Comments URL: https://news.ycombinator.com/item?id=48036420

Points: 2

# Comments: 1

Additionally, it looks like Pingdom/Solarwinds authentication is affected too - not a great look for a service in that category.

Comments URL: https://news.ycombinator.com/item?id=44673891

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=43455155

Points: 2

# Comments: 1

Comments URL: https://news.ycombinator.com/item?id=40753746

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=40753254

Points: 2

# Comments: 1

Obviously it's upsetting to have our API used by a scammer, but our service couldn't have been involved in this hack beyond fetching a JSON-formatted response of up-to-date exchange rates because that's the only functionality our service/domain provides.

My guess is that the scammer implemented a call to our API to fetch up-to-date exchange rates in order to make their fake wallet seem more plausible & real. Interestingly my API doesn't even support any exchange rates involving cryptocurrencies and so the scammer would have had to additionally integrate with a different API to get something like the up-to-date exchange rate between BTC and USD.

The API is a very simple service - it's just a few endpoints that supply JSON formatted exchange rates over HTTPS. Anyone with an email address can sign up to use the service for free and there are even some totally "open access" endpoints that don't require any authentication. One of these has been used in the GNU `units` converter software for a while.

With regard to proving it's a legitimate service, this is the point where I wish I had made more progress with the landing page update that emphasizes social proof I've been working on recently! The API is used by ICs/teams at hundreds of recognizable companies. There are tens of thousands of free users including some that have used the API consistently for free for over a decade. I guess you could check many instances of the service being archived on the wayback machine? https://web.archive.org/web/20240000000000*/https://www.exch... I'll definitely admit the domain does look a bit odd but back in 2010 when registering it the "Exact Match Domain" bonus was a big factor for SEO. The site has been a top 3 Google result for "exchange rate api" pretty consistently - presumably also how the scammer ended up using the service.

I've used Cloudflare since approx. 2019 and their "cloudflared" tunnel infrastructure since approx. 2021 to secure servers against DDoS.

I'll contact popey to see if we can get more details on the exact path/request they saw being made to our domain and if that leads to any further information or logging from our side.

The line "The two mega coal power stations have been beset with issues as well" even radically undersells just how much of a debacle these two power stations have been. They were supposed to be the 8th/9th biggest coal stations in the world & accurately sized to solve the pending shortages in time, the major contracts went to legitimate companies like Alstom, GE & Hitachi. They were supposed to take approx. 5 years from 2007 and cost a reasonable approx. R30 billion each.

What's actually happened is that 15 years later neither is fully operational and the money spent has crossed 10x the original plans. The parts of the stations that currently do work are hamstrung by massive and debilitating design flaws that regularly cause trips or bigger issues (e.g. a smoke stack collapse last month) and there is no clear end for the construction in site even after all this time & money. And these aren't complex nuclear plants - these are just standard coal power stations. How to build them is quite well understood by now!

It's a combination of sustained and massive corruption (every now and then the current administration finds a few extra billion to recoup from a corrupt contractor), poor original designs that have complicated every subsequent step in the waterfall chart and finally unfortunate incompetence (for instance one of the 6 units at Medupi was entirely blown up after hydrogen wasn't vented before maintenance. The entire generator room must now be replaced with new parts from France at the cost of multiple billions of rands and over a year and a half of additional delay).

Finally, w.r.t. the reforms mention in parent comment's final line - I think they have a chance. South Africa has previously had a radically regulated energy sector. Basically you couldn't generate your own power, period. But due to the pressing political weight of the current situation there have been increasing steps away from the ideological commitment to exclusively state run coal powered grid. Large energy users and businesses can now do paperwork for approval to run their own multi-megawatt stations and basically every big factory, mine, mill etc. is now doing this to varying degrees. The big mining houses especially will spend a lot of money building their own infrastructure now. Between allowing the grid to buy private power (a lot of which is affordably priced renewable energy) and a lot of heavy demand starting to make its own power I think there's a fair chance things will stabilize in the next 2 years. The big question is electoral conferences and the next elections. If EFF wins meaningful electoral power there is a strong chance SA will go the route of Venezuela quicker than people think - and I say that as someone who is very committed to staying here and doesn't subscribe to most of the negative takes people can have about SA.

Accordingly there have been big govt. subsidies for geyser timers to put on your DB and solar geysers to try reduce this effect. Big information campaigns about not running the geyser all the time etc.

The consequences can be substantial, the city electricity depts. have to continually deal with substations and local transformers blowing up (literally, in an explosion, I've seen the aftermath!) because of the demand surges. Some areas are exempted from the scheduled cuts in my city to preserve older infrastructure.

Additionally, insurance companies report big spikes in claims from devices being damaged due to the unstable power as it reconnects. In my house everything is behind varying levels of surge protection, and interestingly I actually have SA made surge plugs that don't pass power through for the first 5 minutes after powering back on. This way my fridge compressor won't be damaged by unstable power (e.g. sudden substantially lower voltage, or a surge) as the scheduled cut ends.

Of course it's not the biggest crisis because grid-level electricity usage spikes overwhelmingly at morning and evening peaks. So if you can use the power cut schedules to shift demand away from these peaks, even if the batteries reduce the efficiency a bit, you're still having a substantial effect on the required peak grid power.

Due to how long these power cuts have persisted a lot of businesses, industry and the middle class & up have almost habituated to the levels up to 4. Shopping centers have generators, business parks have full solar and retail stores have battery backup. For instance a local clothing chain (Foschini) installed 300+ Tesla powerwall setups so that all their locations can be totally uninterrupted even with 2.5/5/7.5 hours per day of power cuts. Cell towers, fiber infrastructure, hospitals, even traffic lights at busy intersections all have battery backup these days.

The reason this announcement is making the news is because levels above 4, like the two weeks or so of stage 6 we recently had are much more problematic. You start to run into issues where cell tower batteries can only charge like 80% back up with the number of hours powered per day - and so after a few days they no longer have enough charge to keep up with the interruptions and go offline, disrupting communications & internet access.

Additionally the provisions heavy industry has made over the years to deal with this become insufficient and you start to lose shifts and thus there's a lot of evidence the economy is very materially affected at these levels of cuts.

Of course the real weight of this crisis lands massively on the poor and disrupts job growth when it's desperately needed, curtails foreign and local investment etc. To discuss how parts of society can easily function with the lower stages of power cuts is not to miss how insane this all is... A society of 60 million people has largely stood by while this has happened for approx. 15 years now. And it's not like this is a matter of a poor nation without the ability to invest - approximately $40 billion USD has been spent by the power utility just in capex alone in this period - and afterwards they are producing less power than at the start... Quote from a local article: "It means that Eskom destroyed 46 GWh of power generation per R1 billion spent on increasing its power generation." [1]

[1] https://mybroadband.co.za/news/investing/465641-eskom-blew-r...

So it's either referring to how many pairs they support or the marketing is over reaching a fair amount...

The product isn't available to use - it baits you into putting your email address in but then just tells you that you've been added to a waitlist.

Secondly, there are so many APIs like this. There are a few that are reliable and have been around for years - but there is an endless churn of new ones created, barely maintained and then abandoned. What is different about this one? There doesn't seem to be anything new about it or any specific reasons to think it isn't just yet another cloned SaaS product being "growth hacked" on HN.