ShowHN: Naming Tool - <AUTHOR>

One of the things people spend a lot of time stressing about is coming up with names for things (projects, companies, books, etc).
We've created a tool to help with that process. It allows you to create an entry to solicit names for your project (which you can share with your team / friends, or make public for others to participate).
Another challenge is picking the name. Often it's done sort of random, based on what people think sounds the best. We put together a scoring system that is the core part of naming consultations that usually costs $$$. You can evaluate the name on each of the different dimensions and then have a more thorough understanding of the name you choose.
We'd love your feedback on the concept, execution, etc. as well as suggestions / criticisms.
There is an option for a "premium" entry -- if you'd like to use that feature, use code HACKER to get it for free.
https://bootname.com/ <comment><USER2> The multi-dimensional scoring is probably the best part of this tool, as it forces you to think about the context in which you are naming your company -- vs. just disliking something because it has an emotional trigger in one of the founders / advisors.

</comment><comment><USER3> Pretty cool idea. Added one for testing :)

How long does a free entry stay on the front page for?

<comment><AUTHOR> Right now, we have a simple algorithm that ranks front-page entries based on their type and age, older entries would eventually be pushed down the stack as new ones comes in.

However, we've been contemplating a voting process on the entries themselves and then have the algorithm use that, some entries are worth the public attention more than others.

Thanks for testing!

<comment><USER3> Is there a way to edit entries after they've been entered? I have a tendency to make typos (which I made on my entry) and don't see any way to edit the description.

One feature you could add (maybe premium) is the ability for the entry creator to see if domain names are available for suggested names. I had one name suggestion for my entry and this is the first thing I did.

Wish you the best luck and success with this!

<comment><AUTHOR> There should be and edit icon to the left of the title when you view the entry as the owner, maybe we should make that a bit more obvious.

Thanks for suggesting the domain name check, we've been thinking about that and how to make it useful to users brainstorming names, as well as for names already proposed. It's definitely something we have on the queue.

<comment><USER3> Thanks, found the edit icon.

I honestly wasn't expecting to find it in the title line though. Maybe you could add a button with the text "edit" below the description to the right of the constraints? That's more where I expected to find it. That or just make it stand out more.

One final suggestion for the UI (please keep in mind I'm not a designer and therefor you can freely ignore my opinion if you want), the left side is a lot more content heavy then the right side of the screen on the entry page. Maybe move the "Got a cool name for this?" section underneath the listed names on the right side?

<comment><AUTHOR> That's not a bad idea at all. Thanks!</comment></comment></comment></comment></comment></comment>


Google Loses Emergency Bid To Keep "Innocence Of Muslims" Film Online - <AUTHOR> http://techcrunch.com/2014/03/02/google-loses-emergency-bid-to-keep-innocence-of-muslims-film-online/ <comment><USER2> I'm not a lawyer but, reading through the brief, the decision doesn't seem so bad or consequential as it may seem.

The crux of the matter seems to be that Youssef, the director, did not make Garcia sign any form of written contract before filming her scenes.

A standard work for hire contract would have relinquished Garcia's copyright claims to the work and none of this mess would have happened which is exactly why every professional organization insists on contracts being signed.

Absent a contract, the court is forced to determine what the implied contract is. Now, if Youssef had hired Garcia to work on "Innocence of Muslims", the court may have determined that for a 5 second appearance, a work for hire was implied and Garcia's copyright claim does not outweigh Youssef's.

But that's not what happened, Youssef hired Garcia to work on "Desert Warrior", a film that was described as materially different from "Innocence of Muslims". Given that, it becomes tricky to determine whether the implied contract was broad and general or towards a specific piece of work. The lower court interpreted it as general, the appeal disagreed. I can see both sides of the argument but, given that no contract was signed, it seems correct to me to give the maximum latitude towards Garcia.

The court decision though, is that only the 5 seconds that Garcia appeared on film could be copyrighted by her. Youssef is still perfectly free to produce a cut in which her 5 seconds is excised or replaced and re-upload it to Youtube and Garcia would have no more claim to attempt a takedown.

So, in summary, this case only creates a precedent if:

* No work for hire contract is signed

* You materially misrepresent or misappropriate the nature of work to be performed

* The person later files a copyright claim

* The work can't easily be altered to excise the copyrighted parts.

Again, I'm not a lawyer so I may be reading and interpreting the case wrong but it seems largely reasonable.

<comment><USER3> No need to inform us that you are not a lawyer. That was made quite clear when you gave us your take on the decision after reading the _brief,_ never even mentioned first amendment concerns (good or bad) and failed to limit the scope of the precedent variable to the Ninth Circuit.

<comment><USER2> I'd love to be educated. This seems to be primarily an IP case. What are the first amendment concerns?

<comment><USER4> I'm not a lawyer either, but from having read a few cases in the past, it seems that preliminary injunctions - like the one issued to force Google to take the film down - that prevent speech are usually considered violations of the First Amendment except in extreme cases.

Whether this applies to copyright cases is still unclear, but it seems the Supreme Court has taken that stance: [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1802778](http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1802778)

</comment></comment></comment></comment><comment><USER5> The EFF has much better coverage: [https://www.eff.org/deeplinks/2014/02/bad- facts-really-bad-l...](https://www.eff.org/deeplinks/2014/02/bad-facts-really- bad-law-court-orders-google-censor-controversial-video-based)

Note that this is an injunction _ahead_ of the decision of whether her copyright claim is valid. This is especially bad, even if she does eventually succeed in her claim, as it reinforces _claims_ of copyright infringement as a way to restrain speech (especially worrying here because her performance consists of 5 seconds of film).

<comment><USER6> To get a preliminary injunction, you have to show (among other things) a substantial likelihood of success on the merits as well as irreparable harm. I tend to agree with 'shalmanese above, which is that it would be a peculiar situation in which this precedent would allow you to suppress without there having been some bad conduct on the part of the speaker as is the case here.

</comment></comment><comment><USER7> One thing to note–It's standard for everyone on a film set to sign a 'Deal Memo' which among other things expressly releases all creative rights(copyright) to any work you do on said project. While I agree with Google, there isn't a big risk to movie studios etc.

</comment><comment><USER8> I don't understand how she had any claim to this. I'd expect that everyone working on the film signed an IP agreement releasing all moral rights.

<comment><USER2> From the brief:

"Youssef didn't obtain a written agreement, and Garcia simply doesn't qualify as a traditional employee on this record."

<comment><USER9> I don't agree with that. She was in the movie. Obviously she agreed to that part. She relinquishes everything at that point written agreement or not.

</comment></comment></comment><comment><USER10> Now that it's gone, I kind of want to see it.

I have to wonder why more people don't file takedown requests solely to exploit the Streisand Effect. (Not that I'm implying that's what's being done here, just that it would be an interesting idea.)

<comment><USER11> Imagine you hate Islam and you want to portray it in an obnoxious, demeaning, and depraved manner, with all the production quality of a middle school film project. You've just envisioned Innocence of Muslims.

<comment><USER10> Yeah, I read the Wikipedia article. It sounds horrifyingly bad. And in very poor taste.

<comment><USER12> And protected by the First Amendment.

Unlike some theocratic regimes where the maker of this film would be beheaded, at least we have some remaining freedom of speech and expression.

The right of free speech is not resolved in motherhood-and-apple-pie cases but in the extreme fringes of bad taste and offensiveness ( _Human Centipede_ , Nazi propaganda, etc)

<comment><USER13> This is a contract law case.

<comment><USER14> I disagree this is a first amendment case that someone found a way to get the video taken down.

They then made this a copyright case due to a bad contract.

<comment><USER15> You can disagree, but you are wrong.

A first amendment case, by definition, is a case involving whether the government has a right to restrict your speech.

By contrast this case is about a person's private lawsuit to have unauthorized video of herself taken down. No government, no first amendment.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> There are some very old themes in this story.

Maintaining strong & effective sanctions against apostasy & heresy is a central component of "organized religions," their historical rise as official state religions and their positions as power wielding institutions. The collaboration of state and church to enforce a ban on heresy has been one of the most dangerous cornerstones of many of the most totalitarianism institutions of ancient, medieval and modern history.

In my opinion, it is a very bad thing to tolerate.

</comment><comment><USER17> Link to the "movie trailer": [http://www.dailymotion.com/video/xtk8hd_innocence-of- muslims...](http://www.dailymotion.com/video/xtk8hd_innocence-of-muslims- movie-muslims-don-t-want-people-to-see_shortfilms)

It's so bad, actors change voice, presumably because post-production had to make them say things.

</comment><comment><USER14> Movie: Sad that this was made

COST Judgment: Going to cost everyone Billions. Movie industry needs to be scared. If 5 seconds with paper work that was not upfront is the deciding factor of copyright I am betting there are thousands of actors and actresses who will bring up similar claims.

Copyright is to strong already, as we all agree.

</comment><comment><USER18> Interesting. Does this precedent (if it stands) give the EU concept of Moral Rights legs in the US, or was it just that the producers forgot to get the actress to waive her rights to the film?

<comment><USER19> None of the above.

In the US, a judge cannot simply say "OK, we have moral rights in copyright now" \-- only Congress has that power. And the court did not rule that the actress had "moral rights". Most of the time, when you create or take part in creating copyrighted work, for someone else, for pay, you do _not_ hold the copyright to it. The person who paid you to do it gets the copyright, and this is called "work for hire".

What the court ruled was that there may be a case to be made that this would not fall under "work for hire", and if so, that there might be a copyright claim the actress can assert to her work in the film.

The main problem is that it appears to be a ludicrously-massive deviation from established precedent, and in US law courts at this level really do not get to do that, either.

</comment></comment><comment><USER20> The real issue surrounding this film is about how it was used as a tool and scapegoat in the destabilization and coup of Egypt. Lot's of very suspicious activities surrounding it.

</comment><comment><USER21> Ah, Google. Defending the first amendment, while shitting all over our privacy! Such heroes!

<comment><USER22> If you think they are doing something good in this case, I recommend not complaining in discussions about this case.

Also, Google is a big complicated thing with many different people and parts. Don't expect total consistency from anything that large and complex.

<comment><USER21> > If you think they are doing something good in this case, I recommend not > complaining in discussions about this case.

I don't think they're doing anything good. If they were actually good, they wouldn't be eagerly shitting all over our privacy and constantly devising new ways to do so.

This is just a PR/Distraction-stunt.

</comment></comment></comment><comment><USER23> Good riddance. It's pure garbage, regardless of the legal reasons behind the takedown.

<comment><USER24> Being able to say something controversial or offensive is precisely the reason why freedom of speech is necessary. There's no need to have "freedom" to do what everyone else finds non-objectionable.

<comment><USER25> To add to your point:

 _" The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all."_ \- H.L. Mencken

<comment><USER26> We seem to be implying that this means we have a specific obligation to defend all scoundrels and all terrible propaganda movies, when in fact that isn't the case

<comment><USER24> In that there is an "obligation" to defend our liberties there is an obligation to defend attacks on scoundrels insofar as such attacks strike at fundamental freedoms.

Scoundrels are the easiest targets but denying them of freedoms ultimately denies everyone of those same freedoms.</comment></comment></comment></comment></comment>


Say Cheese: a snapshot of the massive DDoS attacks coming from IoT cameras - <AUTHOR> https://blog.cloudflare.com/say-cheese-a-snapshot-of-the-massive-ddos-attacks-coming-from-iot-cameras/ <comment><USER2> I've been warning about this kind of thing for _years_ and years. Both professionally and in my personal life. On forums and anywhere people will listen...

 _IoT is a security disaster_

I hate to suggest things like this but we may need _legal_ remedies to solve the problem before it becomes an Internet Zombie Armageddon (IZA). It's _that_ bad.

There's going to be _tens of billions_ of IoT devices installed at businesses and homes in just a few short years. If they're not receiving regular, timely security updates the Internet as we know it may just plain collapse from the sheer weight of all the zombies.

I propose a mandatory "nutrition label" of sorts for IoT device packaging. Something like this:

        * Updates itself regularly
        * Conforms to NIST security standards
        * Public penetration test results: https://ptr.iot.nist.gov/A2L7P9D23345
        * Shares data with 3rd party: No
        * Administration by vendor: No
        * Requires Internet connection to administer: No
        * Requires 3rd party service to function: No
        * Notifies of intrusion: Yes
        * Logs all access: Yes
        * Encrypts all network traffic: Yes

Something like a publicly-posted penetration test would be incredibly valuable. Especially if it was performed after each update of the device and at regular intervals. Even if it was an automated test (which in theory could be 'gamed') it would still be better than what we have now which is _nothing_!

<comment><USER3> As Dan Geer warned[1], embedded devices must not be both _unfixable_ and _immortal_. Either they have some sort of remove management interface and receive regular security updates, or they _must_ have a limited lifespan.

Creating embedded systems that won't be updated and live indefinitely is knowingly creating a hazard and nuisance to society.

[1] [http://geer.tinho.net/geer.blackhat.6viii14.txt](http://geer.tinho.net/geer.blackhat.6viii14.txt)

<comment><USER4> > _or they must have a limited lifespan_

This seems like it would give free range to sell shitty devices that are obsolete the moment they come out of packaging - or worse, that brick themselves on a timer for supposed security purposes (think HP ink cartridges.)

<comment><USER3> I agree, but the unfixable+immortal combination isn't really an acceptable situation.

The solution for most devices is to simply keep them off the internet. Being a host on the internet requires some level of care and maintenance so you don't become a hazard to others. I doubt most light-bulbs or thermostats are worth the ongoing expenses of maintaining security updates into the indefinite future. In theory, traditional goods that last more than a few years should be more successful on the market than self-destructing devices with dubious internet features.

</comment></comment></comment></comment><comment><USER5> Interesting. This set of attacks is coming from real IP addresses. (SYN floods and single-packet UDP-based attacks use a totally bogus source IP address.) The device can be talked to and potentially located. Somebody needs to be finding some of those devices and analyzing them. How are they controlled? IRC? Some set of known domains or IP addresses? A self-healing mesh network? All of those have been used, and most modern botnets have a quite sophisticated control network. This provides both robustness and conceals the actual controller. In modern botnets, everything is encrypted, so it's hard to take over the botnet.[1]

Attacks from real IP addresses are potentially blockable upstream. That's only a temporary fix. The device, if behind a NAT, can request a new IP address and evade the block. It may do so periodically, just to confuse the issue. At least you can block a hostile IP at a firewall, so it can't use server resources. That's what Cloudflare is doing.

On the legal front, it's worth suing makers of vulnerable devices for negligence. Their EULA will not protect them, because the victim isn't their customer and isn't a party to the EULA. A few court orders to recall a product might get the attention of the IoT industry.

[1] [https://www.damballa.com/downloads/r_pubs/WP_Botnet_Communic...](https://www.damballa.com/downloads/r_pubs/WP_Botnet_Communications_Primer.pdf)

<comment><USER6> _On the legal front, it 's worth suing makers of vulnerable devices for negligence._

Where does one sue the no-name Chinese manufacturers of these devices? I have a feeling a lawsuit won't get very far in Shenzhen Municipal Court. There's absolutely no consequences to them building these devices and you cannot expect a solution from them.

<comment><USER5> Nolo Press: _" In between the manufacturer and the retailer, there may be any number of wholesalers, suppliers, distributors, or other "middlemen." Each and all are part of the chain of distribution of the defective product, are therefore potentially liable, and should be named as defendants in your defective product lawsuit."_

Cloudflare can start by suing a retailer. That's likely to result in the retailer pulling all merchandise from the offending vendor, even before the lawsuit gets very far. (Otherwise, they move to a higher tier of negligence and damages for knowingly allowing the problem to persist.) That will start to get the attention of manufacturers.

See this article.[1]

[1] [http://www.techrepublic.com/article/lock-it-down-ddos- attack...](http://www.techrepublic.com/article/lock-it-down-ddos-attacks-may- land-you-in-court/)

<comment><USER7> Lots of this crap gets shipped straight from China by a distributor on Amazon. Try to sue them and I'm sure they'll just disappear and come back with a different name

<comment><USER8> Sue Amazon?

</comment></comment></comment></comment></comment><comment><USER9> Strangely enough, I think the solution is in devices like OnHub, Google WiFi, or other third party managed routers (yes, another IOT device).

Why? When attacks like this are first detected, they can be shut down at the source. Known bad devices can be preemptively locked down behind a firewall. Traffic to specific IP addresses, or packets which spoof headers to cause amplification attacks could all be detected and dropped before they even reach the ISP.

Yes, there will be problems and bad diagnoses, no, I don't want one of these managing my home network; but it would be perfect for my mother, for my non- technical friends, and for the average Joe with a subverted IP camera.

<comment><USER10> I like this idea a lot. Perhaps every IoT device should publish a profile of its expected behavior to the router. For example, a wifi-enabled thermostat might tell the router that it only intends to connect to a particular range of servers, by DNS name. The router could then set up an automatic firewall rule that stays in sync with DNS changes. The user should be able to disable that firewall rule (to overcome technical issues), but most users will never have a reason to do so.

We could bootstrap this idea by having the router fingerprint IoT devices and apply matching firewall policies from a database. If only we could install "apps" on routers, like we do on Android and iOS devices, someone could get started with this idea right now.

<comment><USER11> The only issue is that after that point, the device can never connect anywhere else.

<comment><USER12> So allow the device vendor a way to push a configuration change?

<comment><USER13> Then the attacker would push that configuration change before DDoSing someone.

<comment><USER10> Well, I would hope that any IoT device that accepts remote configuration or software updates also checks digital signatures before applying changes. If it doesn't, then I would want the automatic firewall on the router to block all updates.

</comment></comment></comment></comment></comment></comment><comment><USER14> That's a problem that will only get worse. To give an example, last year, Incapsula recorded ~9,000 IoT cameras attacking them. A few months ago, Sucuri recorded ~25,000.

CloudFlare is seeing close to 50k. And that's the attackers just using a small portion of their real power for http floods.

Our report from a few months ago breaking down the types of cameras and networking doing the attack - very similar to what CloudFlare saw:

[https://blog.sucuri.net/2016/06/large-cctv-botnet- leveraged-...](https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged- ddos-attacks.html)

*I work at Sucuri.

</comment><comment><USER15> I've got a bunch of cheap Wifi cameras and I don't worry about this kind of thing at all.

All of the cameras live on a separate Wifi network that is unable to connect to the internet. I use Zoneminder to handle all of the recording, motion detection, etc. For remote access, I've got a VPN server running. Fortunately, the cameras I use are perfectly happy to work without being able to talk to the manufacturer's servers (though they do try!).

In a nutshell, I get almost all of the "benefits" of the cloud service (the only missing thing is off-site storage, but a fix for that is in the works) with almost none of the drawbacks.

Of course, this is NOT easy for the average consumer to set up. They expect to be able to plug the camera in and have things Just Work, which is why we've got cameras that can open ports on routers/firewalls, register themselves with cloud services, etc, with minimal effort.

As for IoT in general, my future plans are to use this separate WiFi network for all IoT-like devices that don't really need to connect to the internet. The Philips Hue is a good example - it has a bunch of cloud-enabled functionality, but I don't actually need any of it.

<comment><USER16> It sounds like you actually worry about his kind of thing a great deal, considering the amount of effort you put in.

<comment><USER15> Believe it or not, it was a whole bunch of little things that added up to this state.

When I started with the cameras I was just using the motion detection and email features that were built into the firmware. I never bothered setting up the cloud stuff because I didn't need it. Slowly I transitioned to having the cameras dump images onto a local NAS via FTP. Eventually I started using the cameras for more than watching the cats, so I needed something with better motion detection and recording capabilities. I started with 'motion', then used a fork of 'motion' that seemed to work better, then finally ended up with ZoneMinder.

On the VPN side, I decided many years ago that I wanted remote access to my "stuff" \- file shares, etc. This started out with the PPTP VPN built into my router, which is terrible but sort of worked. The next step was writing a script that would run SSH and set up a couple dozen tunnels, which is differently terrible but sort of worked. Eventually I got tired of maintaining that and ended up with an IPSec VPN using racoon -- split DNS and split tunneling are truly amazing.

The extra Wifi network actually started as a misguided attempt to prevent other stuff (Netflix, mainly) from interfering with the cameras. I figured that putting them on a separate Wifi network would isolate them and give them dedicated bandwidth. My first attempt involved using a Raspberry Pi as an AP. It worked, but not very well at all. The second attempt used the Virtual AP functionality on my router -- it wasn't until I set this up that I understood that Virtual APs don't quite work this way. Around this time I started to see articles about cloud-enabled cameras doing bad things and decided that this setup was worth keeping.

The camera and VPN stuff both went on over the last 5-10 years or so, with the Wifi changes being something I did within the last year.

You're right that there was a lot of effort, but as you can see it wasn't really driven by privacy/security until the end. Most of these things were driven by trying to find better ways to scratch various itches.

The next planned change is to re-address my network so that it doesn't use the 192.168.1.0/24 range that every consumer router seems to use by default. This way I will be able to use VPN when I'm visiting friends without having to tether to my cell phone. Like everything else, it's just scratching an itch.

</comment></comment></comment><comment><USER17> A general solution to IoT security would be for all IoT devices to only communicate to your personally owned home gateway, which would run open-source drivers for each device to provide the networking/external communication functionality. The IoT device could even be assigned its own isolated network link to the router (i.e. sandboxed).

That approach seems like the only logical conclusion for the device owners. I _hope_ this is how the field will eventually evolve.

While its against the commercial interests of "Internet data" companies (who might subsidize devices), in the long term regular consumer appliance manufacturers will implement it _if_ theres enough market pull for it.

<comment><USER18> That is kind of what Nest's Thread protocol allows IoT devices to do. But strangely enough, Google is going the opposite direction with its devices, including coming up with such stupid ideas of controlling your (OnHub) Wi-Fi router _over the Internet_ through an app.

<comment><USER17> Thread is just an IPv6 wireless mesh routing protocol right [1][2]?. On its own it doesn't solve 2 key security problems:

* Any device can send arbitrary data to somewhere on the internet

* Internally, any devices can send arbitrary data to any other device

\</comment></comment></comment><comment></comment><comment></comment><comment>-----

Another less-critical but important usability limitation is the short sighted nature of how device logic + APIs will evolve long-term for Device-to-Device communication.

Device-to-Device implies the application protocols are running on the devices themselves, which can't be bugfixed or upgraded by the user and in the majority of cases will likely never be updated by the manufacturer after release.

In [2] they give examples of devices like fridges and thermostats talking to each other. There's 3 long-term ways I see of handling device-to-device application APIs:

* Option 1: Raw device-to-device (Short term): How the hell will those APIs be agreed upon and evolve across multiple years and device products? Bluetooth now barely handles relatively simple interop use cases (files, contacts, audio...). Will Thermostat X support Fridge Protocol 8? How will the user handle more advanced use cases?

* Option 2: Vendor managed (Currently the most likely): The devices will talk to the vendor servers which will talk to other vendor servers which will talk to your other devices. Terrible for the user for so many reasons but great for the vendor: its the simplest to implement, keeps protocols secret and locks user into giving that specific vendor endpoint all that juicy data.

* Option 3: User managed (IMHO Preferable): Computer drivers are a much better model for this. Drivers sit over devices to transform the weird device API (fixed target) into a consistent interop API (community driven moving target) that does what people want. This still supports device-to-device: device A -> API call on gateway driver A -> gw driver interop API -> API call gateway driver B -> device B. This is what Option 2 (vendor managed) will actually have to do under the hood anyway. This could be implemented in a simple way e.g. with per-device(type) containers exposing a TCP/UDP port to the device.

I predict Option 3 to become mainstream when the year of the Linux desktop lands :D

\</comment><comment></comment><comment>-----

[1] [https://www.threadgroup.org/portals/0/documents/resources/Th...](https://www.threadgroup.org/portals/0/documents/resources/Thread_Technical_Overview.pdf)

[2] [https://www.infoq.com/articles/thread-protocol-for-home- auto...](https://www.infoq.com/articles/thread-protocol-for-home-automation)

(Thread is a poorly chosen name for a new computer protocol:P)

</comment><comment><USER19> I have a few cheap chinese ip cameras and I noticed that they have telnet open (I subsequently rooted them to fix this) and of course have them behind my home firewall.

However this and other IoT devices got me thinking that maybe it's time to start an underground device hacking organization solely committed to not only rooting and reverse engineering these devices but also releasing new firmware for all of them with open source internals. I'm sure this would have to be "underground" due to all the legal restrictions around the embedded device drivers.

Who wants to do this? I wouldn't know where to start besides a .onion site...

<comment><USER20> >not only rooting and reverse engineering these devices but also releasing new firmware for all of them with open source internals

I had the same idea, except in my version automated scan finds exploitable IOT devices and updates them with new firmware straight from /dev/null. Problem SOLVED.

<comment><USER21> Actually it would be a nice thing to do. Wonder how long would it take manufacturers of all this crap fix their shit after massive warranty claim flood came in

</comment></comment></comment><comment><USER22> Does Cloudflare still host (edit: proxy) the companies that do DDoS attacks thus serving to justify the use of Cloudflare services?

<comment><AUTHOR> We don't do hosting.

<comment><USER22> Quoting Brian Krebs:

> These two services, like most booters, are hidden behind CloudFlare, a > content distribution service that lets sites obscure their true Internet > address. In case anyone cares, Lizardstresser's real Internet address > currently is 184.108.40.206, at a hosting facility in Bosnia.

[https://krebsonsecurity.com/2014/12/lizard-kids-a-long- trail...](https://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of- fail/)

<comment><USER23> So they don't do hosting... What you've quoted just explains how they act as a layer in front of the actual server

<comment><USER22> Host/proxy - a non-relevant detail. I misspoke.

Either way, Cloudflare appears to both help booters and then also sells services to protect you from booters.

<comment><AUTHOR> Cloudflare's CEO spoke about this here: [https://www.youtube.com/watch?v=SWFX- zEYwN0](https://www.youtube.com/watch?v=SWFX-zEYwN0)

<comment><USER24> An almost hour long talk. TL;DR?

<comment><USER25> (I work at CF)

I usually agree that spending 1h on a talk may be much. But I found this one to be really good. Matthew is both entertaining, and revealing some things that weren't public before.

I'd say the 1h is worth it.

<comment><USER26> I think the point of a TL;DR is to allow those short in time to still take some points away, or to give an overview and entice to consume the entire thing.

I'd say "Cloudflare recommends Cloudflare" is pretty uninformative while a TL;DR isn't.

<comment><USER27> Sometimes there isn't a TL;DR. Like explaining cancer or quantum physics in 30 seconds misses most of the important details.

<comment><USER26> Sure, but GP seemed to focus on "I know best how to spend your time", whether intended or not. Irksome.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> > Connection: close

well if they would have keep-alive it would be probably even more disastrous. especially if the botnet would have some intelligence that it would try to detect the keep alive timeout and send requests exactly in this time frame.

\--

also a lot of these devices are probably built with linux. and here is something that is probably bad with linux, the lifespan of most linux iot devices are probably outspanning the official lifecycle of any distribution/kernel. this may lead to problems that the vendor will just abadonned it or doesn't care anymore, if he even provided a way to upgrade. on windows this is probably as bad as well since most vendors will probably not pay additional fee's after the next windows iot gets out of live.

it's probably time to abadon most os's for these devices and create a new open source project for these kind of devices, hardended from scratch. this would at least help with the unmaintained part of the os parts, which would make the situation at least 1% better. well it won't fix the laziness of certain vendors.. but it would be a beginning.

</comment><comment><USER29> The OVH write-up [0] is very interesting combined with this, as they had to withstand an even bigger attack. Unfortunately, they don't publish as many statistics. But apparently their attack came mostly from Spain, so different AS than Cloudflare.

Their plans to upgrade the Ddos mitigation sound very interesting, will be interesting to see how long it takes until they need the 5Tbps:

>will be replaced by a new technology developed in-house and based on FGPA (programmable integrated circuits) and codes that have been in development for the past 18 months. This will allow us to offer up a VAC capable of withstanding DDoS attacks with peaks up to 5 Tbps without slowing down our network.

[0] [https://www.ovh.com/us/news/articles/a2367.the-ddos-that- did...](https://www.ovh.com/us/news/articles/a2367.the-ddos-that-didnt-break- the-camels-vac)

</comment><comment><USER30> Internet is decentralized so there is no authority that could stop DDoS attack. We need a protocol that would allow a host to require peer or upstream network to block/allow traffic from specific IPs or subnets. And of course the denied traffic should not be paid for.

</comment><comment><USER31> Seriously? I get the cameras scenario keeps coming up, but most of these (if not all) are CCTV systems with a DVR with open remote management that either:

\- Is turned on by default (bad)

\- Is turned on without enabling even the slightest of security by the end user (stupid but still bad)

\- If a or b aren't true, it has some sort of exploit that the company will never fix (if they are still in business)

The "rest" of IoT in many cases doesn't have this problem at this scale. You're either talking about proximal networks with no outside internet (z-wave, 15.4, etc) or something with secure communication with the home service (PKI for example).

I'm more and more frustrated with IoT fearmongering, if you want to talk about CCTV fearmongering? OK. But these aren't Nest cams, or Arlo cams. They're off the shelf DVR CCTV systems.

</comment><comment><USER32> At the moment a ddos is like an open weapon that can be deployed by nearly anybody to further any agenda; governments, extortionists, and anyone with an axe to grind.

But putting the burden on all devices that connect to the network is idealistic. Sure it may work for the 99 billion devices, but what about the 1 billion devices that may not be properly secured. This wack a mole strategy rarely works.

There must be a way for edge nodes to quickly detect a ddos and shut it down.

We should be extremely wary security hysteria often used by people with agendas to gain control and lock things down. Only 'approved' devices can connect to the network or everyone on the internet must surrender their passport to the nearest authority and be surveiled 24/7 to prempt and prevent criminal operations.

</comment><comment><USER33> The first attacks were described as only lasting minutes. Is this the perpetrators stopping? If so, why? In case people start to notice their 'smart' lightbulbs are glowing unusually bright? Otherwise what else stops the attack?

<comment><USER34> Proof of ability to potential customer? Checking that their command and control software works?

I doubt you'd notice a difference on the device unless you were doing something network/CPU intensive on it, even then, it'd just seem slow.

<comment><USER33> Ah OK that makes sense, thanks. It's handy for companies like Cloudflare to get a heads up on what's around the corner.

</comment></comment></comment><comment><USER35> Nobody seemed to mention it, but the large payload query is designed to also DoS the hell out of old/insecure PHP binaries that will blindly accept (and keep appending) as many items as you want. (In this case the array $a).

Similar attacks probably work against other CGI parsing things that don't expect to have hundreds of thousands of qps each with long querystrings.

</comment><comment><USER36> The only way I see IoT security being taken serious is when someone makes a bot that hunts down insecure IoT devices and permanently disables (bricks) them. Only then will customers will force manufacturers to take the subject of security seriously.

</comment><comment><USER37> Does anyone if there's a commonality amongst these IoT security cameras that is facilitating this? Is it just non-sensible defaults or is something more like the embedded webserver/SoC?

<comment><USER38> I think the biggest shared threat is the ability to punch holes in firewalls with upnp. That and the fact that they're running ancient unpatched software stacks.

<comment><USER37> Indeed, that gets back to not sane defaults though I suppose. The filet-of- firewall was particularly troubling, Flash and DNS rebinding is all it takes if UPnP is running on your router. This worth read if anyone is interested:

[http://www.kb.cert.org/vuls/id/361684](http://www.kb.cert.org/vuls/id/361684)

</comment></comment></comment><comment><USER39> How about this for a fix? Just thinking out loud here...

Let's make a protocol that allows a server to specify to its upstream ISP to cut off all traffic from a particular IP address. The ISP can either soak up the traffic, or go further up to its own upstream ISP and relay the request, and so on until the source of the attack is reached. Now it's between an IoT device owner and his residential ISP, it's up to them to sort it out.

To motivate all ISPs to play along let's make a law for each ISP to be financially responsible for failure to honor such requests, enough for a victim to pay for defense plus some %% in penalties.

Sort of an automated "Ceases and Desist" letter, and a failure to abide is an automatic tort.

Hm?

<comment><USER40> BGP flowspec works kind of like that. Also routers don't have unlimited capacity to hold everyone's filtering rules, don't forget that.

<comment><USER39> Your typical large-scale attack has a few thousand IPs at most, so it's technically doable. All that's missing is the motivation for everyone to abide. With enough incentive hardware makers might accommodate, too.

</comment></comment></comment><comment><USER41> Time probably time to name and shame brands. CP Plus is doing so much marketing in India with TV slots.

They should probably invest that in doing some research and patching .

</comment><comment><USER42> If things get too bad, can cloudfare pool with google, etc. and just block the IPs of those affected? (until someone fills a captcha)

<comment><USER25> There are researchers in many companies that are actively fighting the botnets.

Some links:

\- [https://krebsonsecurity.com/2016/10/who-makes-the-iot- things...](https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under- attack/)

\- [http://blog.malwaremustdie.org/](http://blog.malwaremustdie.org/)

\- [https://www.akamai.com/us/en/our-thinking/information- securi...](https://www.akamai.com/us/en/our-thinking/information- security/information-security-research.jsp)

</comment></comment><comment><USER43> It's high time we start fixing criminal liability for companies building such poor quality software and hardware.

</comment><comment><USER44> Seems somewhat ironic that an article about DDoD is published on CloudFlare's blog.

<comment><USER45> Ironic? To me, it seems quite fitting that a company who has "protecting you from DDoS attacks" as one of their major selling points would publish an article about (recent and relevant) DDoS attacks.

<comment><USER46> Ironic in the sense that they protect companies offering DDoS as a service.

</comment></comment></comment><comment><USER47> Their graphs mention Mrps and Krps, any idea what the R stands for?

<comment><USER48> Requests (i.e. HTTP requests).</comment></comment>


Entangled - A DHT Based on Kademlia - <AUTHOR> http://entangled.sourceforge.net/

<comment><USER2> A DHT thats based on a pre-existing DHT implementation? Who woulda thought..

TBH, I'm more interested in the tuple space aspects of Entagled then it's DHT bits. But thats just me.

</comment><comment><USER3> Probably a few years before a couple of well-used open source components emerge but it's good to see development in this space.</comment>


Incliq - the (P2P) social network that doesn't suck? - <AUTHOR> http://incliq.com

<comment><USER2> Unfortunately I do not see incentive for the mass to move from facebook to this new solution.

It is really though already to educate ppl about privacy issues already let alone trying to convince them to migrate from facebook to another solution.

Even in a best case scenario where there would be a general consensus about leaving facebook, the migration task itself is so huge that it would probably make the project fail on its own. Nobody wants to be scatered between FB, Twitter, the other bazillion sites that we're subscribed to and this newer one.

</comment><comment><USER3> video describing what they plan to do: <http://www.youtube.com/watch?v=vcrVzWVo4Fs>

Based on the video, I think maybe diaspora would serve this purpose better.

</comment><comment><USER4> If I have one friend, and our machines are never both on at the same time, how do our updates get synchronised?

</comment><comment><USER5> no. it sucks.</comment>


Suggestion for startups - remind us who you are when you email - <AUTHOR> As a user of online services, I can't tell you how many times I get an email from one I haven't used in a while, asking me to come back or telling me about a new feature.
Problem is, if I've only used your site/service once or twice, I might not remember what it does -- especially if your name is abstract.
Even a simple line like "XYZ creates and manages RSS feeds from your Facebook streams" would be a memory jog, and gives you room for a quick marketing pitch.
Remember -- just because you automatically associate your name/URL with your product doesn't mean that we your prospects or customers do.
On the flip side, know that as users we appreciate the work you put into your site and service, even if we don't email you to say so.  Thanks! <comment><USER2> Likewise with your company blog. Put a prominent, descriptive link to the main site at the top. It's too common that I have to go to the address bar and remove "blog." to get to the main page. Most people won't do this.

<comment><USER3> And while you are at it, make sure there is a clearly highlighted way of contacting you on your blog (both startup blogs and personal blog).

If you don't want to give out your email address or create a second email address just for the blog, offer a contact form at least.

</comment></comment><comment><USER4> So true. I got an e-mail yesterday with an invite to Crowdbooster. I don't even remember signing up for an invite, let alone what Crowdbooster is, and the e-mail didn't offer any clues at all.

<comment><USER5> I got the same email from Crowdbooster. It's the first thing I thought of when I read the title.

<comment><USER6> We'll fix this right away! Thanks for taking time to read through an email without any context of what the company did. Let me know if you have any questions or have run into any issues.

</comment></comment></comment><comment><USER7> That's the best advice I've read in weeks. Thank you. I'm changing this right now for the notification emails of our startup.

</comment><comment><USER8> Very good advice, this should be part of your branding strategy.

And I'd say instead of "XYZ creates and manages..." I'd say a line like this should be a standard link to your login page:

"Create and manage RSS feeds from your facebook streams: [XYZ Login Link]"

</comment><comment><USER9> I'll add that if you have invite e-mails that people can send to friends, you better explain your startup in the e-mail. I've received invites from legit startups that looked exactly the same as spam invites that I've received.

</comment><comment><USER10> Great advice!

I've always been annoyed by those e-mail invitations to the beta of a service I signed up to many weeks ago, that don't give me any clue to remind me why I cared in the first place...

</comment><comment><USER11> This x 1 million.

</comment><comment><USER12> And please, just one e-mail. Don't let a rambunctious new marketing type decide "Hey, if we find our inactive users and email them two or three times a week from here on out we'll increase our user base". And make sure your unsubscribe features work.

</comment><comment><USER13> The first thing we were taught in the business and formal communication class (mandatory for freshmen at my university) is that in the body of an official letter, the first paragraph is essentially a small pitch of your company or product. I found it stupid at first but then in the third lecture I asked the question "But why?" and the professor gave just that reason. Customers and even other business which provide raw materials, tool or purchase your product/service might not remember who you are even if there is a gap of a week in your communication.

</comment><comment><USER14> You should also link to any particularly informative HN post about your product.</comment>


Employment and Stock Options Plan Explained - <AUTHOR> http://stason.org/articles/money/investing/everything_you_ever_wanted_to_know_about_employment_and_stock_options_plan.html

<comment><USER2> If you are ever exercising your options; get out the crowbar, pry open your wallet, and go find an accountant to explain all of your tax options and the risks involved in them.

If you exercise your options, I believe you generate a taxable event. If you do not sell the stock for twelve months (as advocated in the article), you risk the stock price dropping below your strike price and you might not have enough money left to pay your tax bill. I recall reading a sob story (Money magazine?) about a guy going bankrupt because of this but I haven't been able to find it.</comment>


The Unmistakable Trait of a Kick-ass Startup - <AUTHOR> http://vijaysblog.wordpress.com/2008/03/21/the-key-element-of-a-kick-ass-startup/ <comment><USER2> I don't buy it.

One at a time:

1\. Good (ie, narrowband) voice codecs have been around for a while. I don't think that's why Skype took off. I think that they crystalized the notion of the cheap call.

2\. I can't comment on the TeNeT group with any authority.

3\. Originally, Google wasn't visionary in any way. It was another search engine, albeit a good one.

4\. The Tata Nano seems to be the latest in a long line of ever cheaper people's cars. You may remember this one:

[http://people.westminstercollege.edu/staff/bknorr/html/histo...](http://people.westminstercollege.edu/staff/bknorr/html/history.htm)

</comment><comment><USER3> Although the examples are not the epitome of what I think he's trying to get across, I would describe the overall thesis as "great startups are those that engage in creative destruction" (to quote Schumpeter).</comment>


Friends for Sale Architecture - A 300 Million Page View/Month Facebook RoR App - <AUTHOR> http://highscalability.com/friends-sale-architecture-300-million-page-view-month-facebook-ror-app

<comment><USER2> Great to see this float to the front page. blader announced their launch right here on news.yc: <http://news.ycombinator.com/item?id=74993>

That said, is this YC-funded?

</comment><comment><USER3> It's a toy application on a real infrastructure. Wait until developers start writing some real value-adding/lifestyle Facebook apps. Real Facebook applications will intermediate between users without requiring their direct input (think Personal Assistants). That being said, 300M page views/month is something most indie developers would sell their friends for - though it might be a bit embarassing that it's such a LCD app.

<comment><USER4> I wouldn't expect to see value-adding apps too soon... unless FB is willing to make some significant changes to their platform. There's simply no incentive to make them right now -- virality continues to be the main criterion for app success.

<comment><USER5> The #1 value added app for lots of people, whether they know it or not, is exportability insurance. Make an app that tracks everything externally so that if Facebook starts to suck, you can migrate the next platform.

The existence of that portability might actually ensure things never start sucking.

<comment><USER6> I believe it's been tried. They got shut down.

<comment><USER5> the end is nigh

</comment></comment></comment></comment></comment><comment><USER7> It this a type of <http://en.wikipedia.org/wiki/Sharecropping>

</comment><comment><USER8> What do you guys think is a "reasonable CPM"? $0.001? $0.01? $0.05?

<comment><USER9> I think those are too low. At $0.05 CPM, 300 million page views would earn just $15000 a month. I doubt that that many pages could be served for a few thousand dollars. Look at their hardware and bandwidth costs and work out what a profitable CPM would be from there.

<comment><USER10> 3E8 * .05 = 15 million, not 15000

<comment><USER11> CPM = cost per mille

300 000 000 / 1000 * 0.5 = 15000

<comment><USER12> Should that be 150000?

<comment><USER11> typo 0.05</comment></comment></comment></comment></comment></comment>


Ask HN: How to speak English like native speaker? - <AUTHOR> <comment><USER3> I guess it is very difficult. But definitely achievable. English is an easy language to learn. You can master reading, listening and comprehension. But the tricky part is the speaking as a native speaker.

You need to listen to a lot of native speakers to adapt their accent. But then again which accent do you want to adapt? British? American? Australian?

Further, those accents break down into a lot of sub-accents based on the geographical location of the country. But with enough practice you can reach a level where native speakers would not hear the subtle differences in your pronunciation and you'll be speaking just like any native speaker in that area.

</comment><comment><USER4> be a native speaker.

I think it's impossible to really speak as a native speaker. You'll always have to improve in some ways that you cannot see before reaching a close-to- bilingual level.

You can just improve. The only questions are: what's your current level ? what are the points you're not satified with ? what's your goal by speaking "like a native speaker" ?

<comment><USER4> As an example, for myslef: \- I'm not satisfied with my accent, my english accent is just ok, and sometimes it really goes into french accent without control. \- I miss a lot of specific vocabulary in some areas as politics, human science, medecine \- I'm not able to judge my grammar rightness because I've no idea what the rules are. I would have listen more carefully at school if only I had known...

But I can understand most movies without subtitles exept the american ones in wich everyone speaks at 200mph, so i do not make any efforts in improving.

Anyway, I do not care about speaking as a native. Language is here to understand other people and explains your own views. In most situations I can do that. I've no urge on improving myslef

<comment><USER5> _I would have listen more carefully at school if only I had known..._

Meh... I doubt most native speakers of English learned the _actual_ grammar of English, as used in practice, from listening in school. You learn English (or any language) from experience, more than anything. I couldn't recite many or any of the "rules" of English as taught in 11th grade English class, but I speak English fluently because it's my native language.

I'm not an expert, but everything I've heard suggests that - in the end - <USER2> best way to learn a new language is immersion. Or the closest approximation to immersion you can get, without moving to another country or whatever.

When I was working on learning Spanish at one time (an effort that I, sadly, more or less abandoned) the things that seemed to help me most were:

1\. Having a Spanish speaking friend who was a native Spanish speaker to talk to

2\. Trying (and failing, but gradually getting better) to converse with the wait staff at Mexican restaurants in Spanish.

3\. A couple of nights a week, watching an hour or two of Spanish language sit-coms or whatever I could find on Telemundo or Univision.

4\. Listening to my Spanish course while I was driving around, commuting to work and so forth.

I never got around to trying, but I suspect it would also have helped if I'd found some good Spanish language podcasts, or news channels, to listen to during other idle times.

<comment><USER4> Yeah, that's mostly what i've done to learn english. watch movies, read news, speak english whenever I can. I suppose my english is good. I know it is compared to the poor french standards, but I cannot judge compared to real english speakers.

Do not worry, I am not obsessed with grammar. It would just give me some tools to judge objectively about my level. I had like 4 hours a week of english for 10 years, that's 1400 hours I think. I just lost those hours for nothing</comment></comment></comment></comment>


Mozilla pulls Bypass Paywalls from Firefox add-ons store - <AUTHOR> https://github.com/iamadamdev/bypass-paywalls-firefox/issues/82 <comment><USER3> Lots of heat in this thread...

So, Addons are mostly reviewed by volunteers. Sometimes people make mistakes. The best course of action is to try to reach out for the AMO team on IRC or their mailing list.

\- Addons forum is at [https://discourse.mozilla.org/c/add- ons](https://discourse.mozilla.org/c/add-ons)

\- All contact info for AMO dev stuff is at: [https://developer.mozilla.org/en-US/docs/Mozilla/Add- ons#Con...](https://developer.mozilla.org/en-US/docs/Mozilla/Add- ons#Contact_us)

\- Developer Hub for addons is at: [https://addons.mozilla.org/en- US/developers/](https://addons.mozilla.org/en-US/developers/)

There is no need for FUD or conspiracy theories. We can just talk to people and find out what happened and maybe revert it if possible.

<comment><USER4> My experience with firefox add-on reviewers has been hit or miss - One of the most frustrating things is that reviews often happen long after your add-on has been published. I'd rather have a longer waiting time, but once an add-on is published then it means it's been approved. From the developer point of view it means that it's very hard to communicate on releases, because you never know when your addon is going to be reviewed. From the end user, it means that if someone maliciouly changes one of your addons, you may already have updated to that version before the review. I also feel that the guidelines around reviews aren't well explained, and the reviewers comments are often terse, bordering on the incomprehensible : at least with Apple, you get pointed to which part of the rules they think you didn't respect - <USER2> firefox, we often get broad comments that require a bit of back and forth to figure out what it is they're actually thinking is wrong.

<comment><USER5> This was the old model and it put a lot of pressure on the volunteer add-on reviewers and their were times where the delays stretched out to several months.

<comment><USER6> It's not like Mozilla has no funds. Why not hire a couple of people for the reviews?

<comment><USER7> Or at least hire review coordinators who can manage the program effectively. Our volunteers review 15,000+ loans a month. Happy to share insights with Mozilla on how to run an effective volunteer community and keep the pipeline flowing.

</comment></comment></comment></comment></comment><comment><USER8> > Release and Beta versions of Firefox do not allow unsigned extensions to be > installed

I'm really disappointed at Mozilla regarding this. I recently wanted to do some Firefox customization for my own private use (not even an extension, I just wanted to have some visual indication of which Firefox windows belong to which profile). I was surprised to find out that even just a header .png in a theme can't be loaded locally but must be on-line and vetted by Mozilla. Utter craziness.

<comment><USER9> IIRC you can install unsigned extensions in the dev and nightly as well as unbranded versions of firefox (usually the last option means compiling it yourself).

Mozilla is, to some extend understandably, concerned with the image of Firefox and patrolling what Addons are available in the store is part of that. Apple does the very same thing.

<comment><USER10> > Apple does the very same thing.

I understand that Apple does everything in its power to make the life of developers miserable (such as requiring a Mac to be used for iOS development), but Mozilla were supposed to be the good guys on the web.

<comment><USER9> I think you misunderstood there.

Apple's primary aim by limiting the access to the store isn't to make devs miserable, it's to have users trust the app store.

Mozilla's aim is (likely) the same. If a user finds an addon in _Mozilla 's_ addon store, then Mozilla wants the user to fully trust that this addon will not violate their privacy in unexpected ways or install malware on their computer or otherwise interfere with them.

Similarly, Apple spends a lot of money on making sure the PR image of the app store is clean. People should be able to fully trust Apple's app store, in Apple's opinion.

That doesn't mean there won't be addons you don't like, it just means that malicious behavior is not allowed. If the user doesn't like it they can remove it without consequence.

<comment><USER11> > Mozilla's aim is (likely) the same.

Nothing prevents me from compiling my own binaries and running them on my Mac.

But the issue here (AFAICT) is that Mozilla won't even let you sideload your own stuff on your browser. This is horribly broken.

<comment><USER12> >But the issue here (AFAICT) is that Mozilla won't even let you sideload your own stuff on your browser.

There's no way to allow that that doesn't also allow crapware / malware installers from injecting stuff into Firefox.

</comment></comment></comment></comment></comment></comment><comment><USER13> While this is extremely dubious behavior from Mozilla, and reminds me why I stopped donating to them (the moment Firefox started requiring _their_ signature in order to load addons), Mozilla still has the "automated signing API" in place. Supposedly, this API allows to get an XPI signed as long as it passes a series of automated checks. So it's worth a try.

This was the excuse they used anyway when trying to justify their signature requirements were "not a walled garden". I didn't believe it of course.

You can also just mark the addon as "not listed in AMO" when submitting it to addons.mozilla.org and it will not be listed on the store, but it will be signed. More details in [https://developer.mozilla.org/docs/Mozilla/Add- ons/Distribut...](https://developer.mozilla.org/docs/Mozilla/Add- ons/Distribution)

<comment><USER14> I've recently been experimenting with creating an extension, and the automated signing was literally one of the first things I did when I followed the Hello World tutorial. It's very easy to obtain an .xpi that you can distribute to your users yourself.

<comment><USER10> How do you do this without leaking your code to mozilla?

<comment><USER15> Out of curiosity, under what circumstances would you consider distributing an extension bundle to be leaking its code? Unless I'm misunderstanding, isn't this the same file you'll be distributing to your users? At first bluff it seems similar to worrying about leaking your website's frontend (I've got news for you...).

<comment><USER16> It could be a private extension developed by a company internally, and only distributed to internal users.

<comment><USER17> If it's for an entire company, then it's easy enough to compile your own copy of firefox that accepts extensions signed with the company signature rather than mozilla.

<comment><USER10> It's really not. Small businesses exist.

<comment><USER17> If you have the resources to develop an internal company addon, you have the resources to build a firefox that accepts a different signature.

<comment><USER18> Respectfully disagree - having to rebuild each time patches come out, on multiple OSes and versions, which have a patch to allow unsigned extensions is a massively more time expensive than developing a browser extension, and requires extra knowledge on the behalf of the persons responsible

<comment><USER14> Luckily it's not necessary: you can still enable a flag in ESR releases that allow installation of unsigned add-ons, so that solves it for company-internal tools.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> The worst bit here is that they aren't explaining exactly which part of the ToS is being violated, and what needs to be done to fix it...

<comment><USER19> A large part of corporate platform power is due to the ambiguity in decision making arising from the absence of clear and transparent processes or accountability regarding how the rules are applied.

That's just a giant gateway for despotism.

<comment> dao- It's unlikely that there's a corporate decision behind this. I wouldn't even call this a corporate platform. Let me copy-paste a comment from further below that deserves more attention:

[https://news.ycombinator.com/item?id=18568302](https://news.ycombinator.com/item?id=18568302)

> Here is what the creator actually said

> >One of the community reviewers removed it from the store claiming it > violated the ToS, which is BS. The ToS never mentions the word paywall once. > Please support me in appealing! [https://wiki.mozilla.org/Add- > ons#Getting_in_touch](https://wiki.mozilla.org/Add-ons#Getting_in_touch)

> Which sounds more like a zealous community member than Mozilla taking a > position.

<comment><USER19> I didn't want to imply a corporate decision behind this specific case.

Corporate power arises through the capability alone, not necessarily its frequent execution.

I think that Mozilla is actually a great company to demonstrate how responsible platforms could operate. Past examples might be Pockets non cloud based recommendation engine or their encrypted user account setup.

</comment></comment></comment></comment><comment><USER20> This would not be an issue at all if Firefox had not jumped the shark in version 37 by implementing anti-user features like requiring Mozilla approval (signed) to run add-ons.

<comment><USER21> The idea is to protect users, not hurt them in any way. Anyone can sign and run their own add-ons, or offer those add-ons for others to use. The only thing being restricted now is who can distribute their addons via addons.mozilla.org, which seems more than fair.

<comment><USER22> The idea might be good. The execution is harmful to users, and they refuse to roll it back. That's all that matters. Mozilla has shown this pattern consistently - they have an idea they think will be good for people, and when it ends up being hurtful and damaging not only the core product but the userbase - driving more people to alternate browsers - they steadfastly refuse to see what's going on around them.

Frankly, those of us who went to Pale Moon may as well have been the last rats off a sinking ship.

<comment><USER23> > The idea might be good. The execution is harmful to users, and they refuse > to roll it back.

Howso? I've been using FF forever and I didn't notice this change…

<comment><USER22> I'm glad that all of the addons you use are the ones they've approved of and which haven't been made incompatible by any of the major breaking changes they've introduced in the last few years.

<comment><USER24> Those seem like two entirely unrelated issues

<comment><USER25> I don't know the whole story, but I'm inferring that the signing change affected the ability for people to sideload plugins.

<comment><USER24> That had nothing to do with the move to WebExtensions and the associated compatibility issues though...

<comment><USER22> I feel that Mozilla's misdirection is one very large issue encompassing many problems.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> I don't want to subscribe, I also don't want to see ads or be tracked. I wish there was a universal micropayments way of paying for what I read.

<comment><USER27> If you mean automatic micropayments when reading articles then you'll still be tracked, because the payment provider has to track what you read to make the payments and even has to be able to provide a log of it in case there is a payment dispute, so they will store what urls you visit and when.

Without a proper log payment disputes can't be resolved legally.

<comment><USER28> if there was something like anonymous payments (cryptocoin-based maybe?) then it would be possible without any tracking. In the few cases where you ask your penny cash back because something happened, most companies would just give it back without questions asked assuming they dont get tons of cashback requests from your IP.

<comment><USER27> That's why they need a log, because there will be cashback requests which people could abuse. And this will not necessarily be only pennies. A penny for a single page, for example, but if you visit many pages of the same site then the amount will be much higher and a user could claim then he has never visited that site and wants his money back.

<comment><USER29> Seems like there has to be some method to solve this? Maybe the transaction is part of the page load? You don't get the page until you pay via anonymous cryptocurrency. No need for any post-transaction verification and reconciliation? The problem there will be if the page fails to load, how can I safely get a second attempt without creating some kind of "double-spending" problem.

<comment><USER30> There is.

You can do tracking in such a way only the person browsing has a log. In the case of a dispute, the log file can be revealed to the website so they can determine how to resolve the dispute.

In the undisputed case, the website wouldn't see the log.

</comment></comment></comment></comment></comment></comment><comment><USER31> Here is what the creator actually said

>One of the community reviewers removed it from the store claiming it violated the ToS, which is BS. The ToS never mentions the word paywall once. Please support me in appealing! [https://wiki.mozilla.org/Add- ons#Getting_in_touch](https://wiki.mozilla.org/Add-ons#Getting_in_touch)

Which sounds more like a zealous community member than Mozilla taking a position.

<comment><USER3> yes!!! people don't realize that volunteers review the addons and that sometimes they make mistakes. They start acting as if Mozilla sent an internal memo to kill something when it is usually not the case.

<comment><USER32> > that volunteers review the addons

I don't think that makes it better. In fact, it's worse.

Why is Mozilla Corporation, a company with gross revenue of $562 million, delegating an important security role to unpaid and apparently unaccountable volunteers?

<comment><USER3> Thats not how it works. To become an addon reviewer there is a process and it is not like all the reviewers are the same. Again please, don't treat volunteers who are donating their time and effort as unaccountable or as if they don't know security, they are accountable and there is also a staff team working on there. There are a ton of volunteers who are very good with security. Whatever happened between this addon author and the review this is kinda private to them.

I really dislike when people assume that because you're a volunteer that you're unaccountable or less capable technically or security wise than an employee. That is simply not true.

There are volunteers in all places at Mozilla and personally, I think this is great. Also treating Mozilla as a company is not really the ideal mindset. Mozilla is at best a NGO, a foundation, who owns a company for legal reasons, who is also a community, who builds a ton of stuff. It is quite a complex entity to be summarized as "a company should handle this different".

<comment><USER33> I don't understand what point you are trying to make. First you agree with the OP that the reviews being done by volunteers who can makes mistakes somehow makes Mozilla less culpable, then you jump in to say that these volunteers are just as accountable, technically capable and security wise as an employee would be.

You only seem interested in letting Mozilla off the hook rather than acknowledging the systemic issues that gave rise to this situation.

> Also treating Mozilla as a company is not really the ideal mindset. Mozilla > is at best a NGO, a foundation, who owns a company for legal reasons, who is > also a community, who builds a ton of stuff.

Except the Mozilla Corporation is the entity that develops Firefox and is a company. That company may be wholey owned by a non-profit, but it is still a company.

</comment></comment></comment></comment></comment><comment><USER34> This is a cool add-on, but it does have the side-effect of making cookie- consent and GDPR popups/boxes appear for every page loaded.

Can anyone recommend an add-on for automatically hiding/dismissing such popups?

<comment><USER35> The following two solutions hide cookie messages.

Fanboy's Anti-Cookie Filters (for uBlock Origin, etc.):

[https://www.fanboy.co.nz/](https://www.fanboy.co.nz/)

I don't care about cookies (extension):

[https://www.i-dont-care-about-cookies.eu/](https://www.i-dont-care-about- cookies.eu/)

[https://addons.mozilla.org/en-US/firefox/addon/i-dont- care-a...](https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-about- cookies/)

Here's an interesting discussion about the second solution:

[https://github.com/gorhill/uBlock/issues/909](https://github.com/gorhill/uBlock/issues/909)

</comment></comment><comment><USER36> If anyone is interested in installing this extension, I uploaded the .xpi file and instructions to install it in an issue on the git repo a few days ago [[https://github.com/iamadamdev/bypass-paywalls- firefox/issues...](https://github.com/iamadamdev/bypass-paywalls- firefox/issues/82#issuecomment-441105276)]

Hopefully the maintainer puts the .xpi file somewhere it can be accessed.

edit: someone has replied in the bottom of the git issue thread with a direct install link. use that instead

</comment><comment><USER37> After reading all these comments, perhaps its time to branch Firefox to something else?

This situation feels like the old Mozilla vs Firefox issue that happened a decade and a half ago. Perhaps the fact that the Mozilla Foundation is treating their browser like an Apple device is the final impetus to move elsewhere?

<comment><USER38> Unfortunately, with the size and scope of a browser and the sheer numbers of features constantly being added, this is a difficult task. What would be ideal is a company (preferably with financial incentive to do so) maintaining an embeddable, highly configurable form of FF (ala CEF[0]) and then the rest of us can build UI around it.

[0] - [https://bitbucket.org/chromiumembedded/cef](https://bitbucket.org/chromiumembedded/cef)

</comment></comment><comment><USER39> you can sign and distribute xpi addons without putting them on the addon marketplace

</comment><comment><USER40> Meanwhile in useless podcast ads they try to paint Firefox as the parangon of virtue for users privacy.

</comment><comment><USER41> We need easy to use, non subscription micro payments. I was hopeful Bitcoin would do this but sadly it was never adopted as a mainstream payment platform.

<comment><USER42> Bitcoin does not scale to micropayments. Lightning could probably help, but the next problem is that Bitcoin's value is way too volatile for broader acceptance (which, I realize, is to a certain extent a chicken-and-egg problem).

</comment></comment><comment><USER43> Hi All, You can reach out to addon reviewers in #addon-reviewers in Mozilla IRC server or shoot an email at amo-admins AT mozilla DOT org.

</comment><comment><USER44> What I want is something that blackholes links to paywalled sites from search results, hackernews, and social media.

</comment><comment><USER45> Waiting for the day when news sites start blocking your IP when you circumvent the paywall--to bad there isn't an add-on for that right?

</comment><comment><USER46> Thank you Mozilla I didn't knew about this very helpful extension.

</comment><comment><USER47> Is it a matter of liability on part of Mozilla's?

Could they be have been sued?

</comment><comment><USER48> Boy, ungoogled chrome and brave are looking mighty appeasing at the moment. Im not sure how long I can continue to support mozilla.. Why do they keep doing these things? They can't just be satisfied with what they were?

Profit over all, always and forever.

<comment><USER49> In your mind, how is this decision one that was made to increase profit?

</comment></comment><comment><USER50> Now I want it.

</comment><comment><USER51> HN mods: title is incorrect and misleading, should at least read "Bypass Paywalls add-on removed from Firefox add-ons store". The use of "Mozilla" in the title has caused a lot of confusion in this thread from people who haven't clicked through the link.

<comment><USER52> Distinction without a difference, IMO. Mozilla has chosen to require this level of curation on Firefox against all complaints in the name of "safety", so they can also take the heat when their process results in an outcome like this. Their browser, their addon site, their decision, their fault.

<comment><USER51> The idea that AMO shouldn't be curated is baffling. Browser extensions are the biggest malware vector since email attachments named `importantstuff.txt.exe`. The title saying that Mozilla "pulled" this extension is not merely incorrect, it is blatant misinformation.

<comment><USER33> >The idea that AMO shouldn't be curated is baffling. Browser extensions are the biggest malware vector since email attachments named `importantstuff.txt.exe`.

This is a strawman, the GP did not say AMO shouldn't be curated. [Edit: added missing "n't"]

> The title saying that Mozilla "pulled" this extension is not merely > incorrect, it is blatant misinformation.

Mozilla selected, manages and empowers the reviewer who made this decisions. Since organizations are not people, delegating authority like this is the only way that organizations can ever do anything. Therefor to claim that Mozilla did not do this is spurious at best.

Now, Mozilla can disown the decision by saying the reviewer did not follow the appropriate process in making the decision. If that claim is shown to be true, only then would the title possibly be incorrect or misleading. Until then, Mozilla is as culpable for the authorized actions of its agents.

</comment></comment></comment></comment><comment><USER27> The hard truth is someone has to pay for content in the end. It's either ads or some kind of paywall or micropayment.

It's okay to say no to ads, but then we shouldn't circumvent paywalls. Free content is free only as long as someone somehow still pays for it.

<comment><USER53> Publishers should take some basic control of the ads on their site, just like it used to be with newspapers and broadcast. Serve them from their own domain, restrict their format (no moving parts or sound, no Javascript at all), vet them for basic decency before publishing. My uBlock Origin setup wouldn't block that.

<comment><USER54> Good idea, but they are not tech companies, so they likely lack the ability to do so.

I guess they could upscale in tech, but how would they pay for it when they can barely earn enough money to fulfill their primary function?

I don't think publishers have a problem. I think users do. I hate online news as much as everyone, but I still want deep, intelligent and critical journalism, so I subscribed to a paper which sells it.

It's one of the most successful news papers of my country, financially, and up until April this year they didn't have a website. They do now, but it's basically just a digital version (also available in audio from apps) that you can still only access if you subscribe.

I couldn't be happier, and they earn money. So maybe the whole free content thing isn't really a good way to go for either the user or the publisher?

<comment><USER55> _Good idea, but they are not tech companies, so they likely lack the ability to do so._

They'd best gain the ability, then, or fade into irrelevance and die.

And honestly, we're talking about serving a few images from their own webserver. It's not rocket science.

<comment><USER56> Technically, serving few images is not a problem.

The question arises, what images to serve. Someone has to sell advertisement, find clients, persuade them to advertise with the given site, etc. That's something they are getting with ad networks for free.

<comment><USER55> You could easily outsource ad sales while still serving the images unobtrusively from your own server.

<comment><USER57> Who owns a server today? Even publishing platforms are outsourced or behind nicely packaged SaaS today, not to mention infrastructure services. There is no more "FTP your site to XYZ".

</comment></comment></comment></comment></comment></comment></comment><comment><USER58> Mozilla shooting themselves in the foot again? Really, these people can't take a break.

What's worse is that both Google and Mozilla are equally vile, so what browser am I supposed to use? In the end I guess I'll go with Brave.

<comment><USER3> You're kind overreacting here. Addons are reviewed by volunteers. Someone thought this violates the policies and acted. There are many ways to verify what is happening, including talking to the AMO team on IRC or other communication channel. It is not like you can't ask for clarification, it might all just be a honest mistake.

<comment><USER58> Addon security is vital to the security of the browser. The fact that addons are reviewed by volunteers, instead of employees, is even more ludicrous.

</comment></comment></comment><comment><USER59> I've never understood how paywall bypass addons can be considered ethical. Even if you hate paywalls, it's the publisher's decision to use them. If I were to take a newspaper from a news stand without paying because there's an article I want to read but I don't want to pay, is that much different?

I'm honestly asking what the justification is for people who use these addons. Do you not consider it unethical or do you not care?

To clarify the tone of this post, I'm not trying to judge the value of someone's character based on if they bypass paywalls, I'm really just interested in other perspectives on this.

<comment><USER60> Just to give one example where I consider it ethical: the WSJ doesn't paywall articles if they originate from FB and it's simple to simulate this link.

These bypasses aren't "hacking" the sites in any normal sense. They are using publisher-created methods of accessing articles that any person could do if they had enough time and knowledge of the particular side channel.

In short, unless the bypass is truly hacking the site (using compromised credentials, e.g.), the argument is altruistic more than moral: "giving as much money as possible to good journalism."

<comment><USER61> Did you just essentially argue that it is ethical because it is easy?

</comment></comment></comment><comment><USER62> It's always about money. It's not about a free and open web.

<comment><USER22> Someone else has finally figured it out.

</comment></comment><comment><USER63> Bypassing paywalls is easily in top ten most evil things you can do as a consumer in a modern information society. We _should_ pay for the things we consume, with money. But only with money.

Then again, if the thing behind the paywall expects money _and_ tracks/mines you, then fuck'em.

</comment><comment> village-idiot Mozilla's rhetoric and their actions have been drifting apart for years now.

</comment><comment><USER64> It's good for Mozilla to take a stance, and drop the pretense that you can have the cake, eat it, and have all your other cookies left over.

Circumventing paywalls is not a crime, but it is also not victimless. The crisis for journalism is already eating at the foundations of democracy on the local level. To blithely ignore this is the triump of short-sighted egoism. And the inability of publishers to prevent you from doing it is no more justification as the old shopkeeper's failing eyes are a license for you to steal from the produce displayed outside.

<comment><USER22> It's bad for Mozilla to take a stance that's obviously against the preferences of their users. They can't play both sides of the field - either you're for the User, or you're for the Corps. I once sincerely believed that Firefox was part of a statement that they would fight for the User. That disappeared somewhere between 4.0 and 27.0. I believed there was still some hope in Mozilla - all of it has been eroded over the years.

So now, they've taken their stance. They don't want free users. They want corporate servants, the same as Microsoft, Apple, and Google.

</comment></comment><comment><USER65> Thanks, Mozilla. I never knew about this useful extension. But now I do and I'm going to install and use it. Use it in Chrome, of course. I stopped caring about Firefox a long time ago.

</comment><comment><USER28> I 'm going to have to defend Mozilla here. There is this very perverse idea here that everything should be free, but that's only because you are used to using VC-funded services with an expiration (acquisition) date. This seems to be endemic thinking in SV but the rest of the world has to make their own paycheck.

Maybe mozilla should think of experimenting with some micropayment service though. They are ideally positioned for that.

<comment><USER66> I would argue that this position is contrary to Mozilla's stated values about freedom on the web. If they truly support freedom, that should include my freedom to decide which add-ons I want to run on my browser.

Sure, they can have an opinion about where should the web go, and in fact it would probably be a very well-informed one. But they can't both claim to support freedom for their users while, at the same time, imposing their ideas on their users.

<comment><USER67> Which "position"? No one has even shared the stated reasoning for removing this extension yet. Just a bunch of people jumping at an opportunity to disparage Evil Mozilla in here with no details on the real situation. This whole thread should be deleted if you ask me.

</comment></comment></comment><comment><USER68> Isn't this exactly the kind of user-hostile behavior open source is supposed to prevent? Apologies if this is a naive question, but how hard would it be to delete the parts of the release version of the Firefox source code that pertain to checking signatures for add-ons and recompile it?

<comment><USER69> > Isn't this exactly the kind of user-hostile behavior open source is supposed > to prevent?

What part of behavior is user-hostile?

<comment><USER52> Preventing the user from installing whatever they choose, for starters.

<comment><USER69> > for starters.

It is not only for starter but for the whole platform ecosystem. It is not even user-hostile. It is just to prevent "Nah forget Firefox add-on market, just install this file" fragmentation. Firefox add-on platform is already much smaller than Google chrome (of course). I wouldn't be happy if the market got even smaller because of the fragmentation.

And Firefox already allows us to install whatever we want in dev/nightly version, for hackers. So I don't see any problems here.

<comment><USER70> What? There is no requirement to offer your add-on on AMO.

<comment><USER52> No, just a requirement that you submit your addon for signing, submit to a separate agreement[1], and their policies[2] (which has separate sub-politics about data usage), regardless of whether you offer it on AMO or not.

[1]: [https://developer.mozilla.org/en-US/docs/Mozilla/Add- ons/AMO...](https://developer.mozilla.org/en-US/docs/Mozilla/Add- ons/AMO/Policy/Agreement)

[2]:[https://developer.mozilla.org/en-US/docs/Mozilla/Add- ons/AMO...](https://developer.mozilla.org/en-US/docs/Mozilla/Add- ons/AMO/Policy/Reviews)</comment></comment></comment></comment></comment></comment>


Coyote – making asynchronous software easier to design, develop and test - <AUTHOR> https://www.microsoft.com/en-us/research/blog/coyote-making-it-easier-for-developers-to-build-reliable-asynchronous-software/ <comment><USER2> I really like the idea of being able to consistently and reliably reproduce these hard asynchronous bugs. I have heard engineers working with customers and finding it hard to understand and fix issues because the issue happens in certain conditions that are unknown. This leads to many issues left unresolved or fixed through workarounds that seem to hold things up.

Coyote now empowers the developers, by not only identifying hard to find bugs, but also enable them to replay these bugs and study the root cause and make a solid fix. This should help with stability and uptime of services over time.

</comment><comment><USER3> Super happy to see Coyote publicly released. Our team within Azure has used it on a number of services and cannot say enough good things about it. It has allowed us to develop code knowing that safety and liveness violations due to subtle race conditions are caught in testing and design time instead of production! For folks familiar with software verification tools, you might know the project as P#. Coyote is an evolution of P# and adds support for testing task-based programming (.NET's TPL framework) in addition to the state-machine based actor programming model.

</comment><comment><USER4> Coyote brings a fundamental and revolutionary change in the design, development and testing of asynchronous systems:

\- Finding even the most obscure concurrency bugs even before pushing to production?

\- All done on your laptop and in no time?

\- Giving you a full repro in the Debugger?

Not only are big professional teams in Azure reporting this, but I personally have benefited enormously from being able to use Coyote in my work.

</comment><comment><USER5> Coyote is very useful for developing and testing asynchronous services particularly in the context of hard to find async bugs. We can feel confident in the quality of the services we build and deploy to production using Coyote.

</comment><comment><USER6> This is fantastic framework</comment>


MetaWatch STRATA: the Smartwatch for the iPhone 4S & Android - <AUTHOR> http://www.kickstarter.com/projects/metawatch/metawatch-strata-the-smartwatch-for-the-iphone-4s

<comment><USER2> Seems like less of an offering when compared to Pebble for more money.</comment>


Why can't women time travel? - <AUTHOR> http://www.theguardian.com/film/2013/jul/31/why-cant-women-time-travel

<comment><USER2> It seems it's more common in TV-series. Examples are Continuum, Doctor Who and Primeval. Star Trek Voyager probably also had some time travel :-)

<comment><USER3> In Continuum, the terrorists travel in time and underthe aauthor's logic both the heroine and the female terrorists are "along for the ride". Millineum, mentioned here is a terrible movie, but does seem to break the mold from what I remember of it anyway.

</comment></comment><comment><USER4> Or [http://abstrusegoose.com/526](http://abstrusegoose.com/526)

<comment><USER5> > for white guys

Nonsense. Location could be China or America.

</comment></comment><comment><USER5> Millennium movie 1989: [http://www.cherylladd.com/movies/mill.jpg](http://www.cherylladd.com/movies/mill.jpg)</comment>