Hacker Newsnew | past | comments | ask | show | jobs | submit | _w8sy's commentslogin

1. Fent is not an RC, it is used in medicine 2. It's strongly regulated


The story provides a figure depicting the structural formula of actual fentanyl, and next to it similar fentanyl-like molecules that are being trafficked.

Caption: "Yan Xiaobing was indicted for distributing these similar compounds; making slight changes to the molecular structure can have unpredictable effects on potency."

Also: [I]n recent years, rogue chemists have unearthed instructions for analogues that researchers discovered decades ago but never put into legitimate use.

While Chinese authorities control fentanyl, they’ve been slow to ban new analogues.


Tweet [0] Says only 24Hrs notice given? can anyone confirm this?

[0] https://twitter.com/MalwareJake/status/973567705142853632


He appears to be trying to justify it, badly, by insinuating AMD did the same by breaking the meldown/spectre embargo. https://twitter.com/MalwareJake/status/973569779419160576


These tweets to give the impression the team behind "AMDFlaws.com" are either

A) incompetent,

B) jerks or

C) all of the above

Post Scriptum: I've archived both tweets here; https://archive.is/bqQRT https://archive.is/z1wgy

Just in case.


Every time a market has been taken down it's been due to OPSEC failure and other information leaks (e.g. Silk Road captcha IP leak, DPR's advertising of market being linked to his personal email address). AlphaBay Which got taken down first in this operation was due to a personal email being included in the header of the welcome email sent out to new users 3 years ago [1]

[1] https://www.justice.gov/opa/press-release/file/982821/downlo... (pdf)


> Every time a market has been taken down it's been due to OPSEC failure and other information leaks (

This is true, but it dangerously misses the point. Every time someone gets taken down, the know-it-alls on various fora sneer and go "Ha! What terrible opsec! I wouldn't have made that mistake!" No, you would've made some other mistake.

To run a darknet market and not get caught, your opsec has to be perfect. Every second, every minute, every day, every person involved, forever. That is simply not possible once an operation exceeds a certain size. Like the IRA once said: "We only need to be lucky once. You need to be lucky every time". This is the "defender's dilemma" that guarantees you will be caught as t goes to infinity: sooner or later, you'll make some mistake that burns you.

Focusing on the specific mistakes made by bust-ees only boosts your confidence and ignores that you, in their situation, would've leaked information somewhere else.


I'm sorry to nitpick and I mostly agree with you, but similar to a casino game that favors the house, if you are lucky and quit while you're ahead, you can avoid capture. Your statement is only true in the long run. Of course criminals usually become addicted to their risky behaviors just like gamblers... It's a frequent trope in crime movies: one last job before the criminal retires, but that last job is the one where he makes a key mistake.


This is a very superficial way to look at things, and ultimately, entirely wrong.

One of the cornerstones of OPSEC is persona creation & management. This is orders of magnitude easier to perform in cyberspace than in real life, and can be used as a catch-all safety -- for exactly when mistakes are made and layers are compromised --.

You will make many many mistakes, but part of a well-implemented OPSEC strategy, is to have those mistakes land in a compartment, an illusionary persona that you created out of thin air. Operation size has nothing to do with it and should be completely irrelevant when the compartmentation strategy used is solid.


> That is simply not possible once an operation exceeds a certain size.

A good argument for not getting too greedy and keeping things small. It's the nail that sticks out that gets hammered down.


These opsec failures that you're talking about are very easy to find in the process of parallel construction.

So that these are the stated reasons is no indication that they are the real reasons.

They are, in fact, so very, very convenient the they smell like parallel construction to me.

Might not be, but they certainly aren't good evidence that parallel construction isn't going on.


>Might not be, but they certainly aren't good evidence that parallel construction isn't going on.

On the other hand, the evidence that parallel construction is going on appears to be a belief that everything is parallel construction.


But where did they get the 3 year old email.

1) They were investigating AlphaBay for nearly 3 years 2) They came upon somehow control of an email address which contained 3 year old mail that contained the password reset email 3) They are capturing and storing large amounts of tor traffic much like the NSA does on clearnet see: xkeyscore

This isn't really explained in the indictment


Apparently, he leaked the email address in an early email sent to site users. It contained his real first name and birth year, and he used the address on several other sites.

When he was busted he was logged in to the site, and had several passwords/keys stored in plaintext on his machine.

Multiple OpSec failures.

Good analysis here: https://medium.com/@thegrugq/dark-net-trap-545ae5dd8476


They could have gained knowledge of the email address through classified means, and made up the email header story to hide their method of initially obtaining it.


This is a really interesting question. Knowing how they got access to such an old email from an external source.


Honestly it doesn't seem that interesting - browsing /r/DarkNetMarkets, dnstats and just signing up yourself is enough. I've signed up for a few for shits and giggles but never bought anything, browsing is pretty interesting. You just need to find one person like me who'd be willing to give them the email... not exactly hard.


Perhaps it's from someone they were investigating for other crimes. I mean, it doesn't seem beyond the realm of possibility that law enforcement were going after say, a drug dealer who was using the site to sell goods, and found the welcome email from the platform he or she was using in their inbox.

That seems like one plausible possibility.


This is my pet theory. A seller was busted and the emails were siezed. Seems like the most likely possibility.


Isn't it likely that a number of recipients did not delete that particular message? Also that a number of them sold drugs by mail order, not uncommonly a short lived profession?


I'm sure they sign up for every darknet site constantly.


The poll was legally binding, they had to leave. Not that politics isn't broken ofc. EDIT I was wrong


The referendum was not legally binding.


It would have been untenable, however, for a government to defy the will of the people as expressed in the referendum.


I have no desire to re-hash this particular argument, but the margin, 48/52 was very small. Very close to 50/50. And the turnout wasn't perfect. I've heard that only something like 30% of the eligible voters voted to leave.

There was no "will of the people". The people were undecided.


And then there's the fact that Britons settled in Europe didn't have a vote.

Whatever you can say about voting rights for overseas citizens in general elections, this vote was explicitly removing rights that they are currently exercising as part of EU membership — arguably they are the most affected by the outcome, yet were disenfranchised.


Indeed, it's frustrating to see it constantly said that the "decisive will of the British people" has spoken!


> It would have been untenable, however, for a government to defy the will of the people as expressed in the referendum.

I may have missed something but at no point was anything resembling the current 'plan' ever put forward to be considered as 'the will of the people'.


Bitcoin has inherit utility in allowing immutable and globally accessible data storage, people assign the rest of the value to it. Just like property, except if people with bigger guns come it doesn't matter as it will become theirs if they want


It's also highly mobile, unlike property. You can easily move more than 10k euros in BTC on a storage medium across borders without declaring anything.


Doesn't mean it cannot be surveillance software


> I do RF/Microwave circuit design


Thanks. (It was edited in.)


add a (2013) ?


Better a company that generates revenue than one that uses all it's money on growth and has billions $ negative. I hate this idea of a growth rate being "too slow", all it does is encourage monopolisation which is bad for people. Edit: spelling


Snapchat doesn't have earnings (they lost $514 million dollars in 2016) so they really need to demonstrate ongoing growth in either number of users or revenue per user.


I'd honestly be curious to why this comment is being downvoted so much, as I've often found myself agreeing with this refrain.

To pre-answer the common rebuttal I get, that VCs are taking moonshots at the chance of a VERY HIGH return; I'd ask why not look at VC investments in the sense of a more traditional portfolio, where you'd have your growth stocks, your value stocks, etc. If I could find a vehicle that reliably gave 20% YOY I'd throw fistfulls of money at it.

So can someone enlighten me as to why this isn't a viable way of looking at VC investment?


It's not a viable way to look at investing in ad companies. Advertising has historically been zero-sum (about 2% of the economy), and there's huge returns to scale (more data, bigger advertisers, etc). Unless your inventory is unique (which it isn't), you need reach (which is why TV is/was such a great platform). Look at Twitter, which is having a extremely difficult time w/ ads because of that lack of scale.

In ads, you want to be GOOG/FB, not TWTR.


>id honestly be curious to why this comment is being downvoted so much

Because it confuses revenues and earnings? It defends Snap chat for not having "negative billions" when, in fact, it is has negative billions.


Or because they have phones they are using them to communicate instead


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: