Ex-lottery worker who rigged winnings gets 25 years in prison - <AUTHOR> http://money.cnn.com/2017/08/22/news/iowa-lottery-sentencing/index.html <comment><USER2> Ok. Do these guys that commit white collar crime not know how a passport works? If you have millions of dollars stashed in bank accounts WHY are you in the US? Why are you buying estates and testing out a new bmwI8 and spilling champagne all over? Why not get on a _plane_ go to Morocco (a country with an extremely complex extradition process)? wtf. Even the guy running silk road was hanging out in SF now lives in a 4x6 concrete cube - instead why not hang out with Edward Snowden in a Russian bar or whatever.

This guy for example the FBI calls just to chat. They can't touch him.

[http://www.oregonlive.com/news/index.ssf/2009/11/felon_share...](http://www.oregonlive.com/news/index.ssf/2009/11/felon_shares_inside_story_of_o.html)

<comment><USER3> I've also always wondered this. But people seldom run.

I think Snowden had seen enough of the sausage being made to realize that hiding in the USA was impossible, given the security apparatus' capabilities.

<comment><USER4> Given that he defected to Moscow, staying in the US wasn't an option

<comment><USER5> Crazy that people still believe this stupid lie, easily debunked by 30 seconds on Wikipedia.

Even crazier is that the people who really wanted to string Snowden up by the neck were the conservatives, because they love law enforcement and are willing to give up freedom in order to fight Islamic terrorism. In other words, supporting Big Brother despite ostensibly wanting less government.

Crazier still is that those same people, the ones who were demonizing Snowden for ending up in Russia, are now in love with Assange and Putin because Trump.

"Two things are infinite: the Universe and human stupidity, and I'm not sure about the Universe."

<comment><USER6> > Even crazier is that the people who really wanted to string Snowden up by > the neck were the conservatives

I strongly feel that this had bipartisan support across the aisles. Obama supported it, despite his pledge to protect whistle blowers. Hillary was no different.

<comment><USER7> It's true that this was bipartisan amongst elected officials, and strangely to me, a number of liberal people in my native DC area that I still talk to. I think there were varying degrees though. Do you think Trump would have let Manning go for example? I'm not sure that even Hillary would have. And yet Obama did, eventually.

Also, there is little doubt in my mind that mutual hate of Hillary brought together WikiLeaks and several previously unlikely allies.

<comment><USER6> > you think Trump would have let Manning go for example? I'm not sure that > even Hillary would have.

Of course not, I'm just trying to dispel the myth that the world is in black and white. You can't just hold the 'other' party accountable. We need to look in the mirror.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > "It's difficult even saying that with all the people that I know behind me > that I hurt."

It is interesting to think about who he considers he hurt. The potential winners who relied on lottery winning to secure a future for their families? The lottery workers? He is a criminal surely, but isn't the whole lottery system a tax on lack of education and it just gives false hope to people and encourages gambling. He reduced faith in it somehow being a random lottery so I guess he probably hurt the state income bottom line. At least in some states they claim to use lottery proceeding to improve math education - not sure how truthful that is.

<comment> temp-dude-87844 While I support the idea that lottery and gambling is for 'entertainment purposes only', if one never buys into the lottery, they can never obtain the winnings. Buying exactly one ticket per drawing at least places one in the pool of potential winners, despite the odds being rather long. Although the expected value is still minuscule, it's an unquantifiable improvement (since we can't divide by zero).

And before you evoke any comparisons with the probabilities of getting struck by lightning or hit by meteors, none of those will ever _pay_ you a nice chunk of cash.

Investing the same amount of money in a financial device with higher assurances of returns is not a comparable experience, neither psychologically nor practically, even if we callously suppose that such instruments are in fact widely available across all cross-sections of society. Holding back the price of 1 ticket per drawing period from safer investments to gain a shot at a high-payout lottery is simply diversifying your investment portfolio.

<comment><USER9> _> Although the expected value is still minuscule, it's an unquantifiable improvement (since we can't divide by zero)._

This isn't how it works, because the expected value, in monetary terms, is negative once you factor in the cost of the tickets. Statistically, it is a quantifiable unimprovement.

That said, lots of activities have negative expected monetary value, like going to the movies, or going bowling. And it is theoretically _possible_ that you will find an envelope in the bowling alley parking lot containing a million dollars, but let's not pretend that both bowling and playing the lottery are anything other than entertainment products at the end of the day.

<comment><USER10> > This isn't how it works, because the expected value, in monetary terms, is > negative...

I once heard a statistics professor explaining he played the lottery. His reason? It was fun. Period. He said one may spend $10 on a movie ticket and be entertained for a few hours, but one would end up $10 poorer with 100% certainty. On the other hand when _he_ spent $10 on a lottery ticket he was entertained for days just thinking of the possibility of winning, and he _might_ end up a lot richer, but it was not a necessary condition for him to enjoy the fun it provides.

<comment><USER11> That sounds exactly like a smoker "explaining" why they smoke. They claim to enjoy it. In reality, of course, smokers only smoke because it makes them stop feeling the nicotine urge for a short while, i.e. they feel like a normal non- smoker person for a short while.

Likewise, anyone could fantasize about getting a windfall of mountains of money from _far likelier_ events, like an unknown relative willing their fortune to you. Sure, it's unlikely, but it's _more likely_ than winning the lottery. You don't need to play the lottery to do that.

<comment><USER12> > They claim to enjoy it. In reality, of course, smokers only smoke because it > makes them stop feeling the nicotine urge for a short while

Using this model, it's difficult to explain where new smokers come from.

<comment><USER11> The reason people start to smoke are the same reasons people start to drink coffee, or tea, or beer. Nobody likes any of those things when they first try them, but they _choose to acquire the taste_ , for either social reasons and/or because they want the side effect (caffeine or alcohol). In the case of cigarettes, the social effect has been very strong but is declining, and the wanted side effect is illusory, but as long as people still think that they will get something from nicotine, people will start to smoke, or vape, or chew, or snuff, or whatever form it will take in the future.

<comment><USER12> [http://slatestarcodex.com/2016/01/11/schizophrenia-no- smokin...](http://slatestarcodex.com/2016/01/11/schizophrenia-no-smoking-gun/)

In general, you're not on firm ground when someone says "I enjoy X" and you say "no, I can tell what you enjoy better than you can".

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> > The prosecutor said Tipton will serve no more than five years, if he behaves > and makes parole.

Well at least he didn't sell drugs.

Slightly relevant story: A few years ago I was visiting China and my colleagues there were discussing a city official who had just been found guilty of embezzling tens of millions of dollars from the local government (which is more or less what this guy did). Me: "How much time did he get?" Them: "Three days." Me: "In prison?" Them: "To live."

<comment><USER14> The median sentence for sale of narcotics (state charges, like the lotto fixer) is less than three years. In some jurisdictions the average drug sale sentence is less than a year.

</comment></comment><comment><USER15> If you can hack different lotteries in multiple states, how hard can it be to hack voting machines?

You can't count on a complicated extradition process to prevent extradition. With an Interpol Red Notice, travel is difficult. There's informal extradition as well, as El Chapo found out. His Mexican cases were still on appeal when he was shipped north. Florida lawyer Scott Rothstein fled to Morocco, turned around and came home. Still, there are exceptions. France will not extradite its citizens for any reason, in part because of the Holocaust. This keeps Roman Polanski safe. Italy will not extradite its citizens either. Nor will Israel.

</comment><comment><USER16> Anyone know why these lotteries stopped using the traditional bingo ball machines in favour of a black box?

<comment> tuna-piano It's really telling when computer experts are the ones most scared ahout electronic voting, software lotteries, etc.

Even the best BitCoin experts seem to recommend burying your bitcoin key in you yard or storing it on paper at the bank.

<comment><USER17> Absolutely. The most useful idea I've seen about how to think about this is this: 'On a network, everything is at zero distance'.

So, imagine the worst people you can imagine in the whole world, sitting right there in the same room as all the things you care about. You'd probably be worried about that, right?

But, the argument goes, we have all these security measures in place between those things. They're not in the same room we've built all these walls! Sure, but those walls are not impenetrable by a long shot. None of them beats simply not being in the same place. Nobody has a teleporter yet, but those layers of security you are relying on are vulnerable to a constantly evolving landscape of exploits, vulnerabilities and plain old fuck-ups.

This is why air gaps are still such a valuable concept. Why off-siting your backup tapes is not an outdated step but rather a pragmatic step in securing your information assets. Why keeping some systems unplugged from any network when they're running critical infrastructure is sensible. Why buring your bitcoin wallet in some secret location is not the behaviour of an off-the-wall tinfoil nutter.

There are, of course, steps to be taken if you have compelling reasons to stay connected, and those steps can get you to (or close to) the same level of assurance as unplugging. But those steps are complex, require ongoing maintenance, and operate in an evolving threat landscape. Think for example: Encryption protocols that we used to consider secure.

There's a simple bypass for that effort and knowledge and it's to unplug. It's a very powerful tool, and yet often ridiculed, in my opinion from positions of either ignorance or zealotry.

</comment></comment></comment><comment><USER18> It is a bit amazing when you think that on average, there is a new millionaire (or even multi-millionaire) made by the different lotteries in the USA _every day_

<comment><USER19> It would be interesting to know the rate at which they subsequently fall out of that status.

</comment></comment><comment><USER20> How could you possibly believe you would get away with something like this.

<comment><USER21> He started in 2005 and the investigation started in 2015, so he did get away with it for 10 years. He probably could have won a few, stopped, and gotten away with it if he'd been less greedy.

The code was clever, generating predictable numbers on a few particular days of the year. And it must have been subtle, to survive 10 years of nobody else noticing.

<comment><USER22> Makes you wonder how many people _do_ get away with things like this without anybody realising.

<comment><USER23> Most criminals get away with most crimes. 40% of murders go unsolved.

<comment><USER24> Wouldn't that mean they don't get away with most murders?

<comment><USER25> It's close enough that undetected/unreported murders could tip the scales. If you get away with making it look like an accident, isn't in the statistic of unsolved murders.

</comment></comment></comment></comment></comment></comment><comment><USER26> Time to switch over to provably fair lotteries!

<comment><USER27> This is actually a hard problem. In order to be provable, you have to be deterministic (i.e. you can't leave the RNG as a black box). However you can't let any individual (nor any conspiring individuals, think Sybil attacks) predict the result, nor have any control over the result (except perhaps to disqualify themselves).

<comment><USER28> What about this scheme?

This week's random number is the concatenation of three cryptographic signatures of last week's random number. The three private keys are kept in different places on cryptographic tokens and they are guarded. Lottery numbers are drawn by a deterministic algorithm using the week's random number as seed. In the case of a compromise of a single private key it can be revoked and replaced by the signature of the two other keys.

I'm not a cryptographer, maybe this scheme is flawed in some way that I can't immediately see.

<comment><USER27> Presumably, the winner of the lottery will earn lots of money. As such, someone would be willing to spend lots of money in order to ensure they can win. They could therefore bribe the guards to give up the keys before bets are placed, and therefore know what to bet on.

</comment></comment></comment></comment><comment><USER29> So, have they not watched _Die Hard_? The point made in that movie is that when you steal this many millions, they _will_ find you -- unless they think you are already dead (thus, the plot to blow the building and look like they all died in the process).

What were these fools thinking?

<comment><USER30> Using movies as basis for decision is even worse.

</comment></comment><comment><USER31> Wow American sentences are out of this world. You get less than that for mass murder in Norway.

</comment><comment><USER32> Do these people not do code and/or security reviews? The random number generator for a lottery seems like the most important part and should be heavily audited.

</comment><comment><USER33> > Tipton's lawyer said he expects his client will serve three to four years > before being released.

Far from the 25 years mentioned in the headline...

</comment><comment><USER34> I'd love to know what he actually did. You'd think with what is at stake, the lottery would have some serious security measures in place to stop someone doing an obfuscated _if(date=x) return [12,34,5,6,7];_ or messing with the RNG.

</comment><comment><USER35> Anyone have details on how exactly he did it, and how he got caught? I'm not a lottery player but I'm intrigued by the fact that one state had refused to pay him because they thought it was fraudulent. What was their cue?

</comment><comment><USER36> I'm not saying this person is innocent, but 25 years for something that didn't hurt anyone is way excessive. This sentence would be more appropriate for murderers, and yet some of them get way less.

<comment><USER37> One of the principles of tort law is that the penalty should account for the likelihood of getting caught. If your nuclear power plant melts down, punitive damages will be low, since there's no way you could have ever covered it up, and the plant will typically pay mostly compensatory damages for direct harms. For a tort where you expect that thousands of people have done it without getting caught, the punitive damages are very high so that the overall calculus for a prospective criminal becomes net negative expected value.

That's not a principle of criminal law in the US but often becomes part of the sentence extrajudicially.

<comment><USER31> Pointless though as that is not how humans really assess risk. England tried thisin the 1700s or so. Replacing cops with harsh penalties. Did not work, punishment levels kept going up without any affect on crime

<comment><USER37> It may be how companies assess risk, especially family-owned businesses, which is probably why it's remained in tort law.

</comment></comment></comment></comment><comment><USER38> I didn't understand the State here, who did he harm? "All the people that were harmed", what does that mean?

<comment><USER39> Eddie Tipton tarnished lottery's reputation. The State milks lottery (taxes) and therefore loses financially if lottery reputation is tarnished.

</comment></comment><comment><USER40> This is the reason the lottery should be run by a smart contract in Ethereum for example, like [https://lifelottery.github.io/](https://lifelottery.github.io/)

</comment><comment><USER41> .

<comment><USER42> Money represents time and resources. He can't exactly restore those either.</comment></comment>


Sprint/Google Voice integration results in overage charges  - <AUTHOR> http://www.zdnet.com/blog/mobile-news/some-sprint-customers-seeing-overage-charges-due-to-google-voice-integration/2567

<comment><USER2> At the risk of sounding clueless, would someone tell me what my benefit of using GV is if I already have Sprint with the unlimited cell minutes?

I haven't really listed very intently to this whole thing, so I'm a little behind.

I know that before you could make calls using your GV number - can we now set our Sprint number as our GV number? If I set my Sprint number as my GV number, do I incur charges for using it?

Right now I'm only using GV for the voicemail feature, but would be interested in learning more.

<comment><USER3> GV was very helpful when my cell phone borked and out of service for a week since it let me redirect the phone number to my landline. That said, this is the only time this feature has ever been remotely useful to me, and now a replacement cell phone shows up quickly enough that I barely have time to switch the number over.

</comment></comment><comment><AUTHOR> FWIW, this is a huge bummer and I'll probably be looking to figure out how to disable the integration (without the havoc that has happened to some trying the integration in the first place).

The bummer about this is that Google Voice really gets in your face about choosing Option 1 or 2. There really isn't a good way to say "No thanks".

</comment><comment><USER4> is this different than using google voice with any other carrier? I know when I switched I tried to balance getting free mobile to mobile calls with the annoyance of people knowing both numbers, but I really use so few minutes these days anyway I just went with all google voice all the time. Others should probably go the other way.

<comment><USER5> Nope. People just don't don't understand that when they call someone on google voice, they aren't calling them. Google is calling both of you.

<comment><USER6> Placing a call from Google Voice's website DOES call your phone and the other caller's phone, as you said.

But that's not what this article is about.

Its about you authorizing Google Voice take your number from Sprint on your behalf so a Google Voice number is used instead of a Sprint number. And the unexpected consequences.

<comment><USER4> fair enough, but I guess my point was that, while it might be a new batch of people encountering an unexpected consequence, it's the exact same unexpected consequence. I use google voice integrated into my phone's dialer (or whatever), which means I'm initiating the call. _I_ know that it's actually calling a google voice number and then being redirected to my destination, but what appears to happen is that I call someone's mobile phone but don't get free minutes. same thing, right?</comment></comment></comment></comment>


3-Day Egyptian Maker Space in Cairo, to Help Establish FT Hackerspaces in Africa - <AUTHOR> http://www.kickstarter.com/projects/bilal/3-day-egyptian-maker-space-expanding-the-maker-mov

<comment><AUTHOR> A friend of mine who helped found All Hands Active hackerspace in Ann Arbor is traveling to Cairo, Egypt with Mitch Altman, who helped found Noisebridge hackerspace in SF in a couple weeks to establish the case for hackerspaces in Cairo. If you're interested in helping establish Maker Spaces in newly democratic areas and throughout Africa or getting involved in an advisory role checkout their kickstarter project that launched over the weekend.</comment>


The resume written by Swift – a full-stack engineer & desginer - <AUTHOR> https://gist.github.com/catfan/bfedfa5d04c51996276ac0a415ee8815 <comment><AUTHOR> I'm right now looking for a full-time job in California.</comment>


9932 days streak - <AUTHOR> https://github.com/jamerica

<comment><USER2> Obviously he/she altered the git history. There are many hacks floating around the internet to do something like this.

<comment><USER3> Yup, pages and pages of commits "Just now" without any content to them.</comment></comment>


Massively Multiplayer Online Drum Machine - <AUTHOR> http://mmodm.co/ <comment><USER2> Looks cool, but I'd be a lot more willing to allow the Twitter integration if I could try the drums out beforehand and see if they're any fun.

Posting something to my Twitter is essentially a recommendation of it, which they're asking me to do without letting me try the thing I'm recommending. Too high of barrier to entry for me, sorry!

<comment><AUTHOR> Agreed, thank you, we're thinking of changing that soon to allow you to practice before tweeting! you can still hear each beat if you type its letter (outside the input text field:p)

</comment></comment><comment><USER3> As someone who spends a lot of his time playing around with drum machines, I couldn't figure out how to use this. I was only able to make lines without laying down any individual notes. Not sure what I'm missing here?

Also another thing to note, is that setting up the key triggers in alphabetical order like that is odd and really unintuitive. The standard for most digital audio workstations is to line up the top two rows of qwerty keys like they are piano keys (qwerty row = black piano keys, home row = white piano keys), and use 'z' and 'x' to change the octave.

<comment><AUTHOR> Appreciate your feedback! Putting '-' in your sequence will have add a 1 unit gap between your beat! We're changing the letters order to match qwerty soon!

<comment><USER4> Derek, I don't think people realize you have to retweet to get this to work? I had the same issue...

I agree with other people who complain about this. I shouldn't have to tweet something in order to see the results.

</comment></comment></comment><comment><USER5> What's the point of Twitter integration? Why can't I make patterns with the mouse on the screen?

<comment><AUTHOR> Good point, it's text based because I miss playing around with text-based interfaces. Other than to please the keyboard junky in me, using Twitter stream API as a part of your system has so many cool benefits...

<comment><USER6> right but... how do i know if it's a cool rhythm before tweeting? I don't get how to create something without spamming people with crap.

<comment><AUTHOR> if you mention @playmmodm in your tweet like so'@playmmodm [o---o---oxx-x-x-z- z-z] #MMODM' you wont spam your friends because they're not following @playmmodm! Hope that helps a bit while we take all the good feedback we got here and fine-tune those details. Thanks.

<comment><USER7> Then what is the reason to integrate it with twitter only? I can't even use it (and I wish I could) unless I sign in.

</comment></comment></comment></comment></comment><comment><USER8> Yeeeeaaaah...

Why does your music toy need to be able "see who I follow and follow new people", "update my profile", or "post tweets for me"? That's just not happening. It's unnecessary.

<comment><AUTHOR> Read/Write access to be able to tweet on your behalf with your access token. We're changing that to a Twitter button as we speak. If you still feel like giving mmodm a shot, you can Tweet the sequence from your own account without the need of oauth! Make sure to follow this pattern '@playmmodm [o--o--x-x-x- xzzs] #MMODM'

<comment><USER7> Still not necessary. A simple share button is enough.

</comment></comment></comment><comment><USER9> I don't tweet when I am forced to tweet.

<comment><USER10> You and me both brother. *highfive

Forced interaction with a social network is an easy way to alienate anyone over 15.

<comment><USER9> _

</comment></comment></comment><comment><USER11> Update my Twitter profile? Come on, for all the work that obviously went into create a cool product you could have taken an extra minute to properly set the oauth permissions.

<comment><AUTHOR> Unfortunately, to be able to Tweet on your behalf, we need to request for the Read/Write permissions. I understand your fear, you can bypass that thing by going to your Twitter and tweeting to the Drum Machine like so: @playmmodm [o ---o---o---ozz-z-z-zz] #MMMODM

</comment></comment><comment><USER12> No, you are _not_ getting access to post from my Twitter account.

</comment><comment><USER13> Please, put the letter as qwertyuiop... and not abcdefg... Otherwise, cool project!

<comment><AUTHOR> Good idea! Thanks, it'll feel more intuitive.

<comment><USER13> However, this will kill the azerty folks. Add a way to switch, and keep abcdefg for the folks using other weird layouts!

</comment></comment></comment><comment><USER14> I think this is a really neat idea and I really wanted to play with it but the interface isn't really intuitive and then I read that you have to use twitter to be able to use it. I think I'll pass. Neat idea though.

</comment><comment><USER15> How do I make the music?

<comment><AUTHOR> every letter corresponds to a beat! Dashes are spaces between beats! Tweet from either the web-app or from Twitter like so '[dd--dd--ddo---o---o---o] #MMODM'

<comment><USER2> What is the vertical line? Why does clicking on a box not turn on/off that box? Is there some other way to turn on a box? Is there some way to generate the "[dd--dd--ddo---o---o---o]" for me, so I don't have to figure out the syntax myself and make sure I have the right length of string? Is there some way outside of twitter to try a string like "[dd--dd--ddo---o---o---o]" to see what it does, before I post it to my friends on Twitter?

I like to think I'm not the average clueless user, but this site really confuses me :) Looks like with a little polish and user testing, it could be fun, though!

<comment><USER16> It doesn't encourage play at all and doesn't even tell you what its supposed to do. Its honestly one of the most frustrating interfaces I've seen. It feels like it would be powerful, but its so unintuitive in even the most basic function of setting beats it fails miserably.

</comment></comment></comment></comment><comment><USER17> _Acid Defender_ is an addictive (single-player) drum machine game:

[http://cappel-nord.de/webaudio/acid-defender/](http://cappel- nord.de/webaudio/acid-defender/)

</comment><comment><AUTHOR> We replaced Twitter oAuth with a simple Tweet intent! [https://github.com/MMODM/mmodm](https://github.com/MMODM/mmodm)

</comment><comment><USER18> I can't understand how to use it. Should I post something on twitter to enter a pattern? I would prefer clickable interface I think.

<comment><AUTHOR> try tweeting the following '@playmmodm [o---o---o---oxx-xx-x-xx-xxxz--z--zzzz] #MMODM' and watch what happens on mmodm.co

</comment></comment><comment><USER19> Heh, is Chrome slowing down the Javascript clock when you switch away from the tab? Because it changes to around 1 beat per second.

<comment><USER20> Haha yep. Chrome cranks SetInterval way down when a tab is in the background.

</comment></comment><comment><USER16> I don't get the interface after 2 10 minute tries. Can someone please tell me how you actually put a beat down?

</comment><comment><USER21> So the input to this is posts at their twitter account from your twitter account?

<comment><AUTHOR> MMODM's Twitter account (@playmmodm). I understand hackers fears as I'm one of them. That's why the better way to play the drum machine is by tweeting to it like so (from Twitter) ' @playmmodm [o---o---o---oxx-xx-x-xx-xxxz--z--zzzz] #MMODM'

<comment><USER22> i want to share via twitter only after i've found a good combination of beats. Am I missing something here, can this page do anything without being integrated with twitter?

</comment></comment></comment><comment><USER23> Fantastic....not very intuitive to select beats...really strange.

<comment><USER24> You have to log in with your twitter. Which gives them control over your account to follow who they want, and the ability for them to tweet for you.

I'll pass.

<comment><AUTHOR> woot! No way! You can tweet like so '[deeeedghgo---o---o--] #MMODM' from your Twitter account and still be able to play it!

</comment></comment></comment><comment> tech-no-logical my firefox (latest beta) says :

"The buffer passed to decodeAudioData contains invalid content which cannot be decoded successfully"

and produces no sound on win 7 64 bit. chrome works flawlessly.

<comment><AUTHOR> Web Audio API issues with your Firefox I guess! Thanks for reporting, we'll look more into that!

</comment></comment><comment><USER25> Imagine posting this somewhere like 4chan or reddit

<comment><USER26> Way ahead of you.

<comment><AUTHOR> haha!

</comment></comment></comment><comment><USER27> hope you guys enjoyed my drum solo at about 1:00 PM PST

I totally killed it....

because nobody else played anything for a while.

but seriously, what was used to build this? meteor.js?

<comment><AUTHOR> Thank you! I think we did, I'd have to check the database logs! If you click on the share link, you can save the cool drum beat you made!

We used Node.js, Express, socket.io, cluster, redis and MongoDB! Please fork us! [https://github.com/MMODM/mmodm](https://github.com/MMODM/mmodm)</comment></comment>


Git is 42 times more space efficient than SVN - <AUTHOR> http://vcs.atspace.co.uk/2012/11/05/which-repository-is-more-compact-git-or-svn/

<comment><AUTHOR> The article does not explain why Git is that much more efficient. It has some thoughts in the right direction though.

Obviously, SVN and Git have different delta-compression techniques. For a given SRC and DST files, Git's algorithm puts COPY instruction from _any_ position at SRC file. Subversion however restricts COPY instructions to be sequential, i.e. the consumer of generated instruction stream doesn't perform random reads at SRC in order to produce DST.

For the sake of simplicity, let SRC='aabc' and DST='aaxyaa':

Git instruction stream:

      COPY   'aa'
      INSERT 'xy'
      COPY   'aa'

SVN instruction stream:

      COPY   'aa'
      INSERT 'xyaa'

As result delta-encoded DST file is more compact in Git repository than in Subversion. What are the drawbacks of Git's approach? Good exercise for the reader.</comment>


Enlightenment Foundation Libraries release version 1.0
 - <AUTHOR> http://www.enlightenment.org/?p=news/show&l=en&news_id=28

<comment><USER2> No release notes, no screenshots, no videos. Way to go.

I really liked enlightenment in 2004, when they had all the latest desktop bells & whistles (transparency, 3d, shadows, etc) - in short back when they had the stuff that we take for granted nowadays.

<comment><USER3> What sort of screenshots would you expect to see for a bunch of libraries?

Thus isn't a release of the window manager, this is a release of the libraries which various applications use (including the window manager)

Presumably, you'll now start to see some applications written using the EFL's, which I'm sure will have a plethora of screenshots for your amusement.

</comment></comment><comment><USER4> I'd love to see some demo apps.

</comment><comment><USER5> good to see progress in the libraries, however i find it really sad e17 never quite "made it".

</comment><comment><USER6> They beat Perl 6, then.</comment>


Six Django projects accepted into Google Summer of Code - <AUTHOR> http://socghop.appspot.com/org/home/google/gsoc2009/django

<comment><USER2> But not the Pylons project [ <http://www.pylonshq.com/> ] (Ref: [http://groups.google.com/group/pylons- discuss/msg/6b9bb138da...](http://groups.google.com/group/pylons- discuss/msg/6b9bb138da906733) )?

What is GSoC, the American Idol popularity contest?

<comment><USER3> Can't support all open source projects. Django clearly has the momentum that the others don't.

<comment><USER4> That has nothing to do with it. There are specific guidelines for accepting a specific organization based on their proposal, their community, their willingness and ability to become involved with the students.

The organization also has to apply.

</comment></comment></comment><comment><USER5> I'm excited to see that someone is working on a high level database API. This will be very useful for hooking up non traditional databases like bigtable or couchDB.

<comment><USER6> I don't think they're going to do any more abstraction. What you'll be able to do is query quickly in another database. So for example build a web app with access to the company's legacy accounts database or something. No abstractions over schema free DB's.

<comment><USER7> Django already does this quite well:

<http://docs.djangoproject.com/en/dev/howto/legacy-databases/>

So it's hopefully something else.

</comment></comment></comment><comment><USER4> why is Django at GSOC news and not any of the other 149 organizations? or any of the other 994 accepted projects?

</comment><comment><USER8> I guess it's the GSOC students/mentors who are upvoting this news.</comment>


Ask HN: Can a contractor earn as much or more than a full-time employee? - <AUTHOR> My understanding is that the main drawbacks of contracting is not to have any of the benefits of  full-time employment, although from personal experience a few years ago, I struggled to consistently find clients and had periods without contracts, hence not making it worthwhile in the longer term.
As a FT employee now, I keep getting thousands of contract work offers, but these don't seem attractive from my previous experience.
Is there any of you out here able to consistently get contract work, which in the long term earn you as much or more than as a FT employee?
(in the context of software development, mobile/front-end/back-end) <comment><USER2> Contracting can be very lucrative. It is also extremely flexible. It also involves a lot of tasks that you don't need to think about as an FTE.

Importantly, it also usually grows through a daunting non-linear curve where:

1\. [Scary Phase] you don't have enough work in the beginning and don't know how to find it and freak out and look at FTE job listings and think about giving up.

2\. [Frustrating Phase] you start accumulating good clients and bad clients and have to learn to avoid new bad ones and shake existing bad ones; you feel like you're always working with the bad ones and are neglecting the good ones.

3\. [Lucrative Phase] you're good clients keep coming back with fresh work and you've really gotten the hang of getting new leads without even trying and you have more work than you can handle on your own. And if you have good business instincts, you're earning quite a lot.

Often (but not always), it can take quite a while to get to (3).

<comment><USER3> How do you identify a bad client?

<comment><USER4> They either:

\- don't pay

\- don't pay on time

\- want to low ball you on bids

\- don't follow your advice

\- get upset when the pain you told them would happen if they ignore your advice, happens

\- are verbally abusive or manipulative

\- anything else that makes you unhappy working for them

Bottom line my mentor taught me to take work from the troublesome clients but to make sure their rate was sufficiently high so that I was always happy to work for them. They can be jerks but I would smile because I knew I was getting a fat check from them. Experience has shown me however crap loads of cash aren't always enough.

</comment></comment></comment><comment><USER5> The amount of money you can earn as a contractor depends heavily on your brand. From what I've heard from contractors, their playbook seems to be the following:

1\. Work to increase strength of brand to get more leads.

2\. When number of leads exceeds capacity, increase prices until number of leads are manageable.

3\. Go to step 1.

The hard thing here is of course to increase the strength of your brand. The easiest way to do that is to pidgeonhole yourself into a very narrow area of specialization (SEO, effectively), attend / speak at relevant conferences, write books / articles about it.

<comment><AUTHOR> This makes sense. #1 feels like building a product/business, which I've tried many times and the marketing part is ALWAYS hard!

I guess iOS, front, and back-end aren't exactly niche, though.

<comment><USER6> Many times consultants specialize in certain industries. I know one consultant that charges $200+/hour + expenses for basically energy industry data processing and custom reporting. I imagine that there are a ton of people in banking/finance systems that charge that much or more for their knowledge about the regulations and how some of that data should be processed.

<comment><USER5> There's horizontal and vertical specialization. Your "vertical" is your "ideal clients", and your "horizontal" is your product.

Solve an expensive problem for a niche industry and roll in gold.

</comment></comment></comment></comment><comment><USER7> The upside of being a freelancer / contractor is that you make 100% of the rate you charge. The downside is that you have to take care of all the overheard as well (lead generation, benefits, tools, accounting, etc).

If you're able to charge a high enough rate, then yes you will make more money than you could in most full time positions. But this depends alot on your ability to market yourself and handle the overhead I mentioned.

<comment><AUTHOR> This makes sense, this correlates with what undreren said.

[https://news.ycombinator.com/item?id=17868192](https://news.ycombinator.com/item?id=17868192)

</comment></comment><comment><USER8> In my experience, the majority of contracts are offered 100% as a way to avoid having to pay benefits or make any sort of real commitment. The so-called lucrative contracts are the exception.

It's also going to depend on if you find a certain type of repetitive niche where you are just reusing the same speeches or libraries over and over again or where you really are engaged with unique problems.

</comment><comment><USER9> Clients want contractors so that they don't need the commitment of an employee. This is a benefit to the Client that the contractor can charge a premium for. Therefore, if the contractor can find enough clients and is able to handle their overhead efficiently, they can make a lot more money than an employee. The downside is that the contractor needs to be willing/interested/effective at marketing and managing overhead.

To me the question is a lot like "what type of company should I work for". It depends on your skills, interests and values.

<comment><AUTHOR> This makes sense, yet it contradicts with [https://news.ycombinator.com/item?id=17869727](https://news.ycombinator.com/item?id=17869727), which argues that there's a trade-off between income and freedom.

But maybe they all fit into some sort of balance between income, self- marketing, and freedom? Oh man, that really makes me want to get into contracting again!

<comment><USER9> I don't think our two comments are mutually exclusive. One could be a contractor only working a few small jobs or off and on. In that case you'd have more freedom but not make as much.

</comment></comment></comment><comment><USER10> This doesn't directly answer your question, but there is some silliness in the way some large companies hire contractors that typically prevents an individual contractor from making more (including benefits) than an employee. I know somebody who was able to work around this that I'll describe at the end of the post.

Many companies prefer to hire contractors through agencies they trust or professional services companies. Sometimes this is just baked into HR policy so you can't hire an individual contractor even if you want to. I used to work for a services company that charged customers ~$225/hr for US based people with specialized expertise in a certain area. The employees would get less than 50% of that in salary, but it probably came to 50-60% of that if you added in benefits.

Note that "specialized expertise" is really broad and many customers were paying premium rates for very average consultants. The customers that really needed experts cycled through a few average consultants before getting a great one.

I've also been at the other end of this, being the person who was hiring through an agency who charged ~$150/hr and paid their actual contractors much less. Again, the quality of the "experts" on their end varied widely.

At those rates, if you paid an individual directly you could get somebody amazing. But none of these companies were willing to do that and directly hire a great person for 75% of what they were paying a firm to do the same (or worse) work.

I knew one person who found a way around this. He was part of a professional services group and was contracted to a large company for 2+ years (multiple short term contracts) and built a bunch of custom stuff for them. He was literally the only person on earth who understood what he had built. He was also really good, so you couldn't replace him easily. He had some family issues and had to quit from the services company to take care of family.

The large company had no choice but to hire him directly as a contractor and give him a lot of leeway in his work schedule so he could take care of his family. He got a great rate and made that work for multiple years. I think the large company wanted to hire him as an employee, but he had no interest in getting pulled into their day-to-day politics.

<comment><AUTHOR> > He was literally the only person on earth who understood what he had built.

This is often not a good sign, i.e. if the code is so messy no one can understand it. But if it's so technically challenging only him can understand, then that's a great position to be in!

I guess the tldr of your story is to stay away from these big companies and to work directly for your clients?

<comment><USER10> >This is often not a good sign, i.e. if the code is so messy no one can understand it. But if it's so technically challenging only him can understand, then that's a great position to be in!

What he built required specialized knowledge of a GUI driven product that had a very convoluted C# SDK for developing custom add-ons. So it was less about messy code and more about there being very few people who could understand all 4 aspects (The product, C#, the SDK, and how the SDK related to the GUI).

>I guess the tldr of your story is to stay away from these big companies and to work directly for your clients?

Yes and No. Sometimes to get paid well as a contractor you need to find other ways to get gigs than finding standard contract recruitment that comes through LinkedIn. In the case of the person I knew, he had basically created an add-on product and was charging hourly for services to maintain and add features.

</comment></comment></comment><comment><USER11> You are looking at it the wrong way. What you lose in income, you gain in flexibility and self-reliance. If you get very good at it (deep specialization or a knack for finding contracts) it may equalize in income but that should not be the point.

Just as working for a startup shouldn't be driven by dreams of riches.

<comment><AUTHOR> Right, trade-offs! Thanks for the mindset shift!

</comment></comment><comment><USER12> you might consider keeping your FT job, and as a side-hustle, subcontracting those "thousands of contract work offers" with third-world professionals acting as an agency.

<comment><USER13> > subcontracting those "thousands of contract work offers" with third-world > professionals acting as an agency

Aka the easiest way to ruin your brand and deliver shit work. If the clients wanted work done by "third-world professionals" they would hire them directly; the reason they're contacting _you_ instead is because you have some credentials, references, etc that the third-world guys don't have; now do you wanna bet all of that on unvetted third-world freelancers?

<comment><AUTHOR> Oh thanks for adding that, totally agreed.

I initially misunderstood the suggestion as taking those contract as side gigs.</comment></comment></comment>


Why Amazon Was Not Successful in China - <AUTHOR> https://capitalandgrowth.org/questions/2212/why-wasnt-amazon-successful-in-china.html <comment><USER2> Good. American corporations shouldn't own the world, even if they must rule America.

<comment><USER3> Yeah. Amazon should never get access to the Chinese market like Alibaba has to the US market. /s</comment></comment>


The Internet Was Built on the Free Labor of OSS Devs. Is That Sustainable? - <AUTHOR> https://motherboard.vice.com/en_us/article/43zak3/the-internet-was-built-on-the-free-labor-of-open-source-developers-is-that-sustainable <comment><USER2> When I evangelize for an open-source project, I tell a company that they need to do two things to make Free/Libre/Open-Source Software work Really Well:

1 - hire an engineer on your payroll give to this one project ( _maybe_ two, if theyre both small). Their role is to join the software project, and ensure that your usecase remains viable. That last bit is where your engineer will pay for theirself.

2 - give them a giant novelty check once a year at a conference. It doesnt need to be $100,000 - just give _something_ back, and you may as well do it where engineers will see you do it.

Does your company have to be a software company to do these things? No. Just like you dont need to be a software company to need your own social media, your own website,... But those arent quite like. . .

Your Own App. Your own servers, or cloud presence. Your own in-house software. These things dont run in a vacuum. Even the proprietary software you run depends on open-source projects.

</comment><comment><USER3> Didn't Al Gore solely invent the internet? :)</comment>


Show HN: RealIdeas.site (submit an idea, get 10 real ones back) - <AUTHOR> https://realideas.site/ <comment><USER2> Ideas themselves should not be overrated. People often think the main part of building a successful product is having the right idea, and expect some form of compensation for submitting a good one. But as a matter of fact, if there is a problem to solve, many others have probably had similar ideas and the difference will be made in their implementations.

So the "compensation" of ideas with other ideas like here seems perfectly reasonable to me and should not be extended or gamified any further.

<comment><USER3> Yep, it is the execution of the idea where the money is. Most well known products are simple to explain / understand, but it was their implementation and ability to retain users on their platform that make them successful.

</comment></comment><comment><USER4> Reminds me of the slogan on the trucks of Sunset Scavenger Company, the predecessor to Recology: "Satisfaction guaranteed or double your garbage back".

</comment><comment><USER5> Very cool.

I tried many approaches (although I didn't finish any implementation besides the first one, the worst) on idea sharing and feedback. This is probably a little better than the best I've thought in all these years.

Oh, it looks like Wayback Machine has my first attempt at this thing stored: [http://web.archive.org/web/20130814135339/http://www.ideacra...](http://web.archive.org/web/20130814135339/http://www.ideacraft.us/)

<comment><AUTHOR> Thanks. Yours looks very nice. I've been thinking of allowing comments on the ideas themselves but I like your approach better (where the comments fall into different categories).

</comment></comment><comment><USER6> Ideas which are 'actionable pieces of intellectual leverage' are actually massively underrated, and unfortunately grouped alongside mere daydreams.

If you happen to have a collection of design/market/engineering insights that could actually inform a working solution, you'd be a fool to just dump them into the public domain as free 'ideas'.

Executing the creation of a factory to produce lightbulbs is comparatively valueless, compared to inventing the first lightbulb. It's not only easier, it's also less important to society.

New ideas are actually incredibly important, and they might even be getting harder to find [0]. As Thiel said in 'Zero to One' [1]: "Every great business is built around a secret that's hidden from the outside." Unless you have incredibly deep pockets or a monopoly, ideas are likely to be the only thing protecting you from your competition.

As an aside: the money isn't in execution, or in innovative ideas, but in the creation of economic moats [2].

[0] [http://www-leland.stanford.edu/~chadj/IdeaPF.pdf](http://www- leland.stanford.edu/~chadj/IdeaPF.pdf)

[1] [https://www.amazon.com/Zero-One-Notes-Startups- Future/dp/B00...](https://www.amazon.com/Zero-One-Notes-Startups- Future/dp/B00M284NY2)

[2] [https://news.morningstar.com/classroom2/course.asp?docId=144...](https://news.morningstar.com/classroom2/course.asp?docId=144046&page=5&CN=)

</comment><comment><USER7> Love this. I've been looking everywhere from reddit, twitter, hn to forums for inspiration for ideas (because I suck at coming up with my own).

I have more ideas about brick / mortar businesses (i.e. buy this thing off website X, rebrand and sell for Y% to make profit) than I do about SaaS business (which is my primary interest).

<comment><USER8> My advice for you is the usual "find a problem, scratch someone's itches and work on that ".

</comment></comment><comment><USER9> Just submitted an idea, which i think is pretty good idea, that i'm probably never going to implement myself, because i usually get lost in yak-shaving halfway (tried it three times). Let's see what ideas come out of this :)

</comment><comment><USER10> For me as an all round analytics manager in enterprise there are plenty of pain points. I am not sure I'd call them ideas, but it would be great to share those, also to see who else has them.

</comment><comment><USER11> If someone is interested in using your idea, can you get some credit or something?

<comment><AUTHOR> I need to add a terms of service. Something like: "All submitted ideas are free for all members of the site to use and act upon."

Does anyone have an example of such a TOS? One that basically says you relinquish all rights to the ideas you give on this website.

<comment><USER12> You don't have to, there are no rights to ideas in the first place.

</comment></comment></comment><comment><USER13> Neat idea! I think you should allow comments.

<comment><USER14> This was my thought as well. That the benefit of sharing the idea is to get feedback so the idea can be refined.

<comment><AUTHOR> I'll add comments later on. After that I'll develop a system where you get ideas regularly based on your engagement level on the site.

</comment></comment></comment><comment><USER15> This is great and positive and all things nice. How about making this more valuable by somehow connecting me with 10 people who know about this problem area or have tried or are interested in building a solution to this and more important : people who are facing this issue and are wanting to try out my solution to the problems that I am trying to solve ?

To be honest the only thing that will inspire me to build something is seeing 10 real people face real issues that I believe I can solve. Queue Management for example. Its 2016 (almost 2017) for heaven's sake and I still see people queuing up at cash registers, coffee shops and department stores alike. That's what I want to solve. How is 10 new ideas helping me ?

Edit: This unintentionally turned out more like a rant than constructive criticism. Its just that I have a feeble sense of what I want and this does not feel like it. Credit to the author for actually building it, putting it up here and having the courage to be open to feedback.

</comment><comment><USER16> If I submit 10 ideas, where are the 100 new ideas going to come from?

Why would someone swap one good idea for ten bad idea?

What do you plan to do with "all" the ideas?

___

Would you post answer to your own questions for your own site? Those being:

What's the problem?

What's the solution?

Why would anyone pay for that?

How would you reach your audience?

Are there other solutions out there?

How is your solution any different?

Will you reject bad ideas?

<comment><AUTHOR> "If I submit 10 ideas, where are the 100 new ideas going to come from?" Same place as the first 10, from other people's ideas. If you're an idea generating machine the DB will eventually run out of ideas to give you.

"Why would someone swap one good idea for ten bad idea?" This is answered in the FAQ. You get 4 from the top rated ones. Chances are if you haven't worked on your idea by now, you probably won't do it at all. Share your idea and you might get one or more that you will work on. Even if you don't get an idea you think it's "good" you might get inspiration from them or put a twist on these.

"What do you plan to do with "all" the ideas?" Same as everyone else who submits an idea: get inspiration.

"Would you post answer to your own questions for your own site?" I don't understand the purpose of your question.

<comment><USER16> The purpose of the question, "Would you post answers for your own site?" \- being I don't understand and/or would be interested in the answers to the questions before for RealIdeas.site:

What's the problem?

What's the solution?

Why would anyone pay for that?

How would you reach your audience?

Are there other solutions out there?

How is your solution any different?

<comment><AUTHOR> This is all covered in the FAQ. Problem: no vetting process on similar sites. Solution: have someone read the ideas. It's free, not meant to make money. I just posted it on HN. I don't see similar sites with a vetting process out there.

<comment><USER16> There are lots of sites that provide lists of vetted ideas, what am I missing?

<comment><USER17> I don't understand the negativity. This is a Show HN. And Show HNs don't have to be completely original things that have never before appeared on the Internet.

<comment><USER16> >> "Are there other solutions out there? How is your solution any different?

Negative? I am only reflecting the questions back at the post/site that they're asking themselves.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> anyone interested in this sort of thing should take a look at [https://nugget.one/](https://nugget.one/)

</comment><comment><USER5> Maybe you could put the source for this site on GitHub so interested people could submit buggy PRs with unwanted new features?

</comment><comment><USER19> Is there not a "low-tech" solution to this already?

Like an invite-only forum that extends invites to people who share an idea in the public thread? With increasingly more access as users continue to contribute ideas that receive positive feedback from their peers?

<comment><USER5> No.</comment></comment>


America: Welcome to Your Hungarian Internet  - <AUTHOR> https://www.commondreams.org/view/2011/09/17-0 <comment><USER2> One of the knock-on effects of our third-world telecommunications infrastructure is that it limits the level of innovation in small startups that might want to build systems that are bandwidth dependent. That sucks on toast.</comment>


Never Give Your Information To 10 Minute Old Startups - <AUTHOR> http://blog.ryankearney.com/2012/10/never-give-your-information-to-10-minute-old-startups/ <comment><USER3> Everyone here that is _thinking_ of giving this company the benefit of the doubt _needs_ to go read their (smeagle) responses to RKearney from the original thread. Here are some samples of the careless attitude behind this:

\----

"if anyone's concerned about your AWS key, just destroy your IAM user and create a new one. that's what it was designed for."

\----

In response to advice saying they should notify users by email:

"good idea. actually, we'll just wipe them and force new ones."

\----

In response to RKearney warning people about just what exactly is exposed:

"in case you have issues with your AWS keys. RKearny's email: email@example.com [https://secure.gravatar.com/avatar/f7d7b021fb488fe6a67ddb286...](https://secure.gravatar.com/avatar/f7d7b021fb488fe6a67ddb286..).

<comment><USER4> I was slightly sympathetic to them right up until smeagle posted RKearney's email. While not noticing an incredibly obvious security hole is serious, it's _somewhat_ understandable in the context of a site that unintentionally goes public before it's ready. What's far, far worse is the mindset in which someone who points out a security hole is the _problem_ , and should be personally attacked.

They should have thanked him, notified their users, done a thorough review of their own security, and warned new signups to _only_ use IAM keys. Instead they got defensive, made excuses, and attacked the messenger.

<comment><USER5> > it's somewhat understandable in the context of a site that unintentionally > goes public before it's ready

Sorry, but no. There is absolutely no good reason while creating an user controller - even when writing the very first lines - to not check against current user on sensible actions.

Actually, I may argue that's the very first thing you do once the controller skeleton is set up.

<comment><USER6> Agreed. You don't even need to add any gems or do any rails magic for this to work. In your controller:

        def edit
          @aws_credentials = current_user.aws_credentials
        end

        def update
          current_user.aws_credentials.update_attributes(
            params[:aws_credentials].slice(:a, :b, :c)
          )
        end

<comment><USER7> Don't forget `destroy`.

</comment></comment></comment></comment></comment><comment><USER8> Many folks in the security community might suggest a) An oblique warning publicly like "There exists a security problem with this; I have mailed the devs" b) actually mailing the devs c) waiting for confirmation of fix or a reasonable time and only then d) tar-and-feather. The term-of-art for this is "responsible disclosure."

This incentivizes people to fix things quickly and preserves the reputational value of breaking into things without researcher-vendor relations getting adversarial when you announce something like "I harvested a couple dozen of your customers' API keys" or "Here's an exploitation roadmap you can follow in your browser" in a public forum.

<comment><USER9> Sorry, but I think you're being far too kind.

A policy of so-called responsible disclosure is a reasonable approach to take when dealing with an established product/service that contains a minor vulnerability, something potentially dangerous but unlikely to be exploited in the immediate future with serious negative effects.

In this case, we appear to have a new project run by people who don't know what they're doing, with a glaring vulnerability that had presumably already compromised 80+ people's sensitive credentials and in turn who knows what other sensitive information. Bringing it down as fast as humanly possible and loudly so no-one else gets damaged in the meantime is entirely justified in a case like this.

<comment><USER3> Completely agree. Look at his responses to the security issue being brought up in the original thread [1]. This is someone who is clearly playing fast and loose with some frameworks, and people's information, and does not deserve to be given that consideration.

In his own responses, _he says that he won't email the users_! I can't imagine how upset I would be if this had my information. Access control for something like this is _dead simple_

[1]<http://news.ycombinator.com/item?id=4619424>

<comment><USER9> > In his own responses, _he says that he won't email the users_!

If they're based almost anywhere in the US or EU, they might well have a legal obligation to notify at this point.

(I am not your lawyer, etc.)

</comment></comment></comment></comment><comment><USER9> 10 minutes? Never give your information to a business that made a mistake like this, _ever_.

That wasn't merely a "security vulnerability". It was also a demonstration that the people running the business have _absolutely no idea_ what they are doing when it comes to security, privacy, or testing and release processes. (Actually, there is an alternative explanation, which is even worse: they knew and didn't care. I prefer to assume naivety rather than malice.)

Unfortunately, the only sensible action when faced with a business like this is to run away and not look back for a very long time, except perhaps to check who the people responsible were so you can avoid anything else they work on in the near future as well.

<comment><USER10> "Never give your information to a business that made a mistake like this, ever."

Fwiw back in 1996 or 97 the UPS website did the same thing. By altering the tracking number you could see somewhat complete information on someone else's shipment. Since the tracking numbers ran in sequence from the shippers log books giving one tracking number from a competitor you could see all their customers. (To get that all you had to do was place a single order so they shipped to you. Although I guess it wouldn't have been even easier to social engineer someone to simply give you any tracking number and save that step.)

<comment><USER11> Totally not the same thing. Not even close. Knowing a tracking number is nothing compared to having access to someone's AWS account. That's like saying knowing where someone's car is parked is the same as having their keys and a full tank of gas.

I agree with silhouette. These guys scaffolded a rails project and and then slapped bootstrap on it. You can't trust an MVP this extreme.

<comment><USER12> This is exactly the same thing - an obvious security oversight that resulted in private information being disclosed, simply by modifying the URL.

The fact that the results are so different is irrelevant - the attack vector was essentially the same.

Also, even with the complete lack of security on this site, it should still not be possible to take any action on the victim's AWS account. IAM has read- only roles for this exact reason - hopefully no-one was negligent enough to post their master AWS key/secret in to this or any other third-party site.

<comment><USER13> The results absolutely do matter. If you're running a site, you should be auditing the areas where the security risk is the greatest and taking extra precautions, and those areas are hopefully few. If you're not first taking care of the places where the results are disastrous, then you're doing it wrong.

Obviously if there is a known attack vector, you would fix any similar issues everywhere, but not all code is the same.

<comment><USER12> The point I was making is that this particular flaw is indeed the same as the UPS flaw when considered at a high level - modifying a URL caused sensitive data to be disclosed.

In practical terms, of course the nature of data that is disclosed is relevant. AWS keys are incredibly valuable, and should be treated as such.

</comment></comment></comment></comment></comment></comment><comment><USER14> Those who know me will laugh to see me continuing to beat this dead horse, but this is a really great example of why ORM+scaffolding is an anti-pattern, by which I mean it seems like a good idea at first, but the costs outweigh the benefits.

It's absolutely true that you can use ORM and scaffolding patterns in a totally secure way. But the problem is that the defaults are insecure -- every table can be accessed, every record is available, every field can be edited, and the URLs for doing so are (deliberately) easily guessable.

One of the simplest and most fundamental rules of effective security is to close everything down by default and only open things up as required, after careful consideration. Scaffolding breaks that rule.

<comment><USER15> I think it has less to do with ORM and more to do with laziness. Its really one line in the controller, if loggedin user is not the user trying to edit redirect.

<comment><USER16> It's not just laziness. 99% of all framework tutorials I've seen out there completely ignores even basic authentication/authorization issues, which are universal to all real websites. This lack of attention to details is cultivated.

<comment><USER17> I guess they are using Rails. If they had only taken a few hours to go through a free tutorial like the one at railstutorial.org , they could have avoided this blunder.

</comment></comment></comment></comment><comment><USER18> At first, I thought I was supposed to notice the complete lack of "HTTPS" in the URL bar.

The data leakage obviously overshadows it, but I can't think of a site that wouldn't be a better "fit" for SSL encryption than an app like this, aside from banking/government sites.

SSL might have been a "nice-to-have" back in the day when there were real arguments to be made against it (mostly performance-related), but even those don't really apply to a "pet project" made by "two nerds" (smeagol's words, not mine.) And for an app like this, I think it's critical.

Just my two cents.

</comment><comment><USER19> I took a look at the team. Is it considered apropos to state how surprised you are that developers who come across as relatively senior are capable of making an incredibly fundamental security mistake such as this?

It looks like this was just the default Rails resource scaffolding.

<comment><USER20> > Is it considered apropos to state how surprised you are that developers who > come across as relatively senior are capable of making an incredibly > fundamental security mistake such as this?

Only if you're concerned that you can't tell who is "relatively senior." In this case, your judgement was unfortunately wrong.

<comment><USER19> 'Relatively senior' here means 'ostensibly trusted with important tasks in the past'. Both of the creators of this application (I won't say 'founders of this startup' because that's silly) are ex-WePay.

<comment><USER20> I had to look up WePay on Google. The wikipedia page says they have 30 employees as of a year ago, did YC and 1 round of funding.

I have to be honest - that doesn't demonstrate a high level of trust at all these days. It's sad, but true. Plus, if you say they're "ex-WePay," I assume they were just everyday developers for WePay, not critical resources.

<comment><USER21> One would hope that even average developers for a payments company would have a better understanding of security than to make mistakes like this...

<comment><USER20> Except you're talking about a payments _startup_. In startups, engineering talent isn't very important.

</comment></comment></comment></comment></comment></comment><comment><USER22> I'm curious, did you let them know that this vulnerability exists before you wrote an article and posted it to HN?

If you let them know and they ignored you, then I understand that you'd want to write an article and spread it around. It's important that customers know when a company doesn't value their security. At that point, the proper way for them to handle it is to quietly fix it, and then let all their affected customers know so they have a chance to change their security settings.

However, if you didn't give them a bit of time first, then you are doing more damage than good to them--and their customers.

<comment><AUTHOR> They already knew and it was fixed before I posted this.

<comment><USER22> And did you let them know privately before you posted this comment? <http://news.ycombinator.com/item?id=4619411>

<comment><AUTHOR> Details of the vulnerability were not posted until it was patched, which was no more than 60 seconds after that initial post.

<comment><USER3> Given the severity of the hole, I am thankful that you posted what you did

</comment></comment></comment></comment></comment><comment><USER23> Holy shit! I consider myself a mediocre programmer _at best_ and even I wouldn't make such a dumb mistake. This is literally something only a amateur would do. I'm just awe struck that this would even happen. How?

<comment><USER24> it's something someone would do who's never worked with authentication and authorization before and doesn't have the fallback of a professional tester (aka breaker).

As people have mentioned, rails doesn't have it built in. I've used gems to provide it since I don't trust myself to write good enough security algorithms (and really, why reinvent the wheel if I don't have to).

In .net we can use the asp.net membership. But you've always got to have that authorization part, which I think can get forgotten about unless you've got a system under you belt or something/someone to crib from.

Sometimes you just don't think, and sometimes it becomes very public.

<comment><USER23> In .NET you can protect controller action methods using `[Authorize]` data attribute above each method.

You can even create your own custom filters.

<http://www.youtube.com/watch?v=BsxUsyMSGeA>

Just letting you know. :)

<comment><USER24> indeed, aren't specifics, wonderful.

However, I do think that authentication is where people may believe they can stop, forgetting or maybe not understanding, that authentication really doesn't do much, without an authorization system.

</comment></comment></comment></comment><comment><USER25> I'd love to see some concrete suggestions on the right way to do security for a site like this. This would take far more than protecting a few web pages from unauthorized access. What else should they do? How should they store sensitive data like AWS keys? Should they include a feature to force the creation of a new temporary key to prevent users from naively storing their master key? Is there a better mechanism than storing the key?

<comment><USER26> One appropriate way to do this is to not build this type of application as a web service, but instead as a standalone application. (Disclaimer: I haven't really tried this product, for obvious reasons.)

</comment></comment><comment><USER27> I'm puzzled. For the kind of service they want to offer, to have such newbie security vulnerabilities makes you wonder if it even works. It's the kind of flaw that any moderately experienced developer never leaves opened.

</comment><comment><USER28> Security stuff aside, I'm curious why a system would be designed this way. Surely (in most systems) all users have the same page for managing their account (eg: /account) or is this system designed so that the management portion (eg: what a support person would use) is the same as what the users use? I don't think I've encountered a site that had accounts edited this way before.

<comment><USER29> The last time I used Rails (2009), the way RESTful URLs are set up encouraged this pattern. It's simple enough to restrict access to the user in question, but it is (or was) easy to overlook.

<comment><USER30> i agree - i cant think of a reason why the user id would ever be in the account url

<comment> grey-area It's relatively common practice to have an url like this: /yourusername or /users/yourname or /users/32, which shows a public profile, and therefore to have a guessable url for it, and to have a link to edit your account on that page if you are that user.

That in itself is not a security problem, but having no access control obviously is.

</comment></comment></comment></comment><comment><USER31> To be fair, the guy who owns that site did mention that it wasn't meant to be picked up by HN and was still in the early stages of development.

<comment><USER32> If it's accessible on the public internet and asks for something as secure as API keys, _that_ is when you should worry about security, not when it's "meant to be picked up by HN".

<comment><USER31> Fair, but in any case, the ultimate responsibility still lies with the user's judgment.

Maybe if there was a service promised but not rendered, could you place full blame on the developer(s).

<comment><USER33> What exactly does "ultimate responsibility" even mean here?

</comment></comment></comment></comment><comment><USER34> Wow. That's taking the idea of an MVP a little too far. Just goes to show worth doing a little research before handing over any real information to a new service like this.

</comment><comment><USER35> I would recommend using CanCan for security if they haven't done so already so you can't just type in other users user_id in the url to view or edit. <https://github.com/ryanb/cancan>

Cancan is great way to make sure that you can only read or edit your own records in the database with Rails.

<comment><USER36> Cancan probably wouldn't have prevented this. It's not because someone didn't use some library. The developer probably just did a User.find(params[:id]) instead of doing something like current_user from whatever authentication system they were using. He probably used the scaffolding generator to make everything and forgot to go back and ensure things are secure.

It's also interesting that the aws key/secret are "masked" on the page, but you can just visit <http://www.iceboxpro.com/users/12.json> and get the formatted json representation with no masking.

</comment></comment><comment><USER37> I really don't think it has anything to do with the startup being 10 minutes old. That's security 101 we're talking about ...

</comment><comment><USER6> The optimistic and humble side of me wants to believe that this is a rare occurrence.

The truth is that I don't remember working on a single codebase that didn't have some eventually discovered vulnerability in auth(entication|orization). When I eventually do comb through controllers and find easily exploited access-control violations, I've often been met with responses similar to the behaviour of the developers at Icebox.

Rails does and will continue to protect you from a lot of mistakes, but nothing is going to help long term unless you know what words like authentication, access control and session management mean.

If you're a professional web developer and you _care about your users_ then please buy and have a read through _The Web Application Hackers Handbook_ [1]. Every page is dripping with easily exploitable attacks _you didn't think of_. That last app you built is almost definitely vulnerable to a handful of them.

[1] [http://www.amazon.com/gp/product/1118026470?ie=UTF8&tag=...](http://www.amazon.com/gp/product/1118026470?ie=UTF8&tag=portswinet-20&linkCode=as2&camp=1789&creative=9325&creativeASIN=1118026470)

</comment><comment><USER38> Another hole that has been exploited in the past (speaking generally here, not about this specific startup) is a password reset function that confirms the email address it is sending the password/recovery link to. If the accounts are sequentially numbered, it's a trivial exercise to fetch a reset link for each member, and scrape the email address returned.

</comment><comment><USER39> Major data leaks / security issues like this are not confined to sites that are 10 minutes old. Yesterday I discovered a recently funded startup is exposing all personal user data and activity to the world via their public, unprotected APIs. I'm hoping they fix it quickly before someone interested in harvesting that data finds it.

</comment><comment><USER40> if anyone else is having problems viewing this: it's a serious hole in icebox, the service featured here <http://news.ycombinator.com/item?id=4619132>

if you've used that service, the information you entered was publicly visible (key to access aws, etc) (the thread linked above says it has now been patched).

[i don't understand why, but when i access the link for this thread i get the gzipped page as a download; linux + chrome 22; firefox displays what appears to be gzipped data; wget saves the gzipped data as index.html; same behaviour for chrome on opensuse and ubuntu; windows 7 + ie9 (in a vm) shows the gzipped data in notebook; is no-one else seeing this?!]

[update: fixed now - it looks like it wasn't changing the content type]

<comment><AUTHOR> What OS/Browser are you using?

<comment><USER41> I'm getting the same. Chrome 22/Mac.

</comment></comment></comment><comment><USER42> I would rather say 'Never give your information to a startup that does not handle it responsibly'. Not every startup is irresponsible with data.

In this case you have a strong point. Good work finding the security issue and reporting it.

</comment><comment><USER43> That's why I'm not a user of App.net. They only accept credit card.

<comment><USER44> What does that have to do with _anything_?

<comment><USER43> With the title of TFA.

<comment><USER45> Fortunately, you don't give App.net your credit card information directly. It's handled by Stripe, and they're past being "10 minutes old". (Even though this isn't easily verifiable in the checkout flow to a non-developer.)

<comment><USER43> They want my credit card info on the app.net page. With Paypal I'm on the Paypal page. (Or Google checkout, or whatever.)

</comment></comment></comment></comment></comment><comment><USER46> Was wondering how it was "compromised", thanks for posting this.

</comment><comment><USER47> Am I the only one getting a download.gz file?

<comment><AUTHOR> What OS/Browser are you using? I turned on aggressive caching with CloudFlare to speed up page loads but it appears that it's only serving the gzipped version.

</comment></comment><comment><USER48> I'm sure there is a middle ground here. Security is not necessarily a function of age.

</comment><comment><USER49> Its got nothing to do with the age of the startup, and everything to do with the quality of the engineering. You see problems like this and worse in companies that have been around for years.

It would have been more responsible to privately notify the owner of the site rather than karma whoring a blog post to top of HN.

</comment><comment><USER50> This is an example of the overuse of the term MVC...

</comment><comment><USER51> I'm not surprised about this. Caveat emptor.

</comment><comment><USER52> Mirror? I can't read download.gz files.

<comment><AUTHOR> Sorry, try again. Misconfiguration on the server was sending out gzipped content without proper headers.

</comment></comment><comment><USER53> Ugh. Seriously?

How did you not notice that?

</comment><comment><USER54> Mannnnnnn, this exploit is SO 4 hours ago... ;D

<comment><USER54> This comment was completely tongue in cheek; in all seriousness it was great to see them fix this so quickly.

Tell me that blog post didn't read like a security exploit announcement...

Anyways, as discussed, it never should've happened in the first place, but it sounds like from the comment threads that it was likely Framework related, so.... yeah, still prettty bad.

</comment></comment><comment><USER20> It might be time for pg and co. to reconsider the idea that engineering doesn't matter and that startups are just about people. This is _pathetic_.

<comment><USER55> Honestly, this isn't even a matter of engineering.

I don't know the rails solution, but a quick-and-dirty solution in other frameworks is to use a decorator on your controller/views that does something like:

      if request.session.userId == action.userId:
        pass
      else:
        return SecurityExceptionResult

The example above is like 10 mins to code and put under test once you fill it in with the necessary stuff- You're probably going to want to log would-be security issues and gracefully handle the error.

With that said, user-identity does not belong in a URL. If you just did /user/edit (we assume all operations are performed on the logged in user) and then moved your security validation down a level to verify that session.userId == model.record.userId you'd be much better off.

<comment><USER20> What do you call the role of the individual whose job it is to implement account management? Do you not call that person an engineer? If not - <USER2> responsibility would you say it is to ensure shit like this doesn't happen?

<comment><USER55> Good point, but I read "engineering doesn't matter" to mean you shouldn't spend a _significant_ amount of time carefully designing a system that's likely to change. pg is absolutely correct in that sense.

My point was the amount of time required to prevent security holes like the ones outlined in the link are minimal - preventing them isn't going to stand in the way of an engineer implementing other features.

</comment></comment></comment></comment><comment><USER56> I'm shocked at the security flaws in this system. It's so easy to prevent..

</comment><comment><USER57> Ah I'm reminded of the Blippy credit card leak [http://venturebeat.com/2010/04/23/blippy-credit-card- citiban...](http://venturebeat.com/2010/04/23/blippy-credit-card-citibank/)

What strange times we live in.

</comment><comment><USER58> Ryan, your post is NOT an example of responsible disclosure. You could have written your post and posted it AFTER alerting the Ice Box Pro guys and waiting until they had the main issues fixed. Your post would still be a good post. In fact, you seem to weigh the importance of your post getting on HackerNews above the security of the people who tried Ice Box Pro. The creators of Ice Box Pro had good intentions and messed up security (as almost any startup does to some extend). You are either ignorant to what security actually means or unethical, which at best is as bad as what the creators of Ice Box Pro did and maybe worse. Will you take responsibility if any of the users that tried Ice Box Pro get hacked as a consequence of your post?

<comment><USER58> Ah, I see you did let them know and the vulnerability was fixed before you posted. Good. I recommend saying such a thing in your post because it helps people like me understand that you are in fact responsible about the disclosure.

<comment><USER20> According to timestamps, it took ~5 minutes for you to realize your mistake. It may be worth waiting those five minutes before posting, in the future.</comment></comment></comment>


Submitted my Twelephone HTML5 WebRTC project to AWS Startup Challenge - <AUTHOR> http://youtu.be/x3GdIqfGT7Q

<comment><USER2> nice idea. how is this sustained?

<comment><AUTHOR> We are planning to offer business communication features in the future.</comment></comment>


DeepPCB: Pure AI-Powered, Cloud-Native Printed Circuit Board Routing - <AUTHOR> https://deeppcb.ai/ <comment><USER2> I exhausted the 3 project limit trying to see how it would route open source mechanical keyboard PCBs.

Every single one failed with an error.

The first one failed with an error that didn't specify the reason, the second one because it had more than 200 wires, though I wonder how that's possible on a 3x3 macropad PCB, and the final one failed with "Sorry, we do not support non 45° rotation for this beta version".

The errored projects count towards the limit of 3 projects you can create.

Doesn't seem to be working all too well.

<comment><USER3> Hi gorbachev we've just refreshed your free credits to 4 per week and won't include errored projects in this count. If you need more pls let us know at email@example.com You can also find more information in our longer answer posted as a separate comment. Thanks! -KB & the DeepPCB team

<comment><USER2> Thanks, I'll take another look this weekend.

</comment></comment></comment><comment><USER4> Don't mean to undermine the effort but " what is the problem being solved here"? I have used Altiums auto router and it's like Tesla AP version 1. Also like someone mentioned below, the hardest part of PCB routing is Placement. There are Tons of variables that goes into consideration for getting placement correct. Routing follows placement and routing can't fix placement problems. If cost of routing is what the OP is after then they are mistaken as you could get a 12 layer PCB routed with analog, mixed and high speed DDR and RF within a week by an army of PCB designers in Taiwan and PRC.checkout Palpilot if you need references.

<comment><USER5> > within a week by an army of PCB designers in Taiwan and PRC.

You could also (ab)use electrical engineering students, might take a bit longer though.

But routing has indeed become very cheap. I still could see this service as useful, especially for the amateur prototype market. There are a lot of software devs that immediately die if they come in contact with electricity in any form.

But they might still need some hardware. And maybe they could offer some templates where you can just add the chips you need right now.

<comment><USER6> > You could also (ab)use electrical engineering students, might take a bit > longer though.

It would take longer to train them, PCB design isn't taught in much depth to undergrads at least in the US.

</comment></comment></comment><comment><USER7> That's human powered for sure. Routing isn't the hardest problem, everything is quick once all the components are placed where they belong. E.g. TopoR already does quite a good job at the routing part.

But if you only take a schematic, and the design is sufficiently complex, it's already difficult if you hand it to another engineer who's not too familiar with what is being done, let alone a machine learning model.

<comment><USER8> It also states " _We harness the power of advanced AI and deliver results in less than 24 hours..._ ", which is a red flag...

<comment><USER9> Agreed, Altium's autorouter takes, what, 10 seconds?

24 hours? That's an East Asian subcontractor.

</comment></comment></comment><comment><USER10> I guess I don't spend enough time laying out tedious-but-straightforwards PCBs to appreciate this. Almost everything I do has some important layout considerations like "this loop inductance should be tiny" or "this section needs guard rings" etc. Also, placing components is non-trivial, if you're doing anything dense, fast, or sensitive. I find that's like 90% of layout work: guess where the components should go, try to route the tricky bits, move the components around a bit, route again, etc...

<comment><USER11> This is the part that all the autorouters seem to miss. A board design may be represented in the computer by a schematic, but in reality it's a schematic + a huge amount of engineer knowledge. The person laying out the PCB needs to be able to look at the schematic and know that the switching regulator has very precise layout requirements, but that status LED can be at the end of a long trace.

That information simply isn't captured in current schematic software. Until it is I can't see autorouters being effective.

I can see a world where every schematic includes simulation models, and the autorouter uses simulation data to know exactly what frequencies are moving down each net and in each location. That requires detailed spice models of every component on your circuit though - so it probably wouldn't save the designer any time anyway as they're just doing different work. I'm not even sure how you'd simulate the signals coming out of a microcontroller - how does the autorouter know that one PWM IO is producing a 500kHz clock into a high current switch and the other PWM IO is producing a fixed 3.3V?

So then maybe you need to incorporate not only simulation models, but your actual CPU code. Which then means you need high quality microcontroller and FPGA emulators. There's a new problem!

There's probably a middle ground - a designer could annotate each net with a waveform which would be fed into the spice simulation - but even then we're talking significantly more work than just laying it out yourself.

<comment><USER12> What you have outlined is a combination of feedback directed optimization, sensitivity analysis, iteration to a fixed point, cosimulation and configuration spaces.

[https://en.wikipedia.org/wiki/Profile- guided_optimization](https://en.wikipedia.org/wiki/Profile- guided_optimization)

[https://en.wikipedia.org/wiki/Sensitivity_analysis](https://en.wikipedia.org/wiki/Sensitivity_analysis)

[https://en.wikipedia.org/wiki/Fixed- point_iteration](https://en.wikipedia.org/wiki/Fixed-point_iteration)

[https://en.wikipedia.org/wiki/Co- simulation](https://en.wikipedia.org/wiki/Co-simulation)

[https://en.wikipedia.org/wiki/Configuration_space_(physics)](https://en.wikipedia.org/wiki/Configuration_space_\(physics\))

</comment></comment></comment><comment><USER13> It looks like a mistake to target KiCad. Pros generally use Altium.

2 layers is super limiting!

24 hour turnaround is actually quite slow... I would bet they have a human in the loop.

<comment><USER14> Just want to counter this sentiment and say I love the fact they are targeting KiCad. A good way to incentivize the free, open source tool. Most hobbyists don't need more than 2 layers, and that seems like something that can be eventually expanded in the future.

24 hours, however, is a little bit long.

It would be nice to see exactly what they are offering before uploading a file, right on the front page. Some components absolutely need to be in a fixed position, some can be moved around... Some have RF requirements... Does it minimize size? Does it brute-force the traces?

<comment><USER15> From what I can tell, you need to position all the components and then it routes between them...

<comment><USER14> That's a shame... There is a bit of fun figuring out routing, but, I don't think that is an opinion that applies to most.

<comment><USER16> It's not about whether or not there are people that enjoy it; it's the fact that the market they are serving doesn't exist (people that don't enjoy or don't want to route themselves but have already placed the components correctly).

</comment></comment></comment></comment></comment><comment><USER17> Not terribly positive comments here, but I think people are missing the point. This is an unsolved problem, or at least a problem not solved well. Any efforts in this space should be encouraged. I'm not sure we can trust the main vendors to innovate, and starting off with Kicad makes 100% sense to me at this stage.

If this is the first rung of the ladder and it's all up from here, good luck - I'm sure we all hope you nail it.

A good comment here about placement - I hope that this approach can grow to adjust placement to some degree, even if not complete placement control.

<comment><USER18> > This is an unsolved problem...

Yes, this is the point. It's NP-Hard. If you solve this problem, you can make far, far more money doing something besides routing mechanical keyboards and Internet of Things sensor cruft.

Autorouters have been in development for the last fifty years, starting with wire-wrap machines at Digital, and going on to the work of very, very smart people at Altium and Autodesk. The smartest people in their field have been working on autorouters for decades, and this company wants to solve it with 'the cloud' and 'AI'. Sure, buddy.

150 pairs and 2 layers is abysmally limited for anything but the lowliest hobbyist (read: poorly designed) boards, and there are no examples whatsoever of what this product produces. Like, really, great job for producing a demo to show to investors but you might also want to _demonstrate_ your demo.

Oh, and if you're using machine learning on PCB design, that means you need to train your models somehow. That means your training data is absolute crap, because most designs for Open Source hardware are objectively crap. You would be better off paying someone in China $40 to lay out your board, which would also have a 24-hour turnaround. Which brings me to my next point...

<comment><USER19> I just don't understand how deep learning is amenable to this problem. It's just a straight up optimization problem. How is deep learning appropriate?

<comment><USER20> I think it is probably appropriate. Chess and go are just "straight up optimization problems", but they're too difficult for traditional optimisation algorithms to work. You need something to do some fast pattern recognition to cut down on the search space. This is similar.

I expect if you search the literature you'll find a ton of work on this.

</comment></comment></comment></comment><comment><USER21> It is interesting that on the front page, they show a SMT pick and place machine. It only has a small tangible connection to auto routing. It would have been much better if there is a short video showing the routing in action.

</comment><comment><USER22> Layouters hate auto routers.

</comment><comment><USER3> Hi everyone, Karim the Co-founder & CEO of InstaDeep here, first thank you for the interest and comments we did not expect we would appear in HN so quickly :) We've reviewed carefully the different points made, comments below:

"This is an unsolved problem… Yes, this is the point. It's NP-Hard": "We harness the power of advanced AI and deliver results in less than 24 hours...", which is a red flag" InstaDeep has built credibility in AI circles by innovating in Machine Learning and Reinforcement Learning (RL) specifically on how to find good solutions to NP-Hard problems with AI. For example, you can check our R2 paper ([https://arxiv.org/abs/1807.01672](https://arxiv.org/abs/1807.01672)) about AI for combinatorial optimization which was accepted at the NeurIPS 2018 in the Deep RL workshop. More recently we've just published joint AI-research in RL with Google DeepMind that earned a top 2% global ranking at NeurIPS 2019 ([https://arxiv.org/abs/1905.12941](https://arxiv.org/abs/1905.12941)). We also have specific domain expertise in Hardware: some of our team members have worked for more than 15 years in this field in companies such as STM, NXP, Dialog, etc. We believe it's an exciting time to be working on PCB Routing, an NP-Hard problem.

" I would bet they have a human in the loop": No our system is fully automated (which is why it's a first) so bear with us as we are in beta :) Automation is possible because we use RL, which is very useful for decision-making problems like PCB Routing. At InstaDeep, we deploy RL systems in the real world and work closely with hardware partners such as Nvidia (we've recently been upgraded to preferred partner) and Intel (we're part of the AI Builder Program). In our opinion, having no-human in the loop is critical to accelerate PCB development cycles, and that's a key feature of DeepPCB.

"Shitty auto routers have existed for 25 years, at least.": that's the whole point, autorouters don't get the job done properly, which is why many boards are still done manually. It makes sense that AI could improve things here.

"the hardest part of PCB routing is Placement": totally agree here, and our goal once DeepPCB routing is out of beta, is to tackle placement. Routing is an important first step, but we don't plan to stop there. In our livestream ([https://www.youtube.com/watch?v=Ea5i-l8YKQo](https://www.youtube.com/watch?v=Ea5i-l8YKQo)) a few days ago we clearly mentioned that Placement is our key goal for next year.

"I exhausted the 3 project limit trying to see how it would route": we hear you and have decided to increase the limit to 4 credits per week. We've also regenerated the credits for everyone already registered! We will periodically review credits based on demand to accommodate as many users as possible. If you would like more credits please contact us!

On a final note, keep in mind we're in early beta and our goal is to hear from you to iterate and improve the product better. Things might break from time to time and we'll certainly make mistakes but what matters to us is to keep working hard and make progress on this exciting problem. We believe it's the combination of Hardware domain expertise and advanced AI know-how that yields strong results. If you agree, don't hesitate to reach out at email@example.com we'd love to hear from you!

</comment><comment><USER23> It will be interesting to see how this handles signal and power integrity. What design rules is it actually following? If it's just tossing down routes, AI is not needed for that. Shitty auto routers have existed for 25 years, at least.

<comment><USER24> I was reading comments here musing that it must be 30 years since I last routed PCBs on a daily basis: auto routers were useless back then and it looks like not much has changed. Not too surprising when you consider how hard a problem it is. Anyone else have the experience of waking up in the middle of the night with the solution for how to get "that last trace" through?</comment></comment>


Railsbox.io – Ruby on Rails virtual machines with vagrant and ansible - <AUTHOR> https://railsbox.io/

<comment><USER2> Nice idea, however I do not like that it is locked to use Ubuntu as the OS, it would make more sense to me to use Debian w/ Backports enabled, that way it could run on Ubuntu if someone _wanted_ to, but you wouldn't be stuck with Ubuntu's often 'less that perfect' upstream testing and packaging teams.

</comment><comment><USER3> Very cool! (Ansible author here, well done!).

For an earlier PHP equivalent, see [http://phansible.com/](http://phansible.com/)</comment>


Inside Hillary Clinton's Outrage Machine, Allies Push the Buttons - <AUTHOR> http://www.nytimes.com/2016/09/23/us/politics/hillary-clinton-media-david-brock.html?_r=0 <comment><USER2> How are these guys any different from the Putinbots ([https://news.ycombinator.com/item?id=9269760](https://news.ycombinator.com/item?id=9269760))?

<comment><USER3> Astroturfing is a very wide category, so the differences are in the details.

The article you linked to concerns sockpuppets which support Russia's goals.

There is no mention of Shareblue's use of sockpuppets. Shareblue does not hide its affiliation. It appears to be more of a talking points network, and to support a political party's goals.</comment></comment>