Google's top news link for 'final election results' is a fake news site - <AUTHOR> https://www.washingtonpost.com/news/the-fix/wp/2016/11/14/googles-top-news-link-for-final-election-results-goes-to-a-fake-news-site-with-false-numbers/ <comment><USER2> We were previously worried about filter bubbles -- that is, people only seeing _true_ news that agreed with their worldviews. This election cycle we seem to have a rise in blatantly false news that agrees with people's worldviews spreading through social media. Everyone is talking about Facebook and Twitter fueling this problem, but it seems not even Google is immune. A healthy democracy relies on an informed citizenry, so this phenomenon is truly a threat to democracy itself.

<comment><USER3> This is always going to be a problem unless critical thinking becomes a skill that everyone accepts as fundamental as reading and math.

<comment><USER4> Well a hell of a lot of academics who claim to be critical thinkers didn't critically think about their own bias in this election.

Critical thinking is not a shield against your own bias.

<comment><USER5> What does this mean? What biases are you talking about?

<comment><USER6> I am not _ThomPete_ but if I had to guess, it's PC bias that blinded many to the potential of this outcome. Perhaps most glaring of these biases is the idea that all women should demonstrate solidarity for their gender and vote for a woman, even if it means voting against their own best interests and the interests of their communities. I don't see too many people calling that for what it really is: sexism.

<comment><USER5> If you're talking about the pollsters, which are not necessarily academics (bias much?), it seems like a stretch to say that making a prediction of a complicated future event based on statistical techniques is due to a lack of critical thinking. Their prediction models will have to be adjusted, sure. But all the people that were "proven" right because their intuition happened to match the outcome are using a much worse critical thinking technique.

Also, Clinton won women 54% to 42%.

<comment><USER6> No, I'm talking about all the columnists who openly refer to that 42% as _traitors to their gender_.

<comment><USER7> _No, I 'm talking about all the columnists who openly refer to that 42% as traitors to their gender._

I did a Google search (ironic, I know) for "Trump traitor gender" and I couldn't find columnists referring to Trump-voting women as traitors to their gender. Maybe I didn't look hard enough, but I think this illustrates the sort of problem we are faced with

<comment><USER4> Took me one search.

[http://www.chicksontheright.com/feminists-say-white-women- ar...](http://www.chicksontheright.com/feminists-say-white-women-are-traitors- for-supporting-donald-trump-heres-what-i-think-about-that/)

<comment><USER7> Thanks, but that's a column that _accuses_ feminists of the same thing that GP did. It isn't a column _by_ a feminist accusing Trump voters of being gender traitors, although it does link to a single blog post on Slate [http://www.slate.com/blogs/xx_factor/2016/11/09/white_women_...](http://www.slate.com/blogs/xx_factor/2016/11/09/white_women_sold_out_the_sisterhood_and_the_world_by_voting_for_trump.html)

Perhaps that blogpost partially satisfies GP's assertion, but this little thread illustrates how difficult it is to fact-check political rhetoric, even in the absence of fake news.

<comment><USER4> This is silly.

Anyone who followed the election just a little bit saw plenty of that.

Here is another one that didn't take me more than one search either.

[http://www.nydailynews.com/news/election/republican-women- su...](http://www.nydailynews.com/news/election/republican-women-supporting- trump-ashamed-article-1.2822728)

If anything it proves exactly what I said.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> There seems to be a lot of focus on the popular vote and the fact that Clinton won the popular vote but lost the presidency. But is it really useful to look at the popular vote for a close elections like this? I feel like people's behavior would change if the metric to elect the president was solely based on the popular vote. Many people that live in very red or very blue states feel like their vote "doesn't matter" and are not enthusiastic to vote. Not to mention campaigning strategies would be very different. We don't really know how the election would go under a popular vote scenario. It seem kind of disingenuous - like focusing on strikes out in a baseball game instead of the score.

<comment><USER9> People need to understand that the electoral college is working as designed.

The US was created to be something like the EU: a confederation of states.

Everyone intuitively understands that Luxembourg and Malta need to have protections in the EU so that Germany and France don't always get their way. The only way to achieve this is to have some disproportionate representation for the smaller member states.

In the US we have become much more centralized since WWII and FDR and now we seem more like a regular country with a unified power structure. But the system we're built upon is still designed for a group of largely autonomous states.

<comment><USER10> > People need to understand that the electoral college is working as designed.

The electoral college was indeed intended to ensure representation for all of the states, but it is definitely not working the way it was originally designed.

The original design assumed that the voters would vote for electors by name (i.e. the electors' names would be on the ballot, not the candidates' names), and the chosen electors would exercise independent judgment and vote for the candidate they thought would be the best president. We know this is the original intention, because the people who designed the electoral college wrote about this at length.

When some states started putting the names of the presidential candidates on the ballots instead of the names of the electors, James Madison and the other people who designed the electoral college were very unhappy about it. They felt so strongly about it that they proposed amending the constitution to require that ballots contain the electors' names rather than the candidates' names.

When electors are bound to vote for a certain candidate, it's clear that the electoral college is not working as it was originally designed.

</comment></comment></comment><comment><USER11> What can Google do to prevent this from happening?

If Google really wants to organize the worlds information and make it usable for everybody, they have to make sure Google news is a news source you can trust. Pagerank is not going to cut it.

A couple of suggestions:

\- prevent less reputable websites from showing up for political queries _at all_

\- ignore articles with headlines in ALL CAPS

\- work with a dedicated team of editors, like politifact, to give websites an honestyrank

\- be transparent, show honesty rank in the search results

Any other ideas?

<comment><USER12> A start would not let anything that is run on Wordpress or Tumblr become the top news result for something. That's where most of the spam/fake websites seem to be these days.

<comment><USER13> Then you filter out legitimate news websites.

source: run a legitimate news site built on Wordpress.

<comment><USER14> I assume you mean your site runs on a Wordpress back-end, but in the case of this article the dodgy 70 News site is literally running on Wordpress.com's free hosting (it's 70news.wordpress.com). I suspect that's what the original poster meant since they mentioned Tumblr as well.

<comment><USER13> Oh ok, yes sorry misunderstood!

</comment></comment></comment></comment></comment><comment><USER15> Kind of surprising...as I remember it back in 2013 working at a news startup, getting listed in Google News seemed like a manual, hand-curated process. Not perfect, but frictiony enough to block this kind of crap

edit: by "manual", I only know what it was like on the news outlet side. You had to fill out a form, provide a real address and phone for contact info among other bits of company info, and the wait was several days if not a week. It felt like the process one goes through when a human has to verify the info, like an iOS app.

<comment> angry-hacker You still do, b t if something goes viral, the specific viral page can be shown there.

I know since I run a site that had similar scenario.

</comment></comment><comment><USER16> Who gets to decide what the real news is? Like if you make a white list of legit news, then you are creating an inherent bias.

What if the real news list chooser doesn't like a certain website, so they black list it?

Isn't trying to control this unintentional or maybe even intentional censorship?

<comment><USER17> It's a bias that you can trust but verify. For instance, AV software, and web filtering apps rate websites you visit with a score and could block you from visiting sites with a low score to keep you "safe". If web filtering vendor A is a competitor of vendor B or doesn't like the world view of candidate X, they could easily block you from going there. So we have to trust but verify. This is why open source is helpful so we can see the algorithm or reasons why something is blocked.

<comment><USER16> I see the problem you are describing.... But if google or Facebook blocks something, its totally possible that you won't even be able to verify... Things will vanish forever.

<comment><USER18> Shouldn't blantantly false information vanish forever, or at least be pushed out of the platform? For example, the meme on Facebook that said the Pope endorsed Donald Trump. It was blatantly false; and yet it was shared over a million times.

<comment><USER16> Truth is super subjective, plus people should be able to spread the memes they choose... It's up to the reader to decide what is real and true.

If someone else gets to decide its censorship.

</comment></comment></comment></comment></comment><comment><USER19> I am already missing the days when all information disseminated to the masses was hand-curated by passionate, serious, intelligent professionals who staked their careers -- their lives -- on accuracy and objectivity. Those are days that went out with the internet.

</comment><comment><USER20> This is an extreme example that illustrates something that happens all the time.

In this case the publisher is reported as a "fake news site" but I would argue that any publication that cites sources that are not thoroughly researched and fact-checked should be considered a fake news site.

Huffington Post does this all the time- they link to their own articles and other sites' opinion pieces to make points and pass them off as legitimate fact-based sources.

</comment><comment><USER21> It is a crazy time that we live in. We have a massive group of people that openly reject mainstream news and were lead there by the now President elect. Trump spent his entire campaign crafting an alternative reality and now millions of people are all in. If he continues down this road of trashing mainstream media institutions while pointing people to his cronny owned newsertainment entities like Breitbart I am very concerned about the future.

The Trump bubble has to burst eventually and I think the American's that voted for him are in for a rude awakening when it does. I just hope the fallout doesn't bring down too much of the country.

</comment><comment><USER22> This reminds me a lot of Ryan Holiday's book, Trust Me, I'm Lying: Confessions of a Media Manipulator.

Except that is it something that happens via automation rather than through methods listed in the book. Still the book is a good read if just to get acquainted with how one can manipulate media in this day and age.

</comment><comment><USER23> How do you define 'fake' news sites now after all the mainstream media outlets called the election so completely wrong? It all seems like propaganda with people trying to push their views.

<comment><USER24> There's a difference between succumbing to your own bias when seeking out & reporting news, vs willfully making $#!^ up as clickbait.

</comment></comment><comment><USER25> I really think they need to look at what the difference between "news" and the web is. I thought news was a list of sites that I could exclude if I felt they weren't worth reading.

They also have a bug with the interpretation links to snopes.com that has been reported to them[1]. I wonder if that affects any other site? I would doubt it would be just one.

1) after filling out their form on news.google.com, I posted here [https://news.ycombinator.com/item?id=12384851](https://news.ycombinator.com/item?id=12384851)

</comment><comment><USER26> What is the top news link, isn't part of the problem that what I see when I search for 'final election results' is different from what any one else would see, personalization, in other words?

<comment><USER27> I am able to reproduce, both incognito and signed into chrome. I'm guessing it's not personalized because the actual search is short circuited by a specialized result view, with Google's own "2016 US election results" widget appearing above the search listing.

Though ironically it's now been bumped to second by the WaPo article about it.

</comment></comment><comment><USER28> Google also includes the correct election counts in a big box directly above any of the search results...

<comment><USER24> Question is: what constitutes "correct"? The Federal Elections Commission hasn't released the official results.

Google does (in light gray) mention that there's still 20 electoral votes to account for. It does not, however, give any disclaimer to the very precise looking "popular vote" count[1], which will change significantly when those 20 EVs are finally accounted for, and change again if[1] more counting occurs. A whole lot of arguing is going on over that popular vote, which indications are actually puts Trump ahead even though Clinton is authoritatively presented by Google as having more. No major site is showing Trump having the 306 EVs which he will undoubtedly have; the stalling at this point is getting suspicious.

[1] - To clarify: the USA presidential election does _not_ establish a winner from the straight count of all voters. Since we are the United _States_ , voters in each state vote in their jurisdiction, the state decides how to handle the results, and then each state submits a set of votes (weighted by population in a way to ensure low-population states aren't invariably washed out by a dozen major cities elsewhere). We don't necessarily complete the vote count because, mathematically, there comes a point (usually) where the remaining votes simply don't matter (say, candidate T is ahead by 200,000 votes and there are 100,000 votes remaining to count) because the allocation of the state's electoral votes are provably complete (and because counting every vote usually gets pretty messy at the end; look up "hanging chad").

<comment><USER24> BTW: the official results will be published here - [http://www.fec.gov/pubrec/electionresults.shtml](http://www.fec.gov/pubrec/electionresults.shtml)

</comment></comment></comment><comment><USER15> I guess while we're on the topic, and since it appears in the WaPo's screenshot, can someone give insight on how the hell Heavy.com is almost always at the top ofbreaking news links when doing standard Google News searches for people suddenly in the news? Things like: "John Doe: 5 Facts You Need to Know"

Here's one:

[http://heavy.com/news/2016/09/keith-lamont-scott- charlotte-n...](http://heavy.com/news/2016/09/keith-lamont-scott-charlotte- north-carolina-police-shooting-daughter-facebook-live-video-brother-officer- name-photos-reading-book/)

Entirely cribbed from real news sites' coverage when it's not just innuendo. And yet when the news is fresh, Heavy.com is almost always at the top, beating out original coverage and even sites that do it much better (DailyMail comes to mind).

I get that prioritized placement of proper nouns in the headline and page title can boost SERP, but this is ridiculously effective SEO-gaming, the likes which were mostly stopped when Google's Panda was thought to drastically hurt content farms like Demand Media [0]

Even the article the WaPo screenshot, which is the _very first link_ for "clinton vs trump", is just fluff:

[http://heavy.com/news/2016/11/popular-vote-clinton-trump- hil...](http://heavy.com/news/2016/11/popular-vote-clinton-trump- hillary-2016-2012-2008-uncounted-ballots-electoral-college-presidential- election-results-california/)

The first 3 lines:

> There are millions of ballots that haven't been counted yet from the 2016 > presidential election. How many? The New York Times estimated on November 12 > that there are 7 million uncounted ballots in the country.

How is this beating actual URLs to live poling data that have Clinton vs Trump in the title?

[0] [http://searchengineland.com/google-panda-update- costly-11206...](http://searchengineland.com/google-panda-update- costly-112062)

</comment><comment><USER29> I just googled for "Was there a Trump wave?" for legitimate reasons, and the top news result (second entry) was a Breitbart article next to an image of Trump with the words "Sieg Heil!" This is so upsetting.

</comment><comment><USER7> Zuckerberg seems to be downplaying Facebook's fake news problem, and I'm not particularly optimistic about Google taking it seriously either.

Software engineers are smart- software engineers who work for Google and FB especiallly so. It isn't inconceivable that they, and the people they know, are smart enough to see right through fake news, and that the idea that anyone can be fooled by fake news is probably absurd to them.

Unfortunately in the real world, many otherwise normal, functional people just aren't equipped to do basic fact-checking.

Just yesterday, I got a forwarded fake news meme from my uncle, about a woman who had 11 babies[^]. My uncle, in his 50s, is a college dropout and of above- average (though not stratospheric) intelligence. He is simply not equipped (along with many others I know) to deal with a world where hostile, greedy and mischievous actors are working to shape their reality.

This is an example of where some diversity would help improve tech. The monoculture at the top seems to have isolated the industry from its customers and their intellectual weaknesses.

[^]It happened to be a Whatsapp family group, so I was able to see the story and tell him it was fake...my FB feed is already filtered to hide that sort of junk.

</comment><comment><USER21> I noticed this on Sunday but it seemed par for the course for a Google news result. I wish they would use better signaling on any domain being returned as a news result. A domain registered less than a year ago with a link profile almost all alt-right is probably not the best source.

</comment><comment><USER30> Google News allows you to tune which news sources to prefer (under Personalize > Adjust Sources). I have a long list of "news" sites that I mute. It would be useful if there was a way to export or share these lists, similar to some Twitter blocklist sharing services.

</comment><comment><USER31> I think one of the issues is, unlike the printing press days, you can't unsubscribe from bad news outlet. In the old days, you'd cancel your subscription and delivery. Now your best shot is adding 70news.com to adblocker or something.

</comment><comment><USER32> What's funny, is now this article is the top result for "final election results" on Google. :) And then the article they're talking about shows up second.

</comment><comment><USER33> Why does Google wait so long to report the real election result? They don't want to make Hillary look as bad as she did in the election?

</comment><comment><USER34> I typically go to the state registrar of voters for official vote counts. Aggregating them over multiple states is hard though.

</comment><comment><USER35> Fake news is a hard business. Even human cannot tell whether it is true or not, if without intensive fact checking.

<comment><USER24> I've been wondering about that for some months now: for all the stuff I see reported as news, I'm increasingly suspicious about how any of it comes into being as reported.

</comment></comment><comment><USER36> The printing press dramatically changed the sociopolitical landscape of the world.

Should we expect less from the internet?

</comment><comment><USER37> I googled "safety pin" and 50% of the top results are clickbait garbage

<comment><USER38> I googled "kardashian" and 90% of the top results are clickbait garbage

</comment></comment><comment><USER39> Wow, self-criticism from WaPo? I applaude that.

</comment><comment><USER40> AI will eat the world.

</comment><comment><USER41> Every corporation try to hide now they hate against Trump. Sad that there is so many liars in corporate world. I Don't trust anything that Google, Facebook & Twitter is pushing. Trust issue is really understatement.

</comment><comment><USER42> Hilarious that WaPo is complaining about other people spreading fake news. Stealing some of their readership no doubt.

</comment><comment><USER43> Ironic that WaPo should call out anybody for being fake this election cicle.

For those downvoting, read at least this:

[http://nypost.com/2016/10/12/how-the-washington-post- killed-...](http://nypost.com/2016/10/12/how-the-washington-post-killed- bernie-sanders-candidacy/)

<comment><USER13> I am with you, friend. On reddit's /r/politics, there was a heavy influx of Correct The Record shills, and now that the election is over, things have returned to relatively normal there. With Bezos controlling WaPo, I have no reason to believe things are not being manipulated here as well. The only thing, and maybe good, this election cycle has done was throw out the window the small shred of faith I had in fair and unbiased reporting in this country in critical moments. They throw a puff piece, or a good piece of journalism here and there on side topics, but when it comes to crunch time -- as shown by the WaPo days leading up to the Democratic Primaries, they unleash the full weight of their propaganda machine with no remorse.

The only thing I'll turn to these corrupt giants now is weather events. Can't slant those in any way. We need to break up the 6 corporations that control our media, ASAP.

<comment><USER44> Discrediting honest reporting has been the foundation of the whole alt-right approach to the media, and getting acceptance for the lies broadcast by sources such as Breitbart News and Drudge Report. In fact, it's essential to discredit honest reporting if your lies are going to get any traction. And, evidently, it has worked on you.

Sadly, it's even worse than it sounds, because now even the alt-right websites can't tell the truth. For an interesting short piece about this, see the final section of "Donald Trump broke the conservative media" (1). Quote:

One of the chief problems, Sykes (2) said, was that it had become impossible to prove to listeners that Trump was telling falsehoods because over the past several decades, the conservative news media had "basically eliminated any of the referees, the gatekeepers."

"There's nobody," he lamented. "Let's say that Donald Trump basically makes whatever you want to say, whatever claim he wants to make. And everybody knows it's a falsehood. The big question of my audience, it is impossible for me to say that, 'By the way, you know it's false.' And they'll say, 'Why? I saw it on Allen B. West.' Or they'll say, 'I saw it on a Facebook page.' And I'll say, 'The New York Times did a fact check.' And they'll say, 'Oh, that's The New York Times. That's bulls---.' There's nobody — you can't go to anybody and say, 'Look, here are the facts.'"

"And I have to say that's one of the disorienting realities of this political year. You can be in this alternative media reality and there's no way to break through it," Sykes continued. "And I swim upstream because if I don't say these things from some of these websites, then suddenly I have sold out. Then they'll ask what's wrong with me for not repeating these stories that I know not to be true."

(1) [http://uk.businessinsider.com/conservative-media-trump- drudg...](http://uk.businessinsider.com/conservative-media-trump-drudge- coulter-2016-8)

Edit/insert:

(2) "Charlie Sykes, a popular conservative talk show host in Wisconsin"

<comment><USER13> > And, evidently, it has worked on you.

Yeah, no. I see the dung heap in front of me, I don't need conservative click bait news outlets to help me.

<comment><USER44> Which dung-heap is that?

</comment></comment></comment></comment></comment><comment><USER45> Be fair I didn't read the article. Just judging by the site, the headline, and current events, I assume the problem is that the content of the page is opinion instead of fact.

Ok, what's wrong with that? If that site/blog post has gained more traffic, social signals, backlinks, etc. etc than it's "competitors" shouldn't it naturally be top ranking?

<comment><USER46> That's not what the article is about. It's about misinformation; the fact that people are citing these sites and touting numbers that "prove" that Hilary lost on both electoral and popular vote.

<comment><USER47> I've seen some (really condescending) comments doing just that. I thought they were on drugs or just trolls.</comment></comment></comment>


Managing Apt Repos in S3 Using Lambda - <AUTHOR> http://webscale.plumbing/managing-apt-repos-in-s3-using-lambda <comment><USER2> Interesting idea to use Lambda. (Personally, I've used Aptly.)

\---

For the Apt transport, I recommend apt-boto-s3 ([https://www.lucidchart.com/techblog/2016/06/13/apt- transport...](https://www.lucidchart.com/techblog/2016/06/13/apt-transport- for-s3/)) that I authored. Unlike apt-transport-s3, it

      * Works with AWS v4 signatures (required in some regions)
      * Supports If-Modified-Since caching.
      * Uses pipelining.
      * Uses standard AWS credential resolution, like ~/.aws/credentials or IAM roles
      * Allows credentials to be specified per-repo (in the URL)
      * Supports both path and virtual-host styles for S3 URLs

And it works with proxies if you use HTTPS_PROXY/HTTP_PROXY environment variables (though I haven't tested this).

<comment><USER3> Oh cool. The only reason I chose apt-transport-s3 was that it was included in Ubuntu 16.10. It also only uses stuff from the standard python library so there's less bootstrapping before it is usable.

That does look really cool though. For proxies it would be nice if it supported the standard apt-get proxy declaration. Apt-transport-s3 basically does that and sets the proxy env vars.

You could probably get yours into the offical ubuntu repos if you wanted, though.

</comment></comment><comment><USER4> Great write up. We use S3 for our Apt & Yum repos at work, too, only with website hosting turned on for the buckets (losing some of the security OP's solution has but adding simplicity).

I'd like to point out a tool I'm using now for building and managing our Apt repos- Aptly [https://www.aptly.info/](https://www.aptly.info/)

It's really nice and Just Works™. It even has S3 publishing built in. Oh, and you can build Apt repos on Debian, CentOS, MacOS X & FreeBSD (thanks Go!).

To solve for Yum & Apt I wrote a tool in Go that keeps all the metadata in a JSON file in S3. It's just a map of S3 buckets that are repos to a list S3 URLs for each RPM / Deb. Whenever that file gets updated, just like OP, I send an event from S3 to Lambda. Unlike OP, tho, I just have Lambda launch a task in ECS and then my repo builds (& S3 syncing) takes place in containers (1 Ubuntu container for Apt repos & 1 CentOS container for Yum).

<comment><AUTHOR> So, this way be dragons but... You could just have a small Javascript or Python wrapper that simply calls out to Aptly. As long as you compile Aptly for the right target you can bundle it up in the zip that your ship to Lambda. Since it's Go it'll just run. Then your wrapper just takes care of calling Aptly with the right arguments depending on what event got sent from S3.

<comment><USER4> I actually prefer using the containers. It's easily repeatable anywhere I can run docker (doesn't have to be AWS). I can also avoid any race conditions by checking to see if the task is already running.

(And in general I'm not a fan of trying to do a lot in lambda. I like it a lot more as a glue layer / event handler).

</comment></comment></comment><comment><USER5> I use deb-s3[1] which is sort of like this, but handles uploading the package and updating the Packages index in a single step. deb-s3 can also sign your Release file so apt won't complain about unsigned packages.

The post mentioned deb-s3 and dismissed it as more complicated to setup than this solution. While the lambda solution is neat, I'm not sure I would describe it as simple. For now I think I'll stick with deb-s3.

[1]: [https://github.com/krobertson/deb-s3](https://github.com/krobertson/deb-s3)

<comment><USER3> True, lambda setup is not super simple. However with deb-s3 you have to have a local copy of the .deb, whereas with what I'm doing the files never leave S3.

</comment></comment><comment><USER6> If you care about your time, PackageCloud is a hosted solution for managing dpkg and rpm repositories. It supports repository signing out of the box. I'm a happy customer.

[https://packagecloud.io/](https://packagecloud.io/)

</comment><comment><USER7> I love this!

But I have to admit I'm a little confused. Is this mostly for large repositories? I ship some software on multiple platforms and part of my build process builds an apt repo (available over HTTP) as follows:

        run_gpg_command dpkg-sig -g " --yes" \
            --sign builder *.deb && \
            rm -rf repo && \
            mkdir repo && \
            cp *.deb repo && \

            cd repo && \
                (dpkg-scanpackages . /dev/null > Packages) && \
                (bzip2 -kf Packages) && \
                (apt-ftparchive release . > Release) && \
                    (run_gpg_command gpg --yes -abs -o Release.gpg Release) && \
                    (gpg --export --armour > archive.key)

Then I sync it to S3 using aws s3 sync.

What are the problems doing it this way?

<comment><AUTHOR> It's not just for large repos. The idea is that you can just build your package, drop it in S3 and the rest is taken care of. You don't need to generate the rest of the metadata yourself, like the Packages or Release file.

It does however not address the issue of signing in this case. Would be interesting to see if someone can extend it using an additional bucket to store credentials with the necessary policies to only allow the Lambda function to get and use them.

<comment><USER7> Seems to me that it's not really beneficial for most small software publishers in that case. They can just use a variant of the script I posted above, I suppose.

</comment></comment></comment><comment><USER8> Looks really interesting!

I may be about to show my apt inexperience here, but I don't see any explicit callout of a signing step. Does apt handle signing only at the package level, such that you'd just sign when you build a single package and then upload that?

I've written a tool for managing Archlinux repos in S3 ( [https://github.com/amylum/s3repo](https://github.com/amylum/s3repo) ), which I run in a container myself so that I can use my GPG key to sign the packages and the full repo metadata. I'd love to move to something like this, so I'd be able to let AWS handle running the lambda on my behalf, but I've yet to figure out a good way to do that with the signing structure necessary

<comment><USER4> Not OP but I left another comment further up-

I also run my Yum & Apt repo builds in containers and I have lambda launch those containers when S3 is updated...

In order to facilitate signing I have my GPG key on the container host machine and mount that directory as a volume in the container so the container has access to the key as well.

For initially provisioning the container server I deploy the GPG key as an encrypted blob and decrypt it on the host.

<comment><USER8> Yup yup. I do similarly at the moment. I was brainstorming a bit more, I think if I were to port to Lambda, I'd probably use a KMS-encrypted S3 object to store the private key.

That said, it would mean fixing up my original key strategy. At the moment, I'm using a signing subkey of my personal GPG key, since it's just a personal repo and I control the VM/container where the stuff happens. By comparison, if I were dropping it into a lambda/s3, I'd probably be more motivated to split onto a fully separate key for the repo.

</comment></comment></comment><comment><USER9> Very interesting - I've been working on exactly the same approach for a yum repo, but hadn't solved the race condition issue yet. I might have to "be inspired" by this post :)

</comment><comment><USER10> I'm wondering what people are using to _build_ custom deb packages. We currently have a set of simple shell scripts which first install the dependencies, then compile some source code and finally use checkinstall to build a Debian package from that. It works, but I'd much rather have a config file with all the required steps instead of a buggy shell script. Is there any better way?

<comment><USER6> fpm - [https://github.com/jordansissel/fpm/wiki](https://github.com/jordansissel/fpm/wiki)

<comment><USER10> Looks good! Additionally, there's fpm-cookery, which comes pretty close to what I want: [https://github.com/bernd/fpm- cookery](https://github.com/bernd/fpm-cookery) Somebody also created a Docker container for that: [https://github.com/andytinycat/fpm- dockery](https://github.com/andytinycat/fpm-dockery)

Now combining this tool with Jenkins, which triggers a build whenever I change the recipe would be all I need for now.

</comment></comment></comment><comment><USER11> I like that this solution takes into account the "race condition" for doing multiple things at once. To me that was the biggest issue I ran into with deb-s3 and it's why I wrote deb-simple ([https://github.com/esell/deb- simple](https://github.com/esell/deb-simple)).

</comment><comment><USER12> My co-worker just setup something similar for RPMs. his solution was Lambda + ECS - [https://github.com/erumble/s3-repo- sync](https://github.com/erumble/s3-repo-sync)

</comment><comment><USER13> This is an awesome write up.

<comment><USER3> Thanks! And thanks everyone else for all the comments!</comment></comment>


Stats for 'top' coding bootcamps for January to June 2016 - <AUTHOR> https://cirr.org/data <comment><USER2> This is from the CIRR website:

CIRR is an independent non-profit organization. Its board members are: CIRR CEO: Michael Kaiser-Nyman, Founder & President, Epicodus Liliana Aide Monge, Co-Founder & CEO, Sabio Rachel Martinez, General Counsel, Turing School of Software & Design Rachel McGalliard, VP of Operations, The Software Guild Rick O'Donnell, Founder & CEO, Skills Fund Harsh Patel, CEO, Hack Reactor Sharon Wienbar, Capella (Hackbright & Dev Mountain) David Wintrich, Co-Founder & Chief Academic Officer, Tech Elevator David Yang, Co-Founder, Fullstack Academy & Grace Hopper Program

\</comment><comment></comment><comment></comment><comment>---

Follow the money. Not exactly a disinterested, objective source. And certainly not consumer/student advocates. Important to note.

</comment><comment><USER2> And isn't this a bit outdated in terms of info that could tell us what is going on with these bootcamps now? (which is just the tip of the iceberg here)There is a palpable desperation in the fact that this comes in the middle of yet another thread about coding bootcamps' impending demise.</comment>


A Lot Of People Have Already Left Clinkle - <AUTHOR> http://www.businessinsider.com/clinkle-employees-depart-2013-11

<comment><USER2> so let me get this straight... over the course of three years, 19 people (many of them not full time employees) have left a 70-person company founded by students? and this is news?</comment>


Ask HN: Review my startup - <AUTHOR> I've came up with an idea to make Quora but personal. Like answering & asking questions with people you know. I came up with this idea because my relatives & friends often asks me technology related problems and questions face-to-face, by chat or via call so why not make a platform which offers this service.
I would love to have your detailed feedback on this.
Thanks in advance! <comment><USER2> They ask you because you're free. If there was a paid service for this, they'd still ask you. If it was monetized some other it might be useful but need more details.</comment>


When an Open Relationship Comes at a Price - <AUTHOR> http://www.nytimes.com/2015/06/28/style/when-freedom-comes-at-a-price.html <comment><USER2> TL;DR people get jealous.

<comment><USER3> ditto that in vanilla relationships as well.</comment></comment>


Ask HN: Does anyone use Streak (YC S11) as their main CRM? - <AUTHOR> I've used Streak as a personal CRM on and off over the years and it has certainly made a lot of progress as a product. However, I only use it as a "personal" CRM - i.e. for fund-raising, or senior hiring, and when we have done sales in a company we have used something like Pipedrive or Salesforce.
I'm wondering if anyone uses Streak to run a serious, multi-agent sales team, when otherwise they might be using a more regular CRM?
They have Uber, Twitter, AirBnB, Yelp logos on their website, but I find it hard to believe that these companies are really using Streak as their CRM company-wide - it's probably just a few individuals like me also using it as a personal CRM.
I'd love to hear first-hand accounts of sales teams really using Streak.
Streak: https://www.streak.com/ CRM plugin for Gmail <comment><USER2> Hey there - founder of Streak here.

Sharing our customer success stories is something we need to do better of. We hope to get a few of these on our site.

To answer your question, yes many companies use Streak as their main sales CRM. Can't comment on specific companies but we have several large companies using Streak (in the hundreds of users). Our sweet spot is lower though, in the 10 to 50 user range.

Feel free to reach out, happy to share more details or help with onboarding: aleem at Streak dot com.</comment>


The End of My VC Career - <AUTHOR> https://techcrunch.com/2018/04/05/the-end-of-my-vc-career/ <comment><USER2> There's not much of interest in this story. Glaenzer was caught, by police witnesses, sexually assaulting a woman in a London train. He was convicted. He retained his role at the VC firm he cofounded for several years, but discovered that institutional investors --- the people who fund VC funds --- were unwilling to allocate capital to a firm that included Glaenzer. He left the firm.

The job of a VC partner is about trust, judgement, and persuasion. Flagrant violations by partners redound to the reputation of the whole firm. When you understand just what it is a VC firm is, how they're essentially middlemen simultaneously pitching themselves to operators and to capital, it becomes clear how important reputation is. Really, it's _all there is_. Without it, you can't do the job.

<comment><USER3> Indeed. Seems like a pretty clear-cut case to me.

</comment></comment><comment><USER4> This is a complex topic, but it seems like there are a couple of questions about the character of people who work in executive roles which _should_ fundamentally matter in due diligence discussions.

Do they implicitly respect the agency of others? Do they see people as individuals with their own goals and the fundamental right to decide what those goals are?

These people make a lot of decisions on behalf of others, and I believe that asking those questions isn't that far off from asking: can you trust them to act in the interests of their employees, clients, and customers? Or at the very least, are they likely to have some sense of fiduciary duty towards the people who they agree to perform work for?

So, from my perspective, "a private mistake which we all agree was not business-related" sounds...well I don't know the right word, but who is 'we' in that phrase?

And I don't know which institutional investor balked at the fund based on the perceived character of its decision-makers, but I appreciate that they considered that angle in their process.

<comment><USER2> I thought "private mistake" was an extremely weird argument, too. It can't possibly be right; any of us can think of "private" crimes that would preclude someone's continued involvement with a VC firm. So, really, the implied argument he's making is that sexual assault is some kind of lesser crime.

<comment><USER5> I read it as drawing a distinction between sexual assault committed against someone with whom the firm has an actual or potential business relationship (e.g. hitting on a founder when she pitches you) vs. one committed against someone with no such connection. Certainly the law would not distinguish these two — I didn't read him as suggesting that — but one's business associates might.

</comment></comment></comment><comment><USER6> > I suggest that by remaining in his position he took very few consequences, > and that in almost any other walk of life a person with less privilege would > automatically lose their job after being convicted of sexual assault.

Is this actually true? If, as a random example, a waiter in a restaurant were convicted of sexual assault on the subway (as in the story here), how would the owner of the restaurant even know about it to fire him?

I think things work exactly the opposite of how the author of this piece does. The person under question here had his career end because he was famous in his field. But 99% of people are not famous. Rather than "privilege" shielding him, being rich and famous was his downfall.

<comment><USER7> Through the increasingly popular (and unreliable, and hard-to-dispute) background check service that SV has created.

[https://checkr.com/](https://checkr.com/)

<comment><USER8> Background checks have been around for a long time, and a new service has little to do with their availability to employers. The actual answer as to how an employer would know if their employee had gotten in legal trouble is the time they would miss as they got arrested, jailed, bailed, and then worked through the legal process.

<comment><USER6> Being jailed or otherwise detained for any amount of time, sure. But otherwise, working through the legal process wouldn't be something a regular employer knows about. You would have more errands to run than usual perhaps, that's about it.

Another example: as a programmer, if I run into legal trouble with the IRS and they sue me, or if my neighbor sues me for damage to their property, how would my employer know?

(I'm not saying it's good that employers might not know this. I'm just baffled by the article taking it as a given that practically all employers would.)

</comment></comment></comment></comment><comment><USER9> This is the kind of article that makes me want to go into the mountains for a week.

<comment><USER10> Ik this article was so poorly written, even the format for an interview was not there.

</comment></comment><comment><USER11> Actions have consequences.</comment>


The Doomsday Clock is the closest it's been to midnight since 1960 - <AUTHOR> http://www.theverge.com/2017/1/26/14397862/worlds-doomsday-clock-moved-30-seconds-president-trump <comment><USER2> Dupe: [https://news.ycombinator.com/item?id=13493396](https://news.ycombinator.com/item?id=13493396)</comment>


New Gap logo was not social media theatre, but part of a year-long rebrand. - <AUTHOR> http://thesethings.posterous.com/gap-did-they-mean-to-do-that

<comment><AUTHOR> Not earth shattering, but I posted this 'coz I've seen a few suggestions that the Gap logo launch + reversal was planned social media genius. Nope. They sincerely launched that new logo as part of something bigger that's been in the works for at least a year.</comment>


Zuckerberg: Kids under 13 should be allowed on Facebook - <AUTHOR> http://tech.fortune.cnn.com/2011/05/20/zuckerberg-kids-under-13-should-be-allowed-on-facebook/?iid=HP_LN?cnn=yes

<comment><USER2> "That will be a fight we take on at some point," he said. "My philosophy is that for education you need to start at a really, really young age."

Sounds like a great reason to avoid Facebook, because I can assure you the kids who are spending time on Facebook today are doing it instead of expanding their education.

</comment><comment><USER3> Oh, _brilliant_ , everyone's crush from the fourth grade gets recorded. The least mature among us, given the power to blow their 'internet history' for the rest of their lives. What am absolutely fantastic idea.

If someone wants to support education, they should try a _different_ startup, one dedicated to improving education, instead of providing new ways to distract onesself in class.

Anecdote: I used to TA - occasionally I'd sit in on the main class. Only the 'front row nerds' would be taking notes on the computer, as a rule. The rest of the laptoppers were on facebook/myspace.

Admittedly, I don't like Facebook/Twitter/Foursquare and the rest of the self- surveillance systems. So I'm biased.

</comment><comment><USER4> Most of the youngsters are spam machines.

<comment><USER5> Spam targets.

</comment></comment><comment><USER6> Hook em young!

</comment><comment><USER7> I don't think any humans should be allowed on facebook. Zuckerberg is a nasty piece of work. Childish, careless and with obviously no respect for people. Throws a few million dollars at the education system in the US to buy some credit.

There are a lot of engineers and scientists who contribute more to this world and they are utterly ignored in favour of that asshat.

<comment><USER8> Seems like a pretty extreme judgement and based on what he's been doing recently a bit unfounded.

<comment><USER7> Not really. It's a pretty reasonable judgement based on that fact that most people see the positive things, rather than concentrate on the small details which are intentionally hidden by the big gestures. The small details slowly encroach on our privacy, our human rights and our ability to function without such things as social networks.

</comment></comment></comment><comment><USER5> Keep Zuckerberg as far away from kids as possible. He will treat them like "dumb fucks".</comment>


Show HN: Free email forwarder as a Service - <AUTHOR> https://proxy4.us Suppose you have the domain example.com with a WEB server. Now suppose you just want to receive emails to your new domain.
Probably you don't want to maintain an e-mail server, or even another e-email inbox to make your life even harder, right ?
With proxy4.us you can setup a forward in few minutes!
The idea is that you can forward emails sent to firstname.lastname@example.com to your current inbox (firstname.lastname@example.com for instance) <comment><USER2> Exactly what I was looking for. I just configured it to receive at my personal gmail!</comment>


How to make a fast website (in 2020) - <AUTHOR> https://volument.com/blog/how-to-make-a-fast-website <comment><USER2> That is wonderful!</comment>


Transparent SLIs: See Google Cloud the way your application experiences it - <AUTHOR> https://cloudplatform.googleblog.com/2018/07/transparent-slis-see-google-cloud-the-way-your-application-experiences-it.html <comment><USER2> I think you have to hand it to Google, that is really next level deep analytics. I feel it would be hard for most companies without huge investment to do this (or maybe not).

It is like the reverse of a "customer survey" that instead of asking and getting an arbitrary number, instead of really detailed level of service performance.

<comment><USER3> People often consider to use this information for reliability and performance, but you can do much more with the data. For example, if a method has low latency, you can use short deadline with fast retry to improve reliability. If you see a sudden jump of certain usage, you can consider to use batching and caching to reduce your cost. If you see an unexpected usage of a service, you know someone introduce a new dependency in your system. Google teams often use the same data to understand how large services work and how they are correlated.

Disclosure: I worked on this feature at Google.

</comment></comment><comment><USER4> This is amazing, kudos to Google. It's astounding that most cloud services only show status info for their entire cloud (or big chunks of it). I don't care if 99.999% of your customers are fine, if the server running my servers is down for no reason.

</comment><comment><USER5> Any idea when stackdriver is actually going to be usable for production? The latency of events is way to high to drive alerts from and the UI has basically always had issues. Clicking though any link seems to have about a 50% chance of resulting in "this page was not found" which only means you have to somehow find a different navigation path to get to that page.

<comment><AUTHOR> We (The GCP Ops Management and Stackdriver teams) are working hard in multiple fronts to deliver innovation (Such as service graph highlighted in day 1 keynote at Next and GKE monitoring) and at the same time deliver first class scale and reliability. its a journey, but we have made a lots of improvements over the last 12 month, and will continue to raise the bar in the next 6-12 month. We have many very large customers as well as startups using Stackdriver as the core of their Ops and SRE command and control center. I can personally guarantee that our users getting great UX and reliability is top of mind for the entire team. I would appreciate it if you can flag to our team any time you see a page not found or any other experience in Stackdriver that you feel does not meet the bar - we listen and we will resolve bugs one by one to meet your expectations. we have an email list, bug tracker and a feature request forum all listed here [https://cloud.google.com/stackdriver/docs/contact- us](https://cloud.google.com/stackdriver/docs/contact-us) . you can also submit in context feedback from the Stackdriver and GCP consoles which will be reviewed by the team. finally, please feel free to DM me on Twitter @markcartertm . We care deeply and would love to hear and respond.

</comment></comment><comment><USER6> On one hand, this is really cool and I'd love this type of info out of AWS.

On the other hand, the whole point of using a cloud provider is to lower the amount of ops work, and this feels like I'm helping do ops work for Google, and paying them for the privilege.

<comment><USER7> This is purely additive. If you don't want to look at these metrics, you don't need to, but if they would be helpful to you, then you can. Speaking as a GCP customer, I'm very glad these are available. It means that I will more easily be able to tell the difference between issues in my service, and issues in the APIs I depend on.

</comment></comment><comment><USER8> =</comment>


Open source Linux driver supports 3D acceleration with all GeForce GPUs - <AUTHOR> http://www.h-online.com/open/news/item/Open-source-Linux-driver-supports-3D-acceleration-with-all-GeForce-GPUs-1776089.html <comment><USER2> For those familiar with Linux development, the whole article could basically be summed up with: "Nouveau can now generate firmware for all GeForce GPUs on the market, including Fermi and Kepler SKUs". Yay! This is good progress, but not really earth-shattering; it would have been expected.

<comment><USER3> Its earth-shattering because its an entirely volunteer project, where once there was nothing but proprietary blobs for us to run. This is significant because 3D-acceleration has been an Achilles heel in the Linux desktop world for ages .. and now the community has sorted it. This is GREAT news!

<comment><USER2> It's not earth-shattering. This is nothing new; several older models have gone through the same process over the years. It has been happening for a long time. This article is just exaggerating the real news item: firmware can be supplied by nouveau for all available SKUs, including Kepler/Fermi chips.

nouveau is an awesome project, but this is _not_ a huge thing. It's not going to make Linux gaming explode overnight. It's just normal iterative progress, which, don't get me wrong, is great and all, but it's not a _big deal_ like this article suggests.

</comment></comment></comment><comment><USER4> For some definition of "supports". The last two or three releases of Ubuntu have used the Nouveau driver by default for the LiveCD, which causes my system to hardlock (known, unresolved issue for almost two years now) so I've had to pass special kernel boot flags to disable it and use the VESA driver instead to install and then switch to the nVidia driver afterwards.

Realistically though, I don't think it's ever going to be practical to use the Nouveau driver. No Cg support, no CUDA support, and performance will always be a fraction of nVidia's driver.

That isn't to say that I don't wish them well, I do. But I still think it's foolhardy at best to ever expect this to be truly competitive with nVidia's proprietary drivers.

<comment><USER5> Did you bug report this in launchpad?

<comment><USER6> What do you think "known, unresolved issue for almost two years now" means?

<comment><USER5> I don't know. That you read someone else's bug report? Can you link to it?

<comment><USER7> Here's the bug that affects me! Newly reported, but similar to all previous issues I've had with nouveau:

<https://bugs.freedesktop.org/show_bug.cgi?id=43562> [https://bugs.launchpad.net/ubuntu/+source/xserver-xorg- video...](https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video- nouveau/+bug/689507)

(Gee, thanks Ubuntu for expiring this bug. It's not like there's been no activity because NOBODY IS FUCKING WORKING ON IT or anything!)

</comment></comment></comment></comment></comment><comment><USER8> Very impressive.

(Still no fan control; and a few other features missing - but great progress has been made)

<comment><AUTHOR> I have an Intel graphics chipset in my new laptop, and it makes a WORLD of difference being able to use open source drivers. They run on first boot, and even on live CDs. And no more funny pieces of software for configuring graphics-related stuff - all the DE/WM standard stuff can be used.

<comment><USER9> What's the most compatible high-performance graphics card for Linux these days? Would that be something by Intel based on their recent effort to provide OSS drivers?

<comment><USER10> The "radeon" driver supports everything up to the "Northern islands" series very well. Check out <http://www.x.org/wiki/RadeonFeature> for details.

Support for the "Southern island" series should be coming soon. And AMD is working to make future driver releases coincide with the hw releases.

The free drivers are still a little slower than the proprietary drivers but they have more features such as KMS.

EDIT:

To answer your question directly, the Radeon HD 6970 or 6990 are the fastest northern islands cards and are well supported by the radeon xorg driver. I don't know if the driver can use both of the gpus in the 6990 though.

The southern island chips should be supported very soon though, which are the HD7750 - HD7970 .

<comment><USER11> I made the mistake of not confirming the vid card in my new work PC and it's a southern island chipset (Pitcairn). I use two 1920x1200 monitors and the open- source drivers can do that with no hardware acceleration. But if I use the proprietary drivers... I am limited to a total resolution of 1920x1920. That's not a typo, that's the limit it gives me - a square resolution I've never heard of in my life.

I am looking forward to the open-source support and it can't get here fast enough - running a compositing desktop puts the eight cores of the i7 at ~50% CPU :) (though I live mostly in terminals, so I don't feel it beyond a touch of UI sluggishness sometimes)

<comment><USER10> The proprietary drivers suck because AMD is focusing on the open source ones. Big changes are coming for the OS driver. They've been making vertical changes that don't break down into small releases well.

</comment></comment></comment></comment></comment></comment><comment><USER12> "The open source Linux drivers from AMD and Intel can also use the 3D capabilities of almost any graphics chip."

Does anyone know if this will be true for the Mali-400 GPU in the ARM branch?

<comment><USER13> I think what was meant was that the AMD driver supports almost any ATI/AMD GPU and the Intel driver supports almost any Intel GPU. For Mali you can try the lima driver.

<comment><USER12> Excellent info! Thanks.

</comment></comment></comment><comment><USER14> Have they fixed re-clocking yet?

Last I knew nouveau couldn't change the clock speed on many GPUs leaving them either locked at a very low clock, performing poorly, or locked at max clock, chewing through power.

<comment><USER15> The article says, No.

"Furthermore, the driver can't switch between the various graphics chip and memory speeds with many current cards and often causes the graphics hardware to run at the slowest operating speed..."

</comment></comment><comment><USER7> It still doesn't work on my card. Hurray for "progress".

<comment><USER16> Please write something useful. Do you have a card that is supposed to be affected by this change? Are you running the right software/software version? Have you filed a bug report? Or do you just enjoying typing and negativity that much?

<comment><USER7> There has already been a bug filed on the bugzilla for nouveau. I'm not going to file another and spam their bug tracker. That's my positive contribution - making sure it's reported and verifying that the error the bug reporter sees is what I see. So stop being such an unhelpful, assuming asshole. You won't advance the cause of free software that way.

<https://bugs.freedesktop.org/show_bug.cgi?id=43562></comment></comment></comment>


If your code accepts URIs as input, filter out "file://" - <AUTHOR> https://blog.steve.fi/If_your_code_accepts_URIs_as_input__.html <comment><USER2> Wrong way around: only allow [http://](http://) and [https://](https://) (and generally filtering out anything thats not letters, numbers, slash or dot is probably a good idea. Remove any sequences of more than one slash or dot.

<comment><USER3> Can we please stop trying to _enumerate badness_ [1]? When parsing input it is possible to define the set of _valid_ input, not all possible invalid inputs.

Also, anybody accepting input from an untrusted source (such as anything from a network or the user) that isn't verifying the data with a formal recognizer is doing it wrong[2]. Instead of writing another weird machine, guarantee that the input is valid with a parser generator (or whatever) recognize the input and drop anything even slightly invalid.

[1] [http://www.ranum.com/security/computer_security/editorials/d...](http://www.ranum.com/security/computer_security/editorials/dumb/)

[2] [https://media.ccc.de/v/28c3-4763-en- the_science_of_insecurit...](https://media.ccc.de/v/28c3-4763-en- the_science_of_insecurity)

<comment><USER4> _guarantee that the input is valid with a parser generator_

OK, that works really well... until you learn how much non-RFC-specified behavior is built in to web browsers. Simply building a parser to the RFC will leave you wide open to all sorts of nastiness!

The is_safe_url() internal function in Django is a bit of a historical dive into things we've learned about how browsers interpret (or, arguably, misinterpret) various types of oddball URLs:

[https://github.com/django/django/blob/master/django/utils/ht...](https://github.com/django/django/blob/master/django/utils/http.py#L287)

<comment><USER3> > non-RFC-specified behavior

I never said anything about limiting the parser to what's defined in an RFC. The acceptable input to "quirks mode" is just another (non-RFC) grammar, which still needs to be defined and validated.

<comment><USER4> Then I do wish you luck, but I don't think you'll ever be able to produce a suitably complete grammar since parts of it will require knowledge of undocumented proprietary internals of Internet Explorer.

Hence we scrape along doing our best with what we can figure out from observing behavior and collecting bug reports. But even with that, is_safe_url() is one of the most prone-to-security-issues functions in Django's codebase.

</comment></comment></comment></comment></comment><comment><USER5> "Despite reporting the problem to the author on Friday, and following up the report via Twitter this has not yet been fixed, but after four days I assume I'm not alone in spotting this."

Giving someone a weekend to fix something doesn't exactly sound like responsible disclosure. I understand if you get excited because you found a flaw but if you find something like this please be more responsible with publishing your findings.

<comment><USER6> Well, I found the same by pure chance before reading this article, and I suspect many more in the HN crowd did.

If already half a dozen people on HN report they've found it and emailed the person about it, it's likely it's too late for responsible disclosure.

<comment><USER7> Agreed! Better get that karma before someone else does /snark

<comment><USER6> The issue is more that if so many people have already found it, who else has?

<comment><USER8> Disclosing it publicly before it's been fixed only increases the number.

</comment></comment></comment></comment></comment><comment><USER9> The vulnerability is happening because the web server is running as a user with elevated permissions. If it were running as a user who only had permissions to read files from the webserver's serving directory this would obviate the problem.

Not that you shouldn't also validate input (in a whitelist rather than blacklist as others have said): just goes to show that security is a multifaceted problem with lots of ways to be paranoid. :)

<comment><USER10> You don't need elevated privileges to read /etc/passwd

<comment><USER11> That is correct.

        sebboh@namagiri:~$ ls -al /etc/passwd
        -rw-r--r-- 1 root root 1450 Jun  7 09:08 /etc/passwd

So, there's this idea of running publicly facing services as a user which has less privileges than a normal interactive user. This user might be called 'nobody' or 'apache', etc.

However, on your average distribution, /etc/passwd is accessible to the 'nobody' user or the 'apache' user.

There are various work arounds:

\+ run your service in a chroot or jail.

\+ employ some kind of SE Linux thing.

\+ ...?

I've only ever used the first one.

<comment><USER12> Since ages now: [https://en.wikipedia.org/wiki/Shadow_password](https://en.wikipedia.org/wiki/Shadow_password)

<comment><USER11> That doesn't mean you should allow your app to access `file://` ... (Nor allow it out of a chroot.)

Simply knowing some usernames on your system could provide an attacker with clues...

</comment></comment></comment></comment></comment><comment><USER13> Also be sure not to allow loopback connections (ie your own site or localhost) or you can cause a deadlock if the user requests the same URL to download from your site recursively. Choose an appropriate timeout too to prevent users tying up backend processes with a HTTP server that is slow to respond, and don't follow Location headers to avoid bypassing of your initial filters. A Range header should also be used to prevent users from telling your server to download multi-GB files and causing bandwidth waste / denial of service.

<comment><USER14> > Also be sure not to allow loopback connections (ie your own site or > localhost) or you can cause a deadlock if the user requests the same URL to > download from your site recursively.

Keep in mind that any arbitrary domain can point DNS to a loopback or LAN address. So the code that fetches a URL needs to include this filtering.

> don't follow Location headers to avoid bypassing of your initial filters

Often, you'll want to follow redirects, but re-apply your filters when doing so.

> A Range header should also be used to prevent users from telling your server > to download multi-GB files and causing bandwidth waste / denial of service.

You can't count on support for Range, and the server might also just behave unexpectedly. Your fetching code needs to limit how much data it accepts from a server, and drop the connection after some upper bound.

<comment><USER15> > _Your fetching code needs to limit how much data it accepts from a server, > and drop the connection after some upper bound._

And if you accept compressed responses, remember that they can be _a lot_ bigger when decompressed: e.g. gzip allows for factor 1000.

</comment></comment></comment><comment><USER16> Also be very wary of ../ or possibly ..\ in URIs.

Say you have [http://example.org/download?file=release/software-1.0.zip](http://example.org/download?file=release/software-1.0.zip) so that you can log download statistics.

If you just fetch GET["download"] and return it, you're gonna have a bad time if they try [http://example.org/download?file=../../../../../etc/hosts](http://example.org/download?file=../../../../../etc/hosts) (browsers strip it out automatically, but it's easy enough to type such a request into a telnet session.)

And don't just assume your safeguard works. Act like a hacker and try it out on yourself to make sure it works. Add an assert(validate("../") == false); at startup on your server, so it won't even run otherwise. Forbid the use of fopen() and instead go through your own file::open() function that calls validate() internally, then #define fopen ERROR_DONT_USE after (or whatever equivalent for the language you use.)

It is a hostile world, you can never be too safe by adding multiple (even seemingly redundant) layers of protection.

<comment><USER17> I've done something similar in node to ensure URIs like those cannot walk up past a base directory:

      function saferesolve(base, target) {
        var targetPath = '.' + path.posix.normalize('/' + target)
        return path.posix.resolve(base, targetPath)
      }

      saferesolve("./datasource", "a/b") === "./datasource/a/b"
      saferesolve("./datasource", "a/b/../c") === "./datasource/a/c"
      saferesolve("./datasource", "../..") === "./datasource"
      saferesolve("./datasource", "../../a/b") === "./datasource/a/b"
      saferesolve("./datasource", "../../a/b/..") === "./datasource/a"

<comment><USER18> I've done something similar in Java, though more focused on file paths [https://github.com/aJanuary/basepath](https://github.com/aJanuary/basepath)

</comment></comment></comment><comment><USER19> Also make sure you don't follow 301/302, or someone can set up a http link which redirects to file:// .

<comment><USER6> Or just, when following 301/302, call the same function again – which then validates the link completely again.

<comment><USER19> I'm not sure why you're getting downvoted, it's a little unfair for people to downvote a sensible suggestion without explaining why.

One possible downside is that someone could Redirect A -> B and redirect B -> A, which risks tying up your resources following links, but browsers limit how many redirects will be followed, so it ought to be possible to limit redirects.

</comment></comment></comment><comment><USER20> The u= parameter in the OPs article also is vulnerable (even if http/https are whitelisted, file:// blacklisted, etc) to the #10 vulnerability on the OWASP Top Ten 2013 list, namely Unvalidated Rediredcts and Forwards. [https://www.owasp.org/index.php/Top_10_2013-A10-Unvalidated_...](https://www.owasp.org/index.php/Top_10_2013-A10-Unvalidated_Redirects_and_Forwards)

I can easily get you to click the link to drive-by malware, adult sites, pharma, phishing, etc. because the site doesn't ensure where the link is actually going to.

</comment><comment><USER21> This is the confused deputy problem. The most general solution to this class of vulnerabilities, SELinux, has been largely ignored. Does SELinux need more work to "bring it to market", or is it just too complicated and needs to be simplified?

<comment><USER22> configuring SELinux is way too complicated for the average user.

<comment><USER23> And poorly documented. I learned what little I know about it from online tutorials, not the docs

</comment></comment></comment><comment><USER24> Quick FYI. It's difficult to filter URIs with regex because they are context free grammars and belong to a larger language than regular expressions.

Recursive descent parsers are the way to go like uri objects in most languages.

Ex. URL url = URL.fromString(inputString); url.getScheme;

</comment><comment><USER25> The original link seems down, but it has been saved at archive.org: [http://web.archive.org/web/20160912105232/https://blog.steve...](http://web.archive.org/web/20160912105232/https://blog.steve.fi/If_your_code_accepts_URIs_as_input__.html)

<comment><AUTHOR> Looks fine for me (the author), but glad to see a cached copy the content is pretty minimal.

Rate-limiting hasn't kicked in, and I'm seeing a steady stream of visitors.

<comment><USER26> It seems to be inaccessible for me here in Australia, but works when I access it via a VPN to Europe. Possibly traffic is blocked from certain networks/regions.

</comment></comment></comment><comment><USER27> Also, if you're using ruby's open-uri: [http://sakurity.com/blog/2015/02/28/openuri.html](http://sakurity.com/blog/2015/02/28/openuri.html)

</comment><comment><USER28> This is a special case of a Server-Side Request Forget vulnerability. Validating schemes is part of the answer but not the whole answer because attackers can still forge requests to internal resources you have firewalled off from the internet.

These were recently released to help people deal with these issues since the details can be finicky: [http://blog.includesecurity.com/2016/08/safeurl- server-side-...](http://blog.includesecurity.com/2016/08/safeurl-server-side- request-forgery-protection-library.html)

<comment><USER29> Really. Surely if I tried to enter [http://localhost:8983/solr/admin/cores?action=UNLOAD&core=co...](http://localhost:8983/solr/admin/cores?action=UNLOAD&core=core0&deleteIndex=true) the back service would be password protected.

Oh, wait a minute.

</comment></comment><comment><USER30> file:// urls are awesome! People forget about them and nobody actually understands what to expect from these urls. Consider cross-origin policy implications. Is file:///home/john/bar.html on the same origin as file:///home/john/foo.html ?

Also, XHR is totally allowed to go to file://

</comment><comment><USER31> > Actually the actual output all newlines had been stripped.

Not stripped, but replaced by spaces. Also, the linked image looks like /etc/passwd, not /etc/hosts.

> Weird.

Not weird. That's how whitespace in HTML works.

<comment><USER32> OP tested his hack on an online Markdown converter, so it probably has more to do with Markdown's treatment of whitespace than HTML's.

As it happens, Markdown ignores most non-consecutive newlines.

<comment><USER15> It's a converter taking HTML as input, converting it to Markdown.

</comment></comment></comment><comment><USER33> Another fun one that's becoming more common with cloud hosted services: access to internal metadata services that issue credentials.

Blocking file:// doesn't prevent access from > [http://169.254.169.254/latest/meta-data/iam/security- credent...](http://169.254.169.254/latest/meta-data/iam/security- credentials/..).

</comment><comment><USER34> I usually only do this, if I'm putting a user-submitted URL into file_get_contents: if(substr($_GET['url'], 0, 4) != 'http') { exit; }

<comment><USER35> If thats the only validation on calls to file_get_contents, that could very easily be bypassed. Entering something like just "/etc/passwd" for example.

<comment><USER34> /etc != http :)

<comment><USER35> Ah yes, you're right. Totally mis-read the code.

It'd still leave access to any files in the same (or sub) directory starting with http, which realistically would probably be none but still something to bear in mind.

<comment><USER36> Right, best to check the whole URL. Something like "http/../../../etc/passwd" might get through otherwise.

<comment><USER34> Like....

       $url = rawurldecode($_GET['url']);
       $url_without_protocol = str_replace(array('https://', 'http://'), '', $url);
       $protocol = (stristr($url, 'https://') ? 'https' : 'http');
       $page = file_get_contents($protocol . '://' . $url_without_protocol);

<comment><USER37> What about

        u = urlparse(url)
        if u.scheme not in ['http', 'https']:
            return 400

</comment></comment></comment></comment></comment></comment></comment><comment><USER38> There are others things to consider when fetching data from untrusted HTTP resources.

A. Can it be used to DDoS

B. How much data do you read (download, inbound may cost you real money)

</comment><comment><USER39> I think handling (rejecting) this in the libraries that handle URIs would be the wrong fix. While this is a vulnerability in a web app, it is a handy feature in an app that runs locally, and the library doesn't really know the context. It's up to the app to filter the URLs according to its isolation requirements.

</comment><comment><USER40> This is no different than failing to validate input parameters, and letting an attacker take a dump of your database. A service connecting to a remote location should have checked the URI scheme.

</comment><comment><USER41> I tried Python requests and Common Lisp drakma, and neither of them can handle "file://" URL schema. Which HTTP client libraries are actually vulnerable to this?

<comment><USER42> The most popular HTTP library is libcurl, and it supports file URLs by default.

</comment></comment><comment><USER43> Don't write server code that opens URI's that come in as input, period. If you take URI's as input, do it only to turn them around and spit them out into some Javascript sent back to the same session. Whatever can or cannot be accessed this way is the browser's problem.

<comment><USER44> This works as long as your business model doesn't have opening user's URIs at its core, e.g. monitoring service.

</comment></comment><comment><USER45> a blacklist is generally not a good idea in any case. You should use a whitelist instead.

</comment><comment><USER46> fuckyeahmarkdown fixed it just now.</comment>


Why I'll be letting Nagios live on - <AUTHOR> https://laur.ie/blog/2014/02/why-ill-be-letting-nagios-live-on-a-bit-longer-thank-you-very-much/

<comment><USER2> Quick summary, since the site is down:

In response (obviously) to [http://www.slideshare.net/superdupersheep/stop- using-nagios-...](http://www.slideshare.net/superdupersheep/stop-using-nagios- so-it-can-die-peacefully) (also available through HN).

Author uses Nagios at Etsy, with 10,000 checks (mostly in the 2 minute range), and it seems to work well for them with some minor tweaking. They have a plugin that provides a REST API. And he thinks the rest of the complaints are about backend stuff that he doesn't deal with much or at all (configs, wire formats, et al.)

He considers Nagios to be simpler than the proposed Sensu, and prefers "Unix style" applications rather than monolithic ones, where Nagios is certainly on the simpler side.

So he will continue using Nagios because it works well for his use, and good luck making something better.

<comment><USER3> > So he will continue using Nagios because it works well for his use, and good > luck making something better.

Ops guy here. If something better than Nagios/Zabbix came along, ops people would use it. Nagios gets used because 1) people know it and 2) its pretty easy to setup.

Is it going to scale to Netflix or AWS scale organizations? Probably not. But at that scale, I presume you have buckets of money to throw at problems (i.e. build a custom monitoring platform).

<comment><USER4> That's like saying 'If something better tha PHP came along, programmers would use it'. Something better did come along, but that doesn't change the fact that PHP is still popular.

<comment><USER5> It's not like saying that at all. There aren't a plethora of full-featured monitoring/alerting tools out there.

</comment></comment></comment></comment><comment><USER6> i love the diagram making fun of too complex systems

[https://pbs.twimg.com/media/BNELF1GCUAExynU.png:large](https://pbs.twimg.com/media/BNELF1GCUAExynU.png:large)

for reference the architectural diagram of sensu

[http://portertech.ca/images/2011-11-01/sensu- diagram.png](http://portertech.ca/images/2011-11-01/sensu-diagram.png)

</comment><comment><USER7> Hopefully Nagios is showing him some red metrics right about now.

<comment><USER8> The first bulletin point: _"Doesn't scale at all."_ I wonder how much traffic is sending to his blog right now. Just in 1 hour we _DDoS_ -ed his blog with HNers visiting his blog.

<comment><USER3> I'm going to buy pg and company a beer and get code integrated into HackerNews that turns all submitted links into Coral cache links. Its 2014 and the Slashdot effect is alive and well :(

<comment><USER8> That's actually a great idea! :) Haven't actually thought of that. Two things in mind: rewrite links but provides copy-paste for the original link (think about XSS from clicking a link on tweet and people want to look at the link before clicking it) and (2) HN's rewrite/shortened link must do dynamic cache url retrieval; not static. I think Google's cache link is different as cache is updated.

<comment><USER3> Thanks! I agree with both points; I'd even suggest adding a link to the Internet Archive's copy, but baby steps.

</comment></comment></comment></comment></comment><comment><USER9> Google cache: [http://webcache.googleusercontent.com/search?q=cache%3Ahttps...](http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Flaur.ie%2Fblog%2F2014%2F02%2Fwhy- ill-be-letting-nagios-live-on-a-bit-longer-thank-you-very- much%2F&oq=cache%3Ahttps%3A%2F%2Flaur.ie%2Fblog%2F2014%2F02%2Fwhy-ill-be- letting-nagios-live-on-a-bit-longer-thank-you-very- much%2F&aqs=chrome..69i57j69i58.1552j0j4&sourceid=chrome&espv=210&es_sm=93&ie=UTF-8)

</comment><comment><USER10> Well, this is embarrassing.

My colo server died earlier today (completely unrelated to this) and didn't come back up because GRUB hadn't reinstalled properly on a replaced software RAID disk.

But yes, Nagios did tell me it was down :)

</comment><comment><USER11> > ...just the architectural diagram of how it works scares the shit out of me. > When you need 7 arrow colours to describe where data is going in a > monitoring system, I'm starting to fear it slightly.

This strikes me as a pretty lazy argument. Admittedly, that diagram is not the best. But that you can separate the components of Sensu isn't a bug, it's a feature. No one says you have to do it this way. In fact, you can exactly replicate the architecture of Nagios by having a single server. The point is you have choices, choices which are dependent not on the monitoring software (which is very lightweight by design in the case of Sensu), but on the other open source software it relies on (Redis, RMQ).

So I would argue that the "server instance" scope is way too broad a category to measure complexity. If you attempted to diagram the workflow Nagios uses (ignoring for a moment what server instance each component is on), you would come up with something equally bad (if not worse). That's if you even understood anything at all about how Nagios works to know what to diagram.

So let's replace one crude measure with another. The Sensu core repo is ~3MB total. Nagios core is about 10x that (30MB). NRPE is about 1MB all by itself. Mod_gearman (to pick out an add-on) comes in at a whopping 6MB. Suffice it to say, but for something that's basically a glorified exit code validator, this seems like a lot of complexity. Sure, Nagios has a lot of features that Sensu doesn't have, and that accounts for some of this. But there's a lot to be said for modular systems vs. monolithic ones.

</comment><comment><USER12> Is this some sort of joke? Maybe it is intentionally down and alerting him? :)

</comment><comment><USER13> His point about the NRPE config is spot-on - just put all your checks in one file. Done.

Not sure why people are making Nagios configuration more complicated than it needs to be.

</comment><comment><USER14> Site down - anyone got a mirror?

<comment><USER15> [http://webcache.googleusercontent.com/search?q=cache:mMFIAge...](http://webcache.googleusercontent.com/search?q=cache:mMFIAgeTTOQJ:https://laur.ie/blog/2014/02/why- ill-be-letting-nagios-live-on-a-bit-longer-thank-you-very-much/&strip=1)</comment></comment>


Remote team trends to watch in 2016 - <AUTHOR> https://medium.com/@ryanchartrand/top-4-remote-team-trends-for-2016-2e4cb24394cf#.4pv7krblv <comment><USER2> So... CoLiving companies don't hire anyone with families?</comment>


Ravenmaster Tells of His Relationships with the Tower of London's Resident Birds - <AUTHOR> https://www.scientificamerican.com/article/ravenmaster-christopher-skaife-tells-of-his-relationships-with-the-tower-of-londons-resident-birds/ <comment><USER2> The article fails to mention the ravens cannot leave because their wings are clipped, leaving them unable to fly. So there would likely be no "relationship" if the ravens were not intentionally crippled. [https://en.wikipedia.org/wiki/Ravens_of_the_Tower_of_London#...](https://en.wikipedia.org/wiki/Ravens_of_the_Tower_of_London#Care_and_diet)

<comment><USER3> > Appointed in 2011, current Ravenmaster Christopher Skaife was caring for > seven of the birds in 2018.[33] He has reduced the amount of clipping of > wings and feathers by a third to allow the ravens to fly, instead of merely > hopping or gliding. He has allowed one of the birds, Merlina, to fly to the > wharf on the Thames but she always returns due to the bonding with her > keeper.[34]

<comment><USER2> If the birds are staying because they like it, or have some special "bond" then why clip them at all? Clearly they can't fully fly as they would naturally. It doesn't add up.

<comment><USER3> Most birds are social animals (including Ravens) and prefer to stay with their flock (which includes caretaker humans), so it's not really about making sure the birds are kept prisoner. Pet birds will occasionally fly away because they're spooked (e.g. from a bird of prey) or get lost. Once they've flown far enough away, you're likely not to see them again. [0][1]

There are those who free flight their birds, but that requires lots of training and requires constant monitoring of the birds, calling out to them when they get too far. Birds rely on loud calls to find their way back to their flock (hence why they squawk all the time--its a natural homing beacon meant for large distances).

I'd say semi-clipped wings are probably a good compromise without constant monitoring. These birds will outlive birds in the wild, while still having a greater degree of freedom.

0\. [http://www.libertywings.com/2008/training/basic-flight- train...](http://www.libertywings.com/2008/training/basic-flight-training/)

1\. [https://adventuresofroku.com/blogs/education/free-flight- tra...](https://adventuresofroku.com/blogs/education/free-flight-training)

<comment><USER2> Those are all excuses to justify keeping the ravens captive because of a ridiculous superstition. The only ethical thing is to not keep these birds and let ravens (and all birds for that matter) live their lives naturally in the wild. I could chain you up "just a little" and let you have a walk now and then and even feed you well and treat you nicely, but you would still be a prisoner and it would be wrong for me to do that to you.

<comment><USER4> I think we romanticize flight, because otherwise that sounds just like owning a dog or an indoor cat.

<comment><USER5> You don't cut off part of your cats' feet so they can't go too far from home.

Edit: as pointed out elsewhere, wing clipping is not permanent. That's not the point.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Yr man on youtube [https://www.youtube.com/watch?v=H-D73wveJeg](https://www.youtube.com/watch?v=H-D73wveJeg)

</comment><comment><USER7> That's so cool!

<comment><AUTHOR> If you're interested, the Ravenmaster (along with several ravens) did an interview that's available on the Guardian books podcast at:

[https://www.theguardian.com/books/audio/2018/oct/09/what- is-...](https://www.theguardian.com/books/audio/2018/oct/09/what-is-it-like- being-ravenmaster-at-the-tower-of-london-books-podcast) (the Ravenmaster segments starts at 31:05).

It's a nice weekend listen.</comment></comment>


Ex-MI6 officer Christopher Steele in hiding after Trump memo - <AUTHOR> http://www.bbc.co.uk/news/uk-38591382 <comment><AUTHOR> "Founded in 2009 by former British intelligence professionals, the firm - based in Grosvenor Gardens, central London - has a "global network" of experts and "prominent business figures",, according to its website: [https://orbisbi.com](https://orbisbi.com) "</comment>


RESTful Email over HTTP - <AUTHOR> http://blog.webhooks.org/2009/02/13/restful-email-over-http/

<comment><USER2> This notion of replacing every protocol with HTTP greatly depresses me.

<comment><AUTHOR> This is not about replacing E-mail protocols but extending its reach. For example being able to link to e-mail messages in an issue tracker instead of copying its content.</comment></comment>


Scala Lifting Off - <AUTHOR> http://blogs.sun.com/theplanetarium/entry/scala_lifting_off

<comment><USER2> How does Scala compare with Clojure? (I'd like to learn a lispy/fp language and these two are currently at the top of my list.)</comment>


BeeHopPing : Realtime Web Analytics - <AUTHOR>

Hello all,
I have released my first Node.JS app: BeeHopPing
http://www.beehopping.com
Excited!
It does not use beacons(1x1 pixel image used by most analytics based services) but relies on Websockets(COMET as a fallback for older browsers) to track visitor activity. I'll be rolling out a Private Beta soon :) Please do sign up for an invite if you like the demo. The demo by itself is limited in features. But I'll be releasing all the remaining features(once out of testing phase) in the Private Beta itself.
Feedback appreciated!
P.S: The demo is tracking the test page:
http://mustreadebooks.blogspot.com
Sorry for not being creative enough with the test page! Wanted something out soon!
Shripad K. <comment><AUTHOR> Ok! I did not know that the links won't show up in the topic.

hope this works:

Site: <http://www.beehopping.com> Test Page: <http://mustreadebooks.blogspot.com></comment>


How Wikipedia Embraced Transphobia for Chelsea Manning - <AUTHOR> http://www.philipsandifer.com/2013/09/something-rotten-at-sausage-factory-how.html

<comment><USER2> > In practice, Morwen and Gerard adhered to policies regarding transgender > people that have been in place for nearly a decade, and advocated a course > of action that is straightforward to anyone with even a passing familiarity > with transgender culture.

I think that's one of the causes of this controversy - most people _don 't_ have a passing familiarity with transgender culture. I know transgender people, but had no idea that it is hateful to use their birth name. Later in the paragraph the author even acknowledges this, calling the editors on the other side "a crowd of people . . . approaching transgender issues for the first time."</comment>


Don't use online Bitcoin wallets over Tor - <AUTHOR> https://bitcointalk.org/index.php?topic=843228.0;topicseen

<comment><AUTHOR> Looks like this person doing the transfers has been pretty active: [https://blockchain.info/address/1FJxeqyAAkxjbV5ijh3CnNkbgdu8...](https://blockchain.info/address/1FJxeqyAAkxjbV5ijh3CnNkbgdu8zCVsY7)

</comment><comment><USER2> These thefts that are occurring over tor are almost definitely using Poodle</comment>


Facebook mulled multi-billion-dollar acquisition of gaming giant Unity - <AUTHOR> https://techcrunch.com/2019/02/13/facebook-mulled-multi-billion-dollar-acquisition-of-unity-book-claims/ <comment><AUTHOR> What I like about this post is that it allows to peek into the reasoning/thought process and long term vision of FB/Mark Zuckerberg. One of the things that was surprising to me is how investment in AR/VR is seen (kind of) as a risk mitigation/escape from Google/Apple control over mobile platforms.</comment>