Chinese Hackers Infiltrate New York Times Computers - <AUTHOR> http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html?pagewanted=all&_r=0 <comment> brown9-2 If you want to give credit to a report detailing how much money your political leaders have piled up for themselves, hacking the media outfit that published it is a great way to confirm the story.

<comment><USER2> _If you want to give credit to a report detailing how much money your political leaders have piled up for themselves, hacking the media outfit that published it is a great way to confirm the story._

Do you think it matters _now_ for the Chinese gov? By doing this and more they will make it very expensive for NYT and impossible for smaller outfits to mess with them. Maybe they'll uncover some dirt and release it to embarrass or discredit its reporters, who knows.

Google thought they'd forced them to back down and we know what happened.

<comment> brown9-2 I don't think the New York Times would need much motivation to investigate corruption in China in the first place, but I strongly doubt being hacked by a foreign government would make them less motivated to do so.

</comment></comment></comment><comment><USER3> All this focus on the sophistication of the Chinese hackers irritates me slightly.

Reading between the lines, it seems the NYT would likely have weathered this "sophisticated" attack a lot better if they had observed a few simple security best practices:

\- Salt your password hashes (rendering rainbow tables inert)

\- Train your staff NOT to open attachments from unknown sources (especially if you've just written an inflammatory article on a foreign government official)

\- Configure your mail server to automatically strip and quarantine any attachment (inbound or outbound) that isn't of a type defined in a very strict white list

\- In addition to network firewalls, make use of the software firewall on the PC's themselves by tightly controlling what processes on the machines are given egress permission

This stuff isn't rocket science and if the NYT can't get it right (knowing that they're a natural high profile target), what hope do other firms have?

The focus of the discussion should be on getting to the bottom of why we keep seeing these basic security oversights being made over and over again, not panicking about Chinese über hackers and suggesting everyone move to smart cards, retina scans or paper.

<comment><USER4> > Salt your password hashes

As brown9-2 mentions in his reply, it was a Windows Domain Controller

> Train your staff NOT to open attachments from unknown sources

Spear phishing attacks are more sophisticated than that. They aren't sending .EXE files. The two most common attachments are RTF[0] and PDF[1], or a link in the email body to a website that will attempt a drive-by download.

These emails are composed in a way to make them look innocent (for eg. 'Twitter Password Reset Request', 'New Amazon.com Order', or an email from a new source, etc.).

It is also likely that at this level of sophistication that there are 0day exploits involved.

Attackers can send hundreds of spear emails over weeks and months, they just need a single click from one user to get their foot in the door.

> quarantine any attachment (inbound or outbound) that isn't of a type defined > in a very strict white list

As mentioned above, the attachment types are RTF, PDF and XLS - and much more common is a link in an HTML email.

> make use of the software firewall on the PC's

The command and control servers send commands to ordinary looking websites using HTTPS. If you read the analysis of Flame or Stuxnet you will see the lengths that the designers went to to obfuscate this traffic.

This analysis[2] describes what the C&C servers looked like for Flame. The admin panels make no mention of bots or worms, it looks like any other intranet site.

It is really difficult to defend against these types of attacks. An attacker only needs 2 or 3 decent exploit writers to come up with a unique attack vector and a custom trojan tailored for the target. Also, time is on their side and they only need a single hit while you need to find and shut down all of the attempts.

[0] <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3333>

[1] <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4363>

[2] [http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame...](http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame_s_Command_Control_servers)

<comment><USER3> Re: Windows Domain Controllers - I wasn't aware they didn't have the ability to salt hashes (I last used domain controllers and active directory back in the Win2K days). I could be facetious and say "move to open ldap, samba 4, zarafa and an open stack" but I realise that isn't being very helpful :)

Re: spear phishing attacks

All it takes is a bit of training and common sense to significantly reduce the effectiveness of this vector. Examples:

1). Remove Flash and, if possible, Java from all the desktop PCs and work laptops. [0]

2). Use a non-Adobe product for reading PDFs

3). Standardise on one browser (e.g. Chrome), force all users to use it and have someone in IT be responsible for tracking all security announcements from the manufacturer.

4). Ban browser addons

5). Train staff to hover over any link in an email and verify where it's going to before clicking it (and to be especially vigilant if the url purports to be from a well known website i.e. amazon, twitter etc)

6). Ban staff from clicking on any link rendered by an url shortening service.

7). Ban staff from opening any attachment from a new/unrecognised email source (regardless of file format).

8). Re-work your provisioning, network architecture and file storage setup so that it becomes quick and painless to regularly (even randomly) format user's machines and install a clean image.

9). If feasible, configure all user's email programs to render emails in plain text and encourage staff to avoid checking their private accounts on work provided machines (especially high profile users).

10). Ban users from connecting non-work appliances to the network. Use MAC filtering if you have to enforce this.

Re: firewalling

That's why I said block everything going out and only white list a very limited number of _processes_ not ports. Do it via the native software firewall or something like TinyWall.

[0] If a user really needs either of these, they can apply for special dispensation and IT can (after making sure the user is security trained) give them a locked down virtualbox instance they can launch from the desktop. If possible this could also be scripted so that it gets deleted every day or week and re-provisioned from a "gold" vm image.

Some attacks would still make it through despite the above but that's life. At the very least it raises the bar needed for a successful attack, making vanity hacks (like in the case of the latest one on the NYT) less common.

</comment></comment></comment><comment><USER5> The executive editor of the Times says "Computer security experts found no evidence that sensitive e-mails or files from the reporting of our articles about the Wen family were accessed, downloaded or copied"... but referring to their forensics they say that the attackers "search[ed] for and grab[bed] Mr. Barboza's and Mr. Yardley's e-mails and documents from a Times e-mail server" after cracking their password hashes.

So which is it? Did they download gigs and gigs of mail, but _not_ the ones they were looking for? Or is "found no evidence" doublespeak for "we're pretty sure they got what they were looking for, but the logs had already rolled over on that system, so we have no evidence that they did". Based on the rough timeline presented, this was after they were known, so it may have been their honey-pot server, but the tone of the article suggests that they were not honey-potting them and simply monitoring their progress as they slowly stomped their way through their live network. This begs the question... if they were really monitoring the attackers for months, including watching them grab Barboza and Yardley's e-mails, what are we to make of the PR statement that no relevant or sensitive e-mails were obtained?

</comment><comment><USER6> There's a couple surreal quotes in here. Like asking the Chinese Ministry of Defense to comment.

"A Symantec spokesman said that, as a matter of policy, the company does not comment on its customers."

Uh huh. Even when it's the customer doing the asking? Way to hide behind the policy.

<comment><USER7> About Symantec's technology, it is worth noting that antivirus scans are based on identifying malware in one place, then being able to recognize that malware everywhere. This does not particularly help you recognize malware that was custom made to only be installed in one location. Particularly not when the people who were making that malware themselves have access to your anti-virus scans prior to deployment and can verify on their own computers that you do not detect them.

Therefore there is no surprise that Symantec failed to provide any meaningful protection during this attack. They know this. But they hardly want to admit it in front of all of their customers.

<comment><USER6> But see, the thing is, that's not what it says on the box. <http://us.norton.com/antivirus/>

"It's okay to blink, because we never do – SONAR technology and live 24x7 Threat Monitoring watch over your PC for any suspicious behavior to quickly identify threats."

"Protection from the future, available today – our exclusive reputation and behavior antivirus technology are so advanced that they can stop online threats that bad guys haven't even created yet."

<comment><USER7> Yes. And if you engage in _suspicious behavior_ like connecting to a botnet and then spewing spam, SONAR likely figures out that something is wrong.

But remote command and control through a covert channel can be done in ways that do not look particularly suspicious. And a sophisticated attacker should be assumed to know what behaviors SONAR is looking for.

</comment></comment></comment></comment><comment><USER8> I think it's important to understand the Chinese perspective on this issue, if only to see why they do these things. Start with this:

[http://www.nytimes.com/2011/04/15/world/15aid.html?pagewante...](http://www.nytimes.com/2011/04/15/world/15aid.html?pagewanted=all)

      U.S. Groups Helped Nurture Arab Uprisings

      Even as the United States poured billions of dollars into
      foreign military programs and anti-terrorism campaigns, a
      small core of American government-financed organizations
      were promoting democracy in authoritarian Arab states. ...

      The United States' democracy-building campaigns played a
      bigger role in fomenting protests than was previously
      known, with key leaders of the movements having been
      trained by the Americans in campaigning, organizing through
      new media tools and monitoring elections. ...

      Today the work of these groups is among the reasons that
      governments in turmoil claim that Western meddling was
      behind the uprisings, with some officials noting that
      leaders like Ms. Qadhi were trained and financed by the
      United States. Diplomatic cables report how American
      officials frequently assured skeptical governments that the
      training was aimed at reform, not promoting revolutions.

and then this:

[http://online.wsj.com/article/SB1000142405274870356040457618...](http://online.wsj.com/article/SB10001424052748703560404576188981829658442.html)

      Is China Next?

      Over the course of three short months, popular uprisings
      have toppled regimes in Tunisia and Egypt, sparked a civil
      war in Libya and created unrest in other parts of the
      Middle East. They also have raised a question in many
      people's minds: Are all authoritarian regimes now
      threatened by this new democratic wave? In particular, is
      China, a rising superpower, vulnerable to these forces?

Whether or not you believe the Arab Spring actually resulted in good outcomes, the salient fact is that US funded groups started the revolutions and prominent neocons (like Fukuyama in that WSJ article) were/are calling for similar actions in China.

This is why the Chinese government feels that it is under attack by the United States, and it does not see a line between NGOs, the NYT/WSJ, and the US government, which they believe are working in concert to discredit their leaders and foment violent revolution in the name of democracy, as they did in the Middle East. Is this paranoid? Well, it's now hard to gainsay the USG/NGO connection given those articles, and in general even the NYT does tend to side with the USG against China or Arab regimes (most famously with Judith Miller).

From this worldview, China thinks of this as a conflict between one of their intelligence agencies and one of ours. It's not obvious that they are wrong in that assessment.

<comment><USER9> Very good points!

>> it does not see a line between NGOs, the NYT/WSJ, and the US government.

Aren't we all doing the same mistake when we refer to them? All we know is that the attacks came from China, so we safely assume it came from the Government? Why is it that each time something comes from China (a country with approximately 5 time more people than the US - source Wikipedia) we blame their government and treat it as a declaration of war (or, with less exaggeration, a political move)? Is it possible that this enormous gigantic human honeycomb has, say, organizations, corporations, competitors, God-knows- what-which-isn't-their-government?

The western media have created this weird image of China and ... something doesn't add up. I've never been there and I hope I'll get the chance some day, but I can't help but feel that "someone" (feel free to replace this word with the antagonists of your favorite conspiracy theory) is trying to shove down our throat that China is a menace.

That being said, I agree with your analysis. The Chinese government has seen what happened in the Arab world and it knows that the US constantly needs an enemy. It probably does feel threatened.

<comment><USER10> I've been there. I spent 6 months last year.

What you might not understand is that the Chinese government has its hands in every corporation, organization, competitor, etc.

You might have false assumptions coming from the US system, where corporations and government are separate entities. They even sue one another at times.

In China, large corporations are overseen by the government. The government funds them, decides what they can and cannot do, and decides which corporations will succeed. You cannot build a search engine or social network right now, unless you pull a political coup, because the government controls which companies succeed. Baidu and Tencent are the "blessed children" for the time being.

Within the government, China is run by various clans, continually vying for power in the Communist Party. It's easiest to build a large company by having a family member in the upper echelon of the party, to push things through.

Everything is connected to the government in China. It's in your company's interest to keep the party in power, because the corrupt politicians keep you in business. It's in your wealthy family's interest to keep the government in power, because they keep you wealthy. It's a giant corrupt system, keeping itself in place.

Most likely, these attacks were actually executed by some low-level hackers somewhere. But most certainly, someone in the government has something to do with their funding, organization, or guidance.

<comment><USER11> "Government" is not one cohesive entity, certainly not in a country as big as China. Sure, there might be some rogue actors sympathetic to such attacks. But that doesn't imply that "Chinese government" in general is supportive of such acts, just like a few corruption scandals do not imply that entire US government is corrupt.

<comment><USER12> But for each scandal we need to re-evaluate the prior.

I'm irritated that you post this as if presupposing that the US government is not corrupt. I know you are factually correct, but the connotation bothers me.

When they failed to stop SOPA of their own accord, I realized that the majority _are_ either incompetent or corrupt.

<comment><USER11> Well, my main point was about China and mentioned US govt just as an example. If you don't like that example, how about: "Its wrong to call a corporation corrupt just because a few mid-level employees go rogue"

</comment></comment></comment></comment></comment></comment><comment><USER13> Strange that they would hack NYT when NYT's source for the WenJiaobao article seemed to be public financial records and info from wikileaks (state department cables).

What is the strategic gain from hacking NYT? Identify potential other sources (within china) perhaps?

<comment> brown9-2 It's not necessarily that the state as a whole found strategic value in this. Could just be one general hoping to impress the Politburo.

<comment><USER14> TBH, it could be anyone in the chain with sufficient authority to trigger it and hoping to impress someone who can reward him in a tangible manner.

And the sad thing, it is not limited to bureaucracies or government organisations. I have seen bugs that are not fixed, patches that are rejected because it allows someone somewhere to behave heroically in an attempt to impress someone.

When I first experienced this, it was a very real WTF moment from the School of Dilbert Mismanagement.

</comment></comment></comment><comment><USER15> It will be interesting if we see the first use of national firewalls used to keep a nation-state boxed in from the outside. I'm not sure what the 21st century equivalent of a blockade or siege is, but that would come close.

<comment><USER16> Interesting idea but difficult to implement. The hackers hide behind proxies. Unless you could cut off proxies everywhere they would still find ways to get in.

<comment><USER15> As are sieges and blockades of course.

As virtual as the Internet is, in many ways, it still takes physical form as fiber optic cables and trunks. And due to a variety of reasons the number of those that cross national borders is fairly limited. Wireless is great but hard to push terabits of data through like lasers in glass do.

I've just always thought of the Great Firewall of China as a state device to keep Chinese citizens from full access to the Internet, this article made me wonder if at some point there will be another Firewall outside the Great Firewall which _isn't controlled_ by the Chinese but also keeps Chinese packets inside the country but for different reasons.

</comment></comment></comment><comment><USER17> From the article:

"After surreptitiously tracking the intruders to study their movements and help erect better defenses to block them, The Times and computer security experts have expelled the attackers and kept them from breaking back in.

"The timing of the attacks coincided with the reporting for a Times investigation, published online on Oct. 25, that found that the relatives of Wen Jiabao, China's prime minister, had accumulated a fortune worth several billion dollars through business dealings."

As a student of the language, history, culture, current politics, and future prospects of China since 1975, I had better comment on how significant this is. The effort by operatives based in China (that much is indisputable from the computer forensics involved in this case) is deeply hostile to the press freedom that is a fundamental difference between China and the United States. Under usual principles of international law, China has the responsibility to keep actors on its territory from launching harmful attacks on the territory of another country, unless it is interested in declaring war. Prior restraint of news media is routine in China, and accounts for a great deal of the public ignorance in China that keeps the current dictatorial regime in power, but it is not at all a friendly act toward the United States. The United States government has everything to gain and essentially nothing to lose by every other government on the planet being exposed to more press coverage of national leaders and their possibly corrupt activities. In this regard, the current regime in China and any government of the United States under the Constitution have inherently differing interests.

The national interest of the common people of China, on the other hand, would be best served by freeing the news media there from the prior restraint and censorship that now exist there. If everyday people in China knew better what is really going on in the country, and what their leaders are doing, China could make greater progress in overcoming persistent poverty and enjoy more peaceful relations with countries all around the globe. Right now, the masses in China are not given the choice of knowing what's going on through uncensored mass media, nor are they given the choice of free and fair elections for choosing national leaders.

My best hope is that this effort to scare off the New York Times from honest reporting about China will fail as efforts by the Church of Scientology to frighten away investigative journalists are also increasingly failing.

[http://tonyortega.org/2013/01/29/more-signs-of- scientologys-...](http://tonyortega.org/2013/01/29/more-signs-of-scientologys- armageddon-as-the-media-takes-aim/)

A lot of journalists would like nothing better than to write even more tough stories about what is really going in China, based on unfettered reporting with Chinese-speaking sources in the country. One journalist from China I met long ago in a place far away commented well in advance of the Internet age that if the Communist Party of China ceased censoring mass media that its rule would be gone "in a week." The time will come when the Party can't shut down all the channels of information flowing into China and within China, and then the Party will have to face elections or face a revolution.

AFTER EDIT: The first reply asked a fair question, which is whether or not there is a basis for thinking that the Communist Party of China losing power in China would be a good thing. My answer is yes. I lived in Taiwan both under the KMT dictatorship and under its current democratic regime (which now again has the KMT as the ruling party, after an election). I have also been to Hong Kong. Chinese people can adapt well enough to democracy. In general, all around the world, freedom and democracy have their defects, but they are generally better for the people who live with them than the alternative. Precisely because Taiwan is available for an example, I think a transition to democracy in China could be especially smooth. It is regrettable that although there are Muslim democracies, the first attempts at specifically Arab democracies so far are nascent and struggling. The democratic transition in Arab countries will be harder in the short term for lack of culturally similar examples, but I think that too will be a long term benefit to the common people of the Arab lands.

AFTER ONE MORE EDIT: Anyway, it shouldn't be the censorship and armed force of the Party that restricts the people's right to choose their national leaders.

<comment><USER13> > One journalist from China I met long ago in a place far away commented well > in advance of the Internet age that if the Communist Party of China ceased > censoring mass media that its rule would be gone "in a week."

Is that a good thing?

Would it's replacement be better?

Arab spring has kind of taught us that things aren't as simple as: "Break status quo and things get better".

<comment><USER18> _Arab spring has kind of taught us that things aren't as simple as: "Break status quo and things get better"._

I don't think that anyone needed to be taught that. I doubt that we will be able to judge whether the Arab Spring was a success for another ten or twenty years- the immediate aftermath of revolution is always deeply messy.

Not to mention that 'better' is entirely subjective anyway, of course. There are plenty of older Russians that miss the Soviet days, believe it or not.

<comment><USER13> That was my point.

If it takes 20 years to see a 'benefit' is it that bad now, that they should go through that kind of mess?

<comment><USER18> When looked at from the very long term position, the removal of dictators is indeed a good thing that is worth suffering through. I'm not sure that anyone can judge whether it's worth it, though- that a personal judgement.

<comment><USER13> Dictators... Are you saying wen jiaobao is a dictator?

Given the vast improvement in the way of life for Chinese since deng xiaoping, and their continuos prosperity. Are we really sure that's the "best" thing to do.

</comment></comment></comment></comment></comment></comment><comment><USER19> "a thermostat in one of its corporate apartments and a printer in its offices — were still communicating with computers in China"

This is the dark side of the "internet of everything". Software=inherently buggy Software EATS WORLD Word=buggy?

</comment><comment><USER20> I like how the whole article is rambling about Chinese hacks yet no strong & clear evidence suggests it's from China, except perhaps from a Chinese IP address.

You know what, Chinese computers are also likely to be hacked easily.

<comment><USER21> I agree that the Times can't prove absolutely that the Chinese government was behind the attack. But they do provide a few strong pieces of evidence: (1) the university computers used in this attack were the same machines used in past attacks that were linked to China's military; (2) the attacks coincided directly with policy issues affecting Chinese officials.

The article also had a relatively even-handed tone. It discussed the broader trend of hacks originating in China without linking the trend to the Chinese government, and it included an eloquent rebuttal quote from a Chinese official.

<comment><USER20> the two evidence from NYT made a meme in Chinese Interwebs:

蓝翔 hacked Google.

</comment></comment></comment><comment><USER22> Seems like putting a password on their printer and thermostat as well as telling their employees not to click random links or better yet setting up a security rule on their email router to not allow links and attachments from outside the network would have prevented this.

In essence these big companies are leaving the door unlocked and keep acting surprised when people that don't like them open it up and poke around inside. There needs to be more education and common sense this sounds like a very easy attack to prevent.

</comment><comment><USER23> This story, and the recent RubyGems debacle should be teaching all of us one thing -- assume you can and will be hacked. Do you understand the implications (what data you are going to lose? what credibility?) Do you have a plan to deal with it?

Ruby Gems was lucky in that their hack was noisy. The chinese government, as illustrated above, won't play so nice.

This is why monitoring and incident response matter.

Remember the subtle backdoor that almost slipped into the Linux kernel in 2003[1]? That could be Ruby Gems right now. Hopefully, they are taking the proper steps to investigate exactly what the hackers did.

[1] <http://kerneltrap.org/node/1584>

<comment><USER24> China appears to be engaging in highly sophisticated attacks of the like that major companies need to be aware.

The RubyGems fiasco is the result of remarkably incompetent decisions by everyone in the chain of control.

The lessons are completely different. In the first, it's that you have to expect that you will be compromised if a determined and capable attacker targets you.

In the second, it's that you will be compromised if you use software written by people and maintained by a community that seemingly lacks any remote resemblance of engineering competence.

<comment><USER23> I don't think the RubyGems people were incompetent. The software serves its core purpose quite well (as a library delivery mechanism) and is quite reliable. But clearly they weren't thinking about security in decision, and what would happen if the repos were compromised.

Let's be honest here - no software is 100% secure. As developers and consumers, the idea that we all review all of the tools in our toolchain for security soundness is absurd. It's like saying that everyone using C made poor decisions because of security flaws in popular libraries (even security ones, like openssl) and therefore all of the C community has no engineering competence.

The fact is, China already has their eyes on GitHub and it's not beyond the planning capability to place backdoors in popular software to suit their future ends.

No matter who the attacker may be, you have to be prepared for the situation where your computers and data are compromised, period.

<comment><USER24> > _I don't think the RubyGems people were incompetent._

They sat on a publicly disclosed vulnerability in the YAML parser for a week. The YAML parser itself was ridiculously designed to (essentially) eval() YAML.

Those were the two active decisions of incompetence.

On top of this, they built a massively central system that is widely trusted with no means of code verification whatsoever. There is no telling what people could have injected into that repository at any point in its history.

<comment><USER25> > On top of this, they built a massively central system that is widely trusted > with no means of code verification whatsoever.

<https://github.com/rubygems/rubygems/blob/master/History.txt>

0.8.11 / 2005-07-13: Added Paul Duncan's gem signing patch.

They've had a mechanism for code signing for 8 years. Yes, they could require signing of all gems on the site, but the ability has been there for a long time.

<comment><USER24> This doesn't do any good if it's not required/used, which it's not.

As a counter-example, the maven central repository requires signatures, and caching Maven repositories validate those signatures.

<comment><USER25> I'm simply contesting the "no means of code verification whatsoever" statement.

<comment><USER24> My point is simply that without signatures, there is no means of verification. Having the code isn't enough.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> So PRC online spin doctors couldnt do the job <http://en.wikipedia.org/wiki/50_Cent_Party>

</comment><comment><USER27> didn't expect much out of this story because it has felt for a long time that hackers targeting politically sensitive media orgs, govt and private sector out of China is the norm. Too common, widespread (however it's being organized) and they are too many for us to keep tabs on/hope to stop. All we can do is be vigilant in security practices and keeping on top of latest measures.

<comment><USER28> Keeping on top of the latest measures is great, but I wonder if it's good enough. Maybe we should go back to writing our most sensitive information on paper.

</comment></comment><comment><USER29> "It then replaced every compromised computer and set up new defenses in hopes of keeping hackers out."

I hope that's just poor reporting, or does the Times' IT department really have that poor an understanding of how computers work? No wonder they got pwned. And I'm not buying the "we gave them free reign for four months on purpose" line. It makes no sense.

<comment><USER30> Someone has poor understanding of how computers work, but it isn't necessarily the NY Times.

Once a computer is compromised, you can't trust anything about it. You may believe reinstalling the OS is enough, but it is possible that some remote control tool is still lurking in a main BIOS reflashed while compromised, or in the GPU firmware, or tens of other places.

While it should potentially be possible to reflash everything, it is practically cheaper to replace the computers. Do YOU know how to reflash your bios with a trusted version, your GPU firmware, etc?

I don't mean "I know how to look it up on Google, and I'm sure I can do it if needed". This thing is hard to automate and do at scale even if you do know how to do it, especially if not all your computer models are uniform. Depending on how old and varied the hardware is, it is very likely that the economical solution, (assuming you suspect an attacker capable of these feats), is to replace all the computers.

[Though, all the hardware they replaced it with has been, most likely, built and QAd in China. Why would you trust _that_? The rabbit hole goes very deep. Practically too deep for anyone without a billion dollar R&D budget these days]

<comment><USER29> _You may believe reinstalling the OS is enough_

I made no such claim, but verifying bios and firmware signatures (and indeed detecting changes when they happen), and reinstalling them at scale is not a major challenge with a well managed IT infrastructure.

I can accept however that the Times may well have been running 10 year old PCs, with manual IT management processes, and outdated security software, and that replacement may have been overdue and economically more viable.

<comment><USER30> > verifying bios and firmware signatures (and indeed detecting changes when > they happen), and reinstalling them at scale is not a major challenge with a > well managed IT infrastructure.

Can you back up that claim with reference to a system that does that?

EVERY single management system I can think of trusts the system to report its status. You can't trust a compromised system to report its status.

Assume you have 5,000 desktop computers. How do you set them up so you can verify bios and firmware signatures without forcing a good bios reflash in the first place? (An action that does require soldering or jumper setting on modern motherboards!)

> I can accept however that the Times may well have been running 10 year old > PCs

If you're running your business properly, 3-4 years is the oldest any PC should ever get. If you know a business running 10 year old PCs, tell them to get a new accountant. Today's $300 ATOM netbook (with your 10 year old screen and keyboard) will have positive ROI compared to maintaining a 10 year old machine (The best 2002 Pentium 4 is comparable to a modern ATOM, but needs 5-10 times as much power). You'll be saving money just with energy/cooling costs.

<comment><USER31> Good point, as in theory both the BIOS and the BIOS flash update routine could be replaced/virtualized... confirming a successful update even though the update was ignored.

</comment></comment></comment></comment></comment><comment><USER32> "Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees"

Does this mean the NYTimes is storing passwords in plaintext?

<comment><USER33> I think if they have the ability to steal the passwords, even if they weren't plain text, they didn't do the proper precautions of encrypting with a salt. So either way, they failed.

<comment><USER34> At this point, passwords should be considered obsolete when it comes to securing things. We should be using smartcards and cryptographic techniques; humans are just not good enough at generating or remembering random strings for passwords to be considered a good idea.

<comment><USER35> Yes I personally like the Yubikey idea which integrates with AD. Keeping a physical token and just pushing a button is nice.

</comment></comment></comment></comment><comment><USER36> So much time and effort by talented people being used for such useless purposes. So monarchic.

</comment><comment><USER37> Looks like their mail is just protected by username & password too

</comment><comment><USER38> "Psychic spies from china tries to hack your mind elation"

</comment><comment><USER39> How come the Anonymous never attacked Chinese government?

<comment><USER40> [http://www.telegraph.co.uk/news/worldnews/asia/china/9189192...](http://www.telegraph.co.uk/news/worldnews/asia/china/9189192/Chinese- government-struggles-to-restore-hacked-websites.html)

google is useful for this kind of thing: <https://www.google.cl/search?q=anonymous+target+china>

</comment></comment><comment><USER41> *Crackers.

</comment><comment><USER42> Are these state-independent actors capable of orchestrating intrusions of such sophistication?

Judge for yourself.

      They operate from a bare apartment on a Chinese island.
      They are intelligent 20-somethings who seem harmless.
      But they are hard-core hackers who claim to have gained
      access to the world's most sensitive sites, including
      the Pentagon.

      In fact, they say they are sometimes paid secretly by the
      Chinese government -- a claim the Beijing government
      denies.

      "No Web site is one hundred percent safe. There are Web
      sites with high-level security, but there is always a
      weakness," says Xiao Chen, the leader of this group.

      "Xiao Chen" is his online name. Along with his two
      colleagues, he does not want to reveal his true identity.
      The three belong to what some Western experts say is a
      civilian cyber militia in China, launching attacks on
      government and private Web sites around the world.

      If there is a profile of a cyber hacker, these three are
      straight from central casting -- young and thin, with skin
      pale from spending too many long nights in front of a
      computer.

      One hacker says he is a former computer operator in the
      People's Liberation Army; another is a marketing graduate;
      and Xiao Chen says he is a self-taught programmer.

      "First, you must know about the Web site you want to
      attack. You must know what program it is written with,"
      says Xiao Chen. "There is a saying, 'Know about both
      yourself and the enemy, and you will be invincible.'"

      CNN decided to withhold the address of these hackers' Web
      site, but Xiao Chen says it has been operating for more
      than three years, with 10,000 registered users. The site
      offers tools, articles, news and flash tutorials about
      hacking.

      Private computer experts in the United States from
      iDefense Security Intelligence, which provides
      cybersecurity advice to governments and Fortune 500
      companies, say the group's site "appears to be an
      important site in the broader Chinese hacking community."

      Arranging a meeting with the hackers took weeks of on-
      again, off-again e-mail exchanges. When they finally
      agreed, CNN was told to meet them on the island of
      Zhoushan, just south of Shanghai and a major port for
      China's navy.

      The apartment has cement floors and almost no furniture.
      What they do have are three of the latest computers. They
      are cautious when it comes to naming the Web sites they
      have hacked.

      On camera, Xiao Chen denies knowing anyone who has
      targetted U.S. government Web sites. But off-camera, in
      conversations over three days, he claims two of his
      colleagues -- not the ones with him in the room -- hacked
      into the Pentagon and downloaded information, although he
      wouldn't specify what was gleaned. CNN has no way to
      confirm if his claim is true.

      "They would not publicize this," he says of someone who
      hacks the U.S. Defense Department. "It is very sensitive."

      This week, the Pentagon said computer networks in the
      United States, Germany, Britain and France were hit last
      year by what they call "multiple intrusions," many of them
      originating from China.

      At a congressional hearing in Washington last week,
      administration officials testified that the government's
      cyber initiative has fallen far short of what is required.
      Most alarming, the officials said, there has never been a
      full damage assessment of federal agency networks.

      "We are here today because we must do more," said Robert
      Jamison, a top official in the U.S. Department of Homeland
      Security. "Defending the federal system in its current
      configuration is a significant challenge."

      U.S. officials have been cautious not to directly accuse
      the Chinese military or its government of hacking into its
      network.

      But David Sedney, the deputy assistant secretary of
      defense for East Asia, says, "The way these intrusions are
      conducted are certainly consistent with what you would
      need if you were going to actually carry out cyber
      warfare."

      Beijing hit back at that, denying such an allegation and
      calling on the United States to provide proof. "If they
      have any evidence, I hope they would provide it. Then, we
      can cooperate on this issue," Qin Gang, a spokesman for
      the Chinese Foreign Ministry, said during a regular press
      briefing this week.

      But again off-camera, Xiao Chen says after the alleged
      Pentagon attack, his colleagues were paid by the Chinese
      government. CNN has no way to independently confirm if
      that is true.

      His allegations brought strenuous denials from Beijing. "I
      am telling you honestly, the Chinese government does not
      do such a thing," Qin said.

      But if Xiao Chen is telling the truth, it appears his
      colleagues launched a freelance attack -- not initiated by
      Beijing, but paid for after the fact. "These hacker groups
      in my opinion are not agents of the Chinese state," says
      James Mulvenon from the Center for Intelligence Research
      and Analysis, which works with the U.S. intelligence
      community.

      "They are sort of useful idiots for the Beijing regime."

      He adds, "These young hackers are tolerated by the regime
      provided that they do not conduct attacks inside of
      China."

      One of the biggest problems experts say is trying to prove
      where a cyber attack originates from, and that they say
      allows hackers like Xiao Chen to operate in a virtual
      world of deniability.

      And across China, there could be thousands just like him,
      all trying to prove themselves against some of the most
      secure Web sites in the world.

Source(s):

<http://www.cnn.com/2008/TECH/03/07/china.hackers/>

<http://www.youtube.com/watch?v=ovNVhk1rVVE>

</comment><comment><USER43> Jeez, NYT. 2FA much?

<comment><USER44> Most valuable point in this otherwise very interesting discussion.

MFA neutralizes most hacker threats. Organizations like the NYT that are sensitive should implement them. I know we do for banking, per industry standards (FFIEC). Fraudsters aren't about to defeat RSA tokens or multiple channels of authentication in the near future, as far as I know. It's just too logistically difficult and an order of magnitude harder to then compromise the MFA servers (via MITM or otherwise), etc. If implemented correctly, they make access to individual personal data significantly more distributed and difficult to breach.

Is MFA for e-mail each time extremely annoying? Probably. But logging into a system with just a username and password for a new ip address should not be the standard for authentication. This has got to be the solution eventually, and one which will essentially de-emphasize nation states or any large organizations from surveilling lists of accounts.

<comment><USER45> MFA and Authentication has a much larger scope than what you've brought up here. I should start by I think passwords have atrophied and should be replaced, and MFA is the best option we have to replace passwords at this time. However, MFA has flaws many people are unaware of.

I apologize for starting with a contradiction to something you state, but MFA does not neutralize most hacker threats. It only addresses authentication, it's unable to help against software compromises or user compromises -- Phishing attacks would still be effective, as the user will input a valid temporary token. What is MFA effective at preventing? Brute force password attacks, and users choosing bad passwords.

An attacker who compromises an internal system or is successful in egressing a login database will gain the session tokens for logged in users and be abel to use that to access compromised accounts (subverting the entire logged in process.)

But, you covered this, so I will digress to mentioning MFA's authentication concerns:

The "forgot password" or "lost my token" systems are always a weak link. Frankly, it's improbable (due to overhead costs) that any bulk service provider (twitter, gmail, etc...) enact a strict verification process beyond automated email/phone verification (and this has been compromised before, lookup the attack against cloudflare's google services.)

Second to the "lost password/token" attacks, there is the simple attack against the session ID/token. Remember, once you're logged in, your computer will store a token that it shares with the service to verify you are still authentication. While the token will expire, if the token is active then system will accept the session ID or token to verify you are logged in. The egress of data from the twitter login database included these session IDs. Of course, this requires a compromise of the system and not a MFA login compromise.

Finally, on your discussion of using an MFA token for every login, every time. This is actually not true in all cases. A reasonable approach most implementations use is to require MFA for logins from unknown computers/IPs, once a system is verified via MFA a user would likely have a grace period when they would have to enter only their password until that grace period expires and then they would have to verify via MFA again, this could be 1 week, 1 month or 1 year+

Of course these statements I've made are really up to the environment's configuration, ideally in a very strict environment it's expected you verify via MFA each and every time, session IDs are updated automatically with every action and users are aware of security risks. But we don't live in this security/paranoia utopia (and perhaps that's all for the better.)

Hope I've helped spark some discussions on MFA here. Bam, i'm out!

<comment><USER44> Very good points. Good discussion, thanks.

Interesting to think about. And you're right, phishing, breaches of the MFA database, and session jacking (via breaching the session database) are all big problems still.

But it's significantly more difficult to compromise certain accounts with another channel of authentication. Whether it's the initial attack vector (trying to crack some random employee's password) or secondary attack vectors (once access is gained, trying to go up a security level or compromise servers upstream, etc.), if each of those authentications require (after initial setup) a secondary device, it's just so much harder to crack.

Anyway, I think there's got to be a way to design a security system that partitions secure information. MFA secure cookies (or whatever we want to call long-term session ids associated with authenticated secondary channels), I would hope could slow down access to individual accounts.

Ideally, secure cookies get more sophisticated in the future and truly lend a 'distributed' quality to the architecture (i.e., are just one-time RSA private keys, maybe?). Thus making it very difficult to login without actual access to the device that the user setup MFA with.</comment></comment></comment></comment>


Ask HN: Forums or Groups which one should I use - <AUTHOR>

hey guys
Im building a video/pic site and wanted to also build a community around this.
What do you think is better to use a forum or groups - which is a better format to support user interaction.
Im thinking to start with a forum is better to get the discussion happening but once people start using to more transitioning to group would be better. Forum is a silo on it own contains all discussions whereas groups as each individual silos.
I like the idea of breaking things up into groups which people can join if they are interested. But again if there is not much discussion going on groups might be pointless. The other thing I could do is make 5 main groups to start the site and then let users add more. So everyone that joins is a member of those 5 automatically.
The site is about health and fitness.
thanks <comment><USER2> IMO, NH/reddit style discussion system will be better option. I personally find these much usable than the traditional forum/groups.</comment>


Umberto Eco: Texts, sign systems and the risks of over-interpretation - <AUTHOR> https://www.the-tls.co.uk/articles/public/umberto-eco-texts-sign-systems-risks-interpretation/ <comment><USER2> "Foucault's Pendulum" by Eco deeply impacted how I interacted with ideas. I took it as a parable about the danger of mixing dogmas or untestable hypotheses with crowds, conspiracy theories in that case. Ultimately, probably against Eco's intentions, it left me skeptical and increasingly dissatisfied with of a lot of his peers in continental philosophy.

His view, from this article, that "semiotics is in principle the discipline studying everything which can be used in order to lie" adds an interesting spin on that. Maybe you can lie by crafting an entire belief system, start at the root and people will interpret all incoming contradictory information as falsified. That happens in a few domains.

It's hard to get good antibodies in the system for those kinds of manipulation.

<comment><USER3> Could not agree more.

In fact, I find Foucault's Pendulum, in many ways, very strongly supports skepticism in all realms. And adds the sort of lovely literary tinge that if anything can be made to "prove" anything (in "The Plan"), then of course nothing truly proves anything. And so the age of modernity/reason leaves us flailing in uncertainty (science is always skeptical, never certain).

And it's such a hoot to boot.

</comment></comment><comment><USER4> One Eco's book relevant, IMO, for programmers: "The search for the Perfect Language". In a way, it can be thought of as a prequel to the history of programming languages.

[https://www.amazon.com/Search-Perfect-Language-Umberto- Eco/d...](https://www.amazon.com/Search-Perfect-Language-Umberto- Eco/dp/0631174656/ref=sr_1_1?keywords=umberto+eco+language&qid=1566138362&s=gateway&sr=8-1)

<comment><USER5> He also wrote a short piece comparing operating systems to religion which is is quite amusing. It boils down to:

Windows = Protestantism Macs = Christian Unix = Talmudic

(if i recall correctly)

<comment><USER5> Previously on HN too [https://news.ycombinator.com/item?id=11137982](https://news.ycombinator.com/item?id=11137982)

</comment></comment></comment><comment><USER6> [https://en.wikipedia.org/wiki/Kant_and_the_Platypus](https://en.wikipedia.org/wiki/Kant_and_the_Platypus)

</comment><comment><USER7> One thing he did was use a serial comma to reduce the risk of mis- interpretation.</comment>


What's next for the Raspberry Pi? - <AUTHOR> http://www.fastcompany.com/3033850/most-creative-people/whats-next-for-raspberry-pi-the-35-computer-powering-hardware-innovatio

<comment><USER2> _" The rule of thumb for anyone building hardware is that a product will sell for three to four times that of material costs, Cyril Ebersweiler, the founder of the hardware accelerator HXLR8R told me. "That would be at least a $100 product if you were only selling the Pi," he said."_

3x to 4x material costs? Is that retail? What about selling at just above cost and charge these rates for the software?</comment>


Self-Destructing Cookies - <AUTHOR> https://addons.mozilla.org/en-US/firefox/addon/self-destructing-cookies/ <comment><USER2> While this is an awesome extension, it is annoying living in the EU to continually see "This site uses cookies, click 'accept' to acknowledge and continue to the site" every time I visit a site that has had its cookies cleared, since the acknowledgement is stored in a cookie that is subsequently cleared when the tab is closed.

<comment><USER3> How came that crap to pass and become some EU thing anyway?

Whats the big deal about EU and cookies?

<comment><USER4> People complained that cookies were being used by advertisers to track them.

The EU decided to take action by mandating that companies make it visible when this was happening, in the Directive on Privacy and Electronic Communications[1].

Since it's technically impossible to allow the benefits of cookies without opening privacy holes, I don't really know what else privacy campaigners were hoping to achieve.

[1]: [http://en.wikipedia.org/wiki/Directive_on_Privacy_and_Electr...](http://en.wikipedia.org/wiki/Directive_on_Privacy_and_Electronic_Communications)

</comment></comment></comment><comment><USER5> This'll probably be an unpopular comment but I feel the need to point out that this is good (in the ways that made this post popular) and bad.

Bad because for the dot com company I work for, we use cookies to make sure we don't show users 'helper' tooltips more than once per 30 days and cookies is one of the better ways of doing this. It also helps us anonymously track a user location to show better search results, user currency etc.

There are many bad ways a website can use cookies, but by using a plugin like this, it'll ultimately just ruin your own user experience.

<comment><USER6> For years ive been browsing with clear cookies after each session. What you describe with first visit notification is not common at all. And when sites actually do it, its usually very subtle and can be ignored like the notification bar on the top of stackoverflow. I can only name one website where I am annoyed by the lack of cookies and that is when youtube doesn't remember my preferred video resolution. Otherwise browsing with fresh ones has no degraded user experience for me.

Actually this is starting to become worse though after EU introduced the must notify about cookies law last year. The ones who do clear their cookies once in a while are punished by being notified about them time after time while the others will blindly click OK and never see the message again.

<comment><USER7> > when youtube doesn't remember my preferred video resolution

[https://addons.mozilla.org/en-US/firefox/addon/youtube- cente...](https://addons.mozilla.org/en-US/firefox/addon/youtube-center/)

</comment></comment></comment><comment><USER8> Cool! I wrote a similar extension for Chrome that simply enforces a user- adjustable maximum cookie lifetime (e.g. 21 days instead of 10+ years...). This seems to provide a good balance for login cookies that you don't necessarily want removed every session.

[https://github.com/semenko/chrome-limit-cookie- lifetime](https://github.com/semenko/chrome-limit-cookie-lifetime)

[https://chrome.google.com/webstore/detail/limit-cookie- lifet...](https://chrome.google.com/webstore/detail/limit-cookie- lifetime/pplilgolafepgkdmocfpgblngcpdlopm)

(And the same for Chrome's ever-present history:

[https://github.com/semenko/chrome-limit-history- lifetime](https://github.com/semenko/chrome-limit-history-lifetime)

[https://chrome.google.com/webstore/detail/limit-history- life...](https://chrome.google.com/webstore/detail/limit-history- lifetime/opkjpinehmnbdeebdamcapfgfepdiohp) )

</comment><comment><USER9> Note the "clear browser cache when idle" option aggravates a referrer logging side channel for sites embedding Google Ajax libs or Analytics.

That aside, I'm in love!

<comment><USER10> Can you explain why?

<comment><USER11> Nuking those scripts from the cache means that they get re-requested more often, and the request has its referrer sent to the server hosting the tracking script which means the referrer+ip pair can be logged.

<comment><USER12> And that's where RequestPolicy comes in: [https://addons.mozilla.org/en- US/firefox/addon/requestpolicy...](https://addons.mozilla.org/en- US/firefox/addon/requestpolicy/)

<comment><USER13> I already use No-Script. I tried addeding RequestPolicy but the combination is just too much work for normal browsing.

</comment></comment></comment></comment></comment><comment><USER14> I've been wondering for many years why this isn't the standard behaviour of web browsers.

<comment><USER15> Just like "click to flash" and other plugins that should only run when I authorise them once, or always if I whitelist them.

</comment></comment><comment><USER16> This is a very good extension, I have been using it for a while. It is very much the best of both worlds, using cookies to login, then deleting them when you leave the site. You don't have to worry about whitelists, etc.

<comment><USER17> But without whitelisting, I wouldn't know how much of the web is completely broken without cookies, where by "broken" I mean a blank page, or just a little strip of the template. This includes blogs, one-off demos, and other sites that don't require (or even offer) log in or settings of any kind.

I can only conclude that some common frameworks depend on cookies for their own operation, and that in many cases the developers aren't even aware of the "problem".

</comment></comment><comment><USER18> I switch browsers more than I switch underwear, mostly between Safari, uzbl, Firefox, Chrome and TOR Browser (FF fork). When I write extensions I do it for the browser I currently fancy, so I've got a few ones for Safari, Firefox and Chrome. But when I switch I lose the old ones, until I switch back.

Right now I'm in Safari (silky smooth rendering), and can't use this. That sucks. But FF, Chrome and Safari extensions are just JS anyways. Why can't they be automatically ported, or something? What's stopping Mozilla from enabling Firefox to run Chrome and Safari extensions, and vice versa?

<comment><USER19> Because they interact with different APIs.

Different browsers provide similar APIs in different ways sometimes, and usually web standards support differs between browsers.

<comment><USER20> Any idea if someone has written an abstraction layer for this yet?

</comment></comment></comment><comment><USER21> I love this extension and have been using it for a long time! It makes it convenient to use a single browser to access multiple Gmail (or other mail or any other service provider) accounts without having to clear cookies manually and without having to associate or link accounts together (the latter is something Gmail allows, but I prefer not to use it). Just close the tab and the cookies are gone, allowing a new session to begin.

The same holds good even for web searches, though I rarely use Google/Bing and instead use start page or DuckDuckGo.

</comment><comment><USER22> Nice! I wonder if it clears cache too?

EDIT: apparently it does.

BTW, you can check if you can still be cookie / storage / cache-tracked here: [http://www.canyoutrackme.com/](http://www.canyoutrackme.com/)

<comment><USER10> For me it didn't work. I was still tracked by \- Cache, \- ETag.

<comment><USER23> ditto.

Also, I had to close my browser for the test to be allowed to work (session expiry). I tried closing the tab, but that's not enough.

For me that is an unfair test as I hardly ever close my browser down completely.

<comment><USER24> IIRC, SDC does not immediately clear cookies/cache on tab closing. It purges them on a scheduled interval. If you close the tab and wait a while (you should eventually see a toast message, if you have them enabled, saying something like "deleted x cookies from blah.com"), then your session should be removed. Closing the browser runs the purge immediately which is why that was working for you already.

</comment></comment></comment></comment><comment><USER25> So, what other extensions can we ditch now?

I really like the UX of SDC; are Disconnect or DoNotTrackMe just clutter, or adding value still?

</comment><comment><USER26> Can't you already set Firefox (and Chrome?) to only keep cookies around for the session?

<comment><USER9> This deletes cookies /during/ the session. After you close a tab, any cookies unique to that tab's history are cleared

<comment><USER27> And not just when you close a tab... also a short time (configurable, default 10s) after you navigate away from a site in an "old" tab.

</comment></comment></comment><comment><USER28> Persona is not working when I enable this addon.

<comment><USER29> Persona uses third-party cookies, so this is expected with this add-on. If you whitelist persona.org (e.g., just visit persona.org and set self-destruct to "never"), then Persona works fine.

</comment></comment><comment><USER30> Is there something similar for Chrome?

<comment><USER31> There's a setting for both 'Keep local data only until you quit your browser' and 'Block sites from setting any data' under Cookies in stock Chrome.

I don't use it though, so not sure of the effectiveness.

<comment><USER32> Not exactly. You have to quit the browser. Using this FF extension, you just have to close a tab. So there's no such option available in Chrome.</comment></comment></comment>


Is Open Source Open to Women? - <AUTHOR> http://www.toptal.com/open-source/is-open-source-open-to-women <comment><USER2> " If men and women are equally intelligent, statistically speaking, then out of the smartest ten people in the world, five should be male and five should be female."

This is false. Females are less represented on both the extreme low end and extreme high end of IQ. While it is true that the average IQ is roughly the same for women and men this is because most women are around the same average value, while there are much more men at the top end and lower ends (i.e. most geniuses are men and most idiots are men). So the 10 smartest people in the world are most likely all men.</comment>


Ask HN: Googlers on HN, Why Does GOOG Let Pinterest, Quora and Yelp Ruin Search? - <AUTHOR> Title says it all. Why does Google continue to let Pinterest dominate search results on Google images? Similarly, why does Google allow Yelp and Quora dominate search results while heavily penalizing almost all other results which are behind pay/sign in walls? Further, Google seems to have decimated forum results (unless you append "forum" or "reddit" to your search), but how do forum results differ from Quora, Pinterest, and Yelp, which are crowdsourced, user generated content? <comment><USER2> Pinterest absolutely should be completely deindexed everywhere.

<comment><USER3> I've never used it, can you explain why you don't like them?

<comment><USER2> It's basically a spam blog that hijacks inbound referrers from search engines to throw up full page sign in screens and nothing else.

The vast majority of it is effectively stolen and rehosted content.

<comment><USER4> Is it that much different than Redditors rehosting images on Reddit/Imgur? I find the functional design of the site terrible but there's tons of popular sites that are based on hijacked content.

<comment><USER2> Imgur is (IMO) turning into the same thing. Banning direct links, forcefully redirecting direct linked images to their ad packed pages of mostly stolen content.

<comment><USER5> Being so popular and serving images directly seems like a path to losing money

</comment></comment></comment></comment></comment></comment><comment><USER6> Hah! Indeed. I add -quora -pinterest -yelp to my searches by default, and it often reduces my results by 60% or more (for the better, in my opinion).

</comment><comment><USER7> Of all the offenders in bad search quality these are hardly the worst offenders. The throwaway SEO'd affiliate blogspam and factory produced Medium articles are much worse.

<comment><USER8> Say what you like about blogspam, but at least you generally get to the awful content you click on, rather than being greeted by a signup process that will leave you with little chance of finding the image Pinterest served Googlebot even if you complete it.

Plus penalising a single domain whose growth strategy is based on flagrantly violating Google's guidelines with deceptive search results ought to be a lot easier than playing whack-a-mole with SEOers.

<comment><USER7> Ok that's fair. Bait n switching gated content is BS.

</comment></comment></comment><comment><USER5> It's like googlers don't dogfood their own product.. but they obviously must since I doubt they use any other search engine.

</comment><comment><USER9> Google's algorithm actively promotes shitty content. Want proof? Go search for a tuna salad recipe.</comment>


Dow Jones Predicted Last Week on Twitter - <AUTHOR> Someone on Twitter correctly predicted the Dow Jones Industrial Average change for each day for all of last week. The Twitter timestamps show that the prediction was made the previous week. The claim is corruption, but there are no details. There is an email address. Possibly I am wrong, but the chance of this person correctly making such a prediction is 1 in 1024. What does everyone think?<p>twitter.com/StockMarketCor <comment><USER2> if i make 100 predictions a week for months, and just happen to be right for one week and hide/delete all the incorrect ones...</comment>


Should McDonald's fire all the human workers? - <AUTHOR> http://www.kernelmag.com/features/report/4599/should-mcdonalds-fire-everyone/

<comment><USER2> tl;dr. yes. i don't care anymore. they should fire their employees and just close down shop. i know the article implies it should be automated, but i don't really care. the food is horrible for you. this is the time when we all stand up and say, fuck fast food. let's eat a food that wasn't chemically marketed to make us want more.

<comment><USER3> Oh come on. That is bit dramatic don't you think? Fast food, like coffee, sex, drugs, and even water are dangerous when taken to excess.

How about this mantra: Everything in moderation, including moderation. :-)</comment></comment>


Ask HN: How to do freelance jobs and a full time at the same time - <AUTHOR>

I'm trying to bootstrap a consultancy/freelancer business.
For now, I have a possible situation where I can work full time and then also work part-time probably on a contractor basis (not sure) for another company.
What do I need to know about this? What are the legal considerations? How do taxes work? Lifestyle stuff I should worry about?
Do you have any war stories about this kind of thing? <comment><USER2> Talk to your friends/colleagues and find a _good_ lawyer to talk to about this. The legal situation could be all over the map depending on your employment contract.

Taxes are usually done after the fact. I.e you get a 1099-MISC from each person who has paid you, and you are liable for that.

Speaking of payment, learn to be a squeaky wheel about it straight off the bat. Freelancing is notoriously inconsistent, expect 60 day swings between receiving payment. DONT BILL BY THE HOUR. There's plenty of reasons why online.

Lifestyle-wise, figure out a way to be productive. You have to enforce accountability in yourself, you don't have a boss or a team counting on you. It doesn't matter when you work, you don't need to show up 9-5, you just have to get your shit done.

<comment><AUTHOR> Thank you for your input. :) I was expecting 1099, just not sure about the specifics. Thanks for the tip about hours.

</comment></comment><comment><USER3> _Time_

Make sure you set your hours (preferable a week in advance) and follow them. For example, if you work 9am-5pm Mon-Fri, set 6pm-9pm (an example) Mon-Fri and 11am-4pm on weekends for freelancing projects. In addition, realize that a freelancer is always thinking about his/her business, so you will 'always' be working. You will be emailing clients, marketing yourself, and building your brand at all times.

 _Legal_

Consult a few lawyers for about 30-60mins each (they usually offer this for free) about your situation. You are essentially interviewing them at this point, and finding the right one. If you don't feel quite right, move on. They should be able to accurately explain the answers to your questions thoroughly. Taxes, incorporation, setting up contracts, etc. should all be covered.

Also, they should be able to tell you what their fees are!

 _Money_

Watch this: [http://vimeo.com/22053820](http://vimeo.com/22053820)

"F*ck You. Pay Me." is a talk about how to make sure you're getting payed what you are owed as a freelancer. The speaker's lawyer comes up and also gives fantastic advice.

</comment><comment><USER4> I did this for a while. Now I freelance more or less full time.

Contrary to popular advice I billed per hour.

Don't do any contracting work at your job and you should be fine legally. Don't tell anybody you are working on the side though. Raises eyebrows you don't need raised.

Best tip: Find businesses that actually need a problem to be solved and not somebody that just has a budget.

They'll appreciate you more, pay faster and generally love all over you if you let them.

Companies with budgets to spend but no pressing problems to solve are a real pain.</comment>


Is high-frequency trading good or bad for liquidity? Rain provides the answer - <AUTHOR> http://blogs.wsj.com/moneybeat/2016/10/21/raining-in-high-frequency-traders/ <comment><AUTHOR> This is a brilliantly simple experiment:

\- most HFT companies use microwave transmitters because they are faster than fiber;

\- microwaves are disrupted by heavy rain and snow, so they fall back to fiber;

\- one can observe bid-ask spreads when it rains to see how liquidity is affected.

Conclusion: spreads narrow, and liquidity is improved when the fastest HFT traders are slowed down.</comment>


Ask HN: What regulations apply to my company? How do we know we're compliant? - <AUTHOR> Are there any good resources to understand what regulations / laws apply to my business? As a small business owner I'm finding it very difficult / time-consuming / expensive to understand what regulations are relevant, let alone have confidence that we're in compliance.<p>Previous experience working at large companies (2,000+ employees) suggested that most companies eventually give up and pay professional services firms (accountants, lawyers, process consultants) to help them cobble together the necessary docs before an audit but that's beyond our means right now. Curious what other folks have seen with regard to understanding compliance / regulatory liabilities and executing against those. Thanks! <comment><USER2> Your lament is not an unusual one for a business owner; it's unfortunate that legislators and regulators sometimes overlook or disregard the costs of compliance, especially for smaller firms.

Areas of regulation that apply to most small businesses, such as employment law, taxation, and consumer protection, are discussed in many books available from publishers [1] and business organizations [2]. A comprehensive, one- volume textbook on business law can also be a good starting place. These resources are valuable not only for the specific information they contain, but also to help identify areas for further inquiry. This sometimes involves professional advice, but it may just mean checking the website of the relevant government agency.

Indeed, many agencies publish guidance about the laws and regulations they administer. Examples include the IRS's _Employer's Tax Guide_ [3], the _California Employer's Guide_ [4], and _Your California Seller's Permit_ [5].

Obviously, in more specialized and heavily regulated fields, it's expected that businesses will have competent advisors. No one reads _Becoming a National Bank_ [6] and then successfully applies for a bank charter, for example, without help from lawyers and others familiar with the process.

[1] [https://store.nolo.com/products/legal-guide-for-starting- and...](https://store.nolo.com/products/legal-guide-for-starting-and-running- a-small-business-runs.html) [2] [https://store.calchamber.com/10032179-mastqb/products/employ...](https://store.calchamber.com/10032179-mastqb/products/employment- law/hr-quick-guide-for-california-employers) [3] [https://www.irs.gov/forms- pubs/about-publication-15](https://www.irs.gov/forms-pubs/about- publication-15) [4] [https://www.edd.ca.gov/pdf_pub_ctr/de44.pdf](https://www.edd.ca.gov/pdf_pub_ctr/de44.pdf) [5] [http://www.cdtfa.ca.gov/formspubs/pub73.pdf](http://www.cdtfa.ca.gov/formspubs/pub73.pdf) [6] [https://www.occ.treas.gov/publications/publications-by- type/...](https://www.occ.treas.gov/publications/publications-by- type/licensing-manuals/becoming-a-national-bank.pdf)

<comment><AUTHOR> Super helpful, thank you! I'll check out the books you mentioned as a starting point.

</comment></comment><comment><USER3> Do a google search for Broker Briefcase. Some of their documents have leaked out onto the web and they do a pretty good job of summarizing and sorting fed and state and local requirements.

Spoiler alert it's all pretty annoying and silly laws and formulas and really the main problem is if you are ever audited or targeted for investigation, they will go hunting for where you aren't compliant at that time.

</comment><comment><USER4> You always non-compliant.

The task is to get you more compliant than the guy next door - so he'll be an easier target.

The way to get there depends on industry you're in.</comment>


Long URL Please: URL "unshortener" extension for Firefox - <AUTHOR> http://addons.mozilla.org/en-US/firefox/addon/9549

<comment><USER2> I see he's using Ajax to call his API to unshorten the URL. This is fine, but wouldn't it be faster (and less load on his server) if the JavaScript tried to follow the link directly, and looked at the Location header in the response? Or can't you do this using JavaScript?

<comment><AUTHOR> Personally, I'd rather _his_ server checked it out, rather than leaking my IP all over the place, potentially making requests to untrusted servers.

</comment></comment><comment><USER3> Why exactly does this need to be a full-on Firefox extension rather than a GreaseMonkey script? As a GreaseMonkey script users can use it on multiple browsers...

<comment><AUTHOR> Actually, there's a bookmarklet for non-firefox users. Check out the home page for the project:

<http://www.longurlplease.com/>

Still, I think you're on to something; Greasemonkey might be the best of all worlds.

<comment><USER4> I don't think greasemonkey is as easy for my grandmother as a plugin - yeah I know my grandmother might not care about seeing the long url (or know what one is) but the premise is the same FF plugins are easier than greasemonkey... for the average user

<comment><USER5> You have to restart Firefox to install / enable / disable extensions -- with Greasemonkey you only have to do that once. You also don't have to deal with addons.mozilla.org and their wanky policies.

</comment></comment></comment></comment><comment><AUTHOR> If you're bothered by HN commenters who use URL shortening services, then this is the extension for you. Disclaimer: I didn't write this; I'm just sharing it to ease the pain.

<comment><USER6> I believe those HN users are annoyed that their paragraphs are taken over by 200-character URL strings, when they should be at most parenthetical to the discussion at hand--they are _references_ to further reading, after all. Why does HN not allow titled links? If it's a matter of the possible syntax interfering with normal discourse, Markdown's footnote-style "reference link" specifications[1] are very unobtrusive and degrade gracefully (in fact, you're seeing the degraded version of a [modified] one in this very post!)

[1] <http://daringfireball.net/projects/markdown/syntax#link>

<comment><USER7> So you know, URIs in comments are displayed in truncated form like so:

[http://docs.djangoproject.com/en/dev/internals/release- proce...](http://docs.djangoproject.com/en/dev/internals/release- process/#internals-release-process)

<comment><USER6> Ooh, forgot about that. :) Still doesn't help with the URL text interrupting the flow of prose, though. What's so wrong with having to hover over links to find out where they go?</comment></comment></comment></comment>


Network Effect: Human Life on the Internet - <AUTHOR> http://networkeffect.io/write <comment><USER2> I was curious but I had to leave the site. Far too noisy in every way possible.</comment>


Google Chrome 2.0 Pre-Beta - <AUTHOR> http://googlesystem.blogspot.com/2009/01/google-chrome-20-pre-beta.html <comment><USER2> Multiple profiles looks nice. Hopefully cookies are segregated so I can easily keep multiple Google accounts open. Edit: profiles appear to be completely different sessions, which is awesome.

<comment><USER3> I thought that the "process" per tab architecture of the current release already allowed this? But then, I'm not (yet?) a seasoned Chrome user.

<comment><USER3> I guess not. Bummer.

<comment><USER4> That wouldn't make any sense anyway. You'd have to keep separate cookies per tab, but tabs have no identification for persistence.

So you open two gmail accounts, one in each tab. Close them both. Open a new gmail tab, which account will you be in? The logical conclusion is that, in your scenario there are no cookies written to disk.

With profiles, each profile has its own set of cookies and you are deliberate with respect to the profile you are in. Cookie behavior is well defined, predictable.

<comment><USER3> Thank you for the explanation. I'll look forward to the new profile support. I'm starting to need to be in more than one Google account simultaneously; the timing is fortunate, for me.

</comment></comment></comment></comment></comment><comment><USER5> Wake me when they have a working build for linux.

<comment><USER6> I can't wait. I sometimes switch to xp on virtualbox to use it as it's so much faster than firefox. It's not the raw speed, its the process per tab. It makes a huge difference when you have multiple heavy ajax apps open all day long.

</comment></comment><comment><USER7> Are there any plans for a mac version of chrome?

<comment><USER8> More importantly, what does it say about Google Chrome's plans if it's working on v2.0 _before_ releasing anything on a non-windows platform?

<comment><USER9> I noticed in one of the screenshots that quarterly releases are considered stable. That and the ridiculously fast incrementing of version numbers seems to indicate that

(1) they're continually tracking another project a la Gnome/Ubuntu -- presumably WebKit,

(2) everyone in the company is spending their 20% time on Chrome,

(3) they're planning to surpass Firefox's version number this summer and eventually catch up to IE and Opera in a couple of years, and

(4) the original code was very Windows-specific and porting to Mac and Gtk+ is really a lot of work.

</comment></comment></comment><comment><USER10> Google seems to be very aggressive with it's browser strategy. Chrome has to be their most active project -- from beta launch to version 1 to version 2 beta - all in four months.

</comment><comment><USER11> wake me up when I can write plugins for Chrome.</comment>


Gamification in Corporate Learning - <AUTHOR> http://www.docebo.com/2014/03/31/gamification-corporate-learning/

<comment><USER2> Very interessing post. I used Docebo LMS many times and I got success in the training of my employees, also thanks to the GAMIFICATION app.</comment>


NYT Opinion: Learn to Love Trillion-Dollar Deficits - <AUTHOR> https://www.nytimes.com/2020/06/09/opinion/us-deficit-coronavirus.html <comment><USER2> paywall.

Also author is selling her book released today june 9 2020.</comment>


Color e-ink displays are arriving soon in eBook and e-note devices - <AUTHOR> https://goodereader.com/blog/electronic-readers/color-e-ink-will-be-available-in-e-notes-by-2021 <comment><USER2> By soon, the article means 2021. Also does anybody really care?

I care about price and refresh rates. Currently I read books on a kindle. I also would like to have a cheap-ish display which I can setup on the wall to show relevant for me info like calendar, TODOs. etc.

And that's it. I don't need another tablet.</comment>


Show HN: Rndmlnk – TinyURL creator that randomly selects the target from a list - <AUTHOR> http://www.rndmlnk.com/

<comment><USER2> For what it's worth, the short urls you generate are [http://rndmlnk.com/s/<whatever>](http://rndmlnk.com/s/<whatever>) but requests to rndmlnk.com 302 redirect to www.rndmlnk.com. This adds an unnecessary redirect.

</comment><comment><AUTHOR> Creator here: A marketting buddy of mine wanted a scrappy way to redirect participants to one of 5 surveys, so I whipped this together for him.

</comment><comment><USER3> Was going to say "Should have A/B style stats", but you already did it. I might find a use for this...

<comment><AUTHOR> Planned additional features are:

Custom weighting (80% here, 20% there), CSV Files (Or newline separated, depending), Round-robin option, instead of the current full random

</comment></comment><comment><USER4> This is cool, looks nice too. Similar to a little app I have set as my homepage: [https://github.com/charlieegan3/coincidental/blob/master/web...](https://github.com/charlieegan3/coincidental/blob/master/web.rb) ([http://coincidental.herokuapp.com/](http://coincidental.herokuapp.com/))

<comment><AUTHOR> Thanks!

That's a cool homepage. I might have to steal that idea :-)

<comment><USER4> Enjoy!

<comment><AUTHOR> Made it here, doesn't have the same weighting yours does, stay tuned for that feature in Rndmlnk:

[http://rndmlnk.com/s/random_hompage](http://rndmlnk.com/s/random_hompage)

</comment></comment></comment></comment><comment><USER5> This is pretty nice. I was curious how the spread was like for multiple links: [http://www.rndmlnk.com/counts/testredirect2](http://www.rndmlnk.com/counts/testredirect2)

side note, it was fun to see what the max redirects is in Chrome with the redirect loop.

<comment><AUTHOR> Was it 1000 :-P

Also I should probably stop it from referencing itself

<comment><USER5> not anymore :(

</comment></comment></comment><comment><USER6> A way to control the probability of each link would be useful.

</comment><comment><USER7> Another use case: as a simple load balancer.

<comment><AUTHOR> Thank you!</comment></comment>


PROVE: 0 0 0 0 = 24 - <AUTHOR>

Prove 0 0 0 0 = 24 Apply any logic on the LHS, either logical, mathematical, or any other combinational logic.<p>Question asked by Company's HR to my Friend.. <comment><USER2> Rarely have I seen a question that would cause me to leave an interview unfinished. This one would do that.

</comment><comment><USER3> (0! + 0! + 0! + 0!)! = 24

</comment><comment><USER4> Well there are 24 different possible combinations - assuming the 0's are different

4 * 3 * 2 * 1 = 24

is this incorrect for me to use this as a solution?

edit:

<http://news.ycombinator.com/item?id=3550753>

This is what I was trying to convey - I guess he's the big winner!

</comment><comment><USER5> Would HR be able to judge if the answer was right or wrong?

</comment><comment><USER6> (((0!)+(0!))^((0!)+(0!)))! =(2^2)! =4! =24

</comment><comment><USER7> !(0^(0^(0^0))) = 24 ; if you believe 0^0 is 1 that is...

<comment><USER8> That's not true even under your assertion

        0^0 = 1
        0^(0^0) = 0^1 = 0
        0^(0^(0^0)) = 0^0 = 1
        !(0^(0^(0^0))) = 1! = 1

<comment><USER7> Indeed. Oops</comment></comment></comment>


A friend created a game called "Far Star", what do you think? Here's a 3m video - <AUTHOR> https://www.youtube.com/watch?v=vKIridYvYT8 <comment><USER2> Looks fun. Seems like your friend has a sense of humor, and mixing very different area in the game (stargates from desert to business district) offers opportunity for light comedy as well as interesting game mechanics - items to be brought from one area to another, or character powers that work better or worse in different areas. I was amused by the 'blues brothers' characters. Silly visual jokes are part of what makes a game enjoyable rather than mechanical. Perhaps the game can feature jokey versions of cliche characters and explore the cliches in unexpected ways. Good luck.</comment>


Let Bogons Be Bygones: T-Mobile Filters Address Range Used by Hetzner - <AUTHOR> http://www.wordsforreading.com/blog/2012/07/19/let-bogons-be-bygones-t-mobile-filters-address-range-used-by-hetzner/

<comment><USER2> tl;dr T-Mobile's routing to 5/8 is broken. If your server's IP's are 5.x.x.x T-Mobile customers will not be able to reach you.

</comment><comment><USER3> I think Hamachi uses 5/8 adresses too.</comment>