5,198 karma · joined April 15, 2013
I went to federal prison for hacking and internet piracy. Speaker at SLEUTHCON and InterCOP hosted by Interpol.
Aimless thoughts at https://josh.mn; prison stuff at https://josh.mn/prison.
Email is hn@the above domain.
meet.hn/city/us-Minneapolis
I was having a conversation with someone about OpenClaw, and they proposed this idea of OpenClaw being used for inventory tracking at the retail-level. I let them continue. They said it'd be the best option for tracking when purchases are made and what SKUs are sold at what time of day. They weren't talking about prompting, they were talking about it as a data store.
I didn't bother mentioning how long this problem had been solved.
It's not you being a curmudgeon.
I'm very disappointed to not have made the list—going to federal prison for 18 months didn't help my score.
I live in Minnesota. This is my backyard.
mostly about the federal prison system (for which i am an alumnus) and ruby. some essays about autism, too.
The level of persistence these guys went through to phish at scale is astounding—which is how they gained most of their access. They’d otherwise look up API endpoints on GitHub and see if there were any leaked keys (he wasn’t fond of GitHub's automated scanner).
https://www.justice.gov/usao-wdwa/pr/member-notorious-intern...
I really didn't have any significant demand for these. One of my litmus tests, besides demand, was "okay, can this be as good as the other sports' implementations?" I was always concerned about feature parity—I could have provided radio feeds for MLB but not for NBA, and that would cause people to say "well they have radio feeds for x but not y" and create confusion as to what is what. Being consistent in this regard was important.
The run-of-the-mill IPTV requests came and went, and I just wasn't interested in that. Ultimately I made the site for me so I could watch sports, I just had some other people watching with me.
There's a lot of nuance, and what was ultimately reported about the bug isn't how things played out—there's tons of context missing. I won't talk more of the bug, or the handling of situation. I realize it was the leading headline (more so than the "guy had streaming website") but it was, in my opinion, also the most far-fetched.
By presenting myself as, well, myself, having an informal tone (I mentioned to another user that I talked to everyone as if they were a friend of a friend), and always closing with "if you need anything just reply :)," it was a good way to reach users and to establish the human element.
You can't build a playbook for friendliness, and people have bad days which they certainly can drag into work. I am guilty of this, too. The proceeding week after my mom died I was rather terse, and have some uncomfortable memories of being short and not living up to my own standards. I went so far as to tell the person my situation and they told me that because I'm providing a service I have to do better. This user in particular was relatively new. If I recall correctly, he churned.
In short, I made sure that the subject matter was right—"how can I stream the Lakers when I am in Los Angeles"—and that there was no schilling. I ensured that users were otherwise active in the communities that they were posting in, and that it wasn't just spamming referral links. Everything had to be tasteful or I'd kick them off the platform, which happened once after the person told me they were going to do it anyway.
The first purchase was for $100 on a "pay what you think it's worth" model, and after watching the value that others were willing to pay, I had a good idea as to what I would ultimately charge.
The closest to that was the quarterly newsletter: I'd highlight the awful and frustrating bugs that nobody saw, and some of the funny emails I got.
Occasionally I'd get replies saying that the person looked forward to me automatically emailing them. That was a good litmus test.
The last quote in particular is rather timely: on Wednesday I "came out" to the entire company that I work for with a cheeky slideshow, which started as an "about me" during an all-hands ("look, we have a new employee!") and then was like, "oh yeah also..."
Being able to shape the narrative and tell my side of the story before someone sees some of the slanted reporting has continued to prove helpful. I even went so far as to say "I know people Google their colleagues sometimes and that's cool just be aware that the truth is usually in the middle of what the DOJ says and what actually happened."
That probably doesn’t change your perception—I, too, feel like Reddit is pretty bad these days—but I felt the need to say something anyway. I ran a pretty tight ship and had placed a lot of importance on perception and reputation. Building trust was important to my operation, from both a growth standpoint and a customer service standpoint. When shit broke (as it often did, considering I operated as the mouse instead of the cat), my users took my word that an attempted fix was in the works.
If anyone has any general questions (it seems like my little “startup lessons” page is as popular as the others) I’m be happy to answer them as long as they’re not too technical or related to my finances. However, the specifics of the technical side of my site are best found on TorrentFreak, and, in short: curl commands.
I also found it underwhelming, though I'd like to think I’m the most scrutinizing of the subject matter. There's some nuance between my take on my behavior and the profiler's, but I'll give them the benefit of the doubt—they only had my Reddit posts to go on and had to package that for investigators.
I still tend to trust by default and make witty comments or jabs that sometimes land flat, so the article was accurate in that sense.
As for talking to the undercover, I made a point of keeping no secrets about my site's technical implementation. Between me and some "competitors," I was usually the first to respond to upstream provider changes—I'd even share my findings without expecting anything in return. Anyone could’ve asked about my issues, and I would've told them.
Trust is the most valued currency in the piracy world, and I worked hard to earn it with both peers and customers. Acting otherwise would've gone against that—and against my own morals. My being neurodivergent may also be worth noting in my willingness (or unwillingness from a free-will perspective) to trust others.
Technically speaking, the site worked by reverse-engineering the league's official streaming services—a few curl requests, careful observation of responses, and adapting them to my needs. There's more to it, of course, but my 2016 MVP was barely 50 lines of Ruby and a plain HTML file. TorrentFreak got some of the details right.