Someone Is Learning How to Take Down the Internet - <AUTHOR> https://www.lawfareblog.com/someone-learning-how-take-down-internet <comment><USER2> Since there are lots of hobbies that sometimes overlap with community service I'd love to see a club that focuses on being prepared to reestablish intra- community communication in case the Internet goes down. Yes, it'd be great if everyone was self hosting, using distributed services and involved in a mesh network now, but without motivation it won't happen. So this club could focus on developing the resources that a few individuals in a community could use to set these things up after the network is already down. They could have offline caches of Wikipedia and Openstreetmaps, copies of firmware, apps and instructions for attaching consumer routers and other Wi-Fi devices to a mesh network, systems for registering people with a locally functioning email address, etc. User friendly portals could be made that provide the basic instructions for people who stumble on a mesh network access point with their otherwise disconnected smartphones.

All of the tech exists in some form or another, but if it were well packaged, it's not hard to see there being a sufficient distribution of members to get people connected easily.

<comment><USER3> The amateur radio community already has the technical know-how and disaster readiness to do most of that, and I'd be willing to bet there's enough overlap between them and the meshnet crowd to take care of the rest.

<comment><USER4> KG6YHQ here. It's doable, but if the wired net becomes unusable and you have to rely wholly on the RF spectrum, bandwidth would be stupendously tiny. Forget about sending anything else but, basically, text-based messages.

Perhaps in an event like that a decision would be made to temporarily open up the spectrum, but even then there are only so many of us, only so many transceivers out there.

I feel the HAM net would be more useful after a natural catastrophe, where the infrastructure would be destroyed physically. Which is exactly what a lot of us are preparing for.

<comment><USER5> Wouldn't SDRs be a lot more useful for creating higher-bandwidth wireless networks in the sort of disaster where the FCC opens up other frequency ranges?

The amateur radio regulation regime and common ham radios work well for small numbers of small messages sent around in a well-regulated way, without the government initiating a frequency band jubilee. But beyond that, HAM radios are limited, even if they're modded, and the cheap SDRs are even cheaper than baofeng handhelds, so where does that leave amateur radio in a real frequency free-for-all? I think what would matter is, as mentioned above, availability of SDRs, and secondly, parties of people tracking down transmitters that are messing up the ad-hoc sdr wireless nets.

<comment><USER4> Sure, but everything has to be ready, prepared and exercised _before_ anything happens. Whatever plan you may conceive, you have to do plenty of test runs in advance. After it happens, it's chaos, it's too late to start new initiatives.

And there are caveats anyway.

For local connections, some kind of WiFi mesh might still be the best option.

For long distance, I don't think you can currently use anything but proper HAM equipment, and fairly large power at that. For a reliable connection, especially at good bandwidth, you need lots of power and a good antenna. But if you blow standards out of the water, and start pumping out huge bandwidths at huge powers, you run again into a tragedy of commons - you're taking up large chunks of spectrum over entire continents.

There is no free lunch.

<comment><USER6> As a fellow ham, I have to say: guys, guys... it's ham, not HAM. Other than that I totally agree with you.

The (VHF and UHF) ham bands will send data a few tens of kilometers with good messaging bandwidth. Here in Seattle there's a Monday-night digital net through a repeater on the Columbia tower where folks send text messages and some (slow) photos on 444.55 MHz. Typical speeds are like 9600 baud.

As you mention, when you go down to the HF bands like 20m you can transmit and receive around the world, but there's far less bandwidth. The tragedy of the commons is right on.

I've operated PSK31 (which runs at 31 baud) worldwide on 20m and it's pretty much a chatroom. You can get a lot said with that, but you certainly won't be browsing the web.

It would be cool to play around with connecting 2.4 GHz local wifi meshnets with ham repeaters at ranges of say 50 km. Then you'd have nice fast local communication with reasonable long distance. .

</comment></comment></comment></comment></comment></comment><comment><USER7> Although Schneier is probably correct in this instance, one of the most exasperating features of his computer security writing is an utter lack of citations or evidence to back up his claims. (His writing about cryptography should require no citations because he is an actual crypto expert.)

After the significant inaccuracies and frequent unsubstantiated speculation in _Schneier on Security_ , I don't think credible security researchers can take his analysis at face value. Additionally, the halo effect of his actual expertise, cryptography, convinces people who aren't security experts that his opinions and speculations are correct. Worse, he rarely frames his speculation as such; he states conjecture as fact. This is counterproductive and leads to confusion among journalists and eventually the general public.

To the imminent downvoters, I'm not offended; I expect it with an unpopular opinion. I'd prefer you engage with a reply in addition to the downvote so we can have a discourse. I think it's important that I add my dissent to the conversation.

<comment><USER4> Sometimes it feels as if computer engineers have a unique inability to deal with ambiguous information.

Yes, I agree the article is vague, and I'd like to learn more. But this is typical for this kind of backchannel intel. From some sources, through some channels, for some kinds of info - this is all you get. This is business as usual.

Take it in for what it's worth. It's a signal from a sea of noise, nothing more. Maybe it's actionable, but perhaps it's not. Just learn to deal with ambiguity; the world at large is quite different from the rigid boolean-logic computer systems you're interacting with on a daily basis.

<comment><USER8> > _Just learn to deal with ambiguity; the world at large is quite different > from the rigid boolean-logic computer systems you 're interacting with on a > daily basis._

You're shitting me, right?

Computer engineers are the _last_ people who think in rigid, boolean-logic ways. It's the general population that does that. If you do any serious thinking in any STEM field, you quickly learn that the world is probabilistic in nature, and ambiguity is what you eat for breakfast. What the technical fields do to manage with it is learn to quantify the exact nature of ambiguity. When you do that, by means of probability theory, you learn that ambiguity doesn't mean "anything goes", there are rules it follows.

Like, backchannel intel may be vague, and this also implies it's likely to not be true (unless you can pull out additional evidence in its favour, like e.g. good track record of the person delivering this backchannel intel; that point is discussed in parallel threads). In a sea of noise, the "signal" you see is most likely a coincidence. Not comprehending this (aka. "seeing patterns everywhere") is one of the biggest sources of irrationality in people.

<comment><USER9> Well, as far as ambiguity goes, a CS or CE's job is to fit that round peg into our square hole, with mathematics and neural networking as our hammers.

</comment></comment></comment></comment><comment><USER10> So how exactly is one entity, even a state entity, going to take down all 13 root servers, _assuming_ that that is what Schneier is talking about since the man speaks in mysteries? What would it take to do that?

Let's safely assume that these servers, every single one of them, are subject to DDoS attacks all the time and have at least some experience in handling them, and have a backup scenario ready for a serious attack. One of the reasons why the root servers are not centralized is to avoid the kind of disaster that Schneier predicts.

Also what if I maintain a list of IP addresses of the websites I visit most and update that list daily. When the "big attack" strikes, I put that list in /etc/hosts. Would I still be able to do my holiday shopping from Amazon? Would I still be able to read the logs on my VPS by ssh'ing to its IP? How long would such an attack sustain before BGP modifications start blackholing the sources? Long enough to let the average TTL cache expire?

Would an attack on the root servers really take down the internet? Or in case Schneier isn't talking about that, what kind of attack on the decentralized internet is actually able to take it all down? I'm not saying he is wrong, but I have a hard time thinking about how we should prepare and protect our infrastructure if he doesn't want to share the intel he knows instead of some generic warnings.

<comment><USER4> Every once in a while I think of creating a little DNS cache that never expires entries, except when it runs out of storage, and run it on a Raspberry Pi, feeding it with DNS queries on my home network (but never using it to send replies to clients, just store queries and results).

But I never do anything about it.

<comment><USER11> You can use dnstap with unbound or BIND 9.11 to do this kind of data collection really easily.

</comment></comment></comment><comment><USER12> This is both unsurprising, and worrying. Unsurprising because it's the job of any nation's military and espionage arms to consider and form plans to cripple or destroy their potential enemy's infrastructure, information included. Worrying, because as far as I can tell most people remain deeply ignorant and/or unconcerned (present company excluded both from that remark, and realistically the descriptor "most people") about 'cybersecurity' in any form.

That needs to change, and the author is right that while there seems to be little to do now, people should be aware of it.

<comment><USER13> 'the author' (Bruce Schneier) is right a lot.

<comment><USER14> He suspects China or Russia as the likely culprit. What exactly rules out an American agent? Is it because American economic and social activity rely disproportionately on internet backbones more so than other state actors? If so, that would be especially interesting.

<comment><USER15> It depends on exactly what services Schneier is talking about here, but an awful lot of the infrastructure of the internet is hosted in countries that the US armed forces have easy physical access to.

Even if a cyber attack were the "plan a" for quickly and untraceably taking those systems out, the US has an easy enough "plan b" that testing "plan a" isn't going to be a major concern. Add that to the fact that the US has a lot more to lose if it gets caught attacking internet infrastructure than China and friends do (even just tests like this) and I would be surprised (honestly not shocked, but definitely surprised) if the USA is behind these shenanigans.

Actually, if the US wanted to test something like this on a service in a friendly country, I would expect the NSA to approach the infrastructure company and say something like, "We're concerned that $enemy_of_free_speech may be planning an attack on your service, and we would like to wargame that scenario with you. What time(s) would an outage have a minimal impact to your bottom line?"

<comment><USER16> > Add that to the fact that the US has a lot more to lose if it gets caught > attacking internet infrastructure than China and friends do (even just tests > like this) and I would be surprised (honestly not shocked, but definitely > surprised) if the USA is behind these shenanigans.

So can you give me the address of the rock you've been living under for the past 3 years?

<comment><USER15> No, but maybe you can share some of the evidence you apparently have that the United States is actively trying to sabotage the world's communication infrastructure?

Sure, it throws its weight around when asking various social media platforms to censor certain types of content, and it has a no-holds-barred approach to intercepting data traffic, but it generally draws the line at knocking services entirely offline.

<comment><USER16> It creates, exploits and maintains vulnerabilities in public infrastructure that anyone else(state nation or similar capacity) can take advantage of.

> it generally draws the line at knocking services entirely offline

Well if you're gonna play the card "I'm reading a different Internet than you are", sure whatever.

</comment></comment></comment></comment></comment></comment></comment><comment> norea-armozel This is why I worry about the centralization of all communications as we've done over the entirety of human history. Letting the Internet be centralized as it has been might be make economic sense but as for sustaining the world economy through a potentially global conflict it doesn't make any sense to put all our eggs in one basket here. It's like I mentioned on the "napalm girl" post that we've become too complacent with having ease of use trump reliability of communication. This is just one of the larger consequences of our individual and collective choices coming to bite us in the butt. I hope this spurs people to get smarter and put together p2p solutions that can weather such a conflict at least for regional and/or city-wide communications.

<comment><USER17> The internet _is_ decentralized, for the most part; it was designed to be that way from the start. Whole pieces of the internet can go offline that the rest of it will continue operating as normal, with packets routed around the damage. The TCP and IP protocols were designed for this.

It's not the designers fault that so many people are dumb enough to happily give one company a near-monopoly over certain forms of communication.

It's very simple: stop using Facebook for everything. Use different sites/services, or switch to a decentralized service like Diaspora. Otherwise, stick with Facebook for everything and stop complaining when it bites you in the butt, and suffer the consequences when disaster strikes.

<comment> norea-armozel You're confusing the issue by focusing on protocols versus actual physical implementations (data centers, trunk lines, etc). The physical installations for what we call the Internet are centralized. Companies like Level 3 might put some redundancy but at some point the cost of redundancy out weighs its benefits for them and other companies like them. This is especially true of consumer financial services like banking. If an attacker wanted to disrupt the United States they only have to do it to banking to cause a panic. They could easily ignore emergency services, hospitals, and even the government itself (outside of ACH) while doing this. And it would be such a mess that we couldn't resolve it immediately. The happiest outcome is the disruption is only for a few hours but the more likely outcome is possibly days or weeks of disruption where a large part of the banking system would be inoperable. It doesn't matter if you used TCP/IP or switch based communications the outcome is the same: the American economy shaken and possibly worse. So, we can take all day about Facebook and Diaspora but neither of those services do anything important for the average user like your bank which also uses the same centralized infrastructure. There is no Diaspora for banking and not one that's widely used or not using the current banking/financial transfer systems which are centralized.

</comment></comment></comment><comment><USER18> I totally disagree that we can't do anything. With the existing TCP/IP protocol we can't do anything because it's possible to forge the origin IP address or modify the datagram content on its route to destination. A receiving end has no way to verify the validity of the datagram.

An IP datagram authentication at the lowest level is required so that anyone on the route can detect forgery, error or tempering with the data. This would allow tracking the real sources of DDOS attack, diagnose the cause and fix it.

What's the point of keeping digging deeper trenches ?

This should be a top priority change of the Internet. There was no incentive to move to IPv6. Now there is one to move to a more secure Internet.

<comment><USER19> > top priority change of the Internet

See you in thirty years.

Also, IP authentication doesn't help you. DDOS traffic often has real IP source addresses on. It tells you that the traffic is several hundred thousand home PCs. Now what?

<comment><USER20> If you knew for sure that an IP src address involved in a DDoS attack was not spoofed, we could easily design a control protocol that allowed a recipient to contact the origin ISP and enable a block on that particular {src,dst} pair. Unless you know for sure that the src address isn't spoofed though, such a mechanism would itself be abused to deny service. Having the ability to validate a source address would be the enabler for proper defense mechanisms.

We wrote about one way to do this about ten years ago, but no-one was really interested at the time: [http://www0.cs.ucl.ac.uk/staff/M.Handley/papers/terminus2007...](http://www0.cs.ucl.ac.uk/staff/M.Handley/papers/terminus2007.pdf)

<comment><USER21> > Unless you know for sure that the src address isn't spoofed though, such a > mechanism would itself be abused to deny service.

Unfortunately, even if you know that the source address isn't spoofed, such a mechanism would itself be abused to deny service

</comment></comment></comment></comment><comment><USER22> The Internet is suppose to be decentralized. Yet we have these centralized groups, proving backbone, DNS, certs. Well duh, it's no surprise. Why can't I connect to my neighbor who lives next door without the packet doing a 200 mile trip? The Internet is really only devices that can route packets through at least 2 different gateways. If you only have one route. You are not part of the vision of the Internet.

<comment><USER23> You can make such a connection and establish a mesh network, most people are just too lazy or technically unsophisticated to pull it off apparently. Centralization is a consequence of that fact that people do not actually want to maintain their own infrastructure, they just want it to work while they get back to the rest of their life.

</comment></comment><comment><USER24> Can anyone elaborate on what he means when he says that Verisign can 'go down' and take down most of the internet with it? How would a registrar going down affect anything to do with actual hosts?

<comment><USER25> Poor wording. Verisign operates .com for the US government. So if Verisign's .com servers were to go down, then .com would go down with them. The author shouldn't have used the word "registrar" which makes people think of the creation of _new_ domain names, à la GANDI (good) or GoDaddy (bad).

<comment><USER8> What does it mean "operates .com" and ".com would go down"? Does it mean that "google.com" would suddenly stop resolving? If so, how is that possible given the way DNS works? If not, what exactly is the panic about?

<comment><USER21> Most DNS resolvers come with a 'root zone hints file', which includes a list of the root nameservers and static IPs for each one.

When you look up google.com, these root nameservers are queried for com, and they return the results (name and IP) for the nameservers for .com

These nameservers for com are then queried for google.com, which then return the results for the nameservers for google.com.

Google's nameservers are then queried for google.com, and an IP is returned.

So yes, given how DNS works, all .com and .net domains would stop resolving if the Verisign nameservers for .com and .net were to go down. Most people go through caching nameservers, which would retain the values for google.com, and continue to return them, up until the time to live on those records expired, at which point they too would stop returning any values if the upstream servers hadn't returned before then.

</comment></comment></comment></comment><comment> m-jones This is (one of) the reason(s) I moved my website to the decentralized web- hosting platform ZeroNet. It is still accessible to regular web users (through the use of proxies) but is ultimately secure against DDOS attacks and the like as there is no single server to attack (it could still be done, but it would take much more effort as you would have to attack each user of ZeroNet individually).

As applicable with all areas of life, association is a security risk. By depending upon any centralized authority (such as a server or domain name registrar) you are open to being censored (either by them or an attacker).

At this point however, decentralized web-hosting solutions still rely upon clearnet centralized port checkers, which is (ofcourse) an issue. The best the community can do is help to raise awareness of decentralized web hosting in the hopes more people will adopt it leading to a higher likelihood that the problems will be solved.

</comment><comment><USER26> _> The NSA, which has more surveillance in the Internet backbone than everyone else combined, probably has a better idea, but unless the U.S. decides to make an international incident over this, we won't see any attribution._

Or unless it's the US itself. Not the most likely possibility I think, but still a possibility.

</comment><comment><USER27> When my Omnia Turris arrives I will connect it with second WiFi card and enable cjdns on it. We need to start showing it.

</comment><comment><USER28> Makes me wonder if we'll ever see a "hot" war that starts off as a "cyber" war.

<comment><USER29> The start of every US war in the ME has featured attacks on communication and infrastructure, starting with hacking in to the telephone exchanges weeks or months before the hot war starts, and culminating with the takedown of critical physical infrastructure, like power, water, etc. as the first thing to go when the shooting starts.

<comment><USER7> Can you clarify this? I remember seeing some articles about this tactic in maybe 2010, but nothing before then. I recall the Gulf War and OIF/OEF infrastructure damage being primarily from aerial bombing, but it's possible I missed the articles about the hacking element.

I'm not doing the snarky "citations pls" thing; I don't dispute it happened. I just want to know more.

<comment><USER29> I can't find the article I read at the time. The gist of it was that a sysadmin was bribed to gain access to the telephone exchanges and once the Iraqi government realized they were compromised they ran expedient unburied fiber links to communicate with commanders.

</comment></comment></comment></comment><comment><USER30> Blaming China or Russia is lazy writing. It could be just about anyone, including a rogue internal agency doing a spoof-attack to precisely cause the blame to go towards the obvious "state actors".

Cyber-warfare is the 'new' war and just like any war, misinformation plays an important role.

<comment><USER31> > Blaming China or Russia is lazy writing

It's what the author is being told by the people he has spoken too. Maybe a lazy _assumption_ on their part, but it's not lazy writing. And your point is directly addressed in TFA:

"The data I see suggests China, an assessment shared by the people I spoke with. On the other hand, it's possible to disguise the country of origin for these sorts of attacks."

It would be interesting to know the sort of resources needed for this kind of attack/probing. Is it limited to state actors, or could we all play? Is the objective simply to be prepared, or is there a plan afoot?

<comment><USER32> > Is it limited to state actors, or could we all play?

Per the article, no, we can't all play. We don't have either the bandwidth or the expertise.

<comment><USER31> > Per the article

Not quite, it says "If the attacker has a bigger fire hose of data than the defender has, the attacker wins" and "the size and scale of these probes—and especially their persistence—points to state actors" which is not quite the same as saying you need to own the bandwidth. For example, DNS amplification can be used "to turn initially small queries into much larger payloads, which are used to bring down the victim's servers".

[https://www.incapsula.com/ddos/attack-glossary/dns- amplifica...](https://www.incapsula.com/ddos/attack-glossary/dns- amplification.html)

So maybe there are other techniques which might allow for similar leverage. Neither is the article conclusive about "state actors", they are merely "pointed to". As for expertise ... I don't doubt there are people out there who have it or might acquire it. So it's still an interesting question imo.

<comment><USER32> OK, perhaps I phrased it slightly wrong. _I_ can't play, because _I_ don't have the bandwidth or the expertise. I think that most of us on this board are in that category. (There's expertise here, but most of it isn't on the level of these attacks.)</comment></comment></comment></comment></comment>


How to learn object-oriented programming? - <AUTHOR> http://www.schibsted.pl/2016/02/object-oriented-thinking-in-the-data-centric-world/ <comment><USER2> Why? It's about a time for everyone to _unlearn_ the OOP, once and for all.

<comment><USER3> Excuse me, I might be a bit intrusive. I just began to learn programming. One fellow said you seem to have a good understanding of it as a whole and I had thought it might be a good idea to talk with you. As you said you're slow- banned, I leave my address here. Please write to sublunaralchemist yandex com</comment></comment>


What It's Like to Work at Beenz.com Inc. (2000) - <AUTHOR> http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=Financial&articleId=49034

<comment><USER2> I think what's most terrifying is they raised roughly $100,000,000 USD in funding, from folks like Larry Ellison at that.

It was a glorified loyalty reward program. They did however manage a partnership with MasterCard that allowed members to credit beenz to their account, and they allowed some other online reward point sites to convert their currency to beenz as well.

If I remember right, they dealt with a lot of scrutiny from governments since their end-game plan was to have beenz be a commonly accepted currency, and for members to convert real money to beenz. They even employed a few economists to orchestrate the buying/selling of beenz from/to partnering merchants, making their margin on the spread.

<comment><USER3> Why not? Aside from violating (unconstitutional) legal tender laws, Beenz would have had no less intrinsic value than the fiat currency used to buy them. They were never a real threat to the Fed.

Now, someone comes up with a gold backed electronic currency, THAT is a real threat to the Fed, and they are shut down rather quickly. Why? Because, unlike Fed notes, a gold backed electronic currency would have real intrinsic value.

<comment><USER4> There's nothing unconstitutional about legal tender laws, the Constitution explicitly gives Congress the authority to pass laws regulating the issue of legal US currency.

There are gold backed electronic currencies, and a lot of people will tell you gold is more valuable than fiat money, so they will gladly take all of your fiat money and give you some gold electronic currency in exchange. Gold is a _crap_ currency. It's just as "fiat" as dollar bills, except (a) commodity backed currencies are totally ruined by gold rushes, (b) using commodities as currency distorts the market value of that commodity, and (c) a gold standard would lead to deflation, which would be an economic disaster.

All of which misses the main point, which is that you took a discussion of a failed startup from the dot-com era and used it as a springboard into a totally unrelated recitation of half-baked goldbug talking points that are off topic and for that matter rather crankish. Little different than if there was a failed dot-com that centered around teaching kids about biology, and someone commented on it just to push some creationist viewpoint.

(Trying to make up a little for missing the down-arrow and accidentally modding you up.)

<comment><USER5> An oasis of reason, in a desert of insanity.

</comment></comment></comment></comment><comment><USER5> I wonder what happened to my beenz. It was quite a crazy thing with people paying up to $1 to have you visit their website.

<comment><USER6> I think they're has-beenz now...</comment></comment>


Skype drops support for Windows Phone 7 - <AUTHOR> http://blogs.skype.com/2013/09/20/setting-our-course-for-the-future-of-skype-for-windows-phone/

<comment><USER2> Misleading title,

      "As a result we are not planning to release further updates   to Skype for Windows Phone 7. However the Windows Phone 7 app will remain available to download in the Windows Phone Store, so users can still keep using the core Skype experiences, such as Chat, Voice and Video Calls."</comment>


Guile 2.0.2: Building the Guildhall - <AUTHOR> http://wingolog.org/archives/2011/07/04/guile-2-0-2-building-the-guildhall

<comment><USER2> _By the time we have native compilation, I hope also our Elisp implementation will be significantly faster than the one in Emacs, so it will really become attractive to people to finish the work that we have done to make the switch there._

For an emacs user, that's pretty exciting.

<comment><USER3> I don't buy it.

Replacing Emacs elisp implementation is just looking for trouble. Although it is not the fastest one, the existing one works well enough and is battle tested and there are millions of lines of elisp code that would need to be tested, debugged and fixed.

If the goal is to allow to write parts of Emacs and extensions in some other language, I wander is Scheme really the best choice? Why not go all out and implement elisp in Common Lisp and use Common Lisp as a base for future Emacs and extensions development. There have already been such attempts, so it's not exactly something unheard of.

<comment><USER4> Common Lisp is huge, Scheme is small(ish nowadays), easier to learn, and as a consequence better suited as an embedded/scripting language.

</comment></comment></comment><comment><USER5> So, does 2.0 have up-arrow history and in general not freak out when I try to do stuff in interactive mode? Guile's great for what it's great at, but interactive dev. in the custom of Python or Gambit Scheme isn't one of those things, at least for me.

<comment><AUTHOR> I think you just didn't enable readline. See:

[http://www.gnu.org/software/guile/manual/html_node/Readline....](http://www.gnu.org/software/guile/manual/html_node/Readline.html)

Guile's REPL is among the best, I think. It's all documented here:

[http://www.gnu.org/software/guile/manual/html_node/Using- Gui...](http://www.gnu.org/software/guile/manual/html_node/Using-Guile- Interactively.html)

But for real interactive development, you want Geiser:

[http://www.gnu.org/software/guile/manual/html_node/Using- Gui...](http://www.gnu.org/software/guile/manual/html_node/Using-Guile-in- Emacs.html)

<comment><USER5> Oh wow thanks! Note to self: RTFRM.

<comment><USER6> Also, in the future if you need to get Readline capability and don't have time to RTFM, you can just wrap the command with rlwrap (`rlwrap guile`).

</comment></comment></comment></comment><comment><USER7> They talk about ELF for storing byte code? Would that work on Windows/OSX?

(I guess it would, as much as Mono can load PE .NET files for OSX/Linux, after all these won't be loaded directly (it won't make much sense without the runtime anyway))

<comment><USER8> it's very straightforward to convert one header format to another of comparable (or greater) information-density, for the same processor.

ELF <-> PE is doable.

any debug format -> PE|ELF is doable (linking + stripping)

com|a.out -> PE|ELF is doable

</comment></comment><comment><USER9> Waiting with excitement for this to get into Debian. Even testing is at version 1.8.

<comment><USER6> 1.8 is years old. I suggest you grab 2.0.2 yourself if you want to see it _anytime_ soon...</comment></comment>


Ask HN: Grep, Awk for Windows Powershell - <AUTHOR> Hi,<p>Windows Powershell if powerful and you can call any .NET function from it. Being developer, my work involves switching between Linux Shell and Windows Powershell. I got used to grep, awk for many years. Is there any package/tool which can mimic the same in Powershell without learning new commands <comment><USER2> Does WinGW or Gow not work?</comment>


Robocalls & spam texts silently deliver fake news at scale but are hard to study - <AUTHOR> https://spencerdailey.com/2019/01/03/robocalls-and-spam-texts-deliver-fake-news-silently-at-scale-but-are-impossible-to-study/ <comment><USER2> I've had enough of these robocalls. I never answer calls anymore now. 90% of incoming calls are coming from telemarketers and scammers using those robocalls. I have just read an article at [https://www.whycall.me/news/consumer-wins- massive-229500-rob...](https://www.whycall.me/news/consumer-wins- massive-229500-robocall-lawsuit-against-time-warner-cable/) about how we can deal with such robocalls. However, it only works if the caller is a legit business. Hope this help.</comment>


If you mastered PHP & Rails, would there be any use case for PHP? - <AUTHOR>

<comment><USER2> I use PHP an Python. Not exactly Rails, but it's a similar question.

They both have their place, and they both have situations where one is an easier/better choice than the other.

Pick the best tools for the job. It doesn't matter how awesome your power drill is, even a double-clawed hammer is better at driving in nails.

</comment><comment><USER3> I mastered PHP, Python, JavaScript, Java. For me the only reason to use PHP is availability on every low cost host. I don't found any other arguments to use PHP.

<comment><USER4> You must be a fucking genius.

</comment></comment><comment><USER5> PHP has a much larger install base on commercial web hosts than Ruby, so I would consider it a perfect tool for a self-hosted application.

Also keep in mind PHP5 is not the same relic of the past that people constantly bitch about.

<comment><USER2> I'm just hoping PHP 5.4 adoption starts picking up. As it is, it's hard enough finding shared hosts that support 5.3

<comment><USER6> With the ever decreasing prices of VPSs these days (both Digital Ocean & Prgrmr offer a $5/month VPS) I really don't see much need for an experienced developer to pick using a shared host.

<comment><USER5> We're not necessarily talking about "experienced" developers. I know plenty of people who have set up their own self-hosted WordPress instances for their personal blogs who don't know how to how to self-manage a VPS.

Keep in mind not everyone who uses or even installs software is an "experienced developer".

</comment></comment></comment></comment><comment><USER7> Maybe you don't want to allow users to execute code by HTTP?

<comment><USER3> Yeah, PHP is a lot funnier :) [http://me.veekun.com/blog/2012/04/09/php-a- fractal-of-bad-de...](http://me.veekun.com/blog/2012/04/09/php-a-fractal-of- bad-design/)

</comment></comment><comment><USER8> wordpress templates/plugin development?</comment>


Olympic Winter Games Opening Ceremony – A great show with droneswarms - <AUTHOR> https://www.youtube.com/watch?v=y515-3r6LeM <comment><AUTHOR> This must be awesome to look at live. Also amazing to see drone swarms move out of labs with nets to a major event.</comment>


Confessions of a Bad Teacher - <AUTHOR> http://www.nytimes.com/2012/03/04/opinion/sunday/confessions-of-a-bad-teacher.html?_r=1&ref=opinion

<comment><USER2> A key problem of many of the school-reform/accountability/etc. initiatives lately seems to be that they're cumulative: a new way of assessing teachers or schools or curricula is added _in addition_ to existing methods, with no real effort to make sure that they're consistent with each other or mutually satisfiable. Hence you can get someone who's simultaneously too assertive in the classroom, not assertive enough, a bad teacher, and a teaching-award nominee.

Special-ed classes often seem to fit awkwardly into the schemes as well.

</comment><comment><USER3> My wife just went through a lot of this. She's been teaching for 8 years, the first 7 of those at one school. A few years ago that school got a new principal. She went from being one of the top performing teachers based on evaluations to the bottom of the list. This isn't because she's a bad teacher, but because she and the principal didn't get along. At the end of last year, she quit that job and got a new position in a new district. First evaluation this year? Right back to the top again.

On top of that, the new district has a completely different outlook on how to deal with parents amongst other things. The old school and district would bend over backward for parents even if they were completely in the wrong. The new district will at least try to take an objective view of any issues, including input from the teacher.

What does that do for a teacher's morale? I know a number of teachers from that old school who were great teachers, but quit to do other things because they didn't want to deal with the BS anymore. My wife was nearly one of those, but she knew that it wasn't her that was the problem.</comment>


Ask HN: How to Choose Problem? - <AUTHOR> Some start-ups solves very simple problems that I didn't see as sellable, yet they sell.<p>How does one find and choose a problem worth mending that can also bring people working on it food on to.their table? <comment><USER2> Often cited, Dropbox solved a problem that many thought was simple and didn't see as saleable.

Besides being there at the right time, marketing and clicking, the key thing was that it provided an easy way to take the pain away from setting up a system for backup and sync in the cloud, specially for non-technical users.

There is no sure shot way of finding such problems. If you look around, most problems not only appear simple but are in-fact simple to solve. It's the way you solve those 'simple' problems will put food on the table.

You have to try and fail fast to find the one.

That said, there are no shortcuts. The start-up road is long and hard; and it will try to sap the energy out of you. Be prepared for the long haul.

<comment><AUTHOR> Thanks for the new perspective

</comment></comment><comment><USER3> I don't think there's one simple, straight-forward, cookie-cutter answer to this. There are a lot of different ways you could approach this, depending on ... stuff.

But to start... I would say you should begin not by thinking in terms of identifying a problem, but by thinking in terms of identifying a _candidate_ problem. That is, some hypothesis that you can then turn around and try to validate. (I won't get all Popperian here and point out that you can really only invalidate hypotheses, but instead will just lean on our intuitive notion of what it means to validate a hypotheses).

Once you have a candidate hypotheses (or two, or three, whatever) there _is_ a somewhat straight-forward process for how to validate it and (potentially) turn it into a business. That process is laid out and explained in _The Four Steps to the Epiphany_ and _The Startup Owner 's Manual_.

Anyway, back to our "candidate hypotheses". The most obvious way to generate one is from personal experience. Eg, if you have worked as, say, a surgeon, you will probably already know a lot about what problems surgeons face.

OTOH, if you think you want to sell to a certain domain, but you don't have actual experience in that domain, you could make it a point to cultivate personal relationships with people who are in that domain, as well as doing a deep-drive into "the literature" of that domain, taking classes, watching videos, etc. But at the end of the day, if you're going to try to build a business selling something to, say, fire departments, you're probably better off having been a firefighter.

It might be a tough nut to crack, and the logistics might be tricky, but you may be able to find a way to embed yourself in the domain you're interested in. Volunteering, or just asking to "shadow" somebody for a period of time (this is where those pre-existing personal relationships come into play).

Another angle is "problems that are so general that they always exist." There's a famous phrase, the exact words of which I forget, which summarizes this nicely... it's something like "people will always want to pay less for things, have more free time, be healthier, have more sex, etc." So if you can come up with something that addresses any of these highly general topics, you might have a good candidate. Alan Kay, in one of his videos[3][4] talks about referencing Donald Brown's book _Human Universals_ [5] as a source for thoughts on these "universal" themes. There's a LOT of good stuff in those two videos, so if you haven't seen them yet, I'd highly advice watching them.

Another thought is to find places where people like to complain, and listen to their complaints. Find any forums, sub-reddits, or sites named something like "XYZSucks" and pay attention to what people are complaining about. Maybe you can build the replacement for XYZ that doesn't suck, or at least a complement / accessory for XYZ that mitigates some specific instance of suckage.

I'm sure there are a hundred other ways to approach this, so be creative.

[1]: [https://www.amazon.com/Four-Steps-Epiphany-Steve- Blank/dp/09...](https://www.amazon.com/Four-Steps-Epiphany-Steve- Blank/dp/0989200507)

[2]: [https://www.amazon.com/Startup-Owners-Manual-Step- Step/dp/09...](https://www.amazon.com/Startup-Owners-Manual-Step- Step/dp/0984999302)

[3]: [https://www.youtube.com/watch?v=id1WShzzMCQ](https://www.youtube.com/watch?v=id1WShzzMCQ)

[4]: [https://www.youtube.com/watch?v=1e8VZlPBx_0](https://www.youtube.com/watch?v=1e8VZlPBx_0)

[5]: [https://en.wikipedia.org/wiki/Human_Universals](https://en.wikipedia.org/wiki/Human_Universals)

<comment><USER3> I forgot to mention this earlier, but there are also forums like the "SomebodyMakeThis" sub-reddit. Basically, a place for people to talk about things they wish existed. This could probably help seed some ideas for you as well.

[https://www.reddit.com/r/SomebodyMakeThis/](https://www.reddit.com/r/SomebodyMakeThis/)

<comment><AUTHOR> Thanks for the references.</comment></comment></comment>


Why are big sites like CBS.com still getting hacked? - <AUTHOR>

I'm trying to figure out how the websites of big companies are still getting compromised and defaced. Many of the attacks don't seem that sophisticated. . . thought this community might be able to help clarify.  Thanks <comment><USER2> In general, you only need to make 1 mistake for your website to be vulnerable to what looks like a trivial hack.

The mistake could be anything from an insecure form input parser, through to not updating your web server to the latest update.

Once one hacker finds that vulnerability, it looks like it's an easy thing to do to take down or modify the side, but the finding of it can be extremely time consuming.

On the other side, look at who didn't go down in the recent Anonymous attacks - CBS and Universal Music went down, but Sony, EMI, Warner, etc, remained up.

Anonymous only had to find a couple of major relevant corporations that were vulnerable to make a big impact, it doesn't matter that the other dozens (100s?) of suitable targets were more secure.

<comment><AUTHOR> If it only takes 1 mistake, would having a hot backup or failover be a best practice, so that if something does happen, you can immediately channel traffic to a live site?

<comment><USER2> Quite often the failover is just a DNS change to a static page saying "Sorry, we're currently unavailable".

The difficulty of having a hot backup is preventing a hacker repeating their attack immediately after you fail over.

<comment><AUTHOR> Thanks EwanToo - that makes perfect sense. A combination of some security monitoring system that notifies you of the vulnerabilities along with someone to update your system is needed. But what if the updates have dependencies, for instance, incompatible Ruby gems or so. At that point, do you have to make the tradeoff of security risk vs time to update all gems/resolve incompatibility issues/deal with bugs in latest release?

<comment><USER2> Exactly, if you've got a complex environment, you might not even know that one of your suppliers deployed an insecure ruby gem (or any other package), but you'll want to do full testing before upgrading.

All this leaves big windows of opportunity for attacks.

</comment></comment></comment></comment></comment><comment><AUTHOR> *Point of clarification: I'm not asking why Anon went after them, just how they could be so vulnerable.

</comment><comment><USER3> CBS and other companies are what we call "old money". And when it comes to things like Websites and social networks, they just don't have the mindset that they should have when it comes to it. That said, their servers are greatly under managed, and the people working in those areas are unable to keep up because when they first started, they where still writing "the book". Also, Anon is made up of more than just bored 18 year olds (As the media greatly dramatizes.)but rather "disgruntled" and "fed up" masters who want to retaliate in any way possible.</comment>


Ask HN: Reversible expressiveness of programming languages? - <AUTHOR>

I have used many different programming languages from different paradigm, and all of them talks about how expressive they are, etc. I had this thought that the expressiveness of all these languages is in only one direction i.e from your thoughts to the code and the reverse of that - from code back to thoughts - takes around same amount of effort in all languages and this is really disappointing and leads to the use of alternate tools like documentation, comments etc. It may be possible to easily understand a specific part of the whole code base but that is no where near the whole picture of the system and what thoughts exactly were used to design the system. Also, we all know that code is read more than it is written.<p>Would like to know what people think about it. <comment><USER2> It is a good goal. There are a few lines of thinking about this. One is to stress discipline by coding in the "literate programming" style. Another is to stress writing less code so that less has to be expressed. A third is to make the language representation more suitable for gaining understanding at a glance - this leads to most of the interesting visual languages.

<comment><AUTHOR> The "visual languages" concept is something that has been in the industry for quite a long time. I guess it may have been successful in some domain specific languages but when it comes to general purpose languages, it seems that the generality of these languages somehow make the visual representation not feasible.</comment></comment>


Deconvolution and Checkerboard Artifacts - <AUTHOR> http://distill.pub/2016/deconv-checkerboard/ <comment><USER2> One thing that's interesting about this article is that it's the canonical publication for a novel result. It isn't a blog post accompanying a paper -- it is the paper.

<comment><USER3> i agree. I hope this trend continues. I'm not saying that papers should be phased out, but the blog post is a good avenue for "micro" results which don't seem like they deserve to be written up in some dog and pony show of a paper but are still of interest to the general public.</comment></comment>


What would be a good health + tech related project to pursue? - <AUTHOR>

so I have to do a mini-thesis like project of something health related and I have decided to take on a tech direction with it. Obvious things have come to mind such as data-analysis for personalized medicine, apps/startups aiming to make more efficient old and outdated processes etc, however, these kind of seem to be the low hanging fruit. I want to look into something that is truly cutting edge and can cause disruption and hopefully if my research can back it up I can pursue it and make it into an actual product or website etc.<p>Any ideas are appreciated! <comment><USER2> _I want to look into something that is truly cutting edge and can cause disruption._

John listed many good projects. Based on ^^, other good places to look to help generate ideas:

Current notable movers:

* <http://rockhealth.com> (also check out their Events page in case you may able to get cheap access to conferences as a student)

* <http://blog.23andme.com>

And places to see what people are talking about/building:

* <http://www.quora.com/Health-Informatics> and all sorts of related topics

* <https://angel.co/health-care-information-technology> and all sorts of related topics

* <http://mobihealthnews.com>

* <http://www.imedicalapps.com>

And in general I'd recommend following any company/person you learn about from the above ^^ on <http://crunchbase.com>

Also feel free to shoot me an email email@example.com. I'm in the process of starting up my own health tech-related project (<http://blog.stayinyourprime.com>) so I've been doing a lot of research. Happy to share what I've learned and chat more about what you're doing.

<comment><USER2> Also see Katelyn Gleason's post on a recent Nick Grossman (of USV) post about things he thinks people can build in this space: <http://news.ycombinator.com/item?id=5043588>

</comment></comment><comment><USER3> Mind dump of thoughts/sites:

<http://www.fitbit.com/> <http://nikeplus.nike.com/plus/what_is_fuel/> <https://jawbone.com/up>

Lots of hardware devices and some software integrations, but need to think outside the box.

www.dietbet.com/ - Gamification of working out is a great idea/starting point, but what about taking it further. Choosing what you eat can be more important than working out.

A food/photo sharing/tracking software of pictures of everything you eat and possibly automated/encouragement via mechanicalturk based on does it look healthy would be cool. Also could align with friends/groups who are trying to eat healthy - people could comment and say WTF/Seriously... or better yet, ask wheres the photo or have you not eatten?

Some other directions would be more in line with a chrome plugin that goes off ever 30min for you to do a pushup or something.

Just some thoughts.</comment>


Autonomous Cars Are Not Imminent - <AUTHOR> https://www.recode.net/2017/9/5/16257314/stop-autonomous-self-driving-cars-not-coming-soon-future <comment><USER2> This article is pretty bad. There's no reason that automous vehicles have to be linked to electric vehcules, it just happens to be the case that Tesla is pushing both. The Lexus cars that Waymo uses are not electric for example.

Automous also cars don't need communication with other cars to hit the market. It'd be nice for faster driving, but it's in no way a requirement.

Hacking is a real concern, but I don't think it will stop adoption. It's also essentially unsolvable, companies will just need to have sufficiently good security measures that it occurs rarely enough to make automous cars safer than non-automous.

</comment><comment><USER3> I think there are roughly two camps about autonomous cars: the people who think that a car that's 70% as good as a human, but significantly better for that 70%, will be good enough in the beginning, and the people who think that an autonomous car won't be okay until it's as good at a human in every aspect, e.g. requiring an AGI.

Both camps have valid arguments, but I think that the safer option is the one where humans don't need to think or drive at all, essentially not requiring a steering wheel at all. I don't think the Tesla model is so good because if you let a driver essentially not worry about what's going on for 95% of the time, and then something needs their attention quickly, their reaction time will be significantly slower because they're not primed for it, unlike during a normal driving session. You can argue that humans can be trained for this, but unlike pilots pretty much anyone can get a driving license and it's not difficult: for example, in Florida, many municipalities just have you do some simple stuff in a parking lot with no real world, as in not in an actual road, driving test. For those people you can't expect them to pay attention and allow a car to drive, the human brain just doesn't work like that. This argument doesn't even talk about the things humans don't even realize they perceive, like the intention of other humans in the area, that is really, really difficult for a computer to understand, another huge barrier.

In my mind there will be two areas that self driving cars will impact: long haul trucks, and regular car features. Truckers are trained pretty well and I could see a semi-automated truck work for them, especially if they were trained a bit more on the specifics of the automated tech. Regular cars will likely get an improvement as well, maybe a better version of cruise control that takes care of stop-and-go traffic better, or something that can sense accidents further away and warn the driver to take an alternative route before even being near the accident. These would have real, and positive, impacts but won't be truly self driving.

<comment><USER4> There is a third camp.

The ones that think cars need to be better than humans and that one death in a self driving car is too many even if there would have been thousands of deaths by human drivers in the same time.

The amount of time spent debating issues is huge. Like how a computer would handle situations that are unique to human drivers (for example, not leaving enough room to stop because you're driving too fast and following too close) or things that a human driver would perform poorly on too (should I drive off the bridge or run over those children?).

It's fine to debate issues but to use them as "show stopper" by default is irresponsible.

</comment></comment><comment><USER5> Naysayers are a dime a dozen. What's valuable: someone who can see how to make it happen.

</comment><comment><USER6> Expected change takes longer than expected. And unexpected change happens before you know it.

</comment><comment><USER7> This article is one long non sequitur. I learned absolutely nothing.</comment>