FBI Admits It Controlled Tor Servers Behind Mass Malware Attack - <AUTHOR> http://www.wired.com/threatlevel/2013/09/freedom-hosting-fbi/ "It wasn't ever seriously in doubt, but the FBI yesterday acknowledged that it secretly took control of Freedom Hosting last July, days before the servers of the largest provider of ultra-anonymous hosting were found to be serving custom malware designed to identify visitors." ... <comment><USER3> I don't even know anymore. We're gonna have to raise the bar on what it means to be a "tinfoil hatter"; the original definition has become reality.

 _" Trust no one! Suspect EVERYTHING!"_, I can say today without sounding crazy.

Also, remember this? [http://www.linuxfoundation.org/news- media/blogs/browse/2011/...](http://www.linuxfoundation.org/news- media/blogs/browse/2011/08/cracking-kernelorg) ....hmm, I wonder if....

<comment><USER4> > I don't even know anymore. We're gonna have to raise the bar on what it > means to be a "tinfoil hatter"; the original definition has become reality.

That's sort of where I've gotten to this summer. It's really frustrating and saddening.

Although mind-control waves still aren't, TO THE BEST OF MY KNOWLEDGE, a thing.

<comment><USER5> Mainstream media bombardment and constant advertising harassment do a pretty good job of mind control, though.

Also, culture is the best mind control. Raise people with a mind set the way you want it and you never have to do anything directly, because they already are siding with you even through cognative dissonance.

<comment><USER6> Public schools are far more significant than the media.

<comment><USER7> You could be right. Or it could be the exact opposite. Or something else. It doesn't matter. Fundamentally we do it to ourselves, because we're herd/pack/social animals. We _shun_ anyone too different from the tribe, it's in our DNA. Because of that, we are highly evolved to fit in.

Yeah, we're self aware and all that, we have choices, but what we generally choose to do is identify with some group and hate opposing groups. It's what we do.

The chimpanzees are laughing at us.

<comment><USER8> _In England and Wales, truancy is a criminal offence for parents.[6] Since 1998, a police officer of or above the rank of superintendent may direct that for a specified time in a specified area a police officer may remove a child believed to be absent from a school without authority to that school or to another designated place...._

<comment><USER9> It's not that widely known, but you can remove your child from state education as a parent and teach them yourself. You just have to tell the local authority you're doing so in writing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> The use of malware in police enforcement is truly a unique event in society. At what other point in history has police distributed a completly illegal tool onto unsuspected and non-targeted civilians? It feels like a total unexplored area of liability laws, so I look with excitement to when the first lawsuit starts.

Some people have compared malware with guns. This is to me a very bad comparison, since guns actually have legal usage like hunting or self defense.

A better example would be a under cover cop, selling real drugs to real people with the intent to impress a local drug cartel. It has to my knowledge never happen, but it would be interesting to know if the cop could be held liable if someone dies from a overdose from those drugs.

Let say that a police virus spreads out of control, and infects millions of computers. What if this specific firefox exploit get copied by a botnet, and is used to execute credit card stealing software on unsuspected users. How liable can the police become when millions of people are effected? I really have no clue.

<comment><USER11> The government poisoned alcohol during Prohibition.

<comment><USER12> They still poison medicines. Hydrocodone, a Schedule II substance, drops to Schedule III when sold with acetaminophen, a substance toxic to the liver.

<comment><USER13> This is ridiculous. Acetaminophen is Tylenol. Are you seriously trying to make the argument that Tylenol is a poison?

Arsenic is a poison. Lead is a poison. Cyanide is a poison. Tylenol becomes toxic at a certain threshold (like every other substance on the earth for that matter).

Sure, it is toxic to your liver in large doses. That isn't why Tylenol 3 is Schedule II while pure Codeine is Schedule II. The difference is in dosage. Tylenol 3 tends to come in doses of around 5mg Codeine to 300-500mg Tylenol. You get T3 when you have a tooth taken out, or maybe some minor stitches. You are also only given a few pills.

You get pure Codeine when you break a bone or stick a pencil through your eye. Or one of the stronger codeine-derivatives (oxycodeine, etc). These come in larger doses and are more prone to abuse.

Hence Schedule III.

I'm no fan of the DEA or the schedule system...but the "Government" isn't poisoning anyone. That's pure FUBAR and true tin-foil-hattery. Its a classification system for the abuse potential of perfectly legal drugs.

<comment><USER14> [http://www.medicinenet.com/tylenol_liver_damage/article.htm#...](http://www.medicinenet.com/tylenol_liver_damage/article.htm#do_the_recommended_doses_of_tylenol_cause_any_liver_damage)

Yes, but in rare cases. Acetaminophen is not the easiest thing in the world for your body to deal with. But this is technically correct and in the 99 percent case you're correct so this is kind of belaboring the point.

Nevertheless, I thought it was worth mentioning.

<comment><USER13> Sure, but you can make that argument for virtually any substance. A particular combination of genetics and <insert molecular compound> will equal a bad reaction in some portion of the population. It's practically guaranteed due to the nature of genetics and statistics.

</comment></comment></comment></comment></comment></comment><comment><USER15> "Freedom Hosting has long been notorious for allowing child porn to live on its servers. In 2011, the hactivist collective Anonymous singled out the service for denial-of-service attacks after allegedly finding the firm hosted 95 percent of the child porn hidden services on the Tor network. In the hearing yesterday, Donahue said the service hosted at least 100 child porn sites with thousands of users, and claimed Marques had visited some of the sites himself."

So this paragraph of the news report suggests that sometimes Anonymous and the FBI can be united in the goal of stopping child pornography, although not united in how they try to deal with it.

<comment><USER16> The reason the FBI and Anonymous seemed to join forces is because the FBI turned Anonymous's leader, Sabu. [http://gawker.com/5890847/revered-anonymous- leader-rats-out-...](http://gawker.com/5890847/revered-anonymous-leader-rats- out-his-pals-to-the-fbi)

<comment><USER15> Please tell me more background about that. (I recall mention of this before on HN, but I'm not recalling many details.) What's our best information on how leadership of Anonymous has changed over time?

AFTER EDIT: Thanks for your link, which I think came as an edit to your comment. Here is a link to follow-up news:

[http://www.theguardian.com/technology/2013/feb/22/lulzsec- sa...](http://www.theguardian.com/technology/2013/feb/22/lulzsec-sabu- sentencing-monsegur-postponed)

<comment><USER16> Someone else should step up and give a comprehensive overview, because I can only recount the timeline from memory, not provide sources. But iirc, Anonymous was a loose coalition of random people on the internet, some of which turned out to have some basic hacking skills. They weren't really taken seriously until they embarrassed HBGary. At that point, the FBI began investigating them. Anonymous changed their name to LulzSec (or possibly AntiSec). The FBI used standard police techniques to infiltrate and eventually dismantle the those groups. The technique was simply to 1) figure out who was a member of Anonymous, 2) threaten them with prosecution unless they cooperate, 3) repeat. This eventually led them to turn Sabu, Anonymous's leader. I'm going to dig for an interesting HN comment I remember reading about the relationship between FBI, Anonymous, and the takedown of Freedom Hosting.

EDIT: Here it is: [http://news.ycombinator.com/item?id=6154642](http://news.ycombinator.com/item?id=6154642)

In order to be friendly to mobile users, I'll copy-paste the comment here (although the link is worth reading because of the informative replies):

\---

redthrowaway 40 days ago | link | parent | flag

Interesting. Freedom Hosting had been a target of Anonymous' Operation Darknet from the beginning--they're well-known for refusing to take down exploitative sites. Operation Darknet is, itself, a pretty interesting phenomenon: Anonymous hacks onion sites, then hands over user information to the FBI for investigation. Anonymous does what the FBI legally can't, and in exchange they're not prosecuted for it. I can't find the article now, but I recall reading an interview with an FBI agent in Wired or Ars or some such where he described the anons as "Internet Superheroes". (sic)

That, in and of itself, is kind of curious. Curiouser? One of the original Op Darknet principals was Sabu. You may remember him as the hacker the FBI rolled and got to bust up LulzSec. Sabu was turned by the FBI on June 7th, 2011.[1] Operation Darknet began several months later, in October, 2011.[2]

The obvious question, then, is this: Did the FBI use Sabu to entice Anons into attacking child porn networks, thereby evading the laws against them doing it themselves? Did they use the fact they turned a well-known hacktivist to help them deal with criminals they lacked the legal tools to go after? Is this arrest the culmination of those efforts?

[1] [https://en.wikipedia.org/wiki/Sabu_(hacktivist)](https://en.wikipedia.org/wiki/Sabu_\(hacktivist\))

[2] [http://www.informationweek.com/security/attacks/anonymous- at...](http://www.informationweek.com/security/attacks/anonymous-at..).

<comment><USER17> LulzSec was not Anonymous. While some of its membership may have overlapped, that doesn't really mean anything, because anyone can be a part of Anonymous, simply by carrying out acts in the group's name.

Sabu forgot to activate TOR before logging into IRC just a single time, and the FBI was able to locate him. Sabu was the legal guardian of his siblings, and was pretty much told that he would never see them again if he didn't cooperate with the feds. And so Sabu became a mole for the FBI, spending the next several months trying to elicit identifiable information from his own crew. For the most part, it worked.

What's interesting is that at least one of his fellow hackers is already out of prison, and the rest are going to be out in a few years. Sabu on the other hand, being a United States citizen, faces much harsher penalties than his European counterparts even though he was the only one with a deal. If I had to guess, best case scenario he is going to be sentenced to 10 years. To be honest though, I wouldn't be surprised if he got a few decades more.

Also, Sabu didn't have to manipulate Anonymous into attacking CP networks. It's something that they do on a semi-regular basis. They did it before Sabu, and they are doing it now.

<comment><USER16> _If I had to guess, best case scenario he is going to be sentenced to 10 years._

Ten years? Even with a deal? Really?

That's astonishing if accurate.

<comment><USER17> Like I said, that's just a guess based both on the severity of his crimes and the tendency of the United States to overreact to anything that involves a computer.

I could very well be wrong.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> The FBI was never going to ignore huge stockpiles of easily accessible child pornography on the deep web, and Hacker News was never going to believe that this wasn't about more than child pornography. Just another day.

<comment><USER19> Do you assume that the techniques used for something most would assume to be reasonable will not ever be used in less desirable ways?

<comment><USER18> Police "techniques" involve guns, tear gas, helicopters, etc. At any time the police could in theory fly to your house, launch tear gas into your windows, and shoot you in the head as you run out. And I don't know about you, but I'm not exactly worried about that happening to the point where I want to take guns, tear gas, and helicopters away from the police.

This is the FBI taking down criminals engaging in a clear criminal activity, and it is silly to implicitly compare it to the NSA fishing for terrorists. All the evidence gathered here will be presented in a court of law, all the techniques used will have to be approved by judges as in accordance with laws and the constitution or the gathered evidence will be thrown out. The suspect and any other future suspects will get a trial if they want. It will be out in the open.

If you are upset that the software you thought was secure and anonymous isn't as secure and anonymous as you thought, that isn't the FBI's fault.

<comment><USER20> IANAL, but I'd be surprised if the police was allowed to raid me, launch tear gas through my window and shoot me in the head. Even with a warrant. I'm not worried about this happening, because it doesn't. If it did, I'm sure it would blow up into a huge scandal.

I am worried about government agencies intercepting my traffic / communications because it does happen, it's really hard to find out unless you know what you're looking for, and they don't have a warrant on every American citizen that happens to get caught.

<comment><USER7> > Even with a warrant. I'm not worried about this happening, because it > doesn't.

Spend a little time in here: [https://duckduckgo.com/?q=warrant+no+knock+raid+mistake&t=ca...](https://duckduckgo.com/?q=warrant+no+knock+raid+mistake&t=canonical)

Or here: [https://duckduckgo.com/?q=warrant++raid+mistake+death&t=cano...](https://duckduckgo.com/?q=warrant++raid+mistake+death&t=canonical)

Or here: [http://www.newyorker.com/online/blogs/comment/2013/08/swat-t...](http://www.newyorker.com/online/blogs/comment/2013/08/swat- team-nation.html)

I'm still waiting for the scandal.

<comment><USER21> Is there a difference between ddg and startpage.com principles? Because I find startpage to be more in-line with the results I want to see.

<comment><USER7> startpage serves you google results, anonymized. It's sort of like scroogle was, I suppose.

ddg, I _think_ , does their own spidering and also serves bing and other results (but not google), but that's from dusty memory and it could be wrong or changed. ddg will however forward your request to google if you want, and you'll get a results page from google itself. In fact I use ddg as a front end for google when I want to use google.

startpage is Dutch/American, ddg is American.

[https://startpage.com/eng/company- background.html](https://startpage.com/eng/company-background.html)

[https://duckduckgo.com/about](https://duckduckgo.com/about) [http://dontbubble.us/](http://dontbubble.us/)

ddg's Gabriel Weinberg posts here on HN. [https://news.ycombinator.com/user?id=epi0Bauqu](https://news.ycombinator.com/user?id=epi0Bauqu)

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> So, uh, that's a criminal offence in many jurisdictions.

Are we going to see international arrest warrants and extradition and trials?

<comment><USER23> Horray. A new growth industry for the us-ians. We'll export prison sentences! Just in time too. I hear we're running low on minorities with dime-bags of pot to incarcerate.

</comment></comment><comment><USER24> > The apparent FBI-malware attack was first noticed on August 4, when all of > the hidden service sites hosted by Freedom Hosting began displaying a "Down > for Maintenance" message.

The underlining reason for this has been the notion that the FBI was attempting to catch people engaged in CP related activities...

This maybe a little tin-foil here, but...

If you deliver a 404-type of a page on all requests, no website is traversed, no CP is viewed, transferred, replicated, or distributed. Meaning there is nothing here to charge the person with.

Does this article get the facts wrong, or was the purpose of this exploit something entirely different. Because if the article is true (this exploit was only in "Down for Maintenance" pages, which were the only pages served), all they did was get a bunch of useless IP to MAC to host-name correlation/mapping data for that moment in time.

There is also the 'Fruit of a poisonous tree' argument here. Would this untargeted hacking even stand up in court if this data is used to prosecute someone?

This sounds more like flexing of the muscles - the FBI saying we can get you if we want to. Or something else was going on. It also seems like a waist of a good exploit that they would probably use towards terrorist or national security related issues (ex: if they knew the MAC or host-name of a bad guy using TOR that day, but did not know his IP / so they put this out).

<comment><USER16> The way Tor works is that anyone can set up something called a "hidden service". It's basically a website that can only be visited by using Tor.

These websites have a unique URL. For example, Bitcoin Fog's URL is [http://fogcore5n3ov3tui.onion/](http://fogcore5n3ov3tui.onion/) If you try to visit that using a standard web browser, it won't work. But if you use Tor browser, then it takes you to the Bitcoin Fog hidden service.

Some of those websites were devoted specifically to delivering CP. Now the FBI's reasoning goes like this: anyone who was visiting those websites were very likely visiting them for the purpose of looking at CP.

The FBI delivered an exploit designed to identify as many of those people as possible. So even though no CP was being served, people were still accessing the URL. The malware collected the MAC address and hostname of the computer, then submitted that info to an FBI server. So those people were apparently added to a centralized FBI database.

One way that database might be powerful is if e.g. a politician (or any other government worker) were was identified as a visitor of one of these websites, because whoever controls that database now controls them.

</comment></comment><comment><USER25> This is actually a pretty good attack. The only problem I see is the usefulness of the evidence that the attack gathers. Visiting an FBI warning over Tor isn't illegal, so appearing in some child-porn-user database because you were curious about how the exploit worked is a little disturbing, given the stigma child porn has.

I'd also like to see the legal theory they used to seize control of someone's computer. Did a judge sign off on this attack strategy?

But ultimately, I think they used some pretty good software engineering to solve a problem they wanted to solve.

<comment><USER18> It most likely falls under the FBI's legal wiretapping abilities.

<comment><USER10> wiretapping normally require a specific target, with a specific reason. Going after the tor email service, is like wiretapping the US postal service for a fishing expedition.

It sounds to me as being outside the FBI's legal wiretapping abilities.

<comment><USER18> This is just wrong.

First, you are implying that Tor has an official Tor e-mail service, which it does not. Tormail is/was just a basic e-mail service someone not associated with the Tor project was hosting on the deep web. For all anyone knows, Tormail itself could have been run by the FBI or NSA or whatever all along. Anyone who thought Tormail guaranteed them anonymity was a fool, much like anyone who kept Javascript enabled while browsing the deep web was a fool.

Second, Tormail wasn't itself targeted. What was targeted was the hosting provider that was hosting 95% of child pornography in the deep web, and that hosting provider also happened to host Tormail and a bunch of other non child pornography websites.

Conspiracy theories will abound, of course, but keep in mind that the NSA's MO is not to disrupt communication but to intercept it. If the government's real concern here was with Tormail, they would have simply kept it around and tapped it, since they had clearly compromised the hosting provider's boxes and could have done so. They wouldn't have shut it down and just sent people fleeing to the dozens of other supposedly anonymous and secure e-mail services out there, including ones that perhaps they haven't yet compromised.

<comment><USER26> > What was targeted was the hosting provider that was hosting 95% of child > pornography in the deep web, and that hosting provider also happened to host > Tormail and a bunch of other non child pornography websites.

What the government did was the equivalent of show up at the houses of everyone who used a particular post office and forcibly finger print them because that post office routed 95% of the child porn magazines in the US (regardless of what percentage of their traffic that actually was, which you don't even mention besides 'there were other sites, too').

That would be a clear abuse of powers, as is this.

</comment></comment></comment></comment></comment><comment><USER27> This would make the FBI guilty of a whole bunch of felonies, would it not? (Independent of whether what they were doing is morally right or wrong, isn't this exactly what they imprison hackers for?)

<comment><USER28> You cannot arrest the U.S. government for felonies.

<comment><USER29> Huh? Surely if they started killing innocent people you could arrest them.

The question is what gives them the authority to use these tactics? Wiretapping laws?

<comment><USER6> They started killing innocent people very early in the government's history and have yet to stop.

<comment><USER29> _Sigh,_ I should have expected this response. You know what I mean.

<comment><USER6> White innocent people?

</comment></comment></comment></comment></comment></comment><comment><USER30> _> "Mozilla confirmed the code exploited a critical memory management vulnerability in Firefox that was publicly reported on June 25, and is fixed in the latest version of the browser."_

Will Rust help eliminate the problem of buffer overflows and other memory related hacks?

<comment><USER31> IIRC the original attack was a JS heap spray (using JavaScript Typed Arrays, no less), so not only would the browser have to be written in rust, but also the JavaScript engine which, AFAIK, isn't on Mozilla's roadmap (but I don't speak for them).

<comment><USER32> Uh, no. A heap spray is not an attack. It's a method of exploiting a vulnerability, but it's a) trivial to do and b) useless without said vuln. Also rewriting the JS engine in Rust doesn't change the ability to heap spray.

</comment></comment></comment><comment><USER33> What is happening to this world? The Government and it's so-called agencies vested with protecting America and its allies are treating everyone like criminals, privately harvesting our information via any means possible.

They don't even have to hide it any more. They can admit things like this and nobody can do anything about it. We've passed the point of being able to defend ourselves against actions like this. Every step we take to protect our privacy, the Government is presumably two-steps ahead.

We just can't win...

<comment><USER34> Pff. That's like saying the government is spying on you because you saw a police officer look at you when you walked past a police car. Personally, I am just fine with the FBI harvesting the details of anyone who visits a CP site. So this puts strain on the network and causes loss of functionality for non- illegal uses of Tor - inconvenient, but then it's also inconvenient when you can't park because a police car, fire truck, or ambulance is taking up the space you hoped to park in. On a scale of 1 to 10, the harm suffered by non- criminal Tor users during this sting operation looks to me to be about a 1 or a 2.

</comment></comment><comment><USER35> From my point of view there appears to be a huge campaign to discredit Tor or short FUD going on.

Okay, lately there appears the be a huge campaign to discredit Tor going on. The botnet, the Freedom Hosting thing.

We should fight back on that. Tor is still the best took we have and maybe these attacks are the best sign of it.

If you consider switching to a VPN like many do..

That's a bad idea. VPNs are no technology for anonymity. There are various reasons. They don't defend against various attacks, but more importantly they are owned by private entities. Did you hear of this PRISM thing? [rhetoric question] Well, guess what a private company.. even outside of the US would do if any government would ask for a backdoor, maybe even offering money.

A reason why there are these great releases about attacks on Tor is the fact that it is the best tool we have. There are attacks on it, but way less than on any comparable technology. Numerous institutions, universities, etc. work on both finding attacks and improving Tor. The Tor community is attracting the smartest people in the world, just like the NSA is. There is no other anonymity software with so many scientific papers written about it. There are attacks, none of them reaching beyond what can be done to VPNs, etc. and there are tons of improvements that are outlined, that only need a tiny bit more research or only the actual implementation. If you want to work on a real quality product for the greater good there probably is no better place than the Tor Project.

If you wanna help right now (meaning in seconds to minutes) here are some places to go.

If you want to host a Tor Bridge on the cloud for free or really cheaply: [https://cloud.torproject.org/](https://cloud.torproject.org/)

If you are using Firefox: [https://addons.mozilla.org/en- US/firefox/](https://addons.mozilla.org/en-US/firefox/)

If you are using Chrome/Chromium: [https://chrome.google.com/webstore/detail/cupcake/dajjbehmbn...](https://chrome.google.com/webstore/detail/cupcake/dajjbehmbnbppjkcnpdkaniapgdppdnc)

If you have a website/blog: [http://crypto.stanford.edu/flashproxy/](http://crypto.stanford.edu/flashproxy/)

If you have more than just a few minutes: [https://www.torproject.org/getinvolved/volunteer.html.en](https://www.torproject.org/getinvolved/volunteer.html.en)

<comment><USER36> Flashproxy seems pretty dark unless I've misunderstood it - <USER2> opting website visitors in to becoming a transient TOR node is deeply unethical.

</comment></comment><comment><USER37> Looks like it's all out war between the government and people who value their privacy...

Really, it always was, but it was a sort of "undeclared war". Now there's really no question about what's going on, so it's time for the gloves to come off.

</comment><comment><USER38> Why are MAC's persistent?

They're totally insecure, so you can't make sensible security decisions off of them. Why aren't they randomly assigned on power-up?

<comment><USER39> drivebyacct2, you're hell banned

</comment></comment><comment><USER40> This is crazy, but really interesting at the same time. I always thought that this was the way to break anonymity on the Tor network.

FBI basically generated a shit-load of Tor nodes ([https://blog.torproject.org/blog/how-to-handle-millions- new-...](https://blog.torproject.org/blog/how-to-handle-millions-new-tor- clients)) for some while to increase their chances of intercepting traffic. Following the data collection and using statistic, they were able to pin-point the origin of most Freedom-hosting request/response, and then raided the place.

Think about it: if you own 9/10 of the node of the Tor network (and they did for a while) and simply analyze all the traffic, it's just a matter of time before you can find what you are looking for.

The second interesting thing is how they planned everything using the Firefox exploit to find out who was going on each Website. I'm pretty sure they got what they were looking for.

Even thought this is highly scary in term of government control, I think we can all learn a lot about it. Also, I'm wondering how much this attack cost.

<comment><USER41> > FBI basically generated a shit-load of Tor nodes > ([https://blog.torproject.org/blog/how-to-handle-millions- > new-...](https://blog.torproject.org/blog/how-to-handle-millions-new-...)) > for some while to increase their chances of intercepting traffic.

The blog post you link to was about a recent massive increase in Tor clients, not Tor nodes.

From what I've read I was under the impression that Freedom Hosting itself was hacked to disclose its IP addresses, rather than the FBI taking over the Tor network.

</comment></comment><comment><USER16> What's worrisome is that if they were willing to burn this Firefox JavaScript exploit, then that probably means they know of at least one more.

<comment><USER42> Keep in mind that this was a known and fixed vulnerability, not an 0day. 'Burning' is a bit misleading in this context.

</comment></comment><comment><USER43> It's like the government isn't even pretending anymore that they don't constantly break the law.

</comment><comment><USER44> this is fantastic. now I know who I can sue for destroying the tormail accounts I was using for (legal) business purposes. Probably the best news I've had since Tormail went down.

</comment><comment><USER45> In a proper judicial system any evidence gained resulting from infecting computers with malware by law enforcement would automatically be inadmissible because the owners of those computers were no longer the only ones with access.

</comment><comment><USER46> If this is the only manner that the FBI --or any law enforcement for that matter-- has for identifying TOR users, then wouldn't the best operational security just be to firewall yourself off completely except for Tor connections? Better yet, you could monitor what applications are trying to broadcast out even if they are designed or intended not to leak. Isn't this what the TAILS live-CD does? For this case, even if your software was out of date and vulnerable to the initial attack on the browser, the attempt to broadcast out would hit a firewall and fail (and ideally be logged and alerted).

<comment><USER47> ..or just adhere to common sense and disable javascript.

<comment><USER48> ... at the packet level.

</comment></comment></comment><comment><USER49> My two cents about the "french hosting provider" : The 22 of july, the french hosting provider OVH suffered an APT attack from intruders looking for the database of european clients. The 29 of july, OVH announce new rules about using Tor on their network... In august Marques is arrested.

[http://d4n3ws.polux-hosting.com/2013/09/14/freedom- hosting-l...](http://d4n3ws.polux-hosting.com/2013/09/14/freedom-hosting- lattaque-de-de-anonymisation-sur-tor-est-bien-a-linitiative-du-fbi/)

</comment><comment><USER42> Oh, the malware!

What do they do about users who do not turn on Javascript?

Or users who do not use the popular browsers?

It seems like the malware authors here, government employees or contractors, are just like all the others that form the underbelly of the internet... they only focus on the least sophisticated users or the users who always follow the herd (not the Hurd): Windows and OSX/iOS users.

Assumptions, assumptions, ...

<comment><USER50> They were specifically targetting the version of firefox bundled with the Tor Browser Bundle.

</comment></comment><comment><USER51> This is about child pornography. I support this action by FBI for a change. The deep web is rotten in some respects. Child pornography cannot be allowed anywhere. If I were in the FBI, I would do anything to stop child abuse.

</comment><comment><USER52> I don't understand why he isn't being prosecuted in Ireland.

</comment><comment><USER53> So the more you try to hide your ass, the more you get targeted

</comment><comment><USER54> It's sad everyone on here is amazed the good guys have good tools. Sure it probably cost them $1M USD to have some server record an incoming ip from an http request, but still.

"Oh noes, we aren't 3 steps ahead of them, they are 3 steps ahead of us." Fuckin-a they are and I'm glad.

Getting rid of scumbag terrorists, child porn shitbirds and spying on foreign adversaries is fine by me.

And yes, I already know the comments will be "what if they designate you a terrorist some day". I suppose I will cross that bridge when that happens.

<comment><USER55> What are you talking about?

Nobody is amazed that the "good guys" (btw, whose good guys?) have good tools. It's been known for decades that the USA has some of the best signals intelligence people and systems.

But that's not even relevant here. This particular attack exploits a known issue of Tor, which has existed by design since day one. Hacking machines isn't rocket science, and the particular vulnerability in Firefox was public before the attack.

What people _are_ surprised by is the brazen and open use of an illegal hack by law enforcement officials. We have laws for a reason and lawmen to uphold those laws. When the lawmen are breaking the laws we're pretty much fucked. I'm sorry that you can't see that.

<comment><USER56> _This particular attack exploits a known issue of Tor, which has existed by design since day one._

Just so everyone's clear, this was not a "known issue of Tor". It was a javascript based Firefox exploit.

<comment><USER55> The known issue of Tor that I refer to (and sorry for not being more specific) is that a buggy client can leak your identity. The Firefox exploit leverages this design weakness.

</comment></comment></comment></comment><comment><USER57> Misleading title - the FBI did not conduct a 'mass malware attack'

<comment><USER58> The FBI didn't conduct a 'mass malware attack' on the open web. It did, however, inject malicious code in Tor hidden services that were hosted in Freedom Hosting.

How is that not a 'mass malware attack'?

</comment></comment><comment><USER59> So, don't trust spy agencies?

</comment><comment><USER60> WTF? Can we even trust the water we get from the government? Maybe they put some meds in there to make us dumb and complaint. Is that too far fetched now after what we've reading?

 _> > Donahue also said Marque had been researching the possibility of moving his hosting, and his residence, to Russia._

Nice try FBI, but I have a feeling that Puttin's Russia will have him a gulag after a 5 minute "trial," appeal included.

<comment><USER61> _WTF? Can we even trust the water we get from the government? Maybe they put some meds in there to make us dumb and complaint._

Funny you should mention that -- I believe that water fluoridation was once suspected of being a communist plot to more or less the same effect.

<comment><USER62> Not just "once". Many conspiracy theorists still believe that it is some form of government plot or another. The theories range from it being a toxic waste disposal scheme that is poisoning people (and as far as I know, there is some basis for the claim that fluoridation came about as a way to cheaply get rid of a relatively toxic byproduct; that doesn't validate any other part of it though), to fluoride being used as a mind control chemical (usually pointing to drugs like Prozac that include fluoride as "evidence").

Of course, none of these "theories" manage to address the fact that there is fairly strong evidence that water fluoridation does in fact reduce tooth decay.

<comment><USER63> > _Of course, none of these "theories" manage to address the fact that there > is fairly strong evidence that water fluoridation does in fact reduce tooth > decay._

Not agreeing with those theories, but this argument is flawed.

Even if it does "reduce tooth decay", so what, in the context of their argument? Who said a substance can't do two things at one time?

<comment><USER64> It isn't proof, it's supporting evidence.

<comment><USER63> It's only "supporting evidence" if they said that it doesn't also help with teeth.

</comment></comment></comment></comment></comment></comment><comment><USER65> Let the dark wars begin.

<comment><USER66> The hilarity here is that Anonymous and the FBI had the same target this go- round.

<comment><USER67> In case you hadn't heard, much of "Anonymous" has been FBI-sponsored activity.

<comment><USER68> Source?

<comment><USER67> E.g., [http://www.theguardian.com/technology/2012/mar/06/lulzsec- sa...](http://www.theguardian.com/technology/2012/mar/06/lulzsec-sabu-working- for-us-fbi)

Check the timelines. Some of Lulzsec's most dramatic attacks were carried out with an FBI agent literally looking over Sabu's shoulder.

'Opdarknet' in particular seemed quite a bit different from the rest, in the MO (basically the same as the FBI used against Freedom Hosting) and the wording of their release.

<comment><USER68> I forgot about the whole Sabu thing. Thanks.</comment></comment></comment></comment></comment></comment>


Reddit has now been down for 30+ hours - <AUTHOR> http://www.reddit.com/?down For the first time ever the admins have pushed a hand curated content (where did they get that one from?) to the top.<p>Seems to be like the community is well past the state of being angry when the site gets back up. They will be so glad that it is back at all. Need more donations Conde Nast? <comment><USER2> Being a sys admin and having to plan disaster recovery I can understand this scenario. I've played it out in my mind, its been done to death on paper and we've tested it. My question is, why aren't reddit doing anything about it? After numerous outages over the past few months it seems reddit's answer to everything is, "It's not our fault, it's Amazon". In all honesty without turning this into an attack that is ridiculous. If my company were to suffer outages on a weekly basis, my boss and I would both be under the gun and seriously before it even got to that point we would be restructuring systems and shifting hosting platforms. Before anyone says to me, "hold on, you cant just go moving infrastructure". BS. When your business is the website and you are providing a service, availability is damn well key. I've moved datacenters more than once, I've delt with disaster recovery, I know how to do these things transparently and before you start thinking I'm arrogant well actually I only have 4 years of experience in the system administration game so I'd expect people with more talent than me to be able to get the job done pretty damn effortlessly. If our company suffered an outage of more than 3-4 hours we'd be switching to our DR plan end of story. That means switching dns and pushing to warm standby servers.

Engineers of reddit, take some initiative. Move off aws. I dont care how hard it is, look at the outages you've suffered. Look at the problems you've had. Havent you figured it out yet? Get some physical hardware with rackspace and sort it out.

Please understand this comment is not meant to attack anyone but I am frustrated with people shifting blame and not taking responsibility. If your down 30 hours then you have failed.

<comment><USER3> Reddit has < 5 engineers working on it and in the last few months has been at 1 active engineer for a while. With 13mm unique visitors and > 1 billion page views monthly let's cut them some slack.

<comment><USER2> Let me ask you. How does a company get into that state? Say you had 5 engineers, 1 billion page views a month and ongoing issues. Wouldn't you dedicate some resources to that? When one engineer leaves, wouldn't you worry a little? And then another, and another? Would you sit and do nothing? These events did not occur in a day. They occurred over a lengthy period of time. I can sympathize with the lone engineer because I've been there. I still sleep with my laptop and phone next to my head. I know what the burn out feels like, so yes I feel for that engineer. But as a business letting it get to that point.

edit: JonnieCache mentioned Conde Naste will not let them hire more people. Obviously we know where the fault lies then.

<comment><USER4> _> JonnieCache mentioned Conde Naste will not let them hire more people._

Yeah, I imagine the situation is more complicated than that, but look into some of the reddit blogposts and some of the admins comments on here for more details. There was a lot of stuff in the big 'AWS is down' thread about it, something about CN giving them an unlimited operating budget but a tiny, non negotiable hiring budget. God knows.

<comment><USER5> Gist I got from the 'AWS is down' thread was they had maxed their operation budget and that was why they couldn't afford to use multiple regions. Reddit being very write heavy the data synchronization across regions would be too expensive in both bandwidth and manpower.

</comment></comment></comment></comment></comment><comment><USER6> I was wondering why I was logged in, able to comment and vote.

They're letting back in members slowly, with Reddit Gold members having a larger chance of being allowed in: [http://www.reddit.com/r/reddit.com/comments/gv63r/nobody_can...](http://www.reddit.com/r/reddit.com/comments/gv63r/nobody_can_login_or_vote_except_gold/) . Be sure to read the comments by jedberg, one of the reddit staff.

Edit: Now the top of reddit says:

>UPDATE: We are slowly getting our capacity back and as such allowing a random subsets of redditors access to the site as we increase capacity. Please check back soon, as you may be able to log in if you are lucky. Thanks!

</comment><comment><USER7> Maybe it's just me. I feel HN has become very sluggish this morning. Does that mean lots of redditors come over here?

Edit: Wierd, got downvoted. I do think this is related to the topic, so the failure of Amazon can have a domino effect, say, AWS fails -> Reddit fails -> HN sluggish/struggling -> ... Some times I really question the resilience of the social networks, as most of them may not be designed to handle 2x or 10x more load.

<comment><USER8> > Does that mean lots of redditors come over here?

I know I did.

</comment></comment><comment><USER9> It's amazing that AWS has been affected this long, or rather that their customers have been; here focusing on one big customer, Reddit. But actually what seems more relevant to me, vis-à-vis sites like Reddit are services such as Heroku which were or still are affected. Although I can appreciate that Reddit is an extremely popular site, at the end of the day I'm more concerned with the development services that were impacted.

</comment><comment><USER10> Btw, has Amazon commented about potential irrecoverable/lost changes/damages, if any?

</comment><comment><USER11> They are sort of limping back up now. Some users -- seems to be mostly gold users right now -- can get in.

<comment><AUTHOR> It is reddit. Not experts-exchange. If it were "gold users can now login" that would be bad.

<comment><USER12> If they have to let users back in slowly (which they do), why shouldn't it be ones that contributed financially to the site?

<comment><AUTHOR> If it has to be based on a metric, it should be based on the Karma. "Who contributed the most for the site."

<comment><USER13> They had a bad outage around a year ago which was the first time I saw the "emergency read-only" notice. Back then, the metric was "age of account". Even though by that metric, I would have been one of the first users back, I really don't mind that the Gold users are being let in on a "biased random" basis. As ceejayoz said, "why shouldn't it be the ones that contributed financially"?

The three metrics mentioned so far all have issues, but I think I like yours the least.

Gold - "Thanks for helping fund the site. Hopefully your dollars will let us hire folks that will ensure this doesn't happen again." Age - "Thanks for sticking by our little site through all of our outages. We know you've had to put up with a lot, but we appreciate it." Karma - "Thanks for all the cats. We love cats."

I realize that I'm lumping a lot of users who post great informative content in with the "better drink my own piss" image macro crowd, but karma just doesn't seem like the best metric here.

It's also harder to come up with a good threshold for karma. Where do you draw the line? 10k karma? 100k? Are we only including comment karma or submission karma? Both?

At least the Gold members have, in general, unambiguously contributed to the site. I don't have a problem using that as the primary metric here.

(I should note that I'm a reddit plebeian in this regard. I have no golden dog in this fight.)

<comment><AUTHOR> This conversation is rather had there, at reddit. And since this morning, the response on the reddit itself is much on the lines of how I predicted it.

</comment></comment></comment></comment></comment></comment><comment><USER14> If I understand correctly, sites using AWS, and reddit.com for sure, are geared towards automatically starting and stopping EC2 instances as needed. If that is the case, why can't they just move everything to a different region, which hasn't been affected by this disaster?

</comment><comment><USER15> Is there any proof that Conde Nast is trying to starve-off Reddit so they can maybe write it off on their taxes? They just don't seem to have a single ounce of pride in owning it.

It's amazing how much has been done with it's development given how little they have to work with.

</comment><comment><USER16> I recently set up a website, and did consider AWS to host it. I decided not to, based on the problems Reddit had been having with AWS. I eventually got a VPS; looks like I made the right decision.

<comment><USER17> Counterpoint: We've been happily using AWS for several years now. We haven't had one second of downtime. We host across multiple availability zones, and have been pretty insulated. We are hosted in the eastern region (which was the one having issues yesterday), but managed to get through everything ok. We did lose some instances in one AZ, but failed back to our other instances without any incident.

ANY provider is going to have issues, the AWS actually gives you a bunch of nice options to easily handle those. I'm not saying that everyone should use Amazon, but don't take Reddits issues (I'm not familiar enough with their architecture to know where the fault really lies) to be the only data point for AWS reliability.

<comment><USER18> If you do use AWS, however, it is vitally important to understand the tools they provide for redundancy, and their limitations. There are multiple availability zones for a reason, and although there was some multi-AZ downtime at the start, that recovered relatively quickly.

</comment></comment></comment><comment><USER19> I'm kindof curious how they're going to deal with the self-serve ads that were supposed to run yesterday.

Just a straight refund, or...?

/me patiently waiting for it to come back up so that I can buy some for next week... :(

<comment><USER5> jedberg said yesterday he will add a day to the self-serve ads.

</comment></comment><comment><USER20> Sadly, my productivity has not improved one bit :(

</comment><comment><USER21> I wonder what the users of Reddit are doing? going for a walk outside and enjoying the nature?

<comment><USER22> Maybe this is Amazon's way to tell Reddit addicts to stop and smell the flowers? :-)

</comment></comment><comment><USER23> If anyone from reddit is reading this, I tried to sign up for Gold so I could log in, but I can't because signing up requires you to log in. I suspect I'm not the only person who would have happily bribed you to get to the head of the line. I think you guys left a lot of money on the table.</comment>


Show HN: Chrome Extension to see results with the previous style (green URLs) - <AUTHOR> https://chrome.google.com/webstore/detail/google-classic-results/mncmlbggmdcmddddanjcgabpajadljhm <comment><AUTHOR> Hi!

I'm Yasu, and I recently worked on a very simple Chrome Extension to revert google results back to what they used to look like before the recent change a few days ago.

Let me know what you think!</comment>


Jason Cohen: How to work out whether advice is helpful to you. - <AUTHOR> http://blip.tv/file/4933967

<comment><AUTHOR> Jason Cohen's talk at Business of Software <http://businessofsoftware.org/>

How to filter advice from others. Brilliant advice, but don't take it as the absolute truth.

</comment><comment><USER2> This talk summarizes a big chunk of what people submit to HN.

The arguments about bootstrapped vs funded, lifestyle vs selling out, lean vs not, MVP vs GDP, internet celebrity worship - all covered pretty well in an hour.

</comment><comment><USER3> I found the Dimensions of Advice particularly useful. It can found at the 45:20 mark.

</comment><comment><USER4> Wow....I don't know why, but I always thought Jason was much older. Like 45 - 55.

But he looks/sounds much younger in this talk.

Btw, interesting presentation!

</comment><comment><USER5> Great Talk

Acid test: can I go out and personally retrieve 30 customers @ $49.95/month?

Hm...Do adwords campaigns count? I would love to hear more about this.

<comment><USER6> He wrote about this some on his blog: <http://blog.asmartbear.com/vetting- startup-ideas.html>

I don't see why AdWords couldn't work if you built the right experiment. For example, a simple email-capturing landing page with a price tag doesn't touch on it as much as personally talking to people and finding 30 who _will_ (not would, as Jason emphasizes) pay at that price. You can learn a lot from just talking to folks, and an AdWords campaign could help you get in touch with the right people.

</comment></comment><comment><USER7> I wish this were better written and better edited. I gave up after 2.5 min.

<comment><USER8> I think you should give it another chance. The first few minutes aren't very interesting, but once the actual talk starts it's great.</comment></comment>


Open-Source Clojure Library for Geospatial Information - <AUTHOR> http://blog.factual.com/open-source-clojure-library-for-geospatial-information <comment><USER2> For those that don't recognize the name on the blog post, this is aphyr, who has been publishing the excellent "call me maybe" technical posts.

</comment><comment><USER3> This is excellent news. Without knowing much clojure or looking deeply into the source, I wonder if or how this project does or plans to handle projections and coordinate systems? I find this capability to be among the really important things that geospatial libraries provide.

</comment><comment><USER4> This is great news and I applaud the work. The state of open source for geospatial geometry has frequently been fragmented and dodgy at best so this effort to unify it are a step forward. PostGIS is the crown jewel of open source for GIS processing but a broader set of tools is much needed.

The only caveat looking at this is that the geometry computation is not suitable for some types of geospatial analytics. This has been a persistent gap in open source geospatial tools. The challenge is that closing this gap is a pretty esoteric topic in applied mathematics that only a handful of people are really qualified to address and few of them seem to be contributing to open source. Still, any progress is good.

<comment><USER5> Can you expand on what the esoteric topic is and its application?

<comment><USER6> Translating between coordinate systems and basically anything that involves mapping and measuring in 3 dimensions on an irregular not-quite-spherical surface is really hard to get right.

<comment><USER7> I didn't make this picture, but it gives a good idea on the "irregular not- quite-spherical surface" part.

[http://alienspacesciencenews.files.wordpress.com/2013/10/an-...](http://alienspacesciencenews.files.wordpress.com/2013/10/an- example-of-the-spatial-relationship-between-a-local-datum-a-global-datum-and- the-geoid-is-represented-in-the-following-figure-wgs84.gif)

The Local Datum could be NAD83 or what-have-you based on where you are on the surface. Using the local datum gives better distance measurements and more accurately can represent elevation.

<comment><USER6> That's a pretty great image. I'll have to remember it for next time someone asks why is all this so hard and can't we just use WGS84 for everything.</comment></comment></comment></comment></comment>


Big Tech adding 20000 jobs by 2022 in NYC - <AUTHOR> https://www.nytimes.com/2020/01/05/nyregion/nyc-tech-facebook-amazon-google.html <comment><USER2> I find it absurd how tech is blamed for gentrification in various cities, but particularly New York.

Finance, law, inherited wealth, foreign buyers have been purchasing NYC real estate for decades.

At least the technology industry contributes to economic growth. The rest is largely a result of rentier capitalism and oligopoly.</comment>


CloudEvents 0.1 – A common set of metadata to help process events - <AUTHOR> https://medium.com/@austencollins/introducing-cloudevents-a758c62c76bf <comment><USER2> Harmonization between vendors is good. If all this is is common names for headers and keys to cut down on trivial divergence, this is great.

As for the big picture, one of the unfortunate consequences of HTTP having recently won out as the default protocol for remote interaction is having to reinvent or re-frame all of the prior art that's been in use with other platforms. There's half a dozen other pubsub messaging protocols and their associated framing and envelope specs, but they usually define full semantics around addressing and routing -- and usually run on lower-level transports than over HTTP.

Since this effort doesn't want to prescribe every facet of messaging, it can't directly define a more restrictive profile or overlay of an existing protocol. Instead, it has to start fresh, and invent yet another envelope format. Someday, someone will ask why there isn't a simple way of getting MessageID or MessageTimestamp across a variety of technologies whose purpose is largely the same, yet I don't think anybody will go back and define a one true mapping between the protocols. If some vendor later decides to accept AMQP as well, they'll write some glue code to translate, but if another vendor accepts it too they'll write their own independent mapper. This is one of the ways that incompatibilities proliferate: actors left to their own devices in the absence of unambiguous guidance.

It shows that standards can be both extremely useful and frustratingly bound to fashions.

<comment><USER3> Certainly true, CADF is a good format for auditing events, but in implementation the several I've used seen, support most of it, and make some subtle changes. That divergence causes it to be a mostly standardized format which might as well be a non-standradized format, involving mappings, etc.

</comment></comment><comment><USER4> > Vendors (especially nascent ones) have an opportunity in serverless, if they > decrease emphasis on trying to copy each other's services, and instead > innovate new serverless services that offer unique, best-in-class, value > propositions.

I think this is super important. In the serverless space, we've seen a couple of larger API vendors (Auth0, Twilio, ...) build their own FaaS. This is great for "Hello World" projects, and projects focused only around that single API.

But I believe that for all bigger projects, that work with multiple APIs, you end up in hell. Some functions running on Auth0 webtasks, some on Twilio Functions and some on a cloud-vendor FaaS? Sounds like a maintenance nightmare.

What we tried is to integrate our events with the three big cloud players. It's doable rather quickly as long as it's just "dumping a message into a queue".

I think a spec like CloudEvents can make such integrations easier in the future, and it would allow us to make use of higher level features of the cloud providers, without having to deep-dive into their specific products. I'm petitioning my PO to give me some time to make our API compliant with CloudEvents :)

<comment><AUTHOR> Great points and good luck!

</comment></comment><comment><USER5> This looks similar to CADF [1], which is used by OpenStack, but it looks less structured.

In CADF, each event has a target (the thing that is changed or being viewed), an initiator (the user performing that action), and possibly an observer and reporters. I'm not sure if CloudEvents wants to be intentionally minimal, or if it just hasn't developed to the same intricacy as CADF (as the 0.1 version number suggests).

[1] [https://www.dmtf.org/standards/cadf](https://www.dmtf.org/standards/cadf)

Context: I work on an internal OpenStack deployment at SAP that uses CADF for auditing.

<comment><USER3> The references contain an OpenStack audit middleware event [https://github.com/cloudevents/spec/blob/master/about/refere...](https://github.com/cloudevents/spec/blob/master/about/references.md)

I'm a contributor on the project, and have been working to make sure that the use cases fit both requirements.

Can be difficult to maintain both, with naming conventions of the particular entities, but so far it seems to be moving forward, and the working group is collaborative.

<comment><USER6> Isn't it weird to have references to some AWS services, but not CloudWatch Events itself? To me that would be the service that makes the most sense as a comparison point.

</comment></comment></comment><comment><USER7> This article has too much self-congratulatory tone that comes off as a bit disingenuous. A single person didn't invent 'serverless' and 'spread it all over the world'.

Also, most efforts are team-effort.

<comment><AUTHOR> Good feedback. Didn't intend that. The goal was to give a personal perspective starting from the beginning of the serverless trend, to highlight why the effort is meaningful.

<comment><USER7> Thanks for the clarification. That makes more sense with your explanation.

</comment></comment></comment><comment><USER8> This looks somewhat interesting.

but I couldn't help but to point out that while healthy self promotion is good, the author needs to notch down a little on the "I".

</comment><comment><USER9> So is this all an effort to combat amazon's dominance of the market? Because I see every competitor to them on this standard except for them.

<comment><USER3> I don't think we're thinking about AWS at all, at least I'm not, nor have I ever heard them brought up in that context. We see a problem, we have a problem, we're working together for a combined solution that fits our use cases.

We have included AWS examples and considerations for their requirements, if they choose to be involved or not is on them.

<comment><USER10> Agreed, I think this is more an effort to have a free flow of event and information. It's not that one organization has a monopoly on it, it's that all users suffer small painful taxes at every boundary. Collectively they become rather large and this is a way to address that.

<comment><AUTHOR> +1

</comment></comment></comment></comment><comment><USER11> Why did they have to name it cloudevents? What's in it that restricts the use of it to the cloud? Surely you can structure events acc.to this spec without using public cloud.

<comment><USER10> I would say it's more cloud native than cloud restricted. In the past we used to try to bring things from outside of the cloud into to the cloud, now we're starting to bring things born in the cloud out of the cloud.

<comment><USER12> Ironically, the spec under the CloudEvents standard is much less restricted to cloud-based objects than its early working version "open events"

We considered a number of cases where the event source is not addressable software. Heck, your local library can emit a feed of cloud events where the event source is an isbn Uri.

</comment></comment></comment><comment><USER13> Idea: Distributed peer-to-peer "serverless" computing, where you gain points/money for computing, that can be used to run your own functions.

<comment><USER14> Sounds like ether or one of the many projects built on it (golem?).</comment></comment>


Ask HN: Why is transacting small sums of money (micropayments) so expensive? - <AUTHOR> Why is it so expensive to make transactions < $1?
Enabling people to exchange tiny sums of money would make a number of financing issues over the internet and in real life considerably easier.
Many have attempted to tackle this problem and no one has succeeded. <comment><USER2> The overhead to transfer ten cents is the same as the overhead to transfer $1000, but your profit is going to be minuscule for facilitating the transaction.

<comment><AUTHOR> Sure, but why is the overhead so high?

</comment></comment><comment><USER3> It's not that it's expensive, there are plenty of crypto coins that can do this cheaply.

The main issue is that there doesn't appear to be much demand for this. No micropayment solution has gained mass adoption and there have been plenty of attempts.

<comment><AUTHOR> In this instance I would argue that poor use ability is at fault.

Patreon is certainly evidence of this need.

</comment></comment><comment><USER4> Because the people who would secure the micro transactions would br counter party to tons of risk & compliance costs.

If you are going to be take on tons of counterparty & compliance risk it's easier to make money in other markets.

</comment><comment><USER5> I'm also curious about this, specifically why such a big fixed fee. Couldn't we just have digital prepaid cards with only a percentage fee?

<comment><AUTHOR> I think it's always going to be a fixed fee.

But why is that fee so high?

Hat are the actual, person to person, machine to machine mechanics that make it expensive?

</comment></comment><comment><USER6> Like any business, financial firms have fixed costs. You can only reduce these costs so much, hence the large percentage on small transactions.

<comment><AUTHOR> I understand that.

But why are the fixed costs of moving any amount of mo way so high?

It would be great to a detailed walk through of all of the mechanics the varying systems of exchange use.

<comment><USER7> Compliance, integrations, archiving, reliability, staff, electricity, dividends -- banks and intermediaries are for-profit businesses. Somobody needs to pay for that.

Crypto transfer costs too -- miners do bankers job.

<comment><AUTHOR> I want to understand deeper though. I get how their businesses work at a high level.

But why is all of that required to facilitate a transaction?

</comment></comment></comment></comment><comment><USER8> Personal bank transfers are free in most of EU.

<comment><AUTHOR> True, and the open banking api may allow this to occur!

Again though, right now the UX is basically unusable for frequent transactions.

</comment></comment><comment><USER9> Why should it be cheap?

<comment><USER10> To facilitate the exchange of goods between individuals. To make it so that people can donate small sums to whatever they want. To make less costly the transfer of funds.

Why shouldn't it be cheap?</comment></comment>


Building a higher-level query API: the right way to use Django's ORM - <AUTHOR> http://dabapps.com/blog/higher-level-query-api-django-orm/

<comment><USER2> The main point raised by the article is spot-on, and I'm ashamed to say that I had never recognised it as an issue before reading it. It applies even more strongly for more complex lookups (possibly involving Q objects), which I've always felt would find a better home in models.py than in views.py. And I too cringe every time I come across the django.db.models.manager source code.

Some thoughts:

The approach goes slightly against the commandment of "there should just be one way of doing it". It's probably best to apply it sparingly, only where there are very clear readability and/or DRYness improvements to be had.

The `PassThroughManager.for_queryset_class(TodoQuerySet)()` bit is a bit intimidating, especially to someone not familiar with django-model-utils. I'd probably take the time to write a `manager_with_queryset(queryset, manager=models.Manager)` function to make things more readable.

When you're trying to convince someone that the way they currently code isn't optimal, it really helps if the code you use to illustrate the current way looks like something your reader is likely to write. The strangely formatted filter chain at the start is thus really off-putting. Instead of adding three disclaimers asking the reader not to focus on the implementation details, why not just write it the way most people would:

        todos = Todo.objects.filter(
            owner=request.user,
            is_done=False,
            priority=1,
        )

No need to make the current way of doing things seem unnecessarily convoluted, the point you're making still stands. Though I'll admit that when you're forced to throw an .exclude() into the chain, it starts looking a lot like your example.

<comment><USER3> Agreed. I found the contrived chained filters at the beginning of the article off putting but the rest of the article was quite interesting.

<comment><USER4> I completely agree, but I think this was author's way of demonstrating how ugly a call to the ORM can get. With his very simple to-do list app I think this was the easiest way for him to do that.

In real life you would obviously have all your filter in one call (most of the time), then perhaps .values call with an .annotation call in there too.

</comment></comment></comment><comment><USER5> I can't agree more. Always wrap your ORM with your own logic that makes sense to you and your application. You'll find code reuse will go way up, readability will go way up, testing is easier. You can actually test the model without bootstrapping the whole app. I've been preaching this in my SqlAlchemy talks and tutorials for years.

<comment><USER6> For our project I've been thinking about this a lot lately. Could you maybe elaborate on how you did this with SqlAlchemy and how you write your tests against the new model? Do you now of any more in-depth articles on the subject?

This really seems to hit a sweet spot of moving business logic into the model and I would love to use this in some form.

</comment></comment><comment><USER7> Wait, what's wrong with:

      class Todo(models.Model):
        content = models.CharField(max_length=100)
        # other fields go here..

        @classmethod
        def incomplete(cls):
            return cls.objects.filter(is_done=False)

        @classmethod
        def high_priority(cls):
            return cls.objects.filter(priority=1)

<comment><USER8> There's a couple reasons that's not ideal.

The big one is that you'd lose filter chaining. With your example you couldn't do

        Todo.objects.high_priority().incomplete()

The other issue is a semantic one. In your example you could do:

        Todo.objects.all()[0].incomplete()

which will return a QuerySet of _all_ incomplete Todo items. This, at least to me, doesn't make sense.

The last reason is that by using a Manager you are encapsulating this filter data. If you later decide that you want to create a new model with similar types of filters, then you'd have to rewrite these methods. With a Manager, both models can simply use the same manager.

<comment><USER7> No, I believe you've read the code above incorrectly. This would be, for example:

      Todo.high_priority().all()

and would allow, for example:

      Todo.high_priority().filter(id__gte=1)

I haven't tested chaining these, but this might work:

      Todo.high_priority().incomplete().filter(id__gte=1)

<comment><AUTHOR> Your last example wouldn't work. Todo.high_priority() returns a plain QuerySet, which won't have your "incomplete" method (as that's defined on the Model class in your example).

</comment></comment></comment></comment><comment><USER9> For simple approaches you can also bitwise through Q objects:

      >>> from todo.models import Todo
      >>>
      >>> Todo.objects.incomplete()
      [<Todo: 2>, <Todo: 3>, <Todo: 4>]
      >>>
      >>> Todo.objects.high_priority()
      [<Todo: 1>, <Todo: 2>]
      >>>
      >>> Todo.objects.incomplete() & Todo.objects.high_priority()
      [<Todo: 2>]

</comment><comment><USER10> > Personally, I'm not completely convinced by the decorator-based idea. It > obscures the details slightly, and feels a little "hacky".

The purpose of the decorator is, indeed, to obscure the implementation details in favour of more semantic code. But then again we're using an ORM which makes heavy use of metaprogramming to obscure the details of the database layer from us; I don't see how this is a bad thing.

<comment><AUTHOR> Yep, and my criticism of your suggested approach wasn't intended to be particularly strong by any means. I could definitely be sold on the idea. It just felt like a workaround to a problem that could probably be solved in a nicer way.

I think my main objection is that these query methods _should_ conceptually be on the QuerySet, and so defining them on the Manager (the "wrong place") and magically copying them to the QuerySet (the "right place") feels somehow worse than the opposite.

I appreciate that you raised the discussion on the mailing list, as it highlights the fact that this is a common problem in big Django codebases. Even pulling something like PassThroughManager into core might work (perhaps with a nicer "manager_with_queryset" API, as suggested by Aramgutang).

<comment><USER10> But my problem is that most people wouldn't even think of subclassing QuerySet.

When we write methods that operate on collections of things, we typically use @classmethod. Without @classmethod, we'd have to write a custom metaclass (and instruct our class to use that) if we wanted even a single class method on a class. Multiple inheritance would break (or at least be difficult to reason about) when classes defined class methods, because there would have to be both an instance method resolution order and a class MRO. Fortunately Python's built-in `type` provides the descriptor protocol, which allows us to have class methods and instance methods and properties and all these other nice things without having to metaprogram or hack the interpreter.

All I'm asking for is a similar (if less ornate) interface for Django models, wherein the methods that operate on collections of things can be defined alongside the methods that operate on individual things, without requiring a knowledge of Manager/QuerySet internals.

<comment><USER11> A few years ago I was experimenting with exactly this problem, and I came up with an API that worked using an inner class on the model. I can't find the code now, but from memory it looked something like this:

        class BlogEntry(models.Model, MagicManagerMixin):
            title = models.CharField(max_length = 128)
            is_published = models.BooleanField(default = False)

            class QuerySet(models.QuerySet):
                def published(self):
                    return self.filter(is_published = True)

        entries = BlogEntry.objects.published()

Where MagicManagerMixin was some scary code that made sure the objects Manager would use the queryset subclass.

</comment></comment></comment></comment><comment><USER12> Momentarily arguments sounds right(perhaps because it's intellectually appetizing) but I think we are forgetting basic philosophy of every layered architecture that "lower layer provides generic api to its higher layer" allowing higher layer to customize its every possible needs using this api. Django ORM does exactly same thing.

author seemed to be concerned about these issues:

1\. embedding businnes logic in views:

making query isn't business logic, business logic is in your database constraints or sometimes if db constraints are not enough then by overriding save() and validate(). queries belong in views because all we are suppossed to do in views is mearly fetch data from a data structure(already modeled according to biz. logic) and representing it as we see fit(thus the name views). theoretically this representations(views) could be of infinite types and changes over time so queries would change for every representation and over time but we can't go about implementing all possibilities in models. And this is what's antipattern because we are talking abaout putting views in models(partially though).

2\. code reusability:

agreed, some queries could be repeted many a times and if complicated enough may clutter the code. I recommend putting querries into functions and put the functions in views or any similar aproach(I will think of one or you figure out one and share) but they just dont belong in models. although I believe full reusabilty can be achieved but in some cases if we can't- well we are choosing 'division of functionality' over 'reusability'.

and most important of all if django's documentaion does not suggest inherting for eg. queryset class then we shouldn't (even if you yourself coded the django framework) because these implementation details are supposed to be concealed and hence they are free to change it in future versions making our code 'upgrade-ugly'(if that's the right term)

</comment><comment><USER13> I see what he's trying to do but this just seems like a ton of extra "boilerplate" code when you're trying to make an app.

I'd rather spend extra time tracking down where I've used the is_done field if I later change it to a status, than spend all this time writing a manager for every query I do. Unit tests help with catching it if you've missed somewhere.

On the other hand, if you have an extremely complicated query, then this might make sense. Maybe he chose that example for illustrative purposes but it's not really the kind of thing he's recommending you use this for?

<comment><USER14> It's not much overhead and considering the savings in views the LOC will probably be equal or less. It doesn't make sense for every model or attribute, but if you find yourself doing the same types of queries multiple times, this can be a big savings.

</comment></comment><comment><USER15> Correct. Another benefit: easier to implement cache between the view and the DB down the road.

</comment><comment><USER16> I'm a freelancer and I've been using this approach since ever. I wish more developers did too because it's really frustrating when they don't and you need to maintain their code.

</comment><comment><USER17> Lately I've been re-discovering the value of the ORM and putting as much business logic on your models as possible. This, after spending way too long writing out lots of query logic in views instead. It's amazing how you can many times reduce complexity from 10-20 lines to 2-3 lines, and gain reusability, just by putting business logic where it belonged in the first place.

<comment><USER18>
        > putting business logic where it belonged in the first place

I've been thinking a lot about where to put business logic, and I think the models are the closest, but not the best place for them.

A significant portion of this logic for me affects more than one model, and while you could solve this by using public interfaces, you still need to put in _any_ of the models, which seems like a suboptimal approach.

The ORM is already responsible for several layers, and custom business logic is not relevant there imho.

Still puzzled how to organize my code. MVC has started to fall apart for me. Just my two cents.

</comment></comment><comment><USER19> A bit OT. In Yii framework (php) these are called "scopes" and there is a nice abstraction to define non-parametric scopes via arrays. [http://www.yiiframework.com/doc/guide/1.1/en/database.ar#nam...](http://www.yiiframework.com/doc/guide/1.1/en/database.ar#named- scopes)

</comment><comment><USER4> This article is great and provides some awesome insight from someone who clearly has been down this road before. It couldn't have come at a better time for me. I was just about to implement my own manager today, but I'll take this much cleaner approach.

Thanks!

</comment><comment><USER20> Spot on. Never (okay very rarely) do business logic in your views. Just don't. Model methods for row-level logic, managers for table-level logic. It's easier to test, it's easier to abstract and it's easier to change your views later.</comment>


Linus Torvalds pulled WireGuard VPN into the 5.6 kernel source tree - <AUTHOR> https://arstechnica.com/gadgets/2020/01/linus-torvalds-pulled-wireguard-vpn-into-the-5-6-kernel-source-tree/ <comment><USER2> Extensive discussion yesterday: [https://news.ycombinator.com/item?id=22176032](https://news.ycombinator.com/item?id=22176032)</comment>


Understanding Why Multithreaded Programming Is Hard - <AUTHOR> http://ridiculousfish.com/blog/archives/2007/02/17/barrier/

<comment><USER2> I would argue that concurrent programming _is_ something new. If you have 2 processors, then the worst thing that can happen is you get 50% of the machine's power per application - and if you have other processes running, they can use the other processor. In practice, on a dual-processor machine, you can completely ignore concurrency and often still get excellent performance for the majority of users, just by letting the OS worry about it for you. Particularly in the case where there is one long-running task in the background and one interactive task in the foreground, the user will get the best experience possible with no extra effort on the programmer.

The difference now is that with 32-cores (on the Sun T2000 for example) or more, unless you have a very easily partitioned workload (e.g. serving simple web pages), if you don't think about concurrency up front, your app will suck. With 32 cores, naive approaches to locking will rapidly drag performance into the mud. Working on massively multicore kit _if you need a single task to dominate the system_ is a hard problem. Things are about to get interesting...</comment>


Let's face it; Facebook doesn't care about privacy anymore - <AUTHOR> https://news.alphastreet.com/lets-face-it-facebook-doesnt-care-about-privacy-anymore/ <comment><USER2> Why should they there's no law against tracking you like a criminal. Except if your a criminal.

</comment><comment><USER3> Did they ever?</comment>


Time to ditch the climate consensus - <AUTHOR> http://www.theregister.co.uk/2009/05/06/mike_hulme_interview/ <comment><USER2> It should be more often observed that the only reason we see this call for consenus (and opposition) is that they demand government action.

This is a very statist mindset, and that grinding sound you hear is statism running up against science.

In other scientific matters (e.g. If string theory is real) you don't get empassioned pleas for one side.

Environmentalists would do more good by abandoning statism and focusing on private action.

There is nothing stopping people from supporting research into alternative energy themselves. Farmers could be paid by private citizens to slow burn their biomass turning it into stable sequesterable charcoal. The roofs of private buildings could be painted white.

Once those that care about the issue realize their methods and not necessrily their ideas are why they get a lot of resistence, more people will come to their side.

<comment><USER3> I'm all for private action, but you cannot take the government out of this issue. After all, whether to build the third runway in Heathrow is not a private decision. Likewise, it's hard for private parties to deal with externalities.

<comment><USER2> Unorganized private action can easily outweigh government action.

With easily provable externalities like toxic waste, private lawsuits can take care of the problem. Other issues like CFCs are easily regulated.

Cap and Trade solutions for climate change are, say, 5 orders of magnitude more costly. With that comes added demand for certainty. The more rigorous the demands for certainty, the greater the indication that a single governmental solution is inappropriate.

A third runway at Heathrow _should_ be a private decision, by a private company that owns and operates an airport. Runways are also completely irrelevant in this discussion.

<comment><USER4> "Unorganized private action can easily outweigh government action.

With easily provable externalities like toxic waste, private lawsuits can take care of the problem. Other issues like CFCs are easily regulated."

This seems to be a contradiction.

</comment></comment></comment></comment><comment><USER5> A plea for reasoned discourse and the end of the politicization of science by the left. Excellent article on the quality of the discussion of climate issues. The climate change debate itself, I know, has been done to death here. But I still think that the quality of the discussion, the role of politics in science and vice-versa, are important issues regardless of whether the topic is climate change or not.

<comment><USER6> Because when a crisis strikes, it's the bankers and derivative traders we really need to here from. Now, you scientists, you need to go out and do something useful. Go shopping.

<comment><USER5> How about just doing science? Seemed to work just fine for hundreds of years.

<comment><USER3> But has this ever truly happened?

Even if we go back all the way to Archimedes, we'll find his science intertwined with warfare, ship building, public works and various other 'statist' concerns.

Or take Galileo - surely not just doing science. Darwin. Manhattan Project, and the subsequent roles of various people like Oppenheimer, von Neumann, and Edward Teller. Nazis eliminating 'Jew Science'. Or for example Carl Sagan's comments about sources of funding for physics (so heavily military and 'statist') and their effect on the science.

I think this idea of pure science in isolation is an idealization that does not happen in practice.

<comment><USER5> I think you're mixing up several issues here.

First, nothing is truly black or white. Scientists are humans, and humans are political and involved in things outside their own field. This humanity, however, poses a conflict of interest from the mechanisms of how science operates: observe, hypothesize, test, reproduce. In other areas where human nature play a conflicting role with job goals, such as the therapist-patient relationship, doctor-patient relationship, or lawyer-client relationship, strict guidelines have been established to ensure that the human part of doing the job doesn't interfere with the job itself. Where's the line? That's outside my pay grade. When scientists start viewing themselves as activists first, scientists second, however, we've crossed it. Science is concerned with both normal science and paradigm-changing work. Whatever else you may be doing could be important, critical, wonderful, whatever -- but it ain't science.

Your second concept is statism. I'd take that up with the other commenter who mentioned the statist issues.

I think your observation that politics and science have always mixed it up is a great one. However, I think it actually proves my point instead of yours. During the time that these people lived, like Galileo, the word "science" could mean many different things. Indeed, science of the day was the church. And the church had a heavy hand in what was "allowed" to be discussed and what had "scientific consensus". It's only in looking back that we're able to say, gee, of course Galileo was the _real_ scientist here. At the time, common opinion was against him.

The A-bomb guys, as far as I know, did not publicly advocate some sort of scientific consensus in atomic policies. The old Soviets, however, had Lysenkoism -- another example of "science" being co-opted by the state and used to shut down discourse. (In many places even today, you'll end up in the insane asylum if you have the wrong political opinions). The Nazis were famous social darwinists. The list goes on. In each case, science and politics got mixed up to the point where politicians were using science as a foil to advance their ends and scientists were in politics to advance their own ends. You're absolutely right. This isn't anything new. We've seen where this ends up. Science ends up like the old church: with dogmas, consensus, political funding, ostracism, etc.

Let's not go there.

</comment></comment></comment></comment></comment><comment><USER7> Any time that you hear someone say, "we need to get beyond debate and act," it usually means they are no longer willing to listen to others and they just want to implement _their_ solution.

<comment><USER8> But this is one of the _necessary_ differences between science and politics. Politics requires making decisions, and acting on them, based on imperfect information. There's nothing wrong with saying "I know we don't have 100% certainty on this issue, but even at a level of only 80% certainty, the expected cost of doing nothing is so great, compared to the cost of taking action, that we're better off taking action."

<comment><USER7> The cost of acting in the way that some people want could do extensive damage to our economy and could have very little effect on the problem that they are attempting to solve. If individuals feel that there are things that should be done, they are free to start implementing themselves and working with business to make the case. It is only when people assume that the government has to force everyone to do what they want is it a question of what _everyone_ agrees on. You don't need complete consensus if you are willing to put your money where your mouth is.

</comment></comment></comment><comment><USER9> I don't understand why you would argue against using facts as the basis for debate. We're not giving proper weight to people's spiritual beliefs related to climate change?

"Don't use science to get around politics" sounds like a joke. I mean, really?

"...their ultimate authority is a report from a group of scientists, and they're saying 'this is where we stand, forget about our moral concerns, forget about our ethical positions, ... forget about whether we are Christians or Buddists, no, none of that matters.' The only thing that matters is that they're holding a report from peer-reviewed science that in itself justifies their position. And it's not just protesters who are hiding behind the authority of science. World leaders are doing it, too."

What?!

[sorry for the long quote, i'm working myself up :)]

Maybe it's a joke, and it's just too early for me to get it.

<comment><USER10> > What?!

He raises a very pertinent issue; it's just not that clear in this context.

Here's an extreme, yet simplistic analogy:

Suppose scientists discover that green-eyed people are used as transmission vectors by a lethal flu virus. A cure can be found, but it would take at least a decade to complete the research and testing. Scientists estimate that the virus will kill 90% of mankind within 5 years.

Should we round up and isolate all green-eyed people? Should we kill them?

<comment><USER9> That choice seems more obviously between two evils than the climate change issue. :)

I do acknowledge, as the other commenter suggested, that my view may be warped by being from the USA, where the battle is still about whether it exists at all.

<comment><USER10> It's not about climate change - it's an analogy. It's not a choice between two evils either (you could round them up AND kill them). And of course you could propose a multitude of different solutions beside or in addition to these.

My point was that science cannot be used to justify all the choices you make in cases like these.

</comment></comment></comment></comment><comment><USER11> Please note who wrote the article:

 _Stuart Blackman is a science writer and co-editor of the Climate Resistance blog._

My impression of the blog is they want to continue the debate on climate- change and delay whatever action should be taken because they believe the environmental movement is a crazy cult. This interview serves their purpose.

They also believe that: _4\. The scientific consensus on climate change as widely reported inaccurately reflects the true state of scientific knowledge._ This is a familiar charge from people who deny human-caused climate change.

<comment><USER12> Its like the f'ing tobacco industry did for four or five decades. Once they realized the science is against them, they start spraying FUD out every orifice, delaying action for as long as possible.

</comment></comment><comment><USER13> > Perhaps the most surprising thing to hear from a climate scientist writing > about climate change is that climate science has for too long had the > monopoly in climate change debates.

Maybe biologists and geologists shouldn't have a privileged position in debates on whether evolution is true, and about the age of the Earth. And should medical scientists have the monopoly in debates over vaccinations and disease control? Popular opinion clearly says no.

</comment><comment><USER14> FFS. Colour me the stereotypical bad guy in that steaming pile of an article.</comment>


Show HN: Hacker News Clone – Clojure, GraphQL Learning Project - <AUTHOR> I have ported "The Fullstack Tutorial for GraphQL" series, https://www.howtographql.com/, from Javascript to Clojure/script.
Blog post:
https://promesante.github.io/2019/08/14/clojure_graphql_full...
Source code GitHub repo:
https://github.com/promesante/hn-clj-pedestal-re-frame
Suggestions and corrections, more than welcome. <comment><USER2> I did a clone of HN in Clojure 10 years ago (wow, time flies), but it just wrote the state out to files: [https://github.com/cubix/simplenews](https://github.com/cubix/simplenews)

No ClojureScript then, of course. I was planning something more sophisticated for persistence, but never got around to it.

<comment><USER3> Neat, could you provide some annotations or a readme? I'm curious to see how you made this. Only if you have some extra time laying around of course

<comment><USER2> I might have some time to dust it off tonight.

</comment></comment></comment><comment><USER4> Cool! I'm currently working through the lacinia tutorial to learn GraphQL (I've invested a lot of time in getting good at designing RESTful APIs, so GraphQL definitely feels alien to me), making a few changes as I go (I prefer mount to component, for example).

<comment><USER5> And what are you discovering about GraphQL? What have you lost and gained in translation?

</comment></comment><comment><USER6> Nice job!

On the whole the howtographql series is instructive but results in a ton of boilerplate code. The GraphQL framework[1] from the Manifold project avoids all of that with the "manifold" concept, which is similar to F#'s type providers.

Currently manifold targets Java exclusively, but the framework is designed to support other JVM languages. Perhaps clojure could be on the radar? Food for thought.

[1]: [https://github.com/manifold- systems/manifold/tree/master/man...](https://github.com/manifold- systems/manifold/tree/master/manifold-deps-parent/manifold-graphql)

<comment><USER7> No relation to Clojure's own manifold library, I guess? I was a bit confused when I visited that github repo you posted and saw a bunch of Java code :P

This is the one I thought of: [https://github.com/ztellman/manifold](https://github.com/ztellman/manifold)

<comment><USER6> Ah, no relation, but interesting library!

</comment></comment></comment><comment><USER8> Interesting. I have wanted to get into GraphQL. As Clojure person I liked the idea but we had some similar stuff already.

I will defiantly look at that code later.

<comment><USER9> In Clojure we have walkable which can handle graphql and EQL, personally I found holes in the graphql type system that EQL wouldn't have had a problem with @see: Fulcro EQL walkable

<comment><USER10> I like the idea of EQL, but I'm not sure I want to tie myself to Fulcro. Looking forward to more projects adopting EQL.

GraphQL definitely has a number of issues (type explosion being one) that can be avoided with EQL.

<comment><USER11> EQL as a pull syntax for Crux is definitely interesting (and we're considering building something more official): [https://github.com/souenzzo/graph- demo](https://github.com/souenzzo/graph-demo)

</comment></comment></comment></comment><comment><USER12> Been looking for a fun way to learn Clojure. Thanks!

</comment><comment><USER13> I've been looking for a motivated tutorial to learn Clojure beyond the syntax and similar basics, thanks for sharing!

</comment><comment><USER14> thats a lot of code

</comment><comment><USER15> Clickable links:

[https://promesante.github.io/2019/08/14/clojure_graphql_full...](https://promesante.github.io/2019/08/14/clojure_graphql_fullstack_learning_project_part_1.html)

[https://github.com/promesante/hn-clj-pedestal-re- frame](https://github.com/promesante/hn-clj-pedestal-re-frame)

<comment><USER16> Thanks! We've clickied the main ones.

</comment></comment><comment><USER17> Not very exposed to Lisp style languages. So take this as you will.

But the actual clojure code looks weird? I get that its a different way of writing from the C like syntax, just that fro a quick glance it doesn't look very pleasant to read due to the how messy the brackets everywhere nature is.

I also feel like reasoning about CRUD problems is easier in a non functional way, but again no real experience with functional languages to say for sure.

EDIT: To illustrate with an example: In C# I can write LINQ using the lambda syntax for queries, however sometimes its useful to be able to break down complex queries into parts, step through with a debugger to follow the logic, don't see how the functional style of Lisp aids in doing any of that (at least not when writing it idiomatically).

<comment><USER18> Most people new to languages with Lisp syntax find it difficult to read at first. At some point, it becomes natural to read and write it that way. More importantly, it becomes obvious how useful having a consistent and extensible syntax is to writing all sorts of things.

Eventually the C-style syntax feels "messy" because the symbols are used less consistently. At the same time, Lisps like Dylan transitioned to a more conventional syntax and can still maintain lots of the power that they got with S-expressions.</comment></comment>


Changes to Reddit's Political Ads Policy - <AUTHOR> https://www.reddit.com/r/announcements/comments/g0s6tn/changes_to_reddits_political_ads_policy/ <comment><USER2> i think reddit should stay out of politics and be independent</comment>