Netflix is $20B in debt. Can it keep borrowing its way to success? - <AUTHOR> http://www.latimes.com/business/hollywood/la-fi-ct-netflix-debt-spending-20170729-story.html <comment><USER4> Very misleading article - per the company's latest 10-Q, they only have $4.8 billion in debt. On a net leverage basis, they are currently around 3.2x net debt / EBITDA which is down the fairway for most high yield public companies.

The remainder of their "debt" as the article lays it out is in Streaming Content Obligations and is not debt as you and I would think about it. Yes, it is contractually committed; however, unlike debt, they likely can default on their obligations and the only recourse would be a lawsuit for either damages or specific performance. (There is also no interest payment - as interest expense on $15.7 billion would be significant relative to their current debt burden.)

Compared to true debt instruments, which carry covenants that allow the debtholders to push the company into bankruptcy, the streaming content obligations very likely do not have any such ability to do so. (From what I can tell, the cross-default clauses in their debt instruments do not trigger in the event that they do not fulfill their streaming content obligations.)

<comment><USER5> Do the streaming content obligations explicitly say that the "creditor" can't initiate bankrupt proceedings or something? This seems strange.

</comment></comment><comment><USER6> I wonder where the $20B figure came from, Google finance says that they only have about $3 billion in debt. [https://www.google.com/finance?q=NASDAQ%3ANFLX&fstype=ii&ei=...](https://www.google.com/finance?q=NASDAQ%3ANFLX&fstype=ii&ei=r_R- WciXGo6LUtqujcAD) $3B looks sustainable given their net annual income of $200 million but $20B does not - Especially with interest rates going up again.

Whenever I read about a software company needing that kind of money though, I often wonder why... Especially when I also hear stories about companies like Whatsapp and Instagram being able to scale their businesses to hundreds of millions of users using very small engineering teams and advertising budgets.

I've had a recurring thoughts that maybe big tech companies are conspiring together to hire as many software engineers as possible to make sure that those engineers don't have any time to build competing products. Software engineering talent is thus an artificially created scarcity. If that's the case then I don't think that is sustainable.

<comment><USER7> If they have some 100M+ subscribers, wouldn't their net income be at least 600M * 12 = 7.2B? Given around $6 per subscriber per month?

<comment><USER8> That would be gross income, net income is income after all costs have been deducted. That would indicate that their annual costs are ~$7B, most of which probably goes towards producing new shows and licensing existing ones.

<comment><USER9> Actually, 7.2 Billion is the revenue.

Gross Income is Revenue minus Direct Costs, while Net income is Revenue minus All Costs

</comment></comment></comment></comment><comment><USER10> Having debt is not a big deal, it's not so different from having investors.

Investor gives you money for guaranteed say in your business strategy. He may get some interest on his investment or not, no guarantee.

Banker gives debt for guaranteed interest and may get something to say in your company but usually not.

<comment><USER11> Having debt is structurally completely different from having (equity) investors. The entire financial incentive, risk, and payout structure behind taking on debt is unlike that of selling off equity. In this case, Netflix is _much worse off_ having taken on large amounts of debt. I hope this response isn't too brusque, but I strongly suggest you read an introductory finance textbook.

<comment><USER12> Could you summarize what makes debt worse than having investors?

I'm curious, it seems counterintuitive, with debt you don't have to give up a part of your company or lose any control.

<comment><USER13> Debt usually comes with strict repayment schedule. If you don't have enough cash flow to meet the repayment schedule you go into default. The debt holders force you into bankruptcy. You lose the entire company.

<comment><USER10> Well, does a creditor have to push you into bankruptcy? They seldomly do, because then they can't squeeze more money or control out of you.

And at the same time an investor could also push you into bankruptcy by suggesting, supporting or blocking certain decisions.

It's like knight and bishop in chess. True, they work differently, but they are all just pieces on the same board, used in the same game to achieve the same goal.

</comment></comment></comment></comment></comment><comment><USER14> If Musk can keep living on credit based on 'his company status', i am quite sure that netflix will be able too.

Though god knows where that 20 billion debt in the article actually comes from...

<comment><USER15> Tesla's line of credit isn't due to "status" it's due to past performance.

They have consistently doubled sales and production every 18 months or so since they began selling cars, and have orders on the books showing at least as much growth for the next several years.

What "status" do you think Tesla has that makes them a target for creditors? You think Deutsche Bank just thinks Elon Musk is cool and hip?

<comment><USER14> Performance/status is more then just black numbers down at the end of the balance.

The status of super popular by huge volumes of people. So in essence yes because he is so cool, hip, and also because he creates/thinks of things that appeal to the mass, and people cannot stop talking about it on birthday parties and events alike.

disclaimer, i drive a 20 yo toyota and own nothing of tesla.

</comment></comment></comment><comment><USER16> So, assuming Netflix goes belly up at some point, I am MUCH happier they spent $20B making shed-loads of new content (i.e. paying out to creative and production people) that will live on than e.g. putting it in a pile and burning it like the Facebook / Whatsapp $16B "valuation". That value just disappears IMHO.

</comment><comment><USER17> Off topic. Was browsing on mobile Firefox. I've revoked permissions to access the camera. This site asked for permissions to access it. Not entirely sure why but it might be useful for others to know

<comment><USER18> I didn't get this, but the site is pulling tons of ads from all kinds of places, so god knows where that was coming from. Enable tracking protection or use uBlock Origin.

Did you mean you revoked and it still asked, or it asked, and you revoked?

</comment></comment><comment><USER19> $20B looks so innocent, but that is a staggering amount of money. From merely grazing NH, I feel like Netflix seems to "Secure 2 billion investment" every couple of months.

I had the impression the company was essentially working as a street sweeper with a 20 million pound credit card limit.

These documents [https://ir.netflix.com/results.cfm](https://ir.netflix.com/results.cfm) show it is picking up 2.5 billion a quarter.

I am pretty speechless.

<comment><USER20> They're trying to fill the vacuum left by shows they once licensed cheaply and easily. It's all fanning out to other services on better terms. If they don't do this, their library keeps shrinking and dropping in quality.

Enough people like Netflix's originals to keep them from losing paying customers as licensed content flees, so it seems like a wise investment.

</comment></comment><comment><USER21> Success is independent of the quality of the product, but if the quality of the product is any indication, I'd say it's unlikely. After being a Netflix subscriber for over a decade, I finally pulled the plug. Their "original" series include some great shows but also include a lot of crap. Almost everything else is garbage. They got rid of the star rating system which was the only thing sort of making discovery of the few non-garbage items possible. Even when they had the star rating system, you couldn't sort by stars because they didn't want you to see all the garbage in the system. They cannot produce or license, it seems, new shows fast enough to justify the $10 or so a month anymore. Licenses expire and good content goes away. The list of problems is almost never ending and instead of improving the platform, they're making it worse. Even "House of Cards" was rather disappointing this season. I don't see them turning this around with one or two good shows every year.

<comment><USER22> I will admit I found it hard not to read this comment and wonder about your sense of entitlement in the face of the vastly privileged situation we live in now in terms of media consumption. You pay _$10 per month_ to watch high quality TV from the last few decades as much as you want, whenever you want (and, goodness me, if you have children, Netflix is an absolute godsend - <USER2> up _Paw Patrol_ and off you go...); to watch a large and moderately decent selection of films, often including relatively new releases, whenever you want, as many as you want; and as if that weren't enough, they even produce their own content, some of which is actually good.

I remember when, if you wanted to watch a film, you would drive to Blockbuster and rent it, and you had a couple of nights to watch it or the fees would start racking up - and their selection was never all that great, and the availability was limited to how many DVDs or videos they physically had. If you wanted to watch a TV series, you'd buy the boxset - and before DVDs, _Friends_ took up about four feet of your bookshelf.

Sure, I've seen a bit of a movement lately from Netflix to Amazon Prime, but seriously, what we have right now in 2017 is so miraculously much better than what we had ten years ago (when I had a LoveFilm account and had to rely on films being sent through _the post_ \- which seems oddly even more antiquated now than Blockbuster does, frankly), that to describe it as "crap" and "garbage" just seems crazy to me.

<comment><USER23> This is typical HN:

Nothing can please me because I am intelligent advanced than the rest of the crowd.

Instead acting like whiny baby. The suggestion that Netflix get rid of scale rating is pure conspiracy, without any evidence to back it up.

Reminders:

1\. Youtube Red: 10 dollars

2\. HBO Now: 15 dollars

3\. Amazon Prime: 9 dollars

4\. Youtube TV: 35 dollars

5\. Watch a movie: 10 dollars on average.

Maybe the OP is suggesting piracy? That is the only way I could bring out of my mind for cheaper price for any (relatively) well produced content.

<comment><USER24> Piracy is not a bad deal actually - currently if I want all the movies and music I'd have to sign up for multiple streaming services, totalling about 50$ a month. And even then, there's no guarantee I will actually get _all_ the music and movies I want - there's always that one artist/producer that doesn't want their stuff on streaming services for some awful reason. Not to mention region locking, etc.

I can't see myself giving up piracy just yet, but I would love it if streaming services cut the crap and improve their service.

<comment><USER25> So if Netflix increased their library, cut their prices and subsequently increased their debt even more you'd consider them?

<comment><USER24> If Netflix could provide all my movie watching needs then yes I'll consider them. As a consumer I couldn't care less about their debt, I just want a solution that allows me watch movies without stealing them, but until then I'll happily steal - it's a problem this industry created for themselves so it's up to them to fix it.

<comment><USER26> Crappy service doesn't give a license to steal. While the entertainment industry has done a lot of harm like all the DRMs etc. the ethical way is to boycott and not steal. For ex. if you believe in free software use GNU software - don't steal closed source software.

<comment><USER24> Stealing might not have been the right word here. Stealing means you take something away from someone and that someone no longer has the thing you took. In this case however I'm not taking anything away, I am merely denying them of revenue they wouldn't have had in the first place because I am not going to pay 50$/month for streaming services.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> I have an odd thought - Netflix is going about its new commissioning process all wrong. lokking at Netflix from the POV of "innovators dilemma" they are the low end upstart coming to steal the studio / broadcasters lunch

But having the broadcasters lunch on its lips it is now trying to copy the studios at their own game - creating high quality must watch content.

I think that's the wrong game.

One of my favourite discoveries on Netflix was "chaos on the bridge" where Shatner narrated a documentary on the first few years of Star Trek NG. It was fun, had almost zero cost apart from some talking heads and the researcher time.

A similar one on Atari, and the rise of Compaq all made me think that documentaries would be the new magazines - something for everyone's interest and dirt cheap to make - and with not much skill will eat up 50 mins of my time as easily as a GoT episode

Just wondering if they are not getting above themselves?

</comment><comment><USER28> Because of progress of technology, in a few years everybody (with a few millions to spare) can start a film-streaming business. And then there are the big guys such as Amazon and Google.

<comment><USER29> But do you expect end users to pay for a dozen streaming subscription every month?

<comment><USER30> This is what I find so heartbreaking with the surge of news site paywalls. I'm all for paying journalists and understand the need for quality articles, but lately I've seen subscriptions on the order of $40/month for a single tech site! Good luck getting a nuanced, broad worldview covering all your interests with that. :( I can't spend $100+/month for a few news sites that aren't even distributed in print. The only way out of this for me is to simply keep using the free news sites.

<comment><USER31> I'm also depressed by this reality :/

</comment></comment></comment></comment><comment><USER32> A product like Netflix cannot actually monopolise its marketplace because at the end of the day, they are selling a very well understood, easily replicated goods - namely content. Unless we went back to the big studio era when talent was locked up with multi year contracts, nothing can stop a Hulu from poaching a great show runner from NFLX.

Under such a scenario, I don't quite see why N belongs with the other big kids of F-A-A-N-G.

Its long term success is suspect to me, debt or not.

<comment><USER33> "they are selling a very well understood, easily replicated goods - <USER3> content"

No, they're not. They're selling a service that allows you to rent content and have it stream to you instantly. The content library is what attracts people, of course, but their core business is selling the service.

"Unless we went back to the big studio era when talent was locked up with multi year contracts"

Erm, they already produce Netflix Originals, which are exclusively locked up on there (and their competitors all do the same thing). How does that differ from your suggestion?

"nothing can stop a Hulu from poaching a great show runner from NFLX"

...and nothing can stop Netflix from getting the licence to a show that used to be on Hulu. Also nothing to stop them both licencing the same show at the same time.

"Its long term success is suspect to me, debt or not."

Just Netflix, or do you also think that Hulu, Mubi, Filmstruck, etc. are all doomed as well? (I left Amazon out because obviously Prime streaming obviously isn't their core market) If just Netflix, what differs in your view that makes them more vulnerable to their competition?

<comment><USER32> Apart from your point about Netflix selling access to content rather than content itself (which I'll get to), I feel you are making exactly the same point as I am without your realizing it.

Netflix is trafficking in a commodity over which it cannot have monopolistic control. Take, for example, your own instance - licensing shows which used to be on Hulu.

Producing originals isn't something only NFLX has the expertise to do. AMC was home to some of the best shows of this century. No monopoly for NFLX there.

For NFLX to be spoken of at the same level as FB, Goog, and Amazon, I'd have thought they had an insurmountable moat - Social in the case of FB, search relevance for GOOG, and 2-day fulfillment for AMZN. When I don't see a monopoly, I start to wonder why NFLX is so loved by Wall Street and not treated as a commodity like any other content channel is.

I suspect NFLX will end up being just another dividend paying stock like a utility. That's not a failure at all but it isn't ever going to justify being gushed about along with the other companies in FAANG.

Back to your point about a service which lets me rent content - that would be true if they were truly a content aggregator which lets anyone including Hulu serve content to renters and kept a haircut for themselves. Amazon's Marketplace is a great example of service which is designed purely to act as a platform for 1st and 3rd party vendors. Obviously, right now, NFLX isn't interested in this.

<comment><USER33> No, Netflix are interested in providing a streaming service where you rent movies instantly from their catalogue for a fixed monthly fee. Nothing you said changes this.

You also didn't answer my point - if Netflix's model is doomed, why only them? You seem to avoid the idea that the entire sector runs on the same models, so what is Netflix not doing to protect themselves that Hulu, etc. are doing?

I can't speak for Wall Street as I really don't care about that side of things. You do seem to have a massive crush for them over their competitors, though, I'm just curious why that is.

"Netflix is trafficking in a commodity over which it cannot have monopolistic control"

So are a lot of businesses, online and offline. Especially service providers that run using someone else's content/platform. So what?

<comment><USER32> > Why only them?

I did initially question their path to success but I later made it clear that I saw them becoming dividend paying, slow moving utility type companies. I said that same thing in multiple ways in my reply to you.

The competitors like HBO or Hulu are privately held and are therefore less susceptible to market sentiment turning against them.

(Also, I may be wrong about this but your tone sound antagonistic to me. Please don't impute motives like "crush for them over their competitors." Not only do I not know what you mean by it, I really don't feel like engaging with anyone who talks like this.)

</comment></comment></comment></comment></comment><comment><USER34> Netflix can do whatever they want. They are growing at such a crazy rate, they will Amazon their way to a profitable company (burn billions to make billions)

</comment><comment><USER35> You can look at their latest balance sheet and you can tell all their liabilities don't add up to 20 billion. Long Term debt is 4.3billion.

</comment><comment><USER36> Does anyone know about Netflix's publishing of its own content outside of US ? The trick for me is that at least this could be available to everyone..but for some reason it was not so when I was looking at netflix few months ago.

<comment><USER37> Part of it is that a lot of Netflix's "original" content is actually just Netflix acting as the US distributor for stuff someone else has produced- other countries may get distributed through other platforms.

<comment> vertex-four The same happens the other way round elsewhere. For example, Orphan Black is a BBC America production, but is a Netflix Original in the UK and Ireland. There's a bunch of anime that is branded a Netflix Original too, which just feels weird.

<comment><USER38> huh... and it is on Amazon in the US

<comment> vertex-four We've been getting episodes from season 5 every Tuesday - I assume you only have up to season 4 there.

<comment><USER38> yeah, looks like it (I don't have prime)

</comment></comment></comment></comment></comment></comment><comment><USER39> "$20B in debt" is not the same as "carrying $20 billion in debt." Those are very different business traits!

</comment><comment><USER40> maybe it's just me but I really hate being tracked by what TV shows and movies I watch.

I also hate the suggestions and that I can't edit them and ban them. I don't know why it bothers me less on the computer with say YouTube. possibly because I can open YouTube links in an incognito window when I don't want it to be part of my profile.

Let's say some show that stars some actor I detest for whatever reason , or some show I detest because of what it's preaching. It will be the first thing I see on my large TV every time I turn it on.

Imagine if every time you turned on your TV you were present with a picture of your ex with whom you had a bad breakup and no way to take it off the TV except to wait for Netflix to stop recommending it. I get that type feeling from almost no where else.

Needless to say I canceled my account.

<comment><USER40> I see this was downvoted, not clear why.

Let me point out that a video store telling someone what videos you rented was outlawed

[https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act](https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act)

In other words, I'm not the only person who thinks others shouldn't be able to know your video watching history.

I'd personally like to see it outlawed that sharing a profile of your video watching history also be outlawed. In other words, while the law above is about the actual movies I don't want Netflix (or any other company) to be able to share even the type of movie. It's one thing for Netflix to use that data to recommend movies. It's another for Netflix to be able to sell a profile of me (likes action movies) or likes (likes sexploitation movies) or (likes movies with LGBT themes).

That last one I think really makes the point clear. Netflix should not be able to out you to other companies and that means it should be illegal for them to share your profile even if it doesn't include your actual watching history.

I'd argue the same should be true for Google. They should probably be allowed to profile you and then let advertises say "I would like to target my ads to people who fit profiles X, Y, and Z" but Google should not be allowed to share that profile outside of Google.

</comment></comment><comment><USER41> Im sure most of the $9 a month I used to spend went to paying for licensed content but I watched probably 80% original content. I left because of DRM. I don't know if it would be a money making venture for them but, for $5 a month, I would subscribe to a Netflix Original content only, DRM free service if they offered it. Seems like it'd be easy for them to do a trial run of such a thing.

<comment><USER33> You won't get DRM free, because Netflix don't sell you the content, they rent it. Or, more specifically, they sell you access to the platform to stream the rented content.

I'm all for DRM-free purchases, but you're never going to get DRM-free rentals.

<comment><USER41> Their stuff, and everyone elses, is easily available for download, DRM free, without a fee of any kind. DRM has never stopped that. Netflix knows that. I have no doubt DRM is required for every contract they have with other studios, but they could show they're not fools by allowing me to stream their original content without having to allow closed, proprietary binaries to run on my machine to do it. I have no interest in maintaining terabytes of video and manually managing distribution to multiple device. I don't think many people would. I'd rather pay the $5 a month. I won't enable DRM in my browser, ever.</comment></comment></comment>


'Jackpotting' Attacks Hit U.S. ATMs - <AUTHOR> https://krebsonsecurity.com/2018/01/first-jackpotting-attacks-hit-u-s-atms/ <comment><USER3> I worked for Diebold on their ATM's for a while.

I was surprised to learn that they run full Windows. In fact, one of the projects I was on had a requirement that we upgrade the OS from XP to Windows 7 for security reasons.

Regardless though, you can make an ATM do whatever you want if you have enough time and access to it. One of our low level debugging tools allowed you to effectively control every aspect of the device, so it could spit out whatever denominations you liked without talking to the banks mainframe.

We used to have fun printing out ATM receipts showing our fake balances of millions of dollars etc.

<comment><USER4> A full version of Windows or Windows Embedded ("Windows IoT")?

<comment><USER3> Full version of Windows.

And want to know something else? The UI layer was html + javascript and some funky css that ran on a custom modified version of ie6.

Beneath that, to handle fetching of data, comms, navigation, window management and other business logic etc, we used good old .Net and C#.

It was a bizarre setup from a dev perspective but once you got used to it you could crank out new features incredibly quickly as you had a heavily regimented workflow (Usability trumps _everything_ with these machines).

If you open up an ATM you will find your standard run of the mill beige PC inside it and in fact in many of the older machines they _literally_ stuff an _entire_ PC case in there simply laid on it's side.

There is also an extra monitor back there with a little keyboard attached.

The only impressive aspect of ATM's is the engineering that goes into all of the supporting hardware and peripherals such as the stackers, the cash acceptors, the cheque validators, the printers, the recycling cash canisters, the electronic pin pads, the various fraud detection features etc. I found that stuff much more interesting than the dev work I did day to day.

</comment></comment></comment><comment><USER5> If you, like me, were wondering what the Secret Service (widely recognized for their duties as presidential bodyguards) has to do with ATM fraud, there's a comment below the article from the author:

> I didn't mention it in the story, but perhaps I should have: The original > mission of the Secret Service when it was created in the 1800s was to > safeguard the U.S. currency from counterfeiters. Only after a few presidents > were assassinated did their mission grow to include protection of the > president and other dignitaries. Both are their dual roles today.

[https://www.secretservice.gov/about/history/events/](https://www.secretservice.gov/about/history/events/)

<comment><USER6> If you deposit more than 10k in cash, a bank is obligated to inform the Secret Service's money laundering division per the PATRIOT Act. Secret Service has jurisdiction in a few places you wouldn't expect.

<comment><USER7> FinCEN is part of the Department of the Treasury, not the Secret Service (which has been a part of the Department of Homeland Security since 2003).

</comment></comment></comment><comment><USER8> If you ever open up an ATM you'll realise that the majority of things are controlled by serial interfaces (upto 6 of them) for all the motors and pneumatic hardware. If the operating system becomes hardened enough, you'll eventually have people interface with the serial ports directly to manipulate the cash-drawers directly.

I'm not sure why this hasn't really been done in practice but it shouldn't be to difficult to figure out how to do correctly.

In most ATM's the computer hardware and interface connectors are also all housed in the top (mostly plastic or low-quality cast metal) shrouds (as opposed to the currency locked in a safe). Traditionally wafer locks were also used to secure this section however they are slowly migrating to higher security locks like Abloys.

ATM manufacturers may want to take a look at slot machine manufacturers for clues on how to harden machines against tampering.

<comment><USER9> Somehow I'm not surprised that hardening is a higher priority for slot machines than for ATMs...

<comment><USER10> I've read (though have no first hand experience) that slot machines have better security and better vetting than electronic voting machines do so I'm not surprised either.

<comment><USER11> In Nevada the source code for gaming devices is required to be provided to the state gaming commission.

 _(c) In the case of a gaming device, a copy of all executable software, including data and graphic information, and a copy of all source code for programs that cannot be reasonably demonstrated to have any use other than in a gaming device, submitted on electronically readable, unalterable media;_

[http://gaming.nv.gov/modules/showdocument.aspx?documentid=29...](http://gaming.nv.gov/modules/showdocument.aspx?documentid=2921)

<comment><USER9> But _only_ for "programs that cannot be reasonably demonstrated to have any use other than in a gaming device".

Makes one imagine what kind of political trench wars probably went on behind the scenes about this regulation.

Edit: On second thought, this seems awfully easy to circumvent. What stops me from making a rigged PRNG and then refusing to make the source code available on the grounds that there are lots of non-gambling applications for PRNGs?

<comment><USER12> The gaming commission also regulates how much each machine must pay out over a given period with a given take. Any machine not in compliance is removed, and the casino can be fined. Continued non-compliance can result in the termination of the casino gaming license.

This was true even before electronic slot machines.

<comment><USER9> Sounds better but still defeatable. I could track individual players throughout the casino (which is already common practice, I think) and decide on payout depending on how much money I already made through them.

E.g., if someone already dumped a lot of money into other games, I can give them above-average odds of winning and be sure I still make a profit (and they make a loss), otherwise I'll give them below-average odds.

If I tune this right, the average outcome over all players will still look "fair".

Or I simply give the above-average play sessions to strawmen.

<comment><USER13> Except that that is not allowed. It's individual machines tested in isolation that should perform _exactly_ as legally mandated. The only kind of remote interaction there is is logging to make sure they can prove that the machine performed as advertised and to know when to empty the coin box.

<comment><USER14> Modern slot machines don't use just local rngs, they essentially obtain lottery tickets from a central computer. That's how you get building-wide jackpots.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> The details:

The attackers typically use an endoscope so they can attach a cord to the computer and install malware. This makes ATM remotely controllable!

In previous Ploutus.D attacks, the ATM continuously dispensed at a rate of 40 bills every 23 seconds. Once the dispense cycle starts, the only way to stop it is to press cancel on the keypad. Otherwise, the machine is completely emptied of cash.

Jackpotting it is.

</comment><comment><USER16> Embedded software is easy to hack. Spend quite a bit of money getting access to the binary running a common ATM platform. Reverse engineer it. Find a vulnerability. Trigger it. Done!

The age of (common) embedded system exploitation is finally upon us.

<comment><USER17> The "hack" in question involves replacing the hard drive.

This isn't an embedded issue. This is a physical access to OS issue.

<comment><USER18> It doesn't help that almost all the fascia locks on each vendor's machines are a standard key. With that standard key, you have full access to the computer or embedded device drive.

Nowadays the communication link to the dispenser is encrypted, making swapping the hard drive useless. The real problem is the machines aren't replaced very often so there are quite a few old models out in the field that are susceptible to these sort of attacks.

<comment><USER19> > It doesn't help that almost all the fascia locks on each vendor's machines > are a standard key.

Interesting. Is there a source for this?

<comment><USER20> There is a defcon talk about jackpotting ATMs.

</comment></comment></comment></comment></comment><comment><USER21> Wow, I always thought the ATM scene from Terminator 2 seemed unrealistic, but now people are literally doing that:

[https://www.youtube.com/watch?v=3cfQKxUffqA](https://www.youtube.com/watch?v=3cfQKxUffqA)

<comment><USER22> How does it work with posting short scenes from a movie on YT, and possibly monetising? Is it just a case of the Studio not reacting or there's a grey area where you're able to do it?

<comment><USER23> The studio (content-owner) is who receives the proceeds of monetization, even if they didn't upload the video themselves.

</comment></comment></comment><comment><USER24> >"The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack."

I had no idea ATMs ran Windows!

<comment><USER25> You'd be surprised how many things are running Windows. I always wonder if the manufacturer just hires cheap contractors that haven't seen anything apart from Windows in their entire life, or if there is an actual reason it can't run on linux.

<comment><USER26> OpenBSD would be perfect for the job, wouldn't it?

<comment><USER27> An OpenBSD machine still running unpatched from the XP era would be every bit as vulnerable.

<comment><USER28> Yes and no. OpenBSD always had far fewer exploitable bugs than Windows, so it presents a smaller attack surface. And far fewer people bothered to develop exploits. Windows has always been the big juicy target, with exploits easily available.

But on the other hand, it only takes one.

</comment></comment></comment></comment></comment><comment><USER29> The Reuters article is very low on detail. [https://krebsonsecurity.com](https://krebsonsecurity.com) is much more informative.

<comment><USER30> OK, we've changed to that from [https://www.reuters.com/article/us-cyber-atms- usa/atm-makers...](https://www.reuters.com/article/us-cyber-atms-usa/atm- makers-warn-of-jackpotting-hacks-on-u-s-machines-idUSKBN1FG0WU).

</comment></comment><comment><USER31> first? the late Barnaby Jack did it in 2010 :)

[https://en.wikipedia.org/wiki/Barnaby_Jack](https://en.wikipedia.org/wiki/Barnaby_Jack)

<comment><USER32> And it seems to follow his suite. The "jackpot" part. Seeing those bells on the atm gave me a good laugh ..

</comment></comment><comment><USER33> _According to FireEye, the Ploutus attacks seen so far require thieves to somehow gain physical access to an ATM — either by picking its locks, using a stolen master key or otherwise removing or destroying part of the machine._

ATMs need to be more physically secure, like bank safes, if they are to be resistant to such attacks. The software part is mostly immaterial here, IMHO --- it doesn't matter what the software is, if you can get access to the physical money.

<comment><USER34> I used to work with various ATMs and the cash dispenser _is_ a hardened safe, with a combination lock and all. If you are to steal an ATM, you will still need to open the safe and the simplest option would indeed be to try and persuade it to just dispense the money.

The thing is that ATMs from larger vendors (IBM, NCR, Bull, Siemens, etc.) have layer upon layers of protection features. For example, you can configure a secondary combination for the safe which will open it and also send an emergency alert. This is for the cases when someone is being forced to open the safe at gunpoint. There are batteries for secondary power supply. There are options for physical lock-down in case of a power loss. Tilt and movement sensors. Redundant communication options, including exotics like x.28 radio.

I mean that all of this was readily available even 20 years ago. ATMs are not designed by amateurs. The issue is that all these are _options_. They need to be bought first and then they also need to be properly configured and enabled, which falls on the banks or their IT service providers to do. The smaller the bank, the less willing they are to spend even more money on configuring secondary stuff and setting up an infrastructure for it, so many of these options will remain off even if they are available.

<comment><USER35> You explain more about the x.28 radio, and its purpose? Communication between where?

</comment></comment></comment><comment><USER36> Several years ago, I've had an ATM crash and reboot after pressing one of the screen side buttons when the machine was waiting for PIN entry via the numeric pad. It rebooted, and I could see that it was running MSDOS, not even Windows. Luckily, after the reboot completed and the ATM frontend program started, it spit out my card again.

With one of offices of my bank being nearby (to be able to block my card if I couldn't get it back), I tried it two more times, just to check that it wasn't a random occurrence.

While it was probably nothing that could further be escalated into gaining access without additional hardware, it gave me a chuckle (and a bit of fear for my card, initially).

<comment><USER37> I'd rather have a ATM running MS-DOS than Windows. At least the attack surface is small. God nows how many ATM's are running Windows 98 and XP, which contain major security holes which will never be patched.

</comment></comment><comment><USER38> One of the first unethical "hacker" things I did was to attempt to change the bill output to larger bill. I got so incredibly nervous when I went into the debug screen that I power walked out of the corner store when the clerk noticed I had been at the machine for several minutes and had not inserted a card.

You find a lot of these ATMs that are even more insecure than the larger WinXP machines. Those little kiosks are perfect for skimmers, manipulation, or just fucking around with.

<comment><USER39> Hah - the old "swap the tray configs around" trick...

</comment></comment><comment><USER40> I just read through the comments and was VERY surprised to see noone call this out:

> _At this point, the crook(s) installing the malware will contact co- > conspirators who can remotely control the ATMs and force the machines to > dispense cash._

Realize what this means. The ATMs are connected directly to the internet, with a VPN (hopefully...) sitting over the top of that. The ATM can still call out to the internet directly!!

That is, honestly, shocklingly insecure. I'm stunned.

I read [https://news.ycombinator.com/item?id=16250498](https://news.ycombinator.com/item?id=16250498) and how ATMs have different options for security, but "allow anything except the VPN software access to the NIC default route" doesn't sound like something _anything_ should be able to disable.

I mean... I know nothing about networking, and I was able to configure this exact behavior on FreeBSD - which I'd never used before - in a day. I set it up so a torrent program was physically incapable of doing DNS/anything outside of the VPN tunnel interface.

<comment> Anthony-G When I read that part, I figured that the crooks were using their own mobile Internet connection on the laptop or mobile device that they had connected to the ATM.

<comment><USER40> ....Ah. That is a very real possibility. Thanks for pointing that out.

</comment></comment></comment><comment><USER41> I assume this will end with there being fewer ATMs. That they will become more expensive to run in due to costs of hardened physical devices and insurance. If they become too rare it could result in a reduction of cash usage, maybe significantly.

<comment><USER42> Good luck with that, outside of a handful of Nordic oddballs, cash is still king in most of the world (US included). We have a massive unbanked population that isn't going to start using banks or digital payments anytime soon, no matter what politicians or economists may desire.

<comment><USER43> The way that Sweden did it was in small steps, some which other nations has already done.

Encourage companies to only pay employees through banks by making it practically impossible to pay through cash. Expand money laundering laws so that banks are liable if they give out or take in physical cash, with short and hard limits to ATM's. Make it acceptable to have police confiscate money if a person carry more than a few hundred dollars. Just to give examples of those, a person was stopped by a routine police stop when they saw $350 and confiscated it on the concept that such huge amount of money was a sign of money laundering. A few further months ago a elderly couple (70+) had sold their car but could not put the 10 grand into the bank since the sale papers (including government signed transfer) was not enough to prove definitively that the money was still not part of any money laundering. Sweden invalidated all bills and coins made before 2015, forcing everyone to have them exchanged or put it in the bank which was why the elderly couple needed to put the money in the bank.

Add to that a heavy joint campaign between banks and government to paint any physical cash transaction as putting employees at stores at risk and that its a moral responsibility that everyone only use banks, and a strong decline in the availability of bank offices that handles cash.

<comment><USER44> I actually think this is fundamentally an attack on the right to transact anonymously. Trends towards the confiscation of large sums of cash, increasing restrictions on moving money relating to KYC/AML, and the further emphasis on digital forms of payment give governments and, more worryingly, banks the ability to exert incredible influence over the day-to-day lives of individuals.

Here's a good Canadian example - banks now refuse accounts to "high risk" businesses like money services (currency conversion etc.) under the guise that the KYC/AML requirements involved make it too risky for the bank to service them. And yet, our major banks have huge currency conversion businesses - <USER2> in essence these laws are being used to stifle competition.

For merchants, credit cards and debit were originally billed as items that would improve their sales - so who cares if interchange fees add up to a whopping 3% on transactions? But now with almost everyone demanding that stores accept credit/debit, merchants are hit with what is essentially a non- government tax on their revenues. Every "cash back" or "rewards" card is basically funded at the expense of merchants.

<comment><USER28> In the USA also, there is a not-small number of hard-core Christians that would view mandated digital payments as "the mark of the beast" and refuse on that basis.

<comment><USER14> Cash money also has the mark of this beast, and the number of those fringe wackos is small.

</comment></comment></comment></comment></comment></comment><comment><USER45> I guess diebold makes their atms just like their voting machines. [https://www.unhackthevote.com/](https://www.unhackthevote.com/)

</comment><comment><USER46> I am guessing the pulled an unencrypted hard drive from the ATM, analyzed it and the commands. Found the one that spits out cash.

They pop in one with modified code and reboot it to read the new drive.

Only similar ATM I can guess in Canada would already be suspect, in convenience stores, clubs, weed shops, strip clubs lol... The none bank name brand.

Had one bluescreened after taking money from account but before outputting money.

Was running Windows.

Didn't give any money, but kept the money from the account.

Had to call my bank.

</comment><comment><USER47> > To carry out a jackpotting attack, thieves first must gain physical access > to the cash machine.

Ok, like breaking the machine open, but that's cheating, and hasn't got a lot to do with software security.

</comment><comment><USER32> Overeheared a smalltak about something similar in croatia couple days ago . I tought guy was drunk and bs-ing the waitress . Now I hope I bump into him again ;)

</comment><comment><USER48> It seems the ATM has not evolved very much over the past 20 years. Any ideas why?

<comment><USER49> Why should it? Its function is to spit out money and it functions well enough for that.

Obviously they do add features, like topping up phone credit or bill paying. But I would guess nowadays the bankers would rather pay smartphone app developers rather than the ATM developers...

<comment><USER50> By that definition you can say it's doing it's job even better now!

</comment></comment></comment><comment><USER26> > The Secret Service alert says ATMs still running on Windows XP are > particularly vulnerable, and it urged ATM operators to update to a version > of Windows 7 to defeat this specific type of attack.

I would argue that Windows isn't at all the right OS for this.

<comment><USER51> What is? And do you have an OS that you are comfortable calling "secure"? Remember security through obscurity as enjoyed by Mac and Linux doesn't apply here because there is actual money and hence incentive to find vulnerability at stake.

<comment><USER52> It should be much easier to secure a small OS targeted at the job at hand rather than a general purpose OS that supports everything from mouse drivers to webcams which gives it a huge attack surface.

</comment></comment></comment><comment><USER53> _The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack._

I think this applies, _mutatis mutandis_ : [https://xkcd.com/463/](https://xkcd.com/463/)

<comment><USER54> At least they aren't running OS/2 Warp.

<comment> the-dude Actually, OS/2 has been used for ATMs ( I've seen them in the EU, long time ago ).

<comment><USER55> Yup, you'd probably be surprised how much of that is still out there. At this point I'd rather have that than XP which has lots of well known exploits.

<comment><USER54> It appears that NCR and Diebold made the decision to migrate from OS/2 to Win XP a while ago.

</comment></comment></comment></comment></comment><comment><USER56> fiat wallets hacked. this is good for bitcoin.

</comment><comment><USER57> I people didn't need cash this problem would go away. I think of this occasionally when I visit our local bagel shop, which like many bagel shops in the area does not take cards and has an atm onsite.

<comment><USER58> On the other hand, if you pay by card everywhere, your moments and spending habits will be tracked and catalogued.

A lot of people are not comfortable with that.

<comment> grey-area The vast majority carry an internet connected gps tracker with microphone, Wifi, Bluetooth, sms and email all in one place with them at all times, and bank accounts, sms, emails are already accessible to the state on the server side. Shops are using facial recognition and Bluetooth to advertise and track customers. So I honestly think privacy in what you purchase is a ship that has sailed, this data will be recorded in future.

What we should be agitating for is proper control over the use of this info, not trying to limit ways to collect it.

<comment><USER59> In Europe, the General Data Protection Regulation supposedly does just this. There is a notable exception for "national security", but it does at least help move in the right direction.

[https://www.csoonline.com/article/3202771/data- protection/ge...](https://www.csoonline.com/article/3202771/data- protection/general-data-protection-regulation-gdpr-requirements-deadlines-and- facts.html)

<comment> grey-area Yes I agree that's the correct approach.</comment></comment></comment></comment></comment>


Ask HN: What is the best book you read on 2017? - <AUTHOR> <comment><USER4> Non-fiction:

Tough to call. I got a lot out of _Deep Work_ by Cal Newport, _The Obstacle Is The Way_ by Ryan Holiday, _How To Win At The Sport Of Business_ by Mark Cuban, _Thinking Fast and Slow_ by Daniel Kahneman, and _The Engines of Creation_ by Eric Drexler, as well as the three Grant Cardone books I read: _The 10x Rule_ , _Sell or Be Sold_ and _Be Obsessed or Be Average_.

Fiction:

I'll go with _The Whispering Room_ by Dean Koontz. _A Wild Sheep Chase_ by Haruki Murakami was also pretty good.

You can see the entire list of what I've read lately (and further back) on my Goodreads profile:

[https://www.goodreads.com/user/show/33942804-phillip- rhodes](https://www.goodreads.com/user/show/33942804-phillip-rhodes)

or, if this link is visible publicly, on this "2017 in books" page:

[https://www.goodreads.com/user/year_in_books/2017/33942804](https://www.goodreads.com/user/year_in_books/2017/33942804)

</comment><comment><USER5> More replies to similar question here:

[https://news.ycombinator.com/item?id=15801996](https://news.ycombinator.com/item?id=15801996)

As for me, best fiction: three body problem

Best non-fiction: WTF by Robert Peston

</comment><comment><USER6> Wool (Silo series)

[https://www.amazon.com/Wool-Omnibus-Kindle-Motion-Silo- ebook...](https://www.amazon.com/Wool-Omnibus-Kindle-Motion-Silo- ebook/dp/B0071XO8RA/ref=sr_1_2?ie=UTF8&qid=1513880513&sr=8-2&keywords=wool+hugh+howey)

<comment><USER7> IMO the first chapter is the strongest by far: [https://www.2uo.de/wool/](https://www.2uo.de/wool/)

</comment></comment><comment><USER8> scifi: [https://kirubakaran.com/bookshelf/columbus- day/](https://kirubakaran.com/bookshelf/columbus-day/)

nonfic: [https://kirubakaran.com/bookshelf/data-science-from- scratch/](https://kirubakaran.com/bookshelf/data-science-from-scratch/)

fiction: [https://kirubakaran.com/bookshelf/everyone- burns/](https://kirubakaran.com/bookshelf/everyone-burns/)

Here is my full list: [https://kirubakaran.com/bookshelf/](https://kirubakaran.com/bookshelf/)

<comment><USER9> For anyone looking for a DS primer, I have to say I was really disappointed with "Data Science from Scratch". It was all breadth with little depth. It felt more like a suggested list of topics to further research w/ other material.

I personally got way more value and insight out of "Data Science for Business" and would highly recommend it.

<comment><USER8> Thanks for the recommendation. I like "Data Science from Scratch" for the same reason you dislike it :-)

</comment></comment></comment><comment><USER10> The Subtle Art of Not Giving a F*ck [Mark Manson]

Its an easy & enjoyable book on subject : A Counterintuitive Approach to Living a Good Life.

</comment><comment><USER11> Dark Matter: A Novel (Fiction) - One of my favorite SF story so far. [https://www.amazon.com/Dark-Matter-Novel-Blake- Crouch/dp/110...](https://www.amazon.com/Dark-Matter-Novel-Blake- Crouch/dp/1101904224)

Principle: Life and Work, Ray Dalio (Business & Decision- Making) - <USER2> interesting and thoughtful book around building a meritocracy. [https://www.amazon.com/Principles-Life-Work-Ray- Dalio/dp/150...](https://www.amazon.com/Principles-Life-Work-Ray- Dalio/dp/1501124021)

<comment><USER12> Principles is my best non-fiction read of 2017. Superbly written.

</comment></comment><comment><USER13> Web serials:

Worm ([https://parahumans.wordpress.com/table-of- contents/](https://parahumans.wordpress.com/table-of-contents/))

A Practical Guide to Evil ([https://practicalguidetoevil.wordpress.com/](https://practicalguidetoevil.wordpress.com/))

Both of these have active communities on Reddit also. I really think web serials are underrated compared to "real" books.

</comment><comment><USER14> I don't normally read him but yudkowsy's book Inadequate Equilibria was a really good look at how he analyzes "market failures" in society at large. And it's freely available from [https://equilibriabook.com](https://equilibriabook.com)

2017 was also the year I read classics like 3-body problem and ready player one

</comment><comment><USER15> Fiction: The Handmaid's Tale by Margaret Atwood

Nonfiction: The Banker's New Cloths by Anat Admati and Martin Hellwig

Full list: [https://www.goodreads.com/user/year_in_books/2017/63629672](https://www.goodreads.com/user/year_in_books/2017/63629672)

</comment><comment><USER16> I normally only read books to help me sleep and usually that book is "Lord of The Rings". However, I did branch out in 2017 with "American Gods" by Neil Gaiman which I quite enjoyed until near the end where it got a little too crazy.

</comment><comment><USER17> 1\. Thinking fast and slow - <USER3>

2\. Outliers - Malcom Gladwell

3\. How to read and do proofs - Daniel Solow

All of these were packed with great insights and are books I'm sure I will return to in the future for multiple re-reads.

<comment><USER5> I enjoyed Outliers when I read it a while ago, but have since realised it's just a bunch of anecdotes.

<comment><USER18> Yes. Malcolm Gladwell loves to write about his own brilliantly uncovered anecdotes...

Peak loses a lot of that, and is co-authored by a psychologist who is behind a lot of more scientific work in the area of expertise (his work is also referenced in Outliers).

In general, I recommend people skip Outliers (really just skip Gladwell entirely) and read Peak instead.

</comment></comment></comment><comment><USER19> Kurt Vonnegut: Complete Stories

[https://lareviewofbooks.org/article/mister-kurt-he- posthumou...](https://lareviewofbooks.org/article/mister-kurt-he-posthumous- vonneguts-complete-stories/#)!

Goethe: Life As A Work Of Art

[http://www.nybooks.com/articles/2017/12/21/super- goethe/](http://www.nybooks.com/articles/2017/12/21/super-goethe/)

</comment><comment><USER20> Consciousness and the Brain: Deciphering How the Brain Codes Our Thoughts [Stanislas Dehaene], interesting book about up to date neuroscience.

Book of Proof [Richard Heath Hammack], great books on maths. gives a head start on proofs.

Mastery [Robert Greene], best self help book I've read.

[https://www.goodreads.com/user/year_in_books/2017/5980292](https://www.goodreads.com/user/year_in_books/2017/5980292)

</comment><comment><USER21> Non-fiction: Illumination in the Flat-woods by Joe Hutto, an amazing story about raising turkeys.

Fiction: Library at Mount Char by Scott Hawkins, a new great magical realism book, great if you like Stephen King / Clive Barker / Robert McCammon.

My list: [https://schollz.github.io/books-2017/](https://schollz.github.io/books-2017/)

</comment><comment><USER22> By far the most memorable book I read this years was "When Breath becomes Air" by Paul Kalanithi. It's a quick read an immensely impactful.

[https://www.goodreads.com/book/show/25899336-when-breath- bec...](https://www.goodreads.com/book/show/25899336-when-breath-becomes-air)

</comment><comment><USER23> The best book published in 2017 for me is this one:

"A Man for All Markets: From Las Vegas to Wall Street, How I Beat the Dealer and the Market" by Edward O. Thorp

[http://www.edwardothorp.com/books/a-man-for-all- markets/](http://www.edwardothorp.com/books/a-man-for-all-markets/)

</comment><comment><USER24> Fiction: _We Are Legion (We Are Bob)_ by Dennis E. Taylor - the first of a very enjoyable SF trilogy

Non-Fiction: _Chasing the Harvest: Migrant Workers in California Agriculture_ by Gabriel Thompson - a collection of detailed and moving stories from people who work in the fields in California.

</comment><comment><USER25> I've read over 100 books this year, but mostly non-fiction. I'm kinda surprised that my favourite book ended up being a fiction book, which is: 'Ready Player One'

<comment><USER26> Do you have a speed reading technique or just read for a long time per day?

<comment><USER25> I read when I'm in transit or waiting for people

I made a promise to buy a book / e-book per week. So I better make sure I finish it.

When I'm driving or walking from one place to another I'm listening to an audiobook and it is at 3x speed

I think if you're forced to read a lot of book, you'll come up with a system that works for you. Some of the advice people give over the internet might not work at least that was my experience

</comment></comment></comment><comment><USER27> Martin Kleppmann's "Designing Data-Intensive Applications" is one of the best books in computing I've read in a very long time (and thus the best book of 2017).

</comment><comment><USER28> The best book I have ever read I read in 2017, it's the book "The Anatomy of Peace" (and it's twin Leaders and Self Deception) from the Arbinger Institute.

</comment><comment><USER29> Nonfiction: Hillbilly Elegy By JD Vance

Fiction: Golden Son by Pierce Brown - liked the whole trilogy; Rosie Project/Rosie Effect by Graeme Simsion

</comment><comment><USER30> I've been reading David Walliams' books for children. I think they're very good. More importantly, so does my child.

</comment><comment><USER31> Fiction (fantasy): Broken Empire Trilogy by Mark Lawrence (2013)

Fiction (Sci-fi): The Three-body Problem by Liu Cixin

Non-fiction: The C Programming Language

</comment><comment><USER32> "Peak: Secrets from the New Science of Expertise" by Anders Ericsson and Robert Pool

</comment><comment><USER33> The Magic Mountain by Thomas Mann.

</comment><comment><USER34> Hilary Mantel's novels "Wolf Hall" and "Bring Up the Bodies"

</comment><comment><USER35> Turning Pro by Steven Pressfield

</comment><comment><USER36> The Monsters of Education Technology

</comment><comment><USER37> Some of the most memorable/useful/wonderful:

Fleck - _Genesis and Development of a Scientific Fact_

Hacking - _The Social Construction of What?_

Felsner - _Geometric Graphs and Arrangements_

xkcd volume 0

Tommy Wonder - _The Books of Wonder_

Elisabeth Lloyd - _Science, Politics and Evolution_

..and, it's embarrassing to admit it on here :-) but I didn't read _Refactoring_ or _Clean Code_ or Kent Beck until 2017. Better late than never.

</comment><comment><USER38> Nonfiction: Tools of Titans

Fiction: Shantaram

</comment><comment><USER39> Hyperion

Einstein: His Life and Universe

Ready Player One

</comment><comment><USER40> Grit

Mindset

Peak</comment>


Simple, Plain, Customizable JS Dialogs. - <AUTHOR> https://github.com/mattlockyer/diajs/ Frustrated by the lack of a simple, customizable JS dialog, I decided to create a mini library that captures the simplicity of the 3 classic JS dialogs: alert, confirm, prompt, but allows for needed custom features like styling, button labels, and html5 placeholders for inputs. Seeking feedback on any potential issues, code architecture and style, and general usefulness. Before you chime in about jQuery UI or some other framework/library that has this included, think first about projects that don't require such a heavily scripted or styled component and would benefit from a straightforward, easy to customize solution. <comment><AUTHOR> I was frustrated by the lack of a simple, customizable JS dialog. I decided to create a mini library that captures the simplicity of the 3 classic JS dialogs: alert, confirm, prompt, but allows for needed custom features like styling, button labels, and html5 placeholders for inputs. Seeking feedback on any potential issues, code architecture and style, and general usefulness. Before you chime in about jQuery UI or some other framework/library that has this included, think first about projects that don't require such a heavily scripted or styled component and would benefit from a straightforward, easy to customize solution.

</comment><comment><USER2> I think this is a smart foundation. Despite the fact that this problem is tackled in countless libraries, there is no real standalone solution. Would be interested in seeing this grow to include basic form functionality.

</comment><comment><USER3> What does Dia stand for?

<comment><AUTHOR> dialog

or...

dia- a prefix occurring in loanwords from Greek ( diabetes; dialect ) and used, in the formation of compound words, to mean "passing through" ( diathermy ), "thoroughly," "completely" ( diagnosis ), "going apart" ( dialysis ), and "opposed in moment" ( diamagnetism ). Also, especially before a vowel, di-.

Origin: < Greek, combining form representing diá (preposition) through, between, across, by, of, akin to dýo two and di- di-1</comment></comment>