New South Wales rolls out mobile phone detection cameras - <AUTHOR> https://www.reuters.com/article/us-australia-safety-roads/australias-new-south-wales-rolls-out-mobile-phone-detection-cameras-idUSKBN1Y50QX <comment><USER3> Anecdotally (I have no data or way to prove it) stop and go traffic seems about 20-30% slower to me than when I first started driving. It's only in the last few years have I literally seen people just sitting through a green light, but now taking 10-15 seconds to start moving after the car in front of you has is IMHO far more common.

Previously that was almost exclusive to dropping something on the floor, getting distracted talking to people in the back seat, adjusting the radio, or other things that were exceptions, not the rule. Now it's just failing to look up from the phone in their lap.

</comment><comment><USER4> This is some Orwellian shit. An 88 million dollar investment combined with government-sanctioned Tom-peeping, to save an estimated 100 lives? That money would go a lot farther invested in modernizing vehicle safety, requiring lane assist features, etc. instead of fueling the surveillance state. I suspect those pushing this kind of thing are more interested in a solution where they can just defer all the hard work to "Artificial Intelligence" and avoid collaborating on meaningful change.

<comment><USER5> I disagree. Cars are killing machines, and should be constantly tracked at all times. Over a million dead every single year, 40k in the USA, and 3 every day in Australia. And that does not include the indirect deaths from pollution, urban sprawl, lack of exercise, etc....

> That money would go a lot farther invested in modernizing vehicle safety

Such a meaningless statement.

People shouldn't even be in cars most of the time that they are. In Australia, we are addicted to cars, where a large part of the population can not move without them. Disgusting.

<comment><USER4> > Over a million dead every single year, 40k in the USA, and 3 every day in > Australia.

No one is contesting this, and it's good context for visualizing the supposed 100 deaths/year reduction that this $88mm investment would achieve. We'd still be at ~1 million dead per year.

> Such a meaningless statement.

I gave a precise example immediately following the introduction of the high- level concept. I'm not sure how that's hard to grasp.

> People shouldn't even be in cars most of the time that they are.

Ok, but not an argument that this is an effective use of 88 million taxpayer dollars. You could probably prevent more deaths by spending that money _campaigning for people to drive less_ resulting reduction of overall number of drivers, compared to these ridiculous cameras.

> Cars are killing machines, and should be constantly tracked at all times.

I prefer a proactive approach to safety (better, safer, smarter cars) than a reactive approach (better punishment). Besides, the overwhelming majority of auto incidents are accidental. How will surveillance prevent those? It's solving the wrong problem.

Think of the end game of either option. With true self-driving cars, mobile phone use won't be an issue. But if we make this monitoring acceptable now, the cameras and surveillance will remain. Don't let the Overton window shift.

</comment></comment></comment><comment><USER6> Lots of negativity here so far so I'll chip in and say that, as a cyclist, motorcyclist, and pedestrian, I'm glad to see something happening.

Mobile phone use while driving has reached chronic levels. It's a disgrace. Yes, the police could spend their days trying to catch people. But they aren't, and if they do the letters in the tabloids excoriate them for it.

People have to stop using their phones while they drive. Maybe this will scare them in to a behaviour change.

(I live in the state of Victoria. NSW is our neighbour.)

<comment><USER7> This is coming to QLD too (along with $1000 fines), and I totally support it. Whenever I'm cycling in traffic, I see plenty of people on their phones. The worst is people swerving into bike lanes without looking - peripheral vision seems to be completely lost when a driver's mind isn't on the job.

<comment><USER8> In Vancouver there is no such things as peripheral vision, but that is not due to mobile phone use. Indicators are also optional. I am impressed how there is not a crash every second. When you drive here with a bike you basically know that any car will just cut your bike-lane at their convenience and turn right at a traffic lite, right into your path...

</comment></comment></comment><comment><USER9> I wonder if it will be more accurate than an officer's eyes.

Those eyes are not always the best. I was pulled over once for talking on my cell phone. I told the officer that I had not been using the phone (which was only for emergencies, and was buried in a backpack). He argued with me pretty forcefully, until I invited him to check the call-list. My guess is that I was rubbing my ear at the instant he glanced at my car going by.

<comment><USER10> The cameras take a photo which would very likely be reviewed by a human first. And if the photo is very unclear you have some kind of proof to use unlike a police officer saying they saw it.

<comment><USER11> It confirms that in the article:

"Images that the automated system identifies as likely to contain a driver illegally using a mobile phone are verified by authorized personnel."

I wonder whether the system can tell the difference between the driver using a mobile phone, and a front/back seat passenger using one.

</comment></comment></comment><comment><USER12> Can it detect cookies?

[https://www.technobuffalo.com/man-gets-pulled-over-for- eatin...](https://www.technobuffalo.com/man-gets-pulled-over-for-eating- iphone-shaped-cookies-while-driving)

<comment><USER13> That can still get you booked in NSW, if police decide that it's contributing to dangerous driving.

Based on things I've seen during a morning commute, I hope it can detect bowls of cereal, electric shavers, and open makeup cases as well.

</comment></comment><comment><USER14> I think some context might help; Australia, or NSW already has pretty lengthy requirements for getting a drivers license, plus fairly strict road rules.

You have to "log" over a hundred hours of driving as a learner, and then you progress onto your "P" or probationary license; which is also in two stages, which restricts what you can do.

After you make it through both the probationary phases, you then have a normal (unrestricted) license.

NSW also issue's demerit points for offences; and for a little while now has had "double" points for offences, plus a no-alcohol tolerance (blow anything and you will likely loose your license).

The highest speed limit is also 110km/h on 3-4 lane free/high/motorways; but generally dual-lane is around 60-80km/h, and in built up area's it's 40-60km/h.

This strictness is after decades of road deaths for drivers and pedestrians: [https://roadsafety.transport.nsw.gov.au/statistics/fatalityt...](https://roadsafety.transport.nsw.gov.au/statistics/fatalitytrends.html)

It can be argued that advances in civil engineering and vehicles for driver/pedestrian safety have had a far greater impact than road rules, but causation/correlation etc. The introduction of mandatory seatbelts, airbags, ABS, better roads / infrastructure would also line up nicely with the chart but alas, that's not their narrative.

More recently - "distracted" driving incidents have been making the rounds, and I'm not surprised that the state gov wants to jump on this. I was honestly wondering why I've seen more police on foot at traffic lights waving down drivers and fining them for using their devices over the past week or two, and am not surprised to see this pop on the news either.

In Australia, NSW specifically is considered more of a "nanny" state - <USER2> the lockout laws and so forth.

Personal opinion:

It's fairly easy to get a license here - it just takes a few years (or you just make up your logbook as most youths do), and the testing standards are fairly low compared to Western / Northern Europe.

Parents are generally teaching their younger ones to drive, so teaching standards are incredibly varied and tend to be low.

Then there's also the allowance of almost all international drivers licenses being valid for 3-months, which is rarely enforceable; so you have a few drivers also unfamiliar with the road rules.

The money and effort would be far better invested in a more intensive exam, and regular checks of skills / standards, plus providing alternative means of transport.

This current push is just a gov-led posturing of "doing" something for the next election cycle.

<comment><USER15> Unfortunately the vast majority of drivers on the road didn't go through the regime you describe to get a license.

My mother got her license in the 1960s in a town with dirt roads. Quick loop of the main street, reverse park, hill start and the local copper gave her a license. She's never been forced to learn the rules for traffic lights, roundabouts, freeways, drink driving or any of the other modern amenities and rules.

</comment></comment><comment><USER16> How do these work? I'm sure that with the angles and tinted windows involved, these cameras would need to be quite invasive to be effective…

<comment><USER17> How can this camera be more invasive than a red light camera?

<comment><USER16> Red light cameras aren't designed to look into your car.

<comment><USER18> They are when they're designed to also identify the driver.

<comment><USER16> Why would such a thing be necessary when you can just grab the plates instead?

<comment><USER19> In some countries (such as Germany) you have to be able to identify the driver in order to impose a fine. They actually send you a print-out of the picture along with the fine

<comment><USER17> Then it's still the same as a red light camera

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> Good thing I hold mine down below the dash.

</comment><comment><USER21> They could have just posted cops at problem intersections for a fraction of the cost but cops are human and sometimes cut people a break when they deserve one.

It's not about safety. It's about reminding people that if they step out of line for any reason they will get whacked because the government is always watching.

<comment><USER22> Let's assume a police officer costs the state $88,0000 annually (including salary, training, healthcare, equipment, etc). So $88M is 1000 additional officer years.

It's possible a camera and its installation will cost up to $500,000 (it's a government contract, after all). That would mean a camera needs to last 6 years to make it naively cheaper than an additional officer.

So ... I think the cost argument is more or less a wash. Cameras might last longer than that. Or be a bit cheaper than that. They're probably able to detect more offenses than a human, given their positioning.

I think there are more effective arguments to be made about the reversal of the onus of proof, about security of the video imagery, etc.

<comment><USER23> I'm not too sure if you're talking Australian or US dollars there, but the _starting_ salary of a NSW probationary constable is A$73,609 [1]. I'd say that means the total marginal cost of an additional police officer is around double what you've indicated in Australian dollars (so if you were using US dollars, it would probably be quite close).

[1]: [https://www.police.nsw.gov.au/recruitment/the_career/general...](https://www.police.nsw.gov.au/recruitment/the_career/general_duties/working_conditions)

<comment><USER24> I agree with 150k AUD being a closer estimate. Maybe 125k. Once you include superannuation (big) and all other costs associated with maintaining an average foot patrol officer their fully-loaded yearly expense is going to be way more than 88k.</comment></comment></comment></comment>


Kim Dotcom to be extradited to the US, New Zealand judge rules (2015) - <AUTHOR> http://arstechnica.com/tech-policy/2015/12/kim-dotcom-to-be-finally-extradited-to-the-us-new-zealand-judge-rules/ <comment><USER2> Kim is someone I really don't like and I have to admit I get a certain amount of pleasure in seeing him fail but I am really not happy with this whole case. Mostly because I don't want to see people being extradited over IP crimes even when they are for profit like in this case but also because it has led to a large segment of the population seeing Kim as some sort of hero fighting for their freedoms instead of a convicted conman who would happily screw you over for a buck.

I wonder what effect this will have on the million dollars he just raised to develop MegaUpload 2(I thought that was mega).

<comment><USER3> MEGA's actually quite good, FWIW. Dotcom, however, has an ongoing feud with it for murky reasons, and has been claiming that MU2 will kill it dead when released.

</comment></comment><comment><USER4> This is 1 year old.. can OP or mod add (2015) to title?

<comment><USER5> Added - thanks!

</comment></comment><comment><USER6> Not sure how I feel about this. He was certainly a character. I'm not sure why, but what's the deal with all of these guys basically wanting to be comic book villains? (Kim Dotcom, martin shkreli, etc)

<comment><USER7> I hate to bring politics into HN, but isn't Dotcom's character highly reminiscent of Trump? Same ideals, different skills.

</comment></comment><comment><USER8> This article is from almost a year ago.

</comment><comment><USER9> This is a year old story????

</comment><comment><USER10> How was Megaupload really that much different than say Dropbox or any other sort of large file sharing service? Did they actively _encourage_ piracy?

<comment><USER2> Yes, and they actively engaged in piracy as a way of attracting users.

<comment><USER10> Cite?

<comment><USER2> The emails between kim and the other staff discussing it were part of the court case and are in most news articles specifically about the case.

<comment><USER11> IIRC they were written in German, and when translated the translation at the worst didn't mention piracy - but did reference them as bad people.. with the best translation that it would be a confusing mess for the authorities to look through... You'll have to check the exact reference, but it wasn't as clear cut as your comment looks.

<comment><USER2> "The men who ran the Mega sites passed around customers' e-mails with reactions, complaints, and compliments, many of them mentioning obviously copyrighted content. For instance, in May 2009, Batato sent an e-mail to Ortmann with a customer note reading: "We watched Taken successfuly [sic] and then tried to watch the Alphabet Killer a day later and got the message to upgrade if we wanted to continue watching."

Another user in 2010 e-mailed Batato asking, "where can we see full movies?" Batato answered, "You need to go to our referrer sites. Such as www.thepiratecity.org or www.ovguide.com[.] There are the movie and series links. You cannot find them by searching on MV directly. That would cause us a lot of trouble ;-)."

In 2008, a user wrote directly to Dotcom complaining about video problems. "I've been trying to watch Dexter episodes, but... the sound doesn't match up with the visual," he wrote. "I didn't choose to use your site, you seem to dominate episodes 6 and 7 of Dexter on alluc[.org, a linking site]."

Dotcom forwarded the e-mail to Ortmann, writing: "on many forums people complain that our video / sound are not in sync... We need to solve this asap!"

from [http://arstechnica.com/tech-policy/2013/12/us-unveils-the- ca...](http://arstechnica.com/tech-policy/2013/12/us-unveils-the-case-against- kim-dotcom-revealing-e-mails-and-financial-data/)

</comment></comment></comment></comment></comment></comment><comment><USER12> An article[1] published 4th November 2016 states that

>Where is Kim Dotcom now?

>He could face 55 years in prison if Dotcom convicted. All his assets would be handed over to pay for the alleged $500 million in damages to the entertainment industry.

>But for now, the internet mogul continues to live in his £15million mansion with his wife and five children in Auckland.

[1]: [https://www.thesun.co.uk/news/2115443/](https://www.thesun.co.uk/news/2115443/)

<comment><USER2> He never actually owned the mansion it was a rental and it's sold recently so I don't think he lives there anymore.

</comment></comment><comment><USER13> The plutocrats' sheriffs need their pound of flesh to intimidate the peasant sheeple into spending all their money on pointless trinkets and distractions to keep the billionaires rich. Anything or anyone presenting a threat to the corrupt establishment must be destroyed economically, socially and militarily.

</comment><comment><USER14> If racketeering and money laundering is the only grounds on which to extradite him do they have any hope of succeeding or are they just aimlessly trying everything on the list? As far as I know those are made up charges.</comment>


Show HN: We made an iBeacon-based messaging app called Earshot - <AUTHOR> http://getearshot.com

<comment><USER2> Just a heads up. According to your contractual agreement with Apple for the iOS Developer Program, you are not allowed to use your Enterprise account (or even a non-Enterprise account) to distribute your app to anyone who isn't directly inside your company (i.e. you can't openly advertise + accept applicants for a TestFlight).

If someone with the right authority at Apple catches this, you stand a good chance of getting into hot water and/or banned from the dev program.

That said, awesome idea!

<comment><AUTHOR> Yikes. Thanks for the heads up! I've always thought that distributing to a geographically dispersed set of beta testers was the ideal use case for TestFlight, and had no idea that wasn't encouraged by Apple.

Maybe we'll see some better beta testing tools, now that the TestFlight folks are at Apple :)</comment></comment>


Art of Memory Software - <AUTHOR> https://www.kickstarter.com/projects/artofmemory/art-of-memory-software-learn-more-in-less-time <comment><USER2> Thanks for the mention!

We reached our funding goal, and there are just 15 hours left in the campaign. We think that you will be amazed at what your brain is able to do with these techniques. :)</comment>


Raw Thought: The Weblog of Aaron Swartz in Markdown, PDF, and ePub - <AUTHOR> https://github.com/joshleitzel/rawthought

<comment><USER2> I believe SBP (aaronsw's digital executor) is planning to make sure his domain is maintained and all the content remains available. But I do think it's nice to have this stuff in non-HTML form--ePub especially is great.

Be sure to ping firstname.lastname@example.com (Aaron's friends and family) and let them know.

Also, did you look into using html2text (<https://github.com/aaronsw/html2text>) to generate the Markdown? Might be a fitting tribute to try it. It would be helpful to include the generating scripts in the repo no matter what.

<comment><AUTHOR> Thanks, I'll be sure to let them know!

I haven't looked into using it, but I will! Want to improve the generation process if I can. I went ahead and pushed all the scripts I used, but they're a tad messy right now (was tweaking them); hope to clean them up soon.

</comment></comment><comment><USER3> I know you've already spent the time to build the PDF and epub converters, but if you want to use Leanpub to get the PDF, epub and mobi versions, you're totally welcome to.

Since you already have Markdown, it would be ridiculously easy to do.

We don't take (or want!) copyright on anything generated on Leanpub, so you're free to do what you want with it after it has been generated for you.

I'm not suggesting is that you sell it on Leanpub -- we only want to sell things that are put on Leanpub by their creators -- just that you use us as a generator and distribute the files as you wish they're created.

<comment><AUTHOR> I actually didn't "build" the converters, I used the excellent Pandoc tool to do it for me. (Even used them to do the HTML-Markdown conversion.)

</comment></comment><comment><USER4> (I never thought about this before but I would love to be able to convert arbitrary blogs to ebook formats.)

<comment><AUTHOR> Me too! It was something I was actually thinking about before doing this project, so I hope to be able to port this to a more general solution in the near future.

</comment></comment><comment><USER5> Nice work – Including the generating scripts in the repo would be great.

<comment><AUTHOR> Thanks! I've went ahead and uploaded the generating scripts (all the *.rbs at the root level). They're a bit messy b/c I was tweaking them to deal with various idiosyncrasies, but I'll hopefully get time to clean them up this week.

</comment></comment><comment><USER6> It seems that Amazon's Kindle ebook reader doesn't support the epub format. It would probably be a good idea to include another ebook format as well, like mobipocket.

<comment><USER3> This is easily accomplished by kindlegen[1], which takes in an epub file and spits out a mobi file.

[1]: [http://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000...](http://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000765211)

<comment><AUTHOR> Thanks for pointing me to that! I used it to convert the ePub to Mobi and added it to the repo.

</comment></comment></comment><comment><USER7> Seems there is no table of contents for the 1000 page ebook.

<comment><AUTHOR> You're right! I'll try to add that today. Thanks.</comment></comment>


piq - a jukebox for social spaces - <AUTHOR> http://www.piq.fm

<comment><AUTHOR> Hi, I'm a founder of piq. I'm sharing this with the community to ask a few questions.

 _1\. We're launching a Kickstarter in about 10 days. If you like the idea, do sign up to our list so we can reach out to you._

 _2\. Does the website explain our idea and concept to you?_

What we're trying to communicate is: piq is a little hardware device that's essentially a Roku box for audio -- except, it allows people around you to participate and choose what's playing.

Here's a video where I pitched piq -- <http://goo.gl/NFbSH>

_3\. Pick a song for our jukebox!_ \-- <http://www.piq.fm/try>

We use Facebook for our voting system right now, and I assure you that we do not use any personal data at all {I'd be skeptical if I read this too, but we really mean it} This is an alpha version, but critiques of design and experience would help immensely.

 _4\. And if you made it this far, here's a sneak peek of our Kickstarter video:<https://vine.co/v/bjp3aQeEYdj> _

Thanks for taking the time to read this!</comment>


iPhone Driver's Licenses Coming in 2015 - <AUTHOR> http://www.gottabemobile.com/2014/12/11/android-iphone-drivers-licenses/

<comment><USER2> useless. police in my country has handhelds to check any kind of relevant info about you when you have id. yet they require you to carry your license with you. it is weird because you still get fined when you have your id but driving license with you.

i think in a few years driving license will be a must to carry only when you are driving abroad.</comment>


Matt Taibbi on Facebook and Google Playing the Censor - <AUTHOR> https://www.nakedcapitalism.com/2018/08/matt-taibbi-facebook-google-playing-censor.html <comment><USER2> I'm still not sure what to think of all this. Facebook and Google are not public utilities, so why can they not decide what they allow on their platform or not? I suppose you really have to decide at what layer it becomes a violation of your rights. Would it be worrying if your domains were seized if you had something unpopular to say? Definitely. What if your cloud-host takes down your VPS after public backlash? That would probably seem unfair, but hey, you can go out and buy your own bare metal servers. What if you get censored/throttled at the network level, via ISP?

My point is, if you get taken down on FB/Twitter/Google, nobody is stopping you from saying what you want through the use of the internet. Private companies can do what they want, as long as they're not breaking the law.</comment>


If you go near the Super Bowl you will be surveilled hard - <AUTHOR> http://www.wired.com/2016/01/govs-plan-keep-super-bowl-safe-massive-surveillance/ <comment><USER2> I too think measurements like that are "fair", it is one of THE events in the US, so it makes sense to take special precautions.

That being said, the NFL should pay for this 100%. They should also pay for their stadiums (not threaten local fans / politicians they will move if not being financially supported), and frankly they should pay for any security measures during any NFL games.

The government paying for it is nothing but a quite heavy subsidy they don't need. It's the same though with any big sports league around the world where police / government is handling such affairs and the league is not paying for it.

<comment><USER3> I have to agree. It's pretty disgusting how the owners threaten cities until they get a new hundreds million dollars stadium, and how the NFL, MLB, and other leagues are complacent in this.

But what's worse, far worse, is how the fans have no problem with their own governments being fleeced. Their tax dollars are used to build the lavish stadiums and then they're expected to pay exorbitant amounts just to go see a game.

Bread and circuses indeed.

<comment><USER4> The Roman government at least paid for the bread and circuses, right? They didn't ask the populace to pay for the right to pay for circus season tickets ...

</comment></comment></comment><comment><USER5> To be clear, the bombing of the Super Bowl would be both a symbolic and a devastating coup for a terrorist. It's _perfectly_ pragmatically reasonable for the law enforcement agencies to take special precautions. What those are, I decline to comment through ignorance: but precautions are exactly what I'd like to see.

<comment><USER6> Large scale responses to purely imagined nightmares do not come without consequences to civility and society. On the contrary, it elicits a response to something that will probably not happen as if it actually already occurred!

The purpose of terrorism is _to elicit this exact response_. When we have the same reaction whether they show up or not, their goals are met without any effort or risk on their part!

Extraordinary success. They've gotten all they asked for and didn't have to lift a finger. Good job for them!

<comment><USER7> > _The purpose of terrorism is to elicit this exact response._

I don't buy this argument. Sure, you defeat your enemy in war by either destroying his legions or sapping his will to fight, but the last thing that you want him to do is take defensive positions that will hamper your attacks while being minimally invasive to his productivity and happiness.

Now, if fear causes your opponent to take self-defeating measures, like ones that severely hamper economic activity or suppress individual freedom, that's a different story. It comes down to what the specific measures are.

<comment><USER6> War and terrorism are different things.

If I am amassing political power by putting people in fear of say, the United States, I ought to depict the US as a bunch of people to be feared.

So I show the political leaders saying that they want to kill us and I get more power. I show all the repressive state tactics of the Americans on their own people, I get more power. "Look", I say "Even at their sports games, the evil Americans treat their own citizens like they are in a prison!"

Make no mistake, much of this is puppetry in the same way that the cold war, or terrorism, or the reds etc was used as a mechanism to gain political power in the US.

Extreme things like this give an assist to facilitate a foreign orchestration of political attacks on the other (in this case, the US) and help them consolidate power. It's geopolitically and intrapolitically counter-productive --- well that is unless you are trying to control people through the forced- hand of FUD and not their actual consent.

If this is still hard, think of WW2. It was justified historically because of how Germans treated the Jews. Everyone is on board with the _presumed necessary_ large scale destruction of Europe because of the holocaust. It was the _internal_ horrific politics of the Nazis on people they considered foreigners which justify this.

If you want your people on board to what they think is a good, justifiable moral war, depicting your enemy as horrific and anti-freedom is a great effective way to do this. This only has to be true in the minds of the people you need to persuade - not _objectively_ true in any sense.

These tactics enfold hawkism and make a mockery of diplomacy and civility. What kind of world do you want?

One where terrorism campaigns are a smashing success for winning local support or one where they don't actually work so people stop doing them?

<comment><USER7> > _If this is still hard, think of WW2. It was justified historically because > of how Germans treated the Jews. Everyone is on board with the presumed > necessary large scale destruction of Europe because of the holocaust. It was > the internal horrific politics of the Nazis on people they considered > foreigners which justify this._

This is just not true. The plight of the Jews was not a major factor in the United States entering the war, or in the war at all for that matter. The US entered in response to a direct attack, though we could say that that was just the tipping point that escalated America's involvement to outright war. The underlying factors were the defense of allied democracies, and particularly the fear of a hostile international order where America would stand alone against the massive totalitarian regimes in Germany, Russia, and Japan, who likely would have controlled the rest of the world (and thus people and resources, and thus industrial capacity, and thus military might) between them. As for how we look back at it, Lincoln's formulation for the Civil War could apply just as well:

 _[...]that we here highly resolve that these dead shall not have died in vain—that this nation, under God, shall have a new birth of freedom—and that government of the people, by the people, for the people, shall not perish from the earth._

<comment><USER6> Correct.

I referred to it as historically. I did not claim that the 1945 policies justified a 1941 entry.

Unlike with say Desert Storm, the Spanish American War, Vietnam, Iraq round 2, Afghanistan, or the Korean War, nobody I've seen argues in hindsight that we should have stayed out of the European theater in WW2.

</comment></comment></comment></comment></comment></comment><comment><USER8> It's ridiculous and disgusting. Spending all this public money on a private event. Shoving the homeless problem under the rug to put on a pretty face for all the visitors.

Come protest with us. The city needs to invest in lasting solutions, not temporary ones. [https://www.facebook.com/events/955997417814447/](https://www.facebook.com/events/955997417814447/)

</comment><comment><USER9> Everyone knows that the terrorists will detonate a nuclear bomb at the Super Bowl when it's in Denver. [1] In all seriousness, if event security is as lax as the TSA is at airports, what chance do they have of stopping it? Intercepting the cell traffic of those who are at the game will likely be too late. If they don't have credible intelligence beforehand, it's still going to be disasterous.

[1] [https://en.wikipedia.org/wiki/The_Sum_of_All_Fears_%28film%2...](https://en.wikipedia.org/wiki/The_Sum_of_All_Fears_%28film%29)

<comment><AUTHOR> I thought the bomb was brought in through Baltimore and detonated in Baltimore or DC ...

<comment><USER9> I had totally forgotten that the movie and book were different. You're remembering the movie correctly and I was remembering the book (which I read several times before the movie came out).

</comment></comment></comment><comment><USER10> I see a lot of police near the ferry building in San Francisco with machine guns. It feels like the NFL is invading San Francisco.</comment>


Google's AI bot thinks the purpose of life is 'to live forever' - <AUTHOR> http://www.businessinsider.com.au/google-tests-new-artificial-intelligence-chatbot-2015-6 <comment><USER2> This JavaScript AI also "think" same. console.log("The purpose of life is to live forever");</comment>


CloudFlare CEO Plots to Slow Service for Political Opponents - <AUTHOR> https://twitter.com/JoshConstine/status/933479390893162498 <comment><AUTHOR> This is really damning stuff. It's not healthy when CEOs of major internet companies are scheming with activist journalists to use their companies to punish people who they have personal political disagreements with.

Full exchange reproduced below:

TechCrunch reporter: "Some tech billionaire, please buy out the local ISP(s) where FCC chairman Ajit Pai lives and give him 14.4k dial-up speeds for killing net neutrality"

CloudFlare CEO: "I could do this in a different, but equally effective, way."

TechCrunch Reporter: "Please, do go on..."

CloudFlare CEO: "sent note to our GC [general counsel] to see if we can without breaking any laws."

TechCrunch Reporter: "Thanks for doing your part and please let me know how this goes. If he wants an unregulated internet, he might not like what he gets"

CloudFlare CEO: "indeed"</comment>


Ask HN: Developing and selling apps on a student visa - <AUTHOR>

Hi guys,
I have been considering pursuing an MS in the USA. I was wondering if it is legal to develop and sell smartphone apps (iOS/Android) while being in the US on a student visa. Google searches on the subject seems to turn up opinions on both sides of the table, so I hope someone here can help me out.
Thanks <comment><USER2> Talk to a lawyer.</comment>


Bill Gates on how to fight future pandemics - <AUTHOR> https://www.economist.com/by-invitation/2020/04/23/bill-gates-on-how-to-fight-future-pandemics <comment><USER2> Archived four hours ago: [https://archive.is/Ug5Lf](https://archive.is/Ug5Lf)</comment>


Ask HN: Pull-based work location/schedule status - <AUTHOR>

Anybody know a good product or hack for tracking a team's work-from-home, start-time, and out-of-office statuses?
Right now we send emails or update the messaging system or you look at the individual's calendar.
What I want is for it to be a pull workflow - I can go see if Joe is going to be late or working from home because I care specifically about Joe's status, rather than Joe sending an email to everyone because he doesn't know who cares about his status.
Anybody know a good tool for this? <comment><USER2> I usually just used something like Lync or another instant messenger that allows statuses. That way you can set online/busy/away/out-to-lunch and so on as well as custom statuses. Easy peasy lemon squeezy.</comment>


TicketBleed (CVE-2016-9244) (F5 BIG-IP) - <AUTHOR> http://ticketbleed.com/ <comment><USER2> Maybe I'm just a cynic, but do we really need cute exploit names for something that only affects a quite small number of companies as they must be using an F5 BIG-IP device?

<comment><USER3> F5 Big-IP devices are the market leader in commercial load balancing appliances. I think you rather underestimate the impact. I'm not making any judgement on the branding, there are pros and cons to this approach, but it's certainly something that's going to cause a lot of people pain.

<comment><USER2> In the Alexa top 1M there were less than 1000 sites.

And sites smaller than that top 1M are even less likely to be using it.

I don't find that a very large impact personally. F5 knows who their customers are and can easily contact them.

We don't need a big media panic blitz and dedicated domain name for this.

Fact of the matter is SSL accelerators just aren't all that popular now, SSL got cheaper with session resumption and newer ciphers, CPUs got fast and accelerated instructions for AES and all but a few people just use CDNs when their needs go beyond that.

<comment><USER4> These days, the F5 is valued more for it's intelligent load balancing than for the SSL offload. The SSL termination is there more for being able to view the request details / payload (for load balancing, app level routing, credit card tokenization, etc) than to specifically offload the crypto work. It's fairly common, in fact, for the downstream services to also be SSL.

</comment></comment></comment></comment><comment><USER5> PSA: This is _not_ OpenSSL (yay!)

> It is similar in spirit and implications to the well known Heartbleed > vulnerability. It is different in that it exposes 31 bytes at a time instead > of 64k, requiring more rounds to carry out an attack, and in that it affects > the proprietary F5 TLS stack, not OpenSSL.

</comment><comment><USER6> It shouldn't be overlooked that to be at risk to this vulnerability requires a non-default option to be enabled. Said another way, by default the option that would put you at risk is disabled, only if you have manually enabled it would you be at risk.</comment>


Ask HN: Zero in Programming – What do I need to learn to build websites/apps? - <AUTHOR> Lets say I Am a noob in programming (I AM) , would like to spend 2 hours every day to learn  new programming language(s) which could help me build websites (and/or) Apps.. where should i begin! <comment><USER2> To build apps... the best way by far in my experience has been to simply find an objective app and to build it. What you need to develop as an app developer is an intuition about how to structure your project for it's long term goals, and you don't get that intuition by following tutorials telling you the right way to do it. It's developed by using the wrong patterns hitting face against the wall over and over again.

You mention websites and apps, so of coarse you'll want to focus on JavaScript in the beginning as it's a good enough language and the only language that allows building both decent websites and apps, unless you want to use some sort of transpiler to JS, which is probably too much infrastructure in the beginning.

Don't ignore software development practices, but IMO in the beginning:

1\. Find a problem you want to solve. This could be an already solved problem, like a Todo app. It can be more motivating if you have a problem that doesn't have an existing solution though, but will require more creativity and design on your part.

2\. Learn as little is possible to get things working, and keep on adding features. When you add features, you'll notice that some of your earlier decisions make new features harder or easier to implement. This is when it's a good time to research development patterns, because you have a very practical example of why the patterns are important.

3\. Do not be afraid to re-write significant portions, or throw away code. Thinking of different ways to write you project and re-writing will give you a great intuition for evaluating frameworks (code libraries that define the architecture by which you write your code) and even writing your own.

4\. In the beginning, prefer to use lower level tools (avoid to many frameworks or libraries). As you build bigger apps, you'll start to appreciate the value of the frameworks and understated where they're appropriate.

The only other thing I would say is to find a mentor. When run up against issues in your projects, it can be hard to discover the patterns you need to fix it, and a mentor can save you a ton of time.

Good luck!

</comment><comment><USER3> There's 2 ways. First is the reading other people's code method. You find something that's open source, like an existing app and read through the code to figure out how to make changes yourself, usually through trial and error. In the process of this you refer to documentation and books/tutorials.

The other is you work through a text or course before hacking stuff together. Most people don't have the will to do this, they lose interest after one or two chapters unless they are either paying for it (school) or they already have been hacking some program and want to know more, which keeps them interested in the book. There are endless book and course suggestions, pick something with a lot of exercises (most edx/moocs have too few) like PAPL [https://papl.cs.brown.edu/2018/index.html](https://papl.cs.brown.edu/2018/index.html) only because programming is often learn by doing. No local installation is needed at first either [https://code.pyret.org/](https://code.pyret.org/)

</comment><comment><USER4> HTML/CSS is a good place to start as it is super easy and the place where many developers start. Also, it can be used to build web apps & mobile apps. From there, JavaScript will be needed at some point for a web app. Xamarin and C# is a good option for mobile apps as you can develop for both iOS and Android.

I would also recommend avoiding frameworks and libraries to begin with, until you have grasped the language. Start a project and learn while you build that project. My first project was a social network. It taught me pretty much everything I needed to know about frontend and backend development. I think the best place to get started is Udemy as they have some very detailed courses and almost always have discounts, so they do not normally cost too much.

Hope this helps and good luck.

<comment><USER5> Off topic: where are you from? (Curiosity)

<comment><USER4> I live in the UK.

</comment></comment></comment><comment><USER6> That's actually a difficult question!

Javascript is probably a good bet to get started with, stay away from frameworks (angular, react, vue etc) until you know the language. Once you know a language you can pick up any framework crazy easy, but too many people do it the other way around and get stuck.

</comment><comment><USER7> website: HTML/CSS + Javascript + PHP (or any other backend language like Python, Node.js etc)

Or learn a CMS software like wordpress, u can easily build a website using it. (but to customize it to meet your 100% satisfaction, you need to learn the above techs)

If you want to be full-stack web developer, u need to learn some web server knowledge, basics, etc. But its okay to not know it.

APP:

web app: web app can be built by using HTML/CSS + Javascript + PHP (or other back-end language)

native app: (those APP in the ios store or Google Play)

you have to learn the native programming languages, in Android case, you need to learn Java/Kotlin, in IOS case, you need to learn Objective-C/Swift.

That's pretty much it.

</comment><comment><USER8> Possible start with requirements gathering. Knowing what needs to be delivered is critical.

Being able to sketch or wireframe initial design and step through the steps that users will do will help.

</comment><comment><USER9> Find open source projects. You find those on Github. For each try to read its inner workings. Familiarize yourself with the syntaxes, the structures and so on.

</comment><comment><USER10> [https://goalkicker.com/](https://goalkicker.com/)

You can find excellent books on many different languages

<comment><USER11> Thanks for sharing

</comment></comment><comment><USER12> Hey Totaldude,

I taught myself programming over the course of a couple of years, having started from pretty much zero. Now I am working part time as a developer for a startup, and run a business of my own - having built not just the website and app for my business, but also developed the hardware and firmware!

Below are the classes that I took to get started along with a bit of a storyline:

[http://learnpythonthehardway.org/](http://learnpythonthehardway.org/) \- I started this a while ago and never finished because I got distracted. It's kind of bare bones, but will get your wheels spinning.

[https://www.edx.org/course/introduction-computer-science- har...](https://www.edx.org/course/introduction-computer-science-harvardx- cs50x) \- I started and got all the way through the last problem set. This course is EXCELLENT: wonderful lectures, challenging assignments, expansive community (facebook group, reddit.com/r/cs50, stackoverflow, etc). If there was only one class to pick from this list, CS50 would be it.

After CS50, I wanted to get good at a specific language and decided to learn Python. It is a very flexible and powerful language. It's very clean syntactically making it easier to learn. You can use if for data science, for little scripts, for web development, for pretty much anything.

[https://www.edx.org/course/introduction-computer-science- mit...](https://www.edx.org/course/introduction-computer-science- mitx-6-00-1x7) \- i started this late (not self paced like the CS50), and played catch-up a good amount of the time. A solid class, mostly did it because I wanted to get good at Python. I got most of the way though this course as well.

[https://www.edx.org/course/introduction-computational- thinki...](https://www.edx.org/course/introduction-computational-thinking- data-mitx-6-00-2x-0) \- I started this class next because I wanted to use Python to crunch numbers, and eventually get into machine learning. I made it just a few weeks into this course before getting distracted with my own projects.

It's not just about learning a programming language, but learning to program. With two hours a day, you can churn through the CS50 course in a couple of months, during which you'll build a website & webapp. It'll definitely be a challenge (it took me a couple of tries to make it all the way through), but it's an amazing course - make sure to take advantage of the huge community.

</comment><comment><USER13> freecodecamp.com

It's a nice tutorial, gradually increasing in pace. I'd recommend you beeline towards getting the certifications, and then do the exercises that lead you towards that.</comment>


Atomic – New interface design tool goes into private beta - <AUTHOR> https://atomic.io

<comment><AUTHOR> At Atomic we're trying to build a better way of designing websites and apps, by letting you design interfaces, explore behaviour and get feedback seamlessly in one platform.

We've just started testing with real users. You can visit [https://atomic.io/](https://atomic.io/) to find out more about what we're building, watch a video of some of the features we have planned, or sign up for updates.

Some of the team from Atomic will be on Hacker News to respond to any questions you have. We'd love to hear your thoughts.</comment>


Linode hacked, CCs and passwords leaked - <AUTHOR> http://slashdot.org/firehose.pl?op=view&type=submission&id=2603667 <comment><USER3> Ah this is so shit. I want to support Linode, I've had nothing but a good experience. But I just had to check my credit card to be sure they hadn't lost my details. I've NEVER had to do that before with anyone - they've got to respond fast here because if I don't trust them with my CC then I can't leave five-figure contracts at jeopardy hosted on their servers.

I've been living comfortably on Linode servers for over three years. This is like suddenly being evicted and having to pack my stuff up and find another apartment.

I have to wait for some sort of verification for this but if true then I have to leave Linode. I have client sites hosted here - not for cost reasons, just because I like Linode.

For the sake of $5 a month I can't even take the slightest risk of being criticised for using Linode. And this lack of transparency could be a nail in the coffin here.

I don't want to waste a couple of days on this but that's what's going to be involved if this is true.

<comment><USER4> I've now heard from a number of people using Linode that have suspicious activities on the cc which they used with Linode.

I just called up my bank to tell them to 'block' it as a precaution (I will now have to give them a visit later today to get a new card). I encourage all other Linode customers to do the same, _because it'll be easier to just spend half an hour doing this instead of spending hours upon hours disputing specific transactions_.

Linode customer support keeps saying they have "no comment" on this issue (which I suppose does make sense -- I'm assuming they've been ordered by law enforcement persons to not share details), so as we're not being given much information to work with... just treat this as a worst-case scenario (all names, addresses, credit card numbers, etc. have been compromised). Do operate now with the assumption that all of this data has been compromised and may very well be public soon.

<comment><USER5> "because it'll be easier to just spend half an hour doing this instead of spending hours upon hours disputing specific transactions."

I live on the internet. Put my credit card out on many services. Over the last 5 to 8 years I've had my credit card numbers taken I believe 4 times.

Never had to dispute it once. These Credit Card companies and Banks have a stake in not allowing your account to be drained.

I think it would be a waste of time to go out and cancel our CC until hearing from Linode that yes, CC information was taken.

<comment><USER6> Wow, four times? You should probably be more careful about who you give your number to. Personally, I usually get a new card every 3-5 months. If someone ever sat on my card number, it's useless to them now. Never had any issues either.

<comment><USER7> Even old card numbers can be used for transactions in some cases.

<comment><USER8> Sure, but that isn't the former owners problem.

Are you thinking of _expired_ cards? That is different.

<comment><USER9> I can be in some cases. I got mugged and my card was used to pay for parking garages for 1.5 years until it expired even though it was canceled and blocked by the issuing bank. They said that for some transactions, the blocking mechanisms are so expensive its more economically sane to them to refund whatever was drawn.

<comment><USER8> Ugh. Did that require you to protest each charge? Or did you get a charge and credit on every bill?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> How about you guys cool it and stop organizing a lynching mob devoid of any real data? It's embarrassing. HN is supposed to be populated with lots of very smart, data-driven analytical folks. Yet, every time something like this happens out of the woodwork come people who would ran you and your children down in the event of an emergency rather than turn around, carefully evaluate the situation, and help you. Don't be a moron. Stop it. For all you know there's a serious law enforcement effort under way that prevents Linode from talking.

For the record, I am a Linode customer and just got a new server to migrate a couple of sites into. My plans have not been altered at all by this. I have no data to suggest I should.

<comment><USER11> I am a customer too, and I wield no torch or pitchfork, but I grow increasingly frustrated at the lack of response from Linode.

I understand your point about the idea that they may be unable to speak to the issue due to law enforcement efforts, but for the moment, acknowledgement would be satisfactory. I would be happy with, "We're aware of the rumors regarding the intrusion at Linode this past week. We are working with law enforcement and cannot comment on details at this time. However, we will provide a full postmortem once we are able to do so."

The problem is when the explanation _never_ comes. It's OK if it's not this second, but tell us it's coming, and then follow through. Complete silence is frustrating.

<comment><USER12> Here's the response I got from my support ticket:

>Thank you for your inquiry, and I certainly understand your concern. We are still conducting an active investigation and unable to disclose most information at this time. This being said, we do not yet have any evidence that any payment information of any customers have been compromised. We will be releasing further information regarding the incident soon, so please keep watch of our website and blog for said information. If you have any further questions, please feel free to ask.

That actually sounds pretty close to what you're asking for, although I have to say it didn't make me feel much better. It would be nice if they would make a public statement too.

</comment></comment></comment><comment><USER13> From a purported abridged chatlog with the alleged hacker:

> _05:42 < ryan||> credit cards were encrypted, sadly both the private and > public keys were stored on the webserver so that provides 0 additional > security_

> _06:00 < ryann> They did try to encrypt them, but using public key > encryption doesn't work if you have the public and private key in the same > directory_

[http://turtle.dereferenced.org/~nenolod/linode/linode- abridg...](http://turtle.dereferenced.org/~nenolod/linode/linode-abridged.txt)

<comment><USER14> Here is what Linode replied to me when I asked them about that chat log in a support ticket:

      Hello,

      Thank you for reaching out. We appreciate and understand your concerns. At this time the evidence suggest that this activity was targeting a specific customer. We are unable to release any additional details regarding this incident at this time, as there is an ongoing investigation.

      We have no comment regarding ryan*'s comments in #linode. You are of course free to take any steps you deem prudent or necessary to ensure the integrity of your online presence.

      I am sorry that we cannot provide more information at this time. As always feel free to contact us at any time with any future concerns.

      Regards,
      Quintin

<comment><USER15> These guys are looking totally incompetent at this point.

If you believe this Ryan guy, credit cards stored on the same server as the key to decrypt them, Lish passwords stored in plain text, they've known for some time and lied about what actually happened and now they're saying "we won't do anything about it" via email?

"You are of course free to take any steps you deem prudent or necessary to ensure the integrity of your online presence."

Unbelievable.

Edit: not to mention they "made a deal" with the hacker not to tell anyone? What the hell?

<comment><USER16> To be fair the hacker didn't say the keys were stored on the same server as the credit card numbers, he said they were stored on the web server. It's most likely the database containing the CC numbers resides on a separate set of boxes than the web servers.

<comment><USER17> The Cigital-recommended way to hash your passwords is to use an HMAC/scrypt combo, with the HMAC key stored on the app server (not the database).

What Linode did may, or may not, be dumb. They are being tight-lipped so we can only guess.

<comment><USER18> Why would you use an HMAC for password storage? It's not like length extension attacks are relevant in that application.

</comment></comment></comment></comment></comment></comment><comment><USER19> My Visa card that I used with Linode was stolen and used on an Amazon order I didn't authorise last week, my bank successfully blocked the charge. Someone else reported their Visa had also been compromised in the thread 2 days ago, looks like that confirms the suspicions: <https://news.ycombinator.com/item?id=5542015>

Poor show Linode. (edit: worth noting I use the card with other things too, I have no confirmation it was leaked through Linode other than the compromise happening at the same time these supposed leaks happened).

<comment><USER20> Great, now I am feeling paranoid although I don't see any unauthorized charges on my card. Does anyone know if debit cards are legally protected the same way as credit cards with 0% liability.

<comment><USER21> Debit cards have less protection.

Wouldn't hurt just to ask your bank to re-authorise it anyway? It will change the three digits on the back.

<comment><USER22> They don't, protections are exactly the same.

<comment><USER21> They really aren't.

I know someone who got their debit card cloned. While the bank eventually repaid him, that did nothing to repay him the additional fees he owned his normal debtors (e.g. rent, utilities, etc).

With a credit card you aren't losing "actual" money. You are losing the bank's borrowed money which the bank pays back. With a debit card you're losing cash which you won't be able to replace yourself and which the bank might take days to weeks to replace.

Even if you NEED to borrow while your credit card is out of commission you can either use the overdraft facility on your debit card or other quick sources of credit. Hard to get quick cash without going to a pawn shop.

</comment></comment></comment></comment></comment><comment><USER23> If this is true then all the trust that Linode has built up over the years was just thrown out the window. According to the hacker they've known for 2 weeks and made a deal with the hackers. Ultimately, they were as far from transparent as it gets and on top of that they did a horrible job with their security.

Hopefully, they own up and start being transparent.

If this is true then what alternative hosts should I look at, besides AWS?

<comment><USER24> Two alternatives often mentioned on here are DigitalOcean and RamNode.

I've only used DigitalOcean. My anecdotal experience from running a Chef Server on a 1GB instance has been pretty mixed. The price is good, but network and CPU performance feels very variable to me. A month ago their Amsterdam servers were unable to be resized, and there was nothing about it on their status page. I tweeted and was told they'd be working "some time later today". Doesn't fill me with much confidence in general.

I'd still choose Linode for anything of importance - their long reputation is well earned in my opinion. But, if this breach is true, I hope they handle it well.

<comment><USER25> >But, if this breach is true, I hope they handle it well.

That is unfortunately the problem though. If this _is_ true, they have already handled it terribly as it has already been 2 weeks since the attack.

</comment></comment></comment><comment><USER26> Just like I can have application-specific passwords for my Google account, I wish I could have application-specific credit card numbers from my CC issuer.

If I had these, I would immediately cancel my Linode-specific CC# and reissue a new one. I would not have to worry that my other recurring bills will go unpaid, or spend hours dealing with tracking them down and changing them.

<comment><USER27> Bank of America provides this [1], as does Citibank [2] and likely others.

Paypal at one time provided this service as well, but it doesn't seem to anymore [3]

1: [https://www.bankofamerica.com/privacy/accounts- cards/shopsaf...](https://www.bankofamerica.com/privacy/accounts- cards/shopsafe.go)

2: [https://www.citibank.com/us/cards/gen- content/messages/van/i...](https://www.citibank.com/us/cards/gen- content/messages/van/index.htm)

3: [https://www.paypal.com/va/webapps/mpp/security/general- freet...](https://www.paypal.com/va/webapps/mpp/security/general-freetools)

<comment><USER28> Nice. I wonder if any UK providers do this

<comment><USER29> My bank in Sweden does (Swedbank), so it's not a US-only thing. They even have an iPhone app for it.

</comment></comment></comment></comment><comment><USER30> Remember when the Linode customer service portal was compromised which exposed everyone's VPS?: <http://julianyap.com/2012/03/01/compromised-linode-vps.html>

In that case, specific Bitcoin users were targeted.

It's pretty much why I don't trust Linode.

You can't trust a company which puts random AMI BIOS files on the main index directory on the main web site. You can't trust a company that can't even lock down their own Linode customer service portal (which could lead to a breach of each and every customer's VPS).

Perhaps history is fuzzy for people when new announcements come out or low prices are around.

</comment><comment><USER31> Off topic but still relevant, but doesn't it seem a bit primitive that companies have to store you CC# for recurring payments? The one number that uniquely identifies your account and everyone you want to re-use it has to keep a copy. Couldn't the credit card company issue some unique ID to each vendor for recurrent payments? Ex. the vendor issues your CC# to the CC Company for charge and recurring process. The CC Co. responds by replying back with authorization and an ID unique to that vendor that says "Use this number for charging this customer again, but it will only work coming from you, so if you lose it, it can't be used elsewhere". The vendor then discards your real CC number.

<comment><USER32> > Off topic but still relevant, but doesn't it seem a bit primitive that > companies have to store you CC# for recurring payments?

You really really don't have to. Any payment processor that isn't horribly incompetent does the unique token authorization scheme.

Storing CC #s for recurring payments is solely the domain of incompetents who have no business accepting payments from anyone.

<comment><USER33> What if you want to change processors? If you weren't storing the CC details, wouldn't you have to have customers enter all their details again? I imagine this could cause a drop in revenues due to people either forgetting, procrastinating, or just not bothering.

It's never cool to be actually- or quasi-locked into a vendor.

<comment><USER34> Most decent processors have processes in place for the transfer of CC numbers. I was involved with this process at a decent-sized magazine, it involved armed security, an encrypted hard drive in a locked container and millions of dollars of insurance. It's not an easy process, but is possible.

<comment><USER33> Sounds ... expensive.

</comment></comment></comment></comment></comment><comment><USER35> I had a VPS on linode.

I think that Linode did a big mistake here. Let's wait for a formal communication.

But this is the moment to support them. Yes, maybe sounds crazy.

When you host on any third party datacenter, you take risks that something like this could happen. So, deal with it. Check your credit card, if your receive something wrong, call to your card and that's all. But we need to support also the good work, and this guys do great work in the hosting business. Just my opinion.

<comment><USER36> Well said. It's a fact of life that companies get hacked. So it's no surprise that it eventually happened to Linode. If you flee somewhere else, all you're doing is hoping that the other company you run to won't get hacked rather than using any logical thought.

I can think of two good reasons why you should flee Linode. It remains to be seen if either are actually true, and until indications say yes, then panic is unwarranted:

1\. If it becomes apparent that Linode is far more vulnerable to hacking than other hosting providers. But one hack alone does not prove this.

2\. If Linode grossly mishandles the situation. There have been a couple of allegations to that effect so far, but nothing substantial. I don't see any reason to claim that they've done this yet.

<comment><USER37> Linode has already grossly mishandled the situation by not coming out with a complete statement about what exactly happened. I only read this news because it was posed here -- no email notification, no update on their homepage, no twitter, no nothing.

The alleged hacker has made serious and specific claims, and Linode has done jack shit; without more information, how should I proceed? I don't want to call my bank and waste time getting a new credit card (not to mention replacing a million and two services) without a confirmation and I can't get a confirmation because Linodes people are having a circle jerk (or whatever the hell they do).

<comment><USER38> > I only read this news because it was posed here -- no email notification

There was an email notification a few days ago.

</comment></comment></comment></comment><comment><USER39> So what happens now to all the goodwill Linode has amassed through the years? Does it all turn to shite, almost overnight?

This sounds very very bad, and as a customer it's very off-putting.

<comment><USER40> [Warning: imperfect analogy follows.] It's one thing if Linode is like someone who gets drunk and crashes their vehicle. That's 100% their fault and they've burned any goodwill. In this case, however, Linode is like someone who was carjacked. Perhaps Linode shouldn't have been driving that type of vehicle in an area known to have people attempting to carjack every single vehicle that drives by. Perhaps they should have installed thicker bullet-proof glass. Or even have taken measures not to trust any locks that the manufacturer insists are secure but have zero-day exploits. Regardless, Linode is still the victim of unscrupulous criminals. Maybe they could and should have done more but the bigger question is now that they've been carjacked, what are they doing to ensure that the carjackers haven't installed anything malicious that still remains in the vehicle?

<comment><USER41> I think a more accurate analogy is to say that Linode is moving your important files from one location to another in their moving van. They park at a 7-11 to run inside and grab a snack, leaving the van unlocked. An intruder comes along, opens the unlocked doors, makes a few copies of your files and leaves. Linode gets back in the van, notices the intrusion, does nothing except tell you that "you have nothing to worry about, but you may as well change your locks" and then when the truth comes to light, they basically stop returning your phone calls.

"No comment."

</comment></comment></comment><comment><USER42> FYI, I just learned from Linode support that accounts have both a default LISH password AND a default API key, which means that _even if you've never set a LISH password or generated an API key before_ , you still should still go and reset them. This is not what I would consider expected or desirable behavior.

<comment><USER43> I've never generated an API key, and Linode showed it as blank. I generated a new one anyway, but I can't imagine how they'd have a default key _and_ somehow not show it in the UI.

<comment><USER42> I know. I've asked for further clarification, especially since their email on Friday said API keys should be reset "if applicable."

Edit: _Groan_ , here's their clarification. It's starting to look like they don't know what the heck they're talking about:

"Thanks for getting back to us. To be extra cautious it would not hurt to regenerate your Linode API key. You can do that in your user profile. Please let us know if you have any other concerns we can address."

<comment><USER44> After seeing your original post here, I also asked for clarification, and received a similar reply from support:

      The Lish password is set to a random string by default, however we would still recommend resetting this password even if you had not set one manually previously.

I had expected that if the password was not set, then password auth was disabled. I've told them that's what I want and have asked when it will be implemented.

<comment><USER45> I'm kind of upset they didn't clarify this in the initial email/blog entry. The way it was worded ("if applicable") implies that resetting the API might not be necessary in some cases. I think it is reasonable to assume that those who never generated an API key in the first place would've fallen under such a bucket.

Now it sounds like basically everyone should have reset their API key. Bleh.

</comment></comment></comment></comment></comment><comment><USER46> Just rang my bank to cancel my debit card. Hate doing that. Now I have a week or two of failing payments, bills, etc to look forward to.

I will probably be moving away from Linode after this. The poor response to this and lack of full disclosure, plus reading that they're using ColdFusion (wtf?), means I don't feel I'll be able to trust them any longer. It's a shame because their UI and service is generally fantastic.

<comment><USER47> There's nothing wrong with ColdFusion, especially if you've had it around for a while. It's not as glitzy as Rails, but it works and it's still supported and modern. Besides, this isn't ColdFusion's fault. Leave because Linode violated your trust, but not because of the programming language they wrote their site in.

<comment><USER46> It's closed-source, made by Adobe and seems to have a bad security record - there are 3 things wrong with it.

Besides, it's not the reason I'm leaving - it just makes me question them. I'm not after glitzy. If anything, I'd have expected Linode to have been written in Perl or something.

<comment><USER48> (made by Adobe) ⇒ (closed-source) ∧ (has a bad security record)

</comment></comment></comment></comment><comment><USER49> Love the whole side discussion about bitcoin from the supposed attacker:

06:07 < ryannn> They say there's no 'central weak point'

06:07 < ryannn> Yeah there is, there's the developers

06:08 < ryannn> There's been bugs in the client that have allowed the blockchain to split previously

06:08 < ryannn> One could just backdoor the bitcoin client binaries, not the source.

06:08 < ryannn> Nobody would figure it out until it's too late

[http://turtle.dereferenced.org/~nenolod/linode/linode- abridg...](http://turtle.dereferenced.org/~nenolod/linode/linode-abridged.txt)

<comment><USER50> I'm curious how he's going to backdoor the binaries running on my computer built by the launchpad servers without anyone noticing. Granted, I'm not checking the commit logs every time apt gives me a new version, but all the same.

</comment></comment><comment><USER18> Well I'll wait for a response from linode, but it certainly looks like they were very dishonest. I think I will close my account.

<comment><USER51> So you're unfortunate enough to be a customer who had their CC leaked. So you spend 5 minutes changing your password (you use unique, non-formulaic passwords, right?) and 15 minutes on the phone to CC company to ask for a new card. Then you use your backup card for 2 weeks (you have a backup card, right?)

A month later, spend 30 minutes on the phone with CC company only if strange transactions appeared.

Not the end of the world. The CC industry is set up well to handle this kind of thing.

<comment><USER41> To dismiss this breach seems odd to me. The tech community in general has placed a lot of trust and faith in Linode over the years. The shareowners at Linode have surely been great beneficiaries to that. Part of that "unspoken agreement", if you will, is that Linode be competent at what they do and that means keeping your data and information secure.

If even an iota of what I read in the abridged IRC log is true, Linode doesn't seem to care much about security or protecting Linode customer data. I mean, storing "encrypted" card numbers alongside private/public keys? Really.

<comment><USER51> Sigh, really? Ok, you typed your credit card number into a web browser at some point. If your sole reason for doing so was "I absolutely trust the people on the other end of this socket not to do what 99% of all people handling credit card data do whether they pretend otherwise or not", instead of something like "hmm that reminds me, I haven't scanned last month's statement yet", then the problem lies squarely with you, the uninformed consumer.

I will happily dismiss this breach, not because they didn't make some amateur crypto mistake, or because they weren't using freaking ColdFusion, or because they were storing data in some nice compartmentalized form, I reject because _this happens every single day and has done for decades, and there is an entire sub-industry built around its after-effects_. If you don't understand this _you shouldn't own a credit card_.

If you type a credit card number in online not expecting to recuperate any damage caused from your card company, _call them up now for clarification or cancel the damn card_. That's equivalent to stuffing cash in an envelope and posting it to Nigeria because some prince promises he'll keep it in a safe for you. It's 90% the reason you should be using credit cards _in the first place_. _Think_.

Linode should not be rubbished here. They've got one of the largest VPS installs around, so they most likely know their shit. They make an ultra- common CC mistake that has happened daily for almost 20 years now, by companies large and small, got pwned due to a bug in _someone else's software_ , and you think I'm going to play along with the righteous indignation bullshit here? GTFO.

Let he without sin cast the first stone. Despite 20+ years' experience I _still_ cannot cast that first stone. I make bullshit mistakes like this every day, and despite your grandiose delusions you probably do too.

As for whiners complaining about their data suddenly being insecure, well, data security 101: you're making the same bullshit mistake Linode are making, and despite that you're complaining about it. If you care about data security in the "cloud", hosting it on a freaking VPS is not the way to do things.

<comment><USER52> So because companies A through X are irresponsible with data, customers should regard that as acceptable and give company Y a free pass to do the same? I don't understand how a reasonable analysis of the situation can come to that conclusion.

<comment><USER53> You don't know the names of companies A through X, or supposedly safe Z for that matter. All you'll be doing is an enormous amount of work and bother to move from Y to, lets say, A, because you think you'll be more secure but unfortunately if anything its probably the other way around, its just that A hasn't been hacked... yet... so far as they know...

none of them get a free pass they all suck, but the one that just got busted is probably going to be a little more security focused in the near future.

Hmm stay at a place that just got burned, or expend lots of effort to move to a place that hasn't been burned yet...

</comment></comment></comment></comment></comment></comment><comment><USER54> Found it interesting that Linode uses Coldfusion. Wonder if Adobe has anything to say about the apparent 0-day.

If the hacker's claims are true (Would appear so, the directory listing checks out) then Linode really need to address this ASAP. Passwords are one thing but to have CC details leaked is even worse. I'm not familiar with CC processing but it seems like bad practice to store the encryption keys on the web server.

<comment><USER55> It wouldn't take a zero-day flaw in the Coldfusion stack for a CF application to have an undocumented vulnerability; in fact, it's much more likely that the vulnerability is in the application code than in the stack itself.

<comment><USER56> A patch has recently been issued (09 APR 2013) by Adobe for the various versions of ColdFusion:

 _"This hotfix resolves a vulnerability that could be exploited to impersonate an authenticated user (CVE-2013-1387).

"This hotfix resolves a vulnerability that could be exploited by an unauthorized user to gain access to the ColdFusion administrator console (CVE-2013-1388)."_

[http://www.adobe.com/support/security/bulletins/apsb13-10.ht...](http://www.adobe.com/support/security/bulletins/apsb13-10.html)

<comment><USER55> Yep that's bad.

</comment></comment></comment></comment><comment><USER57> Linode hasn't been very forthcoming in the past where security "incidents" are concerned:

[http://arstechnica.com/business/2012/03/bitcoins- worth-22800...](http://arstechnica.com/business/2012/03/bitcoins- worth-228000-stolen-from-customers-of-hacked-webhost/)

[http://forum.linode.com/viewtopic.php?f=20&t=8509](http://forum.linode.com/viewtopic.php?f=20&t=8509)

I had really hoped that they had changed their stance on incident management. _If_ it's true that they suppressed information about a possible wide-scale compromise where customer data could have been affected, then despite everything else about their service that's so great, there's no way anyone should want to continue to be a customer there.

Given Linode's past behavior and the information provided in the IRC chat, I think there's reasonable suspicion that customers' password hashes were stolen and Linode wasn't completely honest in their recent email to customers.

<comment><USER58> Did you see <http://www.linode.com/linode4.css> and <http://www.linode.com/linode3.css>?

Nevermind the security concerns. These guys aren't using version control!

<comment><USER59> Renaming CSS files with numbers or whatever is one legitimate way to handle cache invalidation (not evidence of not using version control)

<comment><USER60> It is not the best way to handle cache invalidation. Why not /linode.css?v=<file_timestamp> ?

<comment><USER57> This is inconsequential.

</comment></comment></comment></comment></comment><comment><USER41> Is it just me or is each passing minute without an acknowledgment of this issue bad for Linode? There's tens of thousands of customers right now who would kind of like to know if they need to request new credit cards or not, or don't know about this and deserve to know that their VPS provider's credit card database has been compromised.

</comment><comment><USER61> The chatlog does provide some evidence that it is indeed the hacker, but does little to convince me that he got CC info and Linode is not telling us the whole truth. The evidence he provides is just simple source code snips and the directory listing, which would be expected based on what Linode has told us.

This could very well be the hackers own submission to /. trying to get more attention for his hack by claiming he has CC numbers which I doubt he has.

<comment><USER18> Doubting the claims of a hacker after it's _known_ that they compromised a system is really bad OpSec. Consider everything burned.

<comment><USER61> That's a fair point. I'm speaking more as a judge/jury view on the situation though. I don't think Linode users should panic and run for the hills just yet based off this alone.

</comment></comment></comment><comment><USER62> I'm looking forward to seeing an official response from Linode on this. Hopefully they are fast and honest about it. I've been a happy customer for quite a while, but this is definitely a concern.

<comment><USER21> They weren't exactly fast and honest the last time a break-in happened. In fact even to this day nobody is quite sure what went down aside from tons of Bitcoins going missing!

</comment></comment><comment><USER23> I guess this is why they wanted everyone to reset their password 2 days ago.

<https://news.ycombinator.com/item?id=5541915>

<comment><USER63> Not only that, it also makes me wonder about the free RAM upgrade from almost a week ago. Some people are reporting their Linode credit cards being used for fraudulent purchases as far as a week ago, so this might have been a move to gain some pre-emptive goodwill.

I don't know though... will wait until more details are available but will be keeping an eye on CC statements / VPS alternatives.

<comment><USER36> "Someone hacked us and stole customer details... quick, give everyone more RAM!"

Doesn't sound very plausible to me.

<comment><USER20> Logically, they couldn't have planned it all in such a short period of time. However if they did, from a business perspective it is very good plan. Without the upgrade, today some customers would have had two reasons to leave Linode, now they only have one.

</comment></comment></comment></comment><comment><USER64> That may explains the seclist hack too... <http://seclists.org/nmap- dev/2013/q2/3>

<comment><USER65> If that's the same one, then that link implies Linode already fixed the issue on or around the 13th. So, I'm wondering if the silence that has some folks here up in arms is indeed because they've been instructed by law enforcement to keep quiet pending the investigation.

Now if we could only stay the torches and pitchforks for a while before this gets sorted out...

</comment></comment><comment><USER66> Is there any confirmation on this?

[edit] Just looked at twitter, this tweet doesn't look good: <https://twitter.com/Jamiesingleton/status/322730588459114500>

But it may just be random coincidence.

[edit again]

Links from slashdot article:

IRC chat: [http://turtle.dereferenced.org/~nenolod/linode/linode- abridg...](http://turtle.dereferenced.org/~nenolod/linode/linode-abridged.txt)

Link in IRC chat (i think it is of linode.com's web directory): <https://bin.defuse.ca/hq0Ay8RzpKdR6vQwYxnmhc>

<comment><USER67> That tweet would suggest to me that someone's credit card was stolen via another method and used to purchase Linode services, rather than the other way around. Ie, I don't think that was related to Linode breach.

</comment></comment><comment><USER68> So, they asked us to change the password for reasons they cannot yet tell. The fact that they cannot lay it all out for our curiosity is driving most of people here off the rails. I don't have any problem with letting them verify & deal with the issue properly before releasing any public statement. Anyone who's ever been with them has never received less than perfect customer service. Can we give them a break, wait and hold our judging wands for a moment? It's not like they are staying mum out of spite towards their customers and the press…

</comment><comment><USER69> I am an ex-customer of Linode and I'm still worried about this incident - <USER2> they still store your card after you've quit the service? This is terrible :(

<comment><USER70> I've asked them this question. Here is the answer:

Credit card information continues to be stored in our database in an encrypted format, and the decryption key is not stored electronically. We are working on a process on remove the credit card details of past customers on request and can handle this for you soon if you would like. If you have any further questions or concerns please let us know.

<comment><USER71> So the answer really doesn't answer the question.

(It appears the answer is no, but given they haven't been forthright in the actual details of the hack, possibly not)

</comment></comment></comment><comment><USER72> As someone who has been a very happy and loyal Linode customer for a long time now, this whole situation paints an image of Linode I otherwise would never have thought. The fact they apparently had both the private and public keys for the credit card hashes in the same location as one another is beyond belief. The very fact that Linode failed to mention they made a deal with the attackers and then reneged on it all without telling anyone makes me sick. I don't want to bash Linode purely because everyone else is, I am legitimately concerned here that my personal details have been compromised.

I thought Linode was different but based on their lack of transparency in this matter, I'm seriously considering just moving all of my sites to DigitalOcean, Rackspace or even AWS instead. This makes me wonder who originally cleared them for PCI compliance in the first place. This is a huge violation of trust and now I've got to keep my eyes focused on my credit card statement for fraudulent transactions, the bank I am with ANZ however has great fraud detection systems and considering I'm in Australia any transaction should be easily reversible, but the fact there is a possibility my card could be fraudulently used saddens me.

Linode needs to come clean about this situation now.

</comment><comment><USER73> Really off-topic, but still sad: This is a link to slashdot, but it's on HN's frontpage before it's on slashdot's front-page (if it'll ever get there). (And IMHO that's sad, because /. used to be top notch).

I've noticed before that stuff from the HN frontpage appears on /. one to three days after, but I've never seen it for links to slashdot :-)

<comment><USER65> I rather wish this was a link instead to the original thread rather than to Slashdot. It isn't a big deal, but it certainly would have saved an extra click.

Also off-topic: I've noticed that as well with Slashdot, which is why I lurk HN pretty regularly now. Plus, some of the front page material on /. does more to insight angry discussion, and the community has become increasingly more vitriolic.

At least here, even if someone's brash, they're fairly honest about it (in general). I've even seen a number of disagreements that have been respectful and cordial. It's sad to say, but that's a rare thing these days.

</comment></comment><comment><USER74> Just got a response from linode: somethings not adding up?

\</comment><comment></comment><comment></comment><comment>----

dportalatin 30 minutes ago Hello,

Thanks for getting into contact with us about this. Linode has found no evidence that payment information of any customer was accessed. We have implemented all appropriate measures to provide the maximum amount of protection to our customers. If you have any other concerns we can address, please let us know.

Regards, Dolores

<comment><USER75> They're doing canned responses right now guys. Just got this exact same message myself.

</comment></comment><comment><USER37> To those of you who have claimed that your CCs have been abused -- I checked mine (which I used to pay for Linode) and it hasn't been used to do anything funny.

<comment><USER76> I checked mine and nothing untoward has taken place. All the same, I put it on hold. Everyone should assume their CC is compromised.

<comment><USER37> Why? It is a major waste of time to insert it into all the places that I have used it and should it be abused, then I just dispute the charges.

</comment></comment></comment><comment><USER77> Is there another way of learning the URLs like

<http://linode.com/googledebcc14d3c9f777a.html> and <http://linode.com/y_key_57284cb2de704e02.html>

If not, it seems likely that he did have read access to the main website filesystem at least

</comment><comment><USER78> The best part is at the very bottom of the log. A customer enters the IRC channel to ask for support after ryann (the hacker) finishes explaining the attack.

Customer: "hello, i forgot my password and linode's email reminder service doesn't work. i checked spam box but there's no email from linode." Linode Guy: "ryannn: can you give him the password?"

</comment><comment><USER79> And right now we got confirmed on IRC that data is out, we do not know how much, 4 last numbers of CCs are out but that doesn't mean that full CCs are out.

E-mails and logins are also out it seems.

<comment><USER80> Last four digits of CC#s are often used to identify them to users ("Visa ending in 1234"), and are specifically OK to store in cleartext. So that's not necessarily a big deal.

</comment></comment><comment><USER81> OFTC has disabled Linode IRC channel:

 __* mode/#linode [+m] by tjfontaine

<tjfontaine> this is what I'm going to say, as a network representative

<tjfontaine> regardless of what has or has not happened with linode, OFTC cannot tolerate release of sensitive information with itself as that mechanism

<tjfontaine> this channel is moderated until staff determines otherwise

<comment><USER82> Channel now unmoderated. Edit: HTP came in and trolled (pretending to be ex- Linode), re-moderated.

</comment></comment><comment><USER83> Is this why Linode doubled the RAM? To bribe us and make us stay. I'm pretty pissed off about this and will be exploring other options. I'm not pissed off they got hacked, I'm pissed off they are hiding and not being forth coming about it. A simple, "We fucked up, we are going to take steps 1, 2 3 to fix it and reduce the likely hood of this ever happening again" will make me happy. I understand that any server can be hacked. I'm stunned that they are storing CC details on the servers, there are ways to go about this without storing them if you want recurring billing.

<comment><USER36> I'm stunned that you, and plenty of other people in this thread, are taking the anonymous IRC person's word as the gospel truth.

<comment><USER84> I am not sure that "gospel truth" is a fair characterization.

Anonymous IRC person has provided verifiable details that strongly suggest he or she had access to Linode administrative systems. Fyodor's post to nmap-dev supports the notion that customer nodes were accessed as well.

Linode has provided no details or evidence of anything.

I don't think one has to take that IRC log as gospel truth to be reasonably concerned about the security of their data stored by Linode.

<comment><USER36> The only "verifiable detail" I saw in the chatlog was the output of `ls` in the http root. And that's only verifiable because you can try to access that weirdly-named HTML file and get a 200 back. Honestly, that doesn't tell me a whole lot.

Everything else, such as the password hashes, don't seem at all verifiable (even if someone were to crack any of the hashes, you can't verify that the password worked at the time of the hack because Linode has presumably changed them all anyway).

</comment></comment></comment></comment><comment><USER85> A link to an unapproved /. submission. Fascinating choice.

</comment><comment><USER86> That explains why my LLC's business debit card was turned off due to a fraud alert.

</comment><comment><USER87> Well, here's a data point: <https://news.ycombinator.com/item?id=5554071>

Since Linode has proven in the past that they aren't the worst at communication, I can only assume some entity really has them over a barrel, considering the curt and callous responses there.

</comment><comment><USER88> I just requested a new CC. Can never be too safe. Not sure I'm going to stick with Linode now... sucks because they seemed to be doing so many things right.

<comment><USER89> I have the same sentiments, new cc and might move off linode, who I have been with for 4 years.

</comment></comment><comment><USER90> This is disappointing and scary. A friend on another forum posted that some guy on IRC told him the last 4 digits of his CC and his e-mail address. I just called my bank and cancelled my current CC and give me a new number. I really liked Linode too :(

<comment><USER44> FYI, the last 4 and your e-mail address are both visible in plaintext from your /account page in Linode Manager. Obviously, still disappointing and scary, but it doesn't necessarily mean that whoever has that information also has the full CC number.

</comment></comment><comment><USER91> I echo everything everybody has said. This sucks because _we don't know_ one way or the other. This may be some asshat FUDing away, or this may be a genuine hack.

It's hard to get angry at anybody but Linode needs better auditing around sensitive data so they can tell people one way or the other.

I resigned to the fact that I'd find it easier to change my card details in 30-odd online shops than it is fight my bank to get my money back. Now I can't make _any_ purchases for 7-10 days.

</comment><comment><USER92> I don't know the skill level of the Linode folks, but could it be that they left a honey-pot CC DB out for this hacker to discover on purpose? Keys sitting right there?

</comment><comment><USER93> I wonder if they've deleted CC details of previous clients. Is Linode going to contact all relevant customers? Seems like the right thing to do. Not everyone reads HN.

<comment><USER94> I was just told by a customer service rep at linode that I "shouldn't trust everything I read on the internet" when I inquired about the possibility of deleting my personal information from their server. This seems like an extremely inappropriate way to handle this situation...

<comment><USER93> By the sounds of it, they probably don't know the full extent of who and what was taken, otherwise they could just email everyone involved and say: "there's been a breach and it affects you" ... or they could contact CC companies.

</comment></comment></comment><comment><USER95> Does any one know of other VPS providers who are about as good as Linode in terms of quality and price but do not have a history of security issues ?

</comment><comment><USER96> Hmmm, Linode claims they emailed their customers about the password reset, but I never got an email (nor in my spam folder)

<comment><USER97> Saturday morning:

        From: "Linode" <firstname.lastname@example.com>
        Date: Sat, 13 Apr 2013 00:11:09 -0000
        Precedence: bulk
        Return-Path: email@example.com
        Message-ID: <firstname.lastname@example.com>
        List-Unsubscribe: <http://e2.ma/optout/c9dae/xxx>
        X-Test-Mailing: no

        Dear Linode customer,

        Linode administrators have discovered and blocked suspicious activity on th=
        e Linode network.=C2=A0 This activity appears to have been a coordinated at=
        tempt to access the account of one of our customers.=C2=A0 This customer is=
         aware of this activity and we have determined its extent and impact.=C2=A0=
         We have found no evidence that any Linode data of any other customer was a=
        ccessed.=C2=A0 In addition, we have found no evidence that payment informat=
        ion of any customer was accessed.

        We have been advised that law enforcement officials are aware of the intrus=
        ion into this customer=E2=80=99s systems. We have implemented all appropria=
        te measures to provide the maximum amount of protection to our customers. O=
        ut of an abundance of caution, however, we have decided to implement a Lino=
        de Manager password reset. In so doing, we have immediately expired all cur=
        rent passwords. You will be prompted to create a new password the next time=
         that you log into the Linode Manager. We also recommend changing your LISH=
         passwords and, if applicable, regenerating your API key.

        The following represent best practices in creating new passwords:
        -- Avoid using simple passwords based on dictionary words
        -- Never use the same password on multiple sites or services
        -- Never click on 'reset password' requests in unsolicited emails - instead=
         go directly to the service

        We apologize for the inconvenience. If you have any questions, please do no=
        t hesitate to contact our support team at firstname.lastname@example.com.

</comment></comment><comment><USER98> So glad the CC I had on file expired this month. +1 for procrastination. Here's to hoping Linode gets their shit together.

</comment><comment><USER99> Again! I seriously start to lose trust in the startups' security of the Silicon Valley...

<comment><USER100> They're based out of New Jersey, actually.

</comment></comment><comment><USER101> I'm most concerned about Lish access. I'm not liable for fraudulent charges to my CC, so all I'll suffer is inconvenience. I'm most concerned about access to my VMs, which can be a business terminating event if things go extremely badly.

</comment><comment><USER102> No suspicious charges on my end, yet, but I did just find out that my bank (USAA) is finally offering cards with Chip-and-Pin, which causes the card number to get re-provisioned. No time like the present, eh?

</comment><comment><USER103> I recently sent an email to linode support, and got a very murky response. I used my debit card on linode, and it was recently used on transactions I didn't make in random parts of the world that I'm not in, so I had to cancel it. My first guess was that it was linode, and all of the posts here make it more likely.

Essentially: I am a linode customer. My cc details were somehow leaked. Adds a data point here.

</comment><comment><USER104> Why would you store credit card numbers? Almost every processor has some method to store them with the processor and all you need is a token.

</comment><comment><USER105> When did this breach occur? The implication is that it was a couple of weeks ago. As it happens my CC expired at the end of March.

</comment><comment><USER106> I've seen no evidence of passwords or credit card numbers being accessed.

The purported "evidence" is a list of supposed entries in a public_html directory.

<https://bin.defuse.ca/hq0Ay8RzpKdR6vQwYxnmhc>

Has anyone seen any evidence that this is not simply a hoax?

<comment><USER107> Well, yes: try some of those files out:

<http://linode.com/MyAddress.class> <http://linode.com/y_key_57284cb2de704e02.html> <http://linode.com/ispcheck> <http://linode.com/k5_3>

etc.

</comment></comment><comment><USER108> the card with my linode account has a minimal amount total allowed to charge. I'll go through my cc usage, but at worst they could've gotten a couple of ebooks. as a long time customer though, Im conflicted and motivated to move off linode to another provider.

</comment><comment><USER109> If this is indeed true I will be very disappointed, I have had an otherwise great relationship with Linode.

I await for more data and hopefully an official response from Linode.

If the worst case is true, what are some good alternatives for Linux VPS hosting?

</comment><comment><USER110> this is why i always use my "virtual credit card" on web sites that store CCs.

</comment><comment><USER111> I'm just curious, is this in any how, related to the recent RAM increase ?

<comment><USER112> Doesn't look like it. If you believe the IRC logs, the attacker broke in using a "0day" exploit of ColdFusion, which is being used on the site. Not because of a flaw in RAM upgrades. Although I believe that Linode beginning to offer free trial accounts is probably responsible for the increase in attacks lately...

</comment></comment><comment><USER113> I dropped linode two months ago. Hope they have purged my cc information from their system. Well I logged in just now with old credentials. Cc information is still there, not so good...

</comment><comment><USER114> Sad day to see that Linode is not immune to data breaches. That being said, I don't necessarily support the witch hunt that seems to have taken place on its reputation.

</comment><comment><USER115> <http://blog.linode.com/2013/04/16/security-incident-update/>

</comment><comment><USER116> When was this alleged hack supposed to have happened?

</comment><comment><USER117> Fortunately my CC information on file is expired.

</comment><comment><USER118> A funny comment on IRC:

        "One bit of good news from all this hubbaloo: more space will be opened on the new E5 hosts from customers leaving \o/"

</comment><comment><USER119> Being a former customer I decided to contact Linode support. I wanted to know if we have anything to worry about as we used to have a credit card on file with them. Notice how they say "Decrypted" which to me is not the same as NOT COMPROMISED.

Here is their response:

Thank you for reaching out to us. We do archive customer credit card details. At this point there is no evidence that customer credit cards have been decrypted.</comment>