The real cause of the financial crisis -- An MIT Blackjack Team perspective - <AUTHOR> http://www.semyon.com/crisis.html <comment><USER2> "...The only solution is to forbid money management as we know it..."

That's a bold and provocative statement. I'd feel a lot better if the author actually proposed some way of ending "money management as we know it" instead of just throwing the blurb out willy-nilly.

Nobody disagrees about the premise: markets will always seek to find loopholes in the system and in the human condition. Some people see this as a source of growth -- after dozens or scores of such blowups, beginning way before the Dutch Tulip Bubble in 1637, markets have continue to grow and become more and more sophisticated. Whatever the fundamental flaws, it's obvious they haven't prevented outstanding growth over the last several hundred years or so.

To propose a dramatic new solution, it's your job to make the case that the benefits outweigh the drawbacks. Otherwise it's like speaking out against eating because of all of the cases of food poisoning -- you're missing the point.

<comment><USER3> Though he doesn't suggest it in so many words, I understood him to be proposing that money managers must be paid a flat rate rather than by commission based on returns or total money managed, that it would remove their incentive to take short-term risks to run up their personal reward.

<comment><USER4> That doesn't work.

If I'm paid a flat fee to manage money, the people handing me money to manage are still going to look for the manager with the highest returns (that's human nature).

So, I still have an incentive to chase riskier short-term gains; I see less of the upside than if I were also getting a cut of the gains, but the incentives that arise from competition with other money managers remains in place.

<comment><USER5> I think lots of people are ready to forego higher returns for higher security. That's what I ask from my banker.

For a short while I was looking for a bank that would just have a portfolio that follows the market instead of trying to beat it, and that would take less fees because it took less effort to manage. I contacted two other banks, but they didn't have anything like that. I found it was extremely tiring to speak to bankers, they all seem to want to drown you with words. I eventually stayed with my original bank just to stop wasting time.

<comment><USER6> I thought such things were common?

<http://en.wikipedia.org/wiki/Index_fund>

<comment><USER5> They are common.

The problems they don't solve is how to allocate the assets between currencies. Also part of my money is in fixed income papers. So even when not trying to beat the market, there are some decisions I would like to leave to a professional.

<comment><USER7> Dimensional Fund Advisors (<http://en.wikipedia.org/wiki/Dimensional_Fund_Advisors>) diversify among currencies, markets, and asset classes according to some math I don't really understand. They seem pretty sharp, though, and they're low-load for the buy- and-hold version (they have market timing funds designed to lower the fluctuation at the cost of lowering the long-term return).

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I won't say this _is_ the best thing I've ever read on the subject, since that would imply I have sufficient knowledge of the financial markets to accurately evaluate what I'm reading.

Instead, let me say this _seems_ , or _feels_ like the best thing I've read on the topic.

In addition to relating the crisis to the Martingale betting system, the author describes how an ecosystem of bettors tends to converge on a Martingale-like system when playing with other people's money, and taking a percentage of the stake as a fee.

<comment><USER9> And limited liability on the down side!

</comment></comment><comment><USER10> I don't have a lot of faith that outlawing performance-based money management yields a stable system either. (I do agree that it is likely to yeild one less to synchronized catastrophic implosions, until it naturally devolves back into what I've seen twice in my 4 decades on the earth.)

Suppose we "agree" that 6% is the safe rate of return, and no money manager is allowed to collect fees or bonuses based on performance. The next logical step for anyone with a relatively large amount of money is to try to build their own in-house (or in-family) money management arm to generate 7% or 8%. If that attempt is successful, by whatever means including blind luck, that money manager can go take his expertise elsewhere with a track record of "proven high returns", or get a not exactly fund performance based raise or bonus. (Call it a corporate profit-sharing bonus, or retention bonus, etc.)

Logically, once one group is doing it, others will try to follow. No wealthy family is going to sit by generating 6% when someone in their same situation is generating 8%. Those that don't have large enough investment nuts to start with will pool with other not-quite wealthy investors, and eventually this will trickle down to the common mutual fund. And then we'll see "funds of funds" (or funds of fund, as we saw recently) that will take money, invest in the latest 8% fund, pay out 7% (still beats the 6%) and pocket 1% for expenses.

Trying to legislate away greed is like pissing in the ocean.

IMO, you need people to feel like risky investments are risky investments. If they instead feel like they own an implied governmental put on their risky investments, you just get more and more comfort with risk. People who make bets that they can't cover need to feel the pain, and for those fallouts to become public in the form of bankruptcies.

Banishing an entire category of financial work (fee-based money management) because of some crooks, some bad bets, and some large failures is not the path to a productive and efficient means of distributing capital to the businesses who need it to generate growth, jobs, and new products, IMO.

I worry that a logical outcome of this proposal would be an end to pooled-risk VC funds, and a substantial impairment to the liquidity and transparency of the public markets. It makes for a good blog entry though, as long as you don't think about it too hard.

</comment><comment><USER11> This essay makes some good points, but ultimately it fails to address the titular 'real cause', due in part to an over-reliance on the personal experience of the author. In this last respect it is typical of the genre; Michael Lewis, for example, tends to focus on miscalculation of risk, and particularly on the defects of the Black-Scholes model for pricing options--- based in large part on his experience as a Big Swinging Dick at Salomon Brothers in the '80s.

Based on my reading of a bunch of these economic diagnoses, I'd like to suggest a two-part litmus test for addressing the 'real cause' of the crisis:

      (a) Explain the system of central banks and fractional reserve banking.

      (b) Connect (a) to the present crisis.

I've become convinced that any explanation that falls short of this test invariably misses the forest for the trees.

</comment><comment><USER12> _People will always move their money into the places that give the best return over a few years, no matter how many times they are warned with the disclaimer that "past performance is no indication of future returns." And eventually the crisis that results will reach global dimensions beyond the means of a government bailout, especially if part of the risk managing strategy becomes counting on bailouts happening every decade or so.

The only solution is to forbid money management as we know it._

There are a lot of assumptions, first and foremost that all investors are trying to maximize their returns with no regards to risk. I know many people who choose investments that are less risky and thus have less of an interest rate.

People always look at money management from the investment side (ie, what is my return) and don't think about what is actually going on... ie funding new ideas/projects, if you outlaw money management then drastically alter the way that people can get funding -- greatly increasing the misallocation of capital.

A better solution would be to tell people to research what they're investing in, if it doesn't look right or you can't understand it don't invest in it.

<comment><USER13> > _A better solution would be to tell people to research what they're > investing in, if it doesn't look right or you can't understand it don't > invest in it._

Unfortunately for most people, that's almost everything.

<comment><USER12> If we didn't have an monetary policy of inflation, merely depositing money in a savings account would be a viable option.

<comment><USER14> I don't see that to be true. There are plenty of low-risk, low reward options out there if all you want to do is preserve your value.

Inflation has its own issues, but as I see it they are mostly social class related.

<comment><USER15> > There are plenty of low-risk, low reward options out there if all you want > to do is preserve your value.

No there aren't. To preserve real purchasing power monetary inflation FORCES you to speculate. Straightforward saving has been a loser's game for many decades now. This was not always true and there were long periods of price deflation and good interest rates before the establishment of the fed.

<comment><USER16> _Straightforward saving has been a loser's game for many decades now._

18% interest was a loser's game? <http://www.hsh.com/indices/6mocd80s.html> Even as recently as 1989, CD rates were over 10%. In 2000, they were over 7%, and in 2007, they were over 5%. <http://www.hsh.com/indices/6mocd00s.html>

<comment><USER15> Yes, and go look at annualized monthly CPI increases during those periods.

<comment><USER16> Annualized monthly CPI increases were over 18% for 6-month stretches? How about 5 years? There are 5-year CD's. From 1980 to 1985, the CPI went up only 30.6%. <http://cost.jsc.nasa.gov/inflateCPI.html> From 1989 to 1994, the CPI went up only 19.5%. From 2000 to 2004 (as late as that calculator goes), the CPI went up only 9.7%.

Right now, America, and the world, are experiencing _de_ flation. Yet, 6-month CD's are paying over 2% interest.

<comment><USER15> A few quarters here and there with decent real CD rates is not reflective of how people actually go about saving. You have consistently lost purchasing power if you plowed cash into savings accounts, CDs, and money markets funds.

When all factors are considered, including understated CPI figures, I believe real returns to cash in the period in the 80s you point to were not even very good. Especially when you consider the opportunity cost of your five year CD and what played out in other asset classes during that five years.

<comment><USER16> _Especially when you consider the opportunity cost of your five year CD and what played out in other asset classes during that five years._

What other zero-risk asset classes were we comparing against?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Hedge fund managers get paid more on their performance than on size. Their % of assets under management is generally about enough to keep the lights on. And many hedge fund managers are heavily invested in their own funds.

What he describes with " And money managers are rewarded based on the size of their fund, or the level of returns. The managers do not risk their own money. " sounds more like a mutual fund, though selling out of the money puts does not.

Hedge funds usually carry losses over from one year to the next as well. They're definitely designed to align the interest of the manager and the limited partners much better than mutuals.

In fact, in the long run hedge funds outperform mutual funds by a substantial margin for exactly that reason. He's right that neither have pure investor/manager alignment. The only way to do that is to lengthen the term from one year to 10 or something.

</comment><comment><USER18> Very interesting argument.

I understand the article to imply that we need more government regulation because the market cannot correct itself for pyramid schemes without severe devastation to the economy (the Albania example).

For me, this argues conclusively that Fannie Mae and Freddie Mac may have been the triggers for the current crisis but not the cause (in themselves, they were not sufficient to cause the crisis). From the article's analysis, the real cause of the current crisis was the lack of regulation of mortgage swaps. The trillion-dollar mortgage swaps is what amounted to the Martingale system.

<comment><USER19> Are you familiar with the Albania example? I wish the author elaborated more on it.

<comment><USER18> Here's a Wikipedia article on the 1997 Albanian Crisis that was initiated by a ponzi scheme: <http://en.wikipedia.org/wiki/1997_unrest_in_Albania>

<comment><USER19> Thanks! If we are to believe globalsecurity.org, which is quoted verbatim as a "primary source" in the article, it seems like the UN played an important role in restoring Albania's order.

</comment></comment></comment></comment><comment><USER19> Semyon gives Albania as a cautionary tale, but a cursory look at WP reveals pitifully little. Anyone with more knowledge on the matter, aside of it being simply a collapse from an overgrowth of unregulated Ponzi schemes? Is it that simple? Finally, is this a textbook example in economic policy?

</comment><comment><USER20> How about making perfomance based payouts only on longish returns, say 10 years? That is, money manager has to be consistently producing positive returns over 10 years, before starting to collect comissions. Now, this can be gamed too, but to much lesser extent than the current system.

</comment><comment><USER21> He doesn't take into account the misguided financial policy of the Federal Reserve as well as deregulation measures.

Perhaps the SEC needs to act more like the FDA. Before new financial instruments are allowed to be sold to the public, they need to be vetted and _understood_.

Drugs are complex and drug makers would love to release their drugs early in order to make a profit. However, as a society, we realize that would be detrimental.

Regulation of financial instruments perhaps would stifle financial "innovation", however, it would hopefully help prevent the spread of toxic instruments as well.

</comment><comment><USER22> This is the best explanation of how to get short term gain at the cost of long term ruin I have seen.

However, let's not get caught up in the details. These bankers knew what was going on. Wall Street told shareholders around the world that they had their best interests at heart, when in fact they were selling them up the river. There is a word for this kind of deception: fraud.

And yes, it is still illegal, even if "everyone is doing it".

The SEC should have stopped this a long time ago, and there is a name for that too: corruption.

</comment><comment><USER23> > The only solution is to forbid money management as we know it

Why it is impossible that people _voluntarily_ do not gamble their money with slick money managers? That is what I'm doing...

<comment><USER24> You can avoid funds. You can even get out the stock market altogether. But you can't get out of the global economy... (unless you have a spaceship, or go live in the woods)

</comment></comment><comment><USER25> Great case but...

> The only solution is to forbid money management > as we know it.

Terrible conclusion. Human nature is stupid, but powerful government is worse.

Let the markets rise and fall. Let people get burnt and learn from their mistakes. Let the market emerge from the current situation with investment firms that thrive because they give their customers confidence that they're not doing dumb things.

</comment><comment><USER26> Another direction one could take concerning this problem is change the reward model of money-managers, similar to vesting in startups.

If fund-managers would not be paid their whole money annually, but subsequently over a longer period of time, they might be more interested in the long-term success of the assets they are managing. For example, if a fund- manager would be entitled to 10M$ for one year, he could get paid 2M$ + interests annually over five years. This way, accountability could be strengthened.

</comment><comment><USER27> I think one major cause of the problem is that every financial show/book/article for the last 20 years has been telling people that funds are a safe, smart thing to invest in. And they have been, but they have been boring and have modest returns. It's not surprising that people are trying to get a better return. The solution is what it has always been "Let the buyer beware". If Madoff's customers hadn't skipped their due diligence, they would have been fine.

</comment><comment><USER28> I have a great idea. Let's just bail them out when they loose the 100k for $100 at blackjack. See, that way, they never learn!

</comment><comment><USER29> I've read a few books on junk bonds, and if they were a Martingale / pyramid, how come Nelson Peltz, Carl Icahn, MCI, et al, became (and still are) billionaires? They made out like bandits.

<comment><USER30> A pyramid scheme always has a few huge winners. They're the ones who get into the pyramid when it's small. Depending on how broad the pyramid is, oftentimes everyone except the bottom rung (the retail investors) ends up as a winner.

<comment><USER31> What people forget is that capitalism is based on fear and greed. If you look at a particular way, everything is a "pyramid scheme". For example: "Why didn't people see that a company based on selling copies of music is not sustainable?" -- this may be the excuse used by everyone when most music music recording companies fail.

Any capitalist activity can be seen as a suckers game, because _price_ is subjective. Financial markets are just a faster, larger scale version of other markets.

<comment><USER32> So, a generalized successful capitalist formula:

      1 - Use greed to motivate Other People
      2 - So you can use Other People's Money
      3 - Get in at the beginning, get out early with the money
      4 - Leave behind suckers with worthless junk

Use your profits to begin the cycle again.

I prefer Warren Buffet's approach:

      1 - Look for good people producing genuine value
      2 - Make a bet on them

<comment><USER30> The difference between the two is really in how cynical the observer is, not in anything that they're doing. For example, one of Buffett's first (and most profitable) investments was in See's Candies. They make _chocolate_ , at fairly high prices. Where's the value in that?

Then he used the money to buy companies like Coca-Cola (they sell _carbonated sugar water_ , and in developing nations often steal much needed water from indigenous people to do it) and furniture stores (which purchase furniture from cheap laborers and sell it after a 4x markup).

This really makes perfect sense when you consider that "greed" is a synonym for "what people want", with the only difference being that "greed" implies that what they want is frivolous, unnecessary, or destructive. So Paul Graham's maxim of "Make something people want" could, if you're cynical, translate to "Exploit people's greed." The end result is the same - you have something they desire - but the connotations are very different.

<comment><USER32> See's pays careful attention to freshness of ingredients. This is not only my experience, but also the opinion of a panel of chocolatiers and food critics hired by Consumer Reports to evaluate various brands of chocolates. For me, they are a much better _value_ than Godiva. I prefer to give See's boxes as gifts. Giving my friends and family pleasure is valuable to me.

Furniture stores - There is a value add to being able to go somewhere and try out furniture. If you think 4X markup is way too much, then you have a business opportunity on your hands. Get information to the consumer and connect them to furniture makers. The consumer pays less, the manufacturer gets more, and you get rich off of your cut.

Coca-Cola - I don't buy it. Others do. To them, it has some sort of value.

It's a stretch to equate "Make something people want" and "Exploit people's greed." That Venn diagram is two overlapping circles, not just one.

</comment></comment></comment></comment></comment></comment><comment><USER15> The financial crisis has little to do with probabilities or risk analysis. It's not like blackjack. It was more like seeing that a ball was falling and would eventually hit the ground. Everyone has latched onto discussions of risk analysis and reward structures because it conveniently excuses widespread idiocy and greed.

"Why did I just lose a fortune? Oh it's not my fault, it was a _Black Swan_! And my fund manager's incentives were not properly regulated." No acknowledgment is ever given to the notion that the financial markets have worked exactly as they should: fools have been separated from their money.

<comment><USER22> When you have to define "fools" as "almost everyone in the world", I'm not sure you have a workable definition.

<comment><USER33> When you define "almost everyone in the world" as the <5% that own stock, then I'm not s.......

</comment></comment></comment><comment><USER34> Typical mathematician knee-jerk reaction (including, often for me). Just because money management is not perfect does not mean that it does not have a high positive return. In fact, the largest money managers, the banks, are absolutely critical to a productive economy.</comment>


The importance of silly projects - <AUTHOR> http://engineering.slideshare.net/2011/08/the-importance-of-silly-projects/ <comment><USER2> > Last week, Sylvain noticed that there was no way to know whether code was > currently being deployed to the server. So he hooked up some (huge) speakers > to a spare desktop and wrote a script that plays a bell sound every time the > deploy script is run.

I wrote a quick five-liner that'll prevent people from deploying over each other - until you've successfully deployed, nobody else gets to. (Yes, there's ways to unlock it.)

As far as sounds go, I'm tempted to use some of the ones from here: <http://theportalwiki.com/wiki/Turret_voice_lines>

</comment><comment><USER3> Almost every place I've worked has had some version of a lunch decider or another. At one place, it was a rails app I wrote in 5 minutes, just to prove to my coworker that it was faster to make than pulling names out of a hat. At another, it was a yelp scraper someone had written to find places near us.

It happens everywhere. I think it's the natural result of any problem that takes a long time but seems pretty easy: a programmer will naturally try to automate it.

</comment><comment><USER4> I like this. It reminds me of this:

Michael Gilfix and Alva L. Couch, "Peep (the Network Auralizer): Monitoring Your Network With Sound" Proceedings of the 2000 Large Installation System Administration Conference (LISA00), New Orleans, LA, USENIX Association, Dec 6-8, 2000. Voted best student paper of LISA 2000. [http://www.usenix.org/publications/library/proceedings/lisa2...](http://www.usenix.org/publications/library/proceedings/lisa2000/gilfix.html)

</comment><comment><USER5> The 'Lunchbot' sounds something like what I wrote a few years back, me and my girlfriend always had trouble finding films to rent and watch, so what started out as a simply imdb scraping bot turned into a web app where it would select a random film to watch, with trailers, ratings and also a database behind that of what films we had watched.

</comment><comment><USER6> Like the Middle Men reference, awful movie, but great ideas. Need to hook some Arduino up at the office for that.</comment>


Alan Watts - <AUTHOR> https://www.alanwatts.org/ <comment><USER2> Curious what prompted you to share alanwatts.org?

Alan Watts audio books on Audible seem to be subsets of these recordings. My favorite collection of Alan Watts talks is "Just So".

<comment><AUTHOR> Didn't know who he was but saw a video by Trey Ratcliff ([https://www.treyratcliff.com/About](https://www.treyratcliff.com/About)) with an Alan Watts voiceover. Seemed interesting so decided to post it.

<comment><USER2> What interests me is how he was aware of technology trends, in addition to studying Buddhism and western religion. That awareness makes some of his observations relevant now.

I've found his essays & lectures interesting ever since my grandma gave me a copy of "The Book on the taboo against knowing who you are" a number of years ago. I like the "net" metaphor the most. I wish it were possible to go back and see the world as a whole, without being influenced by the labels we assign to things.

Interested to hear your impression after you read/listen to more...

<comment><AUTHOR> I like what I've read so far. He combines scientific metaphors in interesting ways. He's constantly making reference to physics, computation, cybernetics, information theory, semiotics, logic, general semantics, ecology, etc. I like all of those fields so his explanations make a lot of sense.

I recently read "Frank Herbert" by Tim O'Reilly and Herbert also speaks with the same metaphors but with a much heavier emphasis on ecology: [https://www.oreilly.com/tim/herbert/](https://www.oreilly.com/tim/herbert/).

I suspect analyzing the ideas that Herbert and Watts emphasize and how they're related would be a very interesting and worthwhile exercise.</comment></comment></comment></comment>


On 'Mad Men,' The Allure of Messy Lives - <AUTHOR> http://www.nytimes.com/2010/08/01/fashion/01Cultural.html?_r=1&partner=rss&emc=rss <comment><USER2> Anyone else get bored with it after the first season? I mean, it's an ad agency, there's only so many plot-lines before it just became a soap opera. I also didn't understand how the main character hardly said a word, yet people seemed to think he was interesting, the writing wasn't very sensical.

<comment><USER3> I was watching the show for the characters. The setting of the ad agency isn't entirely incidental, but it's largely there for backdrop.</comment></comment>


Proposals for Go 1.15 - <AUTHOR> https://blog.golang.org/go1.15-proposals <comment><USER2> I really admire the Go team for sticking to their guns and taking their time before making language changes. Let's avoid another C++.

<comment><USER3> C++ is 35 years old. The problem is that it has 35 years of backwards compatibility. Go will not avoid this problem by taking time to make changes, it can only be resolved by being prepared to break backwards compatibility.

<comment><USER4> It's quite an amazing feat that C++ has maintained backwards compatibility.

Watching the ~11 years of Python 2 to 3 adoption has been somewhat painful, and many libraries have had to offer support for both across much of that time. (And I believe at time of writing Google isn't even 100% ported to 3 yet - please correct this if I'm wrong).

I couldn't be happier that Python 3 is finally king though, and major projects like Django are able to go entirely to 3 now.

Breaking changes in languages can be important and good, but they really can affect adoption of the new version by existing users, which is tough as often major users hold some sway in the ecosystem.

JavaScript has the no breaking changes problem even worse, because you have to support (within reason) all major interpreters existing in the wild, and cannot easily change the code, so "transpiling" has become the normal.

Microsofts support lifetime for IE11 also means this isn't changing soon. Lots of old browsers in the wild (even though it has improved dramatically over last few years).

<comment><USER3> It is _much_ easier to do breaking changes in a compiled and statically typed language, as long as it doesn't use a preprocessor. Because you can do automatic upgrades. Some Python 3 changes were not fixable by 2to3 which meant all source needed to be checked manually line by line, vastly increasing the cost of upgrading. Worse, Python 2 wasn't forward compatible with Python 3 in many cases, which required libraries like six to get a transition period through the back door. The whole process was managed horrifically.

<comment><USER5> C++ has not maintained backwards compatibility by doing automatic upgrades. I don't think that would even count.

Backwards compatibility for a language means that old source code still works _without_ having to update it, even if you can do so automatically.

Also worth pointing out that C++ _has_ broken backwards compatibility in a very small number of cases, e.g. the `auto` keyword has changed meaning. Nobody ever used it before so it wasn't a problem in practice.

<comment><USER3> I wasn't giving C++ as an example of a language that maintains backwards compatibility through breaking changes using source upgrades, I was actually thinking of Go when I said that. Obviously C++ does have a preprocessor, which means upgrades cannot be done automatically in general because e.g. how do you know which macros in an #ifdef are "supposed" to be defined and which are "supposed" to be undefined etc? Instead they have to maintain backwards compatibility in the spec.

</comment></comment></comment></comment></comment></comment><comment><USER6> I've mentioned this before on HN [1]. I strongly hope 1.15 will finally address the math/big.addMulVVW issues that really slow down RSA computations, directly affecting PGP and TLS.

[1] [https://news.ycombinator.com/item?id=21968913](https://news.ycombinator.com/item?id=21968913)

Edit: I screwed up some initialisms.

<comment><USER7> Is RSA mandatory for your use case? Both PGP and TLS support ECC, right?

<comment><USER6> You are correct that the specs support ECC. Go's implementation is not complete (see [https://godoc.org/golang.org/x/crypto/openpgp/packet](https://godoc.org/golang.org/x/crypto/openpgp/packet)). More importantly you can't guarantee clients will be able to use ECC. See this issue (from my initial link): [https://github.com/golang/go/issues/20058](https://github.com/golang/go/issues/20058)

</comment></comment></comment><comment><USER8> Too bad the try proposal didn't make it. It was a good improvement on the great but too verbose error management system.

<comment><USER9> This proposal by deanveloper is the best I've seen against try. (apologies for indentation change - not sure why hn can't preserve it)

[https://github.com/golang/go/issues/32437#issuecomment-49893...](https://github.com/golang/go/issues/32437#issuecomment-498932961)

________________________________________________________________

I actually really like this proposal. However, I do have one criticism. The exit point of functions in Go have always been marked by a return. Panics are also exit points, however those are catastrophic errors that are typically not meant to ever be encountered.

Making an exit point of a function that isn't a return, and is meant to be commonplace, may lead to much less readable code. I had heard about this in a talk and it is hard to unsee the beauty of how this code is structured:

      //
        func CopyFile(src, dst string) error {
          r, err := os.Open(src)
          if err != nil {
            return fmt.Errorf("copy %s %s: %v", src, dst, err)
          }
          defer r.Close()

          w, err := os.Create(dst)
          if err != nil {
            return fmt.Errorf("copy %s %s: %v", src, dst, err)
          }

          if _, err := io.Copy(w, r); err != nil {
            w.Close()
            os.Remove(dst)
            return fmt.Errorf("copy %s %s: %v", src, dst, err)
          }

          if err := w.Close(); err != nil {
            os.Remove(dst)
            return fmt.Errorf("copy %s %s: %v", src, dst, err)
          }
        }
      //

This code may look like a big mess, and was meant to by the error handling draft, but let's compare it to the same thing with try.

      //
        func CopyFile(src, dst string) error {
          defer func() {
             err = fmt.Errorf("copy %s %s: %v", src, dst, err)
          }()
          r, err := try(os.Open(src))
          defer r.Close()

          w, err := try(os.Create(dst))

          defer w.Close()
          defer os.Remove(dst)
          try(io.Copy(w, r))
          try(w.Close())

          return nil
        }
      //

You may look at this at first glance and think it looks better, because there is a lot less repeated code. However, it was very easy to spot all of the spots that the function returned in the first example. They were all indented and started with return, followed by a space. This is because of the fact that all conditional returns must be inside of conditional blocks, thereby being indented by gofmt standards. return is also, as previously stated, the only way to leave a function without saying that a catastrophic error occurred. In the second example, there is only a single return, so it looks like the only thing that the function ever should return is nil. The last two try calls are easy to see, but the first two are a bit harder, and would be even harder if they were nested somewhere, ie something like proc := try(os.FindProcess(try(strconv.Atoi(os.Args[1])))).

Returning from a function has seemed to have been a "sacred" thing to do, which is why I personally think that all exit points of a function should be marked by return.

<comment><USER10> At first glance I can tell where the code exits. It happens whenever there is a "return" or a "try".

</comment></comment></comment><comment><USER11> I thought the whole point of go was to remove extraneous features and provide a completely minimal programming language. The argument being that all those extra features are a source of bugs.

Nevertheless, modules and try... it seems like it's just an effort to add them all back in again.

Surely if this happens go will be indistinguishable from all the other languages it was designed to be different from?

<comment><USER12> Programming languages are products just like anything else in the software industry.

Either they adapt or eventually fade away.

Hence why we get this reboot cycles where new languages get introduced as revolution against the establishment, and a couple of years later are just as feature rich as the ones they were "fighting" against.

<comment><USER13> > Either they adapt or eventually fade away.

The problem is devs are like, "This is a great language! I wish it had all these other feature from this other language I've been using."

Well, just go use that other language.

<comment><USER14> But they want those features _without the complexity_ of the other language. So "just go use that other language" doesn't satisfy them, either.

But at least your response makes it so that they're whining about _two_ languages, instead of just one...</comment></comment></comment></comment>


Coding Horror: I Was a Teenage Hacker - <AUTHOR> http://www.codinghorror.com/blog/2012/08/i-was-a-teenage-hacker.html <comment> T-hawk My high school rascalry:

This was from 1993 to 1996, on MS-DOS 486 machines in the computer lab. I had found a program on some local BBS that could resize a hard disk partition. So on a few of the machines, I shrank C: by a few dozen megabytes and created my own D: drive and copied games into it.

How to hide that D drive? With Norton DiskEdit, I figured out how to manipulate the partition table manually, setting the partition type to a null value so that DOS wouldn't see it. Next I figured out how to read and write that disk sector in assembly language. Soon I had a command-line executable that would hide or unhide my private partition with a single command. Best of all, DOS would only read the partition table on boot. So I could boot with my partition enabled, then hide it, and play games knowing that any reboot would render the partition hidden again.

The last thing I needed to cover up was the missing space on the C drive, which could be revealed by the DIR command. So I wrote a memory-resident program (assembly again) that constantly scanned for the string of "bytes free" in video memory, and patched in a larger value.

Okay, now the MEM command might reveal the existence of my TSR. So I named my program as VSAFE, which was the name of a memory-resident antivirus program on each of these machines. I had my program output the same text as the real VSAFE did on startup, and overwrote the real VSAFE executable with my own.

So I had a pretty well concealed partition, that would have required some heavy duty skills to find and remove. "format c:" would not affect it, and even FDISK would just show the space as empty, not a partition. Never got caught for any of it; the computer lab supervisor and other students knew I was up to something but never found any of the hidden stuff.

Man, I could have had a career as a malware author...

<comment><USER3> That is impressive. That's a lot of work to hide your activities from other people, though. Sufficiently paranoid? I say yes. But then again, I have not met many impressive hackers in real life.

How much reading up did you have to do to figure each of those things out? Or was it trial by fire? Figuring out all that on your own?

Seriously, kudos. Those are some hacker chops.

<comment> T-hawk More the other way around, that I'd read about how to do such things and then saw an opportunity to put them to use.

I had been self-teaching assembly for a couple years from library books and doing other toy programs. One book, possibly one of Peter Norton's, covered the partition table in sufficient detail. (And I was hacking only one byte in it, nothing sophisticated.) Reading and writing a disk sector in assembly was commonly covered in reference books. So was writing a TSR to hook the timer interrupt, which I'd already done for some other purposes. The actual logic of looping through segment B800 looking for text wasn't hard in assembly. Overwriting and masquerading as a legit program (VSAFE) isn't a technical challenge at all. The hacker chops were thinking my way through the detection methods and countermeasures, more so than the actual programming.

If I hadn't had that background, I would probably have hidden the games with less sophisticated methods. Bury them in deep subdirectories, maybe zip them with password encryption. And it was done for the challenge more than the results; I had a home computer that could play all the same games.

Anyway, I'll relate another story.

There was an annoying kid in my computer science classes, the type who thought he knew it all but was pretty clueless. One day he was complaining that a game he had downloaded required more RAM than his home computer had. I told him I'd give him a copy of a utility that would do on-the-fly compression of RAM in DOS. (At the time, Stacker was big for disk compression, and there were real utilities that did memory compression in Windows. So it was plausible.)

Of course, my "utility" was a trojan. But I was subtle about it. The trojan dropped an executable with a blank name (an Alt-255 character) and stuck a reference to it in AUTOEXEC.BAT, which was invisible and looked like a blank line. The payload would trash the partition table, only if the system date was a month later than I originally did this, so he wouldn't be tracing the time bomb back to me. (Yeah, this was nasty. I was a youth with power.) I don't know if he actually ran it or if the payload ever went off; the bomb date was in the summer after school ended.

But the real fun part is the postscript. The outer trojan was in QuickBasic (the dropped payload was assembly.) Years later, my brother was playing with QuickBasic to learn it, so I gave him a copy of my QB directory with several dozen of my programs to play with. A few days later he tells me that his computer won't boot. Yikes. I put together a boot floppy with a Norton disk repair utility to start digging, and eventually notice that the partition table had some corruption that looked oddly familiar. You guessed it, my own brother had run my old nasty trojan and got his partition table nuked!

<comment><USER4> Reminded me of coding a funny practical joke TSR program which after several days showed a message 'Press and hold left Ctrl + left Alt + W + Right Shift + P + M to see a surprise!'. After victim would press this combo, message changes: 'Now, when you release these keys I'll format a floppy inserted in your drive A:\' (that was the time not everyone had hdd on C:\ yet;). The picture of someone sitting with their hands stuck to the keyboard and shouting for help was just too funny.. however, testing the payload, time after time to ensure everything would be working as prescribed, the first victim was I myself, stupidly forgetting to remove diskette from the drive after another run. The sources were on A:\\. Nobody home. Mother comes back from work in about 3 hours. Damn. I tried to open the hatch on the floppy drive door with my leg fingers to prevent diskette from being erased. Then quickly jumped to pull it out, though the drive has made a number of cycles before it was escaped.. and the source lost forever:) that was already enough fun not to bother about it again;)

<comment><USER5> Ha! Okay that is hilarious.

Both the idea ("hold these keys"), and how it ended up backfiring.

Though the program would have given just as funny results if you had not actually formatted the disk on key-release. After all, how is the user going to know whether the program speaks the truth?

</comment></comment></comment></comment></comment><comment><USER6> In college, the machines in the computer labs had no speakers, but I found out that by logging on the TTY you could make the PC speaker beep at an arbitrary frequency. You could only play one note at a time, though... except if you used several machines. So I wrote a daemon and a script that would take a MID file and dispatch the various voices to all machines in the room (the daemon used NTP to ensure that everyone started at the exact same time).

The sound quality was awful, but the spatial effect was pretty cool because the sound came from everywhere at the same time. I got cool results with Mario, Pokemon, Tetris, but also some of the Goldberg variations or the Art of Fugue... But this was December, so I dug out a few Christmas tune MIDs and set them to play at random intervals until Christmas. As it turns out, a song triggered during a class once: a lot of people thought the sound was coming from their machine and freaked out, and the teacher spent some time trying to figure out from which machine it came before he understood what was going on.

At some later time we found one computer with sound, so we set up a daemon to monitor logins on all the machines in the room and had a GLaDOS-like voice blurb out a personalized greeting to newcomers. Fun times :)

<comment><USER7> > _The sound quality was awful, but the spatial effect was pretty cool because > the sound came from everywhere at the same time._

Reminds me of being in the computer lab at 3am when every Mac restarted and played the "buhhhhhhhh" boot sound.

</comment></comment><comment><USER8> My story: We used to learn Pascal in my high school programming classes. Each Pascal program ends with an "end" keyword followed by a full stop ("."), at least if I remember correctly. I wrote a resident program that would monitor the keyboard and screen and when it detected a full stop inserted after the "end" keyword, an animated critter would appear (made of custom characters inserted into the ACII table) and eat the dot, thus making the listing impossible to compile. I didn't write the viral code, so that it took some social engineering to run the program on my classmate's account, but boy it was fun when he started complaining to the teacher that he can't run the source code because of some creature eating his dots :-)

</comment><comment><USER9> There's something amazing about programming in that regardless of whether you're a 100-year tree in the forest like Jeff Atwood or a hapless sapling stumbling about on Codeacademy you can still add value both as a developer and a community member.

I've been coding for 10 years now and have reached the point where I'm reasonably handy but I look at a post like this and the sedimentary layers upon layers of experience that Jeff has and feel like a total novice. And yet I can still build stuff that's useful. I can still help people on StackOverflow and I can still learn from the giants above me.

I had no idea when I got into it but in retrospect it's pretty awesome to have chosen a career with such an updraft for newcomers and where everyone at almost every level can meaningfully teach, learn and contribute.

<comment><USER10> I'm not sure that "adding value as a developer and a community member" is what motivated most of us to hack around on the high school PCs.

<comment><USER5> Jonny looks around, confused, his train of thought disrupted. He collects himself and stares at the teacher with a steady eye.

"I want to develop business application enterprise solutions," he says, his words becoming stronger and more confident as he speaks.

"I want to write something that will add value to the community. I want them to walk away from the computer simply because it's 5PM and that's it for another day at the office. I want to write something that will reach out to end-users, and conforms to requirement specifications. I want to write something they are reluctant to upgrade, knowing that nothing they deploy that quarter will be quite as stable, as backwards-compatible, as good. I want to write enterprise data store solution software architectures."

Silence. The class and the teacher stare at Jonny, stunned. It is the teacher's turn to be confused. Jonny blushes, feeling that something more is required. "Either that or I want to be a fireman."

(w/apologies to Denthor^Asphyxia ... ^_^)

<comment><USER10> beautiful! :')

</comment></comment></comment></comment><comment><USER11> I remember in high school, the computers where running windows 95. They used this shell hacking "protection" software called Fortress. It worked by hiding buttons and menus and trying to prevent you from opening up various apps or clicking certain files in common dialog boxes.

My first "hack" was just a boot disk that simply copied fortress.exe to another directory (a little choice.exe with autoexec.bat magic).

The second hack came later. The computers were upgraded to Windows 98 and my autoexec.bat trick stopped working because of a BIOS password. Thankfully the machines came with Word which had nice shinny feature called Visual Basic for Applications. Most of the shell was hacked to hide menues still in Fortres 2.0 but good old VBA was still accessible. Using VB I could call Win32 apis and it was just a few calls to enumerate and kill the startup entries for fortress in the registry.

The best part of this was that it was all sanctioned activities sort of. The IT department was in a central building downtown (30 minutes away from our school) and who was always a pain to work with for the teachers. Their gradebook apps failed under fortress and even their teacher passwords failed to disable all the shell hacks. Shutting off fortress was the only compatible way to get things to run correctly for the teachers.

At first when the local IT department found out, they laughed, but then later got upset when the disk of my magic word document spread. It was making it's way across the district via email lists.

At some point in the school year I got accused of spreading 'a virus' to other students that allowed them to download 'warez' on school computers. Apparently fortress was the only thing preventing kids from using WinPopUp and windows NT messenger to send broadcast messages to all desktops across the network.

I tried to fight it and explain exactly how the thing worked and the silliness of shell hack in the first place. It didn't work. The Principal said I was hacking regardless and suspended me. After getting the suspension (and after they called my parents who knew before I did and were very upset already), I quickly called the computer programming teacher (who knew knew C++ and VB and had previously been an assistant for in my sophomore year). He called the principle and super and explained that I was not hacking and that I was 'improving productivity' and that the IT department's policies were hindering teachers. I got out of the suspension by the super the next day but no apology was given. Just a stern "stop hacking" the next week when I got back.

I was later voted most likely to succeed by my class. Apparently in a class size of 1200+, I was well known for my exploits.

<comment><USER12> Bypassing my school's BIOS password was easy.

Open up "DEBUG" in a DOS prompt, and write a few-line assembly loop that writes increasing register numbers to port 70h (register select), and 0 to port 71h (value) -- to reset CMOS memory with all 0's.

Then you can just enter BIOS to set it all up from scratch.

<comment><USER13> Or open the case and move a jumper.

<comment><USER14> Or just pop out the BIOS battery, short it with a paperclip for 30s, and pop it back in. Bingo, no more password.

</comment></comment></comment></comment><comment><USER15> I got in trouble for a bunch of things. I wrote a utility that was supposed to cover up the "system tray" clock (with an identical one with context menu) so I could run command line apps on school computers, but the system thought it was a virus. (I guess Delphi 3 apps named iexplore.exe are suspicious? :P)

Then I embedded the Game Maker installer in a Powerpoint presentation, since it was one of the few ways to be able to run a foreign exe (along with zip files, but they are more obvious targets and they're more likely to inspect them).

Then I exposed (didn't exploit) a serious XSS issue in the school's VLE, which of course they gave me a final warning for.

Edit: The School's IT policy, previously a single A5 page, became two-and-a- half A4 pages thanks to me.

<comment> angry-hacker At my school for whatever reason I was able to change for whatever reason the hosts file. I changed the popular mail service to redirect my clone site to collect passwords... I got caught in a week.

<comment><USER16> _At my school for whatever reason_

Ah, those magic words.

For some reason I still don't understand today, 9 of us in my high school programming class had read permission on absolutely everything. It was only students numbered "01" through "09" in that particular class -- I checked the border conditions in a very OCD-style.

Explored a lot of that IBM set up.

</comment></comment></comment><comment><USER17> Oh, high school and the semi-malicious innocent things you do. If only the IT department was more competent and didn't leave everything open. Perhaps instead of playing Quake all day, some of us would have gotten into real hacking a lot earlier.

Then again, teaching the entire year how to use NET SEND to send direct messages to every computer on the network was fun. So simple, yet total chaos soon followed. Imagine hundreds of Windows popups with messages such as: "Hi i79, did you know that miss Lengstein is wearing a thong today?". Every single person behind a computer in the building had to click through all these messages individually when they booted up their machine.

We thought it was amusing, especially the invidivuals who could not figure out what the hell was going on. As was the moment when the horrible miss from the library shouted 'WHAT IS THIS, HELP! I'M BEING HACKED!!!'. The resulting crackdown started out fairly scary at first but became outright hilarious when every single authority figure started their frowning speech with "I am sure you have been punished enough". (Never punished, parents did not even find out, IT department just told me 'whenever you figure someone else out, please do not tell the rest').

I took that advise to heart and told only a select few when I uploaded mugshots of every single person in the school to photobucket. Fairly sure no one every found out, even when we hung pictures of other kids with drawings on their faces around the school and got busted they did not even stop to think about where we got those pictures. To think this all played out in a top five high school makes me smile like I am up to no good again.

<comment><USER18> Haha I did pretty much the same thing back in school.

We also randomly had permissions to terminate running programs on other computers over the network for a year or two. That was fun times until the lab teachers learned to start looking for people with black console windows open. But then I just learned to change the console colors to black text on white to throw them off.

</comment></comment><comment><USER19> Pushing systems to their limits is what hackers do.

Figuring out when it's appropriate is what adult hackers do.

It usually takes a while to go from one to the other.

</comment><comment><USER20> Sometimes a hack gets you a wife: [http://blog.jgc.org/2011/02/hacking- toshiba-t4800ct-love-sto...](http://blog.jgc.org/2011/02/hacking- toshiba-t4800ct-love-story_9458.html)

</comment><comment><USER21> At college, we had AIX Unix terminals that ran in character mode. I wrote a program to simulate the login screen. It would record your user/password to a file and then throw an 'Invalid Login' error and then actually logoff and give you the real login screen. So no one suspected anything.

After I was done with a terminal, I'd run this program and leave (knowing full well, that someone could Ctrl-C to terminate the program and get access to my account though no one ever did)

I got more than a few passwords with this. But didn't actually do anything with them. I felt bad and deleted the program and passwords after some time.

<comment><USER22> I suspect that's why Windows has you do a Ctrl+Alt+Del before logging in.

<comment><USER23> That's more or less exactly it. Ctrl+Alt+Del causes a switch from the interactive desktop (WinSta0\Default) to the Winlogon desktop, which no other process has access to _. Windows code also contains a special rule for interrupting the Ctrl+Alt+Del combination to prevent other applications from hooking into it and overriding the default functionality.

_ Technically it is possible to get other processes to run in the Winlogon window, but that requires messing around with security tokens, among other barriers.

<comment><USER24> I think either VirtualBox or VMware Workstation can detect Ctrl-Alt-Delete - it then asks you if you meant to send that to the guest VM. Any idea how that works if there's protection on Ctrl-Alt-Delete?

<comment><USER25> Ctrl-Alt-Del fires an IRQ. As such, it can't usually be fired remotely - although some utils work around it by making API calls at the client end to trigger the behavior, depending on context.

Some flavors of VMware hooked the IRQ on the host machine and responded to that (not sure about VirtualBox, never thought to check that.) They can send it to the virtual machine easily, as they are also providing the a virtual bios/hardware layer.

</comment></comment></comment></comment></comment><comment><USER26> This is all very amusing, but I have the other side of the story. A close relative of mine was the systems administrator for a large high school. The amount of grey hairs that sprouted in the few years they were in the job due to wannabe hero high school hackers is testament to how hard it is to keep a stable system running when you've got scores of hormonal hackers trying to outdo each other.

While this page tells of succesful hacks, it doesn't mention all the screw-ups whereby the payload didn't work but caused major problems with the school computers. Nor does it tell of the systems admin getting chewed out by school management for failing to play whack-a-mole properly.

By far the most common route of hacking was getting a teachers password, which was usually either easily guessed, or worse, written down in a notebook in the drawer.

As for me, I found that in university we had computer-based testing for weekly lab classes. When you submitted your answers, it printed the results and showed you where you were wrong.

We found that if we yanked the power cable on the workstation after the print job was submitted and the printer started, the results didn't commit to the database, you'd get a printout of the answers but your score wasn't saved. So then you'd just take the test again, using your printed answers as a guide.

<comment><USER27> That reminds me of the only "hack" I recall doing when I was younger. Back then, many BBS systems had 10/1 download/upload ratios enforced. I found that if you aborted an Xmodem download on the last block, you would still get the whole file (the block would finish transferring) but it wouldn't send the acknowledgement back to the BBS. I would just look like a failed download, and wouldn't count against your ratio. I think I filled up some 50 or so floppies that summer (and had the phone bill to match).

Other than that, I was never good at most hacking. I was into writing code, and working with algorithms, but I never got the knack on how to bypass security systems (I also didn't have any other computer savvy friends back then either). But it did help that I had an office job (which involved using my PC talents on the side) from the age of 15 on up. Kept me too busy making money to worry about side projects.

</comment></comment><comment><USER28> In high school, I became yearbook editor and was entrusted with keys to certain parts of the school (darkroom, computer lab, etc). In the late 90's, yearbooks were all done manually: film was loaded into cameras with heavy lenses, pictures were burned into photo paper and stop bath. Some of the work in putting it together was done on a computer, enough to justify being on the computer after hours. We'd print out pages with blank rectangles and squares for the photos, glue the manually-developed pictures onto the pages that had printed text, bind together the book, and send it off to the printer at the end of the year. Being yearbook editor was great, always an excuse to be working on something creative.

I also had a key to the computer lab. Problem was, the part of the building where the computer lab was located was not accessible after hours -- there was a gate which was locked during off school hours. (Meaning it was designed such that I could get into the room with the computers during regular school hours, out during off-hours, but not back in after hours). This lab had about 20 computers, and live Internet access. More than enough reason to find a way.

While none of my "breaking into" that part of the school during off-hours was done with malicious intent to steal or deface school property, it probably wasn't exactly the most lawful thing a 17 year old could have been doing. My good student status probably helped for those rare occasions when one of the janitors or teachers would "catch" me in that part of the building at times when I shouldn't necessarily have been there. "Research for college", was a good excuse at the time (and actually pretty close to the truth).

</comment><comment><USER29> My high school latin course used these silly HTML/JS (probably at the time called DHTML) quizzes and exercises. They were a significant portion of the grade and truly pure JS hooked up to good ol' Matt's FormMail to submit scores.

I slowly developed little bookmarklets to make things ...easier. Reveal the hint without taking a score deduction. Decoded the answer obfuscation to just pop up the correct answer. Auto-select the correct answers for that page. Eventually I sat down and read the source of the quiz all the way through and realized all I needed to do was

> javascript: submitScore("name",100).

</comment><comment><USER30> What about the flip side of this, which is catching and dealing with the hooligans who screwed up school lab machines? It involves trojan horse programs and hex editing DOS binaries, too. I wrote about it not too long ago.

<http://rachelbythebay.com/w/2012/06/13/lab/>

</comment><comment><USER31> Doesn't everyone have stories like this?

I remember when my parents (in Michigan) got a call from Norway after 14-year- old me owned a bunch of some large ISP's nameservers and proceeded to launch broadcast amplification attacks against a bunch of IRC servers.

I guess now that the Internet is for normal people, stories like this are news again.

<comment><USER32> Because 99.9% of people on the internet right now have no idea what a BBS is/was.

<comment><USER33> I recommend <http://www.bbsdocumentary.com/> to anyone who lived through that time. Not sure how interesting it is to people that weren't involved, but I loved it.

</comment></comment></comment><comment><USER34> This isn't really a hack (I wasn't that smart). My earliest memory of playing round with computers was at primary school when I was very young, it asked me to enter my name so I typed in 'poo'. I then showed my friend and he laughed and hit his fist onto the keyboard really hard and the computer froze with the word 'poo' frozen onto the screen.

I got into big trouble as the teachers thought I'd crashed the whole computer, they shouted at me pretty hard!

I still think it's quite funny to enter your name as 'poo'.

</comment><comment><USER35> My first hack was in typing class in 6th grade (1990?). They had the PCs (running DOS) locked down so you could only run the designated typing programs, but one of the programs let you open a text file, and in the root of C: I found a file with the passwords for admins to go straight to the DOS prompt. Turned out there were all sorts of games installed as well, I was the class hero. Ironically, I got terrible grades in that typing class even though I type over 100wpm now...

</comment><comment><USER36> Ah, the memories...

Like most I started early with programming in assembly, C, pascal _shudder_ and then discovering unix.

I remember starting off by hacking the computer lab computers in my school. The lab staff had to log you in so they would know who was using which machines. I learned the pattern through a little social engineering and it wasn't long before I never had to talk to the staff. I also bypassed many of the tools that locked those machines down and even locked the lab techs out of a few of my favorite machines that I used for long running processes. I even had my own primitive form of RDP using screen captures and email. Eventually I learned to crack the passwd file on my schools mainframe and then I had access to everyone's accounts including the teachers. I then discovered those passwords also worked on most home dialup accounts, outside email, irc accounts, etc. Fun! I used to dominate the east coast irc back in the day, at least in my little world, but I kept my head real low so I wouldn't be noticed.

You know the best way to pick up a girl from Scandinavia? Easy, hack her email and irc accounts, knock her boyfriend off of irc and impersonate him, erase her boyfriends incoming emails and, spoofing his email address, bully her a little and tell her to stop seeing guys like yourself. Somehow it worked like charm. Man was she hot! First hot girl I ever dated.

My downfall? I gave some "goobers" some irc scripts to perform netsplits and become admin of their favorite channels. The idiots got caught making life threats against an irc admin that banned them and, in a stroke of self- preservation, they turn me over as their "ring leader". No hacking your way out of that one! Real sweet, eh? My parents were not very happy having the local police, the FBI and the NSA knocking on their door. I lost computer privileges (still went to college and got my degrees though) and now I just hack my own private network of pcs, laptops and cellphones at home.

Ahhh, the memories....

</comment><comment><USER37> I was poking around on the school computers and I found a (world readable) script for joining the AD (these were macs, so there was some black magic going on), with an username and password in it. Turns out that username and password was the administrator account on almost every server in the school, which were all accessible through remote desktop.

Yeah, that was a good time.

<comment><USER37> (until I got suspended, ofc)

</comment></comment><comment><USER38> My indescretion was a boot sector virus that would randomly seize control of the computer long enough to beep the theme song to "Cheers". Oh and spread to the boot sector of any disk inseted. To be diabolical it randomly chose to play the song or simply silently reinfect others each time it spread.

They (at my highschool computer lab) were still battling to eradicate it years after I left. I am ashamed. Somewhat.

</comment><comment><USER39> The details are a bit fuzzy, but I remember a certain computer lab of mac classics on an applets network. We installed some extension that let you send messages to other computers, and even put it on the teachers computer, which was connected to a projector. In retrospect photoshopping his head onto a playboy centerfold and resediting it into the extension and removing the reply button, and then sending it to him during class on the projector, well that was probably a bit much.

They tried several types of lockdown software, nothing ever actually worked. You can't stop kids from playing games.

</comment><comment><USER40> Since we're all reminiscing about high-school geek antics: In my Physics class, we had semester long ongoing assignments that were markedly harder than the nightly homework. You could turn in the problems at your own leisure. They were mostly applied problems that involved some math we hadn't learned yet (like calculus). The problems were the same for each student, but we all had different parameters, so our answers would be different.

After figuring them all out a few weeks into the semester, I started writing up some BASIC programs on my TI-86 that would take in student's parameters and spit out solutions. Long story short, I ended up selling answers to some jocks and got caught (I guess the teacher was suspicious when C students were getting these hard problems correct). End result was: made my teacher simultaneously proud/disappointed, earned a few bucks, learned about corruption/greed.

All in all, it was a good learning experience and I don't regret it (though giving away answers for free would have been more altruistic I guess)

</comment><comment><USER41> High school - 1985 or 1986, I wrote an interpreter (in BASIC) that looked and acted like the BASIC we'd boot up off the shared drive (some odd TRS-80 networked set of workstations). The BASIC interpreter that I wrote worked _mostly_ like the regular BASIC, but would give some random extra output. Came in to class early and booted everyone in to that BASIC, and watched as people took forever to type in their code, then run it, and have it not work - <USER2> like 5+7 came up as 3. The teacher was flummoxed, and we essentially wasted the class that day.

Looking back, it was quite a jerk move. I was trying to be clever (well, I was clever), but it didn't get me any more status with anyone - basically just reinforced the geek status I had (which wasn't a good thing to have in 1985). I was bored, but that's a pretty lame excuse. I think I ended up with a C- in that class ("intro to computers I"), mainly because I never flowcharted anything.

</comment><comment><USER42> I graduated high school in '92 and since my systems at home were better than what we had in our labs, I gravitated toward exploring the local University networks. You could dial in to a terminal and then connect to any of the local machines. Most were VAX/VMS or Ultrix systems. The VMS systems all had open GUEST accounts that were limited, but allowed you access to BITNET. I managed to chat with Taran King, who was co-editor of Phrack at the time, a few times over the BITNET chat protocol which was great fun.

However, my actually hacking life started on the Ultrix systems. I don't remember how I first had access since I don't think it allowed Guest logins, but I discovered a great hack: all of /dev/tty* was word-readable until someone fully logged in to a particular port at which point it was only readable by the user logged into that port. so every few hours, I'd just "cat /dev/tty* >> passwords.txt" and harvest logins for everyone who logged in during that time. I had some fun with one of the admins for awhile having unknowingly logged into his account. We chatted a bit and he was a good sport about it, but the hole was patched a few weeks after. I never knew if it was already a known issue or if I was actually the only one who found it.

A friend wardialed a system that appeared to be a Dept of Transportation front-end to the brand-new digital readerboards along the Interstate. Let's assume we never actually changed any text, but I cracked the password, TRAFFIC, on the 3rd or 4th attempt. Good one, guys!

Exploring random address on TELENET dialups was a blast as well. Most were very secure since they'd been well-picked, but every so often you'd find some interesting terminal and start poking around figuring out what it responded to and how to navigate deeper.

Don't get me started on the first 2600 meetings in Seattle. Some very prominent people in the tech/hacking space now were pretty sketchy back then.

Fun! Memories!

</comment><comment><USER43> _I've grown to love my own bad judgment. It's led me to the most fascinating places._

This appears to be the root of all that is self-taught.

 _Trust your technolust._

</comment><comment><USER44> For some reason I never paid much attention to the phone bills. I was long distance from _every_ BBS, but I had an after school job and mom made me pay every month. That is until the $1200 bill (this was 1987) arrived. My modem got put away until I could pay off the bill, and we never did tell dad about that. I blame it on the Hayes 1200bps modem, it made it sooo much easier to redial busy BBS's than the Atari 830 modem I started out with.

For a while there the first program I wrote for a new computer was a War Dialer. Just like everyone else who had seen War Games.

<comment><USER45> When it comes to the system on which I learned unix and c as a teenager, all I really know about it is that it had a modem set on autoanswer. :-)

</comment></comment><comment><USER46> The Hackers for Charity program is to find bored kids with budding computer skills, and get them experience while helping charities. This helps them build their "legitimate" resume, and hopefully keeps them interested enough that they don't have to resort to trivial illegal things like this.

</comment><comment><USER47> This reminds me how lucky I am to be relatively successful as an adult. I could easily have spent time in juvenile detention for something stupid, and who knows how that would have turned out.

I suspect a lot of people on this board did the same (illegal) stuff as kids... We're lucky that we had the good luck to grow into productive adults. I like to think society is also lucky that it let us grow into productive adults.

<comment><USER48> I doubt it has much to do with luck at all.

Almost no one starts doing stuff like this, especially with technology at the time, because they have nefarious goals or have a crime career planned.

They are kids. They do it to push their limits and may even not be aware it is even illegal. Even if they are aware, they believe they are invincible or can get away with it. As an aside, why do adults so easy forget what it was like to be a kid?

In addition, to even begin overcoming the technical challenges involved, the amount of curiosity required over otherwise mundane detailed technical knowledge is quite high. Criminals tend to be far more motivated to seek high reward, short term activities.

Finally, the same people who have access to the knowledge and equipment to carry out activities like this, tend to also be the ones who are raised in balanced, strongly breadcrumbed environments leading them away from anything that distracts them for the path set for them, lets call them the middle classes for want of any better term.

So, nope, not luck. Just being a curious middle class kid with easy access to new technology and few upfront repurcussions.

<comment><USER47> I don't understand your post (or perhaps you didn't understand mine).

You are right that I didn't have nefarious goals when I did this stuff as a kid, though I knew it was illegal. In any case, the fact that I didn't get caught was mostly luck. If the police came to my door, my life could easily have turned out much differently.

I'm saying I (and many others on this board) were just lucky not to get caught. Certainly Jeff Atwood was lucky to get a sensible judge. I'm surprised anyone would dispute that.

Are you saying we couldn't have possibly been caught? Are you saying it wouldn't have mattered if we got caught and faced the wrong judge?

I'm sure there are a lot of people have really suffered for their kid mistakes. I'm not sure how you can dispute that I'm lucky to have gotten away with mine.

</comment></comment></comment><comment><USER49> "And there's more, so much more, but I can't talk about it yet."

Sounds like the statute of limitations hasn't expired yet. Should be interesting when it does!

<comment><USER50> I'm fairly confident this is in reference to a new startup Jeff is working on.

</comment></comment><comment><USER51> Fun thread. My first computer mischief experience was in "Computer Class" in first grade. The computers were running DOS 3.0 (IIRC) and the class was for teaching computer basics, which mainly consisted of "Introduction to programming" using Basic (with a gentle introduction to I/O, variable assignment, and flow control.) The way the class worked was: an assignment was printed out and handed out to all the students. You followed the steps and at the end of class, the teacher would look at your output to see if you did everything correctly. I finished these assignments pretty quickly, so I used the time to figure out how to exit the editor, find the "hidden" games stash, play them for a bit, and then get my work back up on my screen before the end of class. Pretty soon I was being asked by all the other students how to perform this feat on their own computers. I showed them, and so every time the teacher would leave the room, everyone started playing the games.

We also never got caught. Wild times in first grade, let me tell you.

</comment><comment><USER52> _Does anyone actually even worry about how much voice calls cost any more, to anywhere in the world? This, my friends, is progress._

As someone who works in telecom and VoIP, and deals with the financial and regulatory aspects of a lot of jurisdictions that continue to be locked down by PTT monopolies, I think this is a silly question. :-) It's only domestic long distance that has really crashed.

My high school exploits mostly revolved around bypassing the school district's proxy servers, since they blocked pretty much everything I wanted to do, including legitimate stuff. I did this via tunnels of various sorts (but predominantly SSH) out to my home machine. Oddly enough, they didn't do anything to stop us changing the proxy settings in the browsers, they just broke outgoing HTTP(S) with firewall rules. No problem, I just sent the traffic to a box running Squid, reached via my home cable modem.

</comment><comment><USER53> My highschool "hack" involved downloading the contents of our school's website hosted at ourschooldistrict.com domain, buying the same name at ourschooldistrict.us, and then rehosting so we could put up any press releases we wanted. We wrote up a press release saying that two district high school names were changing to honor our very-hated superintendent. Then we started sending it to friend on AIM saying "omg have you seen this."

Within hours, everyone on my buddy list had their own "petition" in their away message and after checking traffic, we found we had thousands of unique hits.

Most of the credit goes to my friend who actually executed the tech part and was temporarily suspended when the inundation of angry emails _supposedly_ hurt the school board's server.

Just checked and the school district still does not own the .us domain so this "hack" would be reproducible.

</comment><comment><USER54> I remember hacking the Novell netware setup at my school, and being surprised to see how poor all of the teachers passwords were. Almost all were children's names or street names. And the system admins super password? The name of a well known department store :)

</comment><comment><USER32> I was very stupid when I didn't know better, in the days script kiddies were empowered by Backorifice I would play with random folks, mess with their kayboard and mouse.

Other nonrespectable "hacks":

\- "net send *" to importunate colleagues

\- wrote mIRC scripts to win at the IRC trivia games (this was actually funny for a little while)

\- would call collect to my dial-up provider, learned to dial on rotary phones by "switch-hooking" -

\- would connect portable phones to disabled payphones just to see if it was a regular line what I could use (it was)

\- would "paint" the backside of payphone cards with graphite to fool the machine into thinking I had more credits.

\- wrote a little "ringer" program and passed to my colleagues so we all ran it together and made the teacher crazy (oh the regret).

\- used IDKFA in Doom.

Those are my earliest, lamest memories.

</comment><comment><USER55> At school we had a network of Acorn Archimedes machines. We all had space on the file server, which the grumpy admin would search through regularly. There was an autorun feature in RiscOS which allowed a hidden script to execute on opening a folder, eg my network folder. It just so happened that passwords were stored unhashed, so I had everyones passwords appear in my folder one day. I must have been 12 or 13, as my family relocated when I was 13.

At the new school they had the same machines, so I put my knowledge of the platform to good use. I wrote an app which played a sound sample of a loud obnoxious burp at random intervals during class.

At college they had a Novell network. The login was a simple text prompt, which I discovered called in to a novell DLL. I wrote my own substitute login command which also saved the password to local disk somewhere, and replaced the default version on a few machines.

In both cases my reaction was the same on discovering my password hacks had actually worked. I crapped my pants and covered my tracks! By the time I had started uni, I had largely grown out of that stuff. But something triggered a latent interest I had neglected for too long... the campus accommodation was based in tower blocks, with an entry intercom system. I noticed 4 very quiet dtmf tones whenever buzzing my friends apartment. I can't remember how I did it, but I found a way to get a dial tone and to my delight, 9 for an outside line worked fine using the type of handheld dtmf dialer banks used to give out.

</comment><comment><USER56> I was working as a restaurant manager part time while at uni. One of the other managers thought it great fun to staple the back of my shirt without knowing, so when I got home I had a torn shirt.

That weekend, I fired up a 286 someone had given to me, coded up a mock-DOS environment, got the main manager on-side and left it set up for the next morning. Next day...:

Start computer, get coffee. Type "win" (for Windows). Get 2000 random ascii characters with an error message. Typing "dir" produced an empty C:\ drive called "F __* You Francois". Anything you did pretty much got you "bad command or file name". Your manager (who is in on it) is shouting at you to get the computer going because his restaurant is starting up. You're typing out "F __* You Francois" as a password, looking for bits of paper around the office, trying to restart the computer but having the autoexec.bat put you back into it.

After about 2 hours, main manager types "fix", and the rest of your day continues, but with much added mockery.

It wasn't particularly sophisticated, but I truly loved that :) Lessons were learned.

We did something similar at school. Mocked up the Turbo Pascal UI with menus and everything, but was a bit...uh, erratic. Unfortunately the teacher knew exactly who it was and came storming into our next class :)

</comment><comment><USER57> It's cool to see Jeff Atwood could take his skills and contribute so much later on.

</comment><comment><USER58> Hmm... I'm somewhat bothered by how the word hacker is used in the article, where it's used to describe criminal activities. Or am I misinterpreting it? I know in one part he uses the term 'cracker,' and in another part he says that perhaps his utility should have used 'preaking' instead of 'hacking,' but in general I think he's using the term hacker to describe breaking into a system.

I know the word in society has a double meaning. It could mean breaking into a system, or engineering an innovative piece of software. I personally wouldn't really care, except nowadays I'm finding myself promoting a hackerspace or a hackathon on the radio, and usually every time I start an interview I have to begin by saying "We're not criminals." It gets tiring after a while. Once we were trying to form a partnership with an organization, and the guy immediately threw us out of his office when he heard the word hacker. He wanted nothing to do with us.

<comment><USER59> In the 80s and 90s, the community toying with systems including gaining access to it referred to themselves as hackers. Those who broke ciphers and copyright protection were crackers, and those who hacked voice telecommunications systems were phreakers.

It's only outside of the community, in the media, that I first discovered that the term 'cracker' was used to refer to hackers gaining unauthorized access to computer systems instead of, well, crackers.

<comment><USER60> I think it was Eric Raymond's idea; he, like most hackers, was outraged at computer security enthusiasts calling themselves "hackers" and suggested calling them "crackers" instead. I think the fact that the computer-security folks already had a (different) meaning for "cracker" was sort of a coincidence.

</comment></comment></comment><comment><USER61> 1983 I was in College (one year course right out of high school) and we has access via a teletype terminal pool to a ICL 2903 running George. The operator console had a journal file and discs back then were the drum type and rotated to spread the wear and tear. These were not zero erased and you could create a file specifiy the size in buckets of all values how large and zeroing the space was optional. With this knowledge you could basicly go fishing, creating large files and looking to see if it was anything interesting. I was able to get the admin(aka root) password which was 5588. So I did chuckle when I saw the film Hackers and dumping the garbage file on the gibson.

Though I also had great fun with the spv command on george and knowing all the terminal ID's, but thats another story.

</comment><comment><USER62> I have fond memories of "hacking" in high school. The school system I went to used Deep Freeze to protect their Win98 computers. You could format the hard drive, change all of the settings, etc, and upon reboot, the image would return, unchanged. Naturally, this led to deep investigation into how it worked. The system administrators weren't stupid but were severely undermanned, and had left the Deep Freeze program slightly vulnerable. A little command line work and you could remove the protection mechanism for the given session, allowing you to persist changes. So, I did things like edit the shell in HEX and change "START" button to say "FARTS", lame things like that. The suspense was that supposedly the maker of the software would fly anyone who could crack their system out to New York to demonstrate. Despite finding the above hole, I was never able to totally eradicate the software, and could persist only certain changes (changing the startup image, playing funny .WAV files on boot, etc).

My biggest mistake was sharing this knowledge with my classmate, who used it to do a great many annoying and potentially harmful things. After doing things like sending "I 0wn j00!" to 11,000 computers on the network (via NET SEND), crashing the shared network drive with millions of blank text files, etc, he finally got caught after badly damaging 3 of the computers in our lab using my hack method that I'd written a batch file to accomplish and given him the disk.

I was called to the computer lab by my awesome programming teacher, who informed me that he had to leave the building in 45 minutes, and if the computers weren't back to their proper state by then, we'd both probably be suspended. The other kid just sat there, while I furiously reversed the changes and got out with a few minutes to spare.

Naturally, the next year, him and a couple of my other classmates were suspended or expelled for repeatedly crashing the entire 11,000 network with advancements on my initial script. I was thankful that there was apparently no ties left to me in the program's execution, but that was warning enough to focus on productive things for the remainder of my high school career.

</comment><comment> at-fates-hands Its interesting I never got into computer hacking until later when I was in college. In high school, I had a neighbor who was really big into phone phreaking. We had hours of fun building black and blue boxes, getting free long distance and calling people in random countries.

Probably the coolest thing was my neighbor somehow managed to get his hands on two master keys for the high school. He had a buddy at a local hardware store duplicate them (highly illegal) and we spent many nights prowling the high school, opening doors nobody could and exploring every inch of that place. Thankfully we never got caught, but I look back fondly at it as the start of my career hacking stuff.

<comment><USER63> I'm not sure that's actually illegal. Even keys that say 'Do Not Duplicate' can be legally duplicated, though this may be an issue of varying local laws.

</comment></comment><comment><USER64> In high school, we had laptops provided by the school and imaged by the IT department, who had logged into them. All we had to do was use a tool to recover the Windows password (yeah I know, skiddie, etc.) and we could login as IT admins on any computer on the domain.

Was pretty innocent about the whole thing, changed a few backgrounds remotely, and sent messages and shutdown people's computers in class remotely. Unfortunately I changed a default Windows background image, which meant it showed up something unsavoury for everyone who logged in, and got caught, copped detention and a many, many page letter about how I shouldn't do it.

<comment><USER65> I too changed the default Windows background. However it was just the default image with an almost transparent eye in the corner. It lasted a few weeks before it was reverted one day.

</comment></comment><comment><USER66> When I was 7 or 8, my Dad had a fancy new digital safe -- must have been one of the first -- type in your PIN on the keypad, and open it up.

Took me 15 minutes to try the number on the Social Security card in the desk beside the safe! Presto!

</comment><comment><USER67> and if this had happened today, he would have been put in prison for five years! hooray

</comment><comment><USER68> "I must confess I've grown to love my own bad judgment"

This quote is amazing. I see myself in it.

<comment><USER69> Bad judgment takes you to all the interesting places ;-)

Results in an odd resume, sometimes.

</comment></comment><comment><USER70> I never really did much "real" hacking when I was younger, but did fish for passwords and do social engineering back in 96 when I was roughly 11. Gained access to lots of peoples sites and emails that way.

</comment><comment><USER71> Taking Eliza. Editing the answers to make it raunchier then leaving it running in the computer lab.

</comment><comment> X-Istence The thing I got in trouble for ... is not something I should be writing in a public forum yet :P

<comment><USER72> We'll ping you back later. Care to share the statute of limitations for the crime in question?

</comment></comment><comment><USER73> such a cool history/experience!

</comment><comment><USER74> Jeff Atwood is cyborg

<comment><USER75> Your powers of deduction are breathtaking. :)</comment></comment>


The original Bitcoin – what you have is confirmed by what others know - <AUTHOR> https://en.wikipedia.org/wiki/Rai_stones

<comment><USER2> A story full of lessons for designers of any new form of currency. Note the story about David Dean O'Keefe who introduced better tech to produce the rai stones faster. The economy adjusted to take this into account and the stones created with new technology lost value. Only if bitcoin could emulate that somehow.</comment>


Do all 90's computer hackers rollerblade? - <AUTHOR> http://codejustin.com/do-all-90s-computer-hackers-rollerblade/

<comment><AUTHOR> It looks to me like most 90's hackers Rollerblade (well at least in the movies), HAHA!</comment>


Is the "About" button more important than we think? - <AUTHOR>

Does anyone else find themselves reading the first 1/3 of a landing page and then clicking on the miniscule "About" button at the very bottom most of the time?  I think of it similarly to a deck I'd present to an investor: I'd give my problem-solution spiel and then move quickly into my bio slide.  It is my personal opinion (and Mark Suster's) that the features, demo etc aren't absorbed/swallowed if that kind of detail is presented before the listener knows who's behind the product.  As a consumer, I'm inherently skeptical, so I can't stomach a whole page of "the hard sell," even if it's above the fold.  Do you think there's merit in placing a tiny bio block or a whole paragraph--something beyond four words at least--from a reputable press review after the pitch and call-to-action?  I know it's not de rigeur but something worth thinking about nonetheless. <comment><USER2> Yes, though we may not be typical. But I'm surprised how many blogs I run into that don't have any About. An About on HN would be nice too.</comment>


Beware of the GIF: Account Takeover Vulnerability in Microsoft Teams - <AUTHOR> https://www.cyberark.com/threat-research-blog/beware-of-the-gif-account-takeover-vulnerability-in-microsoft-teams/ <comment><USER2> Just today I was joking with my colleagues on Teams - "Who is the Product Manager of Teams, and why hasn't Mr. Gates fired him/ her yet!"

At the peril of being downvoted, I am going to rant, but rant I shall.

Last year they tried to move all Skype users to Teams, which failed miserably. Today, they have tried doing the same, but to my much chagrin, the issue from last year still persists. We are not able to share screen with Skype users. One user just got irritated and left.

A few weeks ago they forgot to renew their SSL certificate, which is unacceptable for a corporation like Microsoft.

And now this. It makes me loathe Teams even more.

<comment><USER3> This is when I decided that Teams is hot garbage:

[https://microsoftteams.uservoice.com/forums/555103-public/su...](https://microsoftteams.uservoice.com/forums/555103-public/suggestions/16950997-integrate- with-windows-10-notification-center) [https://microsoftteams.uservoice.com/forums/555103-public/su...](https://microsoftteams.uservoice.com/forums/555103-public/suggestions/16941685-use- built-in-notifications-for-macos#{toggle_previous_statuses})

It supports neither MacOS or Windows native notifications! On Mac this means all Teams notifications end up behind the native notifications.

<comment><USER4> > On Mac this means all Teams notifications end up behind the native > notifications.

On the other hand, native Mac notifications are nowhere as feature rich as the custom Teams implementation.

<comment><USER5> What exactly does the teams implementation need to do that cannot be achieved with the Mac notifications?

When I get a notification all I want to do is be able to click it or dismiss it. But teams loves to appear on the wrong screen, behind windows, or just not show up at all. That combined with the questionable design choices of the UI, I have missed calls because I heard the sound but couldn't find the alert for it.

Sadly this is likely never to change since Microsoft does the exact same thing for Outlook, which is why I refuse to use it and just stick with native apps for work.

</comment></comment></comment></comment><comment><USER6> Weird lead in about GIFs to simply saying they had a subdomain takeover.

<comment><USER7> Clickbait.

</comment></comment><comment><USER8> Shame they totally skipped the whole sub domain takeover bit, which was required for the exploit to work.

<comment><USER9> I guess a DNS configuration issue doesn't drive as many clicks.

</comment></comment><comment><USER10> please change the title of this to remove the 'beware the gif' part if it doesn't have anything to do with the vulnerability really

</comment><comment><USER11> Outside of my wheelhouse, but is the actual vulnerability here that legit domain has a legit subdomain CNAME record pointing at uncontrolled endpoint; $BAD_PERSON registers target domain and then tricks a user into hitting endpoint with credentials in cookies?

</comment><comment><USER12> I'm confused as to how they do the sub domain takeover.

<comment><USER13> I had to read up on it, the gist of it is (these are example domain names I made up for illustration):

1\. Domain like "abcde.teams.microsoft.com" has a CNAME that points to a domain like "abcde.microsoft-teams.com", but "microsoft-teams.com" is no longer registered to or controlled by Microsoft.

2\. Hacker registers microsoft-teams.com, gets a LetsEncrypt SSL for it.

3\. Send a message to someone with a GIF that was uploaded to "abcde.teams.microsoft.com". Teams thinks it's legit because it's a subdomain of "teams.microsoft.com", and SSL checks out, so it sends the user's auth token along with the HTTP request for the GIF. Problem is, it's sending it to the attacker controlled "abcde.microsoft-teams.com".

4\. Since the hacker controls "abcde.microsoft-teams.com", they now have your auth token, which they can use to impersonate you.

Et voila, account takeover.

I'd bet that plenty of whitehats and blackhats have bots automatically crawling domains belonging to tech companies searching for subdomain takeover opportunities.

<comment><USER14> >Domain like "abcde.teams.microsoft.com" has a CNAME that points to a domain like "abcde.microsoft-teams.com", but "microsoft-teams.com" is no longer registered to or controlled by Microsoft.

Can you elaborate a bit on this? I get that these are example domains, but why would "abcde.teams.microsoft.com" (which is presumably controlled by Microsoft) point to a domain "microsoft-teams.com" that is not controlled by Microsoft? Was that a mistake on Microsoft's part, or did the attackers do something clever to gain control of that domain/point a Microsoft-owned subdomain to the attacker's domain?

<comment><USER13> Yup, in my hypothetical example, at some point "microsoft-teams.com" was registered by Microsoft. At that time, some engineer deployed something that involved the CNAME. Over time, "microsoft-teams.com" was moved elsewhere and the domain became unregistered, but the engineer maybe forgot or left the team, and nobody remembered that there's this out of date "abcde.teams.microsoft.com" DNS record just sitting there.

Microsoft has a lot of these, just random Microsoft-ish domains that were used at one point or another. It's a problem because it makes it harder to look at the domain name as a sanity check against phishing.

</comment></comment></comment></comment><comment><USER15> Putting subdomain takeover aside, are the gifs that are available to use in the chat pane all screened by Microsoft and deemed SFW (safe for work)? I see some of them are watermarked with 'giphy'. Does that mean if it's available on giphy.com it's available to share on Teams?

<comment><USER16> As admin you can control the content restrictions for gifs. It's like sfw, sketchy, nsfw If I recall correctly. But yes, if it's on giphy it's on teams.

</comment></comment><comment><USER17> Ugh, that was an annoying article. Clickbaity and burrying the lede which turned out to be very uninteresting

</comment><comment><USER18> Wasn't WhatsApp also compromised via gif? Gif is a really remarkable format that seems so simple but it's much more. It's just a series of images with timings but then you realize that the first few bits of the gif can be written with arbitrary code.

A somewhat deep dive into the format [https://enthusiasms.org/post/16976438906](https://enthusiasms.org/post/16976438906)

<comment><USER9> Except in this case it didn't really have anything to do with GIFs. The actual vulnerability was caused by misconfigured DNS settings for *.teams.microsoft.com

<comment><USER18> Yes I know. I was referring to the title of the article.

</comment></comment></comment><comment><USER19> I was always confused by seeing those types of exploits. In my head, I could not see why would GIF cause anything other show up on screen. But then I remember I think of offline activity.

All that said, and please excuse my ignorance here, but how common is it for subdomain not to be under the control of its owner?

<comment><USER20> 2018: You CNAME subdomain.microsoft.com. to blahblahblah.heroku.com.

2019: You replace blahblahblah and shut it down on Heroku

2020: An attacker creates blahblahblah.heroku.com. and can now read and write cookies for *.microsoft.com.

Replace Heroku with any off-domain hosting service that lets you register a vanity or predictable hostname rather than assigning a GUID.

</comment></comment><comment><USER21> ... buried the lede

it's subdomain takeover

<comment><USER22> It's not buried; it's in the 2nd sentence of the abstract/summary:

"leveraging a subdomain takeover vulnerability"

</comment></comment><comment><USER23> This is why one should not automatically load external content in e-mails. This Forbes article covers the same territory: [https://www.forbes.com/sites/thomasbrewster/2020/04/27/your-...](https://www.forbes.com/sites/thomasbrewster/2020/04/27/your- whole-companys-microsoft-teams-data-couldve-been-stolen-with-an-evil-gif/)

I have to say, these headlines immediately made me think of this long ago fixed bug: [https://www.cvedetails.com/cve/CVE-2008-2160/](https://www.cvedetails.com/cve/CVE-2008-2160/)

<comment><USER7> That's not what this bug is about. The bug is not to do with the content, but merely the connection. And it's only "external" because Microsoft relinquished control of its _internal_ system but still treated it as internal.</comment></comment>