Technical Details Behind a 400Gbps NTP Amplification DDoS Attack - <AUTHOR> http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack <comment><USER2> _Somewhat ironically, the large French hosting provider OVH was one of the largest sources of our attack and also a victim of a large scale NTP amplification attack around the same time._

And their own semi-official ntp server supports monlist with a hefty response

        $ ntpdc -c monlist ntp0.ovh.net

        remote address          port local address      count m ver rstr avgint  lstint
        </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>=
        10.x.x.246             123 188.8.131.52      515 3 2      0     12       0
        10.x.x.248             123 126.96.36.199      396 3 2      0      7       0
        10.x.x.245             123 22.214.171.124      104 3 2      0     10       0
        212-x-x-101.rev.pon   123 126.96.36.199   178326 3 4      0      0       0
        sw.178.x.x.248-n5.f   123 188.8.131.52       12 3 2      0     12       0
        proxy.ovh.net          46863 184.108.40.206   252113 3 3      0      0       0
        v1.ovh.net             50733 18.104.22.168     2443 3 3      0      0       0
        a2.ovh.net             44965 18.104.22.168  3394192 3 3      0      0       0
        cross.rfid.ovh.net     33352 22.214.171.124    11823 3 3      0      0       0
        10.x.x.176             123 126.96.36.199     1865 3 2      0      4       0
        gw6.ovh.net              123 126.96.36.199     1476 3 4      0      3       0
        sw.5.x.x.248-n5.fr   123 188.8.131.52      361 3 2      0      2       0
        b6.ovh.net             40862 220.127.116.11     1095 3 3      0      4       0
        10.x.x.245             123 18.104.22.168      164 3 2      0      6       0
        10.x.x.211            123 184.108.40.206   314567 3 2      0      4       0
        .
        .
        .

<comment><USER3> I have a server with OVH, but frankly I'm considering moving elsewhere after we've now been repeatedly hit by DOS from servers at OVH. It's fairly low grade, primitive SYN-flood attack that we easily knock back within minutes each time the attacker moves elsewhere (clearly he does not have access to many server resources, or he might have actually managed to muster enough simultaneous resources to do some damage; he's right this minutes wasting resources getting a SYN-flood from some no-name Russian hosting provider dropped by our firewall at a low enough rate that I can keep an eye on it live with tcpdump).

But while our colo provider was extremely responsive and started calling OVH and the other providers right away, and I also emailed evidence to OVH repeatedly, we were met with total silence. The other providers used reacted quickly. OVH let the servers continue to hammer us for days.

I'm seriously considering just dropping all their net blocks in our firewalls. We have next to no legitimate traffic originating there anyway.

<comment><USER4> FWIW large portions of ovh.com have been blackholed on my web server for persistent Wordpress comment spam to hosted sites.

Unfortunately, I can't blackhole their traffic on mail services, because IIRC some open source mailing lists use them.

OVH is not my favorite network.

</comment></comment></comment><comment><USER5> Great write-up and very helpful for those of us who, despite doing so for years, remain amateurs at running our own servers. I am among those who think the Internet would be better as a whole if more people did in fact run servers—server software would gradually become easier for us amateurs to install and run without leaving it in a state that is open to nefarious exploits. But for the time being, I appreciate it when experts take the time to explain simple counter-measures as you have done. Thank you!

As far as I am aware, I am not responsible for any Internet-facing NTP servers (I certainly never set one up willingly), but it's good to have this in the back of my mind now in the off-chance that I ever do set one up.

I did have one of my Windows machines used for DNS amplification. I wrote about the incident [1] at my blog because I had been a bit surprised that it was not sufficient to simply disable recursion. That much had seemed like common sense, and I thought I had been so clever and thorough in turning it off. But later I found attackers were leveraging my server's willingness to provide a list of root DNS servers in response, even with recursion disabled. I ended up deleting the list of root servers and the problem went away. (Though, to be clear, I never ran the incident by any DNS experts, so I may have misdiagnosed the whole thing.)

I don't know what else I don't know about amplification attacks, so reports such as yours are helpful for people like myself who find it fun to run our own servers, but don't consider it an area of expertise.

[1] [http://tiamat.tsotech.com/dns- amplification](http://tiamat.tsotech.com/dns-amplification)

<comment><USER6> Not knowing about this particular vulnerability doesn't make one a pejorative amateur.

<comment><USER5> I am part of the group I was referring to as _amateurs_ , and I was not using the word in a pejorative manner. I mean it literally. We, the amateurs I am speaking of, are not experts at server administration and do it either out of necessity, for fun, or out of principal. For me, it's a bit of fun and principle—I feel it's a good thing for me to more or less know how to manage a server even as I acknowledge that experts know much more about it than I.

I would like to see servers demystified in general, and that's why I applaud articles such as this one that make the necessary counter-measures/workarounds plain and clear for those like myself.

<comment><USER6> That's all well and good, and I wish you luck in your ambitions, but you're still making a category error.

<comment><USER5> I'm reaching to understand the point you're making.

I assume you mean that you interpret what I've said as implying anyone who does not know about NTP amplification attacks is an amateur server administrator. I do not mean to imply that. I simply mean that for people like myself, who are in fact amateur server administrators, this sort of down-to- earth style of article (here is what the problem is; here is how to deal with it) is very welcome.

Although it's only academic at this point, I am curious why you think I used the word "amateur" pejoratively and what category you believe I am describing in error. I ask simply because I'd like to avoid making similar errors in the future.

<comment><USER6> Because you more-than-implied that nobody who got hit with it is a professional.

</comment></comment></comment></comment></comment></comment><comment><USER7> As far as I can tell these attacks always rely on amplification using IP Spoofing. I take it there's no way of mitigating that in a lower layer without adding some leaky abstraction or general overhead to the network? So, for example, (speaking as someone who knows nothing about these things) you could add some sort of handshake along the lines of:

        ntp server sees request from 184.108.40.206 (spoofed by attacker)
        ntp server goes to 18.104.22.168 to check that they really sent the request (sort of ack type thing)
        184.108.40.206 comes back to say that it's an uninitiated request
        ntp server discards similar future requests for some time

Obviously that would require more toing and froing, along with more white / black list tracking etc. Then again, can't all machines have sensible defaults in their firewalls to stop them from participating in such attacks?

Is this not an issue for TCP?

EDIT: I'm assuming it's because UDP doesn't do any checking / acknowledge stuff by default?

<comment><USER8> Yes. And that's exactly what's been implemented in modern versions of ntpd (> 4.2.7p26, 2010/04/24... yes, 2010).

The problem is: 1) No one has upgraded NTPD (and often can't, for embedded devices like IPMI controllers) 2) This can be fixed by basic configuration in older NTPD versions, but up until recently many linux distributions were shipping vulnerable configs.

This particular command (monlist) is a management query, it's in no way related to serving up accurate time.

<comment><USER9> As far as I can tell, the default Ubuntu ntpd config still allows monlist. (That is, /etc/ntp.conf in saucy doesn't have disable monitor.)

<comment><USER10> The Debian default config has noquery set for everywhere but localhost which is I believe safer (disables all ntpdc queries not just the one used here). Ubuntu's likely the same.

<comment><USER9> The default Ubuntu config has the following

      restrict -4 default kod notrap nomodify nopeer noquery
      restrict -6 default kod notrap nomodify nopeer noquery

Edit: Note that this also exists in Ubuntu 12.04, so the latest LTS is fine as well.

</comment></comment></comment></comment></comment><comment><USER11> Details on the SNMP amplification

[http://www.nothink.org/misc/snmp_reflected.php](http://www.nothink.org/misc/snmp_reflected.php)

</comment><comment><USER12> Sigh. [https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=733940](https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=733940)

FWIW, if you install the ntp package and do ntpdc -n -c monlist localhost you'll get a response but I haven't checked if it's configured by default to reject non-LAN requests.

<comment><USER13> FWIW, here's what I got on an Ubuntu 12.04.3 server running on my LAN. It looks like we should be fine with the defaults on Ubuntu at least. (Obviously always a good idea to use ufw/iptables to block everything you don't need exposed so you don't have to worry about stuff like this).

Before installing ntp (from another host on my LAN):

      $ ntpdc -n -c monlist 192.168.1.50
      ntpdc: read: Connection refused

After installing ntp (from another host on my LAN):

      $ ntpdc -n -c monlist 192.168.1.50
      192.168.1.50: timed out, nothing received
      ***Request timed out

After installing ntp (from the server itself):

      $ ntpdc -n -c monlist localhost
      remote address          port local address      count m ver rstr avgint  lstint
      </comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>=
      22.214.171.124              123 192.168.1.50         1 4 4    1d0     54      54
      ...

<comment><USER12> Thanks, I should have checked this.

</comment></comment><comment><USER14> > it returns a list of up to the last 600 IP addresses that last accessed the > NTP server

It just gives up that data to anyone that asks? Seems like a huge privacy issue.

Imaging Apache or Nginx giving up the last 600 IPs it served and maybe the URLs they went to.

 _edit: there is always the occasionally open Apache /server-status handler that leaks this type of data._

<comment><USER15> >It just gives up that data to anyone that asks? Seems like a huge privacy issue.

I could do a nmap on the public internet and probably get a similar amount of addresses. An IP is about as "private information" as a phone number nowadays (You know, those things that get sent out en masse in yellow and white books for public consumption with _real-life names_ next to them).

</comment></comment><comment><USER16> Some historical context on NTP monlist: it's an old debugging interface from the days of the Friendly Internet, when services were more open and people were much less worried about this kind of security. NTP daemons give up a whole lot of information if you ask them; see also the "peers" and "sysinfo" commands, for instance.

Back in 1999 I used these monitoring commands to spider the NTP network, surveying some 175,000 hosts from a desktop workstation. Lots of fun! This kind of survey is much harder to do now because so many systems are locked down. [http://alumni.media.mit.edu/~nelson/research/ntp- survey99/](http://alumni.media.mit.edu/~nelson/research/ntp-survey99/)

</comment><comment><USER17> This is offtopic, but this post was deleted some time ago, and now it's back, it was submitted by jgrahamc then also.

What happened to it? Did the algorithm snip it, but did jgrahamc undelete it somehow, or a mod? Just curious about the way those things work, not complaining.

<comment><AUTHOR> I deleted it and resubmitted it later.

</comment></comment><comment><USER18> Is the response to MONLIST also sent as UDP? If so, why does CloudFlare even accept those packets to IP addresses used for web hosting? Shouldn't all legitimate traffic be TCP on ports 80 and 443?

<comment><USER19> The packets have to actually reach you in order for you to filter them out. If you have a 300Gbps incoming pipe, and you're getting 300Gbps of attack traffic, then there isn't any space left in the pipe for your legitimate traffic. It doesn't matter that your router is throwing away the packets as soon as it receives them.

Also, web servers might want to consult NTP servers now and again.

<comment><USER13> > _Also, web servers might want to consult NTP servers now and again._

CloudFlare doesn't host web servers for their customers. They forward HTTP/HTTPS requests to origin servers outside of their network (or serve from their cache). I don't think the DDoS traffic actually hit any of their customers' origin servers (assuming origin server IPs are not known by the attackers). But yeah, it still means CloudFlare's incoming pipes being hit with 400Gbps of traffic before they're able to filter anything.

</comment></comment></comment><comment><USER20> How do you test a server for this attack? I want to make sure my servers don't participate.

<comment><USER21> The fine article states:

      You can check whether there are open NTP servers that
      support the MONLIST command running on your network by
      visiting the Open NTP Project[0]. Even if you don't think
      you're running an NTP server, you should check your
      network because you may be running one inadvertently.

[0] links to [http://openntpproject.org/](http://openntpproject.org/)

<comment><USER22> As I happen to have openntpd installed on a box I attempted to test this from (in Debian that package conflicts with ntp -- which includes the ntpdc client) -- I also found this:

[https://github.com/sensepost/ntp_monlist](https://github.com/sensepost/ntp_monlist)

It at least correctly identifies ntp0.ovh.net as responding -- and seems to match up with what openntpproject.org thinks...

[edit: apparently this (partly) also illustrates why more people should heed the advice to "run only what you need, listen only where you must" \-- or in other words, make sure that:

        netstat -lnutp # listening, numerical, udp, tcp, program

gives essentially no output, at the very least not a lot of 0.0.0.0:x (listening on all interfaces). I'm always a little sad when people don't check that, and just throw up some complicated iptables-rules -- before checking if they're actually running some daemons that should be removed, or pointed at less public interfaces.]

</comment></comment></comment><comment><USER23> What about a mesh network? How would they implement BCP38?

If a bunch of computers are hooked together in a mesh relaying traffic in all directions, how can one do ingress filtering?

</comment><comment><USER24> OT, but: Tasteful choice of album cover art for the pic at the top.

</comment><comment><USER25> I'm not much of a network guy, but is it possible for Cloudflare to just redirect that DDOS traffic back to the NTP server that sent it?

This would have two benefits. Firstly the owner of the insecure NTP server is going to get a nasty message to fix their damn server, and secondly, the insecure NTP server gets taken out of the attack and becomes useless to the attacker.

As a visual reference, it would be a bit like in Star Wars when Mace Windu fights Palpatine on Coruscant [1]: [http://www.youtube.com/watch?v=Pk4AiCnMqpg#t=2m35s](http://www.youtube.com/watch?v=Pk4AiCnMqpg#t=2m35s)

Eventually these server provider who have left their servers wide open will get the message when there NTP servers no longer respond?

1\. [http://starwars.wikia.com/wiki/Showdown_on_Coruscant](http://starwars.wikia.com/wiki/Showdown_on_Coruscant)

<comment><AUTHOR> No, we are not going to do that.

Two reasons: it's a bad idea and it wouldn't help very much. Each individual NTP server is only generating a modest amount of traffic and such a response might well go unnoticed by the NTP server. Also, it would mean we'd have to generate 400Gbps back to the NTP servers creating an enormous amount of traffic.

</comment></comment><comment><USER26> This is probably a stupid question, why can't tier 1 providers (whom I suppose there are relatively few of and who I would expect to incorporate best practices) just decide to kill any NTP monlist UDP that ever crosses any of their NPUs?

Why would that not solve a large part of the problem?

Thank you in advance.

<comment><USER27> I don't work for a Tier 1 ISP but I do work for an ISP.

As a customer, I don't want my ISP screwing with my traffic. As a provider, I don't want any customers complaining because we screw with their traffic.

To block monlist and only monlist queries, we'd have to be looking into the layer 7 payload of IP traffic. I'd rather not do that.

The brute-force method would be to block traffic to/from 123/UDP but that's gonna mess up a lot of stuff (including my own).

</comment></comment><comment><USER28> So again we find the problem is protocols that are designed for convenience and not security. Sure, network providers could filter out bogus routes, but that's a band-aid more than a fix; the protocol is still broken from a security perspective. Nobody would stand for using rsh with host-based authentication in today's age, but for other protocols it's fine? And public services for the internet at large are great, until they become tools for the public to abuse other people. These protocols either need to be fixed to prevent abuse, or switch to using tcp (which nobody wants - so fix the protocols!)

</comment><comment> TA-bye All NTP seriousness aside, this new "record-breaking" DDoS attack was only possible because CloudFlare -- after the Spamhaus attack -- upgraded and expanded their network endpoints all over the world. When the next attack hits and they have again upgraded their connections with 100Gb/s combined, they'll be able to say that there was again a new record, this time it was 500Gb/s.

</comment><comment><USER29> I wonder, is QUIC vulnerable?

UDP? [✓]

Amplification? [✓]

Spoofable? [?]

<comment><USER30> QUIC datagrams should be as spoofable as anything else using UDP.

The _QUIC Crypto_ design doc contains a section that covers spoofing [1], and seems to push responsibility for DDoS mitigation to the server implementation:

"[...] servers may decide to relax source address restrictions dynamically. One can imagine a server that tracks the number of requests coming from different IP addresses and only demands source-address tokens when the count of "unrequited" connections exceeds a limit globally, or for a certain IP range. This may well be effective but it's unclear whether this is globally stable. If a large number of QUIC servers implemented this strategy then a substantial mirror DDoS attack may be split across them such that the attack threshold wasn't reached by any one server."

[1] [https://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblH...](https://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblHd_L2f5LTaDUDwvZ5L6g/edit#)</comment></comment>


Urbanism and Standards of Respectability - <AUTHOR> https://pedestrianobservations.com/2018/03/03/urbanism-and-standards-of-respectability/ <comment><USER2> I found most insightful the following comment by David Edmondson

> Something drilled home to me at my Cornell planning program was the American > idea of rural as utopia, urban as dystopia. As my professor would put it, > our culture strives for a return to the Garden of Eden – it's seen in our > art, our land-use patterns (pre- and post-independence), our mythology, and > our politics. Even Philadelphia was laid out with that idea in mind.

I think that is one of the core issues. The idea of having your own home on your own plot of land is something that is deep in the American psyche.

And it is something that can be accomplished. Why is there not more remote work even at the big tech companies? If everybody was not forced to crowd into Silicon Valley in order to work for the large tech companies, Silicon Valley and San Francisco home prices would get much better quickly.

Many times, people feel like they are forced to live in cities, not because they want to, but because they have to for their job. If we promoted a culture of remote work, then people could live where they wanted, more wealth would get spread out through the country rather than being concentrated in NYC and Silicon Valley, and the affordability of living in cities would rise.

<comment><USER3> > Many times, people feel like they are forced to live in cities, not because > they want to, but because they have to for their job.

Is this true? I work in a suburbanish portion of the bay area, and 90% of my coworkers commute in from San Francisco and Western Oakland. San Francisco is more expensive and is further away, but the advantages of urban living are multi-fold. Walkable neighborhoods, access to more restaurants, bars, and nightlife, access to more culture (museums, openings, concerts, etc), more people to meet and talk to, etc. Given the choice I would almost certainly choose to live in a city vs. a suburb or rural area.

<comment><USER2> What is your coworkers' age range. In the past, young people would start in the city. Once they married/had children, they would move out the suburbs.

<comment><USER4> That's the trend I've noticed. Lots of 20 and 30 year old live in SF. Once the family expands, the first question is "when do we move out of the city?".

When you've got kids, things like bars and restaurants take a back seat to good schools and family-friendly neighborhoods.

Of all my coworkers with children, maybe 10% chose to stick it out in SF and they seem to bitch non-stop about the schools.

<comment><USER5> It's not predetermined that neighborhoods in the city aren't "family friendly" though, that's a choice we've made though policy.

<comment><USER6> Well, part of the family-unfriendliness is competition for cities' limited housing supply.

If a family with two adults and three children wants a 3-bedroom property, their budget depends on two adults' salaries minus the costs of three children.

On the other hand, if it's house-shared by four childless adults in their mid 20s, their budget is four adults' salaries, with none of the costs of children.

<comment><USER7> Lots of cities manage to do well with children; New York is an above-average performing urban school district with a million kids enrolled.

The problem is that with the rise of housing as an investment vehicle, cities have rapidly increased in price. In most countries housing is not a high-yield investment like stocks, it's a safer, low-yield investment like bonds. REITs have managed to destroy the goal of affordable housing for most people.

<comment><USER8> I wouldn't blame it on REITs but the vastly greater real lifetime income of the previous generations. Wages have been declining since the 70s.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> > A long-forgotten, under-appreciated aspect of encouraging widely dispersed > suburbs was rooted in Cold War defense against nuclear attack.

[https://www.oftwominds.com/blogjuly10/suburbs- defense-07-10....](https://www.oftwominds.com/blogjuly10/suburbs- defense-07-10.html)

<comment><USER10> It's an interesting paper, but there's no evidence it was ever used in HUD policy.

<comment><USER9> The national dispersion strategy was established in the late 40s and early 50s, almost 20 years before the Department of Housing and Urban Development was founded [1]. By that time, suburbanization was well advanced.

[1] [https://en.wikipedia.org/wiki/United_States_Department_of_Ho...](https://en.wikipedia.org/wiki/United_States_Department_of_Housing_and_Urban_Development)

</comment></comment></comment><comment><USER11> The author fundamentally misunderstands some of the economic drivers of family life in NYC.

In Manhattan only 20% of households have children. This is not driven by dreams of the suburbs or a love of mega-commutes but dollars. Even good New York public schools are highly competitive. Assuming you can afford an apartment in a neighborhood with a good public school, your child still needs to be able to test into the gifted and talented program to get a good education. The alternative is to spend 50K to send your child to private schools which are insanely competitive.

Additionally, you have to have space for those children and adding a bedroom to your real estate holdings is at least a six if not seven figure proposition. Virtually all the people I know who have left the city have done so for at least one of these reasons. No one says, "Hey cool I get to move to Jersey and look forward to riding a bus into Port Authority". I have lived in Manhattan for 26 years and know that of which I speak. Can't say anything about the Bay area.

</comment><comment><USER12> I don't understand the tweet early in the article. It seems to imply that cities aren't accommodating enough of people with alternative lifestyles? They're more accommodating than anywhere else. Maybe I'm reading what the author meant backwards.

In any case, we are currently working out as a society how to make cities livable as more and more people try to move into the same space, but I don't think bringing up distinctions like straight/gay, liberal/conservative, etc. is very productive.

And developers don't build single family homes in the suburbs and luxury highrises downtown for nefarious reasons. They build them there because you make more money that way.

<comment><USER13> I believe (though am not sure) that the tweet is posed in the context of San Francisco Bay Area. The Sunset neighborhood, which is shown in subsequent pictures, is a neighborhood with remarkably lower density than the neighborhoods in SF that lie East of Stanyan. Likewise, the proposal to ensure that zoning is more permissive around mass transit stops (pushed by Weiner) is specifically attacking cities that have refused to increase zoning density despite the inflix of residents.

I also do think bringing up this distinction is important. A conservative, landed gentry has controlled Bay Area cities and their zoning laws for decades now and are ferociously resisting a change to their ideas of normal. The article presents examples with how this gentry specifically casts the pro- urban Bloc, with a hammer and sickle flag, and hippie clothing, not to mention the minorities falling out of the buildings. Folks who made those images seem to explicitly see high density housing as not only an affront to the look of the neighborhood, but an afront on their values. To deny that this is a war between 2 different views of the way a city should behave culturally, and to explicitly ignore the anti-queer and anti-minority imagery, is to be both intellectually dishonest and inaccurate.

<comment><USER12> I don't know anything about San Francisco, so I can't comment on any anti- queer/anti-minority imagery. The article certainly didn't provide evidence for it. But is this really a liberal vs. conservative issue? I've heard Berkeley has similar NIMBYism, and that's a very liberal area, right? Is Sunset really that conservative?

<comment><USER13> You're right, the article didn't provide evidence for it, though it did add two pictures with anti-minority and anti-hippie imagery (without attribution).

> But is this really a liberal vs. conservative issue?

I wish I could provide you something more than this, but in my anecdotal experience as a minority in many ways, yes. I don't have the statistical evidence to agree or disagree though.

> I've heard Berkeley has similar NIMBYism, and that's a very liberal area, > right?

Berkeley has less of it (again, in my anecdotal experience as a minority) than most other parts of the Bay. Most of Berkeley's NIMBYism seems to be confined to parts around North Berkeley.

> Is Sunset really that conservative?

From my time in the neighborhood, yes. It was older and more racially segregated than other parts of SF for sure. The neighborhood tended to be split into Chinese (mostly Cantonese) and white sections, and even when neighbors were of different races, most people stuck to a clique. Residents were also much older (older than my parents). Again though, this is just my anecdotal experience.

</comment></comment></comment></comment><comment><USER14> While the essay is about (and contrasting) American urbanism, this point is not specific to the US:

> Not for nothing, urbanism in the United States tends to disproportionately > feature people who have other reasons to be dissatisfied with traditional > culture.

Some cities the author mentions contrast with this (Stockholm, Paris, Singapore) but plenty of others, even in contemporary Europe, are more consistent (e.g. Berlin). In general cities are where people have gone to abandon the entrenched social order for one reason or another (because they are misfits or because they need financial opportunities not available in the countryside). Because of this cities have "always" (OK, I don't know about Ur) challenged the dominant power structure, even when (as in Paris or Rome) they co-opt it.

There would be no revolutions without cities.

</comment><comment><USER15> Self driving mobile homes could become a thing, many advantages of cities and rural life could be combined this way. The routing of the individual homes would just happen based on your personal and work shedule and preferences, including the composition of your neighborhood. basically a decentralization of cities.

</comment><comment><USER16> > Haredi Jews are notable in being an oppressed minority in Israel

Forgive my french, but what the actual fuck? Haredim are almost dictating the whole country their religious laws, calling them "oppressed" is as far from reality as you could get right now.</comment>


You may only use your iPhone for good, not evil - <AUTHOR> https://twitter.com/wgx/status/564106166587129857

<comment><USER2> Technically you can use your iPhone for evil if said use does not involve the JSON parser.

<comment><AUTHOR> I guess so, but don't you accept all the terms, regardless of your intent to use individual bits of the software.

I was just trying to make a wider point about the blanket nature of EULAs

<comment><USER2> Sure. I was not being entirely serious.</comment></comment></comment>


Most Classroom Learning Sucks - <AUTHOR> http://headrush.typepad.com/creating_passionate_users/2005/01/most_classroom_.html <comment><USER2> I agree entirely with this article. From my own experience, I did a lot of abstract maths in undergrad and really hated it because I couldn't figure out what all these Groups, Topologies, Normed Vector Spaces, etc were all about. What was the use of learning all these things without some practical application? It was only later on when I started to learn more about the people behind these theories, and the challenges that motivated them, that it became more interesting. The founders of all this knowledge were trying to get one thing or the other done, and this is what motivated them to construct these mind bending abstractions.

I think it is a lot more effective to give students challenges rather than knowledge. When they get stuck (and they will get stuck eventually), then give them the knowledge they need to overcome their obstacles. Of course, you never know, without having some pre-determined way of solving something, the students might end up discovering a smarter ways of solving the same problems!

</comment><comment><USER3> The "Manhattan Academy" mentioned in this article is a Montessori school. Expensive Montessori private school for my own children is my startup motivator. My day job would be enough otherwise.

You can see some example Montessori materials here:

<http://ourdoings.com/brlewis/2006-01>

<comment><USER4> I'm only one data point, so you should probably take this with a grain of salt. I went to a Montessori school from kindergarten through third grade, and I can't stress enough how badly that specific Montessori school failed. Teachers were distant, more like babysitters than having any kind of structure. Any project we wanted to work on was fine, but most of us didn't do anything (the equivalent of pretending to work at work). We'd have to keep track of what we did in journals and get them signed by a teacher, so most of us made up stuff and forged the teacher's signature. I don't remember learning any mathematics at all back then. In fact, I'm positive that it wasn't until fourth grade that I got into basic math. I don't know if that's normal, but my father had been teaching me math outside of school from a very early age, so I was still strong in it. It's a very strange school system.

My final observation is that my Montessori school was so _small_! I was a shy kid, and going to a small school from K-3rd grade, then another small school from 4th-8th grade, did not help me to become a social person one bit. If you do something against the group, everyone will hate you, resulting in more shyness. Even at third grade.

You probably should evaluate your child. Is s/he shy? If so, it may be a benefit to send them to a larger school. I'm not saying that it will cure them of shyness, but it may help.

I'll totally respect any decision you make though :)

<comment><USER3> My kids are not shy, and math-wise they're ahead of where I was at the same age. I went on to get a math degree from MIT. Your story is the first time I've heard of a Montessori school being so unstructured. Do you know if it was accredited?

<comment><USER4> I don't know, sorry.. I am sure that it was the Montessori system though. They even had pictures of Dr. Montessori hanging on the walls. I haven't really looked back into that time in my life, 'til now. I'm not upset, I turned out fine, I just personally feel that in a bigger school I could have become social more quickly by interacting with a wider variety of other kids.

<comment><USER5> As with everything, different implementors may be better/worse at the same thing. I've certainly seen that with my girl (who was in Montessori as a youngster).

Also, no one approach is perfect for everybody. As frightening as it may sounds, some people need more "structure" than others.

</comment></comment></comment></comment></comment><comment><USER4> One way to improve the learning environment for public schools is to centralize the process using technology, then nudge the process in a different direction.

But we must test to make sure that the new direction is a better one.

<comment><USER6> I have to disagree with you, and vehemently. Centralization is exactly the problem.

I was lucky enough to be educated in an International Baccalaureate program that stressed interaction between students and teachers, convivial debate rather than lecture, and analytic essays instead of rote recall. The strength of the program came from its decentralization, relying on good teachers rather than central planning. The teachers and students worked together, as collaborators.

Technology is a wonderful thing, but in education, it generally gets in the way of the greatest teacher: intellectual discourse. A teacher and 10-20 students talking with each other[1] is an optimal model for learning. Educational technology generally takes the personal interaction out of things, and certainly makes the process less engaging.[2]

[1] Very different from a teacher talking to, or at, students.

[2] I'm talking about secondary education. For primary ed, technology can be very useful. But that is a very different environment.

<comment><USER4> Well, I see now that there are two kinds of centralization.

1) The system is top-heavy, and administrators pick out what teachers teach. This is centralized planning.

2) The content that teachers generate (assignments, quizzes) is put into a centralized pool, which other teachers can browse through to come up with new ideas for their teaching. This is centralized content.

I'm sorry I wasn't clear, but I didn't mean centralized planning, I meant centralized content. If there is some way to know what a teacher taught and how well it worked which other teachers could use as a reference, then it becomes a memory. Teachers can improve upon other teachers' previous works.

Right now, each public school teacher is almost universally independent. My idea is that as each assignment is completed online, the assignment goes into the memory pool. Teachers can browse all content. Students and teachers can rate and comment on the assignments. This seems like it would encourage good collaboration and interaction.

<comment><USER6> I think we're considering fundamentally different paradigms. In my education, there were effectively no assignments, and certainly none that could be completed online. Consider my senior English or Latin classes: the only "assignments" were to read, and occasionally to write, generally on a self- generated topic.

In class, similarly, there was very little pre-planned content. In Latin, we simply went through the previous night's translation, line by line, with discussion breaking out whenever someone was perplexed or intrigued by something.

In English, there was perhaps a bit more planned content, but not much: the teacher would have something to talk about, and start out talking about it, but within 5-10 minutes we would have moved out of the prepared material into our own discussion.

Now, in the sciences, yes, there is definite content, and there, surely, there would be value in a central content store, but it would need to be developed outside the institutional structure, or your 2) would rapidly become 1). (Yes, I'm a bit jaded: I went to an amazing program, but it was housed at a horribly administered school.)

<comment><USER4> "I think we're considering fundamentally different paradigms."

Yes, I agree. I'm passionate about somehow improving the lives and education of the average public high school student. My hypothesis is that the answer is increasing the availability of student-student, student-teacher, and teacher- teacher communication, with the memory pool to store previous content. The internet is a wonderful thing, however programs like Blackboard fail to take into account group interaction. (They claim they do, but their groups are isolated to individual classrooms; I'm talking about networking across the entire world.)

"...but it would need to be developed outside the institutional structure, or your 2) would rapidly become 1)."

Exactly. This is why I feel it can only be created by a commercial entity, possibly a corporation.

Also, I agree that your method of learning is superior, however the entity that creates this must accept that public schools teach in a certain way and change very slowly.

Another problem is dealing with online predators. Any kind of social software created for schools is going to create huge waves of uproar unless people are sure that predators, real or imagined, can't communicate with students. I'm thinking that in order to communicate with other students, you must be a part of a classroom that has at least a certain amount of students and has a certain amount of content. Stifling communication is unsettling, but I don't see another way.

<comment><USER6> "public schools teach in a certain way and change very slowly."

I can certainly agree with you about that. IB has been around for 30 years, and just got any foothold in American 10 years ago. I was lucky enough to go to one of the early public IB schools.

<comment><AUTHOR> Public education is way behind, especially in technology. I just made "my first website" in a CS class 3 weeks ago. And I built it with the same HTML code I taught myself at age 9.

I also am not a huge fan of the amount of "busy work." This is just the work that professors are required to give you to fulfill some degree requirement. Almost nothing I've learned in college has been applicable to any of my business-related work, although I don't think we can hold an undergraduate degree up to much glory.

<comment><USER6> There are two distinct classes of work that are called "busy work". The first is heinous, the second is often loathed, but great.

There's real busywork: work assigned just to take your time, create something to grade. That's crap, it should go away. (And in my collegiate experience, largely has.)

Then there's "impractical stuff": people often malign work they do that doesn't directly apply to the real world, but I think that it is often worthwhile. Consider MIT's famed 6.001: few of its students ever use Scheme, or any functional language, professionally, but the work in Scheme is never the less worthwhile. (Disclosure, I love functional languages.)

<comment><USER4> One thing I'm hoping is that if teachers use the service I described above, they'd be less inclined to create busy work - it would be obvious to the rest of their community that that's what they're creating, and so they'd have an incentive to not do that.

Unless they make all their content private and don't participate in the community, which is an option too.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Enter my "open source" biz plan for leveraging media -- and situation comedy in particular -- to establish the most popular online market for customized education.

See OpportuniTV.com for details. Two (de facto) reviews of earlier versions of the site's content:

"I just spent about an hour surfing around with a bit of amazement."

Josh Peterson Co-Founder/CEO 43Things.com (an Amazon.com company) December 12, 2004

"Frank, you are a good man. Have you thought about joining this team? Your only alternative, of course, is venture capital. But their usual models require getting rid of the 'originator' within the first eighteen months. With Netscape it took a little longer, but you get the idea."

Randy Hinrichs Manager, Learning Sciences and Technology Group Microsoft Research December 1998

Enjoy!

Frank Ruscica

<comment><USER7> What is objectionable about this comment?

<comment><USER6> It's only tangentially relevant and reads like spam.

<comment><USER7> Kathy Sierra's only point is: customized education, good; standardized, bad.

My plan describes how to make customized education available on a grand scale ASAP.

Q.E.D. :-)</comment></comment></comment></comment>


Uber confirms SoftBank has agreed to invest - <AUTHOR> https://techcrunch.com/2017/11/12/uber-confirms-softbank-has-agreed-to-invest-billions-in-uber/ <comment><USER2> When I look at their runway and valuation going forward, IPO is the most probable path they will take. But it might imply some risks to the overall startup IPO scene in the future as well.

Apparently Uber is bleeding about $2 billion a year and have only $6.6 billion in cash reserve. If this deal adds $1 billion more cash, then that would only last 4 years.

Since full-scale self-driving cars launching across most major cities is unlikely to happen within 4 years, they will need to either:

1) Charge more and lose even more market share to Lyft. This is unlikely.

2) Raise more cash. IPO seems to be the easiest channel for them now. (Maybe SoftBank will provide it from their massive fund but they might also extract concessions from existing shareholders and buy at a very 'attractive' price (for SoftBank) but others will likely resist.)

IPO sounds like a good plan for Uber. But if the price drops precipitously at some point afterward because it is outcompeted by other self-driving companies (e.g. Waymo + Lyft expands self-driving fleets to highly profitable market while Uber's tech is still not ready) it may result in a chilling effect on the overall startup IPO scene as they are the largest unicorn in existence, and there are many startups that sell themselves as Uber for X. (Public investors may not be as astute as VCs in discerning differences in business models of similar sounding startups.)

<comment><USER3> IPO is good for Uber - not for society though, who will be the ones to capture the losses.

Also, Tesla often is brought up in this competition - usually mentioned between Uber and Lyft and Chinese companies - however Tesla is positioned to dominate here. I wouldn't doubt that they're working on the apps internally to create the shared vehicle system that Elon speaks of. How many vehicles could Tesla create AT COST spending the $2B / year that Uber is burning? Where Tesla has a fleet of assets on the road ...

<comment><USER4> _> How many vehicles could Tesla create AT COST spending the $2B / year that Uber is burning?_

While I don't disagree, I think the major question here is "how many vehicles can Tesla create" given their difficulties in scaling Model 3 production.

Tesla could have the best self-driving tech, but if it is exclusive to their cars and they can't manufacture them fast enough, someone else will build their own fleet and win all the market share.

Unfortunately I see Tesla's hurdle being manufacturing volume, and that's a lot harder to solve quickly than fitting sensors to existing cars.

<comment><USER3> They're a new automotive manufacturing company - being a few months off estimated production for Model 3 isn't a big deal. It's surprisingly good in hindsight.

Their current capacity capability at the factory is 500,000 vehicles annually. I suspect once they launch the Semi and get 500k+ pre-orders of it, they'll be able to get a loan to build or acquire another factory.

As Elon has mentioned many times, designing the automation is magnitudes harder than designing the vehicle itself. They're on an exponential growth path and it's going to be amazing once they're pumping out millions of vehicles annually.

</comment></comment></comment></comment><comment><USER5> If Uber was only a world wide Taxi company with virtually no capital costs, wouldn't this be incredibly profitable alone?

I am not clear on the impetus everyone sees for Uber creating self driving cars. If developed by another company, can't they just add them to the service? Do they really want to be responsible for that capital?

<comment><USER6> Uber is valuable only because it has solved a two party network problem at a city level. You need drivers and you need riders. If you don't have any drivers riders won't come and vice versa.

Two party networks are much more difficult to solve than one party network problems. Because with two party networks you have a chicken and egg problem.

Anyone who has solved self driving, has near unlimited scale on the driver side. Their cars can autonomously be present to respond to peak demand - e.g having thousands of cars at Burning Man.

In the autonomous car world, Uber has no place if it doesn't have that tech. There is almost no reason for the company which has self driving tech to license it to Uber, when they are easily run it themselves. The only value Uber has right now is because it has crossed the critical mass on the two party network. And some people thought they could solve self driving cars.

OTOH, a global two party network (e.g Airbnb) is exponentially tougher than a city level two party network. Which is why Airbnb has almost no competition (except some local players in China), while Uber has competition everywhere. In fact, Uber has already lost and conceded a few major markets (China, Russia).

Can Uber - even sustain what they already have. I have my doubts and theories, but that's for another day.

<comment><USER5> Wouldn't Running your own cars would mean incredible capital costs and marketing costs to get people to switch from uber?

Additionally you need people maintaining them.

<comment><USER7> Whoever solved self-driving cars could buy 10,000 cars per city. Let's say each car costs $100,000. That's $1B if paid upfront which is never the case, but let's assume.

Now, each of those 10,000 cars could work 24x7. Assuming each ride is $10, and you can do 50 rides in a day (2 trips per hour on average over the entire day), that's $500 per day less electricity and maintenance. That's $5M/day with no employee costs except for maintenance workers. You could scale up by simply buying more cars, and whichever cars aren't needed could roost at homebase, without people picketing or sending nasty tweets saying they don't have enough work.

I doubt you have to pay for marketing costs at this point, word of mouth would be strong enough, and you just develop an app.

<comment><USER8> While I'm bullish that self-driving will happen in our lifetimes, I think there are a lot of challenges that many are underestimating. This includes the actual technology—this is one of the most important and challenging technological breakthroughs of all time. It's going to take time and be very, very expensive to produce at scale (ie all-electric self-driving cars at $100K a piece).

Even putting that aside, I have questions about the business side of things. Demand for transportation has been pretty consistent with big lumps during the morning and evening commutes.

One of the beauties of Uber's existing business model is that it can theoretically spin up and down drivers as needed with Surge pricing. With a fleet of cars, it's not guaranteed that supply will perfectly match demand most of the time.

The counter to that, which I sort of buy, is that it will kind of be like broadband Internet. We don't even know what demand and opportunities self- driving cars will create. My hesitancy with fully embracing this is that broadband was an acceleration of something new whereas self-driving is a leap to an existing quantity of transportation. It will still change lots of things but it will take longer for things like where you choose to live to change.

Finally, my main hesitancy is the human aspect. For self-driving to make the impact that many want/believe, there's going to have to be a hard line in the regulatory sand where human-controlled cars are outlawed or limited. I don't see that happening in the United States for a long, long time.

<comment><USER9> Great points. The other thing I might add, which your points support, is that the longer the roll-out of self-driving cars takes, the less likely it is to be disruptive to TNCs.

</comment></comment></comment></comment></comment></comment><comment><USER10> So how is Uber's runway looking now? This article [1] from August suggests they had just over three years of runway at the end of June ($6.6b burning at about $2b/yr). So this extends the runway by only six months? Are they going to survive long enough to see autonomous drivers? How will this deal affect future funding?

[1] [https://venturebeat.com/2017/08/23/uber-is-still-burning- cas...](https://venturebeat.com/2017/08/23/uber-is-still-burning-cash-at-a- rate-of-2-billion-a-year/)

<comment><USER11> They might spin off the autonomous program into another company to raise fund, prior to IPO, perhaps, just a thought. I think that's a better option financially.

<comment><USER12> There is no future for Uber without automated cars. Think of it this way: as soon as someone else has an automated fleet, Uber is finished unless it has its own. This is an existential requirement.

<comment><USER13> They can still live for 20+yrs very profitably on other markets.

Even US and high tech markets like japan and korea will take several years to transition to self-drive cars. Specially because this will start either with trucks or very high cost cars so they can offset support and iron out bugs.

And that's my guess assuming self-driving cars are ready tomorrow.

<comment><USER14> Self driving cars would be such a dramatic improvement to the public, it would be adopted much sooner than 20 years after being implemented. Cars that require a human driver would depreciate so quickly and the safety benefit would be so clear, people would upgrade incredibly fast.

<comment><USER15> We don't really know that though, do we? I mean, I can see this being true eventually but I'm still very perplex that we'll see cars able to drive autonomously in all conditions any time soon.

It's one thing to drive on the wide streets of american cities literally built around cars. It's an other to navigate the narrow, crowded streets of many european cities, with scooters and bikes zooming left and right, people parking anywhere they can, passing where they shouldn't be etc... Let's not even talk about some places in Africa and Asia where it seems that driving is more art than science.

I'm expecting self driving cars to start on friendlier turf (large avenues, highways connecting cities etc...) and then expand iteratively to "wilder" areas. I'm sure it'll take a while to completely take over though.

</comment></comment></comment></comment></comment></comment><comment><USER16> Saudi Arabia owns half of Softbank's Vision Fund and they already put $3.5 billion in Uber (5.6%), why would they want to double down?

[https://www.nytimes.com/2016/06/02/technology/uber- investmen...](https://www.nytimes.com/2016/06/02/technology/uber-investment- saudi-arabia.html)

[http://money.cnn.com/2017/09/20/technology/softbank- vision-f...](http://money.cnn.com/2017/09/20/technology/softbank-vision-fund- saudi-investments/)

<comment><USER3> It's likely part of the exit strategy. They are confident they can get a maybe even a small return on billions of dollars, and Uber likely is hoping it looks like such a big 'positive signal' is a sign that Uber is a solid company to invest in..

</comment></comment><comment><USER17> It's interesting to note that just recently we had an article about taking money from the countries with abysmal human rights record, especially when you don't really need that money to survive.

Softbank is 50 % saudi arabia public funds money.

<comment><USER6> In this case, it probably doesn't matter.

Saudi Arabia is trying to buy all these assets to secure their future. Returns will likely be reinvested or stashed abroad!

However with the dismal future of oil based economies and the unstable situation in Middle East - only scenario their would be able to retain these assets would be if they are somehow able to transition into a functioning (hopefully democratic), educated and productive society - which would be awesome! It's better for them and the world. I would love it if they are able to use this money to achieve that!

If not they would descend into chaos and all assets would likely be seized by whichever country hosts them. E.g. Gaddafi!

[1] [https://www.theguardian.com/world/2011/feb/28/us-treasury- bl...](https://www.theguardian.com/world/2011/feb/28/us-treasury-blocks-libya- assets)

[2] [https://www.theguardian.com/world/2012/mar/28/gaddafi- assets...](https://www.theguardian.com/world/2012/mar/28/gaddafi-assets- seized-italy)

[3] [https://www.theguardian.com/world/2011/feb/27/gaddafi- family...](https://www.theguardian.com/world/2011/feb/27/gaddafi-family- assets-frozen-queen)

</comment></comment><comment><USER18> That's interesting. SoftBank invested a similar amount into their rivals Grab to head up against Uber.

[https://techcrunch.com/2017/07/23/grab-raises-2b-from- didi-c...](https://techcrunch.com/2017/07/23/grab-raises-2b-from-didi-chuxing- and-softbank/)

<comment><USER19> Also in Brazil's "99", Uber's biggest competitor over here.

</comment></comment><comment><USER20> Can anyone explain why $1B is being invested at a $70B valuation, while existing share holdings are being purchased at a lower/to be determined valuation?

<comment><USER21> The $1B that is being invested at the $70B valuation is direct from the company and Softbank will be purchasing preferred shares like any other VC. These preferred shares have extra rights, things like liquidation preference, board seats, voting rights, etc.

What specifically they will receive is unknown, but at the very least they will have a 1x liquidation preference on that $1B invested, which means if the company sells for the total amount of money raised (well below $70B), the investors get all of their money back.

So think of preferred shares like "insured" shares, which is why investors are willing to pay more, because the likelihood of entirely losing their investment is lowered significantly.

However, Uber may not want to raise more capital, take on extra dilution, etc, so they are selling only $1B that will flow to their balance sheet.

The other $9B will be purchased from common shares, or employee shares. These shares do not have these preferred rights and most significant they do not carry a liquidation preference. Which means if the company sells for the amount raised, or below that, you lose the entire $9B.

Since there is no downside protection and there is no liquid market, this is usually used to negotiate a lower price than that of preferred shares.

If there had been considerable time between when the last priced round happened and when secondary shares are purchased then the investor may have to buy them above the last round price because the company has made significant traction and the perceived value of the company is now higher.

But since the last two priced rounds are at the $70B mark and these shares are unsecured, they will usually be bought at a discount.

How much varies but you can expect a 10-30% lower price.

However, since this is sponsored by the company early employees will most likely be allowed to sell shares at a very large valuation compared to what their strike price is.

<comment><USER22> Thanks for the detailed explanation. I am wondering if its ever possible to board to later approve that those newly bought "common" stocks get converted to "preferred" i.e., have the same liquidation preference?

<comment><USER21> It is of course possible and just requires a board vote, but since the company doesn't receive the funds and have them, it wouldn't be a good idea.

So it's possible of course, but isn't done 99.99999% of the time.

Now if they were purchasing $1B in preferred and another $100MM in secondary maybe, but certainly not when the common shares amount is $9B would put the other existing investors in jeopardy for their own preferred shares providing their invested capital back should things go south.

</comment></comment></comment></comment><comment><USER23> The secondary markets have Uber shares at an ~$50 billion valuation. So that speaks somewhat to what the lower valuation is going to be for the tender offer.

</comment><comment><USER22> Couple of queries if anyone happens to know:

\- Would existing employees with stock options be allowed to sell or the ones with RSU's are also eligible?

\- Would ex employees be eligible too?

<comment><USER24> employees with options can sell, employees with RSUs cannot

<comment><USER22> Makes sense, Thanks.

</comment></comment></comment><comment><USER25> Is the share auction first come first serve? Or how is that done?

<comment><USER21> It's an internally sponsored secondary which means that the buyer has already been determined which in this case is Softbank and Uber will put together some requirements around which share holders can sell and what amount of their stake.

Something typical is if you have been at the company for X number of years, you can sell X% of your vested equity.

They will have a large bank or some other third party as the underwriter for the deal to figure out the correct pricing and then offer it to the employees that are eligible to sell shares until they reach the buyer's total requested amount, which in this case is $9B.

<comment><USER26> > _They will have a large bank or some other third party as the underwriter > for the deal_

Secondaries aren't underwritten; they're brokered. Underwriters purchase the shares for their own account and then resell them. In a secondary, the buyer and seller negotiate directly.

</comment></comment></comment><comment><USER27> So it sounds like the deal was to get Travis Kalanick back onboard/Benchmark an exit?

<comment><USER11> Kalanick has always been on the board. He never left, but he has struggled to appoint two new board members, which results in Benchmark suing Kalanick. It is specualted SoftBank's investment is to reduce Kalanick's power on the board. Also, I don't think anyone in their right mind would want Kalanick back as CEO; perhaps in the future like Steve Jobs. But Kalanick has much to learn, despite I do feel bad for him for losing his beloved mother while he was ousted as the CEO, regardless of how he ran his company. He basically lost two things he has loved a lot, accordingly to him, which I can understand from my own experience.

In anyway, SoftBank is known for very acute investment, so with SoftBank stepping in, the board won't allow any more fuck-ups. Though I am very surprised SB didn't invest in Uber early on...

</comment></comment><comment><USER28> Investors have lost the plot.

Uber is nothing more than a taxi company using VC capital to undercut competitors. There are no self driving cars. That's just a story to get money and make the brand bigger than its product. Come back to reality.

There is no futuristic mars colony with Uber robots driving everyone around. It's just a bunch of taxi drivers with dispatch replaced by an app.

<comment><USER29> _There are no self driving cars_ \- yet. The time scale to realization is measured in decades - longer than is currently promised but the tech companies involved wont tell you that....

I agree with all you on all the other points.

</comment></comment><comment><USER30> "SoftBank has been working with Morrison Foerster, known as MoFo."

<comment><USER31> No one wants the FOMO.

</comment></comment><comment><USER32> Awesome, this startup is capable of anything!

</comment><comment><USER33> Tunnels are more important than Uber or self driving cars

"Without tunnels we'll be in traffic hell forever" -Elon Musk

<comment><USER34> > Tunnels are more important than Uber or self driving cars

> "Without tunnels we'll be in traffic hell forever" -Elon Musk

Public transport solves all the problems tunnels solve as well. Tunnels don't change the fact that cars (self-driving or not) are still an incredibly inefficient use of space when they're all going in the same direction to the same place.

<comment><USER33> The Boring Company agrees with you. Tunnels are not just for cars. They will be 200kph subways where you never need to change trains:

[https://static1.squarespace.com/static/5915617137c58104451ac...](https://static1.squarespace.com/static/5915617137c58104451ac5fb/5915632303596e4ba92724de/59261f6cf7e0ab55ef3e5102/1509233545268/Skate_5_23_2017_001%5B4%5D.jpg?format=1500w)

(Image of shared/public transport tunnel vehicle)

</comment></comment></comment><comment><USER35> Recall, Apple is also principle investor in Softbank Vision Fund. As Google recently made its own $1B deal with Lyft. Feels like lines already drawn in the sand, are turning into trenches.

Google's Waymo passes milestone in driverless car race

[https://www.ft.com/content/dc281ed2-c425-11e7-b2bb-322b2cb39...](https://www.ft.com/content/dc281ed2-c425-11e7-b2bb-322b2cb39656)

<comment><USER24> I somewhat disagree with your take on the "lines already drawn in the sand". The world is bigger than google and apple, lyft and uber. The ridesharing space in particular is fraught with seemingly strange investment partners. Here is a bloomberg article a week ago with more info:

[https://www.bloomberg.com/gadfly/articles/2016-08-16/ride- ha...](https://www.bloomberg.com/gadfly/articles/2016-08-16/ride-hailing- investments-make-strange-bedfellows).</comment></comment>


iOS 13: Optimized Battery Charging - <AUTHOR> https://support.apple.com/en-us/HT210512 <comment><AUTHOR> > iOS 13 uses Optimized Battery Charging to slow the rate of battery aging by > reducing the time that your iPhone spends fully charged. Your iPhone uses > on-device machine learning to understand your daily charging routine so that > it can wait until you need to use your iPhone to finish charging past 80 > percent.* Charging in this way reduces the wear on your battery and improves > its lifespan. Optimized Battery Charging is active only when your iPhone > predicts that it will be connected to a charger for a long period of time. > […]

* Information regarding your charging routine is stored only on your iPhone. The information isn't included in backups and isn't shared with Apple.</comment>


Growing Neural Cellular Automata, Differentiable Model of Morphogenesis - <AUTHOR> https://distill.pub/2020/growing-ca/ <comment><AUTHOR> Be sure to try the spider web.</comment>


Not-So-Social Media: Why People Have Stopped Talking On Phones  - <AUTHOR> http://www.npr.org/blogs/alltechconsidered/2014/05/09/311082149/not-so-social-media-why-people-have-stopped-talking-on-phones

<comment><USER2> I can't remember the last time I called a friend on the phone.

It's so much easier to communicate through email or text message.</comment>


The Disappearance of Open Source? - <AUTHOR> http://www.ostraining.com/blog/general/the-dissapperance-of-open-source/

<comment><USER2> Open source used to be used as a marketing tool --- people believed that software was automatically better if it was Open Source. Today, people have learned how to be more nuanced; just because it is better in some FSF sense (if it is "free software" in the Stallman/GPL ethical/moral sense of the word) doesn't mean it's better for a particular business purpose. If you're a developer, or your company has a development shop where it's prepared to make changes, then obviously Open Source is better.

If however, you're prepared to contract out support and development to a company like Red Hat, then from your perspective as a customer, it may not matter as much. As long as you are willing to pay $$$ to Red Hat and the software/services/support is of sufficient quality for your purposes, you're happy. Now replace "Red Hat" with "Oracle" in the above statement; does it still work? Why, yes. So you really won't care if it's Open Source or not.

At one point there was an argument that Open Source is good because you're free to change to a different vendor. i.e., if you don't like Red Hat's services, you could always switch to SuSE. In practice, alas, the ways in which various boot and configuration scripts are set up are just a tiny bit different enough that it's often not trivial to switch from one Linux provider to another. So the main difference is whether or not you're willing to make changes to the source code and recompile. But if you're a Red Hat customer, the moment you do that you use lose support for your modified package. So most Red Hat customers probably don't take advantage of the fact that all Red Hat software is "open source", at least not in a direct way. And in that case, why bother trying to use it as a marketing term?

</comment><comment><USER3> The reason is very simple: Open Source has become a standard way for the industry to produce software, with even companies like Microsoft and Apple participating. So mentioning it in you marketing materials is a bit like emphasizing that your software _runs on computers_.

<comment><AUTHOR> Hi Bergie

As the original author, that's a great explanation and I like it more than my own :)

It's probably true in quite a few areas of the enterprise where the buyers are more discerning.

Unfortunately, the mass market users still tend to have fits over the phrase.

<comment><USER3> Thanks! Feel free to quote it in your post :-)

I think I'll try to find the time to write a longer response on this, especially on why I think that while Open Source won as a software production model, most companies still don't get the open way of working ([http://bergie.iki.fi/blog/open_source-free_software- what_we_...](http://bergie.iki.fi/blog/open_source-free_software- what_we_need_is_open_projects/)), and users still don't benefit from the four freedoms (<http://en.wikipedia.org/wiki/Free_software#Definition>) that come from free software.

</comment></comment></comment><comment><USER4> I find it ironic how Open Source was originally coined to pitch the practical benefits of free [as in speech] software to business-types without having confusion between free-as-in-freedom and free-as-in-price and now Open Source has become so synonymous with free-as-in-price that it has essentially the same problem it was coined to solve.

<comment><USER5> Similar to <https://en.wikipedia.org/wiki/Euphemism#Euphemism_treadmill>, but in a positive way. I can't think of any other non-negative examples.

</comment></comment><comment><USER6> Good note! I've (for quite some time now) just given up on explaining the real meaning of open source. Hey, Stallman is crazy enough to try and fail year after year, let him keep doing that.

The main question missed in the article, IMHO, is: Is this bad for Open Source at all? In the end no. Hey, Open Source is huge! It is bigger than it was and probably it will be even bigger in the future. In the end, I think "Open Source" is just a really bad choice of words to use in a comercial strategy.

</comment><comment><USER7> >It's disgusting that you guys charge for Open Source training. You're making money off the hard work of all those volunteers.

My brain hurts so much now.

</comment><comment><USER8> I don't think it's entirely fair to compare "then-and-now" screenshots for number of mentions of the phrase "open source". It seems to me that the redesigns simplify, and remove redundant text, which could also be a cause of the fewer mentions.

</comment><comment><USER9> I don't think using Red Hat as an example offers that much sway. Red Hat has been trying to go "pay" for over 10 years.</comment>


Ask HN: Uber signed me in as my ex on download - <AUTHOR> Has anyone downloaded Uber as a brand new install on their device and when you went to use it....it automatically signed you in as someone in your contacts; into their account?  I did and do not have an Uber account.<p>This happened to me last night as I got an Uber for a friend and didnt notice until this morning that it had automatically signed me in under my ex's Uber account.  An ex who is troublesome to me and who blew up my phone accusing me of cheating and threatening me. <comment><USER2> She must have made her account under your phone number.

<comment><AUTHOR> This is a brand new phone one she hasn't seen or used since I broke it off with her.

Further I downloaded Uber .. opened it and it only asked me two questions...Can we send notifications and can we use your location. I agreed to both and then went and ordered an Uber for my friend.

<comment><USER3> Do you have an Android or iPhone and did you get a new phone of the same type? If they were tied to your account on your previous phone (such as your google account) it is possible your ex had set it up before and you never noticed and when you installed the app again your old settings were kept, which included all of the information your ex entered.</comment></comment></comment>


Contributor by Google: An experiment in additional ways to fund the web - <AUTHOR> https://www.google.com/contributor/welcome/

<comment><USER2> [https://hn.algolia.com/?q=google+contributor#!/story/forever...](https://hn.algolia.com/?q=google+contributor#!/story/forever/0/google%20contributor)

<comment><AUTHOR> Strange. I searched before submitting but didn't see any results.</comment></comment>


Chatterous (YC winter 08) connects your friends via SMS, IM, email, and web - <AUTHOR> http://mashable.com/2008/03/07/chatterous/

<comment><USER2> Hey guys, I'm one of the founders of Chatterous. I've created a Hacker News Chatterous group that can serve as a real-time backchannel for fellow Hacker News readers. Simply send your gtalk, email, sms or Chatterous username to email@example.com and we'll invite you to the group!

Also, an interesting story: While practicing our pitches we setup a Chatterous group for our fellow YC founders to provide real-time feedback for our presentations. It actually got to a point where people weren't paying attention to the presentations anymore and became immersed in Chatterous! We feel that Chatterous is super easy to use because of the fact that you don't need to navigate to our website, even as a Chatterous user - it's one of your IM buddies on gtalk, or an e-mail address, or an SMS short code. Think of it as IRC meets Twitter for the Hacker News community :)

<comment><USER3> You're certainly good at marketing speak...

And I don't mean that in a negative sense. Your enthusiasm shows through the medium.

</comment></comment><comment><USER4> Here is some observations after I created an account & tried it (in a very limited way) ~ <http://www.chatterous.com/landing/newsyc/>

\- easily create account

\- has unique url's (important if you want to cut+paste, send to others)

\- email authorisation in reasonable time

\- basic customisation (as expected) though no memorable default icon (think twitter, flickr)

\- each post has unique url (good so I can refer to them in the future).

\- not sure of post size limit (twit is 140 characters) what is chatterous?

\- entry box needs a few visual feedback indicators (not important just yet) what will be clipped when sent to sms?

\- links in comments are not rendered as links but text (how are long urls handled? tinyurl like twitter is _bad_ \- I don't know the solution?)

Only the creation side which _always_ leads to the next bit convincing your friends that they need to get on board. From flickr to twitter, twitter to friendfeed this has been the bane of my life on any _"social-service"_. I don't have any real suggestions [0] other than an observation on icons. Most of my twitter friends who I know from flickr use recognisable icons. So when I saw the icons on friendfeed I could sign them on immediately.

[0] All companies are suffering because of this. No company wants to give away their users friends list. Though the first company that allows easy access to friends will be my customer for life. When is this problem going to be solved?

<comment><USER5> You are wrong to suggest that you have to convice your friend to get on this. Your friends don't even need to be on chatterous to stay connected to you.

Chatterous is just social glue - they don't even bind you to the site.

<comment><USER4> _"... You are wrong to suggest that you have to convice your friend to get on this ... Your friends don't even need to be on chatterous to stay connected to you. ..."_

I missed that bit. How?

 _"... Your friends don't need to sign up Your friends don't need to sign up to chat with you! They can reply right on their im, email or phone. ..."_ ~ <http://www.chatterous.com/faq/>

Ah so users to contact a group "foo" would google mail, email "firstname.lastname@example.com", or "text CHTR foo <msg> to 41411" then?

How do they get the message? Do they still have to sign up to see it?

<comment><USER6> Nope. They will get an e-mail or SMS or gtalk message, and they would reply simply by replying to that e-mail/SMS/gtalk bot. Your friends don't have to sign up. But as the group creator, you need to add your friends' contact information to add them to the group.

<comment><USER4> _"... Nope. They will get an e-mail or SMS or gtalk message, and they would reply simply by replying to that e-mail/SMS/gtalk bot. Your friends don't have to sign up. ..."_

Ok, that solves the signup problem.

So you still need to get the _contact_ details. Not as hard as getting friends to sign up. What is the advantage of non group creators (non-admins) signing up then?

<comment><USER6> You get the ability to direct your messages to what you prefer. Say a friend added your e-mail to the group. By signing up, you can route the messages to your gtalk or sms or web instead.

</comment></comment></comment></comment></comment></comment><comment><USER7> Would you consider creating a project at <http://featurelist.org> so I can submit some feature requests and we can vote on them?

Why can't GTalk addresses be anything but gmail/googlemail? I have accounts that are created using Google Apps and would prefer to use those rather than gmail addys.

Thanks, looks pretty neat so far.

<comment><USER7> Here's some example code in Python for talking to the GTalk servers to other GTalk-supported emails other than @gmail.com and @googlemail.com: <http://snippets.dzone.com/posts/show/618>

If you're connecting to talk.google.com to send the messages, you should be able to send to any logged-in user address. This feature is really important for our teams to use this tool.

So far it's very cool, though. Keep up the good work!

<comment><USER2> We'll definitely take a look, thanks for the info!

<comment><USER2> I also tried to check out featurelist.org, but it kept timing out. I'll try again tomorrow and let you know once we have a project created :)

</comment></comment></comment></comment><comment><USER8> So here's the question I have with sites like this: What are the legal implications of people submitting other people's personal contact info to the service without permission?

Are there not privacy laws that come into play here? Not saying Chatterous are up to no good - really, it looks like a terrific service - but you see what I mean.

<comment><AUTHOR> What are the implications of people submitting other people's contact information to any other service, like, say porn or spammy sites?

I don't think it's Chatterous's problem, as long as they provide a confirmation email and opt-out procedure.

</comment></comment><comment><USER9> congrats guys! looks slick

</comment><comment><USER10> I don't get what the website does. Can someone explain it?

<comment><USER5> chatterous routes messages between your friends irrespective of whether they are on IM, email or mobile.

It allows people to remain hyper connected.

</comment></comment><comment><USER11> okay? I think i am missing something...

</comment><comment><USER12> WTF? I submitted that same idea (extremely similar) to YC as my secondary idea!

<comment><USER13> You're rightly being voted down, because YC doesn't fund ideas, they fund people (and they admittedly make mistakes).

<comment><USER12> yeah... i was simply voicing my opinion. i understand the premises for acceptance into YC. I wish the best for chatterous!</comment></comment></comment>


Alternatives to web development? Help me get out - <AUTHOR>

Freelance developer here, 10+ years, mostly Java backend but also Django front-end work. I need a new perspective and I'm considering a slight career change. I don't want to do web dev anymore and wondering what fields I could go into to apply my programming knowledge.
I'm open to anything. It can be something engineering related (or physics), in business or security. I also wouldnt mind if I had to study for some time. The only requirement would be that I could continue working as an independent contractor/consultant/freelancer because I really like that life-style.
Any tips, ideas or shared experience very much appreciated. <comment><USER2> You may want to look into machine learning/data analysis/inferential statistics.

I'm also a web developer. I do both front-end (Angular etc.) and back-end (Django) work. I enjoy my work, so I'm not looking at a career change at the moment. However, I do not still want to be writing CRUD apps when I turn 30. To that end, I'm planning to learn about data analysis and machine learning over the next few years. I believe it's a useful skill that will always be in demand in business, even after the current "Big Data" hype dies down.

I don't think this is something I can pick up in a few months' time. My current estimate is 2-3 years until I reach a reasonable level of competency.

</comment><comment><USER3> One possibility might be DevOps Engineering (System and/or Network). Another possibility might be Enterprise App Development (very similar to Web Dev). Another possibility could relate to Virtualization (OpenStack was built with Python for example). I'm not sure about freelancing in an Enterprise Environment, but a consulting style of approach should work great. I come from a System and Network Engineering Background but I also do Django/Python Web Development. I've been fortunate in that many of my Engineering related side- projects relate to Python in one way or another. So I've been able to re-use what I've learned in many different verticals (currently focused on Security and Virtualization)

</comment><comment><USER4> Network engineer either for a. Tele/mobile (phone) lines b. computers

The reason: It's a change from software to both software and hardware, you'll have your hands on real equipment at the same time tweaking software the make the big boxes work.

Im a developer, but my brother is a GSM network engineer :D

</comment><comment><USER5> IT Consulting if you're looking to do some traveling. Learn SAP.</comment>


The '80s Public Access Films Produced by a California UFO Cult - <AUTHOR> http://www.atlasobscura.com/articles/the-fascinating-80s-public-access-films-produced-by-a-california-ufo-cult <comment><USER2> The USAF set up a sizable UFO detection network in the 1980s, called GEODSS, the Ground-based_Electro-Optical_Deep_Space_Surveillance System. It's a set of pairs of large (40-inch) computerized telescopes which watch the sky automatically. The system has a star catalog and knows what should normally be visible. This includes noticing dark objects which occlude stars. It was intended to look for USSR satellites and space debris, but it can detect just about anything in near-Earth space. There are three active installations of this system. Most near-earth asteroid detections come from a former GEODSS station now operated by MIT's Lincoln Labs.

Unlike most astronomical telescopes, the GEODSS stations have a pair of telescopes some distance apart, under common control. They can range near- earth objects by parallax. One of the less-publicized features of the system is that one of the telescopes has a laser, so dark targets can be illuminated.

(In my aerospace days, the specs for this system crossed my desk. Our company had bid on the system, but lost.)

[1] [https://en.wikipedia.org/wiki/United_States_Space_Surveillan...](https://en.wikipedia.org/wiki/United_States_Space_Surveillance_Network#Ground- based_Electro-Optical_Deep_Space_Surveillance)

<comment><USER3> I'm betting you didn't read the linked article.

</comment></comment><comment><USER4> The person interviewed in the article downplays the dangers of cults in general, without really talking about any of there activities aside from the films (which are the focal point of the article). Just saying kids, many cults are dangerous and many do a real good job seeming innocuous . Look up the BITE model, learn it and recognize it. [https://www.freedomofmind.com/Info/BITE/bitemodel.php](https://www.freedomofmind.com/Info/BITE/bitemodel.php)

<comment><USER5> That article sounds like it was written by a member of that cult... going on about how warm and nurturing 'Ruth' appeared to be.

<comment><USER6> I think part of that is to answer questions like "why would some believe this maniac?"

</comment></comment></comment><comment><USER7> Unarius is located in El Cajon, CA I drive by there business building pretty often. In the yearly local mother goose parade this is the car they drive

[http://media.lajollalight.com/img/photos/2014/12/11/Christma...](http://media.lajollalight.com/img/photos/2014/12/11/Christmas_Parade_UFO_r620x419.JPG?d86a08e3d8be7604da3f6269b9cbf74cdc5e085c)

</comment><comment><USER8> I watched a documentary about this group a couple of years ago. I don't remember the film itself very well, but the story is interesting and the videos that the group makes are something else! I'm pretty fascinated by cults in general, probably because I tend to not want to join things.

[http://www.childrenofthestarsfilm.com/](http://www.childrenofthestarsfilm.com/)

</comment><comment><USER9> I practically can't believe they're not just taking the piss and having a good belly laugh about it in private! =)

</comment><comment><USER10> Does anybody see a place to watch these films? I would absolutely love to see these.

<comment><USER11> Here's something: [https://www.youtube.com/watch?v=TphNS93ebqU](https://www.youtube.com/watch?v=TphNS93ebqU)

</comment></comment><comment><USER2> Mandatory XKCD: [https://xkcd.com/1235/](https://xkcd.com/1235/)

</comment><comment><USER12> Reminds me of Sun Ra</comment>


GitHub: Reorder issues in a milestone - <AUTHOR> https://github.com/blog/2206-reorder-issues-within-a-milestone <comment><USER2> Sorry, but it almost seems like some weird variation of Stockholm Syndrome that people get excited about this. It is a trivial feature that should have already been there, and was actually there over 5 years ago before they removed it. If you want to feature compare, Issues is still way behind what various other issue trackers had many years ago.

<comment><USER3> What kind of features are missing, compared to other issue trackers you like?

<comment><USER4> Although I'm not OP, I use Phabricator ([https://www.phacility.com/phabricator/](https://www.phacility.com/phabricator/)) at work and I absolutely love it. It's much better than Github for our use case, as it has subtasks, task merging, priorities, Kanban workboards etc. Tasks can block another task (for instance, the "Implement OAuth2" task can block the "Build a private API" task). You can flag objects for later and set specific privacy rules for every task (for instance, you can hide a security bug from the public until it's fixed). It's all tightly integrated with other Phabricator apps, which is a plus. Also, it's open source.

<comment><USER5> GitHub _does_ sort of have subtasks. If you use checkboxes like so:

\- [x] The root url displays a page

\- [ ] Users can sign up, sign in, register

GitHub will display the progress on the issue (when you're looking at the list of issues) as 1 of 2.

<comment><USER6> Can you have several levels?

</comment></comment></comment></comment></comment><comment><USER7> Unrelated feature request (because I bet people from GitHub are reading this thread): I'd love to be able to create gists under an organization account rather than attached to my personal profile (and hence only visible to members of that organization).

<comment><USER8> You may consider to create an issue in one of these repos (or both):

\- [https://github.com/dear-github/dear- github/issues](https://github.com/dear-github/dear-github/issues)

\- [https://github.com/isaacs/github/issues](https://github.com/isaacs/github/issues)

</comment></comment><comment><USER9> I'm amazed that a trivial feature addition like this can make the front page of HN.

GitHub may not be perfect, but they are clearly doing something right to win (or re-win?) the affection of the community.

<comment><USER10> I'm not sure if this is really a good thing. Possibly people are happy that some really annoying problem finally got fixed, rather than celebrate the feature itself. "GitHub stopped killing puppies" would also likely make a front page.

</comment></comment><comment><USER11> Some people can't make the front with a webapp that takes 3 months to create.

Github gets on the front with re-ordering issues ;)

</comment><comment><USER12> The letter that the group of developers wrote a few months ago must have scared them, because they have been adding quite a few features compared to what they did the previous couple of years.

<comment><USER13> It inspires one to wonder... what were they doing before that? Alternatively, perhaps they just hired a bunch of new people right then?

<comment><USER14> Just writing checks for friends and family.

</comment></comment></comment><comment><USER15> This is great. I thought this would be a useful feature at one point, and then just figured it would probably never happen.

Funny how any stream of notifications just turns into a todo list though. I wish I could just pipe them all to one place and have the changes actually committed back to the source. It'd be great to collaborate where some people use Asana, some people use Trello, and some people just use textfiles but they're all in sync and it doesn't matter where or how you make edits.

<comment><USER16> > I thought this would be a useful feature at one point

You used to be able to do this ages ago. Reordering was one of the features that "no one used" and didn't make the cut when they rewrote "Issues 2.0" five years ago:

[https://github.com/blog/831-issues-2-0-the-next- generation](https://github.com/blog/831-issues-2-0-the-next-generation)

</comment></comment><comment><USER17> I love a lot of the changes github has been making. One sorely needed thing they've recently added is ability to assign issues to more than one person.

The one thing I am dying for is the ability to mark notifications unread. Notifications are a wonderful interface to catch up on things where you're mentioned or needed, but there is no way to mark them as unread, so you have to deal with them right that second.

<comment><USER18> I agree on having a need for that feature myself too. In GitLab we solved it by not marking TODO's when you read them but only when you take action. The problem has been when you don't want to do anything (reply, comment, vote, etc.). That is why we just added the ability to mark TODO's as read in GitLab in 8.9 [https://about.gitlab.com/2016/06/22/gitlab-8-9-released/](https://about.gitlab.com/2016/06/22/gitlab-8-9-released/) section "Manually add Todos" (you can mark them done in the same spot.

BTW We're working on ordering issues as part of an issue board [https://gitlab.com/gitlab-org/gitlab- ce/issues/17907](https://gitlab.com/gitlab-org/gitlab-ce/issues/17907)

</comment></comment><comment><USER3> I'm happy they added back this feature.

Can someone from GitHub explain why they removed it a few years ago [1], and why they changed their mind and added it back today?

[1] [https://github.com/blog/831-issues-2-0-the-next- generation](https://github.com/blog/831-issues-2-0-the-next-generation)

<comment><USER16> The rationale I heard back then was "no one used it". My guess is that these days, even if "no one" means "less than 1% of users" it still amounts to hundreds of thousands of people.

</comment></comment><comment><USER19> Can some of the people who upvoted this explain why is this relevant?

<comment><USER20> Because a lot of people use github issues and milestones as a way to gauge what is needed to be done for what release, and the ability to order by priority is a great option.

You may think it's trivial and doesn't deserve the front page, but many people do. Clearly.

</comment></comment><comment><USER21> The main issue I had with milestones is that you could not rename them. Have they fixed that one too?

<comment><USER20> Yes you can rename milestones.

<comment><USER21> Cheers. Unfortunately it seems that the milestone name and link where they are assigned in the issue still doesn't. So you get "[user] added this to the [old_milestone_name] milestone on [date]" and then clicking it returns no issues.

</comment></comment></comment><comment><USER22> Why not a general priority system? Why only for a milestone?</comment>


93% of phishing emails are now ransomware - <AUTHOR> http://www.csoonline.com/article/3077434/security/93-of-phishing-emails-are-now-ransomware.html <comment><USER2> Maybe that's why Bitcoin transactions are up.

It should be possible to follow the money. Bitcoin is only semi-anonymous. If you have a large number of transactions to track, it should be possible to figure out where the money is going.

<comment><USER3> Not if they mix the coins, and anyone employing ransomware will be using a mixer.

<comment><USER2> If there are enough transactions, you can follow the money through a mixer. You'll see coins going into the mixer, and, after a while, items that sum to the same amount minus the laundering fee coming out. It's statistically noisy, but that's what big data is for.

</comment></comment></comment><comment><USER4> Notably, the top 3 ransomware tools they mention are Windows only (Locky, TeslaCrypt, CryptoWall). And that's not just because of platform popularity.

There was recently a case of Mac ransomware (KeRanger) but it was not via a phishing email. It was considerably harder to distribute because Mac users can't simply run unsigned software downloaded from the internet (by default). The attacker got control of an app developer signing certificate and hijacked their software update to deliver the ransomware. It was halted as soon as the the certificate was revoked.

</comment><comment><USER5> Modern world eh? I guess ransomware pays most.

</comment><comment><USER6> The lesson here is that you should backup your files on a cloud storage service that has version history for all files, preferably for a period longer than 30 days.

<comment><USER7> Anybody have recommendations for decent providers of such backup services?

<comment><USER8> Backblaze and Tarsnap.</comment></comment></comment>


India has no reason to worry about US spying: PM has no cellphone, email account - <AUTHOR> http://timesofindia.indiatimes.com/india/Manmohan-Singh-has-no-mobile-phone-email-account-to-hack/articleshow/24695377.cms

<comment><USER2> His assistants, adjutant most certainly have.</comment>


Learning C with gdb - <AUTHOR> https://www.recurse.com/blog/5-learning-c-with-gdb <comment><USER2> The _very last_ line mentions:

> Check out gdb's "tui" mode

But that should be in the first paragraph. TUI mode shows the source code and the current line. This is like the difference between `ed` and `vi`: you can see the source code that you're debugging instead of mashing `bt` or whatever again and again.

To use gdb's TUI mode, simply include the `-tui` argument at the command line:

        gdb -tui path/to/bin

or, at any time while running gdb, press `ctrl-x ctrl-a`.

<comment><USER3> tui mode is great. I would recommend this tutorial by beej [0] as an intro to gdb for those unfamiliar with it, it also has a very handy cheatsheet at the bottom [1].

[0] [http://beej.us/guide/bggdb/](http://beej.us/guide/bggdb/)

[1] [http://beej.us/guide/bggdb/#qref](http://beej.us/guide/bggdb/#qref)

</comment></comment><comment><USER4> One of the assignments I enjoyed the most was the "bomb lab". The bomb is a C program (w/ some Assembly required) that you have to defuse at certain phases in order for it to run to completion. It felt like a game more than an assignment, using and learning gdb along the way.

This isn't the oourse I took, but here's a good example of the lab: [http://condor.depaul.edu/glancast/373class/docs/lab2.html](http://condor.depaul.edu/glancast/373class/docs/lab2.html)

<comment><USER5> And if that kind of "game" is your thing, you may also enjoy [https://microcorruption.com](https://microcorruption.com)

</comment></comment><comment><USER6> Another indispensable tool is this site [http://gcc.godbolt.org](http://gcc.godbolt.org)

<comment><USER7> You can also use the -S flag of gcc to output assembly instead of binary, or if the program has already been compiled you can use objdump on it to read the assembly alongside the source code.

<comment><USER6> I'm well aware of that. This is much more interactive though. The color coding is also dank.

</comment></comment></comment><comment><USER8> If you like this, coursera has a great course called the "Hardware Software Interface".

[http://coursera.org/course/hwswinterface](http://coursera.org/course/hwswinterface)

The course takes a similar approach of starting with analyzing how C interacts with memory.

</comment><comment> vezzy-fnord One might also be interested in the basics of the Acid debugger: [http://doc.cat-v.org/inferno/4th_edition/kernel_debugging/](http://doc.cat-v.org/inferno/4th_edition/kernel_debugging/)

</comment><comment><USER9> Interesting resource! I like this take on learning C.

On another note, I LOVE gdb. One of my prof's begged and pleaded for us to use gdb with all of our assignments because he claimed it would make life easier. For our first two computer org classes, you might be able to skate by without it (except for the buffer bomb and binary bomb), but once you reached the third semester and beyond, those that didn't spend a little time acclimating themselves with gdb began to hate life.

I really do love gdb. It saved my ass more times than I can remember.

<comment><USER10> I have a feeling that it was your first debugger, and that you've not used any others...

<comment><USER11> What other debuggers stand out as the best, in your mind?

(I'm thinking specifically for C-on-Unix, but whatever you wish...)

<comment><USER12> Anything with a UI.

I'm not saying gdb is not a great tool. It is especially useful when you don't have a debugger at all.

</comment></comment></comment></comment><comment><USER13> I taught myself C as a young teenager (some time ago), only to much later learn languages with REPLs like Ruby, Scheme and Common Lisp. Using gdb in this way would have been an interesting learning experience... because back then I didn't know there was a such thing as a REPL!

</comment><comment><USER14> This article reminded me of all the nasty headaches that C caused me back in the 80's, especially with how it handles arrays and memory management.

Say what you will about PHP but even with all the inconsistencies of the language and syntax, the way it handles complex arrays is nothing short of magical when coming from a C background.

</comment><comment><USER15> Another good interface to GDB, especially if you like vi-style navigation, is cgdb: [https://cgdb.github.io/](https://cgdb.github.io/)

</comment><comment><USER16> I had an issue with codesigning, this document helped: [http://wiki.lazarus.freepascal.org/GDB_on_OS_X_Mavericks_and...](http://wiki.lazarus.freepascal.org/GDB_on_OS_X_Mavericks_and_Xcode_5)

</comment><comment><USER17> That's really nice, being able to 'stop and look around' in ipdb for Python, node inspector for node etc has made those respectively so much easier to understand. Being able to do something similar for C is great.

<comment><USER18> I mean, the initial release of gdb was 29 years ago ;)

</comment></comment><comment><USER19> I'm not a C expert, but I think you can prevent your assignment from being optimized away by declaring the variable as "volatile".

Edit: -O0 to disable most optimizations is also helpful when debugging.</comment>