The Great Cannon has been deployed again - <AUTHOR> https://cybersecurity.att.com/blogs/labs-research/the-great-cannon-has-been-deployed-again <comment><USER2> Browsers really have to be a lot more skeptical about the code they run. Running code should not be able to randomly attack any IP address on the internet. Code from non-TLS pages should not be able to run at all. Perhaps that should also apply to code loaded from 3rd party sites.

Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on the net. It certainly should not be consent to delegate that power to others, either via a embedded link or a MITM attack.

<comment><USER3> This sounds like a knee-jerk reaction that doesn't take into consideration the ramifactions of the suggested policy. It won't stop DDoS attacks, because those exist _because the internet exists_ and unless you dismantle the very concept of interconnected "everyone can reach everyone" networking, all you're doing is locking down access to more and more people until only technical experts or the people with enough money to hire those experts get to use it.

Advocate the other direction: more freedom, including the freedom to say "thank you, browser, for being locked down by default, but I trust this website and I am okay with everything it wants to do".

Instead of locking the web down, let's give users the freedom to put on or remove as many locks as they want to live with. And letting make mistakes with that, too: you don't make things better by taking away important life lessons, either.

<comment><USER4> This, on the other end of the spectrum, seems overly and naively liberal, when not being paired with a workable solution to the massive body of education required to provide adequate technical sophistication to (what has to be most of) 8 billion people.

<comment><USER5> >> a workable solution to the massive body of education required to provide adequate technical sophistication

The problem doesn't have to be one of education if it is tackled as a legitimate UI/UX problem and served by a WC3 that supports the needs of end users over corporate partners.

</comment></comment></comment></comment><comment><USER6> "a web site Lihkg.com" is really an understatement as its title indicated. Given the "be water" and no leader, lihkg is really the only way to try to have some sort of info among possible noise (which popo is likely also post their confused Messages). There were discussion to cut off access by hksarg and a rush to install vpn is promoted. Guess they cannot firewall hk given its financial centre status.

The evil empire and culture will try and try to harm liberty and human rights. If it is not so important you would not see many of hkers like me instead of posting in here and other places, but in concentration camp as northern Turks up north.

</comment><comment><USER7> So, maybe firewall off China for a couple of days? Sure, it would hurt on both sides but at least it would be clear that abuse at this scale leads to being blackholed.

<comment><USER8> that's what they want. a bifurcation of the internet.

<comment><USER7> No they don't. They want to use it as a weapon against targets of their choosing and co-opt the rest of the net in doing so. The economic importance of the internet to China can not be overstated.

<comment><USER9> They want a semipermeable membrane that money can cross, but uncontrolled information can't.

</comment></comment></comment></comment><comment><USER10> The web needs to start moving towards a strong same-origin policy for all embedded content-- require sites to proxy requests if they want third party content.

The first step could be sending CORS preflight, then requiring it, then just not allowing cross origin to different domains (but allow sub-/sibling- domains).

<comment><USER11> How would this be different than the CNAME cloaking[1] currently being used by data collectors to circumvent ad blocking software?

1\. [https://news.ycombinator.com/item?id=21604825](https://news.ycombinator.com/item?id=21604825)

<comment><USER12> I agree that this is the next step in the ad-tech / spy-tech war.

uBlock recently found an approach for blocking cnamed origins: [https://github.com/gorhill/uBlock/commit/3a564c199260a857f3d...](https://github.com/gorhill/uBlock/commit/3a564c199260a857f3d78d5f12b8c3f1aa85b865)

</comment></comment></comment><comment><USER13> I'm curious: is it technically and politically possible for the operators of all internet cables receiving traffic from China to filter _out_ malicious scripts?

AT&T's writeup says the injection is only possible because it's HTTP (not HTTPS), and that there are two specific JavaScript files which sometimes serve up the malicious code.

So in case of known malware like this being served from within a geographic region... is there any way to filter this out at scale? Or is that computationally infeasible at scale, so it would have to be built into the browser or something?

The article also doesn't make clear -- is this DDoS coming _exclusively_ from outside of China? Or is it injecting the same malicious code inside of China as well, and they're just not bothering to distinguish between requests coming from inside or outside the country? (In which case, the DDoS will continue regardless, just not with the rest of the world's help.)

<comment><USER14> >I'm curious: is it technically and politically possible for the operators of all internet cables receiving traffic from China to filter out malicious scripts?

Considering that the halting problem is undecidable, it's impossible to filter out the malicious scripts with complete certainty. The best you can do is use blacklists/heuristics which lead to an arms race.

>So in case of known malware like this being served from within a geographic region... is there any way to filter this out at scale? Or is that computationally infeasible at scale, so it would have to be built into the browser or something?

foreign ISPs can block port80 or http requests from coming into china. sure, it's going to break a lot of sites, but it's relatively simple for any site to get unblocked - all they need to do is set up letsencrypt.

<comment><USER15> > Considering that the halting problem is undecidable,

This doesn't mean that you can't prove a big subset of scripts safe.

> The best you can do is use blacklists/heuristics which lead to an arms race.

You can also allow the scripts that automatically prove safe, plus other popular scripts you decide to explicitly allow, plus other scripts that are low-rate enough that you don't believe them to be a concern.

</comment></comment></comment><comment><USER16> So if the cannon is created using the great firewall, how does the Chinese government establish any sort of plausible argument that this isn't state- sponsored activity?

Do they just not care?

Some day soon a war will not be started with an assassins bullet but with a tool like this. I wonder when we start looking at them the same way?

<comment><USER17> War seems to progress as follows:

0 - Peace 1 - Trade War 2 - Financial War 3 - Electronic War 4 - Shooting War

Note that 1 & 2 are different types of Economic war, and could be grouped together. The steps occur in order, but steps can be skipped.

From a US-centric point of view, North Korea and Iran seem to be at #3. China & Russia are at a limited version of #2.

Chinese/HK seem to be at #3 with each other.Given how invisible Electronic War can be, it's possible that they are deep in #3. It's also possible that #4 might be initially fought with HK Police forces as a proxy. Think of that as "4a".

<comment><USER18> I don't know who to attribute this to but I've heard a saying:

"Countries that trade with each other don't make war with each other."

As we isolate countries and disrupt trade we definitely are increasing the risk of conflict.

<comment><USER19> Yes, who cares about the forced labor camps and suicide nets around factories. I want my cheap plastic consumer devices!!

<comment><USER20> > Yes, who cares about the forced labor camps and suicide nets around > factories.

Nobody really cares, except for those directly involved. Sad but true, nobody will ever go to war for that, for foreign citizens.

> I want my cheap plastic consumer devices!!

People do actually want that. And their cheap shoes and clothes and...

</comment></comment></comment></comment></comment><comment><USER21> This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other solutions here such as restricting 3d party resources as a second layer defense once the user clicks through the first warning to access the HTTP content.

and in case I'm totally wrong, what mitigations are feasible? More trade war such as by compelling ISP's to null-route Chinese businesses like Baidu.com as a form of sanction?

<comment><USER22> I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand).

When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The email ended by stating that if I lost my password, they could "recover it" and send it back to me.

I raised a thread about it in one of their off-topic sections, and got harassed - "How secure do you need your browsing to be?" (And hey, I mean, I was asking them to do more work)

But it stands out that most of the public doesn't know, and doesn't care to know. Even a site that's populated by people with net worths and/or incomes that average in the six-to-seven figure range, that they probably signed up for with the same email address and password that they use for their bank and brokerage accounts.

HTTP should come with a warning. Furthermore, it would be fan-fucking-tastic if there was some generalizable way to (automatically) audit a website's security practice. Like, a crawler that just runs standard OWASP-style attack- vector checks, and sends an email to the site's owners when one succeeds. And then put that data into a database and warn users (with a browser plugin) when they are creating credentials for sites with bad security.

<comment><USER23> I'll top that. I used TABCPermit.com to get licensed to serve alcohol in Texas. Their signup form says "no special characters in password". I used one anyway, putting in "password$1" for example. It accepted it, and I worked on the test.

Next day, I can't login. I use the "forgot password" link. They send me and email, and it has my password in it! Bad, right?

That isn't all. My password, they said, was "password1". They silently stripped out the special character.

I just about flipped a table at how security-shallow people who build websites can be.

<comment><USER24> Are you sure your password has a $ in it? What makes you think that they don't strip the $ when you set and enter your password?

If it seemed like they were doing a hash then compare, I would wonder if they are using the legacy unix crypt that truncates passwords at 8 characters.

<comment><USER23> I know when I registered and typed twice that my password had "$" in it. And they mailed me back my password without it. Finally, it wasn't just a truncate because there were characters after the position where "$" should be.

And if they did strip it out, that is bad. That's the point.

</comment></comment></comment></comment></comment><comment><USER25> I didn't see this anywhere in the article (maybe I missed it), but because this utilizes the Great Firewall, it's undoubtedly done by the Chinese government, right?

<comment><USER26> No. "Behind the Great Firewall" is another way of saying "served from China". Perhaps -- or even most likely -- it is the government. But this is hardly a smoking gun. There are plenty of people on the mainland that hate what's going on in HK, and who are not the government.

<comment><USER27> This is not true, the traffic for the previous github incident with the great cannon was co located[0] with the great firewall (which is indisputably under the control of the chinese government).

[0] [https://citizenlab.ca/2015/04/chinas-great- cannon/](https://citizenlab.ca/2015/04/chinas-great-cannon/)

<comment><USER26> Colocated with the Great Firewall is an entirely different claim, and not one that ATT makes. Your citizenlab article provides a possible case for it, but that's a different discussion.

And even then, it could be some third party cache poisoning attack, etc. The citizenlab evidence would look exactly the same.

This is likely China, as I said, but let's not pretend that we know more than we do.

<comment><USER28> Why does it matter whether ATT made the claim?

</comment></comment></comment></comment></comment><comment><USER29> This is a good counter example for whenever you find yourself in an argument with anti-adblocker folks.

<comment><USER30> But these folks still have no answer for how free websites they consume daily (e.g. news) are to be funded, they don't pay, and don't want to see ads either. Yet they still expect these websites to exist.

I use Firefox's built Enhanced Tracking Prevention, that some sites call "ad blocking" but in reality it is super easy to have ads that don't get blocked by it, just make them non-creepy.

<comment><USER31> On the contrary, people pay for Netflix. People also pay for the ad-free upgrade to Hulu. Speaking to text websites, people are also using Brave, though I don't know how that experiment will work out in the end.

<comment><USER32> When it is reasonably priced, people will pay for legal alternatives. If there was a Netflix for paid websites, which would provide subscriptions in a convenient way to all websites in bulk, people would pay for that. Current options are:

> Manage subscriptions of 10 plus websites manually

> Pay by your privacy

It is clear that both options suck, so people opt in to ad blockers instead. Legal options are just overpriced for the demand.

<comment><USER33> Ad blocking is not illegal.

</comment></comment></comment></comment></comment><comment><USER34> DDoS attacks against business competitors are common and rarely punished in China.

Injecting ads/affiliate or whatever js in webpages, stealing social media tokens to do follower boosting business and selling optic fiber traffic dump is also common for Chinese ISPs.

</comment><comment><USER35> [https://outline.com/8BBX3b](https://outline.com/8BBX3b) due to obnoxious header and footer

</comment><comment><USER36> I can't read the OP because I'm using Tor, if anyone else is having similar issues wayback has it cached:

[https://web.archive.org/web/20191206074255/https://cybersecu...](https://web.archive.org/web/20191206074255/https://cybersecurity.att.com/blogs/labs- research/the-great-cannon-has-been-deployed-again)

Too often I cannot browse anonymously because people abuse Tor to aggressively scrape things. Don't do that!

</comment><comment><USER37> Can/shouldn't the rest of the world create a _Greater_ firewall to block the traffic from China?

Let China enjoy it's solitude and we'll enjoy our openness.

<comment><USER38> Yeah except we will effectively be cutting off _all_ outside information from the Cinese citizens, who already have to face incredible amounts of censorship.

Cut them off completely, and we will never find out about all the human rights violations taking place in their country, and their government will be able to brainwash its citizens even more easily.

<comment><USER37> I'm OK with that.

Today we're just finding about them, not able to do anything, so that won't be much different from the status quo but the benefits would be immense.

</comment></comment></comment><comment><USER39> > It is unlikely these sites will be seriously impacted. Partly due to LIHKG > sitting behind an anti-DDoS service, and partly due to some bugs in the > malicious Javascript code that we won't discuss here.

If I get the attack scenario right, valid user IPs from behind the great firewall are driving traffic to the webservers, and so what are some examples of anti-DDoS mitigations that are effective in filtering out the adversarial traffic?

<comment><USER40> Probably whatever Cloudflare uses, like JavaScript challenges.

</comment></comment><comment><USER41> That page generates no response for me, [https://archive.is/I1WO6](https://archive.is/I1WO6) does.

<comment><USER42> Thanks. For others using CTRL+F to find this link, some keywords... [ _archive, site down, 404, error page, mirror_ ]

Edit: better/cleaner version: [https://outline.com/8BBX3b](https://outline.com/8BBX3b)

<comment><USER43> Probably want to add the actual error code of 504 gateway timed out timeout

</comment></comment></comment><comment><USER44> I've wondered about this, in the years since.

Does anyone else have a sense of what (if any) pragmatic technical steps could effectively deter or neuter this tactic?

If the network can't demonstrate the ability to at least pump the brakes on this, it's hard to imagine other states or even the owners of large safe- monopoly ISPs won't get a little jealous of the tool.

<comment><USER45> Block all traffic from China?

<comment><USER14> Collateral damage aside, that doesn't really solve the issue. The attack goes something like this:

1\. non-chinese user visits a chinese site

2\. the traffic goes through the gfw, which inserts malicious javascript

3\. the user executes the malicious javascript and starts ddosing the victim site

Blocking chinese users won't help, since non-chinese visitors will still ddos your site.

<comment><USER46> If China is cut off, then people can't download the malicious JS either. Granted, it sets a pretty bad precedent and would have massive economic consequences.

</comment></comment></comment></comment><comment><USER47> I had no idea this thing existed but it's actually a smart and relatively straightforwards thing for the PRC to do, shitty as it is...

I was especially impressed with their getting the target to retrieve, resize and transmit an image: that's a smart way to waste time...

</comment><comment><USER48> It's bad that there are enough plain http connections for this to be possible.

<comment><USER49> Although Baidu does still default to HTTP, the Chinese government has the root certificates for every Chinese certificate authority. It can MITM traffic for anybody in China, even over HTTPS, so that wouldn't solve the problem.

<comment><USER50> Wow really? Any source for this ? That is like everyone can lock their house but gov has the master key.

<comment><USER49> I suppose I probably overstated the situation a bit. The PRC National Intelligence Law ( [http://cs.brown.edu/courses/csci1800/sources/2017_PRC_Nation...](http://cs.brown.edu/courses/csci1800/sources/2017_PRC_NationalIntelligenceLaw.pdf) ) requires, "Any organization or citizen shall support, assist and cooperate with the state intelligence work...", and China was observed making its own certificates for foreign sites before this ( [https://news.ycombinator.com/item?id=5124784](https://news.ycombinator.com/item?id=5124784) ), but there's no direct evidence that China actually has all the root certificates currently or has used them maliciously. Of course, the law requires citizens to preserve secrecy and Westerners can't observe what China is doing, so that wouldn't be unexpected.

</comment></comment></comment></comment><comment><USER51> > These attacks would not be successful if the following resources were served > over HTTPS instead of HTTP:

Can someone explain how using HTTPS would mitigate this attack?

<comment><USER52> HTTPS makes a MiTM attack much harder, because you need to have a valid cert for the host you are spoofing.

<comment><USER53> Doesn't the Great Firewall mandate (or at least strongly suggest) that those Chinese-controlled root certs are installed for devices behind it?

<comment><USER54> If this were a root cert, OSes and browsers could ban that CA. If you want this to work with SSL, giving the Great Firewall a domain cert would be enough.

</comment></comment></comment></comment><comment><USER55> The fact that you can see these malicious scripts being served directly from a Baidu domain is a good reminder that effectively all major Chinese tech companies are totally at the whim of the Chinese government.

It makes using any product / service from a Chinese based company basically never worth it just because of the security concerns.

</comment><comment><USER56> How about interrupting BGP traffic from/to China by nearby western AS everytime the Cannon is used?

<comment><USER57> What would happen if we black hole all of china's IP range from all over the USA?

I suspect that a lot of businesses would flex muscle on both sides to get that to stop really quickly.

It would be a hard policy to implement on our side, but likely very effective. Its almost like we need someone in power smart enough to ASK telco's and carriers to DO such a thing.

</comment></comment><comment><USER58> Browsers should prompt user and require confirmation before sucking down resources repeatedly in this way. Especially since this is grabbing images/content that are then not going to be displayed.

</comment><comment><USER59> I'm not experienced in DDOS mitigation techniques, but is it possible to redirect malicious traffic to the malicious JS-serving website?

Is this feasible/computationally worth it?

</comment><comment><USER60> If baidu.com is distributing the script, why is baidu.com not being flagged as malware by the various mechanisms used to block this kind of nastiness?

Are the vendors just cowards?

<comment><USER61> baidu.com is not distributing the script. A proxy is taking advantage of unsecure connections (http) to serve the malicious script instead of baidu's script.

<comment><USER60> It's 2019, what excuse does Baidu have to not support https for these scripts?

<comment><USER62> As far as I can tell many CDNs will gladly serve their scripts over HTTP if requested: [http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.mi...](http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js)

I don't know if what's the reasoning behind that.

<comment><USER60> When visited over HTTP that CDN sets "Alt-Svc: h3-23=":443"; ma=86400", telling the browser that (encrypted) HTTP3/QUIC is available.

If you ever manage to load that CDN over HTTPS/QUIC it sets a HSTS header so all further pageloads will go over HTTPS.

</comment></comment></comment></comment></comment><comment><USER63> Am I the only one disappointed this wasn't about someone refurbishing the Dardanelles Gun?

</comment><comment><USER64> What DDoS protection are they using? AT&T didn't say other than it was present.

<comment><USER40> I'd guess Cloudflare:

      $ nslookup -type=soa lihkg.com
      Server:  188.8.131.52
      Address: 220.127.116.11#53

      Non-authoritative answer:
      lihkg.com
       origin = kevin.ns.cloudflare.com
       mail addr = dns.cloudflare.com
       serial = 2032679273
       refresh = 10000
       retry = 2400
       expire = 604800
       minimum = 3600

      Authoritative answers can be found from:

</comment></comment><comment><USER65> I am still amazed by how genius of an idea this is to DDOS at large scale

<comment><USER60> The RPS isn't that great compared to some IoT botnets and this also gives the attacker rather limited control over the requests. It's a cool idea but I'm not really convinced that it's actually worth the trouble.

China has better tools, like XORDDoS.

</comment></comment><comment><USER66> and then the hacker news cannon took down att's site..

</comment><comment><USER67> The Chinese government attacks websites which support a free Hong Kong.

</comment><comment><USER68> Fuck the idea of the browser as interpreter for untrusted code.

</comment><comment><USER69> "Across the Great Wall we can reach every corner in the world."

</comment><comment><USER70> I see a lot of arguments for specific technical mitigations for the specific implementation of this attack. All these technical approaches are doomed to fail.

The attack uses network-level injection to add malware to HTTP requests for resources served from inside China. This malware then runs on hosts anywhere in the world and effectively DDoSes the targets. It is true that if these specific requests were made over HTTPS rather than HTTP, this particular attack would be mitigated.

Unfortunately the point that is being missed here is that if these resources had been served over HTTPS, this attack simply would have been implemented in a slightly different way. The suggested mitigations would work post-facto. However, if had they been in place prior to this attack, which is the alternative we have to consider, other means would have rendered them useless.

The fact is that any website hosted in China is directly accessible to the CCP for hosting these attack payloads. There is an ICP registration system and a chain of access to hosting environments that grants full network control and full access to any server to the authorities at any time they choose. Servers that are not part of this system are simply not allowed to host websites on the Chinese internet. Further, there is direct political control over every major internet company.

This is such a fundamentally different situation that it can be hard for American observers to understand what range of potential responses are meaningful.

The reality is that any network request that is served from China is fully within the political power of the CCP to alter. Whether this involves HTTP or HTTPS or whether implemented via the GFW or by direct changes to endpoints within internet companies is immaterial. Beyond the logistical costs of these actions within China, nothing of any consequence is changed by such minor technical mitigations.

What these attacks show is not just the capability but the willingness to use that capability in an offensive capacity against political targets.

The difference between the internet of independent sites in the US and the situation of near-total political control over resources on the network in China can hardly be overstated. This is why technical solutions that seem completely reasonable from an American perspective are pointless in reality. The threat model of the world's largest online population with all network resources under direct political control is simply too unfamiliar. If the political will exists to use those resources offensively, technical countermeasures will always be ineffective, unless they are so seemingly disproportionate that they become essentially political acts, like depeering.

Meaningful responses are those that affect the political willingness of the CCP to weaponize the internet. Weaponization will destroy the internet as we know it, and raising awareness before this kind of thing becomes routine may be the last chance we have to avoid it.

This is a political problem, and does not have a technical solution.

</comment><comment><USER71> Silent is not a consent.

</comment><comment><USER72> i get a 500.

</comment><comment><USER73> Interesting article, shame it happens to be on a site where undismissable hovering banners on the top and bottom of the screen gobble up 30% of real estate.</comment>


Elasticsearch end-of-life in Debian Stable - <AUTHOR> https://lists.debian.org/debian-security-announce/2015/msg00290.html <comment><USER2> Elasticsearch has provided their own package repositories since December 2013.

[https://www.elastic.co/blog/apt-and-yum- repositories](https://www.elastic.co/blog/apt-and-yum-repositories)

<comment><USER3> It's not a substitute to distribution-maintained packages. With no security support, you'll have to track and upgrade to the latest version. In contrast with other software, you'll have to upgrade your ES cluster (and potentially apply specific upgrade steps) several times a year.

<comment><USER2> I wasn't asserting anything here, just pointing out that there has been an alternative for almost 2 years.

It looks like ES separates repos by version[0], if that helps at all.

[0] [https://www.elastic.co/guide/en/elasticsearch/reference/mast...](https://www.elastic.co/guide/en/elasticsearch/reference/master/setup- repositories.html)

</comment></comment></comment><comment><USER4> Seems like Debian is getting more aggressive on EOL'ing specific packages' security support, and/or upgrading to new upstream releases in the stable distro, lately. There's been version bumps on mysql, php, openjdk and I think virtualbox.

At least we're getting security support(1), but it's a little concerning that more and more upstream vendors seem to leave long-term distros in the dust :-/ Is this a new development? I can't remember similar EOL announcements even just a year ago. Although better to actually announce this than letting packages linger unattended/unannounced...

(1) except php security support in wheezy is also already EOL'ed, before the usual wheezy EOL.

<comment><USER5> I feel like Debian has maybe finally cottoned onto the idea that it only really makes sense to do "transparently apply security upgrades"-style LTS support for packages that are actual OS infrastructure, because people are increasingly vendoring/containerizing anything that affects whether their app works.

In other words (presuming containerization): Debian LTS _is_ the thing you install a Docker daemon onto and then forget about. But Debian LTS is obviously _not_ for use as a container base-image (container-images don't auto-upgrade; and they can be QAed on each app release to ensure the app works with ABI changes of deps.)

Given those two facts, LTS support these days really only has to apply to things that will be run as part of the (from a developer's perspective) black- box abstraction that is "the OS", rather than considered a part of the "service and its dependencies" slug which gets versioned and deployed by the service-owner.

<comment><USER6> > I feel like Debian has maybe finally cottoned onto the idea that it only > really makes sense to do "transparently apply security upgrades"-style LTS > support for packages that are actual OS infrastructure, because people are > increasingly vendoring/containerizing anything that affects whether their > app works.

Or, for that matter, since Elasticsearch is written in Java, most Java developers just use Maven to pull in dependencies and don't even bother using the OS package manager.

<comment><USER7> I don't think the vast majority of us know how to.

</comment></comment></comment></comment><comment><USER8> For someone who's not terribly familiar with Debian's packaging system and policies, can someone explain this? Is it saying you'll no longer be able to type

`apt-get install elasticsearch`

in future Debian releases? Or is this something else?

<comment><USER9> this is kinda correct, you won't be able to get it like that out of the box anymore in jessie stable, but you will be able to get it in unstable or by adding back ports to your system.

they think it's too insecure to include in stable.

<comment><USER10> Not so much that it's "insecure" in general; more that upstream has made it infeasible for Debian to provide backported security patches for a stable version.

<comment><USER11> I'm not sure there's a difference in practice.

Sure it's not that there are known problems, but security isn't a thing you have or don't have; it's a process. If your process for identifying and fixing security flaws is broken, that's insecure.

<comment><USER10> Upstream is patching security flaws just fine. The problem is that you can't get the security fixes _alone_ ; they only come along with version updates, which Debian stable doesn't want.

<comment><USER11> I understand this; I'm saying that a security process that ignores users who value stability over the latest hotness _is_ broken for all use cases I actually care about.</comment></comment></comment></comment></comment></comment>


The misleading stream of articles about scientific studies - <AUTHOR> https://www.washingtonpost.com/news/in-theory/wp/2016/08/17/the-media-is-ruining-science/ <comment> chestnut-tree In the UK, the NHS website includes an excellent, regularly updated 'Behind the Headlines' section that scrutinises health stories reported in the press.

In fact the 'Behind the Headlines' site is a model of clear, factual, unfussy reporting - precisely what you _won 't_ find in the national UK press.

Sadly, the 'Behind the Headlines' site is probably far less read than the misleading newspaper stories it tries to debunk.

[http://www.nhs.uk/news/Pages/NewsIndex.aspx](http://www.nhs.uk/news/Pages/NewsIndex.aspx)

<comment><USER2> I think we could use a "Science News Snopes" service that evaluates the science stories that goes viral while they're still being spread.

We just need a few know-it-all scientists who can write, an office and a bit of funding!

<comment><AUTHOR> Ben Goldacre?

[http://www.badscience.net/about-dr-ben- goldacre/](http://www.badscience.net/about-dr-ben-goldacre/)

<comment><USER2> Looks like good work, but I'm thinking more of a rapid response system that will have something up within hours after "Gluten causes GMO in children" goes viral.

With the hope that the debunking can stop the growth before it's grown to full size.

<comment><USER3> It's a good idea. I suspect you will want this to be selectively applied though. Not that I know anything at all about your opinions or positions, but most people have holy cows they do not want questioned. Also, there is _A LOT_ of BS being published these days. Very nearly all biomed papers can be torn apart and dismissed after a day or two because they contain the same statistical and logical errors over and over.

</comment></comment></comment></comment></comment><comment><USER4> My alma matter is doing groundbreaking research on sexting. Never thought I'd see the day.

In all seriousness, it is a twofold problem. Yes, the media is partly responsible, but there is also a huge internal problem with the scientific and academic community (actually the article rightly brings this problem up): positive results are what net you publication; no one wants to hear negative results. However, if we actually want to progress scientifically, experiments that yield negative results are just as important, if not more important, than any positive ones. Unfortunately negative results and failed experiments just aren't sexy. They don't sell. They don't get people excited. As a result publishers don't want them and leave us with an overabundance of positive results, some of which are even gamed, which both skew the overall picture of scientific progress, as well as feed into promoting the sort of behavior on the media side this article calls out.

Another problem is, and again, the article does a good job by bringing this up, the major barrier of entry preventing the average joe from reading publications directly rather than reading the digestible media summary of their findings. I think it stems back to an education problem. In an ideal world we'd be able to educate everyone to a certain level of scientific literacy which would at least enable the everyman to decipher some of the more arcane jargon of respective scientific fields, but I'm not entirely sure an educational program that might achieve this is even possible.

Luckily, I do know, that as of at least about a year ago, this very problem was at the forefront of work in the philosophy of science, and many philosophers and practicing scientists alike are (or perhaps were) doing what they can to try and devise ways to clean up the system a bit, improve peer review practices, etc. It's not an easy problem. The scientific community in all its aspects is quite a mangy beast.

<comment><USER5> It might be helpful to mandate every submission to an academic journal to be accompanied with a maximum 800-word "layman's summary" that will be directed at the media and the public. Something more comprehensive than the Abstract/Preface without any terms that wouldn't be known to the general public.

<comment><USER6> This sounds like a good idea. But, it may not be possible in most of the hard sciences. Imagine writing an 800-word layman's summary for some results in string theory.

<comment><USER7> Unless string theory all of a sudden gained everyday applications i think i would aim for fields like biology, chemistry and similar first.

<comment><USER8> Yes, biology makes the most sense, as thats usually what gets "translated" to clickbait style headlines like "Quinoa cures cancer".

<comment><USER7> This week i read a headline that could be interpreted as saying green tea would prevent zika infections.

In reality it was a chemical of some sort found in green tea (and elsewhere) that seemed to counteract zika. But it required concentrations that you would never find in nature.

</comment></comment></comment></comment></comment></comment><comment><USER9> I know the inclination is to change link baity headlines but I think the original hed, "The media is ruining science", is far more to the point than the current hed, "Scientific community making an effort to end the stream of misleading articles". The problem is most definitely rooted in the media, which not only disseminates misinterpretations, but also provides harmful incentives to scientists and journals to cheapen their work.

Furthermore, unlike what the current hed implies, there's not much evidence that there's a concerted systemic effort by the scientific community to fix this, nevermind "end" it. I'm not saying they don't _want_ things to improve, I'm saying I don't see a concerted, organized effort to make significant improvement.

<comment><USER10> Isn't blaming everything on the media a bit too one-sided and simplistic?

We live in an era where diversity of media sources have exploded. Media companies compete fiercely with one another for clicks, readers, and ad revenue.

Perhaps the root problem is the media behaves the way it does because its _consumers_ and the structure of the market makes it impossible for it not to.

 _TL;DR_ : click-baity and inaccurate news exists as a reflection of consumer preference

<comment><USER11> Feedback loops strike again.

The fault is in the interaction between media and the audience. People tend to react better to some content than to another, which leads to that content making more money, which leads to more of such content. The process is optimizing for exploiting cognitive biases and heuristics the audience uses.

Now the question is - what's easier to tackle? Issues with brain architecture that would require medical interventions we barely can imagine to correct, or business incentives of the media companies?

<comment><USER12> Aren't both brain architecture issues?

Corporate incentives are built around converting avarice into societal progress and a are incentivized to find the shortest path to that profit.

It's probably easier to make laws for one of those scenarios though.

<comment><USER11> A bit, yes, because the actors are humans too. But the core of the issue is more game-theoretic - shareholders cannot all coordinate to avoid taking some "shortest paths" that end up with unwanted consequences. Tackling this, hard as it is, is still easier than rocket neurosurgery.

<comment><USER12> By this would you mean things like business incentives and tax breaks?

</comment></comment></comment></comment></comment></comment><comment><USER13> This is not just limited to science articles, and it's very serious because it leads to people walking around with incorrect and often very dangerous ideas about fitness, diet, politics, and just about every aspect of the world.

I think the solution will be media outlets that not only insist on honest reporting, maintain high standards, and admit mistakes, but that dedicate a lot of their space to directly and savagely mocking unscrupulous reporters from other outlets for their shoddy reporting or purposeful disinformation.

<comment><USER14> So much this.

I've been looking at a slew of issues, starting from the question "what are the big problems?". Without getting into what I've concluded (and find considerable agreement, as well as some disagreement) on what the big problems are, there's the _dynamics_ behind these.

The slogan I'm blogging behind is "Progress, Models, Institutions, Technology, Limits. Interactions thereof".

It's the interactions _especially_ between Institutions, including the media, politics, commerce, religion, and education, and our Models -- the theories and frames we carry with us as to how the world works -- that strike me as most critical.

I'm not limiting this to scientific models, but _every_ crazy idea people have as to how and why the Universe is the way it is and does what it does.

But yes: one consequence is that we end up with people who have very incorrect and very dangerous ideas. In positions of extreme power -- heads of companies, leading popular movements, on radio and television, as heads of state.

The history of the concept of "the marketplace of ideas" is an interesting one (as well as its own interplay with concepts of free markets, and of "free market" as "completely unregulated market"). It's a tangled, tangled, tangled web.

We also find many of the same people and organisations turning up. Adam Smith. John Stuart Mill. Oliver Wendell Holmes. The Mont Pelerin Society. And more.

Makes you wonder.

</comment></comment><comment><USER15> >There's also the legitimate concern about what happens if methodologies come out with null results — that is, if the only result a study can produce is to prove the hypothesis incorrect. Such a paper could end up being extraordinarily boring or not answering the essential question at issue. Imagine a headline like: "We don't know which gene puts you at a greater risk of depression, but we're pretty sure it's not the gene we thought it was."

Isn't that the whole point of correcting for publication bias? The reporter saying that boring results are a problem seems to perfectly capture the actual problem.

</comment><comment><USER16> The science news cycle, illustrated by PHD Comics: [http://www.phdcomics.com/comics/archive.php?comicid=1174](http://www.phdcomics.com/comics/archive.php?comicid=1174)

</comment><comment><USER17> Other articles recommended to me at the end of this article

* Trump is entirely delusional about why he's losing. His new campaign shakeup proves it.

* Our robot panic is overblown

It seems like fixing the editorial problem is more fruitful than having researchers obfuscate their findings.

<comment><USER18> I'm fully confident that we're going to look at the robot/AI panic the same way we do the Satanism panic of the 1980s. Its almost completely irrational but touted by enough influential individuals to be believable.

Its weird to witness live mass hysteria like this.

<comment><USER19> Were there as many high-profile (respected?) people involved with the Satanism panic as with the 'AI panic'? Honest question.

</comment></comment></comment><comment><USER20> A thought I've had is for journals to require two abstracts for a paper. The first is the traditional one, directed towards a technical audience. The second is akin to a press release, expressing the scientist's own summary in terms that a layperson can understand, including an assessment of the robustness of the result. For instance, "this result needs further work to establish its reproducibility."

Of course a journalist can still give their own take on it.

<comment><USER21> _PNAS_ (probably the highest-impact science journal) has something like this. Every Proc. Natl. Acad. Sci. paper has an abstract, which can be quite technical and intended partly for insiders, but also a "Significance" statement, which is highlighted at the top of the article, is limited to 120 words, and is intended as a near-layman summary of the article. From the author guidance:

"Authors must submit a 120-word- maximum statement about the significance of their research paper written at a level understandable to an undergraduate- educated scientist outside their field of specialty. The primary goal of the Significance Statement is to explain the relevance of the work in broad context to a broad readership. The Significance Statement appears in the paper itself and is required for all research papers."

Example: [http://www.pnas.org/content/early/2016/07/27/1603632113](http://www.pnas.org/content/early/2016/07/27/1603632113)

<comment><USER22> Doesn't _Science_ have a similar feature for articles published in it? A short, educated-layman-level summary of the meaning of the work?

<comment><USER21> Yes, _Science_ partly does this too (I'm a subscriber). They have relatively simple abstracts that try to serve both purposes -- summary for laymen and experts -- but they are tilted more towards a non-specialist summary. The layout of _PNAS_ really emphasizes the Significance statement.

The best thing about _Science_ for outsiders is the "Perspective" article that sometimes accompanies high-profile research articles. The "Perspective" places the more in-depth research article in context. It can be more valuable for an interested non-specialist than the research article itself.

</comment></comment></comment></comment><comment><USER23> I think many times the researchers authoring the original articles merit as much scrutiny as the journalists who report on them. In the US at least there are many incentives to publish eye grabbing results, often at the cost of scientific rigor.

Some of the most successful research groups I know spend a significant amount of time essentially maintaining a brand and consistent message. The brand and reputation of the group is incredibly important for obtaining funding. You can bet if a study finds something off message or fails to reject the null hypothesis it will be set aside and not reported. So while journalists have an incentive to report the most novel and eye-catching results, that motivation has definitely trickled down to the level of guiding research inquiries and influencing data analyses.

</comment><comment><USER24> The only thing that is going to change anything is if the consequences of 'misleading' articles being published on your work is you don't get anymore funding, or your current funding is clawed back (this would be more effective since the administration would have a fit). Only money will stop this problem.

</comment><comment><USER25> better headline: popular science journalists also racing to the bottom just like every other kind of journalist

</comment><comment><USER26> The irony of the Washington Post.</comment>