Silk Road 2 Hacked, All Bitcoins Stolen - <AUTHOR> http://www.deepdotweb.com/2014/02/13/silk-road-2-hacked-bitcoins-stolen-unknown-amount/ <comment><USER2> This is seriously the most hilarious thing I have read in a long time. Here we have a group of objectivist libertarians who believe that there should be effectively no laws other than the law of economics and self-interest who run an illegal website devoted to the pure greed of cashing in on contraband, and this is what they write:

"I've included transaction logs at the bottom of this message. Review the vendor's dishonest actions and use whatever means you deem necessary to bring this person to justice." We need the government! Please, come find the guy who took all of our illegal drug money and give it back to us so we can continue to say you aren't necessary.

"Given the right flavor of influence from our community, we can only hope that he will decide to return the coins with integrity as opposed to hiding like a coward." Yes, you bad guy, you should do the right thing and think of the community not your self-interests by giving back your illegal gains back to the guy named Dead Pirate Roberts (that's totally his real name).

"Whoever you are, you still have a chance to act in the interest of helping this community." In the interest of the community?! Bwahahahaa!

"I will fight here by your side, even the greedy bastards amongst us." Like _everyone_ on the site?!

"The only way to reverse a community's greed is through generosity." Just like Ayn Rand said my brothers!

Then I come here and not a single person on here even notices the massive hypocrisy and lack of self-awareness. Amazing.

<comment><USER3> I think you have a deep misunderstanding of libertarianism (which is your right of course). Libertarians don't necessarily not believe in laws, they simply don't believe in a monopoly of laws and law enforcers. This is kind of the whole point. Its clear that in your world view "justice" is somehow inexorably tied to government, but there others that disagree (which leads to your confusion in thinking that because someone asks for justice he is necessarily asking for government).

To illustrate this a bit better, perhaps using an example that you probably agree with Libertarians on: just because libertarians believe drugs should not be illegal, does not necessarily mean they believe drug use shouldn't be discouraged or treated. It is not hypocritical to fight for drug decriminalization but then seek rehabilitation programs for your drug addicted friends. That is in no way acquiescing to the need for drug control -- it is using a _different_ tactic to fight a problem both sides may very well agree exists.

Similarly, it is not hypocritical to want the government to stay out of currencies, but still want a method of punishing thieves. You may believe other methods don't work (just like there are a lot of red voters who think its naive to think not putting drug users in jails works), but that doesn't make the other position inconsistent.

<comment><USER2> "they simply don't believe in a monopoly of laws and law enforcers"

Ahahahahaah! That's the same as not having laws! And even then, what you're saying is they believe someone should bring this guy to justice...and then do nothing to him. Then it's not justice. You're killing me my friends. Just killing me here.

<comment><USER4> >Ahahahahaah!... You're killing me my friends. Just killing me here.

You can make the same argument without being an ass about it.

<comment><USER2> It's funny how me pointing out the stupidity and bullshit of a group of criminals makes me an asshole...

But a guy who has actually lost people's money, put them at risk of reprisal from drug dealers, helped people (potentially young people) commit major crimes, enabled future addicts, and potentially is lying about the security flaw to steal all this money while spouting hypocritical contradictory statements...is a fucking hero.

Bravo! You win the ultimate hypocrite award of the century!

<comment><USER5> It's the condescending way you write that makes you seem like an asshole... i.e saying "Hahahahah" all the time - I don't particularly disagree with your points but the insulting tone is unnecessary, don't you think?

<comment><USER2> First off, only my mother gets to tell me to "watch my tone". Random jackoffs online can go fuck themselves if they think they've earned my respect by default, especially if those same jackoffs use political rhetoric to harm and steal from others.

My tone is simply a reaction to the tone of arrogance and superiority most objectivists and commenters take. If you don't want to be ridiculed, then don't write like a arrogant douchebag with zero self-awareness. Those kinds of people are due a large dose of insulting and "tone".

<comment><USER5> redthrowaway's comment:

> You can make the same argument without being an ass about it.

Your reply:

> It's funny how me pointing out the stupidity and bullshit of a group of > criminals makes me an asshole...

You completely missed their point, how you can't see that is beyond me.

<comment><USER6> Careful, now. It looks like you're saying that calling something stupid bullshit is being an asshole. Some of us happen to believe that stupid bullshit is a real thing and that there are circumstances where calling something stupid bullshit may be entirely fair and justified.

Try defending against the accusation itself instead of taking the stance that the accusation is always automatically invalid.

<comment><USER4> >It looks like you're saying that calling something stupid bullshit is being an asshole.

No, being an asshole _while_ calling something bullshit is being an asshole. A ^ B |- A. You can say something's bullshit without ridiculing people. Zed's problem isn't that he says unpopular things, it's that he seems to try to be as rude as possible in saying them.

Saying something's bullshit isn't necessarily rude. Saying something's bullshit and anyone who disagrees with you is an idiot|hypocrite|moron|asshole is.

<comment><USER6> > " _Saying something 's bullshit and anyone who disagrees with you is an > idiot|hypocrite|moron|asshole is._"

The truth of that statement still depends on what the issue is. There are some beliefs you really do have to be stupid or disingenuous to espouse.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This is almost certainly hogshit, and anybody who has been paying even a little bit of attention over the last week can probably smell it.

The "hole" in MtGox's security was a social one. You could contact customer support and claim that you had not received your coins, and they could re- issue you new ones if they chose to. There is also no evidence that this ever happened.

This wasn't, and isn't, a flaw in the underlying architecture, it's just a way to convince a customer service rep that you weren't lying.

If SR was re-issuing coins _automatically_ , it's because they were being intentionally stupid.

\--

They're using this as a scapegoat. Either somebody ran off with the coins, or something otherwise hacked them and they're using this as an explanation.

<comment><USER8> _If SR was re-issuing coins automatically, it 's because they were being intentionally stupid._

MtGox was re-issuing coins automatically. Due to this, Gox has lost money. Possibly a huge amount. Were they being intentionally stupid, or just stupid?

Source: [https://news.ycombinator.com/item?id=7222690](https://news.ycombinator.com/item?id=7222690)

This transaction malleability flaw is certainly a convenient excuse. But if these people implemented their wallet software in the same manner as Gox, then they would've suffered the same fate: a loss of thousands of coins, which is exactly what they claim happened.

<comment><USER7> Maybe I just haven't had enough coffee today, but: where does it say there that gox was re-issuing coins automatically?

<comment><USER8> Sorry, I should have linked two comments higher: [https://news.ycombinator.com/item?id=7222457](https://news.ycombinator.com/item?id=7222457)

 _You 'll note that mtgox had funds taken from it. None of these other sites [did]. They're just being flooded with junk that screws up their transaction processing. It's not really the same thing at all._

</comment></comment></comment></comment><comment><USER9> The claim that this was caused by transaction malleability rings hollow.

The reference client (github.com/bitcoin/bitcoin) does not resend transactions because of malleability.

The only way you can have double transfers due to malleability is if you are manually reviewing transfers and re-sending them yourself manually.

This seems like a very convenient scapegoat.

<comment><USER10> I thought the 'malleability' problem only resulted in miners being DDOS'd. The transactions themselves were supposedly still 'intact' \- i.e., inputs, outputs, addresses were not modified.

So.... what are SR2 saying happened here? \- Is it a double spend using SR2 escrow bitcoins? \- How was the malleability introduced?

<comment><USER11> There are two potential issues with the malleability. One is the MtGox problem where you might not realize a transaction was successful and you are duped into sending the money twice.

The second issue is a bug that was discovered in the reference client where if you try to spend coins you sent to yourself before they are confirmed a bug in the wallet causes your balance to be off.

Neither problem inherently allows theft but if you aren't careful the first can open your to social engineering. The reason they are calling this a dos as far as I can tell is because they are preventing you from spending your money until the bug is fixed with the accounting in the reference wallet.

SR2 is probably full of crap but there is a small possibility that they some how automated re-sending of failed transactions w/o properly accounting for malleability in which case you might be able to steal a multiple of the actual amount of money in your account over a few days. The sheer size of this though would make me skeptical of that scenario.

<comment><USER12> > One is the MtGox problem where you might not realize a transaction was > successful and you are duped into sending the money twice.

This isn't really a malleability issue however. Lets say it wasn't successful: You send again. Opps, someone pulls the original out of a hat and both go through.

The only way to safely reissue is to double spend the original transaction. Then you get atomic exclusion, and it's completely safe: only one can possibly get into the longest chain. This safety still applies if there is mutation going on.

</comment></comment></comment></comment><comment><USER13> Given illegal nature of Silk Road 2, I can't help but be suspicious of this explanation of the hack. If someone's sufficiently willing to flaunt laws as to operate a site devoted to selling contraband, what stops them from taking advantage of their position of power and stealing from their users?

<comment><USER14> It's entirely possible to be in support of a free and peaceful drug trade, while at the same time being morally against theft. I don't know why you're lumping the two.

<comment><USER15> There's a difference between supporting a free and peaceful drug trade and participating in a very-much illegal drug trade. It's possible to be a hemp- wearing, tree-hugging hippie and be pro-death penalty - it also happens to be rare.

<comment><USER16> the law has very little to do with supporting freedom and peace these days.

<comment><USER15> That is very true, but there's still an enormous chasm for your average person between being mostly-law-abiding (I'm not counting things like jaywalking or going 5mph over the limit) and participating in drug sales, which could land you life in prison. Hell, I think drug laws are incredibly unjust in the US, and that the government is overstepping its bounds left and right. By no means should you infer from this that I'm not careful of the legality of my actions. I think it's perfectly reasonable to assume that someone participating in a life-in-prison-risking drug enterprise would also be willing to make other illegal/immoral decisions - in fact I think it would be foolish and naive NOT to assume that as a default, despite the fact that it will of course not be true in every case.

<comment><USER17> Having dealt passingly with a large number of marijuana dealers, I disagree strongly with your assessment.

Do you have any statistics to back this up, or just the naive reasoning "Well, it's a /serious/ crime, so they'd probably commit others, because only bad people commit /serious/ crimes"?

</comment></comment></comment></comment></comment></comment><comment><USER18> On 1/31, a SR Forum user warned, "SR2 massive scam about to hit very soon"

      >no Auto Finalize/no resolution center coins are pilling up massively
       whitout anyone even  realising what s coming .
      >there is propably couple millions $$ just in escrow alone and
       no one is fucking complaining.
      >You guys really think it takes more than a month to implement
       a resolution center?how dumb are you
      >This is about to be the biggest scam in the history of the darkmarkets.
      >Defcon postponing dates again and again,then annoucing that a fix
       has been done when clearly it hasn t done shit ?(captcha)in this case.
      >Can t you fucking see throught their bullshit and blatant lies that
       the ship is about to go down the drain very soon??wake the fuck up .

Follow-up from today:

      >well,I ve done what I could to warn you at least,next time you
       call me a troll rethink maybe.
      >my posts weren t really convincing because of the bad grammar
       (not english) but the message was there for everyone willing to hear it.
      >If you believe all this bullshit again from defcon ,then I am affraid
       you d get scammed over and over again.SR isn t what it once was,
       it is run by a greedy cunt.
      >This was just so predictable,it doesn t take 2 fucking month to
       implement a resolution center ,not having it was the main tool
       of their scamming operation.
      >The funniest thing in that story is that SR would still be up ,
       means this scams could go on forever because people are
       licking blindly these greedy mofo.
      >don t be fooled by the green camel next time rant over/

[http://www.reddit.com/r/DarkNetMarkets/comments/1xu8wc/sr_fo...](http://www.reddit.com/r/DarkNetMarkets/comments/1xu8wc/sr_forum_post_31st_january_sr2_massive_scam_about/)

</comment><comment><USER19> Irony at its finest here. If you're going to go to the effort to use a decentralised currency that is difficult to track to a particular individual for a website selling illicit drugs and items served via a decentralised and anonymously run network, don't expect any sympathy when your Bitcoin goes missing... You go to the great effort of avoiding conventional means of currency (banking, trackable transactions to individuals) and yet you realise how the traditional banking system in many ways while not being perfect protects you from a lot of this type of activity. If an attacker hacks into your Internet banking or your credit card is stolen, you in most cases get the money back.

No monetary system is perfect, and I think these increasingly frequent scenarios where X amount of crypto-currency is "stolen" and cannot be recovered drive that point home. I strongly believe that crypto-currency has a bright future, I own a few Bitcoin myself and many other alternative crypto, but I don't entrust and never would entrust my coins in a drug-dealer exchange escrow wallet, I keep them on my computer and in cold storage. These kind of situations just keep driving BTC's price down further, we don't need a Silk Road for Bitcoin to succeed.

This whole situation really just makes me laugh. Some people have no faith in the traditional system of Government or currency, but for some reason have faith in a system and currency that is inherently insecure, unpredictable and when shit hits the fan, there's nobody to help you...

<comment><USER20> Your point about the traditional banking system is irrelevant since there's zero chance of successfully buying a kilo of coke with your Visa card.

So whether it's bricks of cash or shady darknet sites, the prohibition on drugs necessarily doesn't leave one with much recourse when transactions go wrong.

</comment></comment><comment><USER21> My favorite part of bitcoin is just how wild west it always feels. Real money, in very massive quantities is stolen, and there's no authorities who will do anything about it. Old school scams are new again. Crashes happen on a monthly basis. I'm staying out of it in any serious quantities because frankly i'm having too much fun watching it.

<comment><USER22> It's even more fun with skin in the game.

<comment><USER23> Just remember to never invest more than you can afford to lose.

<comment><USER24> Heh.. "invest."

</comment></comment></comment></comment><comment><USER25> This is nonsense. The transaction malleability issue doesn't cause coins to be automatically resent. The simple explanation is that the owner ran off with everybody's money.

</comment><comment><USER26> Sounds like Defcon got the excuse he needed to line his pockets with all of the Silk Road 2 money.

I don't run a marketplace, but I would assume that an alarm protocol would be implemented and triggered when thousands of bitcoins start to drain out of "hot storage".

Exploiting the transaction malleability bug wouldn't net you 4,500 BTC at once. It would take a lot of requests of broken transactions to drain the entire marketplace of thousands of BTC. Defcon and SR2 should have been on high alert for this kind of problem after the Mt. Gox announcement.

Anyone who runs a Bitcoin marketplace would not be "slow to respond and skeptical of the issue at hand", especially not when the entire balance of the marketplace is in such a vulnerable state.

Defcon has been around this business for years, he isn't an amateur. How could he make such a fundamental, incredibly ignorant error?

Even if we believe the "bad luck, terrible timing" explanation, Defcon's lack of caution and general awareness is simply inexplicable. There is no way he would be so nonchalant about any kind of fault in the Bitcoin protocol with everyone's money sitting out in the open, just waiting to be stolen.

I think the moral of this story is to not open an account with an anonymous exchange. Instead, open an account with a marketplace backed by some high- profile VC's who have some skin in the game. You can bet that Andreesen isn't going to be careless and ignorant enough to let the same thing happen to Coinbase. Not when he's got $25m and his invaluable image on the line.

<comment><USER27> > I think the moral of this story is to not open an account with an anonymous > exchange. Instead, open an account with a marketplace backed by some high- > profile VC's who have some skin in the game. You can bet that Andreesen > isn't going to be careless and ignorant enough to let the same thing happen > to Coinbase.

Great. Call me when Andreesen funds a black-market for highly illegal drugs.

<comment><USER26> I think people are less worried about finding a source for illegal drugs, and more worried about finding a secure marketplace where they can trust the administration and exchange their funds securely.

Theoretically, I would be relatively bummed out if my favorite drug dealer was arrested. Then I would get over it and find a new dealer.

I would be livid if my drug dealer took my money, pointed a gun at my head, then got in his car and drove away, all the while claiming that he wasn't robbing me and that he had always had my best intentions at heart.

So I'm not so concerned about a new marketplace popping up. The market demands drugs, and it will have them (SR3?). My point was simple: if you don't want to lose your money, don't store your money in an anonymous, drug-dealing marketplace. I'm not sure why this warranted such a sarcastic response?

<comment><USER27> I'm being sarcastic because your solution is a non-solution: using a trustworthy exchange does not solve the problem of centralized escrows being vulnerable. A real solution looks something like 'use multi-sig escrow'.

</comment></comment></comment></comment><comment><USER28> Reports like these make me wonder what Hacker News would have looked like during the gold rush in the 1800s.

<comment><USER29> Hello good sirs, I am able bodied and in want of land and picket. Please reach me at the bar, call for Sam.

<comment><USER30> Exhibit HN: I've concocted a most healthful and beneficial syrum of the utmost pure ingredients! This here oil shall alleviate ye of all woe, misery and weak-of-knee! Looking for a most suitable alchemical co-founder to assist in mine taking this to production ready status for this year's county fair! Please contact me by post or telegram!

Dr. Samuel's Special Synergistic Syrum One Market Plaza, San Francisco

</comment></comment></comment><comment><USER31> "Movement"? "Comrades"? "Freedom fighters"? Excuse me, isn't this the online equivalent of an open-air drug market he's talking about here?

</comment><comment><USER32> ... and things like this do to a point hilight why there is a lot of regulation around money and trying to create a new "freer" currency is actually really dangerous. I'm pretty sure his operating practice of keeping all the money in one place would be against regulations. Also usually there are big security standards. And finally high transaction fees do in some part support _insurance_ so when my/your visa is stolen or what ever, the bank can just refund me, and take it out of its insurance. Because storing a lot of money for a lot of people is a big deal, but its a well looked at deal, and trying to start from scratch ignoring all of that... well... you just end up with people loosing money in ways that would never happen otherwise. :/

</comment><comment><USER33> For anyone still drinking the "Bitcoin is frictionless" kool-aid, this hasn't been a good week.

<comment><USER16> for anyone who sees bitcoin as a 'wild west' environment, this sort of thing is obvious and just moves the bitcoin economy forward. problems found now are fixed, and won't be as big of a deal later.

<comment><USER34> But this isn't a beta test. People treat Bitcoin as if it's ready for primetime and ready to replace traditional currency.

<comment><USER17> Yes, there's never limits on cash withdrawl in the glorious banking system.

[0] [http://www.bbc.co.uk/news/business-25861717](http://www.bbc.co.uk/news/business-25861717)

<comment><USER33> If one of the main bullet points of your currency replacement is that "it's frictionless unlike regular money", and you ever find yourself pointing the finger at regular money and saying "it has frictions too" you already lost the argument.

</comment></comment></comment></comment></comment><comment><USER35> How do we know the founder didn't steal everyone's coins and is using hacking as a scapegoat?

<comment><USER27> We don't know that, and there's good reason to think they're doing just that.

</comment></comment><comment><USER36> Owner decided to cash in and retire to no extradition treaty island?

<comment><USER37> Why "no extradition"? Would he risk anything penal? If bitcoins are not money he may risk just a fine.

<comment><USER38> [http://en.wikipedia.org/wiki/Fraud](http://en.wikipedia.org/wiki/Fraud)

<comment><USER39> If he is ever found, criminal charges are the least of his worries. We are supposing that he stole lots of money from lots of different drug dealers.

<comment><USER40> Dime Bag Donny is hardly pablo escobar.

If it took the FBI 2 years to track him down, unless he fucked over the Zapatas exactly nothing will be done about this. But then again the Zapatas hide behind guns, not crypto currency.

</comment></comment></comment></comment></comment><comment><USER41> In the San Fran startup world where iphone taxi requesting and self-deleting video clips for 14 yr olds are the cusp of innovation, thank god for bitcoin and all the fun that comes with it.

</comment><comment><USER42> Wow, it really is the wild west out there right now...

I wish that some of the "post-mortem" reports I've seen were this good and detailed with problem, explaination, resolutions. I don't have a horse in this race so people affected probably feel differently.

</comment><comment><USER43> Not having very much knowledge about the financial industry - is this also an issue with marketplaces that deal with fiat monies?

i.e. Dwolla, Balanced, Stripe, Venmo, all serve as intermediaries for moving money - do these companies have bank accounts that hold onto massive sums of money? What protections would go into keep those accounts secure?

<comment><USER44> Modern banking is over 100 years old. There is 100+ years of fraud protection processes, legal experience, etc built into the system, plus a huge and complex industry that has a vested interest in overall currency stability.

Bitcoin and other digital currencies are learning firsthand what it means to "disrupt" on this scale. Part of that is learning the hard way what the old industry has known since before any of us were born.

<comment><USER45> Modern banking is also largely reversible, so stolen funds can often be recovered, and insurance covers the other cases.

Bitcoin has the problem of having irreversible transactions, and it's also a lot more difficult to determine whether or not an account has been legitimately stolen from.

I don't think it's the case that the current banking industry is insulated from theft due to superior security. From what I've heard from programmers working in the financial industry, the software there can be quite ropey, or at least no better than anywhere else.

<comment><USER44> Reversible transactions _are_ a security mechanism. And not all mainstream financial transactions are reversible - short term bank to bank loans, which can run in the tens of millions of dollars over periods of mere minutes, are not reversible within the transaction process itself (set up another transaction to balance the books if necessary). Of course, this is hardly a realm for consumers! Only a rarified few that have passed stringent regulatory requirements can participate in high-end mechanisms, and they can be booted out easily in case of fraud or failure.

Irreversible, unregulated, software-driven money at the consumer level is a thief's wet dream. It's even more appealing than cash. Money can be stolen from halfway across the globe, anonymously. Digital currencies face security challenges that go far beyond those of the fiat currency so many people despise.

Besides the theft problem, there's the crime problem. Digital currency is extremely convenient for high-dollar criminals like international drug and arms dealers. They're the first big customers, while mainstream businesses lag far, far behind in their own cautious way. This makes governments even more hostile, and civilians as well. And a currency that isn't accepted by the vast majority of legitimate businesses is not terribly useful.

But to your other point... yeah, banking software is not necessarily a paragon of security, any more than any other big enterprise software. But consumer- facing parts are generally fairly limited in scope (worst breach I know of is the recent Target breach), and the really big-money parts are hidden well away from the world and buried under many layers of process as well as software security.

<comment><USER45> Sure, but the processes that make banking secure mostly rely on human interaction, insurance and centralisation, which are obviously difficult or impossible to apply to Bitcoin. The current batch of Bitcoin businesses are getting hard lessons in information security, whereas the mainline banking system can compensate for any deficiencies in their software with more traditional security processes.

To me, one of the more interesting results of Bitcoin is how critical information security is to the businesses that deal in it, and how a flaw in their security can make companies vanish overnight. It really provides some darwinian pressure to get security right!

<comment><USER44> And fiat currency starts looking better all the time. The fact that the most powerful security mechanisms aren't even _applicable_ to digital currency should be a huge red flag.

Short the exchange rate + significant DDOS attack on the exchanges = millions in free money. That's just a for example. It doesn't even require explicit crime on the bitcoins themselves, and can be done at a safe remove through multiple cutouts. (Historical point of comparison - shell companies were used to short airline stock just before 9/11, resulting in tremendous windfall profits for presumably close allies of the perpetrators)

<comment><USER45> > And fiat currency starts looking better all the time. The fact that the most > powerful security mechanisms aren't even applicable to digital currency > should be a huge red flag.

You could make similar arguments about security on the internet compared to physical security in the real world. The recent Target credit card theft, for instance - it's unlikely that the thieves could have appropriated 40 million credit card numbers by physically taking them!

> Short the exchange rate + significant DDOS attack on the exchanges = > millions in free money. That's just a for example. It doesn't even require > explicit crime on the bitcoins themselves, and can be done at a safe remove > through multiple cutouts.

Sure, but you could achieve a similar effect by attacking an internet retailer and shorting their stock. It's also a lot easier to short stock, which is a shame, as shorting typically reduces price volatility.

</comment></comment></comment></comment></comment></comment></comment><comment><USER46> How much was stolen? How many bitcoins are we talking about. It isn't very clear.

<comment><USER47> at the top of the article:

Update: The amount of BTC that was stolen was calculated by Nicholas Weaver @NCWeaver – Computer Security Researcher, to be around: 4474.266369160003BTC that are with the value of about $2.7 Million.

<comment><USER48> That should be 4474.26636916 . . . who is doing BTC calculations with floats?

<comment><USER49> Bitcoin can be divided down to Satoshi's (0.00000001) an are often traded in fraction. Since they're worth $500+ at the moment, it makes a lot of sense.

<comment><USER48> I was talking about the trailing decimals after the hundred-millionths place. It's an obvious sign that someone was doing calculations on them as floats and not integers (and dividing by 100,000,000 for display purposes).

</comment></comment></comment></comment></comment><comment><USER50> > our projections of order finalization volume indicated that we would need > the community's full balance in hot storage.

As a bitcoin community leader, you _have_ to stay informed with how other people got hacked in the past, and there are so many cases where all the bitcoins were foolishly kept out of air-gapped cold storage until an adventurous hacker plundered them. I guess history is doomed to repeat itself.

</comment><comment><USER51> All the Reddit kids are talking about a new site called The Marketplace, apparently very secure.

[http://www.reddit.com/r/themarketplace/comments/1tx26z/the_m...](http://www.reddit.com/r/themarketplace/comments/1tx26z/the_marketplace_simple_guide_with_pictures_latest/)

Anyone with more knowledge and less bias care to elaborate?

<comment><USER27> Multi-sig _seems_ like it would prevent these problems of markets scamming their users, and thus far seems to have worked for TMP, but the major issue is that TMP hasn't been very popular because it's harder to use, and so we don't know how robust multi-sig is in practice.

<comment><USER51> Thanks for answering Gwern. I admire your work, trust your opinion, and it resonates with my impression.

</comment></comment></comment><comment><USER52> The hatred for Mt Gox in the bitcoin community blinded them to the reality that the malleability bug is very serious. The way the bitcoin community responded was irresponsible.

Regardless of whether there are workarounds, it's a tragic security flaw in the protocol and should have been treated as such.

<comment><USER53> As I understand it, this was a problem that was identified over 2 years ago, and fixed for over a year. The problem is that MtGox implemented their own wallet software, and neglected to include bug fixes from the reference client.

<comment><USER52> I don't believe that is correct. The core devs relied on people implementing workarounds.

</comment></comment></comment><comment><USER54> Ummm seriously why do these marketplaces hold your bitcoins???

Don't they know bitcoins support m-of-n transactions? There should be a marketplace without the ability to have bitcoins stolen! It's rather straighforward people.

<comment><USER27> > There should be a marketplace without the ability to have bitcoins stolen!

There is at least one, and it's pretty well-known. You underestimate how much ordinary people don't want to deal with things like m-of-n transactions/multi- sig.

<comment><USER54> So why can't it be made more user friendly?

Marketplace initiates the transaction, and all you have to do is sign it with your bitcoin client.

<comment><USER27> > Marketplace initiates the transaction, and all you have to do is sign it > with your bitcoin client.

'All'?

</comment></comment></comment></comment><comment><USER55> _I've included transaction logs at the bottom of this message. Review the vendor's dishonest actions and use whatever means you deem necessary to bring this person to justice. More details will emerge as we continue to investigate._

This seems like absolving themselves of responsibility. Was that in the spirit of how this was set up? I understand that this is different than a bank, both in spirit and law. But is there really nobody who would go after Silk Road 2 to get the money back?

</comment><comment><USER56> Interesting...

 _I've included transaction logs at the bottom of this message. Review the vendor's dishonest actions and use whatever means you deem necessary to bring this person to justice. More details will emerge as we continue to investigate._

Presumably the particular addresses used will be noted for future reference by vengeance-minded parties? Perhaps the list should be referenced by popular client software so innocents can avoid receiving BTC, even indirectly, from the blamed addresses...

</comment><comment><USER57> Okay, I'm going to go out on a branch and throw up a strange hypothesis. I don't have any stake in the Bitcoin or drug dealing games, apart from generalized anarchistic tendancy:

Silk Road 2 was a project set-up by some government agency or gangsters. The overall plan is to eliminate competition and sow uncertainty around both Bitcoin and Silk Road type unregulated markets with anonymous owners. The "transaction malleability" issue is totally unrelated to this event - it's not an exploit that can be used to 'steal' Bitcoins, only to corrupt the blockchain and/or mess with transactions (eg. cause them to fail or end up in limbo).

"We were planning on re-launching the new auto-finalize and Dispute Center this past weekend, and our projections of order finalization volume indicated that we would need the community's full balance in hot storage." \- a silly excuse for such an obvious mistake. No imaginable system would require the _entire_ balance of the community to be stored in such a way, no reasonable systems architect would do this.

"The details we have on the hacker are below. Stop at nothing to bring this person to your own definition of justice. We normally do not doxx anyone, and hold user information sacred. But this is an extreme situation affecting our entire community, and all three users who have exploited this vulnerability are very much at risk until they approach us directly to assist with any information. Do not reveal any details of the attack. This will jeopardize your reward. Contact us directly. If anyone has purchased or sold to these usernames, expect generous bounties for any information you can contribute which leads to identification." \- hold on, where's the evidence? What is he going to do with any information provided by his internet personal army? Why should others do his work for him in tracking these supposed hackers down?

"Few hours before the announcement we at DeepDotWeb received a mail saying: 'SilkRoad hacked, 150 BTC stolen, you heard it first from me' this was sent to us by a reddit user who claimed since yesterday he was going to hack SR and steal the sites money" \- Wouldn't that just be the perfect cover? Get some small-timers to grab a little and point the finger at them while he makes off with the much larger remainder. Besides, didn't this guy just say that he needs help tracking the attackers down? How does he then know enough to attach addresses to particular handles and countries? I admit some unfamiliarity with both Bitcoin and Silk Road/2 here so I hope somebody else can fill me in on this.

"It takes the integrity of all of us to push this movement forward. Whoever you are, you still have a chance to act in the interest of helping this community. Keep a percentage, return the rest. Don't walk away with your fellow freedom fighters' coins." \- An attempt to insinuate that the 'thief' is a member of the Bitcoin in-group, alongside the author. An appeal to those already attached to the in-group to 'join' the author in 'solidarity' and painting this event as an battle to defend Bitcoin itself. One that was already 'lost', I note.

"Multi-signature transactions are the only way this community will be protected long-term." \- oh yes, if ditching anonymity by tying identities and transactions together in an easily auditable fashion is 'protection' in this business.

"I should have taken MtGox and Bitstamp's lead and disabled withdrawals as soon as the malleability issue was reported. I was slow to respond and too skeptical of the possible issue at hand." \- I believe this to be a stretch of the truth, weren't the MtGox and Bitstamp shutdowns totally unrelated to this 'exploit'?

"If this financial hardship places you at risk of physical harm, contact me directly and I will do my best to help you with my remaining personal funds." \- Give us all your information and I promise I'll send you some money!

"Hindsight is already suggesting dozens of ways this could have been prevented, but we must march onward." \- Translation: I just lost a lot of your money, trust me so I can do it again or lose faith in Bitcoin entirely.

"In retrospect this was incredibly foolish, and I take full responsibility for this decision. I have failed you as a leader, and am completely devastated by today's discoveries." \- Awesome, an anonymous guy with nothing to lose takes full responsibility.

I'd love to hear some thoughts on these comments and if anybody is thinking along the same lines? Alternatively, I'd also love to hear good arguments against this position.

<comment><USER58> > _Alternatively, I 'd also love to hear good arguments against this position_

Oh, I'll bite:

If you have the choice between conspiracy and incompetence the latter is almost always the more likely.

<comment><USER57> Ah, yes, Hanlon's razor. It works as a general rule, but I think that there are enough powerful, vested interests (proven by eg. Russia, China and US Fed actions/statements regarding Bitcoin) and enough precedence (CIA disinfo campaigns, NSA TAO and it's 'dirty tactics', Chinese and Russian gang ops and propaganda/DoS attacks, corporate APTs) to make conspiracy a real possibility. I think that one of the key things here is that many of us discussed _the possibility of exactly this situation_ , whether conducted by advanced actors or petty criminals the last time that Silk Road was burned to the ground (and, in that case, it was pretty clear who was behind it).

</comment></comment></comment><comment><USER59> This is why we need to find decentralised means of exchanging Bitcoins.

I built [https://www.cointouch.com/](https://www.cointouch.com/) to find trading partners in my extended social network. I don't want to use a centralised third party.

There's little need for a centralised exchange given we have a rich social graph, and a programmable currency that is truly P2P.

Keep it all P2P.

</comment><comment><USER60> TL;DR one opportunist business with no strong external audits has failed its customers, and everyone who wasn't affected seems to think it's the perfect opportunity to criticise the philosophical views of people who may not even be involved.

Please stop upvoting such low quality threads. We can do better than this, guys. :P

</comment><comment><USER61> Whatever happened to honor among thieves?

<comment><USER30> Well.. if they weren't stealing them bitcoins, then they wouldn't be thieves to uphold said honor...

</comment></comment><comment><USER62> They were just asking for it. If you work with bitcoins in such quantities, you will have an attack surface so appealing that every single hacker on earth will be targeting you. You better treat security seriously.

</comment><comment><USER63> Play with fire and get burned. Sounds like the thugs have started tracking the thief, which would end in blood if caught. Classy stuff here folks, amazed drug dealers and crooks seem "normal" now.

</comment><comment><USER64> Is our only recourse downloading the entire block-chain to keep our wallets stored offline? Or do I have some misunderstanding? I just really like the convenience of services like coinbase.

<comment><USER65> You don't need the block chain to keep coins. You only need a wallet. Technically your private keys never need to see the internet at all.

Edit: here is one way to do it [https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_sa...](https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_savings_wallet)

At a recent meetup there was a presentation recommending Electrum with HD wallets instead. That would mean you really would only need to memorize a passphrase, all the keys would be generated from that so no backup necessary. Personally I am not yet 100% sure HD wallets are safe, need to look into it.

</comment></comment><comment><USER66> index.php?

Can we say that they were inviting themselves to be hacked? Really, the only way to not have all their cash stolen would be for the NSA to hack them first and close up all the security holes.

</comment><comment><USER67> About 150 coins were stolen by the main attacker- $91,870.

</comment><comment><USER30> SO, I am completely ignorant on exactly how bitcoin works; but how the hell is it not possible to secure a bitcoin one owns.

<comment><USER68> It is perfectly possible. Your only task is to secure the private keys. These are short enough to be printed as a QR code or written down. keep that piece of paper somewhere safe. Alternatively, it is possible to use a good, random, long passphrase as your de facto private key. That way, the keys to your wallet are literally stored in your mind and nowhere else.

As of now, there are no known fatal flaws or weaknesses in the Bitcoin protocol itself. The network is secure and as long as you manage to secure your private keys, Bitcoin is extremely safe.

<comment><USER69> > It is perfectly possible [to secure a bitcoin one owns].

You're forgetting about social engineering.

<comment><USER68> Social engineering applies to pretty much everything. It has nothing to do with Bitcoin (or whatever else a social engineer wants from you) and everything with your own lack of due diligence and gullibility.

<comment><USER69> I agree entirely - and that is the reason that one shouldn't say "It is perfectly possible to secure a bitcoin one owns."

<comment><USER68> Semantics. Obviously, theoretically, everybody can be fooled. The common sense definition of secure is not "secure with zero possibility of the security being broken". Storing diamonds in a safe at the bank is secure. Printing your private key and storing it at the bank is not any less secure than storing diamonds there.

</comment></comment></comment></comment></comment></comment><comment><USER70> How much is the loss? Who is going to cover it? don't think there is an insurance policy for bitcoin hacking.

</comment><comment><USER71> Yeah, right, they "got hacked".

</comment><comment><USER72> This thread is now about zed shaw

</comment><comment><USER73> "hacked"

</comment><comment><USER74> how the hell do they get away with kind of heist? Wouldn't they be able to follow the blockchain addresses until arriving at the wallet they are using to cash out?

<comment><USER75> I've talked about this before. [http://news.ycombinator.com/item?id=7086399](http://news.ycombinator.com/item?id=7086399)

You won't be able to find me without the authorities forcing the exchanges to provide info since they make their own cut helping me move the funds around in transaction-fees if they keep quiet about these kinds of things. As long as I'm not too greedy/eager and don't rush things, I can collect on these funds over the course of several months. I can even spice things up by sending a bunch into an online bitcoin-gambling-site. Gamble a little bit; perhaps lose some then withdraw after a few days. So now if I had sent 10 BTC in then 9 BTC goes somewhere else, you don't know if I lost 9 BTC to the casino or if I lost 1 to the casino and 9 is going to another wallet of mine.

All this will look pretty crazy to anyone trying to follow me on the blockchain. You can't know which coins are actually mine and which belong to the exchanges & casinos. Maybe I legitimately won the jackpot; who knows.

Also, there's this: [http://www.bitcoinfog.com/](http://www.bitcoinfog.com/)

Sidenote: Casinos are a great business to launder real life fiat money too...

</comment></comment><comment><USER76> I suspect bandits.

</comment><comment><USER77> What it means to be a libertarian by Harvard Professor [VIDEO] (01:57)[https://www.youtube.com/watch?v=zxj00QD6fNY](https://www.youtube.com/watch?v=zxj00QD6fNY)

</comment><comment><USER78> This is why bitcoin is a sham. The premise of perceived bitcoin value is based on the greater fool theory. What the hell were any of these people thinking?

[http://en.wikipedia.org/wiki/Greater_fool_theory](http://en.wikipedia.org/wiki/Greater_fool_theory)

<comment><USER79> That has nothing to do with what has happened here and has been argued ad nauseam in other threads already. In short: the only aspect of bitcoin that may be considered an instance of the greater fool theory is the idea that it is a guarenteed investment. Obviously it is not, and this news has nothing to do with bitcoin as an investment vehicle anyway.

<comment><USER78> It has everything to do with this - the reason it was stolen is it is a crypto currency with no legitimacy or inherit value. It's not even a physical object, its more like a stock that is not regulated.

If this were real currency or a stock, then there might be some regulation and stealing would be hard to pull off.

This virtual currency's value is based on nothing. The whole hacked account thing has a lot in common with some of the stock scams that occurred pre- depression. You have phony stocks which people buy into, it gets pumped, value is inflated, then dumped only to find out there was no company or the books were cooked. For all we know the guy that created silk road 2 'hacked' it himself and pocketed the bitcoins. This has more in common with a bad stock deal than a real robbery. And bitcoin has about the same real value as one of the phony stocks peddled on the market in the 1920s.

<comment><USER80> What about the USD's value is based on something other than a mental construct shared by billions of people?</comment></comment></comment></comment>


Can Russia Build A Silicon Valley? - <AUTHOR> http://techcrunch.com/2010/09/12/can-russia-build-a-silicon-valley/ <comment><USER2> Ha, not as long as they are as corrupt as they are.

</comment><comment><USER3> Good overview. I'd think one of the major problems, which Vivek lumped into the general topic 'corruption', is the Russian Mafia. Tech startups are already hard enough without having to worry about catching the attention of the mob if you succeed at making money.

Good prescriptions though, and I'd never heard of the <http://www.patentfreezone.com/> before.

<comment><USER4> The term "Russian Mafia" is just as general and shallow as "corruption". The reality is that "the mob" runs the gamut from petty thugs to sophisticated criminal corporate raiders.

The root of the issue is whether Russia's criminal tactics for corporate raiding apply to software startups. One can take over physical means of productions, but the same is close to impossible to do with software.

Arguably the most important factor stopping growth of startups in Russia is personal safety. Founders do startups to get rich. However in Russia financial success brings unwanted attention to founders. There are plenty of thugs salivating at an opportunity to go after a newly minted millionaire.

Most startup incubators in US & Europe offer help with networking, business & investment mentoring. Perhaps incubators in Russia need to help founders with personal security services.

</comment></comment><comment><USER5> I really liked the comment the author made about patents and the amount of opportunity in Russia today. One could literally grab something that has been proven to work well in the U.S. and do it there, making a lot of money in the process. Now that is the theory and I'm aware of increased risk of running business in Russia. However, it is definitely worth thinking about.

</comment><comment><USER6> No, because of [https://secure.wikimedia.org/wikipedia/en/wiki/Corruption_in...](https://secure.wikimedia.org/wikipedia/en/wiki/Corruption_in_Russia)

</comment><comment><USER7> The moral of the story: Don't spout fire and brimstone at someone unless you're prepared to back it up and give a presentation to the entire world about it at a moment's notice.</comment>


Show HN: Invitation Engine for Facebook Apps - <AUTHOR> http://graphmuse.com We spent a lot of time working on this, including the demo, and we'd love some feedback.
It might take a little bit of time to load if lots of people are trying the demo, so please try to be patient. We spent a lot of time to ensure you'll be impressed.
Feel free to email us at tony or chuck @graphmuse.com if you'd like to discuss further! <comment><USER2> I personally just don't like app invites. I don't use them, and I literally never pay attention to ones I get.

That said, the clusters are really impressive. All of my clusters were basically just groups of people from different times/events of my life (highschool people/friends, college friends, colleagues, people I knew when I lived in Syracuse, etc). It's an obvious way to separate my groups of networks, and it was fast. That's useful in so many contexts

<comment><AUTHOR> Yes, I see what you mean regarding app invites.

What if we were to identify your evangelists based on "cluster completion?" What I mean by this is that we'd look for clusters that go from being densely unregistered friend clusters to densely registered over time, and see which friend(s) were the catalyst(s).

<comment><USER2> That would definitely be interesting from a startup founder's perspective.

From a purely consumer standpoint, I would use something like this to create my FB lists, if you made that easy. It's also useful when planning events. So, while I would personally never use it to send an app invite, I would use this if I was planning a party, and wanted to quickly see who I should invite and message, etc

<comment><AUTHOR> Interesting.

We actually thought about offering this as a tool to a company like Paperless Post to speed up their process.

What do you think?

</comment></comment></comment></comment><comment><USER3> Hi Tony.

I just demoed the app and it's awesome, it basically identified all of my friends into perfect groups, with only a little confusion. Obvious groups like "people I met when I spent a summer at Brown" were 100% accurate and blew me away. High school and college also got their own clearly defined groups. Way to go, I hope other people are as interested as I am.

<comment><USER4> Worked exactly the same for me. Blown away thinking about all the cool ways to leverage this.

<comment><AUTHOR> If you'd like to brainstorm, feel free to shoot me an email at

firstname.lastname@example.com

I have some ideas that are worth developing. In fact, we were using GraphMuse originally to determine entire fraternities and sororities. We listed 3,400 Greeks at UPenn in 3 weeks.

Feel free to check out Greekdex.com

or read about it here:

[http://www.thedp.com/article/2012/02/new__directory_launched...](http://www.thedp.com/article/2012/02/new__directory_launched_for_campus_greeks)

</comment></comment></comment><comment><USER5> It's not clear to me that the main hypothesis of this engine is correct - namely, that request recipients who are closely clustered to other users are more likely to accept the request. Do you have data that supports this hypothesis?

That said - request recipient optimization works, and offering it as a service could be a successful business. I think your primary value proposition (higher CTR's on lower volume) is solid, but would like to see verification that your approach (using clustering) is valid for that use case.

<comment><AUTHOR> This is a great point, and I respect your skepticism.

At this point, we're in the process of confirming our hypothesis with case studies.

We did launch this clustering algorithm for our previous venture, Greekdex.com, in which we determined entire fraternities and sororities given just one user's friend graph. Clusters were "completed" over time as more users signed up.

That said, it's obvious that members in fraternities and sororities tell their fellow brothers and sisters about the site that they just signed up for. Therefore, it's difficult to say that our clustering algorithm resulted in more users signing up.

tldr; we're working on confirming our hypothesis with case studies.

<comment><USER5> Makes sense. In the context of auto-identifying social networks, this is very valuable - I could see glassdoor/identified/branchout finding value in this as well.

<comment><AUTHOR> Thank you. We actually considered building a recruitment platform based on clusters.

That said, we don't know much about the recruitment industry.

What are your thoughts?

</comment></comment></comment></comment><comment><USER6> Wow. You built 10 clusters, and I could have clearly given a name to each cluster.

As part of your demo, you should let me build a list based on each cluster.

<comment><AUTHOR> What do you mean by a 'list?' A Facebook list?

We might include that as a neat little tool in the near future for those interested.

What are your thoughts?

<comment><USER7> You should definitely do this.

<comment><AUTHOR> Ok, we will :)

</comment></comment></comment></comment><comment><USER8> I tried the demo and received this message:

Uncaught Error. {"errorCode": 6, "errorStr": "Internal operation failure, unable to reticulate splines!"}

<comment><AUTHOR> I'm sorry about the error, I'm wondering why you received it.

-Do you have more than a small number of Facebook friends? That might be it.

<comment><USER8> My bad... I don't have any friends in this Facebook account.

<comment><AUTHOR> Hopefully you enjoyed the "reticulating splines" error at the very least? :)

</comment></comment></comment></comment><comment><USER9> How will this be monetized? I can't imagine it being free in perpetuity if it catches on.

What about security? Passing Facebook user access tokens over http opens them up to being sniffed on the wire, which would allow anyone to impersonate a user of your app. Maybe ssl is supported, but all of the api documentation examples use http.

<comment><AUTHOR> Regarding security, good point. SSL is supported; however, we are still in the process of obtaining a secure certificate signed by a CA. Most browsers would not let the demo run SSL over AJAX so we have it temporarily disabled, but once we get a certificate, we will re-enable the SSL support for the API. At that point, one simply has to use https instead of http for API calls.

</comment></comment><comment><USER10> Another method of productizing the technology could be an automatic group generator. I'd pay 5$ to have all my friends merged into mutual groups. I have 500 friends and there's no way I'm going to create groups for all of them. But having them grouped would be nice.

<comment><AUTHOR> We've always wondered about this. We didn't think people would pay for something like that.

What about a way of creating all your G+ circles based on Facebook friend clusters as well?

<comment><USER11> Yeah, I don't think many people would pay for something like that.

Katango basically provided that service for free, but they got acquired by Google. [http://techcrunch.com/2011/11/10/google-acquires-katango- the...](http://techcrunch.com/2011/11/10/google-acquires-katango-the- automatic-friend-sorter/)

</comment></comment></comment><comment><USER12> Can you give more info on how you are clustering friends? AFAIK Facebook doesn't allow you to fetch friends of friends, so curious how you're finding overlapping connections.

<comment><AUTHOR> Of course!

Facebook provides you the user's list of friends, and each friend's list of mutual friends with the user. From there, we construct the friend graph, and then run our clustering algorithm on it.

You're right about Facebook not providing friends of friends. Supposedly they used to back in the day, but not anymore.

<comment><USER12> Makes sense, thanks! Didn't realize they provided mutual friends.

Great service, did a great job on my list of friends. I would love to use this, but having to send over user access tokens is a little scary, even over HTTPS. Have you guys considered licensing this? Would be cool as a heroku plugin...

<comment><AUTHOR> First off, thank you.

We thought about licensing it, and we'd probably feel comfortable doing so. However, the infrastructure required to run this is pretty intense and customized. We're actually pushing a patent for the infrastructure/technology behind it.

</comment></comment></comment></comment><comment><USER13> I could see this as a better way to organize my news feed. Facebook is trying to do this a bit with "Groups @ xxxx", but this has grouped people better than that.

<comment><AUTHOR> How might we incorporate GraphMuse into the news feed?

I don't quite follow.

</comment></comment><comment><USER14> Nice work using arbor.js. I've been trying to get a grasp myself on how to use it. What do you think about the ease of using the framework?

<comment><AUTHOR> We just used it for the launch page as a neat way to catch the user's attention, so I can't make any grand claim about it. Not yet.

Arbor is pretty slick, but we haven't tested it out extensively. We have our eyes on d3.js and three.js as well.</comment></comment>


The "Only" Coke Machine on the Internet (1998) - <AUTHOR> https://www.cs.cmu.edu/~coke/history_long.txt?reposted_at=2015-09-8 <comment><USER2> See also the Trojan Room Coffee Pot.

[https://en.wikipedia.org/wiki/Trojan_Room_coffee_pot](https://en.wikipedia.org/wiki/Trojan_Room_coffee_pot)

> The Trojan Room coffee pot was the inspiration for the world's first webcam. > The coffee pot was located in the corridor just outside the so-called Trojan > Room within the old Computer Laboratory of the University of Cambridge. The > webcam was created to help people working in other parts of the building > avoid pointless trips to the coffee pot by providing, on the user's desktop > computer, a live 128×128 greyscale picture of the state of the coffee > pot.[1][2]

This was from 1991.

This is briefly mentioned in the list of other machines on the Internet.

<comment><USER3> I love how many great innovations and inventions have come about by people being slightly inconvenienced.

<comment><USER4> Automatic valves on steam engines were invented by a boy whose job was to run up and down a ladder turning valves on an engine designed to pump water from mines. He attached a pole to the output of the engine to do it for him, and took a nap.

</comment></comment></comment><comment><USER5> I remember RIT having one.. That was the mid 90s and it had been around for a while..

[https://www.rit.edu/news/umag/spring2009/03_computer_soda_ma...](https://www.rit.edu/news/umag/spring2009/03_computer_soda_machine.php)

<comment><USER6> I'm a Computer Science House member -- Drink is still a staple of our organization! Where else can you get Jolt on campus?

Also we've since made an awesome web app and iOS app for dropping drinks.

<comment><USER7> I clicked this post to say that. I am a CSH alum and the Drink machine steve describes here has been around for hundreds of years, easily.

</comment></comment></comment><comment><USER8> Also [https://www.cs.cmu.edu/~coke/](https://www.cs.cmu.edu/~coke/), [https://www.cs.cmu.edu/~coke/history_short.txt](https://www.cs.cmu.edu/~coke/history_short.txt), and [https://www.cs.cmu.edu/~coke/coke.history.txt](https://www.cs.cmu.edu/~coke/coke.history.txt). It's amusing that the third one is labeled "recent history" even though it's from 1990. When you're a coke machine from the 70s you view time somewhat differently I suppose.

</comment><comment><USER9> Around the same time the University of Western Australia's computer club had an internet connected coke machine: [https://www.ucc.asn.au/services/drink.ucc](https://www.ucc.asn.au/services/drink.ucc)

<comment><USER10> The coke machine and learning the Dvorak keyboard in the UCC. Fun times.

</comment></comment><comment><USER11> uiuc's acm soda machine:

[http://www.iana.org/assignments/service-names-port- numbers/s...](http://www.iana.org/assignments/service-names-port- numbers/service-names-port-numbers.xhtml?search=6969)

<comment><USER12> Caffeine! That was the SIGBOT project for 2001 Engineering Open House - it has had a lot of extra work and upgrades since then. =)

I barely avoided having some sort of terrible lung problems after sanding off the baked on paint from the 1970's Dr. Pepper machine it once was.

<comment><USER13> Sadly, the old Dr. Pepper machine bit the dust around Spring 2010. It decided to freeze sodas more often than we liked, so we replaced it with a Coke machine in Fall 2010. It was a pain in the ass to get into Siebel, but it provided a nice capacity upgrade, and we no longer needed to do any tricks when loading to prevent the first few cans from exploding. The story I heard was that the original machine was meant for steel cans, so aluminum ones could explode when being loaded if not loaded gently.

<comment><USER12> Ah, damn. A decade long run isn't bad.

Yeah, we had to load gently, and the thermocouple probably needed to be replaced (if you were exploding cans). The coldest soda in the university though. =)

Yes - it was meant for steel cans. The mechanism at the bottom to output cans was literally an open pair of scissors driven by a giant 120V solenoid.

<comment><USER13> The only time we exploded cans was by freezing or loading incorrectly. Occasionally we had the solenoids fail to fire, but that was solved easily by sshing into the soda machine and asking it to vend again.

When I was there, the machine controlling the soda machine was a Linux box running some old Debian with a 2.4 kernel, on VIA or some non-Intel/AMD x86 processor, booting from iSCSI. Thankfully, it was upgraded when the machine was rebuilt. How much of this was around in your time there?

Nice work with it. Definitely a staple of the ACM office :)

edit: also, it survived a building move, so that's pretty awesome.

<comment><USER12> We had some random x86, running Linux, in there on a full sized motherboard. It lived in between the front face and the actual refrigeration compartment. We also had a fun little perfboard of 120V relays inside of a clear plastic case we built - the most dangerous part of the machine (which melted down at least once in the first build).

Man, memories. =)

<comment><USER14> When avuserow says "upgraded" he means we "replaced it with a not-much-newer HP desktop running Ubuntu", so it's still a random x86, running Linux, on a full-sized motherboard. It lives outside the case these days, though.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Caltech used to have a Coke machine that was Internet accessible in the late 90s, but I guess it didn't survive:

[http://www.anderbergfamily.net/ant/machines/](http://www.anderbergfamily.net/ant/machines/)

<comment><USER16> It was largely designed by Bret Victor while he was an undergraduate. It had its own operating system! You can find the documentation here: [https://web.archive.org/web/20080229205618/http://www.cs.cal...](https://web.archive.org/web/20080229205618/http://www.cs.caltech.edu/~bret/coke/)

The vending machine would occasionally be replaced so students had to create new hacks from scratch, but none of them were nearly as impressive as that one. During my undergrad, its only feature was a "random soda" button. More recently, it had a space cut out of the front panel which housed a flatscreen monitor so you could surf the web on it while eating your lunch, but nothing was hooked up to the vending machine's control system.

I guess we were more inventive before we had the modern internet.

</comment></comment><comment><USER17> Any way to find out how many machines had this capability? I don't think the universities were installing the monitoring hardware, just tapping into them. I seem to remember one on the UF campus in the early 90's.

<comment><USER18> In this case, it sounds like they _were_ installing the monitoring hardware.

> They installed micro-switches in the Coke machine to sense how many bottles > were present in each of its six columns of bottles. The switches were hooked > up to CMUA, the PDP-10 that was then the main departmental computer. A > server program was written to keep tabs on the Coke machine's state, > including how long each bottle had been in the machine.

</comment></comment><comment><USER19> cute and probably great prior art for any "Internet of things" patents that show up.

</comment><comment><USER20> One of my first memories of being on the Internet was visiting Yahoo's "Devices Connected To The Internet" category every day and checking every one of them out. In addition to the coffee pots and soda machines mentioned in the comments here, I spent a lot of time on USC's Telegarden project:

[http://www.usc.edu/dept/garden/](http://www.usc.edu/dept/garden/)

<comment><USER21> Yahoo's list was my inspiration to put The World's First Internet Connected Bat House on the Internet back in '95 (20 years? Wow!). It was a big day for me when I made Yahoo's list

The page is still online, with that '95 look but it's been many years since it's been touched.

[http://batbox.org/](http://batbox.org/)

</comment></comment><comment><USER22> This "autobiography" popped up yesterday in a thread about the general silliness of some consumer-facing IoT devices. The original comment was written by netcan and includes a great Douglas Adams quote: [https://news.ycombinator.com/item?id=10182204](https://news.ycombinator.com/item?id=10182204)

CMS' coke machine is the grandfather of today's IoT devices.

</comment><comment><USER23> I seem to recall there was a connected candy / M&M machine at CMU around that time also... anyone have the details?

<comment><USER24> Did you... did you read the article?

</comment></comment><comment><USER25> An oldie, but a goodie.</comment>


You cannot upload files to a server using mobile Safari 8.0 - <AUTHOR> http://blog.uploadcare.com/post/97884147203/you-cannot-upload-files-to-a-server-using-mobile-safari

<comment><USER2> Apple is trying to tell you that the web browser is a second class citizen compared to native.

Websites don't need to go through the App Store. No money in that for Apple. Hence, low priority.

<comment><AUTHOR> the problem is that some native apps are just wrappers for web apps and still fail miserably.

</comment></comment><comment><USER3> Confirmed on one my sites. Apple needs to give iOS Safari some serious attention, so much has been broken since 7.0 release, especially homepage web apps.

</comment><comment><USER4> Broken since Beta 4 and they still didn't manage to fix it before release. Apple is seriously asleep at the wheel on Safari iOS.</comment>


Stellar and the $10 Trillion Economy - <AUTHOR> https://medium.com/@quintendf/stellar-trust-at-the-edge-of-the-network-96b8ce293c33

<comment><USER2> > Once a week, the two partners "settle up" off network

I believe the network allows the propagation of credits through other gateways. That means the debt should be able to be settled via Bitcoin, Yap stone or other methods without doing an off chain transfer. Those real-world transfers could also be troublesome in many circumstances if they were over a certain amount of value.

<comment><AUTHOR> (OP here)

Agreed that there are lots of well designed on-network mechanisms for this as well. My point was that early Stellar uses cases will probably involve blending on-network/off-network transactions, especially in communities not (yet) comfortable with relying on bitcoin.

<comment><USER2> Assuming two people get together to make this happen is reasonable. It's also reasonable that two other people will get together and do US<\-->BTC and another two peple will do BTC<\-->BRL. That gives you the 'path' to make the remittances automatic. My point was there really doesn't need to be a cross border transfer at all - simply wait until someone builds another gateway to return the debt.

For people sending money home to Brazil, well, they don't have to know anything about Bitcoin to make this work. The network just takes care of it.

I love the postage stamp analogy! Great post man.

<comment><AUTHOR> Yeah! I'm really curious how long it will take for those "closed loops" to develop. I think cryptocurrency co's should be working as hard as possible to find them and get them online.

Thanks re: postage stamp :)</comment></comment></comment></comment>


Boycott HarperCollins - <AUTHOR> http://boycottharpercollins.com/ Thanks to isitrainingnow.com and downforeveryoneorjustme.com and other, similarly designed websites for inspiring us.
Just to be clear, we're not leading anything, just documenting what happened and making it easy for people who do participate in a HarperCollins boycott to know when it's over.
As soon as HarperCollins reconsiders its decision, we'll change the "Yes" on the front page to a "No," revise a few of the other words in bold letters, and update the text on the explanation page. That's been the point of our design from the beginning. While we don't know if HarperCollins will ever revisit its policy, we want to be prepared if it does. <comment><USER2> Does anyone know the details on this? Never knew there was such a thing as e-book library 'renting'.

<comment><USER3> My wife who's studying to be a Librarian explained to me the situation. Overdrive <http://www.overdrive.com/default.aspx> provides software to library that lets them loan out ebooks with DRM that expires after 2 weeks. Also the library can't loan the book to more than one library user at a time.

HarperCollins wasn't happy that ebooks could be loaned out infinitely and decided to add another restriction to the license it has with Overdrive. This would limit the amount of time a library can loan books to about 26 times. Which is a ridiculous amount. (I'd like to see data on how many times on average books have been loaned before needing replacement. I'd wager it's more than 26 times)

<comment><USER4> As if those artificial limitations (really? one ebook for one user?) weren't bad enough, you can't "return" books early. So if I finish the latest [insert popular novel] in a day but my lending period is 2 weeks, the next person on the waiting list won't be getting it for another 13 days because of yet another artificial limitation.

It's been pointed out by many librarians in comments to articles/blog posts about the situation that the average rate of loss/wear and tear for physical books _may_ be enough to warrant buying a new copy after 26 checkouts, but that the more suspicious thing is that 26 checkouts of an ebook for 2 weeks at a time back to back (and again, no early returns) is exactly one year.

<comment><USER2> There are already artificial limits in place with physical books. They are much more expensive if libraries buy them. You can't just make your private books available on a library basis, you'd be breaking several IP edicts (having to purchase the 'library versions')..

<comment><USER5> Really? My family's donated many books to our local library, and they didn't seem to have any issue with that.</comment></comment></comment></comment></comment>


Russian prime minister and government resign after Putin speech - <AUTHOR> https://www.msn.com/en-us/news/world/russian-prime-minister-and-government-resign-after-putin-speech/ar-BBYYS9a <comment><USER2> PSA: "government resigns" in a Parliamentary system does not mean what it sounds like it means to an American.

<comment><USER3> Okay, I'm American. What does it mean in the context of a parliamentary system?

</comment></comment><comment><AUTHOR> "Russian Prime Minister Dmitry Medvedev said on Wednesday that his government was resigning to give President Vladimir Putin room to carry out the changes he wants to make to the constitution. "

</comment><comment><USER4> Does this let Putin keep a hold on power after 2024?</comment>


Sciences, Humanities, and ... Design? The Case for a Third Pillar of Education - <AUTHOR> http://www.theatlantic.com/business/archive/2012/01/sciences-humanities-and-design-the-case-for-a-third-pillar-of-education/251717/ <comment><AUTHOR> I really hope we are moving towards a new understanding of design. The tendency of those who do not understand what design is to lump it in with "art" has been detrimental to the development of products, services, and software by those who focus too much on one aspect of the design process while ignoring others. If engineers, marketers, managers, business executives, etc. (as well as some misinformed "designers") had a better understanding of the balance of aesthetics, economics, usability, and feasibility inherent in good design, the world would be a better place.

Cross posted from this google+ thread: [https://plus.google.com/108998673146368660257/posts/VnnVUJjq...](https://plus.google.com/108998673146368660257/posts/VnnVUJjq9Dd)</comment>


Multiplication: It Ain't No Repeated Addition [2008] - <AUTHOR> https://www.maa.org/external_archive/devlin/devlin_06_08.html <comment><USER2> I have to confess I wasn't clear on what he was trying to convey without digging in a bit deeper. This blog post from a teacher in response to his post clarified things: [https://denisegaskins.com/2008/07/01/if-it-aint-repeated- add...](https://denisegaskins.com/2008/07/01/if-it-aint-repeated-addition/)

<comment><USER3> Nice to see a well mannered conversation between two people with definite opinions and a willingness to learn and explain.</comment></comment>


Deploying AWS EKS on Fargate - <AUTHOR> http://www.beta-neil.com/posts/eks-on-fargate/ <comment><AUTHOR> AWS launched EKS on Fargate at Re:Invent this year. I wrote a post that explains how to spin up an EKS cluster on AWS Fargate and why I think EKS on Fargate will be a huge benefit for companies that don't have dedicated DevOps teams but want to modernize their deployments using a tool like Kubernetes. Comments and suggestions appreciated.</comment>


Ai-class.com vs ml-class.com - <AUTHOR> http://www.investuotojas.eu/?p=690

<comment><USER2> I don't really understand why people want to see this as a "versus" relationship.

Machine learning is part of artificial intelligence.

I found both classes good, a different style, yes, but also a different focus. And of course taught by different people, not better nor worse.

They all did a great job and because of the interactivity it is a way better experience than just posting the video lectures online. The fact that the videos are short (instead of a full hour), it also helps people which don't have the time or energy to focus for a full hour.</comment>


What are the least deserving successful sites/apps? - <AUTHOR>

Some might have succeeded simply by being an early adopter of some technology.  Others might have succeeded because their users didn't know any better.
An example of what I mean:
http://en.wikipedia.org/wiki/The_Million_Dollar_Homepage
Clever perhaps, but worthy of such success? <comment><USER2> Of course the million dollar homepage is worthy of its success. Quite frankly, it's a brilliant idea.

There are very, very few things that are truly "unworthy" of success; your view of this strikes me as far too general. Just because something doesn't awe you in technical marvel doesn't mean it's not an excellent product.

<comment><AUTHOR> What about mediocre early apps in Facebook/iTunes that succeeded simply because they were early adopters with little competition?

<comment><USER3> Building faster than anyone else _is_ value.

<comment><USER4> Or more precisely, speed is a multiplier.

</comment></comment></comment></comment><comment><USER5> expert s-ex change

</comment><comment><USER6> Scribd - it could have been nice, but unfortunately i hate their Flash overkill.

</comment><comment><USER7> I'm impressed with 5 comments and no mention of Twitter

<comment><USER6> We'll i don't know about it being least deserving. I'm not a twitter user but i can see the simplicity that pulls people in. And it can be as useful as any blog, social network in general if you put it to good use and follow the right people.</comment></comment>


NYC regulators announce proposed rules for taxi apps - <AUTHOR> http://www.theverge.com/2012/10/29/3574762/nyc-taxi-app-rule-proposal-e-hail-tlc

<comment><USER2> "The proposals would require any e-hail app to obtain a one-year, renewable license from the TLC.." sounds like a tax....</comment>


Practicing Ruby manuscripts archive now on Github - <AUTHOR> https://github.com/elm-city-craftworks/practicing-ruby-manuscripts

<comment><AUTHOR> I run practicingruby.com, so if you have any questions, I'd be happy to answer them!</comment>


How to sideload apps on your iPhone using Xcode 7 - <AUTHOR> http://bouk.co/blog/sideload-iphone/

<comment><USER2> Wow, amazing development and great write up. Thanks.

"Q: Will I need to install the iOS 9 beta/OSX El Capitan? A: Nope, this will work on any iOS/OSX version."

Has something changed to make Apple feel comfortable to allow this?</comment>


Son of Stuxnet - <AUTHOR> https://firstlook.org/theintercept/2014/11/12/stuxnet/ <comment><USER2> An interesting aspect of this story that points the direction the Internet will probably take in reinforcing trust relationships:

The idea that a major government malware contracting effort was required to pop a particular Hungarian CA (presumably for deniability reasons) tells you something. The USG virtually undoubtedly controls _several_ RSA keys that can be used to sign arbitrary SSL/TLS certificates. Why didn't they just use one of those?

I assume it's because they're expensive, and every time you use them, you risk burning the CA they're associated with: the major browser and OS vendors will excise your root keys, or attach constraints to their use.

Kim Zetter, for understandable narrative reasons, uses Gmail as an example of the kind of site that a CA-hijacker could compromise. But Gmail is the dumbest possible site to target with a traceable compromised CA key, because it's key identities are pinned in Firefox and Chrome; if the key indicated over the wire disagrees with the browser binary, the browser flips out.

This is why HPKP, TACK, and similar pinning/continuity/attestation frameworks are such a good idea. Over the medium term, they allow the users of the Internet to surveil SSL/TLS keys and detect compromised CAs.

<comment><USER3> tptacek, maybe the USG as a whole controls some RSA keys, but the more interesting parts, such as NSA, wouldn't be able to get access to them without setting off some red flags. Not to mention, the USG isn't a monolith; NIST recently rejected Dual EC_DRBG. Employees at NIST publicly criticized the NSA's (alleged, but almost completely likely) decision to backdoor Dual EC_DRBG.

Like you said, for attribution purposes the NSA had to get its keys elsewhere. I'm asserting that it's not just attribution that's on their mind.

<comment><USER2> Attribution back to NSA isn't the big problem. Operations is the problem.

You can't forge certificates without associating them with some specific CA.

If you forge a certificate for a pinned site, you risk detection.

If HPKP is widely deployed, every site could have that risk.

Unless you've popped _all the CAs_ , the browser vendors can respond to detected forged certificates by curtailing the compromised CA. Meaning the NSA has to compromise another CA to continue their activities.

There aren't unlimited CAs to work with.

Stipulate that NSA doesn't care if attacks are attributed to them. Certificate surveillance is still an operational problem for them.

</comment></comment></comment><comment><USER4> A lot of tech related journalism gets (fairly) maligned. This is truly amazing writing, and I highly recommend reading the whole book, even if you know most of the story.

<comment><USER5> I wouldn't call it "amazing" writing, IMO it's silly sensationalism. Here's a particularly annoying sentence:

       There was nothing like staring down
       the barrel of a suspected cyberweapon
       to clear the fog in your mind.

Yeah, right. Staring down the barrel of a probably non-functional rusty .25 would clear my mind a lot faster than would some random Windows malware.

Which begs the question. After thousands of different Windows viruses have been identified, why is any company anywhere in the world still using that crap on any of their computers? Let alone why does a CA let Windows computers into their infrastructure?

<comment><USER6> Really? Even if the malware was nearly identical to that of a previously found malware that was presumably used by a government on government attack? But whatever, seems you are more mad at windows than any sensationalism in the article.

<comment><USER5> Yes, really. I have a very healthy respect for firearms. I've fired plenty of guns and I would never want to be looking at the wrong end of one. It would scare the shit out of me!

There is a very strict rule when dealing with firearms. You NEVER EVER point a gun at anyone else. Ever. No joking. No kidding around. You only point a gun at someone if you are prepared to imminently use it against that person. This means, literally, "life or death".

I've been handling guns for over 45 years and I've never even considered breaking that rule, nor have I seen anyone else break it. BTW one corollary to this is "there is no such thing as an accidental discharge, only a negligent discharge".

Heck, I've even "died" in paintball enough times to know that I don't like the odds.

Software, even malicious software, is OTOH "meh". Even if it's written by government hackers. It's simply not scary at all. IMO the analogy of guns to software was probably written by someone who wasn't familiar with firearms.

And you're right about my abhorrence of Windows. For close to twenty years now, everyone has sat around and said "oh no, woe is me, another virus, it's hopeless, it's terrible, I'm scared, my business is threatened, hackers are stealing my secrets". The details change, the general story is the same.

To which my response is: "the only winning move is not to play". So why do people keep using Windows?

<comment><USER7> You realize it's a metaphor and not a literal gun, right?

And surely the most popular OS will be the one most targeted by criminals no matter what it is.

<comment><USER8> I think he's just trying to point out that the metaphor isn't apt, since most malware is as effective as a "non-functional rusty .25", but nowhere near as scary.

My heart starts racing a bit when I suspect my systems might be tampered with, so I think the metaphor does apply. What would have been better if the parent provided a better, less hyperbolic metaphor.

</comment></comment></comment></comment></comment></comment><comment><USER9> >...the victim was NetLock[1], a "certificate authority" in Hungary... The logs showed that the attackers had signed into one of the command servers in Germany in November 2009, two years before Duqu was discovered.

Professionals stealing certificates since at least 2009.

[1] [https://www.netlock.hu/USEREN/](https://www.netlock.hu/USEREN/)

<comment><USER10> How is NetLock still in business/trusted then? Could they somehow prove that their keys weren't compromised?

</comment></comment><comment><USER11> "The only catch was, he couldn't tell anyone what he was doing. Bartos' company depended on the trust of customers, and if word got out that the company had been hacked, they could lose clients."

It's unfortunate that still today the attitude is "cover it up" rather than disclosure. I would hope that any company that I entrust with my data would be forthright about breaches so that I, as a customer, would have the opportunity to take whatever precautions were necessary given the details of the breach.

<comment><USER12> It's unfortunately, but also expected. Self interest and all that.

CAs' only true marketable asset is trust.

Personally, iff the CA system is something we're going to stick with, there should be substantial legal penalties for failure-to-disclose timely updates on breaches by CAs. Imagine, something that a multi-national trade agreement could actually do that would be beneficial to everyone!

</comment></comment><comment><USER13> Hmm... seems like everyone is writing books on cyber war these days. Maybe I missed the boat. In any case, pulling back the cob webs I do remember there being releases post-stuxnet that indicated there was a c&c virus first. Which is I guess what this article describes.

What the heck is this "alternate C" language stuff though? Anyone remember?

<comment><USER14> Wikipedia:Duqu suggests it may be something called "Object Oriented C (OO C)", though it's hard to tell which one exactly. See [https://www.google.com/webhp#q=object+oriented+c](https://www.google.com/webhp#q=object+oriented+c)

</comment></comment><comment><USER15> So who owned the command servers that the virus reported to? Were they innocent servers that had been hacked?</comment>


Captain Kirk Was a Lousy Tech Manager - <AUTHOR> http://philosophymademanifest.blogspot.com/2010/10/captain-kirk-was-lousy-tech-manager.html

<comment><USER2> OP is right about tech/development managers needing to respect estimates but wrong about Captain Kirk.

Captain Kirk pushed Scotty because Scotty was an extraordinary man capable of doing much more than he admitted, if the matter was urgent. Kirk pushed Scotty when he felt that it mattered to the safety of the crew or to others whom they were protecting. Sense of urgency is important both in getting customers to buy and in helping boost team morale, as long as it is used in moderation.

Few ever doubted Kirk as the leader of the ship, and I think even Scotty was entertained by and admired his tactics and style.</comment>


Silicon nanotube lithium-ion battery stores 10x more power, lasts 6000 charges - <AUTHOR> http://www.extremetech.com/computing/129299-silicon-nanotube-lithium-ion-battery-stores-10-times-more-power-lasts-6000-charges <comment><USER2> This isn't the first time that I've read some amazing claim about dramatically improving the efficiency of batteries. Heck, I'm sure it's not even the tenth time. But we're still yet to see any amazing advances.

These kind of things make it sound like we can catapult the technology by a factor of ten, but the truth is that we will most likely just end up pigeon stepping our way forward slowly.

Don't get me wrong, because this is still very exciting, but just ask yourself the question... is this the first time you have read an article about improved battery efficiency that has been developed by researchers?

</comment><comment><USER3> Sensationalistic title: The article says the increase is only 2x, but they _believe_ they can get it up to 10x eventually somehow _maybe_.

<comment><USER4> My reading is that it's sensationalistic in that they haven't actually built a 10x battery, only an anode that can power it.

It does seem, however, that the 10x number is accurate (in fact, I don't see any 2x notes anywhere in the article).

 _almost every lithium-ion battery uses a graphite (carbon) anode, which has a specific capacity of 400 mAh per gram. ... Yi Cui's team, however, has successfully built a double-walled silicon nanotube anode that has a capacity of around 4,000 mAh per gram._

<comment><USER3> It says:

> The next step is to simplify the production of these nanotubes [...] and > then to build an actual battery with double the energy density of current > lithium-ion batteries. This might seem like a humble goal after saying that > silicon anodes can increase power density by 10 times, but as we mentioned, > the electrolyte and cathode are also important.

</comment></comment></comment><comment><USER5> I've only got one thing to say: Now we're talking!

<comment><USER6> We'll talk after we see these in production. With affordable prices.</comment></comment>


3% decline in tech spending forecast for '09 - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2009/01/13/BUSC159HNB.DTL

<comment><AUTHOR> Obviously, tech spending declines in a recession. What I thought was interesting was the discussion of all the variables that go into these predictions -- so many that I can understand why these predictions are often so far off.

Strength of the dollar, energy prices, Obama's stimulus package... Though my gut-instinct feelings on the first 2 are not particularly good, who really knows? And, of course, the biggest variable and most unknown is how people will "feel" about the economy in a year.</comment>


Ask HN: Should cannabis start to be considered for Covid-19 treatment? - at-fates-hands It's only anecdotal evidence, but I have two friends who are both immune system compromised, both are nurses who work at different hospitals, both who have been diagnosed with COVID19.
Both have experienced similar symptoms. Basically drowning in fluid, extreme shortness of breathe, horrendous body aches, and not being able to sleep.
The interesting part is both started taking pretty potent edibles to see if they could help. Both have taken cannabis in some form for other ailments in the past. Surprisingly, both said at about 180-225mg of THC, it dried out their sinuses, relieved their body aches, and allowed them to breathe well enough to be able to climb stairs, mitigated their coughing fits and allowed them to sleep through the night.
Both are still surviving, neither have been admitted to the hospital and both said they will stay quarantined until they get better. They're 18 days in, and are slowly coming out of this. I should also mention this is in a state where medical cannabis is legal, recreational use is not. Obviously because of their nursing license it's impossible to get approved for a medical cannabis card.
My question is, should the medical community start to more closely examine cannabis as a way to lessen the symptoms of COVID19? <comment><AUTHOR> High doses of CBD maybe?

One strain example that has helped lots of people: [https://en.wikipedia.org/wiki/Charlotte's_web_(cannabis)](https://en.wikipedia.org/wiki/Charlotte's_web_\(cannabis\))</comment>


Shortcuts for Waze 2.0 – create custom navigation shortcuts [Android App] - <AUTHOR> https://play.google.com/store/apps/details?id=com.uxiomatic.shortcutsforwaze&referrer=utm_source%3Dhn <comment><AUTHOR> Waze does not provide a built-in way to add shortcuts to places. So I wrote this app to provide them.</comment>


Ask HN: Legal Issues With Domain Name? - <AUTHOR>

I was reading the story earlier about the guy who received a C&D from eBay (http://news.ycombinator.com/item?id=1727747), and it got me thinking about a domain I was planning to use for a site I'm (slowly, painfully slowly) building.
I came up with the name while I was listening to a Beatles song, and the song title jumped out at me as being perfect for my site. Well, not the exact song title, of course, but definitely inspired by it.
Now, the site has nothing to do with the Beatles, nor music in general, so I don't think it's a problem, but I don't know enough about the law to determine if this sort of "inspired by / play on the name" sort of name could get me in trouble.
I haven't registered the name yet, mostly because financially I can't throw money at something I may not finish (soon), so I'd prefer not to give the name here.
As an example, let's pretend I'm making a site for apartment hunters, called HelterShelter.com. Would that get me into trouble? This might not be the best example since a normal person would probably make that association, but I don't think they necessarily would with my idea.
I'm in Canada, in case that makes a difference.
Thanks. <comment><USER2> I can't give you advice on the legal aspect of it. But, it pains me that you haven't registered the domain name.

I can't speak to your financial situation, but it's $9/year to register a domain. There's a chance your name will get registered while you wait. If your name got registered by someone else, would you just shrug it off, or would it really bother you? If the latter, just get it now.

<comment><AUTHOR> It sort of bothers me too that I don't own the name, but I've started so many projects that were never completed, and money is so tight right now that I just can't justify it to myself.

That said, I've been seriously considering buying it just as a motivator - i.e. well, I own the name, I guess I'd better not let it go to waste. Now, even that doesn't seem like a good idea, since I'm worried I can't use the name anyway due to the issues I'm asking about in this post.

 _If your name got registered by someone else, would you just shrug it off, or would it really bother you?_

I would shrug it off, mostly. I mean, I've been living with this name for three months (the carpal tunnel started not long after coming up with the idea, hence its incomplete status), so it would be an adjustment, but I'm not married to the name by any means. I just happen to think it's clever.

I don't think I'll lose it though. The name wasn't registered three months ago, it's not registered now, and I can't find any record of it ever having been registered in the past. It seems incredibly unlikely that it would disappear now.

If I get the "all clear" from other responders to this post, I'll buy it. Point taken.

<comment><USER3> If you have been living with the name for three months then go ahead and buy it. I have missed a couple of really nice domain names in the past by reasoning that they were too obscure for someone else to register.

Namecheap.com currently has a deal for new .com registrations for $5.99 using the coupon code SAVEBIG - that should save you a few bucks if you do decide to register the name.

<comment><AUTHOR> _Namecheap.com currently has a deal for new .com registrations for $5.99 using the coupon code SAVEBIG - that should save you a few bucks if you do decide to register the name._

I'm already too late:

> Sorry, the coupon code you entered 'SAVEBIG' is not valid or has expired or > has exceeded usage count. Please verify the code and try again.

</comment></comment></comment></comment><comment><USER4> You are safe. Although I'm not a lawyer, it's very well established that titles and short phrases are not copyrightable. They can be trademarked, but (except in the case of album titles, perhaps) that would be very hard to argue in regard to a song title.

<http://www.copyright.gov/help/faq/faq-protect.html>

<comment><USER5> There are plenty of examples that seem to support this, such as <http://www.heyjude.com/> and <http://glassonion.com></comment></comment>


Cool Open Source Games you should contribute to - <AUTHOR> http://shinnok.com/rants/2011/07/18/cool-open-source-games-you-should-contribute-to/

<comment><USER2> Several games I hadn't heard of before are in this list, some rather interesting.

However, it is a bit disheartening to see so many games that are ported engines for old commercial games, or improved clones of the same, rather than new, creative ideas. I suppose it's easier to build a game that's "like SimCity, but better" than to design and create something completely new.

</comment><comment><AUTHOR> Just in case someone is interested, here's the reddit post on this:

[http://www.reddit.com/r/programming/comments/it8ax/cool_open...](http://www.reddit.com/r/programming/comments/it8ax/cool_open_source_games_you_should_contribute_to/)

A lot more debate has taken place there.

</comment><comment><USER3> tl;dr: Doom clones, RTS' and games with penguins in them.

Too bad this game wasn't mentioned, it has cute graphics, interesting gameplay, and no penguins: <http://joyridelabs.de/game/></comment>