The lawyers are coming - <AUTHOR> http://www.embedded.com/columns/barrcode/221901488

<comment><USER2> It seems strange to me that some of the most important software is written in some of the easiest-to-mess-up languages. When we are writing a web application to share 140 character messages with our friends, everything is high-level. There are no blocks of memory, or bits to twiddle that change the hardware configuration, etc., etc. You have to go pretty far out of your way for your application to not work correctly, and then you have extensive unit tests to make sure you don't do that. The possibility of a bug in your application affecting other applications, or the OS, or the hardware is pretty much exactly zero. You aren't even _allowed_ to write code that could be incorrect, like casting pointers or indexing into memory you didn't allocate.

Then there are embedded systems that control missile batteries or commercial aircraft, and to save money on processors, everything is implemented in the lowest-level language possible. You have some registers and a block of memory. The programmer has to manage the hardware configuration, manage memory, make sure he never writes outside of an array, make sure he never treat one pointer as a pointer of another type, etc. If you accidentally forget to do any of those things exactly right, even once in a million lines of code, the device can kill 500 people. And that's not even including bugs in the actual control algorithm... which you don't have much time to get right, since making the computer work at all is the hard part.

Anyway, it would be nice to see the embedded industry as a whole start using a programming language that can ensure some minimal amount of correctness at compile-time. Add a bit of expressiveness to the language so that describing complex algorithms is only a few lines of code, and I think we won't be hearing much about embedded software failing.

My guess, though, is that this will never happen; for the same reason that soft drinks are sweetened with high fructose corn syrup instead of sugar. Saving 0.01 cents times a hundred million units means massive profits. Saving a few cents by using a low-level but dangerous programming languages, and then paying out a few wrongful death settlements is probably cheaper than spec-ing better hardware. Externalities, gotta love 'em.

Edit: I see things like Atom (<http://hackage.haskell.org/package/atom>) as hope for the future. Machines can write C just fine. Just don't let the humans do it.

<comment><USER3> _Then there are embedded systems that control missile batteries or commercial aircraft, and to save money on processors, everything is implemented in the lowest-level language possible._

Avionics and weapons systems are, I hope, still written in Ada.

<comment><USER4> Most, though some is now COTS, so C and others are employed as well.

</comment></comment></comment><comment><USER5> As long as the software model is, "if it crashes my desktop computer (or my handheld device, etc.), there is no legal liability for the consequences of my bug," the lawyers do not have an entry point.

Put it in as software embedded in a device where the crash may lead to physical crashes, injuries, and deaths, and the liability stakes increase immeasurably as lawyers and lawsuits enter the picture.

This is a tough area, as almost all complex coding will have bugs in it. In such cases, the manufacturer of the device will have the primary liability to the injured party but almost certainly would have indemnification/contribution rights against the software developer as well. Whether such rights would ever be exercised against a company employee is doubtful but they would undoubtedly be used against a contractor to whom the work had been subbed out.

Important words of caution for software developers dealing with such systems.

</comment><comment><USER6> I program residential automation systems and this is a real concern of ours. On some projects we must show proof of proper insurance coverage.

I am surprised that most programming projects don't require a similar assurance.</comment>


Ask HN: Startup needs suggestion on business process automation - <AUTHOR> Hi, does anyone have experience with business process automation of tasks? Either open source or SaaS with an API. For example, at a certain trigger, I need to create a file or REST transaction, send an email, follow up on that, call someone. What software should I investigate to integrate to? <comment><USER2> I love Integromat. It can do that and anything else. Found them by accident a few months ago when I wanted to automate a few tasks and it has the right mix between configuration and programming.

</comment><comment><USER3> Zapier comes to mind for one. What kind of triggers would you want?

<comment><USER4> I second that. I use Zapier for automating processes such as:

\- storing incoming invoices in Google Drive

\- sending payment reminders (not entirely automated in this case; Zapier just creates a reminder to check and send a reminder by the due date; this could be completely automated, too though)

\- storing contracts and project documentation coming in via email

\- sending emails to leads at certain stages in the sales process

Zapier's tools for extracting and programmatically accessing data (e.g. for storing invoices in a folder for the current month) are quite sophisticated.</comment></comment>


Firefox 6.0 alpha available - <AUTHOR> http://nightly.mozilla.org/

<comment><USER2> what happened to 5.0? Are they doing 6.0 and 5.0 in parallel?

<comment><USER3> It must be a parallel project.

When 4.0 was released to the public, the next update provided 40 b13 nightly users was a 4.2 alpha. (some plug-ins break)

</comment></comment><comment><USER4> They're really speeding up their release schedule. Not really related to the topic, but I'm curious why is the Mac build twice the size of the Windows one?

<comment><USER5> I wonder if they still package both PPC and Intel binaries together. This is usually the reason why OS X apps seem to be larger than their Windows counterparts.</comment></comment>


Using Apollo to implement mutations on a React client - <AUTHOR> https://medium.com/naresh-bhatia/graphql-concepts-i-wish-someone-explained-to-me-a-year-ago-61923646739b <comment><AUTHOR> In Part 5 of "GraphQL concepts I wish someone explained to me a year ago" we implement mutations on the client.

We'll use the operations exposed by the server to create authors, publishers and books as well as relationships between them.

I'll be releasing one part a day for the next week (in case you'd like some holiday travel reading). Here's what you can look forward to.

Part 6: Subscriptions (server implementation)

Part 7: Subscriptions (client implementation)

We're on the home stretch now–are you enjoying the series so far?</comment>


TechCrunch hacked by OurMine Team - <AUTHOR> https://techcrunch.com/2016/07/26/ourmine-team-important-message/ <comment><AUTHOR> Screenshots: [http://imgur.com/a/eR7GQ](http://imgur.com/a/eR7GQ)

</comment><comment><USER2> OurMine is just getting all over the place. Seems they cracked np vs p. just kidding.</comment>


New Security Warning Issued for Gmail and Calendar Users - <AUTHOR> https://www.forbes.com/sites/daveywinder/2019/06/11/new-security-warning-issued-for-googles-1-5-billion-gmail-and-calendar-users/%233d17ba95565e <comment><USER2> ""The researchers found a way to work around that and after the public disclosure and weaponizing of the vulnerability at the Wild West Hackin' Fest that year, Google contacted the researchers to state that no "fix" had been made because "making this change would cause major functionality drawbacks for legitimate API events with regards to Calendar." A case of user experience taking priority over security in other words.""

At least disable links in Calendar notifications, Google!</comment>


Flat Files And Server Denials: Covering Elections At Three News Orgs - <AUTHOR> http://blog.apps.chicagotribune.com/2014/04/25/flat-files-and-server-denials-covering-elections-at-three-news-orgs/

<comment><USER2> A similar "static site" approach (using Jekyll and Akamai) was used by the Obama campaign's fundraising site. There was a good write-up about it a while back: [http://kylerush.net/blog/meet-the-obama- campaigns-250-millio...](http://kylerush.net/blog/meet-the-obama- campaigns-250-million-fundraising-platform/)</comment>


Henry Blodget: How To Know You've Hired A Killer Team - <AUTHOR> http://www.businessinsider.com/henry-blodget-how-to-know-youve-hired-a-killer-team-2009-12

<comment><USER2> It's nice to give a public pat on the back to a good team, but much of this comes across as hubris -- and that can come back to bite you.

Reminded me Jason Calcanis' posts in early 2008 about hiring the best workaholics you can find and then having to lay off some of his stars when the recession started to bite. And then having to admit that his standards and hiring practices were not that sound when it turned out an employee had a serious criminal past.

<comment><USER3> Well, some of a _killer_ team is bound to have a criminal history.

</comment></comment><comment><USER4> _Because the life of the company is on the line. Every day. The day you forget that is the day you'll be headed for the scrap heap._

Doesn't sound like a healthy way of living / working.

<comment><USER5> No it doesn't. He's not saying 'work yourself to death'. He's saying: 'Behave as if every decision you make, and everything you do will directly impact your companies ability to continue to exist'.

That's how any good entrepreneur behaves, because in all likelihood it's true.

</comment></comment><comment><USER6> Summary: _I just promoted Joe Weisenthal to deputy editor._

Also:

> One morning about a year ago, for example, I woke up at my usual time--5am-- > to discover that several stories had already been posted to the site.

Potential race-to-the-bottom over a positional good.</comment>


What can Uber teach us about the gender pay gap? - <AUTHOR> http://freakonomics.com/podcast/what-can-uber-teach-us-about-the-gender-pay-gap/ <comment><USER2> I think this paper is one of the best cases of evidence against the myth of the gender pay gap.

The Confidence Gap, a piece in Salon, bought up the idea that confidence affects the wages we ask for, and how women are often less confident in their fields (and they have a greater burden of appearing to have confidence without too much, i.e. appearing _bitchy_ .. oddly enough a bigger issue with female focus groups).

But there are other large factors. Women tend to take jobs they are more fulfilled in, even if they know they'll earn less. We see more female teachers and nurses and fewer female oil rig workers.

Even in really progressive societies, I still think there is a subconscious believe that men should be able to provide for the family. This is changing in some areas; the west coast and startup culture cities you'll see this more. But in general, it's the Office Space and Dilbert word: men are more likely to take unfulfilling office work to earn the cash. Why aren't there more women in tech? Maybe they see men miserable with their jobs, both in person and in pop culture.

This study goes to show the income gap may have more to do with personal choices than anything else.</comment>


For avant-garde poets, audio recording was both a breakthrough and a threat - <AUTHOR> https://www.poetryfoundation.org/articles/148543/caught-on-tape <comment><USER2> Was also true for musicians. Recording and distribution killed off a hell of a lot of the music industry.</comment>


Can Airlines Make Money? - <AUTHOR> http://priceonomics.com/can-airlines-make-money/ <comment><USER2> European low-cost carrier Ryanair had a net profit of 523 Mio. €. Seems there are ways to make money. [http://investor.ryanair.com/wp- content/uploads/2015/04/Q4FY-...](http://investor.ryanair.com/wp- content/uploads/2015/04/Q4FY-2014-AnnualInterm_Results-Results.pdf)

<comment><AUTHOR> Oh, good. They must have dropped the $15 fare to Europe then. [http://money.cnn.com/2015/03/17/news/companies/ryanair- trans...](http://money.cnn.com/2015/03/17/news/companies/ryanair- transatlantic-flights/)

<comment><USER3> Ryanair has a very effective marketing department, which seems to work on the basis that any exposure is good.

Hence there are press releases and news articles about plans for standing tickets, or charging to use the toilets.

I guess the theory is, if you tell people how cheap Ryanair is often enough, they won't check other airlines.

Norwegian is the budget airline that's flying US-Europe, for example NY to Oslo in January for $300 return (hand luggage, no food, no seat reservation).

<comment><USER4> No food from NY to Oslo? It's not exactly like there are grocery stores in terminals.

<comment><USER5> I've never seen a terminal that didn't have some market selling sandwiches and wraps to go.

<comment><USER4> Would the flight be something like 14 hours though? You would have to pack 3 full meals. It looks like people don't think that's a problem.

<comment><USER5> NY to Oslo is like 7 hours. At night.

<comment><USER4> They always fly at night, or it takes 7 hours but only at night?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Has anything changed with pilots unions?

"The interaction between labor laws and FAA regulations results in pilot unions having a strong claim on 100 percent of an airline's profits. An investor in a unionized U.S. airline should not expect to see a return on that investment and, indeed, should expect an eventual Chapter 11 bankruptcy filing to wipe out his or her investment altogether."

[http://philip.greenspun.com/flying/unions-and- airlines](http://philip.greenspun.com/flying/unions-and-airlines)

<comment><USER7> Yes, George Bush (i.e. his administration) forbade the Delta pilots from going on strike, sent the pilots and airline to binding arbitration, and as a result, the pilot's pensions were dumped on the US taxpayers:

[http://money.cnn.com/2006/06/16/news/companies/delta_pension...](http://money.cnn.com/2006/06/16/news/companies/delta_pensions/)

Later, when Delta started doing well again, they didn't bother taking back that obligation.

</comment></comment><comment><USER8> make money or show profit? If one to look at the salaries of the army of airlines' executives and mid-managers one would definitely see the money (and would understand why no profits are shown).

Oil is cheap. Planes are reliable and fuel-efficient. The flights are completely booked and the passengers are stuffed tightly in. Tickets are pricey. Where are the money going once it ingested by an airline?

</comment><comment><USER9> Pretty much every major airline has gone Bankrupt at some point. I think there are short periods when they can make money, but based on history it is unlikely they can make profits long term.

</comment><comment><USER10> Businesses with high fixed costs (like airlines) generally need to be some kind of monopoly to survive. Some monopolies are based on difficult to duplicate quality (Apple) or network effects (Windows). Sometimes it's regulatory. But without some protection from price wars, high-fixed costs business usually end up in a death spiral.

</comment><comment><AUTHOR> A naive question... Based on the comparison Peter Thiel made here between the airline industry and Google. [https://www.youtube.com/watch?v=DLWyP83iU5M&list=PLG0NEzaDle...](https://www.youtube.com/watch?v=DLWyP83iU5M&list=PLG0NEzaDlePoz- Pls2f0kG3skZpVJY2E1&index=5)

How come no one has disrupted it? Surely there has to be way to make it work?

<comment><USER11> I recently read an article about the government wasting money on billion dollar jets that didn't work for front-line fighting. The author suggested the slower, cheaper, and more capable WWII airplanes instead. Got me wondering, could someone maintain and fly dual prop or larger airplanes on the cheap and disrupt the airline industry with it's jets that cost hundreds of millions?

I have no idea if props or jets are more fuel efficient but I assume the former.

<comment><USER12> You would first have to build a suitable dual prop for long flights which costs hundreds of billions of dollars (boeing doesnt sell dual props I dont think for big commercial flights). Thats assuming you can get it working and fits with all the safety requirements and what not.

As such perhaps only for short distance flights? i.e. 3 hours.

Dual props are also a lot slower.

</comment></comment></comment><comment><USER13> The business model of airlines is to shove as many people as possible into a giant tin can and deliver them from one hub to another. Despite the number of people and high cost of tickets, this alone is not enough to turn a profit, so the hubs are turned into high-priced shopping traps. When fuel prices are low enough, it is enough to keep the airships afloat. But it is a completely backward system of travel, where the actual travel becomes almost a secondary matter. It's all the fanfare and bazaar around it that drives the wasteful economics, and likewise the hate of it.

An efficient and beloved system would turn to smaller planes and point-to- point trips. Smaller planes would allow automobile-like scaling of plane manufacture and point-to-point trips would provide a reduction in fuel costs. But we will never see it, b/c as it turns out, Capitalism is not about efficiency or catering to the common customer. Rather it is about moving around as many bits of currency as fast as possible. The airline industry is one the great examples of this.

<comment><USER14> I'm sympathetic to this sort of critique, but my impression after years of observing this industry is that anything that makes air travel less insane also makes it less affordable, so there is strong pressure toward insanity. It doesn't seem odd that a market for expensive short-term services would be like that, or at least would have a segment like that. After all the utopia you envision exists for those who are willing to spend more, e.g. on fractional ownership.

<comment><USER15> It's absolutely this.

Airline customers care about price above all else. A price differential as low as $5 is enough to get people to switch flights, even if the pricier flight is better. It's utterly cut-throat.

Why do airlines cram people in so tightly you can barely breathe? Because that lets them shave dollars off the ticket price, which attracts customers from anyone who doesn't do this. Given the choice between a cheaper flight that's less comfortable, or one that's $5 more and has more room, people will choose the former.

Why do airlines not serve meals anymore unless they absolutely have to? Well, those meals aren't free. People will choose the meal-less flight for $5 less over the flight with a meal that costs slightly more.

Why does everybody charge for checked luggage now? Because it lets them shave the price of a ticket.

If people wanted comfort, good food, free luggage, and all that, we would have it. But what people want above all else is to pay less.

And actually, airlines have gotten pretty good at segmenting the market, which for their customers (us) means we can pretty much choose our own tradeoff there. You'd rather pay more money for a larger seat? Almost all of them let you do this now. You want a meal during your flight? Just about any suitably- long flight will have meals available for purchase. You want to check bags? Go for it, just pay for it.

I hate getting crammed into tiny airline seats (I'm 6'3" and barely fit) and all the rest... but every time I get on an airplane and pass those better seats, I remember that I'm just voting with my wallet here, and clearly I value the $100 or whatever it is more than the space.

<comment><USER16> > Given the choice between a cheaper flight that's less comfortable, or one > that's $5 more and has more room, people will choose the former.

This is interesting, I travel on a lot of different airlines, and I always go with the lowest-priced feasible option. However, I don't really see it as much of a _choice_ between quality and price.

Why? Because I don't feel like I have any information about the quality of the service or level of comfort before the flight. A lot of the cheaper and mid- range budget airlines are pretty much like-for-like in terms of experience, reviews are always skewed towards the negative and therefore don't contain too much useful information (people very rarely go online to write a good review after a comfortable flight with a cheap airline, but they absolutely do go online to complain and vent when it's uncomfortable) and anyway I don't feel like it's worth the time and effort to dig through reviews and try to find out what exactly my experience will be like on one 3 hour budget flight vs another, considering the amounts involved are not massive. Obviously I do go off my own experience, but even this varies from flight to flight with the same airline.

There's a lot of noise, therefore usually the easiest way to feel like you're getting the best value is simply to spend the lowest amount possible, assuming the experience will not be different enough to make you wish you'd spent more. To be honest, I think this is a decent strategy. It's very rare I've taken a flight and wished I'd spent $20 more on another airline to get a better cheese and crackers and coffee or a slightly more comfortable seat. These aren't differences which really matter in the budget short flights market.

<comment><USER14> This comment starts with the proposition that there is no choice available between price and quality. Then there are numerous anecdotes that reveal a preference for price over quality. b^)

In other words, you appear to be in violent agreement.

<comment><USER17> Well, the solution would be to provide the source of that information that lets you make an informed choice. I, for one, don't really know whether it's worth an extra $5 to fly, say, Delta instead of United from New York to Los Angeles. I don't know where I'd find that information, either.

</comment></comment></comment></comment></comment></comment><comment><USER18> Excellent encapsulation.

I'm far from an expert, and this is pure, naive speculation, but on a philosophical level, I wonder if the issue is that we've not yet _really_ mastered the technology of air travel. By that I mean we seem incapable of building and managing aircraft at a sustainable, "MVP" level, operating on a fuel consumption minimal enough to withstand the vagaries of commodity prices.

Perhaps Boeing and Airbus are overengineering their aircraft and baking in economic rent to a degree that makes the airlines fundamentally incapable of sustaining a profitable business model. Perhaps this industry can't actually survive with current technology and design methods absent some sort of government backstop or subsidy. Not sure. But the supply-side theory of this business seems like the most compelling (if not wholly complete) theory I've heard.

Maybe we need a firm to come along and build the AK-47 or Toyota Prius of commercial aircraft, so to speak: cheap, reliable, efficient, elegantly engineered, and innovative in its use of parts and fuel.

I also wonder if there is a correlation between airline profitability and the airlines using the oldest aircraft. Seems to me (again, naively) that aircraft from back in the day were more purpose-built and simpler, with less complex global supply chains. Sort of a similar situation to the military's concerns about phasing out the old, reliable A-10s and F-16s in favor of the massive, modern boondoggle that is the F-35.

<comment><USER19> > Perhaps Boeing and Airbus are overengineering their aircraft and baking in > economic rent to a degree that makes the airlines fundamentally incapable of > sustaining a profitable business model. Perhaps this industry can't actually > survive with current technology and design methods absent some sort of > government backstop or subsidy. Not sure. But the supply-side theory of this > business seems like the most compelling (if not wholly complete) theory I've > heard.

It sounds like you were never in enigneering. You never had to deal with building reliable system in regards of safety and high availability. And you even don't know what is really happening in that industry.

Just a small example Rollce Royce revolutionized that business years before IT invented the Cloud and XaaS (X as a service). RR is proving flying as a service since years. As an airline, you don't buy an airplane with engines. You as an airline decide and tell either Airbus or Boing what engines you like. Then RR (and others these days) don't sell you the engine. They sell you flight time. So RR is reponsible that the engines runs without downtimes. RR provide service staff at all major and many minor airports to be able to provide service. RR inventend the Internet of Things way before IT came even close to those ideas. Because to be able to sell airtime, RR needs to know about the status and diagnostics of those engines. Competitors to RR are doing the same since years.

Then, a modern aircraft is stuffed with electronics to replace mechanics, like your car. Because mechanics are wheigt. With electronics this weight can be reduced. It also allowed "services" like autonomous flying. Different to the car industry, almost any modern airplane from Airbus and Boing is able to completely fly on its own inclusive take-off and landing. Only taxiing is not possible.

But electronics have to problem of requiring redundancy to build highly available systems and all that with limited ressources. All way before IT has their 99.999 SAL and with much higher rates. We talk in these industries with undetected errors with a probability of 10^-15 and less.</comment></comment>


Show HN: The fastest way to run Node code on a schedule - <AUTHOR> https://pipedream.com/@tod/run-node-code-on-a-schedule-p_LQCBgr/readme <comment><AUTHOR> Two weeks ago we launched Pipedream in beta and it has been great to see the response. In particular, one customer emailed us and said, "Wow! This is definitively the fastest way to run a script on a schedule!"

When you launch a new product it is tempting to list a laundry list of features that you think can address every potential use case. However, it is often better to have a simple value proposition that every developer can understand, relate to and benefit from.

So, now when people ask me what Pipedream is, my shortcut answer is to say it's the fastest way to run a script on a schedule. If they engage, I have an opportunity to share all the other integration capabilities, features and benefits.

As always, we think there's a lot we can improve and are eager for feedback. Also, if you want a specific app or API fully integrated, let us know. You can reach us here or on Github [1], Twitter [2] or Slack [3].

[1] [https://github.com/PipedreamHQ/roadmap](https://github.com/PipedreamHQ/roadmap) [2] [https://twitter.com/PipedreamHQ](https://twitter.com/PipedreamHQ) [3] [https://pipedream.com/community](https://pipedream.com/community)

</comment><comment><USER2> Interesting product but I'm not sure if you currently differentiate enough (for a developer) from what can be created on AWS using a NodeJS Lambda function and a CloudWatch event.

AWS has the advantage of scalability and integration with their suite of other services.

Your product does have the advantage of simplicity and ease of use – but having to use NodeJS for the logic limits your audience to developers who could relatively easily learn AWS approaches.

How would you position Pipedream against building similar integrations using AWS services?

<comment><USER3> Hi, this is Dylan, a co-founder and engineer at Pipedream.

It's a great question. AWS is incredibly powerful (we use it at Pipedream), but we think Pipedream is better optimized for building workflows and integrations between developer apps and SaaS services. The idea is that we'll save you a lot of time creating and managing these integrations.

We're trying to strike that balance of giving devs the control they need without having to worry about the stuff that shouldn't matter when they're building integrations.

A few ways we differentiate specifically from AWS and other cloud platforms for the integration use case:

\- One click "triggers" that enable you to run a workflow on an HTTP request, cron job, or email [1], vs. having to e.g. Terraform a CloudWatch Events schedule or setup an API Gateway / SES email endpoint.

\- You can connect third-party accounts within Pipedream and we manage the OAuth flow, giving you programmatic access to your OAuth access tokens. You can manage API keys in the same way [2]. If you've ever had to manage the OAuth authorization flow yourself, storing refresh tokens and generating access tokens, you know how nice it is not to have to manage.

\- When you just need to checkpoint the items you've previously processed (common when you're pulling data from an API every few minutes), you don't have to store the data in external state. You can use our built-in checkpoint API to store and retrieve basic state [3].

Also, while you _can_ write Node.js code, you don't have to. Many of our users don't know Node, and exclusively use the actions we've added that abstract common operations [4]. As we add more actions, the tool should be more accessible to "no code" workflows and less technical users.

We'd love if you had a few minutes to sign up and use the tool! If there are things you still like about AWS and want that control in Pipedream, that's exactly the kind of feedback that would help. Send me a note anytime:

dylan [at] pipedream [dot] com

[1] [https://docs.pipedream.com/workflows/steps/triggers/](https://docs.pipedream.com/workflows/steps/triggers/)

[2] [https://docs.pipedream.com/connected- accounts/](https://docs.pipedream.com/connected-accounts/)

[3] [https://docs.pipedream.com/workflows/steps/code/#managing- st...](https://docs.pipedream.com/workflows/steps/code/#managing-state)

[4] [https://docs.pipedream.com/workflows/steps/actions/](https://docs.pipedream.com/workflows/steps/actions/)</comment></comment>


Cuba opts Linux for technological independence - <AUTHOR> http://www.juventudrebelde.co.cu/cuba/2008-11-11/cuba-opts-for-linux-to-guarantee-technological-independence/

<comment><USER2> Not unless they're fabbing their own processors they're not.</comment>


Dropgangs, or the future of darknet markets - <AUTHOR> https://opaque.link/post/dropgang/ <comment><USER2> Dead drop based drug distribution doesn't scale to retail levels. It is used in Moscow and I know of people who will order from a dealer, then search the surrounding area and clear out all the drops they find. It works for them, although one questions the sanity of stealing from Russian drug dealers.

For more practical guides on how people who sell drugs avoid the negative repercussions:

• AlpraKing's business guide is hard to beat. [https://archive.is/K7j1U](https://archive.is/K7j1U) (It's a great business guide in general, actually)

• Gary Cooper's Never Get Busted Again and Never Get Raided Again shows practical use of dead drops for dealing.

Busted: [https://m.youtube.com/watch?v=ZyAjLkBCWKI](https://m.youtube.com/watch?v=ZyAjLkBCWKI)

Raided: [https://m.youtube.com/watch?v=ML6VAy_ygVs](https://m.youtube.com/watch?v=ML6VAy_ygVs)

<comment><USER3> some really great links thanks!

 _> although one questions the sanity of stealing from Russian drug dealers._

I'd conjecture that the value of the booty would be quite limited too? (small envelopes not kilograms exchanging hands). A smack-head probably wouldn't care about the risks just as long as they get their next fix?

EDIT: _" 4\. Don't hire people under 30 years old"_ that is great advise. You want Mike Ehrmantraut like characters (from "Better call Saul") ... btw that show was consistently good in OpSec lessons (unlike the parent show "Breaking Bad").

<comment><USER2> Sure, they aren't stealing to supply their own business but to supply their partying. Apparently there's some trick involved in selecting a dealer who offers a variety of options, not just one substance. They cache one or more of each in an area, so you buy a mid size quantity of something and the surrounding block probably has 5x as much plus other things... because the dealers are humans, they develop patterns of drop locations. Once these guys learn the pattern, they know where to look.

The drops get ripped so frequently there is a process for handling a drop that has been unloaded before the customer get there. The customer has to supply pictures of the drop location and the empty drop, then the dealer will send them to another place. Dead drops provide some security, but they're a trade off.

I think the Gary Cooper videos are massively underrated for security principles. He explains how the adversary operates, how they think, and what their capabilities are, then based on that he distills core security strategies to exploit their operational limitations and mitigate their capabilities.

This is really great stuff for understanding how to counteract a threat, how to do proper counterintelligence analysis and apply it for security. The problem is that people see these as "stoner videos" rather than "the design and implementation of counter law enforcement techniques, by a former cop." There is a lot to be learned, both from general security principles (such as compartmentation, cover, and concealment) But also how to analyze an adversary and develop a plan to mitigate their capabilities.

I was going to do a write up them years ago but someone scooped me by seeing my recommendation and then doing a (crappy) writeup before me. Just one of the things that killed my enthusiasm for sharing recommendations. But, I should do a write up. For a counterintelligence analysis they are sublime.

<comment><USER4> > But, I should do a write up.

That would be very useful. Some people love videos. I don't. I'd rather read something that's concise and organized.

</comment></comment></comment></comment><comment><USER5> Dead drops can't compete with USPS. They require a court order to open your package and even then can't charge anyone with possession. All they do is send you a "love letter" and people have reported receiving future packages just fine.

Millions of people use dark net marketplaces. The war on drugs has fueled their growth and more serious crimes like identity theft have benefited from it.

<comment><USER6> The war on drug has to be one of the top contributors and financiers of crime and criminal gangs.

Imagine a world where criminal gangs don't have access to the money they make through drugs and a government that doesn't have to spend huge amount of money on drug laws enforcement because drug trafficking would be much less lucrative in the existence of legal access and you get fewer and very cash-strapped drug gangs, and government making money from taxing drugs.

Surely such massive savings and earnings can be spent to help problem users and reduce violence, no?

<comment><USER7> The war on drugs is also a big contributor to the LEGAL gangs such as police,distric attornies, defence attorneys, prison officials and worst of all judges. Definitely an industrial economic complex similar to the Military Industrial Complex.

<comment><USER8> >The war on drugs is also a big contributor to the LEGAL gangs such as police,distric attornies, defence attorneys, prison officials and worst of all judges.

I agree with your sentiment but I find it odd that you think judges are the worst. Of all the people in the system judges are probably the least worst because they don't have as many incentives to do things that are bad for society but good for them personally the way all the other actors do (i.e. they do not directly benefit from the war on drugs).

<comment><USER7> Based on your measure of what makes them "most or least worst" you may be correct, but I disagree with the premise that whether or not their motives are virtuous makes a difference. The fact is judges rule over the system and that in itself make them the worst of the bunch, and actually the fact that they have less incentives yet continue to enable such a broken system to hurt people might be the best reason they are the worst.

<comment><USER8> They don't have the incentive to ruin people's lives to game their performance metrics (like prosecutors do). They don't have incentive to make much to do over nothing to justify their budget (like cops do). They don't have incentive to keep people in the system as long as possible to milk money from them and the state (like the prison system does). They don't have incentive to perpetuate the war on drugs to sell crap we don't need like tasers (police abuse them) and post-release monitoring (an overpriced joke that plays fast and loose with people's lives).

The bad incentive for judges seems to be that most of them have a desire to not rock the boat too much which is pretty benign compared to all the other actors who go out of their way to perpetuate and further the status quo because they materially benefit from it.

I find it hard to fault the judges for apathetically presiding over a flawed system when every other group you mentioned is doubling down to further that system.

<comment><USER7> I would concede that your arguments are all valid, unfortunately if we look at where most judges were employed before becoming judges the majority were the best-worst of the people in "every other group I mentioned". I think we will have to agree to disagree on this one, but I do appreciate your well thought out argument.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Very interesting reading the obstacles faced by the black market drug trade and how they're overcoming them. It seems like the producer layer is most susceptible to penetration as it is essentially identical to most gangs. It's entirely glossed over here but procuring the product seems like a difficult problem for an anonymized distributor: How do you make sure the product gets to your support layers?

As interesting as it all is, it's also very concerning for Law Enforcement. While petty things like drugs don't really worry me much, the advances in the anonymized distributed networks like this do mean that things that previously required big budgets of national intelligence agencies become easier for common malcontents to use. The article essentially describes a quintessential terror cell structure, but with the added benefit of 0 direct interaction. The separation of layers has always existed with limits (IE you had to have some form of communication) but this potentially allows for goods and services to easily be passed from fully anonymized layers to others without every having any interaction at all.

<comment><USER10> Since you are primed on the question. You should read Rainbows End by Vernor Vinge. It's a near-future sci-fi book that tackles these sorts of questions.

As a bit of a "spoiler" his solution is a covenant with the citizens. The government will hack all of our computers, will own the IME equivalents of every machine, and in return they will only use this power to hunt down terrorists and mass murderers, people who are looking to leverage technology to build nuclear weapons, bio-weapons, etc.

Things like parallel construction would have to stop though. Or be considered an immediate dismissal.

<comment><USER11> How could the citizens trust the government to do only that?

<comment><USER12> A strong judiciary, high bar to change the law, and harsh accountability.

Still a fine line to walk.

<comment><USER13> People from more or less politically stable countries like the US are very naive in not considering what can happen to the best of governments overnight.

People from Europe have this sort of... experience. Most of us know that trusting the government with our lives is not a good idea.

<comment><USER14> > People from more or less politically stable countries like the US

I would have agreed with that assessment in the past but in the present I really can't.

<comment><USER13> Come on, if your country can handle _this_ president without collapsing immediately, your political system is really well designed!

<comment><USER14> Shall we wait until it is over before drawing conclusions? It's already gone downhill a lot further than I would have expected, the degree to which people are apparently willing to enable all this is f'ing scary.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> It's cool to see serious tradecraft applied to this stuff. Especially compartmentalization.

And yes, using traditional shipping systems is a serious problem for old- school dark markets. I've thought off and on for several years about the potential for using dead drops with accurate GPS. I mean, geocaching. Many years ago, when I was dealing LSD, it was pretty common to use dead drops. But then, they were typically rental lockers in bus and train stations.

I agree that ubiquitous surveillance is a problem. However, it's ~clueless customers and low-level distributors who'll most likely get pwned. And they won't know anything important about the operation overall.

Anyway, time will tell.

<comment><USER15> > However, it's ~clueless customers and low-level distributors who'll most > likely get pwned.

INTERPOL has made some large busts in the past, but afaik it always has come down to failure to maintain proper OPSEC.

There's also the issue of possible directives in the future to prosecute customers en masse after major domestic busts using backlogged USPS analytics. As traffic obfuscation methods continuously improve, the economics of such directives will begin to look more and more reasonable when the goal is not to stop trade directly, but by establishing fear with precedent.

The problem with dead drops is that on a large scale where the level of trust is sufficiently low, it inevitably requires an escrow and resolution system with human moderation. And then you've just centralized trust instead of circumventing it. Dropgangs in the form described by the article do not provide the full package.

The article itself claims dropgangs and off-market platforms are the future and then goes on to state:

> Cryptocurrencies are still the main means of payment, but due to the higher > customer-binding, and vetting process by the merchant, escrows are seldom > employed. Usually only multi-party transactions between customer and > merchant are established, and often not even that.

The author doesn't seem to make the connection that higher levels of trust means less scalability. The success of these platforms however is directly related to their scalability. Yes, this is a dangerous, criminal activity for both parties and I definitely do not appreciate the explosion in popularity of these kinds of markets. I have seen regular people get serious federal prison time due to the Dunning-Kruger effect.

The barrier for entry is much higher for new distributors as well, because A) at this membrane exists highest ratio of undercover law enforcement and B) establishing initial trust is key to something like dead drops, which typically will involve high-dollar, distributor-to-distributor transactions. Open markets help to facilitate initial trust-building by providing a trustworthy platform.

<comment><USER4> Well, they could end the drug war, and then crime wouldn't be an issue.

<comment><USER15> That would also fix a cascade of other major global issues.

</comment></comment></comment></comment><comment><USER16> > _"The Silk Road" was the first of a phenomenon that became widely known: > Darknet Markets._

The history is way off here, Silk Road was one of the first two completely public darknet markets (the other being the short-lived Open Vendor Database) but there were private darknet markets long before, e.g. The Farmer's Market.

> _Use of the Internet to facilitate the marketing and sales of physical goods > - drugs, weapons, false identification papers - began latest in the late > 1990s, but usually focused on local geographic markets in major cities. This > was due to the fact that payment and delivery still required in person > meetings._

Not so, back then and still to this day drug dealers simply throw a stack of cash in the mail. The clearnet markets for "research chemicals" all operated this way and went basically unchecked until Operation Web Tryp in 2004, which began an era of harsher enforcement of the Federal Analogue Act.

<comment><USER4> Well, it was Adamflowers "long before".

And its OPSEC was over-the-top lame. I mean, Hushmail?

But then, DPR was also very sloppy.

<comment><USER17> If you really look at how the big names have gotten busted, you will see that their opsec is bad with no exceptions. Apparently people that actually know the craft don't see enough upside to running a marketplace like that, which should make you wonder about the ones that still exist.

<comment><USER4> Yes, indeed. I did look, rather carefully, a couple years ago. And OPSEC failure (sometimes spectacular) explained all of the the major busts that were widely reported.[0]

However, I did not research criminal court records. Accessing that data is nontrivial, especially for someone using a pseudonym, who can't show up physically, has no ID, and can't pay with a mainstream credit/debit card. Few, if any, courts accept Bitcoin etc.

Also, I made no effort to check for parallel construction, except by looking for inconsistencies among published accounts of investigations. And I do understand that the US DEA's Special Operations Division (SOD) funnels information from the NSA, CIA, etc to federal investigators.[1] With the understanding that "the utilization of SOD cannot be revealed or discussed in any investigative function".[2] And that includes outright perjury, if necessary. Just as we've seen regarding the use of Stinger intercepts.

It's hard to say whether people who know tradecraft well just prudently avoid running dark markets, as you say. Or whether they do, but don't get caught. Time will tell, I guess. At least, if remaining ones _do_ get busted. But if they don't, there's the implication that the operators practice good OPSEC. Or, that they're honeypots ;)

0) [https://www.ivpn.net/privacy-guides/online-privacy- through-o...](https://www.ivpn.net/privacy-guides/online-privacy-through- opsec-and-compartmentalization-part-2)

1) [https://www.deamuseum.org/wp- content/uploads/2015/08/042215-...](https://www.deamuseum.org/wp- content/uploads/2015/08/042215-DEAMuseum-LectureSeries-MLS-SOD-transcript.pdf)

2) [http://www.reuters.com/article/us-dea-sod- idUSBRE97409R20130...](http://www.reuters.com/article/us-dea-sod- idUSBRE97409R20130805)

</comment></comment></comment></comment><comment><USER18> Few years ago it was revealed USPS was photographing all senders and recipient addresses on all mail in order to 'backtrack' packages in order to aid in investigations.

[https://www.offthegridnews.com/privacy/vast-postal- surveilla...](https://www.offthegridnews.com/privacy/vast-postal-surveillance- system-tracking-mail/)

<comment><USER18> more:

[http://www.washingtonpost.com/wp- dyn/content/article/2008/02...](http://www.washingtonpost.com/wp- dyn/content/article/2008/02/17/AR2008021701801.html?hpid=sec- tech&noredirect=on)

<comment><USER18> [https://en.wikipedia.org/wiki/Mail_cover](https://en.wikipedia.org/wiki/Mail_cover)

<comment><USER18> [https://en.wikipedia.org/wiki/Mail_Isolation_Control_and_Tra...](https://en.wikipedia.org/wiki/Mail_Isolation_Control_and_Tracking)

</comment></comment></comment></comment><comment><USER19> How do you defend against the eye in the sky, video surveillance or location tracking ? There seems to be conflicting objectives. When hiding an object you don't want too many people around to see where you hide it. Yet if you record only two person going to exactly the same non standard spot it's pretty much a red flag, then you follow the person in the recording to identify them. Most buildings are probably not valid because they can't be entered easily by both parties.

<comment><USER20> Yeah, it's a great story, but machine vision + machine learning + surveillance could pull the rug out from the dropgangs market in a second.

But really, other than this fatal flaw, it's a great narrative of the internet spilling into and interfacing with analog markets

<comment><USER21> It's not a fatal flaw, unless they choose a location with police surveillance, but why would they?

<comment><USER20> Taking a guess: ML is just too good. Don't forget, it's also a signal to leave surveillance areas, eg "last seen driving into the desert". Any kind of outlier behavior is PART of the detection model ... that's where probabilistic models gain leverage, in fact ...

<comment><USER22> I think if "he left surveilled areas for no registered reason" is something that law enforcement observes and considers evidence of criminal activity, we'll have well and truly lost any semblance of being a free society.

<comment><USER20> "Parallel Construction" ... yep, sad times [https://en.wikipedia.org/wiki/Parallel_construction](https://en.wikipedia.org/wiki/Parallel_construction)

<comment><USER23> I don't see how parallel construction applies here.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Using telegram for communications with customers also allowed marketing to escape darknet forums and into the walls of public places. Normal people don't even need to know about darknet to buy drugs and what those @usernames on walls are is becoming common knowledge.

</comment><comment><USER24> The biggest flaw here is the dead drop system. It doesn't scale well and involves many more complex steps and people in the system.

For example, a drone on surveillance duty that continuously watches the area will be able to identify patterns and pick out possible outliers. Combined that video feed with machine learning and it may be possible actively identify dead drop participants.

<comment><USER25> If the system becomes that large and profitable, those surveillance drones are going to end up mounted on plaques like big game trophies.

</comment></comment><comment><USER26> Anonymous, decentralized transactions using dead drops only works with side- channels for reputation, or with security deposits.

Side-channels for reputation like posting cryptographic proof on darknet forums isn't scalable or reliable.

And security deposits without a third-party adjudicator just move the trust issue around without eliminating it.

One ideal solution could be a cryptocurrency with on-chain confirmation of the real-world transaction by both parties after the fact.

When both parties to the transaction can point to a series of successful transactions through a web of trust, then the central marketplace for reputation or escrow is no longer needed.

<comment><USER27> > One ideal solution could be a cryptocurrency with on-chain confirmation of > the real-world transaction by both parties after the fact.

How do you prevent merchants from just creating a thousand fake transactions to make them look reputable?

<comment><USER26> This is where the web of trust comes in.

You give the greatest trust to reviews provided by the anonymous identities you have transacted with.

You give progressively less trust to reviews by identities 1, 2, ..., _n_ hops away from those you have transacted with.

If a merchant creates 1000 sock-puppet consumers, they won't be reachable from your trust network, so you'll give them little if any weight.

<comment><USER27> > You give the greatest trust to reviews provided by the anonymous identities > you have transacted with.

I don't quite follow. Consumers deal with merchants. Consumers give reviews to merchants. So the anonymous identities you mention will be customers that I don't know. Merchants won't review each other, I presume.

In other words, as I understand it, the "anonymous identities I've transacted with" will be merchants, who don't review other merchants.

> If a merchant creates 1000 sock-puppet consumers, they won't be reachable > from your trust network, so you'll give them little if any weight.

What if do a successful deal with this merchant? Will I then trust that all those 1000 fake transactions took place? And will the people who trust me also believe that?

</comment></comment></comment></comment><comment><USER28> I wonder if dark web markets will ever establish a comprehensive alternative parcel system... that seems like the natural, final extension of these ideas. The technical challenges to this would of course be significant (I'll refrain from listing them and suggesting potential workarounds since I don't really want to give anybody any specific ideas on this LOL)

<comment><USER29> There are quite a few holes in the scheme as outlined in the article. The author asserts that dead drops are better than post office boxes because they're harder to surveil, but what keeps law enforcement from signing up their own personnel as distributors? Then it's just a matter of staking out their own dead drop and arresting whoever shows up. This is why the first rule of opsec has always been, "Involve as few people as possible." You can't improve security by adding more people to the loop.

The best way to do this is probably for the 'salesperson' to drive to an isolated area and chuck packages into the bushes at random intervals. The packages then send their GPS locations to a LoRaWAN gateway somewhere, to which their buyers have been sold access tokens. LE can still infiltrate the organization in the sales role, but with more difficulty. Adding an extra distribution layer with fixed dead-drop locations just seems pointless.

<comment><USER30> It's not just the cops that will be surveilling a dead drop.

You don't think a heroin addict who couldn't come up with the money for their next buy isn't going to go check every dead drop they ever bought at on the off chance that there is something there?

I mean, just thinking of the old espionage meaning of dead drop, if you have dead drops or safe houses or secret meeting locations that you could only use once a year, to avoid patterns, then researching them would become tremendously expensive. A full time job, really, probably for several people (and someone in logistics managing them all). I can't see how that'd be much different for criminals, and how do you make a profit at that? At least in the espionage case, you would have been State sponsored. You don't have to make money.

<comment><USER31> great observations. but as for "how do you make a profit at that?" I'm pretty sure it gets priced into the (expensive) product. That premium might be too high for retail, then this gets used for lower frequency, higher quantity and higher trust transactions.

</comment></comment></comment></comment><comment><USER32> The elephant in the room that this article highlights, but never addresses.

A mobile phone has become a de facto a requirement for illegal commerce, as described, and to me presents a pretty huge single point of failure.

And yes, I know, EVERYBODY has a phone. But I don't. Why would I want to carry a police officer in my pocket? Especially if I'm a criminal.

<comment><USER33> That's why you'd use a burner.

<comment><USER34> Depending on your adversary, you need to be super careful to not make the single mistake that'll blow your cover there. If that burner ever gets switched on or off at your home, or if it only ever gets switched on/off at the same location as a phone registered in your name, or if it commonly travels exactly the same route as your phone...

I'm guessing "they" won't go to those sort of investigative lengths for theoretical retail customers of a theoretical Dropgang. I'd expect a vendor to be targeted using those sorts of techniques though.

And none of that data ever goes away... Who knows what law enforcement might choose to do with those sorts of leads in the future?

<comment><USER33> If you're sufficiently paranoid just use a new phone for every single call.

</comment></comment></comment></comment><comment><USER35> Kind of interesting distribution is kind of like darknet geocaching. I wonder how much accidental discovery occurs.

<comment><USER36> The other issue I see is at some point, all secret hiding spaces will be used. For a consumer, checking previous drop locations may result in finding free goods.

<comment><USER37> If this becomes big business then every retail store will start providing airport locker type storage.

<comment><USER38> In a known, easily watched location?

Did you read the article?

</comment></comment></comment></comment><comment><USER39> Excellent summary. I'm reminded of the old saw, "The future is already here, it's just not evenly distributed".

<comment><USER34> "Old saw"? I remember that quote being new, it's not _that_ old...

<google google google>

It's from 2003.

[https://www.goodreads.com/quotes/681-the-future-is- already-h...](https://www.goodreads.com/quotes/681-the-future-is-already-here- it-s-just-not-evenly)

<comment><USER30> Sit down. You're not going to like what I'm about to say. This is going to start happening to you (us, really) more and more. Things that happened in the 00's happened a 'long time ago' to a larger and larger group of loud people with Internet access. People who can drink legally were born in '98\. What's up with that shit?

[https://en.wikiquote.org/wiki/William_Gibson#Quotes](https://en.wikiquote.org/wiki/William_Gibson#Quotes) has a citation for him saying it in '99 and an unsupported assertion that it might have been said in '93\. I've been hearing this long enough that I believe the '99 date, but I'm skeptical about '93.

<comment><USER34> Yeah yeah. I know...

And I would have gotten away with it too, if it weren't for you meddling kids and your damned dog...

\-- Old Man Big from The Haunted Amusement Park

</comment></comment></comment></comment><comment><USER40> Dead drops sounds like an awful way to distribute anything at scale. The loss from other people finding stuff seems enormous also.

<comment><USER34> So long as there's sufficient profit margin to allow for an acceptable "shrinkage", it just becomes a cost of doing business. The benefits in terms of privacy/security for the typical darknet vendor probably make it well worth low double digit percentage losses, given the assumed margins from source to end user...

<comment><USER40> I don't know how secure it is when a cop sees you drop a bag of heroin behind a bench instead of just shipping people stuff.

<comment><USER41> They wouldn't drop at a public bench with people around

</comment></comment></comment></comment><comment><USER42> Once again, I'm completely surprised how behind is western dark market world compared to Russia in that regard. Tor-based marketplaces with dead drops in parks and around the city have been around since 2013 and are now the only practical way to buy any drugs. Telegram channels have been widely used since at least 2015. Any city park has police squads patrolling the exits at night - they search people, open up your phone and look up Telegram and Tor apps if they suspect you've gone there to get a drop. Drops (they're actually called "buried treasure", or "klad" here) moved from parks to the city - you get instructions, for example, to go to some floor of a random apartment building, stop the elevator and search for a magnet-attached package behind it's doors.

I don't think that this article doesn't do a good job on the risk model because it doesn't understand how law enforcement operates - at least in Russia, the picture is completely different. Law enforcement has KPIs to catch some amount of drug dealers and users, and they have developed ways to do this reliably. So, instead of intercepting communication between the drug sellers and drug buyers, they prefer to work together with sellers (taking considerate money for 'protection') and arrest some proportion of buyers when they go for the drop.

<comment><USER43> Thank you for this valuable comment. It is highly likely that police would go for the lower hanging fruit of buyers instead of sellers in a system so opaque and decentralized. The old thinking of "what could happen, they only want the big guys anyway" should have no place in OpSec. And when information on these networks is so hard to come by to begin with, a buyer being busted is very desirable. The way I see this "evolution" of the dark markets, is that it mostly protects vendors while inconveniencing and endangering buyers.

<comment><USER42> It's always been like that here - the police departments that were supposed to fight drug trade basically overtook it. So why would they arrest their own employees when they can close their quota with drug users instead?

</comment></comment></comment><comment><USER44> Russian darkmarkets started using dead drops years ago if I recall correctly

</comment><comment><USER45> _The current method of reporting sales experience on forums is open to spamming and manipulation since it is hard to show that a deal even took place._

 _It is likely that forums and merchants develop best practices to solve this problem. There is the potential that merchants will start to issue "proofs of sale" in a cryptographic form, that customers then use to make statements about the performance of the merchant in public forums._

Could a blockchain or some other kind of public ledger be used to create a public sales rating record? I don't see how such a thing can respond to spamming and deliberate manipulation, however.

Another thought I just had: could some combination of drones and self driving cars revolutionize dead drops?

<comment><USER46> Yeah, and you can at least sort of solve the manipulation issue by weighting ratings based on "bitcoin days" of the address making the review.

(Number of bitcoin on the address times time it's been there.)

</comment></comment><comment><USER7> My biggest problem with using the Darknet, messaging apps, or old school methods such as dial a dope or hitting up the guy on the street corner to buy drugs is the same. How can I really trust someone willing to break the rules and sell drugs or other non legal goods? You lay down with dogs you get fleas!! Last thing I would want is to eat, smoke or snort something from someone I have never met even if they have a 5 star rating on a darknet review board. Don't even get me started on messaging out to someone whos' contact info is written out next to a pay phone or on a bathroom wall and the likes!

<comment><USER47> If something is illegal, it does not follow that it is also immoral. You may actually deal with a very moral person.

<comment><USER48> If something is illegal, it operates outside of the law and therefore lacks the normal protections which the law affords consumers. It has nothing to do with morality.

</comment></comment></comment><comment><USER49> My vision was distorted for full 30 seconds after reading this page.

<comment><USER50> Yeah. High contrast is only good for people with serious vision problems.

Awful to read.

</comment></comment><comment><USER51> Pokemon Blow!

</comment><comment><USER52> Been a big fan of this author since the cypherpunk podcast, strange to see "smuggler" reveal his real (?) name.

<comment><AUTHOR> Could you please link the podcast?

</comment></comment><comment><USER53> Is this how people will deal food during a food scarcity in a previously developed society?

</comment><comment><USER54> When Pokemon Go hit, it was impossible not to notice in public. Just a thought.

</comment><comment><USER55> Yes, I am also quite impressed at the amount of thought that has been put into this concept. I would be quite interested in helping in designing these systems, as I have been following some of the necessary technologies for years. Jim

I foresee a stiff plastic or metal pipe, tapered to a point at one end, which can be driven by force into soil or into a lawn, so that it ends up to be approximately flush with the plane of the soil. Once placed, a smaller cylindrical container, as well as active elements, if needed, can be slid into the metal pipe, from above.

From the linked article: [https://opaque.link/post/dropgang/](https://opaque.link/post/dropgang/)

"This challenge is met by Dropgangs in various ways. The primary one is that the documentation of each dead drop is conducted in minute detail, covering GPS coordinates, photos of the surrounding and the location, as well as photos of the concealment device in which the product is hidden (such as an empty coke can). The documentation however increases the risk for the Dropgang since whoever creates it would be more easy to identify by surveillance. In addition, even great documentation still requires the customer to understand it and follow it precisely, which can lead to suspicious behavior around the dead drop location (staring at photos, visually comparing them to the surrounding, etc)." [end of partial quote]

Ordinarily, smartphones that use GPS, don't use accurizing features, such as WAAS. (Wide Area Augmentation System).

See [https://en.wikipedia.org/wiki/Wide_Area_Augmentation_System](https://en.wikipedia.org/wiki/Wide_Area_Augmentation_System)

WAAS correction data is probably already available on the Internet. "Accuracy[edit] The WAAS specification requires it to provide a position accuracy of 7.6 metres (25 ft) or less (for both lateral and vertical measurements), at least 95% of the time.[2] Actual performance measurements of the system at specific locations have shown it typically provides better than 1.0 metre (3 ft 3 in) laterally and 1.5 metres (4 ft 11 in) vertically throughout most of the contiguous United States and large parts of Canada and Alaska.[3] With these results, WAAS is capable of achieving the required Category I precision approach accuracy of 16 metres (52 ft) laterally and 4.0 metres (13.1 ft) vertically. [end of partial quote]

WAAS might be described as a form of differential GPS. If the location as computed by the smartphone was improved by WAAS, the statement above indicates an accuracy within about 1 meter.

IR-specific retroreflectors to greatly simplify things.

The article describes complicated systems using Bluetooth or WiFi to help locate these dead-drops. While they are certainly innovative, they add cost and complexity to the hardware involved. I have thought of a much-cheaper system that I feel is sufficiently secure and simple for common use.

Light-retroreflectors are commonly made from Scotchlite [https://en.wikipedia.org/wiki/Retroreflective_sheeting](https://en.wikipedia.org/wiki/Retroreflective_sheeting) or plastic molded corner-cubes. If a rather small (say, 1/4 in diameter) sphere covered with retroreflector material was held up from the insert, possibly by a short, thin stiff wire, the sphere could be visible, but not excessively obvious even during the daylight. It would be easy to find this device with a flashlight in the dark. For added security, an infrared- transmitting plastic (such as is often used to cover IR-activating remote controls, such as [https://www.eplastics.com/plexiglass/acrylic-sheets/ir- trans...](https://www.eplastics.com/plexiglass/acrylic-sheets/ir-transmitting) ) could be used to ensure that only IR is retroreflected back to a searcher.

Ordinary smart-phone camera arrays are not only sensitive to human-visible light (generally described as 400-700 nanometer wavelength), but are also sensitive to near-IR wavelengths. If a smartphone camera was combined with a directional IR LED, substituting for the white light LED lamp used for photography, and aiming in the same direction, a user would be able to see (through the camera display) the IR-specific reflections from an IR-limited retroreflector, and this would probably be doable both during the day and at night. A person operating such a camera would "look like" he was doing photography, or perhaps playing a game. Somebody watching, even at night, could not see the IR. The IR 'searchlight' could be a narrow-beam device, perhaps with a full-angle of 16 degrees or so (typical for a narrow-beam IR LED), so it wouldn't be particularly obvious even if watched through an IR viewer. (If the IR LED itself was shielded from direct view.)

One advantage of this technique is that the searcher could identify the target from a very long distance away, perhaps many tens of meters, and thus approach it in a more "innocent" fashion. No obvious "searching" would have to be performed in the open. And, the person who placed the dead drop could ascertain its status without later needing to approach it closely.

This technique could be combined with Bluetooth or WiFi techniques, too. The retroreflector could normally be retracted, and only raised if the proper Bluetooth or WiFi signal was heard. Or, perhaps, the target would contain an exposed IR LED, which would activate from an battery only if the proper signals were heard. The resulting dead-drop would be virtually impossible to find.

<comment><USER4> Back in the 60s, we just buried the main stash in the garden, behind the house. Nothing fancy, just a large paint can. We did get busted once, but they only found a little of this and that.

I've played some with geocaching, and it's amazingly hard to find something buried, with no data except GPS. Phones are useless for that. And they're also a security nightmare, being basically tracking devices.

So you use a dedicated GPS device, which doesn't transmit. But even with them, you need to average for maybe 10-20 minutes to get WAAS-level accuracy.

I like the IR retroreflector idea. And retractable! It'd be a little stationary robot. And for a cover story, have Pokémon Go installed.

</comment></comment><comment><USER55> This system has problems deleting messages.

<comment><USER4> There's a 10-20 minute window for deleting messages. And then a ~1 hour window for editing them. So if you miss the delete window, you can just edit to "[post deleted]".

But maybe there's some minimum karma needed. I don't remember.

Edit: OK, 20-30 minute window for deleting.

</comment></comment><comment><USER56> Dark Drones!

</comment><comment><USER57> From what I know about drug users' level of motivation I'd say the dealers will regret using dead drops quickly...

</comment><comment><USER58> > "What is illegal and unethical trade for one is perfectly legal for another"

What in the world does that mean? There's only one rule of law.

<comment><USER59> That might be true for one specific country/state. But different countries have different laws.

</comment></comment><comment><USER60> "What is illegal and unethical trade for one is perfectly legal for another. Judge for yourself."

Is it just me, or is this statement just plain incorrect?

<comment><USER61> Jurisdiction.

</comment></comment><comment><USER62> A very long article with the only takeaway being... a better use of dead drops? Am I missing something bigger here?</comment>


My Favorite Start-up Chile Companies - <AUTHOR> http://naysawn.com/my-favorite-start-up-chile-companies/

<comment><USER4> why does art sumo work with a single piece of art a month? [from the site <http://www.artsumo.com/> it seems that they send you a picture of one piece of art per month, which you can buy]

that seems like it's modeled on companies that sell socks, or nappies (diapers), or the like. but you (i? everyone?) don't buy art like that. it's not a regular purchase, and you need to look through a lot of examples to find something you really like.

am i completely mis-understanding how people buy art in the states? (i'm not bullshitting here - about half the art we own was bought over the internet, most recently from <http://puntoarte.cl/>, so i would have thought i am - apart from location - the target demographic).

maybe it's more like small impulse buys? what prices?

(incidentally, i don't claim puntoarte is a great place for art - i think you could improve it significantly with curation - but that doesn't alter the basic argument, i hope)

<comment><AUTHOR> Hey Andrew - Art Sumo works by sending out weekly emails of original art from around the world. You can purchase the painting contained in the email if you get to it first.

About the question of why this format, we decided to go with this to 1 - <USER2> people passively stay connected with art from different cultures and 2 - <USER3> create a sense of excitement to see each painting 3 - it replicates a gallery experience more closely where you examine paintings in this manner and 4 - when the paintings are directly marketed like this, the paintings sell.

Sure others are selling socks and diapers in this manner (via regular updates groupon style) as well. You can also buy those products using different channels as well (like art).

<comment><USER4> ah, thanks. with "get it first", things makes more sense (i was assuming people had different offers and you somehow rotated though a set, but with your approach i guess you can focus on more attractive pieces and set higher values).

</comment></comment></comment><comment><USER5> Any thoughts on how startup Chile compares to traditional Silicon Valley incubators? Obviously, they don't take equity and have a focus on contributing to the entrepreneurial community.

A good friend of mine just flew down to Santiago for Startup Chile. He's definitely enjoying it, but before he left he was concerned that getting out of the US entrepreneurship scene might make it harder to reach US consumers and get relationships with investors. On the flipside, S.C. seems focused on creating an international community of entrepreneurs - I'm told there's teams from 33 countries.

It'll be interesting to see how many of these teams will end up in YC.

<comment><AUTHOR> I think Startup Chile is very different from traditional Silicon Valley incubators.

From what I understand, traditional incubators are focused on getting you mentored and funded. In start up chile, you're pretty much left to your own to decide what is best for you. If you are seeking to build a billion dollar company, it probably isn't the best fit. If on the other hand, you are seeking to build a life-style business and you wouldn't mind a bit of an adventure, it's a great option. There certainly is less social pressure in Santiago as tech is still very new there and expectations on your success are much lower. This can be good or bad depending on what you are seeking.

</comment></comment><comment><USER6> The ZBoard idea blows my mind, such a simple idea I can't believe wasn't created before now. Nicely done.

<comment><USER7> YC S12 company Boosted Boards (<http://www.boostedboards.com/>) is a similar concept. Boosted Boards appear to be more powerful, but they are also significantly more expensive and they are remote-controlled instead of weight- sensing.

</comment></comment><comment><USER8> Thanks for the write-up Naysawn! It was great to meet you in Santiago.</comment>


IRobot Files Patent for Robotic Fabricator: a 3D Printer that Needs No Humans - <AUTHOR> http://3dgeeks.com/news_story/irobot_files_patent_for_robotic_fabricator_a_3d_printer_that_needs_no_humans.html

<comment><USER2> When does this stop being an "invention" and just starts being a regular robotic workcell with a plastic extruder head among its other interchangeable tool heads?

<comment><AUTHOR> I'm with you on that. I mean, I can see why it needs to be patented, but I bet many places will get around the Patent somehow and make their own robots.</comment></comment>


Show HN: Faster access to Google hangouts - <AUTHOR> http://hang0ut.com/

<comment><USER2> [http://plus.google.com/hangouts/_](http://plus.google.com/hangouts/_)

<comment><USER3> Exactly. And for those of us with multiple accounts:

First Id: [https://plus.google.com](https://plus.google.com) Second Id: [https://plus.google.com/u/1/](https://plus.google.com/u/1/) Third Id: [https://plus.google.com/u/2/](https://plus.google.com/u/2/) ...etc

</comment></comment><comment><USER4> If you want a permanent, unique, hangout URL, set up a Google+ event which finishes in 100 years and make Hangout the location. Voila - the hangout URL persists even if no-one's in it.

</comment><comment><USER5> I think this works better for me:

[http://hangouts.google.com/start](http://hangouts.google.com/start)

It is better for me because, now that I've visited the URL, if I start typing 'hangout' in the address bar, this comes up first for me and I just hit enter (and it's easy to remember). It's the little things.

</comment><comment><USER6> [https://plus.google.com/hangouts/_/meet/](https://plus.google.com/hangouts/_/meet/)

<comment><AUTHOR> It does not work: That links let's you open the google hangouts application, however it does not work when you want to invite people. Check that after opening the application, the link to invite other people is set to [https://plus.google.com/hangouts/_/meet/](https://plus.google.com/hangouts/_/meet/). If you send the link to somebody else it will try to create a new hangout (that will have the exact same issue).

<comment><USER7> Just go to [https://plus.google.com/hangouts/_](https://plus.google.com/hangouts/_) \-- It'll generate a new one and take you to it. I have this bookmarked on my address book too so it's just one click to make a new hangout.

<comment><AUTHOR> Thanks! This link works fine. I was not aware of it existence. I has a too long URI but it is way better than having to go to google plus and go to the the bottom right corner so that start a hangout button appears.

I am going to replace my Start button created by hangouts js library with a link to this URI.

EDIT: I just replaced the google hangout button created via js with google's framework by a direct link :).

</comment></comment></comment></comment><comment><USER8> Nice, it amazes me how difficult it is to start a Hangout.

<comment><USER9> I, too, am constantly amazed at the fact that there are so many different paths through the G+ UI for creating hangouts, and that they all seem to produce different, weirdly incompatible results that affect whether or not your intended recipient is actually going to be able to see/use the invitation. It is utterly bizarre that my company uses hangouts every single day, but we are reduced to: 1) hitting "refresh" on the browser in hopes of updating things so we see the invitation, and 2) saying "i sent it...do you see it? I'll try sending it again" ad infinitum. It's the 2014 version of "can you hear me now?" and google should be really, _really_ embarrassed about it.

<comment><USER10> Same experience here. It is always a nightmare using it with everyone having to do weird things like go to every else's G+ page and click hi and weird stuff...

</comment></comment></comment><comment><USER11> I don't understand, how is this faster? There is nothing on the page but a button that says Start. When I click it, it takes me to [https://plus.google.com/hangouts/_](https://plus.google.com/hangouts/_) which then redirects to a page that says "Please wait" for about 5 seconds. After than I get another redirect to a google page asking me to install a plugin. Why do I need a plugin to use Hangouts? At the moment I just open my Gmail tab. What problem exactly are you trying to solve here?

<comment> K-Wall What I don't understand is why this got voted up. It is webpage with a link.

<comment><AUTHOR> Probably because many of us had the same issue: no easy way to create google hangout with a link to share where anybody can join. After creating the page with the google hangout api somebody mentioned a link to resolve the issue I/we had. Since it is very likely that many do not know about the link or do not want to learn it, I think the webpage is useful. It is something very simple and stupid, but it is useful enought, at least for me.

</comment></comment></comment><comment><USER12> It works really well on Chrome. Sadly, it does not work on Firefox.

<comment><USER13> Not working for me either. All I can see is the image and some text but nothing happens. Firefox 30 on Ubuntu 14.04

<comment><AUTHOR> Strange. It is working fine on my linux, mac and windows pcs with Firefox 30. I don't think it is my code since it is really simple (10 lines of html and some css). It might be an issue google platform.js.

</comment></comment></comment><comment><USER14> The Hangouts UI is a disgrace to Google. I can't count the # of times I've tried to get even technical people to join a Hangout and it took an extra 5-10 minutes to sort out. Finding the initiation button is horribly hard, the UI is clumsy and unintuitive for those used to Skype or other video calling tools, and even inviting a new person to a hangout is maddeningly hard, particularly if they've got multiple Google IDs.

<comment> vertex-four Luckily, Hangouts is no longer the only usable vidchat system out there. There's also things like vLine[0] which I use to chat with loved ones, and numerous other services. It doesn't even require a login. WebRTC is awesome.

Apparently it's possible to do screen-sharing over WebRTC with a Chrome extension as well (and I assume a Firefox extension is possible), although I don't know of any services which provide that yet.

[0] [https://vline.com/](https://vline.com/)

<comment><USER15> vLine looks like it's really cool, but I don't see a way to "lock" a chat. That's a dealbreaker for me. =-(

<comment> vertex-four By locking a chat, do you mean keep it open for the future? I think, but I'm not sure, that simply keeping the link around would work.

<comment><USER15> You'll probably never see this, but no -- I meant "keep other people out".

</comment></comment></comment></comment></comment><comment><USER16> Pretty minimal page!

        <!DOCTYPE html>

          <meta name="generator" content=
          "HTML Tidy for Linux/x86 (vers 25 March 2009), see www.w3.org">
          <meta charset="UTF-8">

          <title>Hang0ut - Faster access to Google Hangouts</title>
          <link rel="stylesheet" href="/main.css" type="text/css">
          <link href="http://fonts.googleapis.com/css?family=Lato" rel="stylesheet" type=
          "text/css">

hangout

              Start

Federico Carrone

Faster access to google hangouts

</comment><comment><USER17> I like that the background image is almost 3 megs.

<comment><AUTHOR> Copied from [http://unsplash.com/](http://unsplash.com/). I just resized it. It has not yet been updated on amazon cloudfront. Check: [http://hang0ut.s3-website-us- west-2.amazonaws.com/](http://hang0ut.s3-website-us-west-2.amazonaws.com/)

<comment><USER17> Here's 62kb for you: [http://i.imgur.com/cuL7uX1.jpg](http://i.imgur.com/cuL7uX1.jpg) :)

</comment></comment></comment><comment><USER18> If you have Alfred, this is a great workflow for this problem: [https://github.com/wallace/google_hangout_workflow](https://github.com/wallace/google_hangout_workflow)

<comment><USER19> Here is a link to another Alfred workflow that I wrote. It opens a hangout session in a new window of your default browser and supports Safari, Chrome, and Firefox. [https://github.com/codykimberling/alfred-workflow-google- han...](https://github.com/codykimberling/alfred-workflow-google- hangout/releases/latest)

</comment></comment><comment><USER20> Not working for me on Chrome 37 OS X, interestingly enough. Error in console is 'Uncaught ReferenceError: gapi is not defined'. My bet is on an HTTP/HTTPS discrepancy, but I'm not sure.

<comment><AUTHOR> I changed the google hangout button by a normal link. Check it out: [http://hang0ut.s3-website-us- west-2.amazonaws.com/](http://hang0ut.s3-website-us-west-2.amazonaws.com/). It should work now.

</comment></comment><comment><USER21> Is there a way to do a minimal-click start to Google Hangouts on Air. I really like it for screencasting when I'm giving a lecture but it takes a few minutes to set up and get going.

<comment><USER22> [https://plus.google.com/hangouts/_?hso=0](https://plus.google.com/hangouts/_?hso=0)

</comment></comment><comment><USER23> [http://g.co/hangout](http://g.co/hangout)

</comment><comment><USER24> I don't use Google hangouts because I don't want a Google+ profile.

</comment><comment><USER25> There is no problem, and this is no solution.

<comment><AUTHOR> As I said in other comments sometimes on hipchat I need to have a call with teammates that I do not have on gmail/hangouts. So I need to create a hangout with a link to share so that I can copy it into hipchat and anybody can join it. There is no way to do that on gmail. You need to open google plus that takes a while to load, then you need to go to the bottom right corner and wait for the Start video chat button to appear and finally click it.

I was not aware that there was a link ([https://plus.google.com/hangouts/_](https://plus.google.com/hangouts/_)) that lets you create a hangout with a link to share so that other people can join it. So I created a simple landing page with a button created with google hangouts api. After learning about the link I mentioned before, I changed the google hangout button by a normal link.

</comment></comment><comment><USER26> This works better for me:

1\. Close laptop

2\. Hangout with friends in person

<comment><USER27> I'm sure you don't find the idea of a group video chat so useless, so I guess that's what happens when you choose a "fancy" name for a product. I found it a ridiculous name when I first heard of it, and I still didn't change my mind; even if the product itself works very well for me.

A funny thing about its audio codec: my dogs don't recognize my wife's voice over skype, but they do over hangouts :-)

<comment><USER28> It's better than "facetime". I mean you can't really say, "I'm just going to facetime the wife" without a little chortle. Call me immature ('cos I sort of am).</comment></comment></comment>


37signals Tada-List is now closed - <AUTHOR> http://37signals.com/tadalist-retired In one major move, 37signals shuts down:
1. Backpack,
2. Tada list,
3. Writeboard
(and no longer offers a free version of Basecamp).
The announcements can be found here: - http://37signals.com/tadalist-retired - http://37signals.com/writeboard-retired - backpackit.com
37signals now ONLY offers products that you must buy.
No more freemium sales model.
As well as they are leaving thousands of Legacy Basecamp customers stranded who don't want to migrate to the new Basecamp product. <comment><USER2> This title sounds so indignant. 37signals can do what they want.

I'm sure they'll give existing users plenty of warning & time to migrate content elsewhere before they shut down these services for good. For now, sign-ups are closed. Carry on.

<comment><USER3> Title is now: 37signals Tada-List is now closed

what was the original title?

<comment><USER2> Can't edit my comment anymore. Original title was "37signals kills: Backpack, Tada, Writeboard. You must PAY for all products now."

</comment></comment></comment><comment><USER4> Jason Fried talks about decommissioning these products here:

[http://www.inc.com/magazine/201207/jason-fried/when-to- kill-...](http://www.inc.com/magazine/201207/jason-fried/when-to-kill-a- product.html)

</comment><comment><USER5> The title is misleading. They will no longer accept new signups, but continue to work.

</comment><comment><USER6> It's called 'free market'. Whether it's because sales are declining across the board, or those products aren't as profitable as they want them to be, I see nothing wrong with charging people to use what they make.

They're a great company, with great products, more power to 'em.

</comment><comment><USER7> Oh my gosh! A company wants to make money? This is horrible! We should black out Wikipedia to protest. Give me a break, 37signals doesn't owe anything to anyone. Don't like them, don't use them.

</comment><comment><USER8> Stupid, stupid title.

They had an (apparently) free service since 2005, and you're angry they've started charging for it after 7 years?!

</comment><comment><USER9> The horror. I can't imagine why 37signals thinks its a good idea to charge for their products and services.

</comment><comment><AUTHOR> In one major move, 37signals shuts down:

1\. Backpack,

2\. Tada list,

3\. Writeboard

(and no longer offers a free version of Basecamp).

The announcements can be found here:

\- <http://37signals.com/tadalist-retired>

\- <http://37signals.com/writeboard-retired>

\- backpackit.com

37signals now ONLY offers products that you must buy.

No more freemium sales model.

As well as they are leaving thousands of Legacy Basecamp customers stranded who don't want to migrate to the new Basecamp product.

<comment><USER2> Tadalist and Writeboard both say: `But don't worry — any [x] you already created here at [y].com will continue to work`

Which is nice.

Of the above, the only thing I might take issue with is the stranding of legacy Basecamp customers. Why don't they want to migrate? What can 37signals do for them? Answering these questions is important, and if they are already working on this then I see no problems.

<comment><USER10> _Why don't they want to migrate?_

In our case, it's the price hike ($29 -> $50).

We're a not-for-profit and have a tough time paying for this stuff; we need to stick with Basecamp "Classic" for the time being.

<comment><USER11> I thought they had a free plan for non-profits... you should ask them.

<comment><USER10> [http://help.37signals.com/basecamp/questions/156-do-you- have...](http://help.37signals.com/basecamp/questions/156-do-you-have-special- pricing-for-non-profits-universities-or-other-groups-in-need) <http://37signals.com/svn/posts/2580-why-non-profit-pricing>

Nope.

(We're not helping hurricane victims or the like, more a club that only just breaks even running an event once a year.)</comment></comment></comment></comment></comment>


Funding innovation and various creative peaks - <AUTHOR> http://scienceblogs.com/cortex/2010/01/funding_innovation.php?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+scienceblogs%2FwDAM+%28The+Frontal+Cortex%29&utm_content=Google+Reader <comment><USER2> I think that explanation is simple: The end of age discrimination in science.</comment>