Ask HN: Where should I host my startup? - <AUTHOR> I am done with the coding and I would like to shoot my site into the wild and start some marketing. What are some of the best and most reliable options? Possibly cheaper ones.. Thanks so much. <comment><USER3> Reading a lot of these comments make me think that everyone on HN is a cynic of the Oscar Wilde/Lady Windermere variety: "A man who knows the price of everything and the value of nothing" [1].

IMHO you should go with Heroku and ignore anyone who's suggesting dedicated servers, VPSes, AWS, Docker or containers. Every moment you spend maintaining a server or doing devops is wasted because it's time not spent building or marketing your _app_.

New startups' biggest expense is founders' time. It seems a lot of people, even on HN, don't realise it because it's a hidden cost. But if you think that a decent developer is worth at least $50/hr and it might take you an 1hr to set up and 1hr/yr to manage a server (e.g. apply patches, update security) then you're better off not spending those 2hrs and paying an extra $100 hosting your app.

Worrying about the future infrastructure cost is also wrong-headed. It's a kind of premature optimisation. To get the real, expected future cost, the projected infrastructure cost has to be multiplied by the probability that you'll actually get big, which for start-ups, is very low.

[1]: [http://www.gutenberg.org/files/790/790-h/790-h.htm](http://www.gutenberg.org/files/790/790-h/790-h.htm)

<comment><USER4> I also recommend Heroku when you're just launching your product. At my first startup (which failed miserably) I spend waaaaaaaaaaaaaaaay too much time trying to get the infrastructure right and then the downtime still happened all the time (because I didn't have enough experience with Docker and the project had a few mowing parts and when one failed, everything couldn't work). Honestly, I didn't use Heroku because I really wanted to do infra by myself and learn something (and I actually learned a lot) but also deep down in my mind I felt that using something like Heroku/managed servie was... I'm not sure how to describe it - like admission that I can't do it myself, like as I'm not as good as I think of myself - "I can do infra by myself, I don't need anybody managing my app for me!"-thinking. In retrospect, not using Heroku was a huge mistake because I didn't focus on the product. At my current startup I decided to start with Heroku and I'm really, REALLY glad I made this decision - finally I can focus only on the product and feel that infra is more stable/predictable than in the scenario where I'd try to manage it myself.

</comment></comment><comment><USER5> This highly depends on if your site is dynamic or static. If static, I would go with GitHub Pages or Netlify as they're free/cheap and easy to use. Static sites with this kind of hosting is also great in that they require practically zero maintenance.

If you have to run a dynamic site (less potential headaches if you avoid this), I would try to use something like Heroku. It's easily one of the simplest way to host a robust site that needs to scale without having to spend much time on admin and DevOps.

For the people recommending a VPS, DigitalOcean etc., you're talking about using a huge amount of your own time to make such a setup as robust, easy to use and low maintenance as Heroku. What about backups? Scripting server creation? Adding a load balancer and more servers? Security updates? Server security?

The more parts and scripts you have to put together yourself, the more things that can go wrong and the more time of yours it's going to consume. If you consider how much your own time is worth and how important your startup is to you, trying to save anything in the realm of $10 a month on a core part of your startup doesn't make any sense if this is going to cost you multiple hours of time a month.

<comment><USER6> Honest question, what does Heroku offer over Elastic Beanstalk other than being more expensive? I switched to EB and it seems more flexible and a lot cheaper, and I haven't wasted hours on admin.

<comment><USER5> > Honest question, what does Heroku offer over Elastic Beanstalk other than > being more expensive? I switched to EB and it seems more flexible and a lot > cheaper, and I haven't wasted hours on admin.

I said "something like Heroku" and Elastic Beanstalk is similar.

</comment></comment></comment><comment> andrewl-hn No one has mentioned Heroku yet. Starting at $7 they are a bit more expensive than DigitalOcean, but with that extra $2 you'll get their platform, their tooling for deploying the app, their database backups. Adding other services later on is also easy with their addons. By choosing Heroku you can save hundreds or thousands of dollars in ops costs over a course of a few months.

The hosting cost may go up quickly, but if your business is successful you can either absorb it, or spend time and money to migrate away. They run on AWS, so picking the same location means you can run mixed infrastructure (part on Heroku, and part on AWS) without a latency hit. Thus, a hybrid configuration is very viable.

<comment><USER7> Using Heroku puts two levels of bloat between you and the hardware, and locks you into a hosting environment that becomes very expensive quickly. Eschew.

<comment><USER3> I disagree with this wholeheartedly and just posted why above but wanted to reiterate it here. This might just have been a throw-away comment but "bloat", lock-in & cost are red-herrings.

"Bloat" here is a virtue. Heroku removes two levels of drudgery and administration between you and the hardware. Who wants to be racking hardware? Who wants to be patching the OS? Who wants to be dealing with package vulnerabilities? None of this helps actually build the business

Lock-in is minimal, particularly if it's a self contained app and you're not using a lot of services. There are countless examples of companies who've moved off of Heroku when they've gotten big. Plus there's also lock-in using EC2, S3, AWS. There's lock-in of some level regardless where you run your stuff.

Future cost is also really, very very low because P(success) is, sadly, super low.

<comment><USER7> Built in to your comment is the assumption that you're trying to grow your business big or die.

If you're working in a niche market, costs are important and keeping them low can be the difference between having an independent livelihood and failure.

<comment><USER3> No it's not, it's really not. In fact I think in a niche market then it's often even more true.

If you're building in a niche then (almost by definition) you're not going to need a lot of infrastructure. There won't be millions of customers and they (usually) won't need tons of infrastructure.

I think the only case is where you're building a business like Pinboard :) Where the CLTV is relatively low but the the bandwidth, storage & compute is relatively high.

Regardless of the market you're in though, if you want to build an independent livelihood or a lifestyle business typically infrastructure costs still shouldn't be a factor.

A good livelihood might be $50k/yr say or $4k/mo roughly. The difference between $5/mo and $500/mo in hosting costs isn't what determines success or failure. It's whether or not you've built, marketed and sold an app to 5 or 500 customers.

<comment><USER8> I agree with your overall sentiment I think, but there are many side gigs where $5 vs $500 a month is the difference between viable and not viable. Sometimes it's the difference between sticking with an idea long enough to turn it into something viable; something that's bleeding you $500/mo won't have as long a life as something that's only $5 or $25/mo while you're figuring out if there's something worthwhile or not.

A niche market cuts both ways. Sometimes you don't need to worry about scale, but you also can't bet on large numbers of customers coming to cover up inefficient choices.

</comment></comment></comment></comment></comment></comment><comment><USER9> If "$10 / month" counts as cheap in your book, check out a Linode VPS. I've been using them for a couple years now, and I have been extremely satisfied (although I've upgraded to a beefier VPS as my project has grown in popularity).

Another good VPS option is DigitalOcean, which offers a smaller (and cheaper) plan for $5 / month.

There are also a lot of shared hosting providers out there that will sell you cheaper space, but I would not recommend this for anything non-trivial, as most of the time, you'll be limited to using PHP. Still, if you're looking for the best bang for your buck and you're willing to settle for shared hosting, check out Nearly Free Speech -- they are head and shoulders above any other shared hosting provider that I have ever tried.

<comment><USER10> If you're considering Linode, you should read up on their history of security incidents and make sure it's a risk you're willing to take.

<comment><USER11> I've been with Linode for over six years and the only security incident I've have was my own fault. Follow the guides for securing new VPSs - I recommend that SSH be configured to disallow root logins and only allow certificates for authentication. There are many great guides available.

<comment><USER9> I think people are disagreeing with you because the parent comment is referring to Linode platform security and not the security of the individual VPSes -- which is a valid point. The security of your individual VPS depends, to a certain degree, on the Linode platform's security.

But I find it disheartening that multiple people chose to just downvote you, and nobody bothered to write a response.

<comment><USER11> I came to the same conclusion but what good is karma if you don't get down- voted occasionally?

I didn't misunderstand the parent's comment ... I was just providing a data point on the continuum. My experience with Linode has been great. I do realize that there have been security problems with the platform itself.

</comment></comment></comment></comment></comment><comment><USER12> Microsoft's BizSpark program gives startups $150/month in Azure credits for 3 years

[https://azure.microsoft.com/en-us/pricing/member- offers/bizs...](https://azure.microsoft.com/en-us/pricing/member- offers/bizspark-startups/)

<comment><USER13> Just to add that it is $150/month in Azure credits per user in the startup to a maximum of 5

</comment></comment><comment><USER14> For any non-static website - Heroku FOR SURE. It's not even a question - <USER2> have two companies that both run on Heroku - both startups are profitable and both will remain on Heroku for the next couple of years. ([https://www.switchup.org](https://www.switchup.org) and [https://www.trycarriage.com](https://www.trycarriage.com)) - I know massive scale billion dollar companies that are on Heroku (e.g. Deliveroo, Macy's)

The cost/benefit analysis is ALWAYS positive in favor of Heroku until you hit super massive scale (minimum 2-3 years out for most startups, if ever). It's super easy to use. Their feature set is increasing monthly and they can handle a lot of different types of setups.

</comment><comment><USER15> Hetzner is another option. But you don't really specify your requirements (geographical region, scalability , etc) so I don't know if this suits you.

<comment><USER7> Big thumbs up for Hetzner.

<comment><USER16> Yep, another vote for them here. It's expected that you're 100% capable of admining your own box, but as long as you're happy with that, the price/power ratio is pretty much unbeatable.

</comment></comment></comment><comment><USER17> AWS has a free plan during 12 months: [https://aws.amazon.com/free](https://aws.amazon.com/free)

</comment><comment><USER18> Since you've provided no details at all for your requirements (does your startup need a flotilla of beefy servers to do real-time facial recognition across thousands of live 4K video feeds?) I'm assuming you have a static HTML site with zero backend required. In that case, a Jekyll/Hugo generated site hosted on Amazon S3 will be really cheap. Throw CloudFlare in front of it for even more cheapness if you expect loads of traffic. Your hosting bill will be measured in pennies per month.

</comment><comment><USER19> Depending on your application and stack, you may want to consider Google Cloud or AWS. While I really like DigitalOcean, Linode, Vultr, etc they lack production features like a centralized firewall and IAM security. Additionally AWS and Google have a slew of complimentary services so maybe you don't need raw physical machines. For example, instead you may be able to use Elasticache, RDS, and Elastic Container Service and don't have to manage any servers.

</comment><comment><USER20> I'd go with GCE. They have a wide suite of services, and because they're the number three player right now, will probably give you a bunch of free credit to play with.

</comment><comment><USER21> you should check out free tier offered by Amazon

[https://aws.amazon.com/free/](https://aws.amazon.com/free/)

Also do apply for things like BizSpark [https://bizspark.microsoft.com/](https://bizspark.microsoft.com/)

if you have a static marketing page, you can also host it for free ( almost ? ) on [https://firebase.google.com/docs/hosting/](https://firebase.google.com/docs/hosting/)

<comment><USER22> Yes, for a site that can just be hosted on the Firebase free tier ([https://firebase.google.com/pricing/](https://firebase.google.com/pricing/)) you can go a long way (the same is true of the App Engine free tier). The OP stated they had already written something though, so my guess is that rewriting to Firebase wouldn't work (if it's just a SPA front-end app in Javascript, fine, but if there's any backend a rewrite seems more hassle than it's worth).

</comment></comment><comment><USER23> Don't trust anybody who doesn't start with "it depends". For nothing in this world there is one perfect answer. Context means a lot. What have you coded? Why do you think you are done if it is not running anywhere (I would say you are 20% done if it runs on your laptop)? How many people need to use it to be viable (e.g. a diary service needs only one user who writes texts for himself, a shop needs at least make its hosting and transportation fees, a social network needs thousands of people before it can even start to be successful)?

Good general advice is this: The simplest solution is often the best, but in some cases that means taking your old desktop pc, install ubuntu, configure your router to publicly share http and https from that computer. In other cases it means using a toolset like Heroku.

Please don't be mad about this, but the way you phrase your question it is very very likely you have so little skill that you don't even know how little. Please consider to pay a freelancer to support you. He likely has more skill and has experienced more "this can never happen in real life" F-Ups than you, and therefore can handle a lot.

<comment><USER24> "skill"? That's bullshit, you can't tell anything about skill from a person's poorly phrased question. Especially since that person's primary language might not be English.

<comment><USER23> In fact you can tell a lot about what questions people ask. The more specific and detailed a question is, the better the person knows the topic. A skilled language learner would never ask "What is the best way to learn English?" because he knows already that there is no best way, in fact there is no single way. He knows that he needs to combine different methods and which are the common methods and how well they work for him.

By recognizing a misconception that people have at a certain skill level you can guess their skill level quite acurately. Beginners usually want to solve the biggest of problems, and be done after the next weekend. Mid-levelers usually have specific questions about a method that must be the one true best solution in their eyes, but somehow they struggle with topic X. High skilled people usually ask questions that can't be googled, and even other experts need to look into the problem more deeply to figure it out together.

It's also hard to fake, since you need have some experience in the area to recognize how your current believe is limited. You cannot ask a ungoogleble question if you don't know already most of what can be googled about that topic.

</comment></comment></comment><comment><USER25> I'm going to have to be the boring guy and say: depends completely on how much resources you need.

In most cases though (brace yourself for an unpopular opinion) it's enough to setup a simple dedicated server for about $20-$60 per month.

Now I did read the comments that mentioned how getting a dedicated server is a waste of valuable time, but honestly you'll most probably be able to get it setup in a day, you'll also learn how web servers work along the way and you won't have to depend on third-party cloud services (yet).

Here's a great guide from DigitalOcean on how to setup a modern dedicated HTTP server with MYSQL: [https://www.digitalocean.com/community/tutorials/how-to- inst...](https://www.digitalocean.com/community/tutorials/how-to-install- linux-nginx-mysql-php-lemp-stack-on-ubuntu-12-04)

</comment><comment><USER26> Check out webfaction [https://www.webfaction.com/?aid=9281](https://www.webfaction.com/?aid=9281). It's cheaper/better than shared/heroku/dedicated/vps/ec2 up until a certain point (48GB ram).

</comment><comment><USER27> If you are willing to shell out a little more ($40), you can get a pretty powerful DS for a fraction of the cost of what the major cloud providers would cost: [https://www.delimiter.com](https://www.delimiter.com)

</comment><comment><USER28> Check out Digital Ocean Hatch[1]. If you're an eligible startup, you can get 100K of free credits for 12 months.

[1] - [https://www.digitalocean.com/hatch/](https://www.digitalocean.com/hatch/)

</comment><comment><USER29> Can you give us an idea of what your site is built in? Personally I have a side project I am working on which I am just hosting on the free allocation of AWS. Even if it weren't in the free tier, it would be extremely inexpensive. With that, I have a lot of experience deploying to AWS and I have scripted most of the process (in fact, other than some monitoring, at this point, the deployment process is entirely automated). This would work for just about any architecture. But, the difficulty of setup will cause your mileage to vary a bit.

</comment><comment> grif-fin I can comment on AWS, EC2 (ECS where docker kicks in if you want it). To set it up via UX Amazon Console was absolutely confusing and continues poor user experience until we moved to AWS-cli which was very time consuming and then the setting up of docker which just ate a big chunk of our time.

Strongly recommend to go for something simpler and lightweight to reduce the time waste as lots of other comments suggest.

At the end of the day you don't even know if anyone wants your product or what first user's opinion is, why waste time on shiny host set-up?

</comment><comment><USER30> It depends on how much you want to do yourself.

Heroku is easiest and relatively cheap until you scale. (Great problem)

Lots of people seem to use AWS. My limited understanding is that it is marginally more difficult to implement than heroku.

You could also go with someone like Linode. I would only go that route if you have implemented before. There is a learning curve and if you are trying to get the site up quick, I would go with a different option.

</comment><comment><USER11> Redhat offers free services (you pick which ones) via their OpenShift [0] platform. Under the covers it's Docker and Kubernetes.

[0] [https://developers.openshift.com/getting- started/index.html?...](https://developers.openshift.com/getting- started/index.html?sc_cid=701600000011p9xAAA&gclid=CMbt7eWnzs8CFdcSgQod5k0HDQ)

</comment><comment><USER22> As people asked, what do you need "today" (host website apparently) and what do you need "tomorrow"? If you just need a simple static-ish web app, and everything else is your offline iOS game that's pretty different from building say a Snapchat competitor.

Full disclosure: I work on Google Cloud, but it's unclear you need a cloud provider.

</comment><comment><USER31> I haven't seen it mentioned yet, but Redhat's Openshift provides an alternative to Heroku. I've used it for a few years and been happy with it. They have a startup program that gives you access to a paid tier for a year. I've used Openshift to host Node and Flask apps.

Edit: a bunch of downvotes for trying to be helpful, how nice.

<comment><USER32> I was pretty happy with openshift until I recently discovered it was impossible to update the version of an os package I depended on. On heroku, custom buildpack and it was done in 5 minutes.

</comment></comment><comment><USER33> Webfaction. I don't do anything with heavy traffic, but very happy with reliability, performance and features.

</comment><comment><USER34> If you're talking about hosting your startup's landing page, stick with Github Pages: [https://pages.github.com/](https://pages.github.com/). Free, super quick & easy, with custom domains to boot.

Personally, for almost any product I start here. Even if you do need server- side infrastructure for the product, hosting all your marketing pages on GH pages is probably the right choice - they're going to be better at reliably hosting and serving static content than you are. Focus on your product instead.

When I do need server-side logic I then usually go for Digital Ocean, because they're very cheap, pretty great, and far less complicated to manage than EC2. It's also pretty easy to set up Dokku: [https://medium.com/@pimterry/host- your-node-app-on-dokku-dig...](https://medium.com/@pimterry/host-your-node- app-on-dokku-digitalocean-1cb97e3ab041#.4idyklakq). With that on top you then get a quick & effective Heroku-style deployment experience, at a fraction of the price.

<comment><USER35> Since Github Pages doesn't support SSL/TLS certificates for custom domains, I don't think anyone should be using it. It's simply outdated technology.

<comment><USER36> You can host static pages on GitLab.com for free, with TLS certificates and custom domains.

You can use _any_ static site generator.

</comment></comment></comment><comment><USER37> why can't you use just aws micro free t1? they give you a micro machine for 1 year free. what loads do you anticipate, what hw requirements do you need for your machine? i think hosting a simple website with sqlite database works great on an aws micro, if you need something more glorified like postgresql or mysql and multi-tier, then perhaps you should go for something like digital ocean or paid aws, this all depends on your requirements which you haven't specified.

currently i'm hosting a golang web + restful api + websocket server + sqlite3 db + redis + nginx all on a single micro AWS server, but my marketing hasn't really started yet, we're talking about <100 hits thus far per day.

</comment><comment><USER38> Do you have any special requirements -- such as location, high memory, io performance, or storage capacity?

At [https://mnx.io](https://mnx.io) (my company) we offer various options with reliability, and performance at our foundation.

</comment><comment><USER39> Clever cloud is a good option, they're very good at what they're doing. Plans start low, and you can scale easily when needed. They do have plenty of options, and support is top notch.

</comment><comment><USER40> We are super happy with Firebase. Even if you just use the static hosting you get CDN + HTTPS for free. And you can even use the free tier as long as you want which is awesome for low traffic.

</comment><comment><USER41> if looking into digitalocean, vultr.com is slightly better in terms of pricing and processors, though it takes much longer (~2-3mins) to spin up a vm instead of <60s in digitalocean

<comment><USER42> This is not true if you have custom snapshots. DO takes quiet a bit of time if you have custom images. My experience with vultr is that it boots very fast (<1 min)

<comment><USER43> Does DO even offer custom images? Last I spoke to the owner he said they had other priorities.

</comment></comment></comment><comment><USER44> As someone who wasted time and money with AWS I'd say start with something simple like DigitalOcean and worry about problems as you face them.

</comment><comment><USER45> now.sh [https://zeit.co/now/](https://zeit.co/now/) and surge.sh [https://surge.sh](https://surge.sh) are some lesser-known options that I've used recently with ease and success (on free plan, for small projects).

</comment><comment><USER46> Amazon's PaaS offering (Elastic Beanstalk) isn't too difficult to use and may be less expensive than Heroku.

</comment><comment><USER47> It looks like you're confusing your startup (which is a company) with your web site.

</comment><comment><USER48> Personally had bad experience with linode.. I'd go with aws.

</comment><comment><USER49> Take a look at hyper.sh, if you are using docker.

</comment><comment><USER50> Cheap: browse through the listings on lowendbox.com, you will find some amazing deals for both VPS and dedicated servers.

Reliable: AWS / Rackspace / DigitalOcean / Google cloud / basically any famous one.

When you're starting, it's probably better to rent a cheap VPS server. If you start growing fast, you can always move to the cloud. But modern cheap VPSs are quite powerful. I have 7 websites running on one that costs me $6/month.

<comment><USER51> Has DigitalOcean gotten better for reliability? I took my company off of them about 2 years ago specifically because of their frequent downtime.

<comment><USER35> I've been using for more than 2 years with 100% uptime.

<comment><USER52> yeah, in last couple of years I cannot remember anything really bad in DO. Biggest issue in DO was slower performance of storage, but after complaining to support about it, it was fixed and everything was fine there.</comment></comment></comment></comment>


The Science of Cycology (2004) - <AUTHOR> http://www.liv.ac.uk/~rlawson/cycleweb.html

<comment><USER2> No matter how cynical Rumsfeld quote is, the unknown unknowns seem related to the eureka moments most of us love to have.</comment>


A GUI for the Command Line - <AUTHOR> https://remoteos.io <comment><AUTHOR> A desktop app that will allow you to access your servers and interact with software. I have opened the waiting list for the desktop version that will start out with a more rich set of features and can be used daily in your life as a developer. Would love to hear your feedback

</comment><comment> java-man screenshots?

<comment><AUTHOR> In the website :) the desktop app is almost ready. I'll personally send an email to everyone on the waiting list when it's ready so if you'd like to get notified please just add your email in the waiting list field :)

<comment> java-man Those are thumbnails. I'd like to see full size screenshots, please.

<comment><AUTHOR> the full app will be ready in the upcoming 2 days. I guess that is better than screenshots ;)</comment></comment></comment></comment>


It's Official: China's E-Commerce King Is a Communist - <AUTHOR> https://www.wsj.com/articles/its-official-chinas-e-commerce-king-is-a-communist-1543238782 <comment><USER2> With the extraordinary growth of China their might be some benefits to communism.

<comment><AUTHOR> It is not communism. It is "socialism with Chinese characteristics" :) as Xi Jinping likes to remind everyone!</comment></comment>


The Geography of a Recession - <AUTHOR> http://www.latoyaegwuekwe.com/geographyofarecession.html

<comment><USER2> Interesting. I notice my county, in southwestern Utah, is at the 2% mark, but my own limited experience suggests that might be a rather conservative estimate. A couple idle speculations as per the study:

1) I know many people who have responded to the recession by attempting to start a business (usually involving a depressingly harebrained business plan). These people often fall victim to Kelly Felix-inspired "make money on the Internet" or other affiliate marketing schemes. I could imagine some of these people, when being surveyed, saying that they did not currently desire a job.

2) Many adults, and recent high-school graduates, who otherwise would not be attending college, are attending college now, thanks to the high availability of student benefits and lack of other options. I don't think the study factored these people (I don't know what criteria one could use to do so anyway), but if it had, I'll bet the resulting unemployment rate would be higher nationwide.

</comment><comment><USER3> This is a dark pattern.

It plays with color spectrum, pitting red against violet. Not fair. Roy G. Biv?

Now, there are some messed up things like the south -- it appears severe on state borders, thought the black line probably compounds it.

There is something very interesting and valuable here, yet it doesn't feel honest.

\--

EDIT: Reviewing the color spectrum red and violet are next to each other. It felt more severe than it was. Perhaps because violet is compressed into 3 percentage points (purple, violet and dark purple), while there is red, orange, orange-yellow, yellow and cream for the "good-ish", all strong and not neutral.

<comment><USER4> I agree - the data this depicts is indeed very scary, but unfortunately their use of color is a little manipulative and detracts from it.

10%+ should not be total black - there's no reason to make that the extreme, especially when you consider that the real rate of employment could be around 18-19%, and in the Great Depression it was even worse than that.

<comment><USER5> I hope you mean 'real rate of UNemployment' ?

</comment></comment></comment><comment><USER6> Im my opinion (Michigan resident), the best part about this map is that it illustrates that Michigan was already in a recession well before the rest of the country was.

<comment><USER7> And Alabama plus the border or Arkansaw, whats up with that!? California and the Northwest didn't really surprise me since there's a lot of people and not being in tech makes things hard out there.

<comment><USER8> Unproductive labor (poor education, lack of human capital), few natural resources, zany state economic policies. These are my guesses.

</comment></comment></comment><comment><USER9> Not a recession, a depression.

I would like to see these numbers for the percent jobless, which will provide a much better indicator of the depth of the problem.

</comment><comment><USER10> What inferences can be made from this? Many of the states that seem to be holding out have low populations so the real picture may be far more bleak than it appears... see a population density corrected map here: <http://www.pnas.org/content/101/20/7499/F1.expansion.html>

<comment><USER8> I'm not trying to offend with this comment, but I surely will regardless. Those states that had those low numbers tend to be the ones where people on the whole would not choose to live unless they had a specific reason to do so. A job, for instance.

</comment></comment><comment><USER11> It would be interesting to see this with migration rate, too.

</comment><comment><USER12> Quite a fascinating graphic. If it shows anything, it's that this recession is deep and wide, and far from over.

</comment><comment><USER13> Why on earth would a recession be geographic, in the information age? Could it be that the information age is a myth?

<comment><USER14> Because not all jobs are information-related? There's still an awful lot of brick and mortar out there, and plenty of regional retail shops.

<comment><USER13> ...so the Information Age is a myth. Most folks are NOT participating in the Internet Revolution, as indicated by the chart's geographic locality of employment.

</comment></comment></comment><comment><USER15> hurrah for nebraska!

<comment><USER16> Small population with a higher-than-average percentage employed by government.

<comment><USER17> Those same could be said for Alaska as well, yet it has higher unemployment. I wonder what the other factors are - I suspect it has to do with industry to some extent - farming vs. natural resources extraction.

<comment><USER2> Omaha is a pretty respectable business nexus. I can't think of an Alaskan city with a similar situation.</comment></comment></comment></comment>


Transport app Citymapper trials its own smart bus service in London - <AUTHOR> https://venturebeat.com/2017/05/08/transport-app-citymapper-trials-its-own-smart-bus-and-transport-service-in-london/ <comment><USER2> The article says:

> Imagine if every bus, boat, and train in London was kitted out with sensors > and counters, with the data made available to third-party service providers > — this could help cities manage transport infrastructure far more > effectively.

And my reaction is, "Imagine if we had more buses and investment in public infrastructure to begin with."

In fairness, public infrastructure is already miles better in London than most U.S. cities. So the idea of tricked out buses with good smartphone integration seems a lot more realistic to me than if this were done in the U.S.

<comment><USER3> >> Imagine if every bus, boat, and train in London was kitted out with sensors and counters, with the data made available to third-party service providers — this could help cities manage transport infrastructure far more effectively.

> And my reaction is, "Imagine if we had more buses and investment in public > infrastructure to begin with."

Well in London all the bus and train data is made available to third-party service providers. That is how citymapper exists

<comment> squeaky-clean I think they meant it more along the lines of "I'd rather have my bus be on time than have my smartphone tell me exactly how late it will be."

<comment><USER4> Good luck with on-time buses in London traffic.

<comment><USER5> Having said that they're frequent enough if you're an out-of-towner they feel like they're running perfectly on time.

If a bus is late where I'm from it just vanishes - you can be watching Arriva's live map and its route blip will just disappear, enjoy waiting for the next one (minimum half hour wait, repeat if that one's running late too)

</comment></comment></comment></comment></comment><comment><USER6> Hmm. Making your app profitable by running a fleet of buses seems a bit... ambitious.

Background: Everybody in London uses Citymapper and nobody uses Google Maps. It is a great app. London Buses are also very good. As has been pointed out, they have GPS sensors. There is also a sophisticated infrastructure behind them, e.g. a control room that tells drivers to turn around and go back mid- rout if the buses are too unevenly distributed. See e.g. the BBC's Route Masters documentary if you can find it: [http://www.bbc.co.uk/programmes/b02znsx2](http://www.bbc.co.uk/programmes/b02znsx2)

As has also been pointed out here, London Transport does not make a profit (although their public funding is constantly shrinking). So any new entrant has to be more profitable than them with a much smaller market share. Wonder if that is possible if you only differentiate yourself by technology. We'll see.

<comment><USER7> In my experience, Google Maps is really terrible outside the United States. It doesn't seem to understand that in the UK, a narrow country lane might have a speed limit of 60 mph, but nobody could ever drive that speed on it. It's constantly proposing insane detours off A roads onto back lanes obstructed by sheep and farm equipment.

Unlike Citymapper, Google Maps doesn't have a notion of multimodal transport: cycling to a train station, for example. Citymapper also doesn't "lose" your in-progress journey if you click the wrong thing or close the app.

<comment><USER8> I don't think that's true. Google maps uses average speed on roads to estimate the fastest route, not the speed limit.

If they used the speed limit the app would never take traffic and other conditions into account, which it clearly does.

Having said that, I have experienced a crazy route now and then, but I think it's often caused by incorrect map updates.

<comment><USER7> Maybe they don't have enough Android-carrying traffic on rural lanes to calculate an average speed?

All I know is I frequently get really goofy route suggestions from Google Maps that seem totally clueless about the difficulty of driving narrow UK backroads.

</comment></comment></comment></comment><comment><USER9> This sounds a lot like the on-demand(ish) bus service called Bridj which just shut down here in Boston. [1] They promised popup bus routes just like Citymapper has, but it ended up that a lot of the "routes" they constructed were essentially missing gaps in the MBTA's bus/subway system.

The bus route generation tool that they mention seems to be very promising. Hopefully the realtime demand data is the piece that Bridj was missing, as it would be very cool to see this kind of stuff take off in other areas. I wish them all the success in the world - hopefully this works out for them.

[1] [https://www.theverge.com/2017/5/1/15501764/bridj-on- demand-b...](https://www.theverge.com/2017/5/1/15501764/bridj-on-demand-bus- startup-fail-ford)

<comment><USER10> There's a functioning service called Chariot in Bay Area (and Austin, for some reason). [1] They seem to have quite a lot of routes, although most of them are just charter routes for the big tech companies.

[1] [https://www.chariot.com/](https://www.chariot.com/)

</comment></comment><comment><USER11> I wonder if it is actually possible to make money in the _commoditized_ transportation business. Virtually all government transportation organizations lose money -- luckily for them they're governmentally funded (MBTA loses money [1], which is relevant since there was recently a bus service in Boston that shut down).

[1] [https://www.bostonglobe.com/metro/2016/02/28/mbta-shrinks- it...](https://www.bostonglobe.com/metro/2016/02/28/mbta-shrinks-its- deficit/ROdjjtVNuS1L81f7qdsOXK/story.html)

<comment><USER12> There are quite a few exceptions to this. Sort the second table on this page by %age: [https://en.wikipedia.org/wiki/Farebox_recovery_ratio](https://en.wikipedia.org/wiki/Farebox_recovery_ratio)

FWIW TfL in London has to break even across all modes (operationally, at least) by 2018.

You'll notice there is an exceptionally high correlation between operational returns and city density.

<comment><USER13> I wonder if they factor in the broader economic benefits of public transport (or costs of a lack thereof) into 'breaking even'. Cut bus services, more people drive, take longer to get to work, are now stressed, walk less, put more strain on the health care system. I'm guessing they don't, being politicians and all...

<comment><USER12> No, they don't. This is purely financial.

</comment></comment></comment></comment><comment><USER14> Cool initiative. I've yet to find a reason to switch from Transit to Citymapper in NYC, but it's always exciting to see pure tech companies (like Snapchat) try their hand at physical products.

The Citymapper folks are obviously very smart and I am stoked to see how this pilot project works out!

<comment><USER15> Interesting comment regarding Transit - as a Londoner who went to NYC for the first time last year I didn't even contemplate looking up another app; I just opened up CityMapper and it said "It looks like you're in New York. Switch City?", so it's pretty seamless.

A few years ago I'd definitely have trawled the App Store and I'm sure I'd have found Transit, but it just goes to show the power of a good, reliable interface and considered rollout to ensure you're always the go-to product if someone is aware of you.

<comment> k-mcgrady This is my favourite thing about Citymapper. I use it everyday (multiple times) in London. Went to Milan for the weekend and was able to continue using the same app. It made figuring out another transit system incredibly simple. It's becoming like Uber for me in the sense that when I go somewhere Uber doesn't support getting around becomes something that takes quite a lot of figuring out.

</comment></comment></comment><comment><USER16> Is is simply a small buss run by a private company?

I don't understand why it is a "smart buss".

<comment><USER17> "It's got tracking software for real time integration with the app, passenger counting, and a driver app.

We built software for everything, including realtime operational control to driver management to scheduling systems. We're reinventing how to think about all of these in the realtime world. We've taken systems that haven't traditionally talked to each other and integrated them."

<comment><USER18> What does that _mean_? What is the result?

To me it seems like a van on a short bus route. What does all the technology add on top of this?

<comment><USER5> Bus on its way to you, your app says "There are 12 seats free, 10 standing on this bus" possibly even showing you which seats are free. Saves you catching a bus where you're crammed in like sardines.

Possibly even more functional uses such as "The wheelchair space is available"

<comment><USER18> But I'm going to get the bus anyway. If it re-routed me to alternative transport I suppose that would be helpful.

</comment></comment></comment></comment></comment><comment><USER19> I really enjoy city mapper but find their "search" to be subpar in NYC. Search by address works fine, but if you search a place by name sometimes gives me random places in the other side of the country.

<comment><USER20> Yeah, its quite the same in London. In that case I switch to maps, but it isn't very often for me.

<comment><USER21> In London I'll often use Google Maps to search for the business that I'm looking for, then find the closest tube stop on the map and switch to Citymapper to navigate there.

</comment></comment></comment><comment><USER22> Does anyone know how citymapper makes money; or if they aren't making any money yet what's their path to profitability?

<comment><USER23> According to Glassdoor they save money by treating staff like shit, make them work crazy hours and pay them inappropriately. But hey, you work for a great vision.

</comment></comment><comment><USER24> Why not sell your data to actual public transport to make their systems better?

Why must startups keep reinventing busses (without the poor people)

<comment><USER25> Busses without the poor people seems to be an American dream. In Australia and London it's "acceptable" to ride the bus, but in The Bay Area at least it seemed to be for "weirdos" only.

</comment></comment><comment><USER26> When they said smart bus I imagined they meant the routes were determined in real time according to where people wanted to go.

</comment><comment><USER27> My guess is that this is a PoC to show the value of their data to other cities

</comment><comment><USER28> Pay individually for a service that could be much better with collective funding. I dont see the good in this approach.

</comment><comment><USER29> It seems the next step in transport disruption. If Uber and Lyft can revolutionize taxicabs, why not take a shot at sclerotic and inefficient public transport.

<comment><USER30> Public transport in London is neither sclerotic nor inefficient.

<comment><USER31> Indeed; it was one of the things I liked best about living there. The buses were spectacularly frequent, clean, cheap, and had convenient connections with tube and rail. A triumph, all things considered.

<comment><USER5> I love using the bus when I'm in London for work, none of the hustle and bustle of the tubes with approximately the same run time between places during the times I travel (rush hours)

They're a breath of fresh air... literally, because they're also all electric apparently.

<comment><USER32> Well, some of them are electric.

Most are hybrid diesels. :)

<comment><USER5> Ah fair enough, I've only seen/acknowledged the electric ones then, probably the route I take (Euston to Holborn and back)</comment></comment></comment></comment></comment></comment>


Black Hat USA 2015: The full story of how that Jeep was hacked - <AUTHOR> https://blog.kaspersky.com/blackhat-jeep-cherokee-hack-explained/ <comment><USER2> Has there been a consensus reached on whether or not this could have been a factor in the death of Michael Hastings? [0]

[0] [https://en.wikipedia.org/wiki/Michael_Hastings_(journalist)#...](https://en.wikipedia.org/wiki/Michael_Hastings_\(journalist\)#Death)

</comment><comment><USER3> I'm sure many engineers overlook the "guy who knows a guy" situation. The whole car itself is one giant system that works in unison; practically everything in that car IS connected. Which obviously means everything is accessible one way or another. Isolation is not really isolation as isolation more than likely _depends_ on _something_.

</comment><comment><USER4> Could this have happened in a Mercedes as well? [http://www.occupy.com/article/exclusive-who-killed- michael-h...](http://www.occupy.com/article/exclusive-who-killed-michael- hastings)

<comment><USER5> well, there's this: [https://www.youtube.com/watch?v=k_o-H1j4zZs](https://www.youtube.com/watch?v=k_o-H1j4zZs)

</comment></comment><comment><USER6> Vintage cars have never been more appealing!

<comment><USER7> This whole story reminds me of the Battlestar Galactica reboot a couple of years ago. The premise was that the shiny, new spaceships were all susceptible to hacking and virus injection while the old, "vintage" ones were unhackable.

</comment></comment><comment><USER8> > This is the thing that all the manufacturers always refer back to when it > comes to IT-security of cyber-physical systems: there is an isolation they > say, the air gap between connected and physical parts of these systems.

> [the] multimedia system's controller itself can't communicate directly with > CAN bus, it actually can communicate with another component which is > connected to CAN bus, the V850 controller

That... that's not what an air gap is. Usually I'm forgiving about security that's fudged, since it's hard and marketing and higher-ups rarely understand. That's the _entire point_ of an air gap: there isn't anything to understand, it's a physical disconnection. It's either plugged in or it's not.

When asked "is there an air gap", if the answer is _no_ and you answer _yes_ then you're lying in the most blatant and bare-faced way I can imagine. It's like saying "that car is four wheel drive" when it's only two wheel drive, or saying "that car has an 18 gallon tank" when it has a 7 gallon tank.

<comment><USER9> It's really shocking how blatant and dramatic an official corporate or government statement has to be before we're prepared to call it a lie.

<comment><USER10> Basically if you are high up enough, the only way to get caught in a lie to to admit that it was a lie, and that you meant to lie.

</comment></comment></comment><comment><USER11> A lot of automotive manufacturers are migrating to FlexRay ([https://en.wikipedia.org/wiki/FlexRay](https://en.wikipedia.org/wiki/FlexRay)) and Ethernet so hopefully they will use the extra bandwith to implement a bit more of message authentication to their protocol.

</comment><comment><USER12> Remote control of steering wheel, engine, breaks? Free OTA driverless car update!

<comment><USER13> Wow, that's some good spin! Not sure what you are doing now, but I am sure Chrysler can use you in their PR department!

</comment></comment><comment><USER14> From this point forward we should make very few assumptions about electronic systems.

I'll just leave these here: [http://jalopnik.com/why-its-unlikely-someone- killed-michael-...](http://jalopnik.com/why-its-unlikely-someone-killed- michael-hastings-by-hac-584806047)

[http://jalopnik.com/aols-story-about-terrorist-carhacking- is...](http://jalopnik.com/aols-story-about-terrorist-carhacking-is- fearmongering-514344885)

<comment><USER15> Those articles say that the idea of a remotely exploitable vulnerability in a car is ridiculous (therefore so is the murder idea), but is that not exactly what happened with Jeep here?

<comment><USER14> Yeah that was my point. There are always "experts" to be found who can't imagine a particular exploit working. Reality is not limited to some dude's imagination, so we should have read the initial articles for what they were: "nothing to see here, move along." If we knew then what we know now, such articles would have piqued our curiosity. Therefore, the fact that they were published _does_ pique my curiosity.

<comment><USER16> _Reality is not limited to some dude 's imagination_

I love that quip.

It reminds me a little of something we say, more or less: "this device does not read its data sheet". It comes up a lot when a physical device does not behave the way you might expect from reading its accompanying documentation.

</comment></comment></comment></comment><comment><USER17> _Employing this trick you can find all of Chrysler's cars equipped with this kind of head unit. Over a million of them were actually recalled by Fiat Chrysler. After that all you need is to choose the right one. Funny thing is that it's rather hard to do, "it's much easier to hack all the Jeeps than the certain one," as the researchers say.

However, picking the wanted Jeep is doable as well, thanks to the option of the GPS tracker._

Better double check that you're not crashing another Jeep which is in the wrong place at the wrong time...

<comment><USER18> If you're doing it for nefarious purposes, all you need to know is that the target vehicle in is on the road. You could have every active vehicle crash at the same time. While doing so blows the hack for good, it would make the motive incredibly difficult to determine.

</comment></comment><comment><USER19> This is the recall text from Jeep:

Safety Defect/Non Compliance Description and Safety Risk:

SOME 2013-2015 MY VEHICLES EQUIPPED WITH SPECIFIC RADIOS HAVE CERTAIN SOFTWARE SECURITY VULNERABILITIES WHICH COULD ALLOW UNAUTHORIZED THIRD-PARTY ACCESS TO SOME NETWORKED VEHICLE CONTROL SYSTEMS. A SUCCESSFUL EXPLOIT OF THIS SECURITY VULNERABILITY COULD RESULT IN UNAUTHORIZED REMOTE MODIFICATION AND CONTROL OF VEHICLE SYSTEMS. FCA US HAS NOT MADE A DETERMINATION THAT THIS SECURITY VULNERABILITY CONSTITUTES A DEFECT. ALTHOUGH FCA US HAS NOT DETERMINED THAT A DEFECT EXISTS, IT HAS DECIDED TO CONDUCT A REMEDIAL CAMPAIGN AS A SAFETY RECALL IN THE INTEREST OF PROTECTING ITS CUSTOMERS. EXPLOITATION OF THE SOFTWARE SECURITY VULNERABILITIES COULD LEAD TO EXPOSING THE DRIVER, THE VEHICLE OCCUPANTS OR ANY OTHER INDIVIDUAL OR VEHICLE WITH PROXIMITY TO THE AFFECTED VEHICLE TO A POTENTIAL RISK OF INJURY.

Repair Description:

CUSTOMERS AFFECTED BY THE RECALL WILL RECEIVE A USB DRIVE WHICH THEY MAY USE TO UPGRADE VEHICLE SOFTWARE, PROVIDING ADDITIONAL SECURITY FEATURES INDEPENDENT OF THE NETWORK-LEVEL MEASURES. ALTERNATELY, CUSTOMERS MAY VISIT HTTP://WWW.DRIVEUCONNECT.COM/SOFTWARE-UPDATE/ TO INPUT THEIR VEHICLE IDENTIFICATION NUMBERS (VINS) AND DETERMINE IF THEIR VEHICLES ARE INCLUDED IN THE RECALL. IF SO, THEY MAY DOWNLOAD THE SOFTWARE THEMSELVES, OR VISIT THEIR DEALERS, WHERE TECHNICIANS WILL PERFORM THE INSTALLATION. THERE IS NO CHARGE FOR THE SOFTWARE OR, IN THE CASE OF DEALER VISIT, INSTALLATION.

I'm getting a 404 on the update page [nevermind it's case sensitive and needs to be downcased]. Does anyone know if this update actually fixes the issue? From reading the exploit details it seems more like a systems design issue that can't easily be patched in software.

<comment><USER20> Chrysler worked with the guys that discovered the vulnerability and no doubt simply patched the current known bug allowing exploit from the cellular uplink. The system could be vulnerable again if a new exploit is discovered. I updated my Jeep a week or so ago and haven't had any issues -- yet.

Edit: After reading the paper it looks like the update from Chrysler blocks inbound tcp/ip now, and Sprint is also filtering traffic more aggressively.

</comment></comment><comment><USER21> Software can not be trusted. It is too complicated and people get things wrong.

If something really needs to be be read only, enforce it with physical diodes or similar.

</comment><comment><USER22> I'm going to just ride my honda ruckus moped and forget buying a new car.

</comment><comment><USER23> Why would someone who knows how to use a computer want a Jeep?

</comment><comment><USER6> If you can hack a car like this, what about a Boeing?

<comment><USER24> [http://www.runwaygirlnetwork.com/2015/05/17/boeing-ife- exper...](http://www.runwaygirlnetwork.com/2015/05/17/boeing-ife-experts-hit- back-at-hacker-claims-in-fbi-report/)

</comment></comment><comment><USER25> I'm not so worried about hackers gaining access to change radio stations, but writing to the CANBus is concerning.

It sounds like the weak point in this was the ability to rewrite the firmware of the V850 controller. If that could somehow signed then I'd feel safer.

<comment><USER26> Even changing radio stations could be very dangerous, especially if access is also granted to audio controls (which it is). Attackers could easily cause accidents by creating distractions like rapidly changing, loud radio stations.

<comment><USER27> Don't forget an FM radio signal itself is trivial to hack. I did this when I was a kid so that's not a new problem at all, and probably not a danger. If the driver is going to crash because of a sound on the radio, they probably aren't safe to be driving in the first place.

<comment><USER28> All you can do with an FM signal is override the audio. The volume is still limited to whatever the driver set, and they can always turn it off.

Turning the volume to maximum and preventing the driver from lowering it or turning off the sound would be much worse.

As for "probably aren't safe to be driving in the first place," that may be so, but I would estimate that about 80% of people on the road aren't really safe, and just muddle through by luck and generous margins. Causing unsafe drivers to crash when they otherwise wouldn't have is still bad.

<comment><USER29> In the security paper, they highlight that the entertainment system displays radio station images that are broadcast over the air (not sure if this was FM or satellite). So it's conceivable that an FM transmitter could broadcast a corrupt JPEG, causing a buffer overrun in some crappy image decoding software, and pwn your car...

</comment></comment></comment></comment></comment><comment><USER30> > They were able to control steering wheel

This seems unlikely.

<comment><USER31> Why?

[https://en.wikipedia.org/wiki/Power_steering#Electric_system...](https://en.wikipedia.org/wiki/Power_steering#Electric_systems)

Plus, the vehicle can park for you. Clearly it has the raw hardware to allow for this.

<comment><USER30> Generally cars cannot control their steering. But obviously this one does have that ability. Interesting.

</comment></comment></comment><comment><USER32> A simple fix would be to allow me, the owner, to turn off the wifi device and the connection to Sprint. I am not using those features and don't wish to have them.

<comment><USER33> The connection is probably at least used to crowd-source live traffic information. Most people would like this feature.

<comment><USER34> That doesn't justify not giving the option to disable it.

</comment></comment></comment><comment><AUTHOR> Remote Exploitation of an Unaltered Passenger Vehicle

Dr. Charlie Miller

Chris Valasek

August 10, 2015

[http://illmatics.com/Remote%20Car%20Hacking.pdf](http://illmatics.com/Remote%20Car%20Hacking.pdf)

<comment><USER35>
        While some of the research could proceed without the diagnostic equipment, many
        active tests and ECU unlocking require an analysis of the mechanic's tools.
        After both authors of this paper sold plasma for several weeks, we were finally
        able to afford the system required to do diagnostics on the Jeep Cherokee (and
        all other Fiat-Chrysler vehicles)

<comment><USER36> Its a joke. Miller is loaded, and alibaba is full of cheap clones of diagnostic tools (and 'special' dongles that do magical things like cloning BMW keys, or bypassing Mazda 6 security in 4 seconds)

<comment><AUTHOR> Yep, lots of amazing bitsy things for sale from Asia. I liked the very helpful strings output, it's so nice when programers are thoughtful like that and give helpful -h output.

</comment></comment></comment></comment><comment><USER37> You're sorely mistaken if you think Jeep is the only car manufacturer with this setup. I'd bet that most cars produced within the last few years don't have airgapped CANBus systems. By definition, any car with 'drive' settings you can adjust by the headunit console (suspension, sport modes, charging status, etc) is not airgapped. I mean, in a Tesla you have the option _to change suspension settings based on location from a Google Maps -based GPS system_. It also _can drive itself from your garage to your front door based on meetings scheduled in your calendar_.

We literally have the same information for any auto manufacturer that we have from Jeep - empty assurances that 'we design our cars with the utmost cyber- security protections, trust us'.

<comment><USER38> Car nut here: Your assumption is correct. The system is not air gapped. Even racing control systems suffer from this (except some really expensive ones, although they use commonly sourced sensors with various form of shielding).

<comment><USER14> Hmmm this could lead to some unconventional race techniques.

<comment><USER39> Race conditions would have a totally new meaning.

<comment><USER40> That's awesome

</comment></comment></comment></comment></comment><comment><USER41> The sad thing for me, and I see this way too often, is that someone, somewhere, no doubt said "Of course its secure, you can only READ the CANbus, the software doesn't even HAVE a write capability!" and everyone in the room nodded and went on with the rest of the review.

Manufacturers and engineers have to get it through their head that _IF_ you can change the firmware _ANYONE_ can change the firmware. If the firmware is SECURITY CRITICAL then the only way to change it can be through physical presence, loading encrypted and and signed firmware, with external validation. (something like the car asking for a third party to authenticate the operation ala nuclear launch codes). You can still get screwed but it will be hard enough to do that otherwise low value targets will remain relatively safe.

<comment><USER42> And when manufacturers start doing that, people will complain that they don't "own" their cars anymore. [1]

1: [http://boingboing.net/2015/05/21/gm-says-you-dont-own- your-c...](http://boingboing.net/2015/05/21/gm-says-you-dont-own-your-ca.html)

Disclaimer: I work for GM.

<comment><USER43> There's still the right and secure way to go:

1) By default the cat is "locked", and uses a manufacturer-issued public key to verify the signature of updates

2) A car owner can "unlock" the car, by creating a key pair, and asking the manufacturer to add / replace (debatable) the new public key to the car. Right after that, the owner has an ability to modify the firmware, but everything is still secure. And it's up to the adult owners to manage their private keys and be careful with updates.

3) There should be a simple way to factory-reset the car (with either the owner, or the manufacturer signature).

<comment><USER44> Under this model, if you buy a used car, how can you be sure it doesn't have keys that are controlled by someone else? You can follow the "factory-reset" procedure, but how do you know the reset mechanism hasn't been tampered with?

<comment><USER45> They can design it so that the firmware is in two parts.

The first part does minimal initialization and then gives control to the second part, which is where most of the functionality is.

The first part is also the part responsible for implementing the firmware update protocol and the reset procedure. The first part would either not allow any update to replace the first part, or it would only allow the first part to replace with factory signed firmware.

Alternatively (or in addition) they could have a diagnostic connector that lets external hardware read the firmware memory. You could then do the factory reset on your used car, and then hook something up to that diagnostic connector and have it compute a hash of the firmware that you can check to make sure it is the right firmware. An Arduino should be sufficient as the thing to read and hash the firmware.

<comment><USER46> The second approach is likely preferable - with the first approach, FOSS Stalwarts will still complain that there's non-free software in the system.

<comment><USER47> They could still open source the first system's firmware code. FOSS doesn't imply easily modifiable, does it?

E.g., rms says he used a Lemote Yeeloong because of its free BIOS, but AFAIK he couldn't have reprogrammed it unless he removed the BIOS chip from the motherboard.</comment></comment></comment></comment></comment></comment></comment>


Punk Rock Your Life: The Simple Six-Letter Word That Determines Success - <AUTHOR> http://zenhabits.net/2008/02/punk-rock-your-life-the-simple-six-letter-word-that-determines-success/ <comment><USER2> I thought it was going to be "effort," but "action" may be better because it implies changing state. I.e. finally quitting. You can tell yourself that planning your startup is effort, but you can't claim it's action.</comment>


Ask HN: What are you working on this weekend? - <AUTHOR> <comment><USER2> I'm working on my mental health this weekend - I've been putting it off for a while now, so I'm focusing on writing and staying away from work and competitive games. Might finally crack open a book, which isn't something I've been able to do a whole lot recently. Recommendations are welcome :)

<comment><USER3> [https://www.amazon.com/Mindfulness-25th-anniversary- Merloyd-...](https://www.amazon.com/Mindfulness-25th-anniversary-Merloyd- Lawrence/dp/0738217999/)

</comment></comment><comment><USER4> I am inches away from completing a library that automatically deploys a new SaaS platform, with most of the bells and whistles (more to be added each week). Once it is complete, I will be able to make a new company which I intend to use for other new SaaS companies. Essentially automating consulting / onboarding / services that all start ups need to have

<comment><USER5> This sounds so cool! What stack have are you building it with? Have you been dogfooding your own project?

<comment><USER4> I'm not sure I can give away the sauce yet for the actual ibrary, but the stack it creates is multiple React frontends with a Django API only backend that are all deployed to AWS. The AWS stack consists of RDS, Lambda functions for backend, S3 for media and React applications. The deployments are automated at literally every step; from AWS creation, GitHub configs to repo creation, TravisCI deployments. And yes! It is intended for dogfooding. The problem came about when I kept having to write very similar infrastructure over and over for new start ups

<comment><USER5> That sounds super impressive and useful. Do you ever plan to open source the code? Or keep it your competitive advantage? :)

</comment></comment></comment></comment><comment><USER6> I'm working two projects as of now. Both solves my own problem

1\. [https://github.com/mohitmun/howienduphere/](https://github.com/mohitmun/howienduphere/)

Problem: When browsing internet, I often come across really great blog/project/website etc. Its always good go back to origin of where I found it(let it be HN/reddit thread or some obscure blog). Most of the time I don't remember original source where did I find it mostly because its either in my pocket list or lost in dozens of tabs. this chrome extension will keep of all links i visited and their referrer(full urls not domain).

2\. [https://github.com/mohitmun/punter](https://github.com/mohitmun/punter)

Problem: Being rails developer, I love ORM(debatable). its very useful to quickly inspect data or run some manipulation. recently I was manipulating some CSV files, as well as sqlite db. I hate writing raw SQL for simple queries. so wanted to create a command-line tool where i can run simple queries (table.count, table.where(id > 3)) and get results. this should also work with CSV or any other db

<comment><USER7> Problem 1 is something I'm super into. One place where I think I would use this is in parallel to a web annotation system. Two years ago I had to take a stats course at school and I often found the dry mathematical explanations in the textbook challenging to comprehend. I would go online and search for better answers and often find them. For example a math overflow page or youtube video which makes the problem click in my brain. Now two months go by, and I forget the same theorem. In the back of my mind, I'll remember reading that one mathoverflow page or following a series of links, but now those links are lost in my history.

What I would like to do is annotate the web with data similar to what you are capturing and create 'context chains' as little sidenotes in the margins of the web. Then when I come back to the theorem I'm failing to understand I see a little margin note of the pages I visited when I first read the chapter, and I can immediately regain the context I found in my original study session.

</comment></comment><comment><USER8> Continuing the amazing course on [https://www.nand2tetris.org/](https://www.nand2tetris.org/). I also received an HP microserver gen8 a few days ago and will be setting up a plex server with sonarr/radarr/ombi/etc...

</comment><comment><USER9> A raspberry pi system to monitor my 3d printer during long prints. I'm writing the video streaming part myself for fun. Tomorrow I'll design and print the pi/camera mount.

<comment><USER10> Sounds cool. Wat tech do you use for the streaming part?

</comment></comment><comment><USER11> I'm working on the mobile version of Omnicube, which is a really hard puzzle game set on a talking cube in space.

I released the game a couple of months ago for Windows and Mac. I've had lots of requests to bring the game to mobile -- the mechanics are a great fit for touch devices, but it's hard to fit the entire interface onto a smaller screen. I'm working on some tricks and optimizations to improve the experience on mobile devices.

You can check out the desktop version of the game on Steam, itch.io, or the Windows Store. I also keep a development log on TIGSource.

Steam: [https://store.steampowered.com/app/800860/Omnicube](https://store.steampowered.com/app/800860/Omnicube)

itch.io: [https://trykon.itch.io/omnicube](https://trykon.itch.io/omnicube)

Windows Store: [https://www.microsoft.com/en- us/store/p/omnicube/9njcwkrx4mm...](https://www.microsoft.com/en- us/store/p/omnicube/9njcwkrx4mmh)

TIGSource devlog: [https://forums.tigsource.com/index.php?topic=63388.0](https://forums.tigsource.com/index.php?topic=63388.0)

</comment><comment><USER12> I'll be spending some time with friends, but also rebuilding the gearboxes in my open source 3D printed four wheel drive robot. Specifically I am adding some metal pins to the gearbox which should alleviate one of the failure modes discovered in this video:

[https://youtu.be/DXPmqCd0r04](https://youtu.be/DXPmqCd0r04)

<comment><USER13> I like how strangers were asking and were very enthusiastic.

</comment></comment><comment><USER14> I'm working on an app that matches up new contributors to open source projects who need various grunt work / simple programming done ([https://issuehaven.com](https://issuehaven.com)). All criticism is welcome :)

<comment><USER15> You can sort by code which is nice. I would like to suggest sort by "Difficulty" or "effort" as it seems most issues there also have those tags. Will look into it more. Looks good so far

<comment><USER14> I'm not quite sure what you mean by that, sorry- the issues are crawled based on a preconfigured list of beginner-friendly tags (see [https://github.com/MattAlp/IssueHaven/blob/master/config.py#...](https://github.com/MattAlp/IssueHaven/blob/master/config.py#L32)).

They're currently sorted based on repository popularity (in stars), issue age, and total comments (I'm working on implementing a better ranking system).

How would you propose that I gauge difficulty/effort across board for the aggregated issues?

<comment><USER15> I didn't realize the issues presented are already the 'easier' ones... unless I am misinterpreting your website again?

For example:

1\. [https://github.com/coala/coala/issues/5674](https://github.com/coala/coala/issues/5674)

On the right hand side it has the label difficulty low, importance high

2\. [https://github.com/pyca/cryptography/issues/4377](https://github.com/pyca/cryptography/issues/4377)

has the label good first issue

So labels are not consistent in each of the repositories. And it would be sort of difficult to display a label on each of the issues on your website. But maybe you could display and use the labels the repository is using for your own website (maybe with a toggle). By copying the labels you might not have to gauge difficulty?

</comment></comment></comment></comment><comment><USER16> A Bash script for installing ArchLinux automatically. Right now I'm finishing a "system" for setting up the partitioning scheme (with MBR). You just store partition data in each row of a matrix (type, size, label, mount point, etc), with each row representing a partition. It takes row order as partition order (so row 0 is the first partition, row 1 is the second, and so on). This is the hardest thing to automate in pre-installation and is not difficult to do. It's fun because you have to catch errors like defining logical partitions after primary non-extended ones, partition sizes exceeding disk size and simple stuff like that, it's relaxing.

</comment><comment><USER17> Nothing, British Chess Championship is in my hometown so I'm having a computer free week.

<comment><USER11> If you're participating as a player, good luck! What openings are you playing?

Also...go Mickey Adams!

<comment><USER17> Not participating this year as I have to go out of town for a couple of days (off to see Iron Maiden) and I only started playing at Christmas (last played back when I was a teenager like 20 years ago).

Will likely enter next year in the under 120 baring some radical progression between now and then (I'm currently 104 after 9 league games).

</comment></comment></comment><comment><USER5> I'm working on the beta version of [https://followalong.co](https://followalong.co), which lets you follow specific people on HN.

Currently onboarding alpha testers if anyone's interested.

<comment><USER18> Looks interesting, I'm down!

</comment></comment><comment><USER19> I'm working on a simple GUI for AWS's KMS[0]. KMS is great but it's very confusing for new people and it's not easy to organize the keys (and other information) that you want to store. My thought is that a simple Electron app would make this more approachable by humans and still make the keys usable by automated systems on the back-end.

[0][https://aws.amazon.com/kms](https://aws.amazon.com/kms)

</comment><comment><USER20> I'm working on a simple web app to share ideas for side project. I'd love to "show hackernews" some day, but it's not ready yet.

\- Code is at [https://github.com/sne11ius/egghead.space](https://github.com/sne11ius/egghead.space)

\- Pre-alpha-ish version runs at [https://egghead.space](https://egghead.space)

Also: my tan, since the weather in germany is awesome this summer :D

</comment><comment><USER21> Clearing land, removing poison ivy by the road, taking down yet more white pines and a few small-ish oaks. Generally getting it presentable in the front and also ready for sheep (eventually).

I bought 4.5 acres in March, so this will take many more weekends to come.

Stripping paint off an antique newel that I bought from an architectural salvage.

Working on a wood bench I've been carving, but moving forward with that is now pending a draw knife that I ordered from amazon.

</comment><comment><USER22> I'm working on making Flutter apps run on macOS: [https://feather- apps.com](https://feather-apps.com)

<comment><USER23> Oh, that's awesome. Can't wait to try it out when I finish my flutter stuff!

</comment></comment><comment><USER24> I'm working in a Django's Queryset port to Ruby on Rails: [https://github.com/diegojromerolopez/babik](https://github.com/diegojromerolopez/babik)

I really miss Django and its way of making queries and I think it could be a good add-on for Rails.

</comment><comment><USER25> Working on imageboard software that I'm writing for fun. All its responses are JSON, so it'll be possible to write various frontends for it.

(Although I haven't actually implemented the "image" part of it yet, so I guess it's just a text board right now)

</comment><comment><USER26> I am working on a utility macOS app which add page numbers / text watermark to your PDFs file ( [https://pdfpagenumber.com](https://pdfpagenumber.com) ) , currently implementing the bulk processing function.

</comment><comment><USER27> An app that shows the most demanded technologies for a lot of different IT careers: [https://skills.technology/software- developer](https://skills.technology/software-developer)

</comment><comment><USER28> A way for people to get anonymous feedback from friends: [http://www.andbehonest.com/](http://www.andbehonest.com/)

Not sure how to deal with possible abuse or harassment though

<comment><AUTHOR> Blacklisting certain words for starters.

</comment></comment><comment><USER29> A tinier, faster "react.js": [https://github.com/dosyago- coder-0/brutal.js](https://github.com/dosyago-coder-0/brutal.js)

</comment><comment><USER30> My tan.

</comment><comment><USER31> \- Finishing a large cat tree \- Installing a door \- Building a little free library \- Setting up additional irrigation in my garden \- Dehydrating fruit for snacks \- Writing code for fun and profit

<comment><USER32> How is your dehydration setup?

<comment><USER33> Also interested in this; is it a freezing or heating setup?

<comment><USER31> I had no idea dehydrating fruit would provoke such interest. I've got the cheapest generic-brand dehydrator I could find - think I paid $40 a few years ago at the local *mart. Has maybe 8 trays (I bought extra), basic circular, central air design. It works very well and I've done about ten batches of apples, bananas, cherries, and apricots this summer. Have three pounds of cherries to do this week. Hoping to do huckleberries as soon as they are ripe, and next spring we might try dehydrating morels. It's really nothing special, but it meets the family snack needs. I've even done jerky and fruit leather in it, with good success.

Now on the other hand my home cheese making operation is significantly more complex...

</comment></comment></comment></comment><comment><USER34> Trying to add a referral program to an email list builder I already made: [https://tuemilio.com](https://tuemilio.com)

</comment><comment><USER35> Preparing to ship a comission-free Algo trading Platform

[https://KloudTrader.com/narwhal](https://KloudTrader.com/narwhal)

<comment><USER36> Planning on having trial periods? To be straight I only have an idle interest. Not an active algo Trader

<comment><USER35> Currently 3 days trials, but drop me an email :) Email's in profile. Sign up for our mailing list too: [https://KloudTrader.com](https://KloudTrader.com)

</comment></comment></comment><comment><USER37> I've lfound an old Silicon Graphics Indigo 2 IMPACT (literally) on the street... If I find an SGI to VGA Adapter, I might explore Irix ....

</comment><comment><USER38> A to-do list app to replace Wunderlist: [https://matterlist.com](https://matterlist.com)

</comment><comment><USER39> Getpoe.com, my distraction free writing app for windows. Rewriting in vuejs and it's going beautifully

</comment><comment><USER40> I am finally working again on an idea I have about pre-screening for software engineering interviews.

<comment><AUTHOR> That sounds interesting.

</comment></comment><comment><USER23> A sonarqube replacement with a nice UI, simple setup and easy plugins.

</comment><comment><USER13> Tidying house and looking after kids, esp. Soccer practice plus a it of Netflix.

</comment><comment><USER41> creating golang introductory course for experienced c/python programmers.

</comment><comment><USER42> Writing a pretty redundant Spotify playlist manager in reactjs as exercise.

</comment><comment><USER43> I'm working on a self modifying simulation experiment written in Go.

</comment><comment><USER44> I'll be diving into emulator101.com from yesterdays post.

</comment><comment><USER45> VR space station game.

</comment><comment><USER46> Im trying to make a torifier for windows.

</comment><comment><USER47> Pear compote!

</comment><comment><USER18> I've just started to really kick off my side design project so hoping to spruce up the website and increase it's overall quality since it's not really at the level I want yet: [https://designgib.com/](https://designgib.com/)</comment>


Why your next open source project may only be an interface - <AUTHOR> https://www.scalevp.com/blog/why-your-next-open-source-project-may-only-be-an-interface <comment><USER2> have you thought about yxhvp though?</comment>


Ask HN: Am I the only one thinking that CodeCanyon's rates are unfair? - <AUTHOR>

I never used CodeCanyon before, so I was browsing their site, and looked at their payment rates.
http://codecanyon.net/make_money/payment_rates
They take 50% of each sale if you are an exclusive author (but they lower this rate as your sale volume increases) and 67% for non-exclusives author.
I always thought that Google and Apple market's rates were high (30% of each app sale, if I remember correctly), but they did a huge work builting an entire ecosystem of mobile devices, so that sounds fair to me.
But 67%! It's really bugging me. What service do they provide is worth so much? Does anybody already used CodeCanyon successfuly? <comment><USER2> It was much higher before, starting at 75%.

<comment><AUTHOR> It's not really a good excuse, is it?</comment></comment>


Australia's anti-encryption laws used to bypass journalist protections: expert - <AUTHOR> https://www.theguardian.com/australia-news/2019/jul/08/australias-anti-encryption-laws-being-used-to-bypass-journalist-protections-expert-says <comment><USER2> These things _should_ be surprising, but they are _not._

And this is true around the globe, independent of evidence politician demand ever crazier methods (while at the same time usually reducing both the paychecks and numbers of police officers). I wonder how we, the people, can protect our democratic systems from these dangers?

<comment><USER3> > I wonder how we, the people, can protect our democratic systems from these > dangers?

Stop trading freedom for security?

Politicians will always tantalize you by proposing you <limit guns, limit speech, limit privacy, etc.> for <fewer deaths, fewer suicides, fewer terrorists, etc.> but if you let it go forever, you'll find all your freedoms have been traded for safety.

<comment><USER4> I'm always worried about discouraging people with the pessimistic view here, but it's not actually clear to me that we have a choice in that matter.

Most innocently, because the number of people worried about this remains relatively low, and regularly gets overwhelmed by other groups. That's how democracy works, obviously, but it alarms me because privacy is a partially unrecoverable resource; even if people organize and win, a great deal of damage may have been done.

More cynically, though, because it feels like many of our democratic systems _don 't work_ on this problem.

By its own admission, the CIA violated its charter - and in many cases federal law - numerous times from the 1950s to 1970s. These events were documented internally in 1973, but no one appears to have faced consequences, and the "Family Jewels" weren't publicly released until 2007. Also in the 1970s, the Church Committee concluded that the NSA had conducted illegal surveillance, failed to shut it down when instructed to do so, and then followed up by lying to Congress about the entire mess. It _also_ concluded that no one could be prosecuted for this, essentially because the tracks had been covered too well to convict any specific individual. The history of other Five Eyes nations in not substantially more comforting, as a look at e.g. UK practice in Northern Ireland will testify.

Today, the state of privacy law in the US isn't even known, because much of it is decided in secret court hearings with no one but the government present. National Security Letters help ensure that the public can't object to state surveillance by forcing private citizens to keep it secret, and interfering with basic access to counsel for the recipients. James Clapper gave testimony to Congress that was prima facie perjury, for which he faced no consequences. The list goes on at enormous and alarming length.

I don't know what we do about this. Voting for candidates who oppose war and surveillance is good, but they generally perform poorly, the ones who do well often seem to reverse course after election, and the ones who follow through (like Wyden and Udall) are frequently stonewalled and outright lied to by intelligence services. It feels alarmingly like we've created a surveillance system which operates independent of any democratic decisionmaking, and no longer know how to walk it back.

</comment></comment></comment><comment><USER5> The really concerning part is that legislation of this nature often receives bipartisan support in the Australian parliament. I don't recall if it was this bill or a different one, but the opposition released a strongly worded statement saying "we have concerns with this legislation", then voted for it ASAP. A thinner fig leaf of an excuse I have yet to see in politics.

<comment><USER6> This type of bipartisan support seems to be a recurring concern with the more authoritarian "national security" legislation being passed around the world. We have the same thing in the UK, where both of the big parties have tended to support intrusive government surveillance powers. Because of our voting system, the more liberal but smaller parties that would challenge such measures tend to be disproportionately under-represented at national level, so authoritarianism almost always wins.

This leads to claims that most people support such measures, yet not so long ago we had a huge grass roots campaign against mandatory ID cards (and related measures like the database behind those cards) that ultimately succeeded in preventing their introduction, so clearly it's not really as simple as that. Certainly some reports based on polling that get brought out to demonstrate that public "support" for these measures have glossed over heavily loaded questions in the polls themselves. (They're not quite "Terrorism is a really serious threat and a nuke might kill everyone. Do you support stronger government powers to prevent bad people doing these bad things and keep your children safe?" but sometimes they get awfully close.)

This is the reality of the politics of fear in the Western world today. Personally I'm _slightly_ optimistic that things will turn for the best within the next few years. We seem to have widespread concern about "fake news" and unwarranted interference in democratic processes, to the point that now we see explicit "fact checking" becoming a common practice in media reporting of political statements and we're seeing big social media platforms trying to rein in the more questionable propaganda and stop their systems from becoming little more than a rumour-driven mob on a national or global scale.

Maybe someone will finally notice that the threat from terrorism is actually pretty small, the threat from excessive government powers is actually pretty big, and in any case all of these resources might be better spent on other areas of government like education or healthcare or infrastructure projects that could make a much bigger difference to a lot more people anyway. We can hope...

<comment><USER7> Cryptography is unknown to many and many fear the unknown.

<comment><USER6> True. It certainly doesn't help that a lot of the elected representatives who are making these laws evidently lack even a basic understanding of the technical issues involved, so they are often guided by expert advice from those who entirely coincidentally are the main beneficiaries of the stronger powers being created.

</comment></comment></comment></comment><comment><USER8> > One part of the law updated the powers law enforcement have in executing a > warrant. Added into the Crimes Act was the power for agencies to "add, copy, > delete or alter" data on computers as part of the execution of warrants.

<comment><USER9> When I first read this I interpreted it as possibly having something to do with enabling offensive cyber operations (maybe?), it just sounded too weird to be anything else.

One thing I did notice during the ABC raid was how the police ignored general digital forensic practices and simply created an archive on the target drive (overwriting any data previously there), dragged and dropped what they wanted into it, then zipped it up and left (this was according to one ABC employees twitter feed while they were in the office as it was happening).

<comment><USER10> That struck me as well. How can they ever use that as evidence in a court case when there is no chain of custody whatsoever?

Who cares I guess, they have the power to modify any data they want anyway. It's crazy.

<comment><USER9> My first impression was that they had no intention of going to court with the data they were after, but then again I've not read up on any legal case studies involving digital forensic evidence handling which are publicly available in Australia (how would a magistrate even deal with that sort of evidence if it can legally be modified? I'm not sure any of these new laws have been tested in court before).

It's nuts that something that used to be seen as solid evidence in court could now be seen as totally unreliable, and just because someone may present it saying "trust me because I'm a cop" means absolutely nothing when someone has a duty to factor the human element into the equation. The guidelines regarding the handling of digital forensic evidence (and all types of evidence for that matter) were designed to deal with this. So yeah, I think what I'm trying to say here is that among the new laws, that one in particular could do much more harm than good due to being so vague in its wording and scope. From what I've read about the US court system, this type of evidence would no longer be permitted in 99.9% of cases, It wouldn't matter if you're the damn pope presenting it, everyone's human. I actually wish I knew a magistrate in real life to ask them how they would handle a case involving this law and a drive handed to them by some prosecution team involving the AFP.

</comment></comment></comment></comment><comment><USER11> Reading more, I don't think there is any general lesson to learn about the impact of the anti-encryption laws on journalistic freedom.

The relationship between the AFP and journalists in Australia seems pretty adversarial, and this new law has simply been misused _facilitate_ already occurring egregious behaviour. It does not appear to allow any _novel_ violations of journalistic rights.

<comment><USER12> > _The relationship between the AFP and journalists in Australia seems pretty > adversarial_

Well, yes. The AFP was, for a long time, an incompetent shambles. The media reported on the generous vistas of incompetence, bastardry and shambolatry.

Now the AFP is essentially taking its revenge, with gusto.

</comment></comment><comment><USER13> Being anti encryption is inviting abuse.

Politicians will not their position on the topic until they are personally attacked.

When their private conversations, images, friends and families start leaking they will begin to care.

<comment><USER14> But, but, but... the bill specifically says that they're excluded from the spying! So they're totally immune from that risk! /s

Yes, I'll laugh when their pants inevitably fall down. I wonder what the reaction will be.

But seriously, I have to wonder what these politicians want the endgame to be. A police state isn't good for anyone, including them.

I used to think Australia was the best country and think they were trying their best for Australia's interests, but they are busily removing the good things about Australia at a really scary rate. I don't want to trade a minor increase in "safety" for living in a surveillance dystopia, which is 100% where we're headed.

<comment><USER13> With freedom comes risk, I live in the USA and I want to be able to walk down the street without being monitored or tracked.

Along with that I must accept that petty crime is going to happen, because I am not the only one walking down the street without being monitored.

I think that crime needs to be reevaluated. There needs to be a good financial analysis of where the time and attention is best spent, they cannot find all crime all of the time (which feels like the goal)

<comment><USER14> Finding all crime is not the goal.

As the KGB saying goes, "Everyone has committed a crime, it's about who we decide to prosecute".

</comment></comment></comment></comment><comment><USER15> This was from a letter from the Department of Homeland Affairs in regards to the Assistance and Access Act. Notice that they cite terrorism as necessitating the Act, but in actuality they just abuse it.

 _" Encryption is a vital security measure for digital data and the Australian Government is committed to strong protections for personal and commercial information. It makes the communications and devices of all people more secure. While encryption is an important aspect of modern communications it is routinely employed by terrorists, child sex offenders and criminal organisations to mask illegal conduct. This is an impediment to our agencies' ability to detect and disrupt serious threats to the public.

Rapid technological change means that valuable sources of evidence and intelligence are diminishing; 95 per cent of the Australian Security Intelligence Organisation's (ASIO) most dangerous counter-terrorism targets and 90 per cent of communications lawfully intercepted by the Australian Federal Police (AFP) are encrypted and unreadable. By 2020, it is expected that all communications among terrorists and organised crime groups will be encrypted. The Assistance and Access Act was introduced as a direct response to this challenge. The legislation passed both Houses on 6 December 2018 and received Royal Assent on 8 December 2018.

The need for a modern and fit-for-purpose legal framework was highlighted by the fatal terrorist attack in Melbourne in November 2018, and the subsequent disruption of alleged planning for a mass casualty attack by three individuals. Encrypted communications commonly facilitate the planning and execution of such attacks and it is the Government's duty to ensure that Australia's law enforcement and security agencies have the requisite tools to protect the Australian public.

The Assistance and Access Act balances the needs of investigators with important limitations and safeguards that protect the privacy of Australians, maintain the security of digital systems and ensures law enforcement's powers are used appropriately. Robust transparency, oversight and independent scrutiny measures ensure that industry and the public can maintain confidence in the products and services that allow them to communicate securely online. The new laws are not about breaking encryption. It is paramount that the services and devices that Australians rely on remain secure. Through the provisions of the Assistance and Access Act, Government can partner with industry to modernise investigations and prosecute criminals that hide in online spaces while ensuring their assistance does not make the communications of innocent parties vulnerable. That is why the Assistance and Access Act clearly prohibits law enforcement from requiring a communications or device provider to build systemic weaknesses or backdoors into their systems (so called 'back doors'). The Assistance and Access Act also states a provider cannot be prevented from fixing known weaknesses.

Australian agencies are committed to working collaboratively with industry. The regime sets out how this collaboration will occur and builds greater partnerships between providers and Australia's key law enforcement and security agencies. This is a framework for assistance and does not allow for unwarranted access to communications content or data. Access to this material remains subject to an underlying warrant or authorisation and strong oversight.

The Government undertook an extensive three-stage consultation process to develop and consult on these measures, engaging with industry and the public on the entirety of the Act. Significant changes were made in response to feedback from the technology community and civil society – this consultation process improved the legislation, and ensures a more robust response to the challenges posed by a rapidly evolving communications environment."_

<comment><USER11> On reading more, I don't really see how this particular legislation played a mayor role in things like the ABC raid?

I doubt this "anti-encryption" legislation is what allows the police to stomp into a journalist office and take things like cameras as the ABC warrant allowed.

I mean, clearly a law supposed to help combat terrorism is gravely misapplied when used to search for a journalists source, but the real problem is that journalism seems to lack pretty basic protections at all in Australia.

<comment><USER14> The entire article is to explain how the new anti-encryption laws augmented the existing laws, removing the need for a special journalist information warrant.

So it was exactly these horrible laws that allowed them to stomp through and do whatever tf they want, including modifying data.

<comment><USER11> I'm not convinced, historically they appear to get those journalist warrants easily enough, and those don't appear particularly limited in scope in regards to what can be seized etc.

This circumvention seems to be mostly added convenience. The only novel bit is the allowance for modifying data, but I doubt it matters much in practice as the AFP will likely just take physical devices and at best hand it back wiped.</comment></comment></comment></comment>


A Response to the New Yorkers "Is America Headed for a New Kind of Civil War?" - <AUTHOR> https://steemit.com/news/@emperortefera/a-response-to-the-new-yorkers-is-america-headed-for-a-new-kind-of-civil-war <comment><AUTHOR> Here is a link to the referenced article: [https://www.newyorker.com/news/news-desk/is-america- headed-f...](https://www.newyorker.com/news/news-desk/is-america-headed-for-a- new-kind-of-civil-war)</comment>


Lucy to Allow Charlie Brown to Kick Football - chris-at http://daringfireball.net/linked/2015/08/08/android-security-monthly <comment><AUTHOR> Apple really have worked out the importance of a consistent platform with regular updates.

Google really stuffed up by not ensuring from day one that all Android devices MUST update from a central, Google controlled resource.

Android shouldn't be fragmented but googles poor decisions mean it is. The outcome is that when disastrous security flaws are revealed, the best Google can do is say "errr, please, phone vendors, we'd like it if you considered maybe offering an optional critical security update." The phone vendors say "what, we've got better things to do." Royal fuck up.

</comment><comment><USER2> This doesn't seem like a good source of Android news. The writer writes mostly about iOS and makes a lot of glaringly obvious mistakes when writing about Android. Note in this link talking about Stagefright like it is the name of an exploit when really it is the name of the media framework used on Android.</comment>