Operator of Silk Road 2.0 Website Charged in Manhattan Federal Court - <AUTHOR> http://www.fbi.gov/newyork/press-releases/2014/operator-of-silk-road-2.0-website-charged-in-manhattan-federal-court <comment><USER2> They located Silk Road 2.0's server in an unspecified way, not directly related to their undercover agent on the support staff. Given that two other darknet markets (Black Market and Cloud9) have been shut down today, and they didn't specify how they located the SR2 server, it seems plausible that law enforcement have a vulnerability to locate servers over the Tor network.

From the complaint:

"In or about May 2014, the FBI identified a server located in a foreign country that was believed to be hosting the Silk Road 2.0 website at the time. On or about May 30, 2014, law enforcement personnel from that country imaged the Silk Road 2.0 Server and conducted a forensic analysis of it. Based on posts made to the SR2 Forum, complaining of service outages at the time the imaging was conducted, I know that once the Silk Road 2.0 server was taken offline for imaging, the Silk Road 2.0 websites went offline as well, thus confirming that the server was used to host the Silk Road 2.0 website."[1]

Then, as a result of extremely poor OpSec (Benthall accessed the server directly, used his real email for registering the server), they got his IP's and, well, you know where it goes from there.

1\. [https://pdf.yt/d/RpyX9_xmapTkhmkb](https://pdf.yt/d/RpyX9_xmapTkhmkb) (Complaint)

<comment><USER3> Interesting read, some highlights from the complaint:

"40\. Based on a review of records provided by the service provider for the Silk Road 2.0 Server (the "Provider"), I have discovered that the server was controlled and maintained during the relevant time by an individual using the email account "firstname.lastname@example.com" ("Benthall Email Account-1")."

"b. I have also reviewed a publicly available profile of "Blake Benthall" on Twitter, another social networking website, which includes a photograph of BENTHALL as the user of the account, depicting the same individual associated with the GitHub account, discussed above. I have reviewed a post on that Twitter profile, dated on or about November 6, 2013, the date when Silk Road 2.0 was publicly launched, stating: "All this talk about the #SilkRoad being back up makes me want to watch ThePrincessBride.""

"a. I have reviewed records provided by a U S.-based Bitcoin exchanger ("Exchanger-1"), for an account registered under the name "Blake Benthall" and linked to Benthall Email Account-1 ("Bitcoin Account-1"). According to transaction records for Bitcoin Account-1, BENTHALL engaged in his first Bitcoin transaction with Exchanger-1 on or about November 7, 2013, the day after Silk Road 2.0 was publicly launched. The transactional records reflect that, since that date, BENTHALL has received a total of approximately 575.58 Bitcoins into the account through on or about October 28, 2014, and that BENTHALL has exchanged approximately 543.63 of those Bitcoins for United States currency, totaling $273,626.60"

"c. I have reviewed emails from Benthall Email Account-1 reflecting that BENTHALL purchased a luxury vehicle with Bitcoins in late January 2014 - approximately one month after Defcon assumed control of Silk Road 2.0. Specifically, email correspondence indicates that, in or about late January 2014, BENTHALL made a down payment of approximately $70,000 in Bitcoins towards the purchase of a Tesla Model S, worth approximately $127,000 in United States currency."

"b. Records provided by Exchanger-1 regarding Bitcoin Account-1 indicate that on the same date, BENTHALL logged into Bitcoin Account-1, using the identical combination of software: Google Chrome web browser version 35.0-1910.3 and the Apple OS X operating system, version 10.9.0.

"c. According to publicly available information, on or about April 6, 2014, Google Chrome version 35 O.1910.3 was a beta version of the browser,L2 and Apple OS X version 10.9.0 was outdated.B Thus, based on my training and experience, this particular combination of software versions would not have been common among Internet users at the time. The information available to the HSI-UC indicates that Defcon was not using Tor to access the customer support interface at the time, which would have caused Defcon's browser and operating system to appear differently."

<comment><USER4> >> made a down payment of approximately $70,000 in Bitcoins towards the purchase of a Tesla Model S

Way to lay low.

<comment><USER5> This is a lot of major crimes investigations: if you want to participate in an organized criminal effort (which is what SR2.0 is), you're only as secure as the weakest link in that effort. Worth remembering when SR3.0 comes out. Is it being run by someone else who will put out a hit on a rival, or plow $70k of revenue into a Model S.

<comment><USER6> Silkroad 3.0 will probably be this: [https://openbazaar.org/](https://openbazaar.org/)

Good luck in taking that down.

<comment><USER7> Interesting. Are you claiming that OpenBazaar will be free of bugs, exploits, side-channel attacks, etc? Have you done an analysis of the code? Got a link?

<comment><USER8> I think he just meant that it's like Bitcoin. To stop Bitcoin, you need to seize everyone's computers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I think this is the money quote:

"During the Government's investigation, which was conducted jointly by the FBI and HSI, an HSI agent acting in an undercover capacity (the "HSI-UC") successfully infiltrated the support staff involved in the administration of the Silk Road 2.0 website, and was given access to private, restricted areas of the site reserved for BENTHALL and his administrative staff. By doing so, the HSI-UC was able to interact directly with BENTHALL throughout his operation of the website."

So I assume this means they were able to infiltrate the community and there was possibly no unauthorized break necessary on the actual technology stack. It does lead one to question how they drew the final line between Benthall and his online persona, unless the undercover agent was also given access to financial information or other personally identifiable info. Maybe they even placed a malicious program on the server to target Benthall after they had control of a support backend. Interesting to see if that is all that comes out....

<comment><USER10> This sounds no different than the undercover police, detective work the FBI has been doing since its establishment. Infiltrate the perp, take him down.

They used the same tactics on gangs, mobs, etc. Now violent crime is slowing, but they have hoardes of agents trained in these protocols, so they're redirecting energy into catching so called "cybercriminals."

A bunch of people who infiltrated the mob are now infitrating groups of nerds in basements. It's frustratingly hilarious.

By the way: If the FBI is so successful using traditional police tactics to infiltrate "cybercrime syndicates," why do they need a "front door" to our devices?

<comment><USER11> > A bunch of people who infiltrated the mob are now infitrating groups of > nerds in basements. It's frustratingly hilarious.

I'm a little skeptical of this whole shtick that online criminals are just "nerds in basements." A nerd can do a lot more damage to your life with a computer than your average petty criminal.

<comment><USER12> True, but that doesn't necessarily mean they will. One of the smarter things about Silk Road in my view was the nominal policy of disallowing trade in child pornography, criminal services, stolen credit card data and so on, ie illicit things that also have (or are intended to have) victims who are necessarily injured as a condition of production. There's no economic tipping point at which the consumption of child pornography could justify the abuse perpetuated in its production, for example.

While the drug trade can cause people to become victims (just as the legal trade in alcohol or cigarettes or many other commodities), such victimhood is incidental to the production and consumption of the illicit good rather than inherent to it. I think this distinction between what sorts of contraband could be traded on Silk Road (even if it was not adhered to in practice) is a big part of why many people were/are sympathetic towards Silk Road.

<comment><USER13> One of the most astonishing parts of dark markets is that it flips the drug- dealing paradigm. Instead of watered-down product sold by unsavory people only motivated by profit, we now have what are essentially drug aficionados who are earnestly interested in selling the best possible product.

Which isn't to say they're allergic to profit, but since its closer to an open-market they can no longer rely on being the only game in town. Testimony from buyers on the dark markets shows that some dealers even include free drugs, which is completely unheard of.

If the cocaine cowboys of the 70s and 80s were the first wave and the crack kingpins of the 90s were the second wave, then the cyber vendors are the third wave drug dealers.

</comment></comment></comment></comment></comment><comment><USER14> "On or about October 7, 2013, the HSI-UC [the undercover agent] was invited to join a newly created discussion forum on the Tor network, concerning the potential creation of a replacement for the Silk Road 1.0 website. The next day, on or about October 8, 2013, the persons operating the forum gave the HSI-UC moderator privileges, enabling the HSI-UC to access areas of the forum available only to forum staff."

They were compromised from day 1, before the 2.0 site had even launched. I wonder how they managed to be a trusted admin so quickly?

<comment><USER15> That sounds like the FBI had already infiltrated the Silk Road 1.0 community so they were invited into 2.0 at the beginning.

<comment><USER14> That might have the most chilling effect on a 3.0.

<comment><USER16> WANTED: rockstar programmer for new e-commerce startup. still in stealth mode, but think silk road with less php and more rails. bitcoin experience/enthusiasm a plus. message for details. no feds please.

<comment><USER17> Better watch out, law enforcement isn't exactly known for their sense of humour.

<comment><USER18> Perhaps, but that kind of joke gets made all the time on the Internet without bringing down black helicopters.

<comment><USER19> I made a joke like that on Slashdot once and the black helicopters did show up. Well, the Secret Service, anyway.

<comment><USER18> You satirically quoted an imaginary job posting and Secret Service showed up? That sucks, I guess we need to close down Duffel Blog and The Onion then.

<comment><USER20> Or you know, he did a SLIGHT VARIATION of the "imaginary job posting", an "imaginary something else" but equally imaginary and tongue-in-cheek...

<comment><USER18> Yes, I'm _sure_ that his "not actually the same as the joke we're talking about" joke was a mere slight variation. Maybe the Secret Service guy missed the (+5: Funny), I'm sure that happens to the best of us sometimes.

<comment><USER20> Yeah, because secret service and/or cops are known to have a great sense of humor and enough understanding of the Web (including Slashdot trivia).

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Maybe the title should be, "FBI Announces Silk Road 3.0" :-) And I agree, folks seem to be running these things out of the US rather than out of say the Cayman islands or Belize where is it easier to level the playing field with respect to the authorities.

<comment><USER22> I'm not so sure. There have been offshore gambling sites (sports, poker etc...) that have been shut down before with the cooperation of local authorities, although not always easily. They may see revenue for local industry as a nice plus, but not so nice as to risk the ire of the U.S. govt.

In the end, your allies offshore may only be as loyal as the force they're willing to ignore. And your friends may only be as trustworthy as the information you choose to share with them.

Edit: Link to that poker takedown news [http://www.covers.com/articles/articles.aspx?theArt=234980](http://www.covers.com/articles/articles.aspx?theArt=234980)

<comment><USER23> With TOR, though, it's very easy to move servers quickly. Who wants to play a foreign game of 'whack a mole'? Authorities will tire quickly of complying with an endless game.,

<comment><USER24> I'm not sure how this is a whack-a-mole game.

If you run a single-server hidden service, the NSA _can_ track it (unless you think otherwise - tried to initiate discussion here[1]).

Once they track it, they _will_ get your hosting provider to cooperate and before you know it, your server has been imaged and that irrevocable .onion private key is in the authorities' hands. The most you'll see from your end was some downtime, which a cooperative host (an assumption here, granted) would cover up for the FBI (status update: rack/sector/DC failure at XXX).

They can now impersonate your server, MitM you, the works. After that, in order to move, you have to _literally move_ to another onion address.

What you're saying makes sense if there is anyone who habitually rotates servers as a matter of OPSEC, but that sounds like an invitation for disaster.

AFAICT the name of the game isn't whack-a-mole, because when the NSA sees the mole, it will whack it.

It's "bury the mole in the moleyard" \- multiple mirrors so as to make locating the actual service very unlikely.

[1] [https://news.ycombinator.com/item?id=8568667](https://news.ycombinator.com/item?id=8568667)

<comment><USER25> I'm wondering why they would image the server. Did SR2 not use full disc encryption using LUKS? How would they be able to access anything on it, I know if I were running SR2 I'd have the longest private key ever stored in my brain to decrypt the drives.

<comment><USER24> > I'm wondering why they would image the server.

For offline analysis and to be used as evidence, presumably.

> Did SR2 not use full disc encryption using LUKS? (...) longest private key > ever

So the process for you would be slightly different: There would be a "power outage" in your rack, your encrypted disk would be imaged and (unencrypted) bootloader would be bugged.

Then they'd wait for you to see that your server had some issues, upon which time you'd have two choices:

-enter your private key to resume the service.

-abandon the server.

The correct choice would be (2), but you don't have enough information to make that call.

<comment><USER26> It's not log bugging your bootloader can magically send your password for the key off the server. They would have to be watching and be very quick, but I'm sure they'd want to see the server start to boot to ensure they have it.

I'd compare the bootloader to a known good image as an early boot step and if it isn't what you expect immediately start destroying data. :-)

<comment><USER24> I meant "power outage" as the pretext that would justify (to the HS owner) why the server has been power-cycled (assuming they decided to cooperate with the FBI/whoever).

Here's how I would do it:

\- I assume that your hard drives are in RAID. I gamble that they're in RAID 1 - most typical - and strip one out while the server is still running. Some kernel messages are logged, whatever.

\- I start imaging the disk. If it isn't a mirror of the other after all, I strip the remaining drive(s) out and start imaging them too.

\- While the disk(s) is/are transferring, I patch both your boot loader and your kernel with a rootkit. This should be laughably easy for the level of adversary we're talking about.

\- When the disk(s) are done, I power cycle your server. I may cold-boot your RAM and get the passphrases there if i'm lucky. The downtime was either seconds (if it kept going with one RAID 1 disk) or <however long the imaging takes>.

\- When you realise your service is down you may contact customer support. In that case they will respond (with their usual timing) about something- something-blown-fuse-UPS in your rack.

\- When you log onto your server, you will most likely be faced with the passphrase input and most likely will go for it, but even if you don't...

> I'd compare the bootloader to a known good image as an early boot step

If you do so after you've given away the passphrase, you've lost already. Destroying the data won't help, as they have the encrypted copy of it and you just gave them the key.

I don't think you could detect a good boot/OS rootkit remotely at all. One would cover for the other. You can't unplug the disk and examine it. You can't plug a read-only drive in and boot some forensic tool. All you have is your lying bootloader and your lying OS. Your encrypted partition doesn't protect the integrity of the binaries there either, as after it's been decrypted, the rootkit would happily intercept any values that would give it away.

I'm not sure how you could ensure hardware security without ensuring physical security. Usually, physical access == pwned. Maybe TPM changes/will change that, but I somehow doubt it. Some other routes not covered here (probably easier, heh): Getting host to decrypt your TLS/KVM session where you typed the passphrase in the first place, malware in firmware on misc devices, etc.

<comment><USER25> > I patch both your boot loader and your kernel with a rootkit. This should be > laughably easy for the level of adversary we're talking about.

Well, you won't be getting the kernel, its on the drives. It would have to be in a separate partition so you can start it before mounting the sensitive filesystems, and you may have a key that the bootloader uses on it, but in either case if you are not present and a sever goes offline you basically have to do the following:

Verify the ROMs integrity in that first stage - before you put in the key for your actually sensitive data. That means you need open firmware or some mechanism to hash the ROM that is installed, you need to have a means to read it in its entirety, and then you need to hash it.

I say open firmware because you need to be able to guarantee the FBI couldn't embed a backdoor firmware. If you can get open spec / openfirmware mainboards and verify their authenticity only then can you be safe.

Then you verify the kernel, which is much easier because you can compile it yourself, maybe even pad it with some random and scramble the ELF tables in some custom orientation.

And then you need to worry about how you input the key - if its by USB, you can backdoor the USB and network controllers and keylog in hardware depending on the vendor and model of the mainboard. Over the network, just the NIC is in question, because any secret sharing over ethernet better be over a secure connection.

But that should be it. It is a fine line at best, and a bottomless pit at worse, but there are ways to try to be hardware secure.

<comment><USER24> > Verify the ROMs integrity in that first stage (...) need open firmware or > some mechanism to hash the ROM that is installed, you need to have a means > to read it in its entirety"

Does such a mechanism exist? If you can do this[1] from BIOS, why is it safe to assume that the same can't be done for the dump-bios-image routine? AFAIK the BIOS handles this in real-mode [2] (overrides the OS), and "returns" the image by copying it somewhere in low memory. So, you're trusting the BIOS that it's copied the right data out for you. (goodguybios)

> I say open firmware because you need to be able to guarantee the FBI > couldn't embed a backdoor firmware.

This reminds me of this NSA _RAID controller_ rootkit for Dell Poweredge Servers [3]. Nuts. Every closed firmware on your servers is a potential hiding place to someone with (soldering-iron-to-the-motherboard) physical access.

In our Dread Pirate use case, you don't even have to think that far as you can't ensure your own BIOS. Who are you going to buy TPM servers [4] from, when you're defending against the FBI? Intel? HP?

The Rootkit wikipedia page is alarming, to say the least. [5]

\--

[1] A Real SMM Rootkit: Reversing and Hooking BIOS SMI Handlers [http://phrack.org/issues/66/11.html#article](http://phrack.org/issues/66/11.html#article)

[2] [http://en.wikipedia.org/wiki/Real_mode](http://en.wikipedia.org/wiki/Real_mode)

[3] [http://resources.infosecinstitute.com/nsa-bios-backdoor- god-...](http://resources.infosecinstitute.com/nsa-bios-backdoor-god-mode- malware-deitybounce/)

[4] [http://en.wikipedia.org/wiki/Trusted_Platform_Module](http://en.wikipedia.org/wiki/Trusted_Platform_Module)

[5] [http://en.wikipedia.org/wiki/Rootkit#Bootkits](http://en.wikipedia.org/wiki/Rootkit#Bootkits) ("Bootkits??")

[6] [https://www.blackhat.com/presentations/bh- usa-07/Heasman/Pre...](https://www.blackhat.com/presentations/bh- usa-07/Heasman/Presentation/bh-usa-07-heasman.pdf)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> "Benthall should have known that those who hide behind the keyboard will ultimately be found."

What a weird tone...

<comment><USER28> In which the purpose of the press release (and bust) is revealed: to threaten the public and make an example.

The usual stuff you expect out of an upstanding agent of democracy.

<comment><USER29> Shame on the US government for threatening the public with the enforcement of its own laws.

<comment><USER28> That statement nonspecifically threatens anyone who "hides behind a keyboard". Also, this threat comes without any determination that the law has been broken; there has been no conviction.

I have no problem with assurance that the law will be faithfully executed. This isn't that. This is inflicting fear to suppress people you disagree with. If only we had a buzzword for that.

<comment><USER16> This is assurance to the public that the law will be faithfully executed. They are assuring the public that the FBI is capable of investigating crimes even on the internet.

<comment><USER30> It would just be nice if they operated under the same judicial rules that they are enforcing. It seems like a large portion of US agencies (who enforce 'justice' in one way or another) these days feel like the same laws they are enforcing don't necessarily apply to them, especially when said law(s) limit their ability to do their job.

Or more simply put, exceptional circumstances have now become a rule rather than an exception.

<comment><USER31> Specifically which laws did the FBI break in this investigation?

<comment><USER30> I'm not sure if they did, "in this investigation".

I was commenting more on the general tone of US agencies, since the PATRIOT ACT, and their contradictions of what is breaking the law when it applies to them vs. whomever they are investigating.

<comment><USER18> Commenting more on the general tone of US agencies, since _changing the law to specifically allow an expanded set of investigatory techniques_ , is them "breaking the law"? What?

You can argue they shouldn't have such authorities, but when the law explicitly gives them authority it's foolish to then claim they're breaking the law when using those same authorities.

<comment><USER32> It can still be breaking the law if they: a) exceed even the authority granted to them explicitly by the Patriot Act or b) the contents or interpretation of the Patriot Act violate the letter (and possibly the spirit/interpretation) of a higher law, namely the Constitution. IANAL so I don't know whether either of those are true, but is something that has been called into question (beyond the ethical or social-impact concerns over the laws and practices enabled by the act). I don't feel shutting down a black market is illegal (or unethical) unless the means to do so were illegal (or unethical). However, saying that US agencies violate the law more often after being given more powers within the law is not necessarily a self-contradictory or strange notion.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> I cannot imagine a way in which a _single-server_ hidden service is safe from a global, active adversary like FBI, NSA & Friends.

This [1] discusses _passive_ analysis over time.

Isn't it really easy to locate one if you can perform active attacks on the global infrastructure? (introduce latencies and/or break links temporarily)

If your hidden service is served by a couple of mirrors on each continent, though... _then_ maybe you're safe?

edit: This is a genuine question, not a rhetorical one. Am I missing something?

[1] [http://www.onion-router.net/Publications/locating-hidden- ser...](http://www.onion-router.net/Publications/locating-hidden-servers.pdf)

<comment><USER33> Good point. Noises have been made for a long time that Tor is compromised given a sufficiently motivated adversary. For instance, [0], among many others.

In light of those noises, my non-rhetorical question is this: Why would any Ulbright wannabe reside within the US DoJ's sphere of influence? Get thee to Russia, and quickly! And while you're at it, keep your hardware in some third, fourth, and fifth locations, neither American nor Slavic.

[0] [https://www.schneier.com/blog/archives/2013/08/has_tor_been_...](https://www.schneier.com/blog/archives/2013/08/has_tor_been_co.html)

<comment><USER24> > Why would any Ulbright wannabe reside within the US DoJ's sphere of > influence? Get thee to Russia, and quickly!

100% agree with this. I imagine it is mostly that people never think they'll get caught - or they view the risk of getting caught as much lower than the benefit of not moving, in any case.

 _Edit 1_ : To add: I think "people" also underestimate _just how easy it is to get caught_.

Getting caught doesn't mean you're stupid, or inexperienced, or anything except that you slipped _once_.

You forgot the proxy, once. You sent your personal pubkey your rather your darknet pubkey, _once_.

It takes next to nothing at all to get caught.

 _Edit 2_ : The link you posted was about a javascript 0day exploit in the Tor Browser Bundle. Implementation flaws will always be there, but if the theory is broken as well... My question is about if the tor protocol itself could theoretically shield a hidden service from a global, active adversary. Which I think it couldn't.

<comment><USER34> Hopefully anyone doing this in the future would be doing so only from Tails and public internet cafes

</comment></comment></comment></comment><comment><USER35> I won't link to them directly, but his accounts on most social networks are not deactivated, are publicly viewable and all mention bitcoin in the bio. In the wake of DPR 1.0 I find this a bit hubristic.

<comment><USER36> That's not the worst of it - the criminal complaint mentions that the server was registered to the email address firstname.lastname@example.com. If that's not a giant "hey, feds, come and get me", I don't know what is.

It also mentions that most of the accounts (Bitcoin wallet and other) that he used were all under his real name.

<comment><USER37> It's enough to make you wonder if someone set him up. Did they have something conclusively linking him to the site in the real world?

</comment></comment></comment><comment><USER38> Why couldn't the FBI land this case by itself? What are the responsibilities and special investigative powers (if any) of "Homeland Security Investigations." How do they justify their existence independent of the FBI? Their webpage suggests they do almost exactly the same thing.

[http://www.ice.gov/hsi](http://www.ice.gov/hsi)

<comment><USER18> ICE is the agency that handles customs inspections, and presumably get called in for any type of smuggling of contraband that crosses national borders.

It would make a lot of sense for the Federal government to have a single agency that investigates all computer-related crimes, but since that would make sense it will never happen. Instead each agency (FBI, US Secret Service, ICE, etc.) will investigate computer-related crimes that tie into their bailiwick, likely cooperating for cases that cross jurisdictional boundaries like this case did.

</comment></comment><comment><USER39> These guys should stop operating out of the US. They might last longer.

</comment><comment><USER40> Thank god, I was worried that my violent street gang was going to lose business.

</comment><comment><USER41> A twitter and github account based in San Francisco with a similar name has been quiet for over a month.

Interests include Bitcoin.

<comment><USER42> He posted on Instagram just 5 days ago [http://instagram.com/blakeisblake](http://instagram.com/blakeisblake)

</comment></comment><comment><USER43> Here's a recent image of the person charged from his instagram:

[http://instagram.com/p/uyqRk1CXWk/](http://instagram.com/p/uyqRk1CXWk/)

Prophetic.

<comment><USER44> Oh my.

Rocket Scientist at SpaceX? I think his career might be put on hold for a while.

<comment><USER45> He's all about getting high.

</comment></comment></comment><comment><USER10> How is the FBI going to handle an inevitably popular decentralized marketplace? Will they prosecute anyone who downloads the marketplace software onto their computer?

All the pieces are in place for a true p2p marketplace. It doesn't exist yet, but it will soon.

EDIT: I should read about OpenBazaar.

<comment><USER46> I think we will arrive at a future where it will no longer be legal to create such software. The FBI will then go after the developers of said platforms.

Of course they will still go after the large sellers and such using traditional investigative techniques.

</comment></comment><comment><USER47> I think this may be his hn account. [https://news.ycombinator.com/user?id=blakeeb](https://news.ycombinator.com/user?id=blakeeb)

<comment><USER48> A software engineer at Space X [1] is also behind Silk Road 2.0? Crazy

[1] [https://news.ycombinator.com/item?id=7277371](https://news.ycombinator.com/item?id=7277371)

<comment><USER49> "when I look back I will clearly view the code I've written here to be way more important for humanity's progress than the code I've written for entrepreneurs' selfish attempts at billion dollar exits"

<comment><USER50> Everyone should note that he worked at SpaceX for _5 months_..

</comment></comment></comment></comment><comment><USER51> Quote from [http://www.irishexaminer.com/breakingnews/ireland/gardai- sei...](http://www.irishexaminer.com/breakingnews/ireland/gardai-seize-drugs- after-probe-into-darknet-drug-operation-650036.html)

 _An international day of action to disrupt global activity on the Darknet and remove certain websites and forums is to conclude within the next 24 hours under the FBI /Europol operation codenamed "Onymous"._

<comment><USER52> Very impressed with the codename.

</comment></comment><comment><USER53> Anyone who knows more about tor than me care to explain how DNS works on onion sites?

I assumed that it would be distributed in some sort of way that prevented this sort of thing from happening? Or does transferring ownership require the owner's credentials to be compromized?

<comment><USER54> You seize the server running the tor software serving as entry-point for your hidden service and grab the private keypair in order to impersonate the hidden service.

The .onion address is iirc a hash of the public key.

<comment><USER53> By entry-point, do you mean a server that you would typically own/rent, or some other server in the tor network that you would not normally control?

<comment><USER54> The first one. In an ideal world (tm) you have two physical servers srv0/1, both with full-disk encryption and some form of remote KVM. srv0 is connected to the internet on eth0 and to srv1 on eth1.

Then you set up networking in a way that the only thing aside from absolute required services running on srv0 is your tor gateway, and no traffic from eth1 may pass through to eth0.

On srv1 you set up the usual services, e.g. mysql, lighttpd and whatever you need hosted.

Ideally, you keep srv0 and srv1 in different datacenters, if not even different countries.

</comment></comment></comment></comment><comment><USER55> There are already movements to decentralize Silk Road type sites using P2P technology, like OpenBazaar: [https://openbazaar.org/](https://openbazaar.org/).

</comment><comment><USER56> To anyone thinking about 3.0, just move to another country.

Preferably one that likes to stick the finger to U.S. and extradition requests. Bring along some extra bitcoins for the local police though.

</comment><comment><USER57> I actually had this guy interview me for a first round at SpaceX. Seemed nice enough and we chatted further. By the time I flew in for the onsite he had "left." Cool dude.

</comment><comment><USER58> Wow. The guy's social media accounts indicate that he is a rocket scientist at SpaceX.

<comment><USER50> Meh.. it looks like he was only there for 5 months and that he quit in March (presumably to work on SR2.0 full time).

<comment><USER26> Unlike at SpaceX, at Silk Road 2.0 the sky is the limit

</comment></comment></comment><comment><USER25> Good news for bitcoin though, all these hidden service seizures and the price has barely budged. It is actually up a bit since this morning.

<comment><USER50> I think "Good News for Bitcoin" should be attached to a little trademark icon every time the phrase is uttered.

</comment></comment><comment><USER59> >>> and Peter Edge, Executive Associate Director of Homeland Security Investigations ("HSI"),

I wonder how is it "Homeland Security". Looks like this confirms "Homeland Security" is completely coopted into War on Drugs. Not that after this: [https://www.eff.org/deeplinks/2014/10/peekaboo-i-see-you- gov...](https://www.eff.org/deeplinks/2014/10/peekaboo-i-see-you-government- uses-authority-meant-terrorism-other-uses) there was any doubt, but basically every time they talk about doing something to fight terrorism, it's probably means drug enforcement.

<comment><USER18> ICE (Immigration and Customs Enforcement) is responsible for controlling the import of goods (such as counterfeit Dutch passports and ID cards, but probably including drugs too) into the country, and they're a part of DHS.

</comment></comment><comment><USER60> OpenBazaar.

[https://openbazaar.org/](https://openbazaar.org/)

</comment><comment><USER61> I feel like this information might make some deviously smart individuals think they can get away with it by not screwing up where Benthall did.

<comment><USER15> Like he probably thought he would't screw up the same way Ulbricht did?

<comment><USER61> Yup, but the one takeaway I get from these court documents is the FBI needs someone to make some bone headed mistakes in order to bring them to justice.

</comment></comment></comment><comment><USER10> What are the chances that the FBI set up a number of "copy-cat-silk-road" hidden services, immediately after seizing the original? That would provide them ample opportunity to 1) build a profile of everyone who used them, then 2) shut them down with an intimidating "sting," dampening the desire of potential copy-copy-cats.

<comment><USER38> If Blake Benthall actually does prison time, I'd say that's extremely unlikely... I suppose the FBI could have been behind the original setup and then sold it to him...

<comment><USER10> Or he's a government agent. After all, who's really verifying he a) exists, b) goes to jail?

Ok, that's enough fearmongering paranoia for me today. See you tomorrow hacker news! :)

</comment></comment></comment><comment><USER62> So what? 100 more will arise. And this time not US based. You close 1 100 more will appear.

<comment><USER63> Marketplaces work much better at scale. And entrepreneurs do better the more they are connected with their markets. So from the government perspective, 100 kittens is way better than 1 lion.

The government doesn't have to make these disappear. They just have to increase the perceived risk and decrease their effectiveness until they're no better than buying on well-known corners or getting the phone number of that one friend's friend's friend.

That's mainly because drug practical prohibition activity is about suppression, not elimination. But I think it's worth noting that cops get paid to fight crime, not defeat it. As a general rule, I expect long-lived organizations to act in ways that self-sustain.

<comment><USER64> Drug prohibition is about police departments getting federal grant money based on how many arrests they have made, seizing property of people arrested for drug crimes, and getting bribes from large-scale dealers.

</comment></comment></comment><comment><USER65> Curious if anyone has any idea how he was facilitating this: [https://github.com/blakeeb/private](https://github.com/blakeeb/private)

</comment><comment><USER66> so, is everyone ready to ditch Tor for i2p yet?

<comment><USER67> It wasn't a protocol issue/backdoor. It was social engineering.

<comment><USER66> Against an adversary tapping the entire network, i've already switched to I2P/Tahoe-LAFS for my private communication/file transferring. It's where Silk Road 3.0 should be located.

</comment></comment></comment><comment><USER68> What does this mean in the wake of Prop 47?

<comment><USER69> Nothing. Prop 47 is a state measure for simple possession. This is conspiracy to traffic, interstate wire fraud, federal crimes prosecuted under federal statutes. Even if these were state charges Prop 47 didn't really change much (or anything) sentencing for sales.

<comment><USER70> Conspiracy to traffic? Doesn't seem like it. Is it something that makes trafficking easier? Sure. But who did the trafficking? The seller and the buyer.

Wire fraud? If it's the sale of something illegal I don't think that suddenly makes it wire fraud. Further, he's not charged with that. The sale is still completed. It's an illegal sale, but not fraud. Fraud would be if someone said they were going to sell you cocaine and instead shipped you powdered sugar.

<comment><USER38> "Conspiracy has been defined in the United States as an agreement of two or more people to commit a crime, or to accomplish a legal end through illegal actions."

[http://en.wikipedia.org/wiki/Conspiracy_(criminal)#United_St...](http://en.wikipedia.org/wiki/Conspiracy_\(criminal\)#United_States)

Thus it's conspiracy if you are party to an agreement which involves you receiving a bitcoin commission (legal end) as a result of the trafficking of drugs (illegal action.)

If they're charging wire fraud, I think that may be part two of the complaint, "Conspiracy to Commit and Aid and Abet Computer Hacking." Probably people were using the site to sell hacking services or hacking tools which could be used to defraud people.

[https://pdf.yt/d/RpyX9_xmapTkhmkb](https://pdf.yt/d/RpyX9_xmapTkhmkb)

<comment><USER71> What if you don't take a cut of the transaction? If there's some flat fee that people pay regardless of whether there is an illegal drug transaction, is that then a conspiracy?

<comment><USER18> Perhaps not, but if you know (or reasonably should know) that a crime is being committed and then don't report it, now you're an accomplice to the crime.

It's hard to miss all the ads for drugs on SR2.0, so it would be very easy to prove that charge at the very least. And as we've seen in the past, Federal prosecutors tend to be very inventive, and the law tends to be rather expansive for these types of things, it wouldn't surprise me at all if there are other charges that would be possible.

<comment><USER38>
      > if you know (or reasonably should know) that a crime is
      > being committed and then don't report it, now you're an
      > accomplice to the crime.

It seems as though this depends on the state you're living in and the seriousness of the crime.

I'd like to know what the relevant laws are (if any) in Ohio and New York.

<comment><USER69> I don't know if any state that has mandatory reporting of all crimes based solely on knowledge. Outside of mandatory reporting of child abuse for certain individuals in specific roles (i.e. doctors, teachers, etc) so that those people report despite confidentiality obligations.

But for the average joe walking down the street and witnessing a crime there is usually no obligation to report that and they don't magically become accomplice. Most state laws in the U.S. don't impose duties like that (or even duties to help others) on its citizens.

Now, if your property is being used to commit a crime and you don't report it there might be different implications. And if you don't report it then you are going to have a difficult time proving you were involved. Guilt by association type scenario and the jury is going to likely believe you were involved. But this is not the same as becoming an accomplice because you didn't report the crime.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER72> 1) It's obvious now that TOR _or_ bitcoin has been compromised in some way shape or form, allowing government strong arm agencies to once again subvert US citizens privacy in order to catch a 'drug facilitator.'

2) I have never drank or taken drugs, but I respect the choice and liberty of another person to do so, whether that be the invasive and deadly alcoholic beverage or the noxious cancer causing cigarette, or even the cannabis that retarded pot-heads smoke.

3) Its a shame the governments, christians, jews, muslims, swahilis and everyone else can't do the same.

4) Thinking about it - having the drug trade on the internet, kept it out of the street. No kids were used to distribute it across schools. No one got robbed or beaten. No one got shot. That's more than you can say for the 'war on drugs' and it's fallout. How many trillions have been spent, and how many people have died because of it? How many non-violent potheads clog the prisons?

*There are more people incarcerated in America, the home of the free, than there are in any other country in the world, apart from Seychiles... because the prison system has been privatized and again - people figured out how to make money by taking away the liberties of Americans.

[http://en.wikipedia.org/wiki/List_of_countries_by_incarcerat...](http://en.wikipedia.org/wiki/List_of_countries_by_incarceration_rate)

5) The drug trade had been around for a thousand years and it was never a problem until the FBI, CIA and various interested parties realized they could make money off of it.

<comment><USER73> > retarded pot-heads

Really?

<comment><USER74> That's the part you have a problem with?

Telling.</comment></comment></comment>


Ask HN: Side project went viral, now Google is charging me $1k. Help? - <AUTHOR> About two years ago I hacked together a side project (https://bennettfeely.com/antiweather) that compares the weather at your location and the exact opposite point on Earth.
It uses the (affordable) Dark Sky API to get the weather forecast at two antipodes and Google's Reverse Geocoding API to simply get the geographic name of a coordinate.
The project was live then but never received much traffic until it was posted on /r/InternetIsBeautiful yesterday.
Now I see I am being charged a little over $1,000 from Google for using their API.
I wish I kept a closer eye on the fact Google jacked up the price of their APIs since I released Antiweather two years ago.
Maybe someone can help me understand why it costs 50x more to simply get the name of a location (Google) than it does to get detailed weather conditions and forecast for any point on Earth (Dark Sky).
I don't feel much hope of finding a way around this surprise bill but I am posting here for any advice at all. Is there any chance at forgiveness for a recent college grad whose side project unintentionally went viral, anyone to contact? <comment><USER2> Have you considered asking the moderators of /r/InternetIsBeautiful if you could make a post explaining what happened and asking for some crowd funding?

</comment><comment><USER3> A free OpenStreetMap based alternative you could use to keep it running in the future:

[http://photon.komoot.de/](http://photon.komoot.de/)

[http://photon.komoot.de/reverse?lon=10&lat=52](http://photon.komoot.de/reverse?lon=10&lat=52)

</comment><comment><USER4> First of all, congratulations! That's really exciting!

This is a costly mistake to learn, but to offer a bit of hope, at my last start-up we accidentally racked up high costs on the location API. Our CEO hopped on the phone with them a few times and was able to get the bill down. Good luck!

</comment><comment><USER5> First, find a cheaper API that accomplishes the same goal. Second, email Google billing and see if they're willing to give a discount considering the accidental and non-commercial nature of the charge.

</comment><comment><USER6> Call Google and I'm sure they'll sort it out

Oh wait, that's not the way Google does support. What you should do is get someone with lots of twitter followers to tweet @google until someone notices this and solves it for you.

Not everyone has enough followers to activate this channel, but surely you know someone who works at Google or has 100k followers?

</comment><comment><USER7> If this is a first time, Google will make one time refunds if you reach out to billing

</comment><comment><USER8> hmm me thinks ya business model should have absorbed this and turned it into revenue?

<comment><USER9> I've built many side projects with absolutely no "business model". Sometimes it's just fun to make something for the fun and the learns. I think people forget that.

It's exciting to see people using these things, but a 1k bill would suck. It's definitely a learning experience, but saying "you should have had a different business model" is a little unfair. If we started every project thinking like that the internet would miss a load of the interesting, weird stuff it has.

<comment><USER10> For real. Sometimes people just want to build something and put it out there for the fun of sharing something cool.

</comment></comment></comment><comment><USER11> Nope, you should have anticipated & used better alternatives. Just apply the same in the real world & you'll see how your approach changes.

<comment><USER12> There are people who think of contingencies for an eventually popular product, and people who build actually popular products to think of contingencies for.

Contingengies are things like business models, scalability, high availability, and big data. People who obsess about these before something even exists tend to do so in meetings solely to utter words that keep them on a large organization's payroll.

<comment><USER11> Woah, you went all abstract real quick. You really want this dude to think there are free lunches?

<comment><USER12> > _Woah, you went all abstract real quick. You really want this dude to think > there are free lunches?_

Not really. I've seen people brainstorm something, and before even validating the need or the prototype, they start talking about millions of concurrent connections and scalability. They would then decide they need to do it in Scala or Erlang, use Kafka, and spend time learning a new stack for high availability, concurrency, fault-tolerance, and all the nice words, and lose years of engineering time.

All that before they even have _one_ user or _one_ connection. Sure, if one has spent 10 years with that stack and that's the one they used to make the prototype, then I agree. But if they're switching because they want to be _ready_ for the "millions of users who'll use the app", that's just statistically silly.</comment></comment></comment></comment>


I'm a black ex-cop, and this is the real truth about race and policing - <AUTHOR> http://www.vox.com/2015/5/28/8661977/race-police-officer

<comment><USER2> Prior discussion: [https://news.ycombinator.com/item?id=9619257](https://news.ycombinator.com/item?id=9619257)</comment>


Hacking a $30 IoT camera to do more than it's worth - <AUTHOR> https://medium.com/@tomac/hacking-a-25-iot-camera-to-do-more-than-its-worth-41a8d4dc805c <comment><USER2> Can you flash firmware to a wyze camera to get them to work on home assistant as they are pretty much the same thing?</comment>


PHP: a fractal of bad design (2012) - <AUTHOR> https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ <comment><USER2> A very good article every PHP programmer should read, regardless if you like PHP or not. It's good to understand why things are they way the are in relation to more (historically) thoughtful languages.</comment>


AppSumo: Optimizely (YC W10) Lifetime Bronze for $17 - <AUTHOR> http://www.appsumo.com/?r=kJAF

<comment><USER2> Is the Bronze package 2,000 visitors A/B tested per month or 2,000 in total before you have to upgrade ?

</comment><comment><USER3> The grammatical error on the front page, amidst a burst of self- aggrandizement, doesn't exactly inspire confidence:

"Its built from the same guys who ran Obama's campaign and worked at Google. That means it's good:)"</comment>


SQL query to generate the Mandelbrot set as ASCII art - <AUTHOR> https://sqlite.org/lang_with.html#mandelbrot <comment><USER2> "Udo of Aachen" was the first fictional monk to find the "Mandelbrot" set:

[https://users.math.yale.edu/public_html/People/frame/Fractal...](https://users.math.yale.edu/public_html/People/frame/Fractals/MandelSet/MandelMonk/MandelMonk.html)

<comment><USER3> Fantastic (and hilarious) read :) Thanks for sharing!

</comment></comment><comment><USER4> I solved the "eight queens" Problem in SQL once:

[https://gist.github.com/adewes/5e5397b693eb50e67f07](https://gist.github.com/adewes/5e5397b693eb50e67f07)

Recursive common table expressions are quite powerful.

</comment><comment><USER5> Since SQL (with recursive CTEs and window functions) is Turing complete [1], one can implement all kinds of algorithms with it. I've replicated an ancient handwriting recognizer in Postgres:

[https://github.com/doersino/handwriting](https://github.com/doersino/handwriting)

[1]: [https://stackoverflow.com/questions/900055/is-sql-or-even- ts...](https://stackoverflow.com/questions/900055/is-sql-or-even-tsql-turing- complete)

</comment><comment><USER6> The sudoku solver is equally impressive, didn't realize that SQL could be bent to do these sorts of things.

<comment> GuB-42 The most interesting part for me is that sudoku is a NP-complete problem, and it can do it rather quickly.

I wonder how effective sqlite is effective at solving SAT or other similar problems. I mean, there are solvers that are certainly much better, but the advantage is that you may have sqlite for free in your work environment. The same can be said of regexes BTW. PCRE are NP-hard and have them solve SAT is relatively straightforward.

<comment><USER7> Sudoku is only NP-complete if you generalize to arbitrary NxN boards. The standard 9x9 Sudoku gives a finite class of problem instances, so you could pre-generate a finite lookup table and get an O(1) algorithm on that class.

It sounds like I'm nitpicking, but restrictions of any NP-Complete problem to a finite class automatically reduces the strength of the problem. To the point, an SQL statement on "small enough" SAT instances will probably also be rather fast.

<comment><USER8> > you could pre-generate a finite lookup table and get an O(1) algorithm on > that class.

If I remember my numbers right there are ~6.67 * 10 ^ 21 valid puzzles so if you want to generate and store that table, I am afraid your Amazon S3 bill will be a bit on the higher side. According to [https://www.bernardmarr.com/default.asp?contentID=1846](https://www.bernardmarr.com/default.asp?contentID=1846) , the 'Global Datasphere' in 2018 reached 18 zettabytes. IOW, your little lookup table would consume all the storage in the world.

So yes in theory you are right of course, it's doable but in practice it's not.

<comment><USER9> I'm not sure that's the finite lookup table he's talking about. Within the last year we talked about Peter Norvig's sudoku solver: [https://norvig.com/sudoku.html](https://norvig.com/sudoku.html)

He starts by generating a table where each cell is represented by a data structure that enumerates all of the legal values in that cell. The options. Then there is code that can find all the peers of a cell (same row, same column, same square).

Turns out that most 'easy' and many 'moderate' puzzles can be solved by starting with a list of all cells with one option.

For each cell:

* solve the cell

* for all peers, eliminate that value from their options

* for all peers with one remaining option, recurse

I believe that's quadratic time, and intuition tells me breadth-first converges faster.

After that, Norvig reaches for brute force, under the theory that this has already gotten you so close to the solution that it's not worth implementing and debugging more complex constaint logic. But I think that despite his claims that Sudoku is a disease, I think this is a taunt; it simply encourages you to go into a more sophisticated process of elimination.

Single elimination: Any option that only has one cell in a row, column or square: solved.

Double elimination: If a pair of peers have only the same two options, then eliminate that option from all of their common peers. Solves nothing, but may solve other cells.

Triple and Quadruple elimination: same thing, but progressively rarer.

Quintuple elimination: I don't recall why, but it was asserted that since this is more than half of 9, any time this happens a simpler constraint is also true.

I believe that covers all of the moderate difficulty puzzles and the occasional hard ones. From there there's a whole array of other constraints you can implement. You can either do it yourself as an exercise, or there are whole websites dedicated to these rules.

<comment><USER7> This is fascinating in its own right, of course, but I was indeed referring to a literal finite lookup table, by appeal to the finitude of the 9x9 problem class only. You give a useful strategy for compacting the size of the lookup table though!

(And really, isn't a function just a compressed lookup table? Often trading time for size.)

Another theoretically interesting way to shrink the lookup table is to reduce all grids to the set of _essentially different grids_ \-- see Wikipedia for the details [0]. The upshot is a reduction in size to "only" 5,472,730,538 grids. You can then scan the set for a grid matching your input clues -- though, as noted, this trades time for size.

[0] [https://en.wikipedia.org/wiki/Mathematics_of_Sudoku#Enumerat...](https://en.wikipedia.org/wiki/Mathematics_of_Sudoku#Enumerating_essentially_different_Sudoku_solutions)

</comment></comment></comment></comment></comment></comment><comment><USER10> Wow, and here I thought writing sudoku solver in Java is a tough task.

<comment><USER11> If you think Sudoku solvers are cool, check out (constraint) logic programming, e.g. [https://github.com/clojure/core.logic/wiki/Examples#sudoku](https://github.com/clojure/core.logic/wiki/Examples#sudoku)

You can take that pretty far! I used it to solve Regex Crossword [0]: [https://www.lvh.io/posts/solving-regex- crosswords/](https://www.lvh.io/posts/solving-regex-crosswords/)

[https://regexcrossword.com/](https://regexcrossword.com/)

</comment></comment><comment><USER12> and a 3D cube: [https://observablehq.com/@pallada-92/sql-3d-engine](https://observablehq.com/@pallada-92/sql-3d-engine)</comment>


Ask HN: How do you do a security audit on your site? - <AUTHOR>

You have (an alpha version of) your site up and running. What steps do you follow to protect yourself against malicious users? I'm referring to sites like tripadvisor.com, that doesn't have a whole lot of sensitive information, rather than turbotax.com. <comment><USER2> Check out my answer to this guy's question about how to test the security of his website: <http://news.ycombinator.com/item?id=385093>

<comment><AUTHOR> That's great. Thanks for your help!

</comment></comment><comment><USER3> A simple first step would be to talk to a security expert locally in your area. In my area (Cleveland, OH) there is a group that will test your security for free and give you pointers on what to change.</comment>


How to speed up your design process - <AUTHOR> http://blog.jogofwar.com/3-ways-to-speed-up-your-design-process <comment><USER3> In your point "Communicate with the client or project leader regularly" it's really necessary that both the customer and the designer talk about the same thing. Everybody knows email loops with explainations "which button should be more blue". Usersnap - <http://usersnap.com> \- offers visual feedback to speed up your design process even further. (Full disclaimer: I'm one of the Co-Founders.)

<comment><AUTHOR> Sounds interesting, I'll have to give that a look.

</comment></comment><comment><USER4> I was all ready to dismiss this one from the title, but reading it has the smack of hard won experience and intelligent reflection.

The process of setting limits withinnwhich experimentation is expected and allowed and of producing a prototype version of all major components - <USER2> can be lifted wholesale into development work.

All round a bookmark to come back to every few months. Have a point

<comment><AUTHOR> Thanks! We've been working hard. Big ups to the developers on board too. They've been sweating it out longer than I have now.

</comment></comment><comment><USER5> > Style tiles help establish a common visual language before getting started > on the mockups. "Can we see what this would look like in purple" will no > longer be such a painful question. Style tiles consist of fonts, colors, > patterns and other interface elements. Now, when your team needs to add a > new screen with various elements, it will be easy to borrow the asset from > the style tile that you previously agree upon.

This sounds a lot like using bootstrap, except you have your own custom version. This would help improve the consistency of the design and make it vastly easier to iterate.

Styletiles, bootstrap and other basic web widgeting toolkits will transform the way web apps are built, saving tons of time and producing better results.

</comment><comment><USER6> "Set limitations for your work" I think this is one of the single most important components of creating anything of value. It is very difficult to innovate on a blank and limitless canvas. Barry Schwartz wrote an excellent book about how increasing choice decreases our satisfaction with our decisions. I think this is the same with design/creation it is so much easier for our brains to process- I have these inputs, these constraints, now what can I do with what I have.

<comment><AUTHOR> Yeah man, that's what it's all about. Just as long as people remember it isn't about setting restrictions on the outcome, but on the process itself. Then your outcome will have better conditions to grow.

</comment></comment><comment><USER7> Love the design and agree with most of what you had on there, infact I've been following a few of those in my own process for quite sometime now.

Although, I have to say, any reason why a _Button Pressed_ style is missing?

Visual feedback on actions improves usability and avoids interaction ambiguity.

<comment><AUTHOR> Certainly, I agree. The reason it doesn't exist is because it was just breezed over. This was an oversight on my part. It's not a perfect system, but it's the best one we've found so far.

</comment></comment><comment><USER8> "The nature of design work is very different from that of development work. The key difference being, developers have a defined end point in which they must solve many problems along the way to reach that point. Designers have one problem with no defined end point."

Ha ha bonk

<comment><USER8> Sorry, I was incredulous. The proportion of situations in which developers have a defined end point can itself be defined, simply, as small.

<comment><AUTHOR> haters gon' hate. It's from a designer's perspective, I'm subject to my own biases.

</comment></comment></comment><comment><USER9> I found this hugely useful, thanks. Also that is a beautiful blog design.</comment>


On Not Allowing Users to Register - <AUTHOR>

<comment><AUTHOR> I was watching a Google video (<http://video.google.com/videosearch?q=Designing+Next+Gen+Web+Apps)> about designing the user interface for web apps and it talked about Measure Map (<http://measuremap.com/).>

It looked like a pretty neat product, but when I tryed to examine it more closely, it would't let me register.

I have some vague ideas about why they wouldn't want me to, but from a business standpoint, if someone is inquiring about your product shouldn't you want them to be able to?

</comment><comment><USER2> They were bought by google and are closed to new users while they go through the google intergrate and then kill process.

<comment><USER3> That sound you hear? That is the sound of google swatting small businesses.

(with a huge wad of cash)</comment></comment>