Show HN: Please Don't Rob Me - <AUTHOR> http://www.pleasedontrobme.com <comment><USER8> It always surprises me people think this is a real issue. For many "victims" a more effective algorithm would be something like this:

       If victim's age > 25 && < 60
          If hour of day > 10 and < 17
             Rob house

That algorithm will fail in many cases of course, but I'd argue it covers a much larger number of people than the supposed problem identified here.

For added safety, the implementor may add this feature prior to the "Rob house" step:

       Knock on front door

<comment><USER9> An old trick I've heard is to have someone call the house's landline while you are robbing it. As long as the phone is ringing, you can be reasonably sure that no one is home.

<comment><USER10> A lot of families, including my own, will not answer the phone if they're asleep or busy. Or more commonly, if the caller is not recognized on caller ID they'll just let it ring.

<comment><USER11> If you call the same number 10 times in a row, or let it ring for minutes, you can be reasonably sure nobody is home. Most people would at least get pissed and pick the phone up, if only to slam it back down.

<comment><USER12> Well now your phone is linked to the robbery. One call might be explainable but 10 is pretty suspicious, especially if you do it at multiple crimes.

<comment><USER13> I'm sure it's not too hard to anonymously get a phone number. Google voice perhaps?

<comment><USER14> Payphones.

<comment><USER15> Far too low-tech for HN.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> It's an interesting idea, tracking people's current locations based on their sharing on social networks, and cross-referencing other databases to find out if someone is at home.

But this seems like a very high-threshold way to find out whether someone is home. I mean, if I'm really interested in robbing someone, am I really going to go through the trouble of searching through social networks, cross- referencing information from people in my area, and only then starting to figure out which homes are (and aren't) worth robbing?

And of course, there are a number of very important variables that such an analysis ignores: Whether the person lives alone (or is renting the place out via AirBNB), whether they're in a building or single home, whether there is a burglar alarm, how good the police force is in that city, how easy it is to get into (and out of) the home in question, and whether there's anything worth stealing.

So it's an interesting experiment, but telling people to remove their names and geographical information from Instagram to avoid being robbed strikes me as a bit far fetched.

I run an e-mail list for people who live in my city (Modi'in, Israel), and we now have nearly 3,000 subscribers. People are constantly saying, "I'm going to be away on vacation during such-and-such a period of time. Does anyone need a short-term rental?" That strikes me as a far greater invitation to mischief and robbery than Instagram or any other social network.

<comment><USER17> You may not do this for say, robbing joe blogs. But what happens if your going to rob a celeb who has 50k+ of jewlery in their house and you know they're going to be out of town filming for three weeks, or that they are doing a PR night so you have 8 hours before they return.

There are examples of this, popularized by the movie The Bling Ring[1].

[1][http://en.wikipedia.org/wiki/Bling_Ring](http://en.wikipedia.org/wiki/Bling_Ring)

<comment><USER18> Does a celeb with 50k+ jewelry not have an alarm system? I suppose there are some that don't but I guess I'd expect most do.

</comment></comment></comment><comment><USER19> Is the name meant to riff on [http://pleaserobme.com](http://pleaserobme.com), a 2010 site with similar aims?

<comment><USER20> And which got a huge amount of publicity about it.

[http://techcrunch.com/2010/02/17/please-rob-me-makes- foursqu...](http://techcrunch.com/2010/02/17/please-rob-me-makes-foursquare- super-useful-for-burglars/)

[http://www.telegraph.co.uk/technology/twitter/7266120/Please...](http://www.telegraph.co.uk/technology/twitter/7266120/Please- Rob-Me-website-tells-burglars-when-Twitter-users-are-not-home.html)

</comment></comment><comment><USER21> Mine home address is available to anybody from local yellow pages too.

Privacy is indeed important, but fear of robberies is not the reason why we should protect it. Nor is someones home address the supersecret info I desperately need to protect. There were maybe two facebook post triggered robberies worldwide. It is much easier to rob one of hundreds seemingly right now empty houses robber goes around every day then to analyze pictures and maps to find one random target.

<comment><USER22> You might be surprised by the robbers' creativity and drive. For example, you can't put anymore the time and day of a wake in the local newspapers, since burglars used this info to break into the houses of the dead's relatives. Same thing for weddings.

<comment><USER23> Not sure where you live, but every obituary in the newspapers where I have live have time and dates for services.

As a quick example, [http://www.tributes.com/obituary/show/Mary-Ida- Cammisa-10153...](http://www.tributes.com/obituary/show/Mary-Ida- Cammisa-101531021)

</comment></comment></comment><comment><USER24> The whole point of it is kind of moot though, an impulse burglar would just roam the neighbourhood to find a target and one with a specific target has better ways of finding out if the house is empty than 1 inhabitant posting to instagram... Not being at home is not what elicits criminal behaviour.

</comment><comment><USER25> Doesn't seem very indicative of a good place to rob to me. If I'm not home, my wife usually is, and if we're not, the landlord also lives in the house, not to mention the dogs. The only things I own worth stealing are my computers anyway and those are all portable and stuffed in a backpack every weekday, locked in a hotel weekday nights, and often with me off at a hackathon on weekends. So if I'm taking a picture away from my house, most of the time the only thing I own worth anything is with me. If I was a robber I'd rather case houses in person.

<comment><USER26> It seems like 'any house, during normal working hours' would be just as reliable a bet as a house determined through this kind of snooping.

</comment></comment><comment><USER27> Reponsible behaviour would be informing just the owner of the photograph that they are potentially making themselves vulnerable.

Sharing the information with the internet at large is just being irresponsible in order to try and show off, no matter how many disclaimers are on the site.

<comment><USER28> Agreed.

"PDRM is meant to demonstrate how easy it is to find out where someone lives and if they are at home or not. The aim of this site is to educate and empower people to protect themselves better while using social media."

The target audience of a website like this is us on HN, not the people who need to receive the message about privacy.

<comment><USER29> The two groups aren't mutually exclusive. It never ceases to amaze me how many people with a deep understanding of technology still seem to over-share in this regard.

<comment><USER30> "over-share" is a relative term. How many of them actually get robbed as a direct result of "over" sharing?

</comment></comment></comment></comment><comment><USER31> I think it's far more interesting and productive to use facebook posts for this, rather than GPS coordinates in EXIF data and comparing it with a phone book (which is essentially what they're doing, according to the about page). Facebook posts often contain much more information and that information is easier to extract.

Realistically speaking, neither of these cases will be addressed. Although properly using the privacy settings can help, the entire reason people use tools like these is to express themselves about things they're seeing, and that usually doesn't happen at home. This coupled with the fact that the risk is extremely low, and that there are much better ways for a burglar to obtain this information, I don't think this is the best way to go about privacy awareness. It was probably fun to build, though.

</comment><comment><USER32> Why on earth is that site made primarily for touch controls? Am I the only one who finds these sliding (vertically or horizontally, doesn't matter) sites with tons of empty space and huge fonts extreme impractical or even obnoxious?

</comment><comment><USER33> Classic "individual" vs "any" design pattern.

You want to find my specific kid for nefarious purposes or rob my specific house, modern technology makes that about a billion times easier than decades ago.

You want to find a kid for nefarious purposes or rob a house, any moron can find the nearest elementary school or drive around a subdivision watching cars pull out in the morning and swing back in 5 minutes and technology doesn't help very much at all. If anything technology makes it worse, too easy for nosy neighbor with an omnipresent cellphone to make a call.

So it's being marketed as technology makes it easier for a random scary dude to go after a random victim, but in reality the problem is crazy addicted coworker, crazy ex, crazy relative, not just random scary dude.

</comment><comment><USER34> As an aside, it is official UK policy to NOT respond to reports of someone's house alarm going off. If you ring 999 they'll ask you if you can actually see someone in the house robbing things and if you can't, they won't send anyone out.

The reason is that too many house alarms go off by accident, they don't have the manpower to check them all.

<comment><USER35> Yep, I was just going to say. Right when I moved into a new apartment, I didn't know the security code to the alarm so it went off for a good 20 minutes. You could hear the alarm on the street, but no one seemed to care or pay too much attention to it. It reminded me of this [http://www.nytimes.com/2012/03/13/opinion/bike- thief.html](http://www.nytimes.com/2012/03/13/opinion/bike-thief.html)

</comment></comment><comment><USER36> I thought a a lot about this:

Anyone can rob your house/most apartments if they look like Construction workers/Landscapers.

Hide your jewelry where no one will find it; you might need to know a little bit about construction though.

In the end, make sure you have an ip cam that captures license plates, and a few in your house.

A smart criminal will have flip up plates, and wear desguises though.

Maybe that jewelry should go into a safe dep. box? Make sure you have no active judgements though? They can snatch it all up. They can also empty out your bank account. Be proactive, and don't give them a cent. Become Judgement Proof--if you have any one you trust your life with?

Burying in the backyard is not a bad idea, but don't do it drunk. I know a guy who lost $800,000 in Muir Beach after a night of hard partying. He woke up and couldn't find remember what he did with his ill gotten money, or maybe that's just what he told his wife?

</comment><comment><USER20> It should (and the the previous PleaseRobMe.com also made this mistake) use the word "burglary" rather than "robbery". Edits - this could just be a British difference rather than a US one, if so, my bad!

Robbery is about theft (usually using force) from a person, whereas burglary is unlawful entry to and theft from that person's property. Since the person is not going to be there, the property is empty and ripe for burglary.

A more interesting and challenging PleaseDontRobMe would focus on where the target is, away from home securities, who they are with, the security situation of the country, the best escape routes relative to their location, locations of police, CCTVs etc. Much more interesting geographically in my opinion!

<comment><USER10> This is not just a British difference. Robbery always involves some form of threat or assault in the US, legally speaking. And colloquially speaking too, except in recent years where the word has lost some meaning.

The US vs. British difference is the verbage of "burglary" (though interestingly this article also confuses robbery with burglary). [http://grammarist.com/usage/burgle- burglarize/](http://grammarist.com/usage/burgle-burglarize/)

</comment></comment><comment><USER37> IMO, the how to protect yourself should be more prominent and perhaps on the first slide/page.

I stopped using Instagram because I couldn't keep up with me post-dating my activities. It was more of a chore to remember to post a week or so later and 'pretend' I'm doing such activity now, instead I just didn't bother sharing.

I got a brand new car a few months back, and even though I wanted to share a pic (not to gloat) I knew it would be easy to track down, and due to where I live it's easy to see whether I was home or not. Not a rare car by any means, but how many '14 plate cars in particular colour in a particular model do you see in any one area? Matching cars could be 5-10 miles apart easy

Does anyone else think like this?

<comment><USER38> Car theft scenarios:

\- look on instagram for nearby recent photos of fancy cars to steal

\- visit neighbourhoods where rich people live and look for fancy cars to steal

</comment></comment><comment><USER39> There're a lot of comments saying thieves are too thick to use technology for robbing people. Maybe some are, but there are plenty of tech-savvy people with no scruples who might use information like this. To-order car thieves use plenty of technology to do their business, for example. And furthermore, I'm sure we all know plenty of houses that were mysteriously robbed at an opportune moment (the night everybody went on a trip, for example).

Thieves mightn't be cross-referencing databases using various API's, but they're not so thick as to miss opportunities that might present themselves through Facebook posts etc.

I don't see a problem with increasing awareness of the possibilities.

<comment><USER40> The tech car-thieves use is pretty amazing, I work for an insurance company, and we've seen almost any kind of deterrent being easily defeated.

Some have gone to the extreme of bringing and installing an entire car dashboard to bypass custom keys.

I've seen videos of devices that purportedly copy most common alarms. Heck, it apparently costs U$ 5.

Snopes thinks it's fake:

[http://www.snopes.com/autos/techno/lockcode.asp](http://www.snopes.com/autos/techno/lockcode.asp)

however most mainstream news sites report it as true:

www.cbc.ca/news/canada/manitoba/new-5-device-easily-unlocks-car-doors-for- thieves-in-winnipeg-1.2288826

[http://arstechnica.com/security/2013/06/after-burglaries- mys...](http://arstechnica.com/security/2013/06/after-burglaries-mystery-car- unlocking-device-has-police-stumped/)

<comment><USER39> Yep this is exactly what I mean. BMW's get stolen around here often, robbers programming new keys without breaking a sweat, and knowing how smash windows and get in without setting off the alarm:

[https://www.youtube.com/watch?v=DshK4ZXPU9o](https://www.youtube.com/watch?v=DshK4ZXPU9o)

When the risk/reward of theft is skewed so poorly in a thief's favour, and considering that there's a precedent of unscrupulous technological usage, I don't think it'd unrealistic for people to monitor social networks in this manner to look for opportunities.

In your experience, are certain new cars more likely to be stolen? I suppose any car can easily be taken by waking the owner up at night with a weapon in their face and asking for the keys...

<comment><USER40> I can't answer your question about new cars :) (also, I work in Uruguay, very different from the U.S.).

Your remark about any car being easily stolen reminded me of

[http://xkcd.com/538/](http://xkcd.com/538/)

</comment></comment></comment></comment><comment><USER41> So, essentially:

        - if instagram?
          - if on_vacation?
            - if shared_home? == false
              - if dangerous_pets? == false
                = rob_them
              - <USER7>
                // wait
            - elsif roommates_home?
              - if dangerous_pets? == false && if security_system? == false
                  = rob_them
              - elsif house_guests?
                - if house_guests_home?
                  // wait
                - <USER7>
                  = rob_them
              - <USER7>
                = kill_pets + rob_them
            - <USER7>
              = rob_them
          - <USER7>
            // wait
        - <USER7>
          = chill_with_friends

Seems legit.

</comment><comment><USER42> It would be obviously difficult to pull off, but I'd like to see some estimations on how many robberies occurred based on information gained form social networks. I am guessing it is such a small percentage that these fears are completely irrational. If you are going to take the time to make this site and present this argument, I'd like to see some shred of data to substantiate your claims that social networks are really endangering the "careless people" who use them. Especially if you are going out of your way to call those people careless.

</comment><comment><USER43> When I look at your site on my iPhone 5 in landscape mode the title changes from "Please Don't Rob Me" to just "Rob Me". You should consider fixing that.

</comment><comment><USER44> You've got some browser height compatibility issues [1, 2]. (I'm on Chrome on a macbook.)

[1] [http://cdn.imghack.se/images/c226811e44f418ab538c336f156d1b3...](http://cdn.imghack.se/images/c226811e44f418ab538c336f156d1b33.png)

[2] [http://cdn.imghack.se/images/db6a53b635f7d471f747117aada7f2f...](http://cdn.imghack.se/images/db6a53b635f7d471f747117aada7f2f7.png)

</comment><comment><USER45> Serious question: What do people rob these days? It seems like there is nothing that can be easily transported and sold in most houses.

<comment><USER46> TV, computer, phones, cash, jewelry, clothing, any type of appliance, power tools, medicines, alcohol, cigarettes, toys, ...

I'm not sure what kind of houses you have in mind that have nothing that can easily be transported and sold... Except for the furniture, most houses are full of stuff, and most of it can be sold.

<comment> guard-of-terra My TV is 37 inch, trying to haul that in the street should raise some eyebrows. And it doesn't have that much resale value.

<comment><USER45> That's what I was thinking. Stuff in my house is either too bulky or don't have much resale value (as stolen goods). Our house was burglarized while living in Switzerland, and they did not touch any of the electronics, presumably too bulky. Cost of replacing the broken window/frame was the most costly aspect.

From all the things listed, jewelry seems to be the most likely target.

</comment></comment></comment></comment><comment><USER47> Umm, how do you use it? All I see is copy, no Start Here... Also, no scrollbars, and no way to scroll down to see all the copy.

</comment><comment><USER48> This has been done before (2010): [http://pleaserobme.com/](http://pleaserobme.com/)

</comment><comment><USER49> It always amazes us when we see families post their vacation photos on FB and such, while they are still on vacation.

Can't you just wait till you get home to do that? Is it that critical, or do you just like announcing that hey, we're not home.

</comment><comment><USER50> I have a better idea, re-brand this as, find the best places to vacation.

Step one look at picture. Is the area they're in awesome? Step two go to area, or repeat step one.

Way better than robbing people nonsense.

</comment><comment><USER51> Shouldn't they provide attribution and license of each photo took from Instagram? (I do understand that this would de-anonimize the photos).

</comment><comment><USER52> This is a knockoff of a years-old site [http://pleaserobme.com/](http://pleaserobme.com/)

</comment><comment><USER53> [http://iknowwhereyourcatlives.com/](http://iknowwhereyourcatlives.com/)

</comment><comment><USER54> Perhaps this could be better used as a heuristic for delivery companies to select a delivery time?

</comment><comment><USER55> Maybe Instagram could be sued for not striping EXIF information (aka metadata) from pictures?

</comment><comment><USER56> Speaking of irrational fears: I always fear that I forgot my keys while leaving my flat. Now I know that I just need to post some holiday pictures of myself on instagram and eventually somebody will show up to help me get back in - for free!

</comment><comment><USER57> Typo: "sing in" should probably be "sign in"

<comment><USER58> I rather like it as an idea though, how would it work? I hum a tune that only I know, it lets me in?

<comment><USER59> I like the idea of it as a form of protest more. Like a sit-in, only way more obnoxious.

a tune-dependant sign-in procedure would doom me and the other 'arrhythmics' among us.

</comment></comment></comment><comment><USER60> If you're not home, then how can you be robbed?

Robbery != Burglary.

</comment><comment><USER61> Kudos to the project! I believe the best way to make people aware of privacy issues are sites like this. These "wtf am I doing?" moments are really educative.

</comment><comment><USER59> I wish that my scroll wheel would translate into horizontal movement, since you chose a carousel style presentation.

</comment><comment><USER62> Thinking of the 2012 election, mitt robme

better ban yellow pages or anywhere else addresses can be found</comment>


Aaronsw indicted for hacking MIT network to download millions of JSTOR docs - <AUTHOR> https://www.documentcloud.org/documents/217115-20110719-schwartz.html <comment><USER2> The repeated use of "stole" in the indictment is interesting, even beyond the usual metaphorical usage to discuss copyright infringement.

In this case, the indictment alleges that the documents were stolen _from JSTOR_ , which does not even own them! In the vast majority of cases JSTOR scanned documents whose copyright is owned by someone else, and acquired or was donated a non-exclusive license to distribute copies via its service. In many cases the documents are even public domain. The indictment continues the theft metaphor by discussing the effort and expense JSTOR incurred in scanning the documents, and the alleged attempt to render this less valuable by redistributing "its" documents, analogizing this to the loss someone suffers in a theft.

But effort expended to build a private repository consisting of copies of things you don't own doesn't give you ownership of the result, any more than Google Books doing the same has given them ownership of the documents that _they've_ scanned. If you scraped Google and "stole" their scans, you would be violating Google's Terms of Service, and Google might indeed feel subjectively like you've taken something of value (their exclusive access to this repository of scans), but I think it would be a stretch to say that you've "stolen" "their" documents.

<comment><USER3> They are talking about theft of services, not copyright infringement. In any event these charges are going to be very difficult to beat since they're federal, even though there are some obvious holes in the indictment. It will be almost impossible to get any of the evidence thrown out even if there was an illegal search and seizure. His best bet is probably to get the Harvard legal team to go to bat for him, although it's difficult to say how likely that is.

<comment><USER2> I wasn't really commenting on the legal sufficiency of the indictment, just the rhetorical dishonesty of accusing someone of "steal[ing] well over 4,000,000 articles from JSTOR" (quote from the indictment) when JSTOR didn't own those articles. They could've just alleged violation of JSTOR's TOS and thereby theft of network services. I suspect JSTOR or people sympathetic to them had a hand in writing the indictment, though; JSTOR has a long history of attempting to spread the misinformation that it somehow "owns" its archive.

<comment><USER4> Well, if someone stole $100,000 of property from a storage facility, that wouldn't mean the storage facility claimed ownership of the property, just that it was the location of the theft. Maybe you're overthinking this a bit.

<comment><USER5> Well this is more akin to breaking into the storage facility and making a copy of all the Paintings stored there. The value of the goods being stored has not been reduced.

<comment><USER4> Not to torture this analogy any further, but would you feel safe storing your stuff at such a facility after something like that? No, you'd probably look elsewhere for your storage needs. Breaking in is still bad and would be the subject of criminal charges. If the US attorneys decide that use of the word 'stole' is somewhat over the top, then guess what? they can amend the indictment - just as the defense can amend their motions.

My point is not that the government is correct or morally justified in bringing this indictment, but that getting hung up on terminology like this obscures the legally problematic issue of having (allegedly) bypassed the security systems to download material he was not supposed to have access to, _regardless_ of who actually owns said material.

<comment><USER6> But: (1) JSTOR isn't a storage facility in that sense; the copyright holders do not pay JSTOR to store their items, so this is a bad analogy.

(2) If the outrage is supposed to be about bypassing security systems, why is the government hung up on the "theft" terminology? Especially when JSTOR, the party arguably injured (in some way not specified), has asked the government not to prosecute?

No, this is clearly a convenient way to get a politically inconvenient person labeled a felon.

<comment><USER4> 1\. The analogy is only to point out that a 3rd party repository can be negatively affected by a break-in event if it doesn't have an ownership interest in the materials it stores.

2\. The government is not hung up on the 'theft' terminology. The words 'steal' or 'stole' only appear three times in the 15 page indictment and the actual offenses he is charged with are wire fraud, computer fraud, unlawfully obtaining information from a protected computer, and recklessly damaging a protected computer.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> What Aaron did sounds seriously sketchy (sneaking into MIT wiring closets, trying to download the _entire_ database, etc.), a fact that Demand Progress and several commenters here seem to be ignoring.

Defending his actions would require a very strong, multi-pronged version of the argument "if it's physically / technologically possible, it must be ok." Can MIT legally limit guest access to its network? Can JSTOR limit access to its content? Well, technically, their software _didn't_ limit it, right? He just changed his IP address and they let him right back on, gave him permission. And then he had to change his MAC address. And then physically move to a different building.

But it doesn't matter anyway, because legal restrictions are legal restrictions. It's impossible to enforce every legal restriction in software. Put another way, we don't have to read JSTOR's server code to figure out if there's a violation of policy here -- the policy is written out as a legal document.

In the hacker world, there's a tendency to think that if something's possible, even easy, then it shouldn't be considered "breaking in" or "stealing." If my Gmail password is "password," then of course you're going to read my email! I had it coming. In the real world, though, this is still a crime.

<comment><USER8> >What Aaron did sounds seriously sketchy (sneaking into MIT wiring closets, trying to download the entire database, etc.),

reminded me about ancient IP infringement case:

<http://en.wikipedia.org/wiki/Prometheus>

<comment><USER9> +1 for correlation with ancient Greek mythology.

I seriously recommend Prometheus Unbound for a more modern treatment of the subject.

<http://andromeda.rutgers.edu/~jlynch/Texts/prometheus.html>

</comment></comment></comment><comment><USER10> This is the most technically competent charging document I've ever read. I guess there must have been some hackers on the grand jury.

Paragraph 35 & 36: which "protected computer" on MIT's network did he access? Certainly they're not trying to claim his laptop was a protected computer? Are they talking about the DHCP server or whatever registration frontend MIT has for the DHCP assignments? I have trouble with the concept that a violation of a computer use agreement (when there are no operative security barriers in place) constitutes a violation of the computer fraud and abuse act. Then again, I've always thought that act was vague and therefore overbroad.

Obviously what he did was bad in some sense (at least from the perspective of JSTOR and MIT), but even if it should be a crime rather than a civil dispute or internal disciplinary action at MIT, I don't like the fact that just about any misbehavior on the internet becomes a federal case because the probability of no interstate resources being used is very low.

Finally, I take issue with the notion that someone who is accessing a service through a public interface is criminally responsible for downtime if too high an access rate causes service degradation or an outage. The claims that JSTOR's servers were overloaded and (one?) even went down at some point are clearly there to set up a later claim of damages. Haven't they heard of rate limiting (in this case, since it was a rogue laptop stashed in a data closet, rate limiting by IP)? That wouldn't work against a concerted denial of service attack, but this was no denial of service attack. JSTOR seems to have been relying on manual intervention to stop article leeching that could lead to a (partial) outage. That's naive, and not a good idea.

<comment><USER11> > no operative security barriers in place

I don't know... Even if my front door was open, you still aren't allowed to enter my house without my permission.

<comment><USER12> But there is an element of permission inherent in DHCP. Your device is actively configuring my device _specifically to allow network access_. It's not an open door; it's a sign saying "This way please". That said, its obvious this was an attempt to circumvent access controls.

<comment><USER11> I'm unfamiliar with MIT's guest setup, but I assume they let you get an IP address, but before you can access anything, you have to acknowledge their terms of service / acceptable use policy. If you fail to abide by this, you'd be accessing the network without permission.

You're right that (as alleged), this would be an obvious attempt to circumvent access controls.

Given the way things are worded, I'm guessing that the MIT computer that was improperly accessed was a router or switch. Hell, just plugging into the switch directly could be construed as unapproved access to a computer device. I think the Federal law treats anything with a processor a computer.

<comment><USER13> The MIT Guest network is actually pretty awesome, it doesn't ask you to acknowledge anything, it just grants instant access.

</comment></comment></comment></comment></comment><comment><USER14> [http://blog.demandprogress.org/2011/07/federal-government- in...](http://blog.demandprogress.org/2011/07/federal-government-indicts- former-demand-progress-executive-director-for-downloading-too-many-journal- articles/)

 _"It's even more strange because the alleged victim has settled any claims against Aaron, explained they've suffered no loss or damage, and asked the government not to prosecute," Segal added._

Nowhere do they say he did not do it however.

cached: [http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://blog.demandprogress.org/)

<comment><USER2> JSTOR is being very vague about their role in this, so that might unfortunately be wrong about just how settled JSTOR considers things on their side. Their statement feels extremely carefully worded: [http://about.jstor.org/news-events/news/jstor-statement- misu...](http://about.jstor.org/news-events/news/jstor-statement-misuse- incident-and-criminal-case)

<comment><USER15> MIT (and the alleged disruption to other MIT JSTOR users' access) may also be relevant to the decision to charge.

My understanding is that MIT has a freewheeling attitude to information, but also deep organizational and funding links to national security institutions. So their hacker ethos might tell them to brush it off, while their federal relationships require them to take a tougher stance.

<comment><USER2> In terms of broader implications, I would actually have many fewer problems with MIT pressing straightforward trespassing charges. If he broke into a server room and messed with equipment there without the owner's permission, they could prosecute that under very ordinary state criminal law long predating the computer age.

It's the weird "stealing documents from JSTOR" federal case under the Computer Fraud and Abuse Act that's more worrying, because it's extremely vague what those kinds of charges can cover (in some interpretations, essentially any violation of a ToS).

</comment></comment></comment></comment><comment><USER16> This is almost too good:

"As Swartz entered the wiring closet, he held his bicycle helmet like a mask to shield his face, looking through ventilation holes in the helmet."

<comment><USER17> I was waiting for a part where he cut eyeholes into a newspaper.

</comment></comment><comment><USER18> This reminded me of Jacques Mattheij's list of ideas for startups (see [http://jacquesmattheij.com/My+list+of+ideas+for+when+you+are...](http://jacquesmattheij.com/My+list+of+ideas+for+when+you+are+looking+for+inspiration)):

"(45) OpenPapers

A place where all academic research that has been funded in part by public funds is published, journals be damned. Hopefully with deep pockets to fight off the lawsuits."

<comment><USER19> For NIH-funded studies, PubMed Central is actually doing a pretty good job. It would be great if PMC actually had a mandate to collect papers for all US federal grant-funded research, though.

</comment></comment><comment><USER11> This all hinges on _what_ he was going to do with the documents. If he was looking to perform some large-scale analysis (such as he has done before) and publish the results academically, then this would fall under the academic mission of MIT, and therefore be legit. But if this were the case, why go through the hassle of hacking the system? Why not just ask JSTOR for cooperation? Or maybe he did, and they rejected it?

There has got to me more to this story, because I just can't for the life of me believe that he would download the documents to "free" them on internet (as is alleged).

<comment><USER20> A detail you missed is that Swartz was not a student or faculty member at MIT. He was a fellow at Harvard.

</comment></comment><comment><USER21> I wonder what they'll push for. He sounds pretty screwed if this evidence pans out. Looks like he could even end up with a few years' time if the prosecutors want.

1\. Wire fraud maxes out at 20 years outside of a presidentially-declared emergency. No fine cap, it seems. <http://uscode.house.gov/download/pls/18C63.txt>

2\. Computer fraud under 1030(a)(4) caps out at 5 years with no prior offense, no fine cap. <http://uscode.house.gov/download/pls/18C47.txt>

3\. 1030(a)(2), (c)(2)(B)(iii) looks to be another cap of 5 years. Ibid.

4\. 1030(a)(5)(B), (c)(4)(A)(i)(I),(VI) looks like another cap of 5 years. Ibid.

IANAL, just trying my best to read the code itself.

</comment><comment><USER22> Ignoring legality, Aaron's actions, case specifics, etc., I have to admit: I really wish that the data in question was free and publicly available.

<comment><USER23> Anybody with a library card to a major public library can get this stuff for free over the web.

<comment><USER22> There's an enormous difference between controlled access to individual globules of data, and free access to the entirety of a dataset.

</comment></comment></comment><comment><USER24> When someone risks 35 years in jail for something like this, you know your justice system is broken.

I know he won't get 35 years, but it's nevertheless outrageous that it could happen.

<comment><USER25> Do you think he'd get life in Italy?

</comment></comment><comment><USER14> The title is inaccurate.

It is alleged that he signed up for guest accounts on their network with different laptops, changed his MAC address and re-registered if the IP he was using was blocked (by JSTOR) or cut off of the network (by MIT), and finally connected a laptop in a basement networking closet.

I guess you could say that is 'hacking' in the unauthorized access sense, but not in any meaningful sense. It isn't breaking and entering if someone repeatedly trespasses somewhere (say, banned from a store) even if they change their clothes to avoid detection.

<comment><USER26> IANAL, but legally speaking unauthorized access is a crime regardless of how easy it was to gain access.

<comment><USER27> This is a very frightening belief.

How long until posting a negative comment to a blog is "unautorized access" to that blog? Gaining access was easy: all you had to do was type a comment and hit submit. But some Powers That Be decided they didn't really want you to post that, so now it's a federal computer crime.

Land of the free.

<comment><USER28> Speaking of "TV drama levels of understanding of criminal justice"... :)

With only a few exceptions, persons accused of crimes are not presumed to have _mens rea_. Statutory rape, for instance, has "strict liability"; even if you don't know you're committing a crime, you're liable. Most criminal offenses are not like this. The state is required to establish _mens rea_.

A prosecutor could say that a ToS-infringing blog comment is a criminal violation, but unless that prosecutor can establish that the comment was made in purposeful, knowing, or reckless violation of the ToS, they'd be wasting their time.

<comment><USER29> So where's the _mens rea_ in this case?

<comment><USER28> Aaron's? I respectfully decline to lay out a case against Aaron on HN.

</comment></comment></comment></comment></comment></comment><comment><USER30> The indictment asserts that Mr. Swartz intended to distribute the files downloaded but did not substantiate this claim. I wonder what proof they have of this? (There are, of course, a great many laws dealing with probable intent that need only convince a jury of said intent without demonstrating it's validity.)

<comment><USER31> That is what he normally does. <http://www.nytimes.com/2009/02/13/us/13records.html>

<comment><USER25> That was what he did in that case, but it wasn't what he did with the four hundred thousand law review articles he analyzed for conflicts of interest more recently.

</comment></comment></comment><comment><USER32> The Boston Globe's got an article written on this that they're updating: [http://www.boston.com/Boston/metrodesk/2011/07/cambridge- man...](http://www.boston.com/Boston/metrodesk/2011/07/cambridge-man-accused- hacking-mit-computers-steal-scientific- papers/6SVnqu3Yfo7OIrLQOYSz5M/index.html)

</comment><comment><USER33> Posted in another thread: <http://news.ycombinator.com/item?id=2782752>

This is not the first time he has done something like this if memory serves me. In late 2008 Mr. Swartz and Carl Malamud went to select libraries, ones with free PACER access, and proceeded to download ~700 GB of information that was behind a paywall. After which they made all of it available on Mr. Malamud's website.

[http://arstechnica.com/tech-policy/news/2009/04/case- against...](http://arstechnica.com/tech-policy/news/2009/04/case-against- pacer.ars)

</comment><comment><USER34> Demand Progress PAC's website is down, but they released a statement:

_(from:[http://webcache.googleusercontent.com/search?q=cache:9k5ryiX...](http://webcache.googleusercontent.com/search?q=cache:9k5ryiXKKwsJ:blog.demandprogress.org/+blog.demandprogress.org&cd=1&hl=en&ct=clnk&gl=us&source=www.google.com) )_

Cambridge, MA– Moments ago, Aaron Swartz, former executive director and founder of Demand Progress, was indicted by the US government. As best as we can tell, he is being charged with allegedly downloading too many scholarly journal articles from the Web. The government contends that downloading said articles is actually felony computer hacking and should be punished with time in prison.

"This makes no sense," said Demand Progress Executive Director David Segal; "it's like trying to put someone in jail for allegedly checking too many books out of the library."

"It's even more strange because the alleged victim has settled any claims against Aaron, explained they've suffered no loss or damage, and asked the government not to prosecute," Segal added.

James Jacobs, the Government Documents Librarian at Stanford University, also denounced the arrest: "Aaron's prosecution undermines academic inquiry and democratic principles," Jacobs said. "It's incredible that the government would try to lock someone up for allegedly looking up articles at a library."

Demand Progress is collecting statements of support for Aaron on its website at …URL…

"Aaron's career has focused on serving the public interest by promoting ethics, open government, and democratic politics," Segal said. "We hope to soon see him cleared of these bizarre charges."

Demand Progress is a 500,000-member online activism group that advocates for civil liberties, civil rights, and other progressive causes.

About Aaron

Aaron Swartz is a former executive director and founder of Demand Progress, a nonprofit political action group with more than 500,000 members.

He is the author of numerous articles on a variety of topics, especially the corrupting influence of big money on institutions including nonprofits, the media, politics, and public opinion. In conjunction with Shireen Barday, he downloaded and analyzed 441,170 law review articles to determine the source of their funding; the results were published in the Stanford Law Review. From 2010-11, he researched these topics as a Fellow at the Harvard Ethics Center Lab on Institutional Corruption.

He has also assisted many other researchers in collecting and analyzing large data sets with theinfo.org. His landmark analysis of Wikipedia, Who Writes Wikipedia?, has been widely cited. He helped develop standards and tutorials for Linked Open Data while serving on the W3C's RDF Core Working Group and helped popularize them as Metadata Advisor to the nonprofit Creative Commons and coauthor of the RSS 1.0 specification.

In 2008, he created the nonprofit site watchdog.net, making it easier for people to find and access government data. He also served on the board of Change Congress, a good government nonprofit.

In 2007, he led the development of the nonprofit Open Library, an ambitious project to collect information about every book ever published. He also cofounded the online news site Reddit, where he released as free software the web framework he developed, web.py.

Press inquiries can be directed to firstname.lastname@example.com or 571- 336- 2637

<comment><USER35> _"This makes no sense," said Demand Progress Executive Director David Segal; "it's like trying to put someone in jail for allegedly checking too many books out of the library."_

No it's not. It's like sneaking into the library at night and making photocopies of all the books. Then, upon getting caught, the perpetrator sneaks back into the library in a different disguise and continues to photocopy more books. Repeat this action of getting caught and sneaking back in a few more times and combine this with the fact that his downloading of documents affected JSTOR performance for other legitimate users of the archive and you get a sense of what he's really done.

How is this excusable?

I'm completely onboard with those who claim that we need some reform in scientific publishing, but Aaron's actions smack of low ethical standards to me, not to mention extremely poor judgement on his part.

EDIT: Hi downvoter! Can you please explain why you think I'm wrong?

<comment><USER36> Not a downvoter, but the way governments are reacting to those demanding transparency is what I call draconian. This is no longer symmetric opposition, this is a way of terrorizing those who want a little more freedom. Faced with obstacles as the one Aaron faced, I would do the same. So sue me.

Disobedience is not the same as terrorism although they would like you to think so. Disproportionate punishments are what I term a terrorist act. Stop being such a conformist and stop using their language. Every time you test these boundaries and fight for it you will be fighting for your freedoms.

<comment><USER35> Fair enough. I agree with most of what you're saying here. I definitely believe that any punishment involving more than a fine and/or some community service would be disproportionate to the crime here.

What I didn't like was the statement portraying him as some kind of hero. I'm just pointing out that he's not. He didn't have a legal right to be using the documents, he shouldn't have been trying to download the documents using a guest account at MIT obtained by submitting false information, and he certainly shouldn't have tried to get back into the network after being banned multiple times.

If his goal was to put a lot of scientific papers into the public domain, I can think of many other ways he could have achieved this. So I'm also a bit puzzled by his approach here.

 _Stop being such a conformist and stop using their language._

This attack seems rather uncalled for.

 _Every time you test these boundaries and fight for it you will be fighting for your freedoms._

I can see where you're coming from on this, but I'm not entirely convinced that you're right.

</comment></comment></comment></comment><comment><USER37> How did Aaron get access to the for-pay articles (page 9)?

Also: nice going, Aaron! Drag research access into the 21st century, kicking and screaming!

Does anyone think it's odd that an Acer laptop could write these files to disk faster than JSTOR could serve them?

<comment><USER26> "Does anyone think it's odd that an Acer laptop could write these files to disk faster than JSTOR could serve them?"

Nope. I bet the JSTOR servers are serving many concurrent requests. If he had the servers to himself then yes, that would be surprising.

<comment><USER37> FTA: _This is more than one hundred times the number of downloads during the same period by all the legitimate MIT JSTOR users combined_

It sounds like he was using the majority of their resources. But maybe those servers serve lots of places, and they only mentioned MIT as an example.

<comment><USER38> They do. Universities across Canada also subscribe to this.

<comment><USER37> Yeah, my college also had it. But the article made it sound like only MIT was using these servers.

</comment></comment></comment></comment></comment><comment><USER39> "Aaron Swartz ... was a fellow at Harvard University's Center for Ethics"

<comment><USER40> It is not impossible to imagine a code of morality which views his alleged actions as ethical.

<comment><USER39> Definitely true -- I thought it was a relevant bit of information so I quoted it.

<comment><USER40> That's fair, I was just refuting what your comment implied, that it was an unethical action.

(I understand that you may not have intended to imply it. Just wanted to put that out there.)

So since we don't disagree on that: Do you think what he did _is_ ethical?

edit: also, boston.com says he "is a fellow at Harvard's University's Center for Ethics". A quick google says that he was at least as of October 2010:

[http://www.google.com/search?hl=en&q=swartz+ethics+fello...](http://www.google.com/search?hl=en&q=swartz+ethics+fellow+site%3Aharvard.edu&oq=swartz+ethics+fellow+site%3Aharvard.edu&aq=f&aqi=&aql=1&gs_sm=e&gs_upl=9112l11062l0l11132l16l12l2l0l0l6l170l1142l4.6l10)

</comment></comment></comment></comment><comment><USER41> It's hard to trivialize downloading 4 million articles using a web scraper's bag of tricks and then some. If the information was publicly accessible these charges wouldn't stand unless he tried to distribute it. If it was something so commendable, why would you cloak your activities or go to a different university to do your dirt instead of Harvard (where your a fellow of some sort) or Stanford (where you attended). Regardless of the motives and ideals or the excess of the charges, this isn't one of those hapless grandma versus the RIAA stories. He must have known what he was doing.

The pricing and restrictions on the dissemination of academic papers is by any rational evaluation nothing short of ridiculous and contradicts the academic ideal of free exchange of ideas for the advancement of knowledge. However, history of scholarship is also a history of patronage, academic politics and in-fighting for greater prestige.

It's sad that someone like Aaron has to be treated like a domestic terrorist. It's sad that we have a vindictive justice system willing to flaunt the Constitution in this day and age with what effectively amounts to cruel and unusual punishment so they can "make an example" out of someone.

However, it's no one's fault that Aaron was so emboldened to take this initiative without sufficiently ensuring that he would be free from criminal prosecution.

Am I alone in thinking that these "hacktivists" will only prompt government to push more frivolous data theft laws and heavier punishment for offenses that may one day victimize hapless, innocent people? It's going to get a lot worse before it gets better.

<comment><USER42> > However, it's no one's fault that Aaron was so emboldened to take this > initiative without sufficiently ensuring that he would be free from criminal > prosecution.

Maybe he did it knowing full well what the consequences might be. He seems to be a pretty principled guy.

</comment></comment><comment><USER43> Consider showing your support for Aaron here:

<http://act.demandprogress.org/sign/support_aaron/>

Demand Progress is an organization Aaron co-founded. They've done some great watchdog work on things like PROTECT IP, the Patriot Act, the Internet Blacklist Bill etc.

</comment><comment><USER44> There is a riser closet in my office with various internet service providers wiring in it feeding the entire building.

If I were to enter this riser closet and plug into my laptop into one of these lines, I would be charged with theft of service and deservedly be sent to jail. It doesn't matter if the door is locked or not. It doesn't matter what kind of security they put in place or not. It doesn't matter if I only sent a few bytes of data on their network and didn't harm anyone elses' service. It is still theft of service.

</comment><comment><USER45> Why the hell is MIT stashing information in closed systems in first place? I thought the idea (OCW etc.) was to enable more people to learn, participate and benefit from work of academics and researchers. Hell I even donate a few hundred bucks every now and then to OCW.

It is mind boggling how the supposedly smart people are not getting their heads out of their asses so late in a world frighteningly short on distribution of knowledge that can be effectively used to solve the wicked problems that are crippling it for so long.

We really need a global, openly accessible knowledge network and a platform where all eligible can contribute and collaborate to research at least when it comes to areas that impact human society at large - medicines, natural resources etc. It is hard otherwise to see how things like Cancer and Energy shortage can be tackled.

<comment><USER46> The papers are from JSTOR, not MIT. MIT pays for a subscription to JSTOR like many other universities do.

<comment><USER45> But is it clear that MIT does not also store its research papers in JSTOR instead of making them publicly available? Reading the article I did not get that impression.

<comment><USER39> While many researchers at MIT publish in journals that sometimes have restrictions on the distribution of their papers (exclusivity, etc.), most MIT publications are issued via:

1) DSpace <http://dspace.mit.edu> (an open publishing platform for academic material. Most all theses produced by MIT researchers can be accessed by the public here)

2) as an MIT technical report (mostly published via dspace)

3) as an MIT "Working Paper"

You can find more information here: <http://libraries.mit.edu/docs/research- publications.html>

Certainly, a huge number of MIT publications do end up being mirrored in JSTOR, but they are usually published via whatever journal or conference proceeding they are accepted to first. If an author cannot find a journal that is willing to publish their paper, then they will probably issue it as an MIT technical report.

<comment><USER45> Ok, that's actually useful information. I find MIT's approach fairly reasonable - may be all others should follow suit and JSTOR-like walls would not be necessary some day.

</comment></comment></comment></comment></comment><comment><USER47> can someone please explain what the deal is here for us uninitiated? sounds like they are throwing the book at him for stealing books? seriously? why is the prosecution being so aggressive? did he profit from it or something? this sounds so petty

<comment><USER48> He violated Terms of Service for a large database of journals at an egregious rate. If he had stolen say...10,000 articles this may be a non-issue. The fact that they can tie 4,000,000 articles to him is what makes this so bad.

The other part that is extremely bad is his measure to continually evade MIT MAC banning through spoofing. That measure of evasion proves, to some extent, his intent to steal and is a form of computer fraud.

<comment><USER49> I wouldn't be too surprised if him causing a month (months?) long interruption of JSTOR for an entire campus deeply involved in government contracts was also part of the ire.

</comment></comment></comment><comment><USER31> He posted on his blog yesterday that there would be a "major announcement" on blog.demandprogress.org today, but nothing has been posted.

<http://www.aaronsw.com/weblog/updates>

<comment><USER50> published [http://blog.demandprogress.org/2011/07/federal-government- in...](http://blog.demandprogress.org/2011/07/federal-government-indicts- former-demand-progress-executive-director-for-downloading-too-many-journal- articles/)

</comment></comment><comment><USER51> _33\. Swartz intended to distribute a significant portion of JSTOR's archive of digitized journal articles through one or more file-sharing sites._

How do they know this? Has he said something to that effect?

\--edited for formatting.

<comment><USER52> Well, I'm going to guess that the prosecution is putting that in there just in case they can get the jury to agree. They can claim anything they want, the jury has to decide if it's true without a doubt.

</comment></comment><comment><USER38> Context: JSTOR blocks you automatically if you download articles in quick succession.

</comment><comment><USER53> Wait a minute. All he needed was a _guest account_ to access JSTOR? That's like saying, ANYONE IS ALLOWED TO DOWNLOAD FROM JSTOR. This isn't just bad security, this is no security.

<comment><USER54> Most academic journal repositories grant institutional access based on IP address blocks. Some institutions keep this narrow and force you to use an HTTP proxy, which gives them the ability to put additional institutional-level authentication in place. The upside is that you can access the journals from off-network, the downside is using the proxy can be a major pain. Other networks, e.g. MIT, are permissive with the IP restriction and don't mandate the use of one centralized proxy as long as you are on-network. I suppose that may change after this case.

</comment></comment><comment><USER55> Ballsy, considering his previous brush with the FBI over similar things: <http://www.aaronsw.com/weblog/fbifile>

</comment><comment><USER56> From the JSTOR website (<http://about.jstor.org/participate-jstor/worldwide- access>)

"Our ultimate long-term objective is to make JSTOR available to everyone who wants access to it, while doing so in a way that ensures sustainability of the service."

Cynically, it seems like the bit about "ensures sustainability" can be translated as "we will aggressively prosecute in order to protect our bloated salaries."

<comment><USER57> The salaries of Ithaka Harbors Inc. (JSTOR's holding company), a supposedly not-for-profit organisation are indeed bloated. See pp. 7-8, 23, 26 of [http://www.guidestar.org/FinDocuments/2009/133/857/2009-1338...](http://www.guidestar.org/FinDocuments/2009/133/857/2009-133857105-06a32823-9.pdf)

<comment><USER58> For those that don't like reading, the document describes multiple employees of the "nonprofit" with compensation in excess of 200k.

</comment></comment></comment><comment><USER59> I'm probably Advocating Crime but, couldn't a bunch of people coordinate and do what he was doing, over a year or two, distributed, from several universities? You totally could. The more, the less noticeable, and punishable.

edit: it wouldn't surprise me if something like that showed up; the problem has been highlighted, the legal issues made clearer, and JSTOR bloodied. Go Aaron.

<comment><USER2> There's a loosely-organized project at Wikimedia Commons to liberate at least the public-domain works locked up in JSTOR. This almost certainly violates JSTOR access policies, but once downloaded and stripped of their JSTOR title page, it's probably not illegal for the Wikimedia Foundation to host the result, since the result is in the public domain, even if ToS were violated in the document's acquisition.

See: [http://commons.wikimedia.org/wiki/Category:Scanned_English_t...](http://commons.wikimedia.org/wiki/Category:Scanned_English_texts)

</comment></comment><comment><USER60> So he allegedly goes out and buys a laptop just to do this heist...and then he blows his cover by doing a scrape fast enough to apparently bring down some of the MIT servers? Why was he in such a rush?

<comment><USER61> Most likely the servers crashed for whatever reason, and they looked at the logs and saw lots of recent accesses from a particular computer, and post hoc ergo propter hoc. Sysadmins often blame outlier users for crashes.

</comment></comment><comment><USER11> JSTOR's statement [http://about.jstor.org/news-events/news/jstor-statement- misu...](http://about.jstor.org/news-events/news/jstor-statement-misuse- incident-and-criminal-case)

JSTOR Statement: Misuse Incident and Criminal Case

The United States Department of Justice announced today the criminal indictment of an individual, Aaron Swartz, on charges related to computer fraud and abuse stemming from his misuse of the JSTOR database. We have been subpoenaed by the United States Attorney's Office in this case and are fully cooperating. While we cannot comment on this case, we would like to share background information about the incident and about our mission and work with the academic community and the public.

What Happened

Last fall and winter, JSTOR experienced a significant misuse of our database. A substantial portion of our publisher partners' content was downloaded in an unauthorized fashion using the network at the Massachusetts Institute of Technology, one of our participating institutions. The content taken was systematically downloaded using an approach designed to avoid detection by our monitoring systems.

The downloaded content included over 4 million articles, book reviews, and other content from our publisher partner's academic journals and other publications; it did not include any personally identifying information about JSTOR users.

We stopped this downloading activity, and the individual responsible, Mr. Swartz, was identified. We secured from Mr. Swartz the content that was taken, and received confirmation that the content was not and would not be used, copied, transferred, or distributed.

The criminal investigation and today's indictment of Mr. Swartz has been directed by the United States Attorney's Office.

Our Mission and Work

Our mission at JSTOR is supporting scholarly work and access to knowledge around the world. Faculty, teachers, and students at more than 7,000 institutions in 153 countries rely upon us for affordable and in some cases free access to content on JSTOR. Since our founding in 1995, we have digitized the complete back runs of nearly 1,400 academic journals from over 800 publishers. Our ultimate objective is to provide affordable access to scholarly content to anyone who needs it.

It is important to note that we support and encourage the legitimate use of large sets of content from JSTOR for research purposes. We regularly provide scholars with access to content for this purpose. Our Data for Research site (<http://dfr.jstor.org>) was established expressly to support text mining and other projects, and our Advanced Technologies Group is an eager collaborator with researchers in the academic community.

Even as we work to increase access, usage, and the impact of scholarship, we must also be responsible stewards of this content. We monitor usage to guard against unauthorized use of the material in JSTOR, which is how we became aware of this particular incident.

<comment><USER62> This sounds very hypocritical. If their "Mission and Work" is to support scholarly work and academic usage, and encourage usage of large sets of data, why are they suing Aaron's ass instead of working with him to further understand what were his needs that their system was lacking and how they could reduce that gap? Why else would Aaron hack their system if not for research?

Sounds like instead of spending money in improving their system and security, they found a more beneficial (to their eyes) approach: _charging_ Aaron will instead set the example.

 _Edit: see @mbreese's correction._

 _Edit 2: looks like my comment missed some important pieces of the puzzle. See further down the thread._

<comment><USER63> Here's what's supposed to happen: A student on campus wants to do a research project analyzing a large number of journal articles, or even just the metadata around a large number of journal articles. They approach their librarian, the librarian approaches the journal vendor (JSTOR or someone else), and everyone works together to find a way to get the student their data. Maybe the vendor hands over a special dataset. Maybe they give them back-end access to their database. Maybe they allow the student to run a Python script against their website, but only in the middle of the night so as not to slow down service for other users.

Here's what sometimes happens instead: The student writes and runs a clever script, the vendor notices that their servers have slowed due to automated script activity on their webpages, shuts down access from that IP address, and lets the school know. University IT staff and librarians drop what they're doing and try to track down the party responsible. Once they've been identified, the nice librarian has to have a talk with the student about what's permitted under the university's license agreement with the publisher, and together they go to the data vendor to ask forgiveness and permission. They usually get it.

Here's what Aaron did: He walked onto the MIT campus, set up a script not to analyze metadata but to actually download large numbers of documents, and when his IP was blocked, he used traditional hacking as well as Johnny Long-style "no-tech hacking" to get around it. <http://video.google.com/videoplay?docid=-2160824376898701015>

Publishers, rightly or wrongly, assume that someone systematically downloading entire journal runs is intending to set up a shadow database to give away their content for free. The feds seem to agree, in this case.

The thing that gets me is that JSTOR was more than reasonable in this case. They didn't immediately shut down the whole campus (like some overly- aggressive publishers do), but started with the IP addresses involved. When it didn't stop, they had to cut off access completely. Aaron, who isn't even a student at MIT, managed to kick the whole campus off JSTOR for weeks, and as soon as they restored access, he went at it again. If I were a librarian at MIT, I'd want the book thrown at him.

<comment><USER64> It's outright sociopathic to suggest that justice for a few weeks inconvenience is 35 years in prison and a million dollar fine.

<comment><USER63> It's excessive, and I don't think that's what he'll serve. But he was warned multiple times that MIT and JSTOR didn't want him doing what he was doing, and he continued doing it, so as far as I can tell he's getting exactly what he asked for. He probably thinks he's the Rosa Parks of scholarly communication. I think he's reckless and grandiose.

</comment></comment></comment></comment></comment><comment><USER65> Is the DOJ trying to 'make an example' here? JSTOR and MIT aren't pursuing this, the Feds are.

</comment><comment><USER66> I don't understand why he was so desperate to access it via MIT. There are dozens of libraries in the Boston area with access to JSTOR with guest access to their network. If he wasn't in such a rush, he could have easily bounced around campuses and likely have avoided detection.

<comment><USER67> Perhaps to have enough legitimate traffic surrounding you to mask the fact that you're trying to download every single article.

</comment></comment><comment><USER68> I admire Aaron's persistence. Sadly it was quite rude of him to repeatedly crash JSTOR's servers. If only he'd throttled his script back a bit.

Liberating those documents from JSTOR would have been quite a gift to society.

<comment><USER25> If the indictment is accurate, he did throttle back his script a bit, and continued to run it for several months after the last JSTOR server crash or blockage.

</comment></comment><comment><USER69> Why would he do this? What is the purpose of having all those documents?

<comment><USER70> 33\. Swartz intended to distribute a significant portion of JSTOR's archive of digitized journal articles through one or more file-sharing sites.

<comment><USER57> Interestingly, while the Grand Jury Indictment does discuss evidence for many of the other accusations, they do not discuss any evidence for this intent-to- distribute claim.

</comment></comment></comment><comment><USER71> Is this what our tax money is going into. Aaronsw just presents a soft target for the Feds.

</comment><comment><USER72> If all academic papers were released under a Creative Commons license, would this even be an issue?

Aside from the allegations about breaking into various physical hardware infrastructure at MIT, wouldn't that be like being charged with downloading too many Jonathan Coulton albums?

</comment><comment><USER73> > _The indictment alleges that Swartz, at the time a fellow at Harvard > University, intended to distribute the documents on peer-to-peer networks. > That did not happen, however, and all the documents have been returned to > JSTOR._

All the documents have been returned?!

</comment><comment><USER74> This is beyond belief. If the prosecutor tries enough charges, some of them will stick, especially before a jury who may think this is a hacking case or a file sharing case. He'd do well to avoid the "hacktivist" label in court.

</comment><comment><USER75> There were some poor judgment on display and I generally don't condone breaking the law but it would be a shame to lose Aaron's epic productivity and ingenuity for any period of time.

</comment><comment><USER76> Alternate link, in case these are taken down: <http://pastebin.com/9vjfkigY>

<comment><USER57> I get a 403 from MIT.edu so here are 1000 downloads of the pdf <http://lts.cr/i/21cc51>

</comment></comment><comment><USER77> Aaron's Twitter page which has been active today.

<http://twitter.com/#!/aaronsw>

</comment><comment><USER78> As the saying goes, the end does not justify the means, more so if selection of means was driven by impatience.

</comment><comment><USER79> What's interesting in these threads is the obvious dichotomy of values.

You can't have it both ways. If people want to make money from research itself, then intellectual property must be enforced.

Many hackers seem to hold the belief that making money from research is wrong. Or at least anybody else but themselves.

</comment><comment><USER57> I don't understand why the US Attorney is suggesting he be charged with such ridiculously inflated charges.

Reviewing the Indictment report, "JSTOR did not permit users... to download all of the articles from any particular issue of a journal." Further, "JSTOR notified its users of these rules, and users accepted these rules when they chose to obtain and use JSTOR's content."

So basically JSTOR is claiming Aaron violated their terms of use. Their terms of use are likely an adhesion contract with a passive shrinkwrap notification. (remember ReasonableAgreement.org ?). It is not certain that Aaron did in fact agree to such terms, or what consequences doing so and then violating said terms should have. Regardless, JSTOR proclaiming certain terms may not be sufficient to deny Aaron of his rights as a consumer, citizen, and human.

The report goes on to claim that Aaron took action to "avoid MIT's and JSTOR's efforts to prevent this massive copying". MIT and JSTOR allowed users to access their network, with no system in place to ensure that a user was a student (by design, as MIT admits) or that they were using their real name (or a single MAC address). A researcher accessing JSTOR is really less of a concern than other potential types of access so perhaps this is not a good system. The report suggests Aaron took action to "elude detection and identification" but courts have held that anonymous speech and action are valid parts of society. They take issue with his using a Mailinator address but such an email address is just as valid as any other and simply allows others to read ones mail.

The report whines that the "rapid and massive downloads and download requests impaired computers used by JSTOR to service client research institutions". This inconveniencing of other users could have been avoided and the blame for how JSTOR allocates resources lies with the architects of JSTOR.

MIT acted to ban the IP ranges that they believe were in violation of their rules. Users were to use the network to support MIT's research, or at least not obstruct it. However, very likely Aaron was conducting research. Any hindrance to other users may have been the responsibility of MIT's infrastructure team.They further request users "maintain the system's security and conform to applicable laws, including copyright laws" seemingly suggesting Aaron was in violation of copyright. Very importantly, MIT should remember that when it comes to copyright "Reproduction for purposes such as criticism, comment, news reporting, teaching, scholarship, or research, is not an infringement of copyright." The last point of MIT rules is that users "conform with rules imposed by any networks to which users connected through MIT's system" which makes little practical sense and is certainly selectively enforced. Assuming a JSTOR web server is now a network, so is my personal web server. On all html files on my webserver I link to a ReasonableAgreement- style notification that no user may browse such files between 8am and 11pm EST. Any MIT student, faculty member, or guest who connects during those hours is in violation and should be kicked by MIT, for if a rule is to be fair it should be consistently enforced. This third rule is simply a CYA clause and is its selective enforcement is arrogant.

To conclude, the document does suggest that perhaps Aaron did violate the JSTOR terms of use for their website. When a normal business decides to deal with a violation of their terms of use they deactivate that customer's accounts. However, Ithaka Harbors Inc., a "non-profit" organisation (Presidents yearly compensation is over $400,000 – see their 2009 Form 990 at [http://www.guidestar.org/FinDocuments/2009/133/857/2009-1338...](http://www.guidestar.org/FinDocuments/2009/133/857/2009-133857105-06a32823-9.pdf) ) funded by the Mellon Foundation and the Gates Foundation and committed to "the core values of higher education" and to a "deep understanding of technology" (ha), decided to alert the feds. As to MIT's claims that Aaron broke their rules for using their internet connection, it seems he neither obstructed MIT's research nor violate laws or copyright laws. As to their third claim, he may have violated the terms of a "network" but so do a significant portion of MIT's users everyday.

Why is the Obama administration pursuing an investigation in Wire Fraud and Computer Fraud?

<comment><USER20> Frankly, I think most of the claims in your post are bonkers, but this one sticks out:

 _This inconveniencing of other users could have been avoided and the blame for how JSTOR allocates resources lies with the architects of JSTOR._

"During November and December, 2010, Swartz used the "ghost laptop" (i.e., the Acer laptop) at MIT to make over two million downloads from JSTOR. This is more than one hundred times the number of downloads during the same period by all the legitimate MIT JSTOR users combined."

So we're entirely clear on this: you are saying this is reasonable and that the majority of the blame for any disruption lies with JSTOR. You are saying that JSTOR should have anticipated that a single legitimate user would have placed a hundred times the demand on the system than the entire population of a major university.

<comment><USER57> Basing whether or not Aaron's actions were "wire fraud" based on quantity doesn't really make sense. Saying he downloaded more than other users at MIT is really just saying other people requested less files than he did. I remember when I needed academic papers, I stopped using my institution's access to JSTOR because frequently the same paper could be found (legally) using Google Scholar or similar. As academia switches to things like arXiv, JSTOR will be used less and less. I understand that 2 million is orders- greater than an average individual might request, but basing the legality on quantity is flawed. If one file is accessed illegally, you have broken the law. If 2 million are, you have also broken the law.

As to being entirely clear, yes, I would have expected the employees at JSTOR (like the VP of technology making $300k) to have thought of possible ways to rate limit a connection. Just as you can prevent DDOS with something like iptables hashlimit, JSTOR could have done something better than simply refusing all MIT traffic. [http://serverfault.com/questions/211135/how-to- prevent-a-loi...](http://serverfault.com/questions/211135/how-to-prevent-a- loic-ddos-attack)

As an analogy, if I host 1 million images of cats on my webserver, and I keep everything open and allow indexes in the Apache configuration, expecting the average person to only download 10 pictures and then you use 'a little WGET magic' to download 1 million jpgs, it seems odd for me to complain when my server crashes and my friend Erica can't download 1 single cat image that she had been wanting to. Yes, your downloads caused the tie up but how angry can I be? Your browser sent a request to my server _and my server fulfilled the request_.

Like David Segal says, the United States government wants to punish someone for an action akin to allegedly checking out too many books from the library. Over the objections of both MIT and JSTOR, presumably. And you're saying _I'm_ bonkers.

<comment><USER20> This is what I mean by bonkers: nobody is "basing the legality on quantity". You made that up. I didn't say that. The indictment didn't say that. The law doesn't say that.

As it seems your concern for fact starts and ends with the considerably less relevant quantity of JSTOR employee compensation, I see no reason go on.

<comment><USER57> One of the summary findings of the indictment does seem to suggest that quantity was a factor: "[The] defendant, AARON SWARTZ, knowingly and with intent to defraud, accessed a protected computer... _in excess_ of authorized access, and by means of such conduct furthered the intended fraud".

JSTOR's salary rate is really the least of my concerns (though wasteful bureaucracy in the non-profit industry does concern me in general and tangentially relates to this story). My concern is over the US federal government pursuing felony charges when a researcher violated a website's terms of service statement. I'm sorry you received any other impression.

</comment></comment></comment></comment></comment><comment><USER80> There must be a reason why the US government wants to harass/bully/imprison Aaron.

</comment><comment><USER81> text version

[http://google.com/search?q=cache%3Ahttp%3A%2F%2Fweb.mit.edu%...](http://google.com/search?q=cache%3Ahttp%3A%2F%2Fweb.mit.edu%2Fbitbucket%2FSwartz%2C%2520Aaron%2520Indictment.pdf)

</comment><comment><USER82> Why do the charges all end with "and aided and abetted the same"?

</comment><comment><USER83> This was a good reminder of the importance of physical security.

</comment><comment><USER84> One hopes he is smart enough to have a solid legal argument for what he has done. If he loses the legal battle then it's going to set a bad precedent for all these academic document stores to continue keeping hold of this information. On the other hand, if he were to win then it may make it harder for groups like JSTOR to continue restricting access to their data.

<comment><USER85> A solid legal argument for switching your MAC address, hiding a laptop in a closet, and deliberately concealing your face to try to avoid recognition? He isn't going to win that defense.

<comment><USER25> Hypothetically: wiring closets are normal places for computers engaged in always-on network services. Putting a box over a laptop can keep it from getting stolen. Your bike helmet can end up in front of your face for a while while you're taking it off or putting it on. Switching your MAC address is reasonable if there's a MAC address conflict, or if you've gone and apologized to the network infrastructure guys for causing problems and they accepted your apology but didn't have the password for the DHCP server handy.

Try to remember you're seeing the picture painted entirely by the prosecution, without even the evidence that the grand jury saw to support it.

<comment><USER85> "...or if you've gone and apologized to the network infrastructure guys for causing problems..."

Read the indictment. He started on Sep 25th. He was blocked by IP on Sep 25. He switched his IP on Sep 26. The entire netblock was then blocked by admins. To try to turn the service back on for normal users, admins tried to block his MAC address on Sep 27, which worked until he changed it on Oct 2, and then added a second machine on Oct 8.

Your "hypothetical" defense doesn't even come close to flying. This isn't a little misunderstanding; this is network admins blocking access, and being circumvented, multiple times.

<comment><USER25> Thanks, but I know what the indictment alleges. But the facts of the indictment may be false, and there may be many other highly relevant facts that are omitted.

</comment></comment></comment></comment></comment><comment><USER86> > Aaron Swartz lived in the District of Massachusetts and was a fellow at > Harvard University's Center for Ethics.

Oh, the irony.

</comment><comment><USER87> Did he ever manage to republish the articles? Doesn't look like it.

</comment><comment><USER57> What is a Grand Jury? - <http://grandjuryresistance.org/grandjuries.html>

</comment><comment><USER88> Fantastic news! He deserves to rot in jail for wasting so much precious bandwidth.

<comment><USER89> Compared to the millions of people who viewed "Friday"?

</comment></comment><comment><USER90> The man is a heroic martyr, who risked everything to set knowledge free. (Knowledge most of which was produced at the public's expense!)

He may very well die in prison.

Or perhaps he will be forced to publicly recant and merely be forbidden from using computers. I hope that in the latter case he will have the good sense to emigrate.

One day, his tormentors will be harshly punished. Unless, of course, "the future is a boot stamping on a human face — forever."

 _"Keeping medicines from the bloodstreams of the sick; food from the bellies of the hungry; books from the hands of the uneducated; technology from the underdeveloped; and putting advocates of freedom in prisons. Intellectual property is to the 21st century what the slave trade was to the 16th."_

(<http://en.wikipedia.org/wiki/User:Lulu_of_the_Lotus-Eaters>)

<comment><USER28> HE MAY VERY WELL DIE IN PRISON.

Can we be done with this thread? I know for a fact that I am not the only one who has flagged it. No good can come of this. In a likely worst case given who we're talking about, Aaron will be prodded into _commenting publicly_ on a criminal case.

FLAGGED.

<comment><USER91> Which of the HN guidelines does this violate?

<comment><USER28> None of them. I think you'd be doing Aaron a favor to kill it, though.

<comment><USER90> Yeah, let him become _desaparecido_ in obscurity.

 _Nacht und Nebel._

What a "favor."

Do you really think that he will be invited to post incriminating comments here from his jail cell?

<comment><USER28> Is he in jail? For this? I'd be shocked. I think even Mark Abene made bail, and he reprogrammed telco switches.

<comment><USER90> If he isn't, he will be soon.

I will be surprised if he is allowed into an airport.

<comment><USER28> Oh, you're trolling. OK.

<comment><USER90> I have stated my honest opinion.

You are, however, free to believe that I was trolling. I can't stop you.

I invite the moderators to delete my account, if they believe that I am a troll. As things are, I merely refuse to go along with the herd-think on this site.

<comment><USER27> You seem to have a lot of comments for someone who doesn't even have a TV Drama-level understanding of the criminal justice system. You know that even people accused of murder are often free during their trials, right?

<comment><USER92> For some of us, memory of how Mitnick was treated (or for a more modern example, Manning), still taints how we expect accused "hackers" to be treated by the criminal justice system.

Physical detainment of someone accused of such crimes is _hardly_ unheard of.

<comment><USER28> Mitnick's story is absolutely nothing like Aaron's. Mitnick was a fugitive _after already having done prison time_ and had to be tracked down via cell phone triangulation.

<comment><USER92> Read my comment again, I'm not asserting anything more than a passing similarity.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: Facebook stock derivatives - <AUTHOR>

I just read that there is currently a pool of 'private derivatives' being traded for Facebook stock.
If Second Market has created a thriving marketplace (albeit amongst accredited investors) for non-public stock trading, is there a ripe market opportunity for a derivative-spinning marketplace?
How easy is it REALLY to create a tradable derivative?  Is the paper only as good as someone views it - a la 'federal reserve notes'? <comment><AUTHOR> How about FINRA/SEC regs? Quants in the room chime in?</comment>


An Affordable Salvation - <AUTHOR> http://www.nytimes.com/2009/05/01/opinion/01krugman.html?_r=2 <comment><USER2> You can't do any of that without tariffs on imports from countries which don't do it. So you get to choose, depression or bankruptcy (and then depression).

<comment><USER3> Good point. It's always either protect the environment and lose jobs or get into a trade war and lose jobs, or don't protect the environment.

But what if we treat pollution the way we approach transportation and other infrastructure?

Here's what I mean, we don't make FedEx pay for all the roads and bridges it uses. The public pays for it, we all use it, everybody's better off.

So why doesn't the public pay for CO2 scrubbers and capture, and waste water treatment and etc?

Obviously there's great danger of back door subsidies and corruption and that might lead to trade wars. Doing it right wouldn't be easy, but surely it's better then the choice of jobs vs. clean air?

<comment><USER4> Great idea. It's not so much treating pollution the way we approach transportation/infrastructure as it is changing the way we approach transportation/infrastructure. While the technology would have made it impractical to implement, why wouldn't we but electronic tolling on all roads on a pay per use basis? We could even privatize most of them. The whole reason we have urban sprawl is because highways have been underpriced. One great example is Hong Kong's MTR system that charges you based on where you started in the system and where you got off. Incredibly convenient and efficient. Heck, even China tolls practically all its highways.

That said I'm not sure this type of stuff will help us get out of a recession but at least it makes people pay for the services that they use. We may even get better roads and highways out of it if the owners of the roads (be they governments or otherwise) are incentivized by the revenues from them because they'd be better tracked.

<comment><USER3> I believe France relies heavily on private bridges, like here: <http://en.wikipedia.org/wiki/Millau_bridge></comment></comment></comment></comment>


Stateful Apps on Kubernetes: A quick primer - <AUTHOR> https://www.cockroachlabs.com/blog/kubernetes-state-of-stateful-apps/ <comment><USER3> I would recommend against running stateful apps in kubernetes. It's not really ready for it. Big problems include routing (it works fine for http requests, but not for DBs, message brokers, etc) and just the pain of setting up stateful sets.

If you don't believe me, take it from someone who should know what they're talking about: [https://twitter.com/kelseyhightower/status/96341350830081229...](https://twitter.com/kelseyhightower/status/963413508300812295)

<comment><USER4> We run stateful apps on Kubernetes. There are obvious rough areas (the lack of persistent volume resizing, for example, which is scheduled for 1.11), but overall, it's great.

What a lot of naysayers leave out, or choose to ignore, is that the challenges running stateful apps on Kubernetes mirror those of running stateful apps anywhere. If you run Postgres on a VM, for example, you're completely reliant on that VM staying up -- this is no different from Kubernetes. Some will also point out the dangers of co-locating lots of software (such as Postgres) on the same machine as many other containers, as they will compete for CPU and I/O; but this is also no different than on Kubernetes, which provides plenty of tools (affinities/anti-affinities, node selectors) to isolate containers to machines. And so on. Containers bring some new challenges, but Kubernetes meets them quite well.

What specific issues do you have? I'm not sure I understand the point about routing. I also don't understand what the "pain" of stateful sets refers to.

<comment><USER5> The the original commenter but I'll jump in:

1\. While "we already rely on VM staying up", with k8s we reply on both VM staying up and kubernetes infra on top of that VM staying UP 2\. Maintaining a complex stateful system on k8s _requires_ having and maintaining an operator for that system. 3\. You reduce your options when it comes to tweaking systems, e.g. local SSDs on GCP are available in SCSI and NVMe flavors, while GKE supports only SCSI; harder to perform fine-tuning and other tasks on the underlying VMs that would have been trivial with Chef or similar. 4\. Enterprise systems like Splunk explicitly mention that their support does not cover Splunk clusters running on kubernetes. 5\. As mentioned, you can't even resize a disk without going through dance of operations that would take days or weeks when you're working something like Kafka at scale. 6\. Some stateful services like Zookeeper require stable identities and this is far from perfect on kubernetes. 7\. More complex traffic routing that involves additional fees because to achieve (6) you sometimes need to expose things publicly.

That's just from the top of my head.

Disclaimer: We run 10+ stateful services on Kubernetes.

</comment></comment></comment><comment><USER6> > Because Kubernetes itself runs on the machines that are running your > databases, it will consume some resources and will slightly impact > performance. In our testing, we found an approximately 5% dip in throughput > on a simple key-value workload.

5% seems like a surprisingly large overhead. What is k8s doing in this situation that would have that kind of impact?

<comment><USER7> CPU Cache contention, network overhead introduced by Kubernetes service proxy model, even the liveness checks.

We haven't yet evolved Kubernetes services to prefer specific cores and avoid app workloads quite yet (although cpu management is getting closer).

Docker is also somewhat hefty memory wise and you may contend on disk if not careful.

5% seems pretty reasonable to me in general, just as a consequence of having something heavier weight on the same node managing workloads.

<comment> a-robinson Yeah, it appeared to just be general resource contention from having to share the machine -- CPU interrupts, less memory available, etc.

I'll note, though, that the 5% number is when using host networking for both Cockroach and the client load generator. Using GKE's default cluster networking through the Docker bridge is closer to 15% worse than running directly on equivalent non-Kubernetes VMs.

</comment></comment></comment><comment><USER8> I'd like to know how to solve the storage dilution problem with stateful apps in k8s where you have to buy 3-18x more raw capacity than desired to meet availability & durability guarantees.

For example if you ran CDB on a baremetal cluster of 3 nodes with 30TB of raw capacity, 15TB is lost to RAID10, 10TB is lost to running a replicated database such as cockroach DB, leaving you with 5TB effective capacity which is a 1/6 dilution of your initial capacity.

If you ran cockroach DB on a replicated network volume, with a replication factor of three, it gets worse. If you bought 30 TB of disks, you'd lose 20 TB to volume replication, ~6.67TB to CDB replication leaving you with 3.3TB of effective capacity or a 1/9 dilution. If those disks were configured with RAID your effective capacity would drop to a 1/18 dilution.

You could achieve a 1/3 dilution which is the effective minimum for a replicated database if you didn't configure RAID, but you increase the impact of disk failure, in that it would take much much longer to recover a cluster.

</comment><comment><USER9> >Given its pedigree of literally working at Google-scale

I understood that a team at google developed k8s but google doesn't actually run it for their "google-scale" workloads. Am I misinformed?

<comment><USER3> You are correct.

> [kubernetes is] a simplified clone of Google's internal borg system

[https://email@example.com/honestly-i-cant- stand-k8s-48...](https://firstname.lastname@example.com/honestly-i-cant- stand-k8s-48c9a600e405)

<comment><USER10> That said, Google, to my understanding, does run a completely containerized infrastructure internally, including databases and other stateful things, so it is not wildly off to suggest running a database on Kubernetes.

<comment><USER11> Before it ran on F1/Spanner, Adwords ran on sharded MySQL on Borg. Not for its entire early life, but for quite a few years. Later in life, Checkout and maybe Wallet ran on MySQL on Borg, too. So did YouTube, which used Vitess, a sharding layer (now ported to Kubernetes and open sourced).

Bigtable, Spanner and even Colossus/D run in containers on Borg.

<comment><USER12> How is colossus running in a container in borg? That's their network file system that makes running databases in containers possible?

<comment><USER11> There's a bootstrapping issue, of course, but that's how it works.

And it's even crazier than what you're picturing. What if I told you that Bigtable runs on top of Colossus, but Colossus itself stores metadata about files, including Bigtable's files, in... Bigtable? It's really turtles all the way down, the last of which is, luckily, Chubby.

Some of the details here: [http://www.pdsw.org/pdsw-discs17/slides/PDSW-DISCS- Google-Ke...](http://www.pdsw.org/pdsw-discs17/slides/PDSW-DISCS-Google- Keynote.pdf)

</comment></comment></comment></comment></comment></comment><comment><USER13> Has anyone looked at Service Fabric (Microsoft tech) for things like this? That has offered stateful services for years now. I'm pretty sure it runs on Linux, and I've seen that it's Docker compatible. I know it's kinda in the same space as K8s but I don't really know the details. Would SF be able to do something like this in a similar (or better?) way?

<comment><USER14> It's complicated, because the definition of Service Fabric seems to be in flux.

The "original" Service Fabric is a high-level framework which requires invasive source code changes (you can't just drop an existing app on top of it), but gives you lots of benefits (scale, reliability etc) if you make the effort.

Recently container-based platforms - Docker, Kubernetes, etc - have come along with a different tradeoff: better compatibility with existing applications in exchange for less magical benefits. That approach is getting much more traction, and I think internally at Microsoft there is some infighting between the "Service Fabric camp" and the "Containers camp". One consequence of the infighting is that Service Fabric is extending its scope to include features like "container support". It's not clear to what extent that is done in collaboration with the "container people", or as a way to bypass them. I think they are still trying to decide whether to embrace Kubernetes, or replicate the functionality in-house. My prediction is that the container-based approach will win, but if will take time for the politics to fully play out. In the meantime things will continue to be confusing.

Bottom line: when evaluating Service Fabric, watch out for confusing and inconsistent use of the brand. It's a common pattern with large vendors - <USER2> example IBM with "Bluemix", SAP with "Hana", etc.

<comment><USER13> Okay that's about what it looked like to me too. There's only so many magic words you can throw at a tech and expect it to work together happily. Looking into it, the stateful service side of SF doesn't seem particularly compatible with the container side of it. A stateful service is a stateful SF service, and a container service is its own thing. _Maybe_ there's a way to plug them together but unfortunately I didn't see it.

</comment></comment></comment><comment><USER15> Are there any cloud providers providing remote disks without replications? It looks such needs are popular for deploying databases in which replications are maintained by the databases themselves.

<comment><USER16> That's effectively what EBS is, no?

<comment><USER15> I have the impression that EBS does replication automatically, is it wrong?</comment></comment></comment>


Clinton received more money from weapons makers than all other candidate - <AUTHOR> https://twitter.com/RaniaKhalek/status/701526694683926528?ref_src=twsrc%5Etfw <comment><USER2> Other funny facts from the same table (from the site, the image seems to be outdated)

\- Bernie Sanders is 3rd overall, ahead of Jeb Bush, Ben Carson and Marco Rubio.

\- Larry Lessig got more money from the "weapon makers" than Rick Perry and Bobby Jindal put together.

\- Barack Obama got more than Chris Christie, despite not actually running for POTUS in 2016.

[http://www.opensecrets.org/industries/recips.php?ind=D&cycle...](http://www.opensecrets.org/industries/recips.php?ind=D&cycle=2016&recipdetail=P&mem=N&sortorder=U)

(I put "weapon makers" in quotes since, obviously, Defense includes more than weapons.)

</comment><comment><USER3> A more indicative measure would perhaps be money from category X as a percentage of the total raised.

Otherwise, of course it's no surprise that Sanders (dead even as the leading Democratic candidate) would be ahead of also-ran Republicans like Bush and Carson -- or the tied-for-second Rubio.

</comment><comment><USER4> She certainly received some from the Saudis. I wonder if she'll end up being "tough on defense contractors", since money obviously doesn't influence her.</comment>


Twitter & Performance: An update (aka the SQL query that took down Twitter) - <AUTHOR> http://engineering.twitter.com/2010/07/twitter-performance-update.html

<comment><USER2> Maybe they oversimplified what they do for the blog post, but that doesn't really sound professional to me.</comment>


Introduction to redo - <AUTHOR> http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/introduction-to-redo.html <comment><USER2> This article claims that redo suffers from several security issues at the very end. But can anyone explain to me how a userspace program that is run directly by the user can have any security issues at all? Also, apart from the PATH issue, all those "security holes" seem to require changing files, making them useless.

Besides, the author is wrong about the reasoning of apenwarr to implement #! processing[0]: it's done primarily to avoid having to make .do files executable. execlp() even executes /bin/sh all by itself if no header could be recognized[1]:

"If the header of a file isn't recognized (the attempted execve(2) failed with the error ENOEXEC), these functions will execute the shell (/bin/sh) with the path of the file as its first argument. (If this attempt fails, no further searching is done.)"

[0] [https://github.com/apenwarr/redo#can-my-do-files-be- written-...](https://github.com/apenwarr/redo#can-my-do-files-be-written-in-a- language-other-than-sh)

[1] [http://linux.die.net/man/3/execv](http://linux.die.net/man/3/execv)

</comment><comment><USER3> Here is a great little video series that goes through implementing Redo in Haskell:

[https://www.youtube.com/watch?v=zZ_nI9E9g0I](https://www.youtube.com/watch?v=zZ_nI9E9g0I)</comment>


Data Science for Social Good is a summer fellowship sponsored by Eric Schmidt - <AUTHOR> http://www.dssg.io

<comment><USER2> This is what schools should be teaching to students. How to use your computer to analyze the ways the society could be better. Comparative analysis between countries etc. Critical Theory!</comment>


Setting up CouchDB-Lucene on OS X (Some issues..) - <AUTHOR> http://lethain.com/entry/2009/feb/06/setting-up-couchdb-lucene-on-os-x-some-issues/ <comment><USER2> you might find this helpful:

<http://github.com/davisp/hypercouch/tree/master>

here's the background:

<http://www.davispj.com/posts/12></comment>