The most honest Ponzi scheme of all time - <AUTHOR> https://ponzischeme.io <comment><USER2> I know this is a joke, but there are numerous real life Ponzi and pyramid schemes based on Ethereum smart contracts. PonziCoin, PoWH3D, and EthPhoenix transparently advertise themselves as Ponzi/pyramid schemes. There's also a whole genre of "hot potato" collectible games that operate like pyramid schemes. CryptoCelebrities and CryptoKitties are a couple well known games in this genre.

Personally, I don't think there's anything unethical about transparent pyramid schemes. They're essentially gambling games where players bet on the greed of other players. The greediest players end up "holding the bag" while every one else makes money. These games can be pretty profitable if you play conservatively.

<comment><USER3> >The greediest players end up "holding the bag" while every one else makes money.

Bag holders aren't the greediest players they're the last players.

>These games can be pretty profitable if you play conservatively.

Huh? How exactly do you play ponzi schemes conservatively?

<comment><USER4> > Huh? How exactly do you play ponzi schemes conservatively?

Get in and out quickly taking the, presumably higher-than-normal, ROI with you. Typically with ponzi schemes, folks put in and keep their money in to compound because, on paper, they have insane ROIs. Their greed blinds them to the "too good to be true."

Still, Ponzi schemes _do_ payout to some amount of people, those who pull out before it is too late. None of this is to say you won't be left holding the bag, but if you're an "in-and-out" player you have a better chance of not being the one left holding the bag compared to those who see fake numbers and let greed wash over them.

</comment></comment></comment><comment><USER5> "Want to join our marketing team? Tweet about us!"

Funny _and_ profound

<comment><USER6> Of everything on the page, this was particularly clever.

</comment></comment><comment><USER7> What is so great about this is that in today's age anyone can create a great looking website, appear professional and really pull off things like this. Use fancy job titles, like Second Layer Expert (lol) and invent a bunch of other nonsense that sounds innovative and disruptive, as well of course publish the code to be open. It's a great prank, unfortunately backed by too many real world cases that do exactly that, and make people lose money.

<comment><USER8> > ...anyone can create a great looking website...

The last time I tried to design and code a landing page myself it took me way more time than expected and the website ended up looking like shit. It is not easy as people think. (Or I am a noob, that is also an option.)

<comment><USER9> There are great templates available for $15. Anyone with basic html skills can download one and change the values between html tags. I'm assuming you tried to make one yourself, which in fact is tough and would require multiple people to pull off.

</comment></comment></comment><comment><USER10> This is obviously an April Fools' Day joke, but it shows what is wrong with crypto-backed projects (ICO's etc)

<comment><USER11> April Fools' Day joke or not, a project exactly like this one existed way before today.

[https://ponzicoin.co/home.html](https://ponzicoin.co/home.html)

<comment><USER12> And the one I made before the project you mention:

[https://ponzico.win](https://ponzico.win)

The real fun is the whitepaper (some of my better work): [https://ponzico.win/ponzico.pdf](https://ponzico.win/ponzico.pdf)

But yeah, PonzICOs are turtles all the way down.

<comment><USER13> That whitepaper is damn good.

<comment><USER12> Thank you, truly! Satire is my passion, and whenever folks enjoy my work I feel a deep sense of pride.

<comment><USER14> Follow your dream -- the world needs satire now more than ever. (Though I would prefer [twocolumn].)

</comment></comment></comment></comment></comment></comment><comment><USER15> Meh, there was one in Russia 2y ago. Called MMM 2.0. MMM 1.0 was also Ponzi, but not honest.

So the guy behind them got prosecuted for MMM 1.0, finished his sentence and then did 2.0 honestly.

<comment><USER16> Was it _exactly_ two years ago, 1 April? :-)

<comment><USER15> No, it was not :(

</comment></comment></comment><comment><USER17> This reminds me of the time I was approached to join a multi-level marketing scam affiliated with Transamerica. Their contact phone number was 1-800-PYRAMID. I was like "Well, at least they're up front about it and put it right there in the phone number."

</comment><comment><USER18> I wouldn't mind investing in an honest ponzi scheme as long as honesty tapered off over time as the number of people joining grow, and there's no restriction on when you can pull out. I would have loved the super charged returns in Bernie Madoff's early days.

<comment><USER19> I suppose any greedy person wouldn't mind "investing" in a Ponzi scheme at the point you can still make bank on it. And of course all ponzi scheme have such a phase, that's how they work.

</comment></comment><comment><USER20> This is great. So many little touches.

Have a look at the licensee agreement. [https://ponzischeme.io/images/rules.gif](https://ponzischeme.io/images/rules.gif) Elon?

</comment><comment><USER19> Turns out, Ponzi schemes are illegal even if they are honest about it.

</comment><comment><USER21> I love the roadmap!

</comment><comment><USER22> 90% return... amateurs!

</comment><comment><USER23> view source also

<comment><USER24> For your convenience, this is what it says on top:

        <!--

            MMMMMMMMMMMMMMMMMMMNmdysoo++////++oosydmNMMMMMMMMMMMMMMMMMMM
            MMMMMMMMMMMMMMMNhs+//////////////////////+shNMMMMMMMMMMMMMMM
            MMMMMMMMMMMMmy+//////////////////////////////+ymMMMMMMMMMMMM
            MMMMMMMMMMho////////////////////////////////////ohMMMMMMMMMM
            MMMMMMMMh+////////////////////////////////////////+hMMMMMMMM
            MMMMMMd+////////////////////-..-////////////////////+dMMMMMM
            MMMMNs//////////////////////`  .//. `.////////////////sNMMMM
            MMMN+///////////////-`..-::-   ://   -/////////////////oNMMM
            MMN+////////////////`          .-.  `///////////////////+NMM
            MN+///////////////////:.             `.://///////////////+NM
            My/////////////////////-     `:-.`       .////////////////yM
            m//////////////////////`     ://///:`     `////////////////m
            y/////////////////////-     `///////:      :///////////////y
            +/////////////////////`     .::////:`     `////////////////+
            /////////////////////-                   .//////////////////
            /////////////////////`     -:-.``      `:///////////////////
            +///////////////////-     `//////:-      `/////////////////+
            y///////////////::/:`     :////////:      .////////////////y
            m//////////////.         `/////////.      -////////////////m
            My/////////////.``          ``...`       `////////////////yM
            MM+/////////////////:   `               .////////////////+MM
            MMN+////////////////-   :/:   ....``..-/////////////////+NMM
            MMMNo///////////////`  .//.  `/////////////////////////+NMMM
            MMMMMs//////////////::-///`  -////////////////////////sNMMMM
            MMMMMMd+////////////////////:///////////////////////+dMMMMMM
            MMMMMMMMh+////////////////////////////////////////+hMMMMMMMM
            MMMMMMMMMMho////////////////////////////////////ohMMMMMMMMMM
            MMMMMMMMMMMMmy+//////////////////////////////oymMMMMMMMMMMMM
            MMMMMMMMMMMMMMMNhs+//////////////////////+shNMMMMMMMMMMMMMMM
            MMMMMMMMMMMMMMMMMMMNmdysoo++////++oosydmNMMMMMMMMMMMMMMMMMMM

            .:</comment></comment><comment></comment><comment>-----[ BUY & HODL BITCOIN ]</comment><comment></comment><comment>-----:.
            |                                                          |
            |  * 03 JANUARY 2019:                                      |
            |  Bitcoin will be 10 years old. Even the most skeptical   |
            |  media will announce that "Bitcoin is here to stay".     |
            |  Read about https://en.wikipedia.org/wiki/Lindy_effect   |
            |  and its influence on technology adoption.               |
            |                                                          |
            |  * 31 MAY 2020 (estimation):                             |
            |  The reward for mining a block will be cut in half.      |
            |  Bitcoin's inflation rate will be lower than Gold's.     |
            |                                                          |
            |  * 24 JULY 2020 - 09 AUGUST 2020:                        |
            |  Japan, one of the most cryptocurrency-friendly markets, |
            |  will be hosting the Summer Olympic Games. Thousands     |
            |  of tourists will visit the country where, as a result   |
            |  of technological progress, Bitcoin payments could be    |
            |  something normal.                                       |
            |                                                          |
            |  LAST BUT NOT LEAST:                                     |
            |  Technology advancements on every important field:       |
            |  security, privacy, speed, fees, UX.                     |
            |                                                          |
            ':</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>--:'

        -->

<comment><USER25> Thanks! Wouldn't have seen it without this comment, and it's a clever addition.

</comment></comment><comment><USER26> Aside from being an April Fool's joke, the site is very hard to read, especially the "contract".

</comment><comment><AUTHOR> > If you're working for the U.S. Securities and Exchange Commission you can > contact me by dedicated email address: firstname.lastname@example.com

</comment><comment><USER27> 10/10 would invest

<comment><USER28> Well, invest!

Seriously, there's more hidden gems in the webpage when you try to invest.</comment></comment>


Expect Some Unicorns to Lose Their Horns, and It Won't Be Pretty - <AUTHOR> http://www.nytimes.com/2016/01/20/business/dealbook/expect-some-unicorns-to-lose-their-horns-and-it-wont-be-pretty.html <comment><USER3> I was pleasantly surprised by this article.

I expected the usual 'the end is nigh, the bubble has popped, unicorns are screwed, we're all screwed' article. Instead, I was happy to find that it was about some of the ways that unicorns could or may have to protect employees, founders and early investors from down rounds. Purely as an educational experience, this article is certainly worth a read.

<comment><USER4> Yeah, it really is interesting to see the situation from multiple perspectives. I still wonder though, is this actually happening? Nothing in the many articles I've read suggests solid evidence that a majority of these companies are struggling. Just sound bytes from VCs pontificating.

<comment><USER5> "Struggling" is not the same as "no longer able to justify a highly optimistic valuation". Many unicorns could actually be profitable and still never justify a $1B+ valuation.

</comment></comment></comment><comment><USER6> It's been argued that the deal structure of companies, particularly unicorns, has begun to look like debt[1].

Low interest rates and easy money has created debt. Massive bubbling amount of debt. Crashing debt bubbles is not fun, just ask anyone that lost their shirt in 1929. There is a paper[2] from this past June that goes deep into this, highlighting how and why debt bubbles are so dangerous. TL;DR? At least checkout this Bloomsberg article[3].

I think there will be a number of unicorns that are successful. I don't even think this will only be those that are profitable. Like always, there are companies that are overvalued, and some that are undervalued. I don't think it's a 10/90 split as has been suggested by some, but the next couple years will certainly be interesting.

[1] [http://blog.samaltman.com/the-tech-bust- of-2015](http://blog.samaltman.com/the-tech-bust-of-2015)

[2] [http://conference.nber.org/confer/2015/EASE15/Jorda_Schulari...](http://conference.nber.org/confer/2015/EASE15/Jorda_Schularick_Taylor.pdf)

[3] [http://www.bloombergview.com/articles/2015-06-26/the- reason-...](http://www.bloombergview.com/articles/2015-06-26/the-reason-debt- bubbles-are-worse-than-stock-bubbles)

<comment><USER7> Have to disagree. They're still preferred equity instruments with unique trigger provisions. Higher up in the capital structure but not debt; you can't credit bid using these instruments in a Chapter 11 scenario and they aren't afforded the same protections in bankruptcy court. What attracts investors to debt instruments are the interest payments. You'd prefer PIK (payment in kind) interest on debt as opposed to cash payments in a low interest rate environment but that doesn't translate to pref equity instruments.

The unique feature of debt vs equity is that debt has a concave investment profile; you know exactly what you should be getting upon maturity (principal + interest payments). Equity has a convex investment profile; you get the residual value after subtracting face value of debt from the enterprise value.

<comment><USER8> Great points.

I think the confusion is due to the fact that debt can (and will) be restructured in a downturn, just as equity will lose value. So they're both risky when you make a poor investment.

But, as you note, debt and equity both have distinct risk and payoff profiles that are determined by law.

</comment></comment></comment><comment><USER9> Am I reading this right?:

      1. Early investors overvalue a company at $X+Y
      2. Investors give money and get Z preferred shares at valuation $X+Y
      3. New investment round, company valued at $X
      4. Wealth transferred from founders and employees -> original investors to cover the difference $Y

<comment><USER10> Yes, that is how 'liquidation preferences' work.[1] I strongly recommend reading/watching Mark Suster, who (in my opinion) does a good job at explaining investors and terms.[2][3]

[1] [https://en.wikipedia.org/wiki/Liquidation_preference](https://en.wikipedia.org/wiki/Liquidation_preference)

[2] [http://ecorner.stanford.edu/authorMaterialInfo.html?mid=2516](http://ecorner.stanford.edu/authorMaterialInfo.html?mid=2516)

[3] [http://www.bothsidesofthetable.com/](http://www.bothsidesofthetable.com/)

<comment><USER11> Just thought I'd point out that the example given doesn't tell us anything about liquidation preferences (though of course you can assume they would be involved, since we're talking VCs here, but they don't matter).

The relevant financing term here is anti-dilution. Here's Feld: [http://www.feld.com/archives/2005/03/term-sheet-anti- dilutio...](http://www.feld.com/archives/2005/03/term-sheet-anti- dilution.html).

</comment></comment></comment><comment><USER4> This is almost becoming a self-fulfilling prophecy. Enough articles are written calling for down rounds, now investors are thinking down rounds, employees are sprucing up their resumes, lawyers are preparing for battle...

Can anyone really say if there is any proof to this rhetoric. Are these companies really in such bad shape?

*edit: spelling

<comment><USER12> > Can anyone really say if there is any proof to this rhetoric. Are these > companies really in such bad shape?

One thing is for sure, you can't look at companies/startups or VC in a vacuum.

You'd be wise to look at financial markets as a whole and all the interdependent factors that __might__ be leading to a situation similar to 2008/9 or worse; another housing bubble, weakness in energy markets, banks exposure to housing and energy, weakness in emerging markets (China, Brazil), tightening monetary policy, sovereign debt crises, geopolitical risk, etc.

If investor and consumer confidence really start to slide, yes, valuations will take a hit.

That's not to say that some unicorns and other companies can't still be wildly successful.

<comment><USER13> Technically we don't know until the SEC filing. This is why IPOs become down rounds.

Sometimes a public ally traded institutional investor can shed light on a private companies value based on required public disclosures.

</comment></comment></comment><comment><USER14> If I were a founder who wanted to make sure employees and founders get a better deal, what are my options?

Can I accept money from investors only on the condition that they get paid only after employees and founders get paid a minimum amount, like $1M each?

The stronger version of idea is to not grant stock / stock options to employees (or grant only one share if needed for legal reasons). Instead offer a guarantee that only after they earn some large amount, enough to retire, say $10 million, will any investor receive anything. Employees would never make more than $10 million, but they would maximise the chance of making $10 million. This would make the startup a less risky place for an employee to work, assuming the goal is to maximise the probability of making enough to retire. Then the investors can have whatever liquidation preferences, seniority, ratchets and so on, as they want, and it wouldn't matter to either the founders or the employees.

I'm willing to accept a lower valuation (the certainty of a $100 million company is more important to me than a 20% chance of a billion dollar company).

Does this make sense? Would you suggest a different approach to reduce risk for founders and employees?

<comment><USER15> I'm confused. Employees and founders get a salary. There is no risk to them. If the company fails the investors lose millions of dollars, the founders and employees leave with 1-2-3 years of salary in their pockets and then go get another job.

That is why investors get paid first. Am I missing something? I guess I don't understand where this idea that founders and employees should get paid first. In guessing because the did the work but they seem to be forgetting they also got paid for the work. As a startup it might have been less than some other jobs, in compensation they took some tiny tiny risk that if the company is successful they get a taste. But they risk is orders of magnitude less than the investors.

Sorry if I'm not understanding

<comment><USER16> The ethics of this go deeper than what you describe. If Warren Buffett invests 1m in a company, is he in a riskier position than if a McDonald's clerk were to invest 10k in the same company? The absolute dollar value is not the only way to gauge risk exposure.

<comment><USER14> Not only is the McD clerk less able to afford loss, she doesn't get the opportunity to diversify risks, as Warren Buffett does by investing in many companies.

</comment></comment></comment></comment><comment><USER17> I expect 'unicorn' references to horns and such to be thoroughly worn out by the end of the year.

<comment><USER18> You mean by the end of January.

</comment></comment><comment><USER19> When I read old case studies like WebVan it is hard for me to believe in a bubble. I do think their valuations are too high, but they certainly aren't zero--more than half of the people I know have taken and Uber or Lyft more than once, for example.

<comment><USER20> WebVan isn't the right analogy - a real estate bubble is a better one.

In the .com bubble, no one was really sure how things would shake out, so there were lots of companies who wouldn't have succeeded no matter how big they got (the "losing money on every sale but making it up in volume" business plan). When the .com bubble crashed, real estate was seen as a much stronger investment because no matter how low it went, it was real "stuff" that had a sort of intrinsic value - it may go down, but it wouldn't go to 0. A similar thing happened in Tokyo real estate circa early 90s. A Tokyo apartment still has a lot of value - you'd probably think it very expensive - but it's still 80% cheaper than it was at its peak.

The problem with lots of companies now isn't that they won't ever be profitable, or that they don't have realistic business plans, it's just that their valuation is way more than their earning stream will ever support. They are valued at "we'll eventually take over the market" prices, even though they'll only ever reach niche market status.

<comment><USER21> This is a great explanation. Remember that the value in a stock is that you're owning X% of a business just like if you owned 100% of a coffee shop.

If you buy a coffee shop for 10% @ $100,000 that makes $10k/year you just bought a company for a P/E of 10. The value of a stock in that company is in the growth of that 10k over time that is either paid as a dividend or retained and valued in to the price of the stock. If you don't make money, or make much less than what you could be expected to grow, their value will fall.

</comment></comment></comment><comment><USER22> Any thoughts on which unicorns are more situated to "weather the storm" and which aren't?

<comment><USER23> Flipping through the list, my top 3 are Palantir, Spotify, and Zenefits.

I think Uber or Airbnb will stay and become huge, but they might both be overvalued.

<comment><USER24> I don't think you are viewing this through the right lense. Valuations are a point in time vs. thinking about a company as a long-term investment - <USER2> should more think about which of these businesses has the best long-term potential to become the winner in a massive market, with a strong "moat" that makes it hard to compete, as well as extraordinary margins.

Based on that criteria, Uber & AirBnB should be on top of this list, followed by Palantir and Stripe. Zenefits has not really shown the type of defensible traction that Uber / AirBnB have (right now they are simply a rapidly growing insurance agent with a difficult-to-scale direct sales model). I would not add Spotify to this list - bad margins, and hard to defend against Google / Apple.

<comment><USER25> I'm not going to speak to their ability to become winners in massive markets, but I don't see how Uber or AirBnB have a strong moat that makes it hard to compete. Both seem extraordinarily easy to switch away from to a competitor. Many drivers already drive for both Uber and Lyft at the same time, and it's very easy for consumers to use both apps. I haven't used AirBnB, but it seems like it would be easy to list your apartment/house on multiple marketplaces.

<comment><USER24> Both of these businesses have what are called supply-side network effects ([https://en.wikipedia.org/wiki/Network_effect](https://en.wikipedia.org/wiki/Network_effect)), which are not as strong as demand-side effects, but can still lead to dominant market positions. In more concrete terms this means that for you as a consumer, there is no DIRECT additional value of someone else joining the service (you don't care if your friend joins Uber), but the value of the service does go up with every additional supplier that joins the network (for Uber, this would mean shorter wait times when you want a car, etc.) The defensibility of these types of services is created through their supplier network, and their ability to create more value for those suppliers (and consequently consumers as well) that the competition. Uber / AirBnB can then use the revenue from their leading market position to innovate faster than their competition, create more services for consumers, pay for distribution / new customer acquisition, spend money on marketing and awareness, etc. all of which leads to them creating a massive moat around their market that makes it nearly impossible for anyone to compete with them.

</comment></comment></comment></comment></comment><comment><USER26> What are the best books about the 2000 dot-com bubble?

<comment><USER27> This is all you need to read:

[https://web.archive.org/web/20050715000000*/http://www.fucke...](https://web.archive.org/web/20050715000000*/http://www.fuckedcompany.com/)

<comment><USER28> Founder of Fuckedcompany here.

Thanks!

I wrote a book, too:

[http://www.amazon.com/Fd-Companies-Spectacular-Dot-com- Flame...](http://www.amazon.com/Fd-Companies-Spectacular-Dot-com- Flameouts/dp/1416577939)

<comment><USER26> Do you have a backup of your old website? Archive.org "backup" is incomplete...

</comment></comment></comment></comment><comment><USER29> Boy oh boy, this is all we talk about anymore. Always specifically in the language of unicorns too. People seem to have really latched on to that.

<comment><USER30> You're getting downvoted, but there's lots of value in your statement. Language is important, and the choice of words will frame narratives and reveal hidden truths and agendas.

The press and HN/etc DOES talk a ton about unicorns. It's the only grade that has its own name. There's no word for a $10-25m startup, or a $100-500m startup. No, only $1B-unicorns. They have their own name and we're obsessed with them. This either highlights or promotes the notion that investors (and entrepreneurs?) are only interested in billion-dollar companies.

<comment><USER31> $10-25M: Goblin $25-50M: Elf $100-500M: Centaur

Please let this catch on.

<comment><USER32> I'd really enjoy "wizard" to be the graduated rank, like when you're officially huge and profitable. Then, iOS/Android dispute becomes a wizard battle.

</comment></comment></comment></comment><comment><USER33> Having had a front row seat to the popping bubble in 2000: I can't think of a single instance where wash-outs (which is really what is being described in the article) led to a wonderful outcome for employees.

Any other old-timers around that can name any?

<comment><USER34> Well, I did get to keep a nice office chair from the office cleanout that I still use ;-)

</comment></comment><comment><USER35> All the more reason to go public and have some liquidity in your shares.

I remember being at Intel in 1999 when the share price was 72. six months later it was down around 18. There was one smart senior engineer there that had put options as insurance against all his shares. The rest in that group had to rethink retirement.

<comment><USER24> << There was one smart senior engineer there that had put options as insurance against all his shares.>>

Not sure what the rules were at that time, but most public companies restrict you today from owning any derivatives in their stock.

<comment><USER36> How could a company find out that you bought put options on their stock?

</comment></comment></comment><comment><USER37> Haven't we been 'expecting' this since 2012, yet the biggest, most successful unicorns keep going up in value.

For all the hype and doom about Square stock, the price is back to where it was when it began trading a month ago, although it has fallen 20% in recent weeks.

But this is a good opportunity for employees to understand the risks of stock options, but it's not like the world is coming to an end. Such risks have always existed.

<comment><USER38> Here's a 5 year old poll from HN: [https://news.ycombinator.com/item?id=2231352](https://news.ycombinator.com/item?id=2231352)

The majority had a pessimistic outlook at at least thought "something is going on".

</comment></comment><comment><USER39> It would be interesting to see if more founders take money off the table in high value rounds as a hedge against down rounds. It's not mentioned but while the founders may lose value in their common shares a lot of them have been able to cash out in the good rounds giving them a nicer cushion compared to straight employees

<comment><USER40> Founders can take more money off the table, but that doesn't solve for the bigger problem of down rounds mentioned in the article: employees leaving.

</comment></comment><comment><USER41> Sometime fake valuations. "I give you a boatload of money for a small piece of your company" Doesnt mean the market or the prowess of the company will scale way up beyond that small piece. Reminds me how they pumped IPOs in the late 1990s.

</comment><comment><USER42> META: Am I mad or has the term "Unicorn" suddenly blown up and now every news outlet has to somehow shoehorn it into all their articles when dicussing anything startup related?

I really don't recall the phrase before maybe a few months ago?

</comment><comment><USER43> This article needs a glossary.

</comment><comment><USER44> Don't the late stage investors get hurt in these deals also? Why would they get in at such a high valuation?

<comment><USER45> I believe that some startup founders/execs have optimized for valuation at the expense of costly liquidation preferences for late stage investors.

</comment></comment><comment><USER46> Sometimes businesses fail, even after early success. And the NEW YORK TIMES IS ON IT!</comment>


Ask HN: What would you use a Print API for? - <AUTHOR>

I haven't seen any good API's for printing - on paper, that is.<p>With the Front-Page launch of Pantastic (http://www.pantastic.co), I wonder: what would other developers would do with access to a professional printer (via an API)? <comment><USER4> \- Personal Cards (hallmark just isn't doing it for me these days) \- B2C - Appointment Cards, Thank you cards (clients) - with link to review product or some unique code \- Party/Event invitations -> Mail is so retro - <USER2> getting invited to a party with a qr code or short URL to "confirm" - built a tool to send personalized invitations and/or thank you notes \- Networkers - <USER3> would LOVE to be able to snap a pic, have the person in my CRM and/or their business card and send a great meeting you letter with the pic of us on the front. Fastest way to make an impression - Worst case have a tool/api that emails the customer saying - John wants to send you something - please fill out a mailable address, etc. - A bit sketchy but kinda cool!

<comment><AUTHOR> All great ideas - perfect use case for a flexible api

</comment></comment><comment><USER5> Would anybody be seriously interested in this? I'm currently writing code for a printshop that does fine-art reproductions of various size on paper, canvas, and stretched canvas.

We're somewhat under our print capacity and I could easily justify the time building an API on next to our shopping cart and fulfillment backend if anybody has genuine demand for on-demand high quality prints and reproductions.

Shoot me a message: email@example.com if you'd use the api.

</comment><comment><USER6> I'll be using <http://uk.moo.com/api/> to let customers print out quick-access cards for a SAAS product.

<comment><AUTHOR> Nice, but seems too limited and poorly documented for me personally.

</comment></comment><comment><USER7> I intend to use Pwinty.com for offering reprints from my photo booth. Just haven't had the time to put it all together yet.

<comment><AUTHOR> This looks like a great solution, thanks for the share!</comment></comment>


Everything you Know About XHTML Is wrong - <AUTHOR> http://diveintohtml5.org/past.html#xhtml <comment><USER2> Most people prefer XHTML syntax, that's why they use XHTML doctype in HTML documents. There's nothing wrong with it.

</comment><comment><USER3> My issue with this draconian failure stuff is that (in Firefox at least) view source yields no content when it finds an error in page & obviously the line number it gives for the error can be very far removed from the underlying code.

</comment><comment><USER4> Should an XHTML document start with a typical <?xml version="1.0" encoding="UTF-8" ?> header?

<comment><USER5> Depends if you target the browsers HTML parser or XHTML parser.

Include it if you target the XHTML parser. (Note that if you target the XHTML parser, IE will not show the document at all.) Leave it out if you target the HTML parser. (But if you target the HTML parser, you might as well use HTML.)

Theoretically you could target both HTML and XHTML parsers with the same document, e.g. by using content negotiation. Since this is a lot of hassle and has no real benefit, not a lot of people does this. But in this theroretical case the correct is to leave the prolog out, since it is optional in XML and illegal in HTML.</comment></comment>


Every last drop - <AUTHOR> http://everylastdrop.co.uk/

<comment><USER2> So who actually takes a five minute shower?

Mine consistently take 10 or 15.

(Weather or not it would be better to take a bath or take a shower is one of those questions that I'd like to know the answer to but don't care enough to research.)

<comment><USER3> It's better (for the environment) to take a bath. You fill up the water once and you're done. Shower is a constant stream.

</comment></comment><comment><USER4> amazing UI made with HTML5 & CSS3</comment>


Can any Facebook employee give me a tour at HQ in Menlo Park - <AUTHOR> I'm a Grand Prize Winner of Google Code-in 2018-2019 and one of the rewards for GCI GPW is a Trip to San Francisco and Google HQ in Mountain View for 4 Nights. In those days we visit the Google HQ, visit different parts of San Francisco and do other fun activities. I decided to extend those 4 nights and stay actually 3 more days because I really want to visit more on my own(and my dad) different parts of Silicon Valley. It is my biggest dream to go there so now it actually happens. I would really like to visit Facebook HQ in Menlo Park in one of the free days but I don't know who I could contact so there I am writing to you. Do you think is it possible somehow to arrange a visit for me and my dad in any of the days (28 June - 30 June)?
I would really appreciate if you could help me somehow or get me in contact with other people that may be able to help me. :)
Thanks! <comment><USER2> You also don't want miss the Computer History Museum and the Intel Museum.

<comment><AUTHOR> Thanks! I'll put that on my list

<comment><USER3> I'd recommend blocking off at least 6 hours for this. There are so many interesting exhibits and informational placards to read. It's well worth it though.

<comment><AUTHOR> Thanks!

</comment></comment></comment></comment><comment><USER4> I just talked to a recruiter and got a tour for several friends and I just so they could encourage me to consider interviewing.

Determined I didn't want to pursue working there in the end because I have ethics, but overall it was the best interview process, best interview questions, and possibly the most fun looking campus I have been to in the area.

Also they use super easy to clone HID cards for all their offices if you did want to pop in a side door and take a self guided tour. Security is not their strong suit. ;)

<comment><AUTHOR> Haha I wouldn't consider cloning a card tho. Would you be able to put me in contact with the person who got you a tour?

<comment><USER4> That particular contact is no longer at Facebook however if you email a couple Facebook recruiters on linkedin and have a resume that checks some of their engineering experience boxes, I expect you will get your desired result.

</comment></comment></comment><comment><USER5> Perhaps you could share a little more background about yourself and your interests (EG front end Development, extensive experience in X, 'I love to ski', etc.)? While I am not a Facebook employee, my wife is (we left the bay area a year ago, however, so she would not be able to help you directly).

Facebook employees are incentivized to bring in top-tier talent, so knowing your background might help uncover a person in a similar org with similar interests that could get to know and trust you before putting their reputation on the line.

Just my thoughts/2 cents - but given how embattled Facebook has been over the last 6 to 12 months I would want to build some trust before putting my reputation on the line if I was working for the 'book.

Good luck!

<comment><AUTHOR> Hi, thank your for taking your time to respond, I really appreciate it. I'm not sure if this helps but I have most of the stuff I've worked on my website [https://alexmarginean.me](https://alexmarginean.me) (I haven't updated it in like 2 months so I should do it right now).

<comment><USER6> Just a friendly suggestion: If someone asks you about yourself (especially someone who is potentially able to help you with what you're looking for), take the time to tell them about yourself instead of just linking to your website.

You could then finish with something like "Feel free to see my website for more info!", but doing otherwise just makes it feel like you aren't putting in the effort.

Good luck though, and congratulations!

<comment><AUTHOR> I also sent a mail but yeah I haven't explained much stuff there either. Good point though, I thought that might not have been the best thing to do but I've been contacting people for about a month, telling them about me but none would help..

</comment></comment></comment></comment><comment><USER7> reach out to recruiting, college recruiter, they should be able to help setup something if you are interested

<comment><AUTHOR> I don't know how to get in contact with them. I tried through LinkedIn but most of them either didn't connect or refused to help me.

</comment></comment><comment><USER8> I sent your information over to someone. If they're able to help they will reach out.

<comment><AUTHOR> Thanks a lot!! I really appreciate it

<comment><USER8> Okay! My girlfriend will email you tomorrow to try and set something up with an engineer at FB (she's a recruiter).

</comment></comment></comment><comment><USER9> Perhaps try writing to some FB folks on FB itself or Twitter?

Congratulations, and enjoy!

<comment><AUTHOR> I tried on LinkedIn but most of them can't help or they don't want to.</comment></comment>


Chrome addons hacking: Bye Bye AdBlock filters - <AUTHOR> http://blog.kotowicz.net/2012/03/chrome-addons-hacking-bye-bye-adblock.html?spref=tw <comment><USER2> His tone when he talks about extensions modifying the DOM of random sites, injecting CSS, etc was funny; almost as if they have some god-given right to control exactly how their site will appear on my computer. As long as I control the browser software, it's always going to be possible for me to choose how web sites are displayed on my computer.

</comment><comment><USER3> Bye bye scripting with noscript and scriptno. This is nifty but if people don't want ads people won't have ads. As someone who makes most of his money off of ads I understand the want to stop ad blockers but I rather just provided a good, clean experience and when an ad is blocked put up a nice message saying how I make my money off of ads and to please disable ad block on my website.

This method seems intrusive to me and like an "Ah ha! I stopped your ad blocker from working! TAKE THAT!"

<comment><USER4> But then again, putting ads on web pages is already a matter of "Ah ha! I fooled you into downloading ads by offering you content! TAKE THAT!"

As far as I'm concerned, putting ads on web pages has always been an intrusive an deceitful business model to begin with. I sincerely hope that there will come a day when advertising via ambushing consumers is no longer considered acceptable.

<comment><USER5> Most people know that when they go to a web site, if they are not paying for it, then there is going to be ads on there. If they are put right in the open how is that deceitful?

<comment><USER6> Just because that's the way it is, doesn't mean it's the way it should be.

If you know you will be ambushed and robbed on your way through the forest, would you also say "well, that cannot be helped, people know that when they enter the forest" (excuse me for the rather harsh analogy, it's the best I could spontaneously come up with).

<comment> vertex-four Sending you advertisements along with your content is _not_ the same as taking something from you.

<comment><USER6> Thus my acknowledgement of the bad analogy. The point I was trying to make is that even if you know in advance that something undesirable will happen, that's still not a justification for said undesirable thing.

<comment><USER7> I respectfully disagree. I understand a good portion of hackers find the entire concept of advertising to be distasteful, but why this melodrama? "Ambush"? Likening it to robbery? Really..?

It's a few hundred pixel banner that's trying to convince you to buy something. Not a requirement that you sacrifice your firstborn.

<comment><USER6> _> It's a few hundred pixel banner that's trying to convince you to buy something._

Yes, and that's undesirable to a lot of people. It's distracting and, depending on the intrusiveness of the ad(s), annoying to outright rude. It's gotten to the point that it's hard for me to use the internet when I'm on a computer without a decent ad-blocker. Imagine trying to read a book while a bunch of persons are screaming inane stuff at you; that's what it feels like.

Actually, I long for the day when display goggles and computer vision have advanced far enough for a "real-life ad-blocker". The world would be a much better place.

I didn't intend to liken displaying ads to heinous acts of infanticide or anything of the sort.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Domain-based ad blocking rules cannot be bypassed this way in Chrome if you are running a development build of Adblock Plus (<https://adblockplus.org/en/development-builds>) on Chrome, which makes use of Chrome's new WebRequest extension API.

<comment><USER9> This troubles me. If ad blocking can not intercept HTTP calls, why even bother hide them?

The point of ad blocking is saving bandwidth and speed up page browsing dramatically.

I am going to block all thirdparty javascript with WebRequet extension API.

<comment><USER10> All the Android ad blockers work by modifying the hosts file and null routing ad servers.

Requires rooting and it blocks ads in everything not just the browser.

<comment><USER9> Not really requires rooting if you have a customized DNS server.

</comment></comment></comment></comment><comment> angry-hacker The first method is also working with Firefox and Adblock Plus.

I remember once Adblock became popular, there were few sites blocking users with Adblock, they calculated some elements height and if the Adblock blocked the ads in that element, the height didn't match. So they disabled the whole page and asked users to turn off Adblock or white-list them.

<comment><USER11> You are incorrect. It does not bypass adblock on firefox. Yes, the ad shows, but that's because it does not trigger any of firefox's blocking rules (assuming Fanboy's list. I didn't check the others). He triggers chrome's by the element of name="google_ads_try". Firefox does not block elements of that name. Firefox's much more powerful plugin architecture allows Adblock Plus on firefox to actually prevent ads from loading; it doesn't insert css to hide them. As such, javascript to try and prevent css injection does absolutely nothing against adblock plus.

As a proof of concept, visit this site (it's his modified to hit adblock plus's Fanboy's List by adding ?bannerid=100 to the end) <http://pastehtml.com/view/bstgyxtln.html> . Turn on and off adblock and notice how, even though I left his anti-adblocking code in, it's helpless to stop firefox actually blocking it.

<comment><USER12> As Sephr notes above, I believe AdBlock Plus fully blocks resource loading in Chrome with the WebRequest API.

[http://code.google.com/chrome/extensions/trunk/webRequest.ht...](http://code.google.com/chrome/extensions/trunk/webRequest.html)

Does anyone know why it fails here then? It looks like there might be some other issues with the dev version, so maybe the new method of blocking just hasn't moved into the full version of ABP for Chrome yet?

</comment></comment></comment><comment><USER13> Having used both Firefox and Chrome, Firefox just has a much more powerful extension model which is unfortunate. It's always seemed that Chrome extensions was just a lite version without sufficient thought given to the initial intercept (which would be key for plugins like adblock)

</comment><comment><USER14> I might be wrong, but it seems to me that ad blockers are mostly used by sophisticated users who won't fall into the "you're the millionth user!" scams anyway.

For the ad seller, the bandwidth used to serve non-dumb users is a net loss, so non-trivial-to-install ad blockers are rather beneficial to them if they don't download the resource at all. Even more so if they pay for the ad per view rather than per click.

Disabling the ad blocker remains beneficial to the hosting site, though:

\- if ads are paid per view, more ads unblocked == more money;

\- if they're paid per click, ads will drive away people who never click anyway: saved bandwidth!

<comment><USER15> Not necessarily. Nearly everyone knows a savvy person like us. I've installed Adblock on many computers belonging to less savvy people, people who might be inclined to click on ads.

Also, not all ads are brain dead "you're the millionth user!" type. Some (most?) are targeted to the individual. When I'm browsing with Adblock turned off I see all sorts of ads for web services that I would genuinely consider buying.

<comment><USER16> When I'm doing computer services as part of my side job, I usually install AdBlock and set the option to allow Google ads. I know there are a lot of ads out there which are great and useful and nice and I would like to be seen, but Google's are the only ones I know I can trust to not be large, resource intensive Flash ads hosting malicious exploits.

</comment></comment></comment><comment><USER17> I install adblock to make viewing content on your site bearable. No, I really don't want to know the one weird odd tip of anything, or a flashing banner, or something that starts talking, or these pop-under windows. I can't even use merriam webster without adblock to lookup a word unless I want to get an audio blast of something, a netflix pop-under, and 2-4 other tap dancing gifs surrounding a definition. I can't even pay for an ad-free subscription to the site.

I use adblock to make your site usable. But hey, I understand, you have to keep up the good fight. Keep fighting your users.

<comment><USER18> No need for the self-righteousness. The guy's a web security researcher who's doing AdBlock users a favor by posting this stuff publicly.

If he was actually trying to screw over you rascally freeloaders, he wouldn't be posting instructions, he'd be quietly deploying and profiting.

<comment><USER17> > self-righteousness

I think you've interpreted that as an attack on the article's OP, not the fact that I have to use adblock to make the web usable.

</comment></comment></comment><comment><USER19> FYI when you go here it messes up your Adblock and turns it on for all sites. To fix it go to adblock settings and remove the last entry from the Filter List tab.

</comment><comment><USER20> Without going too in-depth it looks like he is able to modify whatever localStorage list AB is using. I wonder how the extension is reading said list and if it is possible to maybe inject some code- function(){log_all_keys_pesudo_code}- that hijacks Chrome; presuming it is being evaled.

</comment><comment><USER21> Pardon my ignorance, but what would prevent ad-serving websites from totally "inlining" the ads inside their own website html/css/js/? They could even render ads as fonts and vectors graphics, how would an ad-blocker tell that apart from the content part of the web page?

<comment><USER22> Most people use ad networks and ad networks generally don't provide a way to get the ads on the server side. That would also be more complicated than sticking an iframe/script tag on the page for the publisher.

If you don't want to use a network, you have to sell the ads direct yourself - which isn't easy.

<comment><USER21> I am aware that it would be more complicated, but not impossible. I guess for the time being the percentage of blocked ads is still small, but once it gets significant websites and ad providers will take the next step in the arms race

</comment></comment></comment><comment><USER23> I find it strange that facebook doesn't incorporate this in some manner since it is mentioned in their IPO filing that they consider AdBlockers potentially harmful to the business model.

</comment><comment><USER24> The 1st bypass method works on Adblock Plus (for Chrome) too.

</comment><comment><USER25> I'm using the other Adblock extension. Does this affect it?

</comment><comment><AUTHOR> if i would and "adblock" i would use the hosts file <http://winhelp2002.mvps.org/hosts.htm>

</comment><comment><USER26> Cannot resize text on mobile? echo kotowicz.net 0.0.0.0 >> /etc/hosts

<comment><USER27> Chrome and Safari extensions being apparently similar, does that impact Safari as well?</comment></comment>


Command execution on Ansible controller from host - <AUTHOR> https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt <comment><USER2> If only we had some form of superluminal communication, it might be possible to patch all the affected systems before they get exploited.

<comment><USER3> Not sure what you are trying to say. Are you trying say that the CVS publication happened too early? If so, the timeline tells a different story:

        2016-12-08	First contact with Ansible security team
        2016-12-09	First contact with Redhat security team (firstname.lastname@example.com)
        2016-12-09	Submitted PoC and description to firstname.lastname@example.com
        2016-12-13	Ansible confirms issue and severity
        2016-12-15	Ansible informs us of intent to disclose after holidays
        2017-01-05	Ansible informs us of disclosure date and fix versions
        2017-01-09	Ansible issues fixed version

<comment><USER2> It was a joke about the name: [https://en.wikipedia.org/wiki/Ansible](https://en.wikipedia.org/wiki/Ansible)

(Well, that plus the fact that this seems like the sort of scary bug which will get exploited very quickly.)

<comment><USER3> I see. This is really astonishing.

I always preferred using plain SSH and Shell for automatically configuring servers.

That's why I had a look at Ansible, but despite this simple concept, it seemed too bloated to me: too many layers around this simple idea. But I had never thought to be proven right, let alone that this complexity actually translates into 6 scary security holes in a row.

To propose an alternative, this is how I'm currently doing it. I'd love to hear what others think about it, or whether others have tried similar things:

 _Note: This works best of a relatively small and /or heterogenous set of servers/VMs. So it's not really the full-blown Ansible use case. But then, how many people really do have billions of users and a large set of homogenous servers at their hands? I bet the "long tail" of web applications doesn't need more than a few servers. Or, if your hardware is strong enough, just two servers, where the first one takes all the load, and the second one is a failover system on stand-by._

Use a plain shell and plain shell commands, which has the advantage that you can quickly try these interactively in any VM. Use "set -eu" so it halts on error, instead of blindly executing all following commands. Use appropriate commands, e.g. "install" instead of "cat+chmod+chown". Use "\--backup=numbered" to keep backups of previous versions of files, if you want. Use only idempotent commands, i.e. commands that you can run multiple times without changing anything of significance. Prefer portable commands, but use distro-specific code as needed. The time you switch to another distro you'll have a new script, anyway, because you'll have a different system with different requirements. Write everything down in the style of a "copy&paste" documentation (Does this count as "literate programming"?), but put all your remarks in shell commands. Then automate the "paste" part by making it executable.

Example file (executable file "myserver_config"):

        #!/bin/sh
        tail -n +3 "$0" | ssh -p 1234 root@myserver_ip ; exit
        set -eu

        # Install packages
        ...

        # Configure Foo
        ...

        # Configure Bar
        ...

        # Configure Nginx
        #
        # Configure Nginx so that the foo fits into the bar
        # and boggles the foobar.

        install --backup=numbered -o root -g root -m 600 /dev/stdin /etc/nginx/nginx.conf <<'EOF'
        error_log /var/log/nginx/error.log;
        events {
          ...
        }
        http {
          access_log /var/log/nginx/access.log;
          ...
        }
        EOF

        # Do more stuff
        ...

Edit this file and redeploy by simply executing it:

        ./myserver_config

The script may seem hard to read, but with syntax highlighting it is a breeze. And you can easily convert this to HTML, AsciiDoc or Markdown if you need a "real" documentation for your customer or other project members. It's just a few lines of code in Python, or whatever language you prefer.

<comment><USER4> I prefer simple and portable shell scripts too. While I use _here documents_ a bunch too this is the first time I've seen this idiom:

        #!/bin/sh
        tail -n +3 <current-filename> | ssh -p 1234 root@myserver_ip  ; exit
        set -eu
        ...

Clever.

When you write `install`, is this another script that you have installed on the server beforehand or is it a function/alias or something? [EDIT: Duh, didn't realize this was actually a standalone program (standard but non-POSIX AFAICT) I haven't used.]

<comment><USER3> _> While I use here documents a bunch too this is the first time I've seen this idiom_

I came up with this trick to avoid _nested_ here documents, which would make syntax highlighting unusable.

 _> When you write `install`, is this another script that you have installed on the server beforehand or is it a function/alias or something?_

The "install" tool is very common on almost all Unix systems. It is usually called by a Makefile on "make install", but of course can be used by anyone.

</comment></comment></comment></comment></comment></comment><comment><USER5> Am I the only one who finds it pretty unprofessional to release the exploits when the fixed version hasn't been released yet (and anyway was only scheduled to have been released 48 hours beforehand)?

I'm all for disclosure, but seriously - if RH want Ansible to be used in enterprise they can't expect patches at this rate. The researchers releasing the exact exploits so quickly is just irresponsible IMO.

<comment><USER6> But to be a victim of this vulnerability you need to have one of the hosts already compromised AFAIU, so I don't think it's that severe.

<comment><USER7> Any exploit that turns a 1 host hack into hack entire data enter with root access seems worth a patch....

</comment></comment></comment><comment><USER8> The fixed version does not seem to be released yet on pypi or their launchpad PPA. The only (official) place where a fixed release is available seems to be [https://releases.ansible.com/ansible/](https://releases.ansible.com/ansible/)

</comment><comment><USER9> Can anyone explain in simple terms what is this about? Exploit found in Ansible? Should we all update asap?

I couldn't understand from article or discussion.

<comment> grey-area Ansible sends commands to servers, but asks them for certain data first (facts).

If one of your servers is compromised, this is a vulnerability in the ansible client that lets that bad server take over your local computer _and_ your other servers when you connect to it by sending you bad facts.

So it's pretty serious.

<comment><USER10> Puppet uses facter and chef ohai to achieve te same thing. Could they be exploited in similar fashion?

</comment></comment></comment><comment><USER11> I'm just starting to use Ansible for a major deployment at work, so I am not an expert- can anyone who knows more explain why "ansible_connection" exists as a host definable fact? The controller already knows what host it is connecting to when it retrieves the fact, so why can the host change it?

<comment><USER12> it is not a host definable fact, it is a 'host variable' which you normally define in inventory.

<comment><USER11> From the advisory:

When Ansible runs on a host, a JSON object with Facts is returned to the Controller. The Controller uses these facts for various housekeeping purposes. Some facts have special meaning, like the fact "ansible_python_interpreter" and "ansible_connection".

So while you may normally define it in the inventory, it sounds like, from the advisory, it can also be defined by the host.

</comment></comment></comment><comment><USER13> No fix for 1.9? We are stuck on 1.9 because 2.X does not support connecting to more than a couple hundred hosts. This ticket has been open for about a year now: [https://github.com/ansible/ansible/issues/14143#issuecomment...](https://github.com/ansible/ansible/issues/14143#issuecomment-264455619)

<comment><USER14> Have you considered working on it to fix that issue?

</comment></comment><comment><USER12> disclaimer: I'm one of the maintainers

I'll try to answer several questions so this might get long.

First, the procedure for disclosing the CVE is something we discussed internally (including security professionals), as all over the internet there are 2 or more views on this. The decision arrived at doesn't please everyone (I doubt one that would exists), but it is a recognized way of dealing with security issues, so it is what we followed.

The CVE can be dense explaining how the exploits work. The simple version: it is a rehash of an old problem which we had thought solved, the researchers proved us wrong by finding ways around our filtering. The vulnerability is pretty hard to trigger and requires both a compromised system to intercept the Ansible calls and return faulty data and intimate knowledge of the existing playbooks and systems used to force the arbitrary execution.

All software has flaws, this is not an excuse, it is a fact. Not all software or flaws have the same scope though. As a automation tool that is often used to manage things with high levels of privilege, we take these things very seriously and we do our best to prevent it in the first place or remediate it as soon as possible. As an OSS project we appreciate the eyes and efforts many put into finding these flaws which end up making the software better (and me a better programmer).

Ansible is not idempotent, it is declarative, which does help the user create idempotent plays. True idempotency depends on many things, the modules used, the problem addressed and how the playbooks are written, etc. Both of the following are valid ansible tasks, but the implications are very different even if the result ends up being the same.

\- shell: usermod -G user bcoca

\- user: state=present name=bcoca groups=user

I hope this helps,

<comment><USER15> Odd. I reported this very same form of vulnerability to the Ansible team in the 1.5.4 series in 2014, where the code basically eval'd the "facts" discovered from a system under management.

There was this "safe_eval" function which filtered input in a way quite inconsistent with its name. The Ansible team was responsive and pleasant to work with!

[https://groups.google.com/forum/#!topic/ansible- project/MUQx...](https://groups.google.com/forum/#!topic/ansible- project/MUQxiKwSQDc)

But I suspect lots of remote control and monitoring software products might have security bugs like this where they assume that the returned information from systems under management are trustworthy.

Edit to add: Here's the patch made to safe_eval in 2014. I had suggested using literal_eval instead but I guess a Python 2.6+ requirement wouldn't work. [https://github.com/ansible/ansible/commit/998793fd0ab55705d5...](https://github.com/ansible/ansible/commit/998793fd0ab55705d57527a38cee5e83f535974c)

Edit again: Ansible is a pretty great product, and IMO one of the first of such tools to seriously improve the UX for sysadmins. Thanks for maintaining it!

</comment></comment><comment><USER16> [https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt](https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt) has the bug details

Edit: LWN link was changed to this one

<comment><USER17> Thanks! Some of those are somewhat embarrassing, especially for something that's meant to be software used in secure environments. Why does a client need to specify an interpreter to run on the master host? Or changing the template brackets to escape quoting? I'm also thinking that maybe Python might be a bit too dynamic – allowing anything by design – bringing its own share of problems to developing security-conscious software.

<comment><USER18> _Why does a client need to specify an interpreter to run on the master host?_

No, the client specifies the interpreter to use inside itself.

<comment><USER19> But why? I think a dedicated interpreter at a fixed address would do.

<comment><USER20> Imagine you're in a large enterprise environment, and need to deploy something to lots of different servers that were created by lots of different people (your company bought 3 others and each used different software/linux versions/servers). Some have python in the path, some have different pythons in the path, etc. You can't immediately throw away all these servers and rebuild them - some probably have 10 year old bits of software on them where the original author has moved away. Ansible might be one of the tools you use to start fixing this chaotic situation, and having per-host configurations for things like python path is essential.

<comment><USER19> Step 1: Install the expected, dedicated Python interpreter as /usr/bin/ansible_python.

<comment><USER21> Python is not just a single executable. It takes a little more work than one would want. And for what gain? Would you be fine with other software also requiring a custom interpreter to function? It gets cumbersome.

<comment><USER19> If you rely on the system-wide Python you'll need to cover different versions and you need to make sure not to use any 3rd party modules.

<comment><USER18> Ansible ships its own libraries, generally.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Discord shuts down alt-right server and accounts for ToS violations - <AUTHOR> https://techcrunch.com/2017/08/14/discord-shuts-down-alt-right-server-and-accounts-for-tos-violations/ <comment><USER2> slippery slope... Damn them for forcing us to not want to fight for their rights.</comment>


Ask HN: How to kickstart a product idea? - <AUTHOR>

Most of the ideas I've worked on have been web sites or applications, it's a lifecycle I know well.
Yet I keep coming back to a product idea, an electronics device that I really want to develop. I'm unfamiliar with how to develop a proper prototype & find manufacturers etc. Even just to refine the idea first with experts.
I have read a lot of case studies where people have used mfg.com or found suppliers on Alibaba.com
I was wondering if anyone had any other suggestions or experience in building an electronics device.
So far I've had product designs produced (not technical drawings, just aesthetics) I've made a scrappy working prototype from random parts.
I've also done product validation with several groups and have gathered really important feedback.
I'm just wondering what the next step is!
Thanks! <comment><USER2> Maybe Kickstarter would be the next step for you. You'll need a nice designer and maybe even a video. But if you get traction you can go about recruiting the necessary parts to make this a reality.</comment>


Big Data's High Priests of Algorithms - <AUTHOR> http://online.wsj.com/articles/academic-researchers-find-lucrative-work-as-big-data-scientists-1407543088

<comment><USER2> No paywall link: [http://bit.ly/1yh5c0D](http://bit.ly/1yh5c0D)</comment>


Barry's Coilgun Design Site - <AUTHOR> http://www.coilgun.info/about/home.htm

<comment><USER2> The super high power wedge shaped power transfer switch reminded me of my dad (high energy PhD) explaining how the super-colliders were experimenting with laser switched solid state relays capable of transferring enormous amounts of current with very little transition resistance. Unfortunately my father passed away so I can't get details from him. Maybe someone knows more about that technology. Or it never saw the light of day.

<comment><USER3> You make be actually be talking about plasma Wakefield acceleration

</comment></comment><comment><USER4> The site is obviously a labor of love by a dedicated & clever experimenter. However it is frustrating for the casual visitor because (as far as I could see in 10 minutes browsing) there's no way to tell if any of these coilguns are ever fired. No videos, no photos of projectiles smushed into powder or annihilated targets.

<comment><USER5> You might find this to be really cool

[https://www.youtube.com/watch?v=TWeJsaCiGQ0](https://www.youtube.com/watch?v=TWeJsaCiGQ0)

it's a reall full auto gauss cannon. The obvious flaw is that there is no spin added to the projectiles so they flip all over the place.

<comment><USER6> I wonder if this could be fixed with better projectile design. A lot of modern tanks have smoothbore barrels because they use rounds with sabots; once the sabot comes apart the actual projectile is self stabilizing.

I guess the other obvious flaw is that getting a coil gun to produce usable velocity takes a hell of a lot of power.</comment></comment></comment>


10.7 Lion allows multi-user remote computing - <AUTHOR> http://www.9to5mac.com/54102/10-7-lion-allows-multi-user-remote-computing?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+9To5Mac-MacAllDay+%289+to+5+Mac+-+Apple+Intelligence%29&utm_content=Google+Reader <comment><USER2> It seems like Apple have discovered Terminal Services, or the basic networking functionality in X11.

Hopefully it'll be much shinier than X11 and less restrictive than Remote Desktop Protocol.

<comment><USER3> I imagine it uses Apple Remote Desktop, which is apple's own version of RDP. I don't know much about it but it works pretty damn well for me.

[https://secure.wikimedia.org/wikipedia/en/wiki/Apple_remote_...](https://secure.wikimedia.org/wikipedia/en/wiki/Apple_remote_desktop)

<comment><USER4> It's actually using a VNC based application, and uses the VNC protocol. I can "remote desktop" into my desktop using a simple VNC app on my iPad.

It seems that they've provided the option of creating a new VNC server/desktop process when connecting in, rather than just attaching to the existing and current desktop.

Very cool.

<comment><USER5> For the record, this has been a feature of VNC/X forever; in fact, it's harder to run VNC on an extant X session than it is to just start a new one specifically for VNC.

It's just a little annoying when Apple finally integrates tech that's 20+ years old and gets heralded as being "ahead of the curve" or "very cool" for doing it.

<comment><USER4> Get pissy much? I consider it "very cool" in the sense that this is a cool feature that I finally get to use in the OS I prefer to work in.

I don't care if it's been around for decades or done a thousand times before on other OS's, it's being done by them now, and I find it useful.

I'd rather see them do stuff like this and be praised for it than do stuff like this and get shit on by people with the tiresome "it's about time" or "Linux had this a zillion years ago and did it better" crowd.

<comment><USER4> Actually, I won't have the same attitude... I'll be indifferent, and not comment at all, as I don't really care what Windows does. Even though I use it almost daily for various client work.

When it comes right down to it, I don't buy into this whole OS religion thing. I've had more than a passing exposure to quite a few of them, and they all have/had their place.

Case in point, I started my career on IBM 3081's and PDP-11's. I even have a full rack of gear in my home office that includes a bunch of boxes with various flavours of Linux installed, a Tadpole laptop running Solaris, an operational NeXT Cube, SGI and HP boxes running their Unix variants, a cluster of Sun Netras, and on and on. I've also got a few different laptops with Windows and Linux installed. And a couple of MacBook Pro's.

They all have good features, and bad, but none of them have everything.

Do I care what someone else uses? Nope. Do I care if they gush over it and think it's the coolest thing ever? Nope. Do I feel some overwhelming urge to "educate" them on why their choices are "wrong"? Nope.

I just know what works for me, and am happy to discuss things with like-minded individuals. I'm not a fanboy, and I haven't drunk the Cool-Aid. I also don't think everyone who owns a Mac is like that either.

Call me crazy, I guess.

<comment><USER6> Tadpole laptop? Really? Which one? I did the port of Slowaris to several of the SPARCbooks back when I worked there.

(Started my career on a DEC-10, followed by a Vax 11/780, a couple 11/750s and a smattering of PDP-11s (11/44, 11/70))

Had Linux (and NeXTstep) running on an early Tadpole P1000 (100MHz Pentium laptop, it was the sh*t when it came out.)

Mostly all Macs now.

<comment><USER4> It's an UltraBookIIe. Needed it when I provisioned 6 racks of Sun gear in an off-shore co-lo for a gaming company, and it was the easiest way to auto install/configure all the OS's and software into bare metal gear. Wasn't the fastest thing on the planet, but it worked really well.

<comment><USER6> Oh. That's the "other" Tadpole (previously RDI, who acquired Tadpole Technology, Plc in order to trade its stock.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I'd like to see a remote login implementation for OSX that allows you to login remotely, and also adjusts the screen size to match that of the actual physical device you're on.

The existing implementation of screen sharing is frustrating for me to use because I'm often remoting in from a 15" Macbook to a Macpro tower with two heads @ 1920x1200 each. So the options are scale to 1) down the display (slow, fuzzy) or 2) scroll all over the place.

An ideal solution would be to let me log into a virtual display that matches the size of my physical remote terminal. In other words, make the server think it has a head the same size as the client.

</comment><comment><USER8> I'm glad to hear that they've catched up to the original UNIX. :)

<comment><USER9> I would rather say that it is more OS X returning back to its roots where NeXTStep/OpenStep use to have such capability when all the rendering was done with the PostScript built in server. These feature disappeared from OS X, so it is more like a welcome back with a user friendly UI. Back then you usually had to use some terminal command line to make ir happen.

<comment><USER10> Amazing that this is the only comment so far that points out this wasn't even Not-Invented-Here Syndrome, because their own OS already had this feature (Display PostScript remoting) twenty years ago. At least until some architect marking their territory was allowed to wilfully break it and replace it with ... nothing.

</comment></comment></comment><comment><USER11> My job wants to use a third party product to do the exact same thing.

<http://www.aquaconnect.net/mac-terminal-server.php>

This is a great addition to the os. Imagine your house having one [desk|lap]top and a few tablets or phones. Hop on vnc on your docked tablet while someone is using the computer and you're as good as using the desktop. I see this as a move to push both os x and the i[pad|phone] as viable business devices.

This is possible with windows right? I vaguely remember using remote desktop a few jobs ago, but I dont remember if it was one account logged in at a time.

<comment><USER12> The server versions of Windows allow that, it's called Remote Desktop Services (or Terminal Services pre-2008). Way better than using VNC, probably because it hooks all the window control drawing on the server and does it on the client instead, rather than sending over raw bitmaps for buttons/textboxes etc.

</comment></comment><comment><USER13> This is going to be absolutely perfect for educational use. Imagine a university computer lab that lets you remotely login from home after the lab has closed to access all the expensive, specialized software the school has already purchased. I know my university was trying to set something like this up, but couldn't find any user-friendly way of doing this.

<comment><USER14> I doubt there are a bunch of user accounts on a uni computer lab Mac, so this wouldn't be much different than regular screen sharing. It's also still a mess to choose which computer to try, doubly so if you're on an outside network.

<comment><USER15> Mac OS X Server had (has?) decent support for proper accounts, with the client machines essentially just diskless terminals that boot from the server, and with all accounts on the server - called netboot. So not like screen sharing at all. This worked pretty well in a lab setup, but didn't support remote logins - this sounds much better.

<comment><USER14> The OP was talking about doing this so expensive university software... I'm going to go out on a limb here and state that it's just not going to work well when 100 students try and spin up instances of AutoCAD or Mathimatica on the same machine.

</comment></comment></comment></comment><comment><USER16> Er, ssh?

I don't see what the big deal is. I've been able to remotely ssh into my mac for years.

<comment><USER17> now imagine this at the gui level. imagine being on your mac, pick up your ipad, move to the next room, and swipe and have access to the same apps currently running. jut look at what apples been putting out the last few years. look at lions big features. full screen mode doesnt sound impressive. but that would make those apps much easier to use on the ipad.

im nut saying this is all new stuff, rather, its going to be packaged by apple, and that is going to mean something.

<comment><USER18> If you want to do this right now, check out Screens for iPad.

<comment><USER17> Yeah, I've seen that before. I'm not talking about _just_ that. What I'm talking about is having the full screen mode Apple is developing will have support for turning the app into an iPad version with little effort. Basically, by following their API and implementing official full screen support, when the time comes to implement Mac to iPad support like I'm describing, instead of seeing the Mac's desktop, your seeing the application on your iPad in an "iPadified" version of the app.

</comment></comment></comment></comment><comment><USER19> This is nothing special. Lion says it would include a server version of Mac OS X, and this is just a very basic function for any server OS. Although I haven't played with OS X server before, I'm quite sure this feature has been there for some time.

</comment><comment><USER20> The way I like to think of this feature is as a throwback to the days of "dumb" terminals that would connect to a server where you stored your files, account info, etc.

"Back to Unix".

<comment><USER21> Why not? With HTTP we went back to the future vis-a-vis 3270.

</comment></comment><comment><USER22> If I understood it correctly, this has been possible for years in OSX. You just need to be "fast user switched out" instead of logged out: \- Log in with user A \- Fast User Switch to user B \- Log in to user A with VNC. It works just fine.

</comment><comment><USER17> a lot of the comments are fairly shortsighted. i called this some time ago, and it makes sense. consider how mobile our live are right now. consider the wireless nature of everything. imagine having your computer be situated out of sigh, and your screen is mobile. your ipad and iphone connect to the same central hub. the computer becomes an appliance at home. just look at lion and the elements of ios its pulling in. now imagine apple making it easy to do all of this.

airdrop, mobileme, app store, all of this are elements to a grand vision.

<comment><USER23> yes, and especially with rumors that iPhone 5 having NFC technology. Imagine being able to walk up to any mac and just swipe your iPhone and all your settings, bookmarks, etc. will just transfer over and you will be able to use it, just like you were infront of you mac at home.

</comment></comment><comment><USER24> Is it just me or are 99% of tech "news" and "innovation" just reinvention of stuff already found in UNIX, Lisp etc. decades ago?

<comment><USER25> It's not just you, Henry Spencer reportedly said it (first?) in 1987.

"Those who don't understand UNIX are condemned to reinvent it, poorly."

<http://en.wikipedia.org/wiki/Unix_philosophy#Quotes>

<http://en.wikipedia.org/wiki/Henry_Spencer#cite_note-2>

<comment><USER26> He was just paraphrasing the bible:

"What has been will be again, what has been done will be done again; there is nothing new under the sun." -- Ecclesiastes 1:9</comment></comment></comment>


Why is it OK to be Prejudiced against Mormons? - <AUTHOR> http://www.csmonitor.com/Commentary/Opinion/2011/1018/Why-is-it-OK-to-to-be-prejudiced-against-Mormons

<comment><USER2> It's of course hard to read that without thinking about how it's published in the newspaper run by the Church of Christ, Scientist. Quoting Wikipedia:

        There have also been periodic tensions with both mainstream
        and fundamentalist Christians, who think the religion
        is aligned with Gnosticism or is a cult, and fault it
        for departing from traditional Christian doctrine. Of
        particular issue is the deity of Jesus, which Christian
        Science denies; and a view that Christian Science does
        teach, that God is not the creator of finite (material)
        existence and its concomitant suffering, sin and death.

The Christian Science Monitor is meant for a secular audience, and has good news coverage. But this is a commentary, and the people who think of the Latter Day Saints as being a cult likely also think that the Church of Christ, Scientist is a cult.

</comment><comment><USER3> Because many people regard it as a cult?

The same reason goes for Scientology.</comment>


Tattoos: The Legacy of a Seafaring Heritage - <AUTHOR> http://www.historytoday.com/tessa-dunlop/tattoos-legacy-seafaring-heritage <comment><USER2> Since no one else has commented I thought I'd add a tangent which I found interesting when I learned of it:

The origins of the euphemism "nailing" to refer to having sex comes from ~1800 when HMS Dolphin was in harbor at Tahiti:

The relationships became particularly friendly when the sailors discovered that the women were eager to exchange sex for iron. This trade became so extensive that the loss of nails started to threaten Dolphin's physical integrity.

<http://en.wikipedia.org/wiki/HMS_Dolphin_(1751)></comment>


Best apps in a limited app store for Amazon Kindle Fire HD tablets - <AUTHOR> http://gravitationalpull.net/wp/?p=2263 <comment><USER2> I've also just contacted providers of apps on Google Play. Usually, they either provide an APK file or push their app onto the Amazon store (it's been 50/50 on the places I've contacted).

I know it would be easier to get a Nexus 7 in some respects, but I'm unfortunately heavily invested in Amazon Video, which isn't available there.</comment>


IPhones-Macintosh computers become apples of hackers' eyes - <AUTHOR> http://www.breitbart.com/article.php?id=080810051102.njhra1ru&show_article=1 <comment><USER2> _Apple's Safari operating system is the basis for internet browsing using iPhones..._

The Web OS is here. :)

<comment><USER3> The entire article is a great example of laughably bad clueless tech journalism.

<comment><USER4> Yes!

I attended that very session yesterday and almost fell asleep because it was so shallow. I expected a bit more in-depth technical talk, not a glossing over of basic objc/cocoa concepts and IDA Pro for Windows (maybe I was expecting too much and Hotchkies was right on target, given the miniscule number of folks who knew objc in the crowd).

I see the "journalist" just cherrypicked some marketable quotes, whoever it was must have been bored listening to the rest :)</comment></comment></comment>


What a Difference a Year Makes - <AUTHOR> http://the-witness.net/news/2012/08/what-a-difference-a-year-makes/ <comment><USER2> Your latest work definitely looks like pro now. Take your time, keep it up and an year from now, you'll see what big progress you'll have made. With years of experience, the skill starts to increase rapidly, while in the beginning everything is so hard and slow. Persistence is the key to success.

</comment><comment><USER3> The "sign up for the mailing list" function seems to be broken. i get a "not found" error.</comment>


Ask HN: Recommendation for a good UI/UX expert? - <AUTHOR> We are an Atlanta based startup looking for an UI/UX expert to help us build for our Beta. We are self-funded and have the budget allocated for this work.
After hours of looking on the web, the one thing I've realized is that for this type of work you really need someone who comes with recommendations. So I turn to you guys for help.
Thanks!
EDIT: We are an angel-funded startup, building a web-based research aggregation tool. We have a budget of up to $5000. We are looking for someone to help come up with a clean design, branding, and layout. We have 4 unique pages, and a bookmarklet that needs the creative touch.  We are implementing using the JEE stack (Struts2, JSPs, etc.), and have been using Blueprint CSS for layout.
EDIT AGAIN: We have 3 developers on staff, we have been able to come up with a basic site layout, color scheme, and know how to wire it up.  What we want is someone to give us a new logo, CSS, header, footer, graphics for certain controls on the page, and maybe if they have a better idea on how to present certain data (but this isn't as important). <comment><USER2> Should leave your email or contact info.

Also, good UI/UX experts would already be busy with ongoing projects, your solicitation barely registers anything on an excitement scale. Should divulge a bit more info about your project, or industry, or what you want to do.

<comment><USER3> There are thousands of competant UI people who will do a small site for $5k. Most of them don't care about your industry or your excitement scale. On the flip side of that, your product probably needs to be pretty f'ing awesome to get Firewheel to do it for $5k.

</comment></comment><comment><USER3> I'd say Blue Flavor --- <http://www.blueflavor.com> \--- they wrote Blueprint. I liked them a lot; excellent consultants. They may be out of your price range though. For the shops that you've heard of, for projects that include IA and UX in addition to pushing pixels, a small project falls in the 10-20 range.

It does not sound like you want UX --- it sounds like you want a designer. If you just want to look nice, that's a $1500-$4000 project. My advice, based on our experience: post to Craigslist and compare portfolios.

</comment><comment><USER4> The best way to find a designer is find something you personally think is beautiful and well designed (or, if you think you have no taste, substitute your opinion for someone's you trust).

Contact those people and try to convince them to work with you. Be prepared to spend a lot (which is going to be worth it if they're good).

</comment><comment><USER5> Amy Hoy. She's amazing. She made twistori and Color Wars among other things. She's spoken at lots of conferences, so you can see her thoughts about UI right out in the open via her slides. Aside from knowing UX/UI, she seems to be an accomplished hands-on Ruby programmer, Javascript programmer, and graphic designer. <http://www.slash7.com>

</comment><comment><USER6> Are you looking for a designer or a developer? UI folks like myself tend to come in 2 flavors. One is skilled at the wireframes, architecture and look and feel and can do pretty mockups and prototypes. The other is a programmer whom is familiar with the latest AJAX, JSPs etc and implements the design created by the former person.

Also if the company is important to you as it should be you might want to hire someone familiar with branding to do your branding. Having a UI person do your branding is like having a programmer do your UI. They might know a bit about it but are definitely not the expert.

Lastly, if you're looking for someone with recommendations but don't know anyone personally try linkedin.com. Check out some profiles, look at their recommendations and check out their website. You can see my profile as a starting point.

,Jose Benavides

<comment><USER3> Jose --- from what I can tell, there are in fact 3 categories:

(1) The look/feel designers

(2) The UX/IA people who spend most of their time in wireframe

(3) The "developers" who hook things up and get things running.

The difference between (1) and (2) is pretty huge. I've been disappointed on projects that needed strong look/feel but got mostly IA/UX. Here's more advice to readers: you're going to feel like you're "supposed" to want IA and UX. Fuck that. If you want to look cool, _clearly communicate_ that that's what you want.

<comment><USER6> 1 and 2 can be separate, but there are a lot of people whom can do both well. That's not to say that there aren't also a lot of people whom are horrible at one and great at the other. the "look/feel" designers are more of graphic artists then UX/UI people. A good team should be composed of people from each of the 3 elements you described.

No matter whom you decide to go with look at the portfolio first. I can't emphasize this enough. If you don't like what they've done before then chances are you won't like what they'll do for you. If you want a "cool flashy site" find a person that builds great "cool flashy sites". Don't go for the person that loves minimalism.

Whenever I build a UI team I look at the portfolio first. If I like what I see then I look at the credentials and where they've worked. Otherwise I pass.

Richesh, From reading your updates it sounds like you want a graphic designer and not a UI designer. If you have a structure and layout that you like and just need someone to make shiny buttons and give you a good color palette then a graphic designer is what you're looking for.

</comment></comment></comment><comment><USER7> "web-based research aggregation tool"

I personally know of at least two other in-the-works tools like this. I'm interested to see what the competitive space looks like for this market in the next 6-18 months.

<comment><AUTHOR> which two are you thinking of?

<comment><USER7> "two other in-the-works tools". Sorry.

And I should have said "That fit this description". I have no idea if they're like your solution.

</comment></comment></comment><comment><USER8> Kaaren Schulz at Practical Usability (<http://www.practicalusability.com/>)

Disclaimer: She's my cousin. :)

</comment><comment><USER9> I have a guy.

He did the UX for our CMS, and has just quit his day job to do Freelancing full time (and work for Servee)

Check out <http://demo.servee.com> for some UX work and <http://kkellydesign.com> for general Design

(also highlandpr.com/portfolio for branding work)

<comment><USER9> wow. downmodded for answering his question.

</comment></comment><comment><USER10> Hey man I need to find a good one too. Too bad Tony Wright isnt for hire!

</comment><comment><USER11> I hear the guy who does Apple's products is pretty good.</comment>


Delta Will Let You Watch Your Luggage Get Lost in Real Time - <AUTHOR> http://gizmodo.com/delta-will-let-you-watch-your-luggage-get-lost-in-real-1788215929 <comment><USER2> So you could get on the flight, use in flight wifi, and realise your luggage is still at the airport and spend the next few hours worrying if it will actually arrive with the plane...?

Whats the point in Delta adding this functionality? Obviously in most cases it would work fine, but it seems like a complete waste of time/effort/money for them to make this. Most of the time you just assume your luggage is on the plane with you (or you are waiting for it to move from the plane to the pick up area)...

<comment><USER3> Could be because checked luggage is a profit driver. Make it fun to check luggage while charging for each additional bag</comment></comment>