Google doesn't recognise or penalise stolen content - <AUTHOR> http://www.pi-datametrics.com/fatal-flaw-googles-inability-recognise-stolen-content/ <comment><USER2> I think this is pretty fair on Google's part. How could you possibly figure out who owned content?

What if I published a book, it was copy-pasted in blogs, and then later I put it somewhere crawlable by Google? You certainly can't just say "first time we saw it, that's the proper owner". It would either require a massive amount of manual QA to get right (and even then, there are going to be interminable copyright battles), or have a super high error rate.

I think Google's best value is letting proper content owners easily find violators via normal searches, and let them deal with them via takedown notices or the court system -- which is where it should be done, not in a pseudo-court run by a Google who does not want what responsibility.

<comment><USER3> So back when Blekko was a consumer search engine we could 100% figure out who owned content on sites we crawled often. And even when we didn't we could often guess correctly more often than not based on the domain registration dates. (not to mention registry owners). That is because few people who rip off content rip off just one web site, they will rip off dozens of web sites and they will all share the same AdSense ids and the same domain registrar. This is _easy_ stuff to spot when you crawl the web regularly.

I suspect that Google simply doesn't care. They get Ad revenue regardless and in their laissez-faire editorial position it doesn't matter. What are you going to do, use another search engine?

<comment><USER4> Or, more likely, they can't get involved for legal reasons. If they took steps to block the easy stuff, an arms race would ensue, and the content providers would never be satisfied with the performance being provided _for_ _free_ by Google. The content providers would always demand stricter enforcement, and could threaten to sue for copyright infringement regardless of merit.

<comment><USER3> I think if that were the case they would not have pushed out the "Panda" updates which penalized content farms so heavily. If their past behavior (with content farms and other "low value" content sites) is a guide they will not do anything until enough people complain about it.

In the mean time it isn't even Google's content so its not a hosting issue, they are just the "neutral" third party providing their 10 blue links (oh and supplying the advertising engine those sites are using)

</comment></comment></comment></comment><comment><USER5> I was huge into SEO for a few years. I try to stay out of it now, but it's worth noting that this is almost certainly due to the current algorithm's obsession with "freshness." The weaker site is ranking higher with the stolen content because their site was updated more recently. Steal some back and I bet they swap ranks again.

Also, the combination of the pagerank algorithm and normal user behavior typically helps Google to understand who was first and who deserves to rank higher. That is, most people don't plagiarize content, they quote it and then cite the source, which (thanks to pagerank) tends to rank the original better than sites which have plagiarized it.

<comment><USER6> _> the current algorithm's obsession with "freshness."_

Which is how Google makes blogspam such a good business to be in, even if your content is inferior to the post you used for "research".

<comment><USER5> Most of the spam I see in the wild these days is indeed (established) dropped domains which were picked up and then loaded with thousands of pages of "fresh" spun content, with an incestuous backlink profile if any. So indeed 'blogspam'. Everything old is new again; it feels just like twelve years ago. Soon people will be keyword stuffing in a font the same color as the background...

But Google certainly isn't intending to make blogspam a good business to be in, and I'd argue that they aren't; over the past four years Demand Media's stockprice has fallen from $400/share to $4, and the general marketplace for commoditized SEO services has shrunk by a similar degree over the same period. 19 out of every 20 SEOs who were active five years ago have thrown in the towel... just check alexa graphs for the top SEO forums.

The SERPs are clean these days. Google has done an amazing job every year for at least thirteen years now of improving them constantly. The new wave of spam is social. In practice this means Buzzfeed writers stealing user-produced content from AskReddit threads and it ending up polluting my Facebook feed to the point that I can't even find any good counterfeit Raybans.

<comment><USER7> "The SERPs are clean these days."

Here's an alternate take on that [http://www.johnon.com/1075/bullish-on-seo- rankbrain-vs-seobr...](http://www.johnon.com/1075/bullish-on-seo-rankbrain-vs- seobrain.html)

<comment><USER6> That's fascinating because I really don't understand it. Maybe I'm just out of touch with SEO, but things like this escape me completely:

"This is because SEOs follow and influence the intent of searchers in the marketplace, while Google's algorithm (and AI) merely monetizes it."

Where does the extra monetization on page 1 results come from? Unless he's implying that Google provides bad search results so that people will click the ads instead.....

<comment><USER7> There are numerous ways to interpret that. At a base level, one could look at how the mobile search results are sometimes a screen full of ads, or how in some verticals they are a screen full of ads followed by yet another screen full of ads.

And then there is the knowledge graph & other flavors of scrape-n-displace, which is largely content recycled from elsewhere, given prominent positioning not based on merit or editorial quality, but based on who the publisher (or recycler) is.

Another parallel trend would be the confirmation bias / brand bias factors promoting older and staler sites. Or simplified "take" articles in the mainstream media rather than the original source articles on niche hobbyist blogs and forums or such.

And in taking broad sets of new niche intents and trying to guide those streams of users back down well worn paths. For example, sometimes when you want to find a particular news story _about_ a broad & well-known web platform like Apple, Amazon, Facebook, or Google it can be hard to find sites other than the official site. And on some other longtail queries Google rewrites what is being searched for in a way that brings up some results that don't match the true searcher intent. Probably the best example I can come up with on this front is say you wanted a pair of shoes of a specific brand, size, width, and model number. If they are not the most recent and most heavily marketed versions it can be tough. Auto-generated internal search pages on trusted brand sites rank well, while a small retailer carrying that specific shoe might be penalized by Panda.

</comment></comment></comment></comment></comment></comment><comment><USER8> This came up before on YC.[1] Google does have a system to detect provenance, but you have to report your changes to Google as an RSS feed.[2] Google hasn't updated that page since 2010, and it may no longer do anything.

[1] [https://news.ycombinator.com/item?id=10103545](https://news.ycombinator.com/item?id=10103545) [2] [https://pubsubhubbub.appspot.com/](https://pubsubhubbub.appspot.com/)

</comment><comment><USER9> And they shouldn't. Thats not their job.

<comment><USER10> As it is not the job of the street vendor to know from where come these Rolex.

<comment><USER11> I don't know if you're being sarcastic, but it is illegal to sell stolen or fake merchandise in the United States. Anyone selling fake Rolexes is committing a crime and could also be sued.

Saying that Google is "selling" stolen content isn't that clear, though. Yes, they're selling ads on search results, but wouldn't they get the same ad revenue regardless of where those links pointed?

It's easier to make the case with AdSense, where Google literally profits directly from stolen content.

<comment><USER12> _it is illegal to sell stolen or fake merchandise in the United States. Anyone selling fake Rolexes is committing a crime and could also be sued_

Huh? Now I'm worried. Are you telling me that the Rolex watch I paid $30 for, that I bought from a street vendor near Times Square, might be fake? Oh no, the horror! /sarcasm

I don't think that Rolex is too worried about this. Nobody would mistake a $30 watch for a real Rolex. And, give it credit, my fake Rolex worked for a year or so. It probably just needs a new battery.

Besides, you can't sue a street vendor. They're what's known as "judgement proof".[1]

And as to police action against them, the de Blasio administration seems to have adopted a laissez-faire attitude about all this stuff. If they're willing to allow squeegee men to operate with impunity, they certainly won't care about novelty watches being peddled.

[1] [https://en.wikipedia.org/wiki/Judgement_proof](https://en.wikipedia.org/wiki/Judgement_proof)

</comment></comment></comment></comment><comment><USER13> This may be pedantic, but is stolen the right word to use?

I think plagiarized is more accurate.

<comment><USER11> Plagiarism can also apply to copying content without using the exact same wording. In my mind, "stolen" means copying verbatim.

Plagiarism comes from a word meaning "kidnapping" though, so the tone of both words is pretty similar.

<comment><USER14> _Stolen_ implies that the original owner no longer has access to the data due to the actions of the perpetrator.

<comment><USER15> For physical property, yes. For intellectual property, it can still be stolen even if the original owner still has a copy.

e.g. The Soviet spies stole the plans for the hydrogen bomb.

<comment><USER16> No, for intellectual property the word "stolen" is not appropriate.

(Well, unless you're talking about getting the courts to tell the original owner it's yours instead. Which has been at least attempted a few times.)

<comment><USER15> It is semantically appropriate for the word _steal_. I think you're confusing it with the criminal implications.

</comment></comment></comment></comment></comment></comment><comment><USER17> What a rubbish article.. It doesn't fly for a second under copyright law. Google is entirely within their rights doing what they're doing. The onus isn't on Google to detect the infringing content.

For anyone interested in copyright and legal issues, I'd recommend checking out techdirt.com. They have a great starter section at [https://www.techdirt.com/blog/?tag=techdirt+feature](https://www.techdirt.com/blog/?tag=techdirt+feature), and they cover legal, copyright, patent, surveillance and all sorts of related topics. High quality journalism.

</comment><comment><USER18> Is this any better/worse than Facebook actively trying to profit and win over users when people or organizations copy / upload / soak up views for material they did not create and don't have the rights to use? Because that's a hot- point of discussion in some creative circles as well.

<comment><USER19> Facebook's freebooting is pretty terrible. But this can destroy entire websites. The title is misleading. Google isn't just not punishing thieves, it's _heavily_ punishing the originals. They dropped from 20th result, to 100+, because someone stole their content.

<comment><USER18> Yikes! That is much worse, at least based on your note. Do you think this is an area where the EFF could litigate on behalf of the original creators in a fraud context? Just curious, and also grateful to not be dealing with such a horrible prospect.

</comment></comment></comment><comment><USER20> Recognizing "stolen" content autonomously can only pivot on knowing when something was first published or visible to Google, which is a pretty dubious measurement.

<comment><USER21> But the weird thing is the stolen content, even when it's on a crappier site with no shares etc., knocking the original out of its slot. I.e., something (probably freshness) is causing the stolen content on the crappy site to be higher-ranked than the original content on the strong site. That seems avoidable (and in Google's best interest).

</comment></comment><comment><USER22> The title should more accurately be Google _search._ Many parts of Google, for instance Youtube definitely do penalize stolen content.

<comment><USER23> I have had a site that had UGC spam promoting dodgy TV streams - get hit with a penalty.

</comment></comment><comment><USER24> Advertisement post?

<comment><USER25> Yes but a very interesting one.

</comment></comment><comment><USER26> This is not stealing, and even if it is illegal that is a bad way to put it. Also, google's service is primarily to the searcher so this isn't a huge issue for them.

<comment><USER11> > _google 's service is primarily to the searcher_

You are very wrong. For many years, nearly 100% of Google's revenue was from AdSense.

What if someone spends days writing an article and posts it on his blog. Then, someone else copies and pastes it onto BuzzFeed, which becomes the top search result for that topic.

BuzzFeed is making money that the same blogger would have made from his own content. Now, also assume Google serves ads to BuzzFeed, but it does not serve ads to the blogger. _Google has a financial interest in ignoring the provenance of the content in this case._

Is all of that ethically acceptable?

<comment><USER27> > You are very wrong. For many years, nearly 100% of Google's revenue was from > AdSense.

That's incredibly untrue. A substantial portion of Google's revenue has always been and continues to be from first-party AdWords ads.

The fact that you're using BuzzFeed as an example, a firm which emphatically does not use display ads, shows how little you know about this.

</comment></comment></comment><comment><USER28> It's downright tragic to ask for more rules.

</comment><comment><USER29> There is no such thing as "Stolen" content.

<comment><USER11> If that's true, there's also no such thing as "stealing" at all.

Consider a novelist who works for 10 years on her novel. A hacker steals the document from her computer and publishes it online under his own name. He makes $100M.

Is it wrong for the novelist to feel like someone stole from her? What word would you use instead?

<comment><USER30> > What word would you use instead?

Infringing. (duh)

<comment><USER11> I can't tell if you're joking, but "infringe" means "to violate" which implies that there is a law or agreement that's being broken. That makes it sound like you agree with the idea that this is stealing.

<comment><USER30> I absolutely do not agree with the idea that this is stealing. How can it be stealing, when the owner still has the thing that was supposedly stolen?

Different circumstances, different terminology. The correct terminology (see US Title 17 or CDPA 1988) is "infringing". Anyone who insists on using the word "stolen" is signalling their ignorance of the first, most basic fact of copyright law.

<comment><USER11> In my example, the specific crime may not have been stealing, but there was revenue stolen.

<comment><USER31> _but there was revenue stolen._

1.) If the item is being given away for free, there can still be infringement.

2.) If a person would never purchase an item at the available price (due to the law of supply and demand for example), that person might still infringe. No revenue was lost or gained since the transaction would never have completed at the existing price.

In either of those cases, no revenue was "stolen", but infringement still occurred. These are some of the many reasons that stealing isn't a good way to describe copyright infringement.</comment></comment></comment></comment></comment></comment></comment>


Speak to learn English with Spell Up, a Google Chrome Experiment - <AUTHOR> http://chrome.blogspot.com/2014/05/speak-to-learn-with-spell-up-our-latest.html

<comment><AUTHOR> For me it doesn't work with Google+ blocked by AdBlock (now that's a directive to push Google+ :-)</comment>


Ask HN: What are best practices for implementing app analytics? - <AUTHOR> I'm building two apps currently. The first is iOS and we're being very precise about what we track with Google Analytics so we can determine precise ratios/rates of change etc. We're a team of three. For the second product (iOS, Android, Windows), we're slapping tracking on EVERYTHING, with a few specific metrics in mind and figuring the rest out later. That team is 25 including a GA implementation specialist. I see arguments for both methods but which is the better practice? <comment><USER2> I'M a huge fan of Heap Analytics ([https://heapanalytics.com/](https://heapanalytics.com/)). Rather than trying to be precise about what to track and how to instrument the analytics system, you just install their SDK (or JS on your website) and then you have every single thing tracked. Since you collect all the data from day one, as your products / apps grow and mature, you can develop new ratios / rates of change, etc and have them work retroactively.

It's magical. :)

<comment><USER3> I'm looking to Heap but I'm thinking of using it via Segment which is a wrapper for a bunch of services. Like Zapier for customer data collection.

<comment><AUTHOR> Will you use Heap for a website or mobile app? Seems most of their client base are web-first.

</comment></comment></comment><comment><USER4> The best practice is to identify which key metrics are the most meaningful for your business goals. Without knowing where you're headed, it's difficult to know what to measure.

Then figure out what's the cost of tracking everything? Does it affect UX? Does it affect your storage capacity? Do you have an analytical team that can work with all that data?

In theory, great idea to track everything (personally I would too). But it may save you more time just to focus on the ones that matter instead of ones that don't.

<comment><AUTHOR> Yeah I agree with specifying which are more meaningful for the app/product. For my larger team we've done just that but the GA specialist is pretty gung- ho about tracking everything -- the cost is developer time and effort -- and for me, working with the analytics team to decipher the output from tracking it all -- a lot of event tags (descriptors) to keep in your head!

<comment><USER4> Exactly! Ran into same issue taking a long time trying to parse the output of everything. If tracking and storing everything doesn't add significant cost, I'd do just that but come analysis, I'd only limit it to a few unless there's something that you need to dig deep when problems arise.</comment></comment></comment>


Key learnings from running a successful startup news blog  - <AUTHOR> http://antti.vilpponen.net/2010/12/22/key-learnings-from-arcticstartup-part-1/

<comment><AUTHOR> Arctic Startup is a good example of a niche blog that has been able to generate reasonable revenue. Recommended reading.</comment>


Getting to scale: direct marketing vs. mass market thinking - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2010/07/getting-to-scale-direct-marketing-vs-mass-market-thinking.html

<comment><AUTHOR> conclusion:

       "Get it right for ten people before you rush around scaling up
       to a thousand. It's far less romantic than spending money at
       the start, but it's the reliable, proven way to get to scale if
       you care enough to do the work."</comment>


Revisiting Coronavirus Data Analysis - <AUTHOR> https://kirstenhacker.wordpress.com/2020/03/22/revisiting-coronavirus-data-analysis/ <comment><USER2> Not data analysis, just weakly argued opinion. Author even accuses "Germany's virologists" of "lying".

While this seems like pessimistic bias I think much of the confusion about mortality rates stems from the multiple definitions. Is the denominator infected, symptomatic or hospitalized? These three estimates - still very uncertain today - will vary drastically.

Here's some actual data analysis on this subject: [https://www.nature.com/articles/s41591-020-0822-7](https://www.nature.com/articles/s41591-020-0822-7)

<comment><AUTHOR> If the death rate turns out to be 0.5% as claimed by the virologists on the German nightly news, I'll stand corrected. They say that the dark number of unreported cases is a factor of ten of what is reported, but if it is a factor of ten in Germany and South Korea, then it has to be a factor of 100 in places like the US, UK, Spain, and Italy. I like clear data presentation and many people mistake complex data presentation for quality. Just compare the CDC site and the worldometer site. Anybody can do simple calculations to interpret worldometer data, but the CDC site presentation is harder to parse. I think this is a deliberate form of gatekeeping. Incidentally, from where I am in Germany, I can only view the first page of the Nature article you linked. As with all articles of its sort, the devil is in the details.</comment></comment>


Ask HN: What music motivates you? Any genre. Go. - <AUTHOR>

Trying to make a new playlist on Spotify for the Summer, a lot of work to be done and a lot of fun to be had. <comment><USER7> List of my most frequently played Spotify tracks that I've fav'ed while coding. Mostly discovered through Spotify radio.

        Action Bronson - <USER2>
        Feed Me - Rat Trap
        Gammer + Whizzkid - We Killed the Rave
        Michael Woods - Flash Hands
        Robyn - Hang With Me (Acoustic)
        ATB - 9pm (Till I Come)
        K-391 - Electro House 2012
        You Blocked Me on Facebook - Internet Friends
        Groove Coverage - 21st Century Digital Girl
        Vinylshakerz - One Night in Bangkok
        Tantrum Desire - Reach VIP
        Kdrew - <USER3>
        Pegboard Nerds - Razor Sharp
        Disclosure - You & Me - Flume Remix
        Todd Terje - Inspector Norse
        Flight Facilities - Crave You
        Friendly Fires - <USER4>
        Chromeo - Jealous (From the Google Watch ad)
        Flux Pavilion - <USER5>

And for fun:

        The Chainsmokers - #SELFIE
        The Teenagers - <USER6>

Playlist: [http://open.spotify.com/user/1235363762/playlist/4OkN4iv5XBt...](http://open.spotify.com/user/1235363762/playlist/4OkN4iv5XBtmVJprepPIV2)

</comment><comment><USER8> Artist: Soundgarden. Badmotorfinger, Superunknown, and Down on the Upside, specifically.

Devo is my go to for programming music (Freedom of Choice, New Traditionalists, Oh No! It's Devo). Not gonna lie, you may well hate them, but for whatever reason Devo works for me when I'm trying to focus.

Also a big fan of the album Love by The Cult and pretty much anything by David Bowie or Rush. For newer stuff, Zero 7's Simple Things is really chill. Also, if you're really looking to zone out to something esoteric, Bethany Curve and Children of the Bong are nicely mellow. The album Who's Next by The Who is also great. Guess I'm just dumping my Spotify playlist out at this point, pick and choose what you want? :)

</comment><comment><USER9> I have an entire playlist dedicated to folk-metal drinking songs, enjoy - [http://open.spotify.com/user/shortkid422/playlist/2uNWN1AEQO...](http://open.spotify.com/user/shortkid422/playlist/2uNWN1AEQOcaaJZ1lcgoYD)

<comment><USER10> I had no idea such a genre existed, and I think you've just made my day. Thank you for this.

</comment></comment><comment><USER10> Things currently heavy in my rotation (in the format of Band : Album(s)):

      - Murder By Death : Bitter Drink, Bitter Moon, Red of Tooth and Claw
      - Strike Anywhere : Exit English
      - AFI : Burials
      - Circa Survive : Blue Sky Noise
      - The Raveonettes : In and Out of Control

</comment><comment><USER11> I really enjoy Vince Guaraldi. It has it all for me to stay motivated and positive throughout the day -- fun, but not too loud for work, nostalgic and, well, it just gives me a happy feeling.

</comment><comment><USER12> "Ceiling Unlimited", by Rush.

</comment><comment><USER13> Boss tunes...</comment>


Tannins give Wine and Tea their pucker (2014) - <AUTHOR> https://blogs.scientificamerican.com/artful-amoeba/love-wine-and-tea-scientists-discover-plant-part-whence-their-pucker-springs/ <comment><USER2> Tannins also interfere with B vitamin absorption. So if, after much tea drinking, you notice some muscle twitches (esp in your face), take a B complex vitamin.</comment>


I am going to eradicate the inbound Windows Support scam - <AUTHOR> http://jollyrogertelephone.com/i-am-going-to-eradicate-the-inbound-windows-support-scam/ <comment><USER4> A good start, but needs a lot of work. If it's targeting a Windows Support scam, why not tailor the audio to that? Mention one of various viruses. If the "tech" asks you to do something, say your Windows just bluescreened and have them wait 30 seconds while it reboots, all the while saying "hang on, it's almost there", "this thing's been really slow lately", etc. and then play the Windows startup sound. Pretend to have typed your password incorrectly a few times. Occasionally ignore whatever they say and start telling them you're running this program your nephew told you about.

And so on. If you call them yourself and actually follow their instructions, installing something from some site into an isolated, disposable VM and then running it, you can record what happens and then build that into a better script. Trigger these instructions by asking them what they can do to fix your computer, and time their response. Bonus points if you can detect them saying "http" which kicks off that part of the script.

<comment><USER5> When Dell was breeched a few years back my details made their way to India. I get a call from them about once a month. I've learned the script and various vectors they try to get the software onto my computer.

The longest I've had them on the phone is 20 minutes. He's one of my favourite recordings though

[https://soundcloud.com/radiorental1/dellsupport2](https://soundcloud.com/radiorental1/dellsupport2)

It's funny, someone pointed me at this thread because I sort of sound similar to the OP's site.

<comment><USER6> 20 min is pretty good. I will usually get called while away from my computer. I try to see how long I can go from memory of windows (been using Mac for 8 years). Once they pass me to their manager I know they've caught on I'm fucking with them. The second guy is clearly more technical/experienced and starts trying to determine as fast as possible if I'm legit. My "computer" will slow down at that point, then, I ask stuff like "can you guys fix this as well?"

I love it when the person yells at me for wasting their time.

<comment><USER5> I'm on mac too with a win7 vm, I hit upon the idea of tagging them along as far as I could when they asked me to press the windows key and I'm looking at a mac keyboard.

The different shops that have called me all follow a similar set of attacks

1) windows key 2) run command to msconfig 3) browser to download payload.

I had a 'supervisor' on the line once and when they asked me to connect to the internet I'm pretty sure I heard them curse at me with incredulity as I played the 56K dialup sound.

I once got them down a conversation cul-de-sac when I asked them which they preferred - Minesweeper or Solitaire.

<comment><USER7> Oh do you have that recording. Awesome

<comment><USER5> I lost them cursing at me and I don't have the Solitaire v. Minesweeper discussion recorded but here's something similar at 11 minutes [https://soundcloud.com/radiorental1/dell- support](https://soundcloud.com/radiorental1/dell-support)

<comment><USER8> Hah, this was great, listened to the whole thing. You had some nice tricks up your sleeve, laughed out loud a couple of times. Thanks! Love the response you got at the end...

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> This is brilliant. Can't say whether it would work, but if you listen to the pre-recorded calls he's using to tie up the operators, they're ingenius in a comical way.

The second one features this woman who starts arguing with her teenage daughter in the background at length, then says to the guy "Oh my god I'm so distracted, I didn't hear anything you said, I'm really sorry, you're going to have to repeat all that."

What a brilliant strategy to tie them up.

<comment><USER10> This will absolutely work. Or at least should work based on a study by Microsoft researchers stating that the business model is very fragile.

[https://www.microsoft.com/en-us/research/wp- content/uploads/...](https://www.microsoft.com/en-us/research/wp- content/uploads/2016/02/WhyFromNigeria.pdf)

</comment></comment><comment><USER11> I'm Indian myself and it concerns me that so many of these scams emerge from what appears to be India (based on the Indian accents).

Does anyone know if any scammers have ever been "brought to justice" in India. Ever?

Seems like something that should be a high priority for the Indian Govt. if they want to help with India's image abroad, especially with the tech sector.

<comment><USER12> I correspond with someone from India that is heavily into marketing this stuff (he does legitimate things as well, and is one of the most knowledgable paid Facebook advertising specialists on earth, which is how I came to know him). He has been pushing it for years and the Indian government has never come close to bothering either him or the people that actually own the services that pay him for each phone call his advertising generates.

It's not just the Indian government that is lackadaisical about this either. He is able to run ads for tech these support scams through Facebook and get ROI above 500%. Facebook eventually stops his ads, then he buys another ad account. In fact, he claims a single aged Facebook account is worth roughly $10,000 to him (aged accounts have an easier time getting ads through). He spends well into the six figures each year on these types of ads through Facebook alone. Ad platforms share some of the blame for the proliferation of these scams because they simply do not police their platforms well - <USER2> tactics he uses to get these ads through their review process are truly elementary but are good enough to foil a company full of PhD's. Clearly they aren't trying very hard.

<comment><USER13> I'd be weary of this person you are describing, depending how you got to know him. It reminds me a bit of certain poker coaches back in the day. You basically only have his word. I'd assume the 10k figure that accounts are worth and the 500% are vastly exaggerated. If it works so well, why is he sharing this with you? Let me guess, because he enjoys mentoring and is tired of doing the same profitable things over and over? He's probably charging a fee for these invaluable services?

<comment><USER12> We share technical and strategic internet marketing information/software, and info about what is and isn't currently working marketing-wise. The stuff about the specific campaigns he's running came up only after more than a year of such exchanges. Also he isn't giving me his landing pages, his advertiser contact info, etc., and he knows I'd never touch something as legally questionable as a tech support scam anyway. But of course at some point when talking to others, after long enough, you talk about what you are working on. I've never paid or been asked for a dime.

So your assumptions are incorrect.

</comment></comment></comment></comment><comment><USER14> Reminds me of Lenny, the bot that tricks telemarketers:

[https://www.toao.net/595-lenny](https://www.toao.net/595-lenny)

<comment><USER15> I've only recently heard of Lenny (late to the party), but think some of the videos I've heard are hilarious.

I know "he's" been around for a while, and runs on a purely manual random delay system, but I wonder if Lenny could be updated with modern technology, to do a bit of rudimentary voice recognition for better interaction with the scam caller?

I know that his existing script is very cleverly generic and timed to work in with most telemarketing scripts, but I think if it was improved just a bit more, we could end up with quite a convincing respondee that would burn up more scammer time, and hopefully make a small dent in the enthusiasm of these con artists...

<comment><USER16> I believe it (or some other bot) detects silence on the other end of the line to trigger playing samples.

So it can insert "u-huh" whenever the salesman is done talking.

</comment></comment></comment><comment><USER17> An alternative I thought of the other day while watching one of the hundreds of YouTube videos of this was to simply batch-dial thousands of numbers all at once then randomly route them to each other. For bonus points, record everything and make it available live.

The next level up would be a trusted-user system where you could go to a website, hit a button and immediately be connected with an actual scammer; or you could listen in on other people currently in calls and suggest things they should do next. And maybe there could be a pool of VMs available to play with...

Regardless of technique - fake recordings or various types of routing - <USER3> would advise making friends with all the high-level VoIP gateways. That way you won't have any problems batch-establishing hundreds of calls at once (for example if you know all the numbers for a call center and you know what time the, er, _staff_ get in), getting a new number block, or even getting general caller ID override (which I understand is sometimes unavailable?).

My thinking here is that if you can win over a bunch of providers (with money and inspiration/sentiment), you could VoIP-DDoS the gateway providers the scammers are using. Would tie up the scammers' time moving to a new VoIP provider.

<comment><USER7> This. Great idea. I love the idea of being able to be connected to an actual scammer via website and have a little pop-up window with others suggesting fun things to do to the scammer. The recordings can then be made into loops to autodial them.

</comment></comment><comment><USER18> While this seems satisfying, it would be more effective to figure out how these companies are still able to access the credit card networks and block the shit out of them. I used to work at one of the smaller international CC processors, and we _specifically_ rejected merchants offering "remote technical support" (i.e., THIS EXACT SCAM) and the entire rest of the 5967 MCC (inbound teleservices).

I recall reading that the "fake IRS" crew had started working around this by telling people to buy iTunes gift cards, but it would be a start.

</comment><comment><USER19> A word of warning for the author: phone numbers can be easily spoofed (like you can spoof the sender email address or the originating IP in a UDP packet). What's more, many scam calls _do_ use spoofed phone numbers. Thus the number you might be flooding may not be the originating caller. This could turn your utility into something far more malicious than was originally intended.

<comment><USER20> Yes, but also get the ball rolling to also improve this system in the world. Companies do not care that systems are vurnable until it really affects them. Just look at the botnets from vilnerable IoT devices waking up parties so they start to protect them. Same with phones and their support periods...

<comment><USER19> Blackhats don't tend to publish their work in a way that is traceable back to their person. If this system gets abused then the OP becomes liable. This was why I raised my warning to the author specifically - albeit I couldn't have made my point about the legal consequences of abuse clearer in my previous post.

</comment></comment></comment><comment><USER21> I made an email equivalent of this:

[https://spa.mnesty.com/](https://spa.mnesty.com/)

The problem is when people send you numbers or emails of legitimate people, because now you're basically DDoSing their phone number for free. How is this service planning to vet these numbers?

<comment><USER22> You seem to have some loop there with the real Uber support? [https://spa.mnesty.com/conversations/bmazjsnh/](https://spa.mnesty.com/conversations/bmazjsnh/)

And in one case the spammer was aware of your site! [https://spa.mnesty.com/conversations/gywanvsb/](https://spa.mnesty.com/conversations/gywanvsb/)

Maybe you can hide from Google with the appropiate robots.txt so the last one doesn't happen.

<comment><USER21> Thanks for that, I've deleted the first one. I have safeguards in place to prevent legitimate senders from being hassled, but I have to add them first.

That second one is hilarious, though :P

<comment><USER23> " _She is a Monkey climbing trees_ "

Brilliant!

</comment></comment></comment></comment><comment><USER24> Alhough I shouldn't derive my enjoyment from others' suffering, I do on this capture. [https://www.youtube.com/watch?v=Du6acZ- PZQ8](https://www.youtube.com/watch?v=Du6acZ-PZQ8)

The long and short of it, the Indian scammer ends up setting a SysKey password and a bios password on his machine. He's using his bosses' machine, and it appears to be the domain controller.

The scammer ends up crying and screaming at the guy and out of terror and rage, ends up hanging up.

Normally, I would be like "I feel bad for this guy". Nope not at all. Bloody scammer got what he deserved - a taste of his own medicine.

<comment><USER25> My bullshit detector is bothering me.

\- Scammer volunteers the information that he's "using his supervisor's computer". This increases the emotional satisfaction of watching the video but seems unmotivated.

\- Scammer sounds like he's suppressing laughter at one point.

\- Scammer follows the guy's instructions in the first place and continues doing so.

\- Some of his lines seem to have an oddly flat affect, as if he were doing bad acting.

<comment><USER26> \- Scammer doesn't actually have an Indian accent, is pretty clearly just pretending. They try to fake the grammar stuff but can't pull off the subtle mispronunciations.

This is incredibly fake. The end REALLY drives it home.

</comment></comment></comment><comment><USER27> This is neat, but at the end of the day, only user education will eradicate scams. As long as there are people willing to call strangers and give them access to their computers or buy iTunes gift cards for them, there will be scammers ready to be those strangers. Somehow people learn to not get into strangers' cars. They need to also learn to not trust uninvited solicitations, especially coming from the internet.

</comment><comment><USER28> Please have someone manually call reported numbers once to confirm it's actually a scam so this can't be exploited.

</comment><comment><USER29> This reminds me of stuff we used to do with 96 line dialers way back in the day. It was a pretty solid tactic for dealing with anyone that scammed us. Difficult number portability, a lack of ubiquitous capability to cost effectively deal with a phone DoS, their lack of knowledge about various telecommunications laws (what with search engines not being what they are today) and most importantly the fact that they were almost universally uninterested in engaging law enforcement (what with the scamming or fraud) it was a pretty effective way to get bad people to stop being bad. But it was a long time ago and I wouldn't do it again given the chance. I was really young, it was definitely an ethically gray area and we were breaking at least one law.

I also came to understand over time that the reason we kept having run ins with scammers was because we were running a shady ISP/hosting and telemarketing business that had a significant portion of customers who were scamming their own customers. If it always smells like shit there might be some on your shoe. It was an important lesson and now I pay a lot more attention to how my employer gets money and who they get it from.

On a lighter note we won tickets a couple times calling radio stations. We felt pretty bad about cheating like that so we never did it again but it was pretty effective as long as you had a couple butts in seats to deal with the "sorry you're not the 9th caller" pickups.

</comment><comment><USER30> It's rather funny that all it takes to defeat UAC in Windows is for a complete stranger with a foreign accent to call you up and tell you in broken English to "push the 'Yes' button on that popup called 'Run as Administrator'".

<comment><USER31> In Japan they have problems with scammers calling up pensioners claiming to be their sons in a bind, and directing them to go to an ATM and set up a wire transfer to drain their savings. One solution was to install cell jammers inside of the ATMs. [https://www.engadget.com/2008/12/10/japan-installs- cellphone...](https://www.engadget.com/2008/12/10/japan-installs-cellphone- jammers-near-atms-to-prevent-fraud/)

Time to put cell jammers inside of PCs that get activated with UAC is up?

<comment><USER32> The problem exists in America as well; my elderly father was hit by it. Luckily my mom overheard his end of the conversation and put a stop to it. (Turns out, the scammer is very good at crying, but not very good at proving their alleged identity by knowing my mother's name. Hurray impromptu two- factor authentication!)

But I believe that it's illegal to operate cell phone jammers, unless you're the government. And for good reason; it's wonderful that you prevent someone from being scammed, but if I'm attacked by a mugger near an ATM, I'd rather like to call 911.

<comment><USER31> The initiatives in Japan were in cooperation with the police, so I'm sure it's not impossible for them to get the proper permits. And many Japanese ATMs already have a "panic button", I'm sure the ones in question would too. Mugging isn't a huge crime here so I guess that's more of a problem implementing it in the US....

</comment></comment></comment></comment><comment><USER33> What happens once someone sends you a fake report in order to trick you into harassing a real person with fake calls?

<comment><USER34> I'd hope that he gives the number one call to validate that it is, in fact, a scammer before putting it on blast. If he does, I really have no problem with this approach (and have considered it myself, frankly); if he doesn't, then this is just downright irresponsible. But I'd hope no one would be stupid enough to just trust random data from internet users, in this regard ...

<comment><USER35> You could wait for multiple verifications. For example wait until 3 reports of the same number from different IP blocks. It needs Tor and public VPNs filtering, but that should be enough for most cases.

<comment><USER36> What about someone using one of the hundreds of thousands of proxies to submit reports? IPs are easy to get.

<comment> nommm-nommm Easy, use a handful of pre-vetted volunteers, not anonymous IPs. Like all the internet communities that require some form of vetting by mods before a user can do some action.

</comment></comment></comment></comment></comment><comment><USER37> This post could be greatly improved by clearly stating what is the Windows Support scam. I read half the page and I am still not sure.

<comment><USER38> You get called by these people where they tell you that you have a virus on your computer and they are going to help you fix it.

[http://www.makeuseof.com/tag/anatomy-scam-windows-tech- suppo...](http://www.makeuseof.com/tag/anatomy-scam-windows-tech-support-con- examined/)

<comment><USER39> I came across one of these a couple of weeks ago. I knew it immediately it was a scam because the guy had an indian accent. I played along just to see what he would do.

He directed me to site support95 .com. Apparently, there is a similar site called support18 .com. From there he told me to download an exe file. That was where I stopped. I did not know what would further happen.

If anyone wants to try it: Call 18005589204. Tell him you got a voicemail of someone from Microsoft saying something about license expired. I would love to know what ultimately happens.

</comment></comment></comment><comment><USER40> What about the scammers that just cold call and don't have an inbound number?

<comment><USER15> Most of the ones that I have heard of here in Australia don't provide a number - they just call you direct and say that they are reacting to a 'virus log' on their system, apparently.

I have had several family members and colleagues being called by them over the years - some multiple time, but so far I've never received a call from them. I actually can't wait for one of them to call me. My intent is to string them along on the phone for as long as I can with the reasoning that every minute he is wasting with me is a minute that he can't scam an unsuspecting person...

<comment><USER41> My wife does this. One time a support scammer called trying to get her to install malware. It went something like this:

"Ok. Please press the Windows key"

"Ok (long pause)"

"Did you press it?"

"Yes"

"What happened?"

"Nothing happened"

"Try again."

"Ok... Nothing. Does it matter that I don't have a windows?"

"Oh you have Mac?"

"No, I have Ubuntu"

"Ok, what version?"

"I don't know!? You're the computer person. Why don't you know?!"

The best part is that she was sitting on the couch the whole time.

<comment><USER15> That's exactly the sort of thing I want to do with them. I have another colleague who managed to string a guy along for nearly half an hour. Always managing to convince him that he was a noob struggling to get around. He said you've got to give those guys 10/10 for patience. Just imagine if they had _real_ support jobs - they could probably do well at it.

<comment><USER42> Maybe they quit their Dell support job for this for the better pay?

</comment></comment></comment></comment></comment><comment><USER43> What percentage of people doing this (or the "This is Lenny!" thing) would it take to make the scam unprofitable? Is there any work on that topic, like "what percentage of honeypots makes scammers quit"?

I don't get many "Windows Support" scam calls, the two I have gotten I was unable to play them for long, as I am a poor Linux user, not Windows knowledgeable at all, but I generally keep the "Card Services" people on the line for a few minutes.

<comment><USER44> A small percentage could hurt their profits a lot, but it's not like they are without counters to this. They could slap on a max length at which point they know they're wasting their time, and also start to blacklist numbers that waste their time. They could use audio recognition to avoid known automated honeytraps, but even humans would adapt after enough calls.

I still think it would be difficult to even reach that target %. As much as I would like to waste their time, I'm strapped for time myself. There would need to be a way to receive a call on your phone and send it to the honeytrap in two 'clicks', where it plays scripted responses in the background.

If we reached that magic percentage, I think they could have a counter. They could discourage this by using targeted harassment. Someone screws with them, they send a mass of random calls over the course of a day.

<comment><USER43> After a few years of monkeying with the "Cardholder Services" calls, I'm convinced there's two layers of crooks involved. The first layer is the autodialers, they just run through series of phone numbers, and play a recording. I'm pretty sure these bastards don't screen numbers, because I can at least get through to the (Indian) boiler room almost 100% of calls.

I think the boiler rooms are actually seperate organizations/crime clans. The boiler rooms do screen, but not universally. After years of being "Edward Snowden" and giving out fake card numbers that pass the Luhn checksum, only maybe 25% of the boiler rooms cut me off. A few days ago, the "service rep" had a bad headset and I could hear a recorded voice telling him to hang up, which he did.

Even Trump's FCC would have to deal with targeted harassment. That's the kind of crap that nobody puts up with. Besides that, harassment calls probably ruin the NSA's data retention practices, so that just can't happen.

</comment></comment></comment><comment><USER45> Seems like it would be better to go through with the calls and destroy them at the payments gateway/payments provider level, same as was done with online pharma spam.

[https://www.usenix.org/conference/usenixsecurity12/technical...](https://www.usenix.org/conference/usenixsecurity12/technical- sessions/presentation/mccoy)

<comment><USER34> In my experience with counter-scamming, these guys generally don't actually use any kind of payment processor -- they ask people to go get gift cards and tell them the numbers. It's a clever way of going about it, which essentially guarantees that they can't be shut down directly. The only way to beat them is to waste so much of their time that it's no longer profitable.

<comment><USER46> That or install ransomware on your pc.

</comment></comment></comment><comment><USER47> I don't think this is going to DDoS the scammers by calling them back; I think the point is you just transfer the inbound call to his bot -- the success rate on these things is so low, if he's got good enough penetration the false positives will overwhelm the true positives.

I think, anyway. Spent five minutes reading the post and other parts of the blog, and dimly recall seeing something from this project posted previously. Happy to be proven wrong.

<comment><USER48> "As fast as you can report fake "you have a virus call this number now" messages to me, I will be able to hit them with thousands of calls from bots. It's like when the pirate ship turns "broadside" on an enemy in order to attack with all cannons simultaneously."

But it's late, and I'm too tired to read the rest of his blog posts.

</comment></comment><comment><USER49> I'm assuming you're using a VoIP provider to do this - just be careful, they might have rules against this. Definitely don't do it on an account you have a personal number you value or something.

That said, I fire attacks at script kiddies in the clear from big server providers including DigitalOcean and OVH, so I suppose as long as the attackee can't really complain legally, you might be okay.

</comment><comment><USER50> There's an inbound version of this? I've gotten calls from the outbound version, but those I hang up on in the first four seconds.

<comment><USER35> Turn off the adblocker and go to some popular TV streaming sites. You'll find a few of them.

<comment><USER50> Right. I have so much ad-blocking that I never see this crap.

</comment></comment></comment><comment><USER51> ~~ Yes. Yes. Hello? Sorry, you're going to have to start again. Yes? Go on. Ahum. ~~

Absolutely love this guy. Can't say it enough.

</comment><comment><USER52> The problem is that scammers can fake the CallerID. Yes it's illegal but they are already engaging in dubious activities.

So this bot would just dial back at innocent victims whose numbers were unknowingly used by the scammers.

</comment><comment><USER53> I found this on soundcloud. [https://soundcloud.com/user-486592840/scam- recording](https://soundcloud.com/user-486592840/scam-recording)

</comment><comment><USER54> I wonder if a sprinkling of ML could be used here.

<comment><USER55> Nah, I think AI would be a more suitable candidate.

<comment><USER56> Standard ML is probably a safe bet.

<comment><USER55> Are you sure the client's needs would not have been better met with over fitting? I heard it has superb performance!

</comment></comment></comment></comment><comment><USER57> I look forward to hearing more in the future.

</comment><comment><USER58> you could add voice recognition to cue up responses and also launch a vm for them to take control of.

</comment><comment><USER58> this is generic to hassle any kind of call centre: PPI claims, accident claims etc..</comment>


Serverless: A lesson learned the hard way - <AUTHOR> https://sourcebox.be/blog/2017/08/07/serverless-a-lesson-learned-the-hard-way/ <comment><USER2> >This is probably the most stupid thing I ever did. One missing return; ended up costing me $206.

No, dear author. Setting up the AWS billing alarm was the smartest thing you ever did. It probably saved you tens of thousands of dollars (or at least the headache associated with fighting Amazon over the bill).

Developers make mistakes. It's part of the job. It's not unusual or bad in any way. A bad developer is one who denies that fact and fails to prepare for it. A great developer is one like the author.

<comment><USER3> Just wanted to say that last paragraph is one of the simplest descriptions of professionalism in the job I have read - accept and prepare for your own human failings :-)

</comment></comment><comment><USER4> This is not a "Serverless" problem; this is a mistake a developer made that used a pay-per-use system. If I write code that launches EC2 instances and I accidentally set it to launch an instance every second instead of minute because I divided wrong, that's my fault.

<comment><USER5> It is a serverless issue because if you were using your own server, a mistake like this wouldn't have cost money, it would have just degraded your service (or possibly brought it offline).

So I guess the question is, with a mistake like this, is it better to be charged hundreds or thousands of dollars, or to have your service degrade or go offline until you can fix it?

<comment><USER6> The developer should be writing unit tests for their code so they can avoid small mistakes like this.

<comment><USER7> It is impractical to cover every line of code with tests (it would get too expensive). Futhermore, in this case the author would have to test production config interacting with Amazon servers rather than a piece of code.

And even 100% code coverage doesn't find all possible errors.

<comment><USER8> Do you need to cover every _line_ of code, or do you need to test resulting behavior? Also, while nothing is 100% foolproof, the example here would probably have been caught.

<comment><USER9> I doubt this, a unit test wouldn't have covered the infinite triggering of the created events

</comment></comment></comment></comment></comment></comment><comment><USER10> "The actual cost is now $206 and over $1000 forecasted, it makes me think twice about using pay-per-use services in the future."

Never use a pay-per-use service that does not include a reasonable "turn off after $X" feature and appropriate warnings. Also, never use such services without being sure to configure such settings.

I like to think of this as a self-inflicted "DDOC" attack: Distributed Denial of Capital.

Best not to leave yourself exposed.

<comment><USER11> If you really wanted, you could create a script that after a certain billed amount gets reached switches your site via route53 over to a static s3 page that says "down for maintenance" or something until you figure out why your forecasted billing amount is so high. forcastedSpend is an object you can call via api: [http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/...](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data- type-calculated-spend.html)

and a SDK like boto3:

[http://boto3.readthedocs.io/en/latest/reference/services/bud...](http://boto3.readthedocs.io/en/latest/reference/services/budgets.html)

<comment><USER12> That wouldn't have made much of a difference in the particular case of this article.

</comment></comment></comment><comment><USER13> You did well to have billing alerts enabled. Exactly the same thing happened to be, but I didn't notice for three months - no emails because I'd created an account and domain for a side project. Didn't notice anything on my card because the charge had been declined, but my bank didn't contact me. Finally found out because I knew the local AWS rep (was the relationship manager for the accounts we use at work). Had to apologise and explain the situation in detail to AWS and they forgave the bill. That was tens of thousands of dollars.

<comment><USER13> For those talking about this being a 'serverless' problem or not, think they point is that it's a lot easier to shoot yourself in the foot. Great power + responsibility, etc. On regular servers (outside of unbounded autoscaling) mistakes cost a flat rate.

<comment><USER14> Not necessarily.

With a regular server you could go viral, your server dies, so you lose also without a bound in lost business/good will/whatever.

Also need to take into account the time/effort spent on making the regular server scale, albeit this is also a relatively flat rate.

</comment></comment></comment><comment><USER15> TLDR: Deployed buggy code with infinite trigger. Hosting costs increased.

<comment><USER16> The only difference here is that if he deployed it on his own server, he wouldn't have lost money.

</comment></comment><comment><USER17> "a $180 actual cost. I was left with a light headed feeling, it's a lot of money for me"

people still play with fire. limit your losses, go with digital ocean or something for 5$/mo flat no matter what.

<comment><USER18> His previous blog post actually said that he moved away from the exact $5/mo digital ocean plan you're talking about, to this.

I think the author meant to do this less of a "play with fire" way but more of experimenting with new tech way. But yes, I agree that for personal sites, running with your own money, you probably want to stick with something safer like the $5/mo digital ocean box.

<comment><AUTHOR> This is indeed the case, playing around with new tech. I've been a happy customer with DO for years but my own website was the ideal case to try out the whole serverless thing. As my website doesn't get much traffic so it'd cost me next to nothing. I do agree with most of the comments here though and the $5 DO box is the safest choice. I might have been a bit too excited with the new things and failed to think logically :)

</comment></comment></comment><comment><USER19> The infinitely scalable cloud services have this big problem with surprise bills. In the old days teams often made do with what was available, now it too easy to spin up more resources.

I'm surprised people still talk about cloud services as being cheaper esp where developers are free to use what they want.

</comment><comment><USER20> The main issue here is the budget notification emails aren't an adequate mechanism to catch infinite loops. They are too slow and you've already racked up big overages by the time you see it.

Idea: use API Gateway to configure a quota to match your budget projections. That will force a hard stop. Would be nice if AWS made this easier.

</comment><comment><USER21> I wrote my (small) AWS app so it can run both on AWS and my local machine. Then you can write tests against the higher-level logic like "save this file to S3" and run those tests locally as well.

My main challenge with serverless is using Lambda with API Gateway. Lambda has no database connection pooling, so I end up with a ridiculous number of connections to RDS - one for each simultaneous user. I haven't found a solution to this yet, other than not using API Gateway.

<comment><USER22> One solution, use external pooler like pgbouncer or mysql-proxy running on a small instance(s)

<comment><USER23> I'm actually kind of blown away RDS doesn't have pgbouncer installed on the database. That's how we operate...each db server has pgbouncer living right on it. We connected to bouncer, not directly to the DB.

</comment></comment></comment><comment><USER24> There's a lesson in there about how AWS makes a crisp $10m dollar bill for the richest man in the world every day.

<comment><USER16> I know you're being sarcastic but I feel it's partly true. They announce so many different services, each month something new appears, but this very basic feature - bill capping - asked by users from the very beginning, has never been implemented. It's hard to believe they lack the skill or that it would be much more complicated than the current alert system.

<comment><USER13> According to the folks I've spoken to, they don't do bill capping because they have no way to safely shut down your workloads in any way - they'd prefer to let you know and have you do it. And having that choice is way better than a capping operation destroying your production database or causing downtime for your users.

<comment><USER25> I'm sorry, I just don't buy that. It doesn't have to be a hard cap, it could be a soft one. i.e. at £x your servers start shutting down, you'll get billed for a few extra minutes over your cap, before things have finished shutting down. Servers are totally capable of being shutdown without destroying databases.

Besides, we aren't really talking about production databases at large companies. The people who want caps are devs learning and experimenting. It could come with dislaimers that if you enable a cap and exceed it that your services will go offline unexpectedly, and that may leave databases in inconsistent states. But for a large number of usage scenerios that is a completely acceptable tradeoff.

The simple fact is, not having a cap certainly puts me off experimenting with a service due to a fear of a mistake causing a big bill. And developers learning and investigating a technology is what preceeds them recommending that technology to their companies.

Last time I looked Azure allows a zero spend cap on free accounts, but you can't change the amount to anything else, and once you remove it you can't switch the cap back on. Thats limited, but it's perfect for a learning environment.

If Azure can implement a zero spend cap, there is absolutly no reason that either AWS or Azure can't implement an x spend cap in exactly the same way.

<comment><USER26> > _The people who want caps are devs learning and experimenting._

Then AWS is not focused on their use-case. You can make the argument that they're throwing away potential business here, but AWS is already the gorilla in the room, and people clamour for their products already. A couple of years ago they were rated as being bigger than the next 17 VPS providers combined.

> _I 'm sorry, I just don't buy that. It doesn't have to be a hard cap, it > could be a soft one. i.e. at £x your servers start shutting down, you'll get > billed for a few extra minutes over your cap, before things have finished > shutting down. Servers are totally capable of being shutdown without > destroying databases._

The idea of a payment cap _sounds_ easy, but with something as complex as AWS, it's incredibly difficult, and everyone would demand different behaviour at the cap. So, you hit your cap. Turning off EC2 servers is easy. What about the data you've stored on s3? That costs. Should it be purged? What about your disk drives on EBS, should they be purged? How about items you have queued in SQS, should they be purged? Are you using RDS databases? They can't be stopped, only destroyed (you can do a final snapshot, but that's going to go to block storage, which costs. not much, but it costs).

"Just stop anything that costs" _sounds_ easy, but it's not, not when you have a service as complex as AWS. AWS's current model of "forgive the bill for obvious mistakes" is way more workable.

<comment><USER25> Yeah, I totally accept that people who want caps may not be in the target audience. That's probably true. But don't pretend it's because the problem is too hard for them to build, which is what was originally claimed. If their big customers wanted it it would get built.

Besides, Azure proves that it's clearly possible. Azure have a cap. MSDN gives you free Azure credits. When you open an account via MSDN you still have to put in payment details, but you have the option to enable a hard cap that prevents you spending past your free credits. So Azure have clearly got a solution for stopping all the services when the credit limit is reached.

All of what you describe as problems are just decisions to be made. S3 data..? Delete it. Make it read only. Pretend to delete it, but make recovery possible for x days. Doesn't really matter, just pick one when you build it, and document what it does. People who want a cap are going to more concerned with the overspend than any data or service integrity. They could stick up a disclaimer... "If you enable this cap you data may be destroyed or corrupted if your spending reaches the cap". There are solutions to the implementation problem.

Besides, they probably already have all this code in place. If your payment methods gets declined I'm prepared to bet Amazon don't just let all your services continue running indefinitely because shutting them down automatically is too hard of a problem for them to solve. So any cap could be implemented by just triggering the payment declined function.

<comment><USER26> > _S3 data..? Delete it._

O_o

> _... Make it read only._

The primary use-case of s3 is reading objects. This would not be a deterrent for quite a few use-cases

> _... Pretend to delete it, but make recovery possible for x days._

Still consumes the space that they're charging for in the first place

> _People who want a cap are going to more concerned with the overspend than > any data or service integrity._

This is patently not true, and is why I think you don't really grok why implementing a cap is difficult. It's specifically why I said "everyone would demand different behaviour at the cap". Some would want only this or that service to stop, for example.

A small business sets up a payment cap and hits that cap because they went viral? BAM, all their block storage, destroyed. All their backups, their analytics, their RDS databases, just gone. Right at the time they needed it most.That's a _much_ harder lesson to deal with than "oops, our bill's a bit high because we made a mistake, can you please forgive it?". Or even "ouch, okay we'll pay it". The protection you want for hobbyists would destroy small businesses that may not understand what is actually meant when that hard cap is hit. It's not that caps aren't doable _at all_ , it's just that they're a wicked problem, and the more you look at it, the more issues you can see.

As for soft caps, what is the functional difference between a soft cap and the billing warnings they already have?

Also, their claim on s3 is "we don't lose objects". Destroying objects because of billing would utterly undermine that claim.

> _If your payment methods gets declined I 'm prepared to bet Amazon don't > just let all your services continue running indefinitely because shutting > them down automatically is too hard of a problem for them to solve._

AWS does not destroy your services because of late payment. Source: we've just been in late payment.

<comment><USER25> I think we are talking cross purposes here. I get what you are saying. A cap that junks your services would certainly not be suitable for everyone, I get that.

But this thread was initially about a dev running some experiments and getting a $200 unexpected bill. They would have been very happy with a $30 cap that just deleted everything. That functionality would be easy to build if they wanted to. But they don't. For other reasons, not because it's hard.

The thing I dont buy is Amazon claiming its too hard to build a cap. A cap that suits some people would be easy. What they really mean is... A simple hard cap is only useful to customers we dont care about because they dont pay us enough. An advanced cap with all the kinds of failover options and thresholds that a medium sized business might want is complex and the people who actually pay the big money (those we care about) don't actually want caps anyway.

<comment><USER16> > A simple hard cap is only useful to customers we dont care about because > they dont pay us enough. An advanced cap with all the kinds of failover > options and thresholds that a medium sized business might want is complex > and the people who actually pay the big money (those we care about) don't > actually want caps anyway.

That's an honest answer, I'd be happy if they formulated it this way. Fortunately, there are other cloud providers with billing cap implemented properly, and you don't hear horror stories about them (problems with spending too much on AWS are very common though).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> Charged at a flat rate like the cost of a Digital Ocean $5/mo instance, would developers pay for such a service to provide automated notifications of service overages for all the major cloud providers?

All a developer needs to do immediately after adding a credit card to AWS/Azure/GCP would be to create an IAM role with permission to automatically add and track fine-grained billing alarms and notify via email/sms for any potential billing overages.

I think a $60/yr service like this would be useful to protect against future events of bill shock.

<comment><USER11> Looks like it's already been done, at least for AWS, based on a few Google results (not that I've used/tested any of these):

[https://github.com/Teevity/ice](https://github.com/Teevity/ice) [https://billgist.com/](https://billgist.com/) [http://cloudcheckr.com/](http://cloudcheckr.com/)

</comment></comment><comment><USER28> He obviously has a smaller account so Amazon might be less flexible, but it's worth contacting support and explaining the error. Sometimes they do give your money back in my experience.

<comment><USER29> In my experience flexible starts north of few mil. per month spend so why all the startups are running on AWS is a mystery to me.

</comment></comment><comment><USER30> Not sure if someone has mentioned this already, but you should contact AWS support and ask if they will forgive the bill given it was an error which led to the high costs. I've had bills forgiven this way in the past (e.g. forgot to disable an instance that wasn't really doing anything).

</comment><comment><USER31> I was about to make the same mistake yesterday , but I had written a validation function that would check inside a folder only, and fortunately I did not upload the file in that folder. And the next morning , I read this article... Man I gotta be careful LOL

</comment><comment><USER32> The relatively low barrier to learn just a tiny bit of following a Linode or DO vps hardening & stack setup guide to get an ubuntu server going can go a very long way for development and prototyping environments.

It's gotten much, much easier, and is just another form of command line management, similar to the CLI framework tools with your preferred stack.

Once that first setup is done, similar to setting up a serverless environment, you are generally restoring backups of your base image and beginning projects from there.

It also immensely helps to learn about how to build something to scale that isn't completely reliant on the PaaS layer.

</comment><comment><USER33> I've built a fair amount of serverless services over the past two years using the Serverless framework, apex and straight API Gateway/Lambda.

It's nice not to have to worry about a server, but I feel like there are just as many little things to futz with in serverless architectures especially before "environment" variables existed in Lambda.

</comment><comment><USER34> Setup spending alarms for your account. Personally, mine is $5, $10, $15, $20 and so on. At $30, my wife gets paged.

</comment><comment><USER35> The cost by using AWS is hard to foresee. For years, my s3 storage got charged nothing. But some a month, it got charged several dollars.

I have migrated all my services to GCE. At least GCE provides free decent quotas for every resource.

</comment><comment><USER36> Serverless is going to make resource usage a focus in a way it hasn't been for years. The quick feedback, the absence of "all you can eat" pricing and the possibility for savings are all factors in this.

</comment><comment><USER37> Run+know your infra, none of this is a problem. Serverless is a scam.

<comment><USER38> So run my static content only blog on dedicated hardware that I have to administer rather than throw it in an S3 bucket with a Cloudfront on it? No thank you.

Qualify your statements.

<comment><USER16> You don't really need to administer it, there are plenty of hosting options, not just bare metal. And you can always add Cloudlflare anyway.

<comment><USER38> You're missing my point. "Serverless" just means "Applications built on cloud services rather than server(s) I have to administer".

The OP said I should run my own infrastructure. I -could- host my blog by running a web server atop a server I administer, sure. I'd have to take on all the infrastructural tasks of doing that, securing it, ensuring any availability/scalability concerns I may have are taken care of, etc, but I -could- do that.

Instead, S3 + Cloudfront (or, sure, any flavor of hosting and edge caching options you care for; I was not implying "Just AWS") means I don't have to worry about any of that. For me, the reduced level of control, increased availability, scalability, and easy "it just works", is worth the tradeoff. As is the pennies per month it costs me given the low utilization and pay-as-you- go model. It's hardly a scam.

<comment><USER16> I wouldn't call it a scam. You need a certain level of expertise anyway, otherwise you not only screw up your service, but also, in the case of AWS, lose money. Practically speaking, the amount of work needed to set up a blog on S3 with CloudFlare is not that different from the one needed to deploy, say, a WordPress droplet on DigitalOcean. You just click a few times and it works, you can basically forget it. The only difference is that you are guaranteed not to pay more than $5 or whatever your monthly plan is.

Of course scalability is incomparable in both cases, so if it's something that really matters - and matters more than money - of course something like AWS is a better choice.

</comment></comment></comment></comment></comment><comment><USER39> Serverless still is a marketing tool for cloud providers. It will be useful when it really offers advantages over managing your own servers, especially on the cost and debugging.

</comment><comment><USER40> Hey, at least is was an enterprise cloud scale infinite loop.

</comment><comment> brown9-2 You can host a static site on S3 + Cloudfront, so what purpose does Lambda have in this picture?

</comment><comment><USER41> >Keep an eye on your logs, test everything again and again.

This is the takeaway quote from this for me.

</comment><comment><USER42> This has nothing to do with serverless itself but it's rather problem of AWS.

</comment><comment> le-mark Off topic, but the "serverless" moniker needs to die. I propose "adminless" as in "server I don't have to admin, configure, or patch" as being much more descriptive of whats really going on.

<comment><USER43> Eh, if I'm deploying a cloud function, the server truly doesn't exist for me. It's more like a Web Worker running in a privileged environment. I'm ok with the name.

<comment><USER44> No, it's really a server running your function. You just (are told you) don't have to worry about the server or what it's actually doing.

<comment><USER16> > You just (are told you) don't have to worry about the server

...until you receive the $206 bill for the work done by the server.

</comment></comment></comment></comment><comment><USER45> Fun programming story!

</comment><comment><USER46> Endless loops are now billing issues, just like a DOS.

</comment><comment><USER47> If you are big enough and want serverless no-ops yet don't want to pay per burger when you already breed cows then consider kubeless.io

</comment><comment><USER48> I have a 5$ AWS billing alarm.</comment>


Living in the future  - <AUTHOR> http://twentysomething.nl/2014/01/living-in-the-future2/

<comment><USER2> Sam Harris said it better here: [https://www.youtube.com/watch?v=T3JzcCviNDk](https://www.youtube.com/watch?v=T3JzcCviNDk)</comment>


Over the next 12 mo Scott plans to learn MIT's entire 4-year curriculum for CS - <AUTHOR> http://www.youtube.com/user/TheMITChallenge <comment><AUTHOR> Just found his blog post: <http://news.ycombinator.com/item?id=3045153></comment>


Sun's Fortran replacement goes open-source - <AUTHOR> http://news.com.com/Suns+Fortran+replacement+goes+open-source/2100-7344_3-6150063.html <comment><USER2> I've been doing programming in science for 3 years now, and Fortran is a huge, huge problem. Fortran is too much like C, and think about how good C is for writing differential equations. There are tons of potential bugs in the programs I see, and very few opportunities to check for correctness. Development time takes an order of magnitude longer than it should. I've argued with physicists many times over this, and the issues they bring up are always:

\- Alternatives are too slow

\- I have a huge code base that I don't want to port over.

\- I don't need (eg.) closures. If I ever designed a program that needed them, I wouldn't choose Fortran, but that has never happened

\- (most popular) Programming is just a tool. I'm interested in the physic, not programming, and Fortran is Good Enough

I don't know if Fortress will succeed. I hope it does, but unless they can show that Fortress programs are both shorter _and_ faster, I don't think it will happen. Mathematica, Matlab and IDL already have too much of a lock on the market for 'inefficient' computing.

My money is on a Mathematica clone eventually becoming faster than Fortran. It should happen.

</comment><comment><USER3> Believe it or not, Fortran is still used extensively in scientific research circles.. Although badass Java libraries such as JScience are starting to take over.

</comment><comment><USER4> I hear its COBOL replacement went open-source a while ago.

<comment><USER2> From the FAQ: <http://research.sun.com/projects/plrg/Fortress/faq.html>

"As a result, we are able to support features in Fortress such as transactions, specification of locality, and implicit parallel computation, as integral features built into the core of the language."

"Moreover, Fortress has been designed with the intent that it be a ``growable'' language, gracefully supporting the addition of future language features. In fact, much of the Fortress language itself (even the definition of arrays and other basic types) is encoded in libraries atop a relatively small core language."

I haven't looked at the details of Fortress yet, but I don't read 'Java' in the above quotes.</comment></comment>


10 things the Internet has killed or ruined (and five things it hasn't) - <AUTHOR> http://features.techworld.com/networking/3220535/10-things-the-internet-has-killed-or-ruined-and-five-things-it-hasnt/?cmpid=TD1F1&no1x1 <comment><USER2> "Though you may find some some discussion boards and community sites that still encourage good manners and penalise offenders, they are becoming increasingly rare."

So true. HN seems to be the only one.</comment>


2FA Best Practice – Disable Autocomplete - <AUTHOR> http://shkspr.mobi/blog/2014/09/2fa-best-practice-disable-autocomplete/ <comment><USER2> _Every modern browser respects the autocomplete directive. It simply means that dropdown list doesn 't appear._

No longer true with IE 11, which ignores the "autocomplete=off".</comment>


Skit: A pure JavaScript front end for building better web clients - <AUTHOR> http://skitjs.com/ <comment><USER2>
        > > You seriously made another module loader?

        > Yeah. There are several reasons why:
        > To create a new-feeling environment that is clearly not node,
        > because you're writing code that runs in node and IE9 and Chrome
        > etc. It shouldn't feel like any old node.js module.

Why shouldn't it feel like any old node.js module? Nearly all the work in JS packaging of late has been to abstract the differences so that we can use the well-established node packaging system on both ends. We're already able to do it with stuff like babel and browserify.

<comment><USER3> [skit author here] -- skit handles CSS and multi-file module definitions (with submodules) in a novel way, that's probably more important to me than the reason you pasted.

</comment></comment><comment><USER4> Pre-render on server side is the way to go, no more empty html skeletons taking a while to fulfill after the first request, and you still get the reactive style of modern web app.

<comment><USER3> ❤

</comment></comment><comment> enahs-sf given that your handle is nej, i'm assuming you know that skit means literally "shit" in swedish. men jag tycker den har är en faktiskt bra ide.

<comment><USER5> It's mentioned at the bottom of the page and in a Github issue[0]

0: [https://github.com/clusterinc/skit/issues/4](https://github.com/clusterinc/skit/issues/4)

</comment></comment><comment><USER6> Thank you for actually serving up a proper web page (initial server-side rendering)!

Using javascript to enhance the page to provide faster loading or other features is great, but it is important to have at least _something_ on the page when javascript is not available.

</comment><comment><USER7> > Featuring nearly 100% shared server and client-side code

If the code can run on the client as well as on the server, does this mean the client has direct database access?

How well does that work out for the number of required round-trips?

<comment><USER3> the skit frontend abstracts only a few things for server- and client-side code: http requests, cookies and redirects. so you write a REST API client in JS and populate the initial page state with it, and when you wake up in the browser you don't have to make any more requests (until the user does something).

</comment></comment><comment><USER3> Wow just saw this was on HN again — I was traveling yesterday. There was a fun discussion thread a few months ago here: [https://news.ycombinator.com/item?id=9342133](https://news.ycombinator.com/item?id=9342133)

</comment><comment><USER8> Looks neat. For those looking for this functionality in a more mature framework, check out Ember FastBoot: [https://github.com/tildeio/ember-cli- fastboot](https://github.com/tildeio/ember-cli-fastboot)

</comment><comment><USER9> How is this framework similar/different with Meteor.js ?

</comment><comment><USER10> this might be cool until you have to debug some weird bug and do not know if it has to do with client or server code...

<comment><USER3> so far in building LaunchKit with skit ([https://launchkit.io/](https://launchkit.io/)) that hasn't happened. (I was worried about that, too.) it's surprisingly natural. I find the server-side parsing/running actually catches a ton of stupid typos (with nice error messages) quickly before I have to find them in the Chrome developer tools...

</comment></comment><comment><USER11> Two years ago I would've been excited but now I've developed a filter for anything with javascript and front end or framework in the same sentence if they are not backed by a major corporation, simply based on the reason that there have been so much abandonware in this landscape, I think even for Google it's been tough sell. I think that React is the way to do it but slow to adopt it especially because I'm so comfortable with jQuery and never had the need to invent new ways of doing things.

<comment><USER3> I wrote a post about how ridiculous it was to write another javascript library (about skit): [https://news.ycombinator.com/item?id=9342133](https://news.ycombinator.com/item?id=9342133)</comment></comment>


Ask HN: Which general science magazine is the best? - <AUTHOR>

Which english-language, general science, printed lay magazine is the best? I can hear it now: "Well, what do you mean by "best"? Yes, very clever and precise. It's up to you! Thanks, All <comment><USER2> Whichever ones I can find at: [http://www.rlslog.net/category/ebooks/magazines/](http://www.rlslog.net/category/ebooks/magazines/) :)

I actually am commenting because I have a real n00b, meta question. How do you create a 'Ask HN' thread? Do you just go to the submit page ([https://news.ycombinator.com/submit](https://news.ycombinator.com/submit)) and title it 'Ask HN: ________ "? Many thanks.

</comment><comment><USER3> Discover and Scientific American</comment>


Over the Air: Exploiting Broadcom's Wi-Fi Stack (Part 2) - <AUTHOR> https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_11.html <comment><USER2> This is the kind of thing I'd expect to see utilized by state-level actors who in many cases may be able to obtain internal technical information and tools from vendors. I wouldn't expect this to become an in-the-wild exploit, but for targeted use by agencies with the resources and motivations to identify specific models, obtain them and test against them this kind of thing should be relatively easy.

As an example, what kind of Android device is best used for insomniac tweets? At one point I thought I saw mentioned that it was a Samsung device a generation or two old, so perhaps a Galaxy S5 suitable for tweeting from the tub? That's a known-vulnerable device, elderly by Android standards of "who gets updates" meaning that Samsung and the carriers don't put any priority on it. Sure you can look at things like LineageOS, but since part of the problem here is in the proprietary firmware blob of the chipset there may still be problems that aftermarket OS upgrades aren't going to touch.

For that matter, is Trump's possible change to an iPhone within the last month[1] related to this, and has it stuck of does he still have a Samsung floating around as seems to be the case?

[1] [http://money.cnn.com/2017/03/29/technology/trump-iphone- andr...](http://money.cnn.com/2017/03/29/technology/trump-iphone-android- twitter/index.html)

edit: more neutral

<comment><USER3> I would totally expect this kind of thing to be already in the wild for the simple reason that people have been saying this sort of thing is possible for many years, it is just not the sort of thing that once the parties capable of doing it have found a practical exploit that they are then going to turn around and publish it to make the world a better place.

On the contrary, it will be hoarded and used against suitable targets.

An earlier hacker news thread around this theme:

[https://news.ycombinator.com/item?id=10905643](https://news.ycombinator.com/item?id=10905643)

<comment><USER2> In the wild as in "being actively exploited" yes, that's quite possible, but it's not a practical exploit for large-scale hacks on devices.

The required firmware changes are likely to be somewhat different for each version of the radio hardware and firmware and each carrier's OS variants. That means that you'd either need a very sophisticated set of exploit code (which means complicated and bulky when you may not have a lot of space to play with and may be working in hand-optimized assembler) or that you need to narrow your focus to only specified handsets. Even after that, you then have to have a WiFi access point pushing this, so even if you're in a high-traffic area such as a city downtown or an airport you're going to impact a relatively small percentage of devices.

If you have control of a large botnet of compromised WiFi routers you might be able to push this from those, but the more you do that the more likely you are to be discovered, and you're still going to have the problem of selectivity.

What this all translates to is that exploiting this on a wide scale would require a lot of resources and extremely skilled developers while also being at fairly high risk of detection. Using this for highly targeted attacks on the other hand would allow for less work generalizing the attack and could probably go undetected. Further, if someone not a state actor has "weaponized" this their best option for making money on it would likely be to sell the exploit to either a government or to one of the groups who specializes in targeted hacking.

<comment><USER3> It all depends on who you are. Politician or CEO of a multinational or a company related to defense? Political activist? Enemy of the state? The opposition? Hacker?

It doesn't have to be 'large scale' to be effective and given how hidden an attack like this could be (and how easy it would be to erase the fact that it was even there) it may have been used on your device and you still wouldn't be aware of it or able to prove that it was.

</comment></comment></comment></comment><comment><USER3> These write-ups are amongst the best stuff on HN in the last year or so. Fantastic content.

I'm not too hopeful on getting this kind of problem permanently solved though, but one thing that could be done is that manufacturers should treat the radio assembly as hostile rather than friendly.

<comment><USER4> Completely agree. Google gets some rightly deserved hate on HN, but I think their work on Project Zero and other security efforts is exemplary (I'd love to see Apple do the same).

Hat as well tip to the many individuals that contribute to Android security [0]. Especially Chinese companies, academics, and individuals, who often don't have the best reputation here either, but contribute a huge amount of the security bug reports to Android.

[0] [https://source.android.com/security/bulletin](https://source.android.com/security/bulletin)

</comment></comment><comment><USER5> It's about time regulators start to require publication of full firmware source code and build stacks. Even Google's power apparently is not able to enforce Android vendors (and IC vendors) to such standards.

The reason is simple: closed-source blobs are a danger to society as they leave exploitation to those with the highest budget (i.e. secret services) or a bit of luck (the "usual" rooters). Furthermore, having source code reduces electronic waste as independent developers can carry on offering support.

<comment><USER6> Closed source somehow prevent most exploits to be found. I truly don't believe that open source would do more good than it would harm the general public.

<comment><USER7> I see this kind of statement often, but I've yet to see evidence supporting it. The kind of actors who even have the ability to execute this kind of exploit wouldn't easily be stopped by a closed source codebase. My theory is that the security of open source firmware would be equivalent to that of closed source firmware _in the worst case_.

<comment><USER8> I agree. What OP is saying is akin to "if my lock is stronger, then the bad guys will go find another target". This never stops targeted attacks, APTs etc. If anything, it engenders a level of complacency, right up to when a breach occurs...

(and of course, in the "good ol days" of hacking, being a more difficult target actually meant being a more prime target, since that's how repuations are built... oops!)

</comment></comment></comment></comment><comment><USER9> > The Wi-Fi chip managed to DMA into the physical address range containing the > host's kernel, without any interference! This finally confirms our > suspicion; either there is no SMMU present, or it isn't configured to > prevent the chip from accessing the host's RAM.

Uf da.

<comment><USER10> Grim right? Wonder how many of these devices there are out there...

Can you even update the smmu config via OTA android updates?

</comment></comment><comment><USER11> Lack of IOMMU and no memory protection on the Wi-Fi IC was really awkward (but sorta expectable).

However, it's kinda shocking to me that they'd go to the trouble use a magic ethertype to tag internally-originating synthetic frames but completely neglect to strip out __externally-originating __frames with that magic ethertype.

<comment><USER12> I'm less shocked by that than I am by the fact that they still apparently aren't hiring external auditors. At this point it seems to me that it would be cheaper to hire an auditor (even _after_ initial shipment, so no time-to- market problem) than to get black eyes like this one.

</comment></comment><comment><USER13> Wouldn't this type of attack also apply to routers containing broadcom chips?

</comment><comment><USER14> If you have a raspberry pi, you can see the 886c etherframes in libpcap/tcpdump captures. At least on a RPi 3 with Arch Linux ARM.</comment>


Solar panel control systems vulnerable to hacks, feds warn  - <AUTHOR> http://arstechnica.com/security/2012/10/solar-panel-control-systems-vulnerable-to-hacks/ <comment><USER2> I know one of the guys mentioned in this article, and I'll say that this is just the tip of the iceberg. Its pretty nuts how relaxed people are with this stuff.</comment>


Protecting Browsers from Cross-Origin HTML-parsed-as-CSS Attacks [pdf] - <AUTHOR> http://websec.sv.cmu.edu/css/css.pdf

<comment><USER2> Interesting article. Cookie-stealing however is not that simple, as all sites I know in detail, use IP binding. This method renders the cookie useless for the attacker, as long as he doesn't forge the original IP.</comment>


2k pages of Ghislaine Maxwell/Jeffery Epstein unsealed documents - <AUTHOR> https://www.documentcloud.org/documents/6250471-Epstein-Docs.html <comment><USER2> Trying to sift through these last night, I hopelessly wanted a service to transform a collection of PDF files into a searchable text database in one pass. Opening a few files haphazardly, I only found judicial minutiae.

<comment><AUTHOR> > I hopelessly wanted a service to transform a collection of PDF files into a > searchable text database in one pass.

DocumentCloud has the search function. A lot of the files aren't machine- readable, so current resources are limited.</comment></comment>