zillions of tabs, virtual desktops, tiled windows -- just you and your book or news article. And no temptation really to tab around because refresh/redraw and the nav is _just_ pokey enough to provide an incentive to stay on the page. Yes, books and newspapers have been "full-screen" for hundreds of years, but even then you can flip around, be distracted by adjacent stuff. That may be a bug for some. For me and my ADD brain it's a feature.

</comment><comment><USER9> _3\. The Kindle is flimsy. You'll go through your day thinking you will break your Kindle. You don't fit that much screen on a thin device that is meant to be thrown into a bag without a care and not risk cracking it. There will come a day when you open your bag and see that your Kindle is dead, even in its case. It's not your fault. Say it with me: it's not your fault._

True. I'm sure it's partly my fault because I'm not that careful with it, but I've broken the screen on my Kindle (v1) twice in the year and few months I've had it.

</comment><comment><USER10> They're no good for texts needing any kind of formatting:

<http://news.ycombinator.com/item?id=491664>

<comment><USER11> the new one does tables, but still no monospace.

<comment><USER11> correction: I have a doc with monospace (in a personal doc), but the purchased computer books do not have the code samples in monospace for some reason.

<comment><USER10> How about images/graphics/other support stuff?

<comment><USER11> they load much faster on the kindle 2. on K1, it used to suck to read graphics-heavy docs (such as the pragmatic programmers beta iphone book), because the page with the images would load more slowly than the text-only pages. that is mostly fixed in this version. the images look better too, thanks to the increased gray-scale support.

the screensaver images look great as always. it makes it seem as if image handling is an under-utilized feature. a black and white graphical novel would look spectacular on this thing.

</comment></comment></comment></comment></comment><comment><USER12> I want to ask: It is true that to put the .txt or .doc file into Kindle, it will cost me 10 cents?

<comment><USER13> It costs 10 cents to put it on the device wirelessly. You can still hook it up via USB to put files on for free.

</comment></comment><comment><USER14> Kindle by the pool or beach - I would worry about it being stolen.

</comment><comment><USER15> It's probably just me, but the 10 reasons to buy seemed to far outweigh the reasons against. Someone I know is getting a Kindle2 soon, so I suppose I'll get to judge for myself.

</comment><comment><USER16> Every time I go on a trip I carry my laptop with me, good for reading ebooks and surfing the web.

Sorry, no place for another gadget besides my cellphone.

And no, my eyes don't suffer after using my laptop for more than 10 hours non- stop, been doing that for the last 20 years.</comment>


When we ban begging we take away the first amendment rights of the poor - <AUTHOR> http://www.theguardian.com/commentisfree/2015/oct/26/when-we-ban-begging-we-take-away-the-first-amendment-rights-of-the-poor <comment><USER2> When we ban stalking we take away the first amendment rights of jilted lovers. When we ban playing loud music at 4 AM we take away the first amendment rights of jerks. When we ban plastering every square inch of a city with ads (to say nothing of banning billboards entirely), we take away the first amendment rights of business owners. When we ban vandalism we take away the first amendment rights of vandals.

Any limitation on any act that has a component of communication (which is to say, almost any act at all) can be framed as a violation of the first amendment.

In my opinion, "I need 'bout tree fiddy" ranks below spray-painting a dick on a wall in terms of contributing to the free exchange of ideas.

</comment><comment><USER3> Straw man. They showcase mothers begging for diaper money after a national disaster. But the bans are for all those healthy-looking guys that hang out downtown and accost strangers.

<comment><USER4> What's the name for the fallacy where you ignore the broader point in favor of nitpicking some minor piece of the argument?

<comment><USER5> Bikeshedding?

</comment></comment></comment><comment><USER6> Maybe people ought to think about how willing they are to abridge commercial speech?</comment>


WhatsApp's chief business officer Neeraj Arora is leaving the company - <AUTHOR> https://www.telegraph.co.uk/technology/2018/11/27/whatsapp-employee-number-4-joins-mass-exodus/ <comment><USER2> WhatsApp did have a business model when it was independent - charge a small subscription fee for its service.

When Facebook bought it, the business model was to turn its users into the product.

<comment><USER3> They had ~50 people at time of acquisition. Assuming a steep expense level of $18,500/employee/month, total run rate cost was at ~$11M/year. At a $1 a new user (were at 600M users and growing fast), WhatsApp was almost definitely cash flow positive at time of acquisition.

<comment><USER4> Nobody actually paid for WhatsApp. At least, nobody I know off. They supposedly required you to pay 1€ a year after the first year, but everybody kept using it for free forever. I'd say they never made any money.

<comment><USER5> > Nobody actually paid for WhatsApp. At least, nobody I know off.

People did pay. Its just that the charging was somewhat selective. Obviously you and your friends weren't in the group that was selected.

Originally, it was a paid app ($1) on the iPhone. Eventually, that was dropped in favor of using in-app billing to actually charge the $1/year on Android... but this was only enforced in a few selected countries at first. Once the Facebook acquisition happened, this effort was dropped. If it hadn't happened, then charging users would have expanded gradually over time.

<comment><USER6> Or people would just mass jump to Viber or Telegram or any other messaging app...

I can tell you with confidence that very few users in eastern Europe would pay even an euro for an app that used to be free and has free alternatives.

In fact my friends and I discussed that exact particular scenario when we once got a notification from WhatsApp about future payments.

<comment><USER4> Same here in Spain.

I mean, let's be honest, it's just a chat application. It is almost trivial to build and maintain. And since it uses your phone number, there is no friction to switch to another app--if they decided to charge for it, Telegram would eat it alive in months.

<comment><USER7> > It is almost trivial to build and maintain.

I'm interested to know what you've made or helped to make that is more complex and more difficult to maintain than whatsapp.

<comment><USER5> I find it amusing just how many people make this assumption up-front. Probably because its one of those "problems" that seems simple on the surface, until you start digging deeper. This gets especially true once you take into account offline delivery, presence management, delivered/read receipts, group/broadcast use cases, efficient use of the network, complexities of reliable/efficient cross-platform media transfer across a variety of formats, and... robust end-to-end encryption.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> And the bleed continues. Who important is still left? Soon enough it will only be the good little corporate grovelers that will implement whatever Facebook tells them.

<comment><USER5> The bleed shouldn't actually surprise anyone who knows how the acquisition actually happened. It only surprises tech reporters who are universally oblivious to this part.

If someone said: "We're buying the company you work for, and you're going to get $$$$$ out of the deal. You get some of it up-front, and the rest dolled out over the next four years." Well, now the four years are up. Do you stay and continue to simply work for $, or do you take a break and find something new to do with your life?

<comment><USER9> Considering that they worked for $ beforehand and will likely not get more than $ at other places, there is at least the theoretical possibility that it didn't all turn to shit and that they would choose to continue working at the company for the same reason they initially started working there.

</comment></comment></comment><comment><USER10> Curious what the role of a business officer at WhatsApp is considering it doesn't currently have a business model.

<comment><USER11> Probably working with carriers and hand set manufactures to try and get WhatsApp installed by default.

<comment><USER12> Where I live (in South America), carriers give WhatsApp traffic for free to their clients. I guess this is probably the case in other countries as well.</comment></comment></comment>


Five-year-old boy stopped on highway driving from Utah to California - <AUTHOR> https://www.nytimes.com/2020/05/05/us/utah-boy-driver.html <comment><USER2> While I think this is an interesting story, why are these sort of articles popping up on Hacker News? This is not the place for it.

<comment><USER3> This site values driven young people taking risks and chasing goals that seem very far away but maybe achieving them one day. This kid has the same spirit as many startup founders have, and similarly has skills that others in his age group lack. Oh and he's after a lambo. It's a good symbol for the wealth that the young startup founders seek as well.

<comment><USER4> This metaphor is actually really spot on.

He has on the tiniest of ideas of what he's doing; he might be breaking the law; he's audacious and realized he could just _do it_ ; he wants to be in California because that's where dreams come true; he's probably from an upper middle class white family with parents who didn't pay him enough attention.

And he's doing it all because he wants a status symbol of wealth and prosperity, and someone told him he couldn't.

<comment><USER5> this kid really embodies the american spirit: rich white boy doing whatever the fuck he wants without the slightest concern for who he might hurt or kill in the process, all in the delusional pursuit of a meaningless status symbol he has been conned into thinking he can get because of the cultish adherence to the belief it's the land of equal opportunity despite any and all evidence to the contrary, all while trumpeting about how great he is to anyone who will listen

<comment><USER6> Your comments have been breaking the site guidelines badly, not just in this thread but unfortunately in other threads too. Would you please review [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html) and take the spirit of this site to heart?

We're here for curious conversation, not smiting enemies. If you want the latter, please do it elsewhere.

<comment><USER5> if there were a way to delete all my posts and my account I would do that. the hacker news community has become thoroughly disappointing to me and I retroactively want all my contributions withdrawn. i want nothing to do with it.

</comment></comment></comment></comment></comment></comment><comment><USER7> Given that the police tend to catch a relatively low fraction of traffic offenses, how many 5-year-olds are actually driving around on a given day?

<comment><USER8> I think you may be underestimating just how bad a five year old may be at driving

<comment><USER9> you are underestimating kids... given a proper sized car where they can reach the controls, they do pretty good. My kid has been driving a 12V electric car from age two.

<comment><USER10> Not many 5 year olds are tall enough to see the road _and_ push the gas pedal at the same time though. The article states that this specific boy looked like he was 8 or 9.

<comment><USER9> no, but maybe his parents setup the car to accommodate...

</comment></comment></comment></comment></comment><comment><USER11> Uh yeah, the scent of some kind of bullshit is wafting pretty strongly off this story in at least some regard. 5 years old and cognizant of wanting to buy a lambo, where to go to get one, knowing why and the protocol for getting pulled over (didn't roll down the window until the cop sauntered up?), carrying around _any_ amount of money in his pocket, and to top it off... that pic with the kid's face blurred out, that's pretty damn high in the seat for a 5 year old[1].

1\. Point of reference, admittedly anecdotal, parent of a 5 year old boy.

<comment><USER12> Agreed. There is no way this kid is actually 5 years old. He's massive for a pre-school aged kid and our five year olds were I no way attentive or coordinated enough to have pulled something like this off. I don't get why they would like about this age. Maybe hoping for more sympathy?

<comment><USER13> Could be that he's legally 5, but not actually 5. There were some kids in my little league (not my team) who were "10-11" but clearly more like 15-16. 10 year olds can't throw 75+mph fastballs...

<comment><USER14> Or he lied and the parents are covering for him. It's not like he's got ID.

</comment></comment></comment></comment><comment><USER15> Honestly, I respect any five-year-old with this much determination and drive (no pun intended). He's going places (okay that pun was intended)...

</comment><comment><USER16> I was fascinated when I crossed this story. The mechanics of driving a car aren't that hard once you've done it a couple of times, but to get the car started, into reverse, back up, into drive, navigate surface streets, accelerate onto the freeway (ok, he was going slow), change lanes into the "fast lane" etc... Pretty impressed. I was theorizing that maybe he had played car racing video games (hence the Lambo) and had enough of an understanding of distance perception and braking time not to kill himself. While this is a cute feel good story, that kid is _really_ lucky not to be injured or worse.

<comment><USER17> You guys don't generally use a stick shift. A clutch would probably have caused a few teeth marks in the steering wheel rather than a car hurtling down a motorway.

I too am impressed that a child so young managed to get out so far but yes, he had a very long run of luck and so did a lot of other people.

<comment><USER18> Go to an RC field. Nobody above the age of 30 comes close to the childrens in terms of skill. Video games and gravity engines are sufficiently real, I would trust a 12 year old on the track more than myself. Here's betting that they have video game consoles at the five year old's house!

<comment><USER19> Huh, the videogame generation has had a terrible time getting my '72 Dodge started and moving forward. Heck, many can't remember that you have to release the key when the engine catches (modern cars do that for you, and everything else).

Of course, there's that delicate dance pumping the throttle just enough to keep the cold beast from stalling.

<comment><USER20> I had a classic, DS 21 with a semiautomatic gear box and a bunch of non- standard controls. I'd get a lot of requests from people that wanted to take it for a spin and I always handed them the keys with confidence: "If you can get it started you're allowed to drive it". Nobody ever managed. The reason was that the gear shift lever was used as a very clever lock-out to the starter motor, you started the engine with the gearshift lever in neutral, then moved it to a special position that engaged the starter motor. The key only enabled the contact, not the starter. This was to avoid having the car take off immediately after starting the engine. It also served as a very effective deterrent for wanna-be joy riders.

<comment><USER21> > This was to avoid having the car take off immediately after starting the > engine.

I think modern cars have taken all the 'fun' out of learning to drive. Bunny hopping a stick shift along a parking lot used to be a rite of passage, and provided a chuckle for onlookers.

</comment></comment></comment></comment></comment></comment><comment><USER22> "Please tell us about the time you most successfully hacked some (non- computer) system to your advantage."

</comment><comment><USER23> Makes me wonder what the cutoff age would be between being impressed with the achievement (at age 5) vs. being 'in trouble' with the police.

<comment><USER24> How do you define 'in trouble'? An older-looking 14's the mark where I think you'd see actual repercussions, but I can't imagine people would be particularly-impressed if the boy was double his age (plenty of kids can drive at ten; plenty more kids can drive at ten as poorly as the adolescent in the article is described as doing). I think someone at the age of 13 could probably get this amount of press if they got caught in Utah or wherever coming from Georgia.

<comment><USER25> Just a small correction, 5 years old isn't adolescent. Adolescent is more or less a synonym for teenager.

I was left a bit confused.

Though this lead me to look up development stages which was interesting [1]

[1] [https://en.m.wikipedia.org/wiki/Development_of_the_human_bod...](https://en.m.wikipedia.org/wiki/Development_of_the_human_body#/media/File%3AChild_development_stages.svg)

<comment><USER24> Thanks!

</comment></comment></comment></comment><comment><USER26> If Lamborghini wanted to boost their sales, there couldn't be a better product placement than this.

" Our cars are so amazing, even a five year old would drive by himself on a highway to buy it."

<comment><USER27> Of course, Lamborghini is also the sort of brand that wouldn't stoop to such advertising.

</comment></comment><comment><USER28> Best I can tell from the police tweet is that he went about 3 miles, guessing this route from the description of start/stop: [https://www.google.com/maps/dir/17th+St+%26+Lincoln+Ave,+Ogd...](https://www.google.com/maps/dir/17th+St+%26+Lincoln+Ave,+Ogden,+UT+84404/41.2195185,-firstname.lastname@example.com,-112.0065879,14z/data=!4m19!4m18!1m15!1m1!1s0x87530ebffbf4c373:0xbebda80be5567470!2m2!1d-111.9757381!2d41.2368037!3m4!1m2!1d-112.0130364!2d41.228625!3s0x87530e42aee4253b:0x40567d18678521d5!3m4!1m2!1d-112.0095773!2d41.2218108!3s0x87530e5ae510383d:0x73573d457cf7562b!1m0!3e0)

<comment><USER29> Dang, that is really impressive for a 5 year old. This kid is going to do big things when he is older. Hopefully outside of a life of crime.

</comment></comment><comment><USER30> I am skeptical that the kid is only 5 years old. Certainly I've never seen a kindergartner anywhere near that large.

<comment><USER31> Heh, I remember being ~6 and thinking they had an age limit for driving "so you'd be big enough to operate it", but then I figured that couldn't be right because I'd seen little old ladies that were about the size of some 10 year olds.

<comment> mark-r When my Grandmother pulled up in her car, it looked like there was nobody driving. She wasn't tall enough for her head to be visible in the windshield. I don't know how she saw anything.

</comment></comment></comment><comment><USER32> Maybe HN could gift him this Lego Bugatti (1:5 replica)?

[https://www.wsj.com/articles/build-your-own-supercar-on- your...](https://www.wsj.com/articles/build-your-own-supercar-on-your-coffee- table-11588392034)

</comment><comment><USER33> What is more impressive is that the kid actually pulled over!

From the NYT article: "He was all set to make the trip," Trooper Morgan said at the news conference. "It amazed me that when he heard my siren that he did pull over and stop."

</comment><comment><USER34> bypass paywall: [http://archive.is/ws3x1](http://archive.is/ws3x1)

</comment><comment><USER35> We're just lucky he never played Need for Speed: Hot Pursuit

</comment><comment><USER36> Since when did face-blockers look like a vortex into another dimension? Creepy.

</comment><comment><USER37> I wonder if these various concerns would be relevant once self driving cars become common place.

A child could pretend to drive (or even be trained to drive!) by a self driving vehicle.

</comment><comment><USER38> Did the kid actually pull over to the shoulder?

<comment><USER39> Yes (the left shoulder), as seen in the police dashboard camera footage linked in the article.

</comment></comment><comment><USER40> [https://archive.md/ws3x1](https://archive.md/ws3x1)

</comment><comment><USER41> Was he The Wizard?

</comment><comment><USER42> So, there is no Lamborghini dealers in Utah?

</comment><comment><USER43> What were you guys thinking when you intended to upvote this post on Hacker News?

<comment><USER44> See dang's answer here: [https://news.ycombinator.com/item?id=23087284](https://news.ycombinator.com/item?id=23087284)

It actually clarifies a whole lot.

</comment></comment><comment><USER45> how was the child able to stop the car!

<comment><USER46> The same way he got it started...?

<comment><USER47> Makes sense that he could reach the ignition. I'm impressed he could get his foot on the break!

</comment></comment></comment><comment><USER48> "Family members told troopers the boy had gotten upset with his mother at some point earlier when she wouldn't let him buy a Lamborghini"

Source: [https://www.ksl.com/article/46749182/uhp-5-year-old-boy- pull...](https://www.ksl.com/article/46749182/uhp-5-year-old-boy-pulled-over- after-trying-to-drive-to-california-to-buy-a-sports-car)

<comment><USER49> It says that in the linked article as well...

</comment></comment><comment><USER50> I despise paywalls.

<comment><USER51> From a local Utah news source: [https://www.ksl.com/article/46749182/uhp-5-year-old-boy- pull...](https://www.ksl.com/article/46749182/uhp-5-year-old-boy-pulled-over- after-trying-to-drive-to-california-to-buy-a-sports-car)

</comment></comment><comment><USER52> Why is this a story on HN?

This is irrelevant tabloid level news.

<comment><USER53> Meh, seems pretty relatable. I put my parents' car in neutral and rolled it out into a major street when I was five. Haven't we all?

<comment><USER52> Well, if you had an AI aware car, then this would've prevented that from happening. Thus saving your 5-year-old life.

Now, this would be newsworthy. And Tesla's stock price would probably increase from the positive news, as well as the increase from additional car sales for its AI safety features.

</comment></comment></comment><comment><USER54> That kind of resolve is what distinguishes successful founders :P

</comment><comment><USER55> since we're now getting these kinds of posts on HN, I might as well post that I'm glad he didn't get tazed, shot, mauled by a k9 dog, or killed.

</comment><comment><USER56> Until I had kids of my own I did not quite comprehend just how capable little kids can be.

A 5 year old holding an AK47 is entirely capable of being a legitimate competitor to an adult holding an AK47. An average 10 year old armed with an AK47 might be more dangerous than an average 40 year old. Child soldiers are likely very effective, as depressing as this thought is.

Small children are profoundly ignorant but they're not dramatically less intelligent than adults. In limited domains, like driving or shooting, a high performing child can easily beat a low performing adult.

<comment><USER57> Kind of strange comment, but one of the problems I've seen in schools is the assumption by teachers that children are not as intelligent as adults. Generally this isn't true. Usually they lack a framework for reasoning and lack experience with language for communicating. There are some differences with brain development of young children for sure, but in my experience people underestimate children by a fairly large margin. You see the same phenomenon with people trying to talk to adults who are just learning the language. There is an assumption that the person is stupid rather than that they have difficulty communicating.

<comment><USER58> People underestimate kids in some ways, and overestimate them in others. The underlying framework for highly abstract thinking takes time to develop, as does the ability for understanding empathy and moral behavior. A five-year-old kid literally has no notion that driving a car he's not the owner of is theft, and thus grossly unethical conduct. The car is just there for the taking; to him it's no different than playing GTA.

<comment><USER59> 5 year old kids are capable of _very_ complex ethical thinking and empathy, most definitely including understanding of ownership. Maybe it's not as common in the US, but you can see it clearly in any country where kids regularly go to child care from age 3.

</comment></comment></comment></comment><comment><USER60> Why aren't his parents in jail? Why wasn't he removed and placed in a foster home by CPS? I'm glad he didn't hurt anyone on the road.

<comment><USER61> Meanwhile 100% of parents are going "there but for the grace of God..."

Kids get up to crazy shit all the time. There's no way to be up their asses enough to stop something like this if they get it in their heads and don't let on ahead of time. There's no way to hide or lock up everything that could be dangerous all of the time. Maybe today one of the many, many things in your house they've always left alone, that could be dangerous, they'll decide to screw with. You just hope they get out of your house before they harm themselves or others _too_ badly.

The difference between these parents and any other set of average to good parents, judging solely from this having happened, is that they were unlucky. Are they bad? Maybe. This doesn't give us much info one way or the other. Are they _really really_ bad? Well since the call to the cops didn't end with one or both parents in jail on drug charges and the car was theirs, not someone else's, and the kid appears to have been fed, I'm gonna go with probably not. And yes those are all real things that it wouldn't even have been that weird to have ended up in a story like this.</comment></comment>


Make: Theory and Practice - <AUTHOR> http://www.ploxiln.net/make.html <comment><USER2> Not a bad introduction. I spent years working on GNU make stuff (including a complete emulation) at Electric Cloud and wrote an "Ask Mr Make" column. Everything I wrote about GNU make can be found here: [http://blog.jgc.org/2013/02/updated-list-of-my-gnu-make- arti...](http://blog.jgc.org/2013/02/updated-list-of-my-gnu-make- articles.html)

[blatant advertising] And also I have a new book on GNU make coming out this month: [http://www.nostarch.com/gnumake](http://www.nostarch.com/gnumake) if you really want to get into make deeply.

<comment><USER3> If anyone wants to get into GNU Make deeply, one would think that the obvious thing to do would be to _read the official manual_ for GNU Make.

Anyone who writes their own, _not_ freely available, manual to a free software program, is dividing the world into two halves: Those readers who _can_ afford this new book, and will pay the author (not the writers of the software, mind you) for a nice manual, and those readers who _can't_ afford to pay for this new manual, and will have to do with the inferior¹ official manual. Those readers who can afford the new manual will not be incentivised to improve the official manual, since they have the new, better, one. Therefore, this act (of creating new manuals which are not freely available) is reducing the number of readers who can be expected to help improve the official manual to those readers who cannot afford the new manual. These effects, i.e. reduced funding _and_ reduced help to the original software authors, is not, to me, worth it to have a new, even if better, manual.

① Presumably, by their own standards, since they wrote a replacement manual.

<comment><USER4> On the subject of unofficial manuals and guides, people has been sued under copyright and trademark for writing and selling them ([http://news.cnet.com/Warcraft-maker-sued-for-blocking- sales-...](http://news.cnet.com/Warcraft-maker-sued-for-blocking-sales-of- unofficial-guide/2100-1043_3-6053716.html)).

Since the title is "the GNU make book", a consumer could easily mistakes the book as made by the author of _GNU make_ or/and published by the _GNU project_.

Edit: Missread the article. It was blizzard that got sued for filling the DMCA, not the other way around. A more relevant article is the Harry Potter Lexicon case where a guide to the harry potter works was deemed not protection by fair use. ([http://writers.stackexchange.com/questions/8243/can- anybody-...](http://writers.stackexchange.com/questions/8243/can-anybody- write-an-unauthorized-guide))

<comment><USER5> Correction: Blizzard+Vivendi filed DMCA takedown notices to prevent sales. The writer of the guides sued Blizzard+Vivendi for filing invalid DMCA takedown notices and _won_ [http://lawvibe.com/world-of-warcraft-ebook-seller-wins- case-...](http://lawvibe.com/world-of-warcraft-ebook-seller-wins-case-against- blizzard/) .

Title-wise on jgrahamc's book, that's a different discussion, and completely unrelated to the link you provided.

</comment></comment></comment></comment><comment><USER6> I'm currently using Make as part of a data-building pipeline. It's nice that it's a build system that doesn't assume my goal is to build a binary or a JS file, and that it's remarkably easy to parallelize.

One deficiency I've come across, which seems to be well-known, is the M:N problem -- where one step takes M input files and has N output files. Make rules seem to expect to have only 1 output, and the workarounds like .SECONDARY prevent some features of Make from working correctly.

I've also seen this limitation in many of the fancy new build systems that get posted here on HN.

Is there a build system, a modification to Make, or anything out there that _does_ keep track of builds with multiple outputs? Not an I/O-guzzling MapReduce framework, please.

<comment><USER7> FWIW, my tool Ninja (was just on here again this week here: [https://news.ycombinator.com/item?id=9282539](https://news.ycombinator.com/item?id=9282539) ) was designed to be more or less the same idea as make with some semantic fixes, and that includes supporting multiple outputs.

You can see the brief list of improvements here:

[https://martine.github.io/ninja/manual.html#_comparison_to_m...](https://martine.github.io/ninja/manual.html#_comparison_to_make)

(Within Ninja this manifests concretely as needing to represent the build graph as a bipartite graph between files and commands. Though I don't know make's internal representation, I imagine the straightforward implementation is as a graph between files and I can imagine why it'd be difficult to make multiple outputs work in that case.)

<comment><USER8> Is there some fundamental reason why the approach used in Ninja couldn't be used to accelerate a substantial subset of Makefiles? If you dropped Make's built-in rules, more complex functions, VPATH, conditionals, and similar items the Ninja manual describes as slowing down Make (all of which are non-portable features of GNU Make), while mostly keeping compatibility with the portable subset of Make, is there some fundamental reason _that_ couldn't be accelerated to the same degree as Ninja?

<comment><USER7> No, they should be equivalent. The Ninja manual goes so far as to encourage you to continue using Make if Make is fast enough for you.

However, another way of writing your question is "if you removed the features of make that ninja doesn't have and then optimized the remainder for performance, wouldn't they match?" and that is maybe tautologically true -- that description is roughly what Ninja is, after all.

Because we cared more about performance than other things we maybe were a little crazier about shaving off milliseconds than other systems, so it might be hard to make make fast enough. But (as the Ninja manual suggests) this may only matter for very large (Chrome-sized) projects. You can read a chapter about some of the performance work done on Ninja here: [http://www.aosabook.org/en/posa/ninja.html](http://www.aosabook.org/en/posa/ninja.html)

<comment><USER8> > However, another way of writing your question is "if you removed the > features of make that ninja doesn't have and then optimized the remainder > for performance, wouldn't they match?" and that is maybe tautologically true > -- that description is roughly what Ninja is, after all.

Not exactly. I'm asking if an implementation of the portable subset of Make people actually use (pointedly excluding GNU Make extensions) could be made nearly as fast as Ninja. That would have the advantage of running existing makefiles, as long as those makefiles weren't written specifically for GNU Make.

<comment><USER7> I think we are maybe talking in circles. :)

When you write "could be made nearly as fast as Ninja", I thought you meant you would change the code of Make or write a new tool. If you don't write a new tool and just use a subset of Make's functionality for your own Makefiles I'd expect those to be faster than your standard Makefiles, sure.

But "existing makefiles" typically use a mixture of GNU make-isms and other things that are not GNU-specific but still slow (e.g. from a skim of the BSD make manual I see lazy variable expansions and control structures). So if you're talking about implementing a subset of Make you're talking about something that's unlikely to be compatible with Makefiles seen in the wild. And then if you're not compatible with Makefiles seen in the wild you've effectively written an incompatible faster subset of Make, which brings us back to what Ninja is. (In case it's not clear, in Chrome's case the same code was used generate Makefiles and Ninja files with some relatively minor output differences -- the tools are that close.)

Perhaps there's some "common" subset of Make that covers some high percentage of build files seen in the wild that could be made faster. That could be valuable to organizations who want faster builds without changing anything. I vaguely recall seeing some commercial software that did this even -- as I recall, their value add was that they had tooling that would figure out how to run your Makefiles in parallel; though Make supports parallel execution, apparently this business found enough customers by just targeting those with underspecified Makefiles that weren't parallel safe and then fixing them!

Anyway, all of this is kinda moot because for 99% of projects Make is plenty fast. I even use Make myself for all my personal projects! In Chrome's case (what we wrote Ninja for) there's so much code that the build files themselves are over ten megabytes of text, so to parse that quickly you're at the level of worrying about avoiding memory allocations in the lexer, which is beyond what most people would care about.

<comment><USER8> There are plenty of shell scripts out there that are written for /bin/sh without using bash features; similarly, many makefiles just use the portable subset of make, such as POSIX make. I agree that you'd likely need to write a new tool rather than attempting to optimize GNU make or BSD make. But you wouldn't need to introduce a new syntax; you could just use the POSIX subset of make.

I was partly asking because a fast make-compatible build tool seems easier to switch to, and partly because I wondered how much of Ninja's performance depends on dropping the slow features of make versus adding new capabilities or new syntax.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> make is a good idea gone bad. It's supposed to be dependency-based, but it has no mechanism for finding dependencies. It has to be told about them manually. So kludges have been written to find dependencies, but they have to overwrite makefiles. Its analysis of what has changed is purely based on time ordering, so it can get confused. This leads to too much "make clean". Although it wasn't intended as a macro processor, it's turned into one.

Then, of course, there's "./configure".

The alternatives tend to be bundled with some giant IDE, or are language- specific. The trend seems to be towards the latter; Go has "go", and rust has "cargo".

</comment><comment><USER10> This seems like an excellent and concise piece on how to best use Make, and one I will share with other developers.

Thank you for writing it and posting it here!

</comment><comment><USER11> Should read this along with it: [http://www.conifersystems.com/whitepapers/gnu- make/](http://www.conifersystems.com/whitepapers/gnu-make/)

In my current very huge (takes hours to build) project at work there is a lot of voodoo around the amount of parallelism you can use. "make -j 4" seems OK, but "make -j 20" fails.

Of course, nobody wants to work on improving the build system.

<comment><USER2> See also: The Pitfalls and Benefits of GNU Make Parallelization

[http://www.cmcrossroads.com/article/pitfalls-and-benefits- gn...](http://www.cmcrossroads.com/article/pitfalls-and-benefits-gnu-make- parallelization)

<comment><USER12> What's sad is that I wrote about this about 25 years ago when I first wrote gmake's -j feature.

[http://highlandsun.com/hyc/#Make](http://highlandsun.com/hyc/#Make)

The Chrome/Ninja discussion reminds me of the old mess of X11 IMakefiles. Apparently nothing has really improved since then.

</comment></comment></comment><comment><USER13> The reason I love make so much isn't because it's a super reasonable way to build projects, it's because it has the best interface for building projects in a way that can apply to all languages.

I wrap lots of other build tools in make, so that the way things happen always follows

make setup && make build && make (deploy || install)

No matter the underlying tools. It just makes getting started with one of the many dozens of repos we worth with easier.

</comment><comment><USER14> Thinking of make as an example of "declarative programming" helps in appreciating its functionality.

This aspect needs to be highlighted to those who have knowledge of imperative/object oriented programming paradigms only.

Otherwise, understanding how those makefiles actually work can become confusing and painful.

</comment><comment><USER15> Incremental and parallel computations, like building software in a development environment, is better done using some kind of purely functional system, imho.

<comment><USER16> I'm curious--any pointers to example packages?

<comment><USER17> Nix & NixOS - [http://nixos.org/](http://nixos.org/) But, in practice it is used more on the level of packages and configuration than as a build system within a package. I remember reading an article demonstrating its use for building C code but I can't find it.

</comment></comment></comment><comment><USER18> makes my day</comment>


Adv. iOS crash reports for beta & app store and now improved beta distribution - <AUTHOR> http://www.hockeyapp.net/blog/2011/9/20/improvements-improvements-improvements.html

<comment><USER2> HockeyApp's crash reporting is far more comprehensive and useful than TestFlight's, especially in the server-side symbol/line number associations and grouping of crash reports.

This was a major deciding factor in our switching.

</comment><comment><AUTHOR> Hey, I am Andreas, one of the developers of HockeyApp.net. The service provides some pretty unique features especially advanced crash report management. Crash Reporting is based on PLCrashReporter (see [http://landonf.bikemonkey.org/code/objc/Reliable_Crash_Repor...](http://landonf.bikemonkey.org/code/objc/Reliable_Crash_Reporting.20110912.html)), works also in the App Store with full server side symbolication grouping all crashes by class, method and line number. Let me know if you have any questions.

</comment><comment><USER3> We've been using this instead of TestFlight. The crash reporting aggregation is a huge time saver, and the developer is responsive.

</comment><comment><USER4> Am I crazy for considering switching from TestFlight to HockeyApp mainly because HockeyApp actually charges for the service?

<comment><USER5> No, absolutely not. With free products, you are the customer. I don't like this idea either. Also, HockeyApp is far superior to TestFlight. They had In- App-Updates at launch day.

</comment></comment><comment><USER6> We should talk, because I've developed a lot of the stuff you're doing (OTA distribution, analytics, crash and error reporting, bug tracker integration) internally. This was back before both TestFlight and you launched, and we needed a solution so bad that we wrote our own. Would love to talk further if you're interested.

Also, the line about your documentation did not instill me with great confidence:

> HockeyApp provides an open and well-document API which is based on HTTP and > JSON.

<comment><AUTHOR> You can reach us here: <http://support.hockeyapp.net/></comment></comment>


Reddit CEO caught secretly editing other people's posts - <AUTHOR> https://www.reddit.com/r/The_Donald/comments/5ekdy9/the_admins_are_suffering_from_low_energy_have/?st=ivvs9idp&sh=befaa8b8 <comment><USER2> Extensive discussion: [https://news.ycombinator.com/item?id=13027031](https://news.ycombinator.com/item?id=13027031)</comment>