Why JWTs Suck as Session Tokens (2017) - <AUTHOR> https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-session-tokens <comment><USER2> I've read several articles along these lines now I tend to think the arguments are pretty weak.

In this media rich age, the data size argument is a bit silly.

The "you're going to hit the database anyway" argument whilst probably accurate in most cases, doesn't invalidate that JWT allows for one or more fewer database hits on _every_ request.

Having built-in integrity checking is definitely a feature. Just because you can do it without JWT doesn't mean that it's not useful that JWT does it.

IMHO the biggest argument against the use of JWT is that you can't easily invalidate JWT sessions. Should you need to dump a users session or if the information contained in that session token has become invalid then you might be in trouble. For my use cases so far however this hasn't been a problem.

JWT is a fine solution for quite a lot of use cases. As with everything tech, just be aware of the limitations and choose wisely.

<comment><USER3> I have trouble understanding why session invalidation with JWT's is challenging. The JWT itself contains an IAT (issued at time) describing when the token was created. To invalidate all sessions, you can store (in your DB, or other persistence service) a 'invalidated at' date. Any request with a JWT that was issued _before_ this 'invalidated at' date can be considered to be invalid.

<comment><USER4> Sure, but then you're calling your DB to validate the JWT every time anyway. You've just removed the whole "JWTs are cool because they're stateless" benefit.

</comment></comment></comment><comment><USER5> Not a huge fan of this article (despite being a huge fan and consumer of Okta). The author is making a number of assumptions that are bad architectural practices these days. These include: 1) Stateful services everywhere (assuming you always have a database) 2) That you are only doing interactive sessions, and not web services 3) That you have a single issuing authority that is non- federated

For stateful CRUD applications that don't need to scale, and have a centralized authority, by all means, use session cookies.

If, on the other-hand you have a application that needs multiple authentication sources, has a API on the other end that doesn't want to know a separate authentication path, or run stateless functions, JWT is a fairly good choice.

For most modern applications, session cookies create far more problems then the simple universal decision to use JWT across the board.

</comment><comment><USER6> The one example this author gives for an appropriate use of JWTs isn't really any different than his previous ("bad") examples. In it, he suggests the case of an ensemble of services coupled to an authentication service, with an SPA front-end. The front-end obtains a JWT from the auth service and uses it to make API requests of the rest of the ensemble. Because the requests are "small" and "frequent", there's a savings to be had in using stateless authentication for them.

But SPA applications (and, for that matter, classic AJAX applications) have been making small, frequent API requests for 15 years. There is a standard solution to the problem of repeated session database lookups: caching. And in the unlikely instance of an application with significant enough usage that session lookups are problematic but no preexisting caching strategy, the standard answer here is simply to move sessions to a fast lossy database like Redis.

All the previous problems with JWTs remain in play in the author's "good" example.

There are better reasons to avoid JWT than are provided in this article, but it does a fine job of communicating the fundamental nut of the problem. You can _easily_ do better, both for performance _and for security_ , than JWT does. Chances are, your framework's existing session store already _is_ better than JWT. Rails, for instance, has had stateless signed cookies for something like a decade.

We recommend you avoid JWT. If you want to be cool and use a non-default session token format, look into Macaroons.

</comment><comment><USER7> We see JWT a lot. It's usually an accident and not really solving a problem.

Some notes for this blog post:

\- It does not cover the worst issue with JWT (IMO): you don't get revocation by default. Some vendors use JWTs and still have revocation, but they do this via CRL management. CRL management is not easier than a session in a database.

\- In the context of OAuth2, JWT is often a bearer token. This introduces a number of subtle flaws that OAuth1.0a did not have. Notably, in OAuth 1.0a, if I steal your credential for service X, I can't do anything with that without also having service X's credential. In OAuth2.0, it's a bearer token, so game over. You could argue this is an OAuth2.0 flaw -- or perhaps not even an OAuth2 flaw, because OAuth2.0 doesn't force you to do this. But OAuth2 and JWT make it the obvious choice, and so this model is now ubiquitous.

\- It uses the phrase "signing" a lot. In JWT, signing usually means MACing, specifically with HMAC-SHA256. in other contexts "signing" often means using asymmetric cryptography: a separate verification and signing key. JWT supports both -- because JWT, in its folly, supports everything.

</comment><comment><USER8> Comments ITT are not particularly charitable. The author says:

> It's important to note that I don't hate JWTs. I just think they're useless > for a majority of websites.

...and lays out a nuanced perspective of _when_ they're an improvement over cookies at the end.

<comment><USER9> I think anyone who gives an article the now cliche "Why [popular thing] sucks" doesn't care about receiving charitable responses.

His use case at the end is describing microservice architecture. Microservice architecture is trending, ergo JWTs are trending. I don't see the problem.

</comment></comment><comment><USER10> This is ridiculous. It's 2018 and you're complaining about a few MB of bandwidth and a few seconds of CPU time? The whole point of JWT is that they are basically cookies for places where using cookies uniformly is not feasible. The author's solution is to go back to using cookies, which just doesn't work well enough. I'll stick with tokens for now thanks.

<comment><USER11> > ...a few MB of bandwidth and a few seconds of CPU time

Many people are on cell phones with low data limits. A "few MB", let's say 3MB == a few, represents 0.1% of someone's data limit. Sure, it's not that much on its own, but it adds up.

Likewise, a few seconds of CPU time is fine if you're on the latest iPhone, but if you're in a developing country on an inexpensive Android phone that few seconds of CPU time is going to turn into a world of hurt.

This cavalier attitude towards bandwidth and CPU time is outright hostile to certain classes of users.

<comment><USER12> The article mentions 100k page views being ~24MB extra a month, which means we are talking about a token of ~240 bytes. So for a single user you are talking about several kilobytes if they are multiple views to the server, which is now several orders of magnitude less than your original estimate.

<comment><USER11> For this single thing, this is not a big deal at all.

I was objecting to the "It's 2018 and you're complaining about a few MB of bandwidth and a few seconds of CPU time?" statement, not the technical detail of JWT adding an extra ~240 bytes.

I've seen statements similar to this applied to everything from big JavaScript libraries to large "Hero Images" to 2MB GIFs embedded in pages. It's a poor argument and it's representative of an attitude that's hostile to users.

<comment><USER12> The problem is you are talking about a different problem than the OP. The OP was talking about a few MB and CPU _from the server's perspective_, while you are talking about a few MB and CPU _from the client's perspective_. Yes it would be bad to willy-nilly force clients to take on a few MB per request, but that's not the issue being talked about.

</comment></comment></comment></comment></comment><comment><USER13> Very weak reasons for not using jwt. If 24 megs a month is the reason you could easily remove an image from a high traffic page to get the sake savings.

You are hitting the database anyways reason applies to a limited subset of of use cases.

Sessions are simplier use them on multipage websites. SPA or apps jwt is perfect.

<comment><USER14> I like to keep things lean where I can, but saying I have to pay 24mb per 100k requests doesn't sound like a huge deal. And like you say, keeping an eye on your image sizes will net you much bigger savings.

</comment></comment><comment><USER15> One of the biggest downsides in my opinion is that session invalidation becomes non-trivial. Your best bet (assuming you don't want to do any additional network requests) is to reduce the session length to the smallest amount you (or users, depending) will tolerate and perform some kind of re- authentication; i.e. force a logout and do a fresh login or check if they can get a new token based on the old one transparently. For example, a user changing their password should kill all tokens that are in use immediately for good security. You can't do that with JWT. All tokens will stay valid until they expire.

<comment><USER16> I haven't used JWT but the way you solve this is by having a refresh token that lasts several days that lets you "login" without a password. The refresh token is then used to get the real session token with has a low expiration, perhaps 5 minutes. When the session token expires you just "login" again.

But honestly I don't see the need for the vast majority of applications. Most frameworks cache the permissions, etc on login so the database doesn't have to be accessed on every request.

</comment></comment><comment><USER17> « If we store the ID in a cookie, our total size is 6 bytes. »

No. What? No.

You can't compare a signed JWT with a bare user ID. The proper comparison is a signed JWT vs. a cryptographically random session identifier with sufficient entropy. It's _still_ smaller than the JWT, pretty much by definition, but make the right comparison, please.

<comment><USER18> He -does- indicate "For storing a simple user session, that is a ~51x size inflation on every single page request in exchange for cryptographic signing (as well as some header metadata)."

So he admits that the signed part is the tradeoff. But I totally agree with you, barely mentioning that, when that's the whole point (JWTs are used for authentication/authorization, not just easily faked identification), is incredibly disingenuous. Never identify users on the client side with something that isn't cryptographically secure. Somewhere, you or another developer will end up implicitly believing that ID is trustworthy, and you just introduced a critical security flaw.

<comment><USER17> A pretty common approach is to just give the user a version 4 (random) UUID as a session ID, which is 36 bytes in standard format. 304 / 36 = 8.4x, which is a much less impressive inflation.

</comment></comment></comment><comment><USER19> The offered solution to use a centeral memcache/Redis server is exactly why we moved to JWT.

First memcache and then Redis sessions were a continuous centeralized source of failure we could remove, and honestly didn't scale very cleanly approaching millions of users.

Removing moving parts from our stack was a major win.

That's not to say JWT is without thorns, but overall it's better than a centeralized point of failure.

<comment> gm-conspiracy I am curious about your experience with Redis and millions of users...what were the issues you experienced?

<comment><USER19> In particular we weren't storing a ton per session, but were having to spin up more and more instances or suffer port exhaustion.

We go from about 25,000 request a second during the day to 200 at night, and there was no good way we could find to autoscale it.

We scripted the build up process based on time and sometimes it wasn't meeting demand.

It was taking a lot of devops time. I'd had an experimental fork of our application using JWT floating around for a while and my manager made it a priority. It's never needed any maintaince and had been a real improvement for us.

</comment></comment></comment><comment><USER20> Biggest complaints about JWT is the inability to sign out a user. You can, yes, delete the cookie on the client side, but if the JWT is stolen you can't be sure that it won't be used again ( invalidate ).

Same happens on reset password, where by the book you need to sign out the user from every device. Good luck with that having standard JWT implementation.

<comment><USER21> If your using a salt, just change the salt and deploy. We frequently do this and it works great. All existing tokens are expired.

<comment><USER20> So you invalidate all tokens? Or it is per user ID salt. If the latter where do you keep the salts and why not simply having a server side session ID, instead of the salt

</comment></comment></comment><comment><USER22> My employer just started using Okta and I find it hard to take anything they say about security seriously after seeing some of the obvious bullshit in the immediate user-facing aspects of their product:

\- allowing security questions to reset passwords

\- allowing sms resets of passwords

\- allowing sms 2-factor in combination with sms resets

I understand that my company is largely at fault for enabling these, but it's scary that they're even options. It's also pretty stupid that their password requirements are 8 characters, mixed case, and at least 1 number.

<comment><USER23> (Disclaimer: I work at Okta) One thing I've learned at a visceral level is how different threat models are from one organization to the next.

And while I agree that the things you brought up don't meet my personal standards for security, there are many organizations where those features are acceptable given their use case.

<comment><USER22> Under what threat model do you need 2 factor authentication but it's ok if both factors can be bypassed by SMS? There may be some legitimate use cases, but I don't think companies that need to farm out their security to a third party will usually be in the best position to make this call.

<comment><USER23> As I recall, for some consumer facing applications, the concern isn't about targeted attacks, but more about automated attacks that try to re-use passwords. In a scenario like that SMS is to slow down automated attacks.

Keep in mind that I don't endorse that approach! Just giving an example of a narrow case where that applies.

That said, I appreciate your feedback and will personally take your feedback to our product group.

<comment><USER22> That's a good answer, but it doesn't sound like a reasonable threat model for corporate single sign on.

Thanks for taking my feedback to your group. I hope it helps.

</comment></comment></comment></comment></comment><comment><USER24> The reason why you should limit cookie sizes is request round trip.

A typical GET request involves multiple headers, including cookies. Cookies are sent for _every request for any resource for a given domain_. The more cookies you have, and the bigger they are, the bigger your request. The bigger your request, the more likely it is to take longer to send and receive it. The more of them you send, the more latency accumulates.

When The Cookie Crumbles [https://yuiblog.com/blog/2007/03/01/performance- research-par...](https://yuiblog.com/blog/2007/03/01/performance-research- part-3/)

Reduce Cookie Size [https://developer.yahoo.com/performance/rules.html#cookie_si...](https://developer.yahoo.com/performance/rules.html#cookie_size)

Performance Limits [https://stackoverflow.com/a/6963585](https://stackoverflow.com/a/6963585)

</comment><comment><USER25> The model the author is complaining about is far too widespread unfortunately. I've seen a much worse incarnation at a huge corporation that I won't name but whose identity sleuths can doubtless figure out.

Here's how this goes:

When a user authenticates, the system sends them a public key encrypted blob inside a cookie. When the user makes further HTTPS requests the blob will be sent back, the system can decrypt it with the private key and get back the data inside. Components of the system would squirrel away per-user data inside this blob and so the cookie might get updated as they surfed around the site or did things.

One day, people behind a local component using this contraption asked me for some "advice". They'd "filled up" the blob and there didn't seem to be a way to add more data but they needed to store something else, I worked for a different part of the company but I knew about cryptography, what should they do now? They'd found that there didn't seem to be a "cipher mode" option for public key cryptography...

And so that's the point where I couldn't decide whether to laugh or cry, after that I spent a few hours on international conference calls basically telling people that they're idiots and nobody should have even _designed_ this let alone built it.

Part way through that I explained that encryption doesn't magically mean bad guys can't change the inside of the blob AND that it doesn't magically prevent bad guys from stealing blobs they found in one place and using them elsewhere. So what is this even for? In mitigation the engineers who built it explained that, er, actually the first thing they do with the blob after decrypting it is to check their session database to ensure all the data matches up, if not it's invalid and the user just gets logged out silently. Thus, at the end of the day, it's just functioning as a session ID checked against a database anyway. All this cryptographic effort is in fact completely wasted and achieves nothing in practice except to make the system far more complicated and fragile. Brilliant. /facepalm

<comment><USER26> Sounds like a good way for job security.

</comment></comment><comment><USER27> JWTs are good for a bunch of things, one example being when you do NOT want to hit the database on every request, to speed up latency.. eg. in high- throughput IoT setups where you want to validate or discard the request before touching any DB at all

</comment><comment><USER28> With http 2, repeatedly sending the same header value over a persistent connection should cause just a pointer to the previous value to be sent so I don't really buy the size argument here.

</comment><comment><USER29> The unencrypted nature of these is something that gets overlooked a lot of times.

If you are transmitting metadata about some item, such as a song or a video, that's one thing, but when it's user info and the payload is not encrypted, you end up essentially leaking that data.

Other issues arise when you throw in logging and crash reporting - you may not even realize that that JWT session token just got logged and now you have user data where it doesn't belong.

</comment><comment><USER30> Most people here seem to fail to understand that apps rarely get slow and bloated through a single decision. It is tons of 1% or 0.1% decisions. Reading arguments here that this decision doesn't matter for size reasons, decoding performance, etc, is silly. You can argue the same thing about any of the other 100 individual decisions that, in the aggregate, made your app slow and bloated.

</comment><comment><USER31> Besides various other issues (design and implementation-wise) and the fact that it's a useless optimization anyway, minting tokens is just such a headache in general. Avoid it entirely if at all possible.

If you think you need JWTs or similar tech, you don't need JWTs or similar tech.

<comment><USER32> EDIT: I misunderstood what was meant by minting tokens, my entire comment is pointless. Save yourself the time.

What's the headache about minting tokens? You create a new uuid() on the server, store it in the DB in its own table which has references to accounts, keep an isValid field next to it for server-side invalidation, and store it in localStorage in the client. Is there a security flaw or something in this?

<comment><USER31> So you've minted a token, stored that in the DB as well, and every time you see that token you verify the signature and then you look the token up in your DB to see if it's still valid. You do realize that at that point you could've just handed out a random string instead and avoid (1) creating and verifying signatures and (2) the size inflation created by those signatures, because you're not even getting any of the _theoretical_ advantages of minting tokens.

<comment><USER32> It is a random string, I just created it with uuid(). Nothing was ever verified. Is minting tokens an official term that has to do with JWT? I thought it was just short-hand for the process I just described.

<comment><USER31> Minting tokens specifically refers to JWT-like constructions AKA "[probably- RSA-]signed cookies".

Generating a sufficiently (16-32 bytes) long string of randomness and using _just that_ as a session ID stored in a database is a perfectly fine technique, scales well enough and is quite hard to get wrong.

</comment></comment></comment></comment></comment><comment><USER33> I've read so many of these anti-JWT articles, and I don't think I've ever come across a single reasonable complaint against them. What is wrong with people?

I've even read security reports by supposedly reputable security consultants also claiming that JWTs are bad but their arguments are hand wavy and make no sense.

>> Let's say that your website gets roughly 100k page views per month. That means you'd be consuming an additional ~24MB of bandwidth each month.

Negligible.

>> You're Going to Hit the Database Anyway

Yes, but less often. So your DB will be able to service more users overall. For some use cases, we're talking orders of magnitude more users.

<comment><USER34> > I've even read security reports by supposedly reputable security consultants > also claiming that JWTs are bad but their arguments are hand wavy and make > no sense.

[https://auth0.com/blog/critical-vulnerabilities-in-json- web-...](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token- libraries/)

[https://blogs.adobe.com/security/2017/03/critical- vulnerabil...](https://blogs.adobe.com/security/2017/03/critical- vulnerability-uncovered-in-json-encryption.html)

These were critical vulnerabilities enabled by an error-prone cryptographic design that broke real systems.

Don't pretend it's hand-wavy.

<comment><USER33> These are vulnerabilities in specific implementations of JWT. It doesn't make JWT unsafe as a whole.

<comment><USER34> > These are vulnerabilities in specific implementations of JWT.

No, these are vulnerabilities _in the standard itself_.

I outlined the arguments here: [https://paragonie.com/blog/2017/03/jwt-json- web-tokens-is-ba...](https://paragonie.com/blog/2017/03/jwt-json-web-tokens- is-bad-standard-that-everyone-should-avoid)

It's an error-prone cryptographic design that needs to be replaced.

Blaming implementations for faithfully implementing a flawed standard is a stupid thing to do, since it doesn't solve their insecurity.

<comment><USER33> It definitely was an implementation issue. The JWS spec (which is explicitly referenced in the JWT spec) states clearly under section 4.1.1:

'The JWS Signature value is not valid if the "alg" value does not represent a supported algorithm'

Even if you did consider it a flaw in the RFC itself, the fact that there was a flaw once-upon-a-time with a specific aspect of JWT, doesn't invalidate the whole idea of JWTs.

I don't know any major standard that was perfect from day 1. This can be said about TCP/IP (e.g. IpV4 addresses were clearly a mistake). Also, I recall that there were flaws with HTTP1 and that's why HTTP1.1 was released soon after. The WebSocket protocol also went through MANY iterations.

There are use cases were JWTs are necessary. For example, I did some work with real-time presence (to get notifications when users go online or offline); to be able to get the username from the JWT instead of the database saves a lot of database queries and the code is much cleaner since you can check synchronously instead of having to wait. Also, you don't want to waste precious CPU time doing DB queries for connections that haven't been authenticated yet.

<comment><USER34> > Even if you did consider it a flaw in the RFC itself, the fact that there > was a flaw once-upon-a-time with a specific aspect of JWT, doesn't > invalidate the whole idea of JWTs.

The premise that went into JWTs was not invalidated. Their design was proven by multiple incidents to be error-prone, so I sought to replace JWTs.

The result? [https://paseto.io](https://paseto.io)

</comment></comment></comment></comment></comment></comment><comment><USER35> Very good point, thanks for the writeup. Maybe JWTs are good for specific cases but as most people relally use DB for other stuff anyway, it doesn't really bring up any practical advantage. They are just "cool" and look clever so people probably started using them without proper reasoning. This resembles NoSQL and an attempt to burn oldschool SQL servers with hopeless attempts to go back later where more complicated "join-like" requirements emerge.

</comment><comment><USER36> Well, one argument against cookie based sessions is that they get send automatically which opens a large attack vector for CSRF.

(yes, you can store JWTs in cookies too, but that is kinda uncommon)

<comment><USER37> Storing JWT's in a HttpOnly Secure Cookie is common and recommended for Web Apps.

[https://stormpath.com/blog/where-to-store-your-jwts- cookies-...](https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs- html5-web-storage#where-to-store-your-jwts)

</comment></comment><comment><USER38> That was a whole lot of chewing for very little meat. If this article were a tweet, it could've been "use cookies instead of JWT's bc is if all you need is a UUID for a database lookup cookies work just fine, and are prob encrypted using symmetric encryption just like JWTs."

Respect to the author for trying to generate some content for the company blog, but the end result ultimately comes down to a relatively trivial decision in order to save a few bytes.

</comment><comment><USER39> The main and only argument against JWT tokens for me in context of user sessions is that I cannot revoke them if I block user account.

<comment><USER40> Have a relatively short expiration time.

Or, if you want to have more immediate revokes without having a ridiculously short expiration time, keep a list of blacklisted tokens that you clear at least every <refresh time> seconds.

At the end of the day, JWTs still have to be accepted by the server, which you have complete control over.

<comment><USER39> I can't run short expiration times. Well, If I am running distributed system then blacklisting dosen't solve anything for me. I would need to sync blacklists or keep them in database which defeats the purpose of using JWT for sessions already, as I could do what I do now, just keep normal tokens in Redis and check them on every request.

<comment><USER41> Assuming blacklisting happens infrequently, you would have a few orders of magnitude fewer entries and could keep them in-memory on each server and have them fetch them all once every X seconds instead of for each request.

<comment><USER39> A lot of assumptions there to justify using JWT tokens. Unfortunately I can't allow someone that is blacklisted to use the service for X seconds.

</comment></comment></comment></comment></comment><comment><USER42> Really, why ppl keep saying JWT cannot be invalid? isn't it simple enough to use a redis bitmap to store the info? each token only takes one bit, how many tokens you can have, 1 Billion? 120MB is more than enough. What you save here is the time and resource you hit the database.

<comment><USER31> If you have a revocation list for JWT tokens, you could just as well just use session IDs, avoiding all issues with JWTs.

<comment><USER42> But you can not store anything in your session ID. JWT can carry a small amount of data that's need by my service. I only need to validate JWT and check if it's been invalidated. Then I can go ahead to perform by business logic. I don't want to hit db to get all these data. Yes you can argue why not just store them in redis too, but with JWT I only need One bit.

</comment></comment></comment><comment><USER43> "Look, if you just store the user id in an unsigned cookie it's only 6 characters."

Um. Yeah. Also completely insecure.

I know he mentions signed cookies shortly afterwards but the way that part of phrased seriously made me twitch, especially coming from an auth provider's blog.

</comment><comment><USER44> Couldn't this just be an argument against session tokens in general? I don't think I saw anything negative mentioned about JWT that wouldn't be true for any session token.

I guess you could design a binary-first token format that's smaller than JWT, that's true.

</comment><comment><USER45> The size argument ends up being dominant when storing JWTs in browser cookies because cookie storage size per domain is seriously limited. I know Chrome limits total cookie storage to 4kb, including cookie names.

</comment><comment><USER46> How to people usually get around file downloads and initial page loads with JWTs (besides signed urls), since you can't control and preempt these requests to also send the JWT?

</comment><comment><USER47> I learned this the hard way, and a whole host of other lessons trying to ship side projects as fast as possible alongside a full time job.

<comment><USER33> You learned the wrong lesson.

</comment></comment><comment><USER48> I couldn't get a clear answer out of the article: is the author for or against JWTs for authentication purposes?

</comment><comment><USER49> I have used JWTs only for mobile sessions.

Else I opt for the gateway pattern (a service handles authentication and then forwards requests to other microservices).

</comment><comment><USER50> > _In fact, in most web authentication cases, the JWT data is stored in a > session cookie anyways, meaning that there are now two levels of signing. > One on the cookie itself, and one on the JWT._

This sounds like a bug in someone's implementation of JWTs; most JWTs are not signed twice. It's thus not a valid criticism of JWTs.

> _If you're building a simple website like the ones described above, then > your best bet is to stick with boring, simple, and secure server side > sessions. Instead of storing a user ID inside of a JWT, then storing a JWT > inside of a cookie: just store the user ID directly inside of the cookie and > be done with it._

This is conflating two _very_ different things. Sticking with boring, securing server side sessions… sure (though we're eliding how one would actually implement that, but let's assume it's by sending a sufficiently long, unguessable token in a cookie) but then we continue with "just store the user ID directly inside of the cookie" — no! The point of the JWT is the authenticate the user; just sticking a user ID into a cookie doesn't do that; the user could just change the ID in the cookie to whatever, and be done with it. I'd _hope_ the author means "stick the user ID into the session-side storage" (that's associated with the client in some means, likely by an unguessable token as mentioned earlier), but earlier in the article we make the same mistake:

> _If we store the ID in a cookie, our total size is 6 bytes_

Except, no, you're going to need to store that server-side, and send a token, which will realistically be 16 bytes, not 6. The comparison mostly still stands, since there isn't a significant difference between 6 and 16 bytes.

> _For storing a simple user session, that is a ~51x size inflation on every > single page request in exchange for cryptographic signing (as well as some > header metadata)._

It's not a 51x size inflation on every request. That datum is 51x larger, but the request itself includes plenty of other things.

This concern will diminish greatly as HTTP/2 is adopted, I think: HTTP/2 is capable of compressing headers, but in addition to that, multiple requests sending the header can essentially say "let's call this header header #1 and then reference it w/ that number on subsequent requests, _greatly_ reducing the transfer required for common, repetitive headers. If you're on AWS, ALBs support it, so it should be very accessible for most folks w/ browsers. (Client-side programming libraries are another thing, but it'll get there.)

> _You're Going to Hit the Database Anyway_

The point is that you can hit the database one time less; yeah, you _might_ need the user object, but you might not. But the suggested alternative of using server-side storage requires a DB lookup _in addition to_ looking up the user object: we've got to first translate the session token in the cookie into a user ID, and then from there get the user object itself. (Perhaps you can, in some cases, JOIN these if you're using a relational DB; but it still bites you if you don't need the user object, and even if you do, the additional disk read isn't going to be faster than checking a signature.

If you're putting just the user ID in the cookie, and signing it, you're just re-inventing JWTs. Perhaps you'll save a few bytes, but you lose out on what are hopefully more robust, feature complete libraries, and a common, familiar format.

</comment><comment><USER51> tldr; JWTs are a premature optimization (and are often a de-optimization) in the context of user sessions.

That's all the writer is saying, and I think he said it quite well.

<comment><USER35> Yes. It simply doesn't "solve" a particular "need or problem". It just tries to be a fancy modern alternative to tokens not really solving anything.

</comment></comment><comment><USER52> "it's going to be 304 bytes (...) instead of 6 bytes!"

O...M...G... I mean... Let me check again what year it is.

Please stop writing bullshit just because you can have a blog for free...</comment>


How much to integrate a one-page-scroll into an AngularJS single-page app? - <AUTHOR>

How many hours would to take to integrate a one-page-scroll theme into an AngularJS SPA app?
How many hours would you take to integrate a theme like below into a MEAN.io single page app?
For a theme that works exactly like this: http://sveccdesign.com/preview/applight/v2/versions/white/2/
And has a background video on the first slide/page as shown in this: http://themeforest.net/item/wunderkind-one-page-parallax-theme/7601990?WT.ac=search_item&WT.oss_phrase=one%20page&WT.oss_rank=6&WT.z_author=VossenDesign
i.e The first page "index" is the landing page that shows this. And this along with the rest of the application is a single page application. The rest of the app is a different design altogether and this theme is only shown on the "/" route.
A much smaller version for such a mean.io app would be: http://www.breezejs.com/samples/zza
I was asked by a client to do it in one hour into an existing app that was not developed by me, and I could not do it in that time frame - obviously I took much more time and got stuck too dealing with the styling conflicts from the application styles and template styles. Well, that work was allocated to somebody else - and I left the client too.
But, in retrospection, I would like to understand if the the client really made a reasonable expectation. <comment><USER2> What technical skills or how much experience the client have, to say you can accomplish this in 1 hour ? I also question your own experience, why did you get fooled, be more cautious next time, analyse the situation yourself.</comment>


The Robot economy and the future of work - <AUTHOR> https://www.academia.edu/31709922/The_Robot_economy_and_the_future_of_work <comment><USER2> The "robot economy" has certainly failed so far. People are working more than ever and it's a travesty.

<comment><USER3> The problem is that we all need a place to live, want it to be nice and there is a limited supply of real estate. In the UK anyway, a large amount of our free income is devoted to bidding as much as we can afford for nice houses. Since everyone is bidding For the same pool of housing, we end up working as long as we can to out compete each other. We're doing it to ourselves.

<comment><USER4> We have done it to ourselves. Women enter the workplace, up go house prices. Financial deregulation, up go house prices. Low interest rates, up go house prices. Restrictive planning regulations, up go house prices. QE, up go house prices. Help to buy, up go house prices.

It seems we are addicted to it.

<comment><USER5> Profits are up!

Inequality is up!

I mean that those two sentences, repeated over and over in the news weekly, don't make the masses stop and think is a sign that the media machine is doing its job.

<comment><USER6> About 50% of the equities market is owned by households and mutual funds.

</comment></comment></comment></comment></comment><comment><USER7> This article is from 2105. The title should be updated to reflect that.

<comment><USER8> We should listen to the future

</comment></comment><comment><USER9> Note that the author is an Italian scientist/researcher that has been working as Chief Technology and Digital Innovation Officer for the City of Barcelona. [0]

[0]: [https://en.wikipedia.org/wiki/Francesca_Bria](https://en.wikipedia.org/wiki/Francesca_Bria)

</comment><comment><USER10> I am pessimistic but still a little hopeful that we will develop good policy for moving into the future. Getting some form of fare distribution of the technology/ productivity boon will be difficult. I like the article's mention of Soshana Zuboff's "Surveillance Capitalism" which I recommend but if you are short of reading time you can get her message in digest form on YouTube.

Even though the documentary "Living in the Future's Past" is about the environment, it hits great points on how our society is in need of a reset, that we need to all decide what we can do to help society and have a net positive effect on the world. Jeff Bridges and his friends did a fantastic job producing this documentary, I strongly recommend it.

</comment><comment><USER11> [2015]

(and why is this a pdf? it's not even published

</comment><comment><USER12> Academia.edu wants to see and download your contacts. Yeah sure!

</comment><comment><USER13> Socialism is the only answer to the future of work if we want that a majority of people have a good life.

<comment><USER14> That is funny looking at history where it actually never worked, you can have starving people in North Korea vs China which is a not socilism anymore from market perspective... I come from a post-socialist country, and when growing up in the 90s we and 90% of the society was so poor after 50 years of socialism that my parents could not afford a pair of Nike or Adidas. What me and most mates were wearing was Nice and Adidos... as a pair of oroginal Nike was like 1/3 of my mum or dad salary. So I'll never say yes to any socialist ideas! As these ruined several countries: Cuba, North Korea, Venezuela, Russia, Albania, Yugoslavia, Poland and at least a dozen of other countries from the other side of the Iron courtain.

<comment><USER15> I think that the parent poster was most likely referring to democratic socialism as practiced in much of the EU and Nordic countries as opposed to totalitarian communism or Stalinism as practiced in the countries that you listed.

<comment><USER16> The Nordic countries are not socialist. They have not seized the means of production and handed it to a poorly-incentivized bureaucracy that claims to speak for the public.

If you have private ownership of production you are still capitalist. All the Nordic countries do this. They are not so much socialists as welfare states. If we must have a welfare state, I would much prefer the "citizens as shareholders of the country" model with a basic income, rather than the overweening paternalism of current welfare states.

</comment></comment></comment></comment><comment><USER17> I have no conclusion on this topic but I think it's a species wide existential question.

There was a time when you barely had enough time or energy to ensure survival. Doing less was an obvious optimization. But now I think we're pushing the system on the opposite limits. Doing nothing is also detrimental.

<comment><USER18> Losing physical work won't be detrimental, it's something no one likes and no one is particularly good at, losing creative work would be but it doesn't look like we are particularly close to creating ai, and when we create it we'll find some way to stay at the center of it by either creating devices that augment our brains, changing our brains to be as good as the ai, or simply uploading into computer and becoming part of ai.

In any case there is so much work in science, that we should be happy for every human that is freed from physical work.

<comment><USER19> Physical work is creative. Wielding the body takes intelligence and is improved incrementally by trial and error. People can and do take pleasure in it. Robots are merely an extension and enhancement of the bodies of their operators. (So the perennial fear of robots 'taking over' amounts to saying that bodies will somehow take over.)

It's not about being free from physical work, it's about choosing what problems to work on -- before other problems choose you! In most cases people who work a job are having their problems chosen for them. So they are still, in this sense, slaves.

And this is itself a problem. We haven't found the solution yet. But we may...

<comment><USER17> Using your body and mind is maybe half of life. The problem is the context in which you do so. A balance between selfish~ pleasure, altruistic pleasure (social role) is necessary. When so I'm sure most people are highly happy.

</comment></comment></comment></comment><comment><USER20> Yet another stupid article as many not talking about progress and future but only about money, money, money. Those kind of people were laughing about cars being slower than horses.

Automatisation should be priority of everybody unless people want keep being slaves and keep shitty jobs that they don't like, keep living poor and hungry.

Job is demand - if demand for something will be satisfied that doesn't mean everyone will take it and don't want anything else.

The best basic example I know is bread. Someone want white bread, someone dark bread other ones want sweet bread.

I have a small experiment for You reading this shitty comment, try to find exact number of how many types of bread people are buying and making around the world right now. Can you do that because I can't (Why ? One word - entropy).

We are people for god sake not animals so maybe it's time to start behave like one, don't you think ?</comment>


Euclideon (Infinite Detail) Responds to Notch - <AUTHOR> http://www.hardocp.com/article/2011/08/10/euclideon_unlimited_detail_bruce_dell_interview

<comment><AUTHOR> Unfortunately, they do so rather poorly, and they do it as a 40-minute video interview. They also don't provide any useful or meaningful refutations.

Things they have yet to demonstrate:

      Animation in a remotely current version of the engine
      Animation of more particles than comparable technology (Atomontage)
      Dynamic shadows or light sources
      A world composed primarily of non-duplicate objects</comment>


Older users share more misinformation. Your guess why might be wrong - <AUTHOR> https://www.technologyreview.com/2020/05/26/1002243/misinformation-older-adults/ <comment><AUTHOR> My guess why, also based on no data whatsoever:

1\. Older people grew up in an era where news sources were trusted as platforms that reported facts. But now most news sources are optimized for user engagement, which are most effective when delivering divisiveness, outrage, and fear mongering.

2\. Older people have more time to watch the news, and thus the effects of prolonged exposure to such negativity has more of a chance to shape their views.

But who knows what the real truth is without more research?

<comment><USER2> Another factor may be that older people have seen so much nonsense that they've become more skeptical of the "official" narrative. I know this has happened with me. I don't go in for conspiracy theories but I can see how similarly disillusioned people with less developed critical thinking skills could be tempted by them.

<comment><USER3> I've become skeptical of everyone's narrative, if anything, but why would a person realize the official narrative is usually a lie, and then go on to trust someone else or some other group blindly? My guess would be binary thinking (it's always gotta be liberals vs conservatives for every argument), the misapplication of the law of the excluded middle (maybe there's a multitude of answers on a scale of correctness, not just two: right and wrong), and other fallacies and things like that.

The article actually doesn't answer the question, it's just a mix of random words and ideas about why it could be that older people share more misinformation with some incredulity towards 'ageism'.</comment></comment></comment>


Lessons of Immortality and Mortality From My Father, Carl Sagan - <AUTHOR> http://nymag.com/thecut/2014/04/my-dad-and-the-cosmos.html

<comment><USER2> The Sphinx Head Tomb is an interesting building in a very pretty spot:

[https://maps.google.com/maps?q=ithaca+ny&hl=en&ll=42.452685,...](https://maps.google.com/maps?q=ithaca+ny&hl=en&ll=42.452685,-76.490084&spn=0.000761,0.000887&sll=47.272986,-120.882277&sspn=6.970159,16.907959&t=h&hnear=Ithaca,+Tompkins+County,+New+York&deg=90&z=21)

</comment><comment><USER3> This article is so well written. I felt a pang of jealousy for Carl Sagan's daughter Sasha Sagan. To be around a sea of such scientific philosophy right from your toddling days! And, I was also pleasantly surprised recently to learn of Seth Macfarlane's participation in the new avatar of Cosmos.

<comment><USER4> I was immediately impressed by the writing as well.

</comment></comment><comment><USER5> I didn't know about Seth McFarlane's contributions. Much respect for the guy.

</comment><comment><AUTHOR> A must read for Carl Sagan fans.

<comment><USER6> "Somebody else's Library of Alexandria." She seems to have the same knack for expressing the very profound in very simple terms that made her father so compelling. Thanks Seth for ensuring that future generations can enjoy Carl Sagan's words; they truly deserve preservation.</comment></comment>


The Failure of a Past Basic Income Guarantee, the Speenhamland System - <AUTHOR> http://www.nakedcapitalism.com/2015/01/the-failure-of-a-past-basic-income-guarantee-the-speenhamland-system.html <comment><USER2> This article appears to confuse guaranteed income (means-tested top-up) with basic income/basic income guarantee (which you get unconditionally)

One of the major criticisms made of Speenhamland (a means-tested top-up) is that pay was reduced because employers knew employees could claim it back via the state top-up. That could happen under guaranteed income, as it apparently does here, but _is not relevant_ to basic income.

Wikipedia clearly points out this difference: [https://en.wikipedia.org/wiki/Basic_income#Difference_from_g...](https://en.wikipedia.org/wiki/Basic_income#Difference_from_guaranteed_income)

A very poor article.

<comment><USER3> That is a very common confusion. Whenever I mention basic income and people say "That will never work, its been tried!" I ask them to explain what they think a basic income system would be like, and so far it is always some form of means tested supplemental income rather than just basic income.

<comment><USER4> A civil responsibility-tested income would be another reasonable alternative. That is, if you do your taxes, are not currently a criminal, vote in some elections, obey basic health and safety requirements, exercise responsible finances, recycle, etc..

There are lots of things worth considering along this line of thought. You are essentially being paid to be a responsible citizen.

EDIT: When I said there are a lot of things worth considering, I was not advocating stupidity, but consideration. I.e., thought. For one, it wouldn't have to be all-or-nothing. Surely if you have to pay a traffic ticket, it will already be coming out of your income. But if you chose to gamble your income away and you have children to feed, why should you keep getting it?

<comment><USER5> The only way a basic income can avoid being politicized and destroyed is by making it _truly unconditional_. See various government-run web filters as an example of the creeping scope expansion every non-unconditional program will encounter. The easiest way to get people to stop fighting over which conditions are the right conditions is to have no conditions.

<comment><USER6> > The only way a basic income can avoid being politicized and destroyed is by > making it truly unconditional.

Good luck with that. Do you pay citizens, or residents, or perhaps the intersection of them? Do you pay only adults? Or every one who has been born? How dead do you have to be to no longer get the money? (Ie keep your relatives on the machines for longer for money?)

Anyway, I agree with your sentiment. But it's not as clear cut in practice. You still have conditions.

<comment><USER5> _Good luck with that. Do you pay citizens, or residents, or perhaps the intersection of them? Do you pay only adults? Or every one who has been born? How dead do you have to be to no longer get the money? (Ie keep your relatives on the machines for longer for money?)_

One would draw whatever line results in the least ambiguity and the lowest enforcement cost. Regarding end-of-life decisions, that's what medical ethics, living wills, and single-payer healthcare are for.

</comment></comment></comment></comment></comment></comment><comment><USER7> From the article: _" Even though some readers call for a stipend to everyone, that simply is not going to happen, at least in terms of net results."_

From Wikipedia: _" The authorities at Speenhamland approved a means-tested sliding-scale of wage supplements in order to mitigate the worst effects of rural poverty. Families were paid extra to top up wages to a set level according to a table."_

So... "basic income isn't going to happen, a priori, so I'm going to call the failure of this other system (that looks much more like what we're currently doing than like a basic income) a failure of basic income".

<comment><USER8> That is actually an insanely common tactic in political debate.

<comment><USER9> It is. And yet... has true basic income ever been tried, anywhere? If not, the best guide we can find is to look at the closest thing to it that has so far been tried (hopefully recognizing that the example is not completely equivalent, and therefore not completely relevant).

If the new idea takes into account the experience of the old, and has revisions to specifically deal with the problems that the old system encountered, then the question is whether the changes are actually going to fix the problem. (You want to avoid "We painted it orange this time, so your previous experience doesn't prove that our approach won't work!)

<comment><USER7> The sharp drop-off of means testing is precisely the thing that a basic income is intended to fix. The example cited isn't "basic income" any more than Welfare is.

</comment></comment></comment></comment><comment><USER10> Since the early twentieth century, the world is undergoing dramatic and unprecedented change. It's going to be very hard to extrapolate from the failure of any past system or experience into the twenty-first century.

<comment><USER11> Though, that a system like this emerged in another period of dramatic and unprecedented change suggests analogy to today.

</comment></comment><comment><USER12> I find the article to be unfortunately meandering, but it contains an important question slightly more than half-way down: Why all the popular support for a Basic Income Guarantee rather than the arguably superior Job Guarantee (though the two ideas are not mutually exclusive)?

The author makes some frank points that BIG advocates should take to heart. This paragraph really hits home: _Too many of the fantasies about a basic income guarantee seem to revolve around a tiny minority, like the individual who will write a great novel on his stipend. Let's be real: the overwhelming majority of people who think they might like to write a book don't have the self-displine to do so in the absence of external pressure. And that's before you get to the question of whether it will turn out to be good enough for anyone but the author to want to read it._

<comment><USER7> I object to a job guarantee because I think people's time has value and I don't want it squandered on makework. While I think people can find important dignity in work, I think paying people to do things that aren't needed destroys that dignity.

<comment><USER12> The argument is that there are plenty of things that are obviously useful (or even needed) which aren't being done today because too many people incorrectly equate "useful" with "profitable" \- and so only the profitable things end up being done, while many useful things remain undone.

The fact that your strawman appears so frequently shows that knowledge about the details of a Job Guarantee are not spread widely enough yet.

<comment><USER7> It's not a straw man.

How do you tell apart a job guarantee from any old program doing things that need doing?

The difference is that, with the job guarantee you may eventually have to start creating make-work; otherwise, it is not a guarantee. I oppose make- work, so I oppose the guarantee. I do not, on these grounds, oppose creation of jobs to do things that are not make-work.

</comment></comment></comment></comment><comment><USER13> Even if it supposedly works, it seems so artificial and counter to individual freedom and responsibility that it makes no sense whatsoever given the current US constitution and the principles the country was founded upon.

(yes, I understand there are a lot of things in place that fall under that umbrella)

<comment><USER4> What is 'it'? Where is it in the constitution? Why are we supposed to be constrained by founders' principles?

<comment><USER9> We are in fact supposed to be constrained by the constitution (at least until we amend it). But, as you asked, where in the constitution is that? Where specifically?

<comment><USER4> The constitution is supposed to represent _our_ principles, not the founders'. The fact that it does not speaks more to our failure than to their success.

<comment><USER9> Say what? NO. It's not supposed to represent any generation's principles. The constitution is supposed to be an agreed-upon set of rules that is in place until enough people what badly enough to change it that they go through the deliberately-almost-impossible process of amendment.

Because if you were just going to have each generation decide what principles that they want to be governed by, why have a constitution in the first place (especially one that's hard to change)? Why not just, you know, let each generation do what it wants?

Look, I was initially agreeing with you. If pbreit is going to claim that it makes no sense given the constitution, I want to see section and clause quoted before I believe that it's any such thing. But I also don't think that each generation gets to re-do the constitution in the image of their own principles.

<comment><USER4> I don't appreciate your tone. You are jumping to conclusions about my opinions on a complicated and controversial matter.

>But I also don't think that each generation gets to re-do the constitution in the image of their own principles.

I never said that. But every generation does have that power, because all other generations are dead and don't get to make amendments anymore. I don't know what it is about what I've said that makes you think I would support some _other_ means of modifying the constitution.

Those who are alive have all the power. I don't see what is so objectionable about that; it's one of the great benefits of not being a corpse.

<comment><USER9> Ah, I see. Then, yes, I did misinterpret what you said. My apologies.

(In case you can't tell, I'm not a fan of the "it's a living document, it means whatever we want it to mean" school of constitutional interpretation.)

<comment><USER4> I'm not a fan either, but in a sense we have no choice. We can't ask older generations what they meant, we can only hope that their values were passed on effectively. And where they aren't, we do not share those values and so shouldn't be constrained by them.

I don't think we should be reinterpreting the law to suit whatever goal we currently want. That kind of behavior is essentially corruption. We should be rewriting the laws to say explicitly what we want, why we want it, and how important it is to us.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> This article has issues (as already pointed out by others), but it raises a valid point. What would be the effects of a basic income? It refers to lower wages, which might be one.

This just reminds me of other gov't efforts to "tweak" the system. A great example in the US is drug prices. Some federal gov't programs (Medicare) get to buy drugs at either discount X% or _the lowest price offered (to non-gov 't customers)_ whichever is lower.

Sounds like a great idea, but what drug companies started to do is _pull back_ their discounts on private customers in order to minimize the discount to the gov't. As the gov't started paying more, a mish-mash of "tweaks" were made to avoid this. This just created new ways for drug companies to respond.

Basic income is a decent idea at first glance, but holy crap it could become a complex mess pretty quick if it's not done right. It could create some pretty perverse incentives for either individual or companies to maximize their gain.

<comment><USER7> _" It refers to lower wages, which might be one."_

It might, but I don't see why. As _some_ people are more able to opt out of the workforce, you're reducing the supply of labor. Meanwhile, you're making some individuals more capable of realizing their needs as demand. It would hugely surprise me if lower supply and increased demand meant a lower price. Which is not to say I couldn't be surprised.

 _" Basic income is a decent idea at first glance, but holy crap it could become a complex mess pretty quick if it's not done right. It could create some pretty perverse incentives for either individual or companies to maximize their gain."_

Note that we _already_ have a welfare system with a bunch of layers of complexity to try and coddle various behaviour out of people. A system with one simple formula and no discontinuities is likely to be substantially less weird.

</comment></comment><comment><USER15> I think a flat negative income tax is the way to go. [http://en.wikipedia.org/wiki/Negative_income_tax](http://en.wikipedia.org/wiki/Negative_income_tax)

When you earn a dollar, you lose 30c of your basic income. Once your basic income is eaten up in this way, you lose 30c out of your income as tax.

This means that the incentive to earn each subsequent dollar is essentially the same as the last. Of course, I'm sure someone smarter than me has a better idea of what:

1) The basic income amount will be 2) What the flat tax amount would be

The idea is that this would be both a tax reform action and also a replacement of a lot of welfare programs.

</comment><comment><USER16> I normally eschew the practice of judging books by covers, but in this case I think you can judge the content by the URL and the comments here seem to back that up.

The robots _are_ taking the jobs and we are going to have to figure out what people are _for_ (because I'm assuming we cant just throw the "excess" population into a volcano or something, and just working them for no reason is obscene.)

Wendell Berry wrote a whole essay about this called, "What are people for?"

<comment><USER17> _I 'm assuming we cant just throw the "excess" population into a volcano or something_

Something similar was tried not so long ago and I doubt it will be the last attempt. I can think of quite a lot of people that will cheerfully sacrifice a mass of people on the altar of their basic ideology, and won't regard themselves as morally deficient for doing so.

<comment><USER16> Well, okay, lets just throw _those_ people into a volcano.

(Is that an okay ideology? Or should you throw yourself into a volcano if you believe? I for one would gladly throw all the jerks in the world into a volcano and _jump in myself afterward_ as I feel it would be worth it to be immortalized forever as the _Last Asshole on Earth_. Then you all could get on with your lives in peace and harmony. I expect life would be rather pleasant. I mean, can you even imagine it? A world with no assholes? Sure the four or five people left would be pretty lonely but at least there wouldn't be a littering anymore, eh?)

</comment></comment></comment><comment><USER18> Ms. Smith is confused. Income "top-ups" are not a GBI. Means-tested anything are not a GBI. Using the "the Speenhamland System" as an argument against the GBI shows a serious misunderstanding of what a GBI is. For a GBI to work, it'd have to be:

\- national - otherwise you would get strange arbitraging behavior

\- unconditional

\- available to all adults

The idea is that you get the _minimum_ (let's say 22k a year if we started one now), then you work to get even more money. It's enough to live on. To not starve. To pay rent. If you want to live well, you try to get a job if you can. It would have to replace nearly all of the current welfare state (except maybe disability - 22k may not be enough for the seriously disabled), and not just be another program.

I'm also confused about her confidence that there's "so much work to do." Automation is on the march, and will continue (I'm sure Smith is very familiar with Autor / McCaffee / Ford and friends.) Many of the jobs that one might envision (and that still exist) are jobs that no one wants to do in today's world in any case. They aren't pinnacles of dignity and pride; they're soul- crushing, meaningless, repetitive, and body-destroying. The sooner we automate them, the better. No one will miss doing them. A jobs guarantee also puts us right back in the workhouse / make work mindset.

"People need a sense of purpose and social engagement. Employment provides that. History is rife with examples of the rich who fail to find a productive outlet and and whose lives were consumed by addictions or other self- destructive behavior."

Yes, many people would do drugs and play lots of video games. I think it's short-sighted to believe we can stop that (and as things like VR improve, we'll probably get to the point of wireheading.) Many others _would_ spend time with their friends, make art and music, etc. I think pre-emptively assuming that most would just be loafers is falling to the same thinking trap that has sustains ideological wonders like the Protestant work ethic and modern Social Darwninism. There are other ways to encourage "purpose."

A jobs guarantee is, and will hopefully remain, a non-starter. Machines will free us from work; then we'll have to find our own purpose.

</comment><comment><USER19> The math: US population - 316m, income $10,000/yr, so a basic income for all would be 3 trillion dollars. The entire federal budget for 2014 is 3 trillion.

<comment><USER20> It wouldn't be 3 trillion _more_ to provide basic income. A great deal of that $3T is already spent administering and redistributing income in all sorts of inefficient and ridiculous ways.

We don't need to leap right to "a living wage" for basic income to make a huge positive difference. $2k is a huge bump to someone who was getting 0.

Basic income is a hedge against a future where labor is no longer required for productivity so one rich family owns all of the factors of production in the world and wonders why everyone is too poor to buy the outputs of their robot factories.

</comment></comment><comment><USER21> The article wrongly confused unconditional income with conditional one. What proponent of basic income talk about is unconditional basic income.

If you want to look at an actual basic income system look at the test results from [http://en.wikipedia.org/wiki/Mincome](http://en.wikipedia.org/wiki/Mincome)

</comment><comment><USER22> Given how HN leans due to the vast majority of members being young left- leaning idealists with little real life experience in enough cultures and environments to have a realistic world view this isn't bound to be a popular post. So be it.

The human condition is such that most people devolve into pretty useless individuals once all is provided for them with no effort. Even if what is provided is not "all" this usually has negative effects. We do best when we EARN what we have. We become better people when we have to devote time, effort and treasure to achive what we want. Various forms of subsidizing life only succeed at destroying people, communities and futures.

You want a country with a culture hell-bent to innovate, struggle, work hard and compete. That country will prosper and eat everyone else alive. In the US we have generations of people on the dole that have, as a result, utterly destroyed everything from individuals to cities.

While I don't have any data I'd be willing to bet that recipients of huge ridiculous unearned government and union pensions are some of the most selfish people out there, just living their "no worries" life without a care in the world and without doing a thing to help others.

Then you have people like me. I've had two huge business failures. One resulted in a total business and personal not-a-dime-to-my-name bankrupcy. I come from an immigrant entrepreneurial family. I licked my wounds and got back to work each and every time. And did well every time because I worked my ass off while everyone else was watching TV.

Because I understood failure and struggle so well I have always gone out of my way to help those struggling. As an example, I have been working with this guy I met at three meetups here in Los Angeles for a year. He is basically homeless and sleeps at friend's homes while doing gigs here and there for money. I am not giving him a dime. I am teaching him how to start a business. We've been at it for a year. He could barely send an email when we started. Today, I fully expect him to start making $5K a month by June and up from there.

Maybe what we need is safety nets for the sick and old without any family/social (church, friends) backup. The rest get nothing could qualify for something like welfare for a very limited time and only to pay for food, a place to live and education. No iphones, no satellite TV, no playstations. You have to make it such that you turn on the innate drive to problem-solve and improve your situation that exists in every single able-bodied and able-minded individual. Nobody is suggesting throwing grandma off a cliff or not helping those who simply cannot do for themselves due to illness or dire situations. Charity is important. At the same time, organizations like churches get tax free status for a reason. They ought to help people rather than build massive empires (anyone who's been to Texas knows what I mean).

And, yes, businesses, entrepreneurs, might get some kind of a tax incentive to help and mentor others. I don't have any specific ideas to put forth. I know this can be abused to a ridiculous extent. I also happen to know that most tax money that goes to government is often wasted in absolutely grotesque ways. Imagine if we paid someone a couple of million dollars to build the Obamacare website properly the first time around and used the billion (or whatever, the exact number is irrelevant) to launch a massive startup funding program or some other worthy cause. Imagine if the 60 to 100 billion dollars California is going to absolutely burn building a high speed train nobody is going to use and, again, launched an entrepreneurial orgy. No, there's a lot that can be done to produce positive results before we make slaves out of people, even a little bit.

<comment><USER23> "The human condition is such that most people devolve into pretty useless individuals once all is provided for them with no effort. Even if what is provided is not "all" this usually has negative effects."

Source? Evidence?

It doesn't meet the basic smell test. The vast majority of the population works far harder and for far longer than they need to to attain a basic standard of living.

I earned enough to get by in college working ~10 hours a week. When I graduated I still got a full time job. I also could have retired 10 years ago but I'm still working hard. You could have simply got a job and worked 10-15 hours a week to have your basic needs met and yet you worked your ass off.

<comment><USER22> > Source? Evidence?

A few hundred thousand years of human history. What kind of a stupid question is that? Examples of the human struggle to clear difficult hurdles and advance abound.

No. Not everyone succeeds.

> You could have simply got a job and worked 10-15 hours a week to have your > basic needs met and yet you worked your ass off.

That's the beauty of freedom. I chose to work hard, invent technologies, build companies and, as a result, create jobs for people like you who chose a different path in life. One isn't any less than the other, just choices. Yet not everyone is willing to take the risks lots of entrepreneurs will gladly brave in the pursuit of their dreams and ideas.

What is wrong is taking from those who work 80 hours a week to subsidize thise who only want to work 10. If you work 10 then you get to live the life 10 hours a week affords you.

I'll give you another example of this. Up until Obamacare our family was paying $600 a month with a $3,000 annual deductible for health insurance. After Obamacare we pay $1,400 per month and our deductible is fucking $9,000 per year. So we went from $10,200 per year to $25,800. And we are likely subsidizing people who want to work 10 hours per week. That is theft.

It is simple. If you want to choose the 10 hour per week lifestyle, fantastic. Do not steal from others to get he things your work ethic cannot get you.

You can't have it both ways unless you are willing to take risks and work hard to rise to a different level. Today I probably work less than 10 hours a week and make more per month than most Silicon Valley developers make in a year. That took effort, sacrifice, loosing it all twice, learning from mistakes and not giving up.

<comment><USER23> "A few hundred thousand years of human history. What kind of a stupid question is that? Examples of the human struggle to clear difficult hurdles and advance abound."

So you don't have any? I didn't think so.

The western world has had life so easy relative to the thousand years before and yet we have made far more progress.

We have a lot more provided to us "for free" than third world countries and yet our productivity per person is miles ahead of theirs.

"That's the beauty of freedom."

Yes it is. And it is clear that the vast majority of us are happy to work hard even once we have met our basic needs.

The rest of your post is just political talking points. I'm not interested in talking politics or right vs wrong.

<comment><USER22> On the contrary, the evidence is overwhelming. You are simply more interested in pretending it isn't there. Just watched a very interesting documentary that traces the history of artificial light. It absolutely drives my point home. The relevant societies could have chosen a social framework where nobody would care to do better because everything was provided to one degree or another. Instead, the chaotic process of entrepreneurial evolution resulted in a technology that changed the lives of billions of people, created billions of jobs and raised the standard of living of every human being on this planet. Yet many entrepreneurs had to try and fail before that was possible. People content with working ten hours a week to just get by do not advance society, they simply exist within it and are unfairly supported by those who choose to expend a greater effort to advance themselves and others.

Just say "thank you" and move on. You have no point.

<comment><USER23> "People content with working ten hours a week to just get by do not advance society"

You are missing the point. I'm saying the majority of the working population can meet their basic needs with 10 hours a week of work and yet they work much harder and for much longer.

So why then do you keep insisting if they could meet their basic needs in 0 hours they would just be lazy? If modern society is any indication then the vast majority would work just as hard.</comment></comment></comment></comment></comment></comment>


Flightradar24 – how it works - <AUTHOR> https://habr.com/en/post/440596/ <comment><USER2> "Every civilian airliner is equipped with a special device — the so-caller ADS-B (Automatic Dependent Surveillance-Broadcast) transponder"

Not true actually: in the US, ADS-B isn't required until January 1, 2020 [1].

Also, FR24 uses radar data in the US (probably because not all aircraft has ADS-B) [2].

There are also sites, such as ADS-B Exchange [3] that provide _unfiltered_ flight data...very helpful for tracking military flights and such.

[1] [https://www.faa.gov/nextgen/programs/adsb/faq/#g2](https://www.faa.gov/nextgen/programs/adsb/faq/#g2)

[2] [https://www.flightradar24.com/how-it- works](https://www.flightradar24.com/how-it-works)

[3] [https://www.adsbexchange.com](https://www.adsbexchange.com)

<comment><USER3> Even after 2020 ADS-B out won't be required in much of the airspace in the US. Only within 30 nautical miles of a class B airport, within the lateral limits of a class C airport, within class D airspace, and above 10k feet (but not below 2500 AGL I think). Even then, its only required for aircraft originally equipped with an alternator and electrical system (except in class B).

Basically, it's optional in most uncontrolled airspace and for older aircraft.

<comment><USER4> In practice, anything that can be described as an "airliner" is a large commercial aircraft and flies above 10k regularly. Probably required to have ADS-B.

<comment><USER3> Oh whoops, I misread as "airplane"

<comment><USER5> AU: Another good example where it'd pay off to use the 'FQDN', _transport category aircraft_.

</comment></comment></comment></comment></comment><comment><USER6> If you use macOS you might enjoy my app Max Planes [1]. It displays all the ADS-B data, tracks planes on a MapKit view and allows you to save and replay logs.

Also I have an open source Mac app [2] to act a network server for the USB device. It contains a copy of dump1090 with everything statically linked so you don't need to build anything yourself. Just plug in the dongle and launch the app. It is codesigned, sandboxed and notorized.

You can also use the prebuilt dump1090 binary included inside the App.

[1] [https://mtlabs.com.au/planes/](https://mtlabs.com.au/planes/)

[2] [https://github.com/mxswd/dump1090-mac- app](https://github.com/mxswd/dump1090-mac-app)

<comment><USER7> Very nice ADS-B viewer for macOS! Quickly got it connected to dump1090-mutability once I set the bind host to 0.0.0.0 instead of localhost. I wish planes were differently colored based on certain characteristics, much like OpenADSB on iOS (the best ADS-B app IMHO)

EDIT: Also, do you support MLAT?

<comment><USER8> I am the author of OpenADSB, thanks for the kind words. Please don't hesitate to reach out if you have any suggestions or feature requests.

For those that don't know, OpenADSB is an iPhone/iPad app that connects to any Virtual Radar Server and dump1090 server. ADSBexchange runs on VRS and dump1090 is the de facto Raspberry Pi ADS-B decoder. OpenADSB is not affiliated with but uses ADSBexchange as the default datasource.

[https://itunes.apple.com/us/app/openadsb/id1178703539](https://itunes.apple.com/us/app/openadsb/id1178703539) [http://openadsbapp.com/](http://openadsbapp.com/)

</comment></comment></comment><comment><USER9> Worth nothing that if you're in a area with poor coverage, Flightradar24 might be willing to send you a free receiver [https://www.flightradar24.com/add- coverage](https://www.flightradar24.com/add-coverage)

Page above also have a similar guide to this submission.

I mainly started contributing with data only because you'll be able to get a free business account with Flightradar24 if you contribute, which gives you longer history to view, and bunch of more map layers to use.

<comment><USER10> Article did note, at length.

</comment></comment><comment><USER11> In case you are interested in this kind of things there's also the same for ships:

[https://www.marinetraffic.com](https://www.marinetraffic.com)

[https://www.vesselfinder.com](https://www.vesselfinder.com)

[https://www.openseamap.org](https://www.openseamap.org)

<comment><USER12> Aishub is also applicable, they have a great model.

</comment></comment><comment><USER13> Not a big fan of "data monopolies" like Flightradar24. It's as if OpenStreetMaps was a private company that capitalizes on being first into the space and having a community of contributors willing to supply data to a private company for free. I hope an open data project such as [https://www.adsbexchange.com/](https://www.adsbexchange.com/) wins in the long-term.

<comment><USER14> Completely agree. FR24, along with FlightAware, Radarbox24 and Plane Finder has built a business of monetizing free, crowdsourced data. For FR24 there's been multiple requests by the community to for an API, some willing to pay, but they've refused every time. I don't understand why people are eager to feed into those closed network.

ADSB Exchange on the other hand is built with an open premise, runs off donations, and encourages third-party app and value add to build off their API.

<comment><USER15> There's probably not much stopping FR24 from feeding off of ADSB Exchange. This happens in the weather world, where data from community-managed CWOP weather stations ends up in the hands of commercial weather data services, who normalize the feeds and incorporate them into their forecasting products.

<comment><USER16> Isn't there some kind of "free to use, but not to commercialize" license the CWOP people could be releasing their data under?

<comment><USER17> That gets into the very tricky idea of "What is commercialization?" If you use a Creative Commons works that's BY-NC on your blog, but your blog runs ads, is it now commercial? What if it's funded by Patreon? That's why Wikipedia doesn't allow NC and the premise behind the Free Culture licenses.

</comment></comment></comment></comment></comment><comment><USER18> In Germany receiving ADS-B used to be illegal (I don't think it has changed, but I did not verify.)

In Finland receiving as such is not illegal, but forwarding the information is.

In both cases the reasoning is that this information is not directed to the public. Whether anybody has ever been prosecuted I have no idea.

<comment><USER19> That seems very odd. Somewhat similar to putting up a billboard then saying it's illegal for people to read it, as the billboard wasn't intended for them.

<comment><USER20> Someone putting a car in the middle of nowhere doesn't leave it there for anyone ti pickup.

<comment><USER21> But it is pretty OK to look at the license plate...

<comment><USER22> Is it also OK for that license plate to be shown to the world together with its location and time?

</comment></comment></comment></comment></comment><comment><USER23> Rtl-sdrs are great, probably one of the best accidental discoveries I've seen. So many things being sent out from 0-1.5GHz that you can sniff. One that I see often are the unencrypted pagers broadcasting patient details, hotel security information etc. Then you've also got amateur radio, air traffic control, GSM, key fobs, weather stations, satellites, all within the reach of anyone with $15 to spare.

<comment><USER24> I want[ed] to get one but the options are overwhelming. I dislike buying not- the-best product. I also dislike eBay, which seems to be one of the main methods of purchasing a setup (have been burned too many times by sellers).

<comment><USER25> Buy the kit from rtl-sdr.com -- no need to use ebay and they are the best option for a beginner

<comment><USER24> Thanks! Bought one for myself and a second for my Ham radio enthusiast father.

<comment><USER23> Consider also an FM band-stop filter and an LNA, apparently makes things so much better. Even with the antenna removed I can still hear FM broadcast, ruins the whole band. I've just ordered those two, want to test it with NOAA reception.

</comment></comment></comment></comment></comment><comment><USER26> There's also a community-based ADS-B site: [https://www.adsbexchange.com/](https://www.adsbexchange.com/)

<comment> sean-duffy I use [http://360radar.co.uk](http://360radar.co.uk), which is a small site run by (I think) just one guy, but it has the best coverage hands down for the UK. It's used extensively by military aircraft enthusiasts in the UK as it'll usually show some stuff that isn't on adsbexchange, and provides some nice features such as aerodrome and weather layers in the UI.

</comment></comment><comment><USER27> Extra notes: 1) You can share the same data to multiple sites from dump1090, not just FR24. 2) I see no difference between the $27 and $9 version of SDR. I can recommend this one: [https://www.dx.com/p/rtl2832u-r820t-mini-dvb-t-dab- fm-usb-di...](https://www.dx.com/p/rtl2832u-r820t-mini-dvb-t-dab-fm-usb- digital-tv-dongle-black-2021120) Running on two different computers and switching between them give the same number of planes spotted. The $9 actually seems a hint better. 3) I can recommend saving your own data to a sqlite3-database ([https://github.com/yanofsky/dump1090-stream- parser](https://github.com/yanofsky/dump1090-stream-parser)). Easy to work with and under <50MB/month. Fun to write more advanced sql's to count number of time helicopter take-off, the same plane over your house etc. that FR24 can't give you.

</comment><comment><USER28> Perfect timing. I'm just in the process of building my own shortwave listening station in Lahore, Pakistan — which is definitely a low coverage area on both services. I was using a RTL-SDR + Pi and a homebrew antenna to cover the 2m band, so I guess I could run this in parallel. I was looking at volunteer run air quality monitoring services just this morning!

Just filled their forms. Slightly concerned about running a blackbox on my network so I'll have to do some isolation, but this'll be a fun contribution.

</comment><comment><USER29> Here's someone spoofing a fake aircraft this way: [https://www.ainonline.com/aviation-news/air- transport/2012-0...](https://www.ainonline.com/aviation-news/air- transport/2012-08-21/hackers-faa-disagree-over-ads-b-vulnerability)

<comment><USER30> That presentation is something that interested me in ADS-B in the first place. Not because I want to spoof airplanes, but because of novelty of this project.

</comment></comment><comment><USER31> Bait and switch app. They convinced me to fork out for the fully paid version, then switched to a subscription model that froze current features for those who had supported their work, adding a nag and an implied threat of end of life. Stay away.

</comment><comment><USER32> There's also [https://planefinder.net](https://planefinder.net)

<comment><USER33> Thank you!

Lee (CTO @ Plane Finder)

<comment><USER34> Hey Lee,

Just took a look at your website, I was looking for some kind of historical flight data provider.

Clicked on the "Historical Flight Data" link and it just links to a couple popular flights which in turn link to pages with a few pieces of flight data visualized/available.

Clicked on the "Commercial Services" link and it details a few commercial services including "Historical Flight Data" which says

> Looking for historical flight data? Plane Finder historical flight data is > available in 5 minute or 1 minute intervals dating back to 2011 and is > delivered as flat files in CSV format.

"Historical Flight Data" isn't clickable, and I don't want to fill out a form ("Contact Us"), so I click on "View Products" which just links me to your downloadable apps.

Apologies if there's something I'm missing.

I'm trying to get a look at API docs and pricing, and sign up and get started without having to "contact your team."

</comment></comment></comment><comment><USER35> Is there a simple solution to get a basic offline map (OSM maybe) and use a pi without internet as a radar display at my local non-towered airport?

<comment> _-___________-_ Yes. A cheap DVB-T dongle supported by RTL-SDR along with [https://github.com/MalcolmRobb/dump1090](https://github.com/MalcolmRobb/dump1090) or similar will allow this, but bear in mind that something like this should really not be used in any situation where flight safety depends on it.

<comment><USER35> That uses a google map which is nice, but I'd prefer something offline.

<comment> _-___________-_ Should be very easy to swap the google map out for something offline. You can still use the remaining 99% of the tool which does the receiving/decoding/interpreting of the signals.

</comment></comment></comment></comment><comment><USER36> Is there a site that offers truly open data, as in a download of all their collected historic data under a open license and without other restrictions (like having to query an API)?

<comment><USER14> Adsbexchange.com

<comment><USER36> Not open data :(

> for non-commercial use, all of this data is freely accessible to anyone!

> Any commercial users are required to license the data from ADSBexchange, > contact here for terms.

Commercial use is a thing very hard to define so I avoid that even for personal projects (which could be consider advertisements for my commercial offers).

</comment></comment></comment><comment><USER37> One of the reasons I love HN!!! Nicely written and informative post, cheap and practical stuff, lots of interesting links, comments with extra info... I'm so definitely building a receiver with my spare RPi3.

</comment><comment><USER38> Interesting tidbit from the article—apparently flightradar24 doesn't show business jets or military planes.

<comment><USER39> I can confirm it does not show the F15s that routinely fly over my house. But I see business jets all the time, no problem.

<comment><USER40> Those may be running with their transponder off?

</comment></comment></comment><comment><USER41> I always thought it would be interesting to package all of this up and sell it to small operators. For example, a flight school could deploy a small scale RTL-SDR based ADS-B/MLAT system for tracking of their aircraft. The geographic area required to cover would be relatively small. Perhaps a 50 nm radius around the base. Of course they could also just fill in the gaps of something like Flightradar or ADS-B exchange but sometimes it's nice to own your infrastructure.

<comment><USER42> Flight Aware offer a conceptually similar product (i.e. aimed at small operators/FBOs that want to track aircraft) but it uses data from their network rather than needing you to setup your own gear: [https://www.flightaware.com/commercial/global](https://www.flightaware.com/commercial/global)

For a more DIY approach, there's these two: [http://www.coaa.co.uk/planeplotter.htm](http://www.coaa.co.uk/planeplotter.htm) [http://www.virtualradarserver.co.uk/Default.aspx](http://www.virtualradarserver.co.uk/Default.aspx)

</comment></comment><comment><USER43> Relevant talk on getting data live from the sky with Node: [https://www.dotconferences.com/2017/12/thomas-watson- getting...](https://www.dotconferences.com/2017/12/thomas-watson-getting-data- from-the-sky)

</comment><comment><USER44> Flightview also offers an enterprise account for those running an ADS-B ground station and reporting it with their software.

[https://flightaware.com/adsb/piaware/build](https://flightaware.com/adsb/piaware/build)

</comment><comment><USER45> Someone put ADS-B on a satellite a few years ago, it looks like this has been done more recently as well:

[https://www.radarbox24.com/blog/space-based- ads-b](https://www.radarbox24.com/blog/space-based-ads-b)

<comment><USER46> AFAIK at least in Europe we are exactly in the process of moving ADS-B receivers in satellites in a large scale fashion to replace the current system based on ground units. I was talking with a control tower worker a few days ago and this is what he said, additionally a few months ago as the author of dump1090 I was approached by the company he mentioned that tried to hire me. So it looks like it's true.

</comment></comment><comment><USER47> Blog post could have included a link to [https://www.flightradar24.com/](https://www.flightradar24.com/) at least in the first paragraph. Can't find any link in the post at all.

</comment><comment><USER48> Similar open source thing exists for gliders: [https://www.glidernet.org](https://www.glidernet.org) It uses flarm data, which is received by many enthusiasts. Has been on a rise the last few years

</comment><comment><USER49> I'm assuming there is more to it than just the radio data? In FR you can see planes everywhere, including thousands of miles off shore.

My guess is that FR24 just looks up the flight path from the flight number, and then once an airplane goes "off the radar" it just assumes it goes the shortest/great circle path towards its destination airport - at which point it will again be in a "known" spot? If this is how it's done then one should see lots of planes approaching e.g the US east coast suddenly "shift" from their estimate position to their transponder positions, as they are picked up by receivers.

<comment><USER50> But you can see for yourself aeroplanes far over the ocean clearly not following a great circle route, presumably avoiding weather patterns.

<comment><USER49> Interesting. So how does that work in FR24? If there was a service to get this data over long distances, then all these short range receivers would be unnecessary. So something is missing in "how does FR24 work" when it comes to that data.

<comment><USER51> Probably satellite ADS-B receivers like from: [https://en.wikipedia.org/wiki/Aireon](https://en.wikipedia.org/wiki/Aireon)

<comment><USER49> If that's what happens - does that mean that suddenly FR24 won't need all this data crowdsourcing?

</comment></comment></comment></comment></comment><comment><USER52> Flightradar24 has a nice interface and apps but it is CENSORED. Not all airplanes transmitting ADS-B are visible there.

Fortunately there is [https://www.adsbexchange.com](https://www.adsbexchange.com) which offers unfiltered data. You can set up a receiver so that it runs dump1090 separately and forwards it to both using Beast protocol. You can also participate in adsbexchange M-LAT.

</comment><comment><USER53> Glad to see english version of the habr slowly getting traction.

<comment><USER54> Good improvement on them. They had interesting articles from time to time, from various domains (security, gamedev, DYI, management, work-life balance, work migration, science, etc). Opening to the international audience can only be beneficial for them, and the audience.

</comment></comment><comment><USER55> In North America ADS-B is pretty rare except on the coasts where international flights pass through more frequently. If you are not on the coast and look at the logs of your flightradar24 receiver you will see that 99% of the traffic are MLAT rf direction finding logs from mode-S transmissions with no GPS data used. But it's still easier to call it an "ADS-B" receiver because no one knows that MLAT is.

</comment><comment><USER56> I started checking Flightradar24 after seeing a few planes circle above my office building one day. Never knew that transponder data was so accessible!

<comment><USER57> You'll be surprised how much data you can easily grab out of thin air, if you probe the right frequency.

<comment><USER58> Reminds me of this DIY article: [http://jeremybmerrill.com/blog/2016/01/flyover.html](http://jeremybmerrill.com/blog/2016/01/flyover.html)

HN thread here: [https://news.ycombinator.com/item?id=10969447](https://news.ycombinator.com/item?id=10969447)

</comment></comment></comment><comment><USER59> They surely get data from other sources too. You can track planes flying across the ocean, where they get that data from?

<comment><USER60> Satellites, radar, interpolation up to 120 minutes, and receivers on islands.

[https://www.flightradar24.com/blog/the-evolution-of- flightra...](https://www.flightradar24.com/blog/the-evolution-of- flightradar24-coverage/)

[https://www.flightradar24.com/blog/over-the- ocean-24-hours-o...](https://www.flightradar24.com/blog/over-the- ocean-24-hours-of-transatlantic-flight/)

[https://www.flightradar24.com/blog/tracking-flights-with- sat...](https://www.flightradar24.com/blog/tracking-flights-with-satellite- based-ads-b-receivers/)

<comment><USER59> Thanks!

</comment></comment></comment><comment><USER61> And what do they do above oceans? Interpolate? Or are there fallback sources of flights positions?

<comment><USER62> This article suggests that positions are estimated when the aircraft isn't in a coverage area. [https://thepointsguy.com/2017/09/how-flight-tracking- sites-w...](https://thepointsguy.com/2017/09/how-flight-tracking-sites-work/)

It's also worth noting that FlightAware has partnered with Aireon (owned by Iridium according to Wikipedia) to put ADSB receivers on satelites that were launched with Iridum's NEXT satelite constellation in low-earth orbit. Sounds like that data is not yet included in the free data FlightAware provides on its website, but is available commercially. [https://flightaware.com/commercial/aireon](https://flightaware.com/commercial/aireon)

</comment></comment><comment><USER63> You know what would be a fun experiment with this:

Would be to specifially watch all the planes that fly in and out of a large notable event; such as the superbowl, or davos, g-20 summit etc - and see where all thise private jets come from to get to that event...

<comment><USER64> That exists! [https://www.flightradar24.com/blog/watch-the-massive- exodus-...](https://www.flightradar24.com/blog/watch-the-massive-exodus-of- private-jets-after-the-super-bowl/)

</comment></comment><comment><USER65> Does something like flightradar24 exist for trains?

The only API i found exclude all freight trains. (Netherlands) [https://spoorkaart.mwnn.nl/](https://spoorkaart.mwnn.nl/)

</comment><comment><USER66> See also the other article currently on the front page of HN re Space Based ADS-B: [https://news.ycombinator.com/item?id=19187745](https://news.ycombinator.com/item?id=19187745)

</comment><comment><USER29> It updates position and transmits once per second. I wonder if that makes it useful as a homing signal for a missile. Or perhaps the position resolution isn't close enough for that?

<comment><USER4> GPS isn't really precise enough for that and targeting civilian aircraft is easy anyway; this isn't much of an additional attack vector, IMO.

<comment><USER29> I suppose the benefit of knowing where everything is a security plus. Watching 9/11 documentaries, it was surprising how many aircraft the controllers couldn't account for.

(Though this does seem spoofable.)

</comment></comment></comment><comment><USER67> I don't know why, but I'm going to set up a station. Just ordered a Pi to setup pihole, might as well track flights around me too.

</comment><comment><USER30> It's worth pointing out that you can get a free ADS-B receiver from sites like Flightradar24 or Flightaware.

The hardware is often proprietary, but they must allow you to re-purpouse the data received by the antenna (it's public domain).

<comment><USER68> The article goes over this.

<comment><USER30> I'm really not a carefull reader...

</comment></comment></comment><comment><USER69> Wow! I had no idea this is how they did it. Very cool!

</comment><comment><USER70> Then how are they not able to find airplanes like mh370...?

<comment><USER71> The coverage is not global - there are gaps over the oceans and in remote areas (as the article states, it mostly requries unobstructed direct line of sight).</comment></comment>