Notifying administrators about unhashed password storage - <AUTHOR> https://cloud.google.com/blog/products/g-suite/notifying-administrators-about-unhashed-password-storage <comment><USER2> This happens to include a nice two-paragraph summary of how password hashing works, that I think a non-technical person could easily understand. It's a shame they used the term "string", but it reads fine in context. I should save for future use...

\-----

> If you have a Google account, Google's core sign-in system is designed not > to know your password. How, then, can we verify your password when you sign > in to your Google account again? The answer lies in a bit of cryptography: > when you set your password, instead of remembering the exact characters of > the password, we scramble it with a "hash function", so it becomes something > like "72i32hedgqw23328", and that's what we store with your username. Both > are then also encrypted before being saved to disk. The next time you try to > sign in, we again scramble your password the same way. If it matches the > stored string then you must have typed the correct password, so your sign-in > can proceed.

> The effectiveness of the hash function lies in its one-way nature: it is > simple to scramble your password, but nearly impossible to unscramble it. > So, if someone should obtain the scrambled password, they won't be able to > recover your real password. The downside of password hashing is that if you > forget your password, we cannot show you what it was; there's nothing we can > do other than reset it to a temporary password (valid one time only) and > then require you to pick a new one.

<comment><USER3> Doesn't really explain that the "scrambling" is deterministic which is an important feature. In colloquial use "scramble" means to randomize, for example "scramble the code to your gym locker."

When you scramble your locker combo, is really is random. When you scramble your password with a hash function, it may look random, but it's really not.

Also just for fun, here's a creative stab at my own explanation.

As every dog knows, each dog has a unique smell. If you have smelled the dog before, then you can use its smell to recognize who it is, but without that past experience, nothing in the smell itself tells you who it might be.

The hash function creates the smell from your password, which is the dog. A website does't save a photo of your dog, just the smell. So if a hacker breaks in, they might smell your password but they can't see it. And when you login to the website, it makes sure your password smells right before it lets you in.

<comment><USER2> > Also just for fun, here's a creative stab at my own explanation.

I know you said "just for fun", but I really think we need to do better than these types of explanations.

I remember many years ago, I was wondering what the heck hyper-threading was, and I came across a video that compared it to a bowl of cereal. Even though you only have one mouth, you'll be able to eat the cereal more quickly if you use both your hands, instead of just one.

I watched this video, and felt gratified, and closed the browser window... and then suddenly realized that I _still_ had no idea what hyper-threading was, only that I should use both my hands if I'm ever in a cereal-eating competition.

A better explanation would have gone something like, "CPUs solve math problems more quickly than we can give them problems to solve. Hyper-threading queues up additional sets of problems that the CPU can switch to when it would otherwise be doing nothing."

Analogies are useful tools, but usually only after we have some understanding of the real version.

<comment><USER4> Analogies are great to _memorize_ the content. They don't explain the content because they're not 1:1 translatable.

<comment><USER5> Does that mean that analogies themselves are an analogy of hash functions?

(not serious; hope it is not against the guidelines)

More seriously analogies are better for a bigger picture of a complex system, as they effectively describe mode of interactions. The dog/smell analogy was not bad but you have to also add a role for the other actor in the system (here I would say: the third party, and the database)

</comment></comment></comment></comment></comment><comment><USER6> The ordinary response to notifications like these is, to put it bluntly and accurately, a rage-mob. But here you have a corrective, a case where that doesn't make sense. Because Google operates what is considered, by an overwhelming majority of expert opinion, one of the 3 best security teams in the industry, likely exceeding in so me ways the elite of some major world governments. And they can't reliably promise, at least not in 2019, never to accidentally durably log passwords. If they can't, who else can? What are we to do with this new data point?

The issue here is meaningful, and it's useful to have a reminder that accidentally retaining plaintext passwords is a hazard of building customer identity features.

But I think it's at least equally useful to get the level set on what engineering at scale can reasonably promise today.

 _correction: in the world - > in the industry_

<comment><USER7> For one of the world's best security teams, "rumor" has it that their password hashing scheme is very far from best practices...

<comment><USER8> What do you mean?

</comment></comment></comment><comment><USER9> My domain of 800+ users had one unhashed user. It was an account I created for testing something then suspended over two years ago. It never completed the first logon. I have many newer users that have not completed a first logon, yet their passwords are (apparently) hashed.

They said users created through admin console are affected. The might explain my nearly zero count. I've used GAM to automate creation for a very long time. We are a high school school so we churn about 1/4 of our user count every year.

<comment><USER10> I had the same thing happen, only one email. An account for my sister, actually. Turns out she has never logged-in either.

<comment><USER11> Same here: One user!

</comment></comment></comment><comment><USER12> the email I got said it was primarily accounts with one-time use and generated passwords were affected. I'm really confused as to why this isn't in the blog.

> due to legacy functionality that enabled customer Domain Admins to view > passwords, some of your users' passwords were stored in our encrypted > systems in an unhashed format. This primarily impacted system generated or > admin generated passwords intended for one-time use.

Sure enough, the accounts listed in the email as affected were never signed in and still needed a password reset.

The email: [https://i.judge.sh/Twilight/iRcF0e7D.png](https://i.judge.sh/Twilight/iRcF0e7D.png)

<comment><USER13> Same, the address in the notification email had never been signed in.

</comment></comment><comment><USER14> They sure liked repeating "secure encrypted infrastructure".

I was a little confused about the timeline of this as they mentioned implementing some functionality back in 2005. If I understand this right the specific issue of storing some (unsure as to what percentage or quantity) users passwords unhashed:

      - started in January of this year
      - is now fixed
      - were stored for up to 14 days in this state
      - would only effect new years signing up (based on it being part of the signup flow)

Do I understand that right?

<comment><USER15> Looks like two issues were discovered.

1\. All passwords set by admins for other accounts since 2005 were impacted. 2\. Also all passwords starting Jan 2019 were also stored un-hashed for 14 days.

<comment><USER16> I have no inside info on this incident and haven't worked for Google in over 4 years, but the description of the 14-day 2019-only issue sounds like it would have affected only a subset of users whose data they included in a sample for troubleshooting purposes. The sample rate they use is probably far below 100%.

(Once again: this is speculation based on general firsthand knowledge about how Google operates, but I know nothing specific to this incident.)

<comment><USER15> Yes, of course. Not all but a different subset of passwords.

</comment></comment></comment></comment><comment><USER17> Just had a thread yesterday where people raged at the very idea companies and organizations still use poor hashing algos.

Here we have google storing in plaintext by accident.

<comment><USER18> It can simultaneously be true that nobody should do this and that even the best people can make mistakes.

<comment><USER19> I am reminded of the discourse on hypocrisy in The Diamond Age. That we fail does not mean we are insincere in our aspirations to do good.

</comment></comment></comment><comment><USER20> I doubt Google would store passwords unhashed in a database - after all you check against the hashed record. This sounds like good old "accidentally logged sensitive data" issue.

<comment><USER21> Their control panel allowed domain admins to view these passwords. That suggests that they're telling the truth.

<comment><USER22> Those user are "password resetted by admin"

</comment></comment></comment><comment><USER23> I've always been intrigued as to why passwords are not hashed and salted client side before sending (and then hashed again on the server side). The usual argument against it is that SSL is better - but I don't see why it shouldn't be standard to do both. It would prevent issues like this (Malicious admins or compromised server) from ever occurring.

Assuming the salt is unique to the website it also solves the problem of users using the same password on many different websites - this would no longer be an issue.

It would also mean as an end user we can have a look at our login POST request and confirm our password is not sent and therefore cannot be stored in plaintext.

EDIT: I see the other discussion and understand the hash now becomes the password so if a hacker obtains the hash they now can login. I'm advocating for it to be hashed server side also, protecting the user from cases just like this one.

<comment><USER24> This is essentially the same as using a password manager since your browser (and all your devices) would have to know about your username/salt pairs.

<comment><USER23> Yeah very good comparison. And password managers are by all means the best way to go to ensure privacy. So I don't see why people argue against client side hashing.

<comment><USER25> I think they only say it's not perfect.

</comment></comment></comment></comment><comment><USER26> Strange... Didn't realize G Suite and Cloud Platform were well coupled, but it appears they must be.

I recently opened two of what I though were new 'consumer' Google accounts to be dedicated to managing Google Cloud Platform resources. On both accounts I'v also setup Identity & Access Management with an organization and additional sub-user-accounts.

Both of those parent account received this email warning about five hours ago...

Subject: [ACTION REQUIRED] Important Information about your G Suite Account

Google Customer Alert Dear G Suite Administrator, We are writing to inform you that between January 13, 2019 and May 9, 2019, an internal system that logged account signup information for diagnostic purposes, inadvertently stored one of your user account passwords in our encrypted systems in an unhashed format. This impacted the user account password provided during the initial account signup process. The log information was retained for 14 days following the signup process, and then was deleted according to our normal retention policies. We have reviewed the login information for the account and have found no evidence that the unhashed password was misused. The following is the user account impacted in your domain(s): [ __ _@_ __] Google Planned Action: for your security, starting tomorrow Wednesday, May 22, 2019 PT we will force a password change unless it has already been changed prior to that time. Our password update methodology is as follows: • We will terminate the impacted user's session and prompt the user to change their password at their next login. • In addition, starting Wednesday, May 29, 2019 PT we will reset the password for the user if they have not yet selected a new password or have not had a password reset. This user will need to follow your organization's password recovery process. However, Super Admins will not be impacted. For information on password recovery options please refer to the following [Help Center Article]. For further questions please contact [Google Support] and reference issue number ###. Sincerely, The G Suite Team

</comment><comment><USER27> In addition, as we were troubleshooting new G Suite customer sign-up flows, we discovered that starting in January 2019 we had inadvertently stored a subset of unhashed passwords in our secure encrypted infrastructure. These passwords were stored for a maximum of 14 days.

Is this another way of saying they stored cleartext passwords? Interesting they choose to use "uncashed" instead of "cleartext"

<comment><USER28> They are probably not saying "cleartext" because the data was still encrypted, just not hashed.

</comment></comment><comment><USER29> Thank you Google (AKA f __k you Facebook).

</comment><comment><USER30> would this violate GDPR?

<comment><USER31> I'm not a GDPR expert, but I've done a fair bit of work making old systems GDPR compliant. With my understanding of GDPR, yes, this is a violation since part of GDPR requires you keep customer data secure using "appropriate technical and organizational measures". I would argue that this violates the "appropriate technical measure" part.

Again, I'm not a lawyer or expert in this domain, so I could be wrong.

<comment><USER32> They seem to be hammering home the point that the passwords were always stored on 'secure encrypted infrastructure' but the data was not hashed, so anyone with access to googles 'secure encrypted infrastructure' could read the data.

The encryption is most likely enough to be within GDPR compliance.

<comment><USER33> >The encryption is most likely enough to be within GDPR compliance. //

Why do you think that, allowing staff to read plaintext passwords is contrary to standard security practice; companies are expected to make reasonable effort to secure PII and allowing staff to read your password doesn't appear to be "reasonable effort" by even the casualist of readings.

I don't think the EU courts are that stupid.

FWIW I don't think there is a case here particularly, as it appears to be a genuine error and being fixed.

</comment></comment></comment></comment><comment> awinter-py I mean hedgqw is my mother's maiden name and 23328 was my first pet, this isn't a very strong hash

</comment><comment><USER34> It's a shame that password hashing isn't standardized.

There should be a standard password box in html in which you can just call a function to pull out a salted hash of a password. The attributes of the box could include options for password restrictions such as a minimum of 8 chars, etc.

The fact that developers still need to write custom hashing algorithms in javascript is kind of ridiculous .

edit: nevermind, I just realized this wouldn't work

<comment><USER35> There is no client-side security. If you hash on the client side then that hash becomes the password and you have plain text password storage.

<comment><USER36> You could just hash the hash that the client sends, no? Then you never know their password and it's still stored securely.

<comment> munk-a If the client always hashes the password in the same way (no nonce or usage of encryption) then the password essentially becomes the hashed string with some extra clientside code you're burdened with forever. And since that same hashing will need to be done whenever they log in the hashing algorithm needs to be in the client side code sent to everyone... meaning an attacker would have a bit of obscurity in their way and just need to regenerate a rainbow table based off of your hashing algorithm to test common/weak passwords.

<comment><USER36> It's not about the security, it's about preventing side-channel leaks of the plain password (e.g. incorrectly sanitized logs or buffer overflows). Having a data breach of your site-specific hash is much better than leaking the user's password that an attacker could use on any website.

<comment> munk-a Your site specific hash, if leaked into logs and generated using a fixed hashing algorithm, would just be a step of obscurity, a rainbow table generated according to that hashing algorithm would be able to extract the original typed password pretty reliably for use in compromising other accounts held by the individual on other sites.

There are ways to actually add security above SSL but they require a per- session nonce. The most secure versions of these operate on some sort of out- of-band time-scrambling algorithm that's issued to users on an individual basis (usually a dongle) which is basically a nonce that's been pre-arranged a few years in advance, these can (if done correctly) provide all the security of on-demand generated nonces and physical keys combined.

Fixed hashing algorithms add such a negligible amount of security that I'd prefer to avoid them due to the tech debt their existence incurs outweighing their advantage.

<comment><USER36> Their password would have to already be in a rainbow table, and at that point nothing can help them. But I agree it's kind of pointless, I was just arguing that there is a benefit even if negligible. If you want real security, WebAuthn is the future.</comment></comment></comment></comment></comment></comment></comment>


Apple launches Swift Playgrounds for iPad to teach kids to code - <AUTHOR> http://techcrunch.com/2016/06/13/apple-launches-swift-playgrounds-for-ipad-to-teach-kids-to-code/ <comment><USER2> Before Swift Playgrounds launches to the general public, Hopscotch and ScratchJr are still two of the best apps for children to explore learning to code on the iPad.

[https://www.gethopscotch.com/](https://www.gethopscotch.com/)

[https://itunes.apple.com/us/app/scratchjr/id895485086?mt=8](https://itunes.apple.com/us/app/scratchjr/id895485086?mt=8)

For children who are older or more advanced:

Codea [https://itunes.apple.com/us/app/codify/id439571171](https://itunes.apple.com/us/app/codify/id439571171)

For more of a game-like environment:

Lightbot

[https://itunes.apple.com/us/app/lightbot-programming- puzzles...](https://itunes.apple.com/us/app/lightbot-programming- puzzles/id657638474)

<comment><USER3> In addition to the the ones mentioned above, my 7 year old enjoys codecombat on the PC (or Chromebook which a lot of elementary schools use these days):

[https://codecombat.com/](https://codecombat.com/)

</comment></comment><comment><USER4> I like Swift as a language, but I have my doubts as to its suitability as a first-time programming language for children. It contains a whole lot of industry-standard jargon that we as practiced software developers don't think twice about, and will have to be explained. Like, what the heck is a "string", and why is it called that? What is this weird vertical character that I've never seen before (and how do I even begin to type it? is it an emoji?) and why do two of them next to each other mean "or"?

I don't doubt that kids are smart enough to wade through it all, but if you put enough obstacles in their path then they're going to wander off and do something more interesting. It also raises the question of whether you're teaching kids programming for the sake of programming (in which case you'd rather use any of the myriad languages that have been designed for young children), or if you're teaching kids programming for the sake of helping them solve some problem or achieve some task (in which case you'd probably pick a language with a more specific focus), or whether you're just teaching them programming just for the sake of adding to the ranks of the software industry ten years from now.

<comment><USER5> To be honest, I think that

A) Literally everything is new to a kid, and if they can figure out how to play pokemon and minecraft, they can figure out what '||' means.

B) Why teach them one way to do things and force them to relearn it a few years later?

<comment><USER4>
      > B) Why teach them one way to do things and force them
      > to relearn it a few years later?

Who says anyone's being forced to relearn anything? My initial progression of languages went QuickBASIC -> Visual Basic -> Java, and despite the fact that Java is nothing like QuickBASIC the concepts helped me immensely in powering through Java's intimidating learning curve (i.e. "just type `public static class Hello { public static void main(String[] args) { system.out.println("Hello"); } }` for now (and for god's sake, make sure the file name is Hello.java), you'll understand what all that means in about six months or so").

It's easy to forget that our first exposure to programming involves a lot of fundamental concepts that are wholly incidental to the semantics of whatever language we're using. Trivial stuff like case sensitivity of identifiers (quite surprising to an enormous number of first-time programmers) as well as highly non-trivial stuff like setting up your programming environment and teaching people how to invoke the compiler/interpreter. Making the language itself small and intuitive, even if limited, goes a long way towards giving students a stone to cling to in the rushing river of unfamiliar concepts that they're being exposed to.

</comment></comment></comment><comment><USER6> My bet would be on a version of xCode for iPad being released at WWDC 2017.

This seems like a perfect way to get some wide testing of the compiler, coding keyboard, etc. I wonder what IDE enhancements we can expect from a touch interface.

<comment><USER7> That's actually a good point. Are there any good development options for the iPad today that aren't excruciating to use?

<comment><USER8> > Are there any good development options for the iPad today...

Yes, there are.

> ...that aren't excruciating to use?

Oh. No, not really. Pythonista is the closest I've seen to an non-excruciating IDE on the iPad, but that's Python only. Link: [http://omz- software.com/pythonista/](http://omz-software.com/pythonista/)

</comment></comment></comment><comment><USER9> So much of this app reminds me of Codea's way of modifying colors and numbers:

Swift Playground: [http://www.apple.com/swift/playgrounds/](http://www.apple.com/swift/playgrounds/)

Codea: [https://codea.io](https://codea.io)

<comment><USER10> Both are based on the work of Bret Victor (for instance, [http://worrydream.com/#!/LearnableProgramming](http://worrydream.com/#!/LearnableProgramming)), who worked at Apple for a few years.

<comment><USER11> Modifying colours, sprites and sounds with the inline picker directly from code was my own design. And first appeared in Codea, as far as I'm aware.

I was definitely aware of, and inspired by Bret Victor's presentations (and certainly took some of his ideas for Codea). But those particular features were first in Codea before being replicated elsewhere.

</comment></comment></comment><comment><USER12> I think it's a shame to teach kids to program on a platform as closed as iOS.

A 12 year old I know wrote an app as a birthday gift for his grandfather who lived overseas. The app was simple and displayed the grandfather's age with various different effects. Unfortunately, he wrote the app for iOS and so there was no easy way to deliver the app to grandfather (the family tried to submit it to the app store but it was rejected).

At least Swift Playgrounds allows kids to share with one another. Just don't try to leave the playground.

<comment><USER13> Swift is open, so at least they can take what they learned of the language to open platforms.

</comment></comment><comment><USER14> I think this is really cool. It is like a really pretty Scratch-type environment but teaches actual Swift rather than puzzle blocks.

Also the new coding keyboard looks interesting. A nice surprise from Apple.

</comment><comment><USER15> I learned on Microsoft Basic and later QBasic. I fully intend to teach my children using the same.

</comment><comment><USER16> Inspiring the next generation of college students to sign up for freshmen CS classes and shockingly realize that programming is only a small component in the field.

<comment><USER13> Or perhaps, turning programming into a cross-discipline skill, and slowly decreasing the need for a CS degree?

<comment><USER10> This is what I'm hoping for. I want my kids to learn how to program, not so that they can become a programmer like me, but so that they can use programming to inform and enhance whatever they choose to do.

<comment><USER8> Yeah, I'm using my programming skills to write scripts to assist me in making/designing/balancing physical board games. Probably no one would assume that programming would assist in the hobby in any way, but I'm finding it quite useful.

</comment></comment></comment></comment><comment><USER17> I think it makes for a cute demo but misses the mark - what's desperately needed are better developer tools - not another 'how to become a programmer in 30 days'.

There's enough beginner material - the stumbling block is the reality programmers are living in.

Cute demos aren't changing that.

<comment><USER18> I'm not sure there are enough beginner materials.

I've lamented in the past (here even, maybe) that the first computing devices many people get are primarily designed around consumption. Some types of content creation (particularly visual and audio, more limited textual), are very well enabled by these tablet interfaces, but that's not been the primary focus.

But _programming_ them has long been difficult and required an external device. Many of my peers' young children are first given an iPad or similar device, not access to a Tandy 1000, Apple II, Commodore or similar computer that had a BASIC interpreter baked in. To an extent the fault (on iOS) is squarely on Apple's shoulders, as for a long time they explicitly made interpreters and such verboten on iOS. This is a nice turnaround on their part, and a potentially good tool to get programming into the hands of kids.

<comment><USER19> I thought Apple had allowed interpreters etc. for some time, pythonista looks quite nice for example (it even has numpy and somebody ported some sort of pip to it so you can even install modules)

As a first introduction to programming python might be a bit too complicated, but there do seem to be some BASIC interpreter on the app store it seems

<comment><USER17> How is it that we can teach chemistry and physics - but when it comes to 'when this, do that', we throw our hands in the air and claim it is too difficult?

I'm pretty sure calculus is more difficult than intro to python :)</comment></comment></comment></comment>


ASK HN: What methods do you use to gain early customers for your startup? - <AUTHOR>

There are many ways that new tech startups can try to acquire early adopters AKA early customers for their product.
Drew Houston, co-founder and CEO of Dropbox, tells about their original strategies, and their path through the customer development jungle. (http://www.justin.tv/startuplessonslearned/b/262672510)
You as a new startup, whether you're a founder, hustler, hacker, or even early adopter:
How have you been able to gain visibility to early adopters, get them to evangelize for you, and ultimately convert them to early customers? <comment><USER2> As a frequent early adopter, I'd say the most important thing you can do after providing a useful product in order to _retain_ early users is to actively provide excellent support. I'll tolerate buggy software longer if it is easy to report bugs (and I know that reported bugs actually get looked at).

Interacting directly with early users also "humanizes" your company, which makes people both more forgiving of early mistakes as well as more likely to put a little bit of extra effort into helping you get better.

<comment><USER3> Good points. Social news (HN, reddit) is a great place to find early adopters, and interact directly with them.

I launched <http://iDoneThis.com> here on HN in January and now we have 5,000 users. A benefit to that was not only finding early adopters and engaging with them, but in that engagement, you have the opportunity to find what people want and improve the product. One thing we discovered from the international audience at HN is that our site didn't work with unicode, and folks abroad wanted to be able to adjust their timezone from the default US/Pacific. We added those features and now we have a huge following in Japan.

I wrote a bit more about how we got our first 5,000 users here: [http://blog.idonethis.com/post/4779807862/how-we-got-our- fir...](http://blog.idonethis.com/post/4779807862/how-we-got-our- first-5-000-users)

</comment></comment><comment><USER4> Organic SEO. This isn't necessarily limited to early adopters: it is not obvious to the average Internet user that an attractively presented website which ranks #1 to their query is a new entrant in the field.

Most of my customers assume, all evidence to the contrary, that my products are made by some megacorp somewhere. (Most common guess that I've heard: made by Google, because they found it on the Googles.)

<comment><USER5> Anyone interested should read the parent commenter's blog entry on this topic: [http://www.kalzumeus.com/2010/07/17/seo-for-software- compani...](http://www.kalzumeus.com/2010/07/17/seo-for-software-companies/) \-- I found it very useful.

</comment></comment><comment><USER6> Go listen through the Mixergy archives - <http://mixergy.com/> \- it's one of the most common questions that Andrew asks people. Something that I learned is that the answers are _wildly different_ for everyone (and not solely by industry or company type).

</comment><comment><USER7> Blog posts which bring in organic traffic.

Listing on the Chrome Web store.

Asking friends and friends of friends.

Asking former colleagues.

Participating on relevant forums just answering people's questions, NOT pitching your product.

Tweeting product updates.

Using Olark to stalk visitors.

Emailing 3-5 popular, connected and intelligent strangers everyday to get feedback.

Writing a book.

Cross promoting and selling other popular products in the field to get to know customers.

</comment><comment><USER8> This is why many experienced entrepreneurs tell you to ask someone who has money, or a business owner if there's anything you could do to improve their life... because they'll be your first customer, and they'll be spreading the word about you even when you're building the prototype.

</comment><comment><USER9> Steve Blank is teaching an entrepreneurship course at Stanford and blogging about it. They're currently working on customer acquisition strategies:

[http://steveblank.com/2011/04/15/the-leanlaunch-pad-at- stanf...](http://steveblank.com/2011/04/15/the-leanlaunch-pad-at- stanford-%e2%80%93-class-5-customer-relationship-hypotheses/)

<comment><USER10> He came to Michigan to speak a few weeks back and he recommended to me a presentation from Dave McClure that covered some of the same stuff. It's pretty jam packed full of info but really useful none the less.

There's a few of these floating around, this is the most recent one I could find: [http://www.slideshare.net/dmc500hats/startup-metrics-for- pir...](http://www.slideshare.net/dmc500hats/startup-metrics-for-pirates-sf- jan-2010)

<comment><USER11> This is a great deck. Look at slide 22 if you want some good ideas relating to this topic.

<comment><USER12> You may see the video of the presentation : <http://www.ustream.tv/recorded/5336115>

</comment></comment></comment></comment><comment><USER13> Depends if you're B2B, or B2C.

For both, though, giving some incentive to be an "early adopter" is a must.

My company is SaaS; to get some initial momentum, we offered early adopters their first year at a discounted rate, additional functionality at a fraction of the normal price, and an account credit if they connect us to another customer that ends up working with us.

We actually still do the latter; nothing is better than having your customers be your evangelists.

<comment><USER13> and yes, the comment above is correct. It depends on the industry, business type, etc. etc.

For SaaS, what I mentioned is just one of many methods...

</comment></comment><comment><USER14> We gave free trials. One of the most important things for us was image. We work with oil and gas companies and getting a couple of Canada's top producers on board was paramount for us.

We needed the "well if big guy X" is using it then maybe it's worth checking out.

We met with some big guys and asked what else they would need to make it work for them. A few tweaks later and a 6 month free trial (plus discounted first year) and we were off to the races.

There are some customers who love us because we love feedback and work hard to implement the really good ideas.

Providing a free trial + personalized tweaks gave us the start we needed. It worked doubly well because we targeted the companies who have respect in the industry first.

<comment><USER15> Canadas top oil and gas companies needed free trials? Wow.

<comment><USER14> The money wasn't the issue. The fact that there was literally not a single company signed up was the issue. Why would a top company pay for a service that -- as of that time -- no one was using.

The fact of the matter is, it was two guys coming up to a massive company saying "Hey! We've got this site where you can advertise all these items you want to get rid of... but we've got no traffic and you will be the first person on it." There's literally no incentive for them.

Our service depends on having clients to be valuable. So there wasn't any value in our service at the time. However, as soon as you get one of the big guys signed up and putting their items on our site, we instantly add value and get the "hey, if Company X is putting their stuff up there, I want to be there too!" effect.

<comment><USER15> That makes more sense :).

</comment></comment></comment></comment><comment><USER16> Bartering was helpful in getting the first customers with my startup: [http://ai.redsymbol.net/2010/09/boostrapping-your- business-w...](http://ai.redsymbol.net/2010/09/boostrapping-your-business- with-barter.html)

In general, it'll probably work better with B2B offerings.

</comment><comment><USER17> You'll have to build an audience first. I read a lot of the mixergy Entrepreneur majority of the successfull ones all had audience or contacts before they had customers. An audience or contact is different from a customer because they are just people who are interested in you, whereas customers go a step further and buy. However an audience or contact allows you to make offers and build a customer base.

You can build an audience by making friends on hacker news, if you're known for making great contributions to the hacker community you can build audience. So it's important to be genuinely interested in the community. Once you have an audience you can make them an offer, and if it's any good you'll have customers. And interesting recent example of this is edw519 ebook. Ed genuinely enjoys the hacker news community and people enjoy his contributions which are basically his comments/submissions. I doubt his intentions was ever to sell an ebook of his comments, but he is doing that now, and the site promoting it has been viewed 20923 times, and that's only because he is part of the community and has an audience. see: [http://edweissman.com/i-turned-my- hacker-news-comments-into-...](http://edweissman.com/i-turned-my-hacker-news- comments-into-an-eboo)

It's a small experiment on Ed's part, but it won't be worthwhile without an audience. If you're interested in more specific ways to build an audience stay tuned.

Also read: [http://www.jamesaltucher.com/2011/04/the-easiest-way-to- succ...](http://www.jamesaltucher.com/2011/04/the-easiest-way-to-succeed-as- an-entrepreneur/)

<comment><USER11> You don't have to "build an audience first" - that's just one of many possible strategies. It's often promoted by bloggers - who often happen to have found success because of their audience.

For example, Groupon never "had an audience" - they got on the _telephone_ and _rang up small businesses_.

<comment><AUTHOR> That's a great observation actually. When I originally created StartupLi.st in my tent while servine the US Navy on deployment in Afghanistan, the only way I could "gain an audience" was to make the effort to contact each startup before I featured them. It worked brilliantly, and will still be a strategy I'll use as <http://startupli.st> grows. Thanks again for your comment!

</comment></comment></comment><comment><USER18> I think it depends on the product you are lunching. However, in general following things may help to gain early users

1) Using social media (Facebook and twitter) for marketing

2) Make Facebook app/ Facebook fanpage it may help in viral growth

3) Search engine optimization

4) Service\content you are providing should be magnetic so that early visitors will be converted into early users

</comment><comment><USER19> I recorded a video of the Matthew Wensing talking about how he bootstrapped Stormpulse. He spent a lot of time describing how he got the first clients and locked some big distribution channels. [http://www.davidedicillo.com/social/a-great-story-on- bootstr...](http://www.davidedicillo.com/social/a-great-story-on- bootstrapping-stormpulse-com/)

</comment><comment><USER20> It definitely depends on what your startup is doing. Since it is addressing a need (hopefully) you should try to find people who have this need and target them. A local B2B company will do vastly different marketing from a social B2C company. Friends and family are great, maybe sponsor local events and go out with an iPad and show off the startup. Or maybe try advertising on stumble or facebook.

At my startup <http://louderr.com> we have been trying out as many ideas as possible to see what generates good CTR and loyal visitors. Word of mouth is working best, along with strategic advertising on social networks. Im looking forward to writing a blog post with lots of information about what worked and what didnt for us.

tl;dr: Guess and Check. Repeat. This is the hard part.

</comment><comment><USER21> For early adopters, it's all about product endorsements. As someone who isn't from Silicon Valley, but reads all the major tech news sources and thought leader blogs, I set out on a mission to meet as many thought leaders as possible....Long story short, one tweet from a single thought leader converted to 500+ clickthrus to my site at product launch. Another product got 90 signed up alpha users from a single tweet. People who follow tech thought leaders are voraciously looking to find the next best thing in their space.

It's not easy, but once you establish those relationships, they continually pay dividends, if you don't abuse them.

</comment><comment><USER22> A big question to answer is if you're social or standalone. That is do you need critical mass to be truly useful or if one person uses it, does that one person still get 99% of the benefit.

</comment><comment><USER23> As a freelancer, I get to work directly with sales reps and franchise owners, so I am making a SaSS for them and so they will be my early adopters. I've already interviewed a dozen or so of my clients and am confident my service will be well received. At least the Beta will not be overly complex so I can tweak it in the right direction during Beta review. Here's hoping.

</comment><comment><USER24> What's your startup?

<comment><AUTHOR> My startup is <http://StartupLi.st> It is a new way for EVERY tech startup to create visibility, gain early adopters that will socially promote your startup, and build an interactive community around a startup's aggregated social activity streams. Social Customer Development. It's going live this week.... so stay tuned :)

<comment><USER25> Wait a minute. The owner of a start up that helps other startups gain early adopters is asking for advice on how to gain early adopters?

<comment><USER26> If you really think about it, @nickfrost is probably gaining early adopters by posting this. Nearly everyone that reads this post will be interested in <http://startupli.st>

Plus, no one has all the answers and I am glad that @nickfrost is welcoming other ideas.

</comment></comment></comment></comment><comment><USER27> We submitted our site to betali.st and received 400+ signups as a result. Would your site be similar to that?

<comment><AUTHOR> Yes, absolutely! Every person in StartupList can VERY EASILY sign up for your startup, then recommend it to their friends within StartupList and even to their Twitter and Facebook social crowds. Your startups social stream will be connected and automatically aggregated to your startup's profile, so the activity stream is constantly real-time and interactive. Also, submit and relate news about your startup to Startup News to gain targeted readers as well as their opinions on the news you post. Please join <http://startupli.st> and add your startup to gain the full experience of early adopter interaction and development.

</comment></comment><comment><USER28> The best is to use networks... your friends, your friends friends, your advisors friends etc. They'll be more willing to put up with a less than perfect product, and if you make them happy, they will be customers for life and tell their friends. We had luck with this early on at FeeFighters and it has served us well, as our customers almost always refer us to other customers. (B2B site lowering credit card processing fees via instant reverse auction)</comment>


This is the new Gmail design - <AUTHOR> https://www.theverge.com/2018/4/12/17227974/google-gmail-design-features-update-2018 <comment><USER2> I like the new concept

<comment><USER3> Me too, one of the few redesigns that appear to really make sense. They also use space so that it works well on desktops, not one of those pages just optimised for phones with 80% whitespace on a large screen.

</comment></comment><comment><USER4> I feel I would still want to use Inbox over this redesign, although having calendar, notes, and tasks right on the side could be very handy

</comment><comment><USER5> I wish they would allow one to resize the compose window.

</comment><comment><USER6> are they going to leave Inbox project in the future?

I've been looking to use another emailing service. Suggestions?

<comment><USER7> ProtonMail [https://protonmail.com](https://protonmail.com)

<comment><USER6> Did you use that? Can you talk about your experience with it?

</comment></comment></comment><comment><USER8> So much white space....

Why?

<comment><USER9> Google was a proponent of whitespace before it even was a thing. Remember how empty it looked compared to ask.com or yahoo.com?

IMO the white space gives a bit of a breathing room without compromising too much. I also like the emphasis on the todo list, which has always felt like a second class citizen up until now.</comment></comment>


My BBC Micro Model B and a plume of acrid smoke - <AUTHOR> http://blog.jgc.org/2011/11/my-bbc-micro-model-b-and-plume-of-acrid.html

<comment><USER2> Whew. A good ending to that story, then. The capacitor took one for the team; I'd thought you'd let the smoke out of something important.

</comment><comment><USER3> This has happened twice in the last 25 years to my BBC B+128KB. The funny thing is that it just keeps on working. It's a really tough machine!

<comment><AUTHOR> It will keep on working with a dead filter capacitor but you might get some weird things happening or interference because that capacitor is there to filter out transients on the mains line.

<comment><USER3> Sure, I did get a new capacitor each time. I got the diagnosis from Sprow: <http://www.sprow.co.uk/>

And last year I managed to get some new drives attached: [http://alquerubim.blogspot.com/2010/07/upgrade- historico.htm...](http://alquerubim.blogspot.com/2010/07/upgrade- historico.html) (Portuguese only, sorry).

</comment></comment></comment><comment><USER4> I purchased a few spare power supplied for my BBC a couple of years ago. I'm not letting go due to a broken power supply!</comment>


Show HN: Ameelio – Free and Open Source Prison Communication Platform (Part II) - <AUTHOR> A couple of months ago I made a post here announcing the launch of Letters, the first application developed by Ameelio (https://ameelio.org), a non-profit organization committed to making communication free between incarcerated people and their loved ones. Letters allows users to sign up, type a letter to their loved-one in prison/jail and we handle printing, packaging, stamping and shipping through USPS. It's still totally free and unlimited. We've also have went open source. (https://github.com/ameelio)
When I made the post on HN (https://news.ycombinator.com/item?id=23042558), announcing the launch, we received SO much support. Many of you contacted us and wanted to contribute. With your help, we were able to scale our operations, we gained several amazing teammates and we developed an amazing product that's serving over 5,500 users who've sent around 23,000 letters to their family and friends that are incarcerated. The impact we've made already has been incredible.
Letters has been a huge success and we've been planning some things to make it even better. We've revamped the UI with more enhancements coming soon. The next stage for Letters is to focus on scalability and extend functionality to make letters sent from our platform more personal, helpful and even entertaining. We'll be adding games that users can send to their loved ones such as Sudoku, Crossword puzzles and even potentially pop-out board games (TBD). Also, we'll be adding different formats for mail, such as Postcards.
In the coming months, we'll be planning and developing Connect, which will be the first-ever free platform for sending messages and having video calls with incarcerated people. We already have a pilot site!
We've also just launched a Kickstarter campaign to help us keep up the momentum. You can find it here...
https://www.kickstarter.com/projects/ameelio/ameelio-app
I hope this community has enjoyed the update on Ameelio and I look forward to hearing your response.
Thank you, HN! <comment><USER2> Hey y'all again! I am one of the co-founders. Just wanted to highlight that our growth statistics cannot capture our impact. Countless users have reached out to thank us and describe Ameelio's impact on their lives:

I can't tell you how much difference your organization has made for me and my loved one… my LO gets one 15min call per day... how can you keep a father- child relationship strong with that? it rips families apart... you have been able to help... it means a lot... thanks again.

— Steven

Thank u for everything it really helps cause money is so tight and I can't afford stamps. I'm choosing stamps to talk to my husband or my heart meds that are expensive. I don't have insurance. — Savannah

I live in Australia and my husband is incarcerated in PA, so obviously communication is a massive part of our relationship, especially in written format. One factor that most USA residents doesn't have to face, is a monetary factor of sending snail mail, for me to send a card or letter from here to him, it's costs me $3.20 AUD, over $2 USD, so Ameelio is such a cost saving thing for us. I love how informed we are of the status of the letter and that I can send a pic every single time. It's helped me hold things together for us as a couple. When the facility was on total lockdown, mail was still getting thru, but letters I'd sent from early April have only just arrived, yet letters I sent via Ameelio all arrived within a week (at worst). It gave hubby peace of mind knowing I was okay out here and that I was thinking of him in there. WIthout those letters, who knows what his mental health would have been like. Thank you Ameelio, we both appreciate this wonderful service.

</comment><comment><USER3> awesome idea. makes no sense that incarcerated people & their families are paying such steep prices while the rest of us are using hangouts, zoom, facebook, whatsapp, etc for free

<comment><AUTHOR> I agree totally. It's wrong.</comment></comment>


Nearley 2.0.0: a complete JavaScript parser toolkit - <AUTHOR> http://nearley.js.org <comment><USER2> Any recommendation for a fast and lightweight parser combinator, to create the parser manually? or will nearley support it?</comment>


'Pandemic' scientist makes breakthrough on Covid-19 cure - <AUTHOR> https://www.rnz.co.nz/national/programmes/checkpoint/audio/2018740956/pandemic-scientist-makes-breakthrough-on-covid-19-cure <comment><USER2> 'Breakthrough' seems to be a slightly strong word here; this is one of what might be more than 100 parallel efforts to create a COVID-19 treatment going on around the globe.

The next breakthrough isn't going to be a good idea that is testable; they already exist. What is needed at the moment is something that has scientific evidence (ie, a good solid clinical trial) behind it and that is cheap to produce.

<comment><USER3> People are looking for some rays of hope in these dark times, so perhaps the publication can be forgiven to hype up some local researcher's work.

<comment><USER4> On the contrary. It is when people want to be misled into false hopes that it is the press' duty to avoid doing so.

</comment></comment></comment><comment><USER5> This sounds like monoclonal antibodies. Aren't those extremely toilsome to produce, therefore cost tons of money?

<comment><USER6> Yes, they also require extensive testing for a safety profile to be determined.

Unless there will also be a pretty big advancement in fabrication this will likely will never enter the market outside of potentially an orphan drug for the wealthy.</comment></comment>


The history of R's predecessor, S, from co-creator Rick Becker [video] - <AUTHOR> http://blog.revolutionanalytics.com/2016/07/rick-becker-s-talk.html <comment><USER3> I had no idea Tukey invented the words "software" and "bit"

</comment><comment><USER4> Was R named as such because it's one letter before S (and therefore a regression?).

<comment><USER5> "The name is partly based on the (first) names of the first two R authors (Robert Gentleman and Ross Ihaka), and partly a play on the name of the Bell Labs language 'S'." \- R FAQ

[https://cran.r-project.org/doc/FAQ/R-FAQ.html#Why-is-R- named...](https://cran.r-project.org/doc/FAQ/R-FAQ.html#Why-is-R-named-R_003f)

</comment></comment><comment><USER6> Oh wow. We used "S plus" at one of my previous jobs (and I wouldn't be surprised if they still do) because they had a paid product. This was at a conservative government agency.

<comment><USER7> I have a friend at the Census who is, in principle, allowed to use R or Python, but is definitely aware of a strong historic bias for commercial statistical software--SAS mainly. That's the weak form of pro-commercial government bias. The strong form is that there are, I'm told, agencies in which only "certified" statistical software can be used.

<comment><USER8> Hence the existence of Revolution Analytics (from which this blog is posted).

</comment></comment></comment><comment><USER9> _" The story is also coloured with anecdotes from various other luminaries at Bell Labs at the time, including John Tukey (the pioneer of exploratory data analysis and the inventor of the words "software" and "bit"), and Kernighan and Ritchie (who were upstairs designing Unix and the C language at the same time S was being developed)."_

With Shannon still around(?) that must have been some place to be.

Meta: nice to be able to just download the mp4 video for offline playing - <USER2> flash player to fiddle with.</comment>


Code for America (YC for Cities) Announces First City Applicants - <AUTHOR> http://codeforamerica.org/2010/02/24/city-applications-are-in/

<comment><USER2> hot

<comment><USER3> yes!</comment></comment>


Ask HN: Dilemma of a Gamer and Programmer - <AUTHOR>

I would like to ask for some advice. I've been mulling over this for months and haven't come up with a solid solution.
I'm currently juggling a computer engineering curriculum and one particular video game in college. The need to find an actual job and become a true autonomous adult looms closer with every semester. Logically my gaming time should be shortened and replaced by personal coding projects that would give me marketable experience. Unfortunately I'm hesitant to quit gaming, I've played this game (League of Legends) for a long time and have reached a point where I have my own fanbase and make enough money from streaming/youtube to cover my monthly food/luxury expenses.
I hesitate because playing this video game has been a pretty big chapter of my life, it has affected the friends I met, the experiences I've had, and my outlook on life. At the same time I like to be a realistic person, I had multiple opportunities to play this video game professionally, but have chose not to. My opinion is that having actual applicable knowledge to the real world lasts a lifetime as opposed to having a short lived video game career.
What should I do? Suddenly quitting and leaving part of my life behind just doesn't feel right, but at the same time I need to do something if I want to get a app development job in such a competitive environment.
What should I do? Suddenly quitting and leaving part of my life behind just doesn't feel right, but at the same time I need to do something if I want to get a app development job in such a competitive environment. <comment><USER2> I also play LoL, although I've given it up for Lent, and used to run the server's leading raid guild in WoW back in the day. So I hear where you're coming from.

Congrats on your accomplishments. None of the following is meant to lessen them.

When I was young and impressionable, it struck me as absolutely freaking magic that you could make whole _hundreds_ of dollars appear out of the Internet without doing "real work" with an office and tie and deadlines and all those things that sounded a lot like my least favorite parts of school. Being older and wiser, I now realize that hundreds of dollars is rat spit next to the going market rates for engineers, and there exist plenty of options to get compensated in 2014 for things which are much closer to LoL than they are to office/tie/TPS reports.

I also hear you with regards to the social issues. I lost a lot of friends, including some of the people who probably knew me best, when I quit playing WoW. We made the usual non-specific promises for hanging out later. It never happened. I eventually made new friends, some on the Internet ( _waves_ ) and some off.

I'd suggest simply titrating down on your LoL play per week (cap it to, say, 12 hours a week to start [+]) while you start getting ready for Adulthood (TM).

Also, although it's sort of tangential to the LoL issue, you may not be accurately apprised of the current state of the hiring market for engineers as a college student. God knows I wasn't. Here it is: it is _absolutely on fire_ right now. You know how you've been in a cutthroat meritocratic competition for essentially every gate you've ever passed through in life up until now? Your next gate is going to be people bidding against each other to give you six figures in starting salary and a signing bonus larger than your career earnings in LoL. (Those are Valley numbers -- it isn't quite so white hot in every geographic area, but it's still a seller's market rather than a buyer's market.)

Bonus points: It's quite possible that you've learned enough about marketing over the Internet to be dangerous during your streaming career. The returns for having hundreds of thousands of people following you and moving them through multiple types of conversions are, for LoL streamers, not high numbers. Many of those same skills can be cross-applied to selling e.g. business to business software. B2B software is _substantially_ more lucrative.

[+] Guesstimate of current play time arrived at by years of experience rather than by latent contempt for videogaming. It's, um, "more than 12 hours a week."

<comment><USER3> I see this sentiment quite often and it always surprises me. To put it into perspective, it took me seven months after graduation to find a position that pays $50k and I had to leave the USA to find it. Now, I'm not complaining - the project is pretty fascinating and I'm quite excited to be working overseas, but I'm also not the only person I've known who couldn't find work.

<comment><USER4> I've given some helpful critiques to people who had skills but had a hard time finding a job (see [1] for example). Email me if you'd like me to go over your work history, resume, skills, etc. My email is in my profile.

[1] [http://pchristensen.com/blog/articles/what-your-resume- reall...](http://pchristensen.com/blog/articles/what-your-resume-really-says- about-you/)

</comment></comment></comment><comment><USER5> Good grief kids have it hard today; to go get a high-paying job writing code all day long with 10% raises in the future, or to keep on playing video games for a living... we are really failing this generation!

Just teasing, OP, hope you don't mind. Trust me that these are some excellent problems you have. When I graduated, my choice was a 40k/yr job in my hometown, or a 60k/yr job 2 hours away, in a job market that had just tanked. I envy you, and congratulate you on your options!

As for advice, I would say you don't need an extensive portfolio of "personal coding projects" unless you want to be seen by a Google or Amazon right out of school. The market is in such demand for good software engineers right now that you can should be able to get a good job for decent pay with just your degree and a good coding interview. Go interview around for practice, make a killer impression at a place you like, and negotiate hard for the salary.

That said, if you want to develop some projects, look to your gaming/streaming for inspiration. Can you build a members site for your fans? Code your own streaming player? Build some LoL web tools (stats lookup, character comparisons, etc)? Mailing list manager for a LoL newsletter? It is easiest to find inspiration from your own pain points, and easiest to maintain interest in projects you use yourself.

</comment><comment><USER6> I work at Riot and it's great what you've been able to do with LoL. At the same time, I would say that finishing your CS degree (or becoming a better developer) would be definitely worth it in the long term. It's possible to manage both. I know many people who play a lot (not pros) and combine that with their engineering careers.

Also, somewhat relevant post on the question:

[http://community.na.leagueoflegends.com/en/c/miscellaneous/P...](http://community.na.leagueoflegends.com/en/c/miscellaneous/PQffrOg8-programming- for-riot?comment=0002)

</comment><comment><USER7> Nearly all the side projects I've done have been related to fixing a problem or enhancing an experience me or my friends have had in relation to games.

In general they have been weekend projects where 90% functionality is achieved in one weekend, and then I spend months adding small features or fixes.

#1 Advice when doing a personal side project is to make it something you will use yourself. If not you might lose interest quickly.

As a software engineer that usually codes all day and plays all evening (4-5 hours), I'm saying there is no need to do a full stop of anything.

</comment><comment><USER8> Use your programming knowledge to create a product or service related to your gaming. You already have the hardest thing to build: an audience. Offer them something valuable in exchange for money. Best case: you build a real business. Worst case: you gained valuable experience.

</comment><comment><USER9> Finish your degree. But it would be a shame if you totally dropped the hobby you're passionate about right now in favour of listening to the conventional wisdom and becoming a "true autonomous adult".

See if you can make both work out somehow. You're not alone in this and there are many streamers that manage to pull in money to cover their living costs while still being able to pursue an education and the necessities to thrive (hanging out with friends, exercise, learning skills not related to anything in particular, etc.).

Try to combine your two passions somehow. Building gaming-related products and creative ways to give back to your viewers using your engineering skills would be good candidates.

</comment><comment><USER10> My advice: Quit LoL, install Dota2, limit your gaming time per week. :D

Fanboyism aside, I find myself in a very similar situation. I've been playing DotA2 for years (and LoL before that, a littel DotA before that) and now run a Dota-community that has a fair amount of users.

Every day I need to decide between playing a handful of matches with my users or working on coding projects, and it's a hard decision to make.

What has been working most effectively for me is "code-weeks", I have at least a week a month where I limit myself to two (2) games a day, and make sure I'm spending some hours every day working on projects.

It's not perfect, but at least consciously trying to follow this pattern has pushed me to be more productive than I was in 2013, and quitting DotA cold- turkey is just not something I think I could stick with.

</comment><comment><USER11> Nah bro, don't quit man. Be who you are. There are literally so many programmers but only a few LoL elite players. You have to embrace what you love and not let society dictate what is "respectable" or not.

I understand what you're saying, it's fine to give up LoL and try out the professional life. But don't forsake it, my guess you'll pretty soon see the absurdity of app development.

Your clients are like the noobs that call "mid or feed," your co-workers and bosses care more about farming and jungling than helping solo gank. No wards, no missing calls either, everybody for themselves.

Watch a man play LoL/HoN/Dota2 and you can see how a man truly is. Work will always be there but a elite LoL player, that is livin' the life bro.

<comment> jon-wood Please tell me this is a parody. Please.

</comment></comment><comment><USER12> I went through exactly this with World of Warcraft, and later StarCraft. I wanted to go pro playing SC but I realized it wasn't sustainable or as fulfilling as I had hoped. I ended up just giving them up, once I realized it wasn't really building towards anything in my life. It felt like a big loss, but looking back, I wish I hadn't played so damn much in the first place.

I wrote more about it here. [https://danschnau.com/world-of- warcraft/](https://danschnau.com/world-of-warcraft/)

</comment><comment><USER13> Hi TNA,

If you treat gaming like a proper career, where you research and actually care about things like ad hits, branding etc. it will actually make the stuff you do in gaming actually leveragable when you apply for other positions, especially in startups.

If you want to talk about this stuff, my email is on my profile. I have a few ideas on how a person in your unique position can make the most out of it, for both yourself and the community.

Best of luck mate.

<comment><AUTHOR> Hi Jack,

I tried looking for your email but all I was able to find was your LinkedIn page.

<comment><USER13> email@example.com

</comment></comment></comment><comment><USER14> I think you are on good ground, behing aware is a big deal.

About choices ... i belive you have something precious, a fan base: i would think about doing something middleground, something that can involve and interest your LoL users and give you something good to put on you resumee, don't underestimate the "popularity" !!!

Good Luck ;)</comment>


How to build your own VPN if you're wary of commercial options - <AUTHOR> https://arstechnica.com/gadgets/2017/05/how-to-build-your-own-vpn-if-youre-rightfully-wary-of-commercial-options/ <comment><USER3> The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically back to you.

<comment><USER4> > AWS instance is easily traced back to you.

Define "easily" as used in this context. Easy is a product of whom your enemy is.

Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them.

Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them. Unless you are a MAJOR pirate distributor, the extra effort(money) to track you down isn't worth it.

Is your enemy the NSA or the FBI? If that's the case, then yes, it's trivially easy for them to Subpoena digital ocean or amazon to get your data, but similarly they can use techniques on PIA to get your data too.

In the end, it comes down to whom you trust with your data. And whether you want a managed VPN service, or are willing to put up with the inherent problems of maintaining your own system. will PIA sell your surfing habits to advertisers, will DO sell your surfing habits to advertisers? Who gives faster speeds?

<comment><USER5> I agree overall, but PIA has may not be the best example, as they have been shown to not keep any data that could be subpoenaed[1]. One nice thing about running your own (if your client machine is on Linux) is being able to use Wireguard[2], which is quite a bit faster than OpenVPN, for example.

1: [https://torrentfreak.com/vpn-providers-no-logging-claims- tes...](https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in- fbi-case-160312/)

2: [https://www.wireguard.io/performance/](https://www.wireguard.io/performance/)

<comment><USER6> Never heard of Wireguard before, but it looks really cool, especially the mosh-like roaming. However, I found this warning on their website.

 _WireGuard is not yet complete. You should not rely on this code. It has not undergone proper degrees of security auditing and the protocol is still subject to change._

<comment><USER7> its also versioned with a double zero: v0.0.20170517 and the repositories are marked unstable.

also, the protocol itself is still considered 'version 0' with lots of possible changes on their website.

looking forward to it maturing though.

</comment></comment></comment></comment></comment><comment><USER8> I operate my own VPN endpoint for a couple reasons:

1\. I frequently need to connect via open, untrusted local networks, such as those at hotels.

2\. Many commercial VPNs (e.g., PIA) end up having some portion of their endpoint IPs end up on blacklists and break a lot of sites.

Anonymity from the government is a lower priority than both of the above, and I acknowledge the lack of it in my risk model.

Initially I started out just running a Streisand[0] server, but its scope and overall speed were unsuited for my wants. Now it's just a barebones VPS with OpenVPN running, and I connect to it primarily through a travel router.[1] Longer term I would like to develop an Ansible playbook so that I can quickly deploy a new endpoint at a close VPS when traveling if the need arises for better speed.

[0]: [https://github.com/jlund/streisand](https://github.com/jlund/streisand)

[1]: [https://www.amazon.com/gp/product/B01I92T754/ref=oh_aui_deta...](https://www.amazon.com/gp/product/B01I92T754/ref=oh_aui_detailpage_o04_s00)

<comment><USER9> >2\. Many commercial VPNs (e.g., PIA) end up having some portion of their endpoint IPs end up on blacklists and break a lot of sites.

Yup. I cannot use these in good faith. I've gotten burned really badly by using shared VPNs and payment-type sites. I roll my own on a no-log VPS paid in Bitcoin through a mixer, registered to a false name/address.

</comment></comment><comment><USER10> Alternatively, just use Algo. [1] It's a self-hosted, hardened IPSEC VPN that automates setup on multiple cloud providers.

1\. [https://github.com/trailofbits/algo](https://github.com/trailofbits/algo)

<comment><USER11> Algo is great!

For anybody who wants steps on setting it up with an unsupported provider, I wrote a blog post on exactly that recently: [http://modulolotus.net/posts/2016-03-28-setting-up- algo/](http://modulolotus.net/posts/2016-03-28-setting-up-algo/). I used Vultr, but it should help for any Ubuntu-based server.

<comment><USER12> Is the "2016" date in your blog post & URL correct? Seems off by a year.

<comment><USER11> Ooo, good catch. Must have mistyped the year in the filename.

</comment></comment></comment></comment><comment><USER13> Like, I'm not sure why anyone thinks that:

1\. AWS, DO or Linode won't respond to a subpoena

2\. That any of those three won't have extensive logging in place, without the privacy goals that a VPN provider would have

You're just switching your ISP to AWS when you do this, which might be better than what you've got, but certainly isn't flawless untraceable security

<comment><USER10> I really hope people aren't using a VPN for untraceable security. VPNs are for privacy, not for getting away with illegal things.

<comment><USER14> Yeah, coffee shop wifi is for getting away with illegal things.

<comment><USER15> I can confirm. This is where I write all of my dangerous Visual Basic IP addresses.

</comment></comment></comment></comment><comment> super-io "... but what about when your ISP literally edits your web traffic, inserting more ads, and possibly breaking webpages."

It is possible the ISP not only injects ads but injects unique identifiers that the user never sees. These could be used to track the user across different devices and networks. This possibilty was suggested a few years ago by a well-known cryptographer in a presentation titled "How to manipulate standards".

</comment><comment><USER16> This is odd. The primary point of VPN services (aside from a layer of protection on untrusted networks) is to mix your traffic in with N other random users such that the chance of you being identified as the source of the traffic is 1/N instead of 1/1.

Hosting your own VPN exit node, with you as the sole user, defeats this use case entirely.

<comment><USER17> It's worth nothing that this may be _your_ primary point, but that does not necessarily extend to the whole. Netflix has region-locked content that is often most easily accessed by leveraging VPNs. ISPs will have greater trouble selling off your meaningful browsing data if it's going through a VPN. And so on.

</comment></comment><comment><USER18> Why is he using AES-CBC rather than AES-GCM? GCM is generally faster & more optimized, especially for hardware offloads like might be present on some routers.

Is there something about OpenVPN that doesn't support GCM?

<comment><USER19> AFAIK OpenVPN _officially_ has GCM mode support since v2.4, which is relatively recent (official release December 2016).

I'm sure it was also present in 2.3.x - at the very least I'm certain that 2.3.10 I have on one host supports TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 - <USER2> it could be distro-specific backports or something like that. At least 2.3 changelogs don't mention anything about AEAD or GCM specifically, and GCM support is featured in [https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes....](https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst)

<comment><USER19> Update: no I was wrong. OpenVPN v2.3.x has two connections, a control channel and data channel. That TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 (defined by `tls- cipher` setting) is a control channel, and data channel doesn't support GCM.

Anyway, 2.4 is out already.

</comment></comment></comment><comment><USER20> I would like to have a setup like this:

\- One VPN to connect laptop on the road with machines at home LAN, and with VM:s on different hosts.

\- Have this VPN "exit" via a commercial VPN-provider (for privacy).

Could I easily configure this? Have one of the VM's be the VPN server and configure it to "exit" trough the commercial VPN?

I haven't really managed / configured "real" VPN's, how does local access work? I.e, when I'm at home with my laptop and access my desktop that's on the same network, will the packets flow out to the remote VPN server and back, or can it resolve it locally somehow?

Also, will this break stuff that depend on Bonjour / ZeroConf (i.e Apple Airplay and stuff?)

<comment><USER21> > Could I easily configure this? Have one of the VM's be the VPN server and > configure it to "exit" trough the commercial VPN?

This is easily doable, but it comes down to how much you trust your commercial VPN host. As it is, most of these service providers are pretty shady to say the least. If it were somehow possible to provide a service that is _provably_ secure and log free, that would be a different story.

<comment><USER20> For the last year or something I have been using [https://www.ovpn.com/en](https://www.ovpn.com/en). They are not shady at all, and allow bitcoin or cash payments, and are run by a friend of a friend, so I trust them. But no less provably secure compared to the rest.

</comment></comment></comment><comment><USER22> I'm surprised that tinc-vpn.org isn't mentioned more in these VPN threads. It's such a pleasure to work with when compared to OpenVPN. You can standup a distributed mesh VPN in minutes.

<comment><USER23> You should add that it routes in user-space without turning on kernel forwarding, to any node in the network even if they are not directly connected. There are some nice privacy and availability aspects to this.

</comment></comment><comment><USER24> A lot of the focus of VPN discussion centers around logging, and around whether their provider is prepared to hole themselves up in their compounds like Branch Davidians to protect their info.

That misses the point. If the government wants to hack you, steal your traffic, etc, they can, VPN or not, 'no-log' VPN or not.

The point behind consumer-level VPNs is more to prevent the ISP-level tracking, the ad-targeting, etc, and to keep out hackers and get around government/institution blockers. For this, whatever well-reviewed service will do.

</comment><comment><USER25> or use docker: [https://hub.docker.com/r/kylemanna/openvpn/](https://hub.docker.com/r/kylemanna/openvpn/)

<comment><USER26> > or use docker: > [https://hub.docker.com/r/kylemanna/openvpn/](https://hub.docker.com/r/kylemanna/openvpn/)

That's my project, thanks for the shout out!

For those curious the main feature of the Docker container is to wrap up the PKI generation and conf file generation for the 90% use case.

</comment></comment><comment> super-io "First your website uses SNI..."

s/uses/may use/

Not every website uses SNI.

For example, the majority of sites linked to from HN _do not_ use SNI.

Also, there are workarounds when SNI is not supported. Workarounds have been published by one major corporation who authors a popular web server software and runs a cloud hosting service.

Is SNI "the only way to do it"? No. There is another way to do stream encryption for mlutiple websites from one IP. It predates HTTPS. This idea goes back to one of the original authors of the world's first web server at CERN. The legacy of this idea survives today as the Websocket "Upgrade" header. Links to further reading below.

Because of groupthink dynamics among today's standards committee people and website owners who follow along, it appears that any online discussion of alternative options to SNI is met with swift dismissal.

[http://www.ietf.org/rfc/rfc2817.txt](http://www.ietf.org/rfc/rfc2817.txt)

[http://www.ietf.org/rfc/rfc2818.txt](http://www.ietf.org/rfc/rfc2818.txt)

The draft below refers to proxies but further searching will find papers he wrote about how to start an encrypted stream upon connecting to an HTTP server. Any service could sit behind one simple HTTP interface. This idea was revived in "Upgrade" header referred to above. Then forgotten as HTTPS became popular. Then revived again for "Websockets".

[http://www.ietf.org/archive/id/draft-luotonen-web-proxy- tunn...](http://www.ietf.org/archive/id/draft-luotonen-web-proxy- tunneling-00.txt)

SNI is not the only solution, it is just one approach, and I suspect the next- generation encryption (a TLS alternative that will be readily adaptable to PQ) will not need to send domain names in the clear.

<comment><USER27> I am interested in this idea, but I don't expect a better solution than SNI to appear anytime soon.

RFC2817's `Upgrade: TLS` is just like SNI except it requires an extra roundtrip and it only works for HTTP, not other TLS-enabled services experiencing the same issue (e.g. IRCS, FTPS, ...).

For an HTTPS server with a single certificate and no SNI handling, the domain name is (A) still leaked in plaintext by the initial DNS lookup, and (B) instantly visible by anyone who connects to the IP address.

Even if you plug the DNS hole, the fundamental issue is needing to secure communications with the remote server, before you even tell it what domain you're asking for. That can't work under the domain-validation CA model.

I suppose you could add an extra layer of indirection, by adding a certificate for the server itself; but that's just moving the chain of trust, and it's practically equivalent to a multi-domain SAN certificate.

</comment></comment><comment><USER28> I have no current need for it, but I'd be really interested to read a step-by- step guide on setting up an untraceable server using cryptocurrency, starting from cash. As others have pointed out, the hole in these instructions is that you have to trust Digital Ocean.

</comment><comment><USER29> I ran across this one today: [https://github.com/trailofbits/algo](https://github.com/trailofbits/algo)

Based on ipsec, so no extra software to install on the clients. Looked interesting.

</comment><comment><USER30> We also built a solution to quickly deploy your own VPN using OpenVPN: [https://www.tinfoilsecurity.com/vpn](https://www.tinfoilsecurity.com/vpn)

All open-source, too.

</comment><comment><USER31> It seems the gov of Egypt is starting to block ipsec vpns like it did openvpn ones. Any generic solution to add obfuscation layer? Wish more VPN software had such functionality out of the box

</comment><comment><USER32> What's the difference between L2TP/IPsec and OpenVPN?

<comment><USER33> They are three different protocols allowing to tunnel encrypted traffic between two end points:

\- L2TP is the "layer 2 tunneling protocol", where the layer 2 is usually PPP, and an IETF standard;

\- IPsec is designed to tunnel IP over IP, and an IETF standard;

\- OpenVPN is a specific software and protocol, using TLS. IF memory serves well it can operate at both Ethernet and IP level, although IP is the most common.

<comment><USER34> To add, L2TP is only tunneling and not encrypted, which is why it is often used in combination with IPSec.

It is used _instead_ of pure IPSec because it allows non IP traffic, which in some cases is more important (e.g. windows non-IP netbios traffic interop when L2TP/IPSec was first made popular)

and to confirm, yes, OpenVPN will run in IP or ethernet mode.

</comment></comment></comment><comment><USER35> This might be a good idea for a startup where they create a plug and play service so users do not have to go through all of this.

</comment><comment><USER36> Too bad IPv6 is again ignored completely; not even a mention in the article.

<comment><USER37> From my perspective in datacenter infrastructure, ipv6 interest has actually _declined_ in recent years.

I think the emergence of a functioning IPv4 market has actually tipped the scales backwards towards v4 unfortunately. I frequently hear from operators that v4 technology (and expertise managing it) for sharing addresses (NAT) is so mature and stable that there isn't much gain for them in the riskier bet on v6.

You would also be shocked at how many also consider the unsolicited ingress connection blocking caused by NAT to be a bonus security feature that v6 doesn't have.

I'm starting to become convinced I will be dead long before v6 dominates the world. :(

</comment></comment><comment><USER38> I setup something from a script on digital ocean a while back.

</comment><comment><USER39> Its difficult to make you own VPN. you have to purchase servers and IPs

The best solution is to buy a vpn and stay secured. you can run it on - devices. I use ivacy because its $2 a month and working fine with me.

</comment><comment><USER40> Easier: [https://github.com/hwdsl2/setup-ipsec- vpn](https://github.com/hwdsl2/setup-ipsec-vpn)

</comment><comment><USER41> Or just use a modern deployment option like [https://github.com/jlund/streisand](https://github.com/jlund/streisand)

</comment><comment><USER42> i think nordvpn is like 80 bucks for 2 years seems worth saving this hassle.</comment>


A Global Graveyard for Dead Computers in Ghana - Slide Show - <AUTHOR> http://www.nytimes.com/slideshow/2010/08/04/magazine/20100815-dump.html?ref=global-home <comment><USER2> The last slide says it best:

"The Basel Convention on the Control of Transboundary Movements of Hazardous Wastes and Their Disposal, agreed to in 1989 and now adopted by a majority of nations, was meant to stop the dumping of toxic waste in poor countries. But rules get complicated when the waste arrives as a gift."

I think it's easy for most people to basically throw our old junk on the less fortunate if we think it's helping them. In fact, it makes us feel like we're making a difference. And we are, in some cases, but this slide show was a reminder of the importance of understanding the implications of our charitable giving.</comment>