Obscurity: Does Changing Your SSH Port Lower Your Risk? - <AUTHOR> http://danielmiessler.com/blog/security-and-obscurity-does-changing-your-ssh-port-lower-your-risk <comment><USER3> Even if it didn't, it lowers the number of log entries, failed attempts, and number of connections by several orders of magnitude. I've never regretted doing it though I pick a far more obscure port than this. None of my clients have had issues with me doing this either and sshagent makes it transparent to me.

It's the equivalent of moving your main door to the back of your house. Far fewer people will knock, even though burglars can still get in.

<comment><USER4> Glad you mentioned choosing a obscure port. Not that 24 is wrong though <1024 are reserved for various protocols so usually I tend to select ports above this reserved range. Never know when you decide to roll out say mail on 25 and sure enough find out your ssh port is running on 25.

<comment><USER5> If you're running a multi-user server, with possibly malicious users, that's not a good idea. Ports <1024 can only be bound to by root; so if a valid user of the server can figure out how to crash sshd, he can run his own version on the same port >1024, and then all your users' password are belong to him.

<comment><USER3> When I read your comment, I thought "surely you couldn't rig up a fake sshd to steal passwords" thinking the protocol wouldn't send passwords in plaintext but instead some hashing would take place. I read the RFC and, wow, it does send plaintext (though it's over an encrypted transport). Ouch..

<comment><USER6> Any client that has the server's public key in their known_hosts will throw up a big fat error.

</comment></comment></comment></comment></comment><comment><USER7> Not being on port 22 raises the bar for getting into your server slightly, but as both the article and others here point out, you still get connections.

That means:

\- If you have a guessable user name / password, you will still get hacked, and probably also by more determined people - which leads to:

\- Those determined to get into _your_ server will be delayed a few _seconds_ , at most.

It's fine, do it, but only to get the bulk of the automated attacks out of your firewall / logs. If you're uncomfortable running SSH on port 22, your setup isn't safe enough, and switching ports is just putting a band-aid on an infected wound.

Hints:

\- Root can't login from SSH. Use sudo.

\- Public key only.

\- If you have multiple servers, only one can accept SSH connections from the world. Preferably not in the same IP-subnet, much less domain, as any public facing server. Use this as gateway to other servers.

\- IP whitelist, if practical.

<comment><USER8> If you can log in as account xyz over SSH, and account xyz has permission to do anything with sudo, how is that more secure than letting root log in over SSH?

<comment><USER9> If root can log in, the username is definitely known to the attacker and they must figure out the password. If root can't log in, the username of someone with an entry in sudoers probably isn't known to the attacker, so they must figure out both the username and password.

<comment><USER8> I do like this answer, but I'll also point out that making someone guess two strings is just as secure as making them guess one long string. If root has a random 10-char password, that's roughly the same number of guesses as a user's first name with an 8-char password.

<comment><USER10> Unless they can read the shadow file somehow, or a specific user attack vector makes it somewhat easier than complete guessing...

</comment></comment></comment></comment></comment><comment><USER11> I've always moved my server ports to the 10,000+ range. The number of connections is trivial.

In conjunction with the following, I've had virtually no issues:

Port 22222 #Easy to remember, rarely hit. Even if it does get hit, it takes them a little longer to scan up to this range. Move it higher if you want.

Protocol 2 #NO EXCEPTIONS!

LoginGraceTime: 60 #seconds. If you need more than 60 seconds, you're probably doing it wrong. Change to 30 if your host is fast.

PermitRootLogin No #self explanatory. No means no.

AllowUsers jefe78 otherguy #this should help if you use obscure user names

Now, combine that with denyhosts <http://centoshelp.org/security/denyhosts/> and some really strict configs and you should be better off than you were.

</comment><comment><USER12> My advice, and I've been doing security for about 10 years now, run SSH on the normal SSH ports. Keep it patched. Install a good password policy. Centralize your accounts in an LDAP database. And then, perhaps restrict the SSH access to the few accounts or users that really need it. Perhaps you could use a jump host..

The obscurity approach doesn't actually increase security, it does increase the difficulty to use and diagnose things (it's just another step to remember and your network is just a little bit different form everybody else') and it might give you some artificial sense of being more secure. Plus there are off the shelf tools that can monitor and even dynamically repair those attacks on the fly (IPS products) and when you start using different ports those tools don't all work the same way and some won't work at all, in that case the obscurity would actually reduce your security and reduce the effectiveness of other tools you use for security.

<comment><AUTHOR> The military disagrees, that's why they paint their tanks to match their surroundings.

If you're saying that you could get confused and the hassle is worth more than the gain, that's one thing, but to say that there's no benefit is false.

<comment><USER13> Quite honestly at worst you'll just keep out clueless script kiddies, but a determined person can _still_ find your SSH port. It's also worth noting that your server isn't going to launch a 105mm depleted-uranium tank shell in the face of some unscrupulous port-scanner :)

<comment><USER14> Number of clueless script kiddies far, far, far outweigh number of determined people after my particular server.

Reducing risk of actual threats == security.

Dogma, let it go.

<comment><USER13> Fair enough regarding making the port harder to find, but I hope it's not your only countermeasure.

</comment></comment></comment></comment></comment><comment><USER15> This is a failed study.

He should have removed "Port 22" from the config file to get any significant results. Right now it only says that if an attacker gets an SSH-like answer on port 22, it's very unlikely he'll try on port 24 as well.

This is unhelpful because if there's a bug in OpenSSH, then even an OpenSSH "reject all on port 22" configuration* might be compromised.

I think it's very much more likely that an attacker, when not getting any answer (or being instantly rejected) on port 22, will portscan the server to see if any other ports are open, and _then_ try the non-standard port, which in this case is 24.

* I'm unsure if this is possible in SSH (like reject all root logins), but anything non-standard might trigger the "no SSH @ 22" response, so I'm hypothesizing a best-case-scenario config.

<comment><AUTHOR> You're assuming a human attacker, which is not the case for the vast majority of probes and attacks. Bad guys don't generally sit there with a port scanner going from IP to IP.

This is all scripted stuff we're talking about.

<comment><USER16> Scripts can't implement conditional behavior?

<comment><AUTHOR> It's not a matter of "can't"; it's a matter of "don't". My understanding is that scripts check a few places and move on. They're not AI-scripted human replacements that start scanning the entire Internet on all ports once they get an RST or a drop on 22.

</comment></comment></comment></comment><comment><USER17> This is generally well regarded security advice. Its what #ubuntu-server tends to recommend to people if they come in saying their SSH port is being attacked. Simply changing the port greatly reduces the number of attacks, and combined with IP blocking (automatic with fail2ban or similar) you are completely protected from these simplistic automated attacks.

<comment><USER18> Maybe I'm stating the obvious, but in my experience an obscure port number will limit the number of requests, AND you should have a hard firewall in front of it with IP blocking | filtering.

<comment><USER19> What advantage does having a hard firewall give you over using iptables?

<comment><USER18> Less load on the server, plus probably fewer vulnerabilies and simpler admin on the firewall device. I suppose your mileage will vary.

</comment></comment></comment></comment><comment><USER20> We changed our SSH port if only for the fact that fail2ban was showing up near the top of the list for CPU time while SSH was running on port 22. After moving SSH to another port, it's consistently at the bottom.

</comment><comment><USER21> Seems like all security tools are double edged swords. Lots of folks react against security-by-obscurity, because it can get overconfident fools hurt badly. Someone please name _any_ security tool that doesn't do this.

That said, first have your basic security squared away. Only then, layer that with just enough obscurity to avoid attention. By analogy, acquire your armored vehicle first, then drive it to your camouflaged hiding place. It doesn't matter if you avoid all but 1 of 10,000 shots, if shrapnel from that one shot kills you anyways.

</comment><comment><USER22> He should instead put ssh-faker ( <http://freshmeat.net/projects/ssh-faker/> ) in front of his sshd, and then any attempt to connect from an IP not already in /etc/hosts.allow will fail to even get to see his sshd, much less attempt to exploit it.

The advantage of ssh-faker is that if you are logging in remotely from somewhere that is not your normal haunt, you can remotely add an entry to /etc/hosts.allow to let yourself past the gate.

<comment><USER23> _"if you are logging in remotely from somewhere that is not your normal haunt, you can remotely add an entry to /etc/hosts.allow to let yourself past the gate"_

If you're "not in your normal haunt" and your attempts to log in are blocked by ssh-faker, then how are you going to "remotely add an entry to /etc/hosts.allow to let yourself past the gate"?

<comment><USER22> Because the way ssh-faker works, it sends an sshd connect string, just like a real sshd, but then waits for you to enter a secret ssh-faker passphrase. If you enter the passphrase, it adds the IP you are connecting from to /etc/hosts.allow and then disconnects. So you first telnet to your ssh port, enter your ssh-faker passphrase, then connect with ssh normally, and log in (hopefully with only key based auth).

<comment><USER23> So this requires you to first send a password in plain text (ie. unencrypted and open to anyone who sniffs the connection) before you can log in? Why telnet? This really makes no sense whatsoever.

Why not just require an extra ssh password? At least that way it couldn't be sniffed. And even that is simply ridiculous, as you could just use one password that's twice as long.

What am I not getting here?

<comment><USER22> It is not perfect. But then, nothing seldom is.

What it does protect from, given that most attackers will not have your ssh- faker password, is from the attackers obtaining any access to your sshd to try anything, be it a password scan or whatever. It is another layer in front that deflects all of the script kiddies, and many of the more intelligent attackers.

Why telnet? Because ssh-faker is not an sshd, and so you can't submit your password to it using ssh.

Perfect, no, another layer, yes. Kind of like having a lock on both your front gate and front door. Those who can't get through the gate lock can not ever attack the door lock. Those who can get through the gate lock still have to then attack the separate door lock.

</comment></comment></comment></comment></comment><comment><USER24> I'll just leave that here: <http://en.wikipedia.org/wiki/Port_knocking>

Not that I use or endorse it.

<comment><USER11> I've used and endorse it. Set it up to accept a knock sequence along the lines of:

Port 38378, 1292, 65000, in quick succession. IMPOSSIBLE a port scan will ever hit those ports in that order.

Have that sequence trigger a modification to your iptables or execute some script to modify sshd_config or whatever else. It works wonders and is another level of security.

<comment><USER25> Quite impossible, since TCP ports don't go past 65535. :)

</comment></comment></comment><comment><USER26> Port obscurity is pointless when there's much better ways to secure your host.

You should be running SSH with keys only, never with password authentication. Passwords are for encrypting your keys on your local machine and for sudo which is restricted to specific accounts. Source IP filters really slow you down, but may work in some circumstances.

As your network gets larger you'll need to restrict any inbound SSH and use a VPN to a firewall or bastion host and use something like puppet to distribute your ssh keys. Make sure you do two factor auth to the VPN with a password and at least some sort of key.

<comment><USER14> > Port obscurity is pointless when there's much better ways to secure your > host.

Good security is layered. This reduces attacks. Reducing attacks is better. Changing port is better than not changing port.

And most people posting here obviously didn't read the article because it clearly stated this was in addition to all the other security measures you put into ssh.

</comment></comment><comment><USER27> Well, SSH server is secured with `(username, auth_token, sshd_port)` 3-tuple, where `auth_token` is a password, public key, OTP or whatever else it may be. By changing the sshd port from default, one, indeed, would somehow increase security.

People tend to change sshd port so they won't get port scanned. It should be compared to hiding one apartment's door. However, the real annoyance is that after some bot detects sshd it starts brute-force attacking it. Compare it to thief standing in front of your door and trying to pick a lock for a long time. There are tools like denyhosts[1] and fail2ban[2] to prevent such abuse - N failed attempts and unless you're from a trusted network - you're banned.

The open question is whenever you gain something valuable, while giving up your convenience (you'll have to specify `-p` option or register every host in `$HOME/.ssh/config`)? Most security rightfully relies on `auth_token`, so first thing to do is to ensure it's strong enough. The rest of changes are relatively insignificant (just compare 4096 bits of your private key to 16 bits of port number).

I believe people care about their sshd port only because it's noisy in `auth.log` when they're attacked.

</comment><comment><USER16> Here's a philosophical question. Is choosing a strong password "security by obscurity"? A 20-character mixed-case random string is only more secure than the password "password" because so many users default to the latter, and to short words and dictionary words in general. But it's no easier to generate a rainbow table for an English dictionary than it is to generate one for an equally-sized subset of 20-character strings.

</comment><comment><USER28> What's even better is setting up an access sequence to allow you to connect to SSH.

In the past, our experiment had a server that was hit particularly hard with SSH attempts for some reason. So, you had to visit a page on port 8080, which would temporarily add your IP to an allow list, in which case you could then attempt to access ssh on port 22.

It works exceptionally good because port scanners usually start low :)

<comment><USER29> You've reinvented port knocking. Use SPA instead: <http://www.google.com/search?q=single+packet+authorization>

<comment><USER28> yeah I couldn't remember what it was called.

The reason we had it as a web page was because it was easier for the windows/putty crowd.

</comment></comment></comment><comment><USER30> There is another side to this risk. Perhaps you do lower the risk of compromise by changing your port. But you also increase the risk of locking yourself out somehow (especially if you use other tricks such as limiting IP ranges).

This may seem unlikely to you, but so is being compromised if you're security conscious, which you obviously are if you're thinking about changing the port (you'll stay up to date, disable password authentication, etc).

Most security problems occur when you overlook something. For example, you're far more likely to be compromised through a vulnerability in a web app you don't use a package manager for and so don't receive automatic updates for. Or through a user who set a weak password or compromised another machine with his key on it. And so on.

I think that on balance it makes little difference when you consider the real reasons why people get compromised.

</comment><comment><USER31> Of course it lowers your risk. Unauthorized users will make fewer connections, meaning fewer login attempts, meaning less of a chance of being compromised.

Following from that, of course you should do it. In the vast majority of cases it's no inconvenience (add a host block to your ~/.ssh/config file if you don't want to type out/remember the port), so you're talking about a change that's all upside.

It just doesn't get you off the hook for doing ANYTHING else in terms of security good practice. You don't get to use insecure passwords (in fact, preferably you're disallowing passwords entirely in your server config). You don't get to be lax about cleaning up unneeded accounts. You don't get to chmod everything 777 and ignore which binaries are SUID/SGID. You don't get to slack off patching your box.

</comment><comment><USER32> While I agree, you might be able to argue that the hits on an obscured port (24 in this example) come from more experienced hackers who would be more able to compromise your box. And potentially having a non conventional SSH port might be attractive. I.e. Whatever's behind this hidden door must be more valuable than what's behind this obvious door.

Overall though I think it would increase security... just might attract some trouble too.

</comment><comment><USER33> If you change the port, you are saying you know more than the average admin, and may have more interesting things on your server.

<comment><USER34> OK, that makes my brain hurt. (Not saying you're wrong...)

<comment><USER35> once you get the script kiddies out, all thats left are the mind games people. like the bad guy from hackers.

</comment></comment></comment><comment><USER36> I've got the SSH port on my webserver set to a random >1024 port, and I get at least 2-3 denyhosts emails per day.

<comment><USER37> You should not run a system service on a port below 1024. On unix-a-like systems there is usually a rule that a non privileged user can not listen on a port below 1024 - Apache and similar services do it by running as root or similar initially and dropping privileges once the port is open and ready.

If you run SSHd on a port over 1024 you increase the chance that an non- privileged user on your machine (a user on a shared host, or a compromised externally accessible application) might somehow crash your SSHd and launch its own to capture usernames/passwords or such.

Bots scanning for SSH on ports other than 22 will likely scan the whole 65536 range, not just the first 1024, so you don't get extra obscurity by using a higher port.

<comment><USER23> _"Bots scanning for SSH on ports other than 22 will likely scan the whole 65536 range, not just the first 1024, so you don't get extra obscurity by using a higher port."_

Do you have any statistics to back up that assertion? I'd expect most attackers to concentrate on ports below 1024, with proportionately fewer of them bothering to scan higher ports.

</comment></comment></comment><comment><USER38> My strategy for years has been to run SSH on port 22, visible only to hosts inside my local network via a firewall (iptables) rule. Connecting on port 22 is not allowed from the outside. SSH also listens on port 2222 and can be connected to from the outside, root logins are not permitted. Works great.

</comment><comment><USER39> > _The stats over the weekend were over 18,000 connections to port 22, and > five (5) to port 24_

In other words: yes, to random probers. Jury's out on non-random (my guess is no. If they're watching your network, and you _ever_ use the port, it'll get probed for vulnerabilities).

</comment><comment><USER40> Discussing obscurity in the security community is like talking to coffee aficionados about Starbucks.

Noneleless, if you can choose between being obscure or being a prominent potential target...

<comment><AUTHOR> That's precisely the attitude I was trying to address with the article. If you ask the top security people in the world, they agree that obscurity _can_ aid security if don't correctly.

Those who disagree with this outright are stuck with someone else's thoughts. Please read: <http://danielmiessler.com/study/security_and_obscurity/>

<comment><USER40> Wonderful explanation.

I never run SSH on port 22 on a publicly-visible computer when I can help it.

I thought it astounding that the idea sometimes meets with scoffing, seemingly with a presumption that such a practice must be the sum total of one's security precautions.

No matter how effective a security technique is, it can be shouted down as "taking minimal effort to overcome," "providing a false sense of security" or "not going to stop a determined attacker." Dude, I live in a Bayesian world, I just want to improve the probabilities. Then again, that must be effective rhetoric for getting consulting gigs.

</comment></comment></comment><comment><USER41> Yes. Obscurity works. I mean it's not perfect, but otherwise, why put camo paint on tanks? Why not just paint them bright pink and let them stand on their own defensive capabilities?

</comment><comment><USER42> If you filter IPs for sensitive services like ssh (and isn't that fairly standard practice) then I wouldn't expect there to be a real difference in risk level.

<comment><USER43> No doubt, IP filtering is the most secure plan. It's not feasible for many use cases however.

For instance, I have our servers only accessible to my work IP. However, that means I need to connect to them through there when I am not at work - <USER2> shops, hotels, my phone's dynamic IP - so my work server needs to be accessible to anywhere.

<comment><USER42> You don't use a VPN in those locations?

<comment><USER43> I'm not even sure what exactly a VPN is, to be honest. I use SSH and SSH tunneling to do everything.

<comment><USER42> The same result as an ssh tunnel just lower on the network stack. In your case it'd seem that you can filter all your servers except for your one tunnel/bounce host. A VPN host just wouldn't have anything else on it.

<comment><USER43> I should look into that. Thanks for the tip.

</comment></comment></comment></comment></comment></comment><comment><USER44> Here's another obscurity question: Does usings hosts files instead of public dns for domain lookup lower your risk?

<comment><USER45> no. if you're scanning for open ssh ports you just scan IP blocks, not host names.

<comment><USER46> At the same time, I wouldn't leave your domain names open to full listing from any host. Otherwise finding one correct login, rev-dns of the host and the whole list of your internal machines might cause many problems...

</comment></comment></comment><comment><USER47> There is definitely a benefit. However, don't feel too complacent about the perceived benefit.</comment>


Location, Location, Location - <AUTHOR> https://medium.com/the-biz-stone-collection/location-location-location-4715906faccc

<comment><AUTHOR> "It makes sense that Yahoo! got started in Silicon Valley, but that doesn't mean it's the best place for its future."</comment>


Kevin Rose making new friends in Portland, Oregon - <AUTHOR> http://www.oregonlive.com/front-porch/index.ssf/2014/06/google_executive_kevin_rose_pl.html <comment><USER2> One of the really cool things to see here in Italy is how good they are at completely tearing out the guts of a house and redoing it. They'll strip it down to the bricks and then re-add everything they tore out. It's interesting to observe, and nice too, to see something get fixed up rather than just bulldozed and rebuilt as happens with so much stuff in the United States.

That said, I know jack about what's actually involved technically, and I bet old wood houses (as are common in Oregon) are a lot harder to do that with than old brick homes.

<comment><USER3> Been there, late 1800's farmhouse. Patching or replacing plaster walls is messy and inconvenient, but the concept is pretty similar. We've not changed room layout though, so not sure how that goes. Shouldn't be much different unless you have a load bearing wall to move.

</comment></comment><comment><USER4> This title is so egregiously editorialized, and the post so borderline to begin with, that we're going to bury it rather than edit the title.

Submitters: it's against the rules to do this with titles on HN. Please don't.

</comment><comment><USER5> Can you begin to imagine how much Kevin Rose hates that article "How this kid made $60 million in 18 months."?

Which of course was utter bullshit and based on Digg's valuation being $300m+

The Oregon Live's thesis seems to be that this guy is so rich that he just doesn't give a damn.

But the reality appears to be they bought a $1.3m home, had maybe planned on a $300 - 400k remodel.

But instead likely got a $1m+ price tag to completely refurbish, and stabilize, a landmark building.

When price-per-square foot for new construction for something very nice might be $200 x 3,500 sq feet = $700,000

Not defending him, but I get it.

</comment><comment><USER6> Looks like he agreed to sell after all: [http://www.oregonlive.com/news/oregonian/steve_duin/index.ss...](http://www.oregonlive.com/news/oregonian/steve_duin/index.ssf/2014/06/steve_duin_breaking_- _google_e.html)

</comment><comment><AUTHOR> Kevin Rose has every right to do this, but the events leading up to it left a bad taste in the mouths of his future neighbors. I don't know why anyone would want to create and move into a hostile environment.

<comment><USER7> Or why you'd want to tear down such a nice house? Aren't there open lots in Portland?

<comment><USER8> In the article, it says he intended to renovate, but it turned out to cost millions and was more efficient to rebuild.

<comment><USER7> Doh, missed that part.</comment></comment></comment></comment>


UK detains journalists based on Anti-Terror Law - <AUTHOR> http://news.yahoo.com/court-dismisses-challenge-snowden-linked-detention-001317641.html

<comment><USER2> As David Miranda isn't a journalist then the OPs headline isn't accurate.

The more interesting question is why did he decide to fly though London with the leaked documents, why not choose a route through Spain or further south?

</comment><comment><USER3> Quoting for emphasis:

"I'm convinced they've hurt their own country far more than me with this ruling, as it emphasises what the world already knows: the UK has contempt for basic press freedoms." — David Miranda</comment>


Tell HN: Hacker News Atom Feed Provided by Kalimba - <AUTHOR> http://blog.embed.ly/kalimba-atom-feed

<comment><USER2> Don't forget the HN RSS feed with embedded articles (generated using Beautiful Soup): <http://www.nirmalpatel.com/hacks/hnrss.html>

</comment><comment><USER3> Could someone please tell me the simple RSS feed for the comments here on HN?

<comment><USER4> You can use one I hacked together ... only shows items with 20 or more upvotes to make the stream manageable. <http://hackernewsrss.heroku.com/></comment></comment>


Crowdfunding site for Tech Startups - <AUTHOR> http://bestowr.com

<comment><AUTHOR> We intend to use the same model as Kickstarter and specifically focus on tech startups. Kickstarter tends to focus more on Arts/Craft projects (including movies) and doesn't cater to tech startups unless they are creating a software/hardware hybrid like the Peeble smartwatch. Fundable uses a equity crowdfunding model which makes us different from them. Thanks for your question Cmrberry

</comment><comment><USER2> Can you talk a little bit about why this would be better than kickstarter or fundable?</comment>


Letting tools make choices - <AUTHOR> https://www.jackfranklin.co.uk/blog/letting-tools-make-choices/ <comment><USER2> Akin to his adventure, black [0] for Python does one thing and does it very well: It formats my code. It's pretty, it's legible, it's consistent, it works; and you cannot customise it. Has been a great experience since the day I switched from autopep8.

[0] [https://github.com/psf/black](https://github.com/psf/black)

</comment><comment><USER3> I've always struggled with this, on the one hand I recognize my productivity/efficiency increase.

On the other...

I feel like tooling that automatically makes decisions for you can be a crutch if you don't take the time to understand it.

It might be me getting older/grouchier but watching a dev use black or prettier because they don't know how/are too lazy to indent their code properly is frustrating for me.

Or when I see new devs pick up User.find(id) in rails and sticking to the ORM without learning a lick of SQL - I think to myself how they're selling themselves short.

But then I think, what don't I know that I'm selling my self short on? Do I really know _precisely_ how database storage works? or FS operations? Do I know the HTTP spec to the letter?

And I settle on the following: Any level of abstraction is fine - just try to identify what level you're on so you can go down if needed or up when a new level of convenience becomes available!

<comment><USER4> Similarly, I am embarrassed for devs who type their code in a coddling text editor because they are too ignorant to use ed, the standard text editor, properly.

Computers are for solving problems, not helping programmers, after all, right?

<comment><USER5> My sarcasm detector just exploded.

It's all a continuum. A great test for mid career programmers is solving a problem from a blank text file. Especially true for more languages with great IDEs like Java or C#

<comment><USER6> Interestingly, that's how I started coding and I'm still young(ish).

Borrowed a book from the library as a pre teen and followed along using notepad on my dad's computer.

I didn't see syntax highlighting or autocomplete until I was much older. So I can see why some people nowadays aren't concerned as much with things like indentation. Syntax highlighting adds another dimension of legibility. I couldn't imagine coding a website even just in plain old html without good indentation if there was no syntax highlighting.

</comment></comment></comment></comment><comment><USER7> This to me is what I really miss about Ruby on Rails being a more popular platform, way more than any of the metaprogramming magic or super-readable syntax. It made a ton of choices for you, which helped with productivity on teams more than anything else.

If you had a new developer coming onto a Rails project, there's no need to ask how logging is done, where models and controllers were stored, what the naming convention of database tables were, how assets are compiled, where to find tests or how to run them, how to start your application, or probably a hundred other little tiny decisions.

Sure, you have less control over things, but 90% of the time, that control doesn't matter, and you're making life more difficult for every other person who will ever read your code in the pursuit of what's often purely aesthetic.

<comment><USER8> It's the same reason I love Django (no tooling decisions to make) and hate "modern" JavaScript development (far to many options for small tools to construct a framework).

What is the opinionated framework of choice for front end work now? (Something that is all in like Django or Rails)

<comment><USER9> Maybe Ember.js - [https://emberjs.com](https://emberjs.com)

Yehuda Katz is Core Team Member of Ruby on Rails and Co-Creator of Ember.js [https://yehudakatz.com/projects/](https://yehudakatz.com/projects/)

</comment></comment></comment><comment><USER10> A coworker from a previous job said something along the lines of "How much work is getting done by teams debating tabs vs spaces?"

And it was in context of the decision being important but once it's made just go write code and ship a product.

One of the many reasons I immediately fell in love with Go.

<comment><USER11> _A coworker from a previous job said something along the lines of "How much work is getting done by teams debating tabs vs spaces?"_

That's a good question, but having agreed that such debates don't contribute much, you've got two ways to go: either enforce a standard, or "live and let live" (perhaps supported by strong-ish module ownership). I think it's unfortunate that the "live and let live" option seems to have largely fallen by the wayside over the past few years.

</comment></comment><comment><USER12> Great article.

In a similar vein, I first started with react years ago and spent MANY hours even trying to get the libraries working together. Complete nightmare. I put it down for a year or 2 until it matured to a level of stability that allowed me to ship without hassle.

In contrast during that time I picked up some Angular work which, because it was opinionated, was very very quick to get something up and running.

</comment><comment><USER13> I recently moved to a new team, and the project I've been assigned to was handcrafted and built by 'gut feeling'. I'm not familiar with the tech and tools and I'm having a hard time getting onboarded.

I'm exploring the possibility to migrate the code to an opinionated framework that gives guidelines on how to structure your code. Some people feel very strongly about these, but I've been warming to the idea of just following directions, particularly for new techs that I am not familiar with. I rather focus on the logic of the problem at hand rather than deciding where to put what and how to structure things.

</comment><comment><USER14> It looks like a case of analysis paralysis. Customize on use, not upfront. When I _write_ personal tools (throw-away scripts, more long-lived utilities etc.), it is not rare that I change my mind about how they should work after using them - even though I made each and every choice while coding them! You don't know what you need until you need it.</comment>


How Anonymous Shut Down Sites - <AUTHOR> http://gadgetwise.blogs.nytimes.com/2010/12/13/how-anonymous-shut-down-sites/?src=twr <comment><USER2> _Most botnets are operated by organized-crime groups_

And THAT is where I stopped reading.

<comment><USER3> Why did you stop reading there? That is the recent trend. Lots of the largest botnets have been connected with russian crime syndicates. No longer are botnets just crackers with free time on their hands.

<http://www.thetechherald.com/article.php/200912/3229>

</comment></comment><comment><USER4> LOIC also works under Mono on Linux. I tried it.</comment>


The Munger Operating System: How to Live a Life That Really Works - <AUTHOR> https://www.farnamstreetblog.com/2016/04/munger-operating-system/ <comment><AUTHOR> For me, this is gold - To get what you want, deserve what you want. Trust, success, and admiration are earned.</comment>


Sen. Feinstein calls Snowden's NSA leaks an 'act of treason' - <AUTHOR> http://thehill.com/blogs/defcon-hill/policy-and-strategy/304573-sen-feinstein-snowdens-leaks-are-treason

<comment><USER2> Feinstein needs to retire or be voted out of office. She's a disgrace to America and it's time for someone better to take her seat in Congress.

</comment><comment><USER3> How could she possibly come to the conclusion that what he did violates the Constitution? Has she even read it?

To simultaneously uphold and violate the Constitution on issues pertaining to the 4th amendment (or any other part of it for that matter), I think you have to be a member of one of the armed forces. He worked for the NSA as a contractor via Booz Allen. He was not under an oath to the Commander in Chief like Manning was. With this in mind, how could anything he has done be in violation of the Constitution? Is there some part of the Constitution I'm forgetting here?

</comment><comment><USER4> Isn't there a rocking chair calling her name?

Or does her husband have even more war-profiteering to pursue?

</comment><comment><USER5> With politicians like Feinstein who needs terrorists?

They're destroying the very foundation of America all by themselves.</comment>


Show HN: Draw Chrome Browser UI with HTML, JavaScript and CSS - <AUTHOR> https://medium.com/@pd4d10/chrome-browser-ui-built-with-web-technologies-4c57779f3eb1 <comment><USER2> What is the use case for this beyond phishing pages?</comment>


Nail: A practical tool for parsing and generating data formats (2014) [pdf] - <AUTHOR> https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-bangert.pdf <comment><USER2> I've always written non-generic code generators when dealing with a specific protocols that havelots of special case packages and inter-dependencies between different fields of a packet and the length and/or availability of other fields.

With generic approaches, I've always run into some specific constraint that could not be expressed declaratively, but I'll definitely look at this.

</comment><comment><USER3> Calligra uses this approach to parse most of the binary Microsoft Office files. The grammar for this is quite daunting. This approach has the advantage that there is clear separation between the content description and the parser generator. The parser generator can be improved separately. In Calligra this made it possible to work on speed and memory usage separately from the work of figuring out the actual file format.

[https://quickgit.kde.org/?p=binschema.git&a=blob&f=src%2Fmso...](https://quickgit.kde.org/?p=binschema.git&a=blob&f=src%2Fmso.xml)

</comment><comment><USER4> The foremost issue with abstract code generation systems based on DSLs (domain specific languages) often seems to be finding programmers (and project managers) who are willing to invest the time learning the syntax and (often obtuse/opaque) tooling. In this case, aside from the security benefits (6.3/p13), the performance graphs at the end of this paper (NailDNS vs. Bind9; 6.4/p14) should be a great motivator.

That said, relevant quotes affirm this type of approach aligns well with established wisdom:

 _The benefit of using [a formal specification language] is that it teaches you to think rigorously, to think precisely, and the important point is the precise thinking. So what you need to avoid at all costs is any language that 's all syntax and no semantics._ \- Leslie Lamport

 _One person 's data is another person's program._ \- Guy L. Steele, Jr.

 _Representation: Fold knowledge into data so program logic can be stupid and robust._ \- Eric S. Raymond, The Art of Unix Programming (2003)

 _Data Design > Code Design_

 _Get your data structures correct first, and the rest of the program will write itself._ \- David Jones

 _For 80 percent of all data sets, 95 percent of the information can be seen in a good graph._ \- William S. Cleveland, Bell Labs

 _Less than 10 percent of the code has to do with the ostensible purpose of the system; the rest deals with input-output, data validation, data structure maintenance, and other housekeeping._ \- Mary Shaw, Carnegie-Mellon University

 _Pike 's 4th Rule: Fancy algorithms are buggier than simple ones, and they're much harder to implement. Use simple algorithms as well as simple data structures._ \- Rob Pike, Notes on C Programming (1989)

 _Pike 's 5th Rule: Data dominates. If you've chosen the right data structures and organized things well, the algorithms will almost always be self-evident. Data structures, not algorithms, are central to programming._ \- Rob Pike, Notes on C Programming (1989)

... from my fortune clone ( _|grep data_ ) @ [https://github.com/globalcitizen/taoup](https://github.com/globalcitizen/taoup) ; I spoke at _Code Generation 2010_ (Cambridge, UK) but somewhat controversially for that environment do not support UML.

<comment><USER5> > The foremost issue with abstract code generation systems based on DSLs > (domain specific languages) often seems to be finding programmers (and > project managers) who are willing to invest the time learning the syntax and > (often obtuse/opaque) tooling.

I totally hear you on this as far as tech staff goes. However, if you can create a DSL that is writable and maintainable by non-tech staff, that's a huge win.</comment></comment>


Google and Facebook Race to Solve the Ancient Game of Go with AI - <AUTHOR> http://www.wired.com/2015/12/google-and-facebook-race-to-solve-the-ancient-game-of-go/ <comment><USER2> Very interesting. Would be a truly great milestone in history to have an algorithm that can beat humans at Go. Far more impressive than chess, IMO.</comment>


Google Voice Integrated Into Sprint Service - <AUTHOR> http://techcrunch.com/2011/03/21/complete-integration-of-google-voice-and-50-million-sprint-customers-plus-4g-nexus-s/

<comment><USER2> With the news that AT&T is buying T-Mobile, does Sprint move to position itself as a "cool, customer-oriented" mobile service?

</comment><comment><USER3> Brilliant maneuver by these two companies. As if I needed another reason to wish more carriers carried the iPhone.

I look forward to Google Voice being something people understand as a feature of their service plan rather than some mystery google product that makes calling me more confusing than before.

</comment><comment><USER4> Google needs to go ahead and buy Sprint.

<comment><USER5> Why buy them? If you have partnerships then you can sell your product to the entire market. If they buy Sprint then nobody has a reason to go into partnership with them, because they'd be competing with their supplier.

</comment></comment><comment><USER6> I am a sprint subscriber and had switched my voice mail handling to google voice for a couple of months while using my existing number. I found that it was not as reliable as sprint's visual voice mail, with notifications sometimes coming in hours after the call. Also though gv rates for international dialing are great the quality of the connection is lacking compared to using sprint's long distance service.

</comment><comment><USER7> Well I'm shocked. It's not often that I (as a Sprint user) get a cool new ability before people on other networks.

</comment><comment><USER2> Google Voice Blog post: [http://googlevoiceblog.blogspot.com/2011/03/sprint- integrate...](http://googlevoiceblog.blogspot.com/2011/03/sprint-integrates- google-voice.html)

<comment><USER8> Sprint landing page - www.sprint.com/googlevoice

</comment></comment><comment><USER9> Interesting. I have a Google voice number and a Sprint account but there is a question I don't see an answer to, although I haven't dug around in the fine print yet.

If I switch my Sprint number to Google voice, are mobile to mobile calls still in the unlimited mobile to mobile pool, or do they go into the anytime pool(in my case 1500 shared between myself, wife and daughter)? With a nearly teenage daughter I'd rather keep most of our calls in the unlimited mobile to mobile pool!

<comment><USER8> I worked on the Sprint side of this a bit, had the same question early on and the answer I got was that it didn't change minutes of usage calculations...so...nNo change to how numbers behave from a billing perspective. If you're calling a mobile number and have AMA, it goes in that bottomless bucket. If you're calling a landline, it uses Anytime minutes. Same story for shared lines-- no change to how minutes are used.

<comment><USER9> Thanks for the info! So if someone calls my current Google voice number which gets forwarded to my Sprint number it would not be AMA, but if I switch my Sprint number to Google Voice control and they call that it is still AMA, yes?

Sounds like a winner!

<comment><USER8> yep, that's my understanding. If you actually sign up for GV as your Sprint number, it acts just like your Sprint number. No forwarding involved.

Also, you get to keep your GV number for..I believe 6 months is the plan. It behaves the same way as your Sprint number during that time. That's my understanding right now anyway.

</comment></comment></comment></comment><comment><USER10> Wow. Just when I was thinking about looking for greener pastures, Sprint does something seemingly user-friendly for once.

<comment><USER11> Same. I was pumped about Verizon LTE until I saw the insane caps they're putting on usage. This plus Nexus S 4G + unlimited means I'll probably make the switch when my contract is up.

</comment></comment><comment><USER12> This plus the 4G Nexus S is going to make it really hard to hang onto my old T-Mobile/Nexus One combo. No equivalent of my T-Mobile no-contract post-paid service, though.

</comment><comment><USER13> This is an interesting move, of course -- most of the carriers seem to hate the un-monitorable things, like Google Voice, that we like so much.

Conversely, there's an interesting opportunity for Sprint here to catch all the AT&T haters that will be leaving T-Mobile as they get acquired. I personally haven't had much luck with either AT&T or Sprint in the DC area, so I guess I'm Verizon-bound, but there is, perhaps, an opportunity for someone to catch some chum.</comment>


Glitch puts Star Fox 64 ships in an unmodified Zelda cartridge - <AUTHOR> https://arstechnica.com/gaming/2020/01/how-to-get-star-fox-64-ships-into-ocarina-of-time-no-hacking-required/ <comment><USER2> This was known ages ago, though the usual method of playing with the arwings was using a simple action replay code. It was either some sort of weird easter egg or some testing models just left lying around

<comment><USER3> The article explains it. One of the game developers reused code from the other game and left unused parts of it in Zelda.</comment></comment>


Ask HN: why Google doesn't see HN as a link farm? - <AUTHOR>

Honest question. We know Google [1] (Bing and other s.e.) is fighting an endless war against link farms. AFAIK HN doesn't use rel="nofollow" [2] (EDIT: not entirely true, see comments below) so its link juice may flow to any website that is submitted. However, HN and its linked sites don't seem to be negatively affected nor penalized. What makes HN different from what Google consider a link farm?
[1] https://support.google.com/webmasters/answer/66356
[2] https://support.google.com/webmasters/answer/96569 <comment><USER2> Other comments already pointed out the use of "nofollow". But it is also worth a mention that old, well established sites of high rank link to Hacker News. Most link farms do not have incoming links from highly ranked sites, so the existence of such links is another clue that Google uses to distinguish a discussion forum like Hacker News from a link farm.

<comment><AUTHOR> > Most link farms do not have incoming links from highly ranked sites

That's a good point I didn't consider.

</comment></comment><comment><USER3> Afaik, HN uses rel=nofollow on all links below a certain score.

<comment><USER4> I looked in [https://news.ycombinator.com/newest](https://news.ycombinator.com/newest) and apparently the nofollow disappears when the story gets 6 point. The number may change without prior notice. Perhaps they are using a more complicated secret criterion.

</comment></comment><comment><USER5> Uhm, Google doesn't do PageRank anymore. Now their algorithms are driven by people's choices. They know which links people click when they do a search, and they also have "focus groups" who provide ratings of how useful sites are. They use that info to derive algorithms, but at the root, there are people constantly providing feedback to Google, and link farms have no way to escape that.

And of course, lots of people provide favourable feedback for HN so it is not treated like a link farm.

<comment><USER6> Source? AFAIK they use over a hundred metrics including PageRank and what you're talking about.

</comment></comment><comment><USER7> In recent days, Google doesn't even SEE HN. I think it's because HN is blocking Google for being too aggressive in crawling.</comment>


Groupon Set to go public tomorrow at $20 a share - <AUTHOR> http://allthingsd.com/20111103/breaking-groupon-prices-at-20-a-share-more-than-10x-oversubscribed-so-it-adds-5m-more-shares/

<comment><USER2> This is going to be a spectacular bust. It is about as sure a thing as a Chinese reverse IPO.

<comment><USER3> Yeah, my spidey senses are tingling that this will result in colossal failure. I hope that I am wrong and that despite all reports indicating otherwise, this is a sustainable model and a illegitimately profitable company - though I cannot quite make out how (inflated numbers, fudged/made-up accounting lingo, etc.,...)

</comment></comment><comment><USER4> This will be Lefkofsky and Mason's final cash out on the suckers that pick up GRPN tomorrow.</comment>


Ask HN: What happened to trigger my Spotify password reset? - <AUTHOR> Got this email today<p>> To protect your Spotify account, we've reset your password due to detected suspicious activity.<p>Haven't used it recently or logged in to any new device. Leads me to suspect a data breach. <comment><USER3> I had a similar issue not long ago. I went in and really changed it into a massive 50 character pw.

My spotify account was hijacked in 2017 and managed to get it back - <USER2> from Tunisia - he had the audacity to start creating playlists full of autotune rappers. I wouldn't mind sharing but man his taste in music was awful.

<comment><USER4> Same thing happened to me, right around the same time. Also my hijacker shared a similar taste in music to yours! Spotify denied that they had any database breaches, but I only use that password for spotify so I find that highly unlikely.

<comment><AUTHOR> Yes. And my login is specific to spotify, eg. firstname.lastname@example.com

</comment></comment></comment><comment><USER5> I received a 'Reset your Spotify password' email yesterday, sent to a unique email address I use only for Spotify. (And it's not of the commonly-used firstname.lastname@example.com format.)

The only ways I can imagine someone would get that email address are:

A) From Spotify (i.e. breach)

B) From Google (as I linked my Spotify account to Google Home, which presumably shares the registered email address)

C) From some poor security practice on my part (e.g. maybe I entered the email address on a phishing site, or have malware on one of my devices, or someone has access to my email, ...)

D) Guessing it.

I had presumed C or D, but given the timing of your post, I'm now not so sure...

</comment><comment><USER6> Maybe spotify downloaded a data breach and ran it against their db to force better password practices? My user/default password plaintext combo from when I was 15 was leaked in some EA hack a long time ago. That caused such a headache that I stopped using the same thing everywhere except free services. This initially included spotify. Then I upgraded to premium, and about a month later someone was trying to kick me out of my account (listening from their device) and kept playing weird music. Now everything has its own password. EVERYTHING.

</comment><comment><USER7> They check passwords against other hacks, so if you used the same email- password combination somewhere else that would cause them to reset your account.

[https://www.businessinsider.de/spotify-users-password- reset-...](https://www.businessinsider.de/spotify-users-password-reset-not- hacked-other-companies-data-breaches-reuse-account-logins-2016-9?r=US&IR=T) "Spotify's security team identified that some of the leaked user credentials might correspond to Spotify accounts"

<comment><AUTHOR> My email for spotify login is unique, and of the form *+email@example.com

<comment><USER8> I assume that's checked for. For simple SaaS projects compared to Spotify at least, things like that were checked.

</comment></comment></comment><comment><USER9> I had the same message a few days ago. I have family premium, so, I checked the family invites, and, there were 3 unknown invites that I hadn't seen before (they hadn't accepted them yet though). It seems odd that I wouldn't get an email saying that a family invite was sent out.

<comment><AUTHOR> Netflix has a great service of showing where the account was logged-in from. Spotify would benefit from the same.

</comment></comment><comment><USER10> i used a password for Spotify i used nowhere else...and yes...lots of music and artists and albums are being deepfaked...it's kinda fun..it doesn't seem to be malicious in my case but perhaps it is...but yeah...artists all of a sudden everywhere resemble my ex-boyfriend...hmmm ....some songs are actually delivering beautiful and insightful messages seemed to be tailored towards me too</comment>


Dear Authors, Your Next Book Should be an App, Not an iBook - <AUTHOR> http://techcrunch.com/2010/04/11/dear-authors-your-next-book-should-be-an-app-not-an-ibook/ <comment><USER2> The iPad may be a spiffy glitzy flash platform for multi-media, but it's not going to kill reading or books. At least, not for people with intellectual curiosity. Written materials, fiction or non-fiction, are a good way to present complex ideas efficiently. Multimedia is not. Descarte's Discourse on the Method of Rightly Conducting One's Reason and of Seeking Truth in the Sciences (1637), which lays some of the foundations of modern science, is a worthwhile read. What would an iPad version look like if it's not a book. What about Dostoevsky's Notes from the Underground, which some say is the best exposition of Existentialist thought? How would it play as a iPad application? Or Hemingway's Old Man of the Sea? I suspect that multimedia iPad applications will be, like movies based on books, always lacking nuance, complexity, and depth.</comment>


Google invests $75M in a 50MW wind farm, total $1B to renewable energy sector - <AUTHOR> http://thenextweb.com/google/2012/11/15/google-invests-75m-in-a-50mw-wind-farm-has-contributed-almost-1b-to-the-renewable-energy-sector/

<comment><USER2> Just so everyone's clear, the reason that Google (along with Chevron, Wells Fargo, and a number of other big companies with large tax liabilities) are investing in renewable energy is to take advantage of the massive tax credits that come with the investment. There simply aren't that many companies with tax liabilities large enough to make investments in tax equity like this attractive, and Google is one of them.

So, good for Google. It makes a lot of sense for them to do this and I'm glad to see it happening.

<comment><USER3> Thank goodness for beneficial tax policies that encourage investment in future technologies!

<comment><USER4> How do we know whether or not a technology is a "future technology" if it is unprofitable without tax credits? Would car companies have spent millions of engineering hours on hydrogen vehicles if the government didn't pay them to do so in the 00's? Maybe it would have been better for mankind if they didn't.

Broad incentives are better than targeted incentives. The government is bad at picking future technologies. See ethanol.

<comment><USER5> > How do we know whether or not a technology is a "future technology" if it is > unprofitable without tax credits?

Is profitability the only factor that makes a technology worth pursing in "the future"?

<comment><USER6> No, people have many reasons for pursuing technology. The question is whether the government should encourage people to pour money into unprofitable forms of energy.

</comment></comment></comment></comment></comment><comment><USER7> First, a 50MW farm is only ~25 turbines which is small for industry standards. I have been on top of wind turbines in farms of hundreds of turbines surrounded by other windfarms of the same size. I use to inspect wind turbine blades using Industrial Rope Access.

Second, Google benefits a few ways with this and other renewable investments, mainly for the Production Tax Credit or PTC. A federal incentive program to develop the wind energy industry that is equivalent to $02.2 per kWh of production. A 50MW farm running at 30% will produce ~130M kWh per year or $3M/year in PTC.

Google is doing three things at once, reducing their tax liability, diversifying their portfolio and advertising the Google Brand. This has nothing to do with powering their own data centers and might even take the focus off of them using dirty energy to power their data centers.

<comment><USER8> I don't understand the last clause. Yes, Google uses "dirty energy" in many data centers because they're connected to grids without direct "clean energy" feeds. But electricity is near-perfectly fungible. If you care about "clean" energy at all, your goal should be increasing the supply anywhere -- what's the difference to an environmentalist if that 50MW goes to a Google-owned data center or just a local housing development? How does it make it "less good" of Google to have built those turbines?

<comment><USER9> Electricity isn't very fungible at all, at least across space and time: It is expensive to transport and almost impossible to store. The limiting resource on power production is facilities, not fuel.

Any electrical power source that doesn't displace a power plant is a toy.

<comment><USER8> No, that's a very commonly stated point, and it's completely wrong from the perspective of someone trying to reduce carbon output.

Solar usually gets this criticism more than wind, so let's use that: the argument goes that you need enough power generating capacity to handle peak usage, but of course solar only works in the day. So if your peak usage happens at night (it doesn't, but let's assume) then the solar panels have "displaced zero power plants".

But who cares? If you have them built, then _during the day_ the solar plants are operating and generating (much cheaper, looking only at marginal costs) power. And the coal and gas plants, by virtue of having higher marginal costs, are idle. And at night the fossil plants fire back up and do what they were doing before. So the net effect, assuming excess solar capacity, is that _carbon output has been reduced by a factor of two_ (actually a bit more than two in practice).

And of course then the market will accomodate, such that "day power" being available in higher quantity and with higher excess capacity becomes cheaper and "night power" more expensive. So the legacy coal plants will probably still even make money as they're selling into a "premium" market.

So... how is solar (or wind) a toy in that scenario?

</comment></comment></comment></comment><comment><USER10> 50MW seems pretty significant. if Wikipedia is to be believed, "According to Google their global data center operation electrical power ranges between 500 and 681 megawatts"

<comment><USER11> MW is the wrong unit to use for that comparision. TWh/year is more appropriate.

<comment><USER12> Out of curiosity, why do people use Watt-hours instead of Joules for this purpose?

<comment><USER13> Which is more practical?

A: "Hi, can you please supply us with 50MW for the next 12 hours?"

B: "Hi, can you please supply us with 2.16Tj at a rate of 50MW?"

<comment><USER14> It would be much nicer to get 2.16Tj in a bucket.

</comment></comment></comment></comment></comment><comment><USER15> Don't forget about their $5B transmission line as well:

[http://www.guardian.co.uk/environment/2012/may/15/energy- win...](http://www.guardian.co.uk/environment/2012/may/15/energy-wind-google- cable)

[http://gigaom.com/cleantech/by-the-numbers-googles- offshore-...](http://gigaom.com/cleantech/by-the-numbers-googles-offshore- wind-investment/)

</comment><comment><USER16> This makes me wonder how long a game Google is playing. And how good they are at playing the long game.

Does anybody know how well they did on all that dark fiber they were buying up after Bubble 1.0?</comment>


Microsoft "scroogled" ad attacks Google Play data sharing with developers - <AUTHOR> http://techcrunch.com/2013/04/09/microsofts-latest-scroogle-ads-attack-sharing-of-information-that-google-developers-need-to-process-transactions/

<comment><USER2> It's interesting that all the #scroogled retweets at the moment appear to be fueled by the $500 Visa gift card offer from Bing. Not exactly viral.</comment>


Post random censored sentences on your site - cool-RR http://irrepressible.info/

<comment><AUTHOR> Really slow website for me.

Edit: so here is a site using it and the script that is used [http://andrew- jones.com/2009/06/19/irrepressible-widget-from...](http://andrew- jones.com/2009/06/19/irrepressible-widget-from-amnesty-international/)

When you click on the widget you just get taken to the welcome page and it shows what site it is from and who censored it (not really easily seen I think it should be the center of interest).

Script itself:

       <script type="text/javascript">
       var irr_lang = 'en';
       </script>
       <script src="http://fragments.irrepressible.info/js/fragment-180.js" type="text/javascript">
       </script>

and an opendir of their fragments: <http://fragments.irrepressible.info/data/current/>

Interesting but I don't see it being much use only posting fragments rather than the whole thing.

</comment><comment><USER2> Given how slow the site is, can anyone please give some examples of its output? Is it meaningful sentences, "the man walked his dog in the park" type sentences that even things that everyone wants to censor would have or something else entirely?

</comment><comment><USER3> I thought this would be some distributed way to reassemble texts, but actually it's just an awareness campaign?

</comment><comment><USER4> They should use Cloudfront, S3 or at least a decent web server with some decent bandwith. Slow as...

<comment><USER5> My first thought was that they're being DOSed. I would presume a campaign like that gets plenty of unwanted traffic from those who'd rather keep those messages suppressed, even if they're only fragments.

</comment></comment><comment><USER6> This is great. I've always wanted a way to one-up censorship. Let's see them censor the whole web.</comment>


What's in a Passenger Name Record (PNR)? - <AUTHOR> http://hasbrouck.org/articles/PNR.html

<comment><USER2> For those who didn't read all the way through this lengthy article, here's the punch line:

 _" PNR's show where you went, when, with whom, for how long, and at whose expense. Behind the closed doors of your hotel room, with a particular other person, they show whether you asked for one bed or two. Through departmental and project billing codes, business travel PNR's reveal confidential internal corporate and other organization structures and lines of authority and show which people were involved in work together, even if they travelled separately. Particularly in the aggregate, they reveal trade secrets, insider financial information, and information protected by attorney-client, journalistic, and other privileges.

Through meeting codes used for convention and other discounts, PNR's reveal affiliations -- even with organizations whose membership lists are closely- held secrets not required to be divulged to the government. Through special service codes, they reveal details of travellers' physical and medical conditions. Through special meal requests, they contain indications of travellers' religious practices -- a category of information specially protected by many countries.

PNR's for reservations made or changed online routinely include IP addresses and timestamps to enable them to be cross-referenced with Web server logs."_

The rest of the web site looks like it has a lot of useful information for frequent travelers.

</comment><comment><USER3> Wow! I had no idea such a database exists.</comment>


SpellHub, continuously spell-checking of your project's source code - <AUTHOR> http://spellhub.com/

<comment><USER2> This is interesting, many developpers don't pay attention to spell-checking and sometimes it can be really shameful to show a project to a future employers.

Great idea

</comment><comment><AUTHOR> Note: I'm not the author of this project.</comment>


Ask HN: Good open source projects for beginners? (early 2018) - <AUTHOR> What are some good open source projects for beginners here in early 2018? Ideally I'd love pointers to projects that have a culture of nurturing new programmers - people who have had a couple quarters/semesters of programming at the college level, but are otherwise just getting started.<p>(I saw https://news.ycombinator.com/item?id=9305398 - the general advice in it is great; I was hoping to get an updated list for here in February 2018.)(Personally, I'd love to find smaller projects - it seems like a bunch of the projects listed in the earlier post are big things, such as Mozilla, Mercurial, Ruby)<p>(Side-question: I <i>think</i> this is a reasonable 'AskHN' topic, but if it's not I'd be happy to revise it and/or take it down). <comment><USER2> A good open source project is one that matches your existing skills and the skills that you want to build.

My own FLOSS efforts mostly revolve around the Linux audio community (mostly musical software). There's plenty of projects from the very small to mid-large size. My focus is primarily on ZynAddSubFX ([https://github.com/zynaddsubfx/](https://github.com/zynaddsubfx/) ) and the project is looking for new contributors. Depending upon an individual's interests and goals of contributing to FLOSS I may be able to direct them to other similar projects.

</comment><comment><USER3> You would do well to take a look at the well-written open source guide written by the folks at Github: [https://opensource.guide/how-to-contribute/#finding- a-projec...](https://opensource.guide/how-to-contribute/#finding-a-project-to- contribute-to)

One of the links featured there is a website tracking resources to find projects for people who have never contributed to open source before: [http://www.firsttimersonly.com/](http://www.firsttimersonly.com/)

</comment><comment><USER4> [https://whatcanidoformozilla.org/](https://whatcanidoformozilla.org/)

I have a good experience contributing to the Rust programming language. Rust e.g. has open issues on Github that are labeled 'E-mentor', when you decide to tackle such an issue, you will be mentored by an experienced Rust contributor.

The Rust community is generally very friendly and welcoming.

</comment><comment><USER5> If you are interested in JavaScript, Redux is a great library you can start to study the source code.

[https://github.com/reactjs/redux](https://github.com/reactjs/redux)

</comment><comment><USER6> If you are student check out Google Summer of Code 2018</comment>


Halfwidth and fullwidth forms - <AUTHOR> https://en.wikipedia.org/wiki/Halfwidth_and_fullwidth_forms <comment><USER2> Unicode makes this wayyyyyy trickier. There's at least one width-12 composed character sequence for instance. Fonts may render things at fractions of a cell width unless special work is done to make them fall on integer boundaries. And that's before you even get into how the number of bytes that will generate a particular final cell rendering could be practically anything.

Ah, the good old days of just 1x or 2x text. :)</comment>


Sunsets in Google Calendar using R - <AUTHOR> http://hilaryparker.com/2014/05/27/sunsets-in-google-calendar-using-r/

<comment><USER2> I always miss meteor showers. I live in the city so I have to drive for about 30 minutes to see one BUT if the sky cover is over 10% covered it isn't worth it and the moon needs to be gone. I think I might try to figure out a way to let me know when the conditions of a meteor shower, the cloud cover are just right and the moon is not present in the sky and post to my Google Calendar.

Thanks for inspiring me.

<comment><USER3> I wonder if you could use the data from Clear Dark Sky[0] for taking care of the moon and cloud cover constraints. I'm not sure if the data which makes the charts (e.g., [1]) is accessible or not.

[0] [http://cleardarksky.com/](http://cleardarksky.com/)

[1] [http://cleardarksky.com/csk/](http://cleardarksky.com/csk/)

<comment> k-mcgrady I'm not sure how much data the API offers but parent could also maybe get something from this source[0]. It's used by the Dark Sky iOS app and at least for rain I've found it unbelievably accurate.

[0] [https://developer.forecast.io](https://developer.forecast.io)

</comment></comment></comment><comment><USER4> Great idea. There's a lot of calendar apps out there, but the data feeds powering them are the same old crap. The concept of an agent doing stuff with the app feels like 60's-ish virtual assistant futurism.

I wonder how usable an "intelligent" autonomous agent putting things on a calendar would be. (That is, to extend the generation of a calendar feed with more clever bits.) Say there was a weather component that would only schedule sunsets when the weather would be conducive for photography.

<comment><USER5> I'm actively working on building this actually - starting with the normal weather side of calendar integration (appointment locations vs. weather conditions, for example), but also eventually including beautiful sunset predicting/timing. I'd be interested in collaborating on some of these...email me if you want to explore this. :)

<comment><USER4> Definitely, I'll send an email over. I've spent a lot of time mulling over these type of agents, would be nice to do something practical based on it.

</comment></comment></comment><comment><USER6> Reading the title made me think that someone wrote a script that would create sub-calendars of various colors and then schedule events using those calendars so that it'd emulate a sunset across the Google Calendar interface.

</comment><comment><USER7> Man, I totally forgot about my idea for a website until reading this post. I put this into evernote last week:

> A service/website which lets you know when a beautiful sunset or sunrise is > likely, and the best time / place to view them in your area. Includes a > photo sharing feature where people can upload their sunsets, rainbows, etc. > Would use weather forecasts to predict red skies

Does anyone know if this already exists? If it does, I won't even be disappointed, I just want to use it

</comment><comment><USER8> Got it to work! Great writeup Hilary.

For others like me who know nothing about R, I did a little writeup for doing this yourself: [http://blog.samsandberg.com/2014/06/04/sunsets-in-google- cal...](http://blog.samsandberg.com/2014/06/04/sunsets-in-google-calendar-for- r-noobs/)

Hope this helps at least someone out there

</comment><comment><USER9> Any reason in particular you decided to choose R?</comment>


Learn to write your first OS kernel (2018) - <AUTHOR> https://github.com/arjun024/mkernel <comment><USER2> As others have stated there are much better guides than this.

I did this recently for fun, including the bootloader (I considered GRUB cheating!) The best tutorial IMO was [https://samypesse.gitbook.io/how-to- create-an-operating-syst...](https://samypesse.gitbook.io/how-to-create-an- operating-system/)

Some other useful resources I found:

      - http://3zanders.co.uk/2017/10/13/writing-a-bootloader/
      - http://mikeos.sourceforge.net/write-your-own-os.html
      - https://www.nasm.us/doc/
      - http://faydoc.tripod.com/cpu/
      - https://github.com/cfenollosa/os-tutorialjos

<comment><USER3> Clickable links

[http://3zanders.co.uk/2017/10/13/writing-a- bootloader/](http://3zanders.co.uk/2017/10/13/writing-a-bootloader/)

[http://mikeos.sourceforge.net/write-your-own- os.html](http://mikeos.sourceforge.net/write-your-own-os.html)

[https://www.nasm.us/doc/](https://www.nasm.us/doc/)

[http://faydoc.tripod.com/cpu/](http://faydoc.tripod.com/cpu/)

[https://github.com/cfenollosa/os- tutorialjos](https://github.com/cfenollosa/os-tutorialjos)

</comment></comment><comment><USER4> I waited a few hours and didn't see any mention of the big one : [https://wiki.osdev.org/Bare_Bones](https://wiki.osdev.org/Bare_Bones). In general osdev has a lot of good resources although the good threads get buried in the forum. Sortix came from there and the threads about trying to minimize the source dependency graph helped a lot in my first startup.

</comment><comment><USER5> I have made a codebase where all the C and C++ glue is already taken care of, as well as the build system:

[https://github.com/fwsGonzo/barebones](https://github.com/fwsGonzo/barebones)

However, nothing else. So it's a starting point for a beginner. I don't know if its the perfect starting point or not, but at least you won't be stuck with all the setup. If you are writing an OS in another language you can probably get some inspiration as well, as for example I did implement basic ubsan support.

Some fun facts:

There is a C++ exceptions example that shows that with the compiler runtime as well as a libunwind you can catch C++ exceptions, but only if you create the exception fully yourself, as there is no standard library. It does add a bit of bloat, so it's not really intended for OS development.

There is an example of how to runtime load a library, and call into it. No runtime linking, just an exchange of call table.

There is very primitive backtrace functionality in the panic function simply by using compiler builtins. No way to convert the addresses to function + offset because there is no symbol table. One cool way to do this is to link the kernel, generate an ELF section that contains only the function symbols, and then append it to the end of your kernel. During initialization you can then use it for backtraces. It's also fairly architecture independent, as you will only have to distinguish between 32- and 64-bit symbols.

</comment><comment><USER6> What I'd love to have is a tutorial or a base OS that initializes all the hardware stuff (I/O, memory, discs, video, processor...) and let you build the software stack on top of it. Anything outthere? The closest I found is baremetal [https://en.wikipedia.org/wiki/BareMetal](https://en.wikipedia.org/wiki/BareMetal)

</comment><comment><USER7> Well it does what it says on the tin. So its fine.

Whats your next step? Perhaps put a version of snake in there. That will provoke input/output etc... I'd suggest text mode first but then aim for VGA and beyond.

If you want a bigger challenge, implement serial port I/O so you could hook it via virtualbox etc to another running machine and network your snake game etc.

Then from there dig into ethernet and use raw ethernet or even UDP. Now you have a full working network client from the ground up.

</comment><comment><USER8> That's it?

While the point of this project is to go for developing a very small kernel, I afraid I can't recommend this as a way to "learn to write your first OS kernel".

Particularly, this project has been fossilised for two years, (last commit was in 2018) with a single commit each year hardly qualifies as an updated tutorial for writing OS kernels.

My first recommendation would be the "writing an OS in Rust" tutorials [0] and the xv6 tutorials [1].

[0] [https://os.phil-opp.com/](https://os.phil-opp.com/)

[1] [https://pdos.csail.mit.edu/6.828/2019/xv6.html](https://pdos.csail.mit.edu/6.828/2019/xv6.html)

<comment><USER9> His blog post goes into a lot more detail about things, and he has a part 2 where he adds keyboard input and screen output via interrupt handlers. It's useful as a "Hello World" level intro to the topic.

Kernels 101 – Let's write a Kernel [http://arjunsreedharan.org/post/82710718100/kernel-101-lets-...](http://arjunsreedharan.org/post/82710718100/kernel-101-lets- write-a-kernel)

Kernels 201 - Let's write a Kernel with keyboard and screen support [https://arjunsreedharan.org/post/99370248137/kernels-201-let...](https://arjunsreedharan.org/post/99370248137/kernels-201-lets- write-a-kernel-with-keyboard)

</comment></comment><comment><USER10> The link says 2018, but this was published in 2014</comment>


Launch HN: OSIMple (YC W18) – Automating data entry for inspectors - <AUTHOR> Hi HN,
We're Amanda Chan and Mike Miller, the cofounders of OSIMple (https://www.osimple.co/). We automate data entry for inspectors by replacing stacks of paper with tablets and by generating completed inspection forms, saving them almost half of their inspection time.
Through conversations with friends and professors in the civil engineering department at our university, we discovered that data entry and report writing can be quite a time sink for bridge inspectors. Bridges need to be inspected regularly but a great deal of inspectors are using pen, paper, and camera on site and manually entering data back at the office. Those who do use software use old, clunky applications that often require persistent internet connection in the field.
We figured we could build something better so we created OSIMple. There are two parts to the software. First is a mobile application that inspectors use to complete their inspections. It essentially digitizes the inspection form and keeps all the photos and notes organized. The second part is a website. Once an inspector finishes an inspection, they upload their data from the mobile app to the website where they may review and edit the inspection data and finally generate a completed inspection form as a PDF.
We started started selling to bridge inspectors and now our software is being used on over 400 bridges. It's become clear that other types of inspection could benefit from our software as well. So now we're expanding to include home inspectors. Like bridge inspectors, home inspectors often have nothing or inelegant software to help them complete their job. We aim to change that, for home inspectors and beyond.
Thanks for reading! We'd love to hear feedback from the HN community and any ideas or experiences you've had in this space. <comment><USER2> Congrats on your launch! There is huge opportunity in the relatively boring fields of digitizing paper-based tasks for established industries. I worked in this field ( mobile data collection & integration for environmental management systems in forestry, oil & gas) for a significant period and the hard part was not the data collection but the unique workflows of each organization. Nobody wants to change "how" they fit the data collection piece into the rest of their processes so you either don't offer it (and create a easily replaceable niche service) or you end up with numerous bespoke customized solutions - what's your plan?

I'd challenge your statement that there's nothing available for some of your biggest potential markets, unless you're talking a more complete lifecycle solution specifically targeting verticals than just the data collection. Also, what's the "automation" component? To me that implies some form of automatic data collection or predictive workflow creation - both which are huge selling points, but hard to pull off.

Finally a key feature that you could consider are the document management aspects around data collection. Even big organizations do this poorly. The ability to accurately group and find related documents (like inspections over time or by project) tends to be missing in data collection. As a user I likely have one or more sets of related documents that fit together based on some component of my workflow that I share with a team, clients regulators and the public in different capacities. The most common solution I see is the network share and an email alias.

Good luck with your venture and enjoy the ride!

<comment><USER3> Parsable seems to be dealing with the issue of unique workflows. From what I understand they provide a tool to companies that lets them create their own workflow.

[https://www.parsable.com](https://www.parsable.com)

<comment><USER4> What is industry 4.0? What was industry 3.0?

<comment><USER5> [https://en.wikipedia.org/wiki/Industry_4.0](https://en.wikipedia.org/wiki/Industry_4.0) and more info about the previous ones: [https://en.wikipedia.org/wiki/Fourth_Industrial_Revolution](https://en.wikipedia.org/wiki/Fourth_Industrial_Revolution)

</comment></comment></comment></comment><comment><USER6> Site took a good 5 seconds to load anything. Was just a white screen before that

<comment><USER7> I had the same experience. I thought some problem with my internet connection

</comment></comment><comment><USER8> Sounds similar to what SafetyCulture[1] do. It's a great idea and good to see this space opening up.

[1] [https://www.safetyculture.com.au/](https://www.safetyculture.com.au/)

</comment><comment><USER9> Congrats Amanda & Mike! What about plane security inspections? Will from SE ;)

</comment><comment><USER10> Good job Amanda & Mike, 'tis fair!</comment>


Why Concerns About Net Neutrality Are Overblown - <AUTHOR> https://www.nytimes.com/2017/12/04/opinion/net-neutrality-overblown-concerns.html <comment><USER2> If it didn't matter, why is there such a big push to kill net neutrality. It matters. They want to do something they aren't allowed to do today, and doing something they aren't allowed to do today means its not in the interests of the Internet as a whole. Don't let this propaganda fool you.

<comment><USER3> I am mostly indifferent to the net neutrality arguments. Not sticking my head in the sand, I just feel that most of the traffic discrimination everyone is worried about is already happening. The internet was always designed as a government/corporate hybrid and discrimination based on size, importance, etc is already happening on a daily basis. See Free Basics by Facebook for a very clear example: [https://info.internet.org/en/story/free-basics-from- internet...](https://info.internet.org/en/story/free-basics-from-internet- org/)

<comment><USER4> If it's already happening then we should enforce NN laws, not repeal them.

</comment></comment></comment><comment><USER5> This OpEd is written by Ken Engelhart[1], former VP of regulatory affairs at Rogers Communication in Canada. He spent most of his professional life lobbying the Canadian government on behalf of their near-monopoly cable and wireless provider. I'm confident that the new FCC regulations are very much in line with what he would like to see in Canada, and not at all in line with the public's own interests.

[1] [https://www.linkedin.com/in/kenneth- engelhart-591a204/](https://www.linkedin.com/in/kenneth-engelhart-591a204/)

<comment><USER6> Which is why I found this part hilarious: "And there's still competition: Some markets may have just one cable provider, but phone companies offer increasingly comparable internet access — so if the cable provider slowed down or blocked some sites, the phone company could soak up the affected customers simply by promising not to do so."

As bad as Rogers is, Bell Canada is much worse with regards to NN. And both would like nothing better than than to prevent all the other ISPs from being able to lease the last mile from them.

</comment></comment><comment><USER4> The best reason to dismiss this article as propaganda is it does not give a reason _why_ repealing Net Neutrality is _good_. All it says is "trust me, it won't be that bad". Garbage.

<comment><USER7> Yeah, even more so since the author works in the industry that would benefit.

</comment></comment><comment><USER7> "All these awful things have happened in the past but _trust_ us, it's not going to happen in the future"

Bullshit.

Also, competition? Please.

I _need_ 25mbit+ to do my job, if you think phone companies are offering a viable alternative I've got a bridge to sell you.

</comment><comment><USER8> The author was a former VP at Rogers Communications, Inc, a Canadian ISP.

[https://ca.linkedin.com/in/kenneth- engelhart-591a204](https://ca.linkedin.com/in/kenneth-engelhart-591a204)

</comment><comment><USER9> "Some markets may have just one cable provider, but phone companies offer increasingly comparable internet access"

No, they don't. Not at all. I am by some miracle grandfathered into an almost affordable unlimited data plan, and even it gets throttled after a certain limit.

<comment><USER10> What affect would net neutrality have on increasing competition? I am deeply skeptical that it would have a good impact and strongly suspect that any regulation created would be designed to reduce competition.

See airline regulation which did a lot of things and had a lot of goals but ended up being used by the industry to keep new players out of the market place.

<comment><USER11> Net neutrality would preserve content for online services by preventing ISPs from acting as service gatekeepers; it would have minimal effect on ISP competition, which itself was minimal even before the effort at general regulation rather than slapping-down individual egregious violations in the pre-2010 case-by-case regime.

</comment></comment></comment><comment><USER12> > These incidents are troubling for anyone who wants on open, neutral > internet. But keep two things in mind. First, these are rare examples, for a > reason: The public blowback was fierce, scaring other providers from > following suit. Second, blocking competitors to protect your own services is > anticompetitive conduct that might well be stopped by antitrust laws without > any need for network neutrality regulations.

Except BOTH examples provided were not stopped by antitrust regulations or public blow back, but by the authority of the FCC to enforce net neutrality.

> I know that it simply is not in service providers' interests to throttle > access to what consumers want to see.

Which is why they've been fighting so hard to have the ability to do it...

</comment><comment><USER13> I think that if at this point one does not understand the importance of net neutrality, one either is simply not capable of understanding it, or simply wishes not to understand it.

There's nothing left that has not been explained in detail and any sort of argument with someone who claims to understand the matter is futile: they either can not or will not understand.

</comment><comment><USER14> from the article:

> The good news is that we will soon have a real-world experiment to show who > is right and who is wrong. The United States will get rid of its rules, and > the European Union and Canada will keep their stringent regulations. In two > years, will the American internet be slower, less innovative and split into > two tiers, leaving Canadians to enjoy their fast and neutral net?

Isn't this already happening, even with NN?

The big players in the US have already shown they don't care at all about competing and are perfectly content giving the US substandard service compared to much of the rest of the world.

</comment><comment><USER15> I've listened to interviews with Ajit Pai since the announcement, and I agree with both the headline and the overwhelming majority of the content of this. Once you hear the plan going forward, it sounds pretty reasonable, and I've spoken with people who want to start niche ISPs (in this case, trying to take advantage of a local government-funded fiber expansion that is sitting idle) -- the ask-for-permission-in-advance model of regulation is stopping literally everyone in the local market (although only some of that is federal -- some is local to the county).

<comment><USER16> As an actual rural independent FTTH provider, I can say you're wrong. It's incredibly hard to go against the incumbent duopoly of cable/telco, and they will most certainly abuse their market power. Though in a sad way it works in my favor, I've had a number of new customers sign up because they don't want their internet throttled. BigCableCo _will_ create 200 Gb packages and they _will_ exclude their service while counting Netflix. Regular people do deserve access to a free, open, and unmetered Internet. I'm _super_ small and still offer par and faster speeds than the cable company in my area. I'm not losing money because someone is streaming two netflix streams instead of one.

<comment><USER17> Thanks for posting... you touch on something that isn't ever spoken about. The advocates for getting rid of nn regulation always speak in generalities and concepts like attorneys.

I have the perspective of having worked for a large institution that is in effect a large ISP. Our network delivery costs are nothing in the scheme of things, and where we own fiber the marginal cost of scaling our network capacity 100x a decade ago was actually below zero as we replaced more expensive, more labor intensive equipment.

</comment></comment></comment><comment><USER18> So this guys says let them do it and see what happens? And then what? This is the most moronic article I ever read on nytimes. I hope the paper got good money publishing this propaganda.

</comment><comment><USER19> I don't think it is wise to trust monopolies who have a history of doing the wrong thing.</comment>


Samsung Believes iPhone 5 Could Be Nexus S Copy - <AUTHOR> http://www.iphone5torelease.com/news/samsung-believes-iphone-5-could-be-nexus-s-copy/

<comment><USER2> no it doesn't.</comment>


Optimism that tech firms will kick-start economic recovery is overdone  - <AUTHOR> http://www.economist.com/businessfinance/displayStory.cfm?story_id=14688776&source=features_box_main

<comment><USER2> The conclusion was well-put:

 _"As with many new technologies, they overestimate the short-term impact, but underestimate what will happen in the longer run."_</comment>