The Free and Open Internet - <AUTHOR> https://avc.com/2019/02/the-free-and-open-internet/ <comment><USER2> That free model that Wilson louds got us to this point in the first place. Over last twenty years that Wilson been making money investing in free Twitter, etc., thousands of people lost jobs in journalism, etc. He has no solution or suggestion, just ranting. Isn't he the freemium guy anyhow?

<comment> ui-explorer12 add to your points this gem:

>> places like Twitter and Medium that remain open and free.

WHAT? Perhaps only in the most literal sense of "they don't make you pay money to read", but that's not really what people mean when they talk about open and free...

<comment><USER3> Not to mention how much of Medium is behind their paywall...

<comment><USER4> yeah was gonna say Medium literally makes you pay money to read now.

</comment></comment></comment></comment><comment><USER5> > Sure I could have purchased a subscription to the Washington Post, but I > don't believe opinion pieces should be behind a paywall and I certainly > don't believe that something like Dingell's last words should be behind a > paywall.

Quite cheap for a millionaire (billionaire?)! Just think about that for a second. It's comical. Newspapers were never free. Ever. People subscribed or bought them in a vending machine or news stand.

> have ceded their role as the public square to places like Twitter and Medium > that remain open and free.

They aren't free. They both burn massive amounts of cash. Medium isn't profitable and Twitter lost money for 12 years before stuffing it with ads to turn a profit. Oh and most importantly, Twitter doesn't have to pay a single journalist or reporter! Hard for a VC to understand, but WaPo is actually concerned with making money.

> But the way paywalls are implemented today stinks. Some content should never > ever be put behind one.

Well that's just like your opinion, man. WaPo has been profitable under this model.

<comment><USER6> Moreover, WaPo gives a few free articles per month so it's not like this is a one-off where he wanted to read a WaPo article. I can't fathom being in an industry like VC and not having a subscription to all the major papers even just to skim articles that mention portfolio companies.

</comment></comment><comment><USER7> No. Just no. I have downloaded a truly obscene amount of material from the net for the actually tiny fees which ISPs require for access. From 100,000 college grad guides & books to 10,000 "magic" program and production systems, I'm only curious. The Internet leaks and leaks, and how can you make any money?

</comment><comment><USER8> I think cryptocurrency-based microtransactions would be perfect for paying for online content. If browser-based wallets become a thing, making a $0.01 payment to read an article would be easy, painless and potentially sustain online media.

</comment><comment><USER9> Why is the fault even the Post's? The Dingell family (or Dingell himself) decided to sell the piece to the Post, a revenue-generating newspaper that uses a paywall. They had many other options. They probably could have gotten another senator to read it into the Federal Register, where it would have been available to all. But they made their choice.

</comment><comment><USER10> I don't see any way to solve the paywall problem except to have Spotify for news/written content.* Even then there are too many hands reaching into my wallet to the point where I just don't read some things.

*Until there is a universal web currency that is low friction to send like some of the crypto currencies.

<comment><USER11> >*Until there is a universal web currency that is low friction to send like some of the crypto currencies.

I see this idea pop up every day now. It blows my mind that we don't have it yet. It seems so obvious, why hasn't someone written it yet? Can someone just pick a cryptocurrency that doesn't have high transaction fees and make a few browser plugins? Add your payment address to ./well-known or something?

<comment><USER12> The Brave Browser ([https://brave.com/](https://brave.com/)) is attempting something like this. (I expect compatible plugins for other browsers could be made in the future if its system takes off.)

There are complications that make this not super straight-forward to pull off. Low fees in cryptocurrency currently is usually done by having low activity. (There are several projects attempting to solve this in a decentralized way, including the Bitcoin Lightning Network and various Ethereum projects.) Then there's privacy issues.

</comment></comment></comment><comment><USER7> The very simplest of reader tactics. On the Internet, for anything posted, it's stored when read, elsewhere after the read. Web2 is built atop the structure engeineered to provide millitary communication in the "nuke war" scenerio. How will you keep your copy in that scenerio?

</comment><comment><USER13> I recommend taking a look at the good discussion happening in the comments section of that blog article.

<comment><USER14> I can't tell if that's sarcasm. What good discussion are you referring to?

It's not as bad as what I'd normally see on an article. But I don't see much of value. Just a bunch of people sharing anecdotes as to why the death of the news industry is good/bad/deserved.

<comment><USER13> It's not sarcasm. I genuinely found the anecdotes which I saw interesting. The current top rated comment there has a good point on the effects of being public vs. private on news organizations. Further down is a comment so long it could be a HN submission on it's own (and FYI, it's not about the death of the news industry).

</comment></comment></comment><comment><USER15> Thanks for the article! Unfortunately I don't think Medium is an "open" platform, there are paywalls there too.

The other thing I think we need to be careful about is having a "federated" source for the paywalls. To me, this is a scary idea. Unless the solution is open source and completely encrypted, it will just give whichever companies that do it more access to your data, on what you read, when you read it, and what you pay for.

</comment><comment><USER16> > Even the Washington Post's owner Jeff Bezos knew to publish his words that > he wanted everyone to read on an open platform like Medium.

Medium is definitely not free. I always get paywalls when I visit it.

</comment><comment><USER17> The article Fred was looking for, without the paywall: [https://beta.trimread.com/articles/27](https://beta.trimread.com/articles/27)

</comment><comment><USER18> "but I don't believe opinion pieces should be behind a paywall"

Why not (assuming you aren't totally against paywalls)?

I can understand being against basic news reporting being behind a paywall, but opinion is like a newpaper's value add, it's USP.

</comment><comment><USER19> > paywalls should federate, like the early ATMs did, so that joining one means > joining them all

That's an interesting idea. I imagine it could work sort of like Spotify Premium but with a twist. Perhaps that is not what he meant but it's what I came to think of so that's what I want to talk about.

Of course the real problem is getting all/enough/any of the paywall sites to switch. I'll get back to this but for now let's ignore that problem.

How the system will work: There is a payment processor (could be one of the existing payment processors or a new company) that provides the federated system to the paywalled sites. The payment processor handles billing of end- users and once per month it pays the paywall sites according to the proportional amount of articles (another problem I'll get back to) that each user read on each site.

This is similar to the Patreon and other recurring payments services except that payment is calculated automatically similar to how Spotify does it instead of having the end-user decide the amount they want to give to each site. This is done for a couple of reasons. Firstly the point was to lower friction for end-users, so we don't want them to have to individually set the proportions for each site. Secondly, if end-users were to set the proportions then they might forget to update them.

But there are more problems, both for the end-user and for the paywalled sites. End-users might derive more value from some sites than others. In the extreme case there could be two or more sites where one site had a _really_ _really_ good article that the end-user derived _a lot_ of value from but in the same month they read a lot of content on the other site/sites that did not provide them with anywhere near the value of the single only article they read on the other site. And yet they end up giving most of their money to the sites that provided them with less value.

And that problem is further made bigger by this system encouraging the paywall sites to make more clickbait and to use other kinds of tactics to increase the number of articles read just as with the ad-supported model.

So one way to try and combat that is perhaps to use amount of time spent on each site instead of number of pages loaded. Amount of time spent _would_ be a better metric if users simply navigated away as soon as they found some content to be of little interest. And we already know that they do so on the web in general. So it _might_ work to a certain degree. At least it rewards the sites for content that users chose to stay consuming than content that they were simply tricked into loading but which they quickly determined to be not worth their time.

Of course it could still lead to articles that are longer and so take more time to read, while staying sufficiently interesting that readers stick to them. In fact I am pretty sure that this not just could but _would_ happen. We've already seen sites split articles into multiple pages to increase the number of ad impressions they can serve. To instead insert filler content into interesting content within a single article is not much different from that. So while not optimizing simply for pageloads, publishers are still highly likely to optimize for time spent rather than as we ideally would want them to be optimizing purely for value to the end-user.

You could then have a scoring system that allows the user to score each piece of content, kind of like how HN and Reddit has upvotes and downvotes but where you use the scores that each individual user gave to each piece of content when you calculate the proportional division of money that will go from each individual user to the publishers of each piece of content that said individual user consumed that month. But first of all this increases friction once again, which is what we want to avoid, and secondly it encourages publishers to manipulate users into giving a high score. And publishers who made good content and did not remind users to "please give this article a good score if you enjoyed it" would once again get the short end of the stick. And on top of that nobody bothers to score _every_ piece of content that they come by — but that can be accounted for with some maths, the main problem is the friction and incentivizing publishers to manipulate users about the scoring like I mentioned.

There's a lot of other things to consider as well, but I'll round off this comment now with my thoughts on adoption.

On getting sites to switch: I think at the core there are three factors that would determine whether paywalled sites would use this federated system.

One, revenue. Will the paywall sites earn _more_ by using the federated system? With the lower friction of a federated paywall system, it _could_ , but even if there are more subscribed users the sites are also getting only a portion of what each user is paying and the sum of those payments might add up to less than fewer users paying a site directly.

Two, adoption. In order for the system to work in terms of offering lower friction to the end user, high adoption among paywalled sites is required. In the beginning, before adoption is high, why would any paywall site agree to adopt it? A chicken and egg problem.

Three, trust. Will paywalled sites trust the provider of the federated system to be honest and pay them the amount that they should?

<comment><USER20> With Spotify and Netflix, you measure engagement by how many times a piece was listened to/viewed, and the only measure is popularity.

With advertising-based journalism, you measure engagement by clicks - which is bad because it gives us clickbait. You can argue about whether there is clickbait in music and video, but we know that clickbait in journalism is definitely a problem.

In an ideal world, there would be a simple measure of how good/relevant/interesting/informative a news or opinion article is. I don't think anyone has discovered that yet. To my mind, this is the core problem. If we can solve "how to measure objective quality in journalism", then we can apply all sorts of business models to it. All the current business models fall short not because the model is inherently flawed, but because they reward bad journalism. If how much an advert paid the publisher was linked to how good the article was, then we'd have good journalism. As it is now, we reward clickbait-y high-volume low-quality journalism, so that's what we get.

<comment><USER21> > You can argue about whether there is clickbait in music and video, but we > know that clickbait in journalism is definitely a problem.

There definitely is clickbait in video - see Youtube recommendations. In the long run, we should move towards funding content by crowdfunding and open licensing, perhaps combined with a reasonably short embargo period where the content is limited to subscribers. This gives the right long-run incentives, while avoiding either paywalls (after the embargo) or intrusive ad tracking.

</comment></comment></comment><comment><USER22> As much as I was in awe of WaPo's tablet app (on Amazon's Fire), I despise their website on the public Internet ever since they have started the paywall flags. Neither NYT, nor WaPo are going to solve the world's publishing business model on the Internet. The author here makes a lot of good points. And someone please tell me exactly why Bezo wrote his letter on Medium and not anywhere else?

<comment><USER20> if the owner of a newspaper decides what it publishes, that newspaper is no longer considered to have "editorial freedom". This is a very important thing to journalists.

I can totally understand why it's less hassle all round for Bezos to publish in Medium, or the NYT, or any other publication than the one he owns.

<comment><USER21> If the "owners" of a newspaper don't have final authority about what it publishes, they aren't the real owners/publishers in the first place; they just provide funding to it, and perhaps own its branding. It's understandable that journalists like "editorial freedom", because it's a de-facto property right. Who wouldn't like that sort of thing?

<comment><USER23> That's the curious thing: the owner does have final authority, but if they choose to exert it, they lose what they own (as the character of the publication changes).

Like the King in the Little Prince, their authority is absolute, but only if they are reasonable :)

</comment></comment></comment></comment><comment><USER24> I despise paywalls and not because I'm cheap. If I see good value I'd pay for it. I already do it for books, movies and music.

But paywalls are not different from the old model of selling print subscriptions, and that's my problem. I don't see the value of paying for an article of the WaPo or NYT. If I susbcribe then I had to consume that media daily and read several articles to make that subscription worth it and I won't do that. Reading daily news is neither motivating or important for me.

So paywalls for me are just deterrents. I will never get converted into a pay user and they are just another reason for me to go and look for alternative media or simply rely on Twitter with all its biases and shortcomes.

<comment><USER25> >> _If I susbcribe then I had to consume that media daily and read several articles to make that subscription worth it and I won 't do that._

Why do you feel compelled to read several articles per day to make that subscription worth it? I presume the answer is because you think current subscription prices are too expensive. Perhaps this compulsion would be dampened if the subscription price were lower -- but by how much?

<comment><USER3> Or better yet, a service existed that paid per view. Microtransactions, for example, could pay per article read in a similar way to Medium's system (although it would be better if there was just a wallet that it paid from, without a minimum monthly charge). I know Brave is working toward that goal, and I like what they're doing, but I'd prefer if their system was universal (I refuse to use their browser).

</comment></comment></comment><comment><USER7> I have seven T of Junk in my bunk, and dudes, When are you going to get realistic pricing for the native explorers? and pron? A pittance, but sometimes it's hard to get it off. Brains are worth enlightening,but whats a fair cost? Would you follow me around forever? If the net disappeared, I wouldn't/couldn't read all this again... (Oh, filing sys.)

</comment><comment><USER26> For that case, it should use the economist model of you have x free article per month. Then those really burn you like an orange head waving his hair you can read. Or the last word of X.

The title is a bit problematic though. What is meant by free and open if 1/5 of human beings are not allowed to read anything written in English be default. You may argue that is because of their government and people deserve ... But no. I blame it on Internet very design. We were told in 1990s that it is free and open. At worst the commence may have to be tolerant but we can at least offer ourselves and others may. That is within that context this article is. But what we have missed in this context the infrastructure of Internet is not free and open. It is in fact not just closed but a means to monitor every word without a chance to delete.

Free and Open. RIP the last words of Internet.</comment>


Linux team approves new terminology, bans terms like 'blacklist' and 'slave' - <AUTHOR> https://www.zdnet.com/article/linux-team-approves-new-terminology-bans-terms-like-blacklist-and-slave/ <comment><USER2> At long last. It's finally 'The Year of Virtue Signalling on the Desktop'!

<comment><USER3> Please. Even if you don't believe that the terminology has a role in perpetuating stereotypes, it does make people feel uncomfortable and unwelcome.

<comment><USER2> >>..it does make people feel uncomfortable and unwelcome..

Does it really? Have they told you that, or are you feeling offended on their behalf?

I'm from an Irish / Scottish background.

Maybe I should start crying and wailing, next time someone in the office says, at lunchtime, that they're "starving" \- --because it reminds me of the Irish Famine. It might even be cultural appropriation to claim to be "starving" if you're not from a part of the world which has suffered famine.

And if I walk past any shops holding a "Clearance Sale", I'll most likely pass out from the sheer horror of being reminded what my ancestors went through, during the Highland Clearances.

<comment><USER3> I am not personally offended by this terminology.

Yes, I have been told that more than once. Usually in requests to address the issue as quietly as possible. It's always been in the context of new development rather than a request to retrofit older systems), but I don't know if that's self-censoring or indifference.

We aren't talking about cultural appropriation, so why bring it up?

This is about an under-represented group (in tech) subject to current-day prejudice. That's not irrelevant to how the language is received.

Half my ancestors (English) brutally oppressed the other half (Irish and Scottish). None of that oppression is part of my current day experience. But this isn't true for Black Americans.

</comment></comment></comment></comment><comment><USER4> And moderate people supporting the CoC 'promised' it wouldn't be a takeover and that slippery-slope style arguments were fear mongering. Months later Linus is muzzled and the teams are starting to have more and more restrictions based on this microaggression bullshit. Can't wait until they decide the team is 'too white' and they decide to enforce quotas on people based on protected classes.

I previously was unsure that I was cut out for open source but now I'm nearly certain they wouldn't want me.

<comment><USER5> > Can't wait until they decide the team is 'too white' >now I'm nearly certain > they wouldn't want me.

No need to be afraid, there's medication called melanotan II, it can alter your skin pigmentation to appropriate levels.</comment></comment>


How we sold a couple hundred million dollars of software in Japan - <AUTHOR> http://all-things-andy-gavin.com/2012/01/11/crash-goes-to-japan-part-1/

<comment><USER2> _It roughly translated into 'the sound of the guitar mixed with the tree imagery is too nostalgic-sounding'. I'm still scratching my head on that one._

A really good translator might have written that as "Your artistic choices are dated", which is probably what the original author meant to convey. The word invariably translated as "nostalgic" is natuskashii (懐かしい) and it conveys an impression of times-gone-by, which is sometimes not a good thing.

(I once read a delightfully poisonous review of UI decisions by our senior engineer, beginning with "The new interface to the web app reminds me of my childhood experience working with mainframe terminals, except without the complex functionality.")

<comment><AUTHOR> Haha. Ken Kutaragi complained of Crash in the very early days that the "trees should wave their branches at you, giving the nostalgia of childhood." Or something like that. At the time we found it merely puzzling.

<comment><USER3> Natsukashii is one of those Japanese concepts that you just have to learn along with the language, a lot like itadakimasu or the various forms of yoroshiku onegai shimasu. It's not so hard to understand once you understand the feeling they're supposed to convey.

I usually end up mentally un-translating them because the translations end up sounding unnatural in English. Unusual uses of words like "nostalgia" and certain other bits of "translationese" make it easy to spot translations and identify the source language and not just for Japanese. For example, unnatural sounding uses of the word "illiberal" usually indicate statements translated from Chinese.

</comment></comment></comment><comment><USER4> >More problematic was the seemingly simple fact that when a big block of text comes up on the screen the game effectively needs to pause so the player can read it. You can't just "hit pause" but need a separate state. This simple feature caused a lot of bugs. A lot. But we stomped them out eventually.

I would love to hear more of the gory details here.

<comment><AUTHOR> Well pause in video games is actually kinda complicated. By the jak period I had a pause mask (64 bits) that could pause all sorts of independant parts of the game separately. Particles, Camera movement, texture cycling, light changes, enemies, etc.

Sometimes you just want to free the characters in place (and usually enemies and the like) but don't want the whole screen going motionless. For example in Crash, when Aku came out, I wouldn't want to pause the fruit from flying to the score. That would look odd. The Aku pause is to give the player a breather, not just to pause.

Also, the real pause brings up the pause menu, which you certainly don't want with Aku.

</comment></comment><comment><USER5> wow andy gavin on HN would never have expected that.

whats your current thoughts on the "gaming market" these days, so much has changed since the console under the TV ruled the earth. e.g. if you were to start all over what/where/how would you spend your time?

<comment><AUTHOR> I've been on HN for over a year :-)

Starting out is hard now in console gaming, except "maybe" x-box live or something. You'd have to start on iPhone, Android or the like where the costs are lower.

<comment><USER5> over a year cool and thanks for the response! Mr Cerney on here too? aint spoken to him in ages :)

Yup yet I remember when ppl were complaining how PS2/Xbox games x10 game budgets and all hell was breaking loose with the industry doomed. These days iphone/android have technical constraints on par if not more so xbox/ps2 thus making a highly polished game on a phone hell of alot cheaper than AAA console title but still not something you can do in your basement.

Guess my question is what type of game would you start out with? AAA level phone game with 80H+ of gameplay and 10 levels will cost a lot to develop and no one will play past the first level, or pay more than $5 for - IMHO ofcourse :)

<comment><AUTHOR> Probably focus on something simple with very addictive gameplay.

</comment></comment></comment></comment><comment><USER6> calling a title heavily produced by Sony an oddball in Japan is weird.

But takes little away from the feat anyway

<comment><AUTHOR> This was the first American title that was heavily produced by Japan. Before us, Tetris was the only external game that had sold really well. Across all consoles/machines!</comment></comment>


Show HN: Zoomgram – Instagram Image Zoomer - <AUTHOR> http://www.zoomgramapp.com <comment><AUTHOR> We built zoomgram to be able to zoom original sized instagram photos without loggin-in. We love to hear from you. We're also on product hunt today! [https://www.producthunt.com/tech/zoomgram](https://www.producthunt.com/tech/zoomgram)</comment>


Backblaze cuts B2 download price in half - <AUTHOR> https://www.backblaze.com/blog/backblaze-b2-drops-download-price-in-half/ <comment><USER2> I debated switching to Backblaze after CrashPlan's home plan was removed, but they don't appear to have an option to let me send them an external HDD to "seed" the backup, and that's a deal-breaker for me.

I have 4TB of media to backup. My ISP will throttle/penalize me if I download/upload more than 1 TB per month, assuming I do absolutely nothing else with my internet connection. Even assuming I devote 80% of bandwidth to just the backup, it will take me 4-6 months of metered transfers, while paying for their service, before I actually have a "complete" backup with them.

<comment><USER3> I'm curious to know your use case for backing up that much data.

I have this idea in my head that some people are digital pack rats and want to save every movie and series they pirate off the internet in case the apocalypse happens and they desperately need to re-watch an episode of Friends.

Is it uncompressed video? (Why would you back that up to the cloud?) Is it family media? (How many baby pictures did you take???). I honestly have no idea how someone collects 4 TB of data that is worthy enough to back up.

<comment><USER2> You're right, the private data that I choose to preserve is objectively worthless. I shall relay your findings to my family.

"Sorry, Mom, I can't help you watch that _Mork and Mindy_ collection on your bedroom-TV Roku. Someone On the Internet informed me that my digital collections are not worthy of keeping, and I dutifully deleted them."

"No, sweetie, we absolutely _cannot_ share your childhood with our daughter and watch my digital rip of Fraggle Rock. Good parents delete their abhorrent _digital media_ and pay HBO Go $15/month for the privilege of viewing it!"

"What are you _thinking_ , keeping those hundreds of CD's and Vinyl's we ripped together on your iPhone, Dad? You can chuck all that crap that we actually own and pay a monthly fee to Spotify for the privilege of streaming it! Unless, of course, the publisher decides to pull their collection off of Spotify, for whatever reason."

"Hey, guys, now that we're all moved out of the house, we need to talk about the Nintendo 64. Mom and Dad bought it for all of us, so I think it's only fair that we keep the physical console at their place so that no one of us will have exclusive access to it. As for the games, I think each of us should be allowed to take the cartridges with us that we individually paid for and/or receives as gifts. So that'll be me taking Super Mario 64, Majora's Mask, Super Smash Bros, Star Fox 64, and NBA: Hangtime; Steve takes Goldeneye, Ocarina of Time, Perfect Dark, and Donkey Kong 64; and Fred takes Mario Party, Pokemon Stadium, Mario Kart, and Banjo Kazooie. Yeah, I know, I do wish there were some kind of _legal backup_ method that might let us all enjoy the games we collectively owned. Oh well. Maybe Nintendo will release an N64 Classic and we can each pay $80 to play the games we already paid for. Assuming the games we own appear on the collection."

<comment><USER4> I think the idea is that if it is possible / easy to re-obtain the media, then you don't need to back it up (i.e., if it was obtained via bittorrent).

A second classification is data that isn't changing -- you can create a couple backups of that media, store one in a bank safe deposit box, maybe ship another backup to a family member across the country.

Then you have recent acquisitions and ongoing projects -- those are what you would sync daily to an online backup service. So you still have offsite backup of everything, but by splitting up the categories, you end up not needing to sync that much online.

</comment></comment></comment></comment><comment><USER5> Not all bandwidth is created equal. Different providers can have widely different levels of performance. Higher-priced bandwidth _can_ also be better bandwidth.

Cloud providers haven't done a great job of explaining this so far, but Google Cloud's Network Service Tiers product is a good attempt at why they charge more for bandwidth, and how you can get it for cheaper: [https://cloud.google.com/network-tiers/](https://cloud.google.com/network- tiers/)

That said, cheap (and presumably slower) bandwidth may be the right target for B2, given that it's customers are probably using it for backups and private storage rather than, say, serving a website serving photos to millions of visitors from around the globe.

So comparing AWS or Google transfer costs directly to B2 isn't necessarily a fair comparison, depending on your needs.

</comment><comment><USER6> Can HN users share their experience with B2? I wanted to use them as a backup backup solution since their pricing is close to what getting your own leased server would be.

Also, are there ready solutions for B2 and incremental backups of Ubuntu server?

<comment><USER7> duplicati [0] (at least beta 2) can backup to it, however, I use Google cloud storage with it, since B2 is a single datacenter. I like a bit of extra paranoia, even if it is backups. I hear they are spinning up a second one, but not sure how multi-Region storage will work.

[0] [https://www.duplicati.com/](https://www.duplicati.com/)

<comment><USER8> Disclaimer: I work at Backblaze.

> since B2 is a single datacenter

Backblaze now has three datacenters spread about (two in Sacramento area 50 miles apart, and one datacenter in Phoenix). However, if you store exactly one file in B2, it will land in one of those three datacenters. Very soon we will allow you to choose which of the three datacenters your one file lands in.

> I like a bit of extra paranoia

So do I, and I would NEVER keep a valuable piece of data in only one datacenter with only one vendor. My advice to my closest friends is you value a piece of data highly, you should have three copies with three separate vendors and technologies. For example, one copy on your local laptop, one copy in Amazon S3, and one copy in Backblaze B2. You might also make sure the Amazon S3 is not hosted in the same building as the Backblaze B2.

Since Backblaze B2 does not share a single line of code with Amazon S3 and no employees and a different billing system, this means a bug or network outage or malicious employee inside Amazon S3 won't affect your copy in Backblaze B2. For bonus points, use two different credit cards to pay for it that expire at different times. If you forget to pay your Amazon S3 bill, they will delete your data for sure.

<comment><USER9> > > I like a bit of extra paranoia

> ... three separate vendors and technologies ...

> ... does not share a single line of code with ...

> ... use two different credit cards ...

This person legit thinks about failure modes.

<comment><USER10> Yev from Backblaze -> we think about failures ALL the time...

</comment></comment></comment></comment></comment><comment><USER11> Great service - combine with restic for secure and cheap backups with automatic deletion.

I went from only affording to backup the most important files with Tarsnap to just backing up / with B2. It's the difference between $1/mo and $50/mo.

</comment><comment><USER12> I use backblaze for my backups with restic and enjoy it, but their service is just so slow I'm now looking at giving digitalocean a try instead. Transfers both up and down are painfully slow even on a 1Gbit connection.

<comment><USER13> Where do you connect from? Backblaze only has one datacenter, in Sacramento, CA [1].

[1] [https://www.backblaze.com/blog/our-secret-data- center/](https://www.backblaze.com/blog/our-secret-data-center/)

<comment><USER10> Yev from Backblaze here -> We have 3 data centers located in Sacramento and Phoenix, hoping to increase that soon!

</comment></comment></comment><comment><USER14> I would guess this is a reaction to Digital Ocean's object storage, which is also $0.01 per gb downloaded.

<comment><USER15> The great thing about DO storage is that it is S3 API compatible. The not-so- great thing is that DO has serious stability issues. Try deleting 1000 files and the backend just gets stuck for like 5 minutes :/ Make more than 100 calls and you get rate limited. DO does not acknowledge how serious the issues are. Not sure how B2 API performs.

</comment></comment><comment><USER16> Cool! I'm using them to store my Time Machine backups from my Synology. The first month I burned through about 3TB of my 1TB with comcast, but that's the only month I went over my 'cap' (they have 2 months' grace period).

The only problem I have is that my Time Machine backups change too much -- for, say, 400MB of data being backed up in time machine, it seems like the deltas (and what is synced to backblaze) is something like 4GB. I'm using the CloudSync functionality from Synology -- I think the issue is with Time Machine, not with CloudSync, though.

What this means is I'd regularly exceed my data cap if I let me CloudSync run all the time. As a workaround, I've scheduled it to only run between midnight and noon on Mondays, which results in syncing less data (apparently the deltas must contain a lot of duplicate data that doesn't have to be synced up to BackBlaze when I only do it a few times a week).

Of course, now my problem is I'm afraid that I'm risking the integrity of my backups because the schedule might cut off my sync in the middle of a run. Since I leave my home computers off during the day, though, there shouldn't be new deltas occuring as I'm syncing to backblaze, so once it catches up (and 12 hours is enough to catch up), there is no more activity.

<comment><USER17> I'd recommend you to look into borg backup for your important data. It has deduplication and such making the deltas rather small.

</comment></comment><comment><USER18> Plain and simple: you won me. I am hosting (covering the cost out of my own pocket) a very interesting motley collection of pictures of Hungarian history, our first sister site is [http://fortepan.us/about/](http://fortepan.us/about/) you can get a feel what it's like and I have been carefully watching for affordable professional backup solutions. Yeah, the unlimited google drive is nice but it's also a hack and they don't really support this at all.

I had my eyes on B2 because the storage costs were within budget but didn't switch our backup to it because if we ever needed to download it, well, what then, it was too expensive.

I will upload our 100k / 2TB or so photos the weekend. Awesome.

Now I am reviewing this... you are now on BunnyCDN level of download pricing. Are you like a CDN or does every European download need to cross the Atlantic?

<comment><USER19> Have you considered uploading your corpus to the Internet Archive? If not, would you like help doing so?

<comment><USER18> OMG that would be fantastic! Yes please! chx1975 gmail com finds me. Thanks!

</comment></comment></comment><comment><USER20> Backblaze still won't let you label a snapshot. It's so frustrating when I've got say folder A, B, C, and I take a snapshot of each, I have no way to tell which snapshot is which. And god forbid those folders are 100GB in size. This is my only gripe with them.

<comment><USER10> Yev from Backblaze here -> very interesting! We'll look in to this.

<comment><USER20> Yeah please fix it. We won't use snapshots since they are only labeled with the time you create them. It's a joke.

</comment></comment></comment><comment><USER21> I'm about to set up a NAS device at home for personal storage am looking at cloud providers for an offsite backup. I was originally going to send stuff to AWS glacier since my offsite backup is pretty much only going to be for disaster recovery (fire/theft etc).

This is my first time seeing Backblaze and it looks appealing, does any one have any opinions on using it vs glacier/s3?

For context I currently have less than 1TB of data I need to store and I don't expect to upload more than a few GB per month.

Also would I use B2 or the unlimited personal storage?

</comment><comment><USER22> Is this as simple as, "we did market research and we found people wanted to use the service, but didn't want to pay very much?"

Or, was it, "the performance (or some other factor) isn't worth using the service at the current price"

I mean, charging 1/9th of the amount that Amazon does sounds incredible. I'm guessing Amazon has lower costs but it also seems like they're just giving it away now.

<comment><USER23> >I mean, charging 1/9th of the amount that Amazon does sounds incredible. I'm guessing Amazon has lower costs but it also seems like they're just giving it away now.

Shop around, bandwidth costs _nothing_. Amazon & Co. simply charge insane prices. Backblaze will charge you $3285 if you download at 1gbit/s for a month straight, you can get a gbit line for 10th of that.

<comment><USER14> This is really the dirty secret for the big 3 cloud providers. Their egress charges have huge margins. I'm hoping that smaller players like Digital Ocean reaching up, and better competition across the big 3 starts to push egress pricing back into a more reasonable level.

<comment><USER8> Disclaimer: I work at Backblaze.

> dirty secret for the big 3 cloud providers. Their egress charges have huge > margins.

I don't know about the other providers, but Backblaze buys bandwidth at about 2/10ths of 1 cent per GByte right now, and it drops by maybe 10% per year. We look around hard for inexpensive bandwidth, and then make sure we always have redundant network providers and redundant paths. That's all blended into the 2/10ths of 1 cent per GByte cost basis.

Part of this is complicated by any "spikiness" in network traffic. Network providers sell bandwidth based on things like "95% of peak traffic". So the 2/10ths of 1 cent per GByte is based on an assumption that overall the outbound traffic is perfectly flat. It would be more expensive to Backblaze if "most days" the outbound traffic was 200 Gbits/sec but once every 7 days it spiked to 400 Gbits/sec for 25 hours then dropped again. In that case Backblaze is hit with a bill for 400 Gbits/sec sustained for the entire billing period (a month), but customers did not use it up in a "flat" fashion so it eats into our margin.

Luckily, since Backblaze supports hundreds of thousands of different individual customers, it appears mostly "flat" to us in aggregate. The five week days tend to be about 10% higher network use than the weekends, but other than that it is all super flat and regular (so far).

<comment><USER14> Yes, I wasn't talking about your $0.01/GB egress charges.

Amazon, for example, starts at $0.15/GB. It drops down with more volume, but it's obviously gouging to a ridiculous level.

<comment><USER8> > Amazon starts at $0.15/GB and drops with more volume.

Which has ALWAYS baffled me about Amazon's pricing. I would have thought they price it the REVERSE where it is low price at first, and rises. For example, start with a "low introductory rate for the first Petabyte" to get small businesses addicted to Amazon services while Amazon still makes a (solid) profit, then when the small business grows into a large business that requires more than a Petabyte of data Amazon would increase the price because: 1) scaling is hard and does cost money, and 2) a company looks into the future and says "heck, if we reach a Petabyte we're making so much money we can AFFORD the higher Amazon rates", and 3) as a company grows quickly they have so many other problems they won't prioritize getting off Amazon, especially if Amazon is scaling well for them.

Related side note: scaling really does cost extra money. For our online backup business, almost no customers have more than 10 million files in any one "backup" (each backup is "per laptop") so as programmers we can use any data structure we like to browse those files, a flat list IS FINE. But for B2, a large customer might have 1 billion files in one "bucket", and so we have to be a HECK of a lot smarter about how we organize that data so that the customer can still sign in with a web browser and view them all. For Backblaze, that meant moving up to a clustered hash database called Cassandra, and deploying (so far) about 50 1U computers, each with two CPUs, each with fast SSDs and a layer of complicated code to manage all of it. So the scaling requirements of the Personal Backup client required 0 extra servers, but at B2 scale it requires an additional $175,000 worth of equipment. Scale costs extra money.

</comment></comment></comment></comment></comment></comment><comment><USER24> Are Backblaze planning on offering solutions for europeans?

<comment><USER8> Disclaimer: I work at Backblaze.

> Are Backblaze planning on offering solutions for europeans?

About 15% of our business comes from Europe today, and we collect VAT tax accurately for all Europeans as required by European law. So if you are willing to encrypt your data in Europe and send it encrypted WITHOUT the encryption keys to store it encrypted in B2 (zero knowledge) in the USA, then Backblaze would love to have your European encrypted data.

If you are asking when Backblaze is going to open a European datacenter where you can guarantee your encrypted data sits on disks inside of Europe, we are hoping to open that datacenter in 2018 (this year).

<comment><USER24> Thanks, I'll keep an eye out for that announcement.</comment></comment></comment>


Linux USB charging, part 2: implementation - <AUTHOR> https://lwn.net/Articles/694062/ <comment><USER2> If you appreciate these articles, please consider subscribing to LWN - that's what allows us to pay people like Neil to write them...

<comment><USER3> Great suggestion! I just subscribed because of this article (& pt 1).

</comment></comment><comment><USER4> This should not be submitted separately from: [https://news.ycombinator.com/item?id=12157565](https://news.ycombinator.com/item?id=12157565)

This link should be a comment on that article not a separate submission. That's just spamming the front page.</comment>


We're suing everybody on Twitter - <AUTHOR> http://www.theglobeandmail.com/news/technology/globe-on-technology/were-suing-everybody-on-twitter/article1613285/

<comment><USER2> Refreshing to see a newspaper take up this stance.

</comment><comment><USER3> There should be some law against using the law to hinder progress. ;)

<comment><USER4> Wouldn't that be some sort of interminable recursion stack that causes Government to run out of memory and crash? ;P

<comment><USER3> You're assuming this isn't our reality. :)

</comment></comment></comment><comment><USER5> Yes, we need more lawsuits like this (I know it is a joke, but they should actually make the motions to go through with it) to show the complete absurdity of these other suits.

<comment><USER6> Totally agree. Talk is cheap.</comment></comment>


Ask HN: How can I find internships with startups in the US - <AUTHOR> I'm looking for a summer internship in 2016. I am a third year computer engineering student at Nanyang Technological University, Singapore and am currently interning at PayPal, where I am working on and learning a lot about Android development and Node.js server side development. I also have some experience in Python through side projects (https://github.com/Pathangi-Jatinshravan).<p>I am of Indian citizenship and will require a J1 visa sponsorship to intern in the United States. <comment><USER2> [https://techmeabroad.com/](https://techmeabroad.com/)</comment>


Netflix will add interactive games to its platform later this year - <AUTHOR> https://www.theverge.com/2018/6/13/17460092/netflix-interactive-games-minecraft <comment><USER2> This will mark the moment when my kids no longer have late hours access to Netflix. No more movies at bedtime - the temptation to fire up a game will be just too great.

</comment><comment><USER3> Interactive games? As opposed to _non_ -interactive games?

(I guess the distinction matters if you consider a pre-set Game of Life a _game_ )

Or is it about interactive _video_ , the thing that we had (and nobody wanted) in the 90's?</comment>


PostCSS 1.0: Framework for CSS post-processors with full source map support - <AUTHOR> https://github.com/ai/postcss/releases/tag/1.0.0

<comment><USER2> I'm a huge fan of Sass. In fact I taught myself web development with Sass/Bones, so writing in pure CSS makes me feel kind of like a caveman making a fire. I 'get' why Sass and other preprocessors will make my life easy. I don't 'get' why a postprocessor will make my life easy...

<comment><AUTHOR> I use Sass with postprocessors. They are not enemies. Sass and preprocessors are better to fix CSS syntax. Postprocessors are better for some automatically task, like autoprefixing, media queries packing, polyfills, etc.

Unfortunately, Sass is not so flexible as JS. Even simple things require a lot of code. And a lot of task is just impossible on Sass (for example, Autoprefixer, RTLCSS).</comment></comment>


A Day Made of Glass... - <AUTHOR> http://www.youtube.com/watch?v=6Cf7IL_eZ38 <comment><USER2> Lots of the same tricks repeated, but very cool. It's all about the software!

<comment><USER3> And the display technology. And the sensing circuits. And the pixel moving hardware. And the device interchange standards. None of which Corning makes.

It's comforting to know that in the near future we're all so stupid that we need in-car navigation to find our way to the office each morning.

<comment><USER4> Glass dashboards? I don't think so.

<comment><USER3> Don't be so sure.... [http://www.automotiveaddicts.com/wp- content/uploads/2009/03/...](http://www.automotiveaddicts.com/wp- content/uploads/2009/03/tesla-model-s-interior-screen.jpg)

<comment><USER4> That looks pretty cool. I got the impression in the vid that the whole dashboard, over to the passenger door, is glass. That would hurt if you bounced your head on it.

<comment><USER3> Guess it's not really Corning's job to figure out what happens with people hitting glass, either on dashboards or clumsily walking through wall-sized transparent projection screens.</comment></comment></comment></comment></comment></comment>


Bruce Schneier: 'The Internet Era of Fun and Games Is Over' - <AUTHOR> http://www.dailydot.com/layer8/bruce-schneier-internet-of-things/?tw=share <comment><USER4> > When it didn't matter—when it was Facebook, when it was Twitter, when it was > email—it was OK to let programmers, to give them the special right to code > the world as they saw fit. We were able to do that. But now that it's the > world of dangerous things—and it's cars and planes and medical devices and > everything else—maybe we can't do that anymore.

Mark this mindset as the beginning of the end of the open, inclusive programming world as we know it.

Schnier visited RIT (my alma mater) last spring, and his presentation revolved around the threat presented by IoT and the growing need for national legislation to encumber it. I asked him a pointed question about how this scaled to the _international_ level, which he decided mostly not to answer (focus on domestic policy first, and such). Because the answer is simple: _it doesn't_. Without global collaboration, this philosophy is the beginning of national internet feifdoms - moreso than what exists today - and the beginning of the end of the global collaboration we freely enjoy today. I value this freedom a lot.

I respect Mr. Schneier for his poignant responses to popular security issues and his ability to be a public face for computer security, but I strongly disagree with where he's lobbying we take the future to. Maybe I just can't accept the hard reality that "security isn't easy" and that government regulation is the only way to force security on people.

<comment><USER5> It's not like regulating devices is unprecedented. New devices already have to be approved by the FCC before being sold in the U.S. Suppose that the FCC also checked that Internet-capable devices are safe to be connected to the Internet? This would have global impact because most companies want to sell their devices in the U.S. (And even more so if other countries with big markets cooperated with similar standards.)

Another possible model would be something like having Underwriters Laboratories and other independent organizations check the devices.

This is never going to be perfect, but it doesn't need to be. The goal is to make sure that devices people buy at the store are reasonably secure. In previous eras, the goal of new regulation was to make sure that you can still listen to the radio and watch TV, and that people don't often get electrocuted by their appliances. By and large it seems to have worked.

For more: [https://en.wikipedia.org/wiki/Nationally_Recognized_Testing_...](https://en.wikipedia.org/wiki/Nationally_Recognized_Testing_Laboratories)

<comment><USER6> The FCC worked because the devices they regulate are mostly local in range, but this stuff is global. Even if you do get some regulation in the First World internet devices, there are still going to be millions of legacy devices, millions more unregulated in the Third World, plus how many illegal ones and even more with latent flaws. All of them are going to be targets in the next DDOS botnet wakeup. So what do you do there, put up national firewalls? How?

There's around 9,000 CVE's this year so far. Should devices be checked against all of them? How about next week, does the vendor have to go back and check your fridge? Do they have to patch it? For how long? Who pays for all that? A $20 webcam suddenly needs $500/year just in ongoing maintenance and updates.

I don't have any answers, only questions.

<comment><USER4> And, not to be prudish, but the lack of regulation is part of what has allowed the industry to explode. It's more unlikely I can succeed at a kickstarter for a neat computer dongle if it needs an extra few thousand dollars for regulatory approval before I can ship it. While I have no personal experience with the FDA approval process, my father worked for a company in the healthcare industry - I'd hear stories of multi-month long FDA audits of their hardware after a 'statistically significant' number of failures in the field. That kind of pressure is not amenable to single-man operations, as is frequent in our field - nor should a dev be on the hook for lifetime tech support for a silly lightbulb or other trinket. Yea, the infrastructure as it currently stands has issues, but while regulatory pressure will whip the big players into line, it could also easily choke out smaller players and startups.

On the subject of answers, rather than questions... I have a funny story. So the XBox one has this neat feature where you can control your console via an app on your local area network PC or phone. The default setting was that any device on the network the Xbox was connected to could control it. Imagine this, in a college dorm. I saw a lot of xboxes available to control. So, after testing with a friend (yep, I could easily interfere with whatever), I developed a key combo that I could rapidly input from any console state which would open the settings menu and disable the remote control feature, locking out my own access (And I'd know it had worked because I'd be disconnected). That's right, I effectively developed a virus which patched the vulnerability. If attackers have the advantage in this field, then maybe we should put more effort into thinking about friendly counter-attackers. If the silly IoT device can be pwned, then it can be pwned for good, as it were. Does anyone know of any groups working in this area, or any research done towards it? Pen-testing and other white hat hacking activities I know about, but does anyone officially do this kind of guerilla-patching?

<comment><USER7> I'm having difficulty finding any authoritative or historical resources on this, but I recall that "good" viruses were for some time planned that would do just that: Run around, see if they could infect via the method, then patch and self-destruct.

Ultimately the idea was considered not good because of difficulties with getting it to work as expected, pressure and fear that the fix would introduce more issues, liability issues, and so on, and probably some ethics debates on computer intrusion even for the purpose of securing the device.

I'm not really sure what stance to take on such an issue, since the idea behind it is good intentions, but I feel like it can lead to unintended consequences that ultimately would have no one liable. For my personal machines I have fairly vanilla setups, but many of my friends and colleagues have rahter intentionally complex set ups and most definitely would object to someone accessing their set up and making changes without their permission.

<comment><USER8> I remember a history¹ about one that was tried. It just took down the university network where it was placed.

1 - I'm sure it is in one of my undergrad textbooks. In other words, no way I'll find it again.

<comment><USER9> Sounds like Welchia. See, e.g., here: [http://www.internetnews.com/ent- news/article.php/3065761/Fri...](http://www.internetnews.com/ent- news/article.php/3065761/Friendly+Welchia+Worm+Wreaking+Havoc.htm)

<comment><USER4> > "Increased ICMP traffic"

Wow. If a virus propergated like this on today's networks, would such traffic event make a noticable dent in the available bandwidth?

Anyways, I hadn't heard of this virus - it's super neat. Patching its own infection vector and even explicitly removing an existing virus from the target machine... The article loathes it for how overtly it affects machines (forced restart to apply an update) and networks (congestion), but the work it attempted to do was decidedly good. Sounds to me like it worked well, but had poor execution in accounting for the network effects it would have. (I doubt it was rigorously tested in a prod environment ;) ) If anything, I'd see this as a case study that this kind of offense-as-defense strategy has the potential to work... Its just nobody wants to take responsibility to do so.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> The problem is that software engineering is hard.

Immensely so.

On a scale of engineering "hardness" (meaning, we can predict all side affects of action), software engineering is closer to medicine than to, say, civil engineering.

We know stresses, materials, and how they interact. We can predict what will happen, and how to avoid edge cases.

Software? Is there any commonly used secure software? Forget about Windows and Linux. What about OpenBSD?

Did it ever have a security hole?

And that's just the OS. What about software?

There are just too many variables.

So what will happen?

There will become "best practices" enshrined by law. Most will be security theater. Most will remove our rights, and most will actually make things less safe.

Right now, the number one problem of IoT security is fragmentation. Samsung puts out an S6, three years later stops updating it, a hole is found, too bad. Game over.

The problem is that "locking firmware" is common "security theater", which, if there'll ever be a legal security requirement on IoT, it'll require locked bootloader and firmware.

And you can't make a requirement to "keep code secure", because then the question will be for "how long"? Five years? 10 years?

<comment><USER11> > On a scale of engineering "hardness" (meaning, we can predict all side > affects of action), software engineering is closer to medicine than to, say, > civil engineering.

This level of hubris is pretty revolting. Software engineering is _easy_. Writing secure software is _easy_. The difference between civil engineering or medicine and software engineering is that practitioners of the former are held responsible for their work, and software engineers are not and never have been.

Nothing will improve until there are consequences for failure. It's that simple.

<comment><USER12> > Nothing will improve until there are consequences for failure. It's that > simple.

Of course it's not that simple. Clearly you've never written much, if any, real software.

You want to make an SSL connection to another web site in your backend. You use a library. If that library is found to contain a vulnerability that allows your site to be used in a DDoS, where do the "consequences for failure" lie? You used a library.

Do you think people will write free libraries if the "consequences" fall back on them? If not, have you even the slightest understanding of how much less secure, less interoperable and more expensive things will be if every developer needs to implement every line themselves to cover their backs? Say goodbye to anyone except MegaCorps being able to write any software.

Where does this end? Would we need to each write our own OSes to cover ourselves against these "consequences", our own languages?

<comment><USER13> The same could be said for any industry.

Anyone can practise carpentry, but if someone is going to do so professionally and build structures that can cause injury or damage if they fail, then they should be accountable for the consequences. This is why indemnity insurance exists.

In software, a lack of rigour is fine for toy applications, but when livelihoods and safety become involved, we need to be mindful of the consequences and prepared to take responsibility, just like everyone else in society is expected to do.

<comment><USER12> The problem is identifying potential risks. It's obvious if I build a building it might fall down. It's not obvious if you sell web cams they might be used to take part in massive DDoS attacks.

<comment><USER14> Well now it _is_ obvious, and honestly it has been so for a while. The reason we have shitty security is not because the risks are unknown.

</comment></comment></comment></comment></comment></comment><comment><USER15> I can propose a quite straightforward solution for this mess: do not connect things into the Internet.

Your thermostat maybe wants to talk with your alarm clock. I can get that. But it does not have to happen over the Internet. Let them talk locally.

<comment><USER4> That's actually what Bruce wants - and he figures the only way to enforce it is through regulation. He's given up on the sensibilities of individual companies and programmers, and would instead like to rely on regulations to make some basic guarantees.

You and I know the basics of computer security. We can take a crack at designing a secure system and maybe do okay. But the argument goes like this: Yes there are security conscous programmers, but there are also many which are not. And those people work on products which make it to market. How do we stop those products from making it to market? Government intervention. He's given up on education and relying on the informed developer, and would rather rely on public policy. I find it a bit sad.

<comment><USER16> The free market crowd would argue that the surviving companies will bake in the right security if consumers demand it. If companies don't take it seriously, either their customers aren't demanding it, or they will be replaced by companies that do a good job at it.

The government has a proven conflict of interest and disincentive to harden the infrastructure. Vulnerabilities are valuable for espionage. And there are already regulations like HIPPA, PCI, etc, yet there are still breaches. Regulation will add complexity to business and will protect market share for the entrenched players who can afford to follow it. That will lead to further consolidation and reduced competition while I feel that the opposite is needed.

The fiefdoms described in another post wouldn't be such a bad thing. At the nation state level, competition will also make for better security. Isolationism doesn't work out well in world history. Movement of goods and ideas does a better job at bringing countries together. I feel there's a pendulum swinging back towards isolationism but it goes back and forth over time.

<comment><USER17> What the free-market crowd can never account for - here, or anywhere - is how the market is supposed to resolve issues that are not of direct, immediate interest to self-serving buyers or sellers, but which are of massive and justifiable interest to third parties outside the transaction.

Case in point: If a seller in one country can lower the costs of a good shipped to another country by scrapping responsible waste management in favor of polluting the commons (i.e., places where individual property rights claims are difficult to press), then "the magic of the market" is likely to increase - not decrease - the amount of pollution generated by the trade.

What libertarians don't like to admit is that they see free markets as more than ideal mechanisms for preserving efficient economies. They also see them as efficient sources of good and just governance. Like all belief systems, faith in the quality of governance supplied by free markets, while rational and well-supported to a point, can be taken to counter productive extremes where it maintenance stops operating like empiricism, and starts to function is ways indistinguishable from fundamentalists religions.

Not sure how many sensible knowledgeable people want _this_ to be the dominant force in guiding global network security.

<comment><USER18> As a nuance though. one could agree with the notion of negative externalities naturally occurring in a free market economy (perhaps in a total laissez faire environment the affected third parties could retaliate in kind though) but disagree with the form of policy to address it. In principle the market should be able to select appropriate fixes if the costs are internalized, but governments have a tendency to focus less on the internalize costs part, and more on selecting fixes. Pragmatically it might be the best way forward, but in principle it goes against free market resource optimizations and instead becomes a gamble that whatever fix is made policy actually do have an impact on the problem, and doesn't make things worse.

<comment><USER17> _Pragmatically it might be the best way forward, but in principle it goes against free market resource optimizations_

This is a pretty good argument the absolute value of principle, tbh

For what it's worth, I tend to see principles like map; useful - <USER2> indispensable - in many situations, that are nevertheless abstractions and therefor imperfect guides to actual reality. Use maps, yes, but avoid mistaking them - or any system of symbols - for the things they represent (i.e., the map is not the territory).

Indeed, principle is a form of proxy wisdom for the young and inexperienced. It's better than nothing, but probably not enough to save you from at least a few episodes of hard reckoning. Assuming these don't get you killed, the places where principle doesn't serve are the ones where mature judgement develops.

Granted, there's a point where this doesn't serve either, but that's okay too since mortality always wins in the end.

</comment></comment></comment></comment></comment></comment><comment><USER19> It feels like they are using dyn ddos incident as a 9/11 of the internet. So much fear mongering and push for government involvement, disgusting. Next thing you know you'll need a license to write software for appliances and mandated to put a surveillance API into everything.

<comment><USER20> Schneier point of view is that government involvement will happen and it is better to shape this involvement before the US government is forced to intervene after a large-scale disaster.

> Nothing motivates the U.S. government like fear. Remember 2001? A small- > government Republican president created the Department of Homeland Security > in the wake of the 9/11 terrorist attacks: a rushed and ill-thought-out > decision that we've been trying to fix for more than a decade.

> A fatal IoT disaster will similarly spur our government into action, and > it's unlikely to be well-considered and thoughtful action.

> Our choice isn't between government involvement and no government > involvement. Our choice is between smarter government involvement and > stupider government involvement. We have to start thinking about this now. > Regulations are necessary, important and complex — and they're coming. We > can't afford to ignore these issues until it's too late.

[https://www.schneier.com/blog/archives/2016/11/regulation_of...](https://www.schneier.com/blog/archives/2016/11/regulation_of_t.html)

</comment></comment><comment><USER21> I'd love to see what a detailed version of security policies and infrastructure look like in a world of backdoor-less strong encryption from Schneier, the EFF, the Hopkins crew, etc. Something that can be used to persuade, or at least influence policymakers by allowing them to see that another way is possible, one that allows security services to do their job in a way that allows them to feel that their work isn't futile, while simultaneously respecting privacy rights. I think the need for strong encryption and no backdoors (which as Schneier himself has explained in the past, are always a double-edged sword) are very important and I support them, but that those on the side of it who also have in-depth knowledge about the finer details don't deign to articulate just what exactly the policy looks like without resorting to just a list of what we shouldn't do and vague allusions to "just go old-school" or "utilize human assets more."

A coherently articulated, normative counterfactual security platform would be a better place to argue from.

It's a cousin to the negative liberty arguments: they only list what not to do to in order to avoid hurting people, rather than what we can do to help them (positive liberty.) Maybe we could frame the question as "If we let the EFF and Bruce Schneier redesign the United States security apparatus from scratch, what would it look like?"

We already have excellent critiques, and are good at articulating "what's bad," but far too little on "what would a good system look like that strikes the 'right' balance?"

<comment><USER22> A combo of per-customer authentication at packet-level, DDOS monitoring, and rate limiting (or termination) of specific connection upon DDOS or malicious activity. That by itself would stop a lot of these right at the Tier 3 ISP level. Trickle those suckers down to dialup speeds with a notice telling them their computer is being used in a crime with a link to helpful ways on dealing with it (or support number).

Far as design, they could put cheap knockoff of an INFOSEC guard in their modems with CPU's resistant to code injection. Include accelerators for networking functions and/or some DDOS detection (esp low-layer flooding) right at that device.

[https://en.wikipedia.org/wiki/Guard_(information_security)](https://en.wikipedia.org/wiki/Guard_\(information_security\))

</comment></comment><comment><USER23> I think I live in a bubble...

But...

Who buys these products? Why does a toaster need to be connected to the internet and synced with your "smart"phone? What exactly can you achieve having this feature?

<comment><USER24> Not sure about a toster, but there are benefits to having some household appliances connected to the internet. For example, a washing machine may be able to determine what hour it should operate for maximum energy savings, and ping you when finished. I guess a toaster could be similar; pre-loaded with bread so you could ask it to start toasting before getting up from the sofa.

> Consumers may find it totally cool to design images for toast using a > smartphone. Meantime, the resulting data would help food companies > understand how people approach breakfast, design new products and market to > consumers more effectively.

[http://blog.rackspace.com/internet-of-things-why- connected-t...](http://blog.rackspace.com/internet-of-things-why-connected- toasters-and-other-smart-home-devices-matter)

<comment><USER25> > [...] pre-loaded with bread so you could ask it to start toasting before > getting up from the sofa.

But how did the bread get in the toaster?!

</comment></comment></comment><comment><USER26> Could we not solve the problem of DDOS through collaboration between hosts and ISP's?

1) DDOS attack is detected 2) Attacking IP addresses are sent automated DDOS abuse notifications 3) ISP, like your credit card company when it's machine learning algos detect fraud ask for human back channel verification like SMS. 4) ISP notifies user of suspected bot on one of their devices. The onus is put on the user to run a secure network and remove or fix offending devices.

This system could work well for residential connections at least.

It could be implemented similarly to the way spam is handled by the internet, bad neighborhoods and networks that don't self police are treated as second class citizens.

<comment><USER27> > It could be implemented similarly to the way spam is handled by the > internet, bad neighborhoods and networks that don't self police are treated > as second class citizens.

Please no, the way spam is handled on the internet means that anyone who isn't already a massive internet company is usually treat as a second class citizen

<comment><USER26> On second thought, agreed. I hope that is not part of the solution.

I think that our routers may be the key, or are at least completely negligent at the moment.

A normal consumer router is essentially a black box, but it should be a watchdog. The router should alert users when suspect outbound traffic is originating from it's network.

Of course the router could be compromised, and router patch cycles are atrocious generally, but this method could notify in case of hacked IP cameras and thermostats.

</comment></comment></comment><comment><USER28> In my opinion, this is yet another example of a social problem that technology simply amplifies.

Humans make mistakes. Computer systems are fragile. As humans keep developing computer systems, new attack surfaces, new vulnerabilities will be introduced. It's pointless to try and keep playing catch-up either with or without "regulations".

Instead, we should consider _why_ such attacks happen in the first place. Who are the targets? States? Corporations? Maybe they're not open enough. Maybe they're too powerful. Or are we afraid that our governments, corporations, or other entities/instituions of our society invade our privacy to manipulate us? Or are we scared for our wealth or status?

None of these are technological issues at their core. Our society needs to adapt and grow up to this powerful technology. Until then, the only thing we can do for our safety is refuse to use it.

</comment><comment><USER29> "Any sufficiently advanced technology controlled by a miscreant is indistinguishable from a possessed object in a Stephen King Novel."

[http://thefutureisastephenkingnovel.com/assets/player/Keynot...](http://thefutureisastephenkingnovel.com/assets/player/KeynoteDHTMLPlayer.html#2)

</comment><comment><USER30> Yep. Keep IoT on the LAN, or give it the same respect you would any other networked computer.

However, the day the the Internet Era of Fun And Games is over is the day that the internet keels over dead. The Internet was (almost literally) built on fun and games.

<comment><USER31> But the problem has been people haven't done that. So here we are.

Maybe some stick (vs carrot) for unwittingly contributing to a DDoS to make people care will work? Not sure. I'm not really liking any of these solutions, but the problem is that it'll get worse.

<comment><USER32> I don't know, do they have to run on the same network as everything else?

Maybe a first step is just to have an address range for these demonic things, which isn't publicly routable (unless you deliberating NAT it). The "home network" range (steal back some of that loopback space!).

</comment></comment></comment><comment><USER33> >>> We get security [for phones] because I get a new one every 18 months. Your DVR lasts for five years, your car for 10, your refrigerator for 25. I'm going to replace my thermostat approximately never. So the market really can't fix this.

Yes it can. It is fixing the problem as we speak. I, a security aware person, would never buy a connected thermostat. I'll buy the 5$ model that does the job I want perfectly. And my connected DVR lies behind some decent protections on my local network. Should it start participating in a dos attack or talking to those it shouldn't, I'll notice and replace it with a better system. The same is true of laptops, phones and cars. Once people are burnt a couple times they will opt for the safer models. Government could perhaps accelerate this process by increasing manufacturer liability (lol, not for the next 4/8 years) or by mandating that unmaintained products self-brick (again, lol). But the market will react nevertheless.

<comment><USER34> > It is fixing the problem as we speak. I, a security aware person...

The market of devices bought by security aware people is not the market that Schneier is concerned about. It's this other much larger market of normal people buying the least expensive devices with the most convenient features.

Those consumers won't notice or care if their devices participate in dos attacks, but the targets of the attacks care a lot. It's a classic example of a negative externality.

</comment></comment><comment><USER35> In the video he makes an excellent point, that i think is valuable to highlight and repeat here again:

Device insecurity is in aggregate very similar to environmental pollution of devices.

It is a latent danger that in some cases can stick around for many decades, it is caused by many people invidicually adding a tiny bit to the problem, it is created because right now accepting insecurity makes the product cheaper without directly hurting either the manufacturer or the buyer.

</comment><comment><USER36> I remember the last time we called on a government security solution for a problem that was perceived as too difficult and too critical for the private sector that had been, up to that time, managing the issue.

That's roughly how the Department of Homeland Security was born and the TSA was given the critical task of managing airport security where the failures happen. I wonder how Mr. Schneier thought that worked out?

I cannot take seriously any open-ended demand for regulation in the name of safety that doesn't spell out pretty detailed proposals which would work in practice; what such regulations should address and what is off limits. The last time we did this, we sacrificed rights and gained little (if any) additional security; I think Schneier calls it "security theater". I want to know why he thinks his call will result in ANYTHING better than that fiasco before I'm even vaguely convinced that this is the right answer.

Please don't read this as my not believing that there is a real problem and threat. I'm simply dubious of Schneier's answer at this point. "Any action" here is not necessarily the right action.

<comment><USER37> > the last time we called on a government security solution for a problem that > was perceived as too difficult and too critical for the private sector that > had been, up to that time, managing the issue. / That's roughly how the > Department of Homeland Security was born

I'm pretty sure the U.S. government has taken on other security issues since the DHS was founded in 2002.

<comment><USER36> And what's your point caller? Your statement sounds like blind trust and assumption rather than any actual knowledge. Sorry, I can't do that.

So let me run the exercise a bit... DHS... Patriot Act?... All that Snowden revealed stuff?... Invasion of Iraq?... Lybia?... Syria?... the U.S. Border?...

OK... a bit glib, but the point is there: where are the successes where the government protected citizens successfully without a disproportionate reduction of rights of those citizens. Off the top of my head, I can cite about as many as you did. I imagine there are some out there... but the track record isn't so good.

</comment></comment></comment><comment><USER38> Add a physical write-enable switch or jumper, so that malware cannot be installed into the firmware, and hacks cannot survive a reboot.

</comment><comment><USER39> There have been dozens of discussions on ddos and iot over the last few weeks here and its curious the technical consensus to solve a 'fragile network' problem is with politics and control and a political problem like surveillance with technology.

The first can't be solved with politics without locking down the internet and fine frained control of billions of devices connecting globally in others words an unachievable strategy. And the second cannot be solved with technology unless anyone truly believes they can fight an organization with the law, tens of thousands of programmers working on surveillance 24/7 and near endless resources on their side. This way none of the problems get solved.

</comment><comment><USER40> I don't understand how this regulation will work.

Will all open source software have to be submitted to some government run or approved certification? OpenWRT? Linux? Random App that accesses the net? Raspberry PI python script?

Sure it matters that 1 million IoT cameras are secure and can be updated but what about a million servers running some npm library? Do those need to be regulated too?

I'm very concerned about the security issues but I'm not looking forward to no longer being able to write software because I need it certified every time I add a line.

Are there other solutions that don't require regulation?

</comment><comment><USER41> It'll be a continuous sequence of market and government failure until it breaks. And in the meantime it'll involve a lot of finger pointing, not least of which will be at the user e.g. the user is stupid for clicking on that obvious link and deserves to be defrauded, that'll teach them; and other mind numbing nonsense. We'll see a return to walled gardens of private networks very restrictively interconnected, similar to the days of AOL, CompuServe, and Prodigy.

</comment><comment><USER42> The governments want to get involved - the simple fact is I don't think they can. Software can be much more complex than humans. There are systems out there that are already so complex, no one human can reason about the entire system.

I don't think law could even keep up with the space it wants to govern. They would be better trying to govern the application space as they have already been doing, such as vehicles, nuclear, etc.

</comment><comment><USER43> Did Bruce Schneier call for regulations that should prevent ddos attacks? What kind of regulation/law does he propose?

In other articles Schneier called to solve other problems by regulation - <USER3> example to limit data retention by internet companies. are laws the answer? Is these no way to solve security related problems be better technology?

Will microkernel os solve embeded device security or will it be regulation?

<comment><USER44> Correct me if I'm wrong, but I believe he's calling for a specific organ of government to take on regulation of the internet and connected devices in a general sense, not calling for some specific regulation or law.

I suspect what he's getting at is having some set of "safety standards" to be put in place, especially for IoT tech. The whole quote of

>Our computers are secure for a bunch of reasons. The engineers at Google, Apple, Microsoft spent a lot of time on this. But that doesn't happen for these cheaper devices. … These devices are a lower price margin, they're offshore, there's no teams. And a lot of them cannot be patched.

sums up that point pretty well.

I honestly don't know how you would really enforce something like this, but the proposal seems to be less about the specifics of regulation and more about the need for new regulation. The FCC really isn't equipped to handle this kind of thing.

<comment><USER43> % honestly don't know how you would really enforce something like this

Probably like with automotive code - they don't have code audits but have mandated test scenarios. The problem is that you need large organizations to work these out

i guess Schneier has a point, if consumers do not demand secure systems then it can only be done through regulation.

that would be a very German approach - they have strong consumer advocacy organisations like Stiftung Warentest and the Adac, these then push for more consumer protecting regulation. [1]

Once upon a time these requirements were also used as protectionist barriers. In our days that would mean: you did not bother to update your toolchain and have no firmware updates for this smart light bulb of yours? gone is your import license.

[1] [http://americastradepolicy.com/german-customer-protection- or...](http://americastradepolicy.com/german-customer-protection-or- protectionism/#.WDaqd7J96M8)

</comment></comment></comment><comment><USER45> seems like the answer to this is a federal standard for home firewalls. You buy a random piece of crap camera, the FCC or similar should track and publish a reasonable firewall rule for it. That way hordes of IoT devices could participate in a DoS without the FCC publishing bogus internet rules.

</comment><comment><USER46> There are few powerful technologies invented in the last 100 years for which the government did not eventually require a license to make or even operate. I do imagine a future where to own a computer that can truly "create" will require a license to own and operate.

</comment><comment><USER47> We do not need more laws and regulations, we need less. Remember what happened if you had a security vulnerability 15 years ago ? You got hacked by some kid, then you patched your system and restored from backup and gave the kid a cookie. What will happen now ? And why ?

</comment><comment><USER48> Government is useful to solve the tragedy of the commons. Insecure devices are a negative externality. The government should tax insecurity (or fine device manufacturers that allow an attack) and use the revenue to subsidize software security efforts.

</comment><comment><USER49> And I think that it'll be interesting when this kind of thing backfires. Like, let's say, USA government wanting that some computer made by Digital doesn't give the correct precision in all calculus done in the USSR nuclear research.

</comment><comment><USER50> The fun and games are just getting started, it's just the stakes have been raised.

</comment><comment><USER51> Could ISP be responsible for attacks coming from some of their infected users? Shutting down someone's internet for 'abusive use' would be a good incentive of getting incriminating devices out of the market.

</comment><comment><USER52> bro imma let you finish but

"the government should be part of he solution?" Hahah wtf

Bro

the gov't regularly "hacks" all the things(including the internet of things) legally that I literally couldn't give a shit if some random fucktard script kiddie decides to hack my router.

the government literally does it on the regular legally.

that's the actual problem. get a mitt bro.

</comment><comment><USER53> > "Schneier then laid out his argument for why the government should be a part > of the solution"

Now we have two problems.

</comment><comment><USER54> This site's ssl is broken.

<comment><USER55> Or you're using Chrome.

<comment><USER56> I too get an ssl error with firefox 50

</comment></comment></comment><comment><USER57> We're going to need to integrate cryptocurrencies with APIs. Encrypted pay to play is the only way.

</comment><comment><USER58> Another approach to security - give everyone a nuke, and only prevent untraceable strikes. If everyone can denial of service the guy who started it- he wont start it?

Dear god, now im pro-gun. Also then identity fraud will be the weapon of tomorrow.. I miss the old internet.. maybe if the speed is so slow, that strikes become uninteresting..

Could the servers transferring TCP-IP be adapted, in such a way, that a mass- traffic causing incident (controllserver) leads to a slowing down of the connection of the causality chain origin?

No, crypto prevents that. What a nice little maze.</comment>