Linode Manager Security Incident - <AUTHOR> http://status.linode.com/2012/03/manager-security-incident.html <comment><USER2> The message seems to be...

Only 8 accounts were affected. Do not worry. Minor breach. Not much harm done.

It seems to me the truth is the attacker looked for bitcoin wallets and emptied them. The fact he could identify 8 accounts and access them suggests the attacker could have accessed far more accounts if they wished. I think this is the most worrying thing about the breach.

I don't really understand how bitcoin works but it seems that people with wallets need to set up multiple wallets on multiple providers and limit the amount of bit coins in each wallet to limit any losses from breaches like this.

If I was a linode customer I would be thinking about moving. This message, while fairly open, doesn't give me much confidence there aren't other security issues with the platform.

<comment><USER3> Just imagine that BitCoin is like having cash in your wallet, because that's more or less its intended model. There are a lot of 'anti-counterfeiting' measures because computers are very good at copying, and you don't want people to be able to copy BitCoins the way they can copy music -- and when you ask "what is BitCoin?" people basically start to tell you about the anticounterfeiting technology, and the limits on printing uncontrollable amounts of money. But it's essentially stamped paper in your wallet in any other sense, worth whatever people using it on the Internet will pay for it, not backed by anything in particular but its usefulness.

Basically a lot of people were renting storage rooms in an apartment complex run by Linode, you get your own key to enter the door and retrieve and store things -- whatever. Some people left their wallets inside these buildings, with cash therein. Someone else used some unidentified systematic security flaw, but we don't yet know what it was. Maybe there is a ventilation system which is easily navigable once you know how to get in; or maybe all of the rooms have unlocked windows for no good reason; we haven't been told yet. (There are some suggestions that they stole a key from one of the janitors who cleans these rooms up.)

What we have been told is that some burglar stole eight wallets, and that "All activity by the intruder was limited to a total of eight customers, all of which had references to 'bitcoin'." That suggests that the burglar did indeed peek in the windows beforehand somehow, to find out that these 8 rooms had wallets inside. Otherwise, presumably they would say something like, "The intruder broke into many of our customers' accounts but didn't actually do anything in 99% of cases." In that sense I think the scary bit isn't that he accessed the 8 accounts, it is the fact that he identified them in the first place.

Amortizing the loss across many points of failure may be a good idea, but it wouldn't seem to solve the central problem. Suppose I put $20 in two accounts with 5% chance of compromise, rather than $40 in one account with 5% chance of compromise -- either way, I should expect to lose $2. What I've changed is that I am more likely to lose some of my money (9.75%), but I am less likely to lose all of my money (0.25%). This may appeal more to risk-averse people but it is not fundamentally changing the situation.

Perhaps a better approach is to keep a BitCoin wallet encrypted, since that's pretty simple to do in day-to-day life. This is something that you can't do with your wallet -- you cannot turn your wallet into a steel vault with two- foot-thick walls.

<comment><USER4> > In that sense I think the scary bit isn't that he accessed the 8 accounts, > it is the fact that he identified them in the first place.

This isn't all that surprising. There are basically two reasons why you would have a Bitcoin wallet on a server: if you are mining using the CPU power of that machine, or if you need to send Bitcoins from an online application. For example, one of the people who mentioned having coins stolen was from a mining pool; you need some automated system to pay out the earnings to the people who have been doing mining, and so the wallet for that automated system was on the server, and was stolen. I suppose one further reason might be as a backup, but in that case, I dearly hope that it's an encrypted backup without the encryption keys in the sever.

Given these reasons for having your wallet on the server, it's not surprising that people found them. These require network-facing services, that are easy to trace back to the server in question. The mining pool is a public service; anyone can join, and find the address of the server. Furthermore, when you make payments, you announce them to the full Bitcoin network. Someone sniffing transactions can watch where transactions originate, and target that. If they already had a compromised customer service account on Linode, they probably watched the Bitcoin network for a while, made note of transactions originating from IP addresses in the Linode range, and then targeted those accounts.

One way to protect yourself from this would be to proxy your Bitcoin transactions through a host other than the one that has the wallet, obfuscating where the transactions are actually coming from. You could even go so far as to make all of your transactions via Tor, which would probably make it fairly difficult to find where your Bitcoin wallet actually lives.

> Perhaps a better approach is to keep a BitCoin wallet encrypted, since > that's pretty simple to do in day-to-day life. This is something that you > can't do with your wallet -- you cannot turn your wallet into a steel vault > with two-foot-thick walls.

The problem is, if you need to make payouts from your wallet, then the machine that does that needs to be able to decrypt the wallet. That machine can then be compromised to be able to steal your keys. Encryption doesn't buy you all that much, unless you are just doing a backup and don't need the machine to be able to do online transactions at all.

Perhaps another solution would be to encrypt each key in your wallet separately using a k-out-of-n encryption scheme (where produce n keys, any k of which can decrypt the wallet). You can then distribute those keys to independent hosts, which hopefully should not all be subject to the same vulnerabilities. Then any time you do a transaction, k of those hosts will need to produce their key to decrypt the key in your wallet and perform the transaction. That way you would have to compromise several different, independent hosts in order to steal the wallet.

Of course, this would drastically increase the cost and complexity of the system; and you would need to ensure that whatever system that authorized payments was likewise distributed, which if you had, say, a web-facing service would be difficult.

The easiest thing to do to reduce the risk is to only leave enough value in the wallets that are on the servers for a couple days worth of transactions. Then you transfer Bitcoins from a more secure location once a day to keep the coffers full. This is not much different than a physical store; yes, you are at risk of being robbed, but if you only have one days worth of cash there, with the rest somewhere more secure, you reduce how much risk you have.

<comment><USER5> If they had used 'unlock-at-boot'/true-crypt style disk encryption and kept the password/key off the machine they would have been safe from this attack. (They would also have to provide the password/key every restart.) It is only in hindsight that something like this seems worth implementing!

Your more general solutions would protect from an attack that rooted a live system rather than just resetting the root password while the machine was offline.

</comment></comment></comment></comment><comment><USER6> I'd like to understand the what actions will be taken to prevent similar attacks in the future. Also, what can I as a linode customer to prevent my host from being compromised in a similar fashion.

Implementation of two factor authentication for your customers and requiring it for a root password reset would go a ways to preventing similar attacks.

<comment><USER7> Two-factor authentication for their support personnel you mean?

<comment> brown9-2 Also, is this customer service portal available via a public URL? Shouldn't some sort of VPN access be required to even get on the network hosting these things?

<comment><AUTHOR> It is public yes, this is it: <http://manager.linode.com/>

<comment><USER7> I think there is some confusion here. That's the link to the customer portal, which needs to be pretty public.

I have no idea how Linode's support team access accounts, but I would hope it is less public.

<comment><AUTHOR> The title of their blog post is: "Linode Manager Security Incident" and that's exactly the name of the customer website where you can manage your instance, billing, etc.

I think someone found a way to gain access to any Linode customer account through the customer website and from there shut down the instance, changed root password and rebooted (you can do that from there).

<comment><USER8> I think it's just poorly worded - from the OP and what I've read elsewhere someone accessed the portal used for customer service employees that has access to options/all hosts.

<comment><USER9> In any event, it's not very clear, which adds to my confusion/worries as a Linode customer.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> All this talk about banks being safe yada yada and cloud hosting not safe for US50k. Real banking companies (with billions of dollars on hand) do use commodity cloud hosting including Linode, for even sensitive parts. Take for example Natwest online banking login. On initial login page they load a cookie via an image from www.advanced-web-analytics.com and then once you enter a customer number the next page loads a ...drum roll... javascript file from www.omni-traffic.com. Now who can tell me what one can do when you have control over the Javascript on a banking login page?

Ah crap. It looks they have been moved to Amazon EC2, ~8 months ago they were hosted on conventional Linode VPSs. Points still stands though.

<comment><USER11> In my experience working on a US financial website, a bank would never consider using a VPS like Linode to store actual banking and customer data. It's not even close to Level 1 PCI compliant.

<comment><USER10> Not sure about this PCI complaint stuff, but perhaps this is why major banking companies jumped from Linode to EC2? Much improvement? Although I must say I have friends working on banking websites in the UK that dont know the whole picture, its not unreasonable to assume that these things are fucked up.

<comment><USER11> From what I know, PCI compliance is firstly, just a guideline. It's not like OSHA, but IANAL.

I also know there are "levels" of PCI compliance. The highest one, which reputable banks should be following, is very strict AFAIK, and includes provisions for controlling who has access to the physical hardware, encryption levels, etc. The fact that a Linode VPS can be 'rooted' via their management software by a sysadmin working for Linode would, from what I can tell, make them unqualified to be used to store banking transaction & customer data, though perhaps I am wrong.

</comment></comment></comment></comment><comment><USER12> I am failing to understand what exactly happened.

The user who was affected by the incident quoted an email from linode that stated "Our investigation has revealed a customer support interface was used to access your account.", based on that and all the information of that post you get the impression that through the 'interface' the attacker was able to change the vps root password.

Now a reply from linode comes and says "The portal does not have access to credit card information or Linode Manager user passwords". So if the portal doesn't have access to Linode Manager how the attacker gained ability to change the root passwords ?

Thy should give more details on the incident, i do have a certain trust in the ability of linode to have a secure environment & i can understand that things like that will happen at some point to everyone. However its one thing for someone to get access in your system because you had your roots password to 'password' and another if there was a bug that got exploited.(yea this is an extreme example)

<comment><USER13> > So if the portal doesn't have access to Linode Manager

They didn't say that, they said it doesn't have access to the _passwords_. They have an interface to change details, they just can't read them. So they can reset your password to "hunter2" but they can't see if it's "hunter2".

<comment><USER12> You are right, my bad on that. Still this looks like a Public relations post by them than giving out facts. They should be explaining what the attacker could do by gaining access on that interface, the ability of the attacker to change the password has the same consequences.

The point is that exploited interface had a backdoor access to the virtual machines (to be able to change passwords or w/e)

<comment><USER14> I understand how this might be confusing to a third party, but Linode's response thus far makes perfect sense to those of us who have been customers for a while. We're pretty aware of the general parameters of Linode's internal systems.

</comment></comment></comment></comment><comment><USER15> I'm surprised that a tool with this level of access isn't walled off behind a VPN.

</comment><comment><USER16> Can someone with a legal background comment on the viability of the victims taking legal action?

<comment><USER17> I've got to wonder too. If you rent out an apartment and someone breaks in with a key they stole from the landlord and takes your TV, can you sue the landlord? On the other hand, if you rent a security deposit box from a bank and it gets broken into, is the bank liable?

<comment><USER18> I think the threshold would be, did Linode take "reasonable" precautions in protecting the servers in question. Just like the landlord or bank. So long as they take reasonable precautions, they can't be held liable.

You can expect for your landlord to keep their copy of the key in some sort of lockbox, but you aren't going to expect them to keep it in a pressure- sensitive safe, guarded by movie-style lasers and a German Shepard.

You expect a little more security out of your bank.

The real question is: why were services that act like bitcoin banks storing their coins on Linode in the first place.

<comment><USER19> They probably used Linode to _generate_ bitcoins. And they kept them there.

<comment><USER20> No, that is extremely not likely.

The only (realistic) way to generate bitcoins today is with GPU or other specialized hardware that doesn't exist on webservers.

These servers that were compromised were used to manage generated bitcoins. One was used by a pooled mining service (mined coins were sent to the server then payed out to miners) and the other was a faucet service which would give a little bit of bitcoins to new users. The other 6 servers that were compromised are unknown to me.

</comment></comment></comment></comment></comment><comment><USER21> No mention of liability. So they are fixing it, but someone is out of $12k of bitcoins. Linode says, tough luck for trusting us with your valuables.

<comment><USER22> These bitcoin servers trusted their currency exchange to cloud servers--VPSes, really--and they want Linode to compensate them for the money lost? Insane. I don't claim to know anything about the bitcoin infrastructure hosted here but I'm going to go out on a limb here and say that there was no dedicated hardware firewall in front of it, no IDS, no WAF, nothing but some Linux instances running iptables.

The payment card industry wouldn't certify this hardware to process credit cards for a mom-and-pop online business, yet these guys use it like their bank? Come again?

<comment><USER16> PCI-DSS is actually quite easy to get certified in. I would say the issue is Linode not protecting their customers but as you say it's completely optional and would incur higher costs.

</comment></comment></comment><comment><USER23> In Linode's FAQ, they mention that their virtualization management software was developed in-house. They seem quite proud of this, quipping: "The Linode Manager is custom software, written in house, and is not for sale (although others have tried to mimic it)."

It seems to me that this is a classic example of security failures following inevitably from a lack of peer review. Maybe Linode didn't consider its LM software to be peer-reviewable, but I bet the victims of the bitcoin thefts wish that someone else had tested the code (and human systems surrounding it) for vulnerabilities.

Is this not exactly what Bruce Schneier frequently points out? Anything that must withstand attacks to protect the valuables within should be tested by attacking it. A lot. My hunch is that the vulnerability exploited by this attacker would have been found and fixed already if the LM software were more open.

<comment><USER24> I think you may be a little off here. The statements in the thread seem to indicate that the compromise was not based on a vulnerability in custom software, but compromised credentials. You can certainly argue that the management console should be protected by two-factor (and it should be), but their software doesn't seem to be at fault here.

I would be willing to bet that they have had the system tested by external security contractors and scanned with automated scanning tools. This seems to be a people problem and features problem not a vulnerability problem.

I guess we just don't know at this point. You may very well be correct. I guess if you want to use an open source provider, just make sure they are running OpenStack (openstack.org).

</comment></comment><comment><USER25> I really hope the various bitcoin related incidents don't poison the well for online currencies in general. Yes, you need a greater level of security when dealing with transferrable, relatively anonymous or pseudonymous (and rapidly extractable) online assets that you don't need for book-entry accounting with an audit trail and reversible transactions (credit cards, ACH, etc.). Yes, this is beyond what even most banks currently use. No, it's not beyond current technological state of the art.

Gaming (i.e. casinos), at least some of them, do a reasonable job with some very similar security problems.

<comment><USER26> Wasn't the well pretty thoroughly poisoned by e-Gold and such? (We realize they're not the same as Bitcoin, but most don't.)

<comment><USER25> Yeah, kinda. Although E-Gold's problem was force majeure, not technical (did they ever get hacked? people stole passwords all the time, but since it was double entry, it was pretty easy to reverse).

osGold, etc. were probably better parallels. But yes, this whole field has had a long series of technical, business model, governance, and government related failures.

<comment><USER27> Can you explain what happened with eGold, osGold, etc? I haven't heard anything about it.

<comment><USER25> e-gold was shut down by the government for running an unlicensed money service business. They were officially Nevis based, but actually run out of Melbourne, FL (where they started originally); criminal charges were involved. The main reason was a particularly motivated federal prosecutor and the specific uses e-Gold users found -- child porn, paying for stolen cc's, etc. It wasn't a general thing about PATRIOT/MSB laws.

osGold was just an internal fraud; digital currency, give me your (gold) and issue tokens -- then one day it disappeared, taking the original value with it.

There were hack attacks by third parties against some other gold currency systems at the time, but I don't remember the details.

<comment><USER27> I see, thanks. Apparently the space is plagued with problems.

</comment></comment></comment></comment></comment></comment><comment><USER28> While the incident is unfortunate, I do give them credit for being up-front, honest, and relatively speedy in their response. Sad to say, I'm not sure a lot of other hosting providers would be as quick to admit culpability.

That said, there's no way that resetting the root password should be something a customer service rep can do. Particularly when Linode are very explicit about not being a service for newbs - and are in general unwilling to provide help setting up a Linux system.

</comment><comment><USER29> May be its time for some cloud insurance (covering outages/security etc) ? I don't mind paying a little extra if it mitigates risk.

<comment><USER30> Near unlimited liability and virtually zero ability to model the likelihood of events. A hard product to design.

<comment><USER29> Liability might be unlimited, but most of the insurance products for other categories cap it based on premium. So that may not be much of a problem. I agree with the difficulty of modelling the events though... they need more data for any kind of modelling.. I'm guessing amazon already has some kind of insurance to cover its risks under AWS service agreement..

</comment></comment></comment><comment><USER31> Hey, I'm one of those guys! But I wasn't stupid enough to leave a stockpile of bitcoins sitting around to steal.

<comment><USER32> I wonder about that. It seems to me that the bitcoin wallet shouldn't have been accessible after reboot, at least until someone came by to give the agent managing it the passphrase that would allow it to decrypt it's state. From the sound of things the wallet was just laying around unencrypted?

<comment><USER33> [https://bitcointalk.org/index.php?topic=66979.msg778666#msg7...](https://bitcointalk.org/index.php?topic=66979.msg778666#msg778666)

According to the admin of bitcoinica, he didn't have the wallet encrypted because the ruby gem he was using to process withdrawals didn't support it.

<comment><USER34> Doesn't even matter if the wallet was encrypted, he'd still have to have the password somewhere on the server.

<comment><USER35> Not if he entered it manually on every reboot. There'd still be attacks around snooping the contents of the wallet from memory, but the ability to do a root password reset that involves rebooting the box wouldn't be enough (and it seems like that may have been all the access that the attackers here had).

</comment></comment></comment></comment></comment><comment><USER36> There's already quite a lot of discussion of this incident here: <http://news.ycombinator.com/item?id=3654110>

</comment><comment><USER37> Well handled.

<comment><USER38> Agreed. This is in sharp contrast to the Media Temple / Plesk debacle. Which affected how many thousands of sites? How long did it take them to admit it? Meanwhile, Linode reports full details of a hack affecting no more than 8 accounts the SAME day.

<comment><AUTHOR> It's good the fast acknowledgement, but I find it lacks in detail. I'd love to know exactly what kind of measures are they going to take so the chances of this happening again are truly reduced.

I share a Linode with a friend and at work we deal with 4 so this is a concern.

<comment><USER39> Further comment is indeed warranted, but that part can come in a few days, when there's more clarity on the scope of the incident and a fully-hashed plan of attack for closing the vulnerability.

<comment><USER40> I hope so. They said they will be "reviewing our policies and procedures to prevent this from ever recurring."

That doesn't imply they will be posting a public update. As a Linode customer, I would like to know details of how this breach occurred and what actions will be taken to prevent it in the future.

</comment></comment></comment></comment></comment><comment><USER41> Perhaps people affected by the many Bitcoin Exchange password leaks were reusing their passwords on Linode?

<comment><USER42> The breach originated on the Lionode customer service system. Which the attacker used to reset user passwords. Unlikely the incidents are directly related.</comment></comment>


Why are there so few women programmers? - <AUTHOR> http://scripting.com/2013/08/19/whyArentThereMoreWomenProgrammers <comment><USER2> I was thinking yesterday about a couple of women I met almost 25 years ago in a sysadmin class. Both had started programming about 25 years before that, in the days of punch cards and 1" tape. One said that her employer had a window from its machine room onto an NYC sidewalk. Passers by could watch the operators load the cards and hang the tapes, and then could watch as tapes spun and lights blinked. An ABEND would causes the tapes and lights to stop in front of a crowd of curious pedestrians. You didn't, she said, want to be the one whose code ABENDed. So women programmers go way back.

<comment><USER3> _Way_ back: if you're a programmer, you should know who Grace Hopper was:

[http://en.wikipedia.org/wiki/Grace_Hopper#UNIVAC](http://en.wikipedia.org/wiki/Grace_Hopper#UNIVAC)

</comment></comment><comment><USER4> > Programming is a very modal activity. To be any good at it you have to > focus. And be very patient. I imagine it's a lot like sitting in a blind > waiting for a rabbit to show up so you can grab it and bring it home for > dinner.

He's not putting it very well, but there may be valid reasons why male and female brain chemistry cause them to be slanted towards particular professions. Or not.

Unfortunately the poster is now being attacked by angry people who believe men shouldn't write about gender issues.

</comment><comment><USER5> I've submitted this but I'm not supporting his view at all.</comment>


Ask HN: How replaceable are developers on a MERN stack? - <AUTHOR> Hi,
I'm a product manager learning the craft. Coming from UI/UX design background.
I'm currently building a couple of products with developers who've chosen the MERN stack. My question is about "replaceability" — how tied am I to a front end developer on the MERN stack and how tied am I to a back end developer on this stack?
Which one am I closer tied to?
When I say replacing someone, I'm wary of the cost of switching the developer who made the app/wrote the code with a new one:
1. the time cost of finding them 2. time cost of them going through the previous developer's code to understand what's going on there 3. Money cost etc
As far as I understood (correct me if I'm wrong please), the point of using the React framework is that it's all "modular" and that the cost of switching developers is lower. Would appreciate someone shedding some light on me! <comment><USER2> Yikes. If the thing you're worried about the most is how replaceable your staff is, there's something smelly going on ...

That said, any web developer worth their salt should just be able to pick up any tech like Mongo or React with ease. There's enough resources out there that wouldn't mean this is an issue.

</comment><comment><USER3> It's a common stack, so no more or less replaceable than any other stack such as any other permutation of (Mongo/MySQL/PostGresql/SQL Server) + (Express/Rails/Django/ASP.NET) + (React/Angular/Vanilla) + (Node/Ruby/Python) etc.

React is as modular as the developers choose it to be. You can write convoluted code in React too. React does force you into a certain way and makes it easier to standardise, but these days with hooks and Redux and much more there can be a lot of variation in architectural styles.

Picking what tech to use is hard. Sometimes it doesn't matter at all, just pick what you are used to. Case in point most peoples SaaS side projects.

Sometimes it makes all the difference. If using clojure + scala + akka + kafka + prolog means you can crush the problem, then choose those, don't pick worse languages for solving a given problem so you can handle people leaving.

I suspect developer replacability should never be that much of a concern in the choice of tech, where you are even considering something esoteric for genuine reasons.

</comment><comment><USER4> There is a fundamental conceptual error you are making here, but I can't quite come up with a good description of it.

<comment><USER5> I think it's kind of strange that OP's focus on the framework as the way to determine how replaceable people are. I think unless required, most people have basic familiarity with a framework, and are likely more familiar with the languages that make up said framework. Any Javascript framework or stack (outside of something obscure) is easy to learn (read: doesn't take any real special skill) especially if there is an existing codebase that developers can use to learn from...

</comment></comment><comment><USER6> You can ask your team about the flexibility of their architecture. How easy is the current setup such that new team members can be added, how piecemeal are the components and apis such that tasks can be delegated.

It's fair to be concerned that one or very few own your product implementation (and I speak as a developer).

MERN stack is okay, but it can easily have ten other pieces that will make it a highly specialized stack.

Things should be designed so you can rip out any of those letters. If you end up with a convoluted UI codebase, it will cost money and time to rip the R out.

If you don't get the right people to setup your database right, you won't be able to pull the M out.

The E and N are probably the hardest to mess up amongst the letters.

Don't add anymore invisible letters to the stack if you can avoid it (there's a plethora of extra stuff a typical full stack dev now days is prepared to pull in if you search around).

</comment><comment><USER7> I would stay away from mongo as a database depending on what you are doing (in almost all cases, you don't need mongo. There are better options). Tech debt from mongo can pile up soon. Can you explain more about the product?

React is alright. Make sure to use hooks instead of classes and encourage semantic separation. Separate by the use case of the component. Too often people either end up with too big files doing everything or too many small files that should just be a one file.

Use typescript and jsdocs. It will help you make less bugs and help unfamiliar devs quickly start working.

Use something like nestjs to give structure.

Other than that, you are good to go.

</comment><comment><USER8> I think you are too highly tying a developer to a specific technology.

Asking which one you are closer tied to reveals some inexperience in your product management role. Yes there is always a cost to finding new developers and having them ramp up on the codebase. And some of this can be mitigated by hiring developers who are familiar with the stack you've chosen. However the ROI you will get hiring a good developer who needs to learn your stack is much higher vs a mediocre developer who is familiar with your stack.

<comment><USER4> This is broadly true, though individual-variation means it is not absolutely true.

Hiring me to work on a PHP stack will be much less successful than hiring any other developer is okay with PHP.

(This isn't snobbery. PHP is like gluten.)

</comment></comment><comment><USER9> Had to look it up: mongo, express, react & node

One of several js everywhere stacks.

</comment><comment><USER10> > As far as I understood (correct me if I'm wrong please), the point of using > the React framework is that it's all "modular" and that the cost of > switching developers is lower.

I think your mental model of React may be incorrect. The point of using React is to make front end development easier and more sane, and the modularity allows for more easy re-use and composability. Switching developers still requires ramp-up, although a developer familiar with React would have a head start.

</comment><comment><USER11> I wouldn't worry about it. If you know JavaScript and/or *script (any of the more strongly-typed derivatives), going from React to Angular and back is pretty easy. If you're willing to be more flexible with people coming from other languages, the db/web/ui/app stack has been a thing for a long time and the basic premise of how it works is the same</comment>


The Cryptocurrency Industry Is 'On the Brink of an Implosion', Research Says - <AUTHOR> https://www.bloomberg.com/news/articles/2018-10-09/bitcoin-on-the-brink-of-an-implosion-researcher-juniper-says <comment><USER2> An important harbinger of trouble to come is that the Tether (USDT) coin, which is supposed to be pegged 1:1 to USD, is now trading substantially below $1:

[https://www.bloomberg.com/news/articles/2018-10-15/dollar- pe...](https://www.bloomberg.com/news/articles/2018-10-15/dollar-peg-that- underpins-20-of-crypto-trades-is-under-pressure)

Billions of Tethers were printed seemingly out of thin air and used to purchase Bitcoin. It's part of the foundation of the house of cards that keeps Bitcoin at its current price:

 _" Despite their modest total market value of about $2.4 billion, Tether's coins play an outsized role on cryptocurrency exchanges. They were the second- most traded among all digital currencies after Bitcoin as of Oct. 15, according to data compiled by CoinMarketCap.com."_ [https://www.bloomberg.com/news/articles/2018-10-14/why- crypt...](https://www.bloomberg.com/news/articles/2018-10-14/why-crypto- traders-are-so-worried-about-tether-quicktake-q-a)

<comment><USER3> I saw a couple of comments today about the price of USDT so I think it's worth while explaining how it works just in case anyone is interested in knowing more.

USDT is a pegged-currency. It's often described as a stablecoin but that's not correct because it doesn't have an inbuilt stabilisation mechanism unlike Maker's DAI for instance.

The way it works is purely based on well known legal mechanisms that have no cryptoeconomic properties on its own. The issuer holds a USD balance at a bank, then commissions a receipt that proves their balance and issues an equal number of USDT. 1 USD = 1 USDT at issuance time and the trustworthiness of both the issuer, the auditor and banks involved.

The token itself is used to facilitate trading and many investors 'park' their gains in USDT while waiting for the market to reach a certain point or just in between trades, but that means that the token's FX value is set by the open market itself so if there are more buy orders than available USDT the price goes up and if there are more sell orders than demand the price goes down. Where this gets interesting is that some exchanges list assets based on the USDT fx and not USD which opens some arbitrage opportunities like we are seeing today.

For more info:

[https://github.com/jpantunes/awesome- cryptoeconomics#stablec...](https://github.com/jpantunes/awesome- cryptoeconomics#stablecoins)

[https://stablecoinindex.com/](https://stablecoinindex.com/)

<comment><USER4> > The token itself is used to facilitate trading and many investors 'park' > their gains in USDT while waiting for the market to reach a certain point or > just in between trades, but that means that the token's FX value is set by > the open market itself so if there are more buy orders than available USDT > the price goes up and if there are more sell orders than demand the price > goes down.

If the USDT to USD ratio fluctuates so much, what is the point of 'parking' your money in USDT?

<comment><USER5> In theory you could just redeem your money from the Tether issuer, if it's actually backed by USD and they deign to let you redeem them.

<comment><USER4> In theory, cows are spherical. In practice, you can't actually do this.

</comment></comment></comment></comment></comment><comment><USER3> In general, if you pick the all time high as a starting point for your "research" it's all the way down from there. Bitcoin's daily transaction volume is moving to second layer so the metric used is not very useful.

More importantly, and I can't stress this enough, the FX value of a cryptocurrency is not directly related to the project's status (developer activity or security track record, etc) but it is correlated to public perception of its value, which is why these sort of article pops up every now and again at regular intervals.

[https://www.reddit.com/r/Bitcoin/comments/9niw8x/lightning_n...](https://www.reddit.com/r/Bitcoin/comments/9niw8x/lightning_network_at_the_senate_counterargument/)

<comment><USER6> By "second layer" do you mean lightning? Is that project off the ground yet? It's been a while since I paid attention.

<comment><USER7> It's very close, the only thing left to do is solve the Travelling Salesman problem in polynomial time.

<comment><USER8> This is funny, but solving TSP for most real-life networks is not super difficult. Anyway it's not exactly TSP because you don't have to find an optimal route, just any route will do.

</comment></comment></comment></comment><comment><USER9> I doubt it. There is nothing to implode. Most of the activity in the "industry" is shuffling around tokens between the various blockchains as their respective cheerleaders hype their chosen coin and spread FUD about competing ones. All of the "real" economic activity surrounding cryptocurrencies (e.g. darknet commerce) will continue regardless of the price since darknet prices are pegged against the value of government currency anyway. The cryptocurrency world will continue to churn with activity indefinitely because creating the appearance of activity _is_ what the industry does

<comment><USER10> ... and that economic value is tiny when compared with the speculative value. The untethering of tether portends a crash, IMHO.

<comment><USER9> Well, it depends on your definition of crash. We know that large price fluctuations are not uncommon in cryptotoken land so it's important to be clear about exactly what we mean. Personally, I'd consider a definitive crash to be a sub 1k BTC/USD price. I don't see that happening any time soon because the "speculative value" is very cheap to maintain with lots of enthusiasts broadcasting hype across every popular tech platform and the various exchanges generating superficial traffic and trading activity with very little cost.

</comment></comment></comment><comment><USER11> Bloomberg absolutely loves writing these "Anything not a central bank is on the brink of implosion" scare articles. They must generate a tons of views.

Unfortunately Bloomberg as a whole doesn't know anything about cryptocurrency beyond the speculation side which is similar to their existing competencies. But that's all they see.

We have a blind man feeling an elephant's ass and telling us it's shitty. While true, it only describes a tiny part of what cryptocurrencies are or do.

<comment><USER12> > Unfortunately Bloomberg as a whole doesn't know anything about > cryptocurrency beyond the speculation side which is similar to their > existing competencies. But that's all they see.

They don't know anything? Even though they partnered with Mike Novogratz to create an index?

[https://www.bloomberg.com/professional/product/indices/bloom...](https://www.bloomberg.com/professional/product/indices/bloomberg- galaxy-crypto-index/)

<comment><USER11> I never said they don't know anything about finance or speculation markets. But if you (and they) think that's all cryptocurrency is then you're missing 90% of what's up.

Bloomberg keeps trying to predict crypto's behavior based entirely on the most traditional looking speculation markets. Speculation markets aren't really a part of cryptocurency at all (they aren't on the blockchain(s)) but they are the only part of the concept that traditional finance people can (or will try to) understand.

<comment><USER12> I'm sure Bloomberg has a huge archive of speculative articles on stocks.

Why are blockchain advocates so emotional? They should understand these articles because speculation is a core feature of the ICO boom and cryptocurrency in general.

<comment><USER13> Sounds like "no true Scottsman" fallacy.

No one really cares about bitcoin and etherium, after their wild value swings.

Let alone - it's way too complicated for any layperson to grasp. Money is easy... but think about the distrust that many elderly people have with simple debit cards! Cryptocurrency will definitely be our nerdy wet dream

</comment></comment></comment></comment></comment><comment><USER14> Thanks Bloomberg for this advertorial summary of a 1250$ research .pdf. Saves me some money to invest (in crypto or otherwise).

Would you believe that the author of this research was harping about blockchain adoption by large companies less than a year ago? A lot has changed in 11 months, such as a slow price drop from the 2017 December insanity.

Isn't it a bit rich to first make companies anxious to join in on the bandwagon, then to turn around and say they are investing into something that is on the very brink of destruction? Based on pretending that Bitcoin was invented at its height in December 2017?

Heck, I did not sell any of my market research, I gave it away for free (silly me). Sure, sure, I made a few million here and there, but nothing like charging 0.5 BTC to tell you the financial world is collapsing, because John McAffee is so irrationally bullish.

This time it is real though. I can feel it too. Bitcoin is over! I hope you made out like a bandit, because soon, the only way to make money is to sell research about the impending bounce-back of crypto.

Of course the early adopters of Bitcoin are critical about its demise. They have a vested financial interest in seeing it succeed. Unlike these researchers, who only stumbled upon Bitcoin when they realized that people are willing to pay for their objective expert opinion on something they themselves missed the boat on.

<comment><USER15> > Heck, I did not sell any of my market research, I gave it away for free

Don't work for Bloomberg, eg?

Bloomberg News Pays Reporters More If Their Stories Move Markets: [https://news.ycombinator.com/item?id=18162440](https://news.ycombinator.com/item?id=18162440)

</comment></comment><comment><USER16> Bitcoin and similars are the biggest waste of computing power and energy in the history of the planet. It will be nice for the environment when this is all over.

<comment><USER17> Quite the claim.

Obviously you haven't heard of the NSA or the US Military.

<comment><USER11> For anyone downvoting this I'll expand what he said so you can understand it before reflex downvoting.

Nationstate backed fiat currencies require enormous amounts of energy waste in the form of standing armies and other tools of power. Compared to the energy Bitcoin uses to protect itself from attack or fraud this energy is very large.

<comment><USER18> Yes, because if cryptocurrencies became the standard, armies will become obsolete and Nation states will dissolve their Military programs. Makes sense.

<comment><USER19> Ha. That would be true if the only purpose an army was to stabilize the currency. The army/military of any nation does far more than that.

</comment></comment></comment></comment></comment><comment><USER20> Those red lines on the graph are just awful: arbitrarily drawn to make things look worse. Fit an actual model and drawn on prediction intervals next time.

I have never owned crypto currency, I'm just easily triggered by bad graphs.

<comment><USER21> Welcome to crypto, land of the arbitrary graph. pro tip: never read twitter streams from "crypto trader" your IQ will drop like that \

</comment></comment><comment><USER22> I'm uninformed and bearish on bitcoins, but I find it helpful to look at the historic bitcoin price on a log scale.

[https://bitcoincharts.com/charts/bitstampUSD#tgSzm1g10zm2g25...](https://bitcoincharts.com/charts/bitstampUSD#tgSzm1g10zm2g25zl)

Bitcoin has had _relative_ declines this big and lasting this long (late 2013 to mid 2015) only to bounce back later.

<comment><USER23> That's a very simplistic way to look at it. Before the latest huge price increase, bitcoin had very little real competition. Now it has proved that its artificially crippled capacity of 1MB is an enormous problem and that the limited throughput couldn't even come close to handling the last bubble smoothly.

<comment><USER22> My comment is intended to speak to cryptocurrency as a whole (the OP topic) rather than Bitcoin specifically relative to other cryptocurrencies. I welcome links to charts that show, e.g., total crypto market cap on a log scale.

<comment><USER23> > My comment is intended to speak to cryptocurrency as a whole (the OP topic) > rather than Bitcoin specifically

You said bitcoin twice and linked to btc's price over time, I'm not sure why anyone would take that to mean crypto-currencies in general.

This seems like a textbook example of moving goal posts.

<comment><USER22> This isn't a competition. I intended my comment to make one point, you interpreted it as another.

<comment><USER23> I interpreted you talking about bitcoin and linking to bitcoin's price graph as referring to bitcoin.

</comment></comment></comment></comment></comment></comment><comment><USER24> Wasn't there a HackerNews post last week about Bloomberg journalists getting paid for articles that move markets? This one seems like one of those articles.

<comment><USER12> Because you don't agree with it?

<comment><USER24> I don't disagree with it, my focus is more on it being a sensationalist piece of news, which makes the content less trustworthy because I know their goal is to make me move.

</comment></comment></comment><comment><USER25> I feel like its another case of the tech bubble. The projects with real causes and uses will come back from any implosion in the long run.

<comment><USER26> So illegal transactions and money laundering it is.

<comment><USER27> Iunno, if i were a billionaire, the idea of having $50m under nobody's control but my own that I can take anywhere, anytime, doesn't exist anywhere else.

I can't do that with gold. Bank deposits are always available until they aren't. But Coinbase can't do this either.

<comment><USER28> Edit: I calculated this wrong, please ignore this comment

<comment><USER29> Let us know how you get it through airport security.

<comment><USER30> > _Let us know how you get it through airport security._

How you get it through what now? Private aircraft don't deal with that. GP did specify "billionaire", and at that level at least fractional ownership in private long distance transportation is not a reach either.

<comment><USER29> The point is that transporting large amounts of money that can be physically confiscated is a problem, even if it somehow fit into a suitcase.

Debating the logistics of potentially being able to evade _some_ of those difficulties by having even larger sums of money (to afford private airliners or private security, even in times of unrest) and accepting larger risks misses the point.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> According to the finance industry and finance media, the cryptocurrency industry, and cryptocurrencies in particular, have been on the brink of collapse since 2008, when Bitcoin first surfaced and was worth $0.

I guess they're going all-in on the whole 'stopped-clock' prediction strategy, no?

<comment><USER32> It's fascinating to watch these patterns repeat themselves over and over. It's almost like we're all investing in an algorithm and everything's playing out according to its specifications.

\- Sincerely, a guy who's been buying bitcoin since 2013

</comment></comment><comment><USER33> Another one for the Bitcoin Obituaries [https://99bitcoins.com/bitcoinobituaries](https://99bitcoins.com/bitcoinobituaries)

Honestly I have no idea whats going to happen. I threw some money into Bitcoin I was okay with loosing and check on it every few months. It's been fun.

Maybe some perfect storm of the Lightning Network, Web Payments and dodgy banks or failing economies will bring about some crypto-utopia. Or maybe it will implode and in the end all we have done is collectively purchased a metric shit ton of GPU's.

Actually, that's not _all_ we would have done. It didn't work out but at least we ran the experiment.

</comment><comment><USER34> It's interesting that an article like this pops up now. From a technical analysis perspective the entire crypto market had been exhibiting classical accumulation properties for two months now.

Before critics show up - technical analysis is not meant to predict the future, but rather to pick the more probable outcome.

</comment><comment><USER26> Unless there's more analysis than what's quoted in the article, this appears to be nothing more than trend analysis based on the last few months.

</comment><comment><USER23> Here is Bitfenix's cold wallet address:

[https://bitinfocharts.com/bitcoin/address/3D2oetdNuZUqQHPJmc...](https://bitinfocharts.com/bitcoin/address/3D2oetdNuZUqQHPJmcMDDHYoqkyNVsFk9r)

They have about 934 Million in BTC, having had as little as 869 Million USD recently. Their tether liabilities are between 2.5 and 3 Billion USD:

[https://coinmarketcap.com/currencies/tether/](https://coinmarketcap.com/currencies/tether/)

It has long been asked how a token can be pegged to 1 USD without any actual USD.

The reality is that it can work if your balance in other currencies doesn't go below the average price you bought them at. The more the price of btc goes down, the more btc they have to give back when people exchange their tethers for btc (you can't exchange them for USD).

Two dynamics work in their favor:

First, exchanging tethers for btc means buying btc, which makes the price of btc go up. If people buy the btc so that they can exchange it at real exchanges for USD, then this effect would be temporary and you would see a disconnect between the price of btc at Bitfinex and real exchanges like coinbase. Two days ago the premium on Bitfinex was about $100, now it is about $400 higher than coinbase and bitstamp.

Second, what many think originally happened due to the stark correlation between tether creation and btc price jumps on bitfinex, was that the creation of tethers and subsequent transfer in bulk to bitfinex's exchange caused the btc price to rise. Now not only do they benefit from creating tethers out of nothing, they get the exchange commission on top AND get to create the illusion of demand. This illusion of demand was seen to work extremely well on unsophisticated investors during the run up to 20,000 USD per btc, helping to create articles, fear of missing out and general hysteria that brought in more unsophisticated investors buying in to something they did not understand.

</comment><comment><USER35> Well, hopefully graphics card prices will drop then.

<comment><USER27> My friend put a computer in their garbage bin last fall.

I took out its "worthless" video card and still sold it for $40.

</comment></comment><comment><USER36> I have a new BS rule when its a crypto currency headline just replace with Pharm Industry..you get the same exact meaning

</comment><comment><USER37> Instead of inventing bitcoin because evil banks maybe people should do some consumer rights stuff? I have become painfully aware that using an ATM in America costs money... Whose idea was that anyway. Why is Mastercard making billions? A percentage based fee instead of a flat fee. As if it matters if you use your CC to buy a carton of milk or a car.

Hocus pocus Capitol Hillus make usury illegal spell. I really don't want to use cash anymore.

</comment><comment><USER38> Getting my popcorn ready...

This is the silliest human endeavor that somehow seems to attract a few smart people too.

<comment><USER39> I wouldn't call it silly. The idea behind cryptocurrency (distributed agreement) remains a difficult problem to solve efficiently and securely. If nothing else, it is a worthwhile thought experiment.

As for whether or not any cryptocurrency will ever be stable and widespread enough to be usable in the western world remains to be seen.

<comment><USER40> _Trustless_ distributed agreement.

It's an interesting algorithm, but not actually useful. Society is literally built on trust. So "anti-government" (or "anti-social"?) currency is the _only_ use for it.

</comment></comment></comment><comment><USER41> Is there even any reason the world needs more than 1 cryptocurrency? I know there are dozens (hundreds?), but they all effectively do the same thing, right? Allow decentralized currency that can be used for legal and illegal transactions.

<comment><USER42> Just as programming languages are all (well mostly) doing the same thing.

Cryptocurrencies are tech products, various projects try various ideas. You'll have the initial blockchain idea from bitcoin, the privacy blockchain from monero, the programming contracts from ethereum, the decentralized exchange from stellar, etc.

I'm perfectly fine with that, I prefer to see people create new projects to test new ideas rather than to hear them complain bitcoin is not doing what they want.

</comment></comment><comment><USER43> Two anti-crypto stories on the same day?

"Blockchain isn't about democracy and decentralisation – it's about greed "

[https://news.ycombinator.com/item?id=18219256](https://news.ycombinator.com/item?id=18219256)

I'm not a fan of cryptos, but it's fascinating how so much of the media ( even in different countries ) push the same narrative in almost a coordinated fashion.

<comment><USER44> I'm a somewhat early adopter of Bitcoin, and believe in its long-term utility. Even so, I've been bearish for some time due to the influx of people who are buying coins or nothing more than speculation. I don't think that's "bad" per se, but it's not a sustainable means of growth.

I'm seeing more an more of these "the end is near" articles popping up. After witnessing a half dozen or so boom/bust cycle firsthand, my spidey sense is beginning to tingle that we're about to enter another one. After ten months of decreasing volatility and regression toward a mean price of $6,500 +/\- 5%, I'm expecting a run-up any day now. It may not be another "to the moon!" run, but it'll happen. When it does, the new value will stabilize higher than it is right now.

<comment><USER44> Ha! After writing this comment, I checked the price history for the first time in a month or two. There was a spike in price and volume about 12 hours ago, that at first glance appears to be the largest in six months or so.

</comment></comment></comment><comment><USER45> >Echoing sentiments of mainstream economists

Yea, Paul Krugman has been saying "Bitcoin is doomed" since 2012. He'll always be wrong because this is all politically motivated. The banking and political establishment are scared shitless by alternative currencies, crypto or otherwise. Google the "Liberty Dollar". Mouth pieces for the financial industry like Bloomberg will attack alternatives to the petrodollar no matter what they really think, and obviously they know Bitcoin has a future because Goldman-Sachs has bought tons of them.

<comment><USER46> I am not sure Paul Krugman is scared or politically motivated.

One of the strongest argument Paul Krugman makes against bitcoin is about trust. Like, he says dollar has value because US government backs it and you can pay taxes with it. Basically, he is questioning can bitcoin gain that level of trust among its users to be successful. Not the current level of some transaction around dark markets.

Personally, I don't know.

<comment><USER45> >US government backs it

Yes, by putting people in jail who put forward viable alternatives to USD, like Liberty Dollar. And making Bitcoin impossible to use legally as a currency by applying strict capital gains tax reporting requirements.

>Can Bitcoin gain that level of trust amoung its users to be successful.

The massive public and institutional buy-in over the past 5 years suggests that trust in its cryptographic security is not what is holding it back.

Bitcoin, from its inception, is part of a political battle, not a technological or economic one. Read the Satoshi white paper. Paul Krugman is saying that it wont be successful because the banks and government will fight it, and his social status is dependant on him being part of that fight. Do you think Krugman would keep all his exposure and prestige if he went off the reservation and criticized the banks and the petrodollar? No way.

<comment><USER40> > Paul Krugman is saying that it wont be successful because the banks and > government will fight it

He's wrong.

It won't be successful because it's pretty much unusable by regular people, difficult to secure (surprise, "be your own bank" implies "be your own security guard" — and 99% of people want to be neither of those things), extremely wasteful, slow and full of scams.

Most people's first encounter with buttcoins is literally RANSOMWARE. Do you really think mass adoption is coming?

<comment><USER45> Does having $100 in your pocket make you "your own bank"? Does it make you "your own security guard"? Real banks could hold deposits in Bitcoin if the regulators controlled by banking interests allowed it, but they dont. Why do you think that is?</comment></comment></comment></comment></comment>


The Internet's Original Sin (2014) - <AUTHOR> http://www.theatlantic.com/technology/archive/2014/08/advertising-is-the-internets-original-sin/376041/?single_page=true

<comment><USER2> Discussion of this story from last year: [https://news.ycombinator.com/item?id=8177063](https://news.ycombinator.com/item?id=8177063)</comment>


Conversation Between An Atheist Professor And His Student - <AUTHOR> http://www.nairaland.com/259804/conversation-between-atheist-professor-student

<comment><USER2> You can't analyze God rationally, you believe in God or not!</comment>


Google+ is now the second largest social platform by active users - <AUTHOR> https://plus.google.com/u/0/106382433884876652170/posts/hxWNwxYoLYQ <comment><USER2> This could be a little bit invalid because of things like Hangouts. My dev team has started using Google Hangouts as a free alternative to conference Skype. I bet I'm considered an "active" Google+ user because I have participated in a Hangout. It gets posted to my Google+ wall every time I do it.

I'm actually kind of annoyed every time I have to log onto Google+ to do something because I know they are about to add me to some press release statistic. There's something "evil" about that in my opinion.

Google's strategy is putting them in danger of becoming more hated than Facebook. At least I intentionally signed up for Facebook. Who at Google thinks they are going to beat Facebook by forcing anyone who uses Google services to be a part of Google+? It feels very Windows 95 let's integrate the browser into the kernel in the sense that I know as a user, this Google+ portion is not necessary to the product I'm trying to use, but it's being forced on me anyways. Same thing happens every time I'm on Youtube now. No, I don't want my Google+ page updated when I watch a video on Youtube, nor do I want to use my "true identity" when browsing Youtube, nor do I want to explain why I don't want to do that in a way that fits into Google's 4 prefabbed reasons that don't seem to include, "I'd just like to be anonymous, now get off my back about it."

The rate their going, I wouldn't be surprised if by next year something will be posted to Google+ when I read my Gmail and I'll be an "Active User".

What ever happened to making your product better so that people want to use it instead of "tricking" them into being a part of it?

<comment><USER3> There's really a lot of hyperbole in these discussions.

Apple gives you a single signon for their App Store, iCloud, and many of their other services. It unifies your interaction with Apple related HW and services to a single identity. Does it anger you that Apple forces you to sign into your AppStore account to use iCloud when they could be separate? Facebook is used by many sites as a signon credential (which is what I mostly use it for).

For the most part, all of this talk about Google "forcing" you to use G+ to access their other services is really about promoting a single signon, centralized account profile, instead of having different accounts on different properties. This yields a consistent user interface, and centralized location for you to view what information Google knows about you for all their services, and how to delete or export it. You can choose to not "sign in" on some of the properties, for example, legacy YouTube logins still work, but honestly, is it really better for the user if you had a different account for YouTube, Gmail, Maps, Drive, etc and had to log into all of them separately? For example, having Google Wallet linked to your profile lets you buy something on YouTube, in Google Play, or elsewhere, without fumbling with a credit card.

Unlike some of Facebook's services/apps, Google does not automatically share your activity on some news feed every time you do something on their sites, you have to specifically choose to share it. Indeed, it appears G+ doesn't want to pollute the feed with lots of autopublished stuff which interferes with S/N search quality, which is one reason theorized as to why no "write" API exists yet.

G+ is plus.google.com, if you are on other properties signed in, then the biggest benefit is having the Share button be able to pull your contacts, combined with a single place to manage your settings for everything.

In many cases you have a choice. You can use Chrome without signin. You have incognito windows. YouTube doesn't require signin unless the video is NSFW, etc.

I for one, appreciate the "G+ as a common layer across Google Websites" for the purposes of unified profile/single-signon. The plus.google.com newsfeed service is just one addition service you can either choose to use or not. It's best not to think of G+ as a social network + activity stream like Facebook.

<comment><USER4> There is a lot of hyperbole. And also a lot of ignorance as in your post.

Today on Youtube. I am signed in and wanted to bookmark a video I just saw. I can't do that without them creating a PUBLIC Google Plus account with my FULL NAME even though I am already logged in.

Care to explain that one ?

<comment><USER5> That is because you are signed into YouTube using your Google account and not a YouTube account. If you create a YouTube account that you sign into using your Google account you would be prompted to update to Google+ but would not be required to.

</comment></comment></comment></comment><comment><USER6> When G+ initially came out, everybody here was excited to have an alternative to Facebook. Posts about their increasing user numbers were celebrated and everybody was excited.

Then it became clear that Google, like Facebook was going to force people to use real names and since then, everybody likes to hate on G+. Whatever they do is said to be even more evil and whenever they or others publish user numbers, everybody is explaining how the data must be wrong and how G+ is a ghost town and a failure.

Can't we just be honest here? Yes. The real name policy sucks. But does this mean the whole G+ is a failure and every evidence to the contrary must be wrong? Just because you dislike it doesn't mean everybody does.

<comment><USER7> That's actually the only reason i dont care about google+ , the real name policy doesnt only suck its freaking dangerous!!!! cause if facebook goes after your account, so what, you lose some pictures and posts? but you can make a new one and find your friends fast! its bothersome, when google goes after your account, you lose your mail, your documents, your adwords, your adsense, your android.... its a web apocalipse, and for what? for not using your real name? wtf is that! so i dont think avoiding google+ is a question of dislike, more like a preemptive attempt to keep your valuable data safe.

<comment><USER8> Please don't spread misinformation. If Google has a problem with your name, they will at most prevent you from using Google+ until you fix it. The other Google products you use will be unaffected.

<comment><USER9> [https://plus.google.com/116098411511850876544/posts/4t8sFLLK...](https://plus.google.com/116098411511850876544/posts/4t8sFLLK4hK)

<comment><USER8> If it ever were the case that Google would lock you out entirely, that is no longer the policy (nor has it been for a long time). A lot of the early reports that people were getting locked out of Google were centered around one person, who claimed to have been locked out from Google over his name, but it turned out the lockout was because he'd uploaded questionable images to his account (I can't find a link at the moment, but here is Matt Cutts alluding to it: [https://plus.sandbox.google.com/u/1/+MattCutts/posts/NNJduMF...](https://plus.sandbox.google.com/u/1/+MattCutts/posts/NNJduMFjFKS)).

The policy, for the record, is here (see the bottom of the page): [http://support.google.com/plus/bin/answer.py?hl=en&answe...](http://support.google.com/plus/bin/answer.py?hl=en&answer=1228271)

<comment><USER7> :\ you are joking right! did you read the policy? i'll quote "If your profile is suspended, you will not be able to make full use of Google services that require an active profile such as Google+, Reader and Picasa. This will not prevent you from using other Google services, like Gmail. Your profile can be restored by editing your name and submitting an appeal that will be reviewed by our team, as directed by on-screen instructions."

soooo nothing has changed! if they dont like your name or if you dont have a good enough proof bye bye!!! im not spreading misinformation, my coment is still pretty much valid, there is still to this day a chance that by signing up to Google+ that they will suspend your account!

</comment></comment></comment></comment></comment></comment><comment><USER10> According to the definition from the source document, visiting this link is probably sufficient for you to be counted as a Google+ user.

<comment><USER11> Is there any measurement of social networks that doesn't count people viewing a web page on the social network as a user?

<comment><USER10> A social network that does nothing but serves web pages isn't a "social network", it is a "web server"

A social network that does nothing but allow the user make use of web applications is not a "social network", it is often called an "application server", or perhaps still "web server".

A social network as originally defined, was a particular kind of web application where one could describe real-life relationships to a machine which would then attempt to assist the user in maintaining those relationships, for example by sharing drunk shots or funny cat videos.

Google+, in almost all its integrations with other Google products, does not count as a "social network" in the traditional sense -- rendering a "G+" button in an endless series of places where it might accidentally be clicked does not constitute helping the user maintain real world relationships. Forcing users of older web applications to create a Google+ account in order to remain a user of that older web application does not constitute helping the user maintain real world relationships. Integrating arbitrary applications tightly with Google+ does not unconditionally constitute helping the user maintain real world relationships.

In every conceivable way Google+ is a failure as a social network: almost everyone uses Facebook for what Google+ tries and fails to achieve, these "stats" only serve to highlight this each time they appear in the news. In the meantime, it has turned into some kind of mediocre blogging platform, except it doesn't support RSS (because that would encourage people to never visit the site – undistorting the stats against Google's favour).

To count me as a "social network user" I would first expect said network to have helped me maintain real life relationships somehow – Facebook does this, and not by pilfering my Gmail address book, not by tricking me into clicking a share link while I watch a lolcat on YouTube, not by crippling my favourite applications (Reader), and least of all not by rendering blog posts.

Google's only successful social applications to date (IMHO) have been Gmail (including Talk) and Reader, and they already managed to kill one of these in their panic to beat Facebook.

</comment></comment></comment><comment><USER12> I'm not sure where GWI gets their information, but the number 343m seems a good match to G+'s "total actives", as the last result we shared publicly was 235m but that was almost 2 months ago. The number of G+ accounts was already much bigger due to migration, but the number of "stream actives" (people who actually used plus.google.com, or the mobile clients, in the last 30 days) was lower at 135m (again, on Dec 6). Current numbers are bigger, the stream actives may or may not already be in the ballpark of GWI's claim, but AFAIK we didn't yet share new numbers after Dec 6. Rest assured though that when we officially share "stream active" numbers, it's real stuff no tricks.

GWI's comparison is difficult because not all social networks disclose the number of strictly active users -- how many people recently checked their stream/profile/whatever. Most notably, Facebook only publishes the biggest stat of total number of open accounts.

<comment><USER12> s/profile/timeline

</comment></comment><comment><USER13> There are lies, damned lies, and statistics.

Here is the blog post to the "report": [http://globalwebindex.net/thinking/social-platforms- gwi-8-up...](http://globalwebindex.net/thinking/social-platforms-gwi-8-update- decline-of-local-social-media-platforms/)

According to the article: "Active Usage" (defined as "Used or contributed to in the past month").

Now according to Wikipedia (<http://en.wikipedia.org/wiki/Gmail>): As of June 2012, it (Gmail) is the most widely used web-based email provider with over 425 million active users worldwide.

Do you really believe that 80% of Gmail users are "active" Google+ users?

<comment><USER14> I'd love to see some statistics relating to time spent on the site, or number of page views. I suspect that G+ would be orders of magnitudes lower than Facebook

<comment><USER15> > I suspect that G+ would be orders of magnitudes lower than Facebook

Ignoring Facebook here, this chart should give them food for thought: [https://www.google.com/trends/explore?hl=en#q=instagram%2C%2...](https://www.google.com/trends/explore?hl=en#q=instagram%2C%20google%2B%2C%20tumblr&date=1%2F2010%2037m&cmpt=q)

<comment><USER4> Explains the recent move to trick all the YouTube users into signing up for Google+.

I mean seriously why does creating a private video playlist require a public Google+ page.

<comment><USER16> I stopped using Youtube's customization features years ago.

I don't want everybody to know what kind of music I listen to and what my interests are like. Google does not seem to get that. In fact I might stop using Youtube completely soon, except for watching linked Videos. As we all know a login is necessary to watch Videos that are not for children.

In fact Google search has become weird since they more or less half-publicly track which sites I'm visiting from Google. Seriously, this has to stop.

</comment></comment></comment></comment></comment><comment><USER17> It just doesn't matter how many stats they release. The stat just doesn't "feel" true. I have never read a report from anyone who has signed into Google Plus, who has reported anyone but Google employees or their friends using the service.

The only thing bragging about statistics from the service does is make people trust Google less. It does not further engender confidence in Google Plus.

I agree with those that point out that Google Plus is counting "active" users in fallacious method. Common sense of millions of users has to square with the stats companies are releasing. Facebook's? They make sense. Google's? They just don't.

<comment><USER18> Your comment doesn't "feel" true to me. But I'm signed into Google Plus on a daily basis and while it turned out that one of my coworkers is married to a Googler, she's the only Googler I interact with on a semi-regular basis. And I pretty much _met_ her through G+; it was months later that we actually met in real life.

</comment></comment><comment><USER16> Is there a correlation to Google asking me yesterday to merge my Youtube account with my Google account?

</comment><comment><USER19> Google+ posts are rated unsurprisingly much higher in Google results than Facebook posts.

<comment><USER20> Facebook's robots.txt looks pretty restrictive:

<http://facebook.com/robots.txt>

Their sitemap doesn't even load for me.

(I don't use Facebook so I don't know how much this covers, but it's an interesting read compared to <http://plus.google.com/robots.txt.>)

<comment><USER21>
       User-agent: *
       Disallow: /

Yep, pretty much everything.

</comment></comment></comment><comment><USER22> Google+ is the most thriving dead platform of the web. People keep on calling it an empty playground and it keeps on growing. Man are people going to turncoat on this shit if it finally makes it HUGE some day.

<comment><USER4> Google can try and force Google+ down the throats of every unsuspecting Gmail or YouTube user. But you know what it isn't an authentic sign up. It is "tricking the user".

And it may work in the short term but it sure as hell won't work in the long term.

<comment><USER22> Yeah, I can see that. I don't know about you though, but I've had the feeling that people really are engaging more on Google+ than they were before. And it's a different demographic too, one that I like better. More technical people and more refined discussions. Just my opinion though, nothing about Facebook per se.

<comment><USER16> Google+ encourages Blog-style postings. (I don't know how they do it, but it seems natural -- more natural than on FB.) After all Google+ is pretty cool for people who don't want a private life, unfortunately I don't belong to this group.

<comment><USER18> They do it by not bringing up the word "friend" everywhere, actually. Compare Wordpress versus Livejournal; the latter is practically a synonym for emo angst, even though there are strong intellectual posts on the site, but the former doesn't have such a connotation. The problem with having a network with your friends is that there's a natural echo chamber that inhibits really high quality discussion. It's not impossible, but it's a lot harder.

By touting circles as a way to follow completely random people, smart people who want smart posts will naturally gravitate towards other such people and it causes a network effect: at minimum, lots of sharing; at maximum, heavy duty responses.

My favorite circled person in my 2000-odd list is some random academic in Idaho who I saw make a comment one day and decided to add. <https://plus.google.com/112482032780181267192/posts>

</comment></comment></comment></comment></comment><comment><USER23> i still remember how people dismissed facebook b/c "everyone was on myspace" or that an average person would never use twitter.

google+ is bound to grow b/c people love google products and the new google is trying to integrate these products for a better end user experience. as a heavy google user i can easily see that.

</comment><comment><USER24> Wheres the MSN Live/Skype/Xbox network?

</comment><comment><USER25> What is considered an active user?

<comment><USER26> If you follow the links to the source Globalwebindex doc, they defined it as "Used or contributed to in the past month".

<comment><USER4> So Google is counting YouTube users who save videos to their playlist as "active users".

Absolutely disgraceful. I feel sorry for advertisers that are going to be tricked by this.

<comment><USER12> Read my other reply.

</comment></comment></comment></comment><comment><USER27> And we care why?

</comment><comment><USER28> This entire discussion here reminds me back when GMail touted 30 million users. "It's still a beta", "They'll never get as much users as hotmail or Yahoo! Mail!", "People just signed up to try it!", etc.

Now they're the most used webmail and people aren't disputing it anymore.

Same when they bought YouTube: "Google is going bankrupt, they bought a money drain, game over Google".

On my statistically insignificant level, I do see my contacts (the ones who are both on FB and on G+) post more interesting stuff on G+ and less and less things on FB. The one thing people do still post are vacation brags "Been there, done that, 30 deg Celsius here, must suck to be at home for you guys" and the classic "I hate noodles, now I have diarrhea, life is a bitch" followed by "Like"s and "Be strong mate, you'll be ok soon".

That and people who hardly post anymore because of FB security concerns who then post stuff explaining how to harden FB security settings ; )

<comment><USER29> People _liked_ Gmail, though. It was a product everyone loved, a major upgrade for webmail. Google+, on the other hand, has some cool features but is also a cudgel that Google is beating us over the head with if we want to post YouTube comments, Google Local reviews or Play Store app reviews, none of which ought to require using a real name. As Gmail users we're constantly nagged to "upgrade" to Plus. These are legitimate reasons to dislike G+; it's not just jealousy.

<comment><USER23> i think you are missing the point. using real names decreases spam as was a known problem with app reviews/ratings on play store.

i do agree that google+ would be even more awesome if they had post or reply as "anonymous" feature like in quora.</comment></comment></comment>