World of Warcraft: one simple line of code can cost you dearly (2016) - <AUTHOR> https://www.gdatasoftware.com/blog/2016/07/28809-world-of-warcraft-one-simple-line-of-code-can-cost-you-dearly <comment><USER2> It's funny that if you open developer tools in facebook.com, you get a nice message about not to copy things into the developer console.

Stop! t78-eatOBZQ.js:172 This is a browser feature intended for developers. If someone told you to copy-paste something here to enable a Facebook feature or "hack" someone's account, it is a scam and will give them access to your Facebook account. t78-eatOBZQ.js:172 See [https://www.facebook.com/selfxss](https://www.facebook.com/selfxss) for more information.

<comment><USER3> You get this when trying to paste on any page in firefox console view:

Scam Warning: Take care when pasting things you don't understand. This could allow attackers to steal your identity or take control of your computer. Please type 'allow pasting' below (no need to press enter) to allow pasting.

<comment><USER4> I actually don't get that.

<comment><USER5> Dumb question, but have you ever pasted in the past? Once you do it once and turn on pasting, you won't get the warning again.

about:config --> devtools.selfxss.count needs to be 0 when Firefox boots up to get the warning.

<comment><USER6> "pasted in the past" I had to reread that a couple of times

<comment><USER7> Please try to make a more substantive contribution next time. Comments like this don't contribute to the conversation and have quite a distracting effect.

HN has its issues but the least we can do is to take care that the quality of discourse doesn't turn into another Reddit.

<comment><USER8> Your general concern is commendable, but some content-lite comments are worse than others, and sometimes just making nice is more important than calling it out when a comment is largely benign.

<comment><USER7> Fair! I actually deleted it first before going back and deciding to post it.

I've started to see more "content-lite" comments recently (along with puns), so I figured it might be good to over-index on pointing out community values.

Hopefully OP was able to see that it wasn't personal and that I meant no harm.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Reminds me the old days of mIRC (popular IRC client back then) where you could (and still probably can) run similar scenario using mSL language ([https://en.wikipedia.org/wiki/MIRC_scripting_language](https://en.wikipedia.org/wiki/MIRC_scripting_language)) directly from the chat input.

A script could literally takes control of the computer because mIRC is able to load native code by loading arbitrary DLLs

<comment><USER10> Back in the 90s mIRC would download files to the root directory of mIRC itself -- long before the concept of separating user data and code became the norm on Windows -- and if people had "auto accept file transfers" enabled people could send you a viral "script.ini" (as I recall it was called) to you and immediately overwrite your customisations. The end result would spread rapidly as the infected users would share it with others who join and left the channels they were in.

<comment><USER11> mIRC by default would not auto-accept .INI files, there was a blacklist on certain file types that would be rejected, with INIs as one of them.

<comment><USER12> > mIRC by default would not auto-accept .INI files, there was a blacklist on > certain file types that would be rejected, with INIs as one of them.

Was that a reaction to the problem described in the GP? Especially in the 80s/90s, defensiveness like that was probably to solve an existing problem.

<comment><USER13> Exactly that, it was known as the 'script.ini' problem, the download directory was changed as well.

It would attempt to send to people as they joined a channel.

More info: [http://www.irchelp.org/security/si.html](http://www.irchelp.org/security/si.html)

<comment><USER14> there was the funny magic string that would make half a channels modems disconnect too.

<comment><USER10> Ah, yes, I remember that. I think it was because the modems didn't differentiate between the various layers in the transport stream and took anything resembling low-level modem commands to be gospel.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Out of curiosity, why is it ever a good idea to add a command to execute arbitrary strings in the same space as the user? eval() has been the same source of headaches in javascript over the years.

I believe WoW uses it primarily to let the player make macros, which is a legit use, but using something like RunScript to do it seems lazy.

<comment><USER16> eval is by far the easiest way to run arbitrary code, but you can write eval yourself in any fully-general programming language. It doesn't actually give attackers any additional power.

This isn't the eval attack where you accidentally pass attacker-controlled inputs into eval because of an escaping problem or something, the sole purpose of /run is to allow users to run arbitrary Lua in the UI

</comment></comment><comment><USER17> It would have been funny to simply pretend that you had entered the line, just to see the social engineer send you LUA code in plaintext.

<comment><USER18> And immediately after tell him there's a syntax error, and how to fix it

</comment></comment><comment><USER19> Discussion back when this was posted in 2016: [https://news.ycombinator.com/item?id=12158299](https://news.ycombinator.com/item?id=12158299)

</comment><comment><USER20> playing World of Warcraft can cost you dearly

<comment><USER19> Nowadays (EDIT: anecdotally, sourced from myself, friends, and forums/Reddit), there's been a player exodus in WoW, as the latest expansion (Battle for Azeroth) has an _unrewarding_ and _mandantory_ grindy endgame, in addition to other player-unfriendly changes which the playerbase suspects is to pad out time-played metrics.

<comment><USER21> Even if that's true, the game has had incredible longevity. That expansion came out 14 years(!) after the original release of the game. I'm sure the player base isn't what it used to be, but that has to be some kind of record.

<comment><USER22> > the game has had incredible longevity

I'm not a WOW player (or really any MMO), but it's always impressed me how willing Blizzard is to throw out all the investment people have made in learning the game system details. Talent trees (or whatever they are called) are rewritten practically each expansion to follow very different rules.

I suppose it has to do with knowing that NOT changing is a guaranteed loss over time, but still, it feels like an unusual attitude.

<comment><USER23> It's a trend-setting attitude. Relearning skill builds is easy and relatively fun because you already have the skill points/levels and all you do is just allocate them again( provided the new ones are balanced and fun). What blizzard is doing is basically reseting the entire progress of every player in the game every expansion. You might spend 2 years building up your end-game gear and then an expansion comes and the common drops from one level higher are more powerful than the highest drops from the previous one.

</comment></comment></comment></comment></comment><comment><USER24> Does the luascript interface have a vulnerability for actual remote code execution? Can someone launch calc.exe with the HUD API?

<comment><USER15> While this attack does not discuss that particular detail, there have been many documented methods for breaking out of the sandbox (you can google around to see citations). I think for most attackers getting access to the user's WoW API is the goal.

</comment></comment><comment><USER25> As a player of a different game, Elder Scrolls Online, is there any similar danger? The add-on system I believe is also Lua.

<comment><USER26> The difference is Elder Scrolls Online doesn't have a command to run a script inline from the chat window.

So you are pretty safe unless you specifically install a compromised add on. It is definitely possible for add ons to mail stuff from your account automatically, including gold because some add ons have a "tip" feature built in, and some operate by using the mail to help you transfer stuff to a mule character. So a compromised add on could just set it up so every time you log in it automatically mails 1000 gold to another account.

But at least you would have to install the plugin explicitly instead of just compromising yourself via the chat window.

<comment><USER27> You can actually run LUA scripts from chat, exactly the same way:

``` /script d("Hello") ```

But the PC/Mac ESO community tends to be older (rated M) and less gullible in chat. Gold-sellers got a cold reception and rapid bans.

I suspect that'd work on console players, who tend to be younger, if they had scripting and addons, which they do not.

</comment></comment></comment><comment><USER28> tl;dr: if you run untrusted code from malicious actors, bad things will happen.

Nothing new here.

<comment><USER29> As a moderately sophisticated user, I wouldn't have expected the function RemoveExtraSpaces to immediately enable a RCE attack. It sounds pretty innocuous.

<comment><USER30> I don't think RemoveExtraSpaces has any RCE, but it is overwriteable. The "hack" is tricking the user into overwriting it with a different function called RunScript.

<comment><USER31> Which is complicated by the fact that any addon (which many users use a dozen or more) can do this without the user knowing at all on initialization.

<comment><USER32> Any add-on added by the user is _already_ executing in the client's space and has zero need for a vulnerability like this.

It's like saying that any program running on my computer could exploit a remote code execution bug... I mean, yes, it could. But why would it, when it already has local execution rights?

<comment><USER33> Because if the add-on just opens up a backdoor, the author can do more specifically targeted things at their whim rather than blasting everyone who installed it? Harder to get caught.

<comment><USER34> Still zero need for this kind of exploit. The author of the addon can already do specifically targeted things at whim at a later point in time.

<comment><USER31> I mean it was already maliciously exploited in a highly used addon. It was a lot easier to slip in a short one liner than some highly suspicious "hack the user" blob of code. It was also extremely flexible. They could then do different things to each person instead of one fixed attack.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> WeakAuras also had an import/export feature that was widely abused in a similar way.

</comment><comment><USER36> you guise i got phat loot just enter this magic command and it will appear in your inventory... Newbies eyes get wide open O.O</comment>


Adobe to acquire Magento for $1.68B - <AUTHOR> https://techcrunch.com/2018/05/21/adobe-to-acquire-magento-for-1-6-b/ <comment><USER2> What great news for Magento users! Adobe will do great things with this recent acquisition. That is definitely the pattern I see when I look at past Adobe acquisitions.

</comment><comment><USER3> Improvements should be coming to big commerce soon as well. They just raised $64m. More competition for Shopify and I read their stock price is being scrutinized.</comment>


Web 2.0 Expo 2007, April 15-18, 2007, San Francisco, California - <AUTHOR> http://www.web2expo.com/ <comment><AUTHOR> It's that time of the year again. Don't forget to register by this Monday if you plan on going -- you save $200. Students also get 65% off the workshop package (use coupon code: webex07ftst at registration).

My co-founder, Jason, and I plan on attending. It'll be our first Web2.0 expo. Is anyone else planning to attend? Any veterans care to share their past experiences?</comment>


Ask HN: How to consider startup offer - <AUTHOR>

I'm thinking of joining the startup and have got an offer. Now I would like to better understand the financial part of it, putting aside startup culture, fun, idea etc.<p>I do know what I will be missing in terms of cash if I change jobs. How can I approach evaluating the equity? If I'm getting 0.X% of stocks of the company, how can I decide if this is worth it? What are some common mistakes I can make here? <comment><USER2> I'm no expert in this area, but I just stumbled upon your post. Depending on the stage of the startup (and, importance of your role), you might get 1/4% or 1/8%, which is sort of standard, in my understanding, for early employees. But, these numbers do not really mean much, since your share will be diluted and diluted, and diluted, as the startup gets more funding. The cash equivalent of your option is close to zero at this point, so I wouldn't optimize for the option. (As for the valuation of the startup, if it has been funded, then there should generally be valuation based on the previous round. You can always ask the founder(s) and, I presume, most of them will be candid about it.)

</comment><comment><USER3> Get enough money to be happy because the startup probably will close and the equity probably will worth nothing. But remember to take some equity just in case they are the next Google :).

Some ideas about how much equity you should get, by Joel Spolsky: [http://answers.onstartups.com/questions/6949/forming-a- new-s...](http://answers.onstartups.com/questions/6949/forming-a-new-software- startup-how-do-i-allocate-ownership-fairly)</comment>


A Brutal New Germany - <AUTHOR> http://m.spiegel.de/international/germany/a-1062442.html <comment><USER2>
      police are allowed to shoot people in the back even if they (aren't an) imminent threat

and he _heads the opinion desk_ for Der Spiegel?

<comment><USER3> Maybe quote properly? Probably just a (arguably very bad) vocalization of how we Germans have little understanding for the "trigger-happiness" of US police... even one shot fired in Germany is already relatively big news.

      In America, I was often appalled by the brutality of a society where the majority   support the death penalty and police are allowed to shoot people in the back even if they don't present an immediate threat.</comment></comment>


Irresponsible Code - <AUTHOR> http://irresponsiblecode.com

<comment><AUTHOR> Inspired by a recent talk at Euruko 2013 by Steve Klabnik I put up this "manifesto" to promote irresponsible code and find a proper balance between responsible and irresponsible code.</comment>


How much would it cost to buy everything advertised in an NFL game? - <AUTHOR> http://www.theverge.com/tldr/2014/11/13/7213879/how-much-would-it-cost-to-buy-everything-advertised-in-an-nfl-game

<comment><USER2> I'm not a fan of American Football, well, because I'm not American and never got into the sport. I'm glad there is a minimal of ads when I'm watching the Premier League.</comment>


Stampede – Texas Advanced Computing Center - <AUTHOR> https://www.tacc.utexas.edu/stampede/ <comment><USER2> Kelly Gaither gave a great talk at High Performance Graphics a couple of years ago ([http://www.highperformancegraphics.org/previous/www_2012/med...](http://www.highperformancegraphics.org/previous/www_2012/media/Keynotes/HPG2012_Keynote_Gaither.pdf)) if anyone is interested in more detail. An interesting tidbit during the Q&A is that Intel donated the Xeon Phi boards (referred to as MIC back then).

</comment><comment><USER3> I use Stampede regularly via NSF's XSEDE supercomputer access program. It's a fantastic resource, very well designed, easy to use, and the TACC staff are remarkably good at what they do.

<comment><USER4> what do you feel about the Blue Waters system and do you have access to it?

<comment><USER3> Looks very nice but I haven't tried it. I have used other NCSA systems in the past and they were also excellent. NSF funding of supercomputers is a godsend for researchers needing a lot of cycles.

</comment></comment></comment><comment><USER5> The page has conflicting memory statistics. Near the top, each of the 6400 nodes is said to have 250GB of memory, while at the bottom, each node is said to have 32GB of memory.

<comment><USER6> Thanks, Fixed.

</comment></comment><comment><USER7> I love reading about supercomputing, it's a completely alien world that has just enough similarity with what I do to be somewhat understandable.

I'm old enough (34) to have seen much of the revolution in computing and it is easy to get somewhat jaded after a while but the sheer power of the petascale systems just makes my jaw drop every time I read about them.

<comment><USER4> building a petascale system is relatively easy compared to having applications that can actually use all that power. you can count such applications probably on one hand that can scale to post-petascale systems

</comment></comment><comment><USER8> I would love to get a tour of this. I live in Austin.

<comment><USER9> I'll be doing a tour of the machine room (not the vis lab) this thursday noon. Drop me a line: eijkhout at tacc utexas edu

</comment></comment><comment><USER10> ... and in 5 years it will be obsolete.

</comment><comment><USER11> I hate this new info-graphic web page style.

The information is flashy and verbose. When I want to think about what I'm reading, all the pictures, _constant_ scrolling, and animations honestly just gets in the way.

I do realize that this web page style is in vogue right now, but I really hope that simpler pages exist somewhere.

<comment><USER12> Thanks for your reply. I'm not involved with Stampede at all but as a front end dev I'm always looking towards new interesting ways to present content. I have a project coming up that's going to be timeline based and immediately upon seeing Stampede's website I figured the beginning section (The Power of Stampede) could applied usefully. Without user input and feedback I'm going off of my assumptions and those aren't always the best for the end user.

<comment><USER13> That was one persons opinion. I liked the site itself. Don't just go by one persons opinion. There will always be the people who like to stick with their plain html sites and always go "grr" when the pages are modernizing.

<comment><USER12> I never said I was going solely off of his opinion, just that it's nice to see feedback about the presentation of the content from a front end developers and end user standpoint.

I'm a firm believer in making things functional and useful and then adding things on top of that to make them pretty, more readable, and if possible exciting. Thanks to you as well.</comment></comment></comment></comment>


Formalizing the Robots Exclusion Protocol Specification - <AUTHOR> https://webmasters.googleblog.com/2019/07/rep-id.html <comment><USER2> actual RFC proposal if anyone is curious: [https://datatracker.ietf.org/doc/draft-rep-wg- topic/](https://datatracker.ietf.org/doc/draft-rep-wg-topic/)</comment>


Why and how we roll our own infrastructure monitoring - <AUTHOR> https://medium.com/1plusx/monitoring-alerting-at-1plusx-a472984059a8 <comment><USER2> So, basically, nothing fancy or different from what everybody else is doing, maybe with the little exception of keeping things on premises instead of sending to the internets (a.k.a. "the cloud").</comment>


Seven lessons I learned from the failure of my first startup - <AUTHOR> http://therenaissancegeek.blogspot.com/2014/08/seven-lessons-i-learned-from-failure-of.html

<comment><USER2> I think it is almost impossible to judge your own business idea correct. Either you are to optimistic because you spent so much time with the idea and became a fan of it. Or you shoot all your own ideas down. Also i do think design can be important. But of course it can't help if the problem is somewhere else too.</comment>


Applikatoni – An open-source, technology agnostic deployment server - <AUTHOR> http://applikatoni.com/ <comment><AUTHOR> This was linked from the recent DevOps Weekly newsletter ([http://www.devopsweekly.com/](http://www.devopsweekly.com/)) and I thought it looked interesting. Has anyone used it or care to share opinions about it?</comment>


Supercomputing at the Crossroads - <AUTHOR> https://www.nextplatform.com/2018/02/16/supercomputing-at-the-crossroads/ <comment><USER2> HPC has jokingly stood for a second phrase: Half Priced Computing.</comment>


There's a giant void in the great pyramid - <AUTHOR> https://www.popsci.com/giant-void-great-pyramid <comment><USER2> I read about this a while ago. There was mentioned that this Void may be to to make the Grand Gallery more stable by putting less weight on it.</comment>


Show HN: SparkBin, idea gathering for companies (25 invites for Google Apps) - <AUTHOR> http://sparkbin.net/?ref=hn

<comment><USER2> Great little service. I found when I submitted an idea and didn't complete the pitch, the error screen doesn't draw much attention to what the error is. "can't be blank" is the same size/treatment as Name/Pitch/Tags.

<comment><AUTHOR> Should be a little clearer now. :)

</comment></comment><comment><USER3> Nice! Just signed up for an account to check it out.

Just wondering: what are you using for email notifications like the ones for sign up?

(I'm the Product Manager for PostageApp, so I want to know these sort of things. :))

</comment><comment><USER4> Very cool. I wish it hooked in with Outlook though. Not all companies are on Google Apps.

<comment><AUTHOR> We'll be supporting other means of access in the near future, Google Apps is our target for the private beta.</comment></comment>


Hole in Adobe software allows free movie downloads - <AUTHOR> http://www.reuters.com/article/ousiv/idUSTRE48P88V20080926?sp=true

<comment><AUTHOR> On how users can watch any Amazon movie for free instead of renting it:

"Amazon starts to stream the entire movie during the free preview -- even though it pauses the video on the Web browser after the first two minutes -- so that users can start watching the rest of the video right away once they pay... However, even if a user doesn't pay, the stream still sends the movie to the video catching software, but not the browser."</comment>


Non-linear loops - <AUTHOR> http://ericasadun.com/2016/02/26/non-linear-loops/ <comment><USER2> what ide are you using?

<comment><USER3> I think these are Swift playgrounds in XCode</comment></comment>


Perceived Legitimacy: How to Visually Prepare Your Startup for Fundraising - <AUTHOR> http://aleberrycreative.com/swag/perceived-legitimacy/ <comment><USER2> Make sure you stock the employee fridge with La Croix. It shows the investors you're cutting edge, and every company I've been at has been bought within a year after they started stocking the stuff.

If you stock Coke or Pepsi, the investors will interpret that as a sign you come from a poor family.

Coffee is a safe bet to have around, but won't make you stand out.

Tea is a good gambit, but you have to sip it in a way that conveys social class. Make sure you have glass teacups.

Don't stock energy drinks: Having early 20s software developers around gives off that fresh hipster vibe, but only teenagers will drink a can of Monster and that will drive off the investors.

<comment><USER3> While you joke, about the drinks etc. Percieved legitimacy may actually be even more important for customer acquisition. A lot of the rules they mention here are even more important for customers.

On additional thing customers want some way to get a sense of, is that before they buy they believe you will still be there in a year or two years, etc. Especially if there is a long integration process.

<comment><USER4> In that regard, I look for a semi-active blog, preferably with technical topics. A few times a month is fine, weekly shows some steady progress. Talking about customers is a start but I also want to see how they're applying their own product to different use cases, industries, etc.

I also look for mentions on Twitter. Not a specific number but if they're getting tech support questions, are they responded to?

My reasoning is simply: "I'll need help at some point, are they willing & able to provide it?"

</comment></comment></comment><comment><USER5> "Perceived Legitimacy" would be a great title for the future book about the end of the current tech bubble.

<comment><USER6> My thoughts exactly, because who needs a minimum viable product when you have a nice bootstrap landing page

<comment><USER7> otoh often even having a viable product requires appearing legitimate to get funding.

</comment></comment></comment><comment><USER8> This is a fun tutorial. Only the outline. It seems very simple, so much that I wonder why we still need humans for that ;)

</comment><comment><USER9> An impressive application of Poe's law.

</comment><comment><USER10> Surely almost none of this is necessary. If I ever try to fundraise again it's going to be plain, plain text.

<comment><USER11> Of course, it behooves a design agency to push the need for heavily stylized decks. ;)

(We used plain black text on white background and had no issues)

</comment></comment><comment><USER12> I nailed most of this list but didn't have, you know, users: atomicarmies.com

</comment><comment><USER13> JS scroll magic took my tab down twice, gave up after that.

</comment><comment><USER14> Strange how the website did not render properly on mobile for me. Is a responsive website part of perceived legitimacy?

<comment><AUTHOR> What device are you using? We definitely made it responsive and tested. Will fix the glitch. Thanks for letting us know!

<comment><USER15> Does "responsive" not include responding to printers? When I try to print the web page, the first page has the header, but the next 16 pages are blank.

<comment><AUTHOR> We're about to add a link at the top to download as PDF. This was originally a talk given in PowerPoint & uploaded on Slideshare. Here's a link in the meantime. [http://www.slideshare.net/aleberrycreative/perceived- legitim...](http://www.slideshare.net/aleberrycreative/perceived-legitimacy- fundraising-strategy)

Cheers,

<comment><USER15> Thank you!

BTW: Select All, Speech => Start Speaking works great!</comment></comment></comment></comment></comment>


Ask HN: HN supported initiative to transition ageing developers to legal? - <AUTHOR> On the recent front page post on Articles 11 & 13[0] a reply was left to this comment:
>It turns out that regulations are made largely by old lawyers, who are more connected and charismatic than smart and practical, and haven't operated in the real-world for decades. (user: dokein)
Which went like this:
>Maybe that's the career path for aging programmers. Get a law degree. (user: jonhendry18)
Ageism in tech is a huge problem that is widely discussed here as is the disconnect between technology and law makers. It is in fact the perfect intersection which will result in the maximum value add impact for ageing technologists. Given that HN is frequented by many ageing developers and also quite a few lawyers there is an opportunity to create a community supported initiative to make this easier for all involved. I don't quite have ideas on what this would look like so I have created this post to start an open forum discussion where we can collect ideas and see if there is an appetite to make this happen.
Please share you industry/experience specific or general insights, ideas and thoughts.
[0]https://news.ycombinator.com/item?id=17449457 <comment><USER2> I have a law degree, but I work as a full-stack developer. The shared logical thinking between law and programming is astonishing.

Nevertheless I transitioned from law to working in IT, because of the salary / career options ( being a successful lawyer is magnitude harder ).

As this seems like a crazy idea, I tend to agree that we need more specialised IT lawyers, understanding what's happening down to the byte. Unfortunately the idea folks are not always lawyers, but mostly politicians and this is quite hard to transition to.

</comment><comment><USER3> Having programmed for 50 years and going strong, why would I want to submerge myself in pettifoggery? It sounds like something to be left to naive young software engineers who need to learn more about the real world.

<comment><USER4> > Having programmed for 50 years and going strong...

Wow. That means you started in 1968. Professionally or as a kid? Hats off to you sir!

<comment><USER5> A programmer older than (Unix) time itself.

</comment></comment></comment><comment><USER6> I'm going to focus on the US since that's what I'm most familiar with. The generalities will translate to other locations such as the EU, but the specifics will be off.

1) As others have mentioned the transition from engineer to lawyer doesn't make much sense for most of the population. Right now, the most influential law schools in the US (think Harvard and Yale Law) cost 60k+/year to attend for 3 years. Once you're finished, the typical engineer will see a salary dropoff along with a major increase in work. This is probably not the way forward in the US.

So let's take another look at the problem we're trying to solve. To restate the problem, regulation/law is made by those who are typically out of touch resulting in regulations that are often actively harmful. We in the tech industry would like to be involved or influential enough in the tech industry to be able to prevent these "bad" regulations from being created in the first place.

Ok, so where does regulation come from? Who do we have to influence? There are two primary sources of regulation, the legislative bodies such as congress and regulatory agencies such as the EPA, FCC and FDA. Secondary sources of regulation are executive orders/actions and the courts (common law courts used by the US and the UK explicitly look at judicial precedent)

There are already several well-known patterns to influence these regulation creators with the patterns in use by industries of every stripe. 1) Funnel more people from tech into careers as either politicians or their staff

To influence regulation created by these there are 3 well-known possibilities. 1) become politicians, 2) lobbying, 3) be an advisor or other person of influence. Option one is definitely a possibility but comes with the downside that many of those that choose this path will be older and out of touch. Option 2 is the one I believe has the easiest path forward. Today Facebook, Google and Microsoft have big lobbying efforts, although they pale in comparison to the lobbying by telecom and big energy. VCs already have informal lobbying they do on certain issues such as immigration and taxes on stock compensation. Grassroots we've seen the ability of tech to organize, especially around net neutrality and SOPA. The tech industry has seen successes, but hasn't been able to sustain it. It could benefit from formal industry-wide lobbying efforts. As for 3, tech could be more active during rule-making sessions and feedback sessions. We need to establish relations with politicians, regulators and their staff.

<comment><AUTHOR> Yes I completely agree. I was considering lobbying as an option earlier today. Adding to your thoughts, very early stage and bootstrapped startups need to get their voice out. These are the future power houses unlocking unrealised potential in the economy. Google et al and even VC backed startups operate in a totally different reality.

</comment></comment><comment><USER7> I think the massive salary drop off will make the late-career transition from engineering to law hard to stomach. Someone in their 40s or 50s with 20-30 years of engineering experience probably has a family, is thinking about their retirement plans, and is commanding the salary of a senior engineer (at least). Very few people are going to be willing to take 3 years off from work to go back to school only to spend another few years as a junior associate making far less than they could as a senior engineer. A lawyer going into policy or any other altruistic area of the law should expect an even larger salary gap.

<comment><AUTHOR> What about all the 50 year old engineers who have been made redundant and are finding it hard to find work? A combination of this and wanting a sense of purpose could make this an attractive proposition. Also I think forcing someone this experienced to follow the junior associate track is not a good system. Surely there is a better alternative way to leverage the technologists knowledge snd experience. It's exactly things like this that I expect to be discussed here.

<comment><USER8> Stop looking for a jobs at all of the cool startups and look for boring corporate jobs. I'm 44 and never have any issues finding jobs and know plenty of 50 year old developers. The difference is that we are all aggressive about keeping our skills current.

</comment></comment></comment><comment><USER9> But what's the demand like for lawyers who know software development

<comment><AUTHOR> That can be generated. There are obviously powers at play in US and EU which are lobbying for nefarious goals. This can be counteracted. Perhaps setting up a framework for this could be part of the initiative.</comment></comment>


RescueTime (YC 08) CEO to step down - <AUTHOR> http://www.techflash.com/seattle/2010/05/rescuetime_ceo_tony_wright_to_step_down.html

<comment><USER2> All of us at RescueTime want to wish Tony the best of luck!

We will still be seeing Tony on a regular basis as he continues working on some special RescueTime projects, so hopefully we'll get the early scoops ;)

</comment><comment><USER3> This is quite an achievement. I really long for a day my startup can turn into a company which does not need me in order to succeed. That would be a major personal victory for me!

Seems like Tony's achieved it. Congrats!

</comment><comment><USER4> why is he stepping down when RescueTime is doing so well?

> Wright said he's leaving RescueTime at a period of strong growth, with > quarterly revenue averaging 51 percent over the past four quarters. About > 600 to 1000 users sign up for the product every day, with an increasing > number of Fortune 500 companies signing on in order to get a better > understanding of how their workforces function.

<comment><USER5> Sell high, buy low!

</comment></comment><comment><USER6> Good luck Tony!

I <3 <http://rescuetime.com>

<comment><USER7> ditto

</comment></comment><comment><USER8> Well? What's cooking webwright? :-)

<comment><USER9> Nothing yet. Truthfully, a lot of stuff is cooking with RescueTime that I'm going to keep working on (and am genuinely excited about)... But the day to day CEO tasks are going to shift to Joe and I'm going to _start_ thinking about my next chapter.

To the person who replied below about size-- RescueTime is still pretty small-- we haven't felt a lot of pressure to grow and have really focused on keeping the service lean (related: this is one of my favorite graphs on the interwebs-- check out #7: <http://37signals.com/svn/posts/83-traffic-vs- employees> ).

Thanks for all the warm wishes guys. Truly feels good!

<comment><USER10> Super product, it's the one service on the net that I'm actually _scared_ to sign up for :)

Kudos for a great idea and a fantastic execution, very curious what you come up with next.

</comment></comment></comment><comment><USER11> Neat, this is the perfect service I've been looking for. WHy? Because I spend WAY too much time here looking at all the cool things in the world when I should be focusing on my functional specs/coding/etc.</comment>


Sea Otters Are Jerks. So Are Dolphins, Penguins, and Other Adorable Animals - <AUTHOR> http://www.slate.com/blogs/wild_things/2013/10/28/sea_otter_dolphin_and_penguin_behavior_your_favorite_animals_are_jerks.html

<comment><USER4> Our values do come from evolutionary fitness.

It's just that cooperation, exchange, and division of labour benefit all of us better than some zero-sum game. If this were not the case, savagery would rule the world, instead of global trade.

Enlightened self-interest favours respect of diversity and non-conformance - because exploration is more effective when everyone tries a different approach (instead of the same one). And exploration, especially in science and technology, benefits us all, particularly in increasing carrying capacity so we needn't choose between intertribal warfare, infanticide and starvation.

I took the following from studying world war two in school (though I don't think it was explicitly stated): the Nazis started WWII and sought to eliminate many groups, including Jews, on the basis of eugenics (apparently, eugenics was broadly popular at the time). Yet Einstein, a German Jew, created the basis of atomic weapons which ended the war (if not, they would have ended it).

Eugenics is a misunderstanding of the Darwinian value of a human life.

To some people, this point of view may seem cynical, ugly and horrible. But to me, it is the most hopeful view I've ever seen. It means that if some overly- controlling group tries to enslave the world, they will likely fail - <USER2> their very nature weakens them. It also means that over time, the Darwinian pressure is for us to become ever more good, as that is what gets rewarded. Therefore, if one day we meet powerful aliens, they are likely ethical aliens. Taken to the furthest extreme, one could see symbiosis as the nature of the universe.

Is that taking it too far? Maybe. But it follows from the evidence, and the logic of division of labour. Of course, it's just a probability - <USER3> can strike at cooperation at any time. And does. All I claim is that cooperation is the way to bet.

Ethics is power.

<comment><USER5> Why are bringing Einstein into this? That has nothing to do with the original topic. Your post also contains quite a number of inaccuracies and self- observations. Ethics is power? You can try expanding upon that a bit next time you post a comment similar to that.

<comment><USER6> The comment made perfect sense. OP was extrapolating the "animals are jerks because of evolutionary pressure" idea to humans, and reasoning that non-zero- sum ethics are also the result of that pressure. "Ethics is power" was the summation, not the initiation.

It seems like you need to work on your critical reading skills before getting so snarky.

<comment><USER7> aac is trolling by creating a throwaway account and intentionally violating a few of the comment-posting guidelines.

</comment></comment></comment></comment><comment><USER8> Maybe I'm missing the point; or that this is implied, but this seems to really beg the question of, "Humans do all of these behaviors AND MANY MORE!" what sort of "jerks" are we?

In fact, it seems that the whole "jerk" thing is rather contrived, and the occurrences as a whole seem to merely suggest "this is what it is to be an animal."(They seemed to be going in this direction; but then turned it into a "this is why animals aren't actually good and nice and our superior reasoning ability allows us to avoid this" but I would respond with, "it hasn't.")

I don't mean to legitimze, but rather to suggest that it puts any suggestions that humans are more than "just animals" (tm) in an interesting light.

<comment><USER5> You don't need to be sorry for your thoughts. "Maybe I'm missing the point", "I don't mean to...", and other similar phrases can be avoided. You don't need to use phrases such as these. Just say what you think, and if you find yourself unable to post without using those phrases, then that means your comment/argument is flawed and you shouldn't be posting such a comment.

<comment><USER8> I've found, especially in dealing with certain crowds which can often be known as adversarial to put it kindly, a lot of times you avoid conflict by coming across more defensively. Perhaps I've just had to deal with very abrasive people in my day to day work environment, but I phrase things in such a way consciously, aside from any judgement on the argument itself.

</comment></comment></comment><comment><USER9> Teleological reasoning is always trouble when it comes to evolution. The biggest problem these days seems to be going from valid assumptions like "the best foods to eat are the ones we evolved to digest" to the less valid "that's how we evolved so that's how we should be". The first makes one healthy, the second makes one Nazi.

<comment><USER5> And yet another instance of Godwin's law being invoked. What do Nazis have to do with this topic? None. Please don't post this type of comment in the future.

<comment><USER10> _What do Nazis have to do with this topic?_

Eugenics. Sloppy reasoning using evolution.

 _Please don 't post this type of comment in the future._

As far as I can tell, you didn't have the background to know what the gp commenter was saying, so you counterfactually knee-jerked a reaction amounting to censorship.

It would be nice if we could rationally talk about the Nazi regime in a historical and cultural context. It's especially instructive, as they sincerely believed they were "the good guys." What was the most used word referencing an emotion at the Nuremberg Rally the year Leni Riefenstahl filmed _Triumph of the Will_?

"Love."

The Nazis thought they were the good guys, and they were able to convince enough of an entire country to achieve a totalitarian state. What they did afterwards was truly horrible -- which is a glaring indication that we have lots of valuable stuff to learn about how human beings can go horribly wrong by _thinking about what happened._

Godwin's law is an anti-rational knee jerk.

The person who originally introduced me to this idea? (Not in specific reference to Godwin's law, but generally.) A young jewish woman I had fallen in love with. Chew on that.

<comment><USER11> > Godwin's law is an anti-rational knee jerk.

(Off-topic)

Actually, I think parent poster and you misunderstand Godwin's law. Godwin's law is just the empirical observation that, as an Internet thread grows longer, the probability of someone making a Nazi reference approaches unity. It's a "law" in the same way that Moore's Law is one. It's not (originally) intended to be a way to shut down discussion. There's nothing special about the Nazis in this regard - there is a tendency toward a "race to the bottom" when constructing analogies, and it just so happens that in our culture they're considered the worst thing that ever happened. If the Nazis never existed Godwin's Law would have referenced something else - slavery, some other genocide, etc.

<comment><USER12> Maybe this is a different law, but I thought Godwin's law was more along the lines of "whoever first makes a comparison to hitler automatically loses the argument".

</comment></comment></comment></comment></comment><comment><USER13> I don't like this piece. It's anthropomorphising but to little useful effect. We know animals are not humans, and imputing American C21st values to animals, which are really doing things which animals do, doesn't enlighten us one bit. There is a good point to it, but the tone, that "they're jerks" is way too simplistic for a good undersanding of the factors and survival metrics involved here. Why do x do y, and why is that different from us, here are some factors and likelihoods would be a much more useful approach.

</comment><comment><USER14> I loved the conclusions at the end. The "naturalistic fallacy" has been on my mind for quite a while.

<comment><USER15> yes, indeed. It's easy to forget the terror and brutality of survival that is a daily given for most animals and a certain percentage of humans when you live in the "developed" world. Amazing how quickly we get accustomed to a safe and routine life when all it takes is a month in a jungle - or Calcutta for that matter - to re-appreciate how far we have come using reason, stepping beyond what could be classified as "natural".

<comment><USER16> We are safe not just thanks to reason in our social behaviour, but also our hygiene:

[http://www.amazon.com/Parasite-Rex-Bizarre-Dangerous- Creatur...](http://www.amazon.com/Parasite-Rex-Bizarre-Dangerous- Creatures/dp/074320011X)

I thought that anyone who has raised a cat knows that animals are jerks (playing with bleeding mice for hours and all), but I was shocked by the added layer of terribleness from parasites in almost all species.

</comment></comment></comment><comment><USER17> Cats, pigs and bettafish continue unslandered, no one wants to annoy Reddit.

<comment><USER18> That actually bugs me a lot. Cats are wreaking environmental havoc: [http://www.usatoday.com/story/news/nation/2013/01/29/cats- wi...](http://www.usatoday.com/story/news/nation/2013/01/29/cats-wild-birds- mammals-study/1873871/)

Raising this point on Reddit only gets you downvotes.

<comment><USER19> The impact cats are having has been greatly overstated for two main reasons.

1\. Original studies over estimated the amount of animals a typical cat kills.

2\. Cats roam over a lot less area than you'd think, rarely going even half a mile away from their home. Putting the majority of wild animals out of reach of a house cat's range.

</comment></comment></comment><comment><USER20> I think it is our society which has encouraged the cuddly, cute side of these animals to be more recognized. Maybe, If we get to look at a wildlife conservation group's data, we will probably find that the cute pictures of these animals got through to a bigger audience and brought in more donations than a violent/non-cute picture. I am not saying it is wrong, but that is just how it is. This will continue to happen unless more people actually show interest and try to learn more about the wildlife around them.

</comment><comment><USER21> He's missing my favorite bit of mean Adélie behavior- before they jump in the water as a group, they shove a weak or unlucky penguin in and wait for a second to see if a seal eats it.

</comment><comment><USER22> Correction: animals are jerks.

</comment><comment><USER23> This is especially problematic in Monterey Bay, where there are more male sea otters than females. The reason for this skew in the population is unclear, but it leaves male sea otters in a bind. The rehabilitated sea otters were released into an environment of intense competition and were at a disadvantage when it came time to find a mate. > Hello CS class.

</comment><comment><USER24> (I read "so are developers" for a second.)

<comment><USER5> ^Not a useful comment, as it tells nothing new or insightful, so please don't post this type of comment in the future.

</comment></comment><comment><USER25> Actually, males of many species are mostly jerks. Females, on the other hand...

</comment><comment><USER5> This should not be on the front page.

<comment><USER26> So flag it. Oh, that's right, you can't -- because you created a throw-away account to post a bunch of comments on this thread, telling other people what they should or shouldn't post.

</comment></comment><comment><USER27> To be fair, the baby seals were asking for it.

<comment><USER5> Please don't troll.</comment></comment>


Tor use is now forbidden on Kimsufi's OVH - <AUTHOR> http://forum.ovh.com/showthread.php?t=89685 <comment><USER2> Tor can be used for good and for bad. It's the very same problem that Cory Doctorow talks about in his lectures about the War on General Purpose Computing, and it's not an easy problem to solve.

I'm an admin on a social/gaming site (a MUD with appendant forum, blogs, and other community elements), and we have had to make a few decisions about Tor in the last couple of years.

Some background: the site is quite old, and we have historically encouraged users to sign up without needing to provide a unique ID such as email address. They _can_ provide one, but don't have to. In the last few years we have had the problem of occasional griefers log on and cause whatever social havoc they can.

Now, my personal feelings about Tor are generally quite positive, and I like the freedoms it provides people who are otherwise restricted by their ISPs or governments from accessing legitimate resources. Like many others have said, Tor is a tool that, while it can be used to do illegal things, is also used to provide a very useful service to people who need it to get on with things you and I take for granted.

Now, back to our griefers: We have a number of banning mechanisms based on IP or domain, and they tend to be successful because griefers usually get bored when they can't access the site for a couple of hours. However, because a tiny minority of griefers are more persistent, more technically adept, and figured they could use Tor to damage our community, we did a little bit of analysis and found that few if any legitimate users of our site came from Tor exit points, and we chose to block them. The alternative was to require a unique identity during the sign-up process, and frankly we wanted as few hurdles as possible to new users (anyone who knows the MUD community knows that it's in decline, and low-friction signups are pretty desirable). So we blacklist Tor exit points from our signup process. The unfortunate fact is that some Tor users do bad things with the fantastic tool at their disposal, and end up spoiling it for the legitimate (and extremely valuable) use cases that make it such an amazing tool. Yet its very anonymity means that there is no easy way to allow one set of uses while disallowing others. This is a hard problem, and one I'm not smart enough to solve.

<comment><USER3> Assuming you have the technical capability, requiring an email address and confirmation for only tor users could work.

Freenode does something similar - tor and other problematic traffic sources can connect but must use connect time SASL to authenticate to a previously created account, which is sufficient to exclude the vast majority of the griefers.

<comment> Tuna-Fish What good would email address confirmation do? You do know about mailinator, right?

<comment><USER4> Most sites that have issues with trolls and find IP blocks insufficient can also block on mailinator and similar domains.

<comment> Tuna-Fish No, they _attempt_ to block similar domains. And completely fail at it.

I never use my main email for anything I don't feel requires it, and while maininator.com is often blocked, I've never in my life had to refresh the mailinator page more than twice for an alternate domain that works. Since mailinator accepts email from any domain that has it's MX record set to it, if you own a domain you can set it to be an alternate name to mailinator in seconds. Enough people have done this.

<comment><USER5> No, it's actually super easy to block it if you're clever enough ;)

<comment> Tuna-Fish Could you point me to a site that does successfully block it?

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I have a hard time blaming them for this. They're a budget provider, so any extra cost handling subpoenas and legal documents (which, let's not kid ourselves, is going to happen 100x more on a Tor node than on the majority of their other customers) quite possibly means a loss for them on a server.

</comment><comment><USER7> The relevant French: "depuis quelques mois, nous avons eu plusieurs affaires juridiques lié à l'utilisation de plusieurs réseaux TOR dans le cas de la pedo et on va désormais l'interdire au même titre que tous les systèmes d'anonymisation."

My (amateur) translation, cleaning up Google translate (which doesn't recognize Tor as a proper name): "For several months, we've had many legal matters related to the use of TOR networks in pedo cases, and from now on, it is forbidden along with all systems of anonymization."

Doesn't sound like they want any part of it.

<comment><USER8> Weird, the French part looks like the output of a translator. There are a few faults of vocabulary, grammar and sentence structure.

Your translation is correct though.

<comment><USER9> French is my mother tongue, and I think it sounds alright. It's everyday speech though, not something you'd write in a press statement.

<comment><USER10> Fellow Frenchie here- it does look like it was written by a high schooler rather than a CEO- awkward phrasing ("dans le cas de la pedo", wtf?!?), conjugation mistake ("liées"), use of "on va" instead of "nous allons" in a formal written statement...

<comment><USER9> Seems commonplace in the French IT sphere. On the new "42" school forums, the mods are downright trolling.

</comment></comment></comment></comment></comment><comment><AUTHOR> "Pour des raisons de sécurité, l'ensemble des services IRC (à titre non- exhaustif : bots, proxy, bouncer, etc.), services de navigation anonyme (généralement appelés proxy), nœuds TOR, ne sont pas autorisés sur le réseau OVH sauf autorisation écrite d'OVH. OVH se réserve le droit de suspendre tout serveur sur lequel ces éléments seraient utilisés sans autorisation préalable d'OVH."

It looks like anything looking like a proxy is forbidden now. Including tor nodes :/

<comment><USER11> Proxies were already forbidden since 2010 (I think).

<comment><USER12> I hope you mean open proxies, because even ssh allows you to establish a (for you only) socks 5 proxy.

</comment></comment></comment><comment><USER13> OVH used to be one of the top host provider. Last year they removed the unmetered bandwidth and now TOR, VPN too ? (it's unclear to me). What's next ? no HTTPS, European traffic only ? seriously this sadden me, lucky for us Online.net is a good challenger.

<comment><USER14> OVH is still the cheapest host I've ever seen. 1 TB disk space, 100mbps connection speed, 5TB bandwidth, all for $20/mo?

I'm not complaining, nor have I seen better.

<comment><USER15> Their support is totally abhorrent though, be prepared waiting days/weeks instead of minutes/hours for any support at all, they abruptly change your TOS and server specs without telling you, cancel you order for no reason without telling you or even refunding you etc.

They're totally horrible to deal with, unless you make minimum wage you're probably going to spend more on packets of Tylenol due to all the headaches they cause than what you're going to save.

<comment> UVB-76 Indeed. I ordered a Kimsufi server five days ago with a guideline setup time of 24 hours. Placed the order, made payment, no doubt I'm already paying for the service, but five days later, I'm still awaiting setup.

Their ordering process is painful. Their online management interface is atrocious. Communication is poor.

It's true what they say about paying peanuts...

<comment><USER16> "no doubt I'm already paying for the service, but five days later, I'm still awaiting setup."

I'm a long time OVH customer and I can ensure you that your contract term will start only when you get your server.

As far as I know the first 1000 "3euros" servers got sold faster than they thought. Now they are building new ones. Be patient, your server is coming. ;-)

</comment></comment></comment></comment></comment><comment><USER17> They've not been Tor friendly for a while - and indeed have forbidden Tor for some time, at least according to Tors Good Bad ISPs wiki page - [https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISP...](https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs#France1)

</comment><comment><USER18> My French is not good enough to see if this is only for exit nodes, or also for internal relays?

Running Tor relays is one of the reasons I use their servers...

<comment><USER19> "depuis quelques mois, nous avons eu plusieurs affaires juridiques lié à l'utilisation de plusieurs réseaux TOR dans le cas de la pedo et on va désormais l'interdire au même titre que tous les systèmes d'anonymisation. Cela augmente l'utilisation frauduleuse de notre réseau et le nombre de réquisition juridique chaque mois"

"starting a few months back, we've had an number of legal cases regarding the use of multiple TOR networks for pedo, and we will forbid its use from now on, the same way we forbid all anonymisation systems. It raises the number of fraudulent uses of our network and the number of subpoenas each month"

I guess it means both.

<comment><USER18> Internal relays would never result in complaints though, since it only connects to other Tor nodes?

<comment><USER20> The policy is probably just a justification for canceling accounts after they get the first complaint; if you never generate a complaint they'll probably never notice.

</comment></comment></comment></comment><comment><USER21> Google-translated part from [http://www.ovh.com/fr/support/documents_legaux/Conditions_pa...](http://www.ovh.com/fr/support/documents_legaux/Conditions_particulieres_location_serveur_dedie_2013.pdf):

7.4 For security reasons, all IRC services (for non-exhaustive: bots, proxy, bouncer, etc..), anonymous browsing services (usually called proxies), TOR nodes, are not allowed on the OVH network unless written consent of OVH. OVH reserves the right to suspend any server which these elements are used without prior permission of OVH.

</comment><comment><USER22> How do they detect the use of a proxy though? That's what I don't understand. Tor's exit nodes are not broadcast, or are they?

<comment> mike-cardwell The list of Exit nodes is publicly accessible. All you have to do is check if any of your IPs are in that list.

<comment><USER23> The list of ALL nodes, including ENTRY and MIDDLE are also public.

<comment> mike-cardwell Excluding bridge nodes

</comment></comment></comment></comment><comment><USER24> Aww, I was running a relay for more than two years on mine. Hopefully it only means exit nodes.

</comment><comment><USER25> But i think people can still operate Tor Hidden services from there

<comment><USER26> Running a hidden services requires running a relay (exit or no-exit), right? I was planning to provide a hidden service for a site of mine for fun mostly but would not want to risk losing my server for satisfying my hacker enthusiasm.

<comment> mike-cardwell You don't need to be any sort of relay in order to host a hidden service. You can do it when just running as a client.

</comment></comment></comment><comment><USER27> Here's a related link just 5 days ago.

Server host OVH warns of 'multi-stage' hacking attack. [http://www.theregister.co.uk/2013/07/23/top_server_host_ovh_...](http://www.theregister.co.uk/2013/07/23/top_server_host_ovh_warns_of_multistage_hacking_attack/)

<comment><USER28> Well...no. This is OVH's own systems being compromised. It has nothing to do with 'hackers' using OVH servers to attack other people.

</comment></comment><comment><USER29> Makes sense. Tor's nature (and its many dodgy uses) will eventually lead to its demise, alas.

<comment><USER30> I did not downvote but instead invite you to elaborate. Why will Tor cause its own demise?

<comment><USER31> Operating as an exit node exposes you to a great deal of legal issues, if not liability.

Not to mention annoyance for the user... there will be sites you can't access since many sites block exit node IPs outright because of abuse.

If some random does something illegal and they happen to be using your node, guess who gets the knock on the door?

With that in mind, what user would want to operate an exit node?

<comment><USER32> What about hidden services? In my opinion that's the real heart of Tor. I think the value of exit nodes will start to wane as Tor gains a larger and larger user base and becomes it's own truly viable darknet. As it stands the majority of security related discussions I've come across regarding Tor strongly discourage spending any large amount of time on clearnet services anyway as this create many potential security/privacy risks.

<comment><USER33> If you are more interested in the hidden services aspect, did you also have a look at I2P [1]? It is more geared toward this aspect (exit nodes = outproxies in i2p-speak for example are just standard hidden services)

[1] [https://geti2p.net/](https://geti2p.net/)

<comment><USER32> Thanks! i2p is on my list of 'privacy stuff to learn' but your comment may have bumped it up a bit in priority.</comment></comment></comment></comment></comment></comment>


Silicon Valley should stop ostracizing the military - <AUTHOR> https://www.washingtonpost.com/opinions/silicon-valley-should-stop-ostracizing-the-military/2018/08/08/7a7e0658-974f-11e8-80e1-00e80e1fdf43_story.html <comment><USER2> What does ostracizing the military even mean? Do they not have the behemoth of the DOD budget behind them? Is the US military not spending unprecedented amounts of money in AI research?</comment>


Show HN: AS path tracing and IPv4/6 info lookup CLI tool (Linux/FreeBSD/Windows) - <AUTHOR> https://github.com/nitefood/asn <comment><USER2> very cool! as someone who runs their own ASN (as204994.net... shameless plug!) this is very handy.

<comment><AUTHOR> Thanks, I'm glad you find it useful :-)</comment></comment>


Quantum Mechanics: Ph.D Thesis of Paul Dirac - <AUTHOR> http://www.academia.edu/323246/PhD_Thesis_of_Paul_Dirac

<comment><USER4> See also:

Paul Dirac's handwritten notes for his PhD, the first ever on quantum mechanics.

[https://news.ycombinator.com/item?id=6002173](https://news.ycombinator.com/item?id=6002173)

<comment><USER5> > "the first ever on quantum mechanics"

Well that's a statement.

<comment><USER6> I guess that's Dirac for you. Unbelievably brilliant.

<comment><USER5> There were others before Dirac, that was my point.

</comment></comment></comment></comment><comment><USER7> Being in the topic of Paul Dirac, there is a wonderful biography - <USER2> Strangest Man: The Hidden Life of Paul Dirac, Quantum Genius __, by Graham Farmelo.

It is an exceptionally well-written biography of one of the greatest physicists, and a rare combination of a page-turner and a book written with the English reserve.

Besides the history of an important part of physics, and its historical background (including the rise of Nazism and Stalinism, WWII and later - <USER3> War) one can clearly see that science is not a dry product, polished from its very beginning. It's a process, created by various people, of different personalities and views, having simple and genial ideas, making blunt mistakes, and having life besides science (even Dirac).

Also, it shows science (here: physics) as a sociological process, with its centre shifting from Cambridge (centred around E. Rutherford), Copenhagen and Gottingen to Princeton, Moscow, ...

When it comes to Dirac himself - it's a moving example of a person, who may look as cold and devoid of emotions, but in fact is a loving father, loyal friend (defending the imprisoned (P. Kapitza), and excluded (W. Heisenberg)) and a responsible man. And one, who had never became reconciled with his brother's suicide.

The biography leaves a little doubt when it comes to Paul Dirac's autism, or Asperger's syndrome. While introversion, withdrawal, reticence, and persistence may stem from different causes, being literal-minded, characteristic response to stimuli and poor insight into other minds are, IMHO, hard to interpret in any other way.

(And a nicer review by one of my friends: [http://www.math.uwaterloo.ca/~mkotowsk/reviews/3farmelo.html](http://www.math.uwaterloo.ca/~mkotowsk/reviews/3farmelo.html))

</comment><comment><USER8> I think these are just his notes on his thesis, rather than his actual thesis. I don't know what the source is, but this same document was posted on HN as his `handwritten notes for his Ph.D' ([https://news.ycombinator.com/item?id=6002173](https://news.ycombinator.com/item?id=6002173)).

It's incomplete, full of corrections and deletions and covered in notes that are not referenced in the text.

Cambridge keeps a copy of theses submitted since 1920, so they should have a hardcopy of the real thing somewhere, but I wouldn't have thought it had been digitised. How fantastic it would be if they did though!

</comment><comment><USER9> > You must be logged in to download

I have said it before and I will say it again, because it needs to be said:

       F U Richard!

(for making people log in to access content)

UPDATE: On a more constructive note --- @RichardPrice, if you remove the "you must login to access" barrier, I pledge to upload all my papers to your website and I will even promote it.

</comment><comment><USER10> So smart at physics, yet he never figured out LaTeX.

<comment> cupcake-unicorn Haha, wow, I found myself having that kneejerk reaction as well. "Gosh, this looks so unprofessional, like a paper from middle school..."

<comment><USER11> It's from a time when academics (physics at least) was less interested in appearance and more interested in results. It's why there were so many breakthroughs. Today that has shifted with physics being more of a fashion contest to get funding.

<comment><USER12> This may be true but this is surely a bad example: Dirac's thesis is about Quantum Mechanics which is also one of the most fashioned research topics these days. So it's either a "result" or just a "fashioned topic" but it cannot be both at the same time.

On a side note, I wouldn't call (La)TeX a fashioned tool that scientists use to impress other people and get funding.</comment></comment></comment></comment>


A tool to build Docker images and orchestrate containers using only Ansible - <AUTHOR> https://github.com/ansible/ansible-container <comment><USER2> if this works as advertised, I was waiting since the beginning of docker for this. Never quite understood why the possibilities to interface with docker during build are only through a Dockerfile.</comment>


Tech Downtime in 2010: Learn From Foursquare, Skype, Twitter, Digg and Facebook - <AUTHOR> http://bostinnovation.com/2010/12/30/tech-downtime-in-2010-learn-from-foursquare-skype-twitter-digg-and-facebook/

<comment><USER2> Surprised Tumblr didn't make this list after the incident in early December where they had more than 12 hours of downtime.

<comment><USER3> Ahh great call totally forgot about the DDoS attacks those 4-channers put on tumblr.

I guess the lesson learned from the tumblr downtime is don't piss off 4Chan

</comment></comment><comment><USER3> in this article, I cover briefly why these big sites had downtime in 2010. I offer simple advice to a non-technical crowd on how to avoid certain mistakes. Obviously, the situations at all of these sites were pretty complex</comment>


Stop stealing dreams: Seth Godin on education & school - <AUTHOR> http://www.presentationzen.com/presentationzen/2012/10/seth-godin-presentation-stop-stealing-dreams.html

<comment><USER2> The fact is that ways the teaching is done will have to change. As things around us are changing at raid speed.</comment>


Ask HN: Offline / Paper Notetaking at Online Companies - <AUTHOR>

I just can't focus on taking notes on my work computer - I get distracted and switch to email, browsing, and other work.<p>Does anyone have a good system for offline notetaking that is easily searched and archived after the fact? <comment><USER2> I'm on mobile right now, so apologies that there are no links. I have an app on my phone called TinyScan, which allows you to take a photo of a piece of paper and do perspective correction on it to get a normal rectangular copy. I'll take a stack of notes on a particular topic, scan it with TinyScan, and then upload the resulting PDF to Evernote. Then, I'll sprinkle some keywords into the Evernote doc/tag it/move it to the appropriate notebook so that I can find it later. Not ideal, but it's been working pretty well so far.

</comment><comment><USER3> I don't use the 'Sony Digital Paper System' but I wish I did! If you've got a spare $1k it might do the trick.

Not that I've had the chance to try it out but the concept seems great, especially for people aged 50+ IMO.

[http://store.sony.com/digital-paper-system- zid27-DPTS1/cat-2...](http://store.sony.com/digital-paper-system- zid27-DPTS1/cat-27-catid-collections-standalone-installation-telesales- only?_t=pfm%3Dshopping_cart%26pfmvalue%3Dtitle) [Sony]

<comment><USER4> That looks sweet! A less expensive option (that I haven't tried) is the Boogie Board: [http://www.myboogieboard.com/na/products/boogie-board- sync-9...](http://www.myboogieboard.com/na/products/boogie-board-sync-9.html)

</comment></comment><comment><USER5> If you have access to a laptop, change room to take your notes. Or if you have big desk, more to a corner you never use.</comment>


Maersk, Me and NotPetya - <AUTHOR> https://gvnshtn.com/maersk-me-notpetya/ <comment><USER2> I can fully recommend reading the book "Sandworm" by Andy Greenberg. It explains NotPetya and all of the sorrounding investigation.

<comment><USER3> In the same genre, I recommend "Countdown to Zero Day" which looks at Stuxnet and Flame and the events surrounding their creation, deployment and aftermath.

<comment><USER4> Just an aside, I have met Kim a few times at various conferences. She is an interesting person, in a good way. She came to the book as an infosec neophyte. We talked about her process as something of a technologist outsider and how she decided what to focus on. Ultimately, she decided the storytelling was far more important than the technical details, though she felt those were incredibly important as well.

</comment></comment></comment><comment><USER5> Its an interesting article, and I agree with a lot of it, but I never manage to run windows desktop without local admin.

Some examples: Thanks to corona, tons of people started using usb headphones. The bloody thing needs local admin for almost weekly firmware updates. No idea why, but if you dont do them, a windows update for the driver will break them soon.

VPN! If you dare to log on with alternate credentials, it ends your connection. Hence any admin on a remote machine can only happen by a local admin.

Banking software pushes an update and immediately refuses to do any payment until you upgrade. The (nice) people who should package that upgrade are swamped and need months, at least if you manage to get a budget to let them package it. After that, an infosec review might take more weeks.

Printer drivers. No admin? No printing! Bonus points if vendor decides to publish the driver in the app store, which is blocked by group policy for everyone including admins.

ctr alt del needs local admin to kill a task.

As a bonus, infosec is the biggest hurdle: If they take weeks to approve any kind of admin access,and keep asling bureaucratic questions, only big problems that burn for weeks are worth solving. We have expensive software being unused because no one wants to do the battle to get access to fix it. I would love to drop some privileges, if only I trust I could claim them back when shit hits the fan.

</comment><comment><USER6> Related talk at Black Hat 2019: "Implementing the Lessons Learned From a Major Cyber Attack", by the Chief Information Security Officer of Maersk:

[https://www.youtube.com/watch?v=wQ8HIjkEe9o](https://www.youtube.com/watch?v=wQ8HIjkEe9o)

</comment><comment><USER7> As someone with very limited Microsoft/Windows background, I would be curious to somehow better understand how these lessons would apply to the Linux world.

What are the Linux equivalents of pass-the-hash, TAM/PAM/PAWs etc?

<comment><USER8> I'm guessing you know what a password hash is and roughly how password hashing works?

Microsoft's systems don't like to send your plaintext password over the network. Rather than either get rid of passwords or at least _secure_ that so it isn't a problem any more, they do the hashing on your machine and send the hash to wherever it needs to be authenticated. This behaviour enables Pass- the-hash.

Since we can authenticate with the hash, not the password, we don't even need to know the password. If we break into one system that knows the password hash for JimSmith in order to authenticate JimSmith then we can tell other systems we're JimSmith and present that password hash and they'll accept it.

So malware that gets enough rights on a machine with a bunch of people's password hashes effectively gets the ability to log in as them on other machines, on which maybe it can ascend to equivalent rights and get more hashes, which it can use again, recursively.

Pass-the-hash isn't a thing on Linux itself, it's a consequence of crypto- illiterate design in Windows. Arguably that design pre-dates modern Windows, ie it isn't the fault of the people who built versions of Windows you use today. On the other hand though rather than just outlaw this behaviour entirely they've chosen to try to mitigate the worst effects and whose fault is that?

<comment><USER9> Linux isn't vulnerable by default, because it's missing features by default. It has no equivalent of Active Directory, and doesn't use Kerberos or anything like it by default.

However, it _can_ , at which point you're back to the same problem. The vulnerability is with the protocol, not the operating system.

Modern versions of Active Directory enable strong protections for Kerberos that almost entirely stops the majority of the Pass-the-Hash or the Golden Ticket attacks. However, this isn't on by default even in Windows Server 2019 running a domain in 2019 mode for "compatibility" reasons.

I put that in air quotes because it's an excuse, and this is where Microsoft has consistently dropped the ball. They refuse to change security defaults, even when it starts getting absurd, and then lay the responsibility (and blame) at the feet of their customers.

For example, domain trusts between two Windows Server 2019 DCs will use NT4-era RC4 ciphers by default, downgrading all AES-capable devices across the trust.

Similarly, newly created accounts will always default to RC4, allowing downgrade attacks.

SMB is neither signed, nor encrypted by default.

Up until very recently, Windows Server has TLS 1.1 and 1.2, but they were disabled. Now, they're enabled, but so is TLS 1.0!

So on, and so forth.

That's the real issue. It's not that Windows is "crypto illiterate". That's like a person who can't read. No, it's like a person that can read but _refuses_ to.

<comment><AUTHOR> > They refuse to change security defaults, even when it starts getting absurd, > and then lay the responsibility (and blame) at the feet of their customers.

They changed a lot of security defaults with Windows Vista and literally(figuratively) everybody dumped on them. It got called worst Windows ever, unusable, and names I don't want to spell out from the public and the press. That made them reluctant to attempt such drastic measures again. But at least they disable SMBv1 by default nowadays.

<comment><USER9> The crypto wasn't at all the criticism most (any?) people had with Vista.

My criticism is that they didn't implement the Vista-era crypto _enough_.

In 2020, most Microsoft software doesn't support ECC certificates because their server products are still written to use the 2000/XP/2003 era crypto APIs instead of the Vista and later crypto APIs.

I remind you that none of those operating systems are supported any longer, but apparently for "comptibility reasons" SQL Server 2019, AD FS 2019, and System Centre 2019 can't use elliptic certs. Or use TPM-hosted certs. Or anything at all really other than RSA 2048-bit certs stored in software.

IIS can, but that's the lone exception, not the rule.

</comment></comment></comment></comment></comment><comment><USER10> All and all very interesting, however, some of strongly stated opinions in the article lack justifications and that's pity.

I don't mean that the author is wrong, just that he is stating his opinions strongly as facts, for an instance regarding ADFS vs SSO with Hash Sync, the statement that the latter is much better is stated as an obvious fact, without much of explanation of justification.

Since not everyone would agree, for instance some security teams I have the pleasure of working with/against, more facts and reasons and less assertions could have done better.

</comment><comment><USER11> In a geographical note, if you can get a chance to work/contract in Denmark, absolutely do so! I have been working in Copenhagen in 2014-2015 and I only have great memories of the country and the capital.

<comment><USER12> What about the language? I've heard that the best way to learn Danish is to be born to Danish parents.

<comment><USER13> Kamelåså [https://youtu.be/ykj3Kpm3O0g](https://youtu.be/ykj3Kpm3O0g)

</comment></comment></comment><comment><USER14> Great article and good bottom line advice.

</comment><comment><USER15> Not sure if advises are actionable. Especially in the light that decisions ultimately are made by 'tops' and consulting companies.

<comment><USER16> By that logic, nothing is actionable because someone else might prevent it happening. It being derived from the Maersk incident is probably among the better arguments for pushing it against that sort of resistance, since that is something business higher-ups have have heard of and are scared by.

</comment></comment><comment><USER17> devops should be done from 2 systems.

Dev (local administrator access ok, production access not ok)

Ops (local admin access not ok, production access ok)

<comment><USER18> Nobody should directly have access to production, it should be controlled via CD flows which are gated on approvals from other team members or metrics.

<comment><USER19> I can see that being somewhat impractical in real life, but you're not wrong.

In the ideal setup NotPetya would have been less of an issue for Mærsk should only have allowed whitelisted software to run on computers controlling critical infrastructure. It's just a solution very few choose to deploy.

<comment><USER20> How would that have helped? The finance software that started the breach was legitimately needed and would have been whitelisted.

<comment><USER19> One of two things:

Either the malware modifies the finance software, and is executed as part of the finance software, but the checksum for the software is now different and can't run.

Or: The executable malware code is separate and only triggered by the finance software, which will fail to execute it, because the malware isn't a whitelisted application.

At any rate, the malware would never be able to escape beyond the finance software computers. This means that yes you could have some issues with invoicing, new orders and so on, but you most likely didn't have to shutdown ports, because the computers there aren't allowed to run the finance software.

<comment><USER21> NotPetya authors penetrated the accounting software vendor and planted their attack code in a regular update.

</comment></comment></comment></comment></comment></comment><comment><USER22> Very impressive write-up.

</comment><comment><USER23> Why would any of the proposals provide any meaningful protection against this threat model?

Maersk claims NotPetya cost them $250M to $300M [1]. Assuming a criminal organization could demonstrate to Maersk that they could do an attack with similar effects they should be able to extort Maersk for a similar amount of money. If we discount due to unknown information, ROI, etc. I think it is reasonable to say that an extortion demand for $100M, assuming a credible demonstration that the criminal organization could pull off such an attack, would be an economically sound demand and likely to be paid. A criminal organization, considering their own ROI, would probably be willing to invest $30M for a $100M return. For $30M an organization could hire 30 full-time security specialists for 3 years at SV wages to identify an attack with similar effects.

Does anybody here think that their new system could resist such an attack even assuming they adopted all recommendations proposed?

Does anybody here think that there is any deployed system in the world that could resist such an attack?

Does anybody here think that even adopting and correctly practicing all practically deployed recommendations of the security industry that a system could resist such an attack?

All of my research points to no on all of those fronts. And, assuming the answer is no, then adopting all of the recommendations provides no meaningful protection to Maersk or any other company in a similar position since it would still be extremely profitable to attack them. Therefore, any company in a similar circumstance should probably not be deploying connected systems that allow this level of attack.

If the answer to any of those is yes, could you provide an example and evidence that supports that claim? I would sorely like to find a credible deployed case.

[1] [https://www.wired.com/story/notpetya-cyberattack-ukraine- rus...](https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code- crashed-the-world/)

<comment><USER20> This is ridiculous. You're basically saying that having any security at all is pointless because _someone_ will always still be able to break into your system in _some_ way.

Nothing could be further from the truth. Only ignorant amateurs believe that security is an all-or-nothing game.

By making your system _more difficult_ to break into, you:

* increase the effort and thus cost for the attacker, thereby reducing the number of opponents that can successfully attack you

* reduce the damage they can do before the attack is discovered and stopped

* make yourself a less attractive target compared to others

> Therefore, any company in a similar circumstance should probably not be > deploying connected systems that allow this level of attack.

That is simply not an option. You'd increase operating costs far more than the damage caused by this attack, and at the same time lose capabilities that customers have come to expect. Most of the cost of this attack came from having to operate without connected systems.

<comment><USER23> No. I made a very specific statement about the cost of attack relative to the benefit of attack for _this class_ of attack. The cost of attack is so far from the benefit of attack that there is no meaningful defense being offered. To use an analogy, making a tank from paper provides more defense than tissue paper. That does not, however, mean that there is any meaningful defense against credible threats. To provide a theoretical example, which should not be misconstrued as my specific belief on effectiveness, if the existing techniques could only stop an untrained child, but the best techniques in the world could only stop an untrained teenager, I do not think anybody would consider that to be a meaningful defense.

To go through your arguments in order:

Increasing the effort to attack is meaningful if it reduces aggregate harm in excess of the cost of implementation. In the specific case of the NotPetya attack on Maersk and generalized to similar attacks, there is no evidence that any of the proposed measures would meaningfully reduce the probability or raise the cost to be other than extremely profitable (this is my statement that $30M cost of attack is profitable). This is because the benefit of attack is so high relative to the cost of exploit development and deployment. So, in the specific case of techniques designed to prevent large, valuable attacks, it has no significant impact since you would need to raise the cost of such an attack to around the benefit of doing such an attack.

Reducing the damage they can do would be useful. The damage done in the Maersk attack occurred over the course of a few hours at most. Any defense against such a technique would need to already be prepared or completely automated. From my reading, damage mitigation usually occurs far after and mostly only prevents the marginal long tail, so I will contend, as in my previous post, that an organization with $30M in funding would be able to do the same amount of damage to any system given that they have the element of surprise and reconnaissance.

Making yourself a less attractive target is only meaningful if nobody wants to attack in you particular, it is not easy to wantonly attack all vulnerable parties, and the attacker does not have enough resources after attacking all even more profitable targets before attacking you since, as we stated before, it is still very beneficial to attack you. For the first, that is a bad bet when running a large-scale multinational. For the second, that is literally what software is good at, mass synchronized automated attacks. NotPetya is literally an example of a wanton attack. It is mentioned in that article that Maersk was not even the target. They were _accidentally_ attacked for $250M in damages. Being a less attractive target means nothing if somebody has a weapon that hits all attractive targets at the same time for no extra effort. And for the third, that is a terrible bet in the long run because profitable targets means they have money after each attack, so they will have money to spare to go after you. The only comfort is that it may take them time to hockey-stick to the point where they can saturate the market, but saturate they will. We are already seeing this with the increase in attacks with meaningful economic upside for the attacking parties instead of cheesy little $200/computer attacks.

Not deploying vulnerable systems is always an option, it just depends on the cost-benefit analysis as you state. My thesis is that the cost of vulnerable systems is, in the long run, significantly worse than almost all companies realize and there is no effective solution. My justification for this is that I am firmly of the belief, as my questions above indicate, that there is no company that can defend against a $30M attack and that a $30M attack can easily and credibly cause $300M in damages, and, even assuming good-faith extortion so they do not just extort for more money with the same attack, there are enough more $30M attacks that can cause $300M in damages that any such company will go bankrupt either from paying the extortion or from the extortion following through on their threats.

As a thought-experiment to go with this, if Maersk offered a $30M bounty for each unique vulnerability discovered that could cause them over $300M in damages, do you think they would run out of such bugs first or go bankrupt first? If the answer is "bugs first", why do they not offer such a bounty since each such vulnerability discovered is at least a 10:1 ROI for criminals and thus would be highly attractive to discover?

Just to get ahead of a common response to the above thought experiment corollary. Some people will respond that companies do not need to offer that much to get such vulnerabilities reported to them. This indicates that the problem is even worse than I stated since the cost of discovery is lower which means the criminal ROI is even higher. If they offered $30M for all such vulnerabilities they would be more likely to remove the highly attractive 10+:1 ROI attacks that can do tremendous amounts of damage to them which is a great ROI for the company.

<comment><USER24> You are wrong to focus on 300M. That's the cost of dealing with consequences of an attack, not the cost of measures that would have prevented it. So, you're right to say that attacking some businesses leads to >10 ROI for an attacker (actually much higher ROI are quite common although with lower thresholds), but that's only assuming that these businesses do not invest into proper protections ahead of the attack.

The whole point of InfoSec is to find the right balance of investment into preventive measures and incident response teams so that the cost/risk/reward ratios of an attack make it non viable for economically motivated attacker.

<comment><USER23> I agree with your statement on the point of infosec. I disagree that any particular infosec organization is equipped to deal with problems of this class in any meaningful way. In fact, it is so far off as to be mind-boggling and probably criminally irresponsible.

To this end, I will clarify what I meant.

I believe that an attack funded on the order of $30M would be able to do $300M in damages to Maersk even if Maersk adopted best-in-class preventative measures and implemented them as a primary focus with support from management at all levels. An attack, able to do $300M in damages that Maersk can not prevent after we have assumed it already did the best it possibly can, should be able to support a $100M extortion payment. This is an ROI of 3 for an attacker with high threshold and an ROI of 3 for Maersk, so I think this is a valid assessment.

So, a counterargument/example is an organization where an attack funded on the order of $30M can not impact operations by more than 1%. I chose the number of 1% because Maersk has a revenue of $39B, so a $300M attack is only ~1% reduction in company output. I hope this clarifies my statement.

I also stated in a different response that I believe that the number of $30M attacks that could do $300M in damages probably exceeds Maersk's profit if they paid for all of them at $30M, let alone paying extortion at $100M or having the attack follow through at the cost of $300M. Therefore, in the long run the potential market size is enough to destroy Maersk.

As a mildly related note, if anybody here is a member of the infosec community I have a question:

How much do you think it would cost for a targeted attack to breach and cause significant damage to the best system you have every personally observed? How did you verify that number? Three pentests by three different competent companies paid that amount and that found no vulnerabilities of note would be convincing. I would likely find other things on that general level convincing, but I can not declare them off-hand.

<comment><USER24> > I disagree that any particular infosec organization is equipped to deal with > problems of this class in any meaningful way.

FAANGs are bigger targets and yet none of them suffered anything remotely similar.

> An attack, able to do $300M in damages that Maersk can not prevent after we > have assumed it already did the best it possibly can, should be able to > support a $100M extortion payment.

That's incorrect. I already mentioned it in another reply, but in short it does not matter that attack caused 300M in damages. What matters is how much Maersk could possibly save by paying out ransom. And that's a fraction of those 300M not even including secondary effects such as potential problems with tax office, reputational damage or having to deal with becoming a target #1 for every other ransomware crew out there - as they just proved that they are ok with paying out for such "unsolicited penetration tests". It also misses that even if Maersk payed out 100M, criminals wouldn't have any way to actually benefit from all of that, as laundering such amount of BTC isn't trivial and historically that's exactly the step with highest risk for the criminals.

> How much do you think it would cost for a targeted attack to breach and > cause significant damage to the best system you have every personally > observed?

That's a non-answerable question as it does not mention other resources that are available to attacker besides pew-pew internet weapons, restrictions that they potentially face, the risk they are comfortable with, and basically all of these questions applied to the defensive side as well (i.e. on a furthest side of the spectrum there are certain systems, attacking which would put you above ISIS leaders on a to-be-droned-soon list).

<comment><USER23> That is not an unanswerable question at all. To clarify, I am literally asking for a simplified threat model. Take an existing threat model, reduce it to cost of doing those actions, done. Order of magnitude is fine. If there are parameters, pick a set of parameters within the non-totally-stupid range and state them. Estimate when reasonable. The question is just me looking for broad strokes anecdotes.

<comment><USER24> > To clarify, I am literally asking for a simplified threat model.

That's a simplification beyond any usefulness. You wouldn't be able to do as much damage with $100k budget in a few months as a well-staffed national agency in a week.

> The question is just me looking for broad strokes anecdotes.

Even Jeff Bezos wouldn't be able to orchestrate a cyberattack that crashes International Space Station with astronauts aboard.

<comment><USER23> I do not care what parameter set you choose if you actually want to answer the question. Pick one, state the parameters, and then specify it.

To illustrate:

How much damage could somebody do with a $100K budget in a few months to the best system you have been personally involved in?

How much damage could a well-staffed national agency do in a week to that system?

For all credible adversaries that could cause $X in damage, choose the 20th percentile cost adversary, how much would that cost?

The question is also specifically limited to systems the answerer has worked on to avoid speculation on practices or "grass is always greener" mentality. Did you work on the ISS on software or software security?

Jeff Bezos has over $100B. Therefore, I take your answer to mean:

With $100B nobody could orchestrate an cyberattack that could crash the ISS?

The cost to develop the Stuxnet attack has been estimated to be $1M according to former director of the NSA General Hayden. This is likely an underestimate only accounting for the cost of the exploit itself. Kaspersky Lab claims it cost in the regime of $100M to develop and deploy. So, lets take the high number and multiple it by 10 leaving the cost of disabling the secret air- gapped Iranian Nuclear Weapons Program at $1B. Do you think the cost of a critical attack against the ISS is 100x higher than a critical attack on the Iranian Nuclear Weapons Program?

Please avoid limiting your imagination to just direct attack on the ISS itself. There are multiple entities which when attacked would likely be able to de-orbit the ISS and kill all the astronauts. Please verify that none of these could occur for less than $100B: taking over a rocket to the ISS, taking over a rocket to LEO, active satellites in the correct orbital plane, decommissioned satellites that are no longer tracked but with enough fuel to intercept, scientist laptops that connect to the ISS network, over-drawing the laptop batteries so they blow up while in the ISS, etc. This also ignores more clever tactics you could do with $100B such as buy a company directly supplying critical needs of the ISS and then insert backdoors into the software.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Why good people leave large tech companies - <AUTHOR> https://venturebeat.com/2017/07/11/why-good-people-leave-large-tech-companies/ <comment><USER2> Observation: So if it had been the practice to hire "adult supervision" for young innovative founders at startups, why is there such a disparity in the number of startups with individuals with great ideas, Drive and ability who are in their 40 to say mid fifties. Given that most startups are rapidly grown and acquired or go public in the first 5-7 years, if that long, surely SV can see the benefit of funding startups based on idea, Drive and ability rather than just on age, idea, etc.

Out of curiosity, what are the ages of the oldest startup team ever to go through Y Combinator? Not the average age of founders but the oldest. The application clearly asks for founders ages but is there a cutoff age that would not even be considered regardless of idea?

</comment><comment><USER3>
      Over the six months after his department relocated to the East Bay, 55 of the 70 employees in his group
       who were asked to relocate left. 25 of them joined his new startup.

This sounds to me like sabotage on his part, planning to harvest preferred members of that team for is own interests.

<comment><USER4> Uh, sabotage? The author indicated that this company underpaid employees and treats their needs and quality of life with indifference.

If you're talent is a resource, then the company mantra should be "We are lucky to have you as an employee" not "you are lucky to work for us as your employer".

That, or actually make the place a lucky place to work. Pay well, provide great benefits, create a great workplace. There is a HUGE difference between saying people should want to work for you vs. actually being a place people want to work.</comment></comment>


Getting started with Rubinius - <AUTHOR> http://redartisan.com/2007/10/5/rubinius-getting-started <comment><USER2> Knee-jerk reaction: And make it even SLOWER?</comment>


Why do Sloths move so slowly? - <AUTHOR> http://www.bbc.com/future/story/20190828-why-do-sloths-move-so-slowly <comment><USER2> TLDR?

"All six species of sloths live in tropical forests. It's a hot and humid environment that means some of the normal advantages of an endothermic system aren't really required – the environment's already warm, so you don't have to expend an enormous amount of energy to keep your muscles and cardiovascular system warm. So sloths don't."</comment>