Embedding Lua in the Web - <AUTHOR> http://starlight.paulcuth.me.uk/docs/embedding-lua-in-the-web <comment><USER3> I still hope for a day where Lua is implemented into browsers themselves, though this would set off the whole "but VBScript" arguments again, but at least Lua is pretty much standardized and it can be compiled almost everywhere. Not sure how much it would or wouldn't compliment the browsers DOM and such though. If it were added just on experimental browsers just to test it out and see it's upsides and downsides that would be great too, maybe in Electron or Nw.js somehow?

I'm sure I'll get critical comments on this but it beats compiling Lua to JS to make it convert itself back to JS. Maybe WebASM will be a solution for this, but it's too soon to tell for me how reliable that is for now.

<comment><USER4> It's more elegant and technically sound than Javascript.

But I don't think it'll ever happen. There's just too much behind Javascript and it's slowly catching up anyways.

<comment><USER5> Actually it will be possible once Web Assembly is out! I heard they have already tested the Lua interpreter on it! (I need some confirmation of this though! )

I'm reaaaaally excited for that!

</comment></comment></comment><comment><USER6> Link is down. I assume it's about [https://github.com/paulcuth/starlight](https://github.com/paulcuth/starlight)

I'm not sure what the current progress is like. Other projects to get lua in the browser:

* moonshine.js - same author as the OP

* lua.vm.js - emscripten based (I maintain this one; I'd like to think of it's API as the "gold standard" for lua on the web. however it has issues around leaking references to the JS VM (to be solved when javascript gets WeakRef))

* brozula - <USER2>

<comment><USER7> I think the emscripten/WebAssembly approach will win out. One of the the main reasons why Lua is so good is because it's written in strict ANSI C. Porting it to another language doesn't make sense.

</comment></comment><comment><USER8> Broken for me: An error occurred in the application...

<comment><USER9> Found an archive of it:

[http://archive.is/5G7y7](http://archive.is/5G7y7)

Probably will have to pop open the JSBins as live ones to have them properly function.

</comment></comment><comment><USER10> Not too hot :(</comment>


Show HN: Discover new, trending, and popular creators on Patreon - <AUTHOR> http://www.pledgesociety.com

<comment><AUTHOR> While building a web crawling framework, I became fascinated with Patreon but was disappointed with its discoverability features. So I decided to put my crawling framework to the test and track every creator on the platform. The result of this was PledgeSociety, a side project I put together over the weekend that helps you discover new, interesting, and popular creators on Patreon. Please let me know what your thoughts are and if this is useful!

</comment><comment><USER2> This is great. I keep telling people that Patreon is awesome. It is nice to have somewhere to send them instead of just saying "lots of people are making good money on Patreon."

<comment><AUTHOR> Thanks :)</comment></comment>


Ask HN: Looking for python projects to contribute to - <AUTHOR>

Are there any python projects which an intermediate python programmer could contribute to ? <comment><USER2> I am working on an open resource for people who want to learn Python:

[https://github.com/ehmatthes/intro_programming](https://github.com/ehmatthes/intro_programming)

There is a short list of specific ways to contribute here, but the project is young so jump in any way you'd like, if you are interested:

[https://github.com/ehmatthes/intro_programming/issues/17](https://github.com/ehmatthes/intro_programming/issues/17)

</comment><comment><USER3> You can find many open-source projects that are looking for contributions on OpenHatch, and more specifically Python ones here: [http://openhatch.org/search/?q=&language=Python](http://openhatch.org/search/?q=&language=Python)

<comment><USER4> OpenHatch looks cool. Checking it out.

</comment></comment><comment><USER5> I would love a port of Py-GNUTLS to the current GNUTLS. That is badly needed, as there have been major changes.

This is used by many interesting projects, like Blink ([http://icanblink.com](http://icanblink.com))</comment>


Nintendo reserves the right to brick your 3DS if piracy detected - <AUTHOR> http://www.geek.com/articles/games/nintendo-reserves-the-right-to-brick-your-3ds-if-piracy-detected-2011037/ <comment><USER2> This is (apparently) wilful misinterpretation of the translation of a retailer's warning, here:

<http://www.gonintendo.com/viewstory.php?id=152082>

Key passage:

"In case if you use equipment which is illegal or unapproved by Nintendo or if you do customization which is unapproved by Nintendo, there is a possibility that Nintendo 3DS become non bootable by system update."

This is what Nintendo has been saying for years about Wii system updates. This is because past Nintendo Wii updates _have_ damaged modded systems, not because of any particular malicious intent on Nintendo's part, but because the mods changed the system in ways that Nintendo didn't expect. On the other hand, Nintendo could probably test that its updates work properly against the top few system modifications -- but it's hard to fault them for not doing so.

<comment><USER3> Exactly. I remember a few years back there was a bit of an outrage at Apple for "doing" the same thing.

But really, if somebody messes around with their own hardware, do they really expect Nintendo/Apple/etc to have tested against that? Of course not. They've got more important things to test and support.

</comment></comment><comment><USER4> Well, internet connected, always on, multi-player game consoles will not go back to the way things used to be. I bought the most recent SFIV for PS3 and it wouldn't let me play it until I did a system update, but that system update wanted to delete my Linux partition. We pay more money for toys that in the end own us and try to keep us in their sandbox. Just imagine if car makers and insurance companies colluded to detect that you're driving into a high risk neighborhood, your rates go up. Piracy is becoming a term describing plain disobedience to overly strict rules.

<comment><USER5> > Just imagine if car makers and insurance companies colluded to detect that > you're driving into a high risk neighborhood, your rates go up.

Or worse, that your car simply stops working if you make any aftermarket modifications to it. Try to add a sunroof and your car spontaneously gets cinderblocked.

<comment><USER6> I could see them justifying this by saying "We cannot guarantee the safety of this car due to modifications and will require X dollars to re-certify it"

</comment></comment></comment><comment><USER7> Nintendo needs to be careful. I'm not sure they realize just how dire their situation is, especially in the handheld market.

Apple is _already_ in danger of making the 3DS (and other handhelds like the PSP) extinct. The iPod Touch is a serious threat to every other handheld "console". Yet Nintendo and Sony both (in separate ways) continue alienating their fans.

The A5 processor has (allegedly) 9 times the graphics power of the A4, which is already capable of playing some pretty decent games, even 3D games (eg Infinity Blade, Dungeon Defender, Rage).

Just how long do you think it'll before Apple makes the Apple TV a gaming console?

Now this is a fundamentally different model than the touch model their current devices have. The importance of this can't be overstated but Apple has an huge user base and all the distribution infrastructure it needs for this.

Nintendo has proven that you don't need bleeding edge graphics to sell consoles (like Microsoft and Sony provide). There is (IMHO) _absolutely_ a market for Apple to extend the iTunes ecosystem into console gaming.

<comment><USER8> There's also an untapped market for using the iPad (or similar devices) for multi-player in-one-room games. E.g. you could have a poker game where each player's iPad displays their cards, and where betting, dealing cards, blind levels, etc are handled by the computers, so that the game mechanics flow a lot faster than is usual in face-to-face poker.

Or e.g. with monopoly where the iPads handle all the game mechanics.

<comment><USER9> Every time family comes over, we play multipong, wurdle (yes, works great for groups) and battleheart (again, 1p but works well with multiple fingers).

This is a very interesting untapped market, but how to make a breakout hit in this market is still not clear to me.

<comment><USER10> The Kinect has a tremendous potential here as well.

</comment></comment></comment></comment><comment><USER11> This explains why nintendo has been so cocky about the piracy issue with the 3DS. They think they can arbitrarily nuke the systems of 'pirates'.

Of course, this will also nuke homebrew completely, as they generally rely on R4 carts or similar.

This is just another shot in the war about who owns your hardware. I look forward to the class action lawsuits. I will refuse to buy a DS until this comes to a head. I am a game developer and I like messing around with hardware when I can. I won't buy a 3DS if I run the risk of bricking it by being curious.

</comment><comment><USER12> If this handheld works offline the battle is already lost. Same goes for the PS3 and the wii, if you disable the system from calling home you can easily open it and do whatever you want with it.

These companies should instead focus on creating enough value and reason for gamers to be online. Like Steam, introduce social incentives to create a game collection and interact with your friends and half the battle against piracy is won.

There will always be piracy, these companies don't seem to understand that most pirates wouldn't even buy your console if they wouldn't be able to hack it.

</comment><comment><USER13> On another note, wouldn't it make sense for Nintendo to pull a Sony at this point and create a Nintendo store for Android? In a year or so a good amount of Android phones will have glasses free 3D.

</comment><comment><USER14> > _Enterking also asks that customers format their system before bringing it > in to sell. This suggests that Nintendo actually keeps a record of any > illegal activity on the 3DS which it can then analyze on a firmware update > and react to._

Is it just me or is that an extremely paranoid interpretation?

</comment><comment><USER15> They've been doing this very thing (bricking modded consoles via firmware update) with the Wii for quite some time now. People will always find a way around these things, but I think the whole region-lock nonsense that Nintendo insists on is equally ridiculous.

</comment><comment><USER16> Is there precedent for this? I can recall stories about getting cut off from a service if modding is detected but not about this sort of thing.

<comment><USER17> Valve's subscriber agreement says that they can close your Steam account (cutting off access to all of your games, even single-player ones) if they catch you cheating in certain multiplayer games.

And apparently the Blu-ray scheme has the ability to stop non-compliant players from playing new movies.

</comment></comment><comment><USER18> I hope someone figures out how to set off the bricking process on other people's systems. That way, there'll be a huge controversy which will put this procuedure in question.

Nintendo can make some great games, but their business decisions have a habit of being borderline tyrannical. They have this attitude that they're doing everyone a favor by existing.

<comment><USER11> If this link is accurate, then it should be as simple as popping your R4 cart in and booting a game, then quitting.</comment></comment>


Violated: A traveler's lost faith, a difficult lesson learned  - <AUTHOR> http://ejroundtheworld.blogspot.com/2011/06/violated-travelers-lost-faith-difficult.html <comment><USER3> Hey everyone - we were shocked when we heard about this unsettling event. We have been working closely with the authorities, and we want to reassure our community that, with the help of our security infrastructure, we were able to assist the police in their investigation, and we understand from authorities that a suspect is now in custody.

We've created a marketplace built on trust, transparency and authenticity within our community, and we hold the safety of our community members as our highest priority. We will continue to work with our users to stamp out those who would put that community at risk in any way. The vast majority of our community members genuinely respect and protect each other, but we urge users to be careful and discerning with each other and to hold others accountable through reviews, flagging and our customer service channel. Our hearts go out to our host and we will continue to work with her and with the authorities to make this right.

<comment><USER4> Emotionally devastating story, but it seems like there is an easy solution to this. Have AirBnb contract include an insurance policy (superseding the homeowners insurance) for the time of rental. Also, have Airbnb keep credit card info on hand and hold guest responsible for any damage. Pretty standard business practices.

<comment><USER5> What about regular homeowner's insurance? Surely there can be policies that can cover this kind of thing which a host can obtain on their own. AirBnB doesn't have to muddy their business model with doing insurance, let the insurance people do this.

<comment><USER6> I think this case of unofficially renting out your house/apt is difficult to buy insurance for. Most homeowner's insurance policies explicitly exclude damages caused when renting your house. You need a separate landlord insurance to cover rental, but you typically can't buy landlord insurance unless your property is properly registered/licensed/inspected by your municipality as a rental property.

</comment></comment></comment></comment><comment><USER7> I always found AirBnB's model based on a surprising amount of trust - I for one would never be comfortable just handing over they keys to my place to a total stranger.

Even if they didn't ransack my place completely, as happened to the unfortunate author - I would be concerned about unintentional damage to my property that I might not discover till too late. Renting out something as private as my primary place of residence just seems like a generally bad idea, especially when I am not around to constantly check in on it. Even if I got to meet them, and they seemed like nice people whats to stop them from leaving without paying if they accidentally broke my TV ?

As the service expands, and becomes more craigslist-y (in terms of audience) I can only see problems like this getting worse, and apart from implementing some kind of guest / host rating system (like ecommerce portals do with sellers) I see no clear solution to the problem.

<comment><USER8> As the service expands, regular people's homes (with unrestorable personal value and charm) will be replaced with commercial properties using airBnB as just another advertising channel. When that happens the fresh appeal will be gone and airBnB will be successful if they have become popular and stable enough that an airBnB listing is mandatory for people in the property management business.

<comment><USER9> I hope this happens soon.

The risk/reward trade-offs don't seem to be understood by most AirBnB landlords (99.99% chance of earning $100, 0.01% chance of losing $50k+). Even though this is strongly positive expected value, for a family that can't afford to lose $50k this is a game of russian roulette.

My heart goes out to the author of this; I hope the person who did this to her is put in jail, and the system (AirBnB) that enabled that person prevents landlords who can't afford the financial & emotional risk from listing properties going forward.

This is one those places where laws make sense to me; the average person needs to be protected from unknowingly gambling with their family's future.

<comment><USER10> I think you are dramatically overstating the risk at 0.01%. Suppose past performance predicts future results. AirBnB has had, what, 10 million rental deals? And this has only happened, as far as we can tell, once. That's not an 0.01% risk. It's more like 0.000001%.

Overstating the risk by a factor of ten thousand is a very substantial exaggeration.

It's hard for human beings to understand very large and very small numbers, so to put that in context, <http://en.wikipedia.org/wiki/Road_traffic_safety> says about ten people are killed per billion vehicle kilometers in most developed countries, so perhaps five people per billion passenger kilometers. So you have a one in ten million chance of getting killed by riding about twenty kilometers in a car.

Surely you would not advocate making laws to "protect" "the average person" "from unknowingly gambling with their family's future" by traveling tens of kilometers by car, thus possibly orphaning their children?

<comment><USER10> Update: Airbnb's new post [http://techcrunch.com/2011/07/27/on-safety-a-word- from-airbn...](http://techcrunch.com/2011/07/27/on-safety-a-word-from-airbnb/) says "undermined what had been – for 2 million nights – a case study demonstrating that people are fundamentally good." If I take that to mean that 2 million nights had been booked via Airbnb to date, then I underestimated the (frequentist) risk by a factor of around 350: 2 million nights are only a quarter of a million weeks, so this is a one-in-a-quarter-million chance, 0.00035% rather than 0.000001%. Also, my original figure, "It's more like 0.000001%," was wrong; that would have been one in a hundred million, not one in ten million. And the original "0.01%" was an overestimate by only about a factor of 300, not ten thousand.

So the risk of this happening to you is not like the risk of dying by traveling 20 kilometers by car, but more like the risk of dying by traveling 700 kilometers by car.

(Of course that's assuming that past performance is some kind of a guide to future results. It could be that all kinds of tweakers are going to get on Airbnb now and trash things that one of their friends has had a taste, or it could be that future people thinking of doing this kind of thing will be deterred by the rapid arrest of the apparent culprit in this case.)

</comment></comment></comment></comment></comment><comment><USER11> _I get angry when I realize I will never again be who I've always been before, someone who lived strong and free by the creed that people are essentially good, that if you think optimistically, trust others._

Please don't let them steal this too.

I'm really sorry for your bad experience, but remember:

      - You can still live strong and free.
      - People are still essentially good.
      - You can still think optimistically.
      - You can still trust others.

It's true, you will never be who you've always been. But you can be _almost_ the same person, still optimistic and trusting, just a little less naive. You many not realize it now, but the time will come when you may actually appreciate this as a learning experience.

There are bad people out there and some of them will want to hurt you. You don't have to sacrifice who you really are because of them. You just have to live a little bit differently.

Don't let them take away you really are. Believe it or not, that would be much worse than what they've already done.

Lots of well wishes for your quick recovery.

<comment><USER12> > People are still essentially good.

Experiment indicates that the majority (65%) are not: <http://en.wikipedia.org/wiki/Milgram_experiment>

I am sorry to be a downer, and I agree that it is nice to pretend that people are essentially good. Ignoring the Milgram results, however, leads us to forget why we have to maintain societies with complex crime deterrent schemes, and why we should not trust anonymous individuals who cannot be located for punishment.

"[H]alf ... were female, and their rate of obedience was virtually identical to that of the male participants." "Where participants had to physically hold the "learner's" arm onto a shock plate, ... 30 percent of participants completed the experiment."

<comment><USER13> "I don't think that means what you think it means."

That experiment deals with ability to disobey authority, not with the basic goodness of the people performing the actions. Nearly 100% of the people performing the actions questioned what they were doing. That indicates they knew it was wrong, instinctively and didn't wish to do it. But we are well trained to listen to authority, and the authority figure was telling them to continue.

This actually backs up the idea that people are essentially good. But it also provides evidence for the idea that most people can be easily lead into violating their natural conscience.

Studies of innate "goodness" performed on children reveal that most people, from birth, have an innate moral conscience that we would consider 'good'. I'll see if I can find a link to back this up.

Here we go: [http://www.nytimes.com/2009/12/01/science/01human.html?adxnn...](http://www.nytimes.com/2009/12/01/science/01human.html?adxnnl=1&adxnnlx=1311784203-lIy+svrV0/54Iv1qUUfs6A)

<comment><USER14> I don't find it that surprising, given that we are taught from birth to obey authority figures (parents, family, teachers, policemen) /without question/. It's perhaps a useful simplification in early life but is one I've long- considered harmful.

<comment><USER15> > _given that we are taught from birth to obey authority figures (parents, > family, teachers, policemen) /without question/_

One of the important aspects I'm trying to maintain with my kids is a right to reply and express their opinion. My eldest's teacher goes against this, she demands "do it first time" whilst I demand a response - he can refuse but he can't ignore a request, if he can reason his way out/in to something then that's far better IMO than blind obedience.

It can be a useful simplification in the sense that one needs a child to obey commands like "don't touch the hot stove" and "don't run in to the road" ("stop" covers both).

<comment><USER16> It's important to teach children to obey authority figures. It's also important to teach them critical thinking skills and learn how to detect when a thing is arbitrary. However, instead of teaching the child to disrupt the authority in place, I think it is preferable to teach the children to obey unless there is a moral imperative against doing so.

For instance, while your son's teacher may assign him some silly work, while there is no reason to do this work other than the teacher said so, he should learn to work within the framework and do the work anyway because he is subject to the teacher in his current circumstances. If the teacher, however, assigns him to physically harm another student or participate in another morally objectionable act, he should refuse to comply. Things go much smoother this way than they do if people are constantly nagging and arguing over things that really have no incident; much energy could be saved by both your son and his teacher by compliance with non-useful but non-harmful requests rather than disrupting the flow of instruction and encouraging further disorder and disrespect to authority.

<comment><USER17> It's INCREDIBLY important to teach children to obey authority figures WITHIN REASON. If a teacher, cop or fireman is asking your kid to do something that doesn't seem quite right, their first instinct should be to ignore them, and get help from someone they know. The only people a kid should blindly obey is their own parents.

As far as I know, very few people teach their kids that it's OK to question authority (within reason - and yes, respect authority always. If you're in a teachers classroom, you follow their rules.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> The guests sound like drug addicts. (Maybe meth? Tweakers do bizarre things like move furniture at odd hours or burn fires without opening the flue.)

I've been a happy AirBnb guest on a few occasions; the one time I had someone's whole usual studio apartment I found it a bit strange how much of their life was left on display for me – like the host's prescriptions still in the fridge! – but of course respected their privacy.

Each time I've been a guest, we've seen photos of each other on the site, and the keys were handed off in person. While I didn't expect anyone to stop by and check on me during my stays, I always had the impression the host or host's friends were nearby.

A guest with criminal intent would try to pick a place for a longer stay, in a more anonymous building, with a host known to be out-of-town. But then again, that's also what someone seeking to burglarize any vacation-emptied residence would do. More or less this same sort of crime could happen without AirBnb, or perhaps be enabled by nothing more than tracking public tweets/'check-ins' to predict unit vacancy.

(Another development I eventually expect in this progression of tech-mediated sharing: a bad-faith host who surveils their guests.)

<comment><USER19> Definitely tweakers. I wouldn't use that sink near open flame for a while.

<comment><USER20> Dude, did you just predict that AirBNB is going to be used for mobile meth labs?

</comment></comment></comment><comment><USER21> AirBnB can be used without issues if you own a property and you're willing to operate it like a hotel: you're present on the premises to check in the guests, you have a room or a reception-like place from where you can monitor the situation, and you're able to inspect the place when they leave.

Operating a property remotely via AirBnB implies all sorts of risks, which makes me think that it might be an unsustainable model, because a black swan event might ruin the property to such extent that it offsets the income made in all the other cases.

AirBnB handles property promotion and property booking on the Internet -- that's fine -- but when it advertised itself it included in the message ways to do property administration (as in rent-your-home-while-away). While this is not connected intricately with their core business, it is the model that some owners assumed by default, without realizing the risks involved or the fact that you are still exposed to one-in-one-hundred unpleasant events.

If they manage to warn about this upfront similar to the way Craiglist does, without losing their brand and their community support, then owners will become aware of those issues and take the necessary protection (by i.e. requesting guarantees/deposits/passports or by using their social network to validate the guests). If they don't, I'm afraid a couple of bad PR articles will be enough to destroy their reputation.

P.S.: I haven't heard of hotels managed remotely; there are some hotels where you check in automatically and you get the keys via some sort of robot system but in the morning there is someone handling the checkout, the cleaning etc. In addition they have your credit card on file, your passport, probably your cam photo when you picked up the keys and the most you can destroy is a hotel room (still a great deal of value but somehow limited and the hotel probably has insurance for it). But automation didn't pick up at scale in the hotel industry. In the current state, it thrives partially because the reception provides the safety-checks and balances needed to prevent and offset these black swan events. I'm not sure the remote administration model is scalable or even manage-able due to this.

<comment><USER9> Um, this is incorrect. Hotels are vandalized all the time... having a "reception-like place from where you can monitor the situation", and "inspect[ing] the place when they leave" doesn't prevent people from trashing your room/apt.

It sounds like the person who trashed the OP's apartment /enjoyed/ trashing it -- it didn't sound like someone inconsiderate, or in a hurry; it sounded like someone who deliberately and knowingly ruined the place. The security measures you suggest won't stop that sort of attacker.

<comment><USER21> I've said "to prevent and offset". It's about managing the event (offsetting the bad cases when prevention fails). Having a reception area allows you to have their signature on the contract, to validate their identity (name, nationality, passport) based on the photo ID and how they look in real life and to have on record a lot of validated information about them (which will sure help with police and insurance in case something bad happens).

<comment><USER9> You said "can be used without issues".

I agree identity validation, and being there to hear loud noises/odd behavior makes it harder / less fun for an attacker -- but this is not what allows hotels to operate effectively. Some percentage of hotel registrations surely occur with stolen passports, etc. Hotels rather build this cost into their business model in a manner similar to an insurance company.

Because hotels rent so many rooms at a time, they can treat these costs in the same way that your car insurance company treats accident risk -- something that is always happening that can be offset in real time by honest people using the hotel as per the contract.

Letting people into your home does not have that risk-sharing property -- it's insuring a single driver instead of tens of thousands -- you open yourself up to a very real risk of losing a lot of money.

(Not to mention that hotels are not personally attached to the rental rooms).

</comment></comment></comment></comment><comment><USER22> How is this:

 _"... emphasize that the customer service team at airbnb.com has been wonderful..."_

reconcilable with this:

 _"...My next call was to airbnb.com - I tried their "urgent" line, their email address, their general customer support line. I heard nothing - <USER2> response whatsoever - until the following day, 14 sleepless hours later, and only after a desperate call to an airbnb.com freelancer I happen to know helped my case get some attention..."_

Does that mean you'd have to know someone who works at AirBnB before you can get customer service? I've heard similar stories about Google, too.

<comment><USER23> Customer service was apparently wonderful... _after_ they were able to get ahold of them.

One of their suggestions was that airbnb add _immediately_ a 24/7 customer service line, which would have fixed the initial delay.

</comment></comment><comment><USER24> Moral of the story: By using a service like AirBnB to make some cash, you are _Rolling the fucking dice_. It's naïve to think otherwise, and if you're not comfortable with that kind of risk, _don't do it_. It seems some people see the service as "easy money" and don't consider outcomes like this.

I think it's best compared to hitchhiking: Is it cheap? Hell yes. Is it consistant/reliable? no. Is it as safe as a bus/plane? _usually_ yes, sometimes no in a big way.

I travelled in my youth (5 years ago :p) around several states via thumb. It was a calculated risk I was taking, and both I and other hitchhikers I knew were aware of this risk and took steps to mitigate it (carrying mace, turning down rides– one friend would take a photo of the plates and text them to a friend each ride, informing the driver that he/she was not anonymous).

AirBnB is like this: you save/make some money, but rather than a Hotel (or bus company) being on the hook for a bad outcome, YOU are on the hook. If you're not prepared for that, don't do it. It's not "easy money."

</comment><comment><USER25> AirBnB makes us travelers vulnerable to being scammed as well. In the most recent rental, it really was a roll of the dice to see if we were going to have an apartment or not (and of course, by the time we could have contacted AirBnB to say we'd been scammed, the scammer would already have our money, due to the way AirBnB works, and their lack of any way to contact them.)

I travel full time. I'm a nomad. I would rent thru AirBnB for 365 nights a year if they provided the service that they originally set out to provide. I think they changed their focus, and rather than building an organic community of people renting their places to each other, they are pursuing the expensive travel market. This makes sense given the profits are higher and it is easier to get vacation rentals in the system than individuals. But they're not the ebay of travel anymore, they've become a HomeAway clone.

They also really need to change their policies on communication- they inhibit our ability to talk to the owners before renting, and this is worsened given that many owners may not speak english. Letting us call them or email them is not going to want us to cut AirBnB out of the deal, because the primary value AirBnB provides is the fraud protection of letting us pay by credit card.

There's no reason for any company of this size not to have a 24/hour hotline. It may be midnight in california, but it is 5pm somewhere. You have listings around the world.

AirBnB's priorities seem to have shifted away from building an organic "ebay of travel" with regular people to maximum growth in revenue, by going after the high end travel market, with a distinct lack of customer service. This may not be intentional, but I'm part of the market-- a heavy use part of the market- and that's how it is looking to me.

So, 24 hour hotline, policies for dealing with things that go wrong, to help customers, and letting the people use the site communicate are the changes I'd make. I bet you'll find that more communications means more confidence and more nights rented.

<comment> johnx123-up Agreed. Couple of days back, I went through one AirBnB competitor [http://www.quora.com/Airbnb/Will-Agriya-Burrow-be-a- threat-t...](http://www.quora.com/Airbnb/Will-Agriya-Burrow-be-a-threat-to- Airbnb) There comments suggest that HomeAway model is better and also they're adding SecondPorch.

I initially thought that their comparison <http://www.launchfeed.com/launches/view/1308830151> is weird. But, that makes sense now.

</comment></comment><comment><USER26> I remember a while back, someone on HN commented that they preferred the AirBnB model to CouchSurfing; because they felt that they were under no obligation to spend time with their host, or try to repay their hospitality with a meal or gift.

CouchSurfing relies upon (and in turn reinforces) a culture of good-will.

Because AirBnB converts the CouchSurfing model into a simple cash transaction - I think a lot of the positive norms that are inherent to CouchSurfing are lost.

<comment><USER27> Exactly, it seems much harder to blatantly vandalize the home of a like-minded person who personally welcomes you into their home, offers to show you around etc. than the fancy loft of some faceless traveling businessman. Also paying for something tends to give certain people a sense of entitlement.

Of course none of this makes what happened to the poor person in this case OK or even remotely acceptable. Nonetheless, I think understanding why things happen is a good step towards coming up with a solution.

Maybe if AirBnB can get some of the personality of the Couchsurfing community, it can get some of these positive norms that go with it as well. The trick would be how to do that without losing the low social barrier to entry they have now.

</comment></comment><comment><USER28> I am non-representatively paranoid, and have always been afraid of this kind of thing when having guests not personally known to me, visitors to "open house" office events, etc. I think there is little actual risk with almost anyone as a guest (most people ARE good, or at least non-malicious, or at least lazy), but this is why the AirBnB reputation system is so key to their value (and why they'll have a strong network effect).

Maybe the effect of this will be to make people want personal connections (via fb graph or whatever) to their AirBnB guests, or at least requiring minimum numbers of positive reviews from known sources (to prevent the sockpuppet/shill issue).

I wonder if your renter's or homeowners insurance might cover this kind of thing. If it doesn't generally, it'd be awesome if AirBnB could work with a third party insurer (per jurisdiction) to offer optional insurance to hosts (and guests) against this kind of thing.

<comment><USER29> I suspect home owner's insurance would not cover this since they would probably see it as an unlicensed rental. I've thought for a while that Airbnb will need to develop an insurance system. I'm sure that lesser incidents of property destruction / theft are far more commonplace (carpet stains, cigarette burns, appliances damaged, "borrowing" something that doesn't get returned) and I've thought dealing with such is going to be eventually crucial to making the model sustainable over time.

And then, of course, there are going to be rare catastrophes like this one -- or worse. Eventually, if the system gets large enough, there will be a sexual assault case. I wonder if Airbnb has pre-baked disaster scenario plans. Eventually they'll have to deal with the emotional, PR, legal and political fallout.

It's still one of the things that keeps me queasy about listing my extra bedroom. I'd guesstimate the replacement value of the contents of my apartment is circa $50k and I'm loathe to gamble with such.

<comment><USER30> $50k?

I'd be more worried about a guest setting the house on fire, by accident or not. Fire-damage can easily clock in north of $500k. Good luck explaining the AirBnB concept to your insurance company after a stranger turns out to be "not available anymore" (stolen CC, etc.).

<comment><USER31> A thousand times, yes. You'd be insane not to carry _at least_ a half million dollars in coverage for fire loss in a city like San Francisco. I think my own rental insurance covers something like $1M, and they explicitly don't cover losses incurred to property that I'm renting to others. That's another class of insurance -- much more expensive, because the risks are so much higher.

I think you have to be incredibly naive to rent out your personal apartment on AirBnB. The downside risk is virtually unbounded (and lest you think I'm exaggerating: what happens if a tweaker AirBnB renter burns down your building, and _your neighbors die in the fire?_ Hello, civil judgment.)

</comment></comment></comment></comment><comment><USER32> Why was the title of this post changed? It used to have the name "airbnb" in it earlier this morning, around 400 votes.

<comment><USER33> When submitters rewrite titles of posts we almost always (if we notice) replace them with the original title. We've done that since HN started. Otherwise submitters compete to make attention-getting titles, and you end up with the frontpage of reddit.

<comment><USER34> _Otherwise submitters compete to make attention-getting titles, and you end up with the frontpage of reddit._

That sounds like an excellent matter to leave in the hands of the users who vote for/against stories.

<comment><USER35> The purpose is to _prevent_ it being left in the hands of users. "Linkbait" is named as such for a reason.

It's just too tempting to not reflexively upvote a juicy title.

</comment></comment></comment></comment><comment><USER36> With internet almost run over by all kinds of scam artists, spammers, pedos etc. is there any surprise that such a thing can happen? You have crackers trying their level best to install keyloggers and other tools to read the passwords to your accounts. And in this environment if you hand over the key of your apartment to some complete stranger, I think the writer should also take some blame for his naivety. Just because airbnb is current flavor of the month it does not mean you throw your basic common sense out the door.

Even if you are present in an apartment yourself, it is still too risky to allow a complete stranger to sleep in the room next to you. How much verification can be done by you or airbnb? The Norwegian shooter had no criminal history that could have been caught by any verification. So how can you be comfortable with allowing a stranger into your home with no verification done at all from your side?

I think there should be a service which will allow you to rent the room only to your friends or to friends of friends but no further than that. This friend list can be from facebook, linkedin or Google+. This will reduce the chances of getting a rental but give peace of mind that you are not letting some hardened criminal into your home.

<comment><USER37> I know this is a horrible and shocking event, and my thoughts are with the person who has had their life violated, but I feel compelled to comment that you are wrong.

The internet is not "almost run over [with] scam artists, spammers, pedos etc." They are visible and use anonymity to do what they do on the internet, certainly, but it is far from overrun.

Secondly, is it really too risky to be asleep without a locked door between you and the world? That is a scary, closed world to live in. You are also wrong to blame the victim; they say themselves they made a mistake not to do more verification, but the blame can only be on the perpetrator †.

Finally, let's not forget that most sexual assaults and rapes [1] are carried out by friends and acquaintances, so limiting your contact to friends of friends is unlikely to make you significantly safer.

Overall, I think your conclusions are the worst to draw from this attack. Take care, but don't go crazy keeping out the "other".

† It might be useful to make a distinction between casual responsibility and moral responsibility. The victim may have done something that helped cause the attack, but they are not at fault.

[1] According to (admitted a random googling) the American Centre for Victims of Crime, 77% of rapes are committed by non-strangers. [http://www.ncvc.org/ncvc/main.aspx?dbName=DocumentViewer&...](http://www.ncvc.org/ncvc/main.aspx?dbName=DocumentViewer&DocumentID=32306)

<comment><USER38> > Finally, let's not forget that most sexual assaults and rapes [1] are > carried out by friends and acquaintances, so limiting your contact to > friends of friends is unlikely to make you significantly safer.

I'd imagine that's because those people tend to get let into one's home more than a stranger, which means the stat doesn't help your point much.

</comment></comment></comment><comment><USER39> This is not the first story like this I have heard about AirBnB. They have just done a good job keeping them hush hush and talking people out of going to the cops. Obviously stories like this are horrible for their reputation and AirBnB have a big incentive to try and take care of issues on their own.

<comment><USER40> Have you any links for this? Those sound like pretty big accusations to be making without citations.

<comment><USER41> If there were links, wouldn't that disprove his point?

<comment><USER40> I don't see what users would have to gain in not going to the police and reporting these crimes. Unless he's implying airbnb is buying their silence

<comment><USER42> A victim host might be violating the terms of the lease by subletting their apartment, or could be violating local zoning or hotel permitting laws.

<comment><USER43> And how much is their lease that paying the penalty is worth having their entire apartment trashed, their identity stolen, etc., etc?

</comment></comment></comment></comment></comment></comment><comment><USER44> Always bound to happen. Up next, the host who fits spycams in his shower and posts pics of his naked visitors to porn sites.

<comment><USER45> That's what I would do. I once got a letter from my management company that said, "we are conducting random apartment inspections tomorrow. be aware." This bothered me because I don't really like people in my house, and they didn't give the 24 hours notice required by law. So, I set up some cameras, broadcast it to the Internet, and told my twitter followers to watch my apartment for me while I was at work.

They never showed up.

<comment><USER44> Good reason why renting sucks. (It's not _your_ house).

<comment><USER22> Yes and no. There are also situations where state inspectors can come into your _bought_ house: building structural safety inspection, fire safety, pest control etc... It also depends on where you live, of course.

</comment></comment></comment></comment><comment><USER46> What happened to this person is awful and it´s understandable that she/he is very emotional at this point, but I don´t think the lesson is you can´t ever trust people, or that the AirBnB model is flawed. It´s more like: hope for the best, plan for the worst. There is always going to be some black swan risk even if AirBnB does do more vetting. There´s no reason for example to leave valuables anywhere in the residence while strangers are there. You can´t be 100% protected unless you´re willing to get insurance, which probably doesn´t make sense for the occasional provider, but you can at least remove the low hanging fruit risk-wise. Perhaps AirBnB should take a more active role in educating its providers on basic precautions.

<comment><USER47> > There´s no reason for example to leave valuables anywhere in the residence > while strangers are there.

So you're saying AirBnB should advocate against rentals while you're away?

Or are you saying, if you want to rent while you're gone for a week, that you should get a week's worth of self-storage (which I've never heard of, but might exist in a city), move all your important belongings to the self-storage unit, and move them back after the guest is gone? That seems quite onerous.

<comment><USER46> That or drop them with a friend or relative. Why is that so onerous?

I think people should use AirBnB however they see fit, but understand the risks in doing so and take whatever precautions are realistic to lessen them.

This situation would still suck, but not be nearly as bad/scary/expensive if the victim hadn't left cash, credit cards, expensive electronics, legal documents etc. in the apartment. I'm just recommending easy steps to lower the potential downside and increase the overall EV of being an AirBnB provider given that this sort of nightmare is a slight but real possibility.

<comment><USER47> It's not onerous until you consider that desktop computers and flat-screen TVs are "valuables".

</comment></comment></comment></comment><comment><USER48> Does AirBnB offer any help with insurance? I know my home & contents insurance wouldn't cover any of this: I'd need to get (expensive) commerical insurance or some sort, and I'm guessing most AirBnB hosts don't have that.

The idea of renting out my place with no recourse to insurance if it is destroyed is far too insane to contemplate for me.

<comment><USER49> Given the exposure, I would expect AirBnB to have liability insurance up the wazoo. It seems likely they would lose a lawsuit in this case, and even with just partial liability it could be very expensive.

<comment><USER24> Why would they lose a lawsuit if one were brought in this case? I haven't read it but I'd wager their TOS gives them the right to your first born child (hmm... I'm trying to say it probably disclaims any possible liability in the broadest possible terms, bad analogy perhaps). Then again, whether that holds in court is something we couldn't know until after a case.

</comment></comment></comment><comment><USER50> I haven't use AirBnB before, but I do use CouchSurfing a lot. CouchSurfing's system of verification, vouching and references makes a big difference to how much you feel you can trust someone who asks to use your home. I do still sometimes accept guests with no references, particularly if it's a last minute, but I check their IDs first, and only give them limited access to my home.

</comment><comment><USER51> The most important thing to note is this has happened even before it hit critical mass, hell its in its infancy still. This is the reason why Airbnb never made sense to me as a business. The author is lucky there was no bodily harm done to him. It's too much of a risk to rent out your personal property to total strangers. Now they forever know where you live and more so know the complete layout of your house and what you have in it and your schedule. At the end of the day it cannot be more than bedandbreakfast.com used as a listing sits for businesses. That is why the 1billion valuation does not make sense either.

</comment><comment><USER52> Airbnb should willingly do MORE to verify users than CarFax, Paypal, Facebook, etc.

Screw your bizmodel.

Run a credit and criminal background check - and charge 4%.

<comment><USER53> Simple - first time users submit scan of a photo ID, and a picture of themselves. AirBnB checks the ID, and publishes the photo. After booking, the owner can use Skype to see if they match the photo.

<comment><USER54> Great idea! However, AirBnB should not only post the photo, but also be in charge of verifying over Skype that it matches the person posting it. If it'd be too expensive to verify every single new user, they could just verify them once they make their first booking.

AirBnB should be the one matching photos to real, living individuals since not everyone renting out their home is likely to be as through as a company with a well-established procedure.

</comment></comment></comment><comment><USER55> To me, this underscores one of the key risks to having an AirBnB room for rent.

I think if you are going to do it, you really have to be careful.

1\. You should probably be someone that works from home / is home often. At least then you can monitor your place more often. You wont be seeing inside the room, but you could at least hear if anything insane is going on in it.

2\. You should not have much by way of valuables around your place, nothing easy to steal. The first place I rented on AirBnB was like this. There was no TV/dvd player/ps3, the host had a laptop which he took with him. It consisted mostly of cheap Ikea-ish furniture. This works in my mind because it mitigates what can/can't be stolen.

</comment><comment><USER56> A reminder that there's more to scaling out to millions of users than ensuring your hardware is up to the task.

</comment><comment><USER57> I just was quoted in a national article here in Canada (the Globe & Mail) that talked about using AirBNB... I've passed this story along to the author who is going to see about a followup.

This wont stop me from using AirBNB as a guest, but I was never comfortable with renting my own home anyway.

edit - if AirBNB kept a drivers license scan on file to confirm the credit card was the users, that would be helpful. I know that is difficult with privacy laws, etc, but when I check into a hotel I always have to show my ID to make sure it has my name on it....

<comment><USER58> _if AirBNB kept a drivers license scan on file to confirm the credit card was the users_

Don't credit card companies prohibit this?

</comment></comment><comment><USER59> I cannot believe he did not meet them in person first. And left valuable things behind.

edit: or she..

<comment><USER60> How is that relevant? Apart from the fact that valuables were locked in, I don't get the point:

\- You cannot take everything with you, you have to leave stuff at your _home_ (all the documents mentioned for example).

\- I won't try to claim that I can speak for the author, but I'd guess that the valuables lost are less a problem. The violation/emotional troubles seem to be worse.

\- Giving the nature of the destruction (it seems so much on purpose, so carefully done) I don't even know if 'did not meet them in person first' would've helped. At least the author would recognize these guys again on the street, but I don't believe that it is proven that you would've sensed something that wrong.. It kind of reads like someone enjoyed a dark fetish by destroying random stuff.

<comment><USER61> _You cannot take everything with you, you have to leave stuff at your _home_ (all the documents mentioned for example)._

In light of this article, if I ever rented my apartment out for a week, I would box up any sensitive documents, or particularly valuable items, and leave them at a friend's house.

 _I don't even know if 'did not meet them in person first' would've helped._

Getting a scan of a photo ID, matching it to the person, and possibly getting a current photo of them, along with a license plate number all would be reasonable measures that you could take in a five minute meeting. Not only would they give you more leverage in police investigations, they would probably deter people from trashing/taking your stuff.

 _The violation/emotional troubles seem to be worse._

Some of the violation comes from the feeling that she can't really do very much about it, and that she was totally unprepared for it. AirBnB offering a few tips, of the "here are some things people to do protect themselves, you might consider them" variety, seems totally reasonable.

</comment></comment></comment><comment><USER62> It's yet another tragedy of the commons. As AirBNB becomes more popular I expect this is going to happen more often. Unfortunately I think this is only going to have to happen a few more times before people start to seriously question the wisdom of inviting a relative stranger into their homes.

<comment><USER63> Exactly this. A service thorougly tested with (for want of a better term) early-adopter Internet hipsters is going to fail in entirely predictable ways when exposed to the Internet that gave us 4chan.

</comment></comment><comment><USER64> Looks like a couple of reporters have already hit the comments area looking for more info for a story. It goes far, far beyond a basic theft or incident of vandalism and could easily blow up internationally and do a great deal of damage to the AirBnB brand.

I don't know the blogger in any way at all, but have to admit that my first thought was to wonder if this might've been arranged by a competing industry or service at all. Sounds a bit over the top to be a pre-conceived plan though. Doubt various hotel associations would be desperately unhappy to see this story though, you have to admit.

Between Google and AirBnB, I'm sure the police could have IP addresses of the perpetrator(s) and track them down unless they were particularly smart (and if they are particularly smart, they'd be picking bigger targets...).

<comment> mike-cardwell I don't think what you're suggesting is _that_ paranoid. There has to have been _some_ motive. Perhaps it was just somebody seeking revenge, either against the person whos flat it was, or against AirBnB.

<comment><USER47> To suggest it might not be paranoid, but merely prudent. To think it's at all more likely that this is a setup against AirBnB and not just... you know, crime... I think is in fact paranoid.

If you want motive, here's one that you might be surprised to learn motivates a lot of crime: the guest needed money for drugs/debt/food/just wanted money, and thought he might get away with it.

Houses get broken into. People get mugged. There doesn't need to be a conspiracy for these things to happen.

<comment><USER64> Not many opportunistic thieves would pay to rent a target which they haven't cased, right? And meet whoever handed over the keys. Seems pretty bizarre.

</comment></comment></comment></comment><comment><USER65> So anything remotely related to YC companies that shed good light are immediately frontpaged but something potentially dangerous that is bad PR gets title changed?

</comment><comment><USER66> Is there anything stopping the renter from taking extra precautions? Like for example photocopy the tenants passport?

I am finding it hard to believe that somebody would drop off the keys to his own apartment to a total stranger, regardless of any guarantees the site does, without even wanting to briefly meet them.

<comment><USER67> > Like for example photocopy the tenants passport?

Doesn't AirBnB do that? If no, then why?!

Disclaimer: never used the service.

</comment></comment><comment><USER68> Why would you ever rent your place, important valuables inside the property, without being home?

I can understand leaving the place empty of valuables and renting it remotely, but to rent your primary residence while you are away is incredibly foolish. I just don't get it.

</comment><comment><USER28> I'm curious what the specific crime is if you're in a place like NYC or SF (where <30 day rentals are illegal for zoning reasons), you legally permit someone entry to your space, and he just trashes (vs. stealing) stuff. It should be a crime, but what is it? Not theft, not trespass.

"Criminal damage to property", or vandalism, probably counts, but that's really up to the jurisdiction on what it includes.

I wish this guy would try this in Singapore; 3 years in prison and/or caning.

<comment><USER69> Grand theft auto of a car that's parked illegally is still grand theft auto. Ie. that renting the place out is in violation of zoning laws does not make any difference to what crime the guest commits.

The bigger problem is insurance, which, as others point out, probably does not cover.

</comment></comment><comment><USER70> Why was the title of this submission changed? Was it because the old title mentioned AirBnB?

</comment><comment><USER7> Can someone please explain why the post name was changed? If it was to 'protect' AirBnB I find that in poor taste - this is a legitimate problem that occurred with the service, though it is likely not a specific problem. if the OP (foxit) requested or made this change, let us know.

</comment><comment><USER71> I really hope this incident doesn't break her spirit. As someone who's been shot at, beat up, robbed, held up, and still trusts people: What doesn't kill you makes you stronger.

That said, I also rent out my place through AirBnB. (<http://www.airbnb.com/rooms/106355>) I interview everyone who stays with me through Skype before confirming any reservation. AirBnB, has a very classy membership, and we've had great experiences with all our guests, but due diligence is still a must. Communicating with your potential guests is essential, as is reading between the lines. You should also make an effort to look at their face at least once before booking. Skype is perfect for this and AirBnB doesn't block it.

</comment><comment><USER72> This could resolved if airbnb insisted on a refundable deposit of $500-$1000 per visit.

<comment><USER73> 500 to 1000 is not bad of a seed funding for a thief. I think better security measure would be to provide some sort of valid state or federal or national identifications. Any decent hotel requires this so why not AirBnB?

<comment><USER74> I would pay to be verified by AirBnB, by uploading a picture ID and having a human verify this. A service I use provids added verification by mailing you a code that you enter on the site to prove your address. Things like this could help a lot to assisting with identity scams.

</comment></comment></comment><comment><USER75> whats wrong with renting through Craigslist (except obvious problem of spam from companies like AirBnB) ? Both parties may request and provide any documents/verifications until their mutual full satisfaction. We had no problem renting space in Europe from US for example though some amount of communication and search was involved - we didn't like some people, some people didn't like us as we needed full paperwork from them for visas, etc... i wonder how such fine tuning of mutual requirements would be possible through "blind renting" service like AirBnB.

</comment><comment><USER76> I'm shocked by some things I've read in this article. I don't want to blame the victim, but the author has rented out their home for a full week and left identity and financial documents behind a plywood or MDF door. Data, passport, birth certificate, and cash. Trusting people is nice, but surely there's a limit at which it becomes insane. I get a little nervous when I leave my documents in my (empty) apartment over a long weekend; I'm flabbergasted as to why the author seemingly wasn't bothered until after the crime.

</comment><comment><USER77> There is a big chicken or egg problem right at the core Of this sad case. On one hand, why would anyone trust someone they have only had limited conversations with to stay in their home...alone? On the other hand, if Airbnb allows renters to do background checks before the agreement is finalized, how do they avoid private sales?

I can't resolve this, so I wouldn't dream of renting my place out unless I was going to be there. And even then, I'd sleep with one eye open!

<comment><USER78> Why doesn't AirBnB simply do the checks you would do? In fact AirBnB can give a checklist of services they can run from nationwide background to credit checks. You check off what you want done, and AirBnB bills you for them.

</comment></comment><comment><USER79> "They ... found the passport, cash, credit card and grandmother's jewelry I had hidden inside. They found my birth certificate and social security card, which I believe they photocopied "

Why would you leave your birth certificate and social security card behind when you have strangers occupying your home?

Passports, ids, hard drives, diamonds .... these are all small but very important items that fit perfectly into a safety deposit box.

</comment><comment><USER80> After someone has copies of your passport, birth certificate, social security card, etc, what do you even do? Isn't your identity compromised forever?

<comment><USER81> Not really. Often copies or stolen birth certificates, SS cards, and passports are sold to forgers that can use them to make fake passports and identities. So it isn't to necessarily impersonate you (although it can be used for that).

You can get a new SS number, and you can get a new passport which makes the old ones null - but as far as a birth certificate goes - I'm not too privy on the security features of those documents. I do know though that they are rarely used to impersonate and more often used as forgery material.

(please correct me if I'm wrong)

</comment></comment><comment><USER82> Woman gives apartment keys to complete stranger. Gets robbed.

279 points and 124 comments on HN.

<comment><USER82> Thanks for the -4, I think a.) that's worth it b.) proves my point. A "new" business model aka AirBnB does not change any facts.

<comment><USER83> +1.

It's because HN is fundamentally biased and always will be. The top 2 comments are not surprisingly pro airbnb:

a) People are still good fundamentally - because that's exactly what I'd want to hear if someone ransacked my place.

b) PR from a guy who works there.

I personally wouldn't want to stay in a stranger's house and I don't think I ever will - no matter how big airbnb becomes I believe there will always be a percentage of people who are uncomfortable with the airbnb business model.

Obviously a lot of people don't care and airbnb will go on to be successful I'm sure but it's a shame this community has such a hard time being honest with itself.

</comment></comment></comment><comment><USER84> I have always been skeptical about such services. It is like collecting pennies in front of a steamroller. Sooner or later, a tail event like this is bound to happen. A distribution of hosting experiences has to be fat-tailed. It is okay to deal with that risk when even the worst case scenario is acceptable. But, for your own home how can it be acceptable?

</comment><comment><USER85> "They found my coupons for Bed Bath & Beyond and used the discount, along with my Mastercard, to shop online."

Are you kidding me? Seriously.

<comment><USER86> My home was burglarized once and among all the serious stuff that they took they also took: tortillas, salsa, ground beef, and cheddar cheese. I still can't believe that.

<comment><USER87> The first time my home was robbed (while I was sleeping upstairs), the perpetrators did a whole bunch of bizarre things, like taking a jar of pickles out of the fridge and leaving them on the front porch and taking the laundry detergent from our laundry room and pouring it out in the back yard.

In an unrelated story, I happened to be moving out of that apartment the same day. And the very next day my new apartment also got robbed.

<comment><USER88> Remind me not to rent in your neighborhood ;-)

</comment></comment></comment></comment><comment><USER89> I like the (security) services offered by Onefinestay <http://www.onefinestay.com/hosts>

Everyday someone checks your home and cleans it.

Additionaly they actually turn your home into a more hotel-like experience - so guests are provided with towels etc. At least for higher priced accomodations a good choice.

</comment><comment> eric-hu Is no one else struck by the peculiar behavior of the tenants?

Scattering bleach powder across the apartment and taking the time to hang up strange photos seems a bit _too_ erratic to me.

I wonder if the renter has serious mental issues or if this was part of some intelligent plan (i.e. hired by couchsurfing).

This is PURE speculation, don't cite this post as anything else.

<comment><USER28> one word explains all of this: methamphetamine. (and I say this as someone who believes in drug decriminalization or legalization)

<comment> eric-hu I'm generally for (soft) drug decriminalization, too, but I don't have much experience with meth heads :)

Would someone upped on meth be able to conduct himself well via email, sending polite thank-you's?

<comment><USER90> Yes - my experience with meth heads is that they can be perfectly normal in their interactions, but once high on meth they can be aggressive, obsessive compulsive and destructive. Granted, this can't only be blamed on meth (or drugs in general) - the person was obviously sober at some point during this trip - or at least sober enough to know what they were doing. This all seems like a planned out event to have fun with a couple of 8-balls and have a fun couple of days without worrying about what happened to the apartment in the end.

<comment><USER91> I have seen a Meth head steal something from someone, and then politely offer to help them look for what they just stole from them.

</comment></comment></comment></comment></comment><comment><USER92> Personally I think the poster is stupid as f@#&, leaving her apt to complete strangers and then blaming her loss on someone else. What did she expect? B&B's usually have someone onsite to prevent things like this from happening. The person to blame here is the poster and of course the tweakers, not Airbnb.

</comment><comment><USER93> She trusted them and left for the weekend?

<comment><USER94> That struck me as odd too -- is this a normal use case for airbnb?

<comment><USER95> Yeah. The one time I used it, my brother sent a phtocopy of his driver's license to the apartment owner and she sent him the keys in the mail. I was a little nervous about it all working out, but all the hotels in the area were booked or were $600+/night. It ended up being a pretty good experience for us, but it did require both sides to be pretty trusting.

</comment></comment></comment><comment><USER96> Wow.. that's terrible! I really enjoyed all my couchsurfing and airbnb experiences so far, they resulted in the best travels i ever had.. it's sad to see such a thing happen, and i hope the criminaly will be catched and punished.

Still, i am looking forward for my next airbnb trip, it's a great way to travel!

</comment><comment><USER97> Why isn't the title the original one explicitly mentioning AirBnb? Bad PR for YC's portfolio company?

</comment><comment><USER98> Just out of curiosity, why didn't the victim post any pictures of the damage?

<comment><USER99> They stole his camera?

<comment><USER98> I would hope she took pictures for documentation purposes... even if her camera was stolen, she should have borrowed one or bought one for this purpose.

</comment></comment></comment><comment><USER100> Heartbreaking to read this.

Hang in there.

It may help to think that a) these people are broken in some profound way, possibly from some early abuse b) this may not be directed at you personally, you did not deserve this, and this was not your fault

I do think the AirBnB business model needs to take into account some kind of insurance cover, or set aside some percentage of funds to apply to help in the edge cases like this - so that some of the practicalities are taken care of [ such as cleaning the apartment, temporary accommodation ] giving the victim some breathing space to heal from this.

</comment><comment><USER101> I so wish he had a camera at least on the entrance of the apartment. Besides I hope that since the burglar used Internet for communication the IP address is recorded with AirBNB or Google and that will help track him/her down.

Horrible story to be sure. Trust no one goes too far but trust and verify should be the norm. I for one would have thought twice before giving out house keys to a person who misspelled his/her own last name. I guess as he seems to indicate AirBNB model/markting fooled him into 100% trust.

</comment><comment><USER102> This sort of thing is bound to happen when you have helped over 1 million stays between two people who are usually strangers. I think what's more impressive is how long it took for something this big and this public to happen. Human beings act in strange ways and you take a risk anytime you interact with one. I feel awful that this happened to this woman but I don't think it means Airbnb has a flawed business model or needs to dramatically change the way they sign up users.

</comment><comment><USER103> It begs the question, what would be a good verification system for online identities so that sites like AirBnB can leverage? Also, will your property insurance cover this or would this be considered albeit _rightly_ to some extent a carelessness on your part. Come to think of it, like any other insurance industry, providing insurance (dedicated?) for such people for an additional X% wouldn't be a bad start - though it might need more volume for it to be profitable.

</comment><comment><USER104> Reading this article, my spidey sense was tingling the entire time. For whatever reason, I instinctively do not believe that the story this person is telling is the truth.

</comment><comment><USER105> I wrote a comment 2 days ago about some of the psychological barriers of this model that AirBnB would have to overcome--and I never even considered the traveler to be the one who's sketchy/troublesome.

<http://news.ycombinator.com/item?id=2802898>

On that note though, it'll be really interesting to see how AirBnB tries to counter this problem--there's a reason why people are so secluded and things are so private and fenced.

</comment><comment><USER73> victim is correct, this was bound to happen to someone and as the service goes popularity, there will be more victims in the future. AirBnB should have other security measures in place like providing driver license #, ssn, etc. so that identity of the person renting the place is assured. With all the recent funding leading to great PR, bad elements will start coming in. Site is no longer bound to the nice educated customer base.

<comment><USER56> How do you verify that the drivers license, ssn etc are genuine, and not simply stolen as the credit card numbers are?

<comment><USER74> Send a physical letter to the address of the user's bank account, or other form of ID?

</comment></comment></comment><comment><USER106> This is one of those things that made me weary about the home rental business (not necessarily just AirBnB). While I do feel the idea is great, I'm not sure I'd be as composed as this person; especially coming back to a destroyed and violated home. I guess there's no way around it, but this should definitely add an extra layer of thought before posting your home on AirBnB or any other service. Scary stuff.

</comment><comment><USER107> I wouldn't be surprised if this was organized and executed by an AirBnB competitor.

It is just too malicious and meticulously done to constitute a random crime (do I watch too many crime shows? maybe.) AirBnB just closed a gigantic $100m round and they are doing phenomenally well, and here comes someone who makes "everyone's worst fears" about lending out their apartment to a stranger come true.

<comment><USER108> If the competitor was in the same business, I think this kind of story would negatively affect them too.

Well, unless hotel chains are cooperating in doing it to tarnish AirBNB's repuatation - but I still think that is unlikely.

</comment></comment><comment><USER109> Is this real? It sounds like a fictional story.It's awfully flowery prose for someone who was just victimized and "laying in fetal position in her stairwell." Nowhere does it say this isn't fiction. Awful lot of buzz and no further response from the author?

The journalist who commented on the blog who checked with SFPD was unable to find the case.

So -- real or fiction? Someone call in SNOPES!

</comment><comment><USER110> It is unfortunate that stories like that could really harm AirBnB's reputation. I am sure that there are plenty of vacation rental stories of people trashing and burglarizing properties, but the difference is that this was not a vacation rental. I hope that thieves do not make a trend of preying on AirBnB hosts to gain access to their private residences.

<comment><USER111> AirBnB's policy of "disallowing the exchange of personal contact information until the point in which a reservation is already confirmed and paid for" seems like it makes this kind of story inevitable.

</comment></comment><comment><USER112> _"I certainly cannot and do not blame the agency for what has occurred. If anything, I blame myself"_

Yeah no shit. You let strangers stay in your house for a week and all your valuables were still in the apartment?

I guess Airbnb could have a "safety" section but this type of warning would be similar to the "Caution! Hot!" they're forced to put on coffee cup lids now.

</comment><comment><USER113> Welcome to the real world, such things are bound to happen. The main question is: to what degree does AirBnB know the identity of the perpetrator? Let alone helping the police catch them; but is AirBnB even able to prevent this person from making a new account and repeating the deed?

</comment><comment><USER114> Yeah, guess people are different. I would __NEVER __invite strangers to be in my house alone. Esp not with my stuff still there. I can't comprehend why anyone would. Can't understand how airbnb is popular service. But, it is. Like I said people are different...

</comment><comment><USER115> My wife and I been traveling around the world staying at airbnb's for the last 4 months (www.shenventure.com is our travel blog). During our stay in Hong Kong, our host required a photocopy of our passport or driver's license. I think this was a clever deterrent on his part.

</comment><comment><USER116> Of all of the items discussed, the birth certificate, social security and passport are the most important (imho). Supposing I kept them in a bank safety deposit box, what would a thief need to get access to that box?

</comment><comment><USER117> Does AirBnB have owner's/hoster's testimonials like CouchSurfing? It really goes a long way to show someone is trustworthy if they've stayed at 100 people's homes and everyone said nice things about them.

</comment><comment><USER118> How could you, in principle, even tell that it was the bnb'ers who did it? What's to say that they didn't accidentally leave the door unlocked when they left, and someone else broke in?

<comment><USER119> If nothing else, it takes a while for wet towels to get mildew.

</comment></comment><comment><USER120> Good explanation of why hotel rooms cost more than AirBnB rooms.

</comment><comment><USER121> Call me insensitive, but I think the drama here is overblown. Renting out your room to strangers comes with risks. Theft is an obvious one. Could have been a one or two paragraph post, but maybe this is part of the catharsis in getting over a robbery.

And now call me a cynic, but I kind of have the feeling that the the public drama of this complaint is a way of getting the sweetest customer service response ever from AirBnB. Like, new gear, near apartment, moving costs, all of it. Almost like a cooked up insurance claim... if it's not that, AirBnB will probably experience that kind of scam at some point.

</comment><comment><USER122> AirBnb is not legally liable. They are however morally liable. Every company does legal. It's the moral compass that differentiates a company and their founders.

</comment><comment><USER123> I dunno this seems like a hoax to me. Something is fishy about it. I suspect it is a negative PR scam aimed at airbnb.

</comment><comment><USER124> Does homeowner's/renter's insurance cover the property damage from renting out your place?

<comment><USER125> No, it doesn't cover illegal transactions. In many places the Airbnb rentals are violations of local or state hotel laws. Even in places not covered by those kinds of laws, it's unlikely that insurance for owners and renters of a private home covers commercial services in the home. Of course everyone should check their own policy to be sure.

</comment></comment><comment><USER126> With a name like Dj Paterson I'm not sure you could even sign up on google+ or fb.

</comment><comment><USER127> There is no way those guys lived there for a week and left no fingerprints.

</comment><comment><USER128> How sad. I hope you'll be able to cope from this experience soon.

</comment><comment><USER16> I hate that the author broke out the short skirt rape thing. I don't think someone that leaves their house to strangers while they go out of town for a week is quite as innocent as a rape victim that was targeted for lack of modesty.

<comment><USER129> _Innocent?_ Careless != guilty.

<comment><USER16> Right, but it's bad taste to equate a short skirt with letting someone you've never met live in your house completely unattended for a week. Most people have the sense to understand that that is a dangerous idea. I don't endorse either ransacking or rape, and I recognize that there was a crime that was committed here and that the victim is still a victim. But I think comparing that to comments that a woman "deserved" to be raped because of her attire is over the line and insensitive to rape victims.

<comment><USER129> I only criticized your choice of words: _"I don't think someone that leaves their house [...] is quite as _innocent_ [...]"_ implies that this somehow makes them guilty.

I believe that both the homeowner and the figurative rape victim are equally _innocent_.

</comment></comment></comment></comment><comment><USER130> It would be interesting to see AirBnB's response to this.

</comment><comment><USER131> Hmmm, somebody changed the title of this HN post from _"AirBnB: Crimes committed against a host"_...

<comment><USER70> yeah, i'm interested to see what the reasoning behind this change is. seems suspect.

</comment></comment><comment><USER132> Trust me, be it AirBnB or FairBnB, just never hand over your home keys to a stranger - a stranger to "you". Make it a thumb rule.

PS. sad to hear the loss and trauma BTW.

</comment><comment><USER133> It sounds like AirBnB need to educate first-time users more..

It obviously is not for those people who have property that cannot remove personal items from said property before doing a earn-my-trust AirBnB person trial run..

</comment><comment><USER134> The description of what happened, supposedly, is so weird, that I'd bet most likely this was an astroturfed (setup) incident. On the other hand, never underestimate just how stupid, mean, random, evil or rude a human can be. The more I live the greater depths you see. Also, even if this was a faked/fraudulent event, regardless, it would still be true that this kind of thing could naturally happen to anybody that makes their place available via AirBNB. It's statistically inevitable, given the nature of the service and the nature of humanity.

</comment><comment><USER135> I wonder if the hotel chains would hire goons to do this.

<comment><USER135> Ouch. Not sure what everyone has against this simple speculation. The hotels have already used some sleazy legal tactics against Airbnb and corporations have been known to do worse when an entire industry is under threat.

I just find it odd that a mere thief would go to so much extra trouble to destroy things and cause grief.

</comment></comment><comment><USER136> _Cui bono?_

Hotels.

It seems likely that this "mysterious" crime was paid for by an organization serving the interests of hotels.

<comment><USER131> _Cui bono?_

On some level, the bad bastards who did it.

Alternatively yes, of course. Building 7, Area 51, Chemtrails etc...

<comment><USER136> The apartment-trashing was entirely senseless. The motive was clearly not theft, for example.

The _simplest_ hypothesis is that the purpose of the crime was to create outrage - in order to destroy the reputation of AirBnB and its business model. It may yet succeed in doing so.

<comment><USER131> You are aware that there exist nasty people? People who take pleasure in inflicting pain? _That's_ the simplest hypothesis. There's no need to lurch into dark conspiracy theories without any supporting evidence.

<comment><USER136> The polite "everything is beautiful" emails suggest against meth addicts. And it seems like too much work for a run-of-the-mill sadist.

<comment><USER131> You're right. This has the fingerprints of Big Hotel all over it.

It's clearly black-ops by a Hospitality-Industrial Complex team.

 _Gimme strength..._</comment></comment></comment></comment></comment></comment>


Ext4 encryption - <AUTHOR> https://lwn.net/Articles/639427/ <comment><USER2> > The developers note, though, that if an attacker can make changes to an > encrypted filesystem that is subsequently mounted by the user, all bets are > off.

Did this line stand out to anyone else?

I would expect modification of an encrypted directory to cause the loss of any modified files, but I'm surprised at the specific wording of that statement. From that, I'm reading that it could be possible to modify an encrypted directory so as to cause key or plaintext content leakage if the directory is accessed again or the volume is re-mounted.

Does Full Disk Encryption have this problem as well (mounting a maliciously modified full disk encrypted filesystem could result in disclosure)?

<comment> TD-Linux Yes, in all of these cases you can modify the initrd to steal credentials.

<comment><USER3> That's not totally a given anymore with so many UEFI laptops capable of Secure Boot. They additionally mentioned android as a use case for this which also generally comes with a locked bootloader among other boot chain security features.

You can build the kernel as an EFI module (using EFISTUB) and have EFI verify its signature. Most new laptops do support this and an increasing number of desktops and servers do too. In this case, some users may be surprised to find that even though they used ext4's encryption on /, someone can still modify the inode table since it remains unencrypted (though I could be reading the article wrong).

</comment></comment></comment><comment><USER4> According to the comments, the primary benefits of filesystem-level encryption over full-disk (block-level) encryption are claimed to be:

1) The filesystem can be configured to expose different parts of the tree to different users, whereas FDE is all-or-nothing.

2) The filesystem can make room for more metadata than a block device, so it would be easier to implement authenticated encryption.

3) More fine-tuned control over caching.

But are these really significant advantages?

1) Most devices nowadays, including Chromesbooks and Android phones, are only ever used by one person.

2) We could modify dm-crypt to set aside a certain amount of space for MAC, and just expose a smaller block device to the next layer. Besides, the proposed changes to ext4 don't use authenticated encryption, either.

3) Can't this be addressed at a lower level?

<comment><USER5> For point 2, you can't just expose a smaller block to the next layer - everything is designed to work with 512-byte logical blocks. You could possibly do it if you were willing to sacrifice half your disk space by pairing every 512-byte data block with a 512-byte authenticator block, but...

...the other issue is that you need a way to atomically update the data block and authenticator together. This is a similar problem to the "RAID write hole", and doing this at the block layer requires even more overhead - something equivalent to RAID write intent bitmaps.

The filesystem, on the other hand, already tends to have a journal, log- structure or COW rules that allows some form of atomic transactional updates. The encryption authenticator can piggy-back on this.

<comment><USER6> Well if you use atomic 4K writes to the drive, and expose each one as 7 512-byte blocks to the next layer...

<comment><USER4> That's exactly what I was thinking.

SSDs have fairly large page sizes and erase block sizes, so you're often reading and writing a lot more than necessary, anyway. A clever implementation might be able to take advantage of that to scatter the MAC throughout the drive without too much impact on performance or longevity.

</comment></comment></comment></comment><comment><USER7> A related question: what's the best practice to encrypt the FS of a server and allow unattended reboots? One doesn't want to have to type in a password at each reboot (no unattended reboots and impractical for large number of servers) but the password can't be left attached to the server. So how is it done, if it is done? Thanks.

<comment><USER8> Doesn't this defeat the purpose of encryption? If someone steals your server, they can just reboot it and get access to everything.

<comment><USER7> Exactly, that's why the password shouldn't be on the server, but having to type it in every time is inconvenient. Nothing I've been able to think about is secure so I was asking. I also understand that any attacker gaining access to the server while it's running (the usual scenario) gets access to the unencrypted file system so maybe it doesn't make much sense to encrypt servers. Still I'm curious.

<comment><USER9> > _Exactly, that 's why the password shouldn't be on the server, but having to > type it in every time is inconvenient. Nothing I've been able to think about > is secure_

That's what I said to a friend of mine when we had numerous servers with encrypted disks and frequent power outages requiring us to type in passwords. He then suggested many different schemes to fix this, each of which I shot down as being insecure. Then he came up with something which I couldn't shoot down, and he made a first proof-of-concept implementation, which is how Mandos¹ got started. This was many years ago; Mandos has since become available in Debian and Ubuntu; just do "apt-get install mandos".

① [https://www.recompile.se/mandos](https://www.recompile.se/mandos)

</comment></comment></comment></comment><comment><USER10> For those who missed it there is a relevant comment by user abatters against the use of per-directory encryption:

[https://lwn.net/Articles/639766/](https://lwn.net/Articles/639766/)

edit: how can I quote a block of text that preserves newlines?

</comment><comment><USER5> I'm not sure how this is supposed to work in the mobile device (Android / Chrome OS) scenario.

These devices are typically on (but suspended) when they're lost. If this means the master key is still in memory, then the attacker has it.

If, on the other hand, the master key is wiped when the device suspends and is reloaded when you unlock the device, how does your SMS application write your messages (that come in while the device is suspended) to disk? How does the phone lookup your contacts to display the incoming caller name if the device was suspended when the call came in?

<comment><USER11> You can wipe the master key when you suspend. However it will just mean that there needs to be some unencrypted storage to write down things like incoming text messages. Caller ID will also not work (or be stored in the unencrypted storage).

There are ways to do it, but you will lose security/convenience. It all depend on your threat model and how inconvenient you're willing to make your phone.

<comment><USER5> If your text messages and contacts have to be stored in unencrypted storage, then what exactly are we protecting here - your 2048 high score?

</comment></comment></comment><comment><USER12> I noticed that ecryptfs + ext4 doesn't support sparse files efficiently (it takes a long time to write to a large sparse file, as if it actually writes/encrypts all the zeroes). Having encryption directly in ext4 should solve that, but I haven't tested the patchset yet.

</comment><comment><USER13> Could someone please give or link to a comparison of Ext4 encryption and NTFS encryption?

</comment><comment><USER14> Don't miss the comments in the linked page for more insightful information.</comment>