How I recovered a lost email from my email client's memory - <AUTHOR> https://www.ctrl.blog/entry/restore-lost-email-from-ram.html <comment><USER4> > Evolution [..] has a bad data loss bug. It sometimes deletes the email body > text in the compose window after changing the signature [..] it has bitten > me about twice a month for the last two years.

and

> I might have been able to partially recover the message from the Draft > folder if I'd retained my cool and acted immediately. It had been > overwritten by an empty message instead. I must look into versioning my > email draft folder at a later time.

This person has a much greater tolerance for shitty software than I do. I'm certainly not a perfectionist and appreciate that almost all software has bugs, but come on! Arbitrarily deleting draft emails twice a month _for two years_? Requiring convoluted versioned draft folders to work around this glaring issue? Why are they punishing themselves like this?! They must find something really awesome about Evolution to deal with this level of annoying.

<comment><USER5> Maybe they have an exchange mailbox? If you want exchange support on linux with full syncing of mail, calendar and tasks there are two options I know of: evolution and hiri. And hiri is paid abandonware. I've set up both, both are not good. Lately I've been using outlook web access, which is still bad, just not as bad.

Really I guess I miss outlook for windows. There I've said it. Judge me if you will. Its search feature is broken, but everything else worked well.

<comment><USER6> Option 3: davmail[1] acts as a translator between Microsoft's proprietary protocols and open protocols.

1\. [http://davmail.sourceforge.net/](http://davmail.sourceforge.net/)

</comment></comment></comment><comment><USER7> Does anyone know of a good Linux email client that isn't crippled by show- stopping bugs of this sort? I used Mailspring for a while, which has a nice modern interface, but quit after discovering that my drafts were only saved locally, not on the server. This has been an open bug for at least two years.

In the end I've always fallen back to Thunderbird as the least bad option.

<comment><USER8> Have you tried Geary? I helped a colleague get set up with ElementaryOS a while back and it looked really nice and, compared to Evolution, was much lighter and faster.

I haven't used it in anger though, I tend to stick to email in the browser these days.

<comment><USER7> I did use Geary for a while, I can't remember now why I stopped. I appreciated how lightweight it was but I think it was just a little _too_ lightweight, missing one or two features that I'd rather put up with thunderbird than live without.

</comment></comment></comment><comment><USER9> Of course recoverin an email is an innocent disguise.

The same approach works for recovering any secret information that people used on a computer that an attacker can access. Of course there are plenty of possibilities. But it's eye opening to see them in action.

<comment><USER10> Yes, encryption keys can persist in memory, too. That's why many law enforcement agencies use something like a HotPlug[1] + mouse jiggler to keep machines powered on when executing a search warrant.

[1] [https://www.cru- inc.com/products/wiebetech/hotplug_field_kit...](https://www.cru- inc.com/products/wiebetech/hotplug_field_kit_product/)

<comment><USER11> If you don't want to pay for HotPlug, you can also grab a full memory dump using FTK Imager or Belkasoft...

<comment><USER12> It's why operating systems should implement a lockdown option to restrict users from performing arbitrary access to memory or kernel, even if the user is root. I mentioned before that, on one of my computer, I completely disabled dynamic kernel modules, hotpatching, /dev/mem, no ptrace() to arbitrary process, etc., making it difficult for root to do any low-level access to memory or kernel. I also enabled IOMMU, it isolates the address spaces of different hardware from each other, so no external hardware cannot have arbitrary RAM access via DMA, hardware-based memory capturer won't work. The only way to attack is either an 0day or a cold-boot attack, the 0day threat can be reduced by using a security-minded kernel, like PaX/grsec (not available to the public anymore), OpenBSD, or HardenedBSD. As for cold-boot attack, future hardware may support full memory encryption [0] at the hardware level and fix this vulnerability. Mouse jiggler is a problem, but USB firewalls already exist [1], if proper policies is enforced by the firewall, unauthorized hardware cannot register as an input device.

There may be still some exploits, especially when you consider that Linux kernel is not designed with security as its first priority, and over the last 20 years a lot of black magic has been developed to insert bad things into the kernel, but at least doing the countermeasures I mentioned will make it difficult. Hence, it's impossible to do any low-level changing or debugging on the system without rebooting it - which will immediately revert the system back to a "at rest" state, and triggers full-disk encryption. Other people may choose to do the opposite, it's a tradeoff between uptime and security.

Unfortunately, any attempt to introduce such a lockdown will be accused of being an evil technology that enables DRM. However, ultimately, the question is _not_ whether a computer is locked down, but who is in control of the computer and it's locked down to protect whom.

[0] Don't confuse "memory scrambling" and "memory encryption". The vast majority of PCs today already use memory scrambling - the memory controller will "scramble" the data in RAM to a seemingly-random pattern using a Linear Feedback Shift Register, but it's done for electrical considerations - <USER2> there are too many 1s or 0s in a row, excessive current spike (di/dt) is produced, and it reduces signal integrity and creating excessive electromagnetic interference - LFSR-based scrambling is not for cryptography purposes and trivial to decode. On the other hand, memory encryption is a true solution that provides cryptographic protection to the RAM, and many hardware vendors have roadmap to implement it. Currently, it seems that there are two types, the first type is a "full memory encryption" \- protecting RAM from physical access, the second type is "per-application memory encryption", which allows an application to request a segment of encrypted memory with an unique key - protect sensitive data of one application from accidental access by other programs. Both are helpful.

[1] [https://lwn.net/Articles/738306/](https://lwn.net/Articles/738306/)

<comment><USER10> I forgot all about grsec - sad to see its no longer publicly available. Thanks for the tip on IOMMU and your other measures.

<comment><USER12> Just a note for you (and other readers), as I think it needs some elaboration.

> _no ptrace() to arbitrary process_

Traditionally, ptrace() restriction is a grsec feature. But in mainline kernels, the same feature is available in the Yama module, see [0]. Use Yama with "kernel.yama.ptrace_scope = 3" will permanently disable ptrace() for all users, including root, and it cannot be enabled again. Then, you should also compile your own kernel, so you can disable /dev/kmem (CONFIG_DEVKMEM), /dev/mem (CONFIG_DEVMEM) and /proc/kcore (CONFIG_PROC_KCORE) in the Linux kernel. Also, I forgot to mention kexec(), which allows the attacker to execute another kernel without rebooting, so CONFIG_KEXEC should be disabled as well. And the list goes on and on, I think it's necessary to download an old grsec kernel, and using the configuration section of grsec as a checklist (and try disabling them using mainline technique if possible) if your security is serious business.

If you do these things, it will block the technique described in the original article.

[0] [https://www.kernel.org/doc/Documentation/security/Yama.txt](https://www.kernel.org/doc/Documentation/security/Yama.txt)

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> > There are specialized tools you can use to analyze this data blob.

These are called _file carving_ tools and two better known ones are _foremost_ and it's successor _scalpel_ [1].

[1] [https://github.com/sleuthkit/scalpel](https://github.com/sleuthkit/scalpel)

<comment><USER13> Scalpel, as good as it was back in its time, sadly has been stalled. Carrier and/or the folks in charge of The Sleuth Kit have taken it into their github repo[0] but there haven't been commits for ~7 years now.

I did a thesis on file carving some 10 years ago, and scalpels ideas where very good back then. Photorec[1], however, has been the gold standard for a long time on (open source) file carving. It can handle text based formats way better (scalpel is severely limited in this aspect due to the "header/footer" paradigm), and is a wonder with stream based formats (that can have boundaries on the bit level).

And it's not because they authors weren't good[2], I think what mainly happened is that they didn't have the time to keep maintaining the software they created (I know that has happened to me more than once).

There are also some commercial file carving tools, though most are aimed at having better integration with forensics software (like Encase, FTK, Oxygen, etc) or automate parts of the process, like document analysis. Still, if you just want to compare them by their ability to recover files, I'm pretty sure Photorec makes it to the top.

[0] [https://github.com/sleuthkit/scalpel](https://github.com/sleuthkit/scalpel)

[1] [https://www.cgsecurity.org/wiki/TestDisk_Download](https://www.cgsecurity.org/wiki/TestDisk_Download) (PhotoRec is part of TestDisk)

[2] They're some of the best in the field of digital forensics

<comment><AUTHOR> Good to know! I always had ignored Photorec because I thought it is only for image formats.

To add to your list of options there is also YARA when used with appropriate rules. I don't know how it stacks up against specialized tools though.

<comment><USER13> Photorec supports a crazy ammount of file types (about 400 I think, but since they keeep adding it may well be over). Fun thing: Diablo II savefiles (and other games!) are carve-able with Photorec.

And it can also handle fragmentation (though I haven't tested the later versions to see how strong that is).

</comment></comment></comment></comment><comment><USER14> I've noticed the same with web-able apps, you spend time typing-up some missive and then it freezes and refreshing the page loses it all. Could linux write everything to a file every 30 seconds. A bit like a keylogger, only you know it is there.

<comment><USER15> There used to be a Firefox add-on called Lazarus that did this.

[https://www.pcworld.com/article/227948/Firefox.html](https://www.pcworld.com/article/227948/Firefox.html)

From Tom's Hardware:

"Lazarus: Form Recovery is a free downloadable Add-On for the Firefox web browser that automatically saves everything you type into forms of web pages you visit.

With Lazarus: Form Recovery, you will never lose what you write after a crash the browser or other technical problems. In the case when a problem, simply right click and select "recover form" to retrieve data previously typed."

However, that was for web forms, not an email client or other applications.

<comment><USER16> I've found that this can replace Lazarus in modern Firefox:

[https://addons.mozilla.org/en-US/firefox/addon/form- history-...](https://addons.mozilla.org/en-US/firefox/addon/form-history- control/)

<comment><USER17> Thats really buggy with Firefox ESR, Mozilla are adding more WebExt APIs to make it work better though so hopefully it will work at some point.

</comment></comment></comment></comment><comment><USER18> I was using Evolution on daily basis at work (around 2015-17) but I switched quickly to Thunderbird due to stability issues. I was using Evolution primarily for its support for Exchange Server, but it wasn't very stable at the time. On the other hand, the same was possible in Thunderbird through a very solid proprietary plugin (exQuilla).

</comment><comment><USER19> I used to (when this was still possible) dump /proc/memory (or kmem?) to file and rummage through it looking for partially composed website submissions when Netscape decided to eat itself, back in the 1990s. Remarkably successsful.

<comment><USER20> Using Process Explorer at least, it's still just a right click on any process away.

<comment><USER19> There used to be a global system memory file in /proc, 2.0 / 2.2 kernel series, unless my memory's playing tricks on me. Even content from dead processes was still (briefly) available.

</comment></comment></comment><comment><USER21> Yup..this is also how the fbi recovers stuff too. After Ross Ulbright was caught they did this to his laptop.

<comment><USER22> I thought they just kept the computer open?

</comment></comment><comment><USER23> Because of some reasons I use evolution and thunderbird. The search function in Evolution is abysmal.

May try out InScribe

</comment><comment><USER24> nano ftw.

Modern web email clients have this since a long time and Gmail never crashed internally for me ;)

<comment><USER22> I use nano, but I have to say I am very surprised that they mentioned it as a viewer for large binary files. It reads the entire file off of disk into memory and then tries to split it into lines! It can't even do well on files with large enough lines :(

<comment><USER25> Nano reads large files in chunks. Other text editors do indeed pull in the entire file before doing anything useful.

<comment><USER22> No, it reads the whole file at once: [https://git.savannah.gnu.org/cgit/nano.git/tree/src/files.c#...](https://git.savannah.gnu.org/cgit/nano.git/tree/src/files.c#n671).

</comment></comment></comment></comment><comment><USER26> I misread this as: "I recovered a lost email from my client's memory". It made me think of the Black Mirror episode 'Crocodile', and I was quite amazed. Then I saw 'email' client... haha

<comment><USER25> Author here. That was actually the working title up until two minutes before publishing.

<comment><USER27> Yep, and the title, once re-parsed is fine, but I also had - initially - <USER3> wrong impression, it flashed before me how you hypnotized your client (customer)and managed to retrieve from his/her memory the contents of an e-mail message he/she ddn't rememeber anything about.

<comment><USER25> That's pretty much exactly how I thought the previous title might have been misunderstood!</comment></comment></comment></comment>


Will Google Uphold its "Do No Evil" Motto With Muziic? - <AUTHOR> http://www.readwriteweb.com/archives/will_google_uphold_its_do_no_evil_motto_with_muzii.php <comment><USER2> "15-year-old Nelson" ?</comment>


Be an expert in ReactJS by watching these 5 videos - <AUTHOR> https://blog.cloudboost.io/be-and-expert-in-reactjs-by-watching-these-5-videos-4d4452f19fd6 <comment><USER2> Videos don't work...

"This embedded content is from a site that does not comply with the Do Not Track (DNT) setting now enabled on your browser.

Please note, if you click through and view it anyway, you may be tracked by the website hosting the embed.

Learn More about Medium's DNT policy"</comment>


Lessons from a failed startup - <AUTHOR> http://venturebeat.com/2009/04/29/10-lessons-from-a-failed-startup/

<comment><USER2> One of the best startup retrospectives I have read. Especially the points about marketing and user acquisition are very relevant to what I what I am doing currently.

</comment><comment><USER3> _"The main failure of PlayCafe was marketing."_

Sort of buried at #5, so felt it worth repeating (and conversation here).

<comment><USER4> Well worth repeating. Most of us here can code a site up, some are exceptional at it. But even getting that initial press to get those first customers can be daunting.

That's one advantage I can see with something like YCombinator -- that initial traffic. It might not be much, but it's a few links from reputale blogs, some visitors and maybe even those first conversions. It's certainly no guarantee, but it is more than my first startup had.

</comment></comment><comment><USER5> " _2\. Content businesses suck..."_

This seems like a pretty strong argument in favor of _some_ form of DRM. If content creators can't make money, we're not going to have good content.

<comment><USER6> I don't really see DRM as a good answer. It is usually pretty ineffective, and it can cause problems for your customers.

I'm not really aware of truly effective DRM. DRM just needs to be cracked once for it to be pirated. And there are people who actually enjoy cracking DRM.

I guess server side authentication would work, but that is only if you convinced people to connect to your servers. This is actually pretty hard. Spore seemed like it added value when it connected to the internet. But I am sure authenticity could have easily been verified with less restrictive DRM. And cracked copies were out before retail copies were out, so DRM was a total bust in that case.

WOW is one of the few companies that I don't think has huge problem with piracy. But that is only because you can't pirate the experience of playing with tens of thousands of other people. And even with WOW I was able to easily find torrents of the game and lists of private servers. So even MMORPG's get pirated.

Big companies have thrown millions of dollars at this problem already, and haven't come up with a good solution. So this isn't an easy problem. And I am under the impression that DRM is currently very expensive for companies.

Sure, DRM could be made better. But I think it is kind of pointless. If the authentication relies only on hardware that is under the users control, like a pc, it will get cracked. And you will almost certainly end up annoying your paying customers.

That said, I am interested in seeing how GOO turns out. A DRM solution that lets you legally sell your game sounds promising. And since Stardock built it, it might actually be customer friendly.

<comment><USER5> Crackable DRM isn't the problem. Casual piracy is the problem. Pretty much any security system can be circumvented; the point of DRM is just to make getting it for free sufficiently more of a pain in the ass than paying for it.

GOO does indeed look interesting: [http://www.maximumpc.com/article/news/stardock%E2%80%99s_%E2...](http://www.maximumpc.com/article/news/stardock%E2%80%99s_%E2%80%9Cgoo%E2%80%9D_drm_makes_steamworks_obsolete)

<comment><USER7> But the reason why DRM will never work is because your average user _is not the one that cracks the DRM_. The pirates crack the DRM, and the average user downloads it over Bittorrent.

The only way to reduce casual piracy is to convince people that they should pay for your product.

<comment><USER5> Ok, maybe I'm using the wrong term, but what I mean by "DRM" is anything that inhibits piracy. This can include stuff like when the music industry put those mangled mp3s on Kazaa. Anything that makes piracy less convenient will lead to more people paying for the product.

Even if piracy can't be completely prevented, it can still be significantly mitigated, it's just a question of engineering.

</comment></comment></comment></comment></comment><comment><USER8> Anyone else think he was valuing his time too highly?

<comment><USER9> If you think you can add 1mm to the value of your startup by working 12 hours a day 7 days a week for a year, then your time is "worth" $230/hour.

Also, considering what someone with a similar background could earn working full time for an established company (especially factoring in benefits), $50/hr is fairly conservative in terms of opportunity cost.

<comment><USER8> Opportunity cost != time valuation

<comment><USER10> Why not?

<comment><USER8> Because the VC is not paying you at a market rate for what your time could be. They are funding you because they think you will be successful. If you are successful, your ultimate outcome will be a multiple of your "market rate" over three years. Therefore, your hourly rate should be reduced.

<comment><USER10> I can not follow your logic. I never had VC investment, but I did not even think the VCs pay you. Even if they did, wouldn't you access your value by the expected outcome P(failure) _0+P(success)_ 10 billions?

It also doesn't matter, because I still think the opportunity cost equation holds. If you decide now to become a waiter instead of an IT consultant, it costs you 70$ an hour to be a waiter (assuming waiters earn 10$/h and consultants 80$/h). I don't think there is a way around that.</comment></comment></comment></comment></comment></comment>


Azure Intellectual Property Advantage - <AUTHOR> https://azure.microsoft.com/en-us/overview/azure-ip-advantage/ <comment><USER4> Microsoft.

What really surprises me is that so many people are willing to forget that this is the company that bankrolled SCO in their lawsuit.

For that reason alone the tech community should shun them. But just a few short years later and a couple of open source releases and we're supposed to believe it is all so much better now and the Microsoft of old should be forgotten.

Thanks, Microsoft for reminding us of your true colors.

In case you have trouble parsing this announcement: the 'between the lines' FUD here is that when using other cloud providers you could be sued by companies that have these scary things called patents in case it turns out you ar is infringing on any patents (nudge nudge, wink, wink, of course you are). But come and stay in my house and I will protect you against these nasty people.

Cue IV starting lawsuits against parties that in a pitch between Azure and say GCE or AWS decide to go with the latter?

<comment><USER5> I feel like I'm starting to sound like a shill in this thread... I don't work for MS, don't use Azure, and am generally considered an "Apple fan boy." So, with those bona fides out of the way... I disagree.

The reality is that this is not FUD. People actually _are_ sued on a regular basis for bullshit like this. Microsoft is indemnifying Azure customers and giving them free access to their patent portfolio for defensive purposes. This should _reduce_ patent suits, which is a _good_ thing.

Google and Amazon should follow suit.

<comment><USER4> No, Google, Amazon _and_ Microsoft should push for patent reform. Not use their arsenal of patents as a protection racket. And because of IV Microsoft is - indirectly, at just about one plausibly deniable arms length - one of the bigger abusers of patents in this way.

One way in which they could have done this that would be clean would be a blanket statement that would cover parties no matter where they are hosted. To make this a competitive advantage for Azure is fairly disgusting.

Another thing they could do is assure the world without any weasel words that Microsofts patents will never again be used to seek rent on innovation, or better yet, to place them all in the public domain.

<comment><USER5> They can push for reform _and_ provide legal protection like this. They're not mutually exclusive.

I'm assuming by IV you mean Intellectual Ventures..? Are they tied to Microsoft? I thought they had _sued_ Microsoft..?

<comment><USER4> > Are they tied to Microsoft?

[http://techrights.org/wiki/index.php/Intellectual_Ventures](http://techrights.org/wiki/index.php/Intellectual_Ventures)

[http://techrights.org/2014/12/16/trolling-not-working- out/](http://techrights.org/2014/12/16/trolling-not-working-out/)

<comment><USER5> Ok, it was started by a former MS exec and funded by Gates... that's shitty, but Microsoft has lots of former employees and I'm sure Gates invests in lots of things. For all we know it was a family office investment that he wasn't even aware of... or the dude was a friend or something.

Microsoft doesn't have a stake in the company nor do they provide the company with any assistance..? Unless there's more to the story I think it's kind of a stretch to say that this is a Microsoft operation. According to Wikipedia they've actually _sued_ Microsoft.

<comment><USER4> > According to Wikipedia they've actually _sued_ Microsoft.

That is not what I read there. What it says is they _raised_ money from Microsoft, that's something else than suing Microsoft.

[https://en.wikipedia.org/wiki/Intellectual_Ventures](https://en.wikipedia.org/wiki/Intellectual_Ventures)

Can you point out the exact paragraph that you feel describes IV suing Microsoft?

<comment><USER5> Upon closer inspection it appears that you are correct. I interpreted "raised" as "extorted." That still may be the case (the cited source is a dead link) but I think you are right... particularly since some of the names listed are venture firms.

Whatever the case, IV is quite an enigma... founded by the creator of MS Research (which is a great group), funded by Reasonable People, but apparently sketchy as hell. I'm intrigued and will definitely be digging deeper into their story. Thanks for bringing them to my attention.

<comment><USER6> People who like Bill Gates believe it is a bad idea to volunteer your time. If you can earn $60 an hour, you should earn that $60 doing whatever you have to do so thus way you can later pay for four hours at $15.

I don't know. I mean it looks better than earning that $60 and not putting towards a charity?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Is it just me or is this actually genius? Mutually assured destruction has been the name of the game for big companies for a while now, but that wasn't practical for small players. If Microsoft is willing to take small companies under its umbrella, it could be quite effective and helpful. Seems like what they actually do is provide you the opportunity to buy a hand selected legal weapon, but that threat may well make azure a little safer for small companies and startups. Will Google and Amazon feel pressured to follow suit?

Of course this doesn't work against patent trolls, because they have no products to sue over. As long as Microsoft doesn't start threatening to sue companies that use aws or something, I have to applaud this move.

<comment><USER8> They don't have to sue you overtly.

Think of Intellectual Ventures as an example. IV licenses patents for litigation but pretend to be inventors. I say pretend because most of their revenue comes from litigation, while publicly promote their inventions. If anyone is interested, there is an old, but relevant, NPR podcast about them and the use of shell companies to hide their identity.

I believe reading that MS has a stake on IV, but I can't find anything on that. IV founder was MS' CTO. It can also be done covertly.

Oh...and just found this:

[https://www.google.com.mx/url?sa=t&rct=j&q=&esrc=s&source=we...](https://www.google.com.mx/url?sa=t&rct=j&q=&esrc=s&source=web&cd=5&cad=rja&uact=8&ved=0ahUKEwjMotbBz9zSAhXIiSwKHSNdAloQFgg8MAQ&url=http%3A%2F%2Ftechrights.org%2F2017%2F02%2F28%2Fxinova- is-invention-development-fund%2F&usg=AFQjCNGqM0QJTykTpaWkw9xe35MTWOwAbQ)

</comment></comment><comment><USER9> This is proof of the utter emptiness of the fiction of intellectual "property" as a source of innovation. IP is not a source of anything but overhead. You pay a baseline of insurance (or "protection" depending on your POV) to fend off lawsuits just to be able to do your work. It's rent-seeking, but the genius is, it's not rent-seeking over limited resources like land or resource rights, it's rent-seeking over totally artificial unlimited source of nonsense BS that you can never run out of. It's just a tax on existence, but it's not going into anything useful, just into the IP industry's pockets.

<comment><USER10> This is simply not true. IP is a vital and important part of business that protects entrepreneurs the most. Sure there is a huge raft of reforms that need to be untaken and software patents have questionable utility but we shouldn't throw the baby out with the bathwater.

I still look back to the Dyson lawsuit with Hoover as example of why we need patents and IP protection:

[http://www.telegraph.co.uk/news/uknews/1368860/Dyson- cleans-...](http://www.telegraph.co.uk/news/uknews/1368860/Dyson-cleans-up-in- patent-battle-with-rival-Hoover.html)

<comment><USER4> I see some minor differences between Vacuum cleaners and software.

<comment><USER11> Indeed, but the comment to which GP was responding made no such distinction.

</comment></comment></comment></comment><comment><USER12> Latest innovation in Cloud Computing! Frivolous Lawsuit Defense As A Service.

I think at some point the archaic IP laws in USA would mean that deployment of cutting edge technology ends up happening in China. This is already happening in Shenzen.

[https://youtu.be/SGJ5cZnoodY](https://youtu.be/SGJ5cZnoodY)

</comment><comment><USER13> I don't use Windows, just macOS and Linux servers so I claim some impartiality: I can't believe the hate Microsoft is getting in this thread! They are addressing a very real problem that small companies face and offering a free service on top of normal use of Azure.

Microsoft is a very different company than they were in the days when they supported SCO's lawsuits as an attack against Linux. Except for some Windows 10 privacy issues, I personally give the 'new' Microsoft fairly high grades for their current business models.

<comment><USER14> IMO, their willingness to use patents as a protection racket, and their conduct with Windows 10, shows that their true colors haven't changed one iota from the SCO days. The "rainbows and unicorns and open source" schtick is great for getting our guard down, but when push comes to shove, it's Embrace, Extend, Extinguish.

</comment></comment><comment><USER15> So basically the same rent seeking behavior Microsoft applied to Android vendors, now applied to the cloud? Except instead of paying $20 to $40 per handset to MS, you have to use Azure and deal with the resulting mess.

</comment><comment><USER16> Quoting [https://en.wikipedia.org/wiki/Software_patents_under_United_...](https://en.wikipedia.org/wiki/Software_patents_under_United_States_patent_law) :

" On June 19, 2014 the United States Supreme Court ruled in Alice Corp. v. CLS Bank International that "merely requiring generic computer implementation fails to transform [an] abstract idea into a patent-eligible invention." [5][6][7]

The ruling continued:

[...] the mere recitation of a generic computer cannot transform a patent- ineligible abstract idea into a patent-eligible invention. Stating an abstract idea "while adding the words 'apply it'" is not enough for patent eligibility.[] Nor is limiting the use of an abstract idea "'to a particular technological environment.'"[]. Stating an abstract idea while adding the words "apply it with a computer" simply combines those two steps, with the same deficient result. Thus, if a patent's recitation of a computer amounts to a mere instruction to"implemen[t]" an abstract idea "on . . . a computer," [] that addition cannot impart patent eligibility. "

So just how broken and captured are lower US courts that, despite a supreme court decision invalidating software patents, this kind of extortion continues? Are software patents only invalid for those who can afford to litigate all the way to the supreme court, and the lower courts are ignoring this ruling?

<comment><USER17> IANAL, but from what I understand, _Alice_ didn't invalidate software patents. In fact, it's generally agreed that they tried very hard not to rule on software patents. All they did was say that a generic abstract idea (like "escrow") doesn't suddenly turn patentable just because it may run on a computer. You need to have an "inventive concept" to qualify.

<comment><USER18> Reminds me that there is a "shopping cart" software patent. Would this be invalidated by _Alice_?

<comment><USER17> That particular patent was killed because it was even less innovative, as CompuServe Mall already had shopping carts in a computer before. Unfortunately, it had to go all the way to the court of appeals, and only thanks to Newegg choosing to fight it rather than pay them off: [https://arstechnica.com/tech-policy/2013/01/how-newegg- crush...](https://arstechnica.com/tech-policy/2013/01/how-newegg-crushed-the- shopping-cart-patent-and-saved-online-retail/)

</comment></comment></comment></comment><comment><USER19> So, now MS starts using their patent arsenal, as an incentive for their users. I.e. "come use us, we have some lethal weapons in stock, in case of threats we'll rent them to you". This doesn't smell good at all.

How about remembering, that MS are themselves one of the major patent aggressors and proponents of patent arms race?

<comment><USER5> That may have been true in the past but, as far as I know, Microsoft hasn't been that way for years.

Every large tech company has a patent portfolio. Hell, Google bought Motorola to get their patent portfolio to use defensively in suits against Android.

In my opinion companies should not be punished for using patents defensively. It's really the only viable option outside of a major legal change. So, I think Microsoft giving other people access to their portfolio for defensive purposes is a good thing. It should _reduce_ the amount of patent litigation.

<comment><USER19> There is a difference between only using them defensively, and using them for protection racket. As far as I know, MS still do the later (especially with Android).

They also like standards poisoning with their patents, and then collecting money from everyone who is forced to use that. Example - exFAT widely used on SD cards. Why didn't everyone use some free filesystem? Because MS.

<comment><USER20> > Why didn't everyone use some free filesystem? Because MS.

When you look on Wikipedia, there are like a dozen goofy file systems that a developer could use for flash storage. They could sort through all that or, you know, they could just use FAT, like everyone has done forever.

I wonder if the open source world's perpetual inability to get behind one standard hurt them there.

<comment><USER21> The reason FAT and exFAT is being used with devices, is Windows.

If you used any other fs, like f2fs, the ordinary user would insert the card into their computer - and nothing would happen. No, Microsoft is not going to ship alternate filesystems with Windows, when they can use theirs as racket.

<comment><USER20> You might be right, but it's worth noting that nobody with any pull - <USER2> digital camera industry, the smartphone industry, the storage manufacturers - ever even tried to make it happen.

<comment><USER19> I'm kind of surprised, Samsung didn't push f2fs more. They initially announced it as a flash oriented and free filesystem, and promised a Windows driver as well. I don't think it ever materialized. And Samsung have enough weight to push it through.

<comment><USER20> Yeah. They're one of the ones who could do it, especially since they'd probably be able to ally with Google wrt Android. It's a real lost opportunity.

<comment><USER19> Just speculating. It could be a leverage thing. They created it, and MS gave them free usage of exFAT or anything of the sort (in return for not pushing it further). Could be just usual mismanagement too.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> Our patent system is completely broken.

<comment><USER23> Software should only be covered by copyright; software patents are crazy... there are too many dumb ones to count.

<comment><USER24> It certainly should be one or the other. It's completely crazy that you can copyright something, then make a vague description of it and patent it too (without even having to make the original source code available!). And having worked for companies that got sued for patent infringement quite a bit, what usually happens is that someone sues you and demands your source code in discovery. So it isn't even a "I'll show you mine if you show me yours" \-- it's "Your software could plausibly have been implemented using our patented technique. Let's have a look at your source code that proves that it isn't".

So instead of being a tool that trades off a limited monopoly for a technique in exchange for making public something that would have been a trade secret, it's a way of protecting a particular implementation while at the same time being able to force your way to see all of your competitor's implementations.

<comment><USER23> I disagree that it could be patents or copyright. I don't think it should ever be patents. Patents are designed to give the patent holder a monopoly on the innovation so that they can protect their development and research costs. They exist for things with high R&D costs.

Software is much more akin to math or music. You can not patent math or music, and fundamentally it's for the same reason. We must do away with all software patents.

</comment></comment></comment></comment><comment><USER25> Selling accumulated, weaponized, patent and IP defense as a service reminds me of how protection rackets work.

Also, this sort of leverage isn't something a non established large business could provide, stiffling competition in the cloud space. If the other Google/AWS follow suit, the "cloud" and hence the future internet will not be a better place.

disclaimer:I work for a competitor but this is strictly my opinion on the matter, not that of my employer.

<comment><USER26> Yeah but MS is a good guy now right ? Look at all the open source ! Linux integration ! Nobody insulting competition anymore ! And Bill Gates is saving Africa !

Now please forget all the terrible things they did for 20 years. They don't matter.

This is totally not PR.

They are good now.

</comment></comment><comment><USER27> Appears that they're offering patent lawsuit indemnification as a built-in to using Azure, as they have a massive patent portfolio: "use Azure, and as an additional benefit, we'll cover damages related to patent law suits that arise, if we have a patent with which we can defend."

</comment><comment><USER28> "That's a very nice website you have there; it would be a shame if anything were to happen to it..."

</comment><comment><USER29> I'm not even sure I understand what's happening here. Are they offering to rent their patents to you to use in defending yourself against patent suits? What?

<comment><USER30> Looks like there's a couple parts.

1\. They promise that if you get sued for using something open source that Azure is built on, they will indemnify you. Eg, with AWS, in theory someone could say to you: "We have a patent on DB replication, you use MySQL with RDS, that has replication, you owe us money." Unsure if that's a valid risk, but maybe.

2\. If you get sued and you've been paying $1k a month or more to Azure, MS will give you one of a their 10k patents on a list if it'll help mount a defense. Could be helpful, I suppose, but hard to figure out the value. If I'm sued, AND MS has a relevant patent on the list, how useful would it be?

3\. MS promises that IF they transfer some of their patents to a patent troll in the future, the terms of the transfer will prevent the troll going after you. Again, hard to quantify the value, especially since it depends on MS's actions. "We have a big hammer, but we promise not to hit you" is only _partially_ reassuring. But still better than no promise at all!

On balance these all seem like unmitigated goods, although it's hard for me to evaluate if they have any value. It never occurred to me to be concerned that I might be sued for using open source tools on AWS. :)

I'd estimate it to be about 80% marketing, and 20% a good faith attempt at defusing the disaster that is modern IP laws.

(Edit: And contrary to some other commenters, I don't see anything malicious or harmful going on here.)

<comment><USER5> In my experience there's definitely value here. Companies get sued on the regular for bullshit like this. I've had to deal with three patent suits at startups. They were all bullshit, and they all ended in settlements of ~$10,000 (cheaper to settle).

Countersuing is probably the #2 most common response to a patent suit (after settling). It's so common that there's a name for it: "defensive patent strategy." Basically, you file a bunch of patents, but you don't proactively go out and look for infringers. You're just hanging on to them in case you get sued. If you get sued you go and look at the person who's suing you and try to find one of your patents they're violating. This actually works fairly well because the patent system is so broken, and patents are so easy to get, that you can almost definitely find a violation given a reasonably large portfolio (and 10,000 patents is reasonably large).

Unfortunately, countersuing doesn't work against NPEs... and NPEs are usually the ones doing the suing.

<comment><USER4> > They were all bullshit, and they all ended in settlements of ~$10,000 > (cheaper to settle).

You are part of the problem. _NEVER_ settle with a patent troll. I've had plenty of these assholes come after me and nothing ever stuck, on top of that I've helped others defend against the trolls with a 100% success rate when and if they stuck to the end.

Yes, it can cost you money, but this real life prisoners dilemma can only be won if we stick together. And MS is playing both ends against the middle here, to their own advantage of course.

<comment><USER5> Wow, way to blame the victim.

The first two times the decision was made above my head.

The third time I was in the C-suite and it was a joint decision. I had a heart-to-heart with our lawyers because I _did not_ want to settle. Our head IP lawyer said he felt me -- he thought the suit was bullshit, would love to fight, etc -- and if we decided to defend he'd be 100% with us. However, his firm was currently engaged in defending another suit with the litigant and it had been appealed through the circuit court in Texas. At that time it was pending hearing by the Supreme Court. That client had already accumulated more than $250,000 in legal fees and there was no guarantee that they'd win. Even if they did win, it was unlikely that they'd be able to recover any of those fees. He estimated total cost of fighting would be between $250,000 and $500,000.

I reached out to friends at large tech companies to see if they had experience dealing with the litigant. I heard back from two of them that they did have experience, and that they settled. Since there was an ongoing case involving the litigant that was already heading to the Supreme Court (and one that had at least as good a chance of winning) we opted _not_ to spend a significant amount of our venture capital fighting an expensive battle that, at best, would cost us hundreds of thousands of dollars and, at worst, we would lose in Texas.

In the end we spent significantly more money on investigating a defense then we actually paid in settlement.

If you're interested in covering the financial costs associated with fighting these suits please let me know. I would definitely take you up on that and fight all day every day.

<comment><USER4> Extortion is enabled by the previous rounds of victims paying up, so it's an endless cycle that simply won't stop until people stand their ground.

> If you're interested in covering the financial costs associated with > fighting these suits please let me know.

I'm well aware of that, there were years when I paid more to the lawyers than to the tech department. Still, overall it was worth it. Big factor in our survival was that we had an EU parent company rather than one on the far side of the Atlantic.

Even so, I refuse to be extorted.

<comment><USER5> I did too until I realized that the alternative had a high probability of ending in bankruptcy resulting in loss of employment for two dozen employees. I'm fine taking a moral stand when I'm the only one who stands to lose. It's harder when you're playing with other people's money / lives.

The world isn't fair.

<comment><USER4> I guess this is where it helps that I was the CEO of the company being sued, had a European parent company (where software patents at the time were not valid) and would rather go down fighting than give in to blackmail. I can see the economical argument and I also see your argument with respect to playing with other peoples lives and money. The problem is that that attitude eventually results in _more_ effect on other peoples lives and money, just not the people in your direct vicinity.

<comment><USER5> It's complicated. FWIW, if I was the CEO I probably would have fought.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> AWS requires you to give up your ip to use their services. Microsoft is lending its customers his patent portfolio umbrella. [1]

Am i correct?

[1] ttp://www.iam- media.com/blog/Detail.aspx?g=b1c57b03-5b9c-4cbf-b8dd-e209daf3f686

<comment><USER4> No. That's just another FUD article. What the practical upshot of that clause is is that if you are going to troll Amazon with your patent portfolio you can't be a customer at the same time. They do not require you to 'give up your IP', either entirely or in part. Copyright is still what it was before, your patents are still yours.

And all this subject to interpretation by a competent judge.

The hypocrisy lies of course in Amazon patenting just about every dumb 'innovation' that they came up with in the early days of the web (recall the 1-click shopping patent). So for Amazon to want to be protected pre-emptively against customer lawsuits over patents is silly.

I also highly doubt a judge would honor their survival clause, but it's up to Amazon to put in their contracts whatever they want, it's up to a judge to decide if it holds water or not. So until this has been litigated it doesn't mean a whole lot.

<comment><USER32> >>>if you are going to troll Amazon ...

Probably consistent with what you said, but just to clarify, I think the AWS license also applies to suits against AWS customers. The license states "...you will not assert... against us or any of our ... customers... any patent infringement or other intellectual property infringement claim regarding any Service Offerings you have used."

It's difficult to imagine how one AWS customer would be able to use this to defend a patent suit from another AWS customer though, since they are not a party to the contract between Amazon and the patent holder that conveys the license. You'd probably have to get Amazon to intervene in your suit.

</comment></comment></comment><comment><USER5> I'm not a lawyer, but I have dealt with patents a fair amount... so here's a quick ELI5...

1\. Uncapped indemnification: this one is pretty simple. If you're sued for using some tech that powers Azure, Microsoft will cover any losses (indemnify you).

2\. Patent pick: if you're sued for patent infringement _at all_, Microsoft will let you "pick" one out of a selection of 10,000 available patents to use in a countersuit. This is an extremely common tactic in IP lawsuits, but one that is only available to folks with large patent portfolios (this is what people mean when they say they have a "defensive patent strategy"). For example, Oracle sues Google for infringing patent X, Google countersues for infringing patent Y, eventually everyone settles (or not, heh). Presumably, the patent will actually be transferred to you (you become the legal owner of the patent) for the duration of the suit (I'm sure there are lots of conditions here).

3\. Springing license: "non-practicing entities" (NPEs) are a _huge_ problem for tech companies. They're also known as "patent trolls." The reason they're so hard to deal with is that they don't actually do anything (other than sue people) so it's hard to use the countersuit tactic mentioned above (if you don't do anything, you're probably not violating any patents). Microsoft is saying that, while they do not generally transfer patents to NPEs, if they ever did so there will be a "springing license" to that patent granted to eligible customers. Therefore, those customers could not be sued by the NPE.

Now, some editorial. I actually think this is a good thing. They're trying to create a "patent free zone." They can't get rid of patents, so the only way to do that is with "legal hacks" like this. Right now small companies without patent portfolios are at a huge disadvantage when it comes to defending against frivolous patent suits. This would absolutely help. Moreover, one of the eligibility requirements states that you must have remained "patent peaceful" against Azure workloads for the past two years. The only way they could have made this better is if they had made the program more broadly available (btw, you're only eligible if you spend > $1,000/mo on Azure).

For what it's worth, the ideas here are not completely novel. Patent exchanges are fairly common (although you usually need a patent portfolio to join one). There are also some similarities with the Apache 2.0 "mutually assured destruction" clause which (again, in ELI5 terms) tries to prevent patent suits for use of Apache licensed software by saying that if you sue someone for using Apache licensed software then other people can sue you for your use of Apache licensed software (without giving up their right to not be sued).

<comment><USER33> So many questions. Like, what if Microsoft is the one suing you?

<comment><USER34> Surely all these cloud services have agreements not to sue their customers for using their patented services that they market and sell?

</comment></comment></comment><comment><USER35> Cloud IP insurance policies would be something interesting to see in this space.

I was at an insurance analytics conference (kind of) recently, and everyone was all hyped up on this notion of trying to write policies for cybersecurity protection. The problem was the underwriting and how to price the policies. I think another thing we could see in this space is how to insure IP that's in the cloud. Cybersecurity insurance meets IP.

</comment><comment><USER36> The EULA you get when you sign up:

[https://www.microsoft.com/en- us/servicesagreement/default.as...](https://www.microsoft.com/en- us/servicesagreement/default.aspx)

It contradicts the promises on the homepage. I would not sign up unless I get the signature of Nadella on a contract stating that Microsoft won't sue me

</comment><comment><USER37> So, it's unclear because the details on the legal instruments used to effect the patent transfer don't see that clear. (If anyone has a link to it, i can't find it) The requirements seem very clear: A. pay azure 1000/month

B. get sued for a patent you aren't being indemnified about (which are the open source ones)

C. be able to use an MS patent for defensive purposes in a counter-suit.

Note that only exclusive licensees of patents could do C, so it must be some kind of transfer.

Without seeing the instrument, it's hard to see what the loop holes are, but at the very least, it seems like you could very cheaply tie up these 10000 patents forever.

1\. Build 20000 shell companies 2\. pay azure 1000/month through 10000 of them. 3\. Acquire 10000 worthless patents not in the area of open source, distribute to half the ones not paying. 4\. Sue the 10000 that are for patent infringement. 5\. Pick 10000 microsoft patents to counter-assert 6\. Sit in legal limbo forever 7\. Repeat as necessary

Cost: 10 mil.

<comment><USER5> Subsection 4.17a$19 in terms: we reserve the right to not license you any patent if you do that thing you just described.

Seriously though, hopefully there's some mechanism covering this sort of abuse. Even if there's not, if I were MS I would simply not comply. It's civil law, and your behavior is completely unreasonable and does not reflect the any reasonable interpretation of our agreement -- come at me. Besides, what are your damages?

</comment></comment><comment><USER38> Interesting. For conversation sake if I were to build a service directly competing with an exisiting Azure service offering am i protected from microsoft itself?

<comment><USER39> Hi Steve,

such a pity you asked so far down the thread. I really enjoyed having a crack at a reply. So much so...

I found there were several ways to consider your question, not all of which were immediately obvious.

To capture my thought, well I put up a repo, same handle as here, at github, [https://github.com/amygdyl](https://github.com/amygdyl) , under HN_REPLY, where the context and flow of my thought really needed to bypass the "comment is too long" objection I encountered.

(Having done this, I realized just how much I've been discarding in frustration, when editing simply did not bring my reply within the limit, so this may begin a hopefully worthwhile habit.)

My partial conclusion went as follows:

"[...] the outcomes are ternary: the indemnity is worthless; the indemnity by putative assignment of a defensive patent has some limited use, but you are defending not Microsoft directly, but MS + 3rd party; or "highly dependent on strategic evaluation".

I do not think that this contracts provides any straightforward indemnity against adverse action initiated by Microsoft, however. Simply nothing in the context or wording leans towards supporting that interpretation.

However, in the event that Microsoft initiated suit claiming infringement of one of the portfolio of 10,000 patents covered by the clauses within this contract, clearly the siutuation created by the contract would become a nullity.

So, in dealing with 3rd party risks, the result could be quite open to interpretation, at least in early stage litigation.

However, as to your question on face value (and making a number of assumptions) then the answer is - if these assumptions became fact, in particular the tort for infringement cited a patent among the 10,000 portfolio, then, yes, this would constitute effective, but implied, mitigation and defense, which if the relevant clauses were enacted, and defense argued, would create a nullity.

How this benefit for customers of Azure actually plays out, if it in fact is ever played out, might never encompass as risky and interesting a scenario as that which I in passing posit. But I believe that in potential, Microsoft might have done a extremely positive, open minded and market generative, act, in offering this standard term.

It gets more interesting, if you consider the possibility of two Azure customers, suing for infringement, where Microsoft IP might come "in between" their claims. [...]*

 _I hope that makes some sense to you, but I genuinely felt the complete flow of my argument was worth putting down, would absolutely appreciate your thoughts - <USER3>

</comment></comment><comment><USER36> That's Racket. You have to pay to avoid getting sued by Microsoft</comment>


CNN's Dr. Sanjay Gupta falling for faith healing quackery - <AUTHOR> http://scienceblogs.com/insolence/2010/12/cnns_dr_sanjay_gupta_falling_for_faith_h.php <comment><USER2> The title (and article) are a little sensationalistic. It is unfortunate that CNN (and Oprah and Dr. Gupta) are giving this story so much airtime, but Dr. Gupta doesn't really "fall" for it, he's just being journalistic and refusing to openly give his opinion. I have no idea whether he gets to choose the stories he presents. The part of this that I find most-disappointing, however, is that Obama tapped this guy to be surgeon general. I don't expect much from a random MD or a news anchor (or a combination) but I'd hope that anyone under consideration for surgeon general would have enough backbone to be more dismissive of a story like this. Anyway he wasn't chosen for surgeon general... maybe this is why.

<comment><USER3> "he's just being journalistic and refusing to openly give his opinion."

This approach, "Earth revolves around Sun? Opinions differ", isn't good journalism. If something's blatant nonsense on stilts, it should be called out. ESPECIALLY if you're covering health and are a physician. "First do no harm", etc.

<comment><USER4> Who's to say what blatant nonsense is though a few hundred years ago it was blatantly obvious the world was flat. I don't see how it is harmful for someone to go see this guy even though it is complete nonsense. It's not like a patient's mental state is totally unimportant.

<comment><USER2> People should know they're paying for a placebo, if that's what it is. Otherwise it's fraud.

<comment><USER4> What says they don't?

</comment></comment></comment></comment></comment><comment><USER5> He probably saw it on twitter.</comment>


Show HN: Ondevice SSH – Terminal emulator for devices without public IP address - <AUTHOR> https://ondevice.io <comment> irq-1 AutoSSH + GatewayPorts on a public server has been solid for me. Setup is a service file on the private machine and "GatewayPorts yes" in sshd_config of the public computer. Plus there's no keep alive traffic. Combine it with dynamic DNS, a web proxy and Lets Encrypt for access to a website running on the remote computer.

from the systemd service file:

        Environment=AUTOSSH_GATETIME=0
        ExecStart=/usr/bin/autossh -M 0 -N -q -o "ServerAliveInterval 60"
         -o "ServerAliveCountMax 3" -o "ExitOnForwardFailure yes"
         -p 3004 -l pi exampmle.org
         -R 3006:127.0.0.1:3006 -R 8080:127.0.0.1:8080
         -i /home/pi/.ssh/id_rsa

</comment><comment><USER2> Quite neat, and solves a big problem I had (devices at customers sites). However for me it would be very hard to trust you (security and availability wise).

I opted (some months ago when the problem arose), to simply set up a private VPN server, and every device I have at customers connects to it. That way, I can simply `ssh device.cust.vpn.mycompany.tld` and I'm in.

<comment><USER3> A "private VPN server" is meaningless, could be IPsec or PPTP or OpenVPN or SSH or ...

If you're already using SSH you can use it to forward ports. You can SSH into that SSH server (with Mosh you'd achieve low latency) and craft a SSH config (at ~/.ssh/config or /etc/ssh/config), make a bunch of shell scripts (including ProxyCommand if needed). You could even run your SSH server over Tor, or as I briefly suggested above you could go with a SSH server as VPN. One disadvantage that has, is that on Android it will not work with without root. Tor also won't work with Mosh (uses UDP), so you'd have higher latency.

See also this recent HN post "SSH vs. OpenVPN for Tunneling" [1]

[1] [https://news.ycombinator.com/item?id=15773466](https://news.ycombinator.com/item?id=15773466)

<comment><USER4> SSH tunnels adds hassle to deploy and maintain. Compared to openvpn once your server is up you just need to deploy software and install certs and byebye! It is my prefered solution for devices since it takes 5min to deploy. And you have instant access to all ports of the device(s)

<comment><USER5> Ssh local forwarding gives you pretty simple access to all ports though?

<comment><USER6> Yes, but:

1) you have to know which ports you want to forward before you ssh into the remote host and

2) you have to change configurations (hostname and ports) in all the programs you use (for example, instead of pointing your browser to [http://foo](http://foo), you're going to have to go and type [http://localhost:8888](http://localhost:8888) \- not to mention all the scripts or other pieces of software that "just work" using the canonical name and standardized port to connect, and would require customizations to change that)

<comment><USER3> With Sshuttle you got access to all TCP ports. You can add hosts in /etc/hosts, ~/.ssh/ssh_config, /etc/ssh/ssh_config, dnsmasq, or aliases in your favourite shell. If you prefer port 80 and it is being used on local host already you can manually do what ZeroTier does: add a /32 or /128 to an interface and route it.

I just tried ZeroTier yesterday and it is nice indeed, basically an advanced, open source Hamachi. But it is not rocket science. What I especially like is that you can completely self host.

</comment></comment></comment></comment></comment></comment><comment><USER7> Very neat, but SSH already has capabilities built-in to handle this scenario without harming security or increasing complexity.

To add to _irq-1_ 's excellent response, another autossh method is to autossh from the device into a remote relay server (ie jumpbox) that forwards the local port back to the local ssh server running on the device, which can now be listening on localhost.

You can try this out in literally ONE COMMAND LINE (below) and automate it quickly without installing any additional software (except perhaps autossh, which is usually in your distribution's repositories).

        device (autossh) -> jumpbox <- you

You can also use Userify ([https://userify.com](https://userify.com)) or similar to keep keys synchronized on the device and jumpbox in this scenario. (Userify only needs outbound https.)

Use RemoteForward (-R) on the autossh command line for this. See man page for ssh(1) and especially the RemoteForward section under ssh_config(5) for details.

Example:

        # on the device:
        $ ssh jumpbox -R 22001:localhost:22

Now you can just log into the jumpbox on port 22001 using SSH's built-in tun support (-w) in your SSH client (or forward your agent by passing -A when logging into the jumpbox, but this could be hijacked by an attacker who'd compromised the jumpbox, so do -w instead.)

That's all. You can automate this with ssh_config, autossh, etc, and also lock down the remote host authorized_keys file and use a restricted shell.

<comment><USER7> Additional details:

You have to log into jumpbox (presumably still running on port 22) in order to log into the device who's SSH listening port has been forwarded from port 22 on the device itself across the encrypted tunnel to port 22001 on the localhost of the jumpbox.

If instead you prefer to expose the 22001 to the entire world (so you don't need to log into the jumpbox first), try this:

        device$  ssh jumpbox -R 22001:*:22

Then, to log into the device, you can just

        laptop$  ssh jumpbox -p 22001

which will pass your encrypted packets securely through from your laptop to the end device (and the jumpbox can NOT see them.)

Keep in mind that, with this method, any potential attacker can now directly try to break into the device itself _through the jumpbox_ rather than have to break into the jumpbox first, so make sure that you harden both the jumpbox and the end device (which is always a good idea anyway - don't deploy an IOT device that isn't hardened!)

</comment></comment><comment><USER8> You don't seem to mention pricing at all beyond the "5 devices and 5Gb/mo free". That would be useful to what I expect your main audience to be (people for whom the other obvious alternative is a cheap VPS and either OpenVPN or more manually setup SSH tunnelling).

<comment><USER9> I wonder why openvpn comes up so often, and e.g. tinc and zerotier, much less often.

<comment><USER8> Momentum mainly I suspect: it has been around and stable for quite some time so a lot of people have good experience with it so it is their go-to when thinking about VPN options (at least F/OSS ones).

It has also been audited by third parties (example: [https://www.theregister.co.uk/2017/05/16/openvpn_security_au...](https://www.theregister.co.uk/2017/05/16/openvpn_security_audit/)) which is reassuring as it has passed with minor issues which were fixed FDQ. I don't know if that is the case for the other options you've listed.

<comment><USER10> I set up an OpenVPN server on DigitalOcean from scratch and it wasn't nearly as easy to use as I expected. Connecting from ubuntu meant connections would randomly hang and I'd have to restart the client and iPhone didn't work out without some third party app. Honestly if I weren't in Ukraine I would have given up completely, but paranoia is justified in Kiev.

<comment><USER11> Third-party app? OpenVPN Connect is first-party, and I've been using it for years now with no trouble.

<comment><USER10> Third-party as in non-Apple. It's taking over my networking so I'd prefer it was baked right into the operating system.

</comment></comment></comment></comment></comment></comment><comment><USER12> Using curl piped to sudo bash can be a security risk, as used to install the demo.

# curl -sSL [https://get.ondevice.io/|sudo](https://get.ondevice.io/|sudo) \- bash

A fairly balanced post and mitigation options:

[https://sandstorm.io/news/2015-09-24-is-curl-bash- insecure-p...](https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp- verified-install)

<comment><USER13> I really wish people would stop doing this. It gets tiresome having to check every stupid little install script before running when there is a PERFECTLY GOOD one-liner that does the same damn thing without hiding anything from the user:

      apt-key add [key]; apt-apt-repository [repo]; apt-get update; apt-get install [program]

There: one line, no script-reading BS, and it gets it done!

<comment><USER14> Your one-liner only works on Debian-derived Linux distros. Usually the whole point of a curl|bash one-liner is that it works on every Unix-like system.

<comment><USER13> Fair enough. I don't know enough about other package managers to know if they can be sequenced like this, but there's nothing wrong with providing another listing like OP with the script link.

</comment></comment></comment></comment><comment><USER15> On a side-note, I was (pleasantly) surprised to recently learn that if you have macs set up with Back To My Mac, you'll get an "iCloud BTMM" IPv6 encrypted tunnel where all your devices appear via dns-sd, even across the internet: [https://apple.stackexchange.com/a/53776](https://apple.stackexchange.com/a/53776)

</comment><comment><USER16> The Teredo protocol (implemented by miredo-client on GNU/Linux) provides a simple way to get a public dynamic IPv6 address on a host behind NAT. Combined with dynamic DNS this solves the problem of accessing my devices from anywhere I need to.

</comment><comment><USER17> a while ago I found out that you could do this by running a tor hidden service on the device. If I needed it, I think I'd rather use that, or a reverse tunnel than going through a third party.

<comment><USER18> Can you explain a little bit more how do you do this?

<comment><USER19> I don't know much but a little googling reveals this: [https://nurdletech.com/linux-notes/ssh/hidden- service.html](https://nurdletech.com/linux-notes/ssh/hidden-service.html)

<comment><USER20> After the HN comment on this a few weeks ago I implemented the Tor ssh method. The bottom of this script is what I run on my remote servers to get Tor ssh access, if want to see an example of working code - [https://github.com/riazarbi/serversetup/blob/master/remote_d...](https://github.com/riazarbi/serversetup/blob/master/remote_deployment_scripts/ufw_jupyter_rstudio_torSSH_setup.sh)

<comment><USER21> If you don't want the anonymity benefits, you can change the hops from 3 to 1 (from the client) to improve latency.

<comment> yjftsjthsd-h There's also a server (hidden service) option to disable anonymity. Use with caution, of course.

</comment></comment></comment></comment></comment></comment><comment><USER22> Instead of wrapping SSH calls with an additional command, would it be possible to use a ProxyCommand? This way, anything working with "ssh" would work out of the box.

<comment><USER23> Hi, manuel from ondevice here.

That's what happens internally (so yes, you could for example use `ProxyCommand ondevice pipe %h ssh` for other tools in the ssh ecosystem - e.g. in your `.ssh/config`).

</comment></comment><comment><USER24> Why not use zerotier and have a super simple vlan?

<comment><USER25> For the tldr:

Zerotier seems to be an overlay network with a custom addressing layer above virtual L2 networks. There's also an appliance in the works that will presumably work as a "hardware vpn" type of gateway on your network. There's no easy setup for ssh access like ondevice.

</comment></comment><comment><USER26> Similar to StrongDM, except it does less. SDM implements the SSH protocol which allow both session logging (for audit and training purposes) and on-prem deployment. It supports all SSH services such shell (for interactive operation) exec (for remote scripting, like ansible and scp) and subsystems (like sftp). And on top of that it supports DB connections through the same tunnel (again with query logging for audit purposes).

The on-prem part is really neat.

Disclaimer: I work at StrongDM.

Edit: fixed typo

<comment><USER27> OTOH, the ondevice setup doesn't require me to trust the service: FWIW, I'm getting a dumb pipe to tunnel SSH through. StrongDM seems to be something quite different IMNSHO.

</comment></comment><comment><USER28> I wonder what is the difference with ngrok, if any?

<comment><USER29> ngrok is aimed at making applications that are under development available for testing by someone outside of your network, for testing webhooks, etc. It's not for production stuff.

<comment><USER30> ngrok link [https://ngrok.com/product/ngrok- link](https://ngrok.com/product/ngrok-link) is definitely meant to be used for production stuff.

</comment></comment></comment><comment><USER31> Looks really neat, however it works make sense to explain how it works to be exactly like ssh :)

<comment><USER23> Hi, Manuel from ondevice here.

Here's a rough explanation:

\- ondevice makes use of `ssh`'s `-oProxyCommand`, which makes ssh send its protocol data to a command's stdin and expect the responses on its stdout (you can use that for example to get around certain proxy servers using `nc`)

\- `ondevice ssh` basically executes `ssh -oProxyCommand=ondevice pipe %h $@` (there's a bit more to it, but that's the gist) \- internally `ondevice pipe` creates a websocket connection to the ondevice API servers, who in turn tell the device (where `ondevice daemon` is running) that there's a connection incoming.

pretty much the same goes for `ondevice rsync` (and the - not yet released... - `scp` and `sftp` subcommands)

<comment><USER32> I recently thought about using websockets for tunneling, too, but found out that "security appliances" which do MitM and virus scanning seem to block websockets by default and even need the newest version to support them at all.

So for some scenarios, using websockets seems to be not enough

</comment></comment></comment><comment><USER33> The tor option has already been mentioned. The other useful option if you don't have your own server with static addresses is dynamic DNS and then simply set up a VPN or reverse SSH connections to the dyndns hostname on your DSL or whatever. Certainly more sensible than a cloud service with a hilarious 5GB traffic limit that also unavoidably adds unnecessary latency to the connection.

</comment><comment><USER34> I've contemplated doing something similar. Except the way I'd do it is statically link OpenSSH and Tor into a single portable binary. Then create an onion service to a local sshd. Then just provide the onion address (still would use traditional auth). Of course lots of configurability. This has lots of benefits of course and can be completely self contained and ephemeral.

</comment><comment><USER35> I used to go via the ngrok way, but thanks for a better-targeted solution.

BTW, just curious is there any other alternative apart from this ?

<comment><USER36> Gravitational Teleport is frequently used for SSH behind the firewall as well, but also tackles many other aspects of SSH for organizations.

It's Open source! [https://github.com/gravitational/teleport](https://github.com/gravitational/teleport) [https://gravitational.com/teleport/](https://gravitational.com/teleport/)

Disclaimer: I am employed by gravitational

<comment><USER35> Thanks, will try this one too

</comment></comment></comment><comment><USER37> At a previous job we had the same setup to SSH to our customer's embedded devices for diagnostics. Incredibly useful. I've been playing with the idea to provide this as a service since then, interesting to see if this is viable.

</comment><comment><USER38> Seems kinda similar to Pagekite ( [http://pagekite.net](http://pagekite.net)).

</comment><comment><USER39> I wonder if they have the TCP inside TCP problem?

</comment><comment><USER40> Check out ZeroTier [1]. You can place all your devices on a virtual LAN. Not affiliated.

[1] [https://zerotier.com/](https://zerotier.com/)

<comment><USER3> How exactly does ZeroTier differ from Hamachi [1]?

[1] [https://en.wikipedia.org/wiki/LogMeIn_Hamachi](https://en.wikipedia.org/wiki/LogMeIn_Hamachi)

<comment><USER41> Instead of being a VPN it is a virtual network device. It creates a private virtual ipv6 network. It acts like being on a local network, so all devices inside that network are visible. Software defined networking and all that. Quite impressive.

<comment><USER42> That's what Hamachi does. They're still called VPNs.

<comment><USER41> You have no idea unless you try it. It is different. for example this network device is meant to make a network between all your iot devices, or over a cross provider cloud infrastructure. It does not route all tradfic through a vpn server. Nodes connect directly to each other. you do have a fallback openvpn mode for iphone devices though. You cannot really imagine if you havent tried it (and that is a problem for zerotier anyways)

<comment><USER42> Have _you_ tried Hamachi? That's exactly how it works. It's not a VPN that routes all your traffic, it's a virtual LAN. You get a private IP, and can communicate with other devices on the same network over their private IPs. And yes, nodes connect directly to each other.

</comment></comment></comment></comment></comment></comment><comment><USER43> Seems very much like Gravitational Teleport - [https://gravitational.com/teleport/](https://gravitational.com/teleport/)</comment>