skysight-inc/HackerNews huggingface dataset:
I agree with you, but the current system shows no incentive to improve and to work around these issues. Regulators (because of the increased complexity) and Companies alike (because of the potential market losses) are unwilling to commit to do real science and to do the right thing. I do not think it is going to change anytime soon, even if we are all aware of the shortcomings.
He said it was decoded by a Python script.. so easy to understand from the script I guess.
I only read the newspaper articles about Amy Chua, and if they were true, then in my opinion she tortured her daughters. I remember that they had to repeat piano pieces zillions of times and were not allowed to go to the toilet until they got them right, for example. That's torture. Sure, it could always be worse, but it's probably soul crushing enough. That her kids might not hold it against her doesn't mean a thing because kids always love their parents. In my country there was a case recently of a father abusing his daughter sexually for years and offering her to other men, yet in court she still felt sorry for testifying against him and called out "I still love you, daddy".

I'm sure lots of middle class parents abuse their kids, too, but that doesn't imply the Chua style is non-abusive.

Especially since the torturing was done apparently in the pursuit of meaningless status symbols (daughter played in famous concert hall once, great grades at school).

The thing is, kids always grow up, no matter what you do to them. So you can always say "see, it worked out alright". Until the day when it all falls apart and the emotional backlash happens (in the form of something like the Nazi regime, for example - yeah, quote Godwin's law, I don't care...).
For the record, distributing Python scripts doesn't have to mean distributing the source: it's possible to just execute the compiled .pyc files, which are harder to crack than (for example) Java's .class files.

Also, since xor is just a CPU instruction, you won't immediately notice it in the decompiled script (if you get that far). With all the overhead that decompilers tend to produce, it's really easy to miss.
Doesn't apply at the border
Someone want to explain why this is less secure than other DRM methods?
Clickable:
http://sfhn.eventbrite.com/ https://www.facebook.com/groups/gosfhn
programming libraries, not physical libraries...
I seems weird to me, like the whole debt component of the convertible note pretty much ceases to exist unless it is able to be successfully converted to equity.

I guess investors of the type investing in start fund tend to think of it more as a gamble that only converts to anything if the company raises and don't care much about recovering relatively small bits and pieces in the even the company fails.
Apple and Microsoft were both making money before they had spent $80k.

Apple was selling hobbiest boards, Microsoft the license to DOS.

You don't have to build a whole company, just find a market and become sustainable.
And amazingly fun to hack on.
After recovering the original file, he "compared the binary files". Likely this means he popped them both up in a hex editor and noticed the difference. XORing by a string is a very common very very trivial thing to do, so it would be pretty high on your list of things to notice.
The same could be said of UTF-16 implementations that don't support surrogate pairs.
Google also does this method of verification for their Adsense payments -- just type in the amount deposited and your account can now receive payments from Google.
Forget Buy Nothing Day: Could you hack Buy Nothing Christmas?
Art.sy was lucky to be the top article on NYTimes (the one with the large image at the top of their homepage) from about 5pm to 11pm, were the #3 most emailed, and the NYT article was #3 on Hacker News. We went to 1500 concurrents almost instantly, and maintained it for several hours. This is nothing for many large sites, but was the most we'd had. We had added some extra dynos in preparation, and our API response time actually went down as more obscure routes were hit and cached.

We prepared for the worst, though, and had built a failsafe way to progressively shut off more demanding features on the site (for instance: our related search results on artwork pages) in case we were getting overwhelmed. Much better to have a reduced feature set during launch than a broken site. Fortunately we didn't have to flip that switch!
ccache doesn't cache the results of compiling each individual header. Other than the shared cache, ccache is conceptually just a workaround for deficiencies in make.
Maybe OP just xor'd the files with each other and the result was the RANDOM_STRING string followed by a pile of \0 bytes, repeat.

Edit: To clarify, I meant the encrypted and temporarily-decrypted-by-the-wrapper-script versions of the same .mov file.
> I am utterly unable to sell crappy non-solutions to people with more money than knowledge.

This is why us engineers quietly keep the world running.
Probably. But then he is also doing OK on FB.
It's easy to laugh at stuff like this, right up until they get the contract to secure your online banking...
They probably didn't anticipate GitHub becoming a competitor and people including things in job postings like 'links to GitHub profiles would be appreciated - links to LinkedIn profiles will be ignored' - but that is becoming the norm for programming jobs.
Precisely. They've gone to an effort which should invoke the DMCA (as ridiculous as that is) and they have a bullet point somewhere on a power point they can show to content creators that says DRM.

Those are the practical uses of any DRM technology one might ever devise.

Sure, you could throw in more than 5 seconds of security-through-obscurity, but why bother?
What about holding the additional $70k per startup in escrow and dividing it among those startups that deserve to stick around?

Basically, if you take 60 startups, give each $80k and put the $4.2 million (60 * $70k) in the bank. When that batch of YC startups gets to $20k left in the bank on average, figure out which ones show promise and which ones should be deadpooled. Assuming a 2/3 deadpool rate, that leaves 20 startups to divide the $4.2k among, or approximately $210k in convertible debt per startup to reach the next milestone.

This is more inline with your essay about the future of funding, in which you speculate that funding will become more continuous.

http://www.paulgraham.com/future.html
Great. I am in. I just moved to SF and need some community friction.
You cannot simultaneously crow "hurr, DRM is broken!" and act all smug about this discovery. Perhaps the original developer, like you, understood this, and did the absolute bare minimum necessary to fulfil commercial obligations, all the while making it easier for people like himself (i.e. you) to get what they want, and making a few bucks from the old and dying media industry all at the same time.

Given the evidence (complex integration with a non-standard set of open source libs, complex industry area in general), I'd say it's almost certainly an insult to imagine the developer could not have made your life harder if he'd chosen to.

Please, if anything commend the dear fellow, and shame on whoever considered a momentary glimpse of Google Plus limelight worth making this guy's Tuesday morning and ongoing professional reputation much harder earned than it otherwise might have been.

"No good deed goes unpunished"
The wrapper script is GPL'd, so I copied it here:

http://dl.dropbox.com/u/15447644/brainplayer_py.txt

My modifications are on lines 553-556. The compiled app "fixes" the .mov file just long enough for it to be loaded into the player. If you have Leaping Brain's player installed (often branded with the content owner's name), the .mov files are in a hidden .media folder. On my Mac, they were in $HOME/Library/Application Support/LeapingBrain/catalog/$VIDEONAME/.media
It's so easy to solve repeating-key XOR for the key that the solution is a practical way to detect the scheme; you wouldn't even necessarily bother trying to detect it, you'd just run the "solver" (even calling it a solver sort of dignifies it a bit too much).
You should really take a look at one of these .pyc files. They are very very verbose to the point that they even contain local variable names and the python code can be trivially decompiled from the bytecode.

Literally the only thing that goes missing from .py to .pyc is comments.
In addition to what others have mentioned, something that came to my mind is that they're also big enough to have people lobbying for legislation against them in multiple places. That's going to require extra people if for nothing else but to be liaisons to the lawyers and anti-lobbyists.
Investors Need To Lose Their Egos And Founders Need To Gain Some Confidence
Anyone who has taken Computer Security 101 would know that security through obscurity is not the smartest thing to do. Calling it "near-ridiculous level of security." is downright blasphemy.
Would anyone who actually knows something about this be so kind and tell us his/her opinion?
You're right, actually. I'm glad it's broken, because it's a lot easier for me to watch the videos I purchased without the DRM. I was just struck by the audacity of their marketing claims.
Seems to be an obvious cut-off-the-competitor move. Github is quickly becoming a sort-of Resume for tech people. LinkedIn, so far as I've seen, is for the business-types. LinkedIn wants to capture that tech-side, but it's afraid that letting people use Github on LinkedIn will lead to people simply going to Github to look for developers.
There actually are DRM schemes which were too hard to break -- DIVX from Paul Kocher (distinct from DivX), for instance.
Einstein's list of conditions for staying together with his wife
The XOR of two ciphertexts under P XOR K isn't K (you have to know a plaintext to make that trick work, which, granted, you likely would here). The solution that doesn't require a known plaintext is comparably simple.
Exactly. If there's nothing your app does except act as a "nicer" front end to your website, it doesn't deserve to be an app.

Take the Newegg app, for instance. It is literally a mobile site served up in PhoneGap. They could just make that their default stylesheet for mobile web and it would both perform better and be a better experience for their users, who now don't have to download yet another app to use a website they'll visit once or twice a year.
It isn't too difficult to set up a bank account in someone else's name without them knowing. It happens with credit cards all the time.
This is apparently why the DMCA anti-circumvention provisions only apply to bypassing "effective copy protection" systems.

Of course, if a copy protection system was "effective" it wouldn't need a law prohibiting its circumvention. Conversely, if a copy protection system is circumventable, it's not effective.
> Although, yeah, if you've got commercial aspirations like OP, then I think you're in for it.

I think you nailed it right there. If the OP had said something akin to "I want to write a small OS with a command line interface to learn about the topic" it would have been an entirely different question. I would encourage anyone to do that. It would be an excellent learning experience and the foundation for a lot more interesting work.

If you go back and read the post, this is no small OS any of of the many sub-projects he is proposing is a huge undertaking for a developer who self-describes this way: "I spend most of my days in the world of PHP, JavaScript (I love jQuery) and a little bit of HTML, CSS and ActionScript 3.0".

With regards to your comment about writing a "fully preemptible, multiprocessor unixy kernel and userspace on x86" in school. Sure. Of course. But, keep in mind that you are actually being TAUGHT how to do this and guided throughout the process. You also mentioned that "a bootloader, a build system, a syscall spec, and some moderate protection from the details of some hardware beyond the CPU" are provided. The OP is talking about writing everything!

For example, he seems to talk about writing PCIe, SATA and USB interfaces. That alone could take a newbie a whole year to figure out. Particularly if coming from being a web developer.

Insane? Yes. Impossible? Of course not. Probable? Nope.
You realize some of YCs biggest successes to date such as Dropbox and airbnb only got the maybe from YC, no start fund.
As the post says, he gained access to both decrypted and encrypted version. Then (p XOR k) XOR p = k.
I don't understand why the data is unstructured, and thus SQL is not an option. Isn't the data coming in from calls to the company's own API?
Awesome! Can't wait to meet you.
Also for version 2 and inline with the needs of hardware startups:

http://news.ycombinator.com/item?id=4834831
The instant chat window must be one of the most annoying things I've seen on a website currently. Not only do I hear a beep when opening a tab but it also takes about half of my browser space (netbook). Good content tho, too bad it's surrounded by bad design decisions.
Pray tell, where are the full docs?
$49 Personal Genome at 23andme (incognito windows until you get the best price)
I'm probably missing the point (not sarcasm).

I'm about to start writing my first mobile app - a UI client to a ReSTful image rating API. I've been debating between native and HTML5 for the past few days, and reading this article makes me lean ever more toward native.

I see that the author's goal is possible. However, he's also illustrated that getting an HTML5 app to feel native on iOS requires a deep understanding of the underlying implementation of Safari/WebKit. I assume the benefit to this kind of app design is to keep people familiar with web design from having to learn native development?

The problem is that in the quest to not break your comfort zone, you're ultimately forcing yourself to (painfully) learn the depths of the how Safari/WebKit render HTML5 and where its performance 'gotchas' lie. It seems that the uninitiated would have more unimpeded success using the straightforward, well-documented path of native UI development.

Or maybe my assumption is off. HTML5 was originally appealing to me for the sake of portability; I didn't want to write the same app for umpteen different devices. While the idea of writing just one nice responsive interface is appealing - doing this in HTML5 in such a way that it provides a good UX across all devices (or at least the ones I care about) means that I need to learn all the pitfalls of how all the rendering engines out there work. And then there's the maintenance whac-a-mole game that comes when a fix on one platform creates a bug on another... It seems like for portability it'd be a safer bet to rely on separate code-bases for each platform. If I'm doing that - what benefit is HTML5 providing me specifically toward portability, and is this benefit outweighed by the fact that I need to be a WebKit/Chrome performance guru?

Either way, I'll pose the question again: Am I missing something (not sarcastic/rhetorical)?
Cost-Aware Architectures
Once I had both versions of the files, I looked at them in a hex editor. Since there were some null bytes at the beginning of the video file, it wasn't hard to guess the string they were using. I'm not going to post the file themselves (for obvious reasons), but here's the first 16 bytes of the unencrypted and encrypted files (in hex and ascii, from xxd). Unencrypted:

0000000: 0000 0020 6674 7970 7174 2020 2005 0300 ... ftypqt ...

Encrypted:

0000000: 5241 4e64 2939 2623 2526 696e 6705 0300 RANd)9&#%&ing...
Google is Now Responsible for Not Removing Lies from Web
I'm not saying it's impossible, merely saying that the technical strength of a DRM system is often not one of the primary goals.
Fermat's Last Theorem Documentary
This point still stands,

> you cannot enter into a confidentiality agreement that way

In your example, the confidentiality agreement (NDA) exists prior to the email.
Or just (unintentional) truth in marketing...
That's very cool, and I'm surprised RC cars aren't being used in more Arduino projects. I wish it actually was a detailed post, because I'd love to learn more about the Arduino setup in there -- if he's using the Motor shield, how the batteries are hooked up, etc. And how much did the materials cost -- xbee radios are around $100 each I believe...
Not to mention, a foolhardy challenge to break it.
The GitHub application was very intrusive, in my opinion. With default settings, every push I made would be posted to the news feed. I didn't notice for several days, but it was a little embarrassing.
The whole thing is a marketing "worst-of". They consistently advertise their products as "unique, brilliant, revolutionary", "magical, user-friendly, powerful", and "your only option".

The real laugh-out-loud moment is this tagline (http://leapingbrain.com/mod-machine/overview/):

"Forget crappy streaming systems and primitive, unprotected loose movie file downloads that make your products seem like a joke."
Thanks!

Thoughts on other VPS vs EC2?
Also another question along this topic: How bad is "not native feeling" for UX? As a poor self-funded "I just need to launch this" wantrepreneur, do I care?

I happily used the HTML5 Facebook app on iOS without any notice of its performance "issues." Can someone give me an example of a non-native app where it's lack of nativeness is the cause of poor UX, and for bonus points a similar app with UX noticeably improved by the sheer fact that it is native?
You might try asking Slysoft, which has to continually release new betas of AnyDVD HD as Macrovision randomly decides to break their software with updates of BD+.

Or, you could ask all the people who used to make 6 figures dealing H-cards for DirecTV, but can't anymore.
How do we know this wasn't a non-english speaking subcontractor that took the spec too literally?
Maybe there's a scheme here to prevent good DRM by flooding the market with highly inflated impressive-sounding claims attached to laughable security. The Old Media crowd won't be able to solve the Design Paradox (http://www.paulgraham.com/gh.html) well enough to tell who's lying, good designs won't be able to charge more than laughable competition, and the DRM field will slowly die.
I really hope that's not the case. Even as a tech person, I wouldn't want people looking only at my Github page. Call me old-fashioned, but I like the "resume feeling" that LinkedIn provides.
Paid Web Development Internship with City of San Francisco 
Help pioneer web personalization for residents and visitors to the San Francisco 311 Customer Service
Center website. 311 seeks a Java Development Intern. Must be hands-on and technically savvy with an interest in solving problems through technology in the context of local government.

Up to 20 hours per week with telecommuting option available.
From our perspective (hardware company), the 150k did provide some runway, but more than that, it provided funds for R&D. We could finally make future versions of the product without always finding a customer for it first.

We could order components just to try them out, without worrying that we were spending money on what may potentially turn out to be an unusable or unnecessary part. We could answer a lot of questions about what was possible using test setups rather than assumptions based on scraps of information collected from various sources.

80k probably would not have provided both R&D funds and some runway.

EDIT: I mean 'runway' in the sense of money for salaries, excluding R&D and other costs which could possibly be seen as ongoing costs of operation too.
Your e-reader is watching
If you look at the places with highest volatility, it tends to be jobs-heavy SF Bay Area and LA. A farmer in Oxnard might see his farmhouse appreciate 10% here and there, East Palo Alto and Antioch (which I think you're describing) did not experience any significant swings even during the height of real estate bubble.
What uses Divx DRM? I.e., Is there evidence of anyone actually trying and failing to break Divx?

Edit: I'd guessed we were talking about Divx (of the DivX codec fame) http://en.wikipedia.org/wiki/Divx , which apparently has some DRM products now and is owned by Rovio-formerly-known-as-Macrovision.
Thanks for sharing! Hope you won't get in trouble for your post.
It's possible I don't understand the proposal and I'm probably going to get egg on my face and but I'm not sure I really want this. If I wanted Objective C or C# or Java or Python I'd use Objective C or C# or Java or Python.

I actually like the preprocessor. I like that I can write code like this

#ifdef DEBUG
#define DEBUG_BLOCK(code) code
#else
#define DEBUG_BLOCK(code)
#endif

void SomeFunction(int a, float b) {
DEBUG_BLOCK({
LOG_IF_ENABLED("Called SomeFunction(%d, %f)\n", a, b);
});
... do whatever it was SomeFunction does ..
}

In other languages that I'm used to there's no way to selectively compile stuff in/out.

I like that I can change the behavior of a file for a single include unit

-- foo.cc --
#include "mylib.h"

-- bar.cc --
#include "mylib.h"

-- baz.cc --
#define MYLIB_ENABLED_EXPENSIVE_DEBUGGING_STUFF 1
#include "mylib.h"

because enabling it globally would run too slow

I like that I can code generate

// --command.h--
#define COMMAND_LIST \
COMMAND_OP(Stand) \
COMMAND_OP(Walk) \
COMMAND_OP(Run) \
COMMAND_OP(Hide) \
COMMAND_OP(Jump) \

// make enum for commands
#define COMMAND_OP(id) k##id,
enum CommandId {
COMMAND_LIST
kLastCommandId,
};
#undef COMMAND_OP

// --command.cc--
// Make command strings
#define COMMAND_OP(id) #id
const char* GetCommandString(CommandId id) {
static const char* command_names[] = {
#define COMMAND_OP(id) #id,
COMMAND_LIST
#undef COMMAND_OP
};
return command_names[id];
}

// make a jump table for the commands
typedef bool (*CommandFunc)(Context*);
bool FunctionDispatch(CommandID id, Context* ctx) {
static CommandFunc s_command_table[] = {
#define COMMAND_OP(id) id##Proc,
COMMAND_LIST,
#undef COMMAND_OP
}
return s_command_table[id](ctx);
};

Or this

class Thing {
public:
void DoSomething();

private:
#ifdef USE_SLOW_LEGACY_FEATURE
// needs access to Thing's internals.
void EmulateOldSlowLegacyFeature();
#endif
};

Yes, I can try to hide the implementation but again, the reason I'm using C++ is because I want the optimal code. Not a double indirected pimpl. If I wanted the indirection I'd be using another language.

I love C/C++ and it's quirks. I use it's quirks to make my life easier in ways other some other languages don't. Modules seems like is ignoring some of what makes C/C++ unique and trying to turn it into Java/C#

People saying the preprocessor has issues are ignoring the benefits. I miss the preprocessor in languages that don't have one because I miss those benefits.

You could say, "well, just don't use this feature then" but I can easily see once a project goes down this path, all those benefits of the preprocessor will be lost. You can't easily switch your code between module and include, especially if it's a large project like WebKit, Chrome, Linux, etc.

Leave my C++ alone! Get off my lawn!
Right, which is why I'm asking what kind of limbo a modified TOS would place you in. Do they have to contact you directly agreeing to your modified version, and until then you're not allowed to use the service, even though you've been signed up?
> I agree that it is not the most heinous crime committed in the US ever - it is probably a small crime, like petty theft or trespass - but it still is. I hope he will be punished in accordance with the severity of the crime - not too hard, not too lightly.

But he was convicted of a felony. There is no "lightly" on a felony... only varying degrees "You're F'ed!" Fines will be high. Even if probation/community service is used rather than prison (yes, PRISON... not jail), the punishment lasts for a lifetime for a felon. Many, many, many forms have a special check box for felons.
Very impressive! There does seem to be quite a bit of lag between the steering movements and the rc car response.
It appears the term was used to describe the Allied powers between 1939 and 1945.

http://en.wikipedia.org/wiki/United_Nations#History