China harvested organs from political prisoners, says tribunal - <AUTHOR> https://www.bmj.com/content/363/bmj.k5250 <comment><USER2> Why does the west continue to tolerate China as a trading partner?

China is pretty obviously building their empire. They, as a government, appear to have almost no regard whatsoever for human life. They, as a government, appear to have absolutely no regard whatsoever for national sovereignty. They, as a government, appear to have absolutely no regard for the environment.

It just seems completely inevitable to me that China eventually wants to conquer the world. Why is the west enriching them, and by proxy funding their research into war machines when it seems obvious that these things will eventually be used against us?

These acts are atrocities, no doubt. But these atrocities aren't being committed by some dictator in some small, isolated country. These atrocities are being committed by a regime that has all but said that it intends to conquer the rest of the planet and export these atrocities as the standard operating procedure for the entire planet, and which very probably WILL DO THIS if something doesn't occur to change the course.

People are upset about the "trade war" we are currently in, or about to be in, or were in, or whatever the pundit of the hour says. I can't say I agree that restricting trade with China, and encouraging the infrastructure being built there to be built in the US, or at the very least in a country that respects human rights instead, is a bad thing.

<comment><USER3> We fund them because it helps the people in charge get rich off the backs of cheap Chinese labor.

We (the U.S) tolerate their disrespect for human rights because we also do not respect human rights, as demonstrated by our relationship with Saudi Arabia, our many horrible wars, etc. We also do not respect national sovereignty, as demonstrated by our covert wars in South America, our firebombing of Vietnam, Laos, and Cambodia, and our occupation of the Middle East.

We do business with them because they are like us. Or at least, like our business people. They want to grow their power as our businesses do. Not all business people are like this, but we allow the influential businesses to support these actions and we as a people do not stop it.

<comment><USER2> >We (the U.S) tolerate their disrespect for human rights because we also do not respect human rights

I'm sorry but this statement is just absolutely and completely ridiculous. I don't know if you've either never been to The United States, or you've never left The United States, but the difference between the respect that we have for human rights, and the respect that _much of the rest of the world_ has, is stark.

<comment><USER4> The US talks about respecting human rights, but has no problem with 1 million dead Iraqi civilians.

Individual Americans may respect human rights. Just like individual Chinese do as well. But when you challenge them as a nation, well, then the needs of the stong outweigh the needs of the weak.

<comment><USER5> > has no problem with 1 million dead Iraqi civilians

And how many Kurds were killed by Saddam Hussein? How many Shias? I think the Iraq war was a terrible mistake but that doesn't mean that supporting it means you don't care about Iraqis.

<comment><USER6> We need to grow out of this culture of attributing any value to "caring". The fact that Americans "care" that 1 million Iraqis died is not only meaningless, but also facetious.

We elected a government and enabled a system that led to this. How can we judge China as worse? More importantly why do these judgements fundamentally even matter?

The real question Americans should ask themselves is : what is our vision for the future? How can we regain our glory?

Anything else assumes authority without investment. A strategy that is destined for failure.

</comment></comment></comment></comment></comment></comment><comment><USER7> When I was younger, maybe five years ago or so, I was living in Boston and I'd consistently see a pack of Chinese protestors outside the public library at Copley (very popular area) holding up signs, looking to gain attention for this very issue. They spoke to me as best as they could, handed me a pamphlet with hard-to-parse English but nonetheless gruesome descriptions, and asked for my signature along with any other help I could offer.

I was pretty skeptical that this story was as one-sided as they (along with any other protestor/activist) would represent it to be. I remember wondering what I was really signing a petition for, and hesitation in doing so.

This report fills me with regret for not feeling more empathy, as I must imagine they knew people or knew of people who this had happened to, in order to sit out there all day, so consistently. I haven't seen any of the protestors in years, despite their previous frequency-- I hope they're all well, as are their families.

Has anyone else seen this in other cities, or had other experiences with these folks in Boston?

<comment><USER8> I can guarantee you many Chinese protestors you can see in US are protesting for political asylum. For them, protesting for is only a way to green card. Almost every Chinese Uber driver I met in SF are under political asylum

<comment><USER9> >> _Almost every Chinese Uber driver I met in SF are under political asylum_

USA hands asylum like candy (overworked courts?) but honestly, if 5% of what we read is true, the Chinese deserve it.

</comment></comment></comment><comment><USER10> Organ harvesting from Falun Gong practitioners in China [https://en.wikipedia.org/wiki/Organ_harvesting_from_Falun_Go...](https://en.wikipedia.org/wiki/Organ_harvesting_from_Falun_Gong_practitioners_in_China)

<comment><USER11> > "According to the reports, political prisoners, mainly Falun Gong > practitioners, are being executed "on demand" in order to provide organs to > recipients."

Wild... I had no idea this was going on. There are a lot of things about China that I disagree with, but this might be the worst thing I've heard so far.

<comment><USER12> Imagine how much more efficiently the Chinese government could identify involuntary donors if it had better access to people's personal information.

Perhaps through a search engine of some kind. One with a harmless-sounding name. Maybe "Dragonfly" would be a good name.

<comment><USER13> I guess it wouldn't be HN if we didn't tie every story back to our own issues.

In this case, if Google ever does return to China I doubt the authorities would find it more useful for such purposes than existing sources such as iCloud, Bing, and Baidu already are.

<comment><USER14> Hey, at least everyone else is doing it too!

<comment><USER13> The point is more that the parent comment raises a different issue that doesn't really address the topic at hand. Even if another search engine did appear, it wouldn't allow the authorities to target dissidents more effectively than existing services already do.

If we want to actually make a difference, we might consider calling for those existing services to change their ways. Harder to pressure the domestic Chinese companies, of course, but it's surprising how little attention is paid to Western companies who are actually in China and benefitting from it.

</comment></comment></comment></comment></comment></comment><comment><USER15> So how many victims are there? CNN said in 2016 that there were 10k legal transplants and 60-100k actual transplants based on looking at actual volume of transplants at the largest hospitals and supposes that executed minorities compose the difference. Keep in mind that one victim could be sufficient to provide fodder for a number of operations.

[https://www.cnn.com/2016/06/23/asia/china-organ- harvesting/i...](https://www.cnn.com/2016/06/23/asia/china-organ- harvesting/index.html)

Do we have actual hard numbers? The 4000 fulun gong seem insufficient for the volume reported.

<comment><USER16> Don't forget that one body can supply parts for several different transplants.

<comment><USER17> [https://en.wikipedia.org/wiki/Organ_harvesting_from_Falun_Go...](https://en.wikipedia.org/wiki/Organ_harvesting_from_Falun_Gong_practitioners_in_China#Discrepancy_in_known_sources_of_organs)

> Because China lacks an organized organ matching and allocation system, and > in order to satisfy expectations for very short wait times, it is rare that > multiple organs are harvested from the same donor.

<comment><USER15> So 1 illicit transplants is actually 1 murder that is absolutely horrifying. If this has been going on since 2006 we could be looking at mass extermination hundreds of thousands.

</comment></comment></comment></comment><comment><USER18> You can't get much more dystopian or abhorrent than using a political minority as livestock.

<comment><USER19> The word 'harvested' is so much nicer than 'stolen'. That makes the 'optics' better.

(i feel sick now)

<comment><USER20> On the contrary. Harvesting organs is terrifying.

<comment><USER21> Just add one more word... harvesting Human organs, and the alliteration sends a shiver down you spine.

</comment></comment></comment></comment><comment><USER22> I remember first hearing about this in the context of the Bodies exhibit[0] and concern from some people not to accept "donations" from China, as they might've come involuntarily from political prisoners.

Looks like their concern was well-placed.

[0][https://en.wikipedia.org/wiki/Bodies:_The_Exhibition](https://en.wikipedia.org/wiki/Bodies:_The_Exhibition)

</comment><comment><USER23> Interning millions of people on the basis of their ethnicity/religion, and then harvesting their organs ... now where have we heard this one before?

I won't make the direct comparison because it'd normally seem hyperbolic in 2018 ... but this is happening in 2018.

If this is true, it has to change the narrative quite firmly.

<comment><USER24> Why are you singling out Tim Cook? All world leaders (both political and corporate) that appease China are to blame.

<comment><USER23> I believe that since Apple is claiming moral imperative every day in their ads and interviews, and because they have material relationships with China (which governments merely facilitiate) - and that Apple & co are the primary beneficiaries of 'global China' (not for example, Justin Trudeau) ... then they have the first move.

World leaders behind the scenes are very wary of China, they're a) afraid of speaking out and b) have to be diplomatic on some level.

The rubber hits the road (i.e. the 'money') is Apple.

And yes - of course world leaders should be far more aggressive about this.

Sadly, as aggressive as Trump can be, I'll bet he turns a blind eye if he gets a good trade deal.

Though I'm no fan of his, I'll bet he could garner an instant 10% boost in global approval by requiring the closure of those camps as part of any future trade deal. And the thing is - he actually does have enough leverage to get away with it. It would be a major, major international coup of the humanitarian kind ... something so many of his more social/lefty peers could only dream of doing. It'd be nice to seem him try, but I'm not holding my breath.

</comment></comment></comment><comment><USER25> So it's worth noting that allegations about organ harvesting have been circulating since at least the 2000s. There is likely (almost certainly) credibility in the claims that political prisoners (mostly Falun Gong practitioners) were harvested for organs in the early 2000s. From what I can tell, the tribunal is validating that these abuses occurred.

However, there is not any hard evidence (that I know of - I'd be happy to be corrected) of recent harvesting or coerced organ donation from recent years - in particular, in 2015 China agreed to stop using prisoners as organ sources ([https://www.theguardian.com/world/2014/dec/04/china-stop- usi...](https://www.theguardian.com/world/2014/dec/04/china-stop-using- executed-prisoners-organs-transplant-demand-donations)).

So I'll be curious to hear the final report - whether it mentions recent abuses or not.

<comment><USER26> China agreed to stop using prisoners as forced organ donors many times before 2015. They didn't even say "we really mean it this time", so I'm not sure how much credibility you can take from their statement.

The big problem is that the provinces and local governments aren't really that great at following the central government's direction unless the latter is really serious (who can't focus their attention on some many things).

<comment><USER27> China has mass surveillance. The amount of money that would change hands for organs would raise red flags, as well as the likelihood of using a known broker.

<comment><USER26> Just because China has mass surveillance and is partially a police state, it still is a chaotic place where you can mostly jay walk with impunity. State organs are poorly organized and integrated, and there is no easy way to verify the implementation of whatever edicts come from the top.

The central government also don't care if some local politicians are involved in the prison organ trade for a few extra rambos, as long as they keep it under the radar....

</comment></comment></comment></comment><comment><USER28> Crazy that people are just finding this out. They've done this to three major groups of people.

<comment><USER29> which three major groups were you referring to?

<comment><USER30> Uyghurs, Falun Gong, non-communists?

<comment><USER31> Uyghurs are probably not a tissue match for Han.

<comment> barry-cotter Uyghurs are more or less half East Asian, half West Eurasian though ethnogenesis is long enough ago that they're fairly thoroughly mixed. Naively you might expect they'd be half as likely to match Han. It's probably lower than half but I'd be very surprised if it was less than a quarter. There are six loci that are important for transplant rejection or acceptance though there are hundreds of alleles for those loci[1]. And there are almost certainly more Uyghurs in "re-education camps" than any other group at the moment. If there are ten times as many Uyghurs imprisoned as everyone else combined but they're 1/4 as likely to be a good transplant match there'll be 2.5 times as many Uyghurs harvested.

[1][https://en.wikipedia.org/wiki/Major_histocompatibility_compl...](https://en.wikipedia.org/wiki/Major_histocompatibility_complex)

</comment></comment></comment></comment></comment><comment><USER6> Why do people fall for this sort of stuff so easily? There is a pattern of western governments regularly organizing subversive, extremist, headline grabbing testimonies to further foreign policy objectives: [https://en.wikipedia.org/wiki/Nayirah_testimony](https://en.wikipedia.org/wiki/Nayirah_testimony)

I don't think the Chinese government is great either, but I'm pretty cognizant that the level of anti-China FUD is directly proportional to the accelerating economic growth and foreign influence of the nation. China is causing very positive economic development in Africa, Pakistan and other regions that are more than happy to partner with it.

I for one am not so worried about a Chinese Surveillance state being thrust upon Europe or the US.

<comment><USER25> This probably isn't even organized by Western governments - most likely this is meant to support the Falun Gong. I've seen a noticeable uptick in Falun Gong's efforts to highlight the organ harvesting issue over the last few months.

</comment></comment><comment><USER32> U.S. perspective, writing this.

I find this is an area where a "moral decision" is rather clear-cut.

And it highlights the... "amorality", at best, of much of our relationship (whether speaking at the personal level or the state/economy level) with contemporary China.

With our technology, we've enabled and empowered a political and economic structure that has not... "sorted its shit" as part of achieving same. Simultaneously, we've hollowed out our own system -- the checks and balances, as well as raw job counts.

The U.S. is far from perfect. Nonetheless, literally, physically "ripping the life" from one person, as a judgement, to benefit another. That is some symbolism. And a hallmark of what our own society has at least publicly considered to be "dystopia".

\----

P.S. I responded to a reply with the following, but the child comment was deleted before I finished. It was a more than fair point about what happens (over here), and the opportunity for response allowed me to better qualify the... "us versus them" \-- or perhaps lack of a "versus" \-- present in my original comment. So, copy/pasta of that reply of mine:

My "the U.S. is far from perfect" is an understatement -- one I worried about. I agree with your point, and I find the behaviors you point out abhorrent. Prison for profit; Econ. 101 teaches you what you're going to get from that.

The U.S. has, however, been pretty aggressive in regulating organ transplants. When they happen. How limited, hopefully ethical, supplies are distributed.

Of course, over this hangs the spectre of economic disparity, corresponding health insurance disparity and health care access...

Yes, the U.S. is making plenty of life-altering, life-destroying decisions. The "death panels" that actually exist but don't make it into the political discussion (i.e. not the ginned up political phantoms).

And, some of those disparities seem to have been severely exacerbated, domestically -- progress actively reversed -- through off-shoring, outsourcing, and the winner-take-all, short-term reward.

As I grow more depressed writing this, well, at least we aren't ripping out "prisoners'" organs -- yet.

(We go overseas and buy nice foreigners' kidneys, for that.)

<comment><USER33> At first look, from a Western perspective, this is 100% clear-cut morally bad.

But I've also learned a limited amount about the Chinese moral perspective in college, and it can be a useful exercise to examine how someone who doesn't have a Judeo-Christian/Locke moral framework may view this practice.

In some ways, the harvesting of organs from political prisoners can be viewed as the trolley problem. Killing one political prisoner (an 'undesirable' in Chinese society) could save a number of lives of upstanding citizens.

The practice disgusts me personally, but I can see a reasonable argument in support of it.

<comment><USER34> You could take almost anyone, really. Just measure every citizen according to their contributions to society, and when four productive and useful citizens have need of a heart, a liver, two kidneys and a pancreas between them, just harvest a citizen that's not as productive as all of these four combined.

Of course, you maximize utility by choosing someone who does not contribute a lot to society, and _ideally_ someone who is a net negative. That's a win-win situation. The West is incredibly wasteful with our pie-in-the-sky dreamy research on artificial organs, when such a net positive solution is readily available.

It's frightening that a moral argument can be made along these lines. Does anyone really subscribe to this view? I am unfamiliar with Eastern philosophy, but this seems ludicrous.

<comment><USER35> > You could take almost anyone, really. Just measure every citizen according > to their contributions to society, and when four productive and useful > citizens have need of a heart, a liver, two kidneys and a pancreas between > them, just harvest a citizen that's not as productive as all of these four > combined.

On what basis do we determine who gets life-critical medical care?

</comment></comment></comment></comment><comment><USER36> Respect for life is pretty low in China in other ways, take a look at the experience of having a baby:

[https://www.youtube.com/watch?v=dBgZ_xNXViw](https://www.youtube.com/watch?v=dBgZ_xNXViw)

<comment><USER37> Coming from a Middle Eastern country, I understand very well what low respect for life could look like. It runs through all layers of the society/culture, and probably takes generations to fix.

For a better depiction of how low the respect of life could be, I suggest (at risk of psychological trauma) reading or viewing videos about how some drivers in China would rather run over an injured pedestrian (in some cases small children) a few times to ensure they're dead. Apparently a dead victim costs less than ongoing medical bills.

</comment></comment><comment><USER38> I was trying to understand what the Chinese perspective is on this. What do people who live in China or who were born there think about whether or not people in China have harvested organs from political prisoners and/or continue to do so?

Here is the best most levelheaded response I found, on Quora from someone who frequently presents a particular point of view: [https://www.quora.com/Are- there-not-people-within-the-Chines...](https://www.quora.com/Are-there-not- people-within-the-Chinese-government-who-oppose-the-human-harvest-of- organs/answer/Feifei-Wang-6)

She writes that organ harvesting is illegal, that nearly everyone in China opposes it, and that if someone were caught doing it, they would go to jail.

I'm not sure how to square that with a finding from a tribunal in Britain that "state organised or approved organisations or individuals" engaged in "forced organ harvesting from prisoners of conscience has been practised for a substantial period of time, involving a very substantial number of victims".

I guess she would probably respond by saying that the source is dubious and it cannot be true because the state wouldn't break the law like that?

Is that the view?

</comment><comment><USER39> If you're wondering how people can see through all manner of moral repugnance, here's Sacha Baron Cohen exploiting this for laughs:

[https://www.youtube.com/watch?v=P65pZhZ- pks](https://www.youtube.com/watch?v=P65pZhZ-pks)

Includes a segment about a Chinese dissident being eaten. Boggles the mind how the guy apparently thinks this is real human flesh and not only that, it's from a prisoner.

</comment><comment><USER40> Not defending China but this might be simply fake news. Haven't seen it in any major news network or human right organization talking about this.

I wouldn't be surprised if there is just a campaign against China these days. I see bad news every day on the internet about China.

</comment><comment><USER41> I quietly wondered, some weeks ago, when China's "Khashoggi moment" might occur. This probably isn't it, unless an individual story can emerge that can capture the public's revulsion in a way that, for some reason, only an individual story can.

It took one journalist's murder and dismemberment to finally make Mohammed Bin-Salman politically radioactive in a way that thousands of dead and starving Yemenis could not. As we continue to ignore the Uighur internment camps, and probably this as well, what will it take for Xi?

<comment><USER42> China took and kidnapped their own international official personified in the head of the Interpol. Not much more than a squeak. So, I don't think you're going to hear about "unknowns" much.

The Saudi journalist is an odd exception. Any other journalist (remember the Russian journalist assassinated, or the Maltese journalist). Like there is a squeak but not much else --which tells me there is something about the Saudi case.

<comment><USER43> Well, but he was not murdered. "Just" imprisoned in unconvential ways so to say. So you can't really expect the same outcry.

<comment><USER42> True, but a person of great stature and responsibility, Not the UN sec general, but imagine the UN sec general gets kidnapped by Portugal and.... crickets...

</comment></comment></comment></comment><comment><USER44> i remember reading another report by washington post on this issue a year ago...i am posting the report link here and perhaps it could provide us with a bit more details regarding the problem...

      news title: China used to harvest organs from prisoners.
                  Under pressure, that practice is
                  finally ending.
      date: 2017/09/14

[https://www.washingtonpost.com/world/asia_pacific/in-the- fac...](https://www.washingtonpost.com/world/asia_pacific/in-the-face-of- criticism-china-has-been-cleaning-up-its-organ-transplant- industry/2017/09/14/d689444e-e1a2-11e6-a419-eefe8eff0835_story.html)

</comment><comment><USER45> China's arresting Canadians in revenge for the Huawei executive's arrest. Are those Canadians going to be murdered for their organs if the Huawei executive is extradited?

<comment><USER46> Of course not -- hostages need to be alive to have negotiating value.

</comment></comment><comment><USER47> Will this be added to Google's Project Dragonfly censorship engine?

<comment><USER48> "Like, I know harvesting organs of prisoners is bad, but can we just talk about Google products for a second"

<comment><USER49> Well, it's relevant. If Google delivers projects like Dragonfly that means it has no problems supporting practices like these.

</comment></comment></comment><comment><USER50> As an aside, Jimmy Carr mentioned in a TV show a few weeks back that his friend had liver disease, and couldn't get a liver transplant on the NHS, so went to China and bought a liver off a man on death row.

[https://www.youtube.com/watch?v=97SjHFuZilI](https://www.youtube.com/watch?v=97SjHFuZilI)

</comment><comment><USER51> Reminds me of the organ banks in Niven's Known Space, Series. Governments made being sent to the "organ banks" the favored punishment for crimes. Also gave way to OrganLegging:

      https://en.wikipedia.org/wiki/Organlegging

Lovely.

<comment><USER52> I recall a horrifying story Niven wrote about a man running from the police to escape his death sentance. At the end of the story, he is caught and brought to justice for running a red light.

</comment></comment><comment><USER53> Not sure how people can sit outside China for 3 days and gather enough evidence to believe "beyond doubt" that the organ harvesting thing is true.

Also, if you look at what Falun Gong teaches, the credibility of the believers should be at question. Per Wikipedia, the grandmaster of the cult believes that homosexuality is a sin, democracy and science are both bad things, and aliens are constantly interfering with Earth affairs.[1] If Falun Gong is not against China, but against, say Thailand, how many of you will blindly believe their accusations? What about Canada?

[1] [https://en.wikipedia.org/wiki/Teachings_of_Falun_Gong](https://en.wikipedia.org/wiki/Teachings_of_Falun_Gong)

</comment><comment><USER54> any tricks to get full article?

<comment><USER55> use sci-hub

[https://sci-hub.tw/https://www.bmj.com/content/363/bmj.k5250](https://sci- hub.tw/https://www.bmj.com/content/363/bmj.k5250)

mods delete this comment if it's inappropriate but this is a pretty bewildering release

<comment><AUTHOR> ah, the link can't be changed.. sorry

</comment></comment></comment><comment><USER56> wow...

"During the 2000s, analysis of various sources of emerging evidence led to the conclusion that people who practised Falun Gong were being killed to provide the organs fuelling China's transplant boom. "It is common for Chinese transplant professionals to parrot the Communist Party line saying that those who have been speaking out . . . have a 'political agenda.'" In 2006 a whistleblower claimed that more than 4000 Falun Gong practitioners had been killed for their organs at the hospital in China where she worked. Subsequent independent investigators, including David Kilgour, former Canadian secretary of state for the Asia-Pacific, David Matas, an international human rights lawyer, and the investigative journalist Ethan Gutmann, have concluded that such practices occurred

</comment><comment><USER57> It's also rumored they actively seek to harvest organs from Falun Gong practictioners...

<comment><USER56> Not rumors, judging by the contents of this article.

</comment></comment><comment><USER58> The false dichotomy of comparing the "evils" of USA whenever horrifying news comes out of China is worrying. Stretched to the extreme it's the equivalent of bringing up Obama droning killing innocents when comparing The Nazis and Hitler. Our minds conflate the 2 things as bad and we compartmentalize them as such together.

There is a world of difference between the 2. Imagine if the world order was not created by US and instead China, things would be 10000x worse. When you are the sole superpower, other countries would abuse that privilege to benefit themselves a thousand fold more than the US does. We didn't think about China as a serious threat 10 years ago because they were poor and not powerful yet the barbarity was worse then. It's just more pronounced now because they have more power.

The same is true for all countries going to the world stage. Nigeria doesn't seem like a threat now but in 50 years when it's more population than the US the racism and backwards beliefs will result in terrible world crimes. The same can be said of Vietnam, and India too. (I am Indian). If these countries get as powerful as China you'll see them expanding military, bullying neighbors, petty tribalism stuff.

It seems nationalist but I agree with trump to bring our economic industries home. Improve quality of life in these countries and improve human rights, wealth etc. but not to the degree where they are untouchable militarily and economically. Because China is not the worst to come, they are not even close. We don't think of Vietnam and others as a threat but their tribalism runs deep as well. It takes 1 nationalist leader to increase the pace but when they have power like China almost everyone will abuse it.

<comment><USER59> I think you are being downvoted for being off-topic.

>It seems nationalist but I agree with trump to bring our economic industries home.

It's worth a try although the chance of it happening given the complexity of modern industrial good is near zero. I don't think Trump actually wants this and if he does his actions are having the opposite effect. To seriously grow an industrial base in the US would require very open borders, a massive federal investment + subsidy and a complete elimination of tariffs.

<comment><USER60> It would require very open borders on BOTH sides, or at least on the side that the USA doesn't directly control.

With the heavy tariffs imposed by China and others on goods from the USA, manufacturing naturally moves there unless the USA retaliates.

</comment></comment></comment><comment><USER61> China harvested organs from political prisoners on substantial scale, says tribunal Richard Hurley The BMJ Forced harvesting of organs from prisoners of conscience in China has been "substantial," says an interim judgment of an independent "people's tribunal" set up to determine whether the country's transplantation practices breached international criminal law. The former English judge Geoffrey Nice QC, the tribunal's chair, said after a three day evidence gathering session, "We, the tribunal members, are all certain, unanimously, beyond reasonable doubt, that in China forced organ harvesting from prisoners of conscience has been practised for a substantial period of time, involving a very substantial number of victims . . . by state organised or approved organisations or individuals." The tribunal found that the practices breached the Universal Declaration of Human Rights, including articles 3 (right to life), 6 (recognition as a person before the law), 7 (equality before the law), 9 (not to be subject to arbitrary arrest), 10 (full equality to a fair and public hearing in determination of rights), 11 (presumption of innocence), and 5 (torture). The Chinese government and the Transplantation Society, which has "official relations" with the World Health Organization and offers "global leadership in transplantation . . . and guidance on ethical practice," had not submitted evidence. The Independent Tribunal into Forced Organ Harvesting from Prisoners of Conscience in China heard evidence in public in London on 8-10 December. A seven strong panel questioned 30 witnesses, including refugees from China, doctors, and investigators. Its full judgment, due early next year, could have major implications for doctors and institutions worldwide that collaborate with China on transplantation related activities. The Chinese ambassador to the UK and prominent doctors in China involved in transplantation were invited repeatedly to give evidence but had not responded, said Nice. The tribunal invited evidence from the current and former presidents of TTS. Three said that they would not attend the hearings, he said. Nice emphasised that the tribunal remains open to receiving evidence through its website ([https://chinatribunal.com/call-for-](https://chinatribunal.com/call-for-) evidence). Jean-Pierre Mongeau, executive director of the Transplantation Society, told The BMJ, "While TTS will not be providing a testimony at this time, we have been a firm supporter of the reform in China, and we applaud the laws that have been enacted." In 2007 China banned commercial organ trading,1 and a 2011 law insisted on consent.2 In 2015 China vowed to halt the harvesting of organs from death row prisoners (not prisoners of conscience).3 4 The tribunal was convened by the non-profit International Coalition to End Transplant Abuse in China (ETAC), which includes lawyers, academics, ethicists, doctors, researchers, and human rights advocates. However, the tribunal is independent from the coalition, and the tribunal's panel is working "pro bono," Nice said. Susie Hughes, executive director of ETAC, said, "From 2000, there was a rapid increase in the number of transplants [in China]. The source of the organs underpinning this high level of activity has never been explained in a credible way by the Chinese government. "During the 2000s, analysis of various sources of emerging evidence led to the conclusion that people who practised Falun Gong were being killed to provide the organs fuelling China's transplant boom. "It is common for Chinese transplant professionals to parrot the Communist Party line saying that those who have been speaking out . . . have a 'political agenda.'" In 2006 a whistleblower claimed that more than 4000 Falun Gong practitioners had been killed for their organs at the hospital in China where she worked. Subsequent independent investigators, including David Kilgour, former Canadian secretary of state for the Asia-Pacific, David Matas, an international human rights lawyer, and the investigative journalist Ethan Gutmann, have concluded that such practices occurred Sitting on the panel alongside Nice are Martin Elliott, professor of cardiothoracic surgery at University College London, Andrew Khoo, who has a private law practice in Malaysia, Regina Paulose, a US attorney who focuses on international criminal law and human rights, Shadi Sadr, an Iranian human rights lawyer, Nicholas Vetch, a UK businessman, and Arthur Waldron, a US historian and professor of international relations at the University of Pennsylvania. Nice said, "It was decided not to have a panel of people already knowledgeable about, or particularly concerned about, allegations of forced organ harvesting that have already been made" Informal people's tribunals fill a gap, he said, when formal national and international bodies failed to deal with allegations of serious crimes by states or state supported bodies. One For personal use only: See rights and reprints [http://www.bmj.com/permissions](http://www.bmj.com/permissions) Subscribe: [http://www.bmj.com/subscribe](http://www.bmj.com/subscribe) example was Bertrand Russell's 1967 tribunal that investigated US policy in the Vietnam war.

<comment><USER48> Pastebin links are better for this kind of thing

</comment></comment><comment><USER62> You have to give it to Trump for really sticking it to China in trade.

</comment><comment><USER63> Looks like members only content, can't get through the paywall.

In the meantime the short description does trigger the discussion why the US still lets Guantanamo Bay violate the human rights.

</comment><comment><USER64> And nothing will change, as usually. Russia attacked Ukraine - lots of countries said how unhappy they were and that's all - nothing happened.

China is too strong, so companies will still make deals, will still buy and sell there, will just do whatever the China government wants. The same with the politicians bought by the companies.

Any tribunal will not change anything. Even UN is paralyzed as the all sanctions against China will get China's veto and there won't be any decision.

Even when Mr. Trump made concentration camps for children (just like Germans did during the WW2) did anything change after publishing the information about that?

So my final thought is quite sad: nothing will change, live on, be happy that you live in such a country which respects some other values (e.g. exploits work of children in Asia but not your children, so you can think that nothing happens).

</comment><comment> a-nikolaev The word "substantial" is very vague and a bad sign for any scientific and evidence-based publication.

Then, when such news show up while Trump is trying to make his deal with the Chinese and (it seems) even got a hostage recently, this makes me feel a bit suspicious of this article, especially since its content is pay-walled.

(I'm not defending organ-harvesting, which was already reported in the past, but the article must be specific about what has or has not happened, and should not use such vague statements.)

<comment><USER65> Tbh you can see a conpiracy everywhere, even with your comment for example: you could be geniunely suspicious.

Or you could be a die hard trump supporter who prefer to say its suspicious because you don't like that attacking china whill lead in the future to attacking trump policy.

I wonder which one

<comment> a-nikolaev Well, if Trump say something about this topic on TV in the next couple of days, then I'm right. In any case, they promise to deliver a full report on that investigation in early 2019, hopefully it will be more informative. (My main point is not that the article might be politically motivated, but that its main statement is very imprecise and allows interpretations.)

</comment></comment></comment><comment><USER66> A good never-falsifiable story, just like those made up by people who are trying to get and maintain an asylum visa to US.

<comment> barry-cotter There are more transplant operations in China than are consistent with rates of organ donation. Far, far more. What's your alternative explanation?

</comment></comment><comment><USER67> From the article, "The Independent Tribunal into Forced Organ Harvesting from Prisoners of Conscience in China heard evidence in public in London on 8-10 December. A seven strong panel questioned 30 witnesses, including refugees from China, doctors, and investigators.". Clearly, solid and irrefutable conclusions on such a serious matter only need 3 days of hearing from 30 witnesses.

<comment><USER68> > a serious matter only need 3 days of hearing from 30 witnesses.

Making statements about immoral acts by the Chinese government is probably something that takes a little bit of secrecy, security and assurances in the modern era. I have to wonder if you understand the situation.</comment></comment>


Akamai takes Brian Krebs' site off its servers after 'record' cyberattack - <AUTHOR> http://www.businessinsider.com/akamai-brian-krebs-ddos-attack-2016-9 <comment><USER2> Quite impressive. You know your blog is good when folks will try to take down a CDN to supress what's on it. He's also had heroin mailed to him in combination with a swatting attempt before: [http://webcache.googleusercontent.com/search?q=cache:gEjqPfc...](http://webcache.googleusercontent.com/search?q=cache:gEjqPfcbtlgJ:krebsonsecurity.com/2015/10/hacker- who-sent-me-heroin-faces-charges-in-u-s/&num=1&hl=en&gl=us&strip=1&vwsrc=0)

<comment><USER3> The google-cache page doesn't seem to be loading right for me - It's still trying to pull off extra content like css and images from the regular site. That said, I found the article in way.archive.org, and it has images and formatting intact:

[https://web.archive.org/web/20151115154842/http://krebsonsec...](https://web.archive.org/web/20151115154842/http://krebsonsecurity.com/2015/10/hacker- who-sent-me-heroin-faces-charges-in-u-s/)

Thanks for giving a link to this post!

<comment><USER4> Google cache: you have to click Text-only version which isn't trying to load anything from the original site:

[http://webcache.googleusercontent.com/search?q=cache:kaymYsb...](http://webcache.googleusercontent.com/search?q=cache:kaymYsbcGc8J:krebsonsecurity.com/2016/09/israeli- online-attack-service-vdos-earned-600000-in-two-years/&num=1&strip=1&vwsrc=0)

(it's the "strip=1" parameter in the URL)

</comment></comment></comment><comment><USER5> Still not a good move for Akamai, though.

I get him speaking out for them about the hosting having been free, but Akamai is now the CDN that got bullied into kicking someone of their service against their own will.

Terrible PR, and that mud will stick in tech circles. Akamai folds under pressure.

I know it's a crude comparison, but we don't negotiate with terrorists for a reason.

<comment><USER6> > Terrible PR, and that mud will stick in tech circles. Akamai folds under > pressure.

Definitely. The lesson I'd take from this is that Akamai isn't serious about DDOS protection.

For me, buying DDOS protection is something like buying insurance. I don't expect to need it, but if the worst happens, I expect them to stick with me. The way I measure insurance providers is by asking friends how it was when they had a claim.

It strikes me as especially bad that they're doing it in the moment. It'd be bad enough if they said, "Sorry, Brian, this is too big a distraction; you've got 90 days to find a new home." But that they're dropping him in the middle of an attack? That means I can't trust Akamai.

<comment><USER7> I had some friends who worked at Akamai. I always got the impression that they were very serious about addressing anything which could disrupt service, including DDoS.

<comment><USER6> Yup. And it's those people I feel bad for. I'm sure I would have been one of the tech people saying, "We must not give in! Let's use this as incentive to keep upping our game. That's the only way we'll win in the long haul."

</comment></comment></comment></comment><comment><USER8> Isn't this the point at which Cloudflare is supposed to gain a handful of PR points for putting him back online, pro bono, and then doing a write up on how effortlessly they handled the bandwidth with eBPF?

<comment><USER9> I'm surprised that the Azure or Google Cloud teams aren't on top of this. They want tech people to pay attention to their stacks, why not host a high profile site like this to gain the respect of the industry?

<comment><USER10> I feel like Brian Krebs is a public good at this point. Would love to see Google foster a better web by hosting him!

<comment><USER11> They should, and get agreements with CDN's / ISP's to forego charges in case of a DDOS. If anyone could pioneer such an agreement, it would be Google.

<comment><USER12> You want them to push the idea that isp and other middle men networks should not be dumb pipes, but charge a different pricing depending on traffic type and intent?

Your comment may have the best of intentions, but that's how you take net neutrality out the window.

</comment></comment></comment></comment></comment><comment><USER13> Here's a "philosophical" question with regards to the internet, and perhaps even it's future. Given that a currently anonymous attacker, and likely not a "state" player (i.e. not a governmental entity with almost unlimited resources) has managed to DDoS a single website, does this portend that unless there are significant changes to the way the internet infrastructure works, we are seeing the demise of the WWW?

Kind of like a reverse wild-wild-west evolution, where the previously carefully cultivated academic and company site presence, gradually degenerates into misclick-hell? And the non-technical, non-IT savvy masses, in a bid to escape this all, end up in a facebook-style future where media is curated and presented for consumption (or perhaps in future, facebook-type entities end up with their own wild-wild-west hell)?

I have a strange feeling that we are seeing the decline of a city/civilisation; once you used to feel safe walking out at night, knew everybody in the neighbourhood, could leave your doors unlocked... and now, you don't dare to go down the lane to the left in case you pick up a nasty virus, and if you hear a knock on the door at night/email from DHL, you don't dare to even look through the peephole/preview the JPG!

<comment><USER14> You are not the first to come up with this idea. This same thought has been posted every year for the past 20 or so years in mailing lists, forums or Usenet (thought lately, not too often to Usenet).

I think prevention should be emphasized. If there wasn't so much garbage plugged into the Internet, there wouldn't be huge botnets to send DDoSes. There are few groups that scan the Internet for vulnerable systems, and rather than compromise them, send notices to the ISPs. In Canada, the CCIRC does this. But they only check IP blocks assigned to Canadian ISPs and enterprises.

Plus, why do so many ISPs still allow spoofing of IPs? It isn't 1999 anymore.

We should start a grass roots group to talk to everyone they meet, and get people to update their OSes, devices, and get rid of crap.

<comment><USER15> The quickest way to do achieve that would be to hold ISPs legally responsible for any damage caused by their failure to block spoofed traffic from their own network.

I'm not sure how well this would work outside of the U.S. though. Not everyone is as litigious as Americans are.

<comment><USER16> Should not a router be able to this filtering ? Making Internet Exchange Points do it would be even more quicker. Once big IXPs do it smaller would follow suite for the fear being cut-off and eventually ISPs.

<comment><USER17> Filtering can only be enforced at boundaries where an operator can say "Link N will only/never have traffic for net range foo/16." And it isn't always possible to make strong blanket statements like that.

Netadmins can make those kinds of statements about traffic originating from with their own networks because they set the rules. But at an interconnection the types of networks connecting, and the purpose of the connection might mean there is little meaningful anti-spoofing protection that can be done.

For example: I send a packet to google, it passes from AS 123 through AS 456 to AS 789. How is AS 789 going to tell the difference between a packet from me, and a forgery originating from AS 456?

<comment><USER16> It cant. One solution would be blackholing AS 456 from AS 789 at the requrest of its members. Hopefully this will teach 456 to stop misbehaving.

Though we do assume that AS wont itself misbehave and send a spoofed packet to one of its member peer and most of time its true.

We have to worry about misbehaving ISPs for which previously mentioned filtering works.

> Netadmins can make those kinds of statements about traffic originating from > with their own networks because they set the rules. But at an > interconnection the types of networks connecting, and the purpose of the > connection might mean there is little meaningful anti-spoofing protection > that can be done.

I dont think so. IXP can force peers to provide their IP Space even if its whole internet. At least they wont be able to spoof IP outside of their space. If they do spoof ddos from their own space the above solution would probably suffice.

EDIT: I just realized peer already has to give destination ip ranges. So IXP dont have to force anyone.

</comment></comment></comment></comment></comment></comment><comment><USER18> I would like to see stats from Tier1/Tier2/IX for that. Krebs claims it's 665Gbit/s [https://twitter.com/briankrebs/status/778404352285405188](https://twitter.com/briankrebs/status/778404352285405188) Such attack must be visible in many places, however not a single major ISP reported that in mailing list. Previous smaller attacks were reported 'slowing down' some regional ISPs. Perhaps ISPs got better.

<comment><USER19> In a world of 10 and 40 gigabit NICs, why is 665 considered big?

<comment><USER20> Because you have to classify and filter out the spam packets before they reach the intended host and content, which is really hard to do at line rate, especially if you also plan to serve useful traffic.

<comment><USER21> I really like this comment. I think you're saying that moving data is easy, while computing the data hasn't kept up?

Then again, I could be reading into this too much, and the computing part has always been a bottleneck at backbone level.

<comment><USER22> It seems to me that he's saying in order to move data at volume, you have to compute on it.

Computation is tricky. Per-bit, if you can handle the network input, you're probably able to fire packets up to the OS layer.

But when you need to run stats on the incoming data, e.g. an ML classifier of "bad/not bad" or "stop/passthrough", you might be O(n^2) or worse. Moore's can't hang.

<comment><USER23> Interesting. What ML algos are used to classify packets against DDoS?

<comment><USER24> None, really. It's mostly filters against common types of attacks at L3/L4, then OODA. Variations from normal get looked at and custom filters applied as appropriate.

And of course, there's lots of NOC to NOC back channel comms around this stuff constantly to stay relatively on top of things.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> This recent talk about DDoS attacks is worth a watch if you're curious about why it's a hard problem to solve: [https://www.youtube.com/watch?v=79u7bURE6Ss](https://www.youtube.com/watch?v=79u7bURE6Ss)

<comment><USER26> Starting watching this and he gives a great explanation of the issue. Thanks for sharing.

</comment></comment><comment><USER27> This is bad PR for Akamai and a tactical error for them to boot Krebs even if they were providing free service.

To some, the implication would will be "they couldn't handle it" so why should I trust the DDOS they are heavily promoting on their site?

At minimum they should comment on the situation, at best restore his service and learn how deal with high profile clients.

<comment><USER28> Even if they tried to mitigate and quietly _semi_ failed (like 30% packet loss) the PR would have been better. It could be that such attack takes down their entire network hard. Verisign said a year ago to us they could mitigate 2Tbps for comparison.

<comment><USER29> Akamai can easily mitigate this.

They just don't want to provide it for free.

And pretty much no one can afford to use their services @ 655Gb/s for that long unless they had billions of $.

<comment><USER28> Well a single 48 hr mitigation costs 12k/yr contact. Unlimited mitigations probably cost about 130k/yr. Either this negative PR is worth 12-100k in savings for them or they would drop any paying customer if the attack is over a certain threshold?

<comment><USER30> They might bill you that money, but on average it costs them less to provide that service to you, otherwise they wouldn't make any money.

Because we don't know the operating margins and the distribution of DDoS costs per customer, we can't infer how much this particular attack would cost Akamai.

</comment></comment></comment></comment></comment><comment><USER31> The first thing a lot of people are thinking (and saying) is "switch to Cloudflare". But there's another name I think needs to be said - OVH. OVH can withstand a Tbps scale attack as far as I know, and it provides this to pretty much anyone. They have a pretty good interface and some of their plans are extremely cheap. They're also great at standing up for free speech, which I really appreciate.

<comment><USER32> OVH got hit with record attacks yesterday too: [https://twitter.com/olesovhcom/status/778019962036314112](https://twitter.com/olesovhcom/status/778019962036314112)

<comment><USER33> Also, they claim to (soon) be able to filter up to 5 Tbps attacks: [https://twitter.com/olesovhcom/status/778831449206231041](https://twitter.com/olesovhcom/status/778831449206231041)

</comment></comment></comment><comment><USER34> > "I likely cost them a ton of money today."

But more specifically, whoever launched the attack cost them that money.

Also, ha:

PING krebsonsecurity.com (127.0.0.1): 56 data bytes

<comment><USER15> It might be more useful to return the IP address of whoever made the DNS query.

This could trick the computers that make up the botnet to either attack themselves on the public interface (more resource-intensive than trying to DDoS your own loopback), or even better, their ISP's resolvers (it would force the ISP to do something about it).

<comment><USER35> With the recursive nature of DNS, I imagine that could get a little hairy as the DDoS'ers would then be targeting whichever DNS servers they were using.

</comment></comment></comment><comment><USER36> It would be interesting to try out some of these new p2p website technologies like IPFS/WebTorrent with these high profile sites who are frequently attacked.

<comment><USER37> +1 for IPFS

Hosting static blogs is really easy on IPFS (and if you absolutely can't live without comments: use disqus) but the URL's are cryptic and you either need a public IPFS gateway to access the site - which could get DDoS'ed - or run your own.

Another alternative is ZeroNet but you still need to run the client to access the site.

<comment><USER38> IPFS team member here:

If the URLs are cryptic, you can use dns to make them look nicer. Take a look at the TXT record for ipfs.io, as well as the TXT record for _dnslink.ipld.io

Both of those websites are hosted through ipfs and have A (or CNAME) records pointing to our gateways. You can also access this locally if you happen to be running an ipfs daemon at [http://localhost:8080/ipns/ipfs.io](http://localhost:8080/ipns/ipfs.io)

<comment><USER39> A little hard to find, but this is well described in [https://github.com/ipfs/examples/blob/5d77470eb5ae944aa54093...](https://github.com/ipfs/examples/blob/5d77470eb5ae944aa540934e5eeb71a9d862877f/examples/websites/README.md).

<comment><USER37> That's awesome, not sure if this was around last time I tried but it is still hard to find, thanks! :)

</comment></comment></comment></comment></comment><comment><USER13> I tried to get to an article on Krebs' site from a Bruce Schneier blog post, and couldn't, then bumped into this post in HN.

It's a pity Akamai booted him off; on the one hand, I can understand that it would significantly impact on their SLAs to other customers, but on the other hand it's a shame they don't have a lower impact network to re-host him on, and use this as a learning lesson on how to better mitigate such DDoSs...

</comment><comment><USER40> [https://twitter.com/briankrebs/status/779111614226239488](https://twitter.com/briankrebs/status/779111614226239488)

"Before everyone beats up on Akamai/Prolexic too much, they were providing me service pro bono. So, as I said, I don't fault them at all."

</comment><comment><USER41> I'd love to learn more about these botnets. I wonder about things like What's the average time that a compromised computer stays in this net. What is the typical computer (grandmas old PC running XP). Do the ISPs ever get involved to kill bots running on their networks?

<comment><USER42> This was a mixed traffic botnet. There are speculations that a large chunk was from compromised IoT devices.

<comment><USER43> How many IoT devices are out on the public internet at the moment?

and for the existing IOT devices, are they the same thing, or were different exploits used for different devices?

<comment><USER42> How many on the public internet? Too many. Here are close to 100k IP cameras on the public internet: [https://www.shodan.io/search?query=ip+camera](https://www.shodan.io/search?query=ip+camera)

Again, the speculation that it is IoT devices is unfortunately just that. However massive compromise of internet connected embedded device is not new: [http://internetcensus2012.bitbucket.org/paper.html](http://internetcensus2012.bitbucket.org/paper.html)

</comment></comment></comment></comment><comment><USER44> Wow, I figured that everyone that had hired vDOS would be irritated but that is pretty impressive. Still it says a lot for how effective he has been at rooting out this stuff, not like the TierN infrastructure folks have managed to track this stuff down with their resources.

</comment><comment><USER45> Isn't this whole thing a bit silly? I mean what's the point? They just spend time on making him the best marketing, he'll double his audience/readers, no?

<comment><USER46> The point isn't to cost Krebs readers most likely. It's to show off how awesome this bonnet is.

I'd guess the DDoSer is jumping with joy over this news actually, because now the DDoSer can advertise his service with "I DDoSed Krebs so hard Akamai had to drop him!"

</comment></comment><comment><USER47> These 'attackers' give Krebs' more publicity than he would ever be able to generate himself.

It's also useful to point out that Krebs' hasn't been the only target as half a dozen other large targets were attacked [http://www.webhostingtalk.com/showthread.php?t=1599694](http://www.webhostingtalk.com/showthread.php?t=1599694)

</comment><comment><USER48> He should get a Facebook page and publish a copy of all his posts on it.

<comment><USER49> Interesting idea, but probably doesn't go far enough...

Perhaps he should re-post his blog articles everywhere: Facebook, flickr, tumbler, watpad, wordpress, various feedback forums, etc.

Combat a DDoS attack with a DPD (distributed publishing defense - just made that up)

<comment><USER50> That would harm his business model, which is advertising.

It could work with Facebook Instant Articles, he may even be better off using it since they source the advertising and have been out trying to poach and source quality content.

</comment></comment></comment><comment><USER51> Something about the platform-centric world we're in now is that this sort of attack doesn't have the blocking power it once did: you can mirror your content on Twitter, FB, G+, etc. and cross-link so people can still read your stuff. This makes the "denial" part pretty watered down; it's a wonder people even bother with these sorts of attacks anymore for non-services (i.e., for regular media material like text, photos, etc.)

Of course, maybe the goal is to deny someone ad revenue, but that seems awfully low-status for such a high-profile attack: "Yeah, we really got 'em! Denied 'em AD REVENUE for a whole week!"

</comment><comment><USER52> The ddos attacks seem to be getting larger these days.

I've recently seen a ~200 Gbit/s hit us.

Does anyone have good resources around mitigation? I was looking at the BGP flowspec but was hopefully that someone might have come across other tactics?

<comment><USER18> Yes, here is a very good described by OVH [http://media.frnog.org/FRnOG_24/FRnOG_24-3.pdf](http://media.frnog.org/FRnOG_24/FRnOG_24-3.pdf)

</comment></comment><comment><USER53> If you're curious what the source of the DDOS attacks are from, here is a recent one that hit OVH:

> This botnet with 145607 cameras/dvr (1-30Mbps per IP) is able to send > >1.5Tbps DDoS. Type: tcp/ack, tcp/ack+psh, tcp/syn.

[https://twitter.com/olesovhcom/status/779297257199964160](https://twitter.com/olesovhcom/status/779297257199964160)

This is much higher than the Akamai attack on Krebs too. Welcome to the wonderful side-effects of the totally insecure firmware of IoT...

</comment><comment><USER54> Cloudflare should pick up the site for good advertising..

<comment><USER55> Cached version where Krebs paints picture of Cloudflare supporting DDoS:

[http://webcache.googleusercontent.com/search?q=cache:0uf9RIu...](http://webcache.googleusercontent.com/search?q=cache:0uf9RIu0ZswJ:krebsonsecurity.com/2015/01/spreading- the-disease-and-selling-the-cure/&num=1&hl=en&gl=us&strip=1&vwsrc=0)

</comment></comment><comment><USER56> Here's a link to the last post from his website. Google did not appear to have this cached:

[https://archive.fo/t94ve](https://archive.fo/t94ve)

<comment><USER57> relevant quote from that: ››Many readers have been asking whether this attack was in retaliation for my recent series on the takedown of the DDoS-for-hire service vDOS, which coincided with the arrests of two young men named in my original report as founders of the service. I can't say for sure, but it seems likely related: Some of the POST request attacks that came in last night as part of this 620 Gbps attack included the string "freeapplej4ck," a reference to the nickname used by one of the vDOS co-owners.‹‹

<comment><USER58> I'd err on the side of caution and consider that string a Red Herring without more evidence to corroborate the claim. It is a nice coincidence though...

<comment><USER57> I'm just here for the popcorn :)

</comment></comment></comment></comment><comment><USER59> I understand that this is burning bandwidth for Akamai, but seriously, taking into account what is at stake here, I think they need to do their share and continue to support Brian.

</comment><comment><USER60> Brian Krebs is a hero. Are Akamai executives cowards for dumping him? I'd like to add that law enforcement are heroes.

And it's honorable he wants to meet Fly in person, recognizing him as a human being. I haven't read it yet but I'm assuming the reference to 12-step hints that Fly's having some post alcohol binge regrets.

I'm sure alcohol makes it easier to hurt other human beings, which is why violent people are often drunk. I'd be ashamed of myself if I woke up realizing that I'd spent my life actively trying to harm other human beings for money, feeling no remorse until Karma (here defined as law enforcement officials) finally caught up with me.

<comment><USER60> After looking into this more I see that even Krebs himself does not blame Akamai for dumping him so I regret that part of my post.

</comment></comment><comment><USER61> I'm wondering if the rising scale of these attacks & the seeming ease with which sites can be taken down will ultimately result in an "authenticated" internet - ie. you can't even connect without identity verification.

We already see publishing through FB Instant Articles etc. moving in that land on top of the current internet, to combat these types of firehose attacks, the only solution may be to take authentication one level deeper into the connection level.

That of course sounds good to security agencies as that's the end of anonymity online.

<comment><USER62> I doubt it. I think a lot of these attacks (though possibly not this one) would not even be possible if ISPs did egress filtering of packets with spoofed IPs, and yet ISPs don't seem to be implementing even this feature. It seems unlikely that they would leap frog this and start requiring some sort of identity verification, just to solve DDoS problems.

Additionally, in situations that don't make heavy use of amplification (where egress filtering doesn't help much), the way it's usually accomplished is by compromising a bunch of hosts - home computers, routers, etc, and assembling a botnet. In those cases, if your device is compromised, it would authenticate as you anyway, so such a scheme would solve nothing.

<comment><USER61> >>In those cases, if your device is compromised, it would authenticate as you anyway, so such a scheme would solve nothing.

But if you had authenticated access, you could find exactly which C&C server controlled that botnet node and then who controlled that C&C server right? All these attacks depend on some form if amplification - if only to go from C&C servers to botnet. If just being on the network required authentication, you could trace back network connections and ID the controller even if attack was by a botnet.

<comment><USER62> I don't think the imperfect mapping between IP and user is the real problem with tracking down botnet controllers. You have a network of compromised hosts, and you can disguise yourself as one of them. There are lots of schemes for this sort of thing when you have a whole bunch of compromised machines under your control. For example, even if you made it illegal to run a Tor node, you could still just have your compromised network of hosts start running their own Tor (are you going to arrest all the people who just got a virus that starts a Tor network?) and you deliver commands from a hidden service. That's a huge effort on the part of society (banning Tor, implementing that, etc) that's easily circumvented.

In any case, like I said, you can't even get ISPs to do _egress filtering of spoofed IPs_ , so even if it _were_ going to solve DDoS, I don't think you'll get them on board for all the complications of implementing the protocols necessary and buying the equipment necessary to log all the traffic necessary to track down botnet controllers (who may be in a country where knowing who they are won't help you much anyway).

</comment></comment></comment></comment><comment><USER45> It's funny how my mom after reading "record cyberattack" would be wondering how many poor people died but what it means is that somebody was downloading images from website many times.

</comment><comment><USER63> There are a number of factors that go into play (did the site use custom SSL, what edge locations were they providing caching in, etc), but had Kreb been a normal paying customer, this could easily have been a over a million dollar bill (if it was sustained long enough to alter his 95th percentile bracket) in the cheapest case. If things like custom SSL are in the mix (which Akamai charges absurdly high prices for), or lots of traffic from more expensive POPs, or lack of already having pricing commiserate with high volume traffic commitments, the bill could've been 5-10x that amount or more.

</comment><comment><USER64> It's kind of stupid to me that the massive and advanced cdn of akamai protect something as non-important as a blog against such a major ddos attack. If they were doing it pro-bono wouldn't the prudent action be to mitigate ddos's until a certain treshold and then actually assess the value of what you are protecting? A good lesson to have learned, I believe.

But no, they'll drop this client which had to have continually given good referrals.

</comment><comment><USER65> It would be interesting if he started writing on Medium (not saying technically advisable, just interesting). I wonder if he'd ever consider trying that.

<comment><USER66> Why would it be interesting?

<comment><USER65> To see how Medium would deal with massive DDoS attacks and whether they'd kick Krebs off.

</comment></comment></comment><comment> tuna-piano Some are guessing the DDOS was because of this recent post of his, about a large DDOS network.

[http://webcache.googleusercontent.com/search?q=cache:kaymYsb...](http://webcache.googleusercontent.com/search?q=cache:kaymYsbcGc8J:krebsonsecurity.com/2016/09/israeli- online-attack-service-vdos-earned-600000-in-two- years/+&cd=1&hl=en&ct=clnk&gl=us)

</comment><comment><USER67> Why don't we switch to a distributed network with a DHT like freenet? So many benefits, including not being able to take down content via DDOS.

<comment><USER68> The DHT can still be attacked. Here's three methods:

1: Take out the bootstrap nodes. These are several nodes that bootstrap a new client into the DHT system. BitTorrent, Inc. keeps a couple such nodes. On first boot, the client registers it's DHT address and collects a few from the bootstrapping node. The client could then can traverse the network itself. By knocking out these nodes, newly started clients now have to browse the whole IP space for possible DHT clients, which is not feasible.

2: Attack the peers themselves. A malicious program could traverse the network searching for DHT peers in the same way. At first, it would only collect a large number of DHT addresses and their corresponding nodes. Once a sufficient mass is gained, each is targeted with a low level DDOS to knock them offline to further requests. Most of these peers will be homes and local ISPs, which can't effectively deal with DDOS traffic themselves. Others trying to connect to a down client will eventually remove them from their own address space for later queries.

3: Poison DHT peers. This is probably the hardest, but once complete could poison an entire network with a switch. On each of your compromised Bot machines, you make a valid DHT node. Make a LOT of these (like a Botnet). For the most part, participate correctly with the DHT network. Collect as many valid/real DHT user and content addresses as you can and host them in your nodes. When it's time to attack, prevent these valid DHT addresses from resolving on inquiry. Even better, make them go in the wrong direction and infinitely pass around requests to other poisoned bots in your ring to prevent resolution but not hang the process. This is especially useful for content attacks because it attacks the content addresses themselves.

<comment><USER69> 1a. A system could be made for bootstrap links that have the addresses of a few nodes in them.

1b. When you have 10 million nodes like torrents, you _can_ go searching random IPs. As long as many nodes bind to the same ports.

2\. Sure, if you have comparable bandwidth to the entire network you can take it down. But that's a lot harder than overwhelming a single target. Nobody can send 20mbps each to millions of IPs.

3\. This is the method that takes the least resources, but pretty good countermeasures can be made.

</comment></comment></comment><comment><USER70> So if Akamai can't hold an attack of this size, who can?

Or is it that they actually can hold it off but it costs too much money?

<comment><USER71> Cloudflare and OVH (that got a 1.1 Tb attack around the same time, the biggest in history) certainly have the capacity to hold attacks of that size.

Akamai may also have the capacity, but bandwidth is not free.

</comment></comment><comment><USER72> Unbelievable, they enjoyed year of free publicity from association with him, and this is how they repay him. Its bad enough that they couldn't handle the attack, despite all the bragging about their multi-Tbps capacity...

</comment><comment><USER73> Brian Krebs' wasn't a paying customer right? Akamai provided the service pro- bono. Perfectly acceptable for them to suspend service if it becomes more than trivial in terms of cost or it puts their paying customers at risk.

</comment><comment><USER73> I've always wondered if your domain is under a http DDoS attack, couldn't you in theory update your DNS A record to another ip and take other servers down (maliciously)?

<comment><USER20> Most DDOS attacks are launched directly against the IP, so it wouldn't really help.

</comment></comment><comment><USER74> At this scale it must also cost a ton of money to carry out this attack, I wonder if there's a vulnerability that we don't know about that let them do this so easily?

<comment><USER75> > At this scale it must also cost a ton of money to carry out this attack

It doesn't; you're using compromised machines to initiate the attacks, which is free to you.

<comment><USER76> You're almost never using machines _you_ compromised. Instead, you're using someone _else 's_ compromised machines: a botnet-backed DDoS-ing service, which you rented on the open (black) market, at the going rate. Bigger attacks _still_ cost more in such setups—whether or not the botnet nodes were free to acquire, the resulting network is still a scarce resource whose price rises with demand.

(Of course, in the very special case of Krebs, the people he is reporting on frequently _are_ the owners of the botnets, who can of course use their own botnets freely.)

</comment></comment></comment><comment><USER77> Are there web servers or software that blacklist IP addresses that disconnects after a short time and redirects them to a static page?

<comment><USER14> Yes, but they can be flooded as well. Every system is going to have a finite capacity. And if the capacity is exceeded, the system will slow. If the capacity is significantly exceeded, it will become unreachable itself.

So if the capacity of your system is X Gbps, then it will start to have problems if the attacker sends X + 1 Gbps. And will probably be completely unreachable if the attacker sends X * 2 Gbps.

</comment></comment><comment><USER78> krebsonsecurity.com is now resolving to localhost. I guess he doesn't want to give the DDoSers a target.....

</comment><comment><USER79> I'm really interested to read his blog now. Any way I can find a readable version for his blog posts?

<comment><USER80> [https://web.archive.org/web/20160922124922/http://krebsonsec...](https://web.archive.org/web/20160922124922/http://krebsonsecurity.com/)

</comment></comment><comment><USER81> Too bad, I had some nice reads on his website. Hopefully this will only be temporarily...

</comment><comment><USER82> So the attackers win..

</comment><comment><USER83> so long for using a CDN to protect from DDOS attacks...

<comment><USER84> This was prolexic, a ddos protection service purchased by Akamai.

</comment></comment><comment><USER85> Is it according to terms/conditions of Akamai?

<comment><USER86> Akamai were providing him hosting free of charge, but the size of the attack will have had not insignificant financial impact on them, and on their customers. It's completely understandable that they've chosen to terminate their hosting agreement at this time.

[https://twitter.com/briankrebs/status/779111614226239488](https://twitter.com/briankrebs/status/779111614226239488) [https://twitter.com/briankrebs/status/779062433902170112](https://twitter.com/briankrebs/status/779062433902170112)

</comment></comment><comment><USER87> You'll be redirected in... never redirected.

</comment><comment><USER77> Who profits from this attack?

<comment><USER88> Someone's ego.

</comment></comment><comment><USER89> tl;dr Akamai was hosting his site pro bono. His site was being DDOSed, which cost Akamai a ton of money, so they kicked him off since they were literally only losing money on the deal.

<comment><USER90> > tl;dr Akamai was hosting his site pro bono

Let us not permit companies to co-opt language for their benefit.

If it was genuinely _pro bono_ ( lit: for the public good ) then they would have taken all steps possible to keep the site online since the public good was served more by having Mr Krebs online than not.

However, in this case they were hosting him free-of-charge because it was good publicity for them. That's a very different scenario.

<comment><USER91> Krebs is the one who used the term "pro bono".

Besides, _pro bono_ isn't _literally_ "for the public good", it is _literally_ "for good".

Finally - that is a ridiculous standard to hold everything categorized as "pro bono" to. Law firms oftentimes take on cases/clients that can't afford their services, _pro bono_. Because they call it _pro bono_ , does that necessitate that said law firm should continue to fight all _pro bono_ cases in court until either A. they win or B. they go bankrupt? Of course not.

<comment><USER92> Well, to be fair to the parent poster (and without going deeper into the merits of this side-argument), I'd note that the expression "pro bono" as generally used in English is actually short for "pro bono publico" which _does_ in fact mean "for the public good".

Law firms (and other professional services firms) call it "pro bono" when they use their specific skill-set to provide their services to those (e.g. the indigent) who couldn't otherwise afford them.

In that example, it's the fact that the indigent can get access to quality legal representation which is itself considered the "public good".

<comment><USER91> I get that. My point about law firms is that most of them won't take pro bono cases all the way to the supreme court (or equivalent). i.e. there is a limit to how much manpower they are will to expend on a charity case.

In the same way, expecting Akamai to provide free service to Krebs until the end of time because it was referred to as pro bono (even if it was them, which it wasn't) would be silly.

tl;dr - Akamai provided a service that could be seen as publicly beneficial. As long as they were providing free service to Krebs, they were doing something that was arguably _pro bono_. Them no longer choosing to provide that service does not retroactively detract from its public benefit.

</comment></comment></comment></comment></comment><comment><USER93> Time to use Github pages.

</comment><comment> ninja-wannabe-7 Should've used CloudFlare.

</comment><comment><USER94> I think its time for some serious financial incentives for ISPs to start getting serious about routing (or rather not routing) garbage. Financial fines for every DOS originating from your AS, or blacklisting if you are a repeated offender.

<comment><USER14> There is an incentive: it is the cost of transit. However, there usually are not a lot of zombies per single ISP for the access level ISP to even see any abnormal traffic.

The best thing is that access ISPs need to implement BCP38 ([https://tools.ietf.org/html/bcp38](https://tools.ietf.org/html/bcp38)). And shutdown all open recursive DNS servers. It would be great if Microsoft didn't ship such a retarded DNS server too. I would say that most ISPs do not do this.

NTP really should be replaced with something better. There are still large numbers of NTP amplification attacks going on. The big issue with NTP today, is that by default ntpd in daemon mode, is also a NTP server and responds to NTP requests. And so many of the two bit home routers run ntpd.

But the reality is, that no one is even reporting DDoSes right now. I work at an ISP, and I haven't seen a DDoS report in the past year. We pro-actively scan for open DNS and open NTP services. But many DDoS attacks just use regular HTTP/HTTPS, are hard to detect at the individual network connection level. Do you think Akamai sent out a single notice to any ISPs, saying "The following X IPs are sending excessive traffic to site Y, and are suspected to be part of a botnet"?

</comment></comment><comment><USER95> Such attacks are possible because Internet is decentralized. There is no way to tell peers that you don't want to get traffic from some AS.

And investigation is difficult because attacking nodes might be in different countries, in some of which DDOS attacks are not illegal.

Maybe it is time to start building international firewalls to protect local infrastructure?

<comment><USER58> That would be quite the Great Firewall...</comment></comment>


The Command Line - The Best Newbie Interface? - <AUTHOR> http://www.osnews.com/story/6282/The_Command_Line_-_The_Best_Newbie_Interface

<comment><USER2> I thought I recognised this:

<http://news.ycombinator.com/item?id=889522>

<comment><AUTHOR> Huh. Looks like the lack of a trailing underscore in my link let it snuck through. Shenanigans!</comment></comment>


Successful Freelancing With Ruby On Rails: Workflow, Techniques And Tools - <AUTHOR> http://www.smashingmagazine.com/2010/10/26/successful-freelancing-with-ruby-on-rails-workflow-techniques-and-tools/ <comment><USER2> I would have expected railscasts.com to be mentionned, such a great resource to learn Ruby on Rails.

<comment><USER3> I was mentioned <http://rubyonrails.org/screencasts> there, and it contains links to the Railscasts as well.

</comment></comment><comment><USER4> I was going to take a look at this article until I saw it was on smashingmagazine.com.

<comment><USER5> I'd also be interested in learning why you couldn't;t read Smashing Magazine. Thanks.

<comment><USER5> Thanks for your insight, David

</comment></comment></comment><comment><USER6> "The Ruby on Rails Framework (and Alternatives: Merb, Sinatra, Ramaze, Rango)"

Merb? Does anyone maintain that, or use it for new projects?

Has anyone used Rango such that they could comment on it?

<comment><USER7> Since Merb merged with Rails to become Rails 3, yes. But I don't know what it's state as independent project is now.

<comment><USER8> You can check this here:

<http://github.com/merb>

</comment></comment></comment><comment><USER9> Bleh.</comment>


The Future's Pretty Cool, or Why I Love Ruby - <AUTHOR> http://intridea.com/2010/4/28/the-future-is-pretty-cool-or-why-i-love-ruby

<comment><USER2> Of course, this cuts both ways. The Ruby community is infamous for being, for lack of a better word, ADD when it comes to frameworks and tools. What's cool this month is un-cool the next, when someone else comes along and re-invents the wheel with different names & syntax. Going back and trying to reconjure up some old Rails code I wrote a few years ago is basically impossible, as the plates have shifted underneath it so much as to make it a huge project in itself to bring it up to the present day toolchains.

Beyond this, I see communities obsessed with tools and frameworks as distracted. The hard problems are those of algorithms, data structures, design, and architecture. Most of the things that we see a lot of programmers spending their time thinking about, writing about, and writing code for fall under a class of problems that, while important and necessary, often seem to me as those under that oft cited line in most academic papers: "a simple matter of programming, left to the reader."

<comment><USER3> Thank you. As a Ruby on Rails programmer I couldn't agree more. Rails 3.0 will bring some maturity... programming to interfaces and APIs rather than implementations. I believe Javaland "got that" a long time ago.

<comment><USER2> Agreed. Rails 3 seems to be shaping up to be the "revenge of the grown-ups". I see it as potentially being as paradigm shifting as the initial release of Rails, but not as in-your-face.

When Rails came out, it reminded us that programming can be fun. Rails 3 will shows us that not only can it be fun, but it doesn't have to come at the cost of stable interfaces, reusable code, and the ability to not have to go back and refactor your entire project every 6 months.

<comment><USER4> I think it's awesome that you're excited for Rails 3. I'm incredibly excited for it. Lots of great stuff happening.

But. (And that's a big but). I think you might overestimate the philosophical changes that are going on here. Seeing pipe dreams and unicorns where there are simply just incrementally improved ideas and work horses.

The rate of improvement in the Rails camp is not going to change because of anything fundamental to Rails 3. It might change because we're running out of big problems to deal with, but I also somewhat doubt that.

So that means that yes, you will have to change your application every 6 months, if you want to keep up with the latest and greatest. But you don't have to. You never had to. A Rails 2.3 application, for example, could have been chugging along just fine for the last 12 months (2.3.0 released March '09).

</comment></comment></comment></comment><comment><USER5> I wrote a gem in ruby a year or so back using 1.8. When 1.9 came out, it was extremely easy to port it.

OTOH, I've been hearing that people have written books for Python 3 which hasn;t taken off. Now they are backporting their books to 2.x (e.g Dive into ..).

There is a negative side too. Everyone's writing gems. There are plenty of gems floating around, some incomplete some abandoned, its hard to tell. When i worked in Java years back, aside from the Java distribution itself, i used to use libs from jakarta.apache. One knew they would be maintaining it, and the quality would be good.

In Ruby, i really don't know of any such company or initiative, that maintains libraries. It's too open. I get frightened when i download a gem which has many dependencies, since sooner or later some deps are going to break. That's happened several times. Even some of the well-known rubyists abandon their gems and don't respond to mails or bug reports since they are busy in ruby confs, or setting up their startups.

Then there's the gem creation process, which seems to be changing. I typically tend to google (maybe this is my fault) and i get outdated docs on creating a gem or publishing it. Hopefully, the ruby-lang.org site has an updated link on suggested or preferred way to create a gem. Every time i create a new version of my gem (it uses hoe), it seems hoe has changed, and I struggle to find a sample to correct it.

However, I love ruby too.

<comment><USER6> You should really take a look at Jeweler (<http://github.com/technicalpickles/jeweler>) and MG (<http://github.com/sr/mg>). They both make it extremely easy to maintain and publish gems to Gemcutter. Hoe was necessary back when RubyForge was the only gem host, but now that we have gem push it's not the simplest way.

<comment><USER5> The other day while creating a new version for my gem, and getting hoe errors, i did look at the link above. It did not look so easy. Instead of creating a gemspec, or modifying my gemspec, i update the Rakefile and then generate a gemspec.

I will try it out and see how it is.

Again, should not ruby have one standard prescribed way of doing it, and not so many.

<comment><USER7> Ruby does. Jeweler, Hoe, and other things are scaffolding for Gems. They get you going, but I found that as I relied on them too much I didn't really understand how it works. You can write a gemspec by hand which is what I have done now for my new gems that I'm working on. When I get time I will change the old ones to use a hand-rolled gemspec and a simple rake file for publishing.

Gemcutter has made it trivial to take a hand-rolled gemspec and publish your gem. No libraries or gem scaffolding necessary.

</comment></comment></comment></comment><comment><USER5> We should be doing something for all those gems which are abandoned or not functional, and also dead ruby projects which have not released code for years.

It makes it very hard to search for a given gem/library -- one has to wade through too much noise. The reason I've stopped downloading perl apps is the same -- many of them depend on some broken, abandoned library -- you waste hours trying to install something before finding some conflicting/broken dep.

Perhaps a repo or listing of live projects, with some rating system.

Now there is new problem: not knowing if a gem is for 1.8 or 1.9.

<comment><USER8> The 1.8 and 1.9 dichotomy is a pain, no doubt about it.

I totally switched to 1.9, wiped 1.8.* from my development systems. In a few cases I had problems (like manual edits to acts_as_list) but life is simpler and the runtime speed increase is really nice. Pardon a link to my own stuff, but I have written about the 1.9 conversion: rubyplanet.net

I am trying to maintain Ruby 1.9.1 and JRuby compatibility on my rails apps which is getting easier to do.

<comment><USER9> I would be completely on Ruby 1.9 right now if not for Redmine. :(

</comment></comment></comment><comment><USER10> Why I don't love Ruby:

Ruby 1.8.6:

        require 'set'
        [[5, 6].to_set].to_set == [[5, 6].to_set].to_set
        => false

Meaning, two identical objects are not equal. This is fixed in 1.8.7, but:

Ruby 1.8.7:

        require 'set'
        [2, 3].to_set.hash == [4, 5].to_set.hash
        => true

I understand hash functions can produce collisions, but they really shouldn't collide for something as trivial as [2, 3] and [4, 5].

Broken semantics for such simple things make me seriously distrust the language runtime completely. At the very least, this means that the much- touted Hash object in Ruby is untrustworthy and can easily lead to data loss or corruption.

<comment><USER11> As you say yourself, 1.8.6 is slightly broken. But do you expect old releases to always be bug-free? 1.8.6 isn't even the newest version of the 1.8 branch, let alone that 1.9 is the current branch of Ruby.

And as for your distrust of the runtime, did you know that 1.9 is an entirely new one?

<comment><USER10> As I noted, 1.8.7 produces a hash collision for [2, 3] and [4, 5]. 1.9.1-p376 has exactly the same behavior. I reiterate: the Hash object is unreliable, regardless of the runtime version. Based on such nasty behavior in such a simple case, I distrust Ruby's runtime and standard library for more complicated uses.

<comment><USER11> Gotcha. I misread that part. My bad. I don't use sets, so I've never encountered this.

</comment></comment></comment></comment><comment><USER12> Ruby painly needed a milestone of stability. Ruby's market is Rails, and while I admit some projects(JRuby, IronRuby, Ruboto, Macruby) trying to explore other possibilities, they haven't got much further than exploration. So what's up with Rails? It's market won't be growing:

1\. Django/Grails/Symfony/ASP.NET MVC are closing gaps in Python/Java/PHP/.NET communities, making RoR not as much attractive as it was couple years ago. Means much less new developers form these communities.

2\. Today's start-ups are moving to RIA, where the UI is built via Capuccinno/SproutCore/GWT/Flex and Rails doesn't provide much benefit here compared to others.

3\. Ruby hardly can fight with Python and PHP on their markets.

I admit Ruby influence and innovations, but I won't put my bets on it.

<comment><USER4> What laughable and superficial conjecture.

1) It's great that the ideas that Rails popularized are being adopted on other platforms. But besides for Django which has a) been out for almost as long as Rails and b) uses a great dynamic language, the other camps you mention doesn't have anything resembling the "Ruby on" part.

Just grabbing the grabbing the general ideas of Rails are trying to fit them into less expressive languages yields some less than desirable results. Have you actually looked and compared any of the code back and forth?

2) Hahaha. The web has been pronounced dead on more occasions that I can count, but RIA has been the boogeyman since the beginning of the last decade. Don't invest your piggybank in it happening this time.

Additionally, I know of lots of Rails apps that are using all those technologies for the front end. Whether your output is HTML or Flash or whatever, you're going to need a backend to handle it. All the benefits of Ruby, Active Record, Action Mailer, and the works are as relevant as ever with that.

3\. What does this even mean?!

Anyway, good luck betting.

<comment><USER13> In general, I agree with you. However, Rails' influence on other platforms has yielded some great projects. My current favorite is play (<http://www.playframework.org>). It's almost a one-to-one feature port of Rails to Java, but actually manages to do it in a way that works very well and very pragmatically. I'm at least as productive in Play as I am in Rails, and that's after many years of Rails development.

</comment></comment></comment><comment><USER14> This is also Ruby's downfall, and until the community can settle down a bit, why Ruby will never be a mainstream language.

I enjoy Ruby, I tend to write my scripts in it, and have written a couple Rails sites in my time. But there's probably 1 Ruby job out there for every 300 .NET and Java jobs, maybe even less. Maybe the Ruby community likes this, I dunno. But for me, it means I've never had a chance, and probably never will have a chance, to really use Ruby in a professional environment.

And I can't really blame companies, if I had a company I wouldn't use Ruby either. I generally find .NET is a nice compromise between Ruby's ADD and Java's glacial pace, but that's just me.

</comment><comment><USER8> Nice article. I have moved on from 1.8.x and just use 1.9.1 for just about everything except when I need to use existing Java NLP and Semantic Web libs, in which case I use JRuby. I have an ongoing infatuation with Clojure and Scala, but Ruby is my go-to language for getting work done.

</comment><comment><USER5> Another reason to love ruby is the great community. The ruby-forum has leading ruby programmers helping out newbies. No one's berated for asking newbie questions.

I am not saying that other languages don't. Java has wonderful JUG's.

</comment><comment><USER15> Loving a language on account of things that have nothing to do with the language seems kind of weak to me. I love the people, communities, and tools that surround python, but if they all disappeared tomorrow I'd still use it.

<comment><USER5> I think you were replying to my last line. I only added that since I had mentioned some gripes and i wanted to avoid someone getting upset and saying "if you don't like it, go elsewhere".

I have my reasons to love working in ruby, most of all is probably how easy it made my work. I have come from other languages which i initially loved but then found too verbose and cumbersome and sort of strait-jacketing. That there are some issues with ruby (such as repositories, or obsolete gems -- a problem with perl and other languages too) should not make me dislike it. Cheers.

</comment></comment><comment><USER16> There is some irony in using GitHub as a shining example of Ruby consider that the tool underlying it all is written in some hardcore C.

<comment><USER17> He didn't use GitHub as a shining example of Ruby. He said the community embraces it, so he's had exposure to it as a result. CouchDB isn't written in Ruby either, and he mentions that too.

</comment></comment><comment><USER18> Seriously, on HN top 5?</comment>


Top tracking apps - <AUTHOR> http://www.toptrackingapps.com/

<comment><AUTHOR> It has all the typical amenities and luxuries such as trace a lost phone (indicates the last location of the mobile before they run out the battery). It also has a great feature that will notify you by e-mail a photo and location of someone trying to unlock your phone in more than five times, something that Android Device Manager can not do.</comment>


VC/Investor Match Algorithm by Prior Investments? (match.com for Investment) - <AUTHOR> Seems with all the discussion these days on how to get in front of a VC, how to find the right investors, and the due diligence startup founders are encouraged to do, why isn't there a relational database that finds top investor/firm matches for a given situation?
Or is there? Am I just not finding it?
I'd like to see something where a founder can put in a few quick facts like: Funding Stage Ask Amount Revenue (or not) Industry Location top 5-10 funded companies that could be drawn as a comparison.
With that info, a fairly simplistic matching engine could scour industry and comparable company data to find prior investors, cut out those that don't invest at a given size or stage, and return contact info as well as bios for the partners or individuals who were responsible for a given highly similar investment, ranked by either similarity or number of highly similar investments by said individual.
(It's a little like dating, is it not?)
v.2 could auto-search for linkedin, facebook, twitter, or other social connections, mention school or prior employer affiliations, or if there is another known best method for getting in touch with someone. <comment><USER2> [https://www.cbinsights.com/](https://www.cbinsights.com/) is in this space.

Also useful: analysis of potential conflict between investment & VC portfolios.

Edit: comparison: [http://www.quora.com/How-do-CB-Insights-PrivCo-DataFox- Owler...](http://www.quora.com/How-do-CB-Insights-PrivCo-DataFox-Owler-Tracxn- and-Mattermark-compare-for-private-company-research?share=1)

<comment><USER3> Having a database of venture information is a first step, and the easy part.

Performing the necessary statistics is the hard part.</comment></comment>


VMware Workstation vs. Sun xVM VirtualBox - <AUTHOR> http://www.infoworld.com/article/08/09/11/37TC-virtual-workstations_1.html

<comment> patrickg-zill Having tested both, right now the ease of use goes to VMware.

VirtualBox, once they fix a few bugs, will win on wider platforms (OSX, Solaris, Linux, Windows) availability and price (essentially free).</comment>


My Love Letter to the Chevy Bolt - <AUTHOR> https://medium.com/@chacon/my-love-letter-to-the-chevy-bolt-e970c63963dd <comment><USER2> I think they gloss over the two big advantages of a Model S - a network of free superchargers and autopilot.

Some out-of-town trips might change

> you do not ever spend a minute at a gas station ever again

into

> you might spend hours chasing free public chargers, and with some of them > you might find out they're taken, blocked by other cars, have an adapter > incompatible with yours (Chademo, etc.) or just plain out of service

<comment><USER3> > _I think they gloss over the two big advantages of a Model S - a network of > free superchargers and autopilot._

There's also Tesla's discounted insurance program, lifetime warranty, and brand value. (Brand value has a real value to the buyer when selling the car.)</comment></comment>


Tell HN: I had an idea to mitigate the risk of being framed with a fake video - <AUTHOR> If you're a public figure, there's a substantial chance that someone will publish a video of you doing something incriminating. If it looks plausible it's your word against a third party's. What can you do?
One starting point would be to wear a device that takes pictures 24/7, geotags them and uploads a signature to a blockchain. Then, if and when a video surfaces of you doing some unspeakable act, you can issue the following challenge:
- When and where do you say this was?
Then the attacker would have to guess a plausible time and place. It must be one in which there is no other footage of you to contradict the account. Let's say they say: this happened on July 4th at 3pm, inside a room at the Grand Hotel. They know you where there because they saw you check in. If you were wearing this device, you could produce a trail of pictures spaced one minute apart, geotagged and verifiable. Of course it's not perfect, but it's a start.
It's pretty clear that videos and pictures are no longer proof of anything, so I believe these types of preventive steps will be a matter of necessity in the near future (at least for public figures). <comment><USER2> Your solution implies they don't do anything wrong 24/7\. That's not the case with nearly any public figure.

<comment><AUTHOR> No, it doesn't matter if they do wrong things lots of the time. What matters is that _if a deep fake surfaces_ then they can use the pictures of that specific period of time to prove they were not doing that. If they happened to be doing something right at that specific time, that's enough.

</comment></comment><comment><USER3> >>One starting point would be to wear a device that takes pictures 24/7,

and someone hacks into that and leaks much more damaging "actual" videos/images than deepfakes.

Remember celebrity iCloud fiasco?</comment>