Dell launches tiny, Via Nano-based servers - <AUTHOR> http://en.community.dell.com/dell-blogs/direct2dell/b/direct2dell/archive/2009/05/19/dell-launches-quot-fortuna-quot-via-nano-based-server-for-hyperscale-customers.aspx

<comment><USER2> It seems like the need for better granularity in webhosting horsepower is/was better suited by virtualization. Cute little things, though.

</comment><comment><USER3> (2009)

I wonder how many of these they sold.

<comment><USER4> Even considering they were never sold to the public, I doubt Dell sold many.

They have the same fatal flaw as SeaMicro's "hundreds of Atom CPUs in a big box" servers: lack of ECC RAM support. Also, I doubt they were cost competitive with conventional 1- or 2-socket 1U servers with Opteron EE or Xeon ULV CPUs.</comment></comment>


Backbone 0.9.0 released - <AUTHOR> http://backbonejs.org/#changelog

<comment><USER2> Hey folks -- this should be considered a release candidate for a 1.0. We're currently running 0.9.0 on DocumentCloud.org; let me know if you have any trouble upgrading. There's a few things to watch out for, listed here:

<http://backbonejs.org/#upgrading>

Really, in the little over a year since the initial Backbone.js code drop, it's been incredible to see how many amazing apps have been built with it, a sentiment expressed concisely on Twitter this morning:

[https://twitter.com/#!/donnierayjones/status/164012817584881...](https://twitter.com/#!/donnierayjones/status/164012817584881664)

Cheers!

<comment><USER3> This is probably a little bit late for this release, but have you ever considered allowing arrays or strings with spaces on the value side of the events hash? This would allow you to define different functions to call in order when an event is fired, instead of just a single function that has to call them itself. I've run into a few situations where this would be useful, and seems like a very small change. Should I send a pull request?

<comment><USER4> I'm not familiar with the Backbone code or config. However, it sounds like you are setting an argument by specifying a function name in a string. If you want to specify multiple functions, then instead of specifying them in a string I'd say Backbone should accept either a string or a function as the argument value. That would let you define your event handler in-place, and you could define one that just calls a series of other functions.

<comment><USER2> No, that's not quite it. It's simply that you're now allowed to bind and trigger multiple _event names_ in a single call, as in jQuery. For example:

        book.on("change:title change:author", function() {
          ...
        });

</comment></comment></comment></comment><comment><USER5> I'm trying to learn Backbone, I really am. But there's so many tutorials suggesting everything that I don't have a clue how I should structure a project and what to think about as a codebase grows.

Granted, I'm fairly new to Javascript, but - no offense meant - I can't get excited about node.js. Backbone is the first thing about Javascript that really makes me want to write it. And I know enough to know what I lack is primarily practical experience, but every step I take with Backbone feels like a misstep, because it seems like there's no one right answer by design, so I'm paralyzed.

What to do?

<comment><USER6> I was in a similar position to you a little while back. I found the annotated source of the TODO app on DocumentCloud a good start. I then found it was worth spending the money on Recipes with Backbone by Nick Gauthier & Chris Strom.

[http://documentcloud.github.com/backbone/examples/todos/inde...](http://documentcloud.github.com/backbone/examples/todos/index.html) <http://documentcloud.github.com/backbone/docs/todos.html> <http://recipeswithbackbone.com/>

That being said, I've always found the best way to learn, is to do. Come up with an idea for an app and build it using Backbone, with the help from the resources above. You'll learn a lot.

<comment><USER5> Thanks, I'll take a look at it. I'm always willing to invest cash in myself to buy good educational materials.

</comment></comment></comment><comment><USER7> Changelog

* Creating and destroying models with create and destroy are now optimistic by default. Pass {wait: true} as an option if you'd like them to wait for a successful server response to proceed.

* Two new properties on views: $el — a cached jQuery (or Zepto) reference to the view's element, and setElement, which should be used instead of manually setting a view's el. It will both set view.el and view.$el correctly, as well as re-delegating events on the new DOM element.

* When you don't know the key in advance, you may now call model.set(key, value) as well as save.

* Multiple models with the same id are no longer allowed in a single collection.

* Added a "sync" event, which triggers whenever a model's state has been successfully synced with the server (create, save, destroy).

* bind and unbind have been renamed to on and off for clarity, following jQuery's lead. The old names are also still supported.

* A Backbone collection's comparator function may now behave either like a sortBy (pass a function that takes a single argument), or like a sort (pass a comparator function that expects two arguments). The comparator function is also now bound by default to the collection — so you can refer to this within it.

* A view's events hash may now also contain direct function values as well as the string names of existing view methods.

* Added shuffle and initial to collections, proxied from Underscore.

* Model#urlRoot may now be defined as a function as well as a value.

* View#attributes may now be defined as a function as well as a value.

* Calling fetch on a collection will now cause all fetched JSON to be run through the collection's model's parse function, if one is defined.

* You may now tell a router to navigate(fragment, {replace: true}), which will either use history.replaceState or location.hash.replace, in order to change the URL without adding a history entry.

* Within a collection's add and remove events, the index of the model being added or removed is now available as options.index.

* Added an undelegateEvents to views, allowing you to manually remove all configured event delegations.

* Although you shouldn't be writing your routes with them in any case — leading slashes (/) are now stripped from routes.

</comment><comment><USER8> Nodding my head the whole way through the changelog -- I just manually implemented undelegateEvents today. Looking forward to trying this out.

</comment><comment><USER9> The sync addition is great, you can patch backbone to trigger a 'loading' event to accommodate it: <https://gist.github.com/1500028>

My biggest point of pain with backbone is the models, in one project I had to add lazy loading (pagination) and in another a sparse array implementation which was a lot of hassle.

The other point is boilerplate - there's a lot of it. projects like backbone- forms (<https://github.com/powmedia/backbone-forms>) try to fix it, but it's still a problem.

<comment><USER2> If you don't mind elaborating more, and/or opening tickets, I'm sure there are plenty of folks who'd be glad to help with the pain points.

Pagination shouldn't be too big of a deal -- that's precisely the sort of thing that Collections can make easy ... ditto for modeling a sparse array (although I'm fuzzy on why you'd need that -- if it's for performance only, you should be using something more low level)...

As for boilerplate, I'm not sure what Backbone-forms has to do with it -- if you're suggesting that Backbone should include UI widgets for auto-generating forms ... I think that's _very_ far away from the role that Backbone is supposed to serve.

<comment><USER9> To clarify: backbone is so great and widely adopted because it is almost perfectly agnostic and easy to plug into other libraries. But, it feels like Connect, not Express. There's still boilerplate in my code to crush.

I don't like feature request issues, once we are done with the current project we'll send a couple of pull requests.

<comment><USER2> Looking forward to 'em.

</comment></comment></comment></comment><comment><USER10> The 'sync' addition is neat.

Is there any way in Backbone to get a list of all of a model's properties that have been changed since the last sync? model.changedAttributes() only works for the most recent change (and only inside of a 'change' event listener).

The reason I ask: I'm working on a system that only syncs model attributes that have changed - it doesn't send the entire JSON of every changed model. To do that it currently has to keep track of which attributes are 'dirty' or not for each model.

<comment><USER2> I'm having a hard time seeing how "changedAttributes" isn't exactly what you're describing -- the difference in attributes since the last time the model was changed/synced.

That said, if you need something fancier, and can't you simply listen on "change" events, and stash the last set of changed attributes where you can look them up later?

<comment><USER10> Yeah, that's what I'm doing now. Sorry, I realize I was being silly; the reason I needed this behavior is that I've overridden Backbone.sync to sync to the server in batches (every six seconds), rather than send off a new sync every time there's a change. I'd forgotten that I was doing something nonstandard there...

</comment></comment></comment><comment><USER11> "A view's events hash may now also contain direct function values as well as the string names of existing view methods."

Nice! I've always been wondering why I couldn't pass a function there.

Thanks

</comment><comment><USER12> Man, I must have been doing something wrong with my models. I'm getting this error in my console when normally it triggers my validation errors:

"Uncaught Error: Can't create an invalid model"

<comment><USER2> Validation has gotten an overhaul -- I'm afraid it'll no longer allow you to create a model in an initially invalid state.

If you'd like to keep the same flow, first create an empty model, then `.set` the attributes on it.

<comment><USER13> I don't understand. If you create an empty model and you have a validate function, the validate function still runs and you aren't able to create the model.

Also, I don't fully understand the workflow for a "new" form. If the form needs to handle both a "new" model with no attributes (invalid state) and an existing model for update, how does one go about that? (I'm currently using a mock for the new state.)

I realize this are two different issues, but they are somewhat related to the problem of creating a model with no attributes, which is a model in an initially invalid state.

</comment></comment></comment><comment><USER14> Uh oh, and I thought it was clever to monkeypatch a function this.$el() into views that returns the cached jquery/zepto element and is mindful of changes to this.el ;)</comment>


Ask HN: "Creative" ways to handle abusive http traffic? - <AUTHOR> Hi all,
I run a pretty popular site that is constantly experiencing some form of abusive traffic- most notably attackers running password dumps against our login endpoint (sometimes from 10k+ ipv4 addresses among several subnets and ASNs).  We've mostly mitigated this with rate limiting, captcha and other forms of "suspicious login" detection. But I've been recently pondering ways to waste their time or resources to make password dumping less appealing.
The most recent attack could be accurately and precisely detected, and I noticed the abusive traffic would follow 301 redirects, so I decided to redirect all requests back to their own IP addresses.
I don't think it really slowed them down, but got me thinking of otherwise to stop/slow them down:
* 301 redirect them to a "honeypot" server that holds onto sockets for as long as possible and/or causes the client to waste time/cpu cycles (perhaps, constantly asking the client to renegotiate TLS)
* 301 redirect to https://nsa.gov so they might get on someone's radar with the time and resources to stop them
* Redirect them to a non http protocol, like geo:, potentially blocking the abusive client with a dialog "Want to open this with <Maps Application>?" (Some attacks originate from Android devices- I'm not sure how deeply the custom protocol hooks are registered and if that would even work)
I know abusive web traffic is pretty widespread and was curious how others dealt with it other than standard captcha, rate limiting and iptables rules <comment><USER2> Log them in. Give them the data they want but make it false. They think it's working and mark those passwords as good but they don't know otherwise. Now they have no idea if they're really good or bad and they have to verify with multiple other attempts somewhere else.

<comment><USER3> As someone often engaged in nonmalicious (but unwelcomed) scraping, this is one of the anti scraping measures I fear most

<comment><USER4> Out of curiosity, what kind of "nonmalicious but unwelcomed" scraping?

<comment><USER5> Not GP but scraping price data off some stores (particularly travel sites) tends to be unwelcomed by operators.

<comment><USER6> Myself, I did scrapping of a classified ads site once, to have notifications when a particular product I was looking for showed up for sale.

</comment></comment></comment></comment></comment><comment><USER7> Do their requests indicate support for gzip for other compression protocols? One thing I've heard people do is send a response with a zip bomb that expands to essentially infinite size, causing their program to crash.

[https://news.ycombinator.com/item?id=14707674](https://news.ycombinator.com/item?id=14707674)

<comment><USER8> Interesting read. But I'm wondering: how do you _create_ a zip bomb? Do you first need to create a petabyte file? Or can you compute it or something?

<comment><USER9> I believe you can do it off the command line relatively efficiently by piping output straight into gzip.

ie) perl -e "print '0' for (1..1000000000)" | gzip > zipbomb.gz

This will create a ~ 1MB file that will expand into something 1000 times its size.

<comment><USER10> Would probably be much more efficient to use /dev/zero:

      dd if=/dev/zero of=/dev/stdout bs=1M count=1024 | gzip > zipbomb.gz

However, you're restricted to NUL bytes there. However, you can vastly improve your original Perl script by writing more chars at a time:

      perl -e "my \$x = ('0' x 1000000); print \$x for (1..1000)" | gzip > zipbomb.gz

That runs about as fast as the dd variant on my system, and about 10 times faster than your original formulation.

<comment><USER11> yes 0 | head -n 1000000000 | gzip > zipbomb.gz

?

</comment></comment></comment></comment></comment><comment><USER12> > 301 redirect to [https://nsa.gov](https://nsa.gov) so they might get on > someone's radar with the time and resources to stop them

No, don't do that. Don't redirect them to anyone else but yourself.

IANAL but it seems pretty clear that you could end up being partly responsible for any damage caused by sending them elsewhere.

Furthermore, even attacking back in any way could be a very very dumb thing to do. Just because someone is attacking you you don't know that the owner of the system is responsible for that. In fact most likely almost every single machine that is participating in attacks against you are just botnet victims.

The book Aggressive Network Self-defense talks a bit about this. [https://www.amazon.com/Aggressive-Network-Self-Defense- Neil-...](https://www.amazon.com/Aggressive-Network-Self-Defense-Neil- Wyler/dp/1931836205)

I think the only reasonable thing to do is any combination of the following:

\- Present captchas and use rate-limiting like you were

\- Block / blackhole / null route

\- Honeypot that holds onto sockets for as long as possible, but only if you are sure like someone else said ITT that doing so is not DOSing yourself.

<comment><USER13> Is there an easy way to free a socket without having the networking stack close it for you (and tell the remote?)

<comment><USER14> You mean without a close()? You probably shouldn't try to get around that. It's not always great but you could set SO_REUSEADDR to let the stack let you open a new socket on the same port after you close the first.

</comment></comment></comment><comment><USER15> I've wanted to do the same kind of thing. My business partner who handles the backend, and may be more sensible than me, suggests not wasting my time. Hanging onto the socket is potentially DOSing yourself. You could have a server for it, but it's a server you could be using for other things. In the bigger picture, spending time on this is a form of DOSing yourself. You could be working on features or customer service or spending time away from work or, perhaps, implementing two factor auth for customers, if you don't already have it. As much fun as it still sounds to me, I think my co-founder's advice is best: do make sure you're locked down but don't try to get them back, since it's time & resource consuming, and not very likely to work anyway.

<comment><USER16> But if everybody did something like this, it could make a difference. Maybe we could use a library/service specifically designed for this purpose. It could keep itself up to date, and other than setting it up, you wouldn't need to spend time on it.

<comment><USER17> Blue Frog tried something like this over a decade ago.

[https://en.wikipedia.org/wiki/Blue_Frog](https://en.wikipedia.org/wiki/Blue_Frog)

It didn't work out so well.

</comment></comment></comment><comment> ryan-c > Some attacks originate from Android devices

Some attacks _claim_ to originate from Android devices.

If you want to try to crash the client, you can try gzipping a large amount of null bytes and reply with that. It should compress about 1000 to 1.

Someone else suggested faking a successful login a small percentage of the time, which is a nice trick.

Note that by doing this stuff you could very well provoke a DDoS. Just block the traffic.

</comment><comment><USER18> I think you may be on on to something the honeypot server...you could create something like Slowloris in reverse. One of the techniques it uses is to send a request one. Byte. At. A. Time. Very. Slowly. You could try doing the same thing with responses from your honeypot, which, assuming they don't give up before they get the full response, could even be redirects back to the honeypot.

But if you can ID them easily then iptables rules might be the most effective use of your time, especially if you can use fail2ban, which makes the whole process very easy.

The TLS thing is interesting, but if some of this traffic is coming from compromised devices it would probably be less harmful for the owner of the device if you didn't make them burn a ton of CPU cycles.

<comment><USER19> This. Honeypot with fake data once you're sure they are a bad actor. That will reduce their value as a provider of data.

It's fairly easy to create fake, but checksum compliant credit cards.

</comment></comment><comment><USER20> I have an interesting idea.

How about make the login process more resource intensive on the browser side, by running some intensive javascript code before sending it to the server?

The trick would be to make this much more intensive on the client side (say 1s of CPU time), while keeping this relatively easy for the server (say 1ms). We're trying to waste their resources, not ours.

One way I can think of:

1\. server sends a random seed to the client

2\. client calculates 1000 hashes based an random numbers generated from the seed, something like hash(rand() + password) and sends them to the server

3\. server picks a one of those and validates it. In case the hash isn't valid, you'll respond with an invalid password, so the client won't be able to distinguish between a failed authentication because of hash validation or because of a wrong password.

<comment><USER21> That's doable but you have to process a lot of traffic from the clients because the client would have to send all the answers it has calculated.

Do exactly what bitcoin does: You send a random prefix and require the client to find a random suffix so that hash(prefix+suffix) ends with, say 4 zeros.

<comment><USER22> So. Someone is wasting your time, so you want to start wasting everyone's time and natural resources playing games with a script?

Stay away from trying to increase computational overhead. Everyone thinks computation is "free", but it isn't. There is a turbine somewhere cranking out annoyed pixies to drive your computation war with this botnet. The fact some actor has decided to distribute the energy cost to someone else doesn't mean you have to double down on the waste by multiplying the botnet operator's energy expenditure being dealt with by oblivious user's a thousandfold.

It's a bit like global thermonuclear warfare. The only winning mover is not to play.

The least resource intensive way of dealing with it is just detection and either preemptive drop (no more useful info) or if you want to get creative, start doing some whois digging with IP's and start blowing up some operator's inboxes with questions as to why you are getting malicious login traffic from their IP block so they can start running down the source from their end.

This is the Internet. We don't know everything going through it, but most operator's are generally open to trying to keep transits clean if they are made aware of a problem in a way that doesn't seem like a DDoS aimed at their time.

</comment></comment></comment><comment><USER23> Proof of work system.

Require your clients to perform some amount of computation to do a request.

Something like this: [https://www.npmjs.com/package/work- token](https://www.npmjs.com/package/work-token)

<comment><USER24> I know blockchain and PoW is _the_ thing to talk about right now, but if you think about it, client-side PoW is kind of a bad system. the whole point of such a system -PoW or captcha- is to increase the cost for the attacker to do the attack, so rather than $0.00000001/request (if you're renting a russian botnet or something), it costs a bit more, hopefully more enough that it's not worth it for the attacker to continue. a quick search on google says that recaptcha2 solvers can be obtained for $0.003/solve, which makes the cost per attack $0.003. on the other hand, the PoW is much lower. let's assume most of your visitors have a dual core system, and you require 30 seconds of PoW to log in. a dual core ec2 instance (c5.large) can be rented for $0.096/hour. at 30 seconds per solve, it can generate 120 solutions, for a final cost of $0.0008 per attempt. so in this case, going with the captcha solution is clearly the better solution as it costs almost 4x as much per attempt. there's a bunch of other factors not accounted for that makes PoW worse:

* native code can almost certainly run faster than javascript code, even if you're using webassembly. in my experience js cryptominers operate at around half the speed compared to their native counterpart on the same machine

* the attacker can leverage GPUs to compute solutions hundreds of times faster than what your users can

* users have to wait 30 seconds before they can login. you can generate the key while the user's filling in the form to shave off a few perceived seconds, but that will result in a sluggish login form

* users with slow CPUs (ie. anything slower than what's in a c5.large) will take even longer to generate a solution. this is especially problematic for people on smartphones

* users might think that your site's high CPU usage is because you're running a cryptominer on your site!

<comment><USER25> > which makes the cost per attack $0.003. on the other hand, the PoW is much > lower.

If your attacker isn't even paying for the resources they use, such as from botnets or borrowed, then your attack value has gone out of the window. If the indivdual attack is free to the attacker, then you're left with time. PoW guarantees a time value. If a single PoW is too cheap, then ask for more values.

</comment></comment></comment><comment><USER26> Being too creative about unwanted traffic can backfire. Reminded me of this:

Justin.tv used to redirect people who searched for "porn" keyword (apparently high overlap with people being toxic on the platform) to what they were looking and used an affiliate link. This became a negative newsstory for them.

TechCrunch calling them out: [https://techcrunch.com/2009/02/16/justintv-is- redirecting-po...](https://techcrunch.com/2009/02/16/justintv-is-redirecting- porn-queries-into-cash/)

Article with retrospection: [https://www.inc.com/tess-townsend/justin-kan- stop-freaking-o...](https://www.inc.com/tess-townsend/justin-kan-stop- freaking-out.html)

</comment><comment><USER27> While the other suggestions are great, I would really like some kind of write up on _who_ these people are. Send them on weird paths, hell yes, but

\- not on company time, this is not crucial to the business

\- try to collect as much information on the attackers (are they really "hackers"?) as possible, the info they send you, how they react to your challenges ... and share it with us!

Thanks and have fun!

</comment><comment><USER28> We use PerimeterX and it's generally worked well for us [https://www.perimeterx.com/](https://www.perimeterx.com/) (and more cost- effective than spending our own time on it, at least for us)

I do share your desire though to try to direct the traffic towards some entity that could be better equipped at cutting it off at its source. It's automated traffic for the most part, so perhaps a clever automated solution could be effective at stirring a bigger or more well-equipped entity to cut if off. Past attempts at FBI reports and such have not amounted to anything for us.

</comment><comment><USER29> I keep track of login attempts via Redis based on IP address. As soon as one IP address attempts to sign in under different account name (e-mail in my case) and wrong password, IP is added to the set. Once there were more than 3 similar attempts, web server starts to return '403 Unauthorized' errors. In a few minutes (cronjob) IP address is added to the blacklist of 'ipset' (great tool for managing and keeping IPs in sets for iptables), which results in all connections from the offender silently discarded in a kernel firewall. Define your own terms when to purge sets and offer amnesty.

<comment><USER30> I have several e-mail addresses, that I use in combination with several passwords across services. While there's some consistency in which pw I use where, it's not definite. This leads to situations where I have to soft- bruteforce my way through the different combinations of user:pw that are possible. Services that deny me (worse yet, permanently) after a few failed attempts are the bane of my existence.

I've since moved to a password manager, but before they were commonplace this was the only somewhat convenient way to give yourself some protection against password leaks.

<comment><USER29> As a trade-off to prevent legitimate users from trying to login with non- existent credentials, I display "this login does not exist" message. So unless the customers attempt to enter numerous different logins anyway - they are safe.

I am not worried about bots trying to validate various account lists and build "existing users" list of my service, because those enumerating attempts are quickly prevented.

</comment></comment></comment><comment><USER31> You should trick them into thinking they have valid credentials for all their login attempts since it will devalue their dumps which they are likely selling. Most dark actors are highly specialized and these guys are likely selling what they find.

</comment><comment><USER32> If the client handles XML you can use a "billion laughs attack"

[https://en.wikipedia.org/wiki/Billion_laughs_attack](https://en.wikipedia.org/wiki/Billion_laughs_attack)

Also, see if they crash with invalid responses. You can serve a malformed document or something like that.

</comment><comment><USER33> Redirecting to 127.0.0.1 is the most effective strategy. The web hosts who host these compromised sites will notice the increased load and the sites are more likely to get suspended for the good of the internet.

<comment><USER34> Aren't these compromised machines typically desktops?

<comment><USER35> Desktops with users who have not noticed any issue. Making them notice an issue could be a good thing.

Question is, would this approach get their attention? Seems unlikely, but maybe some users would wonder why their computer was sluggish, and run a virus scan, do a system update, or take other steps to check for malware.

Let's be clear, I'm not claiming it would work for sure. I said "maybe." Point is, the computer being a desktop should not lead to shutting the idea down.

<comment><USER34> Not sure how a redirect to 127.0.0.1 (which would simply fail, they're unlikey to be running a webserver) would help?

Eating CPU though should do the trick.

</comment></comment></comment></comment><comment><USER36> Make it useless to even try. Don't make it easy to detect when someone has burned through an ip - they'll just pick the next up in the proxy list they bought. Make it so after 100 unsuccessful attempts, flag the ip and only allow it to log into accounts they've already logged into before (to stop them from using a real account to detect if they've been banned.) don't say "you've been banned" - just shadowban the IP and always fail the auth. After a while they will notice but not after a ton of attempts

<comment><USER37> Shadowbans, if not implemented completely correctly, are extremely user- hostile and frustrating.

<comment><USER38> Very true, for example in case of reddit shadowbans it is trivial to check if an account is banned while a legitimate user can go on for a very long time assuming that simply no one is replying, unaware that something like a shadowban exists.

</comment></comment></comment><comment><USER39> Unless you are 100% certain there won't be any false positives ever, then you should never try to do something that breaks the service.

Rate-limiting the IP's as well as giving them a 5-second delay before handling the http requests should be very effective.

</comment><comment><USER40> 1) Increase delays between failed login attempts. Not sure if by rate limiting it's limiting # of attempts per second alone.

2) Consider (if possible) assigning unique login urls for each user, company, group, etc so not all users access login from same URL.

3) Implement 2 factor authentication

4) To attempt chipping away at their install base, log the IP's of failed login attempts, identify top offenders and report to a few places:

\- look up IP addresses on ARIN.net, and an automated email sent to the abuse contact email on file for each IP address with supporting proof. A similar approach is likely used for reaching torrent downloaders.

For botnet/hijacked devices this may cause some issues for the end user but maybe it's good for them to know their device may be compromised. If you're being hit with some VPN/TOR IP's..

[https://whois.arin.net/ui/advanced.jsp](https://whois.arin.net/ui/advanced.jsp)

\- Submit IP's to blacklists if not already there.

5) There should be a service that helps identify if you are being visited via VPN service/TOR IP, perhaps that could be a flag for you as well, or deny outright.

</comment><comment><USER41> Something like fail2ban, too many bad attempts from any IP should go into a fail2ban rule set that uses iptables rules to null route all traffic to/from that IP for a period of 12+ hours.

There is a "recidivist" option for fail2ban to further ban things that show up in the fail2ban log, repeatedly, every 12 hours, for a much longer period such as two weeks.

<comment><USER42> It seems short sighted to do this. One dirtbag trying to hack logins using a VPN service would poison the VPN's IP(s) for legit users.

<comment><USER41> Fail2ban typically bans a single IP, not a range.

</comment></comment></comment><comment><USER43> Maybe tarpit[1] the connections? By rejecting them quickly you help them move on, but if you instead make the pages load as slowly as possible that would waste a lot of their time.

1\. [https://en.wikipedia.org/wiki/Tarpit_(networking)](https://en.wikipedia.org/wiki/Tarpit_\(networking\))

<comment><USER44> I thought this same thing. Figuring out who/when to tarpit might be a little tricky, but here's the basic approach for a Debian system via iptables: [https://sysadminblog.net/2013/08/debian-iptables- tarpit/](https://sysadminblog.net/2013/08/debian-iptables-tarpit/)

</comment></comment><comment><USER45> I would caution against redirecting them to a government run website. I understand the sentiment but it seems like you could quickly run afoul of the regulations surrounding abusive traffic and may be liable if anything bad were to happen.

</comment><comment><USER46> Loop through these :)

0) Return massive amounts of data.

1) Return empty on requests that go over a requests/second ratio (use memcache)

2) Return fake success pages. [This is super mean]

3) Return dictionary printouts. [Destroys pattern matching]

<comment><USER32> Massive amount of data = not in your best interest, as you pay for this.

<comment><USER47> You can gzip that

</comment></comment></comment><comment><USER48> fail2ban may prove some use: [https://www.fail2ban.org](https://www.fail2ban.org)

</comment><comment><USER49> Whatever you do, do NOT redirect to a gov site.

<comment><USER50> Yes; if the client is a hijacked browser, it'll have a Referer header in it.

</comment></comment><comment><USER51> You should just drop packets from badguys unless you are planning on great- cannon-of-chinaing something using 301s. `--reject-with tcp-tarpit` may slow this down but it's probably not worth it if they have 10,000 IPs since that sounds like it's probably comming from a rotating proxy "service."

</comment><comment><USER52> we use mod_evasive + cloudflare , apache mod evasive is generally effective , we have a static html page which merely says OK for all 403 errors which mod_evasive generates --> this prevents our server resources from being used up to large extent. plus we add abuse IP to cloudflare javascript challenge

</comment><comment><USER53> Are they actually Android devices? It sounds to me like they're probably just spoofing User Agents.

<comment><USER45> There are services that specialize in providing mobile proxies at scale for this sort of thing. See luminati.io

<comment><USER53> I don't understand how that's relevant to what I asked, do you mind elaborating..?

<comment><USER45> You asked if OP was sure they are android devices and suggested they may be spoofing user agents but it would be relatively easy to tell if they were actually mobile devices on a mobile network by the IP address. Assuming that they are mobile devices on a mobile network, the next question would be how would someone do this other than a botnet of mobile devices, which is essentially what luminati.io is, albeit a little more legitimate. My comment was really just suggested reading for anyone curious.

<comment><USER54> luminati sells access to desktop devices running hola.org's 'vpn' extension, the software does not run on mobile devices..

</comment></comment></comment></comment></comment><comment><USER55> Attacks usually come from infected computers, routers or other things-of- internet. Could we find a way to inform their owners about malware on their devices? Or even go as far as cleaning malware remotely and rebooting device (which in some cases might be illegal)?

</comment><comment><USER56> Use [https://www.distilnetworks.com/](https://www.distilnetworks.com/)

They use AI to block attacks to your site. You can do a bunch of customizations too. They are expensive though and start at USD 500/mo

</comment><comment><USER57> Look at using existing products like Cloudflare?

</comment><comment><USER50> It would seem you don't want to interact too much, so maybe you won't/can't reply to this, but I have a tangential "what if"/suggestion:

Would you, or anyone reading this in a similar position, be interested in sharing further details privately (with or without NDA), and working together to build a solution?

This is the kind of thing I'd love to work on for free. Yes, for free; this is precisely the kind of thing that _can 't_ get filed under "awesome exposure!11", and I don't care anyway. I want to learn more about networking and this would be a great hands-on way to do so.

</comment><comment><USER58> None of these options will solve your issues. Your attackers will simply re- adjust the mechanism as soon as they figure out your heuristics. You'll need to focus on two efforts:

(1) Being able to identify the IPs from which attacks originate, in real time. You will need to blacklist those hosts (for a limited period of time).

(2) Minimizing and limiting the impact of traffic you previously flagged, on your infrastructure. Ideally, as hostile traffic is flagged, a response is never sent (at the TCP/UDP level). You absolutely do not want to serve any flagged requests. Block traffic as early as possible.

<comment><USER59> so, I tend to disagree: your solutions were the old approach, where you keep trying to block, and hope they dont have a wealth of new source IP's to spawn their attacks from. I think what we find is, this doesn't work any longer.

The new approach I would advise is along your very first point: don't let the attackers know you are on to them: silently sink their traffic into a dead service that doesnt even attempt a password login, but don't let them know. You continue to handle their password bruteforces, but you DONT ever return a success. This could be a straight up static page. This kind of approach only works if you are happy to pay the bandwidth price.. but the nice part is: you keep the attacker occupied, they have no idea they aren't making progress, and the users accounts are safe.

<comment><USER58> > "hope they dont have a wealth of new source IP's to spawn their attacks > from"

You'd still be able to detect new addresses and block as necessary. I don't see your point, of course the solution proposed isn't entirely hermetic, but how does your suggestion overcome this exact issue?

> "This kind of approach only works if you are happy to pay the bandwidth > price"

Precisely the reason why most people would rather opt-out of serving malicious requests.

</comment></comment></comment><comment><USER60> Would be interesting to know if they fit the 'classic' credential stuffing methodology ([https://breachinsider.com/blog/2017/credential-stuffing- how-...](https://breachinsider.com/blog/2017/credential-stuffing-how-breached- credentials-are-put-to-bad-use/)) or if they have moved on to something more sophisticated.

My email is in my profile if you fancy talking specifics, would love to hear about what you're seeing.

</comment><comment><USER61> Tarpitting is popular with SMTP, you might be able to do something similar in your web server (but only to those you have identified as "abusers", obviously!).

</comment><comment><USER62> Would requiring clients to hash passwords for a large number of times before sending them help? I imagine a 3s second effort would be unnoticeable by human users but hurt the attack rate? That and maybe block the offending IPs, at least temporarily?

</comment><comment><USER63> My suggestion would be to use some alternative log-in method such as client- side public-key authentication (like what ssh is doing, TLS also has support for it). That would make brute-force attempts essentially unfeasible.

</comment><comment><USER64> > I decided to redirect all requests back to their own IP addresses.

I think this one is something to avoid. What happens if you have a false positive? You've just redirected one of your legitimate users to the attacker.

<comment><USER65> > You've just redirected one of your legitimate users to the attacker.

I interpreterd it as being redirect back to your own address. E.g if I'm an attacker and my IP is [FE80::2], then I'd be redirected to [FE80::2]. Same for an user. And if you've got attackers from 10k IPs, then I'd think it'd be unlikely that you'd single out a single attacker IP.

</comment></comment><comment><USER66> Oh, the HTTP scourge.... We run a few websites and we have been doing some work around automatic HTTP traffic... what astonishes me is how much there is...

</comment><comment><USER67> There's a good video on Toxiproxy from a software engineer at Shopify. I recommend you check it out.

</comment><comment><USER68> There is another way .

1\. just redirect them to their OWN IP .

2\. Just welcome them with a WebJelPool Note : WebJelpool will have infinite ( random ) list of Links with no factual result .. these links will only open a new Pool of random & infinite list of URL .. & so on . bot / person will be in a mess with no facts .

</comment><comment><USER69> The iptables MIRROR target is fun. Be aware of spoofing though.

</comment><comment><USER70> Return gzip encoded zip bomb pages. Will crash shabby bots.

</comment><comment><USER71> Set up CloudFlare in front of your site. They were literally built to use every method of f'ing with spammers on your behalf.

</comment><comment><USER72> Reduce attack surface. Only show login panel for your country or vpn. Show 404 for all others.

<comment><USER38> What if a legitimate user travels abroad and needs to use the website?

<comment><USER72> Create two systems: one administrative one for regular users. You don't want regular users anywhere near your administrative system.

edit: why downvote?

<comment><USER35> I didn't downvote but I think people really hate it when a web site doesn't work in their country for no good reason that they can see. So they're probably mad at you for suggesting a solution that involves allowing people only in certain countries to use a site. You might not have even been suggesting that... maybe you just meant one different login panel per country, which seems a bit silly to me. But downvoters vote on what they think they read, not what you think you wrote.

</comment></comment></comment></comment><comment><USER73> Redirect loop.

</comment><comment><USER74> The more creative the solution, the more the script kiddie will enjoy defeating it. You avoid a bully or you punch them in the nose. Never play games with them.

</comment><comment><USER75> Do NOT redirect to a .gov website.

CFAA is a tractor beam they can use against anyone they don't like.

I work cyber security (well, mostly application security these days and not so much networking/telecomms) and I've also been involved with a small spat as a contractor a few years back. Basically, I had broken a collection source for the FBI by fixing and securing a resource for a certain department for a certain state, and maybe hypothetically it had to do with a very sunshiney state and maybe hypothetically it was a department that involved wheeled objects.

The firm I worked for was contacted by an investigator, which, lemme tell you, when an FBI agent appears at your work and asks your boss what sort of assignment you're working on, have no illusion that he's not about to cover for you in any way. Not that I did anything wrong. So anyways, the investigator asked me why I made all these WAN changes and about what packet filtering I had added/removed/reconfigured, all this technical domain knowledge and be really had a good idea of what I was actually doing. So I was comfortable. Eventually he left, basically saying we may be contacted further or potentially if the "investigation" became more serious, be made to appear in court.

Well the following week, a different guy comes in, and basically sealed me in our little coffee room and interrogated me. I was cooperative as I could be because I thought he was well informed like the other guy and generally had an understanding with my work, but he was a complete asshole.

It ended up that (thank God) all my paperwork was in order and my contract was pretty intensively detailed about what work I was going to be doing, I hired an attorney and he took good care of me. Never made it to court, but I ended up owing the lawyer a couple grand (funny how THEY always get paid) and yeah. Luckily I didn't go to federal prison, and my gratitude pushed me to greener pastures and better states.

TL;DR, your judgment has gotten you this far, so trust yourself, but I've poked the government before and I almost went to federal prison. Ymmv

<comment><USER76> Has this occurred more than 5 years ago?

Because if not, you're not out of the woods.

I hired the attorney too. I thought (and he thought) it wasn't ever going to make it to court. I moved on to a different job in a different state. Years later, surprise surprise.

NEVER say anything but the word "lawyer" to a law enforcement official. FBI agents make a policy of not recording interrogations (euphemistically referred to as "interviews") with anything but their own notes. Every word you thought he was trying to put in your mouth, he did, successfully, and when and if it makes it into court, it's your word against his, and nobody will believe you.

<comment><USER75> Yeah this was in 2002. I never heard anything since then about it.

I realized later how badly I fucked up that second interview because you're right, I shouldnt have said anything. It's embarrassing but I was more or less "good fed, bad fed"'d.

I've not had any major incidents of this nature since then, but rest assured, I know what to do now.

Were you a contractor too, or a state employee? How bad did it end up?

<comment><USER76> Pretty bad. It hasn't ended yet, and it won't for years to come.

The bad part is that the agent's notes can be used to convict not only you, but other innocent parties as well. That happened with me- I've never talked to an FBI agent in my life, but after being woken up half-naked with 17+ FBI agents storming the house and pointing M4 assault rifles at her head, trapped in a fenced backyard, my wife did talk to them, no Miranda warning (2011).

Naturally, half the things in the notes were literally impossible for her to have said. The agent himself didn't even memorialize them in a 302 until 2 days after the whole-house search and seizure. That was good enough for the judge to call it consensual and admissible.

For more details, mattchannon dot org.

<comment><USER75> Good God, it's depressing what they're capable of.</comment></comment></comment></comment></comment>


Medium is down - <AUTHOR> https://medium.com <comment><USER2> It's totally down right now. But No status update yet [https://medium.statuspage.io](https://medium.statuspage.io)

 _edit Thev've changed status from 100% down to 50% and are investigating.

_ edit2 Wow it's back up for me atleast now that was fast. Impressive!

</comment><comment><USER3> Down for me right now (from the Netherlands).</comment>


South Australia gaming start-up Odd Games has MEGA win - <AUTHOR> http://www.startupsmart.com.au/finance/2011-07-18/sa-gaming-start-up-odd-games-has-mega-win.html

<comment><USER2> I lived in Adelaide for 8 years. I moved to Brisbane about a year ago. Just not enough work in Adelaide, and the government is too narrow minded (south australians will agree with me).

As a person that runs his own business, there is far more talent to tap into in Brisbane, and client with big wallets.

Don't get me wrong, I love SA and I call it home, but work wise, it ain't this 'untapped potential' they claim it is.

</comment><comment><USER3> Are there more HNers in Adelaide than I suspect?

<comment><USER4> I was in Adelaide until 6 weeks ago when I moved to Melbourne to start a new job as tech lead in Python/Django web development.

I would have liked to have stayed in Adelaide, but from my own personal job search there were very few development jobs advertised in Adelaide and those that were tended to use old technologies (e.g., zero Python jobs advertised on seek.com.au in Adelaide vs. dozens in Sydney and Melbourne) and be government or defense related.

<comment><USER5> I was one until November last year when I moved to somewhere smaller and colder, Canberra. I did work for a startup in Adelaide for almost 6 years, so I just wanted something different and a new environment, hence the move.

That said there are a few interesting companies and people in Adelaide that want to build some cool things, but in reality a lot of graduates and other skilled people move interstate, especially Melbourne or Sydney.</comment></comment></comment>


Intel tries cash to lure developers to its app store - <AUTHOR> http://www.itworld.com/mobile-amp-wireless/98449/intel-tries-cash-lure-developers-its-app-store

<comment><USER2> Why would I want to create an App specifically for their App Store when I could make a Web App?

Besides the App Store visibility, isn't the UI experience usually one of the bigger reasons you make an App over a Web App for Android of iPhone devices?

A netbook doesn't have the limitations that mobile devicse have. You have a mouse and even Flash.

<comment><USER3> I'd say the same reason many make apps for the apple app store: Visibility.

</comment></comment><comment><USER4> What's wrong with the free-for-all of the PC where anyone can write and offer for download their software? Just because Apple wants to advance DRM into the 21st century, it doesn't mean people want to be restricted in what software they choose to use.

</comment><comment><USER5> This just tells me Intel's store is a bad place to sell something, since successful marketplaces don't need to bribe their participants.</comment>


[Infographic] PHP vs. Python vs. Ruby - <AUTHOR> http://www.readwriteweb.com/files/files/hack/assets_c/2012/01/PROGRAMMING-LANGUAGE-3-620x3450-thumb-590x3283-38046.png

<comment><USER2> Here's the image at a higher resolution (1000x5565) : <http://i.imgur.com/U2pRx.jpg>

</comment><comment><USER3> I just wish they would align the column order with the title order. It's such a minor thing but would make it seem so much more organized.</comment>


CIA Confirms Role in 1953 Iran Coup - <AUTHOR> http://www2.gwu.edu/~nsarchiv/NSAEBB/NSAEBB435/ <comment><USER2> The rest of what happened in the region including the rise of terrorism is called 'blowback' in CIA terminology.

[http://en.wikipedia.org/wiki/Blowback_%28intelligence%29](http://en.wikipedia.org/wiki/Blowback_%28intelligence%29)

Some go so far as to argue 9/11 is such blowback. Hard to prove or refute that because of the large number of unknowns, the facts as we know them today leave enough room for either interpretation.

<comment><USER3> All "terrorism" is "blowback". Terrorists aren't just crazy folk who come out of the blue and go "I know, I'll blow some shit up just because" \- they're politically motivated and use fear as a weapon.

They're politically motivated due to actual or perceived past injustices perpetrated by their targeted nation or organisation.

On the note of using fear as a weapon however, our own governments have become absolutely expert, and media reports can now almost have the same impact as an actual terrorist attack in terms of controlling patterns of thought through fear.

So, by the definition of a terrorist as being someone who controls a population through fear, or in fact the fear of fear... you can see where I'm going.

<comment><USER4> > Terrorists aren't just crazy folk

Ok, explain the geopolitical motivations behind shooting a 14 year old school girl in the head.

[http://en.wikipedia.org/wiki/Malala_Yousafzai](http://en.wikipedia.org/wiki/Malala_Yousafzai)

<comment><USER2> Religious fanatics are committing atrocities all over the world. In Algeria they behead people, in Iraq they blow each other up, in Ireland they used to blow each other up (including schools) and in the US they shoot each other and innocent bystanders or professionals.

Geopolitics don't enter into it.

<comment><USER5> Irish terrorism was never anything to do with religion, religion just happened to be a reasonably good proxy for political leanings.

<comment><USER6> Bullshit. Their political leanings that stem from their religion. You could say the same thing about Islamic terrorists.

<comment><USER7> Northern Irish here. We have a cultural division that aligns roughly with a religious division. The political leanings of Unionism and Nationalism stem from that cultural division - the historical inequalities and injustices. Religion is not the _source_ of the division.

Sometimes it has been _part_ of the problem. It has encouraged the establishment of separate school systems for Catholics and Protestants and it has been used a tool by the extremists to give legitimacy to their violence.

Sometimes it has been _part_ of the solution. It has given emotional healing to victims, and it has motivated community leaders on both sides to push for peace.

I'd suggest that the same is true of most conflicts that you think of as stemming from Islam.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Steve Kangas was ex military intel that became a journalist. In 1999, he was found dead of a gunshot wound in a billionaire's building in Pittsburgh.

He was an education for me some 20 years ago when I began learning about the depredations of the National Security Corporate State that now has us in thrall.

\--

A Timeline of CIA Atrocities

By Steve Kangas

[http://www.huppi.com/kangaroo/CIAtimeline.html](http://www.huppi.com/kangaroo/CIAtimeline.html)

<comment><USER2> > It was ruled a suicide by local police.

How convenient. Maybe Greenwald and other persons of interest should go on the record that they does not intend to suicide.

<comment><USER9> Apposite reading right now: "The Execution Channel" by Ken Macleod. Yes, it's a work of science fiction -- by someone with a background in fringe political groups who were being actively infiltrated/used for disinformation during the cold war, and who's been thinking about just how far things could go wrt. the internet.

[http://www.amazon.com/The-Execution-Channel- ebook/dp/B00CBFX...](http://www.amazon.com/The-Execution-Channel- ebook/dp/B00CBFXMDY/)

<comment><USER2> Finished. That was quite the page turner. Apart from the science twist it is quite uncomfortably believable. Thank you for the pointer!

Score 2 for Scotland :)

</comment></comment></comment></comment><comment><USER10> This is why my friends ask me as an Iranian how the hell I can be happy living in the U.S. I can't explain them that U.S. citizens are viction of the same policies. The thing that I don't understand is, who are those elite people who make this kind of decisions? Who are they? Who leads the whole thing?

<comment><USER11> They are the ones that get your taxes you asshole. If you don't want to depose them, stop.giving them money to pull stunts like this.

Although US citizens love to be victims, .no atom bomb would be dropped.without US people.money.

<comment><USER12> You realize paying taxes is mandatory in the US, right?

<comment><USER11> You realize that people can still for example move out, right?

I wrote in a agressive tone, because I see LOTS of US people that just keep complaining about their government, and do nothing about it, beside voting (that clearly, is not working), and when they get for example a 9/11 on their head, they don't understand why other people hate them.

It is a thing of owning up to your mistakes, if you are not making a effort to avoid supporting your government that do evil actions, you are evil yourself, because you are allowing you are providing resources to make evil.

I am Brazillian, and I am tired of hearing here from US tourists for example, that they don't understand why they are hated, if the US meddling here is not their fault, but their government fault. I don't believe the US population is stupid, or they DO support the government evil actions, or they just don't care, saying that it is "not your fault" is NOT acceptable when you are providing taxes that pay the wages of CIA people that disappear my friends.

<comment><USER13> Would you say you condone all the actions done by your country's government. If not, how are you taking action against them?

<comment><USER11> First, our country is much less tame than US in outright evilness...

It is a government that is very inefficient, and corrupt, but does not drop bombs on other people heads to get minerals.

Aside from that, what I am doing?

First, I don't pay most taxes, literally. I don't even bother looking at what taxes I should pay. The tax that I pay correctly is the state (not federal) and municipal ones.

Second, I support with campaigning and donations when I can, some politicians.

Third, I support protests, specially the big and loud ones (like the ones that attracted international media here, and DID resulted into a couple of law changes in our favour).

Fourth, if after next elections things don't improve, I plan in moving somewhere else, and renouncing my citizenship as soon as I can. I don't want to stay citizen of a country that I don't agree with the actions of its population, the government is only a reflection of the local population, maybe with the exception of extreme cases of autocracy.

Fifth, after I amass enough power, I plan in engaging in politics in a active manner, whatever manner is needed at the time, and where I am.

</comment></comment></comment></comment></comment></comment><comment><USER14> So, the CIA releases such information years later, when it's not of much relevance. 50 years from now, if they say they had a hand in some of the most inhuman things happening now, we would probably be indifferent. Not sure how can anyone hold them accountable for their actions. Probably none of those individuals who played a part in the coup would be around.

<comment><USER15> That's a strange comment. We knew a lot about what happened in Iraq just months after the war started and we know a lot more now. All the individuals responsible for that war are still around.

</comment></comment><comment><USER16> I thought they had already accepted the blame years ago, DISCLAIMER I am Iranian.

<comment><USER17> I don't know whether accepted is the word. It has certainly been common knowledge in the US for 20 years or more. I think that one of the principals on the US side may have included it in his autobiography, but I could be wrong.

</comment></comment><comment><USER18> I thought this coup was outed by FOIA documents while I was still in college around 9/11 time.

I highly recommend All The Shah's Men if you want a good run-down of what happened. Even the CIA history FOIA document reads a bit like a James Bond novel. Kermit Roosevelt Junior was quite the Bond-like character and the Operation Ajax coup gets busted by the government days before they rescue the captured agents and complete the operation. Thrilling story for a real life tale.

</comment><comment><USER19> My favorite quote from the piece -- "There is no longer good reason to keep secrets about such a critical episode in our recent past. The basic facts are widely known to every school child in Iran. Suppressing the details only distorts the history, and feeds into myth-making on all sides."

Myth-making is the point of history. Forgive me HN for parroting a quote I first saw in a video game, "History is but a fable agreed upon."

<comment><USER20> Googling the quote it seems like it originally comes from Napoleon Bonaparte. What game do you attribute it to?

</comment></comment><comment><USER21> Is it a requirement that reports become declassified after a certain amount of time? If not, then why is this being released? What does the CIA stand to gain?

</comment><comment><USER22> What would CIA confirm 50 years from now?

<comment><USER2> Conspiracies aplenty to choose from, likely some of those will end up being true after all.

The benefit of knowing which is which is today, 50 years hence it won't matter. Some of the records are sealed for 70 years, sometimes with the most transparent of reasons for the sealing attached to them.

</comment></comment><comment><USER23> Conspiracy theory has become conspiracy fact.

</comment><comment><USER24> Is it just me who is sad for the early demise of what could've been a flourishing democracy in the Middle east (inplace of the silly regime that is now in power) ?

<comment><USER25> Few will thank me for posting this comment but you may find it interesting, it wasn't just Iran in the post war period: [http://www.bbc.co.uk/blogs/adamcurtis/2011/06/the_baby_and_t...](http://www.bbc.co.uk/blogs/adamcurtis/2011/06/the_baby_and_the_baath_water.html)

<comment><USER26> Thanks, very interesting read (as usual with Adam's writing). It's to be expected that playing with fireworks is liable to get one burned, unfortunately intelligence services have a very hard time understanding this sort of thing.

</comment></comment></comment><comment><USER27> How is this even remotely related to Hacker News? I guess if I really wanted to discuss this, I will rather go to /r/worldnews.

<comment><USER28> It's very related! From the HN guidelines:

 _On-Topic: Anything that good hackers would find interesting. That includes more than hacking and startups. If you had to reduce it to a sentence, the answer might be: anything that gratifies one 's intellectual curiosity._

The release of major new documents about a major historical event that still has major side effects today easily clears that bar. What's not related are comments like "how is this even remotely related":

 _Please don 't submit comments complaining that a submission is inappropriate for the site. If you think something is spam or offtopic, flag it by going to its page and clicking on the "flag" link._

[http://ycombinator.com/newsguidelines.html](http://ycombinator.com/newsguidelines.html)

<comment><USER29> Story: interesting.

Result thread on HN: nightmare.

For me, that suggests we keep it off the front page, but I'm just one me.

<comment><USER30> Basically, the problem with your argument is that the quality and tone of the comments on even purely technical stories is equally sad these days on HN.

<comment><USER31> So you're saying there's a correlation between the rise of the political stories, and decline of the technical content?

Seems plausible to me.

<comment><USER30> That is exactly what I was thinking, yes.</comment></comment></comment></comment></comment></comment>


Ask HN: How to fix social welfare - <AUTHOR> I'm very fortunate in life. I've worked hard for what I have and I've been given opportunities I deserve. But there are a lot of people who work hard who haven't had the opportunities they deserve.
Maybe it's the time of the year. Maybe it's recent posts like [1]. But I'm wondering what ideas people here have on how to fix the social welfare systems of the world (and particularly the US)
Note, I believe strongly in having social welfare. I also believe in free markets most of the time. But we have lots of problems with abuse and waste and ineffectiveness in our social welfare systems. And sometimes the motivation of free markets are at odds with the well being of our society as a whole.
I'd love to hear your ideas.
1. https://news.ycombinator.com/item?id=15999322 <comment><USER2> The very purpose of corporations - to take money from people and give it to their already rich shareholders - is at odds with the wellbeing of society as a whole. 'Free markets' is something that corporations want only when they know they will win the competition; otherwise they don't want it. The commonly-heard praise of free markets, level playing fields etc is pure cant and hypocrisy. Big companies get bailed out if they ever get in trouble; anyway, their managers can just go to the next management position. Ruthless competition with actual failure is reserved for the average person, the worker, the small business etc.

</comment><comment><USER3> Believe it or not, the current system works for a lot of people. The number of federal and state services available in the US is quite large. The thing is that you just have to look for them. I myself am not disadvantaged in life, and I work and make a good living. But even I have used welfare programs at certain times of need. I think the biggest inefficiency is just people not knowing there are programs that could help them, or perhaps, being too proud to consider the idea.

<comment><USER4> No, it's really not. It's things like asking a homeless old man for identification paperwork to enrol him into a housing program, or kicking people out of programs because they are addicts who can't quit without help, and making people visit an office in person during a weekday with all their children to get certain aid, when it would be better for them to be at work and the kids at school.</comment></comment>


Ikea debuts an indoor farm that grows greens three times faster than a garden - <AUTHOR> http://www.businessinsider.com/ikeas-space10-designed-a-vertical-farm-for-the-home-2017-9?r=US&IR=T/#the-lokal-farm-lets-anyone-harvest-greens-indoors-1 <comment><USER2> There are tons of exciting things happening in this space.

Check out the OpenAg Movement out of the MiT Media Lab, Caleb Harper's TED talk on youtube.

Also go to www.openagriculturesupply.com for all the Kits, Parts and supplies you need to build your own "Food Computer".

</comment><comment><USER3> Here in sunny Florida, there are plenty of examples of efficient, indoor gardens. We call them grow houses. With supplemental CO2, mylar sheeting, and constant heat, they massively out-produce a normal garden.

But they're still not economically viable for any legal produce. Sun, dirt, and water are still too cheap in the Eastern USA.

With medical marijuana here, and full legalization on the horizon, I wonder how soon grow houses will be an obscure bit of history.

<comment><USER4> A few years ago I heard an episode of "you bet your garden" where the host got a question about the best lights and setup for growing tomatoes indoors. The host kept asking the guy why he would ever do such a thing as the tomatoes would cost much more than you would pay at the store for them and the caller didn't really have a good answer. The funny thing is, tomatoes require basically the same care and conditions as marijuana and I heavily suspect that was the true motivation of that question.

</comment></comment><comment><USER5> Reminds me of this company in Japan called Mirai that specializes in this type of advance agriculture.

[http://miraigroup.jp/en/](http://miraigroup.jp/en/)

</comment><comment><USER6> There must exist some kind of adage out there that acts as a couterpart to Betteridge's Law [1] which states:

Any headline that celebrates an achievement in greater speed will invariably omit the correspondingly greater cost.

If not, you can name it "Andrew's Law" in my honor.

Hydroponics works. It works fast. But that's because it's using more resources in the form of heat and light than the average passive garden. Thermodynamically novel, this is not.

[1] [https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

</comment><comment><USER7> In Shoreditch. That's all I needed to know.

</comment><comment><USER8> Sounds exactly like what Plenty is doing.

<comment><USER9> This looks like a personal greens garden. Isn't Plenty doing a large scale farm?</comment></comment>


University to remove murals commemorating WWII veterans for lack of diversity - <AUTHOR> https://campusreform.org/?ID=15625 <comment><USER2> I'm glad WWII vets aren't alive to witness this disgrace that has been created during the peace they fought to create. But they are rolling over in their graves.

<comment><USER3> Meanwhile the article cites one of those veterans in the interest of balance: 'Yet, the man responsible for the paintings, Arthur Sherman, seems somewhat optimistic about the decision. When asked about the removal of his murals, Sherman responded, "That's a good question. Time goes by and things change."'

<comment><USER4> The article does point out that the murals may be accurate:

> "It's important to note that Blacks and other servicemen of color returning > to the states during that time were prohibited from taking advantage of the > GI Bill, despite that being a promise to them at discharge."

It also looks like the services wouldn't desegregate until at least Korea, or even the mid-1960s:

\- [https://en.wikipedia.org/wiki/Executive_Order_9981](https://en.wikipedia.org/wiki/Executive_Order_9981)

\- [https://web.archive.org/web/20100723014433/http://www.histor...](https://web.archive.org/web/20100723014433/http://www.history.army.mil/books/integration/IAF-24.htm)

> "Originally a follower of civilian society in racial matters, the armed > forces moved ahead in the 1950's and by the mid-1960's had become a powerful > stimulus for change in civilian practices in some areas of the country."

more of the same at [https://news.ycombinator.com/item?id=24333207](https://news.ycombinator.com/item?id=24333207)

<comment><AUTHOR> The US was also 90% white at the time [1], so one shouldn't be surprised murals would be "predominantly white", even if it wasn't for segregation.

[1] [https://en.wikipedia.org/wiki/Demographics_of_the_United_Sta...](https://en.wikipedia.org/wiki/Demographics_of_the_United_States)

<comment><USER2> Also, black soldiers were significantly less than the population percentage. Even if racism is to blame, the fact is the overwhelming majority of US soldiers were white.

<comment><AUTHOR> Were they? The wikipedia page is full of [citation needed] around the numbers, so I'm having trouble confirming this.

<comment><USER2> I'm seeing mixed information too, now that I've started looking deeper. I suppose it was a tangential point in the first place, but now I'm really curious.

<comment><USER4> inductions (rough parity): [https://en.wikipedia.org/wiki/Ethnic_minorities_in_the_US_ar...](https://en.wikipedia.org/wiki/Ethnic_minorities_in_the_US_armed_forces_during_World_War_II#One_million_African- American_inductions)

enlistments (far below): [https://en.wikipedia.org/wiki/Ethnic_minorities_in_the_US_ar...](https://en.wikipedia.org/wiki/Ethnic_minorities_in_the_US_armed_forces_during_World_War_II#African_American_enlistments)

The WP text seems to quote the following directly: [https://history.army.mil/documents/wwii/minst.htm](https://history.army.mil/documents/wwii/minst.htm)

> "The reasons why relatively few Negroes enlisted during World war II were > numerous. The principal one, however, was the severe restrictions placed > against Negro enlistments by the armed forces, which, in some periods, > amounted to complete prohibition."

</comment></comment></comment></comment></comment></comment></comment></comment><comment> just-juan-post > > "Some of our students have even shared with us they didn't feel > comfortable sitting in that space."

Ya gotta do what ya gotta do to keep the paying customers, don't ya?

</comment><comment><USER5> So would this university take down a mural of the 442nd Infantry Regiment too, for not being diverse enough?

[https://en.wikipedia.org/wiki/442nd_Infantry_Regiment_(Unite...](https://en.wikipedia.org/wiki/442nd_Infantry_Regiment_\(United_States\))

"The unit earned more than 18,000 awards in less than two years, including 9,486 Purple Hearts and 4,000 Bronze Star Medals. The unit was awarded eight Presidential Unit Citations (five earned in one month).[6] Twenty-one of its members were awarded Medals of Honor.[3] In 2010, Congress approved the granting of the Congressional Gold Medal to the 442nd Regimental Combat Team and associated units who served during World War II,[7] and in 2012, all surviving members were made chevaliers of the French Légion d'Honneur for their actions contributing to the liberation of France and their heroic rescue of the Lost Battalion.[8]"

</comment><comment><USER6> Eh. How will they preserve the paintings? Or are they going to destroy it? What's the difference from Islamic State burning art that "wasn't representative of them today"? Should we take down Egyptian pyramids too, since slaves built them and that's not what we are today? Hopefully this dumb ideology won't get out of the USA. I feel sad for the Americans of yesterday, though, I can't imagine such disrespect to their work here in Europe.

<comment><USER7> > Should we take down Egyptian pyramids too, since slaves built them

I'm pretty sure that's not true.

> I feel sad for the Americans of yesterday, though, I can't imagine such > disrespect to their work here in Europe.

The _white_ Americans of yesterday used to get upset when a black person used their water fountain, or got a better seat on a bus, so it's not like they refrained from weaponized outrage.

<comment><USER8> > so it's not like they refrained from weaponized outrage

at least you're admitting the stuff now is disingenuous and strategic

<comment><USER7> > at least you're admitting the stuff now is disingenuous and strategic

Strategic, absolutely. And—in this particular case at least—pretty stupid. But I'm more interested in the aim; it's no longer about keeping minorities down.</comment></comment></comment></comment>


San Francisco has worst air quality in the world due to smoke from wildfires - <AUTHOR> https://thehill.com/policy/energy-environment/417188-san-francisco-currently-has-worst-air-quality-in-the-world-due-to <comment><USER2> Ironic that California is possibly the worlds worst polluter. Better forest management might go farther than electric cars in reducing pollution. (But also keep the electric cars coming please)

<comment><USER3> Such is Brown's legacy.

California doesn't even have an oil extraction tax (most red states do).

</comment></comment><comment><USER3> SF doesn't even have the worst air quality in the _Bay Area_. The Livermore Valley does.</comment>


Why No HTTPS? - <AUTHOR> https://www.troyhunt.com/why-no-https-heres-the-worlds-largest-websites-not-redirecting-insecure-requests/ <comment><USER2> In my case I cannot use a cert from one of the free providers, because installation requires root access. I do not have root access on my managed server. This is probably intentional so that my server host can charge money for a Comodo cert. I could leave my host and put my site on as a free github.io site or put it into Amazon or something like that.

Aside from the costly cert, which I actually DO NOT need, I really like my current host. In the meantime this means I will continue to serve insecurely over HTTP.

Why do you ask that I absolutely DO NOT need HTTPS. It is because my site is a web productivity application written in JavaScript. It runs in the browser (or command line) and saves all data in the browser. No user information is sent back to the server and no personalized data or content is sent from the server. This said my site is more secure over HTTP than most every other site over HTTPS.

<comment><USER3> You can use cloudflare or any other CDN that offers SSL. With Cloudflare you don't need to install root certificate.</comment></comment>