WireGuard Merged into OpenBSD - <AUTHOR> https://marc.info/?l=openbsd-cvs&m=159274150512676&w=2 <comment><USER2> WireGuard project announcement is here: [https://lists.zx2c4.com/pipermail/wireguard/2020-June/005588...](https://lists.zx2c4.com/pipermail/wireguard/2020-June/005588.html)

<comment><USER3> What's the performance situation of the wg-go implementation now? I recalled there's a utun device API limitation that each packet requires a syscall. Is there any progress to avoid the overhead?

<comment> vertex-four I imagine that io_uring or similar work could help here - provide the kernel with a submission queue and a completion queue once, and just keep feeding it buffers to fill without syscalls.

<comment><USER3> That's what I'd assume but I've never seen anyone doing that yet.

<comment> vertex-four That would be because io_uring is incredibly new and I don't think the tuntap driver supports it yet.

</comment></comment></comment></comment></comment><comment><USER4> Just great!

Hope to release wireguard on FreeBSD soon as well.

In order pfSense to include it: [https://redmine.pfsense.org/issues/8786](https://redmine.pfsense.org/issues/8786)

<comment><USER5> > _Hope to release wireguard on FreeBSD soon as well._

Available as a Port / package:

* [https://www.freshports.org/net/wireguard/](https://www.freshports.org/net/wireguard/)

* [https://www.freshports.org/net/wireguard-go/](https://www.freshports.org/net/wireguard-go/)

Running it in a jail for further compartmentalization:

* [https://genneko.github.io/playing-with-bsd/networking/freebs...](https://genneko.github.io/playing-with-bsd/networking/freebsd-wireguard-jail/)

* [https://news.ycombinator.com/item?id=23004061](https://news.ycombinator.com/item?id=23004061)

<comment><USER6> GP is referring to the kernel implementation that is a work-in-progress.

<comment><USER7> A kernel implementation also in development on NetBSD:

[https://github.com/ozaki-r/netbsd- src/tree/wireguard](https://github.com/ozaki-r/netbsd-src/tree/wireguard)

</comment></comment></comment></comment><comment><USER8> I've always wanted to run OpenBSD for our Wireguard bastion host (the one machine that is "open". Not sure it makes a difference over Linux but OpenBSD has an even stronger security culture.

Was satisfied with the state of affairs before but genuinely excited about this development.

<comment><USER9> OpenBSD has a different security culture. "Stronger" hasn't been the right word in over a decade.

<comment><USER10> What do you mean?

<comment><USER11> OpenBSD has historically been eager to add new security mitigations without explaining their intended threat model.

Here's an excellent talk (in website form) on the subject: [https://isopenbsdsecu.re/about/](https://isopenbsdsecu.re/about/)

<comment><USER12> I dont think that website is very compelling. It claims a bunch of things as not good practise, and then asserts without evidence or example that openbsd does them.

Quite frankly it reads like someone with an axe to grind against openbsd.

<comment><USER11> > I dont think that website is very compelling. It claims a bunch of things as > not good practise, and then asserts without evidence or example that openbsd > does them.

Here's a material example: OpenBSD has expended considerable effort into removing ROP gadgets from their compilation products[1].

As the website documents[2], these efforts haven't made a single exploit harder to write.

GCC even removed their (mostly equivalent) ROP mitigation approach, documenting it as "fairly ineffective" and "lur[ing] developers to the land of false security"[3].

(Another good example is PID randomization: OpenBSD added this over 20 years ago as part of their "randomize anything that can be randomized" approach. It's never had any real positive security impact, and has made _other_ PID- based vulnerabilities more viable.)

[1]: [https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf](https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf)

[2]: [https://isopenbsdsecu.re/mitigations/rop_removal/](https://isopenbsdsecu.re/mitigations/rop_removal/)

[3]: [https://patchwork.ozlabs.org/project/gcc/patch/CAFULd4ZL- wa3...](https://patchwork.ozlabs.org/project/gcc/patch/CAFULd4ZL- firstname.lastname@example.com/)

<comment><USER13> I agree some OpenBSD security mitigations are dubious, but if I am forced to choose between Linux (too little) and OpenBSD (too much), it seems to me OpenBSD is definitely preferrable. (Of course, the best is to implement only effective ones.) Do you disagree?

<comment><USER11> I think that Linux is a security mess in its own ways.

That being said, I think Linux's guts get _far_ more attention than OpenBSD's do, and that the (fewer) mitigations that Linux chooses to implement are much better supported by both information on real-world attacks and by the literature. Given that, I have a slight preference for Linux. But that shouldn't be taken as praise.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Very good call from the OpenBSD project to include this in their kernel.

</comment><comment><USER15> WireGuard: [https://en.wikipedia.org/wiki/WireGuard](https://en.wikipedia.org/wiki/WireGuard)

</comment><comment><USER16> Incredible, so excited to see wireguard start making it into mainstream distros.

Personally I see this as the most exciting thing to happen to linux in the past 2 - 3 years.

<comment><USER17> Enthusiasm noted, but OpenBSD is not Linux.

<comment><USER18> My guess is that GP is referring to WireGuard, not this specifically.

</comment></comment></comment><comment><USER19> Congratulations to the team on this successful integration into OpenBSD.

I'm really pleased to see ongoing Wireguard integration in all the big platforms.

The setup is so simple, I route all my personal traffic through a simple cloud based WG + Pihole setup.

</comment><comment><USER20> Why does WireGuard need to be a part of the kernels for BSD, Linux, and I assume other OSes? Is OpenVPN the same way? Why can't it be part of userspace?

<comment><USER21> It doesn't need to be, a userspace implementation is available.

</comment></comment><comment><USER22> Does the underlying crypto in WireGuard lend itself to hardware acceleration/implementation in ASICs? If so, when do we expect to see such devices available?

<comment> 867-5309 I believe Wireguard is up to 4x faster than OpenVPN where OpenVPN uses AES-NI. processors with this instruction set is possibly the closest thing to an ASIC for VPN en/decryption, so I dare say Wireguard will neither need nor benefit from a purpose-built instruction set

<comment><USER23> AES is as fast or faster than ChaCha if there is hardware acceleration. OpenVPN is slow for other reasons, and honestly the crypto is usually not the bottleneck in most cases unless you are really pushing multiple gigabits or it's a very small CPU.

<comment><USER24> This is definitely not true, chacha20 is frequently faster than AES even with AES-NI in use, especially on earlier implementations of the instruction extension.

<comment><USER23> I'd like to see some numbers on this. I'm sure there are some chips where it's the case but are we talking small ARM cores or larger desktop and server chips?

</comment></comment></comment></comment></comment><comment><USER25> still waiting for wireguard to be TCP based so I can use it in large corporations, many of who don't dig stateless udp in their firewalls.

<comment><USER12> Wat?

If wireguard doesn't meet your requirements, don't use it, but its kind of rediculous to complain it doesn't do X when doing X would defeat the point of the software.

</comment></comment><comment><USER26> I'm confused about their mention of Go. The Linux implementation of WireGuard is written in C - [https://git.zx2c4.com/wireguard- linux](https://git.zx2c4.com/wireguard-linux)

<comment><USER27> OpenBSD doesn't want any GPL code, so they couldn't just port the Linux kernel module.

The OpenBSD kernel module is also written in C: [http://cvsweb.openbsd.org/cgi- bin/cvsweb/src/sys/net/if_wg.c...](http://cvsweb.openbsd.org/cgi- bin/cvsweb/src/sys/net/if_wg.c?rev=1.3&content-type=text/x-cvsweb-markup)

But the code looks quite different from [https://git.zx2c4.com/wireguard- linux/tree/drivers/net/wireg...](https://git.zx2c4.com/wireguard- linux/tree/drivers/net/wireguard?h=stable)

<comment><USER2> This has nothing to do with licensing. OpenBSD is a different kernel, so different code. Having written the Linux code, I relicensed any similarities between the two to make it amenable to OpenBSD, and remove any doubt about status.

<comment><USER28> Is it possible to create kernel modules for both OpenBSD and Linux with common code that's licensed appropriately? Something like a library with two kernel API glue layers, one for Linux GPLed and one for OpenBSD.

<comment><USER29> My impression about the goal of Wireguard (mind you, I haven't looked at the code) is that it's to be as simple as possible, reusing as much of the primitives the OS offers without reinventing the wheel.

That goal may be antithetical to a single codebase supporting multiple (possibly very dissimilar) operating systems.

It's interesting to compare this approach to the approach taken by OpenSSH (and its openssh-portable variant). One has code specific to each OS, the other one has one canonical codebase for one OS + patches addressing compatibility with other OSes. IMHO mostly due to the difference in complexity of each project.</comment></comment></comment></comment></comment>


Ask HN: Bookmarklet library + community - <AUTHOR>

I find myself making quite a few bookmarklets to make my life easier and funnily enough, there's a bookmarklet to submit to HN as well. Does any one know why there isn't a community where people can submit bookmarklets and have other's vote on their usability. I guess Greasemonkey / tampermonkey is one way to do this. Any ideas? <comment><USER2> I make bookmarklets all the time as well. Let's just start sharing and see where it goes, what do you say? Github w/ a wiki / readme's would be a great and easy way to start this without requiring much effort.

I have hundreds of them...

<comment><AUTHOR> that sounds great! let's connect over email and get this started? email@example.com

</comment></comment><comment><USER3> Reddit does have some subreddits that deal with this. And Nuuton will have that functionality once it gets out of ALPHA (in about 6 months).

</comment><comment><USER4> greasemonkey/userscripts/tamper etc are ways but not really user friendly for masses/non-programmers. ping me over email if you'd like</comment>


Ask HN: Is OLAP/SSAS data just a buzzword for 99% of companies? - <AUTHOR> I think the growing number of requests from recruiting agencies for developers with OLAP/SSAS/Cube experience/knowledge may have a lot to do with how Microsoft (and others) are pushing this as part of their database "stack", even though 90% (tbh I think it's closer to 99%) of the companies who ask for this skill will never actually need OLAP databases. I could be wrong, but it does feel to me like it's a buzzword that doesn't really have a huge amount of practical use in most companies. I do a lot of SQL work and constantly get requests for SSAS from medium-tier companies in sectors like law, design, media, insurance. <comment><USER2> OLAP/MOLAP/ROLAP are interesting technologies to BI folks. Companies say they want to do more BI/analytics, and DBAs/BI managers see an opportunity to get experience with some cool tech, so they say that's the correct path. Now they've got it, even if some indexes and query tuning on a regular DB would have been fine, and want someone who can support it.

And if you think OLAP is unnecessary, you should see how many devs brought in Hadoop unnecessarily.

</comment><comment><USER3> No. Buzzwords have a short shelf-life and it has passed for OLAP and SSAS [actually, maybe not -- no idea what that is].

I don't know the term for expired buzzwords, though! They do turn people away.

<comment><AUTHOR> Where I live, buzzwords probably a longer shelf-life than normal. Also, industry tends to become aware of buzzwords a few years later than everyone else so the dynamic is a little different there.

<comment><USER4> I don't think that OLAP and SSAS were ever known buzzwords ^^</comment></comment></comment>


The Left's Intensifying War on Liberalism - <AUTHOR> http://dish.andrewsullivan.com/2015/01/27/the-lefts-intensifying-war-on-liberalism/

<comment><USER2> Great article, though I don't quite understand why it was posted _here_ of all places.</comment>


Search Lookaside Buffer: Efficient Caching for Index Data Structures [pdf] - <AUTHOR> http://omega.uta.edu/~xxw4571/papers/slb.pdf <comment><USER2> This seems to be the implementation: [https://github.com/wuxb45/LMDB- SLB](https://github.com/wuxb45/LMDB-SLB)

Looks like it is effective for small data sizes and pure read-oriented workloads with heavy key distribution. Not sure whether this could work well for writes and uniform random distribution.</comment>


Competitive equity % for a well funded startup? - <AUTHOR> Are there any current resources outlining a competitive equity stake in a well-funded series C startup? This is for a principal-level software engineering position.<p>If there are no good resources, does anyone have any anecdotal thoughts on the subject? <comment><USER2> The value of equity depends on whether or not a person has the capital to exercise their options, the liquidity of the market for the stock after exercise, and the value of the stock at the time of exercise discounted by the time value of money and the risk of the options not being worth exercising and the risk of the options not being exercisable.

Oh, and the existing cap table and the financial roadmap for its evolution.

Guessing at the existing value is improved by consultation with one's lawyer (to examine the contract), one's accountant (to examine the capital structure) and one's financier to project the employee's future wherewithal to exercise options.

Good luck.</comment>


Apple is finally allowing developers to sell their apps to other developers - <AUTHOR> http://venturebeat.com/2013/06/11/apple-is-finally-allowing-developers-to-sell-their-apps-heres-why-and-how/

<comment><USER2> This deceptively little tidbit of change is probably the most important news on frontpage right now.

<comment><USER3> Arrrgh! Sorry - I impulsively down-voted you out of sheer bewilderment that anyone could possibly think that selling an app is more important than a systematic and widespread government invasion of civilian privacy. But your comment is not (necessarily) a troll, just different to my opinion - so I should have just replied saying so instead of disagreeing via rage-downvote.

<comment><USER4> _impulsively down-voted you out of sheer bewilderment that anyone could possibly think that selling an app is more important than a systematic and widespread government invasion of civilian privacy_

But not _every_ story about PRISM is important or even telling us anything new. Reflexively upvoting any story that has to do with the government being "bad" is just going to fill the front page with a lot of repeated info (at best) and speculative nonsense (at worst).

<comment><USER5> ...and this neatly explains the "all politics, all the time" nature of HN for the past week. :/

</comment></comment></comment></comment><comment><USER6> This is great. I have a single free app I have no interest in updating, but which I am forced to pay apple £60/year to keep on the store, both for new and old users. Now I can 'park' it with a friend still involved in iOS development.

</comment><comment><USER7> I did an app transfer yesterday and it was a shockingly smooth & painless process. The system updated in just a couple of hours.

<comment><USER8> Do the users get some sort of notification of the change, or is the only difference to them the "made by" label in the App Store?

<comment><USER7> As far as I can tell, the only thing the users will notice is a change in name of the _Seller_ in the app store listing if they care to notice; there is no active notification to users. The copyright info and date last updated remain the same.

</comment></comment></comment><comment><USER9> I'm curious what people think of existing marketplaces.

If you're thinking of selling an app, do you feel like the tools are there to find buyers and perform the transaction?

</comment><comment><USER10> Easy app transfer is potentially a huge secondary market for app developers and the market for "app flipping" could become a very lucrative opportunity for devs.

<comment><USER11> How so? What profits could a flipper look forward to?

In other words, does "app flipping" exist in the Android space (which, given the lack of restrictions, would allow/encourage this)?

<comment><USER10> Well there is money to be made on either side. You, could as a dev get good at at building apps quick and turning around and selling them at some potential revenue multiple. As a buyer, you might be able to buy something cheap that pays for itself over some short period of time if maybe you are decent at marketing or something.

I think it exists in both iOS and Android. I haven't looked into it enough to see which is more valuable, but the possibilities are there.

</comment></comment></comment><comment><USER12> You could always sell your app, I had to do this a number of times, when I was working on apps for other companies. It just involved a few emails in the past.

<comment><USER13> Did each app have its own developer account? I think the hard part was if you had three apps and wanted to move one to a different developer.

</comment></comment><comment><USER14> The idea that this is Apple's business whether to allow shows the whole thing to be corrupt.

</comment><comment><USER15> This title is not accurate. You could always sell your code and assets but you would have to recompile and resubmit whereas now it stays live through the transfer.

<comment><USER16> Depends on what you consider to be the "app". The procedure you describe means the app gets a new name, a new bundle ID, means that no existing purchasers get a copy of the newly submitted app, no automatic upgrades, user settings are not migrated, no reviews transfer over, etc.

<comment><USER15> Yes, this is definitely better for the users as well as the developers.

</comment></comment></comment><comment><USER17> And they get a % cut of transfer _sale_ amount, just like 30 or 33% or so of all app purchases by end users?

</comment><comment><USER18> They've given up on thinking the iPhone is something special. Rightfully so.

<comment><USER19> Right, I'm sure that's how the decision making process went.</comment></comment>


Ask HN: Saved stories and saved comments not working? - <AUTHOR>

Both pages are saying "No such user." for me. Anyone else having this issue? <comment><USER2> Whoops—that was fixed but the fix wasn't deployed. Sorry about that. It should work now.

</comment><comment><USER3> I already emailed a bug report about it.

For notes, the HN Guidelines ask us to email email@example.com rather than posting stuff like this:

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment>


Receiving images of Earth from satellites with software defined radio - <AUTHOR> https://l-o-o-s-e-d.net/signs-of-life <comment><USER2> I feel that GOES satellite imagery is a hidden gem, I'm surprised more people aren't working with it.

The imagery is available at [https://www.star.nesdis.noaa.gov/GOES/](https://www.star.nesdis.noaa.gov/GOES/) but is better explored at [https://rammb- slider.cira.colostate.edu/](https://rammb-slider.cira.colostate.edu/)

I have personally built a Twitter bot to collect and animate imagery throughout the day. I have it running for two locations currently.

Continental US: [https://twitter.com/satellite_CONUS](https://twitter.com/satellite_CONUS)

NorthEast US: [https://twitter.com/satellite_NE](https://twitter.com/satellite_NE)

It's amazing to see storm formation visually.

<comment><USER3> That is very cool, thank you. I just sat there and stared at it and had a Pale Blue Dot moment. This thing is so beautiful and here we are fighting about everything.

</comment></comment><comment><USER4> This is surprisingly easy to do with some cheap hardware[0]. There is plenty of information if you just search something like "NOAA RTL-SDR." Building the antenna is the most labor intensive part, but still very easily done. I haven't personally, but it's on my to-do list for this summer.

[0] [https://www.rtl-sdr.com/rtl-sdr-tutorial-receiving-noaa- weat...](https://www.rtl-sdr.com/rtl-sdr-tutorial-receiving-noaa-weather- satellite-images/)

<comment><USER5> I would say it's one of those ruses where it's easy to get basic results, but you can spend (tens of) thousands of dollars and years of learning and refinement to achieve anything approximating error-free results.

It's a lot of fun though. Diving into SDR really opens up a new dimension of reality to you and lays bare the magic that can happen when you are able to directly apply complex mathematical constructs to real data coming out of a wire attached to, well, nothign.

I got a little obsessed with it actually and had to step away from it for a while lol.

<comment><USER4> > I got a little obsessed with it actually and had to step away from it for a > while lol.

Same here. I burnt a ton of time just scanning for voice communications and analyzing ADS-B. Once you start playing around in GNU Radio and decoding more exotic stuff, you really start going down the RF rabbit hole. It's an amazing hobby for learning about electronics.

<comment><USER6> > Once you start playing around in GNU Radio and decoding more exotic stuff

Do you have any tips or resources on how to get to a competency level where you get to decode arbitrary digital signals you find from a scan?

I've read through all the GNU Radio documentation, along with the examples on their wiki and have even written my own blocks but keep finding that opening a grc file that someone else authored, there will be a critical block I've never seen before (and likely, never see again) which hampers experimentation. As soon as I attempt to decode a real-life signal, it feels like I dove in too fast -- there's too many unknowns, since the end result is [presumably] not going to be a nice, human-readable string. However, occasionally, I find challenges like [1] which are great, since you have the expectation that the signal _can_ be decoded; it's just that I've found examples like these to be quite rare.

[1] [https://www.gnuradio.org/blog/2018-02-21-gnu-radio- challenge...](https://www.gnuradio.org/blog/2018-02-21-gnu-radio- challenge-21-feb-2018/)

<comment><USER5> Not the person you asked but once gnuradio flowgraphs started to function materially outside of basic flowgraph blocks stitched together, or worse, wrapped by some python script, I would have to tap out.

It's one thing to demodulate some manchester encoded OOK/FSK signal from some ISM-band hardware monitor vs. 64-QAM or GMSK. At some point it, to me, becomes indistinguishable from magic. Fluency in DSP is, IMHO, mandatory to be broadly effective with GNU Radio.

<comment><USER7> I'm fairly fluent in both DSP and software, and find GNU radio indecipherable.

A plain C/C++ implementation is often so much clearer than a flow graph built in python.

<comment><USER5> Copy that. By far the most informative bit of dsp code for me was the core libraries in SDRSharp.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Somewhat related. For those who are new to SDRs, you can easily view airplane altitude, heading, speed, and other stats of passing aircraft with a cheap SDR. Aircraft transmit this using ADS-B and it's totally open and unencrypted.

FlightAware (among other services) work by aggregating data from users around the world. You can even get a free premium subscription to their service by contributing. Easiest way is to use a Raspberry Pi, install their software (much easier now than back in 2013!), and you're good to go!

<comment><USER9> I've said this before, but the first time I hooked up an RTL-SDR and tuned it to 1090 and saw live air traffic, I was awestruck. Sure the same info was available on flightaware, but something was special about being able to retrieve it myself.

</comment></comment><comment><USER10> Anyone interested in how SDR works/is implemented: the book "Software defined radio for engineers" is the only book I've come across that combines DSP and SDR in the right ratios (Proakis's DSP book is bad if you want to build things straight away)

</comment><comment><USER11> You can also look into receiving weather forecast from the sky: [https://forums.othernet.is/t/wiki-pages-for-the-othernet- dre...](https://forums.othernet.is/t/wiki-pages-for-the-othernet- dreamcatcher/5314)

</comment><comment><USER12> A few posters have mentioned this being accessible with inexpensive hardware. Any tips on how someone starts getting into SDR stuff?

<comment><USER13> Buy this [https://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/](https://www.rtl- sdr.com/buy-rtl-sdr-dvb-t-dongles/) (even available on Amazon)

Use gqrx to listen to the radio, public services / air traffic (if legal where you are. Great fun at airshows), ham radio operators etc [https://gqrx.dk/download](https://gqrx.dk/download) \- requires minimal knowledge to get started (select device, put in frequency, mode (AM or FM) and that's it. Just play). Great time:benefit ratio so far.

There's an excellent video series focusing on SDRs at [https://greatscottgadgets.com/sdr/](https://greatscottgadgets.com/sdr/)

Then use gnuradio to build your own receiver from predefined blocks.

Start with above cheap receive only SDR, but when you want to transmit, buy a HackRF. You do need a ham radio license to transmit. It's not hard (not even highschool level math). Even if you don't do the license, have a look at the materials linked at [https://blog.hamstudy.org/links/](https://blog.hamstudy.org/links/) , specifically the linked book (free PDF or paid printed). The fundamentals are excellent and it picks you up where most people are (high school math skills, no idea about RF). If you speak German, the best resource is [https://www.darc.de/der-club/referate/ajw/darc-online- lehrga...](https://www.darc.de/der-club/referate/ajw/darc-online-lehrgang/) (also available as printed book)

At that point you should have a better idea where to go, and even enough background to read "real" books like [http://www.dspguide.com/](http://www.dspguide.com/) (the math is harder of course). DSP is what SDR is all about in the end. But also other radio related books, like the ARRL antenna book.

(There are alternatives to everything of course, but with above recommendations you will not go wrong.)

<comment><USER14> Not sure why you would create a throwaway account to post this invaluable information.

<comment><USER15> It's a 4 month old account, not created to just post this.

</comment></comment></comment></comment><comment><USER16> Can't hack the dense, overly-arty prose.

<comment><AUTHOR> Haha I do apologize for my writing style. Trying to work on that.

</comment></comment><comment><USER17> The title first suggested that the article is about a security vulnerability of a satellite. The DoD actually held a CTF recently focused on the security of space systems. Information is on [https://www.hackasat.com/](https://www.hackasat.com/) I'm looking forward to the public release of the exercises from the qualifying round which will be on June 19.

</comment><comment><USER18> This is incredibly cool!!! Kind of had a similar weekend RTL SDR project in the back of my mind for quite a while but like a lot of things lately, it's been a classic case of kicking the can. I really wish I could dig up some motivation from somewhere(in general, not just this).

<comment><AUTHOR> It certainly takes time and dedication to go through the steps, but I'd recommend The Thought Emporium for getting started: [https://youtu.be/cjClTnZ4Xh4](https://youtu.be/cjClTnZ4Xh4)

</comment></comment><comment><USER19> So, if people say here that plenty of folks receive satellite imagery, are there projects to assemble a complete map of the planet and have it continually updated? As in, you know, a satellite view for OSM.

<comment><USER19> Though, if this imagery is the same as what's on [https://rammb- slider.cira.colostate.edu](https://rammb-slider.cira.colostate.edu) — then its resolution is apparently on the level of 'I can see mountains'.

</comment></comment><comment><USER20> During the Falklands War the Norwegians gave the UK a constant stream of images obtained from Soviet spy satellites that gave very good information on the position of the Argentinian Navy.

<comment><USER21> > images obtained from Soviet spy satellites

How did they obtain them? Were they not encrypted?

<comment><USER20> Sigint means - it is mentioned in the book _GCHQ_ by Richard Aldrich.

</comment></comment></comment><comment><USER22> As a young teen in the early 80s I read about a project that used an FM radio, a printer, and a bit of code to detect meteoroids. When the meteoroid became a meteor it gave off a frequency in the FM range.

I liked programming but wasn't good at it and didn't understand what I needed. I wasn't sure if my Atari 600XL was suitable for the project but I do believe the code was BASIC which the 600XL could run. And I didn't have a printer which at the time was like owning a unicorn.

</comment><comment><USER23> Also, "How not to optimize a webpage for HN."

(Said with loving snark, as a former architecture student and knowing exactly why all the bells and formatting whistles were thrown in)

</comment><comment><USER24> Hug of Death? Couldn't find it in archive, so google cache it is [https://webcache.googleusercontent.com/search?q=cache:https:...](https://webcache.googleusercontent.com/search?q=cache:https://l-o- o-s-e-d.net/signs-of-life)

Though I haven't read the article yet

<comment><USER25> [https://archive.ph/o9YC3](https://archive.ph/o9YC3)

</comment></comment><comment><USER26> This is interesting data. Are there any online services which stream this data over internet?

AWS has an offering called Ground station. Can we use it to get same data? Anyone worked on it before?

What kind of license apply to this satellite data? Can we use it for commercial purposes?

<comment><USER27> Work product of the US government is in the public domain.

<comment><AUTHOR> Something I'm not sure of is whether or not I could legally sell these images, but as others have noted it's really "intercepting" signals rather than thieving. With an antenna and a raspberry pi, however, it certainly feels like a dangerous or exciting thing to be able to "hear" these signals.

<comment><USER27> You absolutely can, by design they are open to all.

Major businesses are basically built on this data. So much so that nasty players like Accuweather want to limit access to public research and shut down weather.gov so that they can more readily monetize it.

</comment></comment></comment></comment><comment><USER28> Man that's awesome... crazy how your brain is "zoomed in" to your daily life/forget zoom out on this rock in nothingness like a film of bacteria.

</comment><comment><USER29> Are any of those images of earth and space released to public domain, since NASA is a government agency? Especially video. I would like to use a clip for Youtube.

</comment><comment><USER30> Who do we have to thank for not encrypting this data?

PS: Aren't these images available on the web anyway?

Well, if not, perhaps this project could change that.

</comment><comment><USER21> I wouldn't call this stealing? Maybe "catching"? I've been following a related subreddit on this topic that might be useful to the hackers here: [https://www.reddit.com/r/RTLSDR/](https://www.reddit.com/r/RTLSDR/)

</comment><comment><USER31> Stealing? The NOAA satellites exist for you to receive the signals; the NOAA even offers a detailed guide on how to build a receiver: [https://noaasis.noaa.gov/NOAASIS/pubs/Users_Guide- Building_R...](https://noaasis.noaa.gov/NOAASIS/pubs/Users_Guide- Building_Receive_Stations_March_2009.pdf)

The introduction even reads like this art project: "Satellites provide us with a unique and long-sought after opportunity to look at Earth from space. These spacecraft now enable us to observe and measure the many forces of nature which converge on our planet. Mankind can now observe the global nature of the environmental factors which interact to form the complex systems we call Earth. From the unique vantage point of space, sophisticated environmental/weather satellites bring us information about cloud formations and movements, precipitation amounts, temperatures, ocean currents, sea surface temperatures, air and water pollutants, drought and floods, severe weather conditions, vegetation, insect infestations, ozone content of the atmosphere, volcano eruptions, and other factors that affect our daily lives. They have also provided us with less tangible aesthetic values which help shape attitudes about the environment of this planet. This global attitude is, perhaps, just as important as the hard data that the satellites provide."

I was hoping that this was some security vulnerability that let you receive images from private satellites.

<comment> globular-toast Even if the satellites are private, it is intercepting, not stealing.

<comment><USER32> Some call copyright infringement "stealing" as well. Also, "stealing" someone's idea.

<comment> kube-system Works by the US government are generally in the public domain and not eligible for copyright.

</comment></comment></comment></comment><comment><USER33> +1 for cool project; -1 for baity title

as jrockway said:I was hoping that this was some security vulnerability that let you receive images from private satellites

<comment><USER34> It still would not be stealing.

I believe copying information from a commuication channel without autorization is called eavesdropping.

</comment></comment><comment><USER35> Connection timeout. Seems that someone is 'stealing' your bandwidth.

<comment><USER36> "At the end, Daniel Tompkins revealed that the readers of Hacker News were tricked into doing the image heist themselves. Brilliant."

</comment></comment><comment><USER37> it's not stealing if they broadcast it unencrypted.

<comment><USER38> It's interesting that somehow doing math to something sent to your house unsolicited would make it stealing.

I'm not trying to argue with you, I just think it's a weird place to end up legally.

<comment><USER37> The way I think about it is: it's generally accepted that news reporters can go through the trash you throw in a garbage bin and leave on the street. If you want to protect your privacy, shred your trash or otherwise deny physical access to reporters.

The burden is on the transmitter to protect their asset and if they don't, they're negligent.</comment></comment></comment>


ccTLD.uz - <AUTHOR> http://uz./

<comment><USER2> Not working here. Isn't using a top-level domain not allowed?

<comment><AUTHOR> Which browser are you using? Works in my somewhat outdated Mozilla SeaMonkey for me.

</comment></comment><comment><USER3> Is "uz." a vaid domain? Why?</comment>


Political Correctness Killer for Social Media - <AUTHOR> http://www.speerty.com <comment><USER2> It looks like this is a "safe space" for people with rude opinions about a bunch of things including probably the concept of safe spaces.

<comment><USER3> Is a rude opinion necessarily incorrect? I understand the need to engage civilly, but there are probably uncomfortable truths that others find rude.

<comment><USER4> Then you should be willing to suffer the consequences of truth telling. It's a fairly common pattern in history.

<comment><USER5> The entire point of having a relatively free society is to reduce those consequences so that people can freely search for the truth without fearing for their livelihoods, reputations, or lives. We make a lot more progress now that the Church doesn't haul people in for saying the earth revolves around the sun, and now that people don't get blacklisted from their careers for being suspected of communist sympathies. Just because heliocentrism and communism aren't taboo anymore doesn't mean we've figured everything out and can abandon these principles.

<comment><USER6> none of those opinions would be labelled "politically correct"; the term is a dog-whistle for people who want to express opinions like "what if women are simply less capable than men?" or "black people would get a lot further if they'd just clean up their act and behave like civilised folk". google for "politically incorrect but" if you are disinclined to take my word for it.

<comment><USER5> Yeah, those are examples of opinions that are politically incorrect today, but so are more sophisticated and plausible opinions, like "genetics may be expressed in behavioral ways that predict criminality", "the distribution of cognitive and personality traits differs between sexes and races", "Islamic immigrants to Europe are disproportionately responsible for cases of sexual assault", "some women falsely accuse men of rape", or even "it's not realistic to expect people to coexist in society together when they hold entirely different social mores and norms". You may agree or disagree with any of these statements, but the notion of political correctness is that we are not even allowed to discuss whether or not these propositions are factually correct, because they are already politically incorrect.

But the real risk of political correctness isn't just the possibility that some politically incorrect proposition turns out to be true. It's that reality is always more complicated than we think it is. Two opposing propositions might be true in different contexts. For instance, the NBA slam dunk competition was this weekend; I don't think it's a stretch to say that in that particular context, women are, in fact, less capable than men. What if that's true about things other than dunking basketballs? We're not even comfortable contemplating that notion. That discomfort is a bias on our picture of the world.

</comment></comment></comment></comment></comment></comment><comment><USER7> Hard to believe that this 1) is possible, 2) made it through FB's approval process, and 3) is legit.

</comment><comment><AUTHOR> This is great! I love all of the opinions! Thanks so much for your feedback. I'll try you answer all the comments when I have time, I'm on the road right now. Yes, this is legit. We're in beta. Still very rough around the edges. Obviously there's room on this site for abuse, but it's meant to address a larger social issue. Voices and opinions on the periphery of society have been scorned in such a way that no one ever talks about them anymore. This is an opportunity to have educational, yet progressive discussion. At the same time, all character bias is removed and your friends won't view your comments as coming from a particular race, background, nationality, or the like. Users have an opportunity to evaluate comments for their logic and core tenets, not the messenger. Please keep the feedback coming, good, bad, or indifferent. Thanks everyone.

</comment><comment><USER8> So this is basically sockpuppets as a service?

</comment><comment><USER9> Dope watermarks.

</comment><comment><USER10> BTW: address is in Ohio, phone area code is in Silicon Valley.

</comment><comment><USER11> "Defy political corrextness"

<comment><USER11> And all the photos still have the stock stuff on them... this is more likely to be a weird phishing operation or a honeypot than an actual product

</comment></comment><comment><USER10> "Political correctness" is a phrase used by assholes who haven't figured out what free speech is. They think it means they can say whatever they like, without fear of repercussions or consequences. And they get very offended and hurt when they find out that isn't so.

<comment><USER5> Social taboos against unpopular opinions may not rise to the level of criminalization, but that doesn't mean they are all perfectly acceptable. The Hollywood blacklist wasn't a government action nor was it a violation of free speech in the legal sense, but that didn't make it a good or even an acceptable thing. Actually, we consider it a great scandal when screenwriters are blacklisted from their livelihood for expressing sympathies with Stalin, but we don't bat an eye when a tech executive is hounded out of his job because he backed the wrong California proposition a few years ago and refuses to comment on the issue today. One of these is called "McCarthyism" and the other is called "political correctness", and it's hard for me to see a world where one is okay and the other is not, unless of course we live in a world where denying legal marriage to same sex couples is worse than Stalinism.

<comment><USER12> > The Hollywood blacklist wasn't a government action nor was it a violation of > free speech in the legal sense, but that didn't make it a good or even an > acceptable thing.

Well, yeah, it was an combination in restraint of trade. Which is whole different category of wrong than a free speech violation.

<comment><USER5> So we agree that hounding people out of their livelihoods over their expressed opinions is wrong, then.

<comment><USER12> Not sure how you inferred any comment on that subject from my simply pointing out that the Hollywood blacklist was a combination in restraint of trade.

Which, incidentally, the complaints about Eich were not.</comment></comment></comment></comment></comment>


SO: really good answer to golang pointer question - <AUTHOR> http://stackoverflow.com/questions/25290956/go-update-slice-iterating-error-does-not-support-indexing <comment><AUTHOR> ``` m := make([]Members, 5) pm := &m

m[:2] // good pm[:2] // bad (*pm)[:2] // good ```

makes a lot of sense! I never knew how to do (star pm) before.

<comment><USER2> It's the same as in C.

<comment><AUTHOR> hehe i also don't know C.</comment></comment></comment>


Show HN: A tool to make a bot that speaks like you, learning from WhatsApp chats - spandan-madan https://github.com/Spandan-Madan/Me_Bot <comment> spandan-madan To everyone - I literally came back home from lab to find this blown up. Little overwhelming frankly.

I built the bot as a gift for a friend, and didn't really see the Black Mirror angle, even though I have seen the series.

Anyway, if someone is interested in building extensions of this, please write to me at email@example.com, I'd be happy to collaborate and guide :)

</comment><comment><AUTHOR> Better be careful with that...

From "Bicycle Repairman", by Bruce Sterling (1996) (This is a spoiler, BTW!):

"The mook speaks just like the Senator did, or the way the Senator used to speak, when he was in private and off the record. The way he spoke in his diaries. As far as we can tell, the mook was his diary.... It used to be his personal laptop computer. But he just kept transferring the files, and upgrading the software, and teaching it new tricks like voice recognition and speech-writing, and giving it power of attorney and such.... And then, one day the mook made a break for it. We think that the mook sincerely believes that it's the Senator."

Oh, and just note that this was _way_ before Black Mirror.

<comment><USER2> I mean, off topic, but it's not like any (citation needed) of the ideas in Black Mirror are original; it repackages existing ideas and tropes in a modern context. It does an excellent job of that, but it's a bit disingenuous to use it as the golden standard for whacky scifi prophecies.

</comment></comment><comment><USER3> It would be nice to create a bot that would learn how I write my shitty code to be able to write code for me when I retire and eventually die. Only to be resurrected in JavaScript.

:')

<comment><USER4> that could be made recursive ;)

</comment></comment><comment><USER5> Sounds interesting. I'll report on my results here once I have uploaded my otherwise end to end encrypted private and personal conversations into this unknown script...

<comment><USER6> It gets better. Soon it will imitate you without you uploading your conversations, because enough people around you did it (making themselves guilty of private conversation disclosure, at least 6 months emprisonment in France).

It's not that privacy is an endless pursuit, it's more that the governments enjoy it so much that they don't really work on preventing it.

</comment></comment><comment><USER7> Pretty crazy. It's not synthesizing new sentences, but it's basically a huge index of yourself. You can ask it "what's your favorite food?" and you get a response back.

This makes private conversations that much more valuable to ad companies: if WhatsApp sells all your conversation packaged into a model similar to this, most of your personality is easily summarised to be targeted.

</comment><comment><USER8> This is very interesting.

I had been lurking with an idea where one could create a bot, which is a clone of yourself. Bot learns/trains by hearing what you say and how you say. When you talk with the bot, it replies back with your own voice, basically Siri with your own voice and attitude. It would be the best thing one could leave behind after his death.

Is it possible to pull off something like this?

<comment><USER9> This is literally a Black Mirror episode -

[https://en.wikipedia.org/wiki/Be_Right_Back](https://en.wikipedia.org/wiki/Be_Right_Back)

Synopsis: "The episode tells the story of Martha (Hayley Atwell), a young woman whose boyfriend Ash Starmer (Domhnall Gleeson) is killed in a car accident. As she mourns him, she discovers that technology now allows her to communicate with an artificial intelligence imitating Ash, and reluctantly decides to try it. "Be Right Back" had two sources of inspiration: the question of whether to delete a dead friend's phone number from one's contacts, and the idea that Twitter posts could be made by software mimicking dead people."

<comment><USER10> I understand the value of providing hypothetical situations, but the constant mention of Black Mirror episodes with very little other substance here is getting tiring. Without having seen Black Mirror, that synopsis doesn't add much to the conversation other than "somebody made a tvshow/movie about that". Other than the fact that a similar situation was explored, what new conclusion did the episode reach that warrants mentioning?

<comment><USER11> Mainly that it was creepy and the widower realized she didn't really want a dead boyfriend/android thing.

</comment></comment></comment></comment><comment><USER12> I wonder if one could create clones of every user on a site such as hackernews for instance, and create bots for each one, such that when you feed in a random article, comments are automatically generated and replies to comments appear recursively. Comments as a Service.

Poor bastard who stumbles into such a forum never realizing everyone is a bot.

<comment> spandan-madan I think people have done something similar with reddit actually. They tried to make redit conversations, and well as expected they were pretty funny. Try google searching ou might be able to find it.

<comment><USER13> [https://reddit.com/r/SubredditSimulator](https://reddit.com/r/SubredditSimulator)

</comment></comment></comment><comment><USER14> Why not learn from normal text-files instead?

Why connect it to a facebook-owned, proprietary service?

<comment><USER15> If you follow the instructions you'll discover that it works by reading normal text files.

</comment></comment><comment><USER16> A more interesting tool: a tool to stylometry-fuzz one's writing.

</comment><comment><USER17> I'm getting this error when I try to run it:

Traceback (most recent call last): File "clean_whatsapp_chats.py", line 39, in <module> all_text[-1] += line IndexError: list index out of range

<comment><USER7> You're supposed to change the name globals as mentioned in the README.md file.

Then you also need to create a `res` directory in the root directory and install the necessary dependencies. Then you also need to change the encoding when you load the serialized data in the preprocessing notebook.

</comment></comment><comment><USER18> If you're looking for a quick, fun sci fi read with this concept run amok check out Darknet by Matthew Mather.

</comment><comment><USER19> Be Right Back

<comment><USER20> This comment is referencing _Be Right Back_ , a Black Mirror episode featuring this exact idea as a premise.

[https://en.wikipedia.org/wiki/Be_Right_Back](https://en.wikipedia.org/wiki/Be_Right_Back)

<comment><USER21> One of the best episodes of Black Mirror. Truly made me have deep thoughts about myself, life, and where humanity is going. Immortality seems indeed achievable, but not in a biological way our ancestors imagined.

</comment></comment></comment><comment><USER22> black mirror anyone?</comment>


VNC Roulette: Same procedure as last year - srsly-0002 http://srsly.de <comment> srsly-0002 We're back in business, from the 33c3 in Germany. Let's see who finds the most interesting open VNC box.</comment>


ASK HN: How to set up a network for getting secret info out of [country X]? - <AUTHOR>

Supposing that this popped up in my inbox today: "I want to set up a network for getting confidential information and banned journalism out of [country X]. How?"
after a quick phone call, i might have some requirements, in order of trickiness
1. someone has some footage on their camera phone they want to get out of the country without being traced, as a one-off. This person isn't very familiar with the publisher, perhaps has only heard of it.
2. a network of correspondents in 2-way communication with the publisher
3. a network of correspondents with peer-to-peer communication
Say that in this country the ISPs are so compromised that requests to unusual URIs would be flagged, tracked and located. Ideally the any computers involved should have as little incriminating information on them as possible, and knowledge of the networks existence and methodology should not cause it to be compromised.
I have a couple of ideas, but I'm wondering what HN can come up with <comment><USER2> You can't send secure communications over a compromised network of ISPs. Well, you can, but not without looking suspicious. I really think you may as well forget about using the Internet for this.

A better solution is to just use external USB hard drives with Truecrypt and ferry them around via a network or human couriers or through the mail. Truecrypt lets you install a hidden volume on the hard drives so that if the drives are ever captured you have some plausible deniability about what is really on them.

<comment><AUTHOR> How would you look suspicious? What if you stick to communication through innocently used domains using new accounts in internet cafes?

<comment><USER2> There are a lot of trust issues in sending data that way.

1\. First you have to trust the machine in the internet cafe. It might have viruses or keyloggers. You can maybe get around this by using your own laptop, but not allowed in most places.

2\. Next you have to trust the network. It could be monitored or logged. You could be vulnerable to MITM attacks or DNS poisoning. SSL is not guaranteed to get you any real protection in this situation.

3\. So you have a compromised network - you can get around this by just PGP encrypting whatever you want to send to the receiver (assuming you and your receiver have done some kind of sane, out-of-band key exchange), or using steganography tools to hide your video inside some other file, but..

4\. Now you are uploading large encrypted files to 'innocently used domains' (whatever that means) from an internet cafe. And walking around with a laptop with either keypairs or steganography software on it.. That's suspicious.

It's just far easier to use an external drive with TrueCrypt on it to send your sensitive information. You can have a hidden volume containing your really sensitive data, and a main volume where you can store some files that are plausibly sensitive enough to warrant TrueCrypt protection, e.g. a porn stash or some confidential business data.

</comment></comment></comment><comment><USER3> Communicate through drafts saved in a shared webmail account that supports https?

</comment><comment><USER4> The problem is publishing any such strategy on a public forum like HN will essentially render it useless.

</comment><comment><USER5> Encrypted messages hidden using steganography in media published to public, benign websites.</comment>


Lehman Comes Back From the Dead - <AUTHOR> http://www.businessweek.com/articles/2012-07-12/lehman-comes-back-from-the-dead

<comment><USER2> Can anyone explain how they only will be able to pay back 18¢ on the dollar? I understand that the company was heavily over-levered and therefore became insolvent but did their assets really fall that much relative to their debts? The market has recovered since the crash so I would have thought that their assets would be worth much more than that.</comment>


ShopifyStor.es – Get Inspired by the Best Shopify Stores in the World - <AUTHOR> http://shopifystor.es/

<comment><USER2> I've developed a few shopify stores and found the workflow to be similar to working with Dreamweaver and FTP, but worse. There is no way to have a local copy, which means you are constantly either editing files directly in their web editor, or uploading your modified local copies to the server, waiting a few seconds, then refreshing the browser manually to see the results.

But the real nightmare only begins after you launch the shop. There's absolutely no way to test anything before putting it live. Want to add a feature, or fix a bug? Edit the code blindly, upload it and cross your fingers that it doesn't break everything.

I admire the developers who managed to develop these sites and maintain their sanity intact.

<comment><USER3> There are a number of approaches you can take for this. Many developers simply have a production and staging store. Another approach is to have a production and staging theme which you can preview.

The shopify_theme[1] gem or the new theme sync tool[2] help keep synchronization quick. I can see the problem in the lack of context objects that are available to a theme, and there was even a tool a long time ago that solved that.

Sadly, it was very difficult to keep in sync.

[1] [https://github.com/shopify/shopify_theme](https://github.com/shopify/shopify_theme) [2] [https://github.com/csaunders/phoenix](https://github.com/csaunders/phoenix)</comment></comment>


The Literally Sexy, Sexy Password Field - <AUTHOR> http://ksat.me/the-literally-sexy-sexy-password-field/

<comment><USER2> Or, y'know, some other image set that doesn't reinforce tech's already wobbly gender stereotyping.

</comment><comment><USER3> There is no way I'd ever remember those dance moves.

<comment><USER4> I don't think the goal is to remember all the moves, just the final one which is based on a hash of your password. If she doesn't end up in the right pose you typed wrong.

Still, of dubious worth IMO.

</comment></comment><comment><USER5> How is this useful? I don't get it.

</comment><comment><USER6> I was expecting this to be a password strength checker, that showed a woman stripping based on how strong your password was... As an insentive

</comment><comment><USER7> Interesting, try typing in "handsup" or "handsdown"

</comment><comment><USER8> this will not end well for you.</comment>


Ask HN: Want to build a team for red balloon? - <AUTHOR>

I'm pretty interested in: https://networkchallenge.darpa.mil/default.aspx<p>I have a few ideas that make things pretty efficient.  There's also 40k attached as a prize, which is quite a few months of ramen profitability.  Leave comment below if interested.  If you're good with stats, that would probably be immensely useful. <comment><USER2> "All balloons are scheduled to go on display at all locations at 10:00AM (ET) until approximately 4:00 PM (local time) on Saturday, December 5, 2009."

Unfortunately, it looks like we missed the window to participate.

</comment><comment><USER3> It's already been won by MIT: [http://www.darpa.mil/news/2009/DARPAnetworkchallengewinner20...](http://www.darpa.mil/news/2009/DARPAnetworkchallengewinner2009.pdf)

Moral of the story: implementation before ideas.

</comment><comment><USER4> That doesn't really matter. the important thing is the information from others, which the people on hacker news are likely to be good at gathering. Of course more fun might be preventing everyone else from getting it...

</comment><comment><USER5> Quick Tip: Team up with Trucker Blogs. I am just guessing but I bet there are about a thousand trucker related blog sites and forums... they say the balloons are near major roadways... ummm can you think of anyone better to team up with? You can count me in for five grand of the findings for this tip :)</comment>


Dark Liquor Makes For Worse Hangovers - <AUTHOR> http://www.wired.com/wiredscience/2009/12/dark-liquor-makes-for-worse-hangovers/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wiredscience+%28Blog+-+Wired+Science%29

<comment><USER2> Oh, it's about booze. I'm disappointed. I thought it was going to be an article about pulp mills and alternative energy. <http://en.wikipedia.org/wiki/Black_liquor></comment>


Elsevier Complaint Shuts Down Sci-Hub Domain Name - <AUTHOR> https://torrentfreak.com/elsevier-complaint-shuts-down-sci-hub-domain-name-160504/ <comment><USER2> (Thanks for daveguy: [https://news.ycombinator.com/item?id=11593881](https://news.ycombinator.com/item?id=11593881))

[https://188.8.131.52/](https://188.8.131.52/) (sci-hub.io cert)

[https://sci-hub.cc](https://sci-hub.cc) (same ip as above, sci-hub.io cert)

[https://sci-hub.ac](https://sci-hub.ac) (same ip as above, sci-hub.io cert)

[https://sci-hub.bz](https://sci-hub.bz) (uses a separate certificate and ip address -- 18.104.22.168)

And a tor site: scihub22266oqcxt.onion

<comment><USER3> Anybody know a linux script/software that would 'lock' a domain down to am IP regardless what the registrar does.

Maybe have even a out of band way of updating it without the registrars involvement.

I guess what I'm looking for would be P2P DNS server although making sure the data is not fake would be difficult without some kind of signing.

Wonder if it could use the bitcoin ledger as a kind of key server?

Edit: I know /etc/hosts does the job it's just lacking if the server changes IP

<comment><USER4> echo "google.com 127.0.0.1" >> /etc/hosts

<comment><USER5> Yeah, I recommend against this particular example :)

<comment><USER6> Do this on your friends and families computers, and change the world.

</comment></comment></comment></comment></comment><comment><USER7> I feel a little tingle of excitement seeing my own papers on Sci-Hub. I mean I get that they're trying to index _all_ publications so it's not a "stamp or approval" or anything... but it does mean that people can actually access the knowledge I tried to throw into the world, which was kind of the whole point in doing it.

I'd update my academic website to link my papers to their sci-hub URLs if I didn't think I'd catch a world of flak for it.

<comment><USER8> IEEE and IEEE Explore have been actively going after professors and forcing them to take down links to their own papers. In the past, many professors hosted pdf's on their websites for their papers -- this has only stopped because IEEE has been forcing them off. Just wanted to add this for those who think professors have 'suddenly become stingy' \-- no, they aren't - they were forced to.

<comment><USER9> i haven't heard this, this is interesting any links with more info?

<comment><USER8> Academia is probably keeping quiet since most of EE, CS, CE is heavily dependent on IEEE publications for reputation and career advancement and paper-reputation.

<comment><USER10> There would be complaints somewhere you can link to. I have a collection of over 15,000 papers. Many I got off of IEEE/ACM. However, many others I got by typing the name into Google and/or CiteSeerx to find same file. I still can usually get any file I think of and many are still on academics sites. Those are high-profile, too.

So, where's your evidence that IEEE can or is forcing PDF's off the net?

</comment></comment></comment></comment></comment><comment><USER11> "As a result of the legal battle the site (sci-hub.io) just lost one of its latest domain names. However, the site has no intentions of backing down, and will continue its fight to keep access to scientific knowledge free and open."

Does this not enrage people? Elsevier and closed-access journals like them, are doing all they can to impede human progress while leaching off of tax- payer dollars to do so. Something should be done to make what Elsevier and the like do illegal, are there any groups/political parties/etc going after them?

<comment><USER12> This is a case of badly screwed-up incentives. No individual has incentives to fix the system, so they keep optimizing for how they're actually rewarded [academics --> tenure / prestige, journals --> make money, govt --> get lobbied].

<comment><USER13> You are missing a case for academics. Even after tenure, we have to continue publishing in these venues or our students wont be able to find work.

</comment></comment></comment><comment><USER14> On the bright side, this will give some much-needed publicity to Tor Browser. Sci-hub is still available at [http://scihub22266oqcxt.onion/](http://scihub22266oqcxt.onion/)

<comment><USER15> Does using Tor puts you on some kind of list? It would be tragic if someone used Tor to read a scientific article but then got charged with aiding terrorism or looking for child pornography.

<comment><USER16> > Does using Tor puts you on some kind of list? It would be tragic if someone > used Tor to read a scientific article but then got charged with aiding > terrorism or looking for child pornography.

If it does, it becomes an ethical maxim to use Tor. If it doesn't, then you can simply use Tor. So by case analysis you should use Tor.

<comment><USER14> > If it does, it becomes an ethical maxim to use Tor.

This is one of the reasons I use Tor. If there _is_ such a list, I want it to be full of people doing ordinary stuff. In effect, I want the list to be useless.

<comment><USER17> Indeed, this is the main reason I'm using Signal (and badgering my friends into using it). I want to increase the volume of encrypted non-sensitive stuff, so that the "list" doesn't have predictive value.

<comment><USER16> Having metadata (i.e. who communicates with who at which time etc.) still has lots of value for the three-letter agencies (some even say it's even more important then the content of the messages itself). As far as I know Signal does nothing to avoid this kind of metadata (but please correct me if I'm wrong).

</comment></comment></comment></comment></comment></comment><comment><USER18> Why exactly was a New York court able to issue an injunction for a ".io" domain?

It is a British Territory extension being managed by "Internet Computer Bureau Ltd" based in the United Kingdom.

</comment><comment><USER19> Is there a donate location of sorts that we can pay into to support the efforts that the sci-hub person/team/organization is doing?

This is a another good cause that I would find worthy to donate to.

Edit. Ok, found it:

[http://www.sci-hub.cc/donate](http://www.sci-hub.cc/donate)

Apparently, only bitcoin donations are possible at the moment. BitCoint Wallet for donations: 1K4t2vSBSS2xFjZ6PofYnbgZewjeqbG1TM

<comment><USER20> I see a different Bitcoin address. I recommend people visit the site and not use the address random commenters on the internet post. Not saying the parent comment is up to something, sci-hub may have rotated the address for whatever reason. The one I see starts with 14ghuGKD

EDIT: Ah, interestingly, the 1K4t2v address appears on the scihub.cc homepage, but not the donate page that was linked

<comment><USER3> Accessing the ip posted in the article it shows the bitcoin address posted by the OP.

I even switch over to https to make sure the request is not modified.

<comment><USER20> >switching to https

They don't even have a valid certificate for that domain.

BUT interestingly, on a US (DO NYC) server or my house (US/Comcast):

      $ curl http://sci-hub.cc/donate

Please donate to Bitcoin: 14ghuGKDAPdEcUQN4zuzGwBUrhQgACwAyA
%

however, on a French (OVH) server:

      $ curl http://sci-hub.cc/donate
      <!DOCTYPE html>

      {cut for brevity, a fair amount of HTML here}

Please send donations to bitcoin wallet: 1K4t2vSBSS2xFjZ6PofYnbgZewjeqbG1TM

      {more HTML}

DNS reports that the domain's IP is 184.108.40.206 from all tested locations. I get the HTML page with the 1K4t address over tor as well

<comment><USER21> Tested from US university IP, I also get the 1K4t wallet address. Maybe a caching issue with the CDN (assuming they use one)?

<comment><USER20> Which university? I tried from the University of Washington and got the 14gh address

</comment></comment></comment></comment></comment></comment><comment><USER13> > Meanwhile, academic pirates continue to flood to Sci-Hub, domain seizure or > not.

I realize readers of torrentfreak.com have a different relationship with the word "pirate" but--

This is not piracy. You are entitled to read work from Sci-Hub, as your taxes funded the researchers who created the work. We academics _want_ you to read our work, we do not benefit in any way from publisher paywalls. We continue to publish in these venues because it is necessary for career advancement (whether for us, or for our students).

Please continue to "pirate" our work, and please spread the word about this problem.

<comment><USER22> Is this argument valid internationally?

My canadian taxes didn't pay for american research, should I still be able to access those papers?

<comment><USER13> Researchers regularly make use of work from other countries, the scientific community is international. Even if one could make an argument for not allowing Canadians to access US research without payment, it doesn't follow that Elsevier and friends are the ones who should be paid.

Research done by government employees is legally required to be public domain. I see no reason we shouldn't extend that to researchers who take government funding.

</comment></comment></comment><comment><USER23> While I support open science and Sci-Hub is great, I also can see publisher's side.

Imagine the same site with pirated high quality scientific books. (There are some, but in darker corners of the Internet). Would open access to these books be advantageous for humanity? Most definitely. Will publishers get mad about it? Even more definitely. Should publisher's work be free? I think not.

However, you can't get both sides of the coin at once. Either authors are paying publishers to get their papers peer reviewed and published (they do now), or publishers may collect payments from readers and libraries. Not both ways.

<comment><USER24> > Should publisher's work be free? I think not.

What value does the publisher's work add to the work the author generated?

<comment><USER25> > What value does the publisher's work add to the work the author generated?

\- organizing peer review \- spell-checking and fixing layout problems \- making sure that the paper stays available for a long time \- handling complaints and retracting fraudulent papers \- providing a single point of contact for people who would like to reuse published material (e.g., using illustrations in a textbook).

Sure, many publishers don't do a very good job for the money they are taking. Sure, there might be better approaches for disseminating knowledge than the current one. However, in the world as it is now, publishers can and do provide some value.

<comment><USER26> \- At least in computer science, it's generally professors who organise the peer review (the Program Commitee)

\- I've heard from several collegues that the editor _introduced_ spelling mistakes. Sure, overall they might get some errors out, but a spellcheck is not needed.

\- Well yes. But there is no need for that to be expensive.

\- Do we need them for this? If there really is fraud, previous cases show it's their university that starts an investigation. I'm not sure if the effect of retracting a paper is that significant..

\- If all papers were public in the first place, there is no need to contact someone if it's okay to reuse material.

Anyway publishers might provide some value, but not enough to demand we pay for every single paper, or pay costly subscriptions. They need to die already or adept.

<comment><USER25> I agree with your general perspective. (I have publicly vowed to never act as a reviewer for Elsevier, for example.)

However, ignoring the traditional role of publishers does not help our case. Regarding your individual points:

\- Peer review for CS conferences is usually organized by volunteers, yes. However, this is not true for other, journal-focused disciplines, where there are paid assistants

\- One might argue that spelling/layout checks are not really necessary. I personally appreciate them. In any case, these _are_ services that publishers usually offer.

\- I was not trying to argue that the typical publisher does a good or cheap job. What I wanted to say is that publishers can and do add value.

\- Universities usually try to handle scientific fraud discretely (for PR, HR, and legal reasons). They are usually not interested in disseminating bad news widely.

\- Sure, if we could retroactively bring all previously published works into the public domain, things would be much easier. However, in the copyright system we live in right now, publishers provide a useful service by taking care of author's rights and facilitating reuse.

<comment><USER27> \- Journals are also often volunteer based, at least in the sciences.

\- Publishers really don't do much for spelling/layout. They give you a format to fit in, and then put up an automated system for you to check against.

\- Fraud is handled by the community (See: Retraction Watch) much more effectively than by journals.

</comment></comment></comment></comment></comment></comment><comment><USER28> "We wish to set back society, because we want to make more money".

I use Sci-Hub all the time. I can access all papers via my library subscriptions so I actually DO have paid access to everything, but searching with and authenticating against my university library's services is slow and tedious and not feasible if I want to download many papers quickly.

<comment><USER29> Plus multiple times sciencedirect was down for me.

</comment></comment><comment><USER30> Recently shared this here: [http://www.thebookseller.com/news/elsevier- defends-its-value...](http://www.thebookseller.com/news/elsevier-defends-its- value-after-open-access-disputes-328037) ([https://news.ycombinator.com/item?id=11614926](https://news.ycombinator.com/item?id=11614926)) which I'm guessing is the precursor to this debacle.

Reading what Elsevier have to say, you'd think they're either completely delusional (I doubt so), or know full well that they're rapidly becoming irrelevant/abhorred and are adopting a bully position, all the while pretending to be innocent and blameless victims of this situation.

Don't count on me to shed a tear when Elsevier go under.

<comment><USER30> Just saw Elsevier retweeted this:

"Science is better and more accurate when it's inclusive." ([https://twitter.com/ElsevierConnect/status/72821552586887578...](https://twitter.com/ElsevierConnect/status/728215525868875780))

I realize this is about gender, but I can't help but feel a bit of irony in there...

<comment><USER10> Great observation. They're calling their own BS indirectly. Whoever is involved in SciHub with strong presence on social media should immediately start using that quote to push SciHub. :)

</comment></comment></comment><comment><USER31> .cc still works for those who need it

<comment><USER32> It could probably use .se as well. TPB's .se domain still seems to be alive and kicking.

</comment></comment><comment><USER33> I would love to learn more why Elsevier _only_ reports a profit of 37%?

I've read here on HN and elsewhere multiple times, that most of the work done is outsourced to third party labor, which is done essentially for free:

\- writing papers

\- organising reviews

\- reviewing papers

<comment><USER34> I worked as a contractor for MacMillan (they publish nature) and it's hard to believe how much money they spend for no results. The project I was on had been running for a year when I joined. I noped out after three months and I heard it was shut down a few months after I left with nothing to show.

That was 4-6 people full time and my entire floor of 80 people was full of projects like that - projects you never heard of.

The weird thing is that everyone I worked with directly was very smart, and went on to do cool stuff.

Summary: If I had to guess the remaining profit is wasted on silly projects and high manager salaries.

</comment></comment><comment><USER35> Domain names should not, in principle, be subject to the arbitrary edicts of governments. I hope that, in the future, we switch to a decentralised and cryptographically incorruptible system a la Namecoin.

<comment><USER36> Being free would also be nice. But of course, we also need a way to disincentive squatting.

</comment></comment><comment><USER37> Yet again, please don't mention other sites here or in reddit etc. Being in the spotlight is not good for them. What they are doing is morally fine in my book, but infringes the law and you are contributing to their demise. Keep it low profile, the more you blab about them the sooner they are gone. And until the next platform makes it -if it does, you can't guarantee it will- it is going to cause a lot of damage to many careers out there, because there are many people that have no choice but this one. If this is a war, it is a war of attrition, it can't be won by pointing out the targets.

</comment><comment><USER38> I wonder if there is a way of distributing a signed file that contains the IP address of sci-hub over a distributed medium?

Someone else would just need to write a small script that copied it into the system's host file - but make it generic enough that it works for anything. That would help non-technical users.

This would stop courts from going after centralised name servers.

There really needs to be a way of decentralising name servers.

<comment><USER36> It's possible in principle. Just use public-key cryptography (perhaps the SSL cert of the website), grep and ed. You could have it update once a day from the sites listed, or perhaps create some type of dht backend.

P.S. This dht-based P2P dns project might interest you. [https://github.com/mwarning/KadNode](https://github.com/mwarning/KadNode)

<comment><USER38> What about distributing it? Is there a way of decentralizing that?

I notice there is Tahoe lafs...

[https://www.tahoe-lafs.org/trac/tahoe-lafs](https://www.tahoe- lafs.org/trac/tahoe-lafs)

<comment><USER38> And of course, ipfs. Still trying to get my head around how it actually works!

</comment></comment></comment></comment><comment><USER39> As much as I completely support freedom of information there is a problem with not respecting the law that seems to be growing...

I might disagree with the law. I might break it intentionally, but I do my due diligence and do it knowingly.

When i get caught I hold up my hands and face the consequences because I entered into that knowingly. I have actually done this irl. This is why I have no respect for this, or for Uber, Aaron Schwartz or this entire ridiculous movement of subversion instead of facing up to the challenge and taking it extremely seriously and tackling it up front and openly with some pride and courage.

I'm glad people are fighting to keep this alive anyway. That imo is part of the right approach, to defeat the law by showing its futility in the face of reality when it is very far into the wrong. But ffs, don't hide from what you have done like some kind of child. Face up to your responsiblity and take it on the chin... and let people be angry about that, because that is an actual, serious wrong.

"Words are wind."

</comment><comment><USER40> Maybe this is an opportune time to bring up a related concern. It's crucial that any system for disseminating scientific work be reliable and persist indefinitely. I don't like the current system, but I wonder how this will be achieved otherwise.

<comment><USER36> I agree. I don't want papers to dissapear indefinitely due to an IT mistake, and I'm sure there are many researchers that don't save previous papers locally. That, and being able to access cited works is also important.

</comment></comment><comment><USER41>
      echo "184.108.40.206  elsevier.com" >> /etc/hosts

[http://elsevier.com/scimag](http://elsevier.com/scimag)

</comment><comment><USER29> trivial but handy bookmarklet link for scihub:

      javascript:window.location='http://sci-hub.bz/'+window.location

</comment><comment><USER42> Are people working on a better system to replace DNS? This little game is quickly becoming tiring.

<comment><USER43> GNUnet has the GNU name system:

[https://www.gnunet.org/gns](https://www.gnunet.org/gns)

<comment><USER10> Tks for tip. Never heard of it.

</comment></comment></comment><comment><USER44> How big is the sci-hub database?

Are there full/partial mirrors published anywhere?

<comment><USER36> We can see here, over 50mil papers. [http://libgen.io/scimag/repository_torrent_notforall/](http://libgen.io/scimag/repository_torrent_notforall/)

As you can see here, they have three mirrors. One Moscow, one Ocean(ia?), and one Cyber(ia?). Libgen also has a mirror.

As for BookSC, they seem to be quite a bit out of date, or something.

</comment></comment><comment><USER45> why not set it up as a tor hidden service?

</comment><comment><USER46> Long live Aaron Swartz

</comment><comment><USER47> yeah but where's the torrent?

</comment><comment><USER48> Just like with music and file sharing, this will not hurt the large corporations. It will only hurt the researchers that depend on these papers for funding and make it more difficult for them to make a living in the future.

It will also push companies to keep research more private and proprietary. Why would I spend millions of dollars on research, only to have it freely distributed to everyone, including my potential competitors?

I've never witnesses a time where more people fight to give up more and more of their own power and hand it over to governments and large corporations on a silver platter...and then complain when it's all gone.

<comment><USER49> Are you aware that unlike musicians, academic researchers don't get paid royalties on their publications? A list of prestigious publications on one's cv leads to funding and job opportunities regardless of whether anyone pays to read them.

<comment><USER50> Lots of academics are collecting royalties on books.

Typically not large royalties, but they are collecting them.

<comment><USER49> Yes, that's a fair point. I was thinking only of journal articles and conference proceedings. One way of making money off textbooks is to be a professor in an institution with a large number of students and make them a requirement for the course. It also helps to make a few small changes every year and call it a new edition, so each year the next class of students has to buy new ones instead of used copies from the previous year's class. I question whether this practice is worth defending.

<comment><USER51> > Yes, that's a fair point. I was thinking only of journal articles and > conference proceedings. One way of making money off textbooks is to be a > professor in an institution with a large number of students

Yeah that behaviour is detestable. Absolutely utterly unethical and everyone who engages in this type of behaviour should take a long look in the mirror and realize that there's an Evil person looking back.

I've lost so much money to f*ckers like this and I have no recourse, it makes me so mad I can spit.

<comment><USER52> The professors don't actually make much money. The publisher takes a huge commission. I've heard 5-10% royalties in some cases. Usually if they use the book for their own course they'll waive even that to avoid having the appearance of a conflict of interest.

They _could_ make a ton of money doing it this way: Physics textbooks can sell for hundreds. But many don't.

Using your own book for a course(separate from the money) has its benefits: The book has exactly the content that you want to teach off of, and you can also choose good problems.

When I took a Differential Geometry course in college, the professor had a translated version of some paper from a Russian mathematician back in the 1950s that he taught off of. It was cheaper to get copies from Kinko's, and it's not like the math changes. The old pioneers can sometimes give better intuition too.

</comment></comment></comment></comment></comment></comment><comment><USER53> Looking forward to watching the Streisand Effect play out.</comment>


8 Workplace Propaganda Posters to Instill Core Values - <AUTHOR> http://marvinli.com/2014/06/03/8-propaganda-posters-made-work-instilling-core-values/

<comment><USER2> This is the kind of propaganda posters we have in our office:

[http://img-cache.cdn.gaiaonline.com/6d049ff5c5e075e04758eb66...](http://img- cache.cdn.gaiaonline.com/6d049ff5c5e075e04758eb66e6fd211d/http://i1041.photobucket.com/albums/b416/UrbanAvalon/Helghast%20Propoganda/hgh_propagandaposter2copy.jpg)

<comment><AUTHOR> Like!</comment></comment>


Ask HN: I just got an out-of-the-blue seed investment offer, now what? - <AUTHOR>

I've been working on a side project web app for the past couple months that has been gaining in popularity, and I just got an email out of the blue from someone offering me seed investment. It was very brief and just asked if I would be interested in seed money in order to "add more features quickly".
I'm interested in discussing it further, but unsure of the proper way to respond. I've always been a salary man and I'm completely ignorant about the typical process here. Do I just respond with "Sure, I'm interested, what are you thinking?" or do I make an offer myself and see how he responds or what? What would you do in this situation?
To complicate things, the app is completely free and I am making no money off it whatsoever, so I assume that will have to change in order for him to really invest. <comment><USER2> Before talking _any_ numbers whatsoever, you should have a face-to-face. Make sure both the product vision and the path to monetization are clear to both of you (or, at least you generally agree on direction). Once you've cleared all the other possible issues (e.g. how to incorporate), only then should numbers be discussed.

<comment><AUTHOR> What if relocation isn't an option and the guy lives halfway across the world? Does that present a problem in your mind or is a phone conversation acceptable?

<comment><USER2> I think a phone conversation could be ok. One thing to note, I believe the only incorporation option you have for investors outside of the US (assuming you live in the US) is an S-Corp. I guess my main point was to make sure you're on the same page as the potential investor before talking numbers.

</comment></comment></comment><comment><USER3> Is the offer a potential solution or just a distraction?

If it is a potential solution, then do you want this person as a partner in your business?

If the answer to the second is "yes," then a "Gee, I never thought about it" is enough to see where it might go. Otherwise, let it go as the distraction that it is.

</comment><comment><USER4> This is a good time to think about what you want the future of your app to look like. If seed money will get you there, think about how much you'll need.

I would respond with "Sure, I'm interested, what are you thinking?" anyway, but make sure you've thought about what will be enticing to you.</comment>


[infographic] Winning the Y Combinator - <AUTHOR> http://filer.progstr.com/1/post/2012/03/winning-the-ycombinator-infographic.html

<comment><USER2> This is possibly one the most sparse infographics I've ever seen. There's only 5 units of information, and they aren't particularly engaging or related either.

<comment><USER3> They're also not accurate. The information is just taken straight from yclist.com, which is inaccurate in parts and not up to date. For example Loopt which was acquired 2 weeks ago for $43.1m is not included in this.

</comment></comment><comment><USER3> As far as I know the reddit price has never be disclosed and the $15,000,000 is an "estimate" (based on what? who knows).

</comment><comment><AUTHOR> Thanks for the feedback. The infographic will be updated accordingly.</comment>


Show HN: A Hacker News Reader in Vanilla JavaScript - <AUTHOR> https://github.com/k2052/vanilla-hn <comment><USER2> All of that work and my back button is still broken. It also looks like I can slide a script tag into my comment and have it run.

<comment><USER3> Your back button is broken? The only behavior I see is that a different page creates a new history entry. Is that not expected behavior?

<comment><USER4> You can't use back to exit the app, at least on Firefox for Android. Steps to reproduce:

1\. Go to [https://github.com/k2052/vanilla- hn](https://github.com/k2052/vanilla-hn)

2\. Click link to live demo at the top

3\. Click comments

4\. Press back, you'll be back at the main view

5\. Press back, you'll still be in the main view, expected: go back to github

<comment><USER3> Ah, I didn't notice that. Good catch.

</comment></comment></comment></comment><comment><USER5> Super fast – that's really impressive! There may be an off-by-one bug. The next page of results seems to be missing the first element (e.g. 30, 60, etc). The results go from 29 to 31, 59 to 61.

</comment><comment><USER6> Looks like a lot of hard work went into this, nice job. However, the app simply doesn't work. Clicking login did nothing, then a minute later the screen said I need to be "logged in to post", routing not working as expected and many links to the external original story are your github.io site with undefined as part of the path.

</comment><comment><USER7> On Mac/Chrome the back button does not work, plus when clicking through to comments, I see comments for a different thread.

</comment><comment><USER8> Dude, that's super fast! Blazing speed and rendering, even on my old iPhone 4s! Great work!</comment>