HNHacker News
TopNewBestAskShowJobs

joshmn

5,198 karma · joined April 15, 2013

Just your friendly, local federal prison alumnus.

I went to federal prison for hacking and internet piracy. Speaker at SLEUTHCON and InterCOP hosted by Interpol.

Aimless thoughts at https://josh.mn; prison stuff at https://josh.mn/prison.

Email is hn@the above domain.

meet.hn/city/us-Minneapolis

submissionscomments
joshmn··on RFC 454545 – Human Em Dash Standard
Related: Em dash leaderboard https://news.ycombinator.com/item?id=45071722
joshmn··on Cloud VM benchmarks 2026
There are plenty of other dedicated server providers that do.
joshmn··on OpenClaw surpasses React to become the most-starred software project on GitHub
> I keep reading folks saying OpenClaw has completely changed their life while posting a picture of 58 mac minis on their desk.

I was having a conversation with someone about OpenClaw, and they proposed this idea of OpenClaw being used for inventory tracking at the retail-level. I let them continue. They said it'd be the best option for tracking when purchases are made and what SKUs are sold at what time of day. They weren't talking about prompting, they were talking about it as a data store.

I didn't bother mentioning how long this problem had been solved.

It's not you being a curmudgeon.

joshmn··on New accounts on HN more likely to use em-dashes
You shared this with me via email and I had a great laugh.

I'm very disappointed to not have made the list—going to federal prison for 18 months didn't help my score.

joshmn··on How I use Claude Code: Separation of planning and execution
Sometimes I daydream about people screaming at their LLM as if it was a TV they were playing video games on.
joshmn··on The Palantir app helping ICE raids in Minneapolis
I've been on the receiving end of federal enforcement (DOJ, high-profile "cybercrime"). When they want you, they don't need a confidence score. There is no quota—they take time to build a case. The existence of these tools tells you this isn't targeted enforcement, it's industrial-scale population processing dressed up in an algorithm.

I live in Minnesota. This is my backyard.

joshmn··on Ask HN: Share your personal website
https://josh.mn

mostly about the federal prison system (for which i am an alumnus) and ruby. some essays about autism, too.

joshmn··on Checkout.com hacked, refuses ransom payment, donates to security labs
He would complain that it disrupted their business, and that it doesn't catch all keys—it catches the big ones that he certainly found to be very valuable.
joshmn··on Checkout.com hacked, refuses ransom payment, donates to security labs
It’s notable that there were ShinyHunters members arrested by the FBI a few years ago. I was in prison with Sebastian Raoult, one of them. We talked quite a bit.

The level of persistence these guys went through to phish at scale is astounding—which is how they gained most of their access. They’d otherwise look up API endpoints on GitHub and see if there were any leaked keys (he wasn’t fond of GitHub's automated scanner).

https://www.justice.gov/usao-wdwa/pr/member-notorious-intern...

joshmn··on Lessons from Growing a Piracy Streaming Site
Thanks for the advice, I sent him a note on LinkedIn.
joshmn··on Lessons from Growing a Piracy Streaming Site
The typical ones were things like MMA/UFC/boxing, and those I'd say no to because their business model revolves around PPV; things like NCAA sports I said no to because I refused to profit off children (NIL didn't exist at the time) and that the implementation would have required me to "integrate" more than 5 different services just to attempt parity; I'd get the occasional EPL or UEFA requests, too.

I really didn't have any significant demand for these. One of my litmus tests, besides demand, was "okay, can this be as good as the other sports' implementations?" I was always concerned about feature parity—I could have provided radio feeds for MLB but not for NBA, and that would cause people to say "well they have radio feeds for x but not y" and create confusion as to what is what. Being consistent in this regard was important.

The run-of-the-mill IPTV requests came and went, and I just wasn't interested in that. Ultimately I made the site for me so I could watch sports, I just had some other people watching with me.

joshmn··on Lessons from Growing a Piracy Streaming Site
Thanks for asking. No, not yet, I'm working on introducing myself to their legal team with hopes that they might be able to take that as serious enough to believe I am me.
joshmn··on Lessons from Growing a Piracy Streaming Site
It wasn't about the money whatsoever.
joshmn··on Lessons from Growing a Piracy Streaming Site
That was one of the lessons I took away was that not every customer is a good customer. While I did have really accessible customer service, I didn’t want to be everything to anyone, even if it left money on the table. The quirks and features of the site where enough for the typical Reddit user (at the time) to discern, more so than those who were accustomed to official services, sports or otherwise.
joshmn··on Lessons from Growing a Piracy Streaming Site
The bug couldn't have had less to do with streaming, and in the wrong hands would have been worth a significant amount of money—exponentially more than what the Shopify CVE calculator spit out and I replied with at the time. There's more here: https://prison.josh.mn/charges

There's a lot of nuance, and what was ultimately reported about the bug isn't how things played out—there's tons of context missing. I won't talk more of the bug, or the handling of situation. I realize it was the leading headline (more so than the "guy had streaming website") but it was, in my opinion, also the most far-fetched.

joshmn··on Lessons from Growing a Piracy Streaming Site
It's a bit vague, I'll admit. Users in this space are typically plagued by poorly written emails, or emails that are still, "Hello," if any greeting at all; they also often come from noreplys and close you off from the operator.

By presenting myself as, well, myself, having an informal tone (I mentioned to another user that I talked to everyone as if they were a friend of a friend), and always closing with "if you need anything just reply :)," it was a good way to reach users and to establish the human element.

joshmn··on Lessons from Growing a Piracy Streaming Site
I've thought about this a lot. My takeaway is that it's incredibly hard to scale personality—which I have in spades—and even more difficult to give the freedoms for each customer support individual to operate equally as themselves.

You can't build a playbook for friendliness, and people have bad days which they certainly can drag into work. I am guilty of this, too. The proceeding week after my mom died I was rather terse, and have some uncomfortable memories of being short and not living up to my own standards. I went so far as to tell the person my situation and they told me that because I'm providing a service I have to do better. This user in particular was relatively new. If I recall correctly, he churned.

joshmn··on Lessons from Growing a Piracy Streaming Site
I replied to another comment about further context: https://news.ycombinator.com/item?id=45845763

In short, I made sure that the subject matter was right—"how can I stream the Lakers when I am in Los Angeles"—and that there was no schilling. I ensured that users were otherwise active in the communities that they were posting in, and that it wasn't just spamming referral links. Everything had to be tasteful or I'd kick them off the platform, which happened once after the person told me they were going to do it anyway.

joshmn··on Lessons from Growing a Piracy Streaming Site
It started as a proof of concept and graduated to a free site, and eventually I put a paywall up to see if anyone would be willing to pay. Internally, I hoped nobody would—I wanted to have a social life and not be beholden to old men telling me their ghetto streaming site was broken—and I expected nobody would.

The first purchase was for $100 on a "pay what you think it's worth" model, and after watching the value that others were willing to pay, I had a good idea as to what I would ultimately charge.

joshmn··on Lessons from Growing a Piracy Streaming Site
Oh, that's gross. Mine weren't that fun. They were more informal and usually self-deprecating (within good taste).

The closest to that was the quarterly newsletter: I'd highlight the awful and frustrating bugs that nobody saw, and some of the funny emails I got.

joshmn··on Lessons from Growing a Piracy Streaming Site
This one was really important to me. Even the transactional emails were a bit fun to read. I kept them informal, as if I was talking to a friend of a friend. I certainly swore in them, too (at myself), when I was apologizing for things not working right.

Occasionally I'd get replies saying that the person looked forward to me automatically emailing them. That was a good litmus test.

joshmn··on Lessons from Growing a Piracy Streaming Site
Thanks for the sentiment.

The last quote in particular is rather timely: on Wednesday I "came out" to the entire company that I work for with a cheeky slideshow, which started as an "about me" during an all-hands ("look, we have a new employee!") and then was like, "oh yeah also..."

Being able to shape the narrative and tell my side of the story before someone sees some of the slanted reporting has continued to prove helpful. I even went so far as to say "I know people Google their colleagues sometimes and that's cool just be aware that the truth is usually in the middle of what the DOJ says and what actually happened."

joshmn··on Lessons from Growing a Piracy Streaming Site
I’m sorry you got the idea that my users were spamming Reddit with referral links. It was hardly like that and I personally checked that every user was being tasteful, and sent “don’t spam” only a handful of times. I had alerts setup for each source of referrer (via analytics) and for each one that came from reddit (parsed by the ID of the post) I'd individually check to ensure that it wasn't "bad," and that the user wasn't just schilling—if an unreasonable (see: 3) last comments were slinging a referral link, I'd straight up ask them to remove them.

That probably doesn’t change your perception—I, too, feel like Reddit is pretty bad these days—but I felt the need to say something anyway. I ran a pretty tight ship and had placed a lot of importance on perception and reputation. Building trust was important to my operation, from both a growth standpoint and a customer service standpoint. When shit broke (as it often did, considering I operated as the mouse instead of the cat), my users took my word that an attempted fix was in the works.

joshmn··on Lessons from Growing a Piracy Streaming Site
This is relatively new and an interesting business model. There’s also “piracy as a service” https://torrentfreak.com/hollywood-and-netflix-signal-piracy...
joshmn··on Lessons from Growing a Piracy Streaming Site
My experience in finding one (15 people at the company I’m currently at, and I’m one of 3.5 engineers) (.5 because founder still codes more than we’d like him to) was effectively reaching out to companies that I knew didn’t have job postings up, and was the size that I’d fit into. I learned quickly that not every vacancy is posted publicly.
joshmn··on Lessons from Growing a Piracy Streaming Site
The big draw here was bypassing geoblocking that you couldn’t otherwise buy your way out of legally.
joshmn··on Lessons from Growing a Piracy Streaming Site
Author here. This is funny to wake up to. A version of this microsite was posted previously (https://news.ycombinator.com/item?id=45434062) though it didn't have much of the content that exists here.

If anyone has any general questions (it seems like my little “startup lessons” page is as popular as the others) I’m be happy to answer them as long as they’re not too technical or related to my finances. However, the specifics of the technical side of my site are best found on TorrentFreak, and, in short: curl commands.

joshmn··on FBI tries to unmask owner of archive.is
Hi Chocalot,

I also found it underwhelming, though I'd like to think I’m the most scrutinizing of the subject matter. There's some nuance between my take on my behavior and the profiler's, but I'll give them the benefit of the doubt—they only had my Reddit posts to go on and had to package that for investigators.

I still tend to trust by default and make witty comments or jabs that sometimes land flat, so the article was accurate in that sense.

As for talking to the undercover, I made a point of keeping no secrets about my site's technical implementation. Between me and some "competitors," I was usually the first to respond to upstream provider changes—I'd even share my findings without expecting anything in return. Anyone could’ve asked about my issues, and I would've told them.

Trust is the most valued currency in the piracy world, and I worked hard to earn it with both peers and customers. Acting otherwise would've gone against that—and against my own morals. My being neurodivergent may also be worth noting in my willingness (or unwillingness from a free-will perspective) to trust others.

Technically speaking, the site worked by reverse-engineering the league's official streaming services—a few curl requests, careful observation of responses, and adapting them to my needs. There's more to it, of course, but my 2016 MVP was barely 50 lines of Ruby and a plain HTML file. TorrentFreak got some of the details right.

joshmn··on FBI tries to unmask owner of archive.is
Feel free to reach out with thoughts. :)
joshmn··on FBI tries to unmask owner of archive.is
The case study: https://ieeexplore.ieee.org/document/10628922/
← PreviousPage 2 of 34Next →