Cost of a 51% attack for different cryptocurrencies? - <AUTHOR> https://www.crypto51.app/ <comment><USER2> There is _absolutely no way_ to 51% attack a major coin like Bitcoin for as little as $700k an hour. They are extrapolating from Nicehash's mining rental prices, but Nicehash doesn't have anything like the capacity you'd need.

You can see here[1] that nicehash has about 500 PH/s (500,000 TH/s) available for rent. However, Bitcoin's total hash rate right now is 100,000,000 TH/s[2]. This means that if you rented out the entire nicehash market, you'd have 0.5% of the hash rate you need.

Could you get the other 99.5% by buying lots of mining hardware? Theoretically yes, but realistically no. Bitmain is a major supplier of this kind of hardware, so let's use their prices as a reference. They're currently promoting a 67 TH/s unit for $1585 [3]. You would need more than 1.4 million of these units, at a cost of over _$2.2 billion dollars._ Not that any supplier can fill an order like that quickly.

And we haven't even gotten to the power and operations costs. You'd need dozens of huge data centers to run all this hardware, each one consuming astronomical amounts of electricity. You'd probably pick your data center locations based on availability of cheap power and labor, and you'd become a major commercial presence in each of those towns. The local papers would have photos of you shaking hands with the mayor as your data centers open up. Everyone would know what you're doing, including the FBI.

[1] [https://www.nicehash.com/my/marketplace/SHA256](https://www.nicehash.com/my/marketplace/SHA256) [2] [https://www.blockchain.com/en/charts/hash- rate](https://www.blockchain.com/en/charts/hash-rate) [3] [https://shop.bitmain.com/product/detail?pid=0002020011715132...](https://shop.bitmain.com/product/detail?pid=00020200117151322700cA9h5cat0694)

<comment><USER3> Why are you assuming that hashrate would be obtained legally?

If you're already assuming criminality, go all out! BGP route hijack the unencrypted, unauthenticated mining traffic and call it your own.

Cost is basically nothing to do so, other than some jail time.

<comment><USER4> Can you clarify what you mean by hijacking mining traffic? If you mean the traffic of mining pools communicating their solutions to the pool's "mother brain", those are already cryptographically attached to a solution that pays out to specified addresses. You can't substitute the transactions in the block/solution without redoing the PoW.

That's why miners can't steal a pool's solutions to begin with.

<comment><USER3> All miners connect to pools using a protocol called stratum. This is JSON piped over TCP with newline terminations. There is no authentication for this protocol and no encryption. You can simply intercept the communication here and have all the miners on a pool actually mine for your replacement pool, and nobody will ever catch on until its far too late.

> If you mean the traffic of mining pools communicating their solutions to the > pool's "mother brain", those are already cryptographically attached to a > solution that pays out to specified addresses.

That's not correct in practice. There's no authentication of the work going to the miner at all, so an attacker can just change the destination before the miner even sees the work.

<comment><USER4> Okay I see what you mean about replacing the work assignments going to the miners -- if you could tell them to solve a different block/fingerprint (hash of new block + previous block) and receive their output, then you can steal their hashing power. But I'm still not sure what you mean here:

>>If you mean the traffic of mining pools communicating their solutions to the pool's "mother brain", those are already cryptographically attached to a solution that pays out to specified addresses.

>That's not correct in practice. There's no authentication of the work going to the miner at all, so an attacker can just change the destination before the miner even sees the work.

I was referring here to the solutions the miners send out. That does not need to be authenticated because it's already attached to the block they were solving for -- i.e. it is a proof of work valid only for a specific block. If they received the correct block and nonce range to check, then the solutions are useless to anyone else. Diverting their traffic would just reduce the mining pool's hash power, not give it to anyone else.

So yes, I see how you could steal the miner's hash power if you could replace the assignment the pool head was giving them, and then see the output, but I don't think it's correct to say that _solutions_ are vulnerable to being stolen after getting the correct assignment "because they don't authenticate" \-- the proof of work is only valid for that block, and so could only be destroyed, not stolen.

<comment><USER3> You're fundamentally missing the point somehow.

When you connect to a pool, you give them absolute trust over what you're mining using your hardware with the expectation that they will pay you for it later. In a route hijack, an attacker can replace the pool and announce their own work to you, and receive all results you produce. You can not distinguish this with the normal behavior of the pool and will be robbed, and your work can be used to do whatever the attacker wishes.

The output of the work being loosely "authenticated" with the pool by virtue of the work being non-transferable is entirely orthogonal. Nobody is going to be taking that because it's worthless, as you correctly point out. They're going to replace the work that's sent to you in the first place, because that's what makes sense.

<comment><USER4> Pretty sure I'm not missing the point, because that's exactly what I said, in different words.

I specifically agreed that, if you can replace the assignment given to the miners ("replace the pool and announce their own work to you"), and see the output, then you can steal the work. It was in this paragraph:

>>Okay I see what you mean about replacing the work assignments going to the miners -- if you could tell them to solve a different block/fingerprint (hash of new block + previous block) and receive their output, then you can steal their hashing power.

That is an agreement with your:

>In a route hijack, an attacker can replace the pool and announce their own work to you, and receive all results you produce.

That is me communicating agreement that that's the attack that "makes sense" as in your sentence here:

>They're going to replace the work that's sent to you in the first place, because that's what makes sense.

I made my original because it sounded like you were saying a miner not (separately) authenticating their output to the pool would be an issue, which I now see you (always) agreed is orthogronal; my only objection in the follow- up was that your comment was addressing something different than I originally raised:

>>>That's not correct in practice. There's no authentication of the work going to the miner at all, so an attacker can just change the destination before the miner even sees the work.

>>I was referring here to the solutions the miners send out.

So, if I agree with you on every question of what and where the threat is and is not, and said so with slightly different words than you did, what point do you think I'm fundamentally missing?

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Computational power is not a good proof of anything. It devours energy and disproportionately rewards weird market actors (like people with custom mines ASICs).

I always wondered whether storage could be used as proof of stake. It might use less energy and it probably will have much better effect on the IT industry as a whole. First, mining ASICs are not general computational devices and cannot be used for anything useful. On the other hand, storage is storage and can be repurposed. Second, it will up the prices for storage hardware, but that is probably a good thing in the long run. (Consider how super-cheap storage enabled unlimited surveillance and software bloat, for example.)

I don't know whether access to storage can solve all the problems a blockchain solves, but it can solve some. Like proving that you're a real actor in the system, rather than a temporary fake.

Some random ideas I had about how this could work:

If you want to transact with someone, they send you a challenge that consists of a set of addresses in a large file. You must respond with a hash of data at those addresses, problematically proving that you have the entire file.

This is the foundation. There are obvious challenges to how useful this is. Many of them are solvable.

<comment><USER6> There are some IPFS people who talk about proof of having stored files, but I was never satisfied with their fraud detection techniques.

Can you prove that one copy of your data is being stored? Yes.

Can you prove that three copies of your data are being stored? I haven't seen any scheme that can detect if I'm pretending to be multiple people, serving files from the same disk array over multiple network connections.

<comment><USER7> > Can you prove that three copies of your data are being stored?

In the context of IPFS, I'm not sure.

If you want to use the (crypto) network as distributed storage, you can shard and encrypt the data (at you 3x or whatever redundancy) and the storage provider is forced to store all of it, at least once.

Some incentives on data durability and availability may be enough to get a reasonable baseline.

<comment><USER6> If I didn't care how complicated the client is, sure.

I can do something reminiscent of "m of n" control tools, FEC or striping algorithms, but now the client is doing multiple fetches and matrix multiplication on every single request.

If I'm just trying to make sure there are 3 copies of my home page on IPFS, then I need 3 copies of the same file in three locations. And those locations all need to be online when I want to challenge them.

The Bitcoin protocol is designed around low availability of individual nodes and inference of consensus. Any 'proof' has to be uploaded while you're connected. Uploading a proof (of work, stake, whatever) to the network proves you did something, there is no need to challenge that fact, and you can disappear for hours or forever. No voting, no challenges.

Proof of storage requires challenges, which requires availability (well, storage also requires availability, otherwise what's the point?). If you insist that almost everyone is online, then you open the door to other consensus algorithms. Ones that can, for instance, handle non-repudiation.

<comment><USER7> I wasn't thinking of IPFS, rather a way to have a proof-of-stake storage system doing actually useful work. I think I've seen at least one, though I'm not sure of it's current state.

</comment></comment></comment></comment></comment><comment><USER8> If you're capable of playing a long con, it costs much less than the stated dollar prices.

With Bitcoin, for example, a smart malicious actor could infiltrate the Core development team and through their social capital make certain malicious pull requests get merged. This way, if the chain ever splits (let's say, due to a bug you planted), you can actually also influence miners to hop onto a minor chain without you ever owning any hashing power!

To see how this is done, look at the 2013 Bitcoin fork and see how a couple developers steered large miners away from the majority chain: [https://freedom-to-tinker.com/2015/07/28/analyzing- the-2013-...](https://freedom-to-tinker.com/2015/07/28/analyzing- the-2013-bitcoin-fork-centralized-decision-making-saved-the-day/)

The only counter-argument to this is how code reviews should catch this, but history has clearly shown that bugs (including supply-inflation-causing ones) make it into cryptocurrencies all the time: [https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposu...](https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures)

Hash Rate is security theatre.

<comment><USER9> The double spend is only possible against specific counter-party, for example an exchange or a merchant.

For very large value transfers exchanges are expected to wait for 100 confirmations (~17 hours) until they credit balance.

It's all probabilistic.

Finally, Bitcoin PoW is not security theatre, it is just one piece of the complex security system.

<comment><USER8> The most recent bug (that we know of) that allowed double-spend was in production for over a year [0] (~Sept 2017 to ~Sept 2018). I don't think it is possible to accurately determine the probability of this bug being exploited (because you are right, it is "all probabilistic"), but this inability to determine the probabilities is precisely why PoW is security theatre. PoW has always been painted as a mathematical model of the security of the system (see featured article), but in reality this model is not accounting for the much more realistic attack vectors. Hence it fails to be an accurate model.

If you're just saying that PoW isn't painting the whole picture, I agree with you.

[0] [https://bitcoincore.org/en/2018/09/20/notice/](https://bitcoincore.org/en/2018/09/20/notice/)

</comment></comment></comment><comment><USER10> By definition, to execute a 51% attack on Bitcoin, you would need to buy computing power greater than 100% of the entire network's current computing power. In other words, you would single-handedly _double the global demand for computing power in this market_.

Is there enough supply readily available to satisfy a doubling of global demand? How much would it cost to bring such computing power online? How quickly could it be done? Wouldn't the price of computing power skyrocket?

EDIT: Meekro's comment elsewhere on this page makes essentially the same point in a more concrete manner: [https://news.ycombinator.com/item?id=22161500](https://news.ycombinator.com/item?id=22161500) \-- I think his comment is better; read it. Also, see bencxr's analogy with trying to control 51% of global oil supply: [https://news.ycombinator.com/item?id=22161575](https://news.ycombinator.com/item?id=22161575)

</comment><comment><USER11> 1) If a big crypto-community notices an attack, the cost of a 51% attack would rise

2) There are mechanisms to offer smaller cryptocurrencies Bitcoin level security, like Komodo's Delayed Proof of Work ([https://komodoplatform.com/security-delayed-proof-of-work- dp...](https://komodoplatform.com/security-delayed-proof-of-work-dpow/))

<comment><USER12> The number of transactions that can be altered from a sustained 51% attack would be so few and recent (last 10 minutes) in comparison to cost that it makes it not worth it

<comment><USER13> There are many more ways to make money off a 51% attack than just altering transactions.

</comment></comment></comment><comment><USER14> Can someone ELI5 how these numbers fit together? It costs me $3/hr to 51% DeepOnion, which has a market cap of $1.95M. In practical terms, what does that mean?

<comment><USER11> The market cap does not fit into the equation on how an attack works ; it just gives you idea on how big/small is this blockchain

Blockchain don't have a centralized entity to "validate" and secure each transaction, so had to come with a solution to securely do so in a decentralized manner... Most blockchain use Proof of Work to do so : to participate on the validation process you have to "pay", by working on some mathematical problem... If you control more than 50% of the working power you can "control" the validation process...

In the case of DeepOnion, it costs $3 to buy enough computer power to control the validation process for one hour(by controlling more than 50% of the working power). You can use it to rewrite some transaction, and spend 2 times the same crypto.

<comment><USER15> But if it costs only $3 to break the system, how come the market cap is so high?

<comment><USER16> Because the volume of transaction for these currencies is too low for the market cap to mean anything. Imagine if there are, say, 1 million fancycoins in existence, all owned by me. I manage to convince you to buy one fancy coin for $1. Does it means that I now have $999,999 left in fancycoins "market cap"? In theory maybe, in practice I'll almost certainly never manage to liquidate them at this price.

For these small coins like DeepOnion you'll crash the market completely if you try to sell even a moderate amount of coins. There's simply not enough demand to move a big amount of coins at this price.

</comment></comment></comment></comment><comment><USER17> It feels surprisingly cheap.

Take bitcoin, a 105Billion cap can be subverted for just 700K per hour?

Not to mention DeepOnion for 3 bucks an hour. I can see people do that just for lulz.

<comment><USER18> The issue with saying how much a 51% attack "costs" is that ALL cryptocurrencies (and, really, ANY currency) is just based on the trust that the currency has "value", meaning that it would be accepted as payment for real goods and services.

A 51% attack on bitcoin would be easily noticeable. If a 51% attack was really "viable", it means that essentially bitcoin would have $0 value, because all of its value is based on the trust that the blockchain is real and verified. The community at large would essentially just ignore the rogue chain, or rather probably boost other existing resources to back it out.

<comment><USER19> How would the community collectively agree to ignore the rogue chain in a timely fashion? If a client announcement is sent out, that'd help, but there'd still be a lot of people stuck on the original chain (for example, some people on vacation or something). For at least a few days, there'd probably still be a lot of trust to capitalize on, and they could possibly get away with a few big heists (e.g. making a big purchase with BTC and then reversing the transaction after you've received the items).

Also, if the community does ignore the rogue chain, what's to stop the attackers from switching their attack to the other non-rogue chains as soon as they seem to gain traction? If they can hypothetically reliably sustain 51%+ power for weeks, they could potentially perform a DoS on an entire currency. And you're right, Bitcoin would probably soon reach close to $0 (though would probably slowly bounce back once/if the attack seems to be permanently thwarted).

If I'm understanding your last sentence right ("probably boost other existing resources to back it out"), then I also think that'd be the most likely scenario. A serious sustained 51% attack (lasting beyond several days) would turn into a Dragonball Z-like battle, with both sides firing continuous energy beams at each other in parallel. Each side would be trying to increase the magnitude of their beams to keep the other side's beam from collapsing theirs. I think the legitimate mining team would have a lot more energy in reserve (e.g. good samaritans who start mining for the first time to help push away the attackers - kind of like Goku's Spirit Bomb, which Frieza can't replicate) and would probably win. However, if for some reason the attackers can win for weeks at a time, then it'd be a serious DoS.

Disclaimer: I might be misunderstanding something important here. Not a cryptocurrency expert whatsoever.

</comment></comment></comment><comment><USER20> These numbers are based off the current price of hashrate. As soon as you try to buy significant amounts for larger currencies like Bitcoin, the numbers skyrocket.

The nice-hashable column on the site shows how much hash power is available for purchase.

To read the page naively would be a little like claiming one could hoard 51% of the oil supply given today's price at the pump. In reality, as soon as you started buying in large quantities, the price would skyrocket (making that attack very much more costly), suppliers would cut you off, and others would notice.

</comment><comment><USER21> I pointed this out elsewhere in this comment thread, but resurfacing here since it's perhaps not as clear as it should be: The attack cost is based on the the extrapolated cost of attacking the given coin based on the current hashing price on nicehash. If < 100% of the necessary hashing power is available via nicehash, it's greyed out, and the nicehash-able column shows a value of < 100%.

Another caveat: It's potentially cheaper to attack these coins than the number shown on this site since you receive block rewards from the time period when you attack a coin. In a lot of cases this will recover a majority of the money you spend on the attack. That said, this isn't guaranteed, and you are forced to put up this amount of money in order to carry out the attack.

Disclaimer: I built crypto51 ~a year ago

</comment><comment><USER22> Since it took a while for me to understand this. A 51% attack doesn't let you steal money from anyone. It essentially lets you block all transactions from making it to the blockchain. Nodes will still verify all transactions and ignore transactions that are invalid.

Edit: you can also create multiple forks and switch between them. External viewers will see both forks and if they don't or can't handle the difference they could experience a double spend.

That being said any miner has the ability to sort transaction any way they want which can give them an advantage. So if someone has a lot of hashing power they can use that ability to delay certain transactions or to give preference to others.

<comment><USER23> > A 51% attack doesn't let you steal money from anyone.

1\. You deposit BTC at an exchange. The exchange credits you the amount in their non-BTC ledger.

2\. You send off a chain of blocks overwriting the the original deposit so that you never did it.

3\. You fill in the form to withdraw your credited amount from the exchange.

Now you have 2x the coins.

Of course there are a LOT of details to this that I won't get into, and a number of mitigations for the exchange. But that's the basic outline.

<comment><USER22> Yeah exchanges and all other external systems need to handle this. Effectively they should look at the possibility of a deep reorg and the potential cost to them and use that to adjust how many transactions they require until the risk is mitigated.

</comment></comment></comment><comment><USER24> As I recall, last time this was posted, Monero was still on this list. Now it is not. Did the new PoW algorithm for Monero essentially remove the 'rentable hashing power' available?

<comment><USER25> There are no ASICs known to work on Monero anymore. As a brief summary, the new algorithm (RandomX) uses a bespoke virtual machine that requires 2GB of memory, and programs are randomly generated until the opcodes take in an input (previous block hash) and have an output (new hash with required difficulty) that pass the requirements. It is very interesting.

[https://github.com/tevador/RandomX](https://github.com/tevador/RandomX)

<comment><USER3> A GPU is an ASIC, which can mine RandomX. The idea that you could make something that's able to only be computed by a general purpose GPU, and not something more specialized, is just absurd. Even if that's just removing the unnecessary display hardware from the GPU and whatever parts of the shaders aren't being used, you still have an advantage.

<comment><USER26> GPUs actually have a significant disadvantage on RandomX. Their hashrate is much lower than what you'd get from a CPU.

Edit for more info:

[https://monerobenchmarks.info/](https://monerobenchmarks.info/)

According to this site, an overclocked Titan RTX gets about the same hash rate as a stock AMD FX8370E at nearly half the TDP.

<comment><USER3> Replace GPU with CPU in my answer. It applies to all of the algorithms in one way or another. ASIC resistant is an oxymoron.

<comment><USER27> ASIC-resistant specifically applies when you're talking about using ASICs as ASICs. If you're using ASICs to emulate CPUs (soft microprocessors), that is usually much less efficient than what the ASIC is capable of.

</comment></comment></comment></comment></comment></comment><comment><USER28> Anyone know how to calculate the revenue side of these attacks? E.g. if it costs 700k to attack the bitcoin network for 1 hour, how much money could you make in that hour (say based on average transaction volumes)?

<comment><USER29> It depends. Roughly speaking the revenue is

(Largest transaction you can cash out at exchanges) * (1 - (The decrease in value of the currency you attacked)) + (Block rewards earned).

Basically you get someone to give you cash in return for your cryptoX and then the attack lets you undo the transaction that gave them the cryptoX (but you still have the cash you got). The second term handles the fact that the attack may have cause the value of cryptoX to decrease which hurts you since you still hold the cryptoX you double spent.

This is an academic paper that looks into the details more closely [https://faculty.chicagobooth.edu/eric.budish/research/Econom...](https://faculty.chicagobooth.edu/eric.budish/research/Economic- Limits-Bitcoin-Blockchain.pdf)

</comment></comment><comment><USER30> $705k per hour for Bitcoin - these numbers sound very expensive.

Do they take into account that during an attack the attacker will earn block rewards and transaction fees?

Because if not, then they vastly overestimate the costs.

This sounds like it is based on the some energy price that would be needed to do 51% of Bitcoins hashing.

Doing so could very well be profitable.

The reason it would be hard to do is that the attacker would have to gather a ton of hardware that way way exceeds the energy costs.

<comment><USER31> I was actually shocked that it could be this low and thought it must be wrong. Other sources have suggested it would cost over $1B:

[https://u.today/guides/blockchain/bitcoin-51-attack-how- it-w...](https://u.today/guides/blockchain/bitcoin-51-attack-how-it-works-how- much-bitcoin-51-attack-costs)

> The hash rate is currently about six exahashes per seconds. Considering the > most efficient ASIC miner with a hash rate of about 13,000 GHS (using the > SHA-256 algorithm) being sold for about $2,100, an attacker will require > about 500,000 hardware units and this will amount to about $1,005,000,000. > When we factor in the cost of electricity and cooling daily, this figure > rises to $1,006,000,000.

[https://cryptoslate.com/analysis-bitcoin- costs-1-4-billion-t...](https://cryptoslate.com/analysis-bitcoin- costs-1-4-billion-to-51-attack-consumes-as-much-electricity-as-morocco/)

> To successfully conduct a 51 percent attack on the Bitcoin network would > cost an incredible $1.4 billion. This massive network supports over 5 > million specialized ASIC mining computers, consuming a total of 29 Terawatt > hours of electricity a year—as much as the entire country of Morocco. One of > the underpinnings of the Bitcoin network is...

[https://gobitcoin.io/tools/cost-51-attack/](https://gobitcoin.io/tools/cost-51-attack/)

> $17,562,078,097, Hardware cost only, at cheapest rate. The attack would > consume 241,478,573.839 kWh per day. (12,073,928.692$ per day)

<comment><USER32> The calculations you cite and what the linked page are fundamentally different. The numbers you're citing are roughly what it would cost to buy hardware that would continuously be capable of mounting a 51% attack. The linked site is estimating how much it would cost to rent existing capacity to mount an hour-long 51% attack.

</comment></comment></comment><comment><USER33> Hard to take this seriously when it is missing Garlicoin.

<comment><USER34> From their web sites, it sounds like some sort of Dogecoin remake?

</comment></comment><comment><USER35> QuarkChain QKC $6.01 M Ethash 10 GH/s $7 69,816%

So 7$ is the nicehash cost? But isn't nicehash an out of the box solution? So if I wanted to actually execute a 51% attack I'd have to deploy my own malicious mining software to the nodes, that then issued an invalid transaction and _forced_ consensus on it ... is that the idea? Can someone who knows a little bit more about this fill me in?

<comment><USER36> I believe this is the basic idea. Let's say on QKC.

1\. Buy a whole bunch of QKC and wait for your receipt of the QKC to clearly be part of the winning chain.

2\. Make a copy of the blockchain. Keep it to yourself.

3\. Start adding mining blocks* to your copy, in private; do not release your private copy of the chain at all, just keep piling on mining blocks. You must outpace the world's ('public chain') rate at which they are piling blocks on, hence why you need over 50% of total hashing power to do this and guarantee that your private copy ends up with more mining blocks than the public copy.

4\. Whilst you are mining your own private copy, spend spend spend. Spend ALLLLL your QKC, getting goods and services in return, or simply other cryptocurrencies.

5\. Eventually, when you've spent all your QKC and your private copy clearly has more mining blocks on it than the fork of the public chain everyone currently agrees upon... release it.

6\. The protocols and papers all state that now your erstwhile secret, private copy is now the new consensus view; after all, it has the most mining blocks on it.

7\. That means that none of your QKC is actually spent. Effectively you get all your spent QKC back. In addition, whatever wallet has been doing all that mining just earned a bunch of QKC as a reward for doing all that mining effort, so you now have more QKC than you started with, AND you have all the goods (or other cryptocurrencies, or services, or whatnot) that you bought with your QKC whilst you were secretly mining.

Exactly how much time you need to spend all your QKC and ensure that your private copy of the chain definitely will win any consensus fight with any other fork is beyond my understanding of cryptocurrencies.

There are out-of-band mitigations possible; if it is abundantly clear what's going on and sufficient amounts of those who control major nodes all agree to just hardcode in their copy of the software that your chain, no matter how many blocks it has, is never selected as the consensus, then all your work is for naught. Etherium has run into a variant of this problem (it wasn't a 51% attack but something else). Everything happened just as I write: the majority of ethereum network movers and shakers chatted on forums and the like and decided to update their software (and their personal 'belief' of which of the many forks is the consensus fork) to disregard the one where a lot of eth was 'stolen'. But not quite everybody; a few decided not to update their software and stick with the rule that the one with the most is the consensus. That is now called 'etherium classic'.

*) Mining blocks are just blocks confirming all is well; they contain a proof of work which involves a random number added to the message. A mining block is valid if, when you hash it, the hash ends in a whole bunch of zeroes. The idea is that the only way to do this is to generate billions of random numbers, keep hashing the results, until you hit the jackpot and your hash ends up by sheer coincidence to end in the desired # of zeroes. At which point you publish this mining block on the chain. As part of doing that, the 'network' itself gives you some coin to pay you for your efforts, and the 'fork' that you put this block on is now more robust, in that the rule is that the consensus block is the one with the most mining blocks on it.

</comment></comment><comment><USER37> Also relevant, one the front page of HN today: Bitcoin Gold hit by 51% attacks, $72K in cryptocurrency double-spent

[https://thenextweb.com/hardfork/2020/01/27/bitcoin- gold-51-p...](https://thenextweb.com/hardfork/2020/01/27/bitcoin- gold-51-percent-attack-blockchain-reorg-cryptocurrency-binance-exchange/)

</comment><comment><USER38> Interesting article on this topic:

[https://blog.coinbase.com/how-coinbase-views-proof-of- work-s...](https://blog.coinbase.com/how-coinbase-views-proof-of-work- security-f4ba1a139da0)

Also, Ethereum is transitioning to proof of stake which will make attacks much more expensive because an attacker must acquire large amounts of ETH for each attack.

</comment><comment><USER39> 51% attacks on most currencies are quite easy if you attack the mining pools. [http://blog.kevmod.com/2019/01/pooljacking- easy-51-attacks-a...](http://blog.kevmod.com/2019/01/pooljacking- easy-51-attacks-against-bitcoin-and-ethereum/)

</comment><comment><USER40> How is Ripple doing these days? That one always interested me. It's not on here.

</comment><comment><USER41> Discussed in 2018: [https://news.ycombinator.com/item?id=17173051](https://news.ycombinator.com/item?id=17173051)

</comment><comment><USER42> seems like any nation state can easily afford to do this. we should be wary of any country that is heavily reliant on exports of ink and paper.

</comment><comment><USER43> I feel like if someone can envision a motive attractive enough we have to assume that China has the plans in place to execute such an attack.

</comment><comment><USER44> DASH's is incorrect. It has some protection against this vector of attack called "Chain Locks"

[https://cryptobriefing.com/chainlocks-dash- network/](https://cryptobriefing.com/chainlocks-dash-network/)

</comment><comment><USER45> Would it work to somehow sabotage the other 49%?</comment>


Probably the first open source Merb-based social network (GPL'd) - <AUTHOR> http://github.com/foysavas/freegovernment-core/tree/master

<comment><USER2> Timely subject matter, too...</comment>


Ask HN: 1 minute Survey About Open Source Software in Your Products - <AUTHOR> Hey Guys,
If you are a developer can you help us by taking this survey. We are attempting to get some metrics around open source adoption in commercial products.
Survey Link: http://www.surveymonkey.com/s/PT56NHC
Thanks! <comment><USER2> If you really want people to do this, why do you make them copy and paste the URL into their browser? Why don't you provide a clickable link?

Here, I'll do it for you: <http://www.surveymonkey.com/s/PT56NHC>

... and now that I've gone to take the survey, I can't finish it because there is no suitable answer for question 6. Another of the questions I had trouble understanding the distinction between "None" and "0" as answers.

So I gave up.

Good surveys are really quite hard to design, and bad surveys are pretty near useless. It's pretty clear you're asking how much people will pay for something you're thinking of producing, so I suggest you think a lot harder about how you're going to get that information. I'll be very surprised if this survey gives you anything reliable.

<comment><USER3> I was under the impression that you can't have a clickable link in a post submission (or maybe a specific type of submission).

You have to rely on someone posting a reply with a clickable link (most Show HN:'s have this format).

\</comment></comment><comment></comment><comment></comment><comment>--

To the OP, I took the survey. All the best.

<comment><AUTHOR> Thanks for taking the survey.

</comment></comment><comment><USER4> It's good etiquette to post the results page with the poll so that it benefits the entire community, not just yourself.

<comment><AUTHOR> Yup. That is the plan. Once we collect the data, I will post the results.

</comment></comment><comment><USER5> I marked "I only use free tools", but what I really wanted was an option like "This isn't worth paying for".

We do pay for tools we find useful.

<comment><USER6> I thought the same, so I selected less than $10/month.

</comment></comment><comment><USER7> Consider making all questions optional and you'll get more people answering.

</comment><comment><USER8> A metacomment related to question 6: Ubuntu tells us exactly how many packages need to be updated, and the update is as simple as executing a single command. The problem is ensuring that functionality is not broken by things like API or subtle behavior changes. This means that updates end up happening infrequently since they need to be regression tested on a development server before being pushed to production.

If a product could solve that problem (classifying updates and performing code analysis to determine if something could break) it would definitely be worth paying for.

Note also that you're asking the wrong people, and it's going to be hard to ask the right people with an Internet post. The best candidates for this tool are busy founders/CTOs/sysadmins/engineers who don't have time to manage their updates, much less take surveys on Hacker News.

</comment><comment><USER9> I bailed at question #5: "How many open source packages that you build your product on are currently out of date?"

It's just too vague and it implies that I'm lazy/behind. Let's say I'm using jQuery 1.x, for example, because when I was building/testing last, that was the most stable version. Today jQuery has probably 20 more "updates" since I rolled mine into production - the version number has incremented 20 times - but it doesn't mean I'm "out of date", does it? I don't believe that I have to update my use everytime jQuery goes from 1.34 to 1.35 to 1.36 all the way to 1.99.

So "out of date" is a bit problematic for me in that I don't feel the need to test/use every incremental update.

</comment><comment><USER10> I agree that Question #6, the keystone, is poorly designed.

It should also include the option "I don't know, depends on how useful it is".

I just chose a random answer since that option wasn't there (and the question was required).

<comment><AUTHOR> That is a good point. Thanks. I wil implement that answer in future surveys.

</comment></comment><comment><USER11> i clicked on the "only free tools", but this is an interesting idea. how are you planning to implement it? a tool that scans our git, hg, svn and cvs repos and tells us what we have would be quite interesting (although there's the obvious hurdle of trusting third party code enough to ever run it).

i work for a small consultancy that builds bespoke solutions using open source code - we have loads of projects, some ancient (cvs!), and i am sure no-one has a clue what versions of what we used when (sure, it's documented for the client, but we don't have our own central list). now perhaps we should be better organised, but i suspect many other companies are in a similar position.

but if we were going to pay for this, how would it help us make money? is the idea that we can approach ex-clients and scare them with lists of security holes? or are they the target clients - perhaps they should be running this code to audit their systems? and that sounds so useful i am surprised that nothing like this already exists...?

</comment><comment><USER12> Same objection to question 6 that other people have mentioned: I wouldn't pay for a service that tells me about open source software updates (because I keep up with them myself already as part of my usual process of staying informed), but that doesn't mean I don't pay for services in general.

</comment><comment><USER13> Only 6 questions, I've seen much worse surveys ;-)

<comment><AUTHOR> Wanted to keep it short for the HN crowd. :)</comment></comment>


Boston Dynamics Atlas Robot Goes Full American Ninja Warrior in Latest Demo - <AUTHOR> https://hothardware.com/news/boston-dynamics-atlas-robot-american-ninja-warrior-parkour#IYeeEJCo8dfsmAyD.02 <comment><USER2> The headline is sensationalized -- I understand there's more to the show "American Ninja Warrior" than jogging up three large steps and not tripping over a log -- but the demo video is still pretty cool.

<comment><USER3> Yeah. My 8 year old can do that "course".</comment></comment>


9/11 Plane Debris Found in Lower Manhattan - <AUTHOR> http://blogs.wsj.com/metropolis/2013/04/26/911-airplane-debris-found-more-than-a-decade-later/?mod=e2fb

<comment><USER2> Noting the last graf: _The Park Place building attracted controversy several years ago when critics protested the plan to build an Islamic cultural center on the site._

and in hopes of shedding light rather than generating heat on that topic, let me point out that the WTC south tower contained a Muslim prayer room:

[https://www.nytimes.com/2010/09/11/nyregion/11religion.html?...](https://www.nytimes.com/2010/09/11/nyregion/11religion.html?pagewanted=all&_r=0)

</comment><comment><USER3> 12 years later!

I would have thought they would have searched the whole area, at least within half a mile, to find debris.</comment>


New in Clojure 1.10: Prepl - <AUTHOR> https://www.reddit.com/r/Clojure/comments/7wdlq4/first_cut_of_prepl_%E8%B7%AF_clojureclojure86a158d/ <comment><AUTHOR> See related [https://github.com/Unrepl/unrepl](https://github.com/Unrepl/unrepl) for some more context on how this would be useful.</comment>


Physicist Proposes Alternative to Black Holes - <AUTHOR> http://www.skyandtelescope.com/astronomy-news/physicist-proposes-new-black-hole-alternative/ <comment><USER2> At risk of sounding like those armchair physicists on the internet (oh wait, that's exactly how this post sounds!) it's "obvious" that a black hole cannot form.

The standard lay explanation of what an observer outside a black hole sees as an object falls into it is that gravitational time dilation freezes the object just at the event horizon. "[A]n object falling into a black hole appears to slow as it approaches the event horizon, taking an infinite time to reach it.[62]" (wikipedia citing Carroll 2004). For an object with just short of black hole mass, this time would instead be just short of infinite. So how does the black hole finish forming? (A similar problem seems to apply in the interior, where hawking radiation evaporates the black hole mass after essentially no time has passed for the observer falling inward)

Changing argumentative tactics to something totally nonphysical and unrelated to black holes except by sharing the term "singularity", this feels to me like a function such as f(x) = 1/x or f(x) = -ln x as you approach x=0. Yes, if you can get all the way to x=0 you're at a singularity. But if you're riding the curve on your bicycle, the distance you've got to ride along the curve is infinite, so you can never experience this supposed singularity after a finite time.

This armchair viewpoint is obviously flawed in some way, or real astrophysicists wouldn't be talking about actual black holes like they existed, so I'd love to hear an explanation that tackles this specific objection.</comment>


Show HN: Web application protection and security monitoring for web developers - <AUTHOR> https://shieldfy.io <comment><AUTHOR> Hello Everybody This is Eslam Salem Founder & CEO of Shieldfy .. We built shieldfy to help developers protect their web applicaitons and detect vulnerbilities in their code. We are looking for your feedback and suggestions , and please ask me if you need anything. Best.

<comment><USER2> Pretty interesting project, is it PHP only though? All examples seem to point towards PHP or is it a generic solution?

<comment><AUTHOR> Thanks bausshf The concept of language instrumentation which we use is the same for all languages .. but for now we are supporting PHP as a start .. the rest of languages is scheduled next

</comment></comment></comment><comment><USER3> You want someone who is a native English speaker to go through and fix all your copy.

You don't want nonsense like:

"Shieldfy Monitor all requests and Monitor your code to see how it react. When spot attack ,"

<comment><AUTHOR> Totally agree , we are egyptians so english is not our native language. Can you suggest a modification to the phrase you mention ?

<comment><USER2> Maybe something like this "Shieldfy monitors all requests and your code to see how it reacts. When an attack is spotted, Shieldfy blocks it and sends you information about it, including every action the hacker performed, since he landed on your website, helping you reproduce the issue."</comment></comment></comment>


SSH and terminal background - <AUTHOR> http://www.drinchev.com/blog/ssh-and-terminal-background/ <comment><USER2> Did something similar with iTerm changing both the background colour and setting a badge which effectively visually watermarks my terminal session with the host name of the machine I'm connected to.

[https://github.com/kiyanwang/dotfiles/blob/master/bin/ssh](https://github.com/kiyanwang/dotfiles/blob/master/bin/ssh)

<comment><AUTHOR> Having ssh in a wrapper was a no-go for me, since I have a lot (~50) of servers configured in .ssh/config.

Also my autocomplete broke when I made it an alias, so that's why I was looking for different solutions.</comment></comment>


I've proved that p=np - <AUTHOR> http://arxiv.org/abs/1205.6658<p>...and no one wants to/is able refute me. <comment><USER2> (a) if Feldmann really has a P solution to 3-SAT by reducing it to LP, surely he can demonstrate this empirically, there's plenty of solvers out there for both LP and 3-SAT. (b) the reduction of 3-SAT to ILP is classical ([http://www.cs.berkeley.edu/~vazirani/s99cs170/notes/npc.pdf](http://www.cs.berkeley.edu/~vazirani/s99cs170/notes/npc.pdf) and [http://www.cs.cmu.edu/afs/cs/academic/class/15451-s10/www/re...](http://www.cs.cmu.edu/afs/cs/academic/class/15451-s10/www/recitations/rec0408.txt) are two quick examples) (c) Just skimming, I don't immediately see any reason to believe that the solutions to Feldmann's LP formulation will be integral.

<comment><AUTHOR> Thanks for your input, I'll foward that to Feldmann.

</comment></comment><comment><USER3> Perhaps you should submit this to a real journal rather than hacker news? Real experts might be the right people to refute you. May I suggest the Journal of Complexity ([http://www.journals.elsevier.com/journal-of- complexity/](http://www.journals.elsevier.com/journal-of-complexity/)) or perhaps the Journal of Systems Science and Complexity ([http://www.springer.com/mathematics/applications/journal/114...](http://www.springer.com/mathematics/applications/journal/11424))

<comment><AUTHOR> The guy tried just that. After 1 year of this paper being in "research committee" the answer was, and I quote : "This is not possible, you're wrong. Even if you're right, you're wrong". That's it, no one has been able to disprove this, and I hopped someone skilled enough on HN would be.

<comment><USER4> The paper has pages of formalism about interpreting SAT in probabilistic terms that feel like they probably don't add anything to the problem. I'm not inclined to work through all of that either but I think it's very likely he ends up with an LP that isn't integral and therefore he hasn't actually solved the problem.

If that's not the case he should implement his algorithm and show that it actually works on large cnf problems, such as those that one can download from a number of SAT competition websites.

<comment><AUTHOR> Thanks, I hope I'll be able to convince him to register and answer to you guys.

From what I gathered, the implication if he was right, would be the end of encryption.

<comment><USER4> The implications would be far greater than that if he were right. An efficient algorithm for an NP complete problem would mean that you could find global optima for general non-linear functions. That would very likely lead to superhuman AI.

<comment><USER5> I don't understand where your "very likely" comes from here; AI has quite a lot of challenges other than ones that we know how to describe as optimization problems.

You can also in some cases have asymptotically efficient algorithms that aren't very efficient on the problem instances that we try to use them for; a somewhat recent example is the AKS primality test.

[https://en.wikipedia.org/wiki/AKS_primality_test#Importance](https://en.wikipedia.org/wiki/AKS_primality_test#Importance)

<comment><USER4> For your second objection by "efficient algorithm", I meant an algorithm that is practically efficient on very large problems. That probably means no worse than O(N^2), but preferably more like O( N*log(N) ).

For your first objection I think a modified form of AIXI probably already solves most of the "non-optimization" challenges of AI. By modified form, I basically mean replace minimum size Turing Machines with minimum size boolean circuits to transform an uncomputable problem into one that is computable and that would be tractable given the scenario we are discussing. In other words you would essentially be doing reinforcement learning by searching for small boolean circuits which maximize the objective function.

Of course there is the rather important matter of defining the objective function itself, which P=NP may not directly help much with. I think that with a sufficiently powerful optimization algorithm you will get (super-)intelligent behavior almost no matter what the objective function (as Boscom has argued with his paper-clip scenario). The question would be more whether the intelligent behavior that arises is desirable for humans or not.

Even if you don't believe in my AIXI-like approach just look at what a highly suboptimal optimization algorithm like gradient ascent has done when applied to deep neural networks. If you can get superhuman go players and image recognizers with that, what would you get using a universal global optimizer ?

Finally we are talking about a scenario where mathematics is basically a solved problem (in the sense that you would have an automatic theorem prover that could prove any theorem you could state formally). If that world wouldn't lead quickly to general AI then there would have to be some mystery to intelligence that is literally deeper than mathematics itself, which is hard for me to believe.

<comment><USER2> > That probably means no worse than O(N^2),...

We don't even have a quadratic-time algorithm for matrix multiplication (and it's obvious that O(N^2) is a lower bound).

<comment><USER4> Nor do we have any proof of a lower bound > O( N ) for 3-SAT.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> It's easy to formulate 3-SAT as an LP feasibility problem. The problem is that you need solutions in which all variables are either 0 or 1. That makes it an integer or 0-1 LP problem and such problems are NP hard.

<comment><USER5> I don't know if there's ultimately an analogy in the deeper mathematical structure, but the difference between the logarithm problem and the discrete logarithm problem comes to mind. On the one hand, in both cases it's "just" finding the inverse of an operation over a field. On the other hand, numerical approximations of continuous logarithms are straightforward and quick to calculate, yet discrete logarithms aren't.

<comment><USER4> I'm not very familiar with the discrete logarithm problem but it seems to be fairly generally true that many problems which are easy in the continuous case become hard when you try to restrict the solutions to a grid. Even solving the linear equation Ax = b in n dimensions, I believe, is NP hard for x \in {0,1}^n.

<comment><USER5> I wonder if we could say that this has to do with the integers having measure zero in the reals, so if you want to actually hit them you may need a qualitatively better kind of "aim".

(I don't know enough higher math to know if this intuition is meaningful or not.)

<comment><USER4> There are probably a lot of different ways to look at it.

One perspective is that easy problems usually involve convex sets (or minimizing convex functions, which is pretty much the same thing since the solution set is guaranteed to be convex). Discrete sets, such as the vertex set of a hypercube, are trivially non-convex (unless they only contain a single element).

You can also think about it geometrically. Imagine you have a plane that passes through a cube. How do you determine if it intersects one of the cube vertices (this is basically equivalent to the subset sum problem) ? Of course it's easy to find a method that will work in 3D, but these methods all end up scaling exponentially with the dimension of the space.

<comment><AUTHOR> Thanks a lot for your comment, I hope this will help Feldmann.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Not really me, just a mathematician friend who has no clue on how to post on HN.</comment>


Dev vs. Ops - <AUTHOR> https://www.bassi.io/articles/2017/08/10/dev-v-ops/ <comment><USER2> Linux as a platform is the equivalent of asking random volunteers to build a city, not telling them exactly how you want it built, and then hiring contractors to take what has been built and make it work for the majority of people. It's organized chaos.

I think the author is wrong that you need to enforce specific ways of doing everything, or that we need to even think about standards. The only thing you really need to enforce is a culture, which becomes an unofficial, de facto standard. I think Windows is a good example of this. Windows doesn't force you to do everything its way - it's just way, way more convenient. Linux makes it too convenient to do something different, so everyone does.

I think the solution for a distribution is the following:

      1. remove all unnecessary software
      2. remove all methods to easily install new software automatically
         (reserve that function only for updating existing software)
      3. make all base software follow a set of guidelines which are incredibly
         convenient to adapt and follow by new applications

The result would be a culture of convenience that would enable more compatibility by simply making it easier for everyone to do the same thing. My apologies if the author proposed this very thing; it was too long and I didn't read it all.

<comment><USER3> Thats the ironic part. The upstream devs are all about a culture of "we don't care". They basically want their cake and eat it too.

And the group this guy effectively represent, is a forefront of this mentality.

If you try to build GTK, that he is directly responsible for, it will complain loudly unless you have the absolute latest Xorg installed.

Yet if you go and build the equivalent from Qt, they are happy to build against versions if Xorg that GTK would consider Jurassic.

No wonder Gnome is so gung ho about Wayland...

</comment></comment><comment><USER4> I hate to be so callous about this but this article is really just a dev shitting on ops people because they either don't understand or are intentionally omitting the reason why sysadmins are put between devs and production.

> Linux distribution developer tells application and system developers that > packaging is a solved problem, as long as everyone uses the same OS, > distribution, tools, and becomes a distro packager.

There is no such thing as Linux. There is Redhat Enterprise Linux, Ubuntu Linux, OpenSUSE Linux, Debian Linux, ArchLinux, etc.. These are systems with a loose set of tools in common but differ to the point of absurdity in organization, structure, availabile software, and capabilities.

Supporting multiple distributions should be viewed as supporting multiple platforms. You can either port your software or bundle all your dependencies, all the way down to libc if you want.

> making sure that the overall OS fits into a fairly specific view of how > computer systems should work

Which is another name for 'software is incredibly complex and conventions are needed if you want to stay sane'.

Quick, where do web applications go? /srv/myapp, /opt/myapp, /usr/share/webapps/myapp, /usr/share/myapp, /var/www/myapp, /var/myapp/, /myapp, /usr/local/myapp? If you answered all of this above you've used 3rd party software on a Linux system. Where do you think the logs for all those locations wind up?

Packaging is the art of beating software into submission so that it can actually be managed, secured, audited, and monitored.

> You're still supposed to go ask your sysadmin for an application to be > available, and you're still supposed to give your application to the > sysadmin so that they can deploy it — with or without modifications.

This is PaaS which isn't mandatory but highly suggested when dealing with teams of developers. You write the code until it works, we deal with making that new library you want that was released two weeks ago work, deal with the licensing of your APIs, libraries, drivers, and tooling, and integrating it into your CI/CD pipeline. You just write the code.

> to convince the developers of...

Because that's not how it works, we take your source distribution model, pip, bundle, npm (i.e upstream) and turn them into packages. There's no convincing to do because they're not in conflict.

> The issue is not the 'managed by somebody' part; the issue is the inevitable > intermediary between an application developer and an application user.

This is what it's really about. Devs don't understand what ops people actually _do_ and just see them as a team that slows them down and tells them no a lot.

> developers are heavily based on the concept of a core set of OS services; a > parallel installable blocks of system dependencies shipped and retired by > the OS vendor

Otherwise known as a the packages your distribution ships.

> How did foo get into the repository?

Because a distribution vendor thought your software was useful, packaged it for distribution, and put it in their repository. At this point it is NO LONGER your software or your responsibility. The vendor has adopted this package and committed ensuring that it works and is maintained. People with problems should (and do) complain to them rather than you.

> How can you host a repository, if you can't, or don't want to host it on > somebody else's infrastructure?

[https://access.redhat.com/documentation/en- US/Red_Hat_Enterp...](https://access.redhat.com/documentation/en- US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/sec-Yum_Repository.html)

You make a repository and host it on your infrastructure. I promise it will be the easiest web service you've ever configured.

> What happens when you have to deal with a bajillion, slightly conflicting, > ever changing policies?

Depends, if you're distributing it yourself then you treat it like cross platform work. If distributions are packaging them for you, then you sit back and let them do it. If your IT dept is deploying your software then you let them handle it.

> How do you keep your work up to date for everyone, and every combination?

You push an update (i.e copy a file) to your repository, then people download and install it. Again, if you're opting for either distro maintainers or IT dept you just publish your code and let them deal with it.

> What happens if you cannot give out the keys to your application to > everyone, even if the application itself may be free software?

You distribute the software (myapp) and (myapp-license or myapp-api-keys) in a separate package and mark the keys as a dependency.

> Scalability is the problem; too many intermediaries, too many gatekeepers.

There aren't any gatekeepers. There are people are doing work for you. You are totally in control. You (or your org) can _opt_ to have some of that work done for you. You can't pretend that it doesn't need to be done at all.

<comment><USER5> _There aren 't any gatekeepers. There are people are doing work for you. You are totally in control. You (or your org) can opt to have some of that work done for you. You can't pretend that it doesn't need to be done at all_

Soon are coming the days in which developers produce Docker images as their primary artefact and Ops are responsible just for k8s, DC/OS or whatever runs them, without knowing or needing to know what's inside those containers. At first developers will be ecstatic, they can use any version of anything, never have to get anyone else to install anything first, brilliant!

Then the 3am phone calls will start...

<comment><USER6> > Then the 3am phone calls will start...

As a developer this is exactly what I want. It is part of having ownership and is critical to writing and maintaining good software. Containers are great for this reason as they give me control of the complete runtime environment of my application so I can better support it.

And it makes those 3am calls less frequent, not more. I've always been on call for my software and I thought this was now the norm and the throw-it-over-the- wall process had mostly died out.

<comment><USER5> _As a developer this is exactly what I want_

That's refreshing to hear. I've done both jobs, and I'll tell you what I've observed: if you were to go over to a developer and say "there's a bug in the program" they would look at you as if you were an idiot. What program? And when you do what?

But that same developer will go to ops and say "the server is slow", seemingly entirely unaware that the person they are talking to supports hundreds of apps running across thousands of servers. I think many developers are in for a bit of a surprise when they discover DevOps means "you do ops too now".</comment></comment></comment></comment>


Ask HN: Finding a pair programming partner. - <AUTHOR>

I like to learn & work collaboratively. I miss my Pair Programming days from back in school.
I'd like to find some one either local (Bay area) or remote who would like to pair program.
My specific interests: Data mining and visualization, Design, Workflow. JS and Python are my preferred languages. <comment><USER2> ...but you can't just pair program with some random person. If you want to recruit a pair programmer surely you are advertising for a new full time job - an exact copy of your job actually.

<comment><AUTHOR> Nopes. I'd just like to work together on JS projects. My experience is that pairing with someone is an excellent way to both keep you on task and make the experience fun.</comment></comment>


Canadian Rogers caves on iPhone 3G plans, offers 6GB for $30 a month - <AUTHOR> http://www.engadget.com/2008/07/09/rogers-caves-on-iphone-3g-plans-offers-up-6gb-for-30-a-month/ <comment><USER2> This is good news but still need to sign a 3 years contract to get that package. I have a first gen phone so not sure what I'll do :/

<comment><AUTHOR> Yeah, the other thing is that this is only a promotional offer good until August. The problem of the lack of competition in Canada and carriers being able to do whatever they want is unaddressed.

<comment><USER2> Yes, if only the CRTC tried to do something.

Hopefully the turnout of the wireless spectrum auction (<http://agora.ic.gc.ca/AuctionGCLF_BTS/bidderResults.cfm>) will be beneficial.

</comment></comment></comment><comment><USER3> Woo, something semi-usable. Boo, 3 year contract terms. (seriously, this only happens in canada with the 3 years contract terms. I almost want to have some regulation to limit it to 6 months, but regulation is what got us in this mess in the first place)

<comment> a-priori Competition trumps regulation for keeping suppliers honest.

</comment></comment><comment><USER4> The iPhone packages are still crap, and they haven't changed at all. This is a BS ploy, plain and simple. Ugh... Back to the stone age for us...</comment>


War on plastic waste faces setback as cost of recycled material soars - <AUTHOR> https://www.theguardian.com/environment/2019/oct/13/war-on-plastic-waste-faces-setback-as-cost-of-recycled-material-soars <comment><USER2> we need to just stop using plastic altogether. companies were perfectly able to operate and make a profit off of glass bottles. poor and middle class people have not seen any economic benefit to switching to plastic in many cases. only the rich have seen the benefits. i see no reason not to return to glass for things like bottles if the only excuse is that rich people won't make as much money.</comment>


Credit Card Processing is a Hard Business - <AUTHOR> http://blog.zactownsend.com/thoughts-on-braintree-paypal-stripe-and-payment-processing <comment><USER2> Sooooo. A company started in 2007 and sold in 2013 for $800 million. I feel like the author is a little lost in the trees and not seeing the forest. Stripe came along much later and by most accounts was valued at $500 million at their last round. Now, Braintree had reasons for why it couldn't get all the way to IPO so there were some challenges. However, I would take a guess that less than 1% of all startups have an $800 mil + exit after 6 years. And now there's another one right behind them (Stripe).

<comment><USER3> Agree! Congrats to Bryan, Bill, and the whole Braintree team. They've built a great company and operate with integrity.

</comment></comment><comment><USER4> @zt

You say payments processing is a hard business - mostly because margins are commodity unlike software business where margin is exponential. This is an apples/oranges comparison

If one is evaluating startups/enterprises how does one determine market value ? Mostly by growth potential and the profit margin. However before profit margin there needs to be growth

In a startup there are 3 basic ways - either ad based - need to have 10s of millions before one can start monetizing, freemium - need to have millions before any significant monetization or transaction based where the very first user/customer makes the startup "post-revenue". Doing a payments startup negates the question "how/how much will you monetize" to simply "how will you scale" This reduces the startup problem by an order.

Add to this equation that payments defies that standard dictum of entrepreneurship i.e. "if I can only get 1% of the total pie I'll be a billion dollar company" In payments if one gets 1% of of the total pie it is indeed a multi-billion dollar company e.g. Paypal at ~$150B/year annual volume is less than 1% of total ACH volume and only about 2% of total VISA/MC volume

In short payments is a volume business and if done right volumes can get high very quickly and hence valuation can increase equally quickly. As for the long term growth potential witness VISA and Mastercard still doing a good 14-16% CAGR in the past 20 years after being founded 40 years back. Certainly "long term" wouldn't you agree ?

And now about profit margins: Do you know the size of the "interchange pie" \- even with Durbin amendment and Debit becoming low cost, its still more than $150B/year. That's greater than the entire semiconductor revenue industry combined. Traditionally large processors e.g. FDC etc. have not been able to intermediate themselves to threaten the interchange monopoly of banks but with online space volume increasing exponentially its possible for an online 3rd party processor to get big enough in size to eventually challenge status quo. The valuation of such a company particularly if it can intermediate itself to become a consumer brand could be as high as the next google.

<comment><AUTHOR> Thanks for your thoughts. I think you're right that taking payments and comparing it to a normal software model is a little unfair.

That being said, the margins are low no matter how you slice it. It's hard to run a business on thirty or forty bps, before risk and marketing. And, recall that PayPal almost collapsed because of risk.

It's a volume business as you say and you need a ton of volume for it to make sense. I am not saying that Stripe, Braintree, Balanced, etc, are bad businesses. In fact, I think they're very impressive exactly because they operate in an extremely tough, highly competitive, razor-thin margin business.

It's interesting that you point to PayPal in the way you do. I would agree that they have a small part of the ACH and card networks. I would also argue that the parts that they do have are very lucrative. They make the vast majority of their money through charging too much for ACH and through their foreign exchange fee. Ultimately, most of the ACH network's transactions aren't going to go through third parties no matter what you do.

Comparing the growth potential of an independent sales organization like Braintree and Stripe with a card network like VISA or Mastercard is an apples/oranges comparison. If you can create a payments network that meets the three criterion for a a good system - ubiquitous, perceived to be secure, and successfully transmits value - then god bless. I think you'll have 14-16% CAGR. I'm not sure anyone can do that though - and many have tried. I'll eat my words by being so categorical but talk about a schlep business.

I think you're absolutely correct that if a processor could intermediate itself and become a consumer brand, that it could be the next Google. In general I am skeptical that one company will win. I think there will be a ton of large, public, companies in this space but between different processors, pay by GMail, Square moving in to this space, MasterCard's Simplify, etc, I am not sure that there will exist a monolithic winner that will get to that size.

</comment></comment><comment><USER5> Chrome flagged this as a potential phishing attack. Anyone else seeing that?

<comment><AUTHOR> Ya, I'm seeing that myself. (I'm the author). Sorry about that! I think it's because it's my first post and it's about credit cards, processing, and commonly phished sites like PayPal, Braintree, Stripe, etc. I've entered my site on Google's reporting tools...I'm not trying to get any financial information from anyone!

<comment><USER6> Most likely because the word paypal is in the actual URL.

</comment></comment></comment><comment><USER7> I love Stripe as much as the next guy but this post seems a bit biased in that direction.

You've added the caveat (and it's appreciated) but saying someone/something is the best at anything is a tall, tall order. Never align yourself to a tech, service or company so much that you miss anything else on the horizon.

<comment><USER8> I've done some work for a competitor so feel free to call me out for being biased.

Stripe rocks.

Documentation, interface, team, vision, customer service etc, it's all a notch above the expected. If there ever was a company that I wished that I could have invested in early stage this was it. Dropbox, Airbnb & Heroku are all great companies, Stripe has the potential to be an _awesome_ company (no offence to Dropbox, Airbnb & Heroku intended).

That I like the founders on top of all that makes it an even better story, what's not to like about Patrick & John?

Stripe is a story worth knowing about, even if you're not in the payment industry, _this_ is how you do a start-up tackling a tough problem.

<comment><USER7> I'm not knocking Stripe. I use them and love them for what they provide. They've taken an extremely difficult problem and made it easy and they deserve a lot of kudos for that.

However, there are others doing similar work that deserve similar accolades. Balanced is one example. I think the work that Square and now Shopify are doing in the POS space is laudable.

It's just a matter of seeing the forest through the trees. Stripe is a big tree, obscuring a lot at the moment (with good reason) but it behooves us to continually look around and find new opportunities lest the entrenchment of companies like Paypal take root again.

</comment></comment></comment><comment><USER9> I know nothing abut the biz. But getting a slice of a great many transaction seems like a pretty sweet position to be in.

</comment><comment><USER10> Indeed there is a lot of overhead in Fraude detection and avoiding and PCI compliance. This is a big cost in payments. It's all about financial risk mitigation.

A small bug or issue can have severe financial consequences! For the party that is impacted: merchant, bank, processor and clients.

</comment><comment><USER11> I wrote a little post on processing credit cards and some of the challenges I've encounted: [http://jimkeener.com/posts/everyday- numbers-1](http://jimkeener.com/posts/everyday-numbers-1)

</comment><comment><USER12> Credit card processing is becoming commodity and low margins are very natural at this stage until the monopolist arises. Then due to the sheer volume and monopolist power the business becomes very lucrative and easy.

</comment><comment><USER13> If anyone's in the market, compare gateways on [https://feefighters.com/](https://feefighters.com/)

</comment><comment><USER13> Sometimes just getting credit card processing merchant approval makes EV2 SSL look like the Stripe API.

</comment><comment><USER14> The future is bitcoin or bitcoin type/derived currencies with a proof of network at their core</comment>