Recommend a Founder for YC - <AUTHOR> https://blog.ycombinator.com/recommend-a-founder-for-yc/ <comment><USER2> Does YC still require founders move to the Bay Area? That is a significant burden for say, older founders with families.

I mention that because the pitch says:

"We know that great founders can come from anywhere — any city, school, country or background"

But the application form says:

"If we invest in you, your group is expected to move to the Bay Area for June–Aug 2017."

There's a bit of a disconnect, and I'm curious how it's reconciled.

<comment><USER3> YC is only 3 months. Last I checked they still expect you to come to the bay area, but only for those 3 months. After that you can do as you please.

I know this may be challenging in some situations, but I doubt YC could offer the same value remotely. For starters, many of the talks given off the record would never happen if they were being streamed and could easily be recorded. You also would have less interaction with fellow batchmates, be less involved in group office hours, and a myriad of other small details that come from being present.

For remote to work (at YC or in the workplace) I believe it needs to be fostered and prioritized, and YC as it is now was never built around making remote work. If that is ever going to work I suspect an entire batch would need to be remote and the entire experience redesigned for that batch, and that doesn't appear to be a priority for YC.

<comment><USER2> I'd be very interested in better understanding what it takes to make something like YC work remotely. Indeed, if I ever left my own job to start a company again, this is the space I'd like to explore most.

It feels to me that there's an incredible untapped potential of talent that simply can not relocate or even come to an office on a regular basis (due to disability, economic reasons, visa status, age, family obligations, etc).

If we can unlock that potential then there is so much more we can do as a society.

If anyone at YC (or anyone else) is interested in talking, please reach out.

<comment><AUTHOR> I talk to a lot of international founders and one of the biggest obstacles they face is fundraising. In some places, it's easy to raise seed, but hard once you hit Series A territory. In other places, it's even hard raising seed. The Bay Area has a huge population of angels. In the Bay Area, you're also surrounded by a large population of startup founders who can help you. If you're building a startup community internationally, you'd have to build both a community of angels and a community of experienced founders. It's a sacrifice for many founders to come to Silicon Valley for three months, but at this point in history, I believe it still helps most companies immensely.

<comment><USER2> I don't think anyone would argue against the advantage of being there in person.

The question to me is this: can we make it better for people who can't be there? (I.e., raise the foundation, not debate the ceiling.)

</comment></comment></comment></comment></comment><comment><USER4> I've noticed a lot of effort over the past year to get more startups interested in YC (deal flow). I'll say what I hear a lot of startup founders saying now -- YC is just not the same anymore. It's lost its appeal and exclusiveness factor. People are just turned off from it.

I hope some of the YC team reads this comment and takes heed.

<comment><USER5> Can you recommend somewhere else then?

<comment><USER6> An overlooked alternative is to:

1) Reduce your burn rate. 2) Save up enough money to live off of for a year. 3) Bootstrap your startup off your savings.

I am going to make a guess that many of the strongest startups will be produced from this procedure.

Getting funding, from YC or elsewhere, has a way of changing your startup in a way that makes it much less likely to succeed. They have said so in fact -- they want you to fail quickly.

<comment><USER7> _They have said so in fact -- they want you to fail quickly._

That doesn't make you more likely to fail though. Quite the opposite on the long run.

<comment><USER8> "That doesn't make you more likely to fail though"

Actually, it does. They want you to fail quickly so they can (in)validate your initial business plan. But business plans for start ups that don't fail quickly often evolve through one or more pivots.

For example, see slack and twitter.

<comment><USER6> Instagram also comes to mind.

</comment></comment></comment></comment></comment></comment><comment><USER9> I think a lot of early stage startups look up to YC acceptance as validation, but when you apply at the early stage, you get rejected almost automatically. Too much emphasis on number of users, revenue, etc. So a lot of potentially great startups die before they even see the light of day.

Feedback to early stage startups could encourage more founders to apply and keep going. Otherwise it's time consuming to put an application together.

I have a feeling that the next Facebook, Google, etc. will not be discovered in any accelerator program.

<comment><USER10> I would imagine that as investors YC would like to invest in the founders that look at users and revenue as validation of their ideas rather than acceptance into YC as validation. Not only does that show the startup is more viable but shows the dedication of the founders.

I agree with you on feedback. I would LOVE specific reasons why I was not accepted as it would give me very clear goals to shoot for. I also understand that the time to provide that feedback would be crippling to their own productivity.

(As an aside, I wonder if we are past the stage of another Facebook or Google. In a macro sense it seems as if we might be at a bit of a pullback from globalization and a result of that might be less new large global companies. I wonder if the next global companies of that size come from India or Brazil but for that to be the case the company would really need to come at the same time of massive economic growth and reduced corruption.)

</comment></comment><comment><USER11> YC is failing in the same way that so many once-great startups fail. They're not innovating or reinventing themselves, at all.

And YC really does need to change with the times. Paul Graham was the big reason people wanted so badly to get into YC and he's essentially gone now

It's now obvious to everyone that YC can't grant success to founders, it can "only" grant opportunity.

So why not admit that YC needs good founders more than good founders need YC? It's always been true but now it should be obvious to all.

So, drop all the fake eliteness, secret panels of "experts", and insider-club mentality. Just straight up tell founders what the requirements are for YC funding and then fund them!

For example say that all YC startups need:

1\. One competent programmer willing to dedicate years. 2\. At least one other person willing to dedicate years. 3\. A _Launched_ and _usable_ prototype software.

What else do you need to know, whether they went to the right school? Whether they're attractive??? How good their spoken English is???

<comment><USER12> Honestly - it would make our jobs so much easier if there was a simple guide on how to figure out what makes a good startup. The problem is that a successful startup is the exception. It is hard to design a process to find outliers.

Here are some links to guidance we provide:

[http://www.ycombinator.com/howtoapply/](http://www.ycombinator.com/howtoapply/)

[http://www.ycombinator.com/faq/](http://www.ycombinator.com/faq/)

[http://www.paulgraham.com/start.html](http://www.paulgraham.com/start.html)

Here are some questions I ask myself when reading applications:

Can they build their own MVP? Is there a massively unequal equity split? Do the founders have pre-exisiting relationships? Do they have a non- obvious/controversial insight on their space Is the problem being solved significant (problem a lot of people have or people pay money for)? Am I impressed with the progress they have made since starting? If they don't get into YC - will the continue working on this company?

<comment><USER13> >If they don't get into YC - will the continue working on this company?

I applied last batch with ICanPriceIt.com, have a functional MVP but no traction and didn't get an invite.

Since then I've spent more time working on my Amazon reselling business- I'm a lot more passionate about the startup ideas I have, but not confident enough to shut down my profitable business to work on those. In other words, I'll very likely only work on this company if funded, or it might take a year or two before I'm comfortable enough to self-fund.

My understanding is that that hurts my chances of getting into YC significantly. Is that correct?

Is there any chance of YC funding a regular boring reselling company? There's little chance of being worth $1 billion ever, but there are several ones in the $100 million range (etailz sold a few months ago for $75 million, pharmapacks is selling over $100 million a year). Should I try applying for that business?

</comment></comment></comment><comment><USER14> There should be more ways to get help if you are at a pre-YC stage. I'd imagine there are a lot of startups that fail before they get to a YC stage.

Startup School is good but it's not ongoing. Most VC firms have been more helpful than YC in the early stages personally.

For example, I've had VC firms write me a letter of recommendation for a visa when that's not something YC would do.

I can see YC is trying to increase flow. Why not make it more organic?

<comment><USER15> YC does write letter of recommendations for visas once they get to know you (ie once they've funded you). I'm sure individual partners do this as well for founders they know personally and are outside YC, I doubt VC firms do that without knowing you personally.

<comment><USER12> In fact I sign all of YC visa recommendation letters so just want to give a +1 on this comment :)

</comment></comment></comment><comment><USER16> Best of luck getting much of the world to apply in the next couple months with so much visa uncertainty for the next 4 years.

What is your plan for founders who get turned back at the airport if they chose you? PHD-in-progress wasn't good enough reason to enter the US last week and you want the _smart_ people to apply for something in months.

What happened to YC's remote etc stuff? That would have been helpful about now.

<comment><USER12> as referenced in another comment: [https://twitter.com/sama/status/821538708943880193](https://twitter.com/sama/status/821538708943880193) reply

</comment></comment><comment><USER17> I don't mean to flamebait or troll or anything, but lots of the "misconceptions" seem grounded in data, based on the very data that you're putting forward:

[https://blog.ycombinator.com/common-misconceptions-about- app...](https://blog.ycombinator.com/common-misconceptions-about-applying-to- yc/)

> Misconception: Only US companies get into YC.

> S16: 29% were from outside the US.

So it's mostly true.

> Misconception: I need to raise a seed round before I apply to YC.

> S16: False. 14.2% of accepted companies weren't even incorporated when they > applied.

So it's mostly true.

The list goes on and on. Not that it removes the merit of YC or anything, but, hey, mind neutering the PR/marketing BS a bit to give the actual picture without trying to paint lipstick all over the pig? ;-)

The way that FAQ or whatever it is reads atm is: "Our deal flow is not as big as we'd like, so please send more applications in so we can show we've tons of demand to those we raised funds from and ensure they'll invest again because we get to be picky since we're _hugely_ popular!" Which is PR/marketing at the end of the day, but just don't be misleading to would-be founders.

<comment><USER12> So the reason we did this is not because of deal flow. Over 7500 companies apply to YC every batch and only 100-150 get in. The reason why we did this is cause the number one reason why companies don't apply to YC is because they don't think they can get in and the number one myth about getting into YC is that you need an alum to recommend you. We thought that opening up the recommendation system would allow any founder to ask anyone who believes in their company to recommend them (even if they don't know a YC alum). Also, it allows anyone working with a good founder to give them some additional confidence when applying to YC.

<comment><USER18> "the number one reason why companies don't apply to YC is because they don't think they can get in" \- and 98% of them are correct to think that in each batch. It's certainly in YC's interest to encourage as many applications as possible, as YC's option to say 'yes' or 'no' is always worth >= 0, but I suspect that for many startups, it's not worth the distraction. So YC can have lots of applicants, a very small admit %, and still be better off with even more applicants.

"54.7% did not have a recommendation." (regarding accepted companies) - founders who are applying are not interested in the "percentage of accepted founders who had a recommendation", it's "what is my chance of acceptance with a recommendation?" vs "what is my chance of acceptance without a recommendation?" For example, if say, 50% of 150 'recommended' founders are accepted, while 1% of 7350 'unrecommended' founders were accepted, you would get similar numbers to those published.

</comment></comment></comment><comment><USER19> Tossing in an idea: Why not use a rolling application process where founders can update YC on any progress they are making with their startups and an internal system ranks and reddit-scores the startups. YC can jump in and send a note to a founder any time - like an internal advisory board. When application times near, just send a note to the founders you find promising based on your scoring system and they can provide additional info like a video or join an interview if needed. This approach would give YC a lot more data and be less distracting to founders. If you want to reduce volume, just ping companies you know are not VC fundable and let them move on.

The deadline-based application process is distracting. While the application is helpful, and should be kept, the founders are expected to waste time and attention every 6 months wondering "but what if my next 3 out of 6 months are committed to YC". Now requesting recommendations adds just one more distraction. People who are committed to work on their project will likely apply multiple times to an ever-decreasing odds process.

If you keep the application open year-round we can just direct information your way whenever it happens and use it as our own benchmark. Just a thought.

</comment><comment><USER20> What exactly does this do? Clicked the links and it's not clear if YC is just request the community send links to the YC Application page, of if something else is going on.

<comment><USER21> It lets you sign up and provide a more detailed recommendation for an individual or team that you think should apply to YC.

When you provide a recommendation, we reach out and encourage them to apply. You can also track the status of all your recommendations and see how they did.

<comment><USER22> Is this the best mechanism for YC backed founders to recommend other founders who they already know are intending to apply to YC?

<comment><USER21> Yes.

</comment></comment></comment></comment><comment><USER20> For those that do not click the links...

Applications for YC Summer 2017 are open now: [https://news.ycombinator.com/item?id=13600594](https://news.ycombinator.com/item?id=13600594)

</comment><comment><USER23> Kinda related to some of the discussion. Is there anywhere within 2-3 hours of the Bay Area where one could start a company yet have a normal house with a normal yard for a family?

<comment><USER24> Most of the populated areas within 2-3 hours of San Francisco (and an even greater ratio of those within 2-3 hours of any part of the Bay Area) meet that description.

</comment></comment><comment><USER25> For a minute I thought it would be a service to match founders of fail startup from previous batches with others entrepreneurs willing to apply. I would definitely like that.

</comment><comment><USER26> For some reason, they just keep refilling this piñata.

</comment><comment><USER27> I'd like YC to maybe do a blog-post or give some insight into what they are doing here, what they are planning to accomplish, etc. Though that may spoil the data they are trying to collect??

</comment><comment><USER28> So does this mean that I should contact people in my network to go and recommend me?

Is YC going to read all these recommendations or is it going to be only forwarded to the person applying?

</comment><comment><USER29> Don't get it. You're supposed to recommend a founder but end up on an application page? I don't want to apply - only recommend!

<comment><USER21> Try this link: [https://apply.ycombinator.com/organizations/new](https://apply.ycombinator.com/organizations/new)

</comment></comment><comment><USER30> > If you know someone working on a startup who we should encourage to apply > for the Summer 2017 batch, recommend them here.

What the heck? This post reads like YC can't find enough founders (in quality + quantity) already.

If so, is it due to the changing landscape of startups themselves or the shift in focus from startups to left leaning political ideology?

</comment><comment><USER31> I'm curious how much does it cost to rent for 3 months near YC campus for 3 months?

<comment><USER32> If you are looking for a 1-bed apartment, it will cost around $1600-2000. You can find something for less if you are willing to live in a smaller place.

</comment></comment><comment><USER33> YC should have branches for europe and asia.

</comment><comment><USER34> The RMS Titanic?</comment>


Control Adobe Photoshop from Node.js - <AUTHOR> https://github.com/subtleGradient/node-photoshop

<comment><USER2> interesting code. Is there a blog post with it?</comment>


How can I get my motivation for web dev back? - <AUTHOR> https://www.reddit.com/r/webdev/comments/5qfxtn/how_can_i_get_my_motivation_for_web_dev_back/ <comment><USER2> I felt the same way when mainstream web dev moved from PHP/Java to Rails/Django. Although I moved from PHP to ruby on rails, I couldn't get as much confident in the code as I was back in the PHP times. Some years later (and until today), I found in JavaScript (a language that I already used well in the PHP times with jquery) and Clojure(Script) the motivation I had when I first started. I don't know if this helps, but tldr; would be this is cyclical. Stick on for a longer time and you'll start to recognize trends and how to follow or adapt.</comment>


Show HN: Made an app to automate viewings when selling, (sub) letting your house - <AUTHOR> https://viewingbooker.com <comment><USER2> Nice! As a person who very recently did a lot of looking around for the purpose of renting, I had a tough time managing my own appointments. I also found it really hard to get through to agents. Some of them would not return your calls, others mail boxes would be full, some would have their land lines advertised so you could not send a text to them. I am just thinking that this would have been a great way for me to set up viewings. I realize that your app is looking at it from the other side (that of the landlord) and for that the idea is great. I also wish there was an app that could streamline bookings for me as an individual and show them all in one place. This app is really required in today's times when people are moving from one place to the other. Great effort and all the best.

<comment><AUTHOR> Thank you for your feedback, I really appreciate it. As attendee you need to create your Viewing Booker account and it is exactly for that purpose of having all your bookings in one place. Say you are going to view 3 different properties, they will all be available in your dashboard, ordered. Also, when booking other viewings, app will check if you have no other bookings overlooping + some spare time for getting from one to another.

</comment></comment><comment><USER3> Just noticed the images look like the balsamiq mockups still.</comment>


Tracing stolen Bitcoin, using a precedent from 1816 - <AUTHOR> https://www.lightbluetouchpaper.org/2018/03/26/tracing-stolen-bitcoin/ <comment><USER2> Their example is a wallet with 10 bitcoin, 3 were stolen.

* poison: all BTC is the wallet is considered stolen, and all BTC in every wallet the BTC moves through from there is considered stolen

* haircut: BTC in the wallet is considered 30% stolen, and it's diluted as the money moves through other wallets

* FIFO (their solution): the first 3 BTC transferred from the wallet is considered stolen

But, the principle given in the paper is "nobody can give what isn't theirs". Why isn't it the _last_ 3 BTC transferred from the wallet that's considered stolen? The wallet had 7 legitimately acquired BTC to spend, so why isn't spending beyond that 7 what's tracked?

Someone could have a wallet or bank account (from the 1816 example) and not know stolen amounts were given to them. The first amount they spend should be considered legitimate.

<comment><USER3> The FIFO method doesn't track the first 3 BTC, it depends on what the first transfer into the wallet was.

If the first transfer in was 3 tainted BTC, it taints the first 3 out. If the first transfer in was 2 clean BTC and the second transfer in was 3 tainted BTC, it taints the 3rd, 4th and 5th BTC transferred out.

They don't seem to really have a way of measuring where the illicit value actually goes, so the comparison is just hand waving (in terms of forensics that's what tainting is for anyway, enumerating the accounts to consider; enumerating less accounts isn't necessarily an advantage).

</comment></comment><comment><USER4> This is not a technological solution. It's an attempt to create a legal convention of applying a particular form of centralized blacklisting.

The power of this method is directly proportional to how widely it's adopted.

And the reference to a precedent gives a false sense of legal legitimacy to this form of blacklisting. The decision referenced dealt with creditor claims to a shared asset.

The relevant legal precedent is from 1749. That's when a court sided with the Royal Bank of Scotland in its legal challenge to a request for a blacklist for notes used in crime. The RBS argument was that making money responsible for the acts of its previous holders would "render the Notes absolutely useless":

[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2260952](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2260952)

For hundreds of years, that has been the legal treatment of cash, which has facilitated commerce, by making cash _fungible_.

Jurisdictions around the world have been steadily degrading the principle of fungibility over the last 40 years to institute a mass surveillance system to stop the drug trade, money laundering and income tax evasion (it's worth noting the income tax didn't exist in 1749).

The result is concentrated power structures accumulating ever greater bureaucratic control over the traditional financial system.

<comment><USER5> Well it seems like even the actors who influence the G20 finance minister talking heads[0] cant even agree on what to do, except for asserting that somehow they will need to be in charge.

I think that concentrated power structures (that exist today or evolve in time) that can exploit this environment will win in the long run, but it won't necessarily be in any particular nation states interest.

[0] [https://www.euromoney.com/article/b17jt5vnb3fn3m/g20-ministe...](https://www.euromoney.com/article/b17jt5vnb3fn3m/g20-ministers- wrestle-with-cryptocurrency-oversight)

<comment><USER4> Any centralization of a sector of an economy needs to be politically coordinated so the fact that the G20 heads don't agree on a plan is promising. I think it's possible some of finance ministers of the G20 members like the disruptive potential of cryptocurrency.

</comment></comment></comment><comment><USER6> With BTC you can have multi input multi output transactions: in the same tx you can spend 2 legit BTCs and 2 stolen BTCs and send those to 8 addresses, each getting 0.5 BTCs.

Which of those resulting addresses contain tainted BTCs and which contain the clean ones?

A transaction such as the above would make it clear that the thief has control over the whole stolen wallet, but that's it. It doesn't mean that the recipient's addresses are thief's addresses, even though they could be. And we can't consider all of the end addresses as tainted, because what happens when the thief sends some of these to the address holding the silk road BTCs confiscated by the feds? Will they arrest themselves?

<comment><USER7> There's still a 'native ordering' of the inputs and outputs, so this FIFO process will still be able to 'taint' a specific deterministic set of the value-units, across one or more of the outputs.

Whether that's a fair allocation of the taint is a separate issue. They have a case, in some jurisdictions based on that precedent, that the law would support their allocation, and further that this treatment has other efficiencies.

It's sometimes the case that laws are construed to be predictable, and easy- to-apply, rather than maximally 'fair' according to deeper subjective case-by- case analysis.

<comment><USER6> Indeed, there is an ordering, but that's decided exclusively by the creator of the transaction, so he could easily manipulate the future tainted addresses.

The FIFO (or LIFO for that matter) rule seems like an arbitrary chosen one which could easily be overcome: the thief can put the stolen funds in an address and only use those when the atomic swap protocol between chains is created, for example. Or exchange those funds on decentralized exchanges, or sell on localbitcoins.

This is an example of a transaction with multiple inputs, multiple outputs: [https://blockchain.info/tx/1952ae67f75707e8a357cb40cc4e2123c...](https://blockchain.info/tx/1952ae67f75707e8a357cb40cc4e2123c7e4d1310ce805c62469a778d2dc595d)

The creator of such transactions can manipulate the order in both inputs and outputs.

<comment><USER7> Yes, the possessor can control where the 'taint' goes by their spending choices, just like someone with stolen property can choose who to give/sell it to.

The point of this FIFO method isn't exclusively — or even primarily — to outwit thieves. Rather, it's just to have a tractable (and legally-based) rule for deciding which balances, arbitrarily later, can be deemed 'the stolen amount'.

</comment></comment></comment></comment><comment><USER8> This seems like precisely the thing that a mixer service exists to defeat. I'd be curious to see how effective the approach is after the coins pass through such a service.

Personally, I remain unconvinced that coins could be reliably traced through an "ideal" mixer service that moves a large number of coins between a large number of addresses via a large number of transactions.

Edit: A further requirement would be that the service would have to involve a large number of "legitimate" coins. This does disregard the possibility that the so-called legitimate coins would be considered illegitimate simply by association with said service.

That said, perhaps the difficulty lies in actually meeting such requirements.

<comment><USER9> Mixer services exist to facilitate money laundering and the transfer of stolen propery, so they are perpetually at risk of being shut down.

<comment><USER10> They also facilitate privacy.

I never used crypto for illegal purposes, but I still don't wish for people who receive coins from me to know the state of my main accounts.

</comment></comment></comment><comment><USER11> So basically you just assume the first coins out of a freshly-blacklisted wallet are stolen?

Does that accurately model human behavior? Will it continue to once said humans learn of that technique?

<comment><USER12> It seems that if you can just blacklist coins, and since eventually bitcoin will be all mined out (for all practical purposes) that eventually all bitcoins would become tainted since humanity will always have crime and money laundering. Am I missing something here? I'm sure gold was used for all sorts of nefarious uses but nothing stops that "bad gold" from going back into the gold monetary system. This just seems like a bad idea all the way around.

</comment></comment><comment><USER13> The problem with this method, is it gives bad actors complete control over how and where the "bad" coins go just by doing some structured transactions.

<comment><USER14> 1\. borrow n coins

2\. deposit n stolen coins

3\. withdraw n coins (clear)

4\. settle loan with tainted coins

<comment><USER15> Also:

1\. steal n coins from Bob

2\. steal n coins from Alice

3\. move these 2*n coins to the same addresse.

4\. give n coins to Charlie: these are stolen from both Alice and Bob.

5\. the remaining n coins are clean.

<comment><USER16> Nope, after step 3, the first 2*n coins coming out of that address are tainted.

<comment><USER15> Only if they are tainted with the same "tag". What if one of the theft is only recognized in one jurisdiction? What if Alice and Bob separatly track their coins?

<comment><USER16> So, say Alice her money was transferred first, and bob's money second.

Then, after you've spend N coins, anyone looking for bob's coins sees you no longer have them. Anyone looking for Alice's coins sees they are still with you. This is because it is FIFO, so the outgoing transaction is only spending from Bob's coins.

</comment></comment></comment></comment></comment></comment><comment><USER17> I found the computerphile video odd, for reason's I hope I can elucidate below:

1) It seemed to suggest that the increased precision given by this approach is somehow surprising. It totally isn't? I mean, the difference between taint-all (poison) and this approach is in the branching factor, you don't have to run the experiment to see the outcome?

2) The choice of FIFO is very weird ( _I_ don't really care about the case law.) For a given branching factor, surely there are numerous schemes that could be considered, and they don't seem to discuss the merits of any others. Off the top of my head LIFO seems to correspond much more naturally to intuition, but I think there is a better answer than that. If a untainted priority scheme was used, whereby tainted coins were always spent last from a given balance, then this would have the effect of keeping the taint as close as possible to the original thief, and separates the bizarre relationship between cash-flow and culpability that FIFO introduces.

</comment><comment><USER3> This is an interesting discussion of the precedent:

[http://thestudentlawyer.com/2012/04/17/a-critique-of-the- rul...](http://thestudentlawyer.com/2012/04/17/a-critique-of-the-rule-in- claytons-case/)

In the case, the funds transferred out of the account were treated as "dissipated" and thus unrecoverable. The case was about deciding between claims from innocent parties for money remaining in a mixed bank account, which is quite a different activity than tracing the flow of the stolen value.

</comment><comment><USER18> I think the better method would be FBIFO (no pun intended)

FBIFO = first bad coin in - first out. Presumption is that bad coins are urged to be laundered first. So even if good and bad are mixing in - the bad ones ought to be first out

</comment><comment><USER19> What happens if the bad actor desides to spend some amount of the stolen currency to taint random wallets?

<comment><USER16> Those wallets spend the money, perhaps by burning it, and immediately become untainted. I think this is why FIFO is a better system that LIFO.

<comment><USER19> But if they are tainted on what can they spend that money?

Say I have 10 BTC you transfer me 3 stolen ones I want to clean my wallet where do I transfer those 3 BTC and what happens to that wallet?

What happens when you don't actually notice that it happened and try to purchase and item with your BTC? Do you get declined by the merchant because some % of that was tainted? If so how do you get that translation reversed?

<comment><USER16> If you get those 3 stolen coins, and don't want them. The easiest is to just transfer them to a burn-address. If you fear people are ever going to demand it back, either try to transfer it back, or transfer it to a separate holding wallet. Authorities might also set up a special address for collecting these kinds of coins.

This makes me think, what happens to fees? Suppose I take those 3 BTC and 'burn' it by creating a chain of 100 transactions, each with a fee of 10%? At the end, all of the stolen coins have evaporated into fees. Are those fees tainted?

If not, miners could try to white-wash coins this way.

</comment></comment></comment></comment><comment><USER20> When first using Graphistry to analyze cryptocurrency transactions, a couple years ago, we did a cool mix of temporal (vs 1816) + poisoning. Full taint analysis... except only consider tainted after the first tainted transaction date. We loaded the full blockchain into memory and then ran this on the Silk Road bust. Real-time, pretty cool!

It worked quite nicely, and we quickly reproduced what showed up in court... and with some fun extras. Combining the temporal (NOT 1816) and taint approach was a good way to trace the incident. Superimposing on regular (atemporal) taint analysis gives a broader view of the crime network beyond the individual incident.

As folks are noting here, tumblers and exchanges still make this a mess, even for 1816. They can go off-chain. However, those are generally where governments want to intervene anyways. Either way, we traced the full incidents, including how the silk road was moving money around, with our approach.

If you're into this kind of thing, professionally or for fun, let us know! Wouldn't be hard to repeat with more specific variants of 1816.

</comment><comment><USER21> That's interesting, but it will still rely on some method of enforcement to do something about it, the entire point of bitcoins existence seems to be to make that harder.

<comment><USER16> The obvious place for enforcement is exchange to fiat. In the end, one might expect these tainted coins lose their value w.r.t. clean coins.

After all, some people will only accept coins that can be exchanged for fiat, and everyone prefers coins that everyone else will accept.

</comment></comment><comment><USER22> > the results are impressive, with a massive improvement in precision

I'd be grateful if someone who's watched the video could explain what they're measuring, here.

<comment><USER23> The previous method ("haircut" tainting) - wheretransactions from a wallet with "bad" bitcoins are marked as "X% tainted" where X := (#bad_coins / #total_coins) - quickly marked all the active bitcoins on the recent blockchain as ~10% tainted.

With the new FIFO method, the tainting doesn't dilute as quickly. The give an example of a "theft of about 1000 bitcoins in 2014 and trace it forward to 2016", poison tainting and haircut tainting affect ~1.5 million addresses. With FIFO tainting, only 11,000 addresses are affected.

<comment><USER24> This 'solves' the problem of dilution, but it does not address the issue of following the flow of tainted crypto-cash, because the root cause of that problem is that bitcoin do not have identities (they are bosons, not fermions?) This 'solution' is just one of several similar possible schemes that arbitrarily assign a provenance to each atomic unit of the currency, and is not fundamentally more sound than any other.

Any scheme like this is pointless without a mechanism to sanction the use of 'bad' bitcoin, and belongs in the realm of cryptocurrency regulation, not blockchain mechanics. A scheme something like this does exist for banknotes, in that if you are found to have a counterfeit bill, it will be confiscated. The only reason this does not have a stifling effect on the use of paper money is that the probability of this happening to you is slight.

</comment></comment></comment><comment><USER25> I steal 100 bitcoins. I then transfer a satoshi to as many legit bitcoin addresses I can find. Now any transaction those addresses make will be illegal?

<comment><USER26> No, any money in those addresses that was there before your dirty satoshi would still be considered clean. That's one of the claimed advantages of their technique.

<comment><USER25> I get that, but the first transaction they make is considered dirty. So everyone I transfered to is going to make an illegal transaction first thing they do...

</comment></comment></comment><comment><USER27> So if 2 good coins and 2 bad coins go into a UTXO, then that's split to a 3 coin and a 1 coin output, is the 1 coin tainted?

<comment><USER28> Depends on which one is listed first.

      3 coin wallet containing 2 tainted coins and 1 clean coin
      1 tainted coin and 3 coin wallet containing 1 tainted coin

</comment></comment><comment><USER29> If you want to get rich buying bitcoins you shouldn't complain if you lose all your money. We usually say "no pain no gain", right?</comment>


Passport queues vex airlines - <AUTHOR> https://www.economist.com/business/2018/08/18/passport-queues-vex-airlines <comment><USER3> >Airports are not helpless. In 2014 Dallas-Forth Worth airport in Texas paid for extra automatic passport gates to slash queue sizes. And airlines around the world often pay a small sum per passenger to speed business-class customers through special passport-control lanes. Many governments would gladly shift the cost of passport checks. Too gladly, reckon some airports, who fear the entire bill for passport control may eventually be dumped on them.

We've got TSA holding the nation's airports hostage back in 2015 by slowing EVERYTHING down in order to get more funding. Many airports/airlines now offering "expedited security" as part of their "pay for the oxygen on the plane" price plans, this on top of CLEAR/PreCheck. So now TSA knows they can do that, if they don't get the funding from the gov they'll just leverage schemes to get it from airlines/airports, as the article indicates.

I remember as a kid, my parents scrounged together enough cash for disneyland tickets, the flights there, and some nights at a motel. There wasn't room in the budget for comfort items like food on the plane, which back then was free. I can't go full grumpy old man mode cause I'm only 27, but damn does it feel like it will only get shittier and shittier to be poor in this country.

<comment><USER4> > There wasn't room in the budget for comfort items like food on the plane, > which back then was free

Are you allowed to take your own food on the plane in the USA?

When the airline doesn't give me free food, I'll often just pack my own. It's usually nicer than what they'd give me anyway. I'd rather a nice homemade bacon and egg sandwich than the shit they serve you on a plane.

Departing from New Zealand I've never had an issue bringing my own meal. Obviously I can't bring something to drink, but I can buy something after security.

The one that annoys me more than food is charging for luggage. Especially since some airlines will add a luggage fee for every leg of the trip, which can add up to be very expensive.

<comment><USER5> You definitely can bring your own food — except I guess maybe not something yogurt that's a "gel"? That's what I do and it's _always_ better than what they're serving, as long as you don't mind it not being hot.

<comment><USER6> Not sure how much food you can bring through security control. I've never tried more than a pack of gum.

You can buy food once you're in the secure area, of couse, but it's generally quite expensive.

<comment><USER7> I just made a special meal request, at the bottom of the page:

> If you can't find a suitable meal from the options we offer, you're welcome > to bring your own food. Please ensure it doesn't require heating or > refrigeration. Also remember to plan your meal around the security screening > restrictions on liquids, pastes and gels.

So go wild!

</comment></comment></comment></comment></comment><comment><USER8> > In Europe's Schengen passport area, they have grown since more thorough > checks were introduced last year owing to the migrant crisis.

For those not from Europe: You don't actually go through a passport check to travel between the Schengen countries (This is almost the whole EU minus the UK). Airlines - especially budget airlines - might sometimes check to make sure you haven't given your pass to someone else, and there will be a security check, but there is no border/passport check (also no e-gates).

Regarding the quote from the article above, that basically means that a lot (almost half) of the passengers are _not_ facing this problem because they are traveling between Schengen countries.

(off topic: great example of one of the benefits of the EU, in my opinion)

<comment><USER9> > For those not from Europe: You don't actually go through a passport check to > travel between the Schengen countries

Not exactly true. France has reinstated border control since 2015 due to the "emergency". Germany is talking about reinstating border control in places like Bavaria, though it's unclear whether they will have a hard border control, or whether they will simply profile people at the border.

<comment><USER10> Apparently they're only temporary controls... I drove from Spain to France a few weeks ago... there was a sign saying "France"... and that was it.

I had to Google for this: [http://www.blather.net/theblather/2016/01/crossing- border/](http://www.blather.net/theblather/2016/01/crossing-border/)

<comment><USER11> Depends on the border. For about two years after the attacks, the A1 (major highway between France and Belgium) was restricted to one lane, with barrier chicanes before reaching the border. Eventually the three bored policemen at the border left, but the barriers remained for a very long time.

</comment></comment></comment></comment><comment><USER12> Putting the cost of increased staff and gates onto the airports seems like a pretty obvious solution. Short queues can be a competitive advantage for an airport, and are obviously something that airlines (the paying customers at an airport) value. Increase the gate fees to cover the extra cost of more customs agents. It's the easiest way to pass the cost on to the actual users of the service, whether they're tax-paying residents or non-tax-paying visitors.

I'm not sure what the airport's argument is that they _shouldn 't_ be paying the full cost of passport control services. A service that only benefits travelers shouldn't be coming out of the general tax revenue funds.

<comment><USER13> Competitive advantage for an airport? Airports are chosen based on geographical location, not service. Most people live near one major international airport. There isn't some large market of with airports springing up all of the time, they are dictated by regulatory barriers and are natural monopolies.

Passport control doesn't benefit travelers, it hinders them. It benefits the security of the nation, which is precisely the purpose of the general tax fund.

<comment><USER14> Not at all. I live about halfway between two "major" international airports, each of which is about two hours by train. Or I have a local airport - <USER2> minutes by city bus - with a much more restricted flight selection. If my destination is London, that in fact translates to a choice of five airports at the other end; and if I decide, for example, that Heathrow is my preferred arrival point, that means not only will I have a very different experience depending on the airline and hence which terminal, but also means I can decide between a direct flight from either of those more distant origins, or to take connecting flights, and thus have a further choice to make in each direction when I may be able to choose between changing in Frankfurt, Vienna, Hamburg, Cologne or Brussels. For a frequent flyer there are so many factors to consider in choosing routes, airport competitiveness is very very important indeed. Recently my home airport had me fill in a passenger survey while waiting to board, designed to elicit my reasons for choosing that airport; they hadn't even begun to scratch the surface of the multiple variables I need to take into account when booking flights.

</comment></comment></comment><comment><USER15> It'd be nice if there was an actual global version of the American Global Entry/Nexus/Sentri system. I know coordinating between many countries would be a pain, and a lot of people don't like the idea of being added to a government registry and having biometric scans and a background check run, so such a system is probably not feasible for everyone.

However, I have zero regrets signing up for Nexus due to frequent travel to Canada. Nexus includes Global Entry and TSA Precheck for less than the price of Precheck alone. Flying between the US and Canada usually just requires a couple of taps on a screen and you're done with customs, and often times driving over the border I don't get any questions at all.

I do understand that we shouldn't have to pay for this expedited service and it should be available to everyone, but I'm constantly surprised by how many frequent US/Canadian travelers don't even know it's an option.

<comment><USER16> No, thanks. Countries should serve people by making border crossing fast for everyone. GE is an ugly workaround, and shouldn't be needed in any civilised country (and yes, my country has an efficient border, the absolute longest I've seen or even heard of on the news is a 15 minute wait due to unlucky arrival timing - EU/EFTA still had no wait on that occasion due to automatic border gates).

<comment><USER17> I think it should only be used to get back into your host country. When I'm travelling part of the nice thing of going there is to get a stamp in your passport.

<comment><USER18> Stamps are going away. Lots of countries no longer stamp passports, at least in some situations. Hong Kong, New Zealand, Australia, Canada, South Korea. The US will generally not stamp their own passports.

Frankly, I'm fine with it now that the US no longer lets you add pages to an existing passport.

</comment></comment></comment></comment><comment><USER19> I couldn't read the full article, but the Mobile Passport app has improved my traveling experience through passport control. On a recent trip from Europe to SFO, the regular line for US citizens was really long, the Global Entry kiosks were full, but there was no one in the Mobile Pass line. We went through passport control in under 3 minutes.

<comment><USER20> Same here. The Mobile Passport app has been around for what, over two years now?, and the % of people that actually use it is still very very low.

Last border crossing at MIA the Mobile Passport reader guy was standing there all by himself. Cleared in 30 seconds.

<comment><USER21> the first rule of the mobile passport app is _don 't talk about mobile passport_!! it is great, generally the same experience as global entry. and I'm worried that if more people use it, it will become as busy as everything else.

</comment></comment></comment><comment><USER22> This is definitely the result of unintended consequences.

They added specific lanes for nationals to use; nationals are the taxpayers therefore they're the ones who are most listened to. As a consequence the nationals lines were always fast and well staffed, while the international entry lines grew longer and longer.

If they hadn't have split the lines, everyone would be on the same "side" and complaints from nationals would result in improved passport control for everyone.

<comment><USER23> I just entered the US at SFO a couple of weeks ago.

There were big (permanent) signs up directing us to a citizens line and a noncitizens line. They weren't taking that especially seriously; there was also a staffer at the fork directing citizens into the noncitizens line and noncitizens into the citizens line.

My guess is that this was an attempt to balance the waiting time in each line. It was a horrible system, largely because the system was barely able to admit noncitizens at all. Both lines crawled as the noncitizens stepped up to a booth and were s-l-o-w-l-y fingerprinted and eventually waved on their way.

Contrast what happened just a couple weeks earlier when I entered China. Fingerprinting was required for entering noncitizens there too. But you didn't have it done at the booth while everyone waited in line behind you. You got yourself fingerprinted at one of a row of unmanned machines, got a receipt from the machine, and then went to get in line. All the immigration booth did was take your receipt.

<comment><USER24> What they do is as a plane arrives, they direct people to the appropriate side. The citizens line process a lot quicker, so as they get empty, some non- citizen queuers are told to move over to the now mostly empty citizen lines. Then the next plane's passengers arrive and the whole process is repeated. ie the primary goal is that citizens go quick, and the others are second priority. But as you noticed, it starts getting messy as multiple plane arrivals overlap with each other, queues progress at random rates, and it isn't a particular effective system anyway. The booths work the same way as you described China's, but have additional complications (eg people using the app, and the receipt.)

I had the misfortune of arriving on an international flight to SFO when they first got those booths. Some official decided to constantly shout and berate everyone trying to figure them out (he would keep contradicting the screens, or interrupt people trying to read them etc). Thankfully I haven't experienced that since.

And it used to be a lot worse. Instead of a single long queue, there would be long separate queues for each desk. It became quite an art trying to deduce which lines would process quickly.

<comment><USER23> > The booths work the same way as you described China's, but have additional > complications (eg people using the app, and the receipt.)

But when you use the Chinese fingerprinting machine, you're not holding up the immigration line. This makes a big difference in queue times! SFO is wasting an incredible amount of passenger time by making everyone in line wait for everyone else to get fingerprinted.

<comment><USER24> The last time I went through the lines at SFO there was roughly speaking a queue for the machines, and then after that lines for the booths & officers. If one person took 10 minutes on a machine, it wouldn't matter since the machine queue still flowed as did the booth queue. Have they reorganised it again?

<comment><USER23> When I entered on the 12th, ten days ago, there were no freestanding fingerprinting machines. (Actually, there was one, but it wasn't in use.) Instead, the immigration booth itself took your fingerprints using a much smaller machine. This is, obviously, a logistical disaster, and I'm stupefied that they were using a better system and threw it out.

<comment><USER24> Thanks for the clarification. My experience has been that every time I use the machines, they then retake the fingerprints and retina at the officer anyway. (This is possibly because I'm a green card holder.)

They also seem to have a wide range in staffing levels, and adjust what is "open" based on that.

You are right about the efficiency. Quite simply none of the people involved at that level have any incentive to improve it. It won't improve their pay and promotions, and the less efficient the bigger an empire can be built by managers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> > On August 13th Virgin Atlantic grumpily published data showing that Heathrow > hit its target for processing more than 95% of non-EEA passengers within 45 > minutes on only one day in July, with some waiting up to 156 minutes

I was one of those people, traveling to Heathrow at the end of July on an EU flight (from Berlin) on a US passport. It took more than 90 minutes to reach the front of the queue.

You'd think that it wouldn't take long to process people traveling from the Schengen area[0], but they have little incentive to make this faster, unless their domestic airlines (like Virgin Atlantic) start complaining.

[0] I'm aware the UK isn't a Schengen country, but that's the point: if you're going to have passport control at the border, _and_ if you're going to separate out people traveling on EU passports (which is more or less analogous to people from Schengen countries), then why such a delay for travelers coming from non-EU Schengen countries (like Iceland), or, for that matter, people who aren't traveling on an EU passport, but are coming from an EU country?

<comment><USER25> I've flown through Heathrow one time. I hope it will be my last. The lines and the crowding to get through passport control and security were unlike anything I've experienced anywhere else in the world. Thank goodness our destination has frequent flights from Heathrow, because we didn't even come anywhere close to making our connection.

<comment><USER9> > I've flown through Heathrow one time. I hope it will be my last. The lines > and the crowding to get through passport control and security were unlike > anything I've experienced anywhere else in the world.

I nearly missed a connecting flight in Heathrow earlier this year, because it took them thirty minutes to get seven people through security. I kid you not - I was seventh in line at security[0], and they were only allowing one person at a time to unload the contents of their bag onto the conveyor belt. They had five or six agents all "working" there, and a peak throughput of one passenger every three minutes.

[0] International flights connecting in Heathrow have to go through security again, even though they've already gone through security at their original point of departure.

<comment><USER26> > [0] International flights connecting in Heathrow have to go through security > again, even though they've already gone through security at their original > point of departure.

That's not terribly uncommon, or particularly unreasonable -- security standards and implementation vary significantly in different countries, and in as much as security screening is useful, you'd want to redo the screening with the local standards, unless you have separate facilities for international flights arriving from countries you know do a good job and other countries, but the customs/passport control section is probably shared among all international arrivals.

<comment><USER27> Transiting at Frankfurt airport, I didn't have to reclear security when flying from the US, but I Had to reclear when transiting through London Heathrow.

So apparently Germany trusts some countries' airport security, but the UK doesn't.

<comment><USER9> > So apparently Germany trusts some countries' airport security, but the UK > doesn't.

They apparently don't trust Singapore. I was on a flight from SIN->JFK that had a stop in FRA (we got off and got back on the same plane). We still had to go through security.

<comment><USER28> I don't think it's Singapore specifically, seems like all flights incoming to the US always have to pass through some sort of secondary security. For example, MUC->DUS->JFK required additional security when boarding the JFK bound plane (and it was additional even for those entering the airport at DUS).

JFK->SIN though we could get off and didn't have to worry about any security or immigration.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> This is because they have reduced staff numbers with the introduction of e-gates, so there is less flexibility to process peak queues. The KPIs are also very generous, 45 minutes is too long.

As an Aussie this pisses me off entering the UK. When Brits travel to Australia they can use e-gates, but the same courtesy is not extended back to us. Frequent travellers can pay to use the gates, but not everyone has that option. If the strategy is to use the gates they should make them as available as possible.

<comment><USER30> _When Brits travel to Australia they can use e-gates, but the same courtesy is not extended back to us._

Sure can. When I flew to Brisbane, no human inspected my paperwork. From plane to train, the only human interaction was someone taking a stub of something that came out of a machine and waving me through. Really smooth.

</comment></comment><comment><USER31> CBP has a pretty handy app to lookup wait times at US airports at [https://awt.cbp.gov/](https://awt.cbp.gov/) . Looking at the wait times for JFK for the past week, the maximum wait time for non-US citizens exceeded 120 minutes often.

<comment><USER32> Even US Citizens don't really get by much faster. I'm often corralled into the USC line because of some weird green card expiration issue and it's certainly not any faster.

<comment><USER33> Get global entry.

<comment> barrow-rider I'll second this.

I don't like the idea of a play-to-play line, but in a practical sense I travel too much to not make use of this.

<comment><USER33> Precisely. I am looking for other countries to adopt this for us-bound flights. Some airports have preclearence, for example. Would be great if i could use global entry in istanbul. I literally had to go through 5 security checkpoints just to get on flight.

I am going home goddammit, i wont do any harm.

</comment></comment></comment></comment></comment><comment><USER34> This is true for me.

I've cut my business travel a significant amount over the last years as a result of the time it takes to clear the border control in the US. In the past i used to fly the route between Europe and the US maybe 10-11 times a year, now at most 2. I will say i've always been met with respect when finally reaching the end of the line but the line has grown on average where a couple of years ago i had to stand maybe 45 minutes to being consistently over 2 hours. Came in to SFO a month back and had to wait in the line for 4 hours and 30 minutes. That's adding another 4 hours and 30 minutes to an already long trip.

The end result of this is that i absolutely try to avoid flying if i can, doing as much i can online.

<comment><USER35> I've cut my business travel _within_ the USA due to the variable time it takes to get through security -- on a good day I can breeze through in 20 minutes or less... on a bad day it can take 90 minutes or more. So to be assured of making my flight, I need to plan for the worst.

Even real-time security wait times are little help since even if it shows 20 minute waits 2 hours before the flight, an equipment problem or personnel shortage can make that wait much longer before I get to the airport.

<comment><USER36> Sign up for TSA precheck.

<comment><USER35> I did. Well, Global Entry. Still subject to equipment failure or other slowdown. Clear might be better, but I refuse to spend $179 to avoid an inefficient process I'm forced to endure - it's easier to just stop flying.

</comment></comment></comment></comment><comment><USER37> It would be great if that line chart with the wait times at Heathrow could be extended with the number of passengers who land, and the number of employees working border services. I would like to see if there is a correlation between the number of employees and the wait time, and if passenger numbers have increased or remained steady.

</comment><comment><USER38> Some flights you can/must? clear customs pre-flight. It's weird (well, maybe not so weird, airports are weird legal areas), as you are considered in u.s. territory even though your still in a foreign country.

<comment><USER39> Not considered US territory, CBP preclearance is just that, a preclearance. It's still under the jurisdiction of the host country. The CBP can and sometimes does conduct inspection on precleared passengers at the actual US port of entry.

<comment><USER40> > _The CBP can and sometimes does conduct inspection on precleared passengers > at the actual US port of entry._

How? I'm pretty sure that when I've flown pre-cleared from Canada and Bermuda, the arrival was to a non-international gate, opening directly out into the airport rather than via the side hallways that take you to border control. So if they wanted to check you on entry, what do they do, meet you at the gate?

Or am I just misremembering all this?

<comment><USER39> They can conduct inspections right at the gate. It's uncommon, but it happens.

Typically when this happens, the cabin crew announces that the CBP is conducting inspections outside the gate and asks passengers to get their travel documents ready. Outside the gate CBP officers will instruct passengers to form one or more lines and then inspect everybody's travel documents. Sometimes they only approach certain people and let most passengers walk by.

</comment></comment></comment></comment><comment><USER17> That was the article?

They're just reporting that there is an airport that is having issues with queue size and Dallas paid for more agents?

</comment><comment><USER41> So there's not money available to pay someone $18/hr to perform data entry and stamp passports but there is money available to pay someone $18 an hour to grope people and lecture them about what they can and can't bring past security. Top notch prioritization right there. Where is the oversight? Who is letting this happen?

<comment><USER42> Can you please not post shallow dismissals or ideological rants to HN? A substantive discussion needs to start out better than this.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment></comment>


Internet routers running Tomato are under attack by notorious crime gang - <AUTHOR> https://arstechnica.com/information-technology/2020/01/internet-routers-running-tomato-are-under-attack-by-notorious-crime-gang/ <comment><USER2> Including "running Tomato" is a great step. Too often, these warnings, which a great deal of the time are only relevant to machines running Windows, do not include "running X" in the title, so everyone, even those not running X, have to read the article to ensure they're not vulnerable. I believe journalistic integrity demands that the OS/App/whatever appear in the title.

</comment><comment><USER3> ... only vulnerable if the default has been changed to ALLOW remote administration, and are using the default admin:admin or root:admin credentials.

<comment><USER4> How big a group of routers is this? How does one get smart enough to go into the advanced options to enable remote administration, but not smart enough to set the root password first?

I partially blame Tomato for this. It shouldn't allow you to enable remote admin until you've changed the passwords.

<comment><USER5> Shodan returns some 5100 Tomato servers, with about 1500 running web services (presumably the remote administration). I would bet that a fair number of those 1500 servers (maybe 10%?) have the default password, but I'm not going to check.

</comment></comment></comment><comment><USER6> Why/how would you be smart enough to run custom firmware on your router, but not set your password, even while enabling remote administration?

(Are routers pre-loaded with Tomato being sold to naive people somewhere?)</comment>


Hacktivists Are on the Rise–But Less Effective Than Ever - <AUTHOR> https://www.wired.com/story/hacktivism-sudan-ddos-protest/ <comment><USER2> [https://outline.com/VhBTSN](https://outline.com/VhBTSN)</comment>


Show HN: Flutterbud: record videos with a scheduled showtime - <AUTHOR> https://www.flutterbud.com <comment><AUTHOR> Hi Guys, Flutterbud is my experiment while I was learning swift. The app lets you record videos and share with your friends at a scheduled showtime. The recipients cannot view the video before the showtime. I created the app using parse-server, S3, Heroku. Let me know if you have any questions.

Thanks</comment>