Blackballed by PayPal, Sci-Hub switches to Bitcoin - ur-whale https://www.coindesk.com/blackballed-by-paypal-scientific-paper-pirate-takes-bitcoin-donations <comment><AUTHOR> I've also been cut off from most of the traditional banking for most of my professional life, and my only crime was being born in Venezuela.

Yes, I know Bitcoin and other cryptocurrencies aren't being used by everyone. Yes, I'm aware of the risks and the costs. But it's still a huge boon as crypto allowed me to transact _at all_ when it was physically unfeasible to do so.

I've said it before and I'll keep saying it until such reality changes: most people who disregard cryptocurrency as just a fad can afford to think that way. Their needs are served by traditional banking, and that's fine! But it's not the reality for an important amount of people who are unbanked for whatever reason: their past, their actions (whether moral things considered illegal and thus they're prosecuted, or legal things that society consider immoral and thus they're censored) or even just a geographical accident.

<comment><USER2> I think it's a reasonable solution at the margins as long as the situtation in countries like Venezuela is as bad as it is. I don't think many people dispute that.

But as a solution for the institutional failures it still is not a replacement and obviously the solution in Venezuela needs to be repairing the system.

Same with Sci-Hub in this case. The Bitcoin donations alleviate financial pressure somewhat, but of course the lawsuits and IP-infringement will still haunt everyone involved.

<comment><USER3> This sort of "Once we've made everything perfect" reasoning doesn't really reflect reality all that much though; the point is that centralized systems will always be vulnerable to these problems; even if we temporarily fix them, that'll be an exception and sooner or later the systems will fall back into their broken state.

From that premise that the probem is universal, the deduction that the solution is also not just a temporary fix seems like the only reasonably conclusiont to me.

I'm not completely sure whether you're arguing that the bitcoin hype will pass once we've sorted out a few problems, or just that it'd be a nicer world if that could ever be the case; but either way, I don't think cryptocurrencies should be a last resort but instead become the norm. Offense is the best defense, after all.

<comment><USER4> I would argue that centralization is inherent in most humans instincts. To put it another way, many people like having a leader.

In fact people like leaders so much that exposed to a capricious and cruel world they'll invent imaginary and often cruel ones just to give the world a sense of order. Think the old testament God or lizard people conspiracy theories.

Given we're going to huge groups of people running around following leaders I think our best effort is spent trying to make the selection of those leaders pick non-evil people who run vaguely meritocratic and fair systems. Rather than trying to engineer ideal de-centralized systems _which will also have to be robust against the mob following their evil leaders.

Obviously this is a false dichotomy and we can do both, but please don't give up on good leadership, people need it and there's plenty of examples of it exiting.

<comment><USER5> This causes such a problem with governance though: Instead of voting for (or contributing to) ideas/policies directly, you have to translate your preference into a selection/ranking of the people who sound like they might support the ideas that you would like to see in your democracy. Sounds like a pretty crappy codec for that kind of signal tbh.

</comment></comment></comment></comment></comment><comment><USER6> I usually don't quote the article, but the last few paragraphs are important and easy to overlook:

———

Elbakyan says she hasn't approached any political parties or government bodies, thinking they could pick up on the censorship argument if they were interested. She does not believe most people are interested in discussing freedom of knowledge.

"There is no real community to discuss that, you hardly hear such voices. Not just in the mainstream media, but even on YouTube, for example. It all died by 2013, when Aaron Swartz died," she said, adding that even though many people are using her website or pirate websites such as torrent trackers, few care how and why they work.

"People don't think about the [copyright] laws, about doing something about it or voting against it," Elbakyan says. "When people reach out to me, they usually write to say 'thank you' or ask how to better donate."

Sci-Hub's standoff with the publishing industry is a good fight, Carter (who is also a CoinDesk columnist) believes. "The law and morality don't always match up, and they certainly don't in this case," he said, adding:

"Sci-Hub has undeniably made the world a better place, and Alexandra has had to live as a pariah because of it. Funding her operations with bitcoin perfectly demonstrates its value proposition."

<comment><USER7> Is there really no community around "freedom of knowledge"? Why not? How can we make it happen?

<comment><USER8> The internet was originally that pre 2010's

<comment><USER7> Touché, we need to bring that back.

</comment></comment></comment></comment><comment><USER9> "Alexandra Elbakyan, a 31-year-old freelance coder, neurobiologist and phylologist, is running a database of over 80 million articles from academic journals that are normally available only through subscriptions."

A modern Prometheus. Some plinths have recently opened up. A statue of this woman would make a nice replacement.

<comment><USER10> Careful there. Beside this undoubtedly noble deed she has indulged in some less than impeccable political expression. Meanwhile it looks like a holistic approach to moral evaluation of statues is gaining traction so it might end up a waste of copper.

<comment> Funes- >less than impeccable political expression

According to whom? Care to point us to some of those comments?

<comment><USER10> According to me :). But there are quite a few people in Russia who would agree. It's in Russian, but here we go:

[https://www.apn.ru/index.php?newsid=36204](https://www.apn.ru/index.php?newsid=36204)

It might be difficult to understand what's so bad without being embedded into the Russian political context. So here's some more direct stuff from SciHub social media:

[https://vk.com/wall-36928352_38852](https://vk.com/wall-36928352_38852) \- Stalin quotes

[https://vk.com/wall-36928352_37498](https://vk.com/wall-36928352_37498) \- comparing Stalin to Christ

<comment><USER11> Not sure why are you downvoted. Without knowing too much about Russian scientific community, in the first article she doesn't seem to say anything too bad. But on vk.com she seems to unironically go full Stalin (the guy who sent thousands of scientists and intellectuals to Gulags).

<comment><USER10> TBH, without context I'd be 100% certain that those posts are ironic or just trolling. Thing is, in that interview and elsewhere she expresses views typical of other Stalinists, so it's unfortunately not that.

</comment></comment></comment></comment></comment></comment><comment><USER12> If there was ever a noble application of the decentralized, uncensorable technologies ideas bourne out of the crypto community, this would be it.

<comment><USER13> Bitcoin is not uncensorable. Miners have the ability to censor transactions based on the sender/receiver/amount.

<comment><USER14> If you're interested in a fungible currency, checkout Monero. A true grassroots cypherpunk project.

<comment><USER15> Is it true that miners of Monero cannot censor it ?

<comment><USER13> Monero miners cannot see the sender address, the receiver address, or the transaction amount. I don't know if they finished Dandelion which is supposed to remove the link between the transaction and the IP submitting it. As far as I know, without Dandelion, it can be censored by IP address if the people running the miners are paying attention to that part of the network, otherwise Monero cannot be censored like Bitcoin can be.

<comment><USER16> Dandelion is running now

</comment></comment></comment></comment></comment></comment><comment><USER17> > I've also been cut off from most of the traditional banking for most of my > professional life, and my only crime was being born in Venezuela.

Did you see this:

[https://preview.redd.it/29lg5g19dr651.jpg?width=762&format=p...](https://preview.redd.it/29lg5g19dr651.jpg?width=762&format=pjpg&auto=webp&s=9aef0f6cb2c0464f7f0b008f918d2d72d80b262d)

Despite the Maduro Regime launching Petro (State-based crytocurrency) they do not accept it for their official documents, nor do they accept Credit Cards, they do however seem to accept BTC. Which makes sense because for a time the Government thugs were raiding Bitcoin miners and taking their rigs and funds.

Alexandra is a total badass, I like her defiant attitude towards Academia as a whole, and will be supporting her efforts once again this year. Free access to Scientific Journals is fundamental for a well Educated populace and should be available to all who seek the knowledge.

What's even crazier is that COVID has shown us that in dire situations, the walled-garden Peer Reviewed system isn't always best:

[https://www.wired.com/story/peer-reviewed-scientific- journal...](https://www.wired.com/story/peer-reviewed-scientific-journals- dont-really-do-their-job/)

I've seen how petty the peer reviewed system is in the 'publish or die' model in the Health Sciences, its petty and pathetic to see grown men and women alike having to resort to such unscrupulous antics to keep up with the illusion that this is what serves as one of the notable metrics for tenure.

As much as I like SciHub, I hope that her success is measured not by the amount of domains and servers she was able to maintain, but by her/SciHub no longer being needed as the paradigm finally shifted.

<comment><USER18> Petro was a bit of a joke I think, mostly seeming to require a transfer of funds from Venzulean banks and the like to a petro fund presumably controlled by Maduro or friends and family thereof, in return for petro coins that you can't do anything much with. Credit cards are I guess blocked by US sanctions. At least bitcoin works.

</comment></comment><comment><USER19> If an advanced alien species popped up, and were to observe humanity today, it probably would have a hard time understanding why a species would intentionally cripple its future so hard by punishing violators of copy-'right'.

It would even be astonished if there weren't any copyright: it wouldn't understand why empty HDD's weren't 90% capacity preloaded with STEM materials at the manufacturing plant. The user could always format.

The majority of nations are lagging in the majority of STEM subjects, why on earth don't they impose a differential STEMpty-ness tax on imported HDD's? Want to import a drive without randomized sampling of research, current and historical? pay extra to the STEM drive pot; imported a STEM drive? receive a little extra from the STEM drive pot.

<comment><USER20> There's no open source without copyright.

<comment><USER21> There is no licenses like GPLv3 without copyright. But many others would not be necessary, as everything would be essentially under a permissive license.

<comment><USER22> This is true, however without copyright I think many other things would change making the GPL a lot less necessary. For example, no one could prevent you giving your friend a copy of a program, so the market would change a whole lot. Basically, the thing about BSD that GPL doesn't like is that BSD permits proprietary software being created. Without copyright, there isn't really proprietary software any more, and less of a reason to keep source secret.

(Most of this thinking comes pre-web-applications, that does change the parameters a bit.)

<comment><USER21> Yes, that's why I mentioned GPL v3.

</comment></comment></comment></comment></comment><comment><USER23> I hope things like this mean Stripe will bring back Bitcoin support. I understand why they muted it at the time but it seems like high time to have their level of engineering backing something like that out in the wild.

I'd love to have BTC options available. Does anybody know of any similar APIs for doing BTC payments (or accepting cards and having the funds auto-converted to BTC)?

<comment><USER24> Well beauty of bitcoin is that you can be your own payment processor: [https://btcpayserver.org/](https://btcpayserver.org/)

There are other alternatives available as well.

Main problem is taxes and legality though, right now it is better to sell your software with fiat money and convert it to bitcoin through personal investment, at least this way your company won't be under legal risk due to accepting BTC.

</comment></comment><comment><USER25> I like bitcoin but it's hugely wasteful.

Electricity required to process a single transaction equal the consumption of 18 days for an average US household (source: [https://digiconomist.net/bitcoin-energy- consumption](https://digiconomist.net/bitcoin-energy-consumption))

Not only power consumption, these things generate large amounts of e-waste too, comparable to the e-waste generation of Luxemburg (source [https://digiconomist.net/bitcoin-electronic-waste- monitor/](https://digiconomist.net/bitcoin-electronic-waste-monitor/))

It's also terrible to use as a peer-to-peer payment option because it's expensive, slow, and the value fluctuates (in March this year it lost 50% of its value in just a few days)

<comment><USER26> > I like bitcoin but it's hugely wasteful.

Wasteful compared to what?

> It's also terrible to use as a peer-to-peer payment option because it's > expensive, slow, and the value fluctuates (in March this year it lost 50% of > its value in just a few days)

It's possible to transact in a matter of minutes. After that you can move it to a stable coin if you want to be exposed to USD (or gold) instead.

<comment><USER25> > Wasteful compared to what?

Compared to every alternative. Look up the sources I've linked,. the amount of energy used by Bitcoin is ludacris and unsustainable.

> It's possible to transact in a matter of minutes

10 minutes on average, but that's only 1 confirmation. You'll need to wait 6 before you can ship the goods. Current cost is $0.50 - so both slow and expensive. (source [https://www.buybitcoinworldwide.com/fee- calculator/](https://www.buybitcoinworldwide.com/fee-calculator/))

> After that you can move it to a stable coin

There are no stable coins on bitcoin (that I'm aware of) and you can't use one nativelly. Even if there are, they are custodial risks involved plus moving requires another transaction.

<comment><USER27> > 10 minutes on average, but that's only 1 confirmation. You'll need to wait 6 > before you can ship the goods. Current cost is $0.50 - so both slow and > expensive. (source [https://www.buybitcoinworldwide.com/fee- > calculator/](https://www.buybitcoinworldwide.com/fee-calculator/))

Oh boy, wait till you hear about international money transfers.

<comment><USER25> You mean those old telegraphic transfers? Why should I use that?

With my PayPal/Mastercard/GooglePay/ApplePay I can do an international order in seconds.

<comment><USER28> Processing != complete. A credit card transaction generally takes 1-3 days to process. Bitcoin is start -> complete in < 10 mins on average.

<comment><USER25> Nope. 10 minutes for bitcoin is just 1 confirmation. Most exchanges need 3, but it may take significantly more if you don't put enough fees on the transaction.

Meanwhile Credit cards/ApplePay/GooglePay/Paypal/AmazonPay provide the tap- and-go instant purchase experience, even on international orders.

<comment><USER28> "Tap-and-go" is an illusion, and like I said the payment is not fully processed for 1-3 days. Low-risk merchants (e.g. under $100) can accept crypto on 0 confirmations (just checking wallet balance) and accept the double-spend risk. This is similar to the chargeback risk merchants take by accepting credit cards (albeit with fewer protections on the crypto side).

I agree BTC fees are high, but for even moderately large transactions (>$25), it is cheaper than credit card/ApplePay/GooglePay/Paypal/AmazonPay fees.

Edit: and even after processing, chargebacks are often viable for up to 60 days.

<comment><USER25> as a customer, I always like that if something goes wrong, eg. product not delivered, there's always the chargeback option.

<comment><USER28> There's nothing stopping trusted 3rd-parties (e.g. mastercard/visa) from building wrappers to hold the btc in the meantime and mitigate end-user risk (full circle woo!). Definitely fewer protections from bad-actors with direct btc transactions, but that's by design (e.g. no _requirement_ for a third party)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> Is the Sci-Hub archive available over torrent or some other P2P system? It would make it an absolute fools errand to take it down as it would keep popping back up.

I don't know a single person who actually donates in bitcoin, so it's surprising to me that she managed to raise 900k in 2018. Bonkers

<comment><USER30> [http://gen.lib.rus.ec/scimag/repository_torrent/](http://gen.lib.rus.ec/scimag/repository_torrent/)

[http://gen.lib.rus.ec/dbdumps/](http://gen.lib.rus.ec/dbdumps/)

It's something like 75TB last time I checked, over 82 million articles in total. Each torrent contains 100,000 articles, named by DOI.

If sci-hub ever gets taken offline, there are enough full backups out there that it can be re-instated fairly quickly (at least the archive of existing articles; the credentials necessary to obtain new ones are not included in these torrents or database dumps).

</comment></comment><comment><USER31> I still don't see how anyone can claim with a straight face that taxpayer- funded research shouldn't be public domain.

</comment><comment><USER32> Information is power. But like all power, there are those who want to keep it for themselves. The world's entire scientific and cultural heritage, published over centuries in books and journals, is increasingly being digitized and locked up by a handful of private corporations. Want to read the papers featuring the most famous results of the sciences? You'll need to send enormous amounts to publishers like Reed Elsevier. There are those struggling to change this. The Open Access Movement has fought valiantly to ensure that scientists do not sign their copyrights away but instead ensure their work is published on the Internet, under terms that allow anyone to access it. But even under the best scenarios, their work will only apply to things published in the future. Everything up until now will have been lost.

That is too high a price to pay. Forcing academics to pay money to read the work of their colleagues? Scanning entire libraries but only allowing the folks at Google to read them? Providing scientific articles to those at elite universities in the First World, but not to children in the Global South? It's outrageous and unacceptable.

"I agree," many say, "but what can we do? The companies hold the copyrights, they make enormous amounts of money by charging for access, and it's perfectly legal — there's nothing we can do to stop them." But there is something we can, something that's already being done: we can fight back.

Those with access to these resources — students, librarians, scientists — you have been given a privilege. You get to feed at this banquet of knowledge while the rest of the world is locked out. But you need not — indeed, morally, you cannot — keep this privilege for yourselves. You have a duty to share it with the world. And you have: trading passwords with colleagues, filling download requests for friends.

Meanwhile, those who have been locked out are not standing idly by. You have been sneaking through holes and climbing over fences, liberating the information locked up by the publishers and sharing them with your friends.

But all of this action goes on in the dark, hidden underground. It's called stealing or piracy, as if sharing a wealth of knowledge were the moral equivalent of plundering a ship and murdering its crew. But sharing isn't immoral — it's a moral imperative. Only those blinded by greed would refuse to let a friend make a copy.

Large corporations, of course, are blinded by greed. The laws under which they operate require it — their shareholders would revolt at anything less. And the politicians they have bought off back them, passing laws giving them the exclusive power to decide who can make copies.

There is no justice in following unjust laws. It's time to come into the light and, in the grand tradition of civil disobedience, declare our opposition to this private theft of public culture.

We need to take information, wherever it is stored, make our copies and share them with the world. We need to take stuff that's out of copyright and add it to the archive. We need to buy secret databases and put them on the Web. We need to download scientific journals and upload them to file sharing networks. We need to fight for Guerilla Open Access.

With enough of us, around the world, we'll not just send a strong message opposing the privatization of knowledge — we'll make it a thing of the past. Will you join us?

Aaron Swartz July 2008, Eremo, Italy

<comment><USER33> \- I recommend to put the above in quotation marks so people don't think it's your own comment. Extraordinary quote, here's a copy on github: [https://gist.githubusercontent.com/ksinkar/4552726/raw/74458...](https://gist.githubusercontent.com/ksinkar/4552726/raw/74458d1932510e2b93d8ebde9ac387f842afbc0f/Aaron%2520Swartz:%2520Guerilla%2520Open%2520Access%2520Manifesto)

\- I recommend everyone to watch 2014 documentary "The Internet's Own Boy: The Story of Aaron Swartz".

We will never forget Aaron Swartz. He did not die in vain. His work lives on, we are continuing it and will forever.

<comment><USER32> Only saw this too late to edit but it's a good point. I put source at the bottom but clearer to put link above and quote marks.

</comment></comment></comment><comment><USER34> Paypal has been quite prominent in banning people from their service. Some might deserve it perhaps but I am still against it. Paypal can never be a universal payment processor.

If they banned real criminal transactions, sure, but I only have seen them ban people to enhance their image.

<comment><USER35> > If they banned real criminal

This too, is problematic. A private entity should never be the one deciding what is criminal and what is not.

Especially if they are providing crucial infrastructure.

<comment><USER36> This is a very stupid thing to argue and I don't think you actually believe it. Individuals and corporations are responsible for their _own_ activity and are responsible for determining if their _own_ actions are illegal.

Nobody is saying PayPal should be the arbiter of law and order or that PayPal is automatically liable for all actions of their users. But if PayPal believes one of their customers is using their service to finance criminal activity, they have a legal duty to respond.

An extreme (but plausible) example is child abuse - if PayPal discovers one of their customers is using donations to finance child pornography, PayPal shouldn't wait for a court order to shut it down. And if they did drag their feet then some PayPal employees need to go to jail.

<comment><USER35> In your extreme case, it is PayPals duty to inform the authorities. And then to act upon the instructions recieved from that authority. But it is not PayPals duty to decide whether the customer is a criminal or not; that is what the courts or your local version thereof, is for.

It might be that in the US, this is different, but in the EU it is not. In fact, in the EU, payment providers are, in several cases, prohibited by law to shut down or inform customers. So if Paypal were to shut down the contract of such a customer, _that_ would be thing that might bring PayPal employees to jail.

Now, that is obviously aside from any EULA or other agreements PayPal has with its customers: as a private entity, paypal is free to put arbitrary rules in that contract: dissalow stuff that is otherwise perfectly legal, for example. But that is very different from becoming a judge. Edit: but my point was, that the moment PayPal becomes "critical infrastructure", such arbitrary rules are problematic because, if, say, a PayPal account is required to pay taxes or receive any form of wages, such arbitrary rules will exclude people who then might get into serious trouble.

Also, please keep the conversation civil. Calling me "very stupid" does not help to bring your otherwise valid and thoughtful concerns forward.

</comment></comment></comment></comment><comment><USER37> So although stablecoins exist which are great for predictable commerce (having a treasury of the amount value you expected), a key piece of the infrastructure is that Ethereum clients don't work over Tor.

Most stablecoin activity is on the Ethereum network, and the clients have never prioritized Tor use.

Ethereum also hosts privacy that all fungible assets can inherit, using Tornado.cash people can trade notes of unknown amounts, redeemable any time. Using Aztec people can make any token private, and communities can consider doing private-by-default tokens including with stablecoins if the issuer started it that way.

So its not as simple as Bitcoin OR Monero. There is a looming large piece of the puzzle that simply is missing one piece - ease of use over Tor. Layer2 solutions on Ethereum also inherit privacy inadvertently, while solving scaling issues on layer1.

Of course, sci-hub doesn't NEED Tor itself for donations, being fairly benign, but as soon as that piece exists, many tech savvy people simply use that route. Monero will likely remain superior but technically lesser solutions can solve the actual market needs better, since the attack surface isn't that consequential.

<comment><USER38> What's the relevance of whether eth clients work over Tor? A wallet's history would be available on a block explorer like etherscan.io whether the transaction had been broadcast over Tor network or not. I run a bitcoin node over Tor but it does not change how any money spent from that wallet is viewed by the network compared to spending from a non-Tor wallet.

<comment><USER37> It has been trivially easy to disassociate an address from your identity for half a decade.

You just go from fiat to Monero. And then over Tor you swap or morph Monero to the surveillance coin you actually want. The centralized swapping service wont know your IP address due to Tor, Monero uniquely doesnt have transaction history, and the address you provide for the surveillance coin will be a virgin one never used before.

So the swapping service and all the blockchain sleuths will be stopped cold. Actually they wont be stopped they'll just be following transactions forever thinking it has the same beneficial owner. So a wild goose chase for people that think they have purpose in life.

And you get to transact in the digital asset you want.

Unfortunately if that is on the ethereum blockchain then you cant send additional transactions while over tor.

The desired use case: Anonymously funding a subspace of addresses using Monero (unstable value), receiving DAI and Ether.

Still over Tor, using the DAI (stable value) to donate to scihub. Using ether for transaction fees.

Downloading literature from scihub over tor. (Not using bittorrent)

BONUS: we can also get rid of ether transaction fees now, if the dai was issued directly on a layer2 system like zksync.

So there is a vibrant ecosystem that simply cant broadcast transactions over tor right now. Its a udp issue. Not irreconcilable, people just havent done it in the node software.

</comment></comment></comment><comment><USER39> How successful has it been to switch to Bitcoin? I hear mixed things about it and wonder how many actually use this currency.

<comment> ur-whale Bitcoin isn't necessarily well aligned to what people usually think of as a "currency".

It's an entirely new beast in the financial instrument space.

It does bear _some_ characteristics of traditional currencies, but not all of them.

Specifically, as it works today, and until Lightning gets some traction, BTC isn't very convenient for small day to day transactions like buying a cup of coffee.

On the flipside, it does have attributes that traditional currencies strictly do not have.

For cases such as the OP, there is no other financial instrument on the planet that will cut it (other than things like Monero / ZCash / MimbleWimble).

Besides being antifragile and censorship resistant, there is also a very strong case to be made for Bitcoin in the 'preservation of wealth' niche (if you are strongly insensitive to short-term volatility, and capable of playing on a 5 year time horizon, that is).

[EDIT]: To answer your question more precisely, Bitcoin has most definitely been a success story for sites like sci-hub, Wikileak and generally speaking, people who try to speak truth to power.

<comment><USER40> There are forks of Bitcoin that solve (most of) these problems and make it more usable as an actual currency, rather than a gold-like store of value. "Bitcoin Cash" is the most famous, there are others.

Frankly the failure of "original" Bitcoin to adapt to use as a currency seems to me to be a total failure of vision.

<comment><USER41> My understanding of Bitcoin Cash and Bitcoin SV is that they have just increased the blocksize the clients can handle. Is there something more to them than that?

<comment><USER42> Not really, but the result is essentially no fees. And thanks to Moore's Law there's no trade-off for it. Bitcoin (Core) is insane for having high fees.

</comment></comment></comment></comment></comment><comment><USER43> And making the plannet a worse place in the process.

[https://www.vice.com/en_us/article/ywbbpm/bitcoin-mining- ele...](https://www.vice.com/en_us/article/ywbbpm/bitcoin-mining-electricity- consumption-ethereum-energy-climate-change)

</comment><comment><USER44> Many academics use Sci-Hub now as an essential service, otherwise they cannot access academic papers unless they are on arxiv or similar sites. Many universities can't afford Elsevier or Springer-Natures prices. If a university lacks access then a graduate student would have to pay $30-100 per article. It is insane. Unfortunately open access is still not sufficient because top journals are frequently not open or researchers cannot afford the price for hybrid open/paywall journals to make their paper open access ($1000-$6000 per paper).

Not a fan of Bitcoin though due to its inefficiency and environmental/energy costs.

Link to Elsevier open access publishing fees: [https://www.google.com/url?q=https://www.elsevier.com/__data...](https://www.google.com/url?q=https://www.elsevier.com/__data/promis_misc/j.custom97.pdf&sa=U&ved=2ahUKEwi234qDr5_qAhUXQ80KHTigAAoQFjAJegQITxAB&usg=AOvVaw3yuBPUj7bUN8mGb1141I4W)

</comment><comment><USER45> I've been mulling this over but why don't people who want some consistent value go with the gold-backed coins? Couldn't tell you which is the best option, but either people convert or Sci-hub could do the exchange instantly or at EoW every week or whatever to get away from the volatility but keep the improved payment.

Financial markets are very volatile right now, but Gold is just about the best store of value you can have

<comment><USER46> Gold backed coins, like PAX, are very easy to censor. While all the coin ownership information sits on the blockchain ledger, the gold sits somewhere in a vault and the custodian company has the capability to blacklist coins. Virtually all gold backed coins have this issues. You need a native digital token to have better censorship resistance.

<comment><USER45> Ahh thanks -- I didn't think of the censorship angle, that's a showstopper for sure

</comment></comment></comment><comment><USER47> Is this new? I've been meaning to donate but didn't want to do the whole gdpr- questionable bitcoin exchange identification thing, so only when Keybase was taken over I asked a friend to help convert those Lumens into a bitcoin donation to sci-hub. Glancing through the article, it doesn't sound like PayPal was an option for most of the last decade now?

I'm also not too thrilled about supporting this super wasteful currency, a PoS or similar alternative being supported would be quite welcome.

<comment><USER48> You can buy bitcoin at 7-11 and CVS now, with only a $5 fee: [https://www.forbes.com/sites/colinharper/2020/06/23/you- can-...](https://www.forbes.com/sites/colinharper/2020/06/23/you-can-now-buy- bitcoin-at-cvs7-eleven-rite-aid/)

</comment></comment><comment><USER49> Poor choice of words for this title, especially right now. What about "Blocked by Paypal"?

</comment><comment><USER50> Is there support for lightning? If so, I'll donate.

</comment><comment><USER51> They should be using Monero.

Can't be traced by governments (1).

(1). [https://images.app.goo.gl/qKDwxvo5Csk913r39](https://images.app.goo.gl/qKDwxvo5Csk913r39)

<comment><USER52> This isn't about tracing or hiding source and/or destination. It's about being able to donate at all.

</comment></comment><comment><USER49> Poor choice of words on the title. What about "Blocked by Paypal..."?

</comment><comment><USER53> PayPal is a thorn in our world. They are atrocious and I wish they'd die. The extraordinary fees they charge for currency conversion, in the form of very unfair rates, should alone be worthy of their demise, and should be criminal.

</comment><comment><USER54> Some relevant TLDR background from the article:

"A self-described Communist in her political views, Elbakyan believes the paywall policy of science publishing is a kind of censorship."

<comment><USER55> Communist but taking donations?

At least she's right on paywall publishing being total bollocks.

<comment><USER56> Just because you have an ideological belief doesn't mean you're somehow magically exempt from participating in the currently capitalist world. People still need to purchase food, pay bills etc.

<comment><USER55> > currently capitalist world

Plenty of communist countries exist, today. Why not move to utopia?</comment></comment></comment></comment>


The Limitations of the Ethernet CRC and TCP/IP Checksums for Error Detection - <AUTHOR> http://noahdavids.org/self_published/CRC_and_checksum.html <comment><USER2> Reminds me of a random google SRE slide deck I stumbled across a couple of years ago. Switch itself corrupts payload; dense enough to pass the tcp checksum in use.

[http://www.catonmat.net/blog/wp- content/uploads/2008/11/that...](http://www.catonmat.net/blog/wp- content/uploads/2008/11/thatcouldnthappentous.pdf)

<comment><USER3> This. I work at a CDN and there's a particular switch model that we have a fair number of doing this. It was incredibly hard for the network team and vendor to track down. It's because one of the internal data paths was not error checked (i.e. hw design and layout problem). We're somewhat working around it with application layer stuff, but are moving off that switch and vendor as fast as capex allows. It wasn't a bottom of the barrel vendor either.

<comment><USER4> Brocade?

<comment><USER3> Yes

</comment></comment></comment></comment><comment><USER5> Super old article from 2008.

Nowadays people are switching from TCP to unprotected UCP to avoid the costly ACK dance, and not the other way round.

He also fails to mention how trivial CRC is to reverse (e.g. [http://www.woodmann.com/fravia/crctut1.htm](http://www.woodmann.com/fravia/crctut1.htm)), and how good CRC32-C actually is to detect random bitflips. Much better than all other fast hash functions, and up to par with most slow and secure hash functions.

</comment><comment><USER6> When more and more transport employ end-to-end authenticated encryption like TLS and SSH, this will be a non-issue. Message authentication code will resist even malicious tampering, let alone accidental corruption.

<comment><USER7> You are paraphrasing the third line of the article.

</comment></comment><comment><USER8> The suggestion at the end to use zip compression to protect your files seems funny; when we're talking about extremely rare errors, CRC32 seems insufficient to really protect.

</comment><comment><USER9> Interestingly IPv6 removed the checksum from its packet header [1], delegating this work to the higher protocols such as TCP and UDP.[2] So I guess that raises the chance of an invalid IP header getting through. Source and target address will probably result in dropped packets but I wonder what happens if one of the other fields is corrupted, say _traffic class_.

[1] [https://en.wikipedia.org/wiki/IPv6_packet#Fixed_header](https://en.wikipedia.org/wiki/IPv6_packet#Fixed_header)

[2] [https://en.wikipedia.org/wiki/IPv6#Simplified_processing_by_...](https://en.wikipedia.org/wiki/IPv6#Simplified_processing_by_routers)

<comment> X-Istence If traffic class is corrupted it will simply be QoS'ed wrong. No biggie.

</comment></comment><comment><USER10> Would the increasing use of SSL mostly solve this problem as a side-effect?

How likely is it that a secure connection will be corrupted without being noticed?

<comment><USER11> These days many SSL connections use authenticated modes of operation such as CCM or GCM that explicitly guarantee that data is transferred correctly.

</comment></comment><comment><USER12> Here is the chance of that case: "checksum will fail to detect errors for roughly 1 in 16 million to 10 billion packets". source: [http://dl.acm.org/citation.cfm?id=347561&dl=GUIDE&coll=GUIDE](http://dl.acm.org/citation.cfm?id=347561&dl=GUIDE&coll=GUIDE)

</comment><comment><USER13> ethernet >=1gb/s have workarounds for error detection

[https://en.wikipedia.org/wiki/Jumbo_frame#Error_detection](https://en.wikipedia.org/wiki/Jumbo_frame#Error_detection)

<comment><USER14> I think that link says that SCTP (which no one uses) has better error detection, not Ethernet itself.

<comment><USER15> all telecom networks (sigtran) uses SCTP.

</comment></comment></comment><comment><USER16> The error estimate that "between 1 in 16 million and 1 in 10 billion TCP segments will have corrupt data and a correct TCP checksum" is from "Performance of Checksums and CRCs over Real Data" [Stone and Partridge] which only analyzed a particular type of framing error over ATM. More modern transports should be immune to this form of error because the line encodings used make it nearly impossible to start a packet in the wrong place or include a fragment of the following packet.</comment>


NIST reopens draft recommendation on random number generation for comment [pdf] - <AUTHOR> http://csrc.nist.gov/publications/nistbul/itlbul2013_09_supplemental.pdf

<comment><USER2> It should probably be noted that this is not some sort of validation to the fact that "the NSA owns this particular DRBG".

Surprisingly (to me), this is merely a signal of a government agency that takes public perception to heart and issues a vote of not-complete-confidence in standards it has previous prescribed, and today is seeking to rectify the problem by looking for nothing up my sleeve numbers [0] agreed upon by security researchers and the public at large. A smart move, no doubt a difficult one to make, as even the slightest suggestion of no-confidence in a prescribed standard is quite damaging to the reputation of an institution devoted to maintaining reliable standards.

More info on nothing-up-my-sleeve: [0] [http://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number](http://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number)

<comment><USER3> Somewhat off topic, but it seems like it would be better to use some future unpredictable events to really remove any "nothing up my sleeve" doubt. e.x. hash of the sum of all S&P 500 companies' closing stock prices on a specific future date.

<comment><USER4> I assume you need _some_ flexibility in choosing a nothing-up-my-sleeve number, in case the first number you try has properties that are bad for the algorithm.

Imagine if the super-official, international standard nothing-up-my-sleeve number was 1. Any time you need consistent but arbitrary bits in a cryptographic algorithm, they must be ...000000000000001. That doesn't sound like it would work very well.

<comment><USER5> In that case, you announce a reroll, along with a published paper explaining that x^1 == x. But, assuming you use SHA-256 or higher, the chances of that happening are less than one over the number of atoms in the observable universe, so you shouldn't worry about it the same way you don't worry about hash collisions happening purely by chance.

</comment></comment></comment></comment><comment><USER6> I doubt the NIST will ever be trusted again as any standards or specs they are in favor of will be immediately suspected of having some favorable vulnerability for the NSA.

Let's say they hold a contest for people to submit next generation cryptosystems, and that Algorithms A,B, and C make it to the final. If the NIST publishes critical remarks on A and C and seems to favor B, immediate skepticism and red flags will be raised. Does B have a hidden weakness the NSA knows about?

A standards organization can only run on its transparency and integrity.

<comment><USER7> First, a lot of NIST crypto standards are relatively anodyne; for instance, the NIST GCM standard basically just explains how to do multiplication in GF(2^128), and the NIST CTR mode standard just lays out a bunch of ways you can arrange your counter block. Those standards remain valuable and aren't likely to harbor backdoors.

Second, it has _always_ been the case that favorable responses from the USG in general and NSA in particular have cast a pall over proposed standards. Isn't that why there's a RIPEMD160, for instance?

<comment><USER8> Yes but whenever NSA "suggests" changes such as certain constants or like classic S-boxes from DES. Those don't usually come with a clear explanation, more like "here makes these change, it will be better, trust us" kind of idea.

Another point is that most people (especially non-US citizens) don't necessarily view NSA and NIST as separate. They are seen as part of the same government. More like 2 offices in the same government department.

Now this also brings about an interesting thing I have been thinking about. NSA is also in charge of protecting its own data. So recommendations, practices and policies they tweak go into keeping its (and other agencies') classified data secure.

Given that they have managed to "tweak" and insert backdoors in some algorithms or systems, how likely they are to recommend those systems for its own and other government agency use? Do they want the communication or keys to the nuclear launch sites to use the "tweaked" version. They would need to have an pretty good feel that no other agency out there has also figured out the back door.

<comment><USER9> That's why the generally design the backdoor so that it's based on a key that only they have.

For example, with Dual EC DRBG, researchers discovered that it would be possible to create the constants based on another constant, with which you could predict the output easily. But without prior knowledge of that constant, it would be an infeasible brute-force search to find it.

Likewise, previous publicly known backdoors like the one in the export version of Lotus Notes depended on a key that the NSA had. There it was even simpler, and not obfuscated; it would just encrypt a portion of the session key with the NSA's public key, which they could decrypt and the easily brute-force the rest of the session key.[1]

The NSA doesn't want to make security weak against arbitrary attackers, they just want to give themselves the keys.

[1]: [http://www.cypherspace.org/adam/hacks/lotus-nsa- key.html](http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html)

<comment><USER8> Ah, it makes sense now. Thank you for explaining it.

</comment></comment></comment></comment></comment><comment><USER10> Background: [https://en.wikipedia.org/wiki/Dual_EC_DRBG](https://en.wikipedia.org/wiki/Dual_EC_DRBG)

> Dual_EC_DRBG or Dual Elliptic Curve Deterministic Random Bit Generator is a > controversial pseudorandom number generator (PRNG) designed and published by > the National Security Agency. [...] Shortly after the NIST publication, it > was suggested that the RNG could be a kleptographic NSA backdoor.

<comment><USER7> It's an awfully weird trojan horse --- or, as Daniel Franke put it on Twitter, a trojan platypus.

First: NIST RNG designs aren't particularly important (unlike the curve standards); there is a broad diversity of CSPRNG designs, applications tend to "borrow" the OS's, and no OS I know of uses a design taken directly from NIST.

Second: Dual EC DRBG is a CSPRNG that uses elliptic curve point multiplications; in other words, it requires bignum math. If you're unfamiliar with CSPRNG design: that's not a normal requirement. Dual EC is very slow. Nobody would willingly use it.

Why would _that_ be the big NSA standard back door? I'm not saying it isn't. Something hinky happened there. I'm just asking: what did they have to gain from trying to backdoor _that_ standard?

<comment><USER9> > It's an awfully weird trojan horse --- or, as Daniel Franke put it on > Twitter, a trojan platypus.

Heh, that is a pretty good term for it.

> no OS I know of uses a design taken directly from NIST.

Except for all of the pressure recently on the Linux kernel developers to use Intel's RdRand directly rather than mixing it into their existing entropy pool (see, for example, [https://plus.google.com/117091380454742934025/posts/SDcoemc9...](https://plus.google.com/117091380454742934025/posts/SDcoemc9V3J) and [https://lkml.org/lkml/2013/9/5/212](https://lkml.org/lkml/2013/9/5/212)), where apparently the reason is "Customers want a SP800-90 source available through the OS interface" (quote from David Johnston, designer of the RdRand hardware, on the Google Plus link).

So, apparently there is a lot of pressure to get the OS to adopt the NIST standards directly.

There are lots of reasons for this kind of pressure. Obviously, if you sell to the government, it'll be easier if you follow the NIST standards. There are likely lots of other compliance related reasons you would want to, such as encryption requirements for HIPAA. I wouldn't be surprised if some of those standards either required or were easier to comply with if you just used NIST approved algorithms, and it's easiest to use those NIST algorithms systemwide if the OS CSPRNG uses them (and directly, without extra unapproved random number generation on top).

> Second: Dual EC DRBG is a CSPRNG that uses elliptic curve point > multiplications; in other words, it requires bignum math. If you're > unfamiliar with CSPRNG design: that's not a normal requirement. Dual EC is > very slow. Nobody would willingly use it.

Yes, this is the odd part. On the other hand, you do have to recall that the NSA is a big government bureaucracy. It may be that their SIGINT enablement department (the one that's responsible for weakening exportable crypto, planting backdoors, and the like) had promised to get some backdoors into widely used standards, but couldn't find a better way to do so surreptitiously and effectively without weakening security against foreign attackers as well.

It may be that Dual EC DRBG was just inserted so they could check off a box and continue to get funding for the standards body division of SIGINT enablement, and not as an actually realistic attack.

<comment><USER11> > _but couldn 't find a better way to do so surreptitiously and effectively > without weakening security against foreign attackers as well._

Have we seen any evidence that the NSA cares _at all_ about avoiding "weakening security against foreign attackers" in their quest to weak security against themselves as attackers?

Aren't they _neccesarily_ weakening security against foreign attackers when they intentionally weaken crypto, which we now know they do?

<comment><USER9> > Aren't they _neccesarily_ weakening security against foreign attackers when > they intentionally weaken crypto, which we now know they do?

No. In fact, most of the schemes that we know about in which they have tried to weaken crypto have involved them having some secret key which can be used to crack it, but without which you don't have a better attack than the standard brute-force attack.

That's the case with Dual EC DRBG. What researches discovered was that the constants in it could have been picked such that with knowledge of a secret constant, you can predict future output given only a relatively small amount of past output. Without knowing those constants beforehand, you wouldn't be able to do better than brute force.

Previous attempts have been similar; the Clipper Chip was supposed to have strong crypto, but store a master key in escrow with the NSA that they could use to crack it. Lotus Notes would encrypt part of the session key with a public key, for which the NSA had a corresponding private key, so if the NSA wanted to eavesdrop they could decrypt that and use it to speed up the brute- forcing process[1].

So, there are numerous cases of the NSA trying to balance the need for crypto that is strong for other attackers, while leaving them a backdoor that only they can use.

1: [http://www.cypherspace.org/adam/hacks/lotus-nsa- key.html](http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html)

</comment></comment></comment></comment></comment><comment><USER12> This should be upvoted instead, as it provides context, and also links to this PDF (or its official announcement).

[https://news.ycombinator.com/item?id=6364340](https://news.ycombinator.com/item?id=6364340)

Or to provide minimum context, the announcement should've been submitted instead.

[http://nist.gov/director/cybersecuritystatement-091013.cfm](http://nist.gov/director/cybersecuritystatement-091013.cfm)

</comment><comment><USER13> For those curious _(as I was)_ as to what the heck that title means, the press release linked deals with The National Institute of Standards and Technology (NIST) and what kind of random number generators (RNGs) they recommend using.

<comment><USER14> Agreed, a rewording of the title to something a little more accessible would not go amiss.

<comment><USER15> The terms EC-DRBG and NIST have come up quite a bit lately on HN with regards to the NSA, so it's not unreasonable to use them to ensure a descriptive title fits in the 80 characters allotted.

The other cryptic term, SP800-90a, looks like the issue number of an official standard, like ISO-8859 or EIA/TIA-568.

</comment></comment></comment><comment><USER16> Can anyone provide a mirror, please?

</comment><comment><USER17> Here's my comment: This is the dumbest PRNG ever.

<comment><USER18> Look up RANDU.

<comment><USER17> RANDU didn't claim to be cryptographically secure.

<comment><USER18> Oh.

Well, in that case look up Debian's OpenSSL from a few years ago.

<comment><USER17> Debian's OpenSSL was a perfectly good PSEUDO RNG a.k.a. DRBG

<comment><USER18> But it claimed to be a cryptographically secure one.

And I'm pretty sure even the NSA-adjusted EC PRNG standardized by NIST offers more than 15 bits of security.

<comment><USER17> Debain's broken OpenSSL claimed to be a cryptographically secure _true_ random number generator (CSRNG). But it ended up being seeded with only 15 bits of entropy, so it failed in the true random part. Nevertheless, the _pseudo_ random number generator (CSPRNG, or as NIST calls it a DRBG) part of it still sorta worked (I don't recall if you could successfully seed it manually).

But regardless of how you were planning to use it, if an adversary has a backdoor in your PRNG/DRBG then it's not cryptographically secure (CS). That, and this Dual EC contraption is probably much slower than a conventional design.</comment></comment></comment></comment></comment></comment></comment>


Which day job would you choose ? - <AUTHOR>

So about a year ago I took a job at Big Internet Company that was advertised as design of brand new back-end architecture, blah, blah. Reality is mostly support of legacy codebase, operational work and requisite lip service to various "initiatives". ("16 is the minimum, ahkay?")
Startup (had a blast at "school" - thanks PG!) is not an option at the moment due to family situation, but I have an offer to join a different, very technical team within B.I.C. that is working on a new, fairly substantial networking product. No frills, heavy-duty C systems programming in Linux (which I am good at and enjoy).
However: hideously boring job #1 is really only half-time, leaving good chunks of time for hanging out at Chochky's and playing with (and quite possibly sneaking into production) bits Erlang, which I am presently in love with and want to learn inside out.
I suspect job #2 would be pretty much all-consuming, at least for the foreseeable future, leaving no such opportunities to play.
Which would you choose ? <comment><USER2> Job #2. With incredibly boring work, you burn out, your quality becomes sloppy, you lose your edge.

Luckily for you the boring job is only 1/2 time, but what if the politics change and you are forced to work there 60-80 hours a week?

</comment><comment><USER3> I must agree with brlewis. Another way to look at it is Option 1: Spend 50% of your time honing your skills, gaining valuable experience Option 2: Spend 100% of your time honing your skills, gaining valuable experience Another thing to consider is how awesome it is to work with people who are as good as you (or better), love what they do, and have things to teach you. Even if option 2 pays less, take the cut and get the experience that will propel you into a higher pay bracket. BTW, none of the supremo hackers I've worked with have begrudged me time to play with some cool new tool - as long as I willing to share my knowledge.

</comment><comment><USER4> Is this a fair summary?

Option 1: Spend half your time at a hideously boring job, half your time hanging out and exploring Erlang.

Option 2: Spend all your time doing something you are good at and enjoy.

</comment><comment><USER5> i'm lazy. I'd rather get paid the same for 1/2 the work and leave the creative stuff for my own time.

</comment><comment><USER6> Job #2. I don't know about your Big Company specifically, but turning down good opportunities often leads to them not being offered in the future. Besides, performing well may put you in a position to use Erlang with more authority down the road.

<comment> Xlp-Thlplylp Gee, I routinely ignore queries from Google, Amazon and Microsoft.

</comment></comment><comment><USER7> If I were you I'd go for the hardcore job AND sneak some Erlang in there. Working without quantifiable goals will make you sloppy in the long term, even if it seems liberating in the short term - dangerous.

</comment><comment><USER8> Everything I've read here has some validity. Some additional questions:

If you're already not happy at BIC, how do you know you'll be happy in a new department in the same company?

Also, how do you know the technical level of the "technical" team you'd be working with? Have you spoken to a few people on that team? Sometimes the alpha geeks in an organization turn out to be less impressive than you thought.

And what kind of timeline are you looking at? How long would you stay in either position? Months? Years?

</comment><comment><USER9> Assuming pay is the same, I think I'd choose job #1.

</comment><comment><USER10> How about option #3: look for an Erlang job and apply for it.

</comment><comment><USER11> It's not about us, ask yourself? Listen to your inner-voice? If nothing helps then as they say "Fast, easy and good. Pick two." :)</comment>


Meltdown and Spectre: Bugs in modern computers leak passwords and sensitive data - <AUTHOR> https://www.meltdownattack.com/ <comment><USER2> The core of this attack is extremely simple and elegant; use a value from a speculated-but-not-completed instruction as an index, causing one of a set of cachelines to be touched; then use a timing measurement on those cachelines to see which one was accessed, thus determining the value.

This is a nightmare for the cloud, but IMHO for personal computing, it only furthers the notion that you should trust every bit of code running on your system, and my long-standing view that protection features like paging, rings, and access bits should really be considered more of barriers to prevent accidents than any real isolation. Timing-based sidechannels are notoriously difficult to excise completely.

</comment><comment><USER3> > Currently, we have only verified Meltdown on Intel processors. At the > moment, it is unclear whether ARM and AMD processors are also affected by > Meltdown.

> In particular, we have verified Spectre on Intel, AMD, and ARM processors.

Interesting. So there are two different vulnerabilities. Spectre has been verified to affect Intel _and_ AMD whereas Meltdown _may_ affect both.

Edit: based on this statement,[1] AMD states they are not affected at all. This seems to be contrary to what the researchers have found?

1 - [https://twitter.com/rhhackett/status/948676213505232897](https://twitter.com/rhhackett/status/948676213505232897)

<comment><USER4> From Google Security Blog [0]

>The Project Zero researchers discovered three methods (variants) of attack, which are effective under different conditions. All three attack variants can allow a process with normal user privileges to perform unauthorized reads of memory data, which may contain sensitive information such as passwords, cryptographic key material, etc.

> There is no single fix for all three attack variants; each requires > protection independently. Many vendors have patches available for one or > more of these attacks.

That would suggest the possibility of a third unnamed attack variant.

[0] [https://security.googleblog.com/2018/01/todays-cpu- vulnerabi...](https://security.googleblog.com/2018/01/todays-cpu- vulnerability-what-you-need.html)

<comment><AUTHOR> Spectre has two variants, CVE-2017-5053 and CVE-2017-5715.

<comment><USER4> Ah, I missed that, thanks!

</comment></comment></comment></comment><comment><USER5> TLDR: two side-channel info leak attacks on CPUs: Meltdown that appears to affect Intel and latest ARM64 (Cortex-A75), and Spectre that was shown to affect Intel, older AMD and ARM64 and theoretically newer AMD processors.

Meltdown is more severe with read privilege escalation (javascript in browser could read kernel memory!), which has a kernel patch (KPTI) that can slow down many workloads by 30%.

Spectre also allows a user process to read memory of other processes/containers and potentially kernel, which was shown to work on Intel and ARM64 because their predictable branch prediction impl (Tomasulo). Newer AMD (Ryzen and Epyc) employs a hardware neural network for branch prediction, which is much less predictable but still theoretically possible to exploit. This is probably not the first time that the opacity of a neural network helped security :)

</comment><comment><USER6> Impact question on AWS:

From [https://aws.amazon.com/de/security/security- bulletins/AWS-20...](https://aws.amazon.com/de/security/security- bulletins/AWS-2018-013/):

"While the updates AWS performs protect underlying infrastructure, in order to be fully protected against these issues, customers must also patch their instance operating systems."

Prior to this quote, Amazon said that virtually all of the underlying instances have been patched.

What's the risk between now and when all of my EC2 instances are restarted with updated AMIs? Is it the 'full' risk, or is the attack less feasible, given the patched underlying OS'. Thanks.

</comment><comment><USER7> I only had a chance for a brief read over the papers, and to be frank, a lot of it goes over my head.

However, from what I'm understanding, this makes Heartbleed look like a papercut.

<comment><USER2> I'd say Heartbleed was worse. This one requires local code execution, whereas Heartbleed was "connect to any OpenSSL-using server, send a magic packet, and read the private keys from its memory."

<comment><USER7> The difference is scale. OpenSSL was on a lot of servers, but this affects literally every device manufactured in the last 9 years or so. A well-crafted virus could infect nearly any computer and exploit it reliably. We're talking billions and billions of devices, as opposed to millions by Heartbleed.

<comment><USER8> AFAIK, this only allows read access of a host machine. How would it allow a VM to write to its host?

<comment><USER7> From my understanding, the VM can exploit it too via executing a crazy amount of syscalls. I may be misunderstanding, but if that were not the case I doubt that AWS would be forcing quick reboots of a ton of its VMs.

Edit: Wait, sorry, I misread. Read is all you really need, write would just be a cherry. If you can read the memory of the host kernel, then you can gain access to any other VMs on the system. This one is bottom-up, you need access to one system and in theory you can gain access to thousands.

</comment></comment></comment></comment></comment><comment><USER9> ...I am mildly amused that in its logo, the Spectre is brandishing a stick. (And I am mildly chagrined at how long it took me to figure out why)

<comment><USER10> It's easier to figure out if you call the stick a branch ;)

</comment></comment><comment><USER11> Admins: this is flagged as dupe, probably should not.

</comment><comment><USER12> Any good sources of typewriters?

<comment><USER13> A typewriter is likely even more susceptible than a computer keyboard to a listening attack:

[https://freedom-to-tinker.com/2005/09/09/acoustic- snooping-t...](https://freedom-to-tinker.com/2005/09/09/acoustic-snooping- typed-information/)

Has anyone applied similar methods to pen on paper?

</comment></comment><comment><USER14> I am bracing for impact...</comment>


Show HN: Dopamine Blocker – break your Facebook habit - <AUTHOR> Hey everybody, I threw this together yesterday as a side project to make my first chrome extension.
https://chrome.google.com/webstore/detail/dopamine-blocker/c...
Dopamine Blocker is a tool to help break your social media addictions. Every time you visit your favorite social media site, your brain gets a hit of dopamine that keeps you coming back again and again.
Dopamine Blocker attempts to breaks that cycle. Now, instead of getting a hit of dopamine when you visit the social media site, you will be faced with an annoying alarm and a rapidly moving page that is hard to read. Your brain won't get the dopamine you crave and you will hopefully stop subconsciously associating social media sites as a dopamine source.
Currently works with: Facebook, Hacker News, Reddit, Twitter, and Youtube.
Each site can be turned on and off in the options page for this extension.
Let me know what you think! <comment><USER2> I don't wish to create offence, but your website[1] looks amateurish and untrustworthy. This is relevant because your extension requests access to read and change the data of every website I visit, making me wary of installing it.

I really think you should open-source this, so we can at least audit/fork the code. Also, it'd be useful if we could add any domain to the extension.

I'll end saying I like the idea and find it intriguing. I'd like to see some research into this to see if it works.

[1]: [http://www.creativeapestudios.com/](http://www.creativeapestudios.com/)</comment>


Ask HN: What perks do you want when looking for a job? - <AUTHOR> <comment><USER2> Companies chronically escape from offering real "perks".

Instead they insult their employees with ping-pong tables and snacks and Xbox.

Even the famous "unlimited vacation" is a complete and utter scam to shame and guilt people and also to avoid having to pay for accrued vacation time that normally you would be entitled to.

Some even list their garbage noisy open office as a "perk". Yeah Bob it's a great perk for employees to have to use noise cancelling headphones to get their work done while everyone "collaborates" about TV shows.

First they pick something that benefits them, then they reverse engineer some kind of happy story about how it's really a perk for their employees ... let's save some money on office space because .. uhhh ... "collaboration!" yeah that's right ... SO GOOD!

Let's save more ... you don't really need that desk all the time eh? HOT DESKING. So HOT! So FLEXIBLE! you're welcome.

Vacation? easy! unlimited! just take "what you need" wink wink ([http://archive.is/ByJ8X](http://archive.is/ByJ8X))

The situation has turned so bad that even the very basics can be considered perks.

Like .. uh ... a quiet fucking office with some sunlight, you know ... for getting work done?

If they were actually interested they could offer lots of genuine perks.

For example one week extra holiday on top of what the minimum is (government requires 4 weeks? offer minimum 5 weeks in good faith)

Another one, establish and enforce a culture of not working overtime. For example if everyone is working 9 to 5 at a company, have a culture of kicking everyone out and shutting down at 5 unless in very very exceptional cases.

Wanna go further? Make remote a thing. For example if it's a traditional Mon- Fri 9-5 shop, establish remote Wednesdays for anyone who wants it.

Another one? Reduce work hours by 1 hour every day. Instead of 9-5 make 9-4 the standard in your company.

Wanna show you really mean it with the perks? Keep the market salaries and make the work week 4 days. Anyone fortunate enough to work for your company gets Wednesdays off.

Admittedly some of those are quite bold but I think they only sound so bold because no one is even trying to actually offer tangible perks. Many companies have enough fat that they could afford it.

<comment><AUTHOR> I read that some companies offer fruits and coffee all day in the office as benefits!

</comment></comment><comment><USER3> Right now I'm looking for remote-allowed and flexible hours. I've learned through experience that I can't deal with 5 days a week at a cramped office in a cubicle. Health benefits are obviously nice too and large vacation time :)

</comment><comment><USER4> I'm aware that I'm unlikely to ever find another job with the same perk, but I'm ever to go looking for one, I'd really like to have a private office (with a door! and windows!) like I do now.</comment>


Is there still room for debate? - <AUTHOR> https://nymag.com/intelligencer/2020/06/andrew-sullivan-is-there-still-room-for-debate.html <comment><USER2> It started with not allowing anyone to agree or even argue that vaccines cause autism because people can die if they believe they shouldn't get vaccines. Then, we couldn't argue that the Holocaust didn't happen because that could give rise to a new Holocaust. Then, we couldn't argue that Black crime was self-inflicted. Now, we can't argue that police brutality is overstated.

In each case, I tend to agree with the mainstream opinion. However, I only got to be that way because I heard both sides' arguments and came to my own conclusion.

There is an idea that these ideas are inherently dangerous and that holding these ideas could lead to lives lost. While that may be true, entirely censoring one side of a discussion makes everyone feel like evidence is being withheld and suspicion only grows. Even worse, ruining lives by doxxing is what was sought to prevent by stifling discussion in the first place.

The only way forward is to accept that these ideas must be openly discussed, no matter how dangerous the opposing conclusion may be. If the truth really is self-evident, then there is nothing to fear, provided all sides are afforded ample opportunity to make their case. Otherwise, perhaps those who seek to censor are not, themselves, as correct and righteous as they might think.

Edit: Even the Amish let their kids roam free temporarily in Rumspringa so that they don't feel like they're missing the truth.

<comment><USER3> I don't agree fully with your explanation as I don't think the problem has been posed, in general, in terms of avoiding putting people's lives in danger. The issue is instead that empathy has become the attitude and quality that needs to take precedence over any other, including any amount of skepticism, inquisitive attitude and reason.

We have become a world where the ultimate element of truth are someone's subjective feelings (usually negative) as the person reports them. (Google finds 3710 results for the exact phrase "I was in tears, shaking" which is not a bad number for such a precise description of an extreme state of distress). The problem with this is that of course, when you state a fact, it's possible to debate its truth rationally; but no rational debate is possible about a subjective feeling (short of calling the person reporting it a liar).

For example, the problem that led to the sacking of the NYT's opinion editor over Tim Cotton's piece is not that the piece itself was putting lives in danger- that could have been up for debate; it's that some people objected that they _felt_ it was putting lives in danger. While you could argue that stopping violent demonstrations is meant to preserve lives, the _feeling_ is instead outside of any rational debate- you cannot argue that I'm not feeling what I say I'm feeling.

So now whoever has a grievance or feels to have been wronged or is afraid of something, can claim his or her own feelings as the ultimate proof of the fact. It should be obvious to everyone that feeling something, being totally certain of it, doesn't really prove anything, that the whole point of discussion and rational inquiry is to separate what we feel from what is actually true. But refusing to fully acknowledge someone's negative feeling has become the ultimate sin.

We used to negotiate negative feelings with others; sometimes this would bring acknowledgment, but other times sharing and debating them could actually help seeing a different side and attenuate them, or even change our attitude and make us grow. But when every single negative feeling is invariably received as the ultimate proof of a valid grievance, a positive feedback cycle starts: I only need to say how bad I feel to be comforted and assured that I am in the right and something is owed to me. This cannot but lead to an explosion of grivances. Which is what we're seeing now.

<comment><USER4> >> The issue is instead that empathy has become the attitude and quality that needs to take precedence over any other, including any amount of skepticism, inquisitive attitude and reason.

This is the key point.

What I don't get is how it ended up this way? A person might empathize, but why should it take precedence? And if indeed it did, why doesn't that person's skepticism or criticism hold the same weight? Why should that get disregarded?

<comment><USER3> From one side empathy is a very popular emotion; trash tv for example has always been peddling in cheap empathy. I suspect that for a vast majority of people empathy comes natural, while logical analysis requires an effort. We had established venues in which rational discourse was the only acceptable way of addressing issues, but social networks have lowered the bar of entry into the public debate and given everyone the means to participate- all the competence needed being that of clicking a like or retweet button.

Empathy also allows to hide your own personal issues behind the very handy screen of someone else's emotions. "Will someone think of the children", "what about the elderly" are a classic examples of a mechanism allowing you to disguise your personal attitudes (for example homophobia, prudishness, fear of change) as an altruistic attention to someone else's needs, again without the need to provide any kind of rational explanation. So whoever has personal issues with something doesn't need to argue for it any more, they can just point to someone else's distress and ask to empathize with it.

<comment><USER4> So, essentially, as discourse becomes more visible to a larger section of people, that discourse then has to pander to the more trivial, petty or rather those emotions which require lesser effort.

The social networks rely mostly on network effects. There is really no way to, for example, discern, prior to a person joining a network, whether they are actually qualified to be able to participate in it. Sometimes, the network is visible, for example, a forum whereas there is a very low barrier of entry in terms of membership.

That is interesting to think about!

Your second point, I think, ties up to the first. Those people, who out of inclination, capability or training, are unwilling, incapable or unable to exert the effort rational analysis, will end up resorting to, as you say, "hide personal issues behind a show of empathy".

There is one more point I'd like to add though. In circles where a high amount of training is required, not only is it not possible to contribute in a meaningful way, but also there was no inclination for anyone to opine about others' comments. Whereas now, any statement, any remark, any comment, anybody feels that they can comment, criticize, or debate about. That is, the earlier inhibition, or should I say humility, seems to be disappearing. This is, in my opinion, is another reason for deterioration of debate and discussion.

Probably along with this, I'd like to add this quote from another comment in a different HN thread [0]. >> Cynicism tends to look smart to outside observers

Thank you for the wonderful and thought provoking discussion.

[0]: [https://news.ycombinator.com/item?id=23137990](https://news.ycombinator.com/item?id=23137990)

</comment></comment></comment></comment></comment><comment><USER5> According to an African-American prof of history at Berkeley, the "marketplace of ideas" in his department has become a totalitarian command economy: [http://web.archive.org/web/20200611111027/https://pastebin.c...](http://web.archive.org/web/20200611111027/https://pastebin.com/WBzAFDgA)

</comment><comment><USER6> nuance and complexity are self-censoring.

any position that doesn't losslessly compress into a chant or a rally cry or 240 characters is effectively censored by its own unfitness for the infrastructure of mass propagation.

like the demotivation poster quip, none of us is as dumb as all of us.

it does not matter that there is structural promotion of epistemic shallowness on both/all sides of hot-button issues, because there is, and it's getting worse as the noise floor steadily rises. swing a dead cat and hit a dozen informal fallacies in all directions.

what does matter is that, in most cases, only one side is openly indulging and channeling our most degenerate impulses of cruel-mindedness and domination. eventually the other side may be forced to do the same.

<comment><USER7> Great point on the self censoring of nuance, also that quip is hilarious :)

</comment></comment><comment><USER8> I don't find this comparison of "cancel culture" or "performative wokeness" to living in a totalitarian state very persuasive. People who are losing their jobs over voicing a controversial opinion are not facing anywhere near the same kind of oppression as those who face imprisonment for speaking out against the state.

It's notable that the examples Sullivan cites held or hold fairly high-profile positions in the first place. He's not exactly talking about the struggles of the average person here. I understand that the intelligentsia is the environment in which he lives, so it's natural he would be more familiar with and identify with others in that class, but it still comes across as out of touch to me. Most Americans did not attend university, and do not read the New York Times.

Despite its many flaws, one thing that America very much still has going for it - and I'm glad Sullivan at least recognizes this - is a free press. For sure the press follows trends and reports on issues through some lens of bias, but people can still publish independently, and they are largely free to say whatever they like to whoever wants to listen. It's hard to overstate how much of a difference that makes. The fact he is able to write his column and we are able to discuss it shows that he is not - in fact - living in a totalitarian state.

</comment><comment><USER9> It's mentioned at the beginning of the article, but Vaclav Havel's "Power of the Powerless" and particularly its parable of the greengrocer is worth a read:

[https://hac.bard.edu/amor-mundi/the-power-of-the- powerless-v...](https://hac.bard.edu/amor-mundi/the-power-of-the-powerless- vaclav-havel-2011-12-23)

</comment><comment><USER10> This part seems true and seems to be easier for non-Americans than Americans to see, which I suppose is not surprising.

 _Americans have always been good at policing uniformity by and among themselves. The puritanical streak of shaming and stigmatizing and threatening runs deep. This is the country of extraordinary political and cultural freedom, but it is also the country of religious fanaticism, moral panics, and crusades against vice. It's the country of The Scarlet Letter and Prohibition and the Hollywood blacklist and the Lavender Scare._

The "puritanical streak" is making one of its periodic historical comebacks right now.

</comment><comment><USER11> As usual, Matt Taibbi nails it.

[https://taibbi.substack.com/p/the-news-media-is- destroying-i...](https://taibbi.substack.com/p/the-news-media-is-destroying- itself)

</comment><comment><USER12> Nope. We've lost the ability to criticize an idea without the other side assuming it's an attack.

I say De-fund/Disband the Police is a stupid idea to the wrong person, I get branded as a Republican/Trump Supporter/Nazi/Bootlicker. There is a chance my professional career would end.

I say being transgender is weird or something to the wrong person, I get branded as a homophobic bigot. There is a chance my professional career would end.

Those are two hot button issues that I just came up with due to the news. There's a reason I don't have a public profile associated with myself. The wrong person sees something, and they're up their ass just enough, something can be taken out of context and used to destroy my future.

I'd rather be two-faced then risk what I've built.

<comment><USER13> It depend on your position. Some sensitive topics are okay at some levels of your career (like when you're a student or entry-level employee), while other topics are basically fire-able offenses for people in semi-public roles like startup executives, academics, politicians, directors of various non-profit organizations including sports clubs, partner-level people at white shoe firms including VC and law, or middle managers and above at larger companies.

For the latter group, more things are sensitive: the seriousness of the pandemic, nature vs nurture for certain skills/intelligence, being dismissive about ethical issues (robotics, computer vision, privacy, etc.), border control and foreign policy in general, saying the wrong thing about minimum/living wages, usual hot topics like abortion and gun rights (especially during some news cycles), opinion about public funding for certain institutions, agreement with diversity/inclusion initiatives, opinions about laws around discrimination, and taxes and social welfare.

</comment></comment><comment><USER14> "that journalism needs to be rebuilt around that moral clarity, which means ending its attempt to see all sides of a story, when there is only one, and dropping even an attempt at objectivity"

So, what all encompassing media are they referring to here? Fox News? OAN? Reason? Obviously not. Just the fact that FN itself is the most watched cable news source makes this whole premise rather dubious.

</comment><comment><USER15> The short form, as an overall answer to his article: No.

The longer form answer: His article makes several mistakes about the US and ignores the bloody and dark history that we have _today_. I frequently see this sort of ignorance (whether feigned or not) in these sort of arguments because people are convinced that we're somehow past a lot of these issues. We're not. There's this terror of a new 'liberal orthodoxy' while we see black men beaten and killed by the police, rights taken away from LGBT people and more. Rather than fear the government boot coming down on people, they fear the people showing rightful anger against the government doing something about it.

One of his first claims is

>And we are not defined by black and white any longer

If you were to ask a black man this question, the answer would likely be far different. He says that we have 'no secret police', but ask someone who's had experiences dealing with ICE or someone who's been harassed by the police solely because of the color of his skin. Ask any of the women who've had to deal with sexual harassers and predators in their job. You'll find out that there exists two Americas: One for a very specific type of citizen, and another for the rest of us.

Anger is never simply the result of people living in luxury and opulence. Anger is a build up of pressure among the people. And people are angrier than ever because these problems have persisted for decades and have kept persisting.

<comment><USER9> > His article makes several mistakes about the US

Such as?

</comment></comment><comment><USER16> People think that arguments gain status because they're heard outside of their merit.

People also think that they're able to judge what arguments will fool other people while still be fooled themselves.

</comment><comment><USER17> > The reason some New York Times staffers defenestrated op-ed page editor > James Bennet was that he was, they claimed, endangering the lives of black > staffers by running a piece by Senator Tom Cotton, who called for federal > troops to end looting, violence, and chaos, if the local authorities could > not. This framing equated words on a page with a threat to physical life — > the precise argument many students at elite colleges have been using to > protect themselves from views that might upset them.

Hold on now: words _do_ incite violence. Media _does_ incite violence. Remember how it became standard practice to not publish the names of mass- shooters? That's because copycat crimes ARE a thing, and because quite a few school shooters and the like mention getting their face in the news as one REASON for doing the shooting.

So, as a journalist you ought to _inform_ me. Give me an accurate picture of what people outside my bubble are seeing and thinking right now. But you absolutely cannot claim to not be responsible for the consequences of your words. That's why journalism has to be so nuanced.

> In these past two weeks, if you didn't put up on Instagram or Facebook some > kind of slogan or symbol displaying your wokeness, you were instantly > suspect.

I didn't do any of these things. I wasn't harassed. Nobody cared.

> That's why this past week has seen so many individuals issue public > apologies as to their previous life and resolutions to "do the work" to more > actively dismantle "structures of oppression." It's why corporate America > has rushed to adopt every plank of this ideology and display its allegiance > publicly.

What happens when a company doesn't voice support of BLM? Do they get harassed on Twitter? Did you know that the tweets on Twitter only represent about 2% of Americans [1]? I wonder how many sales you actually lose if 0.01% of those Twitter users bash on you for a single day and then forget all about you by the next day.

> We have employers demanding our attendance at seminars and workshops to > teach this ideology.

This concern, I can appreciate. But in the same angle as my previous paragraph, most employers haven't demanded these seminars. I imagine you're looking at that 0.01% and letting it get to you again. Also, what happens when you decide to silently not attend these seminars? I'll bet a lot of these mandatory seminars become not-so-mandatory once you quit tolerating your employer's BS.

But again, let's be nuanced. My work is my contribution to society. I _absolutely_ want my contributions to society to be nuanced. You won't find me working for the NSA. You won't find me working for a petro company. In fact, I'd quite like it if the company I'm working for refused to sell their product to either of those two things, because that's an easy thing I can do to limit some of my greatly negative contributions to society.

So IF the majority of an organization wanted to focus on doing some small thing to address police brutality or systemic racism (like, actually, and not just as a show), and they go about it at an organization-wide level, would that be a bad thing? That kind of just sounds like being principled, which I'm pretty on board with. It'd be cool to have more opportunities to work for an organization that care about their contributions to society beyond what's measured by money.

> And then his tone-deaf, tin-pot dictator act in reaction to the Floyd > protests and subsequent riots put him beyond the pale for many of the > persuadables. Left-wing activists, for a change, didn't play into his hands > — although they're doing their best in Minneapolis and Seattle.

Have you been to the Capital Hill Autonomous Zone (in Seattle)? Or have you only seen what's portrayed of it in the media (TV, Twitter, etc)? Spoiler alert: I've watched what's on Fox, I've watched what's on Twitter, I've watched what's on the local news, I've been there in person: each medium portrays a significantly different view of things. You can't really put more than 20% of the blame on the people on the ground for whatever image Seattle's developed. The media is so much more responsible for what things look like to everyone more than a mile away from events.

\-----

Anyway, my answer is yes: there is still room for debate. Do you have friends? Do you talk to them? It turns out that most people I talk to in real life actually have decently nuanced views! And a number of them are willing to discuss those views with you, and they might even ask you for _your_ thoughts if you show that you understand them.

Mass media is the problem. The one-to-many broadcast style of "dialogue" is the problem. 280-character limits are the problem. Sending your thoughts _to the whole world_ and then being surprised when more than a handful of people disagree with you is the problem.

[1] [https://nypost.com/2019/04/24/twitter-doesnt-reflect-how- mos...](https://nypost.com/2019/04/24/twitter-doesnt-reflect-how-most- americans-think-study/)

<comment><USER3> > Hold on now: words do incite violence. Media does incite violence.

Words and media _can_ incite violence. Now that you've stated this fact, it's still up to you to argue that a particular op-ed is inciting violence and, in case, whether that violence can be worse than the violence its author says he wants to prevent or stop.

See? Now we have a debate. You argue some facts, and you have to prove them rationally. Convince others. Find answers to counter-arguments. Bring data. Maybe discover you're wrong after all.

</comment></comment><comment><USER18> ... he asks, in his column in a prominent national magazine.

<comment><USER10> That's not much of a counterargument. The question could be phrased as "How much room is there still for debate?" and the answer is clearly: less and less, and dwindling rapidly.

</comment></comment><comment><USER19> No.

<comment><USER20> The title of the article, with your reply, succinctly describe the time we're in.

</comment></comment><comment><USER21> Why are we debating if anti-racism has gone too far? In the last two weeks local, state and federal police and soldiers were tear gassing, firing rubber bullets and beating peaceful protestors up.

Being assaulted and arrested by the police for free speech is a clear first amendment violation. Being fired for saying something racist is much more constitutionally (and morally) ambiguous.

<comment><USER9> The author's point is that "racist" is being stretched to include being neutral: if white silence = violence, then you're now a racist if you don't actively plaster your social media with BLM slogans. "If you're not with us, you're against us! Burn the witch!"

<comment><USER22> _> Burn the witch!_

Indeed. The article makes the same comparison:

"It is the same circular argument that was once used to burn witches. And it has the same religious undertones."

A lot of what is going on now can be seen as evidence that we are living in a new Puritan theocracy.</comment></comment></comment>


Linux Kernel Maintainer Statistics - <AUTHOR> http://blog.ffwll.ch/2018/04/maintainer-statistics.html <comment><USER2> I'm curious if the maintainer stats include demographics such as race, gender, etc. An open project where anyone who wants to contribute may do so would provide a sociologically interesting set of data points which could be useful in targeting STEM curriculum or highlighting success stories we don't yet realize.

<comment><USER3> There's no one keeping track of that as far as I know, but the group picture of kernel maintainers (just picked the first one google brought up) is fairly informative on your questions.

[https://lwn.net/Articles/705244/](https://lwn.net/Articles/705244/)

I wouldn't say that the kernel community is a success storie in this regard ...</comment></comment>


Using Sleeper Cells to Load Test Microservices - <AUTHOR> https://www.sumologic.com/2015/06/22/sleeper-cells-for-microservices/

<comment><USER2> +1</comment>


A Norwegian island wants to be the world's first time-free zone - <AUTHOR> https://www.insider.com/norway-island-sommaroy-wants-to-be-worlds-first-time-free-zone-2019-6 <comment><USER2> Well this is "do-whatever-you-want-at-whatever-hour" than eliminating all concept of time...</comment>


Amazon GuardDuty – Continuous Security Monitoring and Threat Detection - <AUTHOR> https://aws.amazon.com/blogs/aws/amazon-guardduty-continuous-security-monitoring-threat-detection/ <comment><USER2> This is a really good addition. AWS has all this data, so it's good to see they're putting it to good use. We had just launched a service called CloudSploit Events [1] that does much the same thing, but I think now we'll be able to treat this as an additional data source to build out our report data using the machine-learning and vast expertise of AWS.

[1] [https://cloudsploit.com/events](https://cloudsploit.com/events)

<comment><USER3> How much of your product can customers self-host? I know the scanner is at least partly available as open source, but we would want support.

<comment><USER2> Technically you can host the scanner yourself by running it as a Lambda function, but we don't have a full featured AMI/self hosted installation with the dashboard and other components at this point. We have done support-only deals in the past where we'll support your use of the open source scans, but full disclosure, you'd be missing out on a lot of the UI and API pieces that the SaaS has. Other companies have taken the open source part and run it entirely on their own with their own added tools, so it is possible. Happy to answer more questions or you can reach out to firstname.lastname@example.com and we can discuss the options if you're interested in going that route.

</comment></comment></comment><comment><USER4> The pricing page [https://aws.amazon.com/guardduty/pricing/](https://aws.amazon.com/guardduty/pricing/) is a bit confusing.

"First 500 GB / month, $1.00". Not bad! <Looks at pricing example>. Oh... $1.00/GB :)

On the other hand, 250GB of only VPC flow logs sounds really high to me, for the "small" environment example.

</comment><comment><USER5> Just enabled it for our account (incredibly easy, single-button activation), and by morning we had results showing some minor vulnerabilities in our public subnets that we were able to patch immediately. Highly recommend.

</comment><comment><USER6> Can anyone explain how this works? They're scanning logs of what? Suspicious interaction of a service, or suspicious command line fu? You know, for science.

<comment><USER2> They're ingesting several data sources, including CloudTrail (IAM events in the account) and VPC flow logs (network activity) to look for suspicious behavior. For example, if someone disables CloudTrail logging, that API event is suspicious, especially if it comes from outside your organization. If your EC2 instances start pinging known Bitcoin mining servers, that's probably something you want to fix as well.

</comment></comment><comment><USER7> From the title I was hoping for security event tracking/categorization for video feeds like Google Cloud Video Intelligence.

</comment><comment><USER8> It seems very similar in scope to Amazon Macie - it would be good if they mentioned how the two services are different.

<comment><USER3> GuardDuty and Macie are complementary. GuardDuty primarily covers network, Macie covers CloudTrail events/anomalies and S3 content policies.

</comment></comment><comment><USER9> Are these flow logs generated for an AWS account even if one doesn't use GuardDuty?

<comment><USER10> VPC flow logs can be created a subnet, eni or the whole VPC.[http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-l...](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow- logs.html)</comment></comment>


Thinking is everything. A bright future means clear thinking - <AUTHOR> https://medium.com/@abraxian/thinking-is-everything-a-bright-future-means-clear-thinking-2d16a0433954 <comment><USER2> The problem with this whinging narrative is that it ignores the humbling reality that someone must first attest 'rightness' for the bulk of uninterested/uneducated society. That chore is inherently political and therefore unrealistic to expect impartially executed.</comment>


Scientists uncover exotic matter in the sun's atmosphere - <AUTHOR> https://phys.org/news/2019-05-scientists-uncover-exotic-sun-atmosphere.html <comment><USER2> The "exotic matter" is plasma. Since the entire atmosphere of the sun (the corona) is plasma the headline is about as relevant to the study as saying that scientists studying hydrology have found water.

<comment><USER3> At least some people are willing to use the word, now. Until recently you would be ostracized by other astronomers for mentioning it. (Thus, "hot gas".)

<comment><USER2> Astronomers consider Nitrogen and Carbon to be metals. Their jargon is very particular to astronomy, and they seem to love using words in ways different from how the rest of the scientific community uses them.

<comment><USER3> While that is true (anything not H or He is "metal") they have long had a sort of guild requirement that every phenomenon must be explained with nothing but heat and gravitation; if a magnetic field is invoved it has to be generated by a massive body. Anything that can't is not to be discussed, because plasma dynamics is too hard.

The wall is starting to crack, though.

</comment></comment></comment></comment><comment><USER3> > ... plasma remains a mystery, mainly due to its scarcity in natural > conditions on Earth ...

I guess a candle flame isn't strictly natural, but a forest fire is. I don't encounter forest fires every day, but I daresay more than one is burning somewhere right now.

Tornadoes also tend to plasma, although you won't find a meteorologist who will discuss it.

But, yes, we generally try to stay clear of plasma events. They tend, inherently, to unpredictability.

<comment><USER4> Is fire plasma?

<comment><USER5> Any of our resident scientists are welcome to correct me if I'm wrong, but I believe that most plasmas require _much_ higher temperatures and pressures than a regular fire like a candle can create.

The light we see from flames is mostly just photons emitting from the hot gases and other products of the combustion reaction, as far as I know.

<comment><USER3> Yes, light is 100% photons, or your money back.

Considering that the overwhelming majority of the plasma in the universe is in interstellar space: no, extreme pressures and temperatures are not necessary.

The absolute requirement is an ionization rate of more than 0.01%: more than one ion per 10000 neutral atoms. (Above that, regular gas dynamics don't work, and you need plasma dynamics.) This can be achieved by high-ish temperatures, or ionizing radiation, or various physical processes involving strong and varying electric and magnetic fields.

Plasma dynamics are interesting because positive ions are at least 2K more massive than electrons. Any field that pushes the positive cores one way pushes the electrons 2k times faster in the other direction. Which, of couse generates other fields, and likely x-rays, too.

Whenever you see some astronomy source claiming that x-rays imply a weirdly high temperature, you can be smug knowing that plasma is happy to emit x-rays at any temperature.

<comment><USER5> Thanks for the rundown on plasmas there, that's super interesting. I always enjoy being taught new things, especially about physics!

</comment></comment></comment></comment></comment><comment><USER6> I'm, maybe, unreasonably angry about that headline. I sort of knew phys.org was not a top quality science publication, but _holy shit_.

<comment><USER5> I don't think it's unreasonable at all. When I read "exotic matter", I immediately think of things like negative mass, not comparatively run-of-the- mill solar plasma.

Something tells me phys.org cares more about clicks than accuracy...</comment></comment>