The Nihilism of Julian Assange - <AUTHOR> http://www.nybooks.com/articles/2017/07/13/nihilism-of-julian-assange-wikileaks/ <comment><USER2> ""Well they're informants. So, if they get killed, they've got it coming to them. They deserve it," Leigh and Harding report Assange saying to a group of international journalists. And while Assange has denied making these comments, WikiLeaks released troves of material in which the names of Afghan civilians had not been redacted, an action that led Amnesty International, the Open Society Institute, the Campaign for Innocent Victims in Conflict, and the Afghanistan Independent Human Rights Commission to issue a joint rebuke" This really sums up Assange for me. I don't know if he is an idealist who believes in what he's peddling or an opportunist but either way he's someone willing to let people die.

<comment><USER3> Very convenient unsubstantiated quote there.

<comment><USER2> It doesn't really matter if the quote is real. He released the information when it was obvious it put peoples lives at risk. There is a reason why responsible journalists wanted to redact that information. Julian seems to just want to put everything out there and destroy privacy and I don't want to live in a panopticon.

<comment><USER3> > There is a reason why responsible journalists wanted to redact that > information.

Yes: the reason they bring it up is that the issue provides a powerful moralistic cudgel against Assange, a threat to their business model.

As far as I know, there are no documented cases of deaths due to the Wikileaks leaks at issue in the unsubstantiated quote: [http://www.politifact.com/truth- o-meter/statements/2017/feb/...](http://www.politifact.com/truth-o- meter/statements/2017/feb/01/john-mccain/mccain-says-taliban-murdered-people- because-chelse/)

<comment><USER4> _Yes: the reason they bring it up is that the issue provides a powerful moralistic cudgel against Assange, a threat to their business model._

Oh this is just beyond ridiculous.

They bring it up because _people 's lives were put at risk_. I won't go so far as to claim people actually died, but that absolutely was a risk and Assange very consciously chose to take that risk.

Who cares if the "old media" also happens to see WikiLeaks as a "threat to their business model"? That's literally 100% beside the core point, here, though it's a mighty fine deflection on your part.

</comment></comment></comment></comment></comment><comment><USER5> The author buries the main point under a lot of kvetching about Assange's personality and motivations:

 _This is where censorship begins. No matter what one thinks of Julian Assange personally, or of WikiLeaks's reckless publication practices, like it or not, they have become the litmus test of our commitment to free speech. If the government successfully prosecutes WikiLeaks for publishing classified information, why not, then, "the failed New York Times," as the president likes to call it, or any news organization or journalist? It's a slippery slope leading to a sheer cliff. That is the real risk being presented here, though Poitras doesn't directly address it._

We are all Julian Assange.

<comment><USER4> "Main point"?

That's _a_ point among many.

This is a documentary about Assange himself. By definition that means a study of the man, not strictly a study of the issues. So "kvetching about Assange's personality and motivations" _is exactly the flipping point_.

Now, pivoting to the issues for a moment: the situation with WikiLeaks is _complicated_. To distill it down to a simple slippery slope fallacy without acknowledging that complexity is, at best, pretty shallow thinking.

It would be dishonest to claim that the kind of radical transparency WikiLeaks espouses has no downsides. Again, the potential threat to Afghani informants is a pretty damn good example.

Is that cost worth the 100% censorship free society that WikiLeaks seems to want? Personally, I don't know... because, again, it's actually pretty damn complicated.

</comment></comment><comment><USER6> "And then this spring, it emerged that Nigel Farage, the Trump adviser and former head of the nationalist and anti-immigrant UK Independence Party (UKIP) who is now a person of interest in the FBI investigation of the Trump campaign's ties to Russia, was meeting with Assange. To those who once saw him as a crusader for truth and accountability, Assange suddenly looked more like a Svengali and a willing tool of Vladimir Putin"

 _Why_ exactly is meeting with the bumbling though reprehensible idiot Nigel Farage clear evidence that Assange is a tool of designated state enemy #1?

<comment><USER7> To call Farage 'reprehensible' is fair comment though not a view I share. However calling him a 'bumbling idiot' is simply ludicrous.

After giving up a successful lucrative career in the city of London, Farage has after innumerable campaigns across the country, fulfilled what he sees as Margaret Thatcher's dream of separating Britain from Europe. Few would demur from the view that Brexit would never have happened but for Farage who meantime has been merely an MEP in the European Parliament not an MP in the UK.</comment></comment>


Curiosity Mars Rover Landing Timeline: What to Expect Tonight - <AUTHOR> http://spectrum.ieee.org/automaton/robotics/robotics-hardware/msl-what-to-expect-on-sunday-night#.UB8TWv-gwU8.hackernews <comment><USER2> ... and 14 minutes later we know the outcome. I've not been this excited/worried/thrilled/paniced about a space mission for a while. :-)

<comment><USER3> Actually, it might take a lot longer than that! <http://www.youtube.com/watch?v=2t7p08hcQzs>

</comment></comment><comment><USER4> Will the PBS stations broadcast this event live? Or will I have to depend on the Internet gods and stream from ustream.tv?

<comment><USER5> Not sure about PBS tonight but I'm going to be watching direct from NASA: <http://mars.jpl.nasa.gov/msl/multimedia/nasatv/>

<comment><USER6> This link looks more live, <http://www.nasa.gov/multimedia/nasatv/ustream.html>

</comment></comment></comment><comment><USER7> "If you are watching from a mobile device or slower connection, watch the Mobile Feed for NASA Television Here"

<http://www.ustream.tv/channel/nasa-mobile> (but it's off air right now)

Actually, the HD channel has a 240p option (see "best" on the toolbar), which works fine for me <http://www.nasa.gov/multimedia/nasatv/ustream.html>

</comment><comment><USER8> I don't remember this much excitement over the 2004 landings. This is pure speculation, but I would like to think the Internet is partly responsible for this shift. It provides a more democratic way of deciding (as a culture) what is important and newsworthy.

<comment><USER9> There's that, and also that this is a pretty interesting landing compared to previous landing methods. There's been a lot of hype over just the landing gear. I've got non-techie friends who are tuning in just to see the engineering feat.

</comment></comment><comment><USER10> What are we really going to see tonight?

I assume statuses?

Video isn't possible, even delayed. And I suspect photos will be delayed for processing?

<comment><USER11> [http://spectrum.ieee.org/automaton/robotics/robotics- softwar...](http://spectrum.ieee.org/automaton/robotics/robotics-software/msl- when-well-see-the-first-images-from-the-surface)

Looks like we might not see any images until about 3:30 EDT

</comment></comment><comment><USER12> My workplace is hosting a landing party. I can't remember the last time I was this excited for something!

</comment><comment><USER13> And they just announced touch down!</comment>


Google's 4k-Word Privacy Policy Is a History of the Internet - <AUTHOR> https://www.nytimes.com/interactive/2019/07/10/opinion/google-privacy-policy.html <comment><USER2> The NYT privacy policy [0] is 5.2K words. It contains basically everything that they're criticizing Google for. And a bit more. Apparently NYT will by default sell (sorry, "rent") your name and postal address to direct mail advertisers.

> [If you use technology, someone is using your information. We'll tell you > how — and what you can do about it. Sign up for our limited-run newsletter.]

Uh-huh. If there's even a trace of irony in that writing, I can't spot it.

[0] [https://help.nytimes.com/hc/en- us/articles/115014892108-Priv...](https://help.nytimes.com/hc/en- us/articles/115014892108-Privacy-policy?module=inline)

<comment><USER3> There is a separation between NYT the corporation and the editorial staff. Just a couple of weeks ago, there was an article in NYT complaining about CCTVs installed in NYT office [0]. Should we now dismiss every article in NYT complaining about surveillance (especially workplace surveillance) as hypocritical and ironic, because if NYT thinks surveillance is bad, why do they do it themselves?

Newspapers like NYT are one of the few institutions where workers enjoy a level of freedom from management in doing their work. The other example is tenured professors. We should celebrate this, not mock it.

[0] [https://www.nytimes.com/2019/06/01/opinion/surveillance- came...](https://www.nytimes.com/2019/06/01/opinion/surveillance-cameras- work.html)

<comment><USER4> > We should celebrate this, not mock it.

I don't know what dystopian world you want to live in, but any time I see a company profit off sheer hypocrisy, I am going to call it out and mock it. They can have freedom all they want, but this article is generating clicks and revenues for Parent Corp, so they deserve the scrutiny. This isn't some public service they are providing.

<comment><USER5> Asking for curiosity: Given the tenured faculty comparison, should we blame tenured faculty who criticize predatory lending when their university accepts students with the same predatory loans?

Or perhaps a more direct comparison: Are tenured faculty at D1 sports universities hypocritical for researching the benefits of more funding going towards education and less towards massive stadiums?

<comment><USER6> There are two different cases for this:

1) The faculty member from University A writes an article criticizing University B, _without_ mentioning that University A also has the same problems.

2) The faculty member from University A writes an article criticizing a set of problems, including examples from both University A and B.

The subtle distinction between both #1 and #2 is why people have different opinions on this. Many people consider #1 to be hypocritical and #2 to be fair.

<comment><USER7> It would never be pointed out at all if you're following case #2 though if you're in a position of the OP though. The university wouldn't allow the article. The net result is a loss.

If people can't criticise at all due to some level of hypocrisy (which is separated from the author in this case!) then we all end up in a worse spot.

</comment></comment></comment></comment></comment></comment><comment><USER8> This article is probably intended as a jab at Google for having a Privacy Policy that is absurdly long.

However, this is also proof of how far we've come in regulating how personal information is identified and stored.

For example, the data comparison between 1999 and 2019 - Simply saying "We collect personal information you provide and clickthrough information" is certainly not enough nowadays. A short and generic policy lends itself to legal abuse, whereas the longer and specific policy tells you exactly what to expect from using the service.

Can things be made more clear? Always. But I think this trend is generally for the better.

<comment><USER9> What difference does it even make? If they want to collect new info, they just add it to the all encompassing policy for "everything Google" and the opt out option (lose access?) is too detrimental, so I have to agree.

They might as well just say "we collect everything."

<comment><USER8> > If they want to collect new info, they just add it to the all encompassing > policy for "everything Google"

Well the policy is not a binary blob. Google does more than most services by providing a full archive of their policies, as well as a clear-cut comparison of each.

[https://policies.google.com/privacy/archive](https://policies.google.com/privacy/archive)

FWIW, their most recent comparison is nearly all clarifications, with only one completely new addition.

</comment></comment></comment><comment><USER9> I hate adhesive ToS / Privacy Policies. I think options for data export should have to be sent to the user alongside privacy policy changes. I also think companies should be required to show TOS / Privacy Policies in a modal dialog that's displayed for the amount of time a fast reader would take to read them.

If the average person reads 250 words / min with 70-80% comprehension, that's 16 minutes for a 4k word policy. Since it's legalese, I bet it's 30+ minutes for most people. That's ridiculous.

<comment><USER10> I don't get it. People want comprehensive details about what companies do with their information, but they also want short privacy policies. You can't have both. And if you look at Google's privacy policy, it's not legalese at all. It's mostly explanatory, since its text binds _Google_ , not the user.

The TOU is a different matter, but, again, users and the law have forced companies into the situation where they have to explicitly spell out every detail. Even with that, Google's terms are written in what seems to me to be plain English ([https://policies.google.com/terms?gl=us](https://policies.google.com/terms?gl=us)). What would you cut from that to make it more concise? I can see a few things, but I'm also not a lawyer, and I'm not equipped to judge what liabilities each sentence might protect Google from.

Most people never read this stuff because most people just don't care. They'll never have a dispute with Google that would be covered by the terms, and they don't care enough about privacy to find a less convenient but more privacy- sensitive alternative. Even if they do care about privacy, they probably have a pretty good idea of what kinds of information Google collects, so the privacy policy is at most a reference for cases where they are unsure. Attempting to force them to read it would be unproductive, since it contains information that is either irrelevant or else already known to potential users.

<comment><USER11> You are missing the point. There should be no _need_ for such policies. Google should not be able / allowed to collect this data, with or without user consent.

<comment><USER10> If that's what the person I was replying to meant, they should just say that. They shouldn't say, "It's too long to read."

I don't agree at all with your point of view. I still think consenting adults can take some responsibility for making their own decisions about things. Obviously there should be exceptions when there are serious safety concerns, but such is plainly not the case with search engines.

Anyway, the TOU doesn't even address privacy very much. It would be a paragraph shorter if Google collected no user data at all. So I don't really think that is the point the top-level poster in this thread was making. Or if it was the point they were trying to make, they were doing so circuitously indeed.

</comment></comment></comment></comment><comment><USER12> Does anyone actually read privacy policies?

My default assumption is that they're all out to f me on this front & it's not like you actually have a choice in the modern world. If it's 4k long then I guess they just needed lots of noise to hide the crux of it.

<comment><USER13> I do. If nothing else, I look for a binding arbitration opt-out, so I can engage that before whatever time period expires.

<comment><USER14> This reminds me of Pokemon Go forced arbitration opt-out clause that made the news and trended a while back.

"The Go terms do include an opt-out provision for people who don't want to give up their rights. However, you must opt out within 30 days of first agreeing to the Terms of Service.

Luckily, many Pokémon Go users have only downloaded and activated the app in the last week, meaning they are still within that timeframe.

To Opt Out: Send an email ASAP (before the 30 days have passed) to firstname.lastname@example.com with "Arbitration Opt-out Notice" in the subject line and a clear declaration that you are opting out of the arbitration clause in the Pokémon Go terms of service."

[https://consumerist.com/2016/07/14/pokemon-go-strips- users-o...](https://consumerist.com/2016/07/14/pokemon-go-strips-users-of- their-legal-rights-heres-how-to-opt-out/#more-10247511)

<comment><USER15> This is America in 2019, where even toy games on phones subvert your right to legal process...

</comment></comment></comment></comment><comment><USER16> The simple idea of presenting users with a text like this is madness. You know I won't read it, you know most people couldn't process or understand it if they tried, you want consent and agreements through a popup in the browser yet you know damn well that it is not an agreement at all.

To anyone who does this, who presents complicated privacy guidelines, EULAs in all-caps, insane cookie opt-out checkboxes, please have a hard look in the mirror. Think of a real-world analogy for the kind of roadblocks and contraptions you are building, how you are misleading and exposing your fellow humans. Thanks.

<comment><USER17> Isn't most of this because of legal reasons though? You can't really leave out a lot of the language without being more vulnerable in court.

<comment><USER18> There should be a summary of all legal policies tbh

</comment></comment></comment><comment><USER19> Yesterday, some editor at Google accidentally used "4,000" instead of 4K in their Prime/Chromecast presser, and now today whoever submitted this replaced 4,000 with 4K. Was that a subtle joke?

</comment><comment><USER20> On a somewhat related topic: Google changed gmail URL to mail.google.com from gmail.com. I think this is for easier tracking of users--it is easier to set cookies that are shared by all Google apps and sites.

</comment><comment><USER21> " _Google's Policy Google's policy on our_ "

Was that typo in Google's original 1999 privacy policy or is that just the New York Times sucking at copying and pasting?

<comment><USER22> It's a heading copied without formatting.

<comment><USER23> To clarify, it currently shows it like this:

> Google's Policy Google's policy on our wholly controlled and operated > Internet sites...

This is what it should look like formatted:

 _Google's Policy_

Google's policy on our wholly controlled and operated Internet sites...

</comment></comment></comment><comment><USER24> (recap)

1999 - we collect 4 things

2019 - we collect everything about you

<comment><USER25> This is very disingenuous. How about:

1999 - we do 1 service

2019 - we do 100s of services

</comment></comment><comment><USER26> I much prefer the retro resolution of 3 words "Do no evil", we're now up to 4k resolution of words, soon we will have 8k resolution of words.

Maybe there is some new moore's law in EULA and Privacy Policies as they keep getting larger and larger, when will we reach peak, as there are published books out there with less words.

<comment><USER27> Any company that has to tell itself not to be evil should be a red flag.

</comment></comment><comment><USER11> So, under GDPR and as EU citizen, can I get Google to erase all my data if I steer clear of their services? I would really love it if I could, though I'm afraid they would rather pay fines than remove my data.

<comment><USER28> I believe you can do this without being an EU citizen: [https://support.google.com/accounts/answer/7660719?hl=en&dar...](https://support.google.com/accounts/answer/7660719?hl=en&dark=1)

</comment></comment><comment><USER29> Whatboutism. They at least make a critical article about it and they're also a simple newspaper website, not the heart of the internet.

<comment><USER30> Canned arguments like "whataboutism" break the site guideline against shallow dismissals and also the one about calling names in arguments.

[https://hn.algolia.com/?query=by:dang%20whataboutism&sort=by...](https://hn.algolia.com/?query=by:dang%20whataboutism&sort=byDate&dateRange=all&type=comment&storyText=false&prefix=false&page=0)

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

We detached this subthread from [https://news.ycombinator.com/item?id=20404173](https://news.ycombinator.com/item?id=20404173) and marked it off-topic.

</comment></comment><comment><USER31> I'm really curious about the volume of tech-bashing opinion pieces that the NYTimes (and other corporate media outlets) publish on a daily basis. It's starting to rival the volume of Trump-bashing articles they used to publish at the peak of the US election cycle.

Do they have an entire department devoted to churning out this content? Are they hiring freelancers are paying them by the word/click? Do they also pay people to post them and upvote them on reddit/HN etc?

In the last day alone (from a search on HN): [https://www.nytimes.com/2019/07/09/opinion/email- tracking.ht...](https://www.nytimes.com/2019/07/09/opinion/email- tracking.html)

[https://www.nytimes.com/interactive/2019/07/10/opinion/googl...](https://www.nytimes.com/interactive/2019/07/10/opinion/google- privacy-policy.html)

[https://www.nytimes.com/2019/07/10/opinion/internet- democrac...](https://www.nytimes.com/2019/07/10/opinion/internet- democracy.html)

[https://www.nytimes.com/2019/07/09/books/review/the-code- mar...](https://www.nytimes.com/2019/07/09/books/review/the-code-margaret- omara.html)

Most of them are just rehashing the same "big tech bad. media is freedom" spiel.

<comment><USER32> NYTimes writes a lot of articles. The anti tech ones are highlighted here because that's what HN likes.

<comment><USER15> HN is far more cynical about tech in general than NYT is.</comment></comment></comment>


Jury Nullification - <AUTHOR> https://en.wikipedia.org/wiki/Jury_nullification <comment><USER2> Compulsory viewing on the topic: [https://www.youtube.com/watch?v=uqH_Y1TupoQ](https://www.youtube.com/watch?v=uqH_Y1TupoQ)</comment>


Why would Amazon want to sell a mobile phone? - <AUTHOR> http://blogs.hbr.org/2014/06/why-would-amazon-want-to-sell-a-mobile-phone/

<comment><USER2> Another thing that amazon can do with a phone is offer better service:

1\. It could deploy it's mayday service , to get you a customer support rep on your mobile , which will help you install that TV. Rep would also have access to the phone's camera , so he could "see" the problem.

2\. Amazon could develop an augmented reality app to make this process even more efficient and simple. Having 3D augmented reality might also make it simpler and more effective.

3\. Combine 1+2 to gain better cost efficiencies in support.

If this succeed, amazon could implement another step in it's mission of being a complete business infrastructure solution.</comment>


Artificial Intelligence is helping old video games look like new - <AUTHOR> https://www.theverge.com/2019/4/18/18311287/ai-upscaling-algorithms-video-games-mods-modding-esrgan-gigapixel <comment><USER2> Nice one, very cool.</comment>


Sorry, Paul. You're a smart guy, but my fortune cookie disagrees with you. - <AUTHOR> http://i11.tinypic.com/67ir2x5.jpg <comment><USER2> And don't forget that "Swim You-Yong" is an anagram for "Wing my You-Os". I think someone is trying to tell you something! ;)

</comment><comment><AUTHOR> <http://www.paulgraham.com/ideas.html>

"Actually, startup ideas are not million dollar ideas, and here's an experiment you can try to prove it: just try to sell one. Nothing evolves faster than markets. The fact that there's no market for startup ideas suggests there's no demand. Which means, in the narrow sense of the word, that startup ideas are worthless."

...I'm not sure whose advice to follow

<comment><USER3> Of course the fortune cookie writer is familiar with Paul's essays. The cookie means "sell" as in persuade others of their value, not as in exchange for money. There's no contradiction here.

<comment><AUTHOR> It's just a joke, bud. Have a laugh. I'm not implying that we should uproot PG's essays because of a fortune cookie. I just got it and thought of the essay.</comment></comment></comment>


A distributed, versioned, multi-dimensional array database [Clojure] - <AUTHOR> https://github.com/TheClimateCorporation/mandoline

<comment><AUTHOR> Previously known as Doc Brown. Here's presentation from this years Clojure West: [https://www.youtube.com/watch?v=ps_HwCvAcfk&index=23&list=PL...](https://www.youtube.com/watch?v=ps_HwCvAcfk&index=23&list=PLZdCLR02grLp__wRg5OTavVj4wefg69hM)

Recently open sourced.</comment>


CoTweet acquired by ExactTarget - <AUTHOR> http://blog.cotweet.com/2010/03/cotweet-connects-with-exacttarget/ <comment><USER2> Good grief. ExactTarget's website is off-putting - they appear to be one of those "I can't quite work out what it is that you do" companies, complete with a 10 page signup form just to see a demo of their product, and various "whitepapers".

<comment><USER3> I've worked with ExactTarget quite a bit. And the experience, sad to say, would not make me want to try CoTweet.

<comment><USER4> Can you expound upon what it is that you did not like in working with ExactTarget? I would love to balance out what I hear from recruiters with some negatives. Thanks

<comment><USER5> We use them where I work, a mid-size arts and media non-profit in Brooklyn. Their services are very nice and unique. That's the end of the good news.

They charge for EVERYTHING. Need more attribute fields for your users? That'll be $500 for 5 per year. Need access to the API? That'll be $2000/year. And on and on. Their UI is atrocious and unwieldy. And their documentation is 10x as long as it needs to be and impossible to ever find what you need. That said, their phone support is good.

If you're excited about the text message marketing capabilities and integration with social sites, and you're willing to pay for it, it's probably a good solution. If you just want to send out nice HTML emails and track the results, go with MailChimp.

</comment></comment></comment></comment><comment><AUTHOR> Cotweet never charged their customers. This is a big missed opportunity for the twitter ecosystem. I might be mistaken, but have we seen a startup with venture backing turn a profit on twitter? Even the iphone apps?

<comment><USER6> CoTweet does have a paid program: [http://blog.cotweet.com/2009/11/introducing-the-cotweet- ente...](http://blog.cotweet.com/2009/11/introducing-the-cotweet-enterprise- innovators-program/)

<comment><AUTHOR> Ohh, I missed that. I wonder if it was going well.

"Enterprise Innovators Program" is cringe worthy, but I guess they are selling to the enterprise. I'm amazed people have the stomach to go after that market.

</comment></comment></comment><comment><USER7> IIRC, the leaked Twitter documents mused on Twitter acquiring CoTweet.

Would have been a great fit. IMHO, Twitter's business model should be CoTweet.

<comment><USER8> Nope.

Twitter's business model should be to tend to the platform and create the eco- system around it that creates value for both the 3rd parties AND twitter.

If twitter acquires a participant in the ecosystem, that vertical is essentially locked up because how can a third party compete directly with twitter? Search is the obvious example because it has happened (Summize).

While it is true Twitter is creating accounts for business, they are not going to be offering the kind of functionality CoTweet and others offer.

</comment></comment><comment><USER9> cotweet.com has been down all day as far as I can tell. I hope it comes back soon.</comment>


The New Generation of Prototyping Tools (Part 1/2) - <AUTHOR> https://medium.com/@kunalslab/the-new-generation-of-prototyping-tools-part-1-2-c01105310b6b

<comment><AUTHOR> I've always viewed prototyping tools as a means to an end. Whether I'm building a "looks like" or "works like" prototype, I want to be quick and invest as little time as possible to achieve my goal. In the article, I've focused on a few tools that help me prototype responsive behavior, show transitions and animations, and translate designs for developers.

Would be happy to answer any questions about the article here on Hacker News.

I'm currently working on Part 2 of the article and would love to hear your thoughts. What do you do to take a design concept and make it easier to build?</comment>


Firecracker – Lightweight Virtualization for Serverless Computing - <AUTHOR> https://aws.amazon.com/blogs/aws/firecracker-lightweight-virtualization-for-serverless-computing/ <comment><USER3> What this is allows, and I'm hoping a full fledged service will be announced on Thursday or Friday, is running containers as Lambdas. i.e. if you application starts fast enough, you can just set a container to start and run as a request comes in. It can also shut down when it's done running.

This allows things like per second billing for container runs, serverless containers (there's no container running 24/7, only when there's traffic), etc.

<comment><USER4> > containers as Lambdas.

How similar is AWS Fargate to what you're describing?

<comment><USER3> I need to run 1+ Fargate containers 24/7, which is useless and wasteful.

With Fargate-Lambda crossover I wouldn't be running anything 24/7, and it would be a lot less resource intensive than one Lambda-Container per request as well.

Google's App Engine gets / got this right when they first launched, but to make it work they had to demand apps be written for their sandbox (like AWS Lambda), because of which the model isn't as general purpose. Firecracker would allow regular containers to be used this way, making a Firecracker service the first service to allow general purpose servers to be started and stopped (all the way to zero) based on incoming traffic.

<comment><USER5> I think with the App Engine Standard generation 2 runtimes you don't have to write to their sandbox anymore. It still has to be one of their supported languages though, instead of any arbitrary server.

[https://cloud.google.com/blog/products/gcp/introducing- app-e...](https://cloud.google.com/blog/products/gcp/introducing-app-engine- second-generation-runtimes-and-python-3-7)

<comment><USER6> Serverless Container support is coming to GCP: [https://services.google.com/fb/forms/serverlesscontainers/](https://services.google.com/fb/forms/serverlesscontainers/)

</comment></comment></comment></comment></comment><comment><USER7> There's a Github Pages FAQ describing why it was made and how it fits with other solutions: [https://firecracker-microvm.github.io/](https://firecracker- microvm.github.io/)

and a high-level design document about how it works [https://github.com/firecracker- microvm/firecracker/blob/mast...](https://github.com/firecracker- microvm/firecracker/blob/master/docs/design.md)

<comment><USER8> Interesting name choice. When I clicked on the link and saw the name and design, my first thought was, "Is this a Firebase knockoff...?" [1] ... and then I scrolled to the bottom to see the copyright and saw this project is by Amazon Web Services.

[1] [https://firebase.google.com](https://firebase.google.com)

</comment></comment><comment><USER9> > Firecracker was built in a minimalist fashion. We started with crosvm and > set up a minimal device model in order to reduce overhead and to enable > secure multi-tenancy. Firecracker is written in Rust, a modern programming > language that guarantees thread safety and prevents many types of buffer > overrun errors that can lead to security vulnerabilities.

This is awesome! Really excited to try this out!

</comment><comment><USER10> This is huge! It basically removes the VM as the security boundary for something like Fargate [1]. This should lead to a significant reduction in pricing since Fargate will no longer need to over provision in the background because VMs were being used even for tiny Fargate launch types.

It should hopefully eliminate the cost disparity between using Fargate vs running your own instances. Should also mean much faster scale out since you containers don't need to wait on an entire VM to boot!

Will be interesting to see what kind of collaboration they get on the project. This is a big test of AWS stewardship of an open source project. It seems to be competing directly with Kata Containers [2] so it will be interesting to see which solution is deemed technically superior.

[1] [https://aws.amazon.com/fargate/](https://aws.amazon.com/fargate/) [2] [https://katacontainers.io/](https://katacontainers.io/)

<comment><USER11> Indeed, this seems very similar to kata+runv+kvmtool(lkvm). I'm curious why they don't provide a comparison. Here's what I gathered:

\- it seems to boot faster (how ?)

\- it does not provide a pluggable container runtime (yet)

\- a single tool/binary does both the VMM and the API server, in a single language.

Can anyone else chime in ?

<comment><USER12> > I'm curious why they don't provide a comparison

They do, if you read the FAQs: [https://firecracker- microvm.github.io/#faq](https://firecracker-microvm.github.io/#faq)

<comment><USER11> I did, and it does not answer my question, because they only address the runv+qemu usecase, not the runv+kvmtool one:

 _Kata Containers is an OCI-compliant container runtime that executes containers within QEMU based virtual machines_

</comment></comment></comment></comment><comment><USER13> Clear containers (now called kata containers) did this more than three years ago, with similar performance numbers (sub 200 ms boot times). It is frustrating, but not surprising, to see the same regurgitated solution receive this much excitement. The firecracker documentation also does not mention the similarity with prior work, oh well.

[Not affiliated with Intel in any way---just a long-time proponent of the clear containers approach.]

<comment><USER10> The FAQs on the Firecracker website[1] specifically address the difference between Firecracker and Kata Containers. The main thrust being that they have decided not to use QEMU and have instead chosen a much more minimal "cloud- native" oriented approach that deliberately abandons certain features in order to gain greater security, efficiency and agility going forward. They also decided to implement it in Rust.

Based on the the responses I have seen from non-Amazon employees with experience in this space[2][3][4], it looks like their approach is solid.

It should also be noted that one of the main architects of Firecracker was formerly the project lead for QEMU[5][6]

1.[https://firecracker-microvm.github.io/#faq](https://firecracker- microvm.github.io/#faq)

2.[https://twitter.com/bcantrill/status/1067326416121868288](https://twitter.com/bcantrill/status/1067326416121868288)

3.[https://twitter.com/jessfraz/status/1067286831287418881](https://twitter.com/jessfraz/status/1067286831287418881)

4.[https://twitter.com/kelseyhightower/status/10672947809488322...](https://twitter.com/kelseyhightower/status/1067294780948832258)

5.[https://twitter.com/jessfraz/status/1067282499938721792](https://twitter.com/jessfraz/status/1067282499938721792)

6.[https://twitter.com/anliguori/status/1067293131366785024](https://twitter.com/anliguori/status/1067293131366785024)

<comment><USER13> OK I had missed the kata containers blurb in the FAQ, thanks for pointing it out. In fact the tweets make my point: we are all so blinded by new shiny releases that we forget their highly incremental nature.

<comment><USER14> Sure, there are going to be some people that are excited by the fact that something seems new or just because it is written in Rust, but jessfraz and bcantrill certainly don't fall into those categories. They have a lot of experience with Operating Systems, VMs and containerization and I don't get the impression that they are eaisily impressed by shiny things. Note that they all work for or worked for AWS competitors (Google/MS/Joyent).

I think what is impressive about Firecracker is that they have chosen to reuse a lot of the right things (Linux/KVM/Rust) while also taking a new approach and rethinking important assumptions (No BIOS, no pass-thru, no legacy support, minimal device support).

In my opinion the Firecracker FAQs give sufficient mention to parallel projects and tools they have built on like Kata Containers, QEMU and crosvm. The developers certainly seem open to collaboration with those communities.

AWS doesn't have much of a track record in terms of leading an Open Source projects so some skepticism is understandable, but I think what we have seen so far is a very good start.

<comment><USER15> These days, I would expect bcantrill to be excited by something written in Rust :)

<comment><USER16> Hey now -- I'm not quite _that_ easily impressed! ;) This is a problem domain that I have suffered in[1] -- and we have recently moved from KVM to bhyve[2] for several of the same reasons that motivated Firecracker. Not that it hurt that it was in Rust, of course... ;)

[1] [https://www.youtube.com/watch?v=cwAfJywzk8o](https://www.youtube.com/watch?v=cwAfJywzk8o)

[2] [http://bhyvecon.org/bhyvecon2018-Gwydir.pdf](http://bhyvecon.org/bhyvecon2018-Gwydir.pdf)

<comment><USER15> Ha! I wasn't trying to imply that it would _only_ take Rust, for sure. :)

I am excited that everyone seems very excited.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> > microVMs, which provide enhanced security and workload isolation over > traditional VMs, while enabling the speed and resource efficiency of > containers.

Reminds me of rkt + kvm stage 1 [https://github.com/rkt/rkt/blob/master/Documentation/running...](https://github.com/rkt/rkt/blob/master/Documentation/running- kvm-stage1.md)

Too bad it didn't take off.

</comment><comment><USER18> This looks great, I'm just wondering what Amazon's motivation for open sourcing it is. It seems like some pretty critical secret sauce for making services like Lambda and Fargate both secure and efficient.

<comment><USER5> Google recently open-sourced Gvisor, which although implemented differently solves a similar problem. Possibly Amazon wants to encourage other vendors to build integrations with Firecracker rather than Gvisor.

[https://cloud.google.com/blog/products/gcp/open-sourcing- gvi...](https://cloud.google.com/blog/products/gcp/open-sourcing-gvisor-a- sandboxed-container-runtime)

<comment><USER19> Also cloudflare announced workers using isolates.

</comment></comment></comment><comment><USER20> My big question is: is this something only exciting for people doing lambda at massive scale?

Qemu is exciting technology and has paved the way for all kinds of interesting layers. So, creating a slimmed down improvement that really makes it faster and provides a new lambda-ish execution context is great.

I'm sure Amazon cares about that. I'm sure people doing millions of lambda calls a day care about that.

But, if I'm an entrepreneur thinking about building something entirely new, is there something I'm missing about this that would make me want to consider it?

Lambda and Firebase Functions are exciting partially because they break services into easy to deploy chunks. And, perhaps more importantly, easy things to reason about.

But that's not the big deal: the integration with storage, events, and everything else in AWS (or Firebase) is what really makes it shine. It's all about the integration.

When I read this documentation, I'm left wondering whether I want to write something that uses the REST API to manage thousands of micro vms. That seems like extra work that Amazon should do, not me.

Am I missing something important here? Surely Amazon will integrate this solution somewhat soon and connect it to all the fun pieces of AWS, but the fact that they didn't consider or mention it makes me think it is something I should not consider now.

</comment><comment><USER21> I really hope this helps with the cold start times on Lambda. We were currently looking heavily into moving our API from Lambda to EKS, but if this impacts cold start times, I think we will look at how it ends up looking like in practice.

<comment><USER3> Most code start time problems on Lambda I've seen are VPC related - <USER2> network Lambdas start in milliseconds, with the main lag being the userspace code startup time.

Starting a Lambda inside a VPC involves attaching a high security network adapter individually to each running process, which is likely what takes so long. I assume AWS is working on that, though, they've claimed some speedups unofficially.

If your security model allows, try running your Lambdas off-VPC.

<comment><USER21> The VPC startup times are insane, so we quickly move our lambdas out of that, accepting the trade off.

Our normal cold starts are in the 1-2 second range, and the app initialization comes after. Too high for an API facing users :/

<comment><USER22> We got around this with a bit of a hack - use a CloudWatch event to trigger a dummy invocation of your function every five minutes. This keeps the container "hot" and reduces the start time (and is negligible cost-wise). This won't fix the cold starts when the function scales up, but it does reduce latency for 99% of our API requests.

<comment><USER23> Isn't using a server better in this case? Or Lambda have some benefits in this setup?

<comment><USER22> It's still insanely cheap. You could have millions of executions per month and only pay $0.50. But if you needed to, it could scale up to billions of invocation nearly instantly, something a standard server would have trouble doing as easily as Lambda does.

<comment><USER24> Then again, you are doing the hacks you describe because it is _not_ scaling up nearly instantly. The cold start delays are not only an issue when scaling from zero to one, they hit you whenever you scale the capacity up.

<comment><USER25> This. I continue to hear about hacks of people running ping to keep a single instance warm. But that doesn't cover periodic changes in capacity needs nor spikes. I would think to avoid cold starts all together you'd need a pinger that sent exactly the load difference between peak load and current load. I would love to hear if anyone is keeping Lambdas warm at more than n=1 capacity.

<comment><USER21> >if anyone is keeping Lambdas warm at more than n=1 capacity

There are various ways to do it, but I feel that it's a very suboptimal solution, and it still won't guarentee no cold starts happen.

I've personally come to the conclusion, that lambda is very nice for anything non-latency sensitive. We are still using it to great effect for e.g. processing incoming IoT data samples, which can vary quite a lot, but only happens in the backend, and nobody will care if it's 1-2 seconds delayed.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> The crosvm and Rust have me intrigued. I was hoping for something like this since I saw the first hints of Rust showing up in ChromeOS in crosvm.

A compare/contrast with Kata Containers would also be interesting. Their architectures look similar. (Kata Containers [1] being another solution for running containers in KVM-isolated VMs, that has working integrations with Kubernetes and containerd already. Not affiliated, but I'm tinkering with it in a current project, though I'm also now keen to get `firecracker` working as well.)

Obviously, if nothing else, qemu vs crosvm is a big difference, and probably significant since my understanding is that Google chose to also eschew using qemu for Google Cloud.

[1]: [https://katacontainers.io/](https://katacontainers.io/)

<comment><USER27> Kata Containers is a lot of infrastructure for running containers and it uses QEMU to run the actual VMs. Firecracker just replaces the QEMU part and we're eager to work with folks like the Kata community.

I love QEMU, it's an amazing project, but it does a ton and it's very oriented towards running disk images and full operating systems. We wanted to explore something really focused on serverless. So far, I'm really happy with the results and I hope others find it interesting too.

<comment><USER28> We felt the same way about QEMU before we started crosvm. Glad to see you all found some use out of it.

</comment></comment></comment><comment><USER29> It's QEMU without all the legacy stuff, they also open sourced it, interesting.

<comment><USER30> QEMU can do much more than this.

<comment><USER31> Which is exactly the problem.

</comment></comment></comment><comment><USER32> More discussion here: [https://news.ycombinator.com/item?id=18539532](https://news.ycombinator.com/item?id=18539532)

</comment><comment><USER3> @zackbloom, @kentonv hint hint. Isn't this roughly the same memory footprint as a Worker? CONTAINERS ON ALL THE CLOUDFLARE THINGS!

<comment><USER33> Heh. Truthfully, what I'm most excited about right now is being able to start a worker in less time than it takes to make an internet request. When you can do that you get magical autoscaling and it becomes just as cheap to run it in hundreds of places as one. As long has you have to invest ~100ms of CPU to get one of these VMs running I'm not sure it will have quite the same economics.

<comment><USER3> Yeah, jokes aside I simply don't think it makes sense to run full processes on the edge. Not yet, anyway.

Script isolates makes a lot of sense with current hardware limitations, but full processes at the edge are coming sooner or later.

<comment><USER33> That would make me a little sad. I'm not excited about the idea that we figured out the ideal way for a program to be encapsulated in 1965 and it will never change.

</comment></comment></comment></comment><comment><USER34> I'm very excited to play with this technology in the same way I love playing with Elixir/Erlang and userland concurrency models. I also love the _idea_ of docker (and use it daily) but dislike the ergonomics. My first thought is, particularly with the emphasis on oversubscription, how does the kernel of the host schedule work?

</comment><comment><USER35> still seems much slower than the model used by Cloudflare for what they call "workers."[1] A recent blog post a few weeks back was the subject of considerable discussion here[2], and it seems to me to be doing much the same thing as Firecracker, but still faster because there's less overhead. But maybe I'm missing something.

[1] [https://blog.cloudflare.com/cloud-computing-without- containe...](https://blog.cloudflare.com/cloud-computing-without-containers/)

[2] [https://news.ycombinator.com/item?id=18415708](https://news.ycombinator.com/item?id=18415708)

<comment><USER18> > But maybe I'm missing something.

From the "Disadvantages" section of your first link:

"No technology is magical, every transition comes with disadvantages. An Isolate-based system can't run arbitrary compiled code. Process-level isolation allows your Lambda to spin up any binary it might need. In an Isolate universe you have to either write your code in Javascript (we use a lot of TypeScript), or a language which targets WebAssembly like Go or Rust."

"If you can't recompile your processes, you can't run them in an Isolate. This might mean Isolate-based Serverless is only for newer, more modern, applications in the immediate future. It also might mean legacy applications get only their most latency-sensitive components moved into an Isolate initially. The community may also find new and better ways to transpile existing applications into WebAssembly, rendering the issue moot."

</comment></comment><comment><USER36> "Process Jail – The Firecracker process is jailed using cgroups and seccomp BPF, and has access to a small, tightly controlled list of system calls."

So basically, a gVisor alternative?

<comment><USER37> gVisor doesn't use KVM:

"Machine-level virtualization, such as KVM and Xen, exposes virtualized hardware to a guest kernel via a Virtual Machine Monitor (VMM). This virtualized hardware is generally enlightened (paravirtualized) and additional mechanisms can be used to improve the visibility between the guest and host (e.g. balloon drivers, paravirtualized spinlocks). Running containers in distinct virtual machines can provide great isolation, compatibility and performance (though nested virtualization may bring challenges in this area), but for containers it often requires additional proxies and agents, and may require a larger resource footprint and slower start-up times."

<comment><USER36> Yeah but one of the main ways in which gVisor provides security is by intercepting system calls and strictly limiting which calls can be made. Firecracker may use KVM instead of running entirely in usermode, but as far as most of us are concerned, that's an implementation detail. The pertinent question is whether the price of security is limiting the possible system calls, which means that Firecracker won't be able to run arbitrary containers, just as gVisor doesn't guarantee that it can run arbitrary code (which may require filtered system calls).

<comment><USER37> That's not true. Your guest application has access to all Linux system calls in the guest VM.

You can see here the security model: [https://github.com/firecracker- microvm/firecracker/blob/mast...](https://github.com/firecracker- microvm/firecracker/blob/master/docs/design.md)

The firecracker process itself is limited in the system calls it can make, but kvm allows the guest Linux process the ability to expose a full set of system calls to end user applications.

</comment></comment></comment></comment><comment><USER38> Does this provide any multi host cluster management capabilities?

</comment><comment><USER39> Does it support Windows?

<comment><USER40> KVM-based, so no it doesn't.

<comment><USER41> KVM supports Windows just fine, which is why you can run Windows on GCP and Openstack. And Firecracker seems to support enough of a machine to boot Windows as long as the windows instance has support for libvirt disk devices and a libvirt NIC.

However, it seems they boot in a slightly unconventional way. They take a elf64 binary and execute it. This works for Linux and likely some other operating systems that can produce elf64 binaries. Windows supports legacy x86 boot and UEFI, but likely not elf64 "direct boot".

So if you can get windows into an elf64 binary and have it run without a GPU you could have it boot. So, likely not. But the reason isn't due to KVM.

</comment></comment></comment><comment><USER42> Can someone explain me how does this work? Is it an orchestration service for containers like Kubernetes or is it any different?

</comment><comment><USER43> I am extremely excited by this. i wonder if this can be used to provision jit kubernetes workers.

</comment><comment><USER39> How does this compare to containers?

<comment><USER41> Containers share the OS kernel and some services. This is a virtual machine monitor, so it deals with virtual machines. A container can only run Linux containers.

Firecracker can likely run other operating systems, such as IncludeOS. You can't run those in containers.</comment></comment>


An AI to help language learners? - <AUTHOR> http://www.heyelena.com/?utm_source=ycom&utm_medium=hackernews&utm_term=hackernews&utm_content=hackernews&utm_campaign=hackernews <comment><AUTHOR> Hi guys, I am working on an AI with friends to help language learners practice conversations, we are calling it Elena. What do you think of it? Any possible features you want to see? check out the demo in the link posted and sign up if you want to download the ios app when it's ready. Thanks guys!</comment>


3 months and 1M SSH attempts later - <AUTHOR> https://livesshattack.net/blog/2016-03-20/3-months-and-1-million-ssh-attempts-later <comment><USER2> > "Hahahahahaha, a successful login"

Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law.

This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.

<comment><USER3> >Congratulations, you just violated the computer fraud and abuse act. How can that be illegal?

Granted publishing it should be, but simply testing if someone has left the default password?

<comment><USER4> CFAA is very broad. "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— C) information from any protected computer;"

A court could see "ambiate was authorized to use the work printer for printing -- ambiate hacked the printer to find out the fax machine number and sent a fax" in an absurd world.

This random internet person was never authorized to access this public router. Even if its set to a default username/password. That's the broadness the CFAA.

Just because you set your password to 'password99', doesn't mean you get more protections than the person who leaves their Cisco router set to 'cisco'.

<comment><USER3> Thanks for the info. Interesting, I can see the merit in having broad legal protection to stop people from malicious activity. But that does seem a little too broad.

</comment></comment></comment></comment><comment><USER5> > He's still going at it 100,000 ssh attempts later.

I got hit with >100,000 on my main desktop a few years ago when I was procrastinating fixing my heavy-handed fail2ban config. I noticed what was happening first from the _lag_ it was causing. It turns out >10 SSH password attempts/second can eat up a significant portion of my 3GHz "Yorkfield"[1] CPU. It wasn't hard to discover the problem: the logfile was rapidly filling with failed SSH password attempts. This is particularly useless as I have used

        PasswordAuthentication no

for many years. There is no chance that the script was going to gain access, but the system load from the rejections was terrible. So yes, I fixed fail2ban and added a few more "instant-ban" rules against anybody that tries password authentication, but the real fix that was moving sshd to a random port. Invalid SSH connection attempts dropped to approximately zero immediately. It's trivial to find with a port scan, but in practice almost nobody has even bothered.

It's probably like the old joke where two hiker see a grizzly bear and one stops to re-tie his shoes. "You can't outrun a grizzly!" "I only have to outrun _you_."

[1] Q9650 (E0); it still works great, even if it's starting to show its age

<comment><USER6> Out of curiosity, why is your desktop exposed directly to the internet (no NAT/firewall) at all?

<comment><USER5> NAT doesn't provide security, and a ssh server isn't useful if you filter that port at the firewall.

<comment><USER7> Masquerading private address with you GW public address and limit connection to outhoing one when ingress filtering is correctly done on your firewall/ISP side is quite efficient.

Using private address is just a convenient way to set up easy invariant templates for FW rules. No more, no less.

If you add the fact that ISP used to not route RFC 1918, it used to work quite efficiently.

<comment><USER5> That "convenient way" has been incredibly damaging to the internet. The primary benefit of the internet was that every peer can publish without needing permission of a 3rd party. IP Masquerading / NAT removes that ability, and has cause a massive amount of centralization. These gatekeepers are necessary to workaround the limitations of every host having to share a _party line_. Regular use of RFC 1918 for most hosts has prevented the development of real network software.

If you want the internet to continue to degrade into something closer to cable TV, then continue requiring central gatekeepers. If, instead, you care about the future of the internet, then _please_ use globally routable addresses instead of the _imprimatur_ we call NAT.

<comment><USER7> one of the benefit of NATing that it is mentally easier to recongize inbound and outbound traffic in firewall rules.

It has been used as a way to centralize traffic by some rogue ISP, and then because Large Scale Nating involve to hold in memory a lot of state considered bad practices because it was costing money to ISPs. (plus FW redondancy/HA in NAT require to synchronize states with CARP or CISCO techs).

But NATing behind the POP of the customer behind a public IP with the classical 3 ways filtering (corporate net, DMZ, internet) still enables templates to be easily shared and understood.

It is not NAT that sux. It is incompetent sysadmins the problem.

<comment><USER5> > NATing that it is mentally easier

"Because it's easier" is a terrible reason to break the internet and limit the development of networking software such that proper direct-connections (in either peer-or-peer _or_ client-server style) are useless and a centralized 3rd party is required to negotiate the connection and/or manage the NAT hole- punching.

You're talking about convenience for a specific set of tools, when the problem is about _freedom_ to publish without middlemen.

> a way to centralize traffic by some rogue ISP

ISPs have little[1] to do with this. I'm not talking about centralization by the ISPs; I'm talking about how network software such as VOIP _should_ be making direct connections once the address is known, which is impossible due to NAT. Instead, we have Skype with Microsoft in a _de facto_ position of control over a lot of the "voice chat" ecosystem.

> enables templates to be easily shared and understood

I'm sure the file-format for those templates can be extended to support a placeholder/variable/macro for local addresses.

> NATing behind the POP of the customer

That's my entire point. This is how the internet was turned into a "two tier" system, where some hosts can use listen(2)/accept(2) usefully, but everyone else has to ask permission of the incumbent feudal lord for permission if they want to accept a connection.

You seem to prefer trading that ability for an internet that resembles the "cable tv" model instead of a network of equal peers (in the protocol). I hope having convenient firewall templates was worth it.

[1] other than dragging their feet on IPv6 for the last ~15 years, which removes the need for any type fo NAT

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> Its interesting how many HN users seem to be missing the point of a honeypot. He set this up deliberately to understand the frequency/types of attacks on a random machine on the internet.

From my past experience, most of those CN computers are actually US zero day'd/patched running root kits/worms. It just happens to be that CN computers are more likely to be unpatched/running ancient software.

<comment><USER8> >From my past experience

I'm curious how you know this for sure.

<comment><USER4> I plead the fifth. CFAA/RICO/Patriot Act.

My hint would be: before decentralized worms, there were IRC hubs. The 'owners' would typically use their native language for the various commands (I know English is used in more than the US, but..). Most of the time, they wouldn't even hide their host name on the IRC server.

I guess from a 'being legal' POV: anyone could infect themselves with the same root kit that's on a honeypot and find out quite a bit about the organizers.

<comment><USER2> Or just read any botnet takedown report, this is exactly what botnets do. Why bother looking for 0day when root:toor or cisco:cisco works?

</comment></comment></comment></comment><comment><USER9> Just FYI, I wouldn't log into any systems using credentials you find through this. A lot of people are obviously using credentials stolen from previous dumps, so there might be valid ones in there. Logging into a public facing router using stolen credentials is definitely a crime.

<comment><AUTHOR> Just like it's a crime trying to ssh into a box that is not yours right? And besides I didn't do anything to the router. I was simply pointing out that you should change your default credentials and hide your router.

... should be a crime to not change the default credentials.

<comment><USER10> Did you attempt to notify that poor schmuck who stood up that AirRouter with the default username and password?

<comment><AUTHOR> Damn it. I should of. I don't know how I would do that now though. He probably got pwned of the internet by now. lol.

<comment><USER11> Dude, it's not funny. You're coming across like a script kiddie and it's not welcome here. You've just posted the credentials to someone's site that has probably been compromised and you're treating it like a joke. Go back and redact the IP addresses of those sites & devices before you get yourself into trouble.

<comment><AUTHOR> Look. Malicious boxes are attacking me. Although I must be politically correct in this situation to probably please everyone, while I probably shouldn't have logged into the router in question, I would prefer to publish such IPs because they have the potential to harm other machines.

Actually that particular IP attacked me more than 170 times. It may be useful to others to keep this address on their "naughty" list of hosts to ban.

<comment><USER12> I don't think there's a need to publish those addresses. There are already lists with those IPs available ([https://www.openbl.org/](https://www.openbl.org/)). Telling people that the IP had default password on the router will only cause the problem to the owner who may not even be aware of the attack. Proxies / worms for ssh scanning are very common, so maybe you just helped people break some Joe Random's home network.

<comment><USER10> > I don't think there's a need to publish those addresses. There are already > lists with those IPs available...

Interestingly, the IP address of that router is _not_ present in either the base (attacks within the past 360 days) list or the delisted (manually removed from the base list by the person in question) list.

It's almost like no single list is terribly likely to be complete, and that publishing collation of a master list is required for completeness. :)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Just for fun I ran an SSH server on a RasPi to basically allow any login and to simulate a Linux shell. And then captured the various things that people tried. If you're wondering what the "standard set" of script kiddy tricks are, I highly recommend it.

<comment><USER4> 15 years ago, that standard set used to be wget something from packetstormsecurity.org. If no wget: curl it. If no curl: just lynx it. else: move on to the next vulnerable server. Script kiddies were quite lazy back then. I feel old at thirty.

<comment><USER14> Hasn't changed for the most part. Though it's either exploit db, some creepy looking .pw site you've never heard of, and once or twice, the zips that github provides. And sometimes they'll just scp their stuff onto the box.

</comment></comment></comment><comment><USER15> If you haven't already, get fail2ban setup on the box to slow down all the attacks. And disable password login and switch to certs instead.

<comment><USER16> SSH key based auth does not use certificates.

In the case of key-based-auth only, fail2ban is pointless.

<comment><USER17> I disagree. I run it because I drop all traffic from the /24 the scan comes from. Harsh, yes, but tough luck. It cuts down on unwanted network traffic.

<comment><USER16> That's a pretty significant denial of service you open yourself up to. If someone shows up bruteforcing you from randomly allocated AWS or Digital Ocean cloud instance public IPs that happen to land in the same /24 as other AWS- or DO-hosted services (Heroku comes to mind, but also any other monitoring, log aggregation, analytics, data processing, et c) your machine depends on, they've convinced your system to cut connectivity to them. Not the best setup...

</comment></comment></comment></comment><comment><USER18> I changed my SSH login banner text to

> Permission denied, please try again.

To confuse people. No matter failed or successful login, the prompt text will always be like that.

<comment><USER2> You deny them permission, then grant them permission to try again?

<comment><USER18> No matter failed or successful login, the prompt text will always be

> Permission denied, please try again

</comment></comment></comment><comment><USER19> I think more cloud providers should do something like what Google Compute Cloud does, they have SSHGuard on their images by default so IPs get blocked after too many failed attempts.

</comment><comment><USER20> Showing off stuff like this is considered stupid, childish and idiotic. Based on the cache version of his publication, I am extremely tempted to report this to the proper authority. Not only you should stop publishing this kind of information, you should stop your project.

<comment><USER10> > Showing off stuff like this is considered stupid, childish and idiotic. ... > Not only you should stop publishing this kind of information, you should > stop your project.

I strongly disagree with both sentences.

</comment></comment><comment><USER21> Change the SSH port...

<comment><USER22> Please don't rely on that alone: [https://blog.shodan.io/hiding-in-plain- sight/](https://blog.shodan.io/hiding-in-plain-sight/)

<comment><USER23> strangely, searching Shodan for product:ssh port:443 finds nothing - when I know there are boxes around running sslh or similar to run both SSH and HTTPS on the same port. Seems like you can hide in plain sight when the scanner has no idea you're there.

<comment><USER22> [https://www.shodan.io/search?query=port%3A80+openssh](https://www.shodan.io/search?query=port%3A80+openssh)

It's really just a matter of time. There are many things you can do to protect yourself and changing the port is one of them, but if you rely on it you're going to have a bad time.</comment></comment></comment></comment>


Announcing MulletDB (Formerly NoNoSQL) - <AUTHOR> http://sheddingbikes.com/posts/1274762986.html <comment><USER2> I don't really understand why I would want to use this. Why wouldn't I just use SQLite3, if that's what's powering the SQL searches? (maybe with a pretty layer on top for external access.)

The KV/document stores that have been coming out are trying to address shortcomings, perceived or real, with RDBMSs. I think some explanation of the trade-offs which each part of the "mullet" make and how they would be obviated by this system would be helpful. Right now there are a ton of KV/Document stores as well as SQL databases, and I don't know how this is going to be different or why I should pay attention to this project.

<comment><USER3> * DB for persistence, kv for speed and disk for scaling(?). Different parts of your app might fit one of these cases. Why not have them all under one API?

* Use protocols to scale, not backends

* Single interface to talk to db/kv store and disk

* In addition, use an SQL-like interface, if that's what floats your boat.

* Moving data between db/kv/disk is a server side operation.

<comment><USER4> Exactly. I'm glad someone's paying attention.

Additionally, it's mostly a project I started on a dare that I started liking to hack on. Not really expecting anyone to use it for a while, if ever.

</comment></comment></comment><comment><USER5> So... does this mean that the MulletDB slogan will be "business on the frontend, party on the backend?"

<comment><USER6> I would hope it would be the other way around :)

</comment></comment><comment><USER7> So... what are the real impacts on a commercial website that uses AGPLed code?

<comment><USER8> I am not a lawyer.

If Zed does indeed release a Python driver under the MIT license, and you use that, it's essentially no different than using the LGPL in an end-user distributed app. You'd have to make any of your changes to MulletDB available to your end users, but your proprietary code could remain closed.

MongoDB takes this approach, and has written more at <http://www.mongodb.org/display/DOCS/Licensing>

<comment><USER4> Actually, I figured if it's AGPL then basically everything has to be AGPL. We'll see how that goes.

<comment><USER7> Do you (or anyone, really) know of a place with a decent definition of how AGPL code needs to be treated?

I'm not clear about what the line is that says "everything from this point must have its source released" versus "all this stuff is OK to license as you please"

</comment></comment></comment></comment><comment><USER9> Valley Mullet FTW!!</comment>


Diseases like Covid-19 are deadlier in non-democracies - <AUTHOR> https://www.economist.com/graphic-detail/2020/02/18/diseases-like-covid-19-are-deadlier-in-non-democracies <comment><AUTHOR> _An analysis by The Economist finds that democracies—defined here as countries with free and fair elections—tend to be better than other forms of government at containing and treating outbreaks of disease. This holds true for rich and poor countries alike.

Using data from the International Disaster Database, maintained by researchers at the Catholic University of Louvain in Belgium, we analysed all recorded epidemics since 1960, from an outbreak of smallpox in Nepal in 1963 to more recent threats such as Zika and Ebola. The results were highly dispersed but a distinct trend was apparent: for any given level of income, democracies appear to experience lower mortality rates for epidemic diseases than their non- democratic counterparts (see chart). In authoritarian countries with China's level of income, for example, we found that past epidemics have killed about six people per 1m population. In democracies with similar incomes, they have killed just four per 1m.

The difference between democracies and non-democracies is statistically highly significant. The relationship also appears to be robust: it holds when considering only large epidemics (more than 50 deaths), or only epidemics affecting populations in the same geographical region. It also holds when controlling for the year or decade in which the epidemics occurred.

It may seem surprising that democracies, with their notoriously messy bottom- up processes, outperform their authoritarian alternatives on this measure. Urgent health concerns demand urgent action, something not normally associated with deliberative democracy. In Norway, one of the most democratic countries in the world, lawmakers have been debating the location of a new 200-bed hospital for seven years. In China, a new 1,000-bed hospital to treat coronavirus patients was recently built in just ten days.

But authoritarian regimes, although able to co-ordinate massive construction projects, may be poorly suited to matters that require the free flow of information and open dialogue between citizens and rulers. During an outbreak, for example, constructive feedback about how government policies are working can help guide a more dynamic response. Non-democratic societies often restrict the flow of information and persecute perceived critics._</comment>


The brain is not computable - <AUTHOR> http://www.technologyreview.com/view/511421/the-brain-is-not-computable/

<comment><USER2> I thought someone was going to make a point about Turing completeness or undecidability. [https://en.wikipedia.org/wiki/Undecidable_problem](https://en.wikipedia.org/wiki/Undecidable_problem) Instead we get this incoherent mess: "You can't predict whether the stock market will go up or down because you can't compute it.... You could have all the computer chips ever in the world and you won't create a consciousness." As if predicting the future was relevant to creating consciousness, or if modelling millions of specific brains involved in the stock market was equivalent to creating a single consciousness.</comment>


Your Culture Is Your Brand - <AUTHOR> http://blogs.zappos.com/blogs/ceo-and-coo-blog/2009/01/03/your-culture-is-your-brand

<comment><USER2> As someone who's suffered under at least one megalomaniac's attempt to be the next whatever, I would caution any future CEO reading this article and dreaming about following its advice to be careful that you're not building a fantasy brand that exists in your own mind. It's very easy to get blinded by your own bullshit - trust in yourself, but verify that others trust you as well.

</comment><comment> hn-miw-i Nice sentiment but I might be that 1% that pockets that $2k after 4 weeks of corporate brainwashing.

Also this is a blog post from 2009 you should tag the article title (2009).</comment>


How to set up a company in Delaware having B1/B2 visa? - <AUTHOR> I would like to set up a company in Delaware - I'm a B1/B2 visa holder and the operations will be run in Europe, although we would like to have a contact point and address in the US.<p>Do you have some experience with similar scenario? <comment><USER2> There is no requirement that you have a US SSN to set up a company in the US. You can get a tax id number for the corporation over the phone. Keep in mind that the establishment of the corporation will have no effect whatsoever on your immigration status in the US. Another issue is the apostille, which is often an issue when there is a US company that is doing business outside the US. Apostilles in Delaware are $250.00 USD each. In Wyoming, they are only $25. each. Something to keep in mind if you need 10 copies of a document.</comment>


A.I. May Underwhelm Today, but Not for Long - <AUTHOR> https://www.nytimes.com/2017/11/30/technology/ai-will-transform-the-economy-but-how-much-and-how-soon.html <comment><USER2> "We'll have real AI in just a few years, we swear!"

\-- Every AI researcher since 1950.</comment>


Adrian Kosmaczewski – Being a Developer After 40 [video] - <AUTHOR> http://blog.appbuilders.ch/2016/05/26/adrian-being-developer-after-40.html <comment><USER2> Despite the title, the bulk of the talk is 10 (actually 12) tips for managing a career in software development, applicable to software developers of any age.</comment>