Doxxing defense: Remove your personal info from data brokers - <AUTHOR> http://www.computerworld.com/article/2849263/doxxing-defense-remove-your-personal-info-from-data-brokers.html#tk.cwfb <comment><USER2> Just because a data aggregation site does not show your data on the front-end, does not mean they deleted it from the back-end. So now you can charge 50$ for people to search in the "special" data pile, where people took the effort to remove it from the front-end.

These data brokers crawl publicly available information. Telling them to remove your data, only slows down the doxxer, it does not stop them at all, since the data was already shared. It is not plugging the leak, it is mopping up some of the water. A false sense of security and a clear sign to the doxxer that you care about your anonymity (so more "lulz" to be had).

A proper doxxing is also much more than entering a name in some search engines. Especially hackers do not like to be doxxed. For internet civilians who already put this data out there (on social media) a simple data broker doxxing is a mere reminder that such data is public to everyone, not just friends.

Doxxing defense is guarding your anonymity online. Everywhere. Doxxing defense is knowing when to change persona's, and when to log off. That is: If you care about it at all. If you care about keeping your identity a secret online, see: [https://www.youtube.com/watch?v=9XaYdCdwiWU](https://www.youtube.com/watch?v=9XaYdCdwiWU) (The Grugq - OPSEC: Because Jail is for wuftpd).

<comment><USER3> > Just because a data aggregation site does not show your data on the front- > end, does not mean they deleted it from the back-end. So now you can charge > 50$ for people to search in the "special" data pile

Do you have evidence of aggregators doing this? It's plausible, but I haven't heard about it happening.

> Telling them to remove your data, only slows down the doxxer, it does not > stop them at all

I think you have a good point overall but let's not dismiss the solution in the ComputerWorld article, which is valuable. All security solutions do the same thing: They increase the attacker's costs, which stops attackers unwilling to pay the price. There is no perfect security.

For example, we tell users to use strong passwords on their Windows logons, but that only raises the cost of an attack and does not completely secure the machine.

</comment></comment><comment><USER4> The US really needs something akin to the EU's Data Protection Directive[0].

I've seen tons of businesses hide some tiny clause in their T&Cs (page 30, subsection 15, paragraph 11, etc) which allows them to resell your data to whoever will pay. For example the National Geographic Store sold my personal data when I purchased something from them (even with no check-box opt out, etc during checkout), and I've been receiving girly catalogues and credit card applicaton snail mail ever since (with a glaring typo which points right to National Geo's store).

I don't really see that happening (the US getting better data protections) as the US constitution is being largely used to protect business's "freedom [to do whatever the hell they want]" rather than individuals/people as was intended.

I was really hopeful that when the blackmail criminal-record racket started that that might finally result in substantial changes within the US, but nope. Nothing has changed and the blackmailers still operate.

[0] [https://en.wikipedia.org/wiki/Data_Protection_Directive](https://en.wikipedia.org/wiki/Data_Protection_Directive)

<comment><USER5> I know you can enter email addresses as email@example.com where x=your regular email and y=some word/phrase to indicate who might have sold your email.

For example, if you register email@example.com with national geographic, and you find yourself getting to: email@example.com from spam, you know who sold your info. My question is, do you think companies know this trick and just remove the portion following the "+"?

<comment><USER6> > _if you register firstname.lastname@example.com_

Please use the second level domain label _example_ [1] when writing examples of email addresses. For all you know, you just posted someone's email address.

[1] [http://en.wikipedia.org/wiki/Example.com](http://en.wikipedia.org/wiki/Example.com)

<comment><USER5> Changed it even though someone else pointed out it bounces. Thanks for the tip.

</comment></comment></comment></comment><comment> ryan-c Abine's DeleteMe[1] service will take care of removing you from these sites, though it's not cheap. They will keep re-checking and re-removing. I've been using it for a few years, and it seems to work pretty well. IIRC there was still one site that I had to call and deal with myself.

1\. [https://www.abine.com/deleteme/](https://www.abine.com/deleteme/)

<comment><USER7> I would also add Safe Shepherd [0]. We remove your information from the standard data brokers, and also give you guides on how to remove yourself from a large universe of sites yourself. Message me if you have any questions.

Edit: The service costs $13.95/mo, but you can get started with a 10-day free trial where we'll kick off all of the removals. You can (fully) delete your account at any time if you'd like.

[0] [https://www.safeshepherd.com/](https://www.safeshepherd.com/)

<comment><USER8> Question - I can see the value of a service that automates all these removal requests. That said, the monthly subscription model seems a bit excessive, as I assume data would creep back in gradually. I would think quarterly, or even annually resubmitting them all would be adequate. No?

<comment><USER7> Many of our customers choose to turn the service on once every several months (upgrade and then downgrade at the end of the month). We totally support whatever works for you.

That said, our service is based around continually scanning the web for exposures of your personal information. There's plenty of new information that crops up all the time, and we're here to help you when it does.

</comment></comment></comment></comment><comment><USER9> The Internet never forgets. No app is going to change that because Internet is de-centralized and de-centralization makes it impossible to know if the data was really completely removed or not.

Let's face it: the only way to not expose your personal info is to not share it in the first place (forget silly Facebook, G+, Instagrams and all that stuff). If you've already done that, make sure that whatever you are doing that might lead to doxxing is done with your other identity (although this is hardly fool proof since linking identities can happen in many unexpected places). Worst of all is that that kind of infomation, once it slips, is impossible to contain and you have to cut ties and start over.

Relevant: [http://en.wikipedia.org/wiki/Streisand_effect](http://en.wikipedia.org/wiki/Streisand_effect)

<comment><USER10> Not relevant. I've never used social media a day in my life. Nevertheless, clicking a few links in this article turned up my full name, age, birthday, every address I've had since I was 14, email address, and convenient links to pages containing that same information for every member of my family. This is all obtained from public records over which you have literally no control if you lead any semblance of a normal life. There should be more legal protections in place to prevent using public data in this way.

</comment></comment><comment><USER11> There are plenty of sources of information where you cannot opt out.

If you own property in Massachusetts, I can find it using [http://www.masslandrecords.com](http://www.masslandrecords.com) , you can't opt out of that.

<comment><USER3> The electricity provider here requires the use of 'smart meters' (that is, if you want to use their electricity). Via smart meters, they can identify what electrical appliances are used in your house and when (and possibly even how you are using them, such as what TV show you are watching), giving them a good picture of everything that goes on in the privacy of your home.[1]

There is no opt-out. They have this information on everyone in the state.

[1] This is not at all a fringe theory. It's been discussed on HN at least a few times.

<comment><USER12> Except is that information public? That information actually has an extremely legitimate use, which is to better manage peak grid usage and how to optimize that.

<comment><USER3> > Except is that information public?

I don't think it needs to be easily accessible to the public to be problematic. Many people, including businesses and government, can have access. The electricity vendor has little incentive to protect it, to scrutinize government requests, etc. Recent NY Times articles describe the US Postal Service accepting almost all law enforcement requests for information on their customers.

Also, data has a way of leaking ...

> That information actually has an extremely legitimate use, which is to > better manage peak grid usage and how to optimize that.

I do see a benefit to it, but 1) It should be anonymized and minimized. For example, how about aggregating data about usage on my block and storing that? Cleaning it of anything that violates privacy, such as high-resolution individual signals? 2) My privacy is a higher priority than their technical benefits; there's an assumption (maybe not by you) that whenever there's a tradeoff, privacy doesn't amount to much -- this is money we're talking about, after all.

</comment></comment></comment></comment><comment><USER13> Rather than trying to make it harder for people to stalk/harass/intimidate others by hiding data, why don't we get tough with laws and sentencing?

A 5 year jail stint for the next 10 idiots to pull this stunt will reduce the incident rate of this happening a lot faster.

<comment><USER14> There's no significant link between prison sentences and crime rates.

If there was, Norway would have a high crime rate and the US would have a low crime rate.

<comment><USER15> Your first point _may_ be true, but the US/Norway example is not good evidence for it. There are significant other confounding factors -- relative homogeneity of the population, economic differences, population size, cultural history are just a handful that spring to mind.

<comment><USER16> Those oft-repeated "factors" can only be factors if you show that they are.

Simply mentioning that there are differences between those two countries does not make any difference you care to list a "factor".

</comment></comment></comment></comment><comment><USER17> There are a LOT more data brokers than listed here, though it's a decent list to start with. These are small fry in the scheme of things though. You can start working your way through this one if you're really concerned:

[http://www.worldprivacyforum.org/2013/12/data-brokers-opt- ou...](http://www.worldprivacyforum.org/2013/12/data-brokers-opt-out/)

</comment><comment><USER18> The threats of violence are usually empty posturing but there are other serious risks associated with speaking out online under your real name. In the US you can get "swatted"[1], which is an evil twist on usual pizza pranks. It's not far from that to getting shot (or having your dog shot).

Then there are basic SEO threats to your good name. And the old "taking information out of the Internet is like taking piss out of a pool." Whether the information is true or not.

I don't think this is an appropriate defence though. Sticking to usual good practices of not conflating anonymous personas with your real identity, using a PO box and proxy services (whether for domain registrations or actual network proxies) will be more productive. Not good enough when evading FBI but probably more than fine otherwise.

[1] [https://en.wikipedia.org/wiki/Swatting](https://en.wikipedia.org/wiki/Swatting)

</comment><comment><USER19> I don't think this is an effective defense.

First of all, doxing works the same way private investigators do, so they do not require one-stop-shopping data banks. Social engineering and public records searches usually give you everything you need and are free. Second, if you're coming from the standpoint of a feminist decrying the ails of an oppressive society, you are pissing people off that will be motivated in attacking you; they aren't going to back off just because your information didn't show up on PeopleFinder.

IMO, the only defense against doxing is to dox yourself. Doxing is just a form of intimidation, after all, usually done by people who think publicizing some "secret information" will be taken as a vague threat. Make the information public and you remove their ammunition.

To me, the best defense against a troll is being completely nonchalant and not giving a shit what they do. Hacked my accounts? Oh well, it's just an account, i'll make another. Sent me death threats? Hey, life is short and we all die some time. The more you show your attackers that you will not be bothered, the more they realize they are powerless to harass you. That combined with reducing one's online footprint in general will break down their motivation and move them to other avenues for venting hate and frustration.

<comment><USER20> > IMO, the only defense against doxing is to dox yourself. Doxing is just a > form of intimidation, after all, usually done by people who think > publicizing some "secret information" will be taken as a vague threat. Make > the information public and you remove their ammunition.

> To me, the best defense against a troll is being completely nonchalant and > not giving a shit what they do. Hacked my accounts? Oh well, it's just an > account, i'll make another. Sent me death threats? Hey, life is short and we > all die some time.

I am clearly a little less nonchalant than you. But I don't feel all that inclined to publicly post my home address or my kid's school address or scout camp location.

</comment></comment><comment><USER21> This is useless. The only way to defeat mass collection is to poison the well. I always put some fake data wherever it's not legally required. The only issue is where it is _required_ and that is the root of the problem - why is it required in so many places?

</comment><comment><USER22> The fact most of these sites even have opt-out mechanisms, and that they're apparently effective, is surprising and quite nice.

Though, I suspect this became the case out of necessity as a result of horror stories and litigation.

<comment><USER23> _The fact most of these sites even have opt-out mechanisms, and that they 're apparently effective,_

My last name is one that fewer than 20 people in the world have. So doxxing protection and name management in general is very important to me. A few years ago I took about a day and had myself removed from everywhere I could find. Far more comprehensive than this article.

In the three years since, I've slowly been added back to all of them. I haven't moved, I haven't added or subtracted phone numbers, I've made no life changes. It just seems like these data brokers remove your information when you ask and then for whatever reason just add it back again. One example: whitepages.com. I was removed from there about two years and then suddenly my name and address are back again. That's just one example that leads me to believe the opt-out at these data brokers is "temporarily effective" at best.

<comment><USER22> Seems like doing it on a persistent basis is required then, regardless. Admittedly it's a sad state of affairs, but it beats nothing.

</comment></comment></comment><comment><USER24> If any of your personal info is on the internet, it has already been saved where you cannot remove it. This is a personal conundrum I have been trying to wrap my head around, especially as it relates to pictures of my kids I'd like to keep offline (but other people take pictures of them and upload them, and it's too late at that point...)

A company I'm familiar with was attacked by a blackhat. He sent the company owner all his personal information including SSN, address, etc. It scared the owner enough to pay off the blackhat, but he also asked the blackhat how he got his information. The blackhat sent the owner a website that you can go to, pay around $4 in bitcoin, and search for anyone's information.

</comment><comment><USER25> People who can afford to are going to begin hiding behind shell corporations. Houses, other assets, etc. will be corporate-owned, with suitable non- descriptive names and corporate addresses.

In fact, this is already occurring, although a prime driver has been a form of trust that reduces taxes particularly inheritance taxes.

I'm not familiar with what e.g. Hollywood celebrities do, but at a guess many of them are likely also doing something similar.

Need to restrict access? Introduce a layer of indirection.

<comment><USER26> agreed. most of the data those companies had on my name were from utilities, insurance, etc.

and most of them aggregated people with my common name in several states.

they had a lot of info, but also a lot of wrong info. all mixed together. i send removals for all entries, mine and otherwise :)

</comment></comment><comment><USER27> I think just using a nickname (instead of your own name) and not sharing addresses etc is the best way to go.

Lirik (a big Twitch streamer) chooses to only use his online alias, and although it's a common question what his real name (or other details) are, no one really has an answer. You just have to put some effort to not leaking information from registrations to sites (and such).

</comment><comment><USER28> Wow. This is an app just waiting to be built. I would definitely subscribe to a service like this. And I would happily give money to a nonprofit who provides this as a free service for women in tech. Developers, start your IDEs!

<comment><USER29> Why not men too?

<comment><USER28> This response grates a little. It's so common that it's widely discussed and parodied. E.g.:

[http://finallyfeminism101.wordpress.com/2007/10/18/phmt- argu...](http://finallyfeminism101.wordpress.com/2007/10/18/phmt-argument/)

[http://www.robot-hugs.com/but-men/](http://www.robot-hugs.com/but-men/)

And it's closely related to the "not all men" line, equally mocked:

[http://www.listen-tome.com/save-me/](http://www.listen-tome.com/save-me/)

[http://imgur.com/gallery/z5AYz66](http://imgur.com/gallery/z5AYz66)

But assuming that you are sincere and just unaware of the context: The reason that I personally would offer to fund this service for women in tech is that diversity in tech is an issue I have been working on for a while. Even though women are a relatively small proportion of the field, those women are a disproportionately large share of those getting abused with things like doxxing. I don't like that and want it to stop.

It would be my hope that by offering it widely, it would enable more women to speak up both about tech and about their experience in tech. Which I in turn hope will promote a more diverse and inclusive field. Which I think is a good end in itself, but I also think that means better empathy for all sorts of users of tech, and therefore better products and less systemic waste.

Is that helpful?

<comment><USER30> This is sexist and ostracizing :P.

Such service doesn't have a natural gender discrimination so it's actually additional work to create one. Sure, it might be worth to focus on marketing it to women, if indeed they get "disproportionately large share" of abuse (it sounds plausible to me, but I don't have data) - but there's no need for artificially limiting the service itself. Male privacy nerds would happily use it too.

<comment><USER31> Nobody asked that the service to be limited to women. That's something you're adding to the conversation. So it seems to me that you're politicizing it even more.

<comment><USER30> From the top comment of this thread:

> _And I would happily give money to a nonprofit who provides this as a free > service for women in tech_

That's how I understood it, and I think it's supported by the poster's other comments.

<comment><USER28> Skybrian is right; you're wrong.

I am speaking of two separate things: a commercial product and a nonprofit that gives away free subscriptions to the commercial product. Although now that you mention it, if some sort of existing nonprofit focusing on diversity in tech built a service, that would also be something I'm glad to support.

One easy way to tell that I didn't want guys excluded from the service: I said I wanted to subscribe, and I am a guy.

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> What creeps me out is that there are now salary databases that people can use to see someone's prior salary history, job titles, and (in some cases) details of separation. It shouldn't be legal for those to exist, nor for companies to use them.

I actually checked myself in one ("The Work Number") in 2012 and it had an accurate title and salary history, which I hadn't made public. Scary, creepy stuff going on. How the fuck are they able to know that?

<comment><USER33> > How the fuck are they able to know that?

This is a good question, that I'd like to see answered too -- if anyone here knows.

On a related (only to me) note: Is there any way that I can set a watcher on your comment to notify me if there is a response to it?

<comment><USER34> I'm just guessing, but they could be using info that was obtained when a user was trying to get a loan. Typically, your info is sent to multiple lenders so you can get the best rate. Somebody could be collecting the info somewhere along the line.

</comment></comment></comment><comment><USER35> "Many women gamers and developers, as well as those who support them, have lately come under attack from online trolls"

Please don't whitewash the GamerGaters who have also experienced such attacks. (For example, one was "doxed" and mailed a knife with a suggestion to kill himself - which I'd argue a far worse "attack" than any online threats. The anti-GamerGate media of course doesn't report on this.)

<comment><USER36> What about a source for that?

<comment><USER35> [https://twitter.com/kingofpol/status/525755692318457856](https://twitter.com/kingofpol/status/525755692318457856)

Keywords "gamergate knife".

<comment><USER37> I'm sure all the folks claiming @femfreq made up her death threats will be equally skeptical about this one.

<comment><USER38> "KingOfPol" is known for lying and generally being not too mentally stable, so it's certainly not a stretch. Sarkeesian on the other hand is unlikely to lie about such things, but there was clearly some exaggeration involved.

<comment><USER39> Why is Sarkeesian "unlikely to lie about such things"?

<comment><USER38> Because she's (sort of) a public figure and if it was revealed she was lying, it would look very bad for her? She also hasn't had a history of lying about such things in the past, so there's no reason to suspect she is now. She is known to have lied about certain other issues, but not in a way that's relevant to threats or harassment. She also doesn't come across as mentally unhinged or malicious. I dislike her, but I don't think she lied about any of the threats.

The other person being discussed, KingOfPol, is known for his narcissism and fabrication of stories, so it's a bit different.

<comment><USER39> That's not an exhaustive analysis. I recommend to look at risk vs reward.

The risk of getting caught is essentially zero: just use Tor and VPN via an 'unfriendly' third country to send fake threats to yourself, or get a friend to do that for you. Clearly the police is not going to investigate, because all these cyberthreats are obviously not serious. The upside on the other hand ... Sarkeesian made how much last time by playing the damsel-in-distress? Wasn't it over $100k? That's quite an incentive. And then there is the political effect: the mainstream media, for various reasons, will automatically sides with the damsels.

I spent quite a lot of time in activists' milieu and I smell attack techniques in a Leninian mould, see e.g. Alinsky's "Rules for Radicals".</comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: What are some good books on SV / Tech industry history? - <AUTHOR> Hello,<p>Being a young person in the tech industry, I've always been fascinated by the little tidbits of history that I've come across. Are there any books / articles which offer an insight into how the industry looked like in the 80's and 90's? <comment><USER2> Fun but also informative magazine articles from those times by well-known writers:

'The Tinkerings of Robert Noyce' by Tom Wolfe in Esquire magazine, Dec 1983, pps 346-374 about the 60s 70s and early 80s in SV: Fairchild, Intel and other companies, Willian Shockley, Gordon Moore and other people. On the web at

[https://web.stanford.edu/class/e145/2007_fall/materials/noyc...](https://web.stanford.edu/class/e145/2007_fall/materials/noyce.html)

Spacewar: Fanatic Life and Symbolic Death Among the Computer Bums, by Stewart Brand in Rolling Stone 7 Dec 1972. Stanford AI Lab and Xerox PARC in the early 70s. Also at

[http://www.wheels.org/spacewar/stone/rolling_stone.html](http://www.wheels.org/spacewar/stone/rolling_stone.html)

The Suburb That Changed the World, Jaron Lanier, New Statesman 28 Aug 2011. SV in the 70s and 80s as seen by a then-young hacker remembered much later.

[http://www.newstatesman.com/scitech/2011/08/silicon- valley-c...](http://www.newstatesman.com/scitech/2011/08/silicon-valley- computer)

The Guy I Almost Was, by Patrick Farley - Early 90s cyber-utopianism in SV as seen by an aspiring outsider

[http://electricsheepcomix.com/almostguy/](http://electricsheepcomix.com/almostguy/)

</comment><comment><USER2> 'High Stakes, No Prisoners' by Charles Ferguson is very good on the early 90s and the dawn of the web. Ferguson was a government technology policy analyst who realized very early -- around 1990 -- that the web was going to be a big thing. So he started up Vermeer, which made a web site building tool that eventually became Microsoft FrontPage. Lots of period detail about tech and business in the eary 90s. Ferguson spent vast amounts of time, energy, and frustration explaining to VCs what the Internet was and trying to convince them it would be important. Lots about creating FrontPage at Vermeer with early 90s tools practices and people, then much more about the acquisition by Microsoft. Lots of vivid portraits of particular VCs, tech people, and Microsoft people.

</comment><comment><USER2> 'Close to the Machine' by Ellen Ullmann - a memoir about the 90s in SF and SV by a software engineer, a different view of same time, place, and kinds of people as in the Ferguson book. Also her novel 'The Bug', a fictional treatment of working in the industry in those days.</comment>


Serena Williams Joins SurveyMonkey's Board with Intuit's Smith - <AUTHOR> https://www.bloomberg.com/news/articles/2017-05-24/serena-williams-joins-surveymonkey-s-board-with-intuit-s-smith <comment><USER2> As someone who has been a customer of SurveyMoneky for years (paying for top tier membership) I have very few complaints about their technology. It works well, and their service is good when it doesn't. However, I'd really love it if they could up their ambitions to unseat the SPSS hegemony in handling survey data correctly. Our company maintains a license of SPSS _just_ for handling the output of surveys from survey monkey, because there are no faster ways to aggregate surveys results from multiple languages. SurveyMonkey still lacks true multilingual support. Meanwhile, I would love to get away from SPSS, but I haven't found a good workflow in any other GUI-ish tool that allows me to do what I need to do faster.

If Serena Williams is reading this, I hope that as a board member she can push SM to focus more on the higher end product roadmap.

<comment><USER3> Hi there:

Serena here.

In my first board meeting, a SurveyMonkey engineer working on multilingual features in the core product brought this post to my attention.

Every global brand needs to handle survey data across languages and geographies. I just reviewed the roadmap with the internal team and i am confident SurveyMonkey is investing in this direction - stay tuned!"

Serena

</comment></comment><comment><USER4> _Serena's voice on the board sends a strong message to our company, investors, and the industry_

What message is that exactly?

 _Serena is an activist, marketer, brand builder, and greatest athlete of our time_

I laud her accomplishments in Tennis and from what I understand she may be the greatest tennis player of all time. How that translates into being the best person to sit on a board of directors is unclear to me.

Putting celebrities on professional boards isn't anything new, and the Economist covered this in 2010 [1], showing that it has a positive affect on share value.

I guess it's kind of like how rich celebrities never pay for anything (comped meals, free valet parking etc...) because their _mere presence_ is payment enough.

[1][http://www.economist.com/node/15810608](http://www.economist.com/node/15810608)

<comment><USER5> When Jay-Z bought into the Brooklyn Nets NBA team it was discussed quite a bit. Turns out he owned something like 0.5% but the media exposure was big for the team.

<comment><USER6> Sure but there's a strong intersection between a sport like basketball, and entertainment and rap/hip hop.

I would imagine a much more relevant person as a board member for a survey company would be someone like Andrew Ng or Nate Silver. But I recognize that I might be overly pragmatic and missing some imagination. Or conflating the role of a board member.

<comment><USER5> That's very true. I guess on the surface people assume Serena was asked to be on the board for the celebrity factor, which I would argue having Serena on the board probably doesn't bring in a ton of business. However, she has been involved in international sports business and marketing since she was very young, therefore probably does bring a lot to the table besides being the tennis GOAT.

</comment></comment></comment></comment><comment><USER7> I'd have to think her husband, Alexis Ohanian, had something to do with this.

<comment><USER8> Imagine a woman could get a job on her own merits...

<comment><USER9> What boards _aren 't_ looking to hire top tennis athletes in this day and age?

</comment></comment></comment><comment><USER10> Looks like SurveyMonkey is going public. As a public company it's important for the CEO to have a pliable board made up of people who owe their seats to you. That's how the big comp packages are awarded.

</comment><comment><USER11> This seems totally out of left-field move that only provides PR for SurveyMonkey. And while that may be somewhat true, this decision actually makes more sense if you dive into Serena's more recent endeavors.

Aside from being one of the world's greatest tennis players, she is clearly an accomplished business woman. She has started her own clothing line, owns a portion of the Miami Dolphins, and has started several successful charities. Most importantly, she knows how to market _herself_ really really well.

Board members don't always have to have directly related experience to the companies they advise. A progressive company like SurveyMonkey that puts a lot of effort into supporting charities and positive social changes could really use the insight of someone like Serena.

</comment><comment><USER12> Does it really matter who is on the board of a privately held company?

</comment><comment><USER13> SurveyMonkey has 650 employees?! Do they just have big customer support and sales teams? Or are they working on a much more ambitious roadmap than simply maintaining their classic survey tool?

<comment><USER14> Every time there is an article about SurveyMonkey someone makes this comment. SurveyMonkey has hugely expanded what they offer from their original core product and has also scaled dramatically. It also has many subsidiary offerings (Fluid Review, Wufoo, Audience, TechValidate).

The answer to both your questions is - yes.</comment></comment>


The first real linear virtual desktop soon becomes Open Source - <AUTHOR> http://desktop-panorama.com/

<comment><AUTHOR> Good friend of mine created Desktop Panorama a virtual desktop environment, after working on it for about thousand hours he recently decided to make it open source. Hats Off To You, My Friend

Panorama has a user friendly design and it is very intuitive. The mechanics are simple, you can drag and drop windows in and out of the square, which can give you a better overview.The layout of the program is fairly nice. You can switch between a number of skins and the overall design looks very well. In theory, you have an infinite number of windows you can move around.</comment>


Show HN: Sesame 2, Locks your Mac when you walk away - <AUTHOR> http://atama.io/sesame2

<comment><AUTHOR> Hi all, Atama software dev here. We are back with a second version of our locking product Sesame.

Sesame 1 got some great feedback from our users so we have refined and enhanced our features alongside a new design and a refreshed app.

We also have windows support in the works.

I'll be sticking around answering as many questions as i can.</comment>


NSA CRACKED OPEN ENCRYPTED NETWORKS OF RUSSIAN AIRLINES, AL JAZEERA, AND MORE - <AUTHOR> https://theintercept.com/2018/08/15/nsa-vpn-hack-al-jazeera-sidtoday/ <comment><USER2> Interesting and relevant but an all-caps title makes it appear like clickbait on first impression.

<comment><USER3> KEYBOARDS ONLY HAVE CAPITAL LETTERS! /S

<comment><AUTHOR> No, Title of the article was in capital letters. It was flagged, I edited but now i see again it is with cap letters and cannot edit it :-(</comment></comment></comment>


The Next Big Thing After Websites and Mobile Apps - <AUTHOR> https://medium.com/@lancengym/the-next-big-thing-after-websites-and-mobile-apps-a15d61465e2f <comment><USER2> So, thiVRd-liff, now that it's with VR. (Where's Second Life? Exactly.)

Sorry, this is a vision that keeps getting circulated since the 1980s, and keeps on flopping.

<comment><AUTHOR> Second Life has languished into satisfying kinky online fantasies.

<comment><USER2> Yup. How's another iteration supposed to be different, if the only difference is technological?</comment></comment></comment>


It's time to kill Surface (2014) - <AUTHOR> https://stratechery.com/2014/time-kill-surface/ <comment><AUTHOR> I submitted this because I think it and the original HN discussion[1] are interesting bits of history. 18 months ago, it was debatable whether the Surface line was worth continuing. Now it's a compelling and profitable product line. To me, this was a very unexpected turnaround.

1\. [https://news.ycombinator.com/item?id=7784739](https://news.ycombinator.com/item?id=7784739)</comment>


Ask HN: List of common user agents and screen sizes? - <AUTHOR>

I want to grab screenshots of some web pages, as seen by common users.  I know that I can use wkhtmltopdf to do this, and pass custom values for the user agent and screen size, as per the example here: https://code.google.com/p/wkhtmltopdf/issues/detail?id=596
However, I'm not so sure where I can get a list of the most common screen sizes for my country (China).
I've seen the list here (http://www.bigbossmas.com/web-development/list-of-mobile-device-sizes/) but it doesn't show the frequency, so I'm not sure which ones to pick to get my 'top 10'.
Does anyone have a list, or a pointer to a tool which will generate the screenshots for popular combos? <comment><USER2> According to statcounter.com, the breakdown for screen size is

        1366x768  27% rising
        1440x900  16% falling slightly
        1920x1080 12% rising slightly
        1024x768  11% falling
        1280x800   7% falling slightly

URL: [http://gs.statcounter.com/#resolution-CN- monthly-201303-2014...](http://gs.statcounter.com/#resolution-CN- monthly-201303-201403http://gs.statcounter.com/#resolution-CN- monthly-201303-201403)

Be patient. It was really slow.

As for browser, the breakdown is

        IE      40% falling
        Chrome  37% rising
        Segou    7% level
        Firefox  5% level
        Safari   3% level

URL: [http://gs.statcounter.com/#browser-CN- monthly-201303-201403](http://gs.statcounter.com/#browser-CN- monthly-201303-201403)

<comment><AUTHOR> Thanks. I should have mentioned I already looked at statcounter. The data for desktops is OK, but what I really want is the most common user- agent/resolution combos. It's easy enough for me to check the Apple ones, just by looking up the specs of recent models, but I don't really know what mid- range Android phone specs to target, as there are so many models.</comment></comment>


Can I edit or create threads by using API of Hacker News? - <AUTHOR>

Is this API read-only? https://github.com/HackerNews/API <comment><USER2> As far as I'm aware.

> Currently, it's read only, but we hope to improve it over time and may later > enable access to private per-user data using OAuth.

[http://blog.ycombinator.com/hacker-news- api](http://blog.ycombinator.com/hacker-news-api)</comment>


WhatsApp Encryption Said to Stymie Wiretap Order - <AUTHOR> http://www.nytimes.com/2016/03/13/us/politics/whatsapp-encryption-said-to-stymie-wiretap-order.html <comment><USER2> What the article doesn't make quite clear is that OpenWhipserSystems, the creators of Signal, partnered with WhatsApp to bring their crypto to WhatsApp. See [https://whispersystems.org/blog/whatsapp/](https://whispersystems.org/blog/whatsapp/) (this was when Signal was still split into TextSecure and RedPhone). The problem, of course---and the article touches upon that---is that with a closed source app like WhatsApp you have no way of knowing whether your communications are actually being encrypted; you have to take their word for it.

<comment><USER3> Open source is not a panacea here.

The situation is largely the same with Signal: Unless you manually build and install Signal yourself, there is no guarantee that the App Store or Play Store versions are actually built from the source provided by OpenWhisperSystems.

And even if you compile Signal yourself, there's always "Reflections on Trusting Trust".

<comment><USER4> If you trust openwhispersystems than on android it is guaranteed to be the same build that was uploaded. All builds are signed by developer unlike apple (where you sign builds to prove that this is your build to apple, not to user).

<comment><USER5> "If you trust OpenWhisperSystems" is a pretty huge condition – the exact condition we're discussing here. The advantage of open source is that you don't have to trust OWS, you have to trust the source code, which you can do by auditing it yourself.

<comment><USER6> > The advantage of open source is that you don't have to trust OWS, you have > to trust the source code, which you can do by auditing it yourself.

No. That is not the advantage of open source. The advantage is that as long as _somebody_ audits the code, you don't have to.

And in this case, you don't need to trust OWS to do the right thing, only to refrain from pushing rogue updates (ie, to only sign versions that are actual releases). You can still read the code yourself.

<comment><USER7> _And in this case, you don 't need to trust OWS to do the right thing, only to refrain from pushing rogue updates (ie, to only sign versions that are actual releases). You can still read the code yourself._

You've missed the subtleties around the word "trust" in the context. You don't need to trust that the WhatsApp people are nice, or want to do what is right.

You need to trust that they and Google haven't been legally compelled to push a "rouge" update - perhaps only to you. Don't forget there is nothing technically stopping a uniquely compiled update being pushed to a single account holder.

The only protection against this is 3rd party auditing and checking the signatures yourself, and that the 3rd party is completely located in a jurisdiction where they are unlikely to be legally compelled to comply with an order that applies to WhatsApp and/or Google.

</comment></comment></comment></comment></comment></comment><comment><USER8> Unless it's opensource, it can't be trusted. Not saying it is enough, but it is a requirement. But that's not enough, any smartphone OS maker (google and apple) can be ordered to install a Trojan by force and keylog everything. So you'd need something like [http://www.replicant.us/](http://www.replicant.us/) I guess and compile it yourself if you're completely paranoid. Even then, there could be a keylog in the hardware directly talking to the bios.

tl;dr: if you want complete risk-free privacy, a smartphone is probably not what you want. I use a smartphone myself by the way, just saying.

<comment><USER9> That's not true: strongest products ever made were high-assurance closed source. There's also been strong FOSS apps. Most apps, open or closed, are insecure due to lack of rigor or specialist skill. Key things are right development, review, and distribution.

I broke it down in the essay below: [https://www.schneier.com/blog/archives/2014/05/friday_squid_...](https://www.schneier.com/blog/archives/2014/05/friday_squid_bl_424.html#c6051639)

Review and identification/possession of what was reviewed are important points. Mass publication or distribution of source hasn't proven to be a determining factor.

<comment><USER10> > strongest products ever made were high-assurance closed source

Because we never found the backdoors put in place by the developers does not mean they were not there, and without source access we have absolutely no reason to believe anyone when they say there are none.

<comment><USER9> High assurance prevents that by full specs of all success and failure states, modular code, avoidance of dangerous constructs, covert channel analysis, testing of execution paths, pentesting with source, and so on.

You could conceivably slip a backdoor in with extra cleverness sure. Yet, whether OSS or closed, you depend on talent of reviewers to find it for you. High-assurance closed has most labor put into that. That's why it was more secure. Aside from activities described above that were mandatory for high assurance security but optional or ignored for the rest.

</comment></comment></comment></comment><comment><USER11> I'd be interested to find out how many actually legitimate terrorist plots have been foiled because of NSA/government eavesdropping. I'd bet it's staggeringly low, if not 0. I'd put money on single digits, easily. It seems like the vast majority of good & concrete actionable intelligence found in these cases are the results of good old-fashioned police work. I mean, they have already caught these people (or, as in the case of San Bernadino, the suspects are dead) -- so now they just want what?... more evidence against them, links to other people/suspects, etc? It seems lazy and/or a lie that they couldn't gather this info with, y'know, investigative police technique.

<comment><USER12> I think this is a very good question, but numbers given by officials will be difficult to verify.

It seems that the problem with foiling terrorist plots is not the amount of information that is available, but the inability to connect the dots:

[http://www.theguardian.com/world/2015/nov/16/french-and- belg...](http://www.theguardian.com/world/2015/nov/16/french-and-belgian- intelligence-knew-paris-attackers-had-jihadi-backgrounds)

If anything, they should be asking (at least in Europe) for more personnel to keep better track of possible terrorists, because that is what has failed here. Another problem is that some countries have cut budgets of deradicalization programs and local eyes and ears since the mid-2000's.

As we all know, the terrorist attacks are just a convenience for asking backdoors. Each opportunity is exploited.

</comment></comment><comment><USER13> The long term problem for broad adoption of end-to-end encrypted mobile messaging is closed software ecosystems; the government will just pass a law to force Apple & Android App stores to stop distributing apps like WhatsApp that facilitate it. Game over.

add:

I suspect that code itself and the act of posting it on the internet could be interpreted as free speech. Even if not, it would difficult to stamp it out from international sites or bit-torrent. Distributing via an App "Store", even for free, could be more likely to be construed as commerce, which is already heavily regulated and for less important reasons than criminal/terrorism investigations. Google and Apple as large public corporations have fiduciary duty to their stockholders to protect their profits, which the US government can easily threaten. So there's a big weak link (and an easy lever for government to pull on) in the closed distribution of secure communications code.

<comment><USER14> Such a law may well be unconstitutional. I would expect Apple and Google to forcefully petition for an injunction (or whatever) that would prevent FedGov from prohibiting them to distribute such software until the constitutionality case was decided.

<comment><USER15> I expect the government to eventually under NSL demand the source code be given to them along with any necessary keys. The question at that point is do the targets say no. This of course would create standing to challenge the constitutionality of secret courts and NSLs and the like which I don't think the DOJ and FBI want to lose.

<comment><USER13> In end-to-end encryption the private keys are on the user's phone. The point of a wiretap is not to let the target know you're listening. Having the code source + user's public keys from WhatsApp is of no help in decrypting.

<comment><USER14> Yup. E2E crypto with keys stored on the conversing devices shuts down _all_ MitM attacks. It doesn't stop targeted attacks (warranted or unwarranted), but I expect that law enforcement considers passive data scraping to be much less serious than targeted surveillance.

</comment></comment></comment></comment></comment><comment><USER16> Hmmm ... is that a real, statutory wiretap? Like, to an actual and regulated telecommunications provider? Or is DOJ skating by on "quacks like a duck" orders? CALEA was limited for a reason (I imagine they really want to change that).

AFAIK pen-register and similar wiretappy things are only applicable if you're a phone company, or very much like one. If you just ship an app and handle packets, that's a different story.

<comment><USER17> The article doesn't really provide many details so it's hard to tell. I don't think they can order a wiretap under CALEA since, like you said, that only applies to telecom providers. And even if they determined that WhatsApp was a de facto telecom, CALEA still has exceptions for end-to-end encryption.

</comment></comment><comment><USER18> Sad. I'd argue that end-to-end encryption is one of the strongest principles of privacy in the history of mankind. I would have loved to see widespread adoption. It is obvious that the state pushes against it. But we must win. We probably won't though.

<comment><USER19> Not with that attitude!

Contact your representatives, tell them how you feel. Share information with your friends and coworkers. The public wants data security. On balance, backdoors will make us less secure. A few representatives like Lindsey Graham have already changed their minds when presented with new information. [1]

[1] [https://youtu.be/uk4hYAwCdhU?t=1m44s](https://youtu.be/uk4hYAwCdhU?t=1m44s)

</comment></comment><comment><USER20> I think it's surprising / disturbing that the discussion here is centered on the importance of open sourced _apps_. What security does an open source encryption app offer when it's running inside a closed hardware / software platform that has direct access to your messages in the clear before they're encrypted and after they're decrypted. If Apple (not picking on them I'm just an iPhone user) wants to or is compelled to monitor what you're doing on your phone they can. Period. End of discussion.

As a thought experiment I think it's valuable to consider what secure messaging over an iPhone would look like. It's actually very simple, just very inconvenient. You encrypt your messages on another, air-gapped computer with known and trusted hardware (a Raspberry Pi works). From there you deliver your encypted text over the phone via whatever channel is convenient -- SMS, Facebook, Twitter, etc. On the receiving end you do the reverse.

If you're not doing that then your communication is theoretically and practically insecure. Discussion of the security of encypted messaging apps is not only worthless it's actually dangerous. It's security theater and takes the focus away from the actual issues -- at best, at worst it convinces people that insecure channels are secure.

I can't figure out if this is lost on most people, they're in denial or if there is actually a concerted effort to mislead. Smartphones -- and most computers -- are insecure by definition. People need to understand that and act accordingly if privacy is important to them.

<comment><USER21> You are missing one impotent aspect. The problem is that this is a war of resources. In the end a government can almost always get access to the end user device.

What we have to fight first is the dragnet. Government just sucking up all communication. This can be archived by end to end encryption even if the computer used are not secure. This forces government to compromise every individual enduser device, such action is impossible on the scale that they do now.

This means the have to limit the amount of people they attack. Once we have archived that, we need to massively improve on end user device security. Secure elements and separate smart cards are decently the future.

Having a trusted Smart card for your encryption needs is decently the future. I already use a Yubikey over NFC when sending email.

You need to stop thinking about absolute security and start thinking about the cost of mass surveillance.

</comment></comment><comment><USER22> Why nobody talks about steganography? Even if there are laws forbidding cryptography, the interested parties can use that today, if they have plausible deniability.

That's in the worst case when majority doesn't care, minority isn't strong enough and there aren't enough education about how to implement cryptography reliably in the absence of companies which would offer the product.

<comment><USER21> Im glad that steganography exists but the fight we are fighing, is about the large public. I have no dought that with Open Hardware, Open Source, Smartcards, Tor and a lot more, I will always be able to hid my most important message I send to a simularly connected friend.

However that is not usuable for most people and such products will have a hard time taking over majority market share.

</comment></comment><comment><USER23> >Jan Koum, WhatsApp's founder, who was born in Ukraine, has talked about his family members' fears that the government was eavesdropping on their phone calls.

And the Ukraine government is not the only government that might be suspected of having shenanigans, whether officially or done by rogue agents.

Even our own FBI has been infiltrated by rogue agents, such the case of an illegal immigrant who managed to become an FBI agent and was trying to get information on their investigation of Hizbollah, as documented on their own web site:

[https://www.fbi.gov/news/stories/2007/november/prouty_111307](https://www.fbi.gov/news/stories/2007/november/prouty_111307)

Of course the majority of the people there are great people doing a good job. But extending trust to them does not protect the users' interest in privacy and more importantly safety.

</comment><comment><USER24> Are wire tap orders mandatory? Or is it just permission to wiretap...

If you can't succeed in wiretapping you aren't penalized right?

</comment><comment><USER25> Didn't they do something like this with Skype years ago?

</comment><comment><USER26> So, there are two end positions - Apple/WhatsApp on one end and the FBI on the other. Is there a third one we aren't looking at? Obama and FBI director want a "middle ground". Is there a middle ground?

Since the US govt helped develop the technology behind WhatsApp encryption, now might be a good time to put money into developing a technology that creates a "middle ground".

<comment><USER27> You have to trust the government to have a middle ground. It has been shown again and again that we cannot trust them.

Even if we trust one government, it doesn't mean you can trust the next one.

If the USG force the US tech companies to provide a backdoor, then the technology is out there in order for non-US tech companies to pick up where they have left off.

It is a battle the USG cannot and should not win.

Trust the maths. Thank you Snowden for showing us the light.

<comment><USER28> Bingo. Obama, Clinton and the rest keep asking for Silicon Valley to find some workable compromise and getting frustrated at the "absolutism". But they don't have enough self insight to see that they're guilty of the exact same thing.

In a world where governments were transparent and government employees were robustly held to account for transgressions of clearly written laws, I doubt many in the Valley would be putting so much effort into e2e encryption. It'd be like the world pre-Snowden, or the telcos, where companies just complied with warrants and orders and didn't see any big problem with that.

The problem is the Snowden affair showed that governments are utterly incapable of handling the power they temporarily obtained via subterfuge, utterly uninterested in holding people like Clapper to account, and generally don't seem to care about whether the people trust them or not. Standoffs like this are the inevitable end result.

If there was trust, there'd be a lot of technical solutions. Like just not employing E2E crypto to start with. SSL would be enough.

</comment></comment></comment><comment><USER29> Couldn't these companies use a public/private key to encrypt a special message that their apps could receive and verify it's signed by the mothership and then proceed to relay message or send unencrypted traffic? I mean, there are technical ways to make this work in a secure way (maybe not using my example).

This discussion seems old and all safeguards are supposed to be in the law (warrants and other legal devices), IN SOME COUNTRIES. And here's the key of this discussion, should FB/WhatsApp and other be above the law? Why is the government being so careful with them and it wouldn't be if this was, say, Verizon withholding phone records in a specific case if there was a warrant?

<comment><USER17> They are not "above the law" because there is no law that they've actually broken. As far as I can tell there's no law against providing secure end-to- end encryption to your customers, and no law requiring that encrypted connumication be tappable.</comment></comment>


Tell HN: The joojoo guy [was] live on mixergy - <AUTHOR> http://mixergy.com/live/

<comment><USER2> Two observations:

1\. Can't imagine a more horrible way to launch a product.

2\. In a lawsuit context, why on earth is this guy, as the company's primary witness, allowing himself to be subjected to detailed questioning on the merits of the case in a public venue? Not coming off as very credible either.

</comment><comment><USER3> I would like to give him the benefit of the doubt, but I don't think I'll ever buy the joojoo product because of this interview. He appears to be dancing around nearly every question, and his body language is shady. I don't trust the company.

<comment><USER4> I completely agree. Everything about his appearance just screams shady.

<comment><USER5> If I was being sued, I'd be dead worried I'd say the wrong thing. To me, it seems like it could just be that.

But come on HN, you're judging someones integrity based on their appearance?

<comment><USER4> I guess I should revise my statement. It's not really appearance as much as presentation. Body language and confidence of your answers.

</comment></comment></comment></comment><comment><USER6> Have to give Andrew credit - he's not using kitty gloves on Chandra, asking him the same questions multiple times to nail down responses.

<comment><AUTHOR> he always does that, he has a really good BS detector and most people tend to give in after you ask them the same question 3 times

<comment><USER5> Reminded me of the ultimate:

<http://www.youtube.com/watch?v=Uwlsd8RAoqI>

(Jeremy Paxman interviewing Michael Howard).

</comment></comment></comment><comment><USER7> I wish I had this HN page up during the interview. I love the input I get from HN readers.

I'm exporting the edited video now. Should be up on Mixergy soon.

<comment><AUTHOR> will you have an embed link? I want to add the interview to my the life and death of crunchpad page on <http://crunchpad.com>

And this way it would actually be seen on the page, instead of getting lost in the wall of text. But if not, I'll just link it

You should really get a player with embed functionality, that way you can get people hooked by the 1-2 good interviews they find posted on other sites they visit, and then they'll come to yours for future interviews.

</comment></comment><comment><USER8> That guy does not seem like a pushover. He's not the kind of guy I would want to get in a fight with. He's really not afraid, he stands up for himself directly. I would bet on him. If he came to me right now and said Max, give me $50k, I'd just hand it over to him.

Fighters are winners.

<comment><USER9> There is a small chance that Arrington thought he could screw them over, but they turned out to be way tougher than some 'random offshore company'

<comment><USER10> From the amount of openness Chandra has shown, it seems there is more than a small chance. No contracts in place? No code contributed? That's not stuff you can lie about.

</comment></comment></comment><comment><USER4> Is it just me, or does this guy act annoyed at answering completely reasonable questions?

</comment><comment><USER11> Anyone got a permanent link? The site's really hard to use and the term 'Joojoo' doesn't appear on their interview page.

<comment><AUTHOR> the interview just finished, he usually edits them and puts them up the next day, so there should be a link on HN tomorrow

<comment><USER11> Thanks.

</comment></comment></comment><comment><USER12> Just finished watching it, congrats Andrew!

Funny thing - I _think_ Micheal Arrington jumped on the phone with Andrew getting ready for an interview just after interviewing Chandra (JooJoo guy) - and Micheal said something like "hold on, let me call you back" - is Andrew going to be interview Micheal next?

<comment><AUTHOR> I think that was Michael from justin.tv

</comment></comment><comment><USER5> Offtopic, but it seems really odd to use twitter to do "realtime" chat. Maybe I'm just biased ;)

<comment><AUTHOR> it's not a chat, it's more of a viewer commentary + a way to ask questions.

<comment><USER5> ok, it's "Real-Time Conversation". I still don't find it useful :)

</comment></comment></comment><comment><AUTHOR> 1 month in singapore, and he is saying that they only spent 1 day in the office? come on

<comment><USER13> ye thats just crazy. I remember seeing photos somewhere at some point of the TC guys at Fusion and there were just heaps of them. Should find the link

</comment></comment><comment><USER8> I feel so...connected...that I just wrote that and got my question answered by the guys in the center of the tech scandal. I almost feel...important! They said my name! I am somehow part of this!

<comment><AUTHOR> at the end of every interview, Andrew asks "so how can people connect with you" people usually give out their emails, or twitter account, or phone #.

I'm actually looking forward to see what contact method this guy decides to give

oh and you got another question asked

</comment></comment><comment><USER14> I never thought I'd say something like this, but watching "lie to me" was worth it!

</comment><comment> sid- More than the lawsuit, I would really worry about the apple tablet competition which is around the corner. That news leak itself is a big sale deterrent for them.

</comment><comment><USER9> What was that song he was listening to? Sounded AWESOME!

<comment><AUTHOR> well he is Iranian/Iraqi so probably something from that region. Although can't be sure, yesterday he was playing JayZ

</comment></comment><comment><USER9> I just can't get myself to trust him, why is that?

<comment><USER9> He seems to be evasive about the 'investors' question too! Why is that so secretive?

</comment></comment><comment><USER15> Chandra is clearly an untrustworthy scumbag. He can't speak perfect English and isn't even white. This alone makes Michael Arrington the legitimate creator of the JooPad. Chandra's story is full of holes. I mean, who cares about who actually built the software and the hardware and the tangible aspects of the product? The TechCrunch people went to Singapore for a whole month! What were they doing there if not contributing their extensive expertise in tablet-device ideation? Surely you don't expect us to believe you came up with the idea to include Youtube all by yourself. You can hide behind your IP and legal rights and Bruce Lee for now, but just wait till someone digs up your old blog where I'm sure we'll find the missing legal documents where you hand over your creation to TechCrunch. Like most of the other posters, I don't care that you've answered the key questions surrounding this case and all Arrington can do is raise a bunch of tangential issues to undermine your credibility. Here in Silicon Valley, we value ideas over execution, loud-mouthed promoters over serious technologists, being part of the start-up establishment over being a genuine entrepreneur, and, of course, appearances over substance.

</comment><comment><USER13> demo fail interview fail joojoo fail

</comment><comment><USER16> I'm really curious if Michael is going to buy one...</comment>


Show HN: Codelapse.com - <AUTHOR> https://codelapse.com <comment><AUTHOR> Hey, HN!

I think that visualizing interview algorithms in that way can help lot of people to understand them, to form a "gut feeling" what's going on. What do you think?

This particular example, linked list reversal, is a "medium" interview question, but I've seen many times people failing it. When I solve this question by myself I always imagine this pointers, how they act and so on, and this visualization - it's what's going in my head. I really think that putting it on the list and animating it helps people to form long-term understanding.

What do you think?

<comment><USER2> Yes I agree visualization aids are helpful, and under-utilized by the educational world. (Same thing goes for math, basic and complex.)

Specifically, for programming:

0) Memory layout or even a Variable's storage, to me, is most useful. It shows intermediate state, and can teach programmers what they can expect to see when their program is running. Most of the time, practically speaking, we don't look at final results ... we look at this intermediate state.

1) Next is historical variable storage. Yes Codelapse seems to have a time- slider. It is also helpful to have a X'd out list of prior values, to help teach programmers to see patterns, showing the historical values they should expect to see over time stored in a variable.

2) Keeping track of the line of code where the program counter is pointing at, is next on my prioritized list of elements to visualize.

I recommend making the time-travel feature, in the center, more "button like", for discoverability's sake.

The >_> faces are cool. Imaginative! Keep inventing these thoughtful illustrations!

<comment><AUTHOR> Thanks for the feedback, espacially for #2.

I really like to see visualisation with feedback loop ( ability to change source code and commit a-la wikipedia) in educational process. For example, consider [https://www.geogebra.org/m/ZFTGX57r](https://www.geogebra.org/m/ZFTGX57r) , it's look beautiful.

<comment><USER2> Wow that is mesmerizing.

Kudos to you for making such a plainly generally valuable and worthwhile piece of technology, itroot.

<comment><AUTHOR> geogebra is just an aspiring example, I do not have any encounter there. So, kudos to geogebra founders =)))

</comment></comment></comment></comment></comment><comment><USER3> Very cool! This is a feature I've partially added to AlgoDaily[1], but your implementation is a much more clean and intuitive IMO.

I assume this works the same as pythontutor.com by executing a code snippet through a debugger and playing back the execution trace. Is each code snippet custom created, or do you have a tool that generates these visuals?

[1] [https://algodaily.com/challenges/reverse-a-linked- list](https://algodaily.com/challenges/reverse-a-linked-list)

<comment><AUTHOR> Hey, thanks for comment! You are right, it uses debugger output.

This is opinionated custom visualization, and I do not have some generic tool here. I think it is possible to do it, but it will be

* generic, like pythontutor - it misses "meaning" of what's happening, just showing the facts without emphasis

* specific cases for popular data structures (I thinking about that way)

* hand-made every time (like a Disney in old good times) - hard work =)

I'm just scratched my own itch, and learned vue.js + vuex + a bit of modern frontend during this project.</comment></comment>


Federal judge: Bitcoin, "a currency," can be regulated under American law - <AUTHOR> http://arstechnica.com/tech-policy/2013/08/federal-judge-bitcoin-a-currency-can-be-regulated-under-american-law/

<comment><USER2> Calling Bitcoin a currency, and therefore allowing that it can be regulated, is an important factor in whether the government can care about it at all.

If they decided that it wasn't a currency and had no value, the case against the Bitcoin Savings and Trust founder would go nowhere. This decision cuts both ways. Without recognizing it as having value, there'd be no fraud to charge and if you were defrauded, no remedy available.

<comment><USER3> It doesn't have to be a currency to have value. Defrauding people with baseball cards is illegal.

<comment><USER4> Baseball Cards is a good example. I think that different Federal, State and Local agencies should prosecute such things.

Meanwhile, the SEC has far bigger fish to fry, as it were.

</comment></comment></comment><comment><USER5> Um, duh? That one is literally right in the Constitution (between regulating Coinage and control of interstate commerce).

<comment><USER6> There were many private currencies in the 19th century that the government never claimed power over. Here's one example:

[http://en.wikipedia.org/wiki/Christopher_Bechtler#The_Bechtl...](http://en.wikipedia.org/wiki/Christopher_Bechtler#The_Bechtler_Private_Mint)

This move with regard to Bitcoin is merely Bank.Gov trying to protect its monopoly on the issuing of currency.

<comment><USER7> I don't know that the government has any illusions over the issuance of currency. I can spend and exchange my foreign currency in the US, correct? I can take my US dollars and transfer them and get foreign currency in another country as well.

What this says is that any commercial exchange is subject to government regulation.

<comment><USER6> The US government claiming power over the currency its banking corporation issues is one thing. I don't know why people just accept, without question, the claim that the government has regulating authority over a currency that it doesn't issue.

<comment><USER8> Because the Article I, Section 8 says that Congress has the power to:

"To coin Money, regulate the Value thereof, _and of foreign Coin_ , and fix the Standard of Weights and Measures;"

<comment><USER6> This isn't Congress doing the "regulating". It's the Executive Branch.

<comment><USER8> It's the executive branch enforcing regulatory laws duly passed by Congress.

<comment><USER6> It strikes many, me included, as an overreach of executive power.

<comment><USER5> Then vote in Representatives who agree with you, instead of claiming that the government has no authority. They now have the authority, they were given it by the legislature, which is in the legislature's power to do. If you want the executive to _not_ have the authority then you must have the legislature take it back. But simply claiming that the government doesn't have the authority just because you wish they would not have the authority, doesn't actually make it so.

<comment><USER6> When government loses consent of the governed, it no longer has authority to govern. That won't stop those that believe themselves fit to rule from ruling if they have the power to do so.

As I had to explain the difference between lunch and arbitrary use of government power, do I also have to explain the difference between government of consent and tyranny?

<comment><USER9> Another great example of how discussing politics on HN is frustrating. You started out with an observation that the executive branch had overreached. It was pointed out that they were delegated this power explicitly by the legislature. Now your argument changes, without acknowledging the correction or the error of your previous comment, and, as usual, it shifts to something too nebulous to discuss.

It's not your fault; this is just a really terrible venue for political discussions.

<comment><USER6> Or perhaps it's indicative of the many abuses of authority that emanate from government?

<comment><USER10> No, you missed the point entirely. It's indicative of the slippery slope you encounter when discussing politics on a tech news forum like this at critical mass.

<comment><USER6> No, you missed the point.

The overarching power of government is the problem, not how we discuss it on the net.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Wait, I don't understand - how does the US government have jurisdiction, practically speaking, over Bitcoin transactions occurring entirely outside of the US?

Or is that not what this says? Because to me, "can be regulated under American law" means what I wrote above.

<comment><USER12> It means they'll pass or enforce laws that require citizens to pay taxes, exchanges to file paperwork & pay fees, etc. It means if you're caught not abiding by the law, then you will get punished.

Obviously they don't have natural jurisdiction over and above crypto-anarchy, unless they have the capacity to wage war against the protocol. They probably do. There will be workarounds. So it goes.

I believe the ponzi pirate PirateAt40 should be punished, not because Bitcoin falls under the jurisdiction of government as money, but rather because the pirate defrauded people. You can defraud people with beanie babies or baseball cards as well.

<comment><USER13> Why would the government bother attacking the protocol? I am sure the NSA has the necessary resources, but there would be no point. Failing to pay taxes is jail time. Failing to pay fees as an exchange means your business is shuttered, and continuing after that means jail time. Maybe other countries will be more lenient but US Bitcoin users will be in trouble.

It is also very likely that any taxes or fees associated with Bitcoin will have to be paid in dollars. If there are no legal avenues for exchanging Bitcoin for dollars then it would be illegal to do business in Bitcoin at all. You may personally skirt the law on that, but your local supermarket will not, and neither will your apartment complex, your auto dealership, or any of the dozens of other businesses you deal with in your daily life.

<comment><USER12> I guess people who want to avoid paying taxes will have to find other local businesses that do the same.

What matters to bitcoin users is whether the transaction goes through or not.

<comment><USER13> How many businesses do you know of that pay no taxes at all? Even mafia fronts pay some taxes (having your front shut down for failing to pay property taxes tends to work out poorly). There is also the matter of where _those_ businesses will get their supplies -- eventually they are going to have to deal with someone who pays taxes.

What this boils down to is this: how much faith you have in the government's ability to enforce the law, particularly those laws related to money. I have quite a bit of faith in the government's ability to enforce the tax code; even people who cheat on their taxes are rarely bold enough to not bother to pay any taxes.

<comment><USER12> They can enforce it within their powers. Confiscating bitcoins like they confiscate wages is not within their powers. They can jail you for evading taxes apparently. C'est la vie.

<comment><USER14> > Confiscating bitcoins like they confiscate wages is not within their powers.

The government confiscates wages by sending legally binding orders to people who they believe might owe you wages directing them to remit the owed wages to the remit them to the government instead.

They obviously can do the same thing with bitcoins. The only _current_ difficulty with doing that with bitcoins now is that bitcoins are currently used for so few transactions for so few people that its not likely to be worth the governments effort to find out who is likely to owe you bitcoins to serve them with such orders. If bitcoin were to become widely used, that would change.

<comment><USER12> > They obviously can do the same thing with bitcoins

How? They can't confiscate bitcoins without the private key. It's not like Bitcoin is run by a bank with an internal central ledger.

<comment><USER14> > How?

I suggest you reread the sentence that precedes the one you quoted (and which is the one that "the same thing" refers to.) Because it answers your question.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Good luck!

<comment><USER13> That is kind of like saying, "Good luck collecting taxes!" At some point you need to exit the Bitcoin system -- maybe you need your nation's currency, maybe you need a new computer, maybe you just need to buy your lunch, but regulations can and mostly certainly will be enforced at the exit points.

<comment><USER12> I'm sure people used to say the same thing about the dollar or bank notes, and exiting to the underlying asset like gold. It is possible to remain within the Bitcoin system. It may be difficult now, but it's getting easier every day.

<comment><USER13> As long as the government is collecting taxes, and as long as you cannot make tax payments with Bitcoin, you cannot remain within the Bitcoin system. Even if all your other transactions are done with Bitcoin, you'll eventually need to get some dollars to pay your taxes -- and then you'll be hit with regulations.

As for gold versus paper money, the above reasoning does not apply. Paper money _is_ accepted for tax purposes (and would be far less popular if it was not).

</comment></comment></comment></comment><comment><USER16> The psychopaths that demand we accept their "protection" want to regulate the exchange of information at all costs.

Exchanging numbers is speech. The war on the 1st continues.

<comment><USER17> I'd love to trade email addresses so that we can exchange numbers in the future! My favorites are 17, 3225, and another one that I don't want to exchange with just anyone.

Unrelatedly, there's a problem with calling things only numbers when they're much more than just numbers. If bitcoin were only numbers, nobody would buy them. People buy them because there's an expectation to store and liquidly transfer value.

The claim that the government can't regulate atoms won't stand up if the atoms you have are in an arrangement that fires bullets.

<comment><USER14> > The claim that the government can't regulate atoms won't stand up if the > atoms you have are in an arrangement that fires bullets.

Well, it might, given the 2nd Amendment. That's not to challenge the general principal you are arguing for, only the specific choice of analogy.</comment></comment></comment>


Log Files Do Not Improve Security - <AUTHOR> http://devcentral.f5.com/weblogs/macvittie/archive/2009/09/09/log-files-do-not-improve-security.aspx

<comment><USER2> It doesn't seem like the author has much experience with security, which is what you'd expect from a technical marketing manager - it sounds reasonable but the real goal is convincing you to buy Ronco spray-on-security appliances.

Log files have never been intended as a security measure in the same way as a firewall, but it's naive to claim that they don't improve security. The concept the author is missing is that security is a process, not a software feature. Log files address several key parts of the security process:

1\. Damage containment: if someone does compromise a system, logs are your way to catch that as early as possible - the difference between, say, someone at your bank getting malware and their authorization credentials being stolen. Identifying failures can be done close to real-time so it's realistic to be able to do things like quarantine desktops which suddenly acting like botnet nodes.

2\. Verifying normal functionality: things like security updates being installed _and_ services restarted, whether your admins are following correct policy, etc. This stuff matters a lot in any large-scale environment and while you can get a lot using a security scanner, logging is faster, safer and easier in many situations.

3\. Identify anomalous behaviour: the classic example is adding firewall rules to drop traffic from hosts which attempt noisy attacks but this can also apply to things like banks notifying their customers that their browser is outdated, showing signs of being compromised, etc. Having actual data makes many security decisions a LOT easier.

</comment><comment><USER3> Monitoring logs may not BE security in the classical sense, but it should be a security enabler. Things like:

* why am I seeing ingress/egress traffic to an IP I thought was firewalled? * why am I seeing triggers to IDS signatures on hosts I thought didn't communicate in/out to the internet? * why am I seeing web traffic bypassing a content filter/proxy I thought everyone had to use? * why am I seeing router/switch VLAN/routing errors that could expose more of my network? * if I continue to buy all of those technologies, how do I monitor them to know that they are functioning/doing their job/reporting any exposure? * how do I know if I've been exploited/exposed?

If you use it right, it isn't just a post-attack/exposure response and investigation system, it can be an early warning system, and an aid in your normal incident response techniques. If you do get exposed (which unfortunately does happen to most organizations - whether it's a simple policy violation or a worm infection or worse), it can help with containment (who is still infected?), patient zero identification (when/where did it start?), and mitigation itself in some cases (though that's not always practical or possible).

For a lot of people/teams, knowing really is half the battle. A lot more are strapped for resources and using a tool to extend the IT team does enable better security in that it enables them to focus their time somewhere other than monitoring.

<comment><AUTHOR> "Monitoring" was not part of the equation and that's part of the problem. The implication in the cited article was that logs IN AND OF THEMSELVES result in better security. That's simply not true. Monitoring logs is better, but analysis and even reactive tools that make use of those logs is better. That improves security, but log files don't..

Absolutely agree that logs are an enabler of security. Either someone needs to look at them (analysis) or they need to be leveraged via third-party tools (if you're looking to do more real-time analysis or catch a breach in progress).

And very good point on the investigation aspect - I was thinking more external facing (breach) but there's also good for internal facing (infection/containment).

<comment><USER3> Yes, ma'am, we are on the same page. :)

</comment></comment></comment><comment><USER4> I disagree. Log files greatly improve security _if you read them_. When you spot problems early, you fix them early. Would you rather spot a burglar as he lockpicks your door, or as he's jumping out the window with all the jewelry?

Use logcheck to filter out benign messages; have _everything else_ emailed to you in real time.

<comment><USER5> A while back, someone (here, I think) cited an article / blog entry wherein the author describes his log reading process as first filtering out all the... I'll use the word "typical" entries. He identified patterns for these and lets a script strip these out. As he continues to identify those types of entries, he adds patterns for them to the script.

He then focuses on what remains. At least as described, it sounded like an effective way to focus attention on the needles in the haystack.

Note that this doesn't mean shrinking your logs. It means an automated process for extracting an interesting subset. You still have the complete logs for other work. I'd also regularly audit the extract process both for sufficiency and as a reminder that its output is not the only thing you should be paying attention to.

It's not my idea, and I'm probably not doing it justice. Maybe someone else recalls the article / blog entry and has a link. It's also not something I need to do; perhaps if I did, I'd see shortcomings in the methodology.

<comment><USER4>
       > [...] first filtering out all the...
       > I'll use the word "typical" entries.
       > He identified patterns for these and
       > lets a script strip these out. As he continues
       > to identify those types of entries, he adds
       > patterns for them to the script.
       > He then focuses on what remains.

That's exactly what logcheck does. <http://logcheck.org>

</comment></comment></comment><comment><USER6> They can help in prosecuting offenders, and in that way be part of a deterrent that improves security. If security is measured in a way such as (average leak size/mean time between leaks)

</comment><comment><USER7> As a novice at security issues, I find the discussion _sounding_ helpful, but would appreciate HN discussion.

The general issue regarding security and blogs seems obvious: Shouldn't logs be considered one element in security _analysis_ ? - not something I see discussed in my short time here. Anyway, it gives me pause to think, "Where have I implemented log-analysis in my (or my cron's) routine... and planned for follow-up?"

<comment><USER8> All boils down to the fairly generic statement in the last line:

 _Logging is an integral part of organizational security policies and best practices and well it should be. But don't make the mistake of thinking that logging access to records is the same as securing them._

</comment></comment><comment><USER9> Here's a weak argument to say that log files can improve security:

IF

* security means reducing risks to the confidentiality, integrity, and availability of information;

* risk is a function of likelihood and impact;

* the longer an attacker has unauthorized access to information, the bigger the impact; and

* if log files are reviewed frequently

THEN

* unauthorized access can be detected;

* corrective actions can be taken;

* unauthorized access can be stopped or limited;

* thus reducing the impact;

* thus reducing the risk; and

* thus improving security.

But, in reality, the corrective action reduced the risk, not the detective control (logs and reviews), so this is a weak argument.

</comment><comment><USER10> The title is trollish. As explained in the first sentence of the article, logs don't provide "real-time security", this is very different than "they do not improve security". Sure they do.

One pretty standard way to classify security counter-measures is in the three areas: Protection, Detection and Response/Recovery. Logs play a very important part in the detection area.

</comment><comment><USER11> Log files have _never_ been about improving security.</comment>


Why the Keurig K-Cup is the Beginning of the End for Great Coffee - <AUTHOR> http://muddydogcoffee.wordpress.com/2011/04/01/why-the-keurig-k-cup-is-the-beginning-of-the-end-for-great-coffee/

<comment><USER2> I tried a Keurig because it was supposed to be fast good coffee. I took 2 back because they were so bad for making coffee with the use your own coffee packs. Back to a normal one...

<comment><AUTHOR> I think Keurig is for those who value convenience over quality and taste.</comment></comment>


Ask HN: Cost of servers & bandwidth  - <AUTHOR>

I am curious the infrastructure cost of running a streaming audio site with 50K to 100K users per month.  Users would be uploading files to server and streaming them.<p>Does anyone know of a link resource that details this type of information or able to detail their experiences?  Does not need to be specific regarding stated monthly users. <comment><USER2> Committed bandwidth can be had in many datacenters these days for around $50/Mbs ($50 for every 1Mbps of committed bandwidth). Or you can do 95th percentile burstable bandwidth as well (or combine the two ($100/mo for 2Mbs plus ~$100 for every 1Mbs over 2Mbps, billed 95th percentile)).

About $400/mo for a half cabinet and some power. You're in the neighborhood of probably $500-$900/mo.

Why colocation instead of some shared or pseudo-dedicated server some place? Because (IMO and IME) you're better off with any site that is going to do streaming and potential sustained throughput in colo facility with fixed costs. Places like Rackspace just love when you go 10x over their pitiful limits and your $200 monthly plan is suddenly $4000. Kind of hard to budget for.

Of course, I'm also biased, having an interest in a colo facility :)

<comment><USER3> > _About $400/mo for a half cabinet and some power. You're in the neighborhood > of probably $500-$900/mo._

And that doesn't even factor in buying a server if it's a colo. Which is exactly why he should be renting a dedicated and buying bandwidth at $10-$20/Mbit. It doesn't make sense to setup your own rack unless you're going to have more than a few machines. It's more expensive and a lot more work.

<comment><USER4> If you're talking about providing a high capacity and quality experience then there's no alternative to colo.

I think the /Mbps prices quoted are a bit on the high side (you can get cheap transit at 5GBP/Mbps if you deal in reasonable commits). Apart from dropping your own line in there's no cheaper way I know of to achieve the quality.

Use of a CDN would allow less capital outlay on the standard http hosting (could use dedis, vm, cloud) and somewhat instant scalability. Once you know your traffic patterns your implementation options sometimes get made for you.

<comment><USER2> Yes, the prices were a bit high. They're very regional (and depend on what carriers are at a given site, etc), so I was trying to give a decent average, erring towards worst case (my own prices in MA are a good bit lower, but I'm not trying to troll for customers on HN).

Good point on the CDN, "streaming" can sometimes be non-CDN compatible (although "CDN" is a wide ranging term).

Were it me, I'd start with an $800 1U box in a decent colo somewhere. Add another one on the opposite coast when the first started to get above 50% utilization and then scale from there.

<comment><USER5> Going colo can be worth it when you need serious hardware but for 800$ / month you can pick up:

Four of these: Xeon 3210 - SATA 250 GB IDE/SATA HDD 2 GB 2000 GB 5 IPs $199.00

Or one of these ~Dual Xeon 2.8, 8 x 300 GB 10K RPM SCSI/SAS HDD 2 x 73 GB 10K RPM SCSI/SAS HDD 8 GB RAM 3000 GB Bandwidth 5 IPs $799.00

Which can take a lot of traffic. IMO Colo is great when you want to use lots of heavy duty HW and little bandwidth but for front end web servers you need a lot of traffic before it's reasonable.

</comment></comment></comment></comment></comment><comment><USER3> If you mean serving audio files 100k times (once per "user") then it's not expensive unless the files are especially large. If you're serving over HTTP then use high performance web server (like nginx or lighttpd) and a dedicated server.

I highly recommend ServerBeach myself -- especially if you're going to use any significant amount of bandwidth. For $75/mo you can have a dedicated server and 1200 GB/mo transfer.

[http://www.serverbeach.com/catalog/cust_ref_landing_new.php?...](http://www.serverbeach.com/catalog/cust_ref_landing_new.php?REF=7XYHDMBU8A) ($100 off w/my referral code ($250 for me))

<http://www.serverbeach.com> (no referral code :D)

<comment><USER6> I also recommend checking serverbeach. My box for userscripts.org runs on a $180/mo box (the extra cost is for 3GB of RAM).

I'm currently doing 50k visitors a day and dark traffic of 10x that - averaging 1.2Mbps without a problem.

You can even get 10Mbps or 100Mbps unmetered for $100/mo and $1000/mo roughly

</comment></comment><comment><USER7> S3 based on 100k members uploading on average 5x5MB audio files each, and a growth (new uploads) of around 10%/month:

      Storage: 1500GB
      Transfer in: 150GB
      Transfer out: 30000GB
      PUT requests: 50000
      GET requests: 10000000
      ———————————————
      Total cost: $4,560.10

Not too bad if you ask me! (btw its late and I'm tired, so sorry if my figures are _WAY_ off! :P)

<comment><USER8> Shouldn't that be POST? PUT would be for updating the file that was originally POSTed.

<comment><USER9> No, POST is typically for submitting data to some other "resource" for processing, while PUT is for storing data to a specific URL.

HTTP/1.1 RFC: _"The fundamental difference between the POST and PUT requests is reflected in the different meaning of the Request-URI. The URI in a POST request identifies the resource that will handle the enclosed entity. That resource might be a data-accepting process, a gateway to some other protocol, or a separate entity that accepts annotations. In contrast, the URI in a PUT request identifies the entity enclosed with the request -- the user agent knows what URI is intended and the server MUST NOT attempt to apply the request to some other resource."_

And from S3 documentation: _"Objects are stored using the HTTP PUT method."_

S3 and similar file storage services map particularly well to GET, PUT, and DELETE.

</comment></comment></comment><comment><USER10> I go through <http://serverpronto.com> for my hosted machine. It's a real machine (not virtual or shared) and I've got real root access to it. It comes with Fedora 3 or 4 and I upgraded it to Fedora 6 remotely, but I'm a little intimidated to upgrade beyond that without having physical access to the machine. $30/mo, 200GB bandwidth @ 100Mbit, 30GB HD, 256M ram for starters. There are other options. I use S3 for storage of large data items. All-in-all not too bad for a good hosting setup. I host about 10 semi-active sites on that one machine. My S3 monthly charges are $1 for my personal backups of important data and $30 for website data.

I know that there are plans out there for unmetered monthly data that's capped at a certain speed for a fixed low $$/mo (30-ish), but they tend to be virtual hosts. You could get a real host (for the site and good performance) with capped bandwidth and a second host with unmetered bandwidth for the storage and delivery of your streaming media. Best of both worlds kinda, but again S3 charges so little, that it may be better to just go through Amazon for the media.

<comment><USER11> But they offer only 200 GB of bandwith with that plus overages are $0.89 per GB. Yes you've got root acess but they charge $29 for reboot (yuck!) and $75 for half an hour of custom services. I think that one would be better off using VPS like Linode or Slicehost: you can reboot, repartition and reinstall your virtual machine to your liking and the expansion should be easy and straightforward. .

</comment></comment><comment> patrickg-zill Go to webhostingtalk.com and look on the colo hosting offers section. That will give you your lower-end pricing for colo space and bandwidth pricing.

Then add some kind of servers, I am partial to the Sun servers that have LOM (lights out management) or the HP ones that have iLO (same idea). This lets you connect to a service processor on the system, and lets you power- on/off/reboot it, control the BIOS, and even install the OS on it, remotely. You can get them used on eBay for $1000 to $2000 each.

</comment><comment><USER12> <http://www.simplecdn.com/savings> (On-Demand Flash Streaming part)

Don't know them yet, but there are some good reviews. Perhaps it can be a starting point even if it doesn't deliver completely. I am planning to use them in the near future on top of AWS and Google App Engine, but not for streaming.

</comment><comment><USER13> <http://www.gandi.net/hosting/proposal/price/>

it's pretty much an elastic cloud. i didn't try it myself yet, though. unmetered bandwidth in 5mbps increments, plenty of other resources, and very attractive pricing. i think it's as good as it gets for home-made small cdns and whatnot.

</comment><comment><AUTHOR> Thanks ....

What about using Amazon S3 to store/stream users uploaded files, but the site being hosted elsewhere - a dedicated box at home for instance?

They click to play a file and it starts streaming it from S3. Is this doable? Looks to be cheap this way?

<comment><USER10> Sure. <http://mediawombat.com> does that very thing. The website is stored on a hosted machine somewhere in Florida and the actual media is stored on Amazon's S3 and loaded via the browser on demand.

<comment><AUTHOR> Cool ... that looks to be the cheapest solution.

Possibly use a shared deluxe to host site on 1.2TB bandwidth a month, then all the storage and streaming of audio files from S3.

<comment><USER14> > Possibly use a shared deluxe to host site on 1.2TB bandwidth a month, then > all the storage and streaming of audio files from S3.

If you mean some kind of shared hosting, I would strongly advice against it. If you are looking at 50k - 100k users a month, you would need good amount of RAM and CPU to do stuff like re-encoding mp3 files (you will have to do this as flash does not support many kinds of mp3 files)

There is other stuff too .. atleast go for a VPS. We are hosted on one and the experience has been brilliant so far.

</comment></comment></comment></comment><comment><USER15> youtube scaled on serverbeach. 'nuff said frankly.

I however would do AWS without question. (already on AWS, was on serverbeach - loved them though)

<comment><USER16> Actually, youtube was on serverbeach _until_ they had to scale. They immediately moved to colo and CDN.

</comment></comment><comment><USER17> I wonder what Justin.TV uses?

<comment><USER18> I think in addition to their own servers, they use AWS [http://www.slideshare.net/tracylaxdal/justintv-aws-the- start...](http://www.slideshare.net/tracylaxdal/justintv-aws-the-startup- project)

<comment><USER16> That's a little out of date. We have a few racks and several 10,000mbps uplinks.

</comment></comment></comment><comment><USER19> does user=visit for small user sets? We get about 15k visits/mo but only 300 users.</comment>


Dept. of Homeland Security: Laptops, Phones Can Be Searched Based on Hunches - <AUTHOR> http://washington.cbslocal.com/2013/06/05/dept-of-homeland-security-laptops-phones-can-be-searched-based-on-hunches/

<comment><USER3> _We do not believe that this 1986 approach, or a reasonable suspicion requirement in any other form, would improve current policy,"_

Well, yeah... the State would clearly prefer a "1984 approach".

We have always been at war with Oceania...

</comment><comment><AUTHOR> To me, this means that any electronic device you carry across the border should be considered, as much as possible, throw away.

Not that I cross the border all that often.

<comment><USER4> Or have its contents encrypted with a password that you don't have in your possession.

<comment><USER5> I'm not sure how wise that would be. Would be somewhat like handcuffing oneself with handcuffs and not having the key.

Official: What is the password? Person: I don't know Official: Why wouldn't you know the password to your own laptop? Either you're lying, or you're definitely up to something nefarious.

<comment><USER6> Think armored transports where the driver's don't have keys to the storage area.

Person: "I'm just a glorified delivery boy, they don't trust me with the company secrets."

<comment><USER5> A similar example are couriers who travel handcuffed to a briefcase - <USER2> keys for neither.

However, in both these examples there is a very important difference. A thorough strip search would reveal that the person does not in fact have the required/desired keys.

Also, usually such people have superiors who may be contacted in order to get access (if they want to push it that far). I'm not sure if a person could use such a defence if they are a normal traveller or their company does not carry much weight.

<comment><USER4> There's the rub. Law enforcement can't prove that you have the keys (unless you volunteer them), and that's why being forced to unlock something is a violation of the 5th amendment (since the ability to unlock the data is by itself an admission of possession).

There was a case - I don't recall the specifics - of a guy that was caught with child porn on his computer crossing the Canadian border. The courts compelled him to unlock his encrypted partitions _because_ he had already unlocked them once (when asked to by the border agent) thereby proving that he had access to the keys. If he had never unlocked it in the first place, the fifth would have protected him against being compelled to decrypt the data, since the act of unlocking it would in effect be a coerced admission that the data was his.

</comment></comment></comment></comment></comment></comment><comment><USER7> Are we even trying to pretend like we care about the constitution anymore or do we really think that "terrorists" must be caught _at any price whatsoever_?

(serious question)</comment>