Leaping Brain's "Virtually Uncrackable" DRM is just an XOR with "RANDOM_STRING" - <AUTHOR> https://plus.google.com/101700526665328331501/posts/Yk71MgkvAXx <comment><USER2> Maybe there's a scheme here to prevent good DRM by flooding the market with highly inflated impressive-sounding claims attached to laughable security. The Old Media crowd won't be able to solve the Design Paradox (<http://www.paulgraham.com/gh.html>) well enough to tell who's lying, good designs won't be able to charge more than laughable competition, and the DRM field will slowly die.

<comment><USER3> Though there is no organized conspiracy, this is actually not far from the truth, especially in some areas of content protection. Companies that don't have the in-house technical expertise (music labels), working from an unprotected distribution system (audio CD) are at a particular disadvantage.

At the other end of the spectrum, you have satellite TV. In this area, a lot of money invested and full control of the playback platform have resulted in some strong systems. But still, it took a long time and a lot of cracks of intermediate systems for this industry to become the success story it is today.

Disclaimer: I worked for a company involved in the above.

<comment><USER4> Remember DirecTV's war on smart card hackers?

<http://www.securityfocus.com/news/143>

\</comment></comment></comment><comment>--

But DirecTV reacted to that wrinkle over a year ago, by taking advantage of their ability to remotely reprogram the set top satellite receivers, as well as the cards. The company sent a few specific bytes of data to all the H cards, while simultaneously reprogramming the satellite receivers to reject cards that didn't reflect the change. This forced hackers to update the cards manually with the new data, or to make the cards writable again.

\</comment><comment>--

<comment><USER4> Replying to myself, here's the much more exciting retelling of the story: [http://www.codinghorror.com/blog/2008/05/revisiting-the- blac...](http://www.codinghorror.com/blog/2008/05/revisiting-the-black-sunday- hack.html)

</comment></comment><comment><USER5> From <http://leapingbrain.com/>:

"Video content is protected with our BrainTrust™ DRM, and is unplayable except by a legitimate owner. All aspects of the platform feature a near-ridiculous level of security."

Near-ridiculous security seems about right.

<comment><USER6> The whole thing is a marketing "worst-of". They consistently advertise their products as "unique, brilliant, revolutionary", "magical, user-friendly, powerful", and "your _only_ option".

The real laugh-out-loud moment is this tagline (<http://leapingbrain.com/mod- machine/overview/>):

"Forget crappy streaming systems and primitive, unprotected loose movie file downloads that make your products seem like a joke."

<comment><USER7> I'm actually wondering if the whole leaping brain website is just filled with sarcasm on purpose?

I mean, even for the US, the superlatives seem a bit overdone.

<comment><USER5> I think you're right. Their word choice about security ("ridiculous" security) seems to be a wink-wink-nudge-nudge touch. In other words, it looks knowingly negligent, and I wonder if that could have legal consequences?

</comment></comment></comment></comment><comment><USER8> You cannot simultaneously crow "hurr, DRM is broken!" and act all smug about this discovery. Perhaps the original developer, like you, understood this, and did the absolute bare minimum necessary to fulfil commercial obligations, all the while making it easier for people like himself (i.e. you) to get what they want, and making a few bucks from the old and dying media industry all at the same time.

Given the evidence (complex integration with a non-standard set of open source libs, complex industry area in general), I'd say it's almost certainly an insult to imagine the developer could not have made your life harder if he'd chosen to.

Please, if anything commend the dear fellow, and shame on whoever considered a momentary glimpse of Google Plus limelight worth making this guy's Tuesday morning and ongoing professional reputation much harder earned than it otherwise might have been.

"No good deed goes unpunished"

<comment><USER9> _Please, if anything commend the dear fellow, and shame on whoever considered a momentary glimpse of Google Plus limelight worth making this guy's Tuesday morning and ongoing professional reputation much harder earned than it otherwise might have been._

The developer(s) created a product that didn't do even 10% of what was advertised and now must face the consequences. Why is that bad? Their professional reputation _should_ suffer if the quality of their work is poor.

<comment><USER10> That's a huge assumption.

Anyone with a few years of experience in the software field has heard the following: I'll pay you N dollars to X but you have to finish by unrealistic Y. I'm the sole provider of a household of 4, so in this kind of circumstances I'll agree to minimum features or specific features plus additional features if time allows. I'll make it very clear that the client can't have their cake and eat it too. Sometimes it's merely a matter of economics, so don't go hanging anyone yet.

<comment><USER9> _the "proprietary video encryption" algorithm: for the first 15kB, each 1kB block has its initial bytes xor'd with the string "RANDOM_STRING"._

Any minimally competent developer could have implemented this particular design during, and for the price of, their lunch.

</comment></comment></comment></comment><comment><USER11> I am awed by the chutzpah of whoever is behind Leaping Brain, selling snake oil to clueless media people.

This is why I'll never be rich: I am utterly unable to sell crappy non- solutions to people with more money than knowledge.

<comment><USER12> All DRM is a non-solution really. Some are just non-er than others.

Its like the first law of "info-dynamics": _'If you can watch it, you can copy it'_.

Anyone actually _paying_ for a DRM scheme feels to me to be of the same caliber as someone investing in a perpetual motion machine. They're determined to get ripped off throwing good money after bad. Why try any harder than you have to to accept their money?

<comment><USER13> > All DRM is a non-solution really.

I know that by now it's tradition to say this, but can we please stop?

It seems to be that a law of life is 'everything dies'. Is medicine therefore useless? Are all the people who spend money for nothing but delaying the inevitable getting ripped off?

We all admit perfect security is impossible. Yes, you're right! Controlling the spread of information is a very hard problem. Yes, you're right! It would be very nice if the things I want to watch and listen to were made freely available by their creators.

But no, you're wrong. DRM has a purpose, and it can be successful even without perfectly achieving its goals. People tend to avoid effort, and if you can make pirating content more difficult than obtaining it legitimately, most people will obtain it legitimately.

There is no fundamental reason why information deserves to be free, it's just easier to copy than physical things.

<comment><USER12> _DRM has a purpose, and it can be successful even without perfectly achieving its goals. People tend to avoid effort, and if you can make pirating content more difficult than obtaining it legitimately, most people will obtain it legitimately._

I haven't yet met a DRM scheme that doesn't achieve this purpose backwards _(1)_. What it really rests on is that people don't _know_ they could just get it easier on "allmyvideos.net".

 _There is no fundamental reason why information deserves to be free, it's just easier to copy than physical things._

Its not just easier. A copy has zero marginal cost. That makes it special and different than anything that came before. DRM seems to just be a monkey-patch to try to get that marginal cost to be non-zero. I'm not saying that it _deserves_ to be free. I'm not even saying that I think it _should_ be. I'm saying that it _IS_ free. We don't want it to be, because our economic models don't support it (yet), but that's its natural state.

I stand by "DRM is silly". If that money were spent providing a better, easier product, they'd make more than they do now with DRM. It seems like they're perfectly willing to spend $3 to keep from losing $1 to piracy. It feels like a kind of willful ignorance.

No data, of course, just a strong opinion, held loosely.

 _(1) It doesn't take long outside the US to find out that there are plenty of things DRM makes_ impossible _to aquire legitimately._

<comment><USER14> > A copy has zero marginal cost. That makes it special and different than > anything that came before.

I disagree that this is news. Thought experiment: You steal a car from the local dealer, but you leave enough money behind to pay for all the materials, transportation and manpower that went into building this one car (the marginal cost). Would this be morally okay? Why, why not? If everyone does this, who will pay for R&D?

Exactly the same is happening with digital copies. You are taking something with a marginal cost of 0, but the producer has no way to pay for one-time costs. Distributing them onto the unit price is not a new monkey-patch at all.

This will be an interesting question as 3D printing advances.

> but that's its natural state.

"Natural" is always a great word to turn an intuition into a fact. ;) There are certainly many products that are sold at arbitrary prices that have little to do with the marginal cost, it didn't take computers to get there.

<comment><USER15> This thought experiment is flawed. When you steal a car from the local dealer, he doesn't have the car any more.

The correct thought experiment is: having bought a car from Ford, you examine it carefully then purchase all the raw materials yourself and assemble an identical duplicate for your wife.

In doing so you save whatever markup Ford places above and beyond their marginal cost.

Asking whether this is morally okay is the true issue.

<comment><USER14> I agree that the local dealer should be kept out of it. I am not sure if it makes a difference that Ford wouldn't have the car anymore, they have the marginal cost. Asking for more than the marginal cost seems to be immoral to some.

But I agree that your experiment boils down to the problem I am pointing to, and it is better because it is a very real problem that we see every day (e.g. in China).

<comment><USER16> > I am not sure if it makes a difference that Ford wouldn't have the car > anymore, they have the marginal cost. Asking for more than the marginal cost > seems to be immoral to some.

It does, and the cases are not comparable. Leaving an empty space (plus marginal cost) where the car used to be requires the original owner to expend time and effort to replace it, and they have opportunity cost as well. None of that is true of the digital example. To be a fair comparison you'd have to leave an atom-for-atom identical replacement for the car (or more accurately, take an identical copy and leave the original) and I doubt as many people would judge that unethical.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> I would like to propose that DRM is not intended to be uncrackable. It's easy to convince yourself that DRM is flawed, because fundamentally it _is_ a flawed tool. Companies know this, they're not stupid. However, DRM is actually not a technical tool to prevent piracy. Rather, DRM is a _legal_ tool to provide stronger _legal_ arguments that theft has occurred.

I'm not saying this is _right_ , necessarily, but I think companies know full well that their DRM scheme will be broken, so it's not really worth investing in an "uncrackable" and costly solution. Instead, the role that DRM play is purely legal -- when the company does decide to go after someone for piracy, the DRM scheme, no matter how simple, provides them with the ability to say that the accused person "broke a lock," rather than simply walking in through an unlocked door. "Entering" vs. "breaking and entering." It's nothing but legal leverage, and effective at that role even if it's not a very strong lock.

Of course, to have this argument hold, a company would never be able to admit that they purposefully implemented weak security -- this would be akin to admitting that their door was unlocked afterall, and would weaken their legal argument. Therefore, there remains a niche in the market for solutions that _look_ secure even if they fundamentally aren't. It's all about lip service.

<comment><USER18> In the US, the DMCA more or less makes it illegal to reverse-engineer DRM regardless of how easy it is to crack.

The DRM could be as simple as the code being "A" to bypass the DRM and if you do so, you have broken the law. Even providing that "A" to someone else would be illegal, look at all the silliness over the dvd copy protection fiasco. Therefore, they don't even have to pretend that the DRM is strong, just saying it's there is probably enough.

It's one reason printer cartridges have chips that communicate to the printer. Reverse-engineering that to provide third-party cartridges is illegal. Well, it used to be, I'm not sure over current policy as the DMCA has a back door for exceptions.

For PC games, the DRM is often employed to prevent piracy for the first two or three weeks because typically that's the highest level of sales. After that point it is usually cracked but sales often have dipped anyway. In some cases the DRM is removed in a patch at some point, often because the DRM causes problems for people who paid for the game, which kills long-term sales. Ubisoft recently changed their policies on having a seriously strict DRM to one that is more flexible; many thinking because it hurt their sales and that it was useless anyway.

No one thinks of DRM as a long term solution since it is only a matter of time before someone cracks it.

<comment><USER19> Anyone can make a bump key, but breaking into people's houses is still a crime :)

<comment><USER18> Actually, if it were covered, the DMCA would make creating a bump key a crime in of itself. For instance, there was a time that simply linking to a DVD CSS descrambler could get you in legal trouble. But considering the wide spread availability of such things, they don't bother anymore.

</comment></comment></comment></comment><comment><USER20> I did a lot of reverse engineering back in the day - you'd be surprised how many "virtually uncrackable" DRM protections used by companies like Adobe (at the time - Macromedia) that were just stupid XORs of magic strings.

Ahh..the good old days of SoftICE and w32disassm.

Oh man, the worst was the md5 of some salt + whatever you put in.

If you ever want to see some gems of misuse of cryptography for DRM management, let me know - email's in my profile.

Some examples: Using RSA 1024 bit keys, with exponent of 3...

<comment><USER21> e=3 is fine, so long as you remember to pad...

<comment><USER3> It's not that simple. There are other attacks against e=3, and you have to prevent them all.

<comment><USER21> What kind of attacks remain when using proper padding (e.g. OAEP)?

<comment><USER3> The original commenter said, "using RSA 1024 bit keys with exponent of 3" was a flaw in DRM systems he or she had reviewed. Your response was "e=3 is fine, so long as you remember to pad" and then "what kind of attacks remain when using proper padding (e.g. OAEP)?"

I feel a bit queasy any time I read "just do this" as a solution to crypto flaws[1]. Such answers assume way too much about the system the proposed fix applies to and make it sound trivial to secure. They also leave out all the steps behind what things "just pad" means (e.g., receiver must verify the padding and sender must properly generate).

When a developer hears "just pad", they think "append a string of zeros" when implementing a sender or "skip" when writing a receiver because that's what it means in other contexts.

In particular, your response assumed the DRM system in question:

* Was performing RSA encryption of a message, not signing or verification

* Used a public exponent e=3, not a private exponent d=3

Assuming the reader knows enough about RSA and cryptography to know what "just pad" implies, it may still be insufficient to solve the problem.

For example, if the commenter meant d=3, "just pad" wouldn't fix Wiener's attack.

<http://en.wikipedia.org/wiki/Wiener%27s_Attack>

Or, in the cases of RSA used for purposes other than message encryption, the suggestion of OAEP does not apply. Consider the attacks against the TMN secret sharing protocol and Franklin/Reiter verifiable signature sharing scheme (sections 5.1 and 5.2 of this paper).

[http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.33.6...](http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.33.6527)

The F/R scheme involves RSA encryption of signatures. But signatures must be the full modulus size (no padding possible) unless you use a larger RSA key for encryption than for signing. So again, OAEP would not fix this flaw.

Remember that the commenter was mentioning DRM, so jumping to the conclusion that they were using RSA for straightforward message encryption and with e=3 was not warranted. There are lots of applications for RSA in DRM (verifying a signature on a license key, calculations under homomorphic encryption, etc.)

For many scenarios, "just pad" would not solve the problem, even with the generous assumption that the reader knows exactly what that means and applies it correctly.

[1] I'm not picking on you here. The most astounding of these kinds of errors was when Colin Percival (who I highly respect) said "use AES-CTR mode + HMAC" and then later found he had made a fatal flaw in his own implementation of exactly that.

[http://www.daemonology.net/blog/2009-06-11-cryptographic- rig...](http://www.daemonology.net/blog/2009-06-11-cryptographic-right- answers.html)

[http://www.daemonology.net/blog/2011-01-18-tarsnap- critical-...](http://www.daemonology.net/blog/2011-01-18-tarsnap-critical- security-bug.html)

<comment><USER21> Great response, thanks; I had not even considered the d=3 possibility. I'd just like to say in my defense that mentioning OAEP wasn't assuming the application was encryption: it was simply the first provably secure padding that came to mind.

<comment><USER3> Ok, glad to help. I agree with your defense, and e=3 is the obvious assumption for most situations.

You're right that RSA with e=3 can be as secure as e=65537, assuming an application where you use proper encryption/signing padding and verification. But it is more brittle in that partial failures in padding randomness or encryption of related messages can lead to compromise. Unless carefully reviewed and appropriate fail-closed measures are not present, it's better to avoid e=3.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> This could very well be a simple bug where it's supopsed to XOR with some really random string generated on the server, but some replacement of a template string isn't happening which is why it XORs with RANDOM_STRING.

Of course this is only marginally better and should really have been caught, but there's a huge difference between saying that XORing 12 bytes with RANDOM_STRING is kick-ass DRM and actually having a kick-ass DRM infrastructure that then doesn't work right because of a bug.

If this was any really random looking string, I would be more inclined to assume that this was intentional. By the string being this token, I would guess it's a bug somewhere.

Remember. If RANDOM_STRING was truly random, unique per file and account and only transmitted from the server before playing, then this would be as good an encryption as any.

<comment><USER23> That wouldn't be better. Intercepting the decoded movie is trivial either way. Finding the encryption scheme was just a fun exercise and discovering the random string (even if it isn't "RANDOM_STRING") once you have the decrypted copy is trivial as well.

</comment></comment><comment><USER24> This is apparently why the DMCA anti-circumvention provisions only apply to bypassing "effective copy protection" systems.

Of course, if a copy protection system was "effective" it wouldn't need a law prohibiting its circumvention. Conversely, if a copy protection system is circumventable, it's not effective.

<comment><USER25> Unfourtuantly, the term "effective" is highly ambiguos. One could argue that any system that works against non-programmers is effective, as most of the market is a non-programmer.

<comment><USER26> The term "effective" is defined in the DMCA:

 _1201(a)(3)(B) a technological measure "effectively controls access to a work" if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work._

So, even trivial measures like the broadcast flag or SCMS[0] are covered by the DMCA's anti-circumvention provisions. Similar laws in other countries have similar definitions.

[0] <https://en.wikipedia.org/wiki/Serial_Copy_Management_System>

</comment></comment></comment><comment><USER27> This is roughly the level of programming I expect from DRM software. After all, the content needs to be in unencrypted format at some point to view it.[1] Therefore there are two kinds of programmers working on DRM, idiots and liars. One kind does not understand the futility of their efforts, the other kind wagers that there superiors do not understand the futility of their efforts.

[1] Assuming a general computation device, not a dedicated hardware player.

</comment><comment><USER28> Someone want to explain why this is less secure than other DRM methods?

<comment><USER29> Precisely. They've gone to an effort which should invoke the DMCA (as ridiculous as that is) and they have a bullet point somewhere on a power point they can show to content creators that says DRM.

Those are the practical uses of any DRM technology one might ever devise.

Sure, you could throw in more than 5 seconds of security-through-obscurity, but why bother?

<comment><USER30> There actually are DRM schemes which were too hard to break -- DIVX from Paul Kocher (distinct from DivX), for instance.

<comment><USER24> What uses Divx DRM? I.e., Is there evidence of anyone actually trying and failing to break Divx?

Edit: I'd guessed we were talking about Divx (of the DivX codec fame) <http://en.wikipedia.org/wiki/Divx> , which apparently has some DRM products now and is owned by Rovio-formerly-known-as-Macrovision.

<comment><USER31> Kocher's team also did BD+, which people definitely try to break, and BD+ has been successful in its "academic" goal (if not in its business goal). They're also behind some other notable DRM/Content Protection success stories.

<comment><USER32> How so? Every single BD+ update gets cracked pretty quickly by Slysoft (and several other apps now) and most Blu-rays are cracked, reencoded and pirated before or just after their release. It's not anywhere closed to the "uncrackable masterpiece" its creators marketed it like. It was even supposed to be "patchable" if flaws were found, but the patches are only stop-gap measures which are circumvented by Slysoft and others in just days.

BD+ is mostly just an annoyance for legit customers, but is hasn't been a major obstactle for pirates and backupers for years. The goal of BD+ was to stop software-based piracy of Blu-Rays and it failed miserably on that front.

<comment><USER3> Heh, if only you knew the stories behind all this.

What if I told you that the attackers had a 2-month head start on some discs due to insiders leaking them -- would that make a difference? What about if you found out that there weren't as many "rippers" as it seems because for a while, one of them was a "thin client with remote access to a competitor's ripper"?

Also, the "uncrackable" thing came from an external analyst who had no communication with anyone at the company and was obviously wrong.

[http://www.avsforum.com/t/871371/bd-unbreakable- for-10-years...](http://www.avsforum.com/t/871371/bd-unbreakable-for-10-years- says-richard-doherty-of-envisioneering-group)

BD+ _is_ renewable, meaning no single hack breaks the system for all time (unlike DVD-CSS). There's always something you can do, and with enough resources, it can still give attackers a challenge.

I'm not saying that BD+ is the most successful DRM scheme ever, but I do think it's done well given the particular environment. If you want an out-and-out success story from the same company (8 years, no hacks ever), see the CryptoFirewall. This is an apples and oranges comparison though.

<comment><USER33> Since HDCP has 'broken' (with master key leak), couldn't someone copy a blu- ray bitstream without having to crack any blu-ray protection format?

<comment><USER34> It wouldn't be the blu-ray bitstream but it would be the decoded digital video bitstream. It would need recompressing although from such a high quality source then generational loss should be fairly minimal.

It also would not get you any interactive elements which for some may be an issue although for others it may be preferable in this way.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> The business goal behind most of these "protection" methods is to make unauthorized (unpaid) copying/sharing inconvenient. That's it. There are no commercially feasible methods to protect video or audio content against "a determined hacker", but that's not what these barriers are for. You can make fun of these laughable encryption methods all you want, but they serve their purpose by providing the desired purchase to piracy ratio.

The problem is marketing folks getting carried away when describing these "technology solutions" to the content owner, because that's what they (as well as VCs) want to hear.

Disclaimer: cofounded a video CDN+DRM provider more than a decade ago, developed many content protection methods over the years.

</comment><comment><USER36> How do we know this wasn't a non-english speaking subcontractor that took the spec too literally?

<comment><USER37> What the hell? That implies someone who can't implement security themselves was tasked with the _design_ of said security. Actually, that sounds about right ..

</comment></comment><comment><USER38> Judging by the headline, it sounded like they tried to implement a one-time pad, but had only heard of them by rough description.

<comment><USER39> That was my thought too.

In theory, OTPs are nigh uncrackable.

In practice, they suck.

1\. The XOR text needs to be as long as the plaintext.

2\. The XOR text needs to be truly random.

3\. You have to distribute the XOR test somehow. Remember all those spy novels where they burn the codebooks? Yeah.

<comment><USER40> It very much depends on the use case. If I was a CIA director having an affair with a biographer, an OTP would seem quite helpful. During our liaisons, we could exchange thumb drives with several GB of randomly generated data from any of a number of reasonably random entropy sources (hardware PRNG works pretty well by itself, but you can throw in EGD and other sources for greater confidence) with some software whitening and the occasional bit of chaff plaintext for good measure. At each exchange destroy any previous pads (and yes, one would have to go to some lengths to ensure destruction without interception, but tossing them in to an incinerator would probably work pretty well).

Now I have a means to communicate over the internet while apart from my paramour without any concerns about the content of the messages being decoded while in transit (compromises at the source or destination are obviously still in play).

Not every crypto problem involves establishing a secure connection party selected ad-hoc without a higher-bandwidth secure channel.

</comment></comment></comment><comment><USER41> Ha, so the key really was "RANDOM_STRING", in the literal sense...was that just the programmer giving up, or was that pseudocode that was missed during shipping?

<comment><USER2> What string could possibly be more random than the one which _says_ "RANDOM_STRING"?

<comment><USER42> <http://dilbert.com/strips/comic/2001-10-25/>

<comment><USER43> Related: <https://bbs.archlinux.org/viewtopic.php?id=66969>

You can even show your support: [http://www.zazzle.com/14_is_not_a_random_number_tshirts-2350...](http://www.zazzle.com/14_is_not_a_random_number_tshirts-235047239743529386)

Or, for those who disagree: [http://www.zazzle.com/14_is_a_random_number_t_shirts-2350463...](http://www.zazzle.com/14_is_a_random_number_t_shirts-235046315951603929)

<comment><USER44> The script was amazing.

</comment></comment></comment></comment></comment><comment><USER45> Can someone explain how he got a hold of the decrypted .mov files that he compared the encrypted ones with? It's not very clear to me from the post, and I'm not familiar with Leaping Brain.

Either way.. wow... XOR encryption with just such a short repeating string! I bet it wouldn't be too hard to decrypt it even without the original file, since the file signature alone would probably be longer than the string. DISCLAIMER: I'm just speculating, I don't know the .mov specs.

<comment><AUTHOR> The wrapper script is GPL'd, so I copied it here:

<http://dl.dropbox.com/u/15447644/brainplayer_py.txt>

My modifications are on lines 553-556. The compiled app "fixes" the .mov file just long enough for it to be loaded into the player. If you have Leaping Brain's player installed (often branded with the content owner's name), the .mov files are in a hidden .media folder. On my Mac, they were in $HOME/Library/Application Support/LeapingBrain/catalog/$VIDEONAME/.media

<comment><USER45> Thanks for sharing! Hope you won't get in trouble for your post.

<comment><USER46> Not sure how he could get in any trouble from it due to the license at the very top of the file he linked:

"# BrainPlayer is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License

I'm sure Leapfrog hated to put that GPL license on there but were likely forced to due to the VLC components they're using that are GPL/LGPL.

<comment><USER47> And, as per <https://www.gnu.org/licenses/gpl-faq.html#DRMProhibited> the DMCA cannot be applied to this software.

</comment></comment></comment></comment></comment><comment><USER48> _facepalm_ Come on, people!

First rule of weak DRM, you do not talk when you find weak DRM.

Second rule of weak DRM, you DO NOT talk when you find weak DRM.

Third rule of weak DRM, upload to pastebin, then walk away.

<comment><USER49> That's not the second rule, but the first rule repeated.

How am I supposed to take weak DRM seriously when it has a third rule but no second rule?

:)

<comment><USER50> You need to learn your cultural references young man. Go watch Fight Club and report back with your results.

</comment></comment></comment><comment><USER51> "All aspects of the platform feature a near-ridiculous level of security."

Well... They weren't lying...

</comment><comment><USER52> To be fair, when I read the title I thought that if the string is truly random then it's actually a very good technique. This is the core operating principle behind the one-time pad which is provably secure.

Now that I read the article twice, I literally got a panic attack when I realized that it wasn't a random string that they were xor'ing their data with, but a string called "RANDOM_STRING". Although it sounds bad, one must realize that this is not security by obscurity since the key has been leaked, and nobody guarantees encryption against a leaked key.

<comment><USER53> 'very good technique' The important part of a one time pad isn't the xor, it's the length. This does not even begin to resemble a one time pad. It's an xor cipher.

<comment><USER52> Yeah exactly. I cannot convey the utter disappointment I had when I realized that it was "RANDOM_STRINGRANDOM_STRINGRANDOM_STRING...." that they were XOR'ing with.

</comment></comment></comment><comment><USER54> Anyone who has taken Computer Security 101 would know that security through obscurity is not the smartest thing to do. Calling it "near-ridiculous level of security." is downright blasphemy.

<comment><USER55> Except that these videos are playing on your local machine. With the most advanced DRM mechanism possible it is nearly as trivial to simply record the video output.

There is no reason to spend developer time making a complex mechanism that is no more secure than a simple xor.

<comment><USER56> Recording the output is not the same as extracting the DRM-free stream

<comment><USER55> This is educational content not blockbuster films. Recording the output in this case would be more than sufficient.

</comment></comment></comment></comment><comment><USER57> You know what's absolutely terrifying? This guy could conceivably go to jail for this. Looks like he has kids, presumably a wife... hoping it goes well for him.

</comment><comment><USER58> There's two software engineers and a product architect listed on the about page - <http://leapingbrain.com/about/>

It might be a good idea to remove their names, to protect their reputation. ;-)

</comment><comment><USER59> Tomorrow on HN: "Legislation passed to embed DRM chips into people's heads, which automatically shut down visual input if un-authorized content is detected playing in their vicinity. Three strikes policy before permanent blindness."

</comment><comment><USER60> _"It turned out the actual player, launched from their compiled app, was a Python wrapper around some VLC libraries"_

Isn't VLC licensed under the GPL? Or at least was until very recently? [http://www.jbkempf.com/blog/post/2012/How-to-properly- relice...](http://www.jbkempf.com/blog/post/2012/How-to-properly-relicense-a- large-open-source-project)

Is/was Leaping Brain violating the license?

EDIT: the wrapper script is apparently released under the GPL too: <http://news.ycombinator.com/item?id=4834834>

<comment><USER47> > Is/was Leaping Brain violating the license?

No, I can't see how they are.

Here's one GPL FAQ that's vaguely relevant:-

[https://www.gnu.org/licenses/gpl- faq.html#CompanyGPLCostsMon...](https://www.gnu.org/licenses/gpl- faq.html#CompanyGPLCostsMoney)

But this question is very relevant:-

<https://www.gnu.org/licenses/gpl-faq.html#DRMProhibited>

" Does GPLv3 prohibit DRM?

        It does not; you can use code released under GPLv3 to develop any kind of DRM technology you like. However, if you do this, section 3 says that the system will not count as an effective technological "protection" measure, which means that if someone breaks the DRM, he will be free to distribute his software too, unhindered by the DMCA and similar laws.

        As usual, the GNU GPL does not restrict what people do in software, it just stops them from restricting others.
    "

<comment><USER61> Just a heads up, but I think (assuming it's not somebody else on the page) the formatting of your GPL quote means that it doesn't break automatically, making the comment page very wide (at least in IE9).

</comment></comment></comment><comment><USER62> Breaking repeated XOR with a string is a variant of the Vignere cipher or the Vernam cipher, depending on how you think of it. Either way, breaking it is a freshman cryptography exercise.

<comment><USER63> The Vernam cipher is actually quite strong when used correctly - the key needs to be as long as the input; it's never repeated :)

[http://en.wikipedia.org/wiki/Gilbert_Vernam#The_Vernam_ciphe...](http://en.wikipedia.org/wiki/Gilbert_Vernam#The_Vernam_cipher)

</comment></comment><comment><USER64> Could someone (OP?) provide more of the steps that might have gone (went) into discovering it was an XOR operation and the original string? Seems like an impressive intuitive leap to me!

<comment><USER31> It's so easy to solve repeating-key XOR for the key that the solution is a practical way to detect the scheme; you wouldn't even necessarily bother trying to detect it, you'd just run the "solver" (even calling it a solver sort of dignifies it a bit too much).

<comment><USER65> Is the solver just (cyphertext XOR plaintext)?

<comment><USER31> No (although that's how this guy solved this system).

</comment></comment></comment></comment><comment><USER66> From their website:

Fort Knox-level security.

Video content is protected with our BrainTrust™ DRM, and is unplayable except by a legitimate owner. All aspects of the platform feature a near-ridiculous level of security.

</comment><comment><USER67> Back in the 1990s, the revolutionary organization Sendero Luminoso was naive enough to believe in WordPerfect's encryption. This was a grave mistake, for that encryption (for 4.2 and 5.1 at least) was a simple XOR of the password against the text--and in 5.1 you had 10 or so bytes of known text to compare against in the header. The decryption of the files was not the only thing that worked against Sendero Luminoso, but it must have hurt them.

</comment><comment><USER68> ...I find it extremely funny when people use the word "virtually" to mean "practically" or "nearly" or "almost" and they turn out to be wrong but are excused by the fact that they added the magic word "virtually" :) ...and conversely, if someone uses the word when talking to me, I label everything the person says afterwards as 99% weasel words...

</comment><comment><USER69> I find it curious that (after 242) there are no comments here ranting about ir/responsible disclosure. Is this simply indicative of the readership's unanimous hatred of all things DRM - or is there perhaps a threshold of ineptitude beyond which we feel ethically free to fully disclose vulnerabilities?

</comment><comment><USER70> Hm, anybody remember Dmitry Slyarov? <http://en.wikipedia.org/wiki/Dmitry_Sklyarov>

As far as I recall the Adobe PDF encryption was also just some XOR with a simple passphrase. Got him into serious trouble.

And WTH is 'virtually uncrackable'?

</comment><comment><USER71> This should be lauded just as much for being a solid little piece of citizen, even activist, journalism. The specific issues about DRM are important, but I think the greater willingness to really look into things and publish the results should be encouraged.

</comment><comment><USER72> This is what they call this a 1024 bit Vernam Cypher in the movie "Swordfish".

</comment><comment><AUTHOR> The CEO of Leaping Brain (or someone pretending to be him) has now joined the Google Plus thread, implying that the "DRM" was intended as satire...

</comment><comment><USER73> XOR isn't insecure per se. What I'd like to know is how this "random string" is created in the first place

<comment><USER74> It looks like the phrase "RANDOM_STRING" should be taken quite literally. That _is_ the random string. Perhaps some code was supposed to substitute in something else, and it failed quietly.

</comment></comment><comment> loup-vaillant The obligatory xkcd: <http://xkcd.com/221/>

</comment><comment><USER75> Question: Can anybody name a DRM scheme that hasn't been cracked?</comment>


I got a Google Home and finally understand the future of computing - <AUTHOR> https://medium.com/charged-tech/i-got-a-google-home-and-finally-understand-the-future-of-computing-e7de00487d7d#.mbbuzf572 <comment><USER2> I'm not sure I want another listening device in my home. Seems like a direct pipe to the NSA to me.

It's bad enough everything is top 3-5 results in search advertising. Now everything is winner take all.

Me: Google, I'd like some Chinese...

Google: No Problem, I'll order some shitty food from the place that paid me the most...

<comment><USER3> Not necessarily the NSA, but I don't particular trust either Google, or especially Facebook if they launched something like this, to not be listening to ad-related keywords.

<comment><USER4> It only sends info to Google's servers after hearing the "hot word" but sure, it more than likely will analyze your requests in a similar fashion to the requests you type into the search box on your browser. Worth noting as this may or may not be a dealbreaker depending on your personal choices/concerns.

<comment><USER5> > may not be a dealbreaker depending on your personal choices/concerns.

How is it not a dealbreaker that companies like Google and Facebook are destroying internet privacy and undermine the whole foundations of democracy. If I visit a friend I would require him to tell me if my speech is being recorded by google or anyone else that he is aware of, privacy is a matter of dignity and will always be the cornerstone of human rights, it's not a matter of personal choices/concerns it's a fundamental concern of how we want our society to be.

<comment><USER6> Did you just miss the "It only sends info to Google's servers after hearing the 'hot word'" part?

It's not like these devices are open microphones pushing data to Amazon/Google/Microsoft. They use onboard processing to detect their personal wake words and then stream your audio until a defined audio gap. That is then processed into text and kicks off the automated routines. Do they analyze this for ad-related keywords? Perhaps (Probably), but that is a different argument that is valid vs. an invalid argument that it's always streaming.

<comment><USER7> > Did you just miss the "It only sends info to Google's servers after hearing > the 'hot word'" part?

And where's the guarantee of that? Can we see the code? Can we turn off the microphones in hardware?

<comment><USER8> Just like every laptop/phone/tablet has a built-in microphone and we can't turn it off either.

All it takes is for Apple/Microsoft/Google/Amazon to push a system update, and, voila<comment>

Skynet listens to all.</comment></comment></comment></comment></comment></comment></comment></comment>


Screw Happiness at Work (Some Commonly Made Mistakes) - <AUTHOR> http://corporate-rebels.com/screw-happiness-at-work/ <comment><USER2> What? Who is making people dress up like animals at work? I don't think that's a thing.

</comment><comment><AUTHOR> Spot-on article on the craziness around the happiness at work hype!

</comment><comment><USER3> Damn.. Unbelievable that companies actually think this works?!

</comment><comment><USER4> Great insights.

</comment><comment><USER5> Awesome stuff!</comment>


Clearing browser history can be deemed obstruction of justice - <AUTHOR> http://www.cbc.ca/news/clearing-your-browser-history-can-be-deemed-obstruction-of-justice-in-the-u-s-1.3105222

<comment><USER2> So many submissions, so little comment:

[https://news.ycombinator.com/item?id=9686325](https://news.ycombinator.com/item?id=9686325) (1 comment)

[https://news.ycombinator.com/item?id=9679511](https://news.ycombinator.com/item?id=9679511)

[https://news.ycombinator.com/item?id=9676852](https://news.ycombinator.com/item?id=9676852)

[https://news.ycombinator.com/item?id=9674037](https://news.ycombinator.com/item?id=9674037)

[https://news.ycombinator.com/item?id=9661930](https://news.ycombinator.com/item?id=9661930) (3 comments)

[https://news.ycombinator.com/item?id=9657809](https://news.ycombinator.com/item?id=9657809) (1 comment)

[https://news.ycombinator.com/item?id=9651459](https://news.ycombinator.com/item?id=9651459) (2 comments)

<comment><USER3> There's very little I see to comment on. From the article, emphasis added:

"the law essentially makes _knowingly_ destroying or concealing any record"

In order to make their case, the prosecution will have to establish intent, and that's sufficient for me to establish illegality.

<comment><USER4> > Whoever knowingly alters, destroys, mutilates, conceals, covers up, > falsifies, or makes a false entry in any record, document, or tangible > object with the intent to impede, obstruct, or influence the investigation > or proper administration of any matter within the jurisdiction of any > department or agency of the United States or any case filed under title 11, > or in relation to or contemplation of any such matter or case, shall be > fined under this title, imprisoned not more than 20 years, or both.

The complaint appears to be that (a) the investigation does not actually have to have commenced for the law to apply and (b) the penalty for destruction of records can far exceed the original crime's penalty.

e.g. did you do videotape you and your friends doing something stupid and illegal that might merit you a citation? And then, upon sober second thought, delete the video? You just committed a far greater crime.

That this law, which was created to rein in corporate crime, is being applied in other contexts suggests that the legislators didn't really think through the ramifications of how this tool might be used by prosecutors.

</comment></comment></comment><comment><USER5> On a new computer or browser install where I am the primary user, I usually set my browser up to use 0MB cache and to delete history on exit. I'm not specifically trying to hide anything, but I don't want to be in a situation where my cache or history is used to make judgements about me.

Would this be construed as obstruction of justice if I had also known the bombers?</comment>


No CEO needed: These blockchain platforms will let 'the crowd' run startups - <AUTHOR> https://venturebeat.com/2017/12/03/no-ceo-needed-these-blockchain-platforms-will-let-the-crowd-run-startups/ <comment><USER2> Mentioned in the article are Aragon, District0x, Ethlance, NameBazaar, Colony, DAOstack; all of which, IIUC, are built with Ethereum and Smart Contracts (DAOs).</comment>


Show HN: OWASP Security Knowledge Framework - <AUTHOR> http://secureby.design

<comment><AUTHOR> Hey guys, I would love to show you the Security Knowledge Framework. With the framework you have a complete set of tools to secure your web application, with OWASP security checklists and a extensive library of best practice code examples.

Founded by professional security specialists with the belief that knowledge on how best to secure web applications, regardless of coding level should be available to anyone. It's open source, thus free of charge. The project is supported by the OWASP foundation. Please take a look and let us know what you think!

The project founders Glenn and Riccardo are giving an SKF workshop at the Devopsdays Amsterdam, if you're there come and say hi! [http://www.devopsdays.org/events/2015-amsterdam/](http://www.devopsdays.org/events/2015-amsterdam/)</comment>


Go and SQLite: when database/sql chafes - <AUTHOR> https://crawshaw.io/blog/go-and-sqlite <comment><USER2> It's exciting for me, if only to see a pure golang implementation. I never tried using database/sql but all the drivers use CGO and so I didn't want to have to wade through building my code with any of them.</comment>


Ask HN: questions to ask freelance designer - <AUTHOR>

I've found a designer who has a portfolio I like.  We've agreed on a detailed spec for the design work and agreed on the price and payment terms (50% up front, 50% on delivery). The deliverables are html and css files along with any required graphics.<p>This is the first time I've hired anyone. Are there any things I should make sure of before I pay him or are there any things I should insist on with regard to our agreement? <comment><USER2> Research the web for topics about how to hire a consultant, how to work with a consultant, how to make a consulting project successful, etc. There's tons more advice available for free out there than you'd ever get here.

</comment><comment><USER3> Define what constitutes a finished product.

</comment><comment><USER4> Define a timeframe.</comment>


Show HN: vi in your browser - edit files directly from Dropbox, etc - <AUTHOR> http://mit.edu/~georgiou/www/vi/ <comment><USER2> Cool. Emacs fans wanting their fix in the browser can checkout ymacs:

<http://www.ymacs.org/demo/>

<comment><USER3> Does ymacs open files from Dropbox yet? Github, if you're reading this please make both vi and emacs interfaces available through your web ui :)

<comment><USER4> [Shameless plug] They could if they use Filepicker.io! Anyone know someone on the project that I could contact?

<comment><USER5> This person is the originator of the ymacs project . <https://github.com/mishoo>

<comment><USER4> Awesome. I'll see what I can do

</comment></comment></comment></comment></comment><comment><USER6> Here's what I really, really, want:

$('textarea').vim()

<comment><USER7> You can get something similar to that with the Firefox vimperator plugin. Press ctrl-I in a textarea and a vim pops up. When you close it the text gets copied back. I use it a lot!

<comment><USER8> that is one of the best things in pentadactyl as well. unfortunately it still tries to use gvim for me. but this can surely be changed somehow.

<comment><USER9> set editor=(command line here), if you were curious. I've found you can easily check if an option for something exists by using :set and its nice autocompletion.

</comment></comment></comment></comment><comment><AUTHOR> Cloud vi was my side project last week. FYI: I didn't build the editor. I took it from <http://gpl.internetconnection.net/vi/> but modified it a bit and integrated it with <https://www.filepicker.io> to make it much more useful.

<comment><USER10> was just about to mention <http://gpl.internetconnection.net/vi/>

</comment></comment><comment><USER11> Thank you for this. Many people will remember early browsers were also editors; Mosaic and Nexus (or confusingly WorldWideWeb as its earlier name) both had document editing features.

</comment><comment><USER12> Yum. Though the biggest thing I liked about this was learning about the service 'filepicker'. Smart integration.

<comment><AUTHOR> Thanks! Filepicker was a joy to use and really made this

</comment></comment><comment><USER13> Pretty darn nifty, but vim stuff like 'ciw' doesn't work, and also 'C' leaves you in an insert state where your next keystrokes are entered just before the last letter in the line, rather than after the last letter in the line.

<comment><AUTHOR> I just fixed C. ciw doesn't work since I've only implemented vim stuff for now but I may slowly add in vim features if there is demand for them

<comment><USER13> Oh well, if you're fixing them, I've a couple more issues:

'^' goes to the first character in the line, not the first non-whitespace character

'o' is not undoable using 'u' (those most other things are, strangely)

Thanks!

</comment></comment></comment><comment><USER14> Has anyone tried compiling the real vi/vim with Emscripten?

</comment><comment><USER15> Somehow online vi clones never bother with implementing ^[ (does the same as escape), which seriously impairs me.

Is this impossible to implement?

<comment><AUTHOR> This is implemented. It works for me in chrome

<comment><USER15> You're right, thank you.

At least it works on chrome on osx. It didn't work when I tested it earlier in dev channel chrome on windows.

<comment><USER15> Just in case you're still scanning the comments:

It works on OSX because it appears the operating system automatically creates a keypress of scancode 27 (escape) when you press "^[".

The special code in term_keypress_inner to handle this combination of keys is never hit, because no keypress event is created for ^[, but it isn't necessary on OSX due to the above feature.

You could expand your handling of keyup/keydown to handle it. For example, change your keyup handler to the following:

$(document).keyup(function(e) { if(e.keyCode === 27 || (e.ctrlKey && e.keyCode === 219)) { do_escape(); } });

</comment></comment></comment></comment><comment><USER16> I always get confused when I run apps like this and they don't work initially. If you use Vimium, press i when this starts up.

</comment><comment><USER17> This appears to be completely static, which is awesome (no server-side required for oAuth thanks to filepicker.io?)

<comment><AUTHOR> It is completely static. I can do everything purely from javascript using filepicker.io to do all the I/O

</comment></comment><comment><USER18> Slight issue: counts do not work in combination with insertion commands. (in other words, you can't use 5i to have something inserted 5 times, or for a more useful example you cannot use 5o or 5O)

It's an easy to overlook, for a long time BusyBox's vi didn't like combining counts with o/O either.

<comment><USER19> As well, non of the screen movement commands and some miscellaneous commands aren't working. It really took out almost all of the flow I have when I'm editing files.

Vi commands: ^D ^E ^B . J and probably more that I haven't tried.

Possibly Vim commands: * #

U is functioning completely incorrectly. Try dd, U on line 3 in the example.

It also wasn't allowing me to hit <ESC> (OSX 10.6, Chrome 19)

(All this isn't Filepicker's fault. It's whomever's that wrote the choppy JS version of Vi. But if you want to show off Vi in the browser, you can't make me feel like a broken machine when I try to use it.)

<comment><USER20> Also, some yanking commands don't work: yiw, yaw (it goes into insert mode)

</comment></comment></comment><comment><USER6> Why I can't use this:

"This app will have access to your entire Dropbox."

Which still happens with pretty much every Dropbox app, despite fine-grained permissions many months ago. Dropbox, love the app, but the company needs a strong developer relations programme to get messages like this out.

<comment><AUTHOR> Is there any other way to get an arbitrary file from your dropbox into a text editor?

<comment><USER6> <https://www.dropbox.com/developers/announcements/11>

"We've introduced App folders: app-specific folders that Dropbox will automatically create and keep track of, even when users move or rename them."

I assume that means a fine-grained folder instead of the scary "entire Dropbox" situation. It was introduced on 8 months ago, but there's little detail on it.

<comment><USER21> but this would mean you wouldn't be able to share work from say an iPad app to this one, which to me is kind of a hassle if I couldn't

</comment></comment></comment></comment><comment><USER22> Sorry to barge into this thread. There seem to be a lot of vi experts reading it. Perhaps you might consider contributing to this thread also:

<http://news.ycombinator.com/item?id=4145060>

</comment><comment><USER4> Aah MIT nerds. Pretty cool though - any plans for Github support?

<comment><AUTHOR> There already is Github support

<comment><USER4> Sorry should have been more clear. I meant for saving back a commit after opening from Github

</comment></comment></comment><comment><USER23> Strike this. My bad.

(Original: First thing I tried: dG to delete everything, didn't work. So, it still needs improvement. Now, I'll admin I'm not 100% sure if G is a vim command or a vi one.)

<comment><USER4> dG works for me

<comment><USER23> Hah, I just realised what caused it. I have one of those vim-browser plugins and it apparently caught some of my keypresses and didn't pass them on.

Sorry about that, it's definitely cool.

</comment></comment></comment><comment><USER24> Funny story, the early version of Heroku was an in-browser editor, roundabout October '07. They're vim guys - but it didn't feel much like vim.

</comment><comment><USER25> Cool! You should add ctrl+c mapping to <ESC>. Thats how I switch out of modes so that I don't move my left hand out of position.

<comment><USER26> Re map your caps lock to esc. How often do you use that stupid button anyways?

<comment><USER27> I would miss caps lock. As soon as I see >2 upper-case letters in a row, I use it. I don't know how people bother to type long acronyms and other words in caps without it.

</comment></comment></comment><comment><USER28> Nice!

Too much vim in my browser at once. Vimium didn't like interacting with the window, and interpreted my typing with a back-button action.

<comment><USER29> Pentadactyl (Firefox) has a "Pass Through" mode (ctrl-z) for this reason.

<comment><USER8> but it does not interact nicely anyway. try to use esc to break out of something. (ctrl-] does not work either as it is (rightly so) also captured by pentadactyl.)

</comment></comment></comment><comment><USER30> Implement text objects and Vim-style fFtT (character searches are repeatable via ; and ,) and you'll have me as a user. :)

</comment><comment><USER31> This looks really cool. Any plans on sharing/open sourcing the code and going through the process of how you built it?

<comment><AUTHOR> It already is open sourced but I do plan on writing a blog post about it sometime in the future

</comment></comment><comment><USER32> Any documentation on the restrictions? Commands like :set nu to display line numbers are not available...

<comment><AUTHOR> Not at the moment. It supports most of the standard unix vi commands but not the enhanced vim ones as of yet.

<comment><USER32> Ability to edit files off Box / DropBox is a big plus. Is there a mailing list or something like that (some RSS feed for a development blog) where I will be able to see when updates are made? I would like to start using this as soon as features like vertical column selection / yanking and pasting as well as line numbers are put in (the nature of the files I have on DropBox call for those features :|)

<comment><AUTHOR> Feel free to join this google group <https://groups.google.com/group/cloud-vi>

</comment></comment></comment></comment><comment><USER33> Can I embed this as an iframe?

<comment><AUTHOR> I haven't tried it, but feel free to use it if it works. It's open source.

</comment></comment><comment><USER34> Nice, I'm not a developer, but I could find myself using this a lot.

</comment><comment><USER35> Thomas... don't you have a startup to be working on? :)

</comment><comment><USER36> Pressing tab in insert mode doesn't work for me :(

</comment><comment><USER37> Finally, I've been waiting for this for ages.

</comment><comment><USER38> so cool. super awesome as-is. if you add evernote support i will go crazy w/ happiness.

<comment><AUTHOR> Sign up for the google group I created here <https://groups.google.com/group/cloud-vi> and I'll let you know when I add evernote support

<comment><USER38> awesome! will do

</comment></comment></comment><comment><USER39> Should you help Uganda?

</comment><comment><USER40> This conflicts with my pentadactyl plugin haha!

</comment><comment><USER41> Awesome, it's 1987 all over again.

</comment><comment><USER42> Works in Android better than hn's textareas.. /me wonders how can you screw up a text area

Only draw back is having to give up Swype for hackers keyboard, thanks to Swype lack of esc key.</comment>


Google's App Engine for PHP Hits General Availability - <AUTHOR> http://techcrunch.com/2015/06/16/googles-app-engine-for-php-hits-general-availability/

<comment><USER2> Blog post doesn't have much information not found in [http://googlecloudplatform.blogspot.com/2015/06/App- Engine-f...](http://googlecloudplatform.blogspot.com/2015/06/App-Engine-for- PHP-is-generally-available-Build-scalable-apps-faster.html)

</comment><comment><USER3> Anyone know if you can run Wordpress on it?

<comment><USER4> Yep but you need Cloud SQL as well: [https://googlecloudplatform.github.io/appengine-php- wordpres...](https://googlecloudplatform.github.io/appengine-php-wordpress- starter-project/)

</comment></comment><comment><USER5> Asking, anyone have a php site on google app engine?

I'm interested to trying it but I have to have Python 2.7 installed (on windows) to install their SDK.

Is vendor lock-in a concern?

<comment><USER6> Is installing Python 2.7 a huge barrier? I bet that you can download and install it in less than 60 seconds ([https://www.python.org/download/releases/2.7.4/](https://www.python.org/download/releases/2.7.4/)).

<comment><USER5> Not a show stopper. But I don't know the first thing about Python and didn't want to have to learn how to install (and config it if something went wrong).

<comment><USER6> On Windows, installing Python involves double clicking on the installer, pressing the "Next" button until it turns into "Finish" and then pressing that. No configuration should be required.

But point taken. It would be cool if Python were bundled with the Windows SDK.

</comment></comment></comment></comment><comment><USER7> crickets.

<comment><USER8> Probably because easily deploying PHP to webservers in 2015 is not newsworthy anymore.

<comment><USER9> I think Google supporting PHP in app engine is newsworthy in that it gives a big nod of support to a community that has been reinvigorated of late. The app engine hoops will probably keep the wordpress crowd away but give people running serious apps another hosting option. I'm not on the PHP train but I know a lot of folks that are and this seems like a boon for their crowd.</comment></comment></comment>


Amazon Route 53 Releases Auto Naming API for Service Name Management/Discovery - <AUTHOR> https://aws.amazon.com/about-aws/whats-new/2017/12/amazon-route-53-releases-auto-naming-api-name-service-management <comment><USER2> This seems like a useful feature but it would be nice to have a better understanding of how it affects rate-limiting.

Historically Route53 has been pretty useless for service discovery because of the heavy rate-limiting. Something around 5 updates per second, on the _whole account_ with a window of 60 seconds. I don't know if it's still the case but it used to be quite painful, especially when you need to scale up the number of instances quickly.

<comment><USER3> Why would these instances not be behind ELB?

<comment><USER2> WebSocket. ELB adds latency and is harder to debug.

<comment><USER4> Have you considered using NLBs instead?

<comment><USER2> That was before NLBs. But yeah, NLBs might be a good choice now.

</comment></comment></comment></comment></comment><comment><USER5> It's not clear how this is different from what is currently possible. I'm not a route53 guru but can't you already a) create a subdomain microservice.mydomain.com b) create instances c) add the instances IP address to an A or AAAA record for the subdomain.

Is it that they didn't have APIs for these operations and now they do?

I know I'm missing something.

<comment><USER6> If I'm reading the underlying docs correctly, previously you would have called ChangeResourceRecordSets[0] with a quite verbose XML document. It looks like you'd need to first query for the existing RR set, modify it, then update it, and deal with potential race conditions if two service instances are starting concurrently. Technically possible, but quite a bit of complexity.

Now with auto-naming, you create a service[1], then a service instance calls RegisterInstance[2] on start-up with a much simpler JSON payload.

0: [https://docs.aws.amazon.com/Route53/latest/APIReference/API_...](https://docs.aws.amazon.com/Route53/latest/APIReference/API_ChangeResourceRecordSets.html)

1: [https://docs.aws.amazon.com/Route53/latest/APIReference/API_...](https://docs.aws.amazon.com/Route53/latest/APIReference/API_autonaming_CreateService.html)

2: [https://docs.aws.amazon.com/Route53/latest/APIReference/API_...](https://docs.aws.amazon.com/Route53/latest/APIReference/API_autonaming_RegisterInstance.html)

</comment></comment><comment><USER4> Only 8 records per answer? I wonder why. Many of us run services comprising hundreds of endpoints or more.

<comment><USER7> Considering this is DNS there has been a historical limit of 512 bytes. Despite this not usually being a limitation now you are really pushing the ideal packet size with hundreds of answers each of which are multiple bytes. High chance of packets being dropped.

<comment><USER8> > Considering this is DNS there has been a historical limit of 512 bytes.

Only with UDP transport, longer responses are told to requery via TCP.

<comment><USER9> These days EDNS0 allows bigger UDP responses in many cases, which may mean some fragment re-assembly. Unfortunately there are a staggering number of networks and firewalls that don't open TCP 53, and also ones that don't permit UDP fragments. So if you want DNS to work reliably /everywhere/, sadly it's wise to stay below the 512 limit.

<comment><USER4> We're talking about service discovery here. This is internal DNS traffic in AWS, where these issues to which you refer are nonexistent.

</comment></comment></comment></comment></comment><comment><USER10> For folks who are using Consul or Zookeeper, would you consider replacing service discovery with this?

<comment><USER4> Not yet. I think this is just the first step towards an AWS-native service mesh solution. I suspect there will be future announcements over the coming months that continue to put all the pieces together.</comment></comment>


One month since a game dev started blogging: was it worth it? - <AUTHOR> https://staticcatgames.blogspot.com/2020/07/one-month-since-i-started-blogging.html <comment><USER2> Blogging can be fun for the reasons the author mentioned. I enjoy the research and the conveying of information to others.

Sadly nowadays I often think of a topic and go reflect on "is this an attractive topic?". So I don't write just for fun anymore on any topic that I like - part of it is because of analytics. I can see which blogs get thousands of views per month and which get barely anything.

These analytics for me kind of ruined just writing for fun. I know I probably should not care about those numbers, but I do. When you spent hours working on a blog and it gets 100 views in a month, it feels bad. Especially when a quickly crafted blog gets 10x that. :)

I am consciously trying to just do it for the fun of it again. I'm also convinced that when I learn a new topic and proceed to write about it, my understanding deepens. That should be the real reward - the understanding.

Sadly I also think that nowadays blogging is a way of 'branding' oneself, limiting what you can write about. You might not write a silly blog criticizing the latest star wars, when you know your professional network reads the blog. Blogging anonymously as was mentioned here on HN some weeks ago might be a solution to this.

I'm rambling, good job on the first month!</comment>


Who owns work related yet external accounts? - <AUTHOR>

If I create an account for use with my job on a social network or a service provider using my personal ID information but, work e-mail address, does my employer have any rights to it when I leave the company? <comment><USER2> Talk to a lawyer. My best guess is that if you used the account as a part of your job (promoting the company, etc) then they own it. You may be able to remove your personal information or ask the company to.</comment>


Ask HN: Who to follow on Twitter and why? - <AUTHOR> I've had twitter account for few years, but still haven't got too many people to follow. Who do you follow and why? <comment><USER2> I follow people that I idolize like Bill Gates(Microsoft), Nas(Rap Music), Steve Wozniack(Apple), Kevin Rose(Digg), Guy Kawasaki(Apple), Satya Nadella(Microsoft). I also follow Microsoft leakers like Wzor. What is your Twitter I follow I will follow you but make sure to follow back? I am really chill.</comment>


Editorially - a simple web-based collaborative Markdown editor, now open - <AUTHOR> http://editorially.com/

<comment><USER2> This is nice looking, and I like the inline conversion of Markdown to visualized content. However, NSA.

What I mean by that is I don't want yet another third-party web service hosting my documents. I'd love this if it were something I could download and install in my network in the same manner as Etherpad Lite [1].

I'd even pay for it if I could install it in my environment because it looks slightly more glamorous than Etherpad.

[1] [http://etherpad.org/](http://etherpad.org/)

</comment><comment><USER3> I'd pay for this and use it daily if it had inline comments, a la google docs. I've wanted a very long time Google Docs but in markdown. I want to collaboratively build a document but be able to comment (as metadata, not as text in the document itself) on certain paragraphs, bullet points, sentences, etc and have a discussion around those comments.</comment>


Busy Beavers, and the Quest for Big Numbers (2012) - <AUTHOR> https://jeremykun.com/2012/02/08/busy-beavers-and-the-quest-for-big-numbers/ <comment><USER2> Hiener Marxen's page is dead, unfortunately, as I found out rather painfully when solving a competition problem related to busy beavers.

<comment><USER3> [http://web.archive.org/web/20170620023155/http://www.drb.ins...](http://web.archive.org/web/20170620023155/http://www.drb.insel.de/~heiner/BB/)

<comment><USER2> Yup we tried that ;) Unfortunately, during the competition we were having some issues getting the Internet Archive to work–apparently there was some sort of bug when showing the list dates that the page had been cached, so the way to grab it was to guess a date and pick a day from there (which has since been fixed). Of course, we found this out a couple of days after getting the solution with a combination of brute force and the application of clever constraints.</comment></comment></comment>


The Long, Final Goodbye of the VCR - <AUTHOR> http://www.nytimes.com/2016/07/22/technology/the-long-final-goodbye-of-the-vcr.html <comment><AUTHOR> > At the time, the machines cost $50,000 apiece. But that did not stop orders > from being placed for 100 of them in the week they debuted, according to Mr. > Pfost. "This represented an amount almost as great as a year's gross income > for Ampex," he wrote.

Now, that's a hockey stick.

</comment><comment><USER2> dupe: [https://news.ycombinator.com/item?id=12131323](https://news.ycombinator.com/item?id=12131323)</comment>


Ask HN: 5 years later, how would you change YCombinator.com/ideas.html? - <AUTHOR>

Not sure if this has been discussed before, but: "Startup Ideas We'd Like to Fund" at http://ycombinator.com/ideas.html is almost 5 years old. Surely the world has changed -- HN, what would you add, what would you remove from the list? <comment><USER2> I would modify Auctions to read: Online auctions _still_ have more potential than most people realize.</comment>


Armoring the Bombers That Came Back - <AUTHOR> http://paul.kedrosky.com/archives/2010/12/armoring_the_bo.html

<comment><USER2> From 2 1/2 months ago here's the story told, and the extensive HN discussion about it:

<http://news.ycombinator.com/item?id=1748979></comment>


Constellations Over Playas (2013) - <AUTHOR> http://www.constellationsoverplayas.com <comment><USER2> I guess in the end,

[http://www.constellationsoverplayas.com/atlas/](http://www.constellationsoverplayas.com/atlas/)

is a parody of

[http://www.emrtc.nmt.edu/](http://www.emrtc.nmt.edu/)

I live in Socorro and attended NMT and I'm not entirely sure what the point is of this. The words on the page seem to be different on every page load.

I think the description of the project is probably more effective than the project itself. I have never been especially comfortable with the cozying-up to defense/national security of my alma mater, but it was more pronounced for me from the CS side with the Scholarship for Service and iCASA, etc., rather than EMRTC. Explosives are going to be interesting to the military.

</comment><comment><USER3> I don't get the point of this and can't seem to dig up any more info.

<comment><USER4> The bios imply it's a cerebral art piece, of the kind people outside the domain generically call "conceptual art." The notion being to cause a more self-conscious (re)examination of what's going on in that town (which sounds kind of Atlas Obscura-interesting on its own) by trying to heighten what's absurd or upsetting or "problematic" about it, by drawing attention to it.

This kind of intervention is a well-established practice; whether it's successful or interesting (or "art" in a pre-20th century sense) is a different matter. :)

\--

Joseph Moore is an artist and Assistant Professor of Art at the City College of New York. His work investigates topics such as perception, interpretation, and similarity. [snip]

Stephanie Vella is a PhD student in Theatre at the Graduate Center of the City University of New York where she researches European theatrical modernism and its engagement with spatial, temporal, and racial otherness in primitivism, classicism, and orientalism [snip]</comment></comment>


Are you suffering from ADHD? - <AUTHOR>

If yes then what copying mechanism you use to cope with attention deficit? <comment><USER2> Adderall</comment>


Inside Earth, Microbes Approach Immortality - <AUTHOR> https://blogs.scientificamerican.com/artful-amoeba/inside-earth-microbes-approach-immortality/ <comment><USER2> My understanding of stellar evolution is that one likely scenario for the sun is that it would become a red giant whose diameter will exceed the orbital diameter of the earth. If this happens, then these microbes would not survive the resulting evaporation of the earth itself.</comment>


Image moderation made easy using cloud-based UI and API - <AUTHOR> http://cloudinary.com/blog/image_moderation_made_easy_using_cloud_based_ui_and_api

<comment><AUTHOR> This blog post discusses the challenges involved in moderating user uploaded photos in order to prevent displaying inappropriate or low quality content in your site. The post describes Cloudinary's cloud-based solution that streamlines the process of manual image moderation using a web interface or an API. Sample code included for Ruby on Rails, Python, PHP, Java and Node.js.</comment>


Arachne: a self-contained graphical web browser for DOS and Linux - <AUTHOR> https://en.wikipedia.org/wiki/Arachne_%28web_browser%29 <comment><USER2> It's awesome to see this posted. It brings back a lot of fond memories.

I came across Arachne about 15 years ago when I was exploring programming and writing graphical shells on top of DOS. As foreigner points out in this thread, it's entire UI is HTML. This blew my mind and eventually led me into the world of web development.

</comment><comment><USER3> Very neat! What does it offer over links2?

<comment><AUTHOR> Given its age, probably quite little, actually. It can run without a display server, but so can links. I guess Arachne's greatest trick is that it runs on DOS.

<comment><USER4> Arachne's greatest trick is the entire UI is defined in HTML. That was a big deal back in the day.

<comment><AUTHOR> Wow, really? I had no idea. Reminds me of how Firefox is all XUL.

</comment></comment></comment></comment><comment><USER5> My god, I totally forgot about this. I didn't even have internet. Learned HTML on it.

</comment><comment><USER6> It needs root privileges to install, though. I wish there were a graphical browser that I could run in an SSH session to Red Hat OpenShift. Installing X11 requires root. I only have standard user privileges. Any suggestions?

<comment><USER7> You don't need to install an X server on the remote box you're connecting to with SSH and X11 forwarding, you just need the graphical application and the libraries it depends on for using the X protocol (xlib or xcb, usually with a higher level toolkit). Accessing real graphics hardware or putting things in /usr require root, but you shouldn't need to do either one.

</comment></comment><comment><USER8> Good memories, I used to run this from a DOS tools rescue disc I maintained up to about ten years ago.

At some point I moved on to Linux full time.

</comment><comment><USER9> it has a dialer and tcp/ip stack built in along with support for various network cards. Ah...DOS</comment>


Dave McClure Adds 500 Mentors to 500 Startups - <AUTHOR> http://gigaom.com/2010/10/07/mcclure-adds-500-mentors-to-500-startups/ <comment><USER2> Interesting approach to constructing an expertise keiretsu, similar to the kinds of experts that KP, Sequoia, and YC each have in a local orbit.</comment>


Show HN: omni.js, Modernized Adobe Omniture Analytics Client - <AUTHOR> https://github.com/metglobal/omni.js

<comment><USER2> As a coder, I love stuff like this. As an enterprise analytics person using SiteCatalyst, I'll stay far away from it. Why? These custom libraries fast become headaches with adding an additional upkeep cost as well as having a non-standard means of implementation, which immediately translates into experienced SiteCat folks having partially non-applicable knowledge, making finding good talent all that much harder when it's already a PITA. Trust me, the official libraries for SiteCat (and Google Analytics for that matter) have LOTS of room for improvement, I agree. But the short of it is, those libraries are hardened from deployment across numerous sites, situations, and scenarios and rolling a custom solution like this throws all that out the window making identification of tracking issues more difficult as well. I've dealt with too many clients that had a good dev team or person that rolled their own solutions like this, and inevitably those people will leave, and leadership will be left to usually re-implement the official, standard solution, which can be very costly as you can imagine. Personally though, thank you for sharing your work, I love looking at stuff like this whether I use it on the job or not.

<comment><AUTHOR> Thanks for your kind review. The standard one makes the codebase some spagetti and I've decided to improve the default client. It already uses the original one at background, just covers it. You can still use the standard one, but you also can use this one at the same time; It makes your code more readable. I think. Thanks for your comment :)</comment></comment>


Ask HN: Programmable Drones - <AUTHOR> So I'm looking to integrate Machine Learning and Computer Vision with drones.
What I had in mind was having a separate computer to be the server, the drone would stream video to the server and it would use OpenCV and the like to make decisions and control the drone based on that.
So that way I can just have a video stream that I can process in whatever language I want ( Python ) and then send commands back to the drone in real time.
Which drone is best suited for this kind of task ? I heard that the parrot drones are programmable to a degree.
I like the Parrot Bebop 2 but am not sure if it's suitable for my use case. <comment><USER2> I've been looking for one as well, but figured that basing it on Nvidias Jetson platform would allow for RT processing on the drone, e.g. object detection. But I haven't found any good candidate yet.. Share if you find something and what you go with.</comment>


Google cancels physical I/O 2020 conference - <AUTHOR> https://www.theverge.com/2020/3/3/21163553/google-io-2020-cancelled-coronavirus-tech-developer-conference <comment><USER2> Kudos to Google for taking this responsible step. There's no way to categorize these sorts of conferences as anything other than "extremely non-essential, optional gathering." Postponing such gatherings is an obvious first step in reducing the spread of an epidemic that we cannot prevent, but _can_ mitigate.

<comment><USER3> It's interesting on so many levels. On the one hand, it seems like the right thing to do. Air-travel and gatherings are like Petri dishes. On the other, all these adjustments are going to have an economic impact.

There's a part of me that wonders if this "crisis" has been created by news coverage. The flu kills thousands every year. The early articles seemed to say that Corona virus was no worse that the flu. [https://www.businessinsider.com/coronavirus-death-age- older-...](https://www.businessinsider.com/coronavirus-death-age-older-people- higher-risk-2020-2) This businessinsider article says that 15% of people 80yrs+ die.

[https://time.com/5610878/2018-2019-flu- season/](https://time.com/5610878/2018-2019-flu-season/) But Time say 61,200 died a year ago from the flu.

Course then I wonder when the US will get serious about doing some basic things to limit the spread of disease like: \- require airlines to allow passengers to change their flight plans without penalty so sick passengers don't have to fly \- educate people to cough into their shirts instead of their hands \- require public bathrooms provide paper towels instead of those damn hearing-wrecking air blowers. \- step up vaccination efforts \- for those of us forced to travel: don't tell us what doesn't work, tell us what does. If masks don't work, should I wear a full hazmat suit? I'm willing to avoid getting another flu like I had last year...

<comment><USER4> > There's a part of me that wonders if this "crisis" has been created by news > coverage. The flu kills thousands every year. The early articles seemed to > say that Corona virus was no worse that the flu. > [https://www.businessinsider.com/coronavirus-death-age- > older-...](https://www.businessinsider.com/coronavirus-death-age-older-..). > This businessinsider article says that 15% of people 80yrs+ die.

I was thinking like that but I don't think so anymore. There is one important difference between COVID-19 and the regular flu: COVID-19 seems to infect a lot more people than the flu. Even if COVID-19 has an overall fatality rate that is much lower than regular flu, the fact that it spreads fast means it can overwhelm health services so that those few severe cases can't get the health they need, when with regular flu they would get that help. That can make it much more dangerous in practice even if, in theory, it's not.

Now with containment having failed the only course of action is to do everything we can to slow its progression to avoid overwhelming services.

</comment></comment></comment><comment><USER5> Meanwhile Miami Ultra Music Festival is still on:

> _Amid growing concerns of the virus and large crowds, Miami Mayor Francis > Suarez said Monday the upcoming Ultra Music Festival and Calle Ocho Festival > will go on as scheduled._

> _More than 100,000 electronic music fans from more than 100 countries will > descend on Miami in two weeks for the festival, March 20-22 at Bayfront > Park._

Just look at this picture: [https://weraveyou.com/wp- content/uploads/2019/12/Ultra-Music...](https://weraveyou.com/wp- content/uploads/2019/12/Ultra-Music-Festival-2019.jpg)

Well, that's one way to test the virus transmission/warm weather theory.

</comment><comment><USER6> In addition to "safety of the people", there is a business reason for cancelling these massive events at a huge loss - they're avoiding a PR shitstorm that would explode if 8,000 people caught Coronavirus at their conference.

After working in many fortune 500 companies (manufacturing), I've become so intensely jaded and cynical of any "safety" things most of these companies do. If you peel the layers, its a glorified CYA. For e.g., no company _really_ gives a shit if you develop a carpel tunnel syndrome. They are covering their ass to make sure there is enough documentation that employees were properly trained in the event of a lawsuit. That Ergonomics training you did or any safety web-training was forced upon you - sure it improves safety but that's a side benefit.

<comment><USER7> I think "do the right thing" and "make it look like you're doing the right thing" will always go hand in hand. I'll take it.

</comment></comment><comment><USER8> As someone headed to SF later this spring, is there a single case of coronavirus in the Valley at this exact moment? With all the companies announcing conferences and employee travel cancelled you'd think that Silicon Valley was the epicenter.

<comment><USER9> There have been several confirmed cases, and more are expected as testing ramps up: [https://www.mercurynews.com/2020/03/02/coronavirus-case- coun...](https://www.mercurynews.com/2020/03/02/coronavirus-case-counts-rise- as-testing-expands/amp/)

Not too many yet, but the writing is on the wall.

<comment><USER8> Thanks, maybe I need to look into travel insurance which is something I've never remotely ever considered purchasing. We have zero cases in Michigan at present.

[https://www.michigan.gov/mdhhs/0,5885,7-339-71550_5104_97675...](https://www.michigan.gov/mdhhs/0,5885,7-339-71550_5104_97675---,00.html)

</comment></comment></comment><comment><USER10> I wonder about the professional sport leagues, NBA and NHL for example currently. 10-20k people every night in closed stadiums. In multiple major US cities. They gotta do something. MLS also started this week and the new MLB season also upon us

<comment><USER11> In Italy they suspended the football season last week, as it was legally impossible to host games in the most-affected Northern areas. Sure enough, they are already talking about resuming next Monday, less than a day after the current ban on gatherings will expire.

It's screwed up, and hugely unpopular, but I think we should just give up all these large events until April-May and then reassess. Zero chances it will happen though, too much money rides on sports these days. So people will die so that someone else can watch 22 overpaid athletes kick a ball.

</comment></comment><comment><USER12> And yet, HIMSS is going forward while pretending nothing is wrong...

<comment><USER13> For anyone previously unfamiliar, as I was: HIMSS = _Healthcare Information and Management Systems Society_

</comment></comment><comment><USER14> And people laughed at me a few weeks ago when I suggested WWDC and i/o might not happen this year (when MWC got cancelled).

So... is Apple's WWDC next?

<comment><USER15> It's the responsible thing to do. We are nowhere near taking control of this virus.

</comment></comment><comment><AUTHOR> It shouldn't be a surprise, after the Facebook F8 cancellation, Google Cloud Next, Microsoft MVP Summit, dotPy, dotGo, the MWC, etc.

</comment><comment><USER16> It'd be nice if this ended up turning into it being more common for tech conferences to be attended remotely, would be a good step for environmental friendliness to reduce all the flying around the world for tech events

</comment><comment><USER7> FWIW I'm wondering about LibrePlanet in a couple weeks. I likely won't go regardless at this point.

<comment><USER7> They just posted about it:

[https://www.fsf.org/blogs/community/update-on- covid-19-and-l...](https://www.fsf.org/blogs/community/update-on-covid-19-and- libreplanet-2020)

<comment><USER7> And now all in-person events are canceled: [https://www.fsf.org/blogs/community/libreplanet-2020-in- pers...](https://www.fsf.org/blogs/community/libreplanet-2020-in-person- component-canceled-but-well-see-you-online)

</comment></comment></comment><comment><USER17> Microsoft BUILD has to be next, its scheduled for a week after IO

</comment><comment><USER18> It was at Shoreline? that place is a dump...

</comment><comment><USER19> I wonder when ngConf will be cancelled

</comment><comment><USER20> So do we think the NCAA March Madness is still a good idea?

</comment><comment><USER21> Don't forget to cancel the supermarket, post office, Chipotle, gym, planes/trains/buses, movies/theater/sporting events, the sidewalk, etc.

<comment> T3OU-736 I disagree with your analogy.

Conferences, by their very nature, and ones with large well-known companies sponsoring them strongly implies international guests, and that translates to higher risks.</comment></comment>


Why Facebook Shouldn't Be Allowed to Buy Tbh - <AUTHOR> https://stratechery.com/2017/why-facebook-shouldnt-be-allowed-to-buy-tbh/ <comment><USER2> Techmeme summary: _Ben Thompson / Stratechery: FTC failed in allowing Facebook to acquire Instagram, WhatsApp; it should intervene on tbh, regardless of whether the purchase price is enough to mandate review_</comment>


How does your website preview look in chat apps? - <AUTHOR> http://richpreview.com/ <comment><AUTHOR> Probably you have seen them already in WhatsApp or Skype, that when you paste a website URL, you will see a small preview image that is called a Rich Preview.

This tool is to check your meta tags, and gives an impression how your Rich Preview looks for chat apps like WhatsApp, Skype, Telegram and social networks Facebook, LinkedIn and Google+.

Please have a look and let us know when you have any feedback!</comment>