IP Spoofing - <AUTHOR> https://idea.popcount.org/2016-09-20-strange-loop---ip-spoofing/ <comment><USER2> I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers ([http://blog.zorinaq.com/nginx-resolver- vulns/](http://blog.zorinaq.com/nginx-resolver-vulns/)) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can't be done on the Internet. And yet [https://spoofer.caida.org/summary.php](https://spoofer.caida.org/summary.php) shows ~25% of network prefixes can be spoofed... _sigh_

<comment><USER3> It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38.

Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing capable, 100,000 node botnet (or the bitcoin required to rent on) with or without reflection capabilities is going to be able to saturate 40gb links.

Name and shame ISPs that allow spoofing, stop wasting developers' time with this crap.

<comment><AUTHOR> This is precisely the point of this article. The only real long term solution to stop large DDoS is to stop spoofing.

The only way to stop IP spoofing is to shame misconfigured networks. For that you need attribution.

<comment><USER4> Recent HTTP DDoS attacks have shown that there is no dependency on spoofing. The problem will be there as long as there's insecure hardware out there.

<comment><USER3> Once spoofing is solved, you have attribution. Once you have attribution, you can use blacklists, notify ISPs, etc. Cleaning up or isolating infected machines becomes tractable at that point.

<comment><USER5> Blacklists and attribution do not hold that much value.

Blacklists are only useful to stop only a few DDoS attacks mainly amplified ones like the ones that abuse open DNS resolvers which should be cleaned up on their own, in which case you want to be blacklisting the resolvers not the machines that use IP spoofing since they do not attack you directly.

Many (heck most) DDoS attacks do not use IP spoofing, the recent and largest recorded in history just used 145,000 IP enabled cameras, and this isn't even remotely the largest botnet out there, blacklisting an entire botnet is effectively DDoSing yourself since many of those machines can be on a network with 100's or 1000's of other computers behind the same IP which many of them would be legitimate users of your service.

Notifying ISP's also doesn't help, some ISP's can do some preventative measures but what often they do is simply kill routes to your service, again it would work if you are dealing with some ISP in Slovakia if you aren't serving any customers there (granted they actually respond to you in due time) but if you are dealing with large ISP's there is little they could do and cutting them off isn't an option.

And as for as cleaning and isolating these machines this is laughable, you aren't going to be tracking down customers, even the ISP won't do that for you, and even if it did what would it do send and email that would likely be ignored? Even if you identify customer the IP belongs to it doesn't tell you anything about the device, not to mention that the customer would likely have no capability of cleaning up their machines to begin with.

IP spoofing is a problem because there are currently ways to abuse IP spoofing to amplify the attacks, if you aren't amplifying your attack using UDP protocols you will usually not going to be using IP spoofing in the first place, and automatically banning IP addresses might sound like a good tactic until you are hit with DDoS from a big botnet within your market region at which point you can't use that any more, you might ban a few IP's that seem to have access to excessive bandwidth but even that might be problematic since it can affect legitimate users.

<comment><USER3> >Blacklists and attribution do not hold that much value

Only because spoofing prevents them from being reliable in any way.

>in which case you want to be blacklisting the resolvers

This approach is idiotic and its the reason these attacks are still a problem. EVERY DNS SERVER can be used if it resolves anything, not just if it's an open resolver. So your blacklist would have to include the root name servers, the .com names servers, etc.

>if you aren't amplifying your attack using UDP protocols you will usually not going to be using IP spoofing in the first place

Completely false. SYN floods and non amplified UDP floods very frequently spoof because it makes pruning attacks upstream by source impossible.

I'm not sure where you got this information, but stop spreading it. It's protecting incompetent network operators, harassing service operators, and doing little to improve the security of the Internet.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> A couple things:

1) There is no evidence that the recent giant DDOS attacks on Brian Krebs used IP Spoofing. In fact, there is every reason to believe that they did not since the generators of the packets were low powered IoT devices. There is increasingly little reason for attackers to even bother with IP spoofing given how easy it is becoming to capture giant herds of low power IoT devices. The attackers don't care if some of their herd gets taken offline due to effective attribution.

Amplification/reflection attacks which will still require IP spoofing. What I'm curious about, and only time will tell, is how much IP spoofing will continue to play a part in lsrge DDOS attacks? Why bother spoofing IPs if your botnet herd is already large enough to bring someone offline?

2) Go and download CAIDA's Spoofer application. Test it and give them bug reports. I gave them one a few weeks ago. [https://www.caida.org/projects/spoofer/](https://www.caida.org/projects/spoofer/)

<comment><USER7> You answered your question there. Without spoofing, only the largest botnets can launch a successful DDoS attack. That's a big barrier to entry, and if the police were effective on this area, would be a huge boom to fighting those attacks.

<comment><USER8> > Without spoofing, only the largest botnets can launch a successful DDoS > attack. That's a big barrier to entry

In the days of Shodan, NO. Absolute no. 100/10 or 50/5 MBit/s household networking is becoming the norm in Germany, and other countries are way ahead of us Germans. Add in the fact that people with lots of (crappy) IoT devices are people who also have the money for high-speed internet connection...

Then throw in a couple of stro's at DCs with good interconnections, and you got yourself a niiiiiiiice huge botnet. You can do LOTS of damage if you get maybe ten or twenty servers with 10 GBit/s links under your control! (10 servers = 100 GBit/s, 10% of the Krebs attack IIRC)

<comment><USER9> 800/500 Mbits/s on speedtest here. (less if we pick a server on another continent).

Fiber is coming to the household. It's gonna bring the potential for DDoS to another order of magnitude. :D

Well. The IoT device will be limited by the bad Wifi or 100 Mbps Ethernet. Hopefully.

</comment></comment></comment></comment><comment><USER10> I have used IP spoofing for good in the past: I had a large number of sensors reporting real time data to our servers. As we wanted to migrate to a completely new infrastructure we wanted to have replication from the old servers to the new. Instead of setting up some kind of higher level system, I wrote a tiny service in C which received the datagrams and then re-sent them to the new servers but spoofed the source IP so it matched the sensor. This worked incredibly well, and the tool was later used for various other purposes.

Of course toward the end of it I learned that I could have done this all with iptables, but I like my way better because I got to learn a lot.

<comment><USER3> Ugh, if you're identifying sensors by IP instead of some other ID in the payload, you're doing it wrong. NAT between the sensors and you can throw a wrench into that whole scheme in a hurry.

This is just a smell emanating from another poor design, not a justification for IP spoofing. If you want to spoof addresses, do it in the privacy of your own VPN tunnel between the servers. Don't expose that sickness to the Internet.

<comment><USER10> You sir are quick to jump to very incorrect conclusions. It's a bad habit and you should abandon it at once.

First, I never said we identified the sensors by IP, but it was important that we record the sensor's IP for diagnostic information.

Second, IP spoofing was not done over the Internet, but rather only between our own servers inside our data center. Obviously doing this over the internet would not only be bad, but also highly unreliable.

In conclusion... well I'm trying to be polite.

<comment><USER3> If you have _anything_ , including diagnostic information, that depends on the source IP being correct, you're doing it wrong.

<comment><USER11> Port forwarding on some consumer grade routers work using IP addresses (not MAC addresses). If I assign a computer a static 192.168/16 IP and forward a port to it, I'm doing it wrong?

</comment></comment></comment></comment></comment><comment><USER12> There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not originate from your network. It would make ddosers life harder.

<comment><USER13> That would penalize a whole pile of parties that probably have nothing whatsoever to do with the spoofers. It's akin to blackholing mail from yahoo.com because there are spammers on yahoo.com.

<comment><USER14> Isn't it more akin to blackholing mail servers that don't set up DKIM, which almost all major mail providers do these days?

<comment><USER13> No, if you drop the BGP route the whole range disappears, not just the host that spoofs the IPs. So it kills off a whole pile of innocents as collateral damage.

<comment><USER14> I don't know if I understand. At first I thought you meant that we shouldn't drop entire providers because one of their customers spoofed an IP, but of course the burden should be on those providers to make sure spoofed packets can't leave their network (since further up the chain you're getting packets that are originating from many networks). Are you talking about something else?

<comment><USER15> BGP route is on the receiving end.

</comment></comment></comment></comment></comment></comment><comment><USER16> Netflow is a great example of the dual use aspects of tech between surveillance and defense. Making Netflow data more widely available looks like it is going to be essential for defending that Internet but at the same time Netflow data can threaten the anonymity of Tor users.[0][1]

[0] [https://blog.torproject.org/blog/traffic-correlation- using-n...](https://blog.torproject.org/blog/traffic-correlation-using- netflows)

[1] [https://gitweb.torproject.org/torspec.git/tree/proposals/251...](https://gitweb.torproject.org/torspec.git/tree/proposals/251-netflow- padding.txt)

<comment><USER17> Of course, I'm not sure if cloudflare could care any less about tor users. They see a lot of attack traffic from tor so this probably isn't something they are concerned about. I can't really blame them from a business perspective, but I avoid cloudflare due to it.

<comment><USER18> > They see a lot of attack traffic from tor

This was debunked.

<comment><USER17> I don't believe this is actually arguable. People use tor to attempt to anonymize their (generally non-ddos) attacks.

I don't believe tor can support the type of ddos the OP is talking about, of course.

If you could provide the source of this debunk it'd be appreciated.

<comment><USER19> This is ridiculous. Anyone can grep their access logs for signs of obvious attacks and very quickly verify that very few, if any, of them originated from Tor exits.

<comment><USER20> It amuses me greatly that probably no one in this thread realizes who you are. (Except maybe Cloudflare.)

<comment><USER21> I have no clue who ryanlol is. Would it make a difference if I did?

<comment><USER22> He's a subject matter expert: Julius Kivimaki.

<comment><USER21> OK

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> I consider myself pretty technically savvy... Developer and DevOps.

However, when I see tricks like in this talk using iptables with BPF bytecode[1] to block SYN packet floods, I get completely humbled. I know that I know nothing.

[1] [https://idea.popcount.org/2016-09-20-strange-loop---ip- spoof...](https://idea.popcount.org/2016-09-20-strange-loop---ip- spoofing/strange-loop3-iwi-09-09.045.jpg)

</comment><comment><USER24> "Operating a content neutral service in today's internet is a tough job. Some people dislike some websites, and they want to stop them from being available on the internet. The easiest way to do so is to launch a DDoS attack."

... which you can conveniently buy on one of the CloudFlare-protected DDoS service websites! I know this point has been hammered to death before, but I find it curious that despite their strong advocacy of being content neutral and not removing a site unless they receive a court order, their Terms of Service explicitly allows them to shut off service based solely on their opinion:

      "SECTION 11: INVESTIGATION
       CloudFlare reserves the right to investigate you, your
       business, and/or your owners, officers, directors,
       managers, and other principals, your sites, and the
       materials comprising the sites at any time. These
       investigations will be conducted solely for CloudFlare's
       benefit, and not for your benefit or that of any third
       party. If the investigation reveals any information,
       act, or omission, which in CloudFlare's sole opinion,
       constitutes a violation of any local, state, federal, or
       foreign law or regulation, this Agreement, or is
       otherwise deemed harm the Service, CloudFlare may
       immediately shut down your access to the Service."

Does CloudFlare ever make use of this provision?

<comment><USER25> That's a standard clause you include in a contract to give you an out if things get so bad you have no choice but to cut the client loose.

They're not offering a safe harbor, they're offering a non-discriminatory service. Those are two different things.

</comment></comment><comment><USER26> Am I the only one that believes that the kind of non-preferential routing and anonymity that the current exchange setups provide is a benefit? In terms of society as a whole this far outweighs the downsides of DoS attacks using IP spoofing.

"Solving" the "problem" of ip spoofing is only a benefit for centralized authorities and services. The loss of privacy is also serious. People advancing this idea are advancing it to better their commercial interests rather than the interests of individuals using the 'net.

<comment><USER27> Is that an actual use case? What could you possibly do without return traffic?

Reverse Path Forwarding is best practice, and has been since more than a decade. The normal reason packets appearing on the wrong interface is a routing loop somewhere and this alone makes it worth it.

<comment><USER26> I'm not saying IP spoofing is useful for many real tasks. I'm saying the solution proposed in the article will end up being abused and worse than the problems it solves. It's one more step to an internet where commercial traffic is prioritized over actual users at all steps along the path.

</comment></comment></comment><comment><USER28> Can someone explain the consequences of DDoS attacks to me? My understanding is that the worst case is that the target server goes offline for the duration of the attack.

If that's indeed the endgame, it seems like a lot of work on the attacker's part to disable a company's servers for a bit, but maybe I"m missing something? The article did mention servers boiling, but that was likely hyperbole unless there's a way to physically damage servers with DDoS.

<comment><USER29> Imagine you are a news outlet. You make money by creating articles that entice people to view your website. You make money to pay your expenses by having advertisements on your website.

DDoS = No Website. No Website = no users viewing ads. No users viewing ads = No income.

Yes, that typically resolves quickly. Depending on your hosting agreement, you may have to pay for all the excess bandwidth that the DDoS bots used.

Now imagine if you are a bank, users want to be able to access their accounts/funds/etc. How long would you remain with your bank if you frequently couldn't access your information because they were being DDoS'd.

<comment><USER30> And, depending on your transit agreements you may have to pay for all that incoming bandwidth.

</comment></comment></comment><comment><USER31> UDP spoofing is one thing but the latest and largest attacks are TCP based.

<comment><USER32> Flatly incorrect. The latest and largest attacks are generally UDP reflection attacks, with a smattering of TCP SYN flood & pure L7 attacks thrown in.

<comment><USER33> _latest and largest attacks_

Except for the latest and largest attacks: OVH @ near 1Tb/s in combined tcp_ack traffic on 2016/09/20 [0]

When attackers have 150k+ comprimised hosts, with 1-30Mb/s each, there is no need for reflection/stealth/source spoofing/etc. At those levels, the attackers can just point them to an IP with 'normal' traffic and it's enough to be devastating.

[0] - [https://twitter.com/olesovhcom/status/778830571677978624](https://twitter.com/olesovhcom/status/778830571677978624)

<comment><USER32> Apologies, I stand corrected.

</comment></comment></comment></comment><comment><USER34> Since IP spoofing could be done by a few malicious hosts, is it really accurate to consider a DoS via ip spoofing 'distributed'? Sure the source IPs may appear to come from all over, but that's just an illusion.

When I think DDos, I envision thousands of compromised hosts all over the internet making requests to a target to consume resources.

<comment><AUTHOR> It's impossible to say if the attacker owns one beefy server or a thousand of bots.

</comment></comment><comment><USER35> Am I correctly understanding that big/most attacks are against unwanted content? For instance, in my country the two most popular political blogs that make strong opposition to the government are regularly DDOSed. If that is the case, maybe an easier solution would be to make this a _software problem_ and not a network one. For that, I think we already have the tech to make P2P websites feasible. My phone and data plan cannot serve hundreds of requests per second but I'm sure I can get ALL the content I read on a given day from peers as well as pass it along to others. Clearly not a solution for all Internet use cases but a viable alternative to blogs.

</comment><comment><USER36> [https://www.youtube.com/watch?v=79u7bURE6Ss](https://www.youtube.com/watch?v=79u7bURE6Ss) youtube video

</comment><comment><USER23> This is a great talk. Marek does an awesome job of explaining something that is very technical in a clear and casual manner. I definitely learned some new things.

Video: [https://www.youtube.com/watch?v=79u7bURE6Ss](https://www.youtube.com/watch?v=79u7bURE6Ss)

</comment><comment><USER37> I've been a software engineer for 18 years, but this amazing post reminded me how little I know about how the internet works lol. Going to read this a few times for sure!

</comment><comment><USER38> Large bandwidth attacks might look sexy, but they're trivially easy to block. Network operators care about pushing packets, not bits. The OVH attacks look huge to the average AWS user, (ZOMG a terabit!) but to even an average tier 2 transit provider it's a trivial attack to block. Especially when the attackers are hitting a single endpoint.

To be honest, attackers are not very smart. They almost always use the same old attacks, attacks that are easily stoppable, and attacks against a single IP.

100gig coherent is easily turning volumetric attacks into old hat. Ending spoofed attacks today is a tactic that's 10 years too late.

<comment><USER3> It's not trivial by any means other than preventing it from clogging up internal stuff. If they are targeting a specific IP and the traffic is indistinguishable from normal traffic in the l3/l4 headers, there is no way you are going to block the attack without taking down the service.

This is why solving spoofing is such an important problem. Once source IPs become sticky, we can actually block based on them to truly stop the attack without taking down the service.

<comment><USER38> You block volumetric attacks by filtering the payload, not by blocking IP's. If you block by IP, you're going to have a lot of upset customers. Also, what are you going to do on an IPv6 attack? Block the entire /64? Unlikely. Also remember that a single IP doesn't always mean a single user for IPv4. An IP might represent several thousand customers in the case of NAT and especially CGNAT.

If the traffic is indistinguishable from normal traffic via L3/L4, then it's a layer 7 attack, which cannot be spoofed. You're not dealing with spoofing in a L7 attack.

The first D in DDoS stands for distributed. Even terabit sized attacks are easy to stop if they're sufficiently distributed (the attack is geographically dispersed enough to be diffused). It's when you get a terabit from a handful of AS's (like in S. Korean attacks) that you can feel pain. Even then, it usually only knocks out access in that part of the world, but not everyone.

IP's will not be sticky. IPv6 is showing why it's important to not be sticky. Ending spoofing isn't going to stop DDoS attacks. I've got 10+ years of experience on the subject, and I'll gladly answer any questions you might have.

<comment><USER3> Yes, you block by IP and piss off customers or the whole /64 if necessary. IPs will almost always be sticky to the advertised prefix.

A TCP SYN, or any UDP initial request indistinguishable from legit traffic of the same protocol at L3/L4, and both can be spoofed so I don't know where you got the idea that they cant be spoofed and are L7 only.

If you're "stopping the attack" through dispersion, you're not actually stopping it, you're just paying the price of absorbing it. I know this is common practice, but it's pathetic than an arms race is the state of the art in defense. It concentrates power into orgs like cloudflare, akamai, and Google (project shield) because the only way to participate is to use them.

</comment></comment></comment></comment><comment><USER39> Ironically, Mobile IPv6 uses spoofing for route optimization.

</comment><comment><USER40> If only we had a method for authenticating packets : /

</comment><comment><USER41> The slide showing the Internet Exchange's switch says those are Ethernet cables, but they're actually fiber.

I'm really impressed with this presentation, but I wish that one flaw could be fixed.

</comment><comment><USER42> Warning: Sales pitch masquerading as a technical talk.

<comment><USER25> Warning: Someone's cranky.

It's a technical talk. It's much better to hear from people who are being attacked regularly and have a track record of dealing with it rather than those who have no clue.

<comment><USER42> sure except their paper just describes the issue and their solution is "pay us money". Not really up to the same standard as even a bad academic article, more like the paid talk track at a conference, you know, the kind lots of people avoid.

<comment><USER25> They laid out several solutions, and none of them are specific to their platform. They also highlighted how the attacks are changing and if you're to effectively defend yourself you'll need to have more resources on hand.

You can pay them, you can do it yourself, you can pay someone else, but at least you have options.

</comment></comment></comment></comment><comment><USER43> Fantastic article.

</comment><comment><USER44> Time to spoof!

</comment><comment><USER45> That was an excellent presentation, very informative.

Except, why put that ridiculous meme in the middle of it? It's cringeworthy seeing an excellent technical presentation littered with such childish imagery.

(Not that I agree with this bastardization of "meme" to mean "silly image with text overlaid in capital letters", but unfortunately that is what everyone is calling these things.)

<comment><AUTHOR> To wake up the audience and emphasize the message :) Also, to divide the presentation sharply between: problem statement and the solution.</comment></comment>


This September, OLED no longer "three to five years away" - <AUTHOR> http://arstechnica.com/gadgets/news/2009/08/this-september-oled-no-longer-three-to-five-years-away.ars <comment><USER2> It's going to be very interesting to see how people will adapt to the power drain issue here.

White text on a black background is no longer what people are used to, but to maximize battery live on these devices that's the way to go.

The next hurdle would be software companies and website makers. Most text is black-on-white now, a regular display is pretty much a constant drain because the backlight is what consumes most of the power, an OLED will consume more as more pixels are turned on and brighter.

Green or Amber text on black anybody ?

<comment><USER3> For text I can live with light on dark... as long as I can reverse when needed.

...which is the joy (on my aging PowerBook at least) of cmd-opt-cntl-8 -- also a real treat to scare a noob relative into thinking I've destroyed their Mac ;)

</comment></comment><comment><USER4> I had some friends that made OLEDs in a MatSci lab last year. It was an incredibly complicated and drawn-out process, not to mention sensitive and nit-picky. Sure, automation would most of the problems, but I don't envy the people who have to make and test each revision.</comment>


Monzo Is Launching in the USA - <AUTHOR> https://monzo.com/usa/ <comment><USER2> I don't see any advantage of using Monzo over BECU (seems you've got fewer features). What is the value pitch here?

The US market is a fair bit different than the UK, there are a plethora of banks and credit unions to choose from.

Most US Credit Unions will give you a free account with free access to the co- op ATM network (every 7-Eleven, many gas stations, every credit union atm, etc) and reimburse $20 to $30 in 3rd party ATM fees per month. Live chat, card freeze, Zelle support, etc is built into BECU, Umpqua and presumably most CU/bank apps & websites.</comment>


Qubit survives record 39 minutes at room temperature - <AUTHOR> http://www.cbc.ca/news/technology/qubit-record-moves-quantum-computing-forward-1.2426986?cmp=rss

<comment><USER2> This is really exciting! For those not familiar, 180s (edit: as previously published[2]) is a phenomenal amount of time at room temperature and it seems they've beaten that now too. I was just looking for this recently in another comment thread[1] too when talking about the really cool things you can do when you have access to ultra-pure silicon-28 (which has been made as a result of something that sounds quite boring–making a more accurate standard for the kg–and is now having some exciting side benefits). Direct link to paper is here[2]; I think it's open access.

I was lucky enough to see a talk by one of the authors recently and was left very impressed. Quantum computing is probably the 'sexiest' application of ultra-pure silicon-28 but there are so many others besides, including being able to use ultra-fine optical transitions to identify defect complexes within the silicon (arrangements of impurity atoms that can influence the properties of silicon-based devices). If I remember rightly, there were several defects that had been misidentified for years based on entirely reasonable Occam's-razor like reasoning that have now been correctly identified thanks to this work.

[1] [http://news.ycombinator.com/item?id=6617183](http://news.ycombinator.com/item?id=6617183)

[2] [http://www.sciencemag.org/content/336/6086/1280.full.pdf](http://www.sciencemag.org/content/336/6086/1280.full.pdf)

<comment><USER3> That's 1800s.. a factor of 10 more!

</comment></comment><comment><USER4> Silicon never ceases to amaze me. While much of the research in solid state physics these days is around novel materials like graphene, silicon continues to dominate solid-state applications including all conventional computer processors and most solar cells and will prove incredibly hard to unseat in these areas. Now it appears to be a leading contender for quantum computing platforms. It's an earth-abundant material with billions of research dollars poured into it to support computing, so seeing progress in silicon quantum computing means real hope for applications.

<comment><USER2> Yes, very true, but this is in part because silicon is simply understood so well now. Trust me when I say we could do just as exciting things and more besides with other materials if we just understood them half as well!

To illustrate what I mean, consider the fact that the Czochralski process [1] _exists_ and that it means you can get huge, pure, relatively defect-free _ingots_ of silicon (see [2]). With new materials, we're happy just to grow a few microns of the stuff, let alone something like that.

So you're right, silicon really is very incredible :) but we've reached the point now that the new innovations are in part possible by sheer momentum alone, like the billions of dollars of investment you mention. The big challenge is to develop new materials that initially (possibly for decades or more) are inferior to silicon but might ultimately unseat it. The only problem is that no one really knows what that material will be in advance. A lot of people right now are gambling on graphene, and from the amount of investment alone something interesting should come from it, but who knows if there's something else better out there just waiting for the attention it needs.

[1] [http://en.wikipedia.org/wiki/Czochralski_process](http://en.wikipedia.org/wiki/Czochralski_process) [2] [http://en.wikipedia.org/wiki/File:Monokristalines_Silizium_f...](http://en.wikipedia.org/wiki/File:Monokristalines_Silizium_für_die_Waferherstellung.jpg)

<comment><USER5> Not that I disagree with what you wrote, I just want to point out that silicon dioxide is probably the most important reason silicon has reached such ubiquity in electronics. No other material has a native oxide as good as SiO2, even though the semiconductors themselves have superior properties than silicon.

<comment><USER6> The interface isn't good though.

<comment><USER7> the interface is not too shabby

</comment></comment></comment></comment></comment><comment><USER8> Publications from the lab: [http://www.sfu.ca/physics/thewaltlab/publications.html](http://www.sfu.ca/physics/thewaltlab/publications.html)

</comment><comment><USER9> Thats great! I need to read the paper but if that is the life time of the physical qubit then it is much larger then what is typically considered needed for using quantum error correction to make logical qubits.

Logical qubits are made up of many physical qubits, with relatively short life times, to make one logical qubits with an infinite life time. The longer life time of logical qubits makes it considerably easier to perform long calculations and store information.

If anyone knows how easily quantum error correction can be applied to this system I would be interested in finding out.

<comment><USER6> In theory, that amount of time should allow for error correction (assuming there are more qubits to work with). The critical factor for computation is this dephasing time divided by the gate operation time (how long it takes to modify the qubit) which should be on the order of at least 10^5.

Single qubit operations have been shown to be on the order of 10's of microseconds for P nuclear spins in Si. (Unfortunately behind paywall, [http://www.nature.com/nature/journal/v496/n7445/full/nature1...](http://www.nature.com/nature/journal/v496/n7445/full/nature12011.html))

</comment></comment><comment><USER10> This is actually super legit, published in Science. Very exciting. I'm so proud that Canada is a world leader in quantum computing research, what with Waterloo and all the millions in funding they're spending at IQC. I hope this is the first step in achieving real quantum computers.

<comment><USER11> Except this took place at SFU.

</comment></comment><comment><USER12> 1 minute longer than the theoretical maximum period for which you can sustain an artificial wormhole

<comment><USER13> Is this in fiction or fact? If fact, can you provide some reference?

<comment><USER14> It's fiction.[1] "Artificial wormholes cannot be sustained for more than 38 minutes under normal conditions."[2]

[1] Quite enjoyable fiction. My canonically chronological SG viewing order for maximum enjoyment is available at [https://docs.google.com/spreadsheet/pub?key=0AkwxWLA63pAmdG5...](https://docs.google.com/spreadsheet/pub?key=0AkwxWLA63pAmdG5jS0F1UkJBQW5vYXBZdl85VHN5dHc&output=html)

[2] [http://stargate.wikia.com/wiki/Wormhole_physics](http://stargate.wikia.com/wiki/Wormhole_physics)

</comment></comment></comment><comment><USER15> 39 minutes? Hmm, still not good enough for long-term backup of your qubits :)

<comment><USER16> Doesn't the no cloning theorem mean that you cannot back up a qubit regardless of how stable it is?

</comment></comment><comment><USER17> For just too often claims like that could not been proved by others. Did they release sufficient information that their experiment could be approved by others?</comment>


Transmitter Fingerprinting - <AUTHOR> http://kb9mwr.blogspot.com/2008/04/transmitter-fingerprinting.html <comment><USER2> How it works is you build the analog parts of your synthesizer using 5% to 20% tolerance parts, because they're cheap and you can. Also FM voice being the modulation scheme that it is, you can get away with keying up the transmitter before the synth totally settles without hurting anything. So the "eh don't worry about it" unique preamble to voice FM VHF transmitters was useful for this technique.

This is a historical post and when it was made DDS synth techniques had only been popular in ham radio circles for maybe 10 years, now that its even more popular, I wonder if this technique is still useful.

Also some modulation schemes (dstar digital voice, etc) embed your ID in the data stream so its not really possible to key up the repeater without identifying.

Finally the popularity of FM repeater operation seems to be declining dramatically among the hams, from multiple 24x7 repeaters in use when I was a kid just on 2M, to it basically being a near dead subset of the hobby. There are now more people checking into the long distance sideband nets on 2M and 6M than you'll hear on 2M FM repeaters...

(PS and a sufficiently advanced software defined radio, and it doesn't have to be very advanced, can both record, analyze, and play back accurately enough to impersonate someone using a legacy analog synth. Or generate a signal with randomly varying freq response simulating a different device each time, foiling this technology)

<comment><USER3> > Also some modulation schemes (dstar digital voice, etc) embed your ID in the > data stream so its not really possible to key up the repeater without > identifying.

-I assume this can be easily forged and rotated, though; being able to tie multiple instances of iq0 activity to a single transmitter still has it's uses.

</comment></comment><comment><USER4> I wonder if that kind of fingerprinting would work for wifi transmissions?</comment>


NASA perplexed by galaxies heading in a particular direction - <AUTHOR> http://www.nasa.gov/centers/goddard/news/releases/2010/10-023.html

<comment><USER2> From the PR: "This is not something we set out to find, but we cannot make it go away […]"

One can only imagine the drama if somone were to find such a sentence in a climate related PR :)

<comment><USER3> Creationists are already formulating their replies...

</comment></comment><comment><USER4> I am always amazed by the amount of new discoveries that are still possible in science. We might think that we have an adequate picture of our universe and how it operates, but then we discover yet another subatomic particle or another strange fact about the movement and organization of the galaxies.

For all we know the smallest subatomic particles yet discovered may be made up of yet smaller subatomic particles, and the laws of physics that we use today will be completely invalidated by a future better understanding of dark matter and its effect on our universe.

It is humbling and incredible to think about how much there is yet to discover.

<comment><USER5> You don't even have to go as far as dark matter, dark energy, or indeed space at all to find amazing undiscovered principles in physics. For example: put a ball on your desk. Now push it. Did it resist? Why? Well, sure, there's a component of friction, but even without friction it would resist your push...so, why? Inertia, right? But where does inertia come from?!? <http://en.wikipedia.org/wiki/Inertia#Source_of_Inertia>

</comment></comment><comment><USER6> The BBC covered this phenomenon in a hour long program on Tuesday. For any one who can get it or is interested, link below.

[http://www.bbc.co.uk/iplayer/episode/b00rgg31/Horizon_200920...](http://www.bbc.co.uk/iplayer/episode/b00rgg31/Horizon_20092010_Is_Everything_We_Know_About_The_Universe_Wrong/)

<comment><USER7> Discounting the sensational title, the click-to-show-text Programme Information has a simple summary:

 _There's something very odd going on in space - something that shouldn't be possible. It is as though vast swathes of the universe are being hoovered up by a vast and unseen celestial vacuum cleaner._

</comment></comment><comment><USER8> We barely know anything about cosmology at all, when you get down to it.

<comment><USER9> Why do you say that?

<comment><USER8> Because there are so often things we discover we're fundamentally wrong about. It's really a pretty thin science based on a _lot_ of assumptions and inferences.

It's very safe to say most of what we know about cosmology is wrong, and a large portion of it is probably deeply wrong.

<comment><USER10> Seriously, what are you talking about?

We know a lot about cosmology. In particular there is very good evidence for for the basic model: hot big bang, cold dark matter, accelerating expansion, geometrically flat, ~14 billions years old (see <http://www.astro.ucla.edu/~wright/cosmology_faq.html> for more).

Granted we don't know what the dark matter is, and we don't know what's causing the acceleration. Those are big unknowns! But the basic picture is pretty well understood. And I think it's very unlikely that much of this picture is "deeply wrong".

I mean, what do you think? Some day we are going to discover that the universe wasn't really denser and hotter in the past? That the universe isn't really expanding? That baryonic matter makes up all of the mass of the universe?

<comment><USER8> The very faq you link to uses cautious language. Look at "currently most accepted model" right there in the first question.

If you've followed cosmological history at all, it's been a cascading series of big changes decade after decade.

I'm virtually certain the model of 2030 will vary in deep, significant ways from the model of 2010.

<comment><USER10> Can you be more specific? What parts of the "hot big bang, cold dark matter, accelerating expansion, geometrically flat, ~14 billion years old" model will be shown to be "deeply wrong"? Do you think that discovering, say, the nature of dark energy, is going to demonstrate that the universe isn't really expanding? That we are going to discover that the universe is really 100 billion years old? That the universe was actually colder and larger in the past?</comment></comment></comment></comment></comment></comment>


Merging OpenTracing and OpenCensus - <AUTHOR> https://medium.com/opentracing/merging-opentracing-and-opencensus-f0fe9c7ca6f0 <comment><USER2> Great to see consolidation in this area. Observability is super important in the cloud/microservices era. Standardizing the collection of logs, metrics and tracing is a big win.

</comment><comment><USER3> People were constantly confused about OT vs OC differences. Great to see this merge!</comment>


CISA passes Senate - <AUTHOR> https://www.eff.org/deeplinks/2015/10/eff-disappointed-cisa-passes-senate <comment><USER2> Interesting votes:

      Nay		  I  	Sanders, Bernie	VT
      No Vote	  R  	Cruz, Ted	TX
      No Vote	  R  	Graham, Lindsey	SC
      No Vote	  R  	Paul, Rand	KY
      No Vote	  R  	Rubio, Marco	FL

Above from GovTrack [1]

Note, the Guardian [2] has Sen. Graham as voting yes. > Democratic presidential contender Bernie Sanders voted against the bill. None of the Republican presidential candidates (except Lindsey Graham, who voted in favor) were present to cast a vote, including Rand Paul, who has made privacy from surveillance a major plank of his campaign platform.

[1] [https://www.govtrack.us/congress/votes/114-2015/s291](https://www.govtrack.us/congress/votes/114-2015/s291) [2] [http://www.theguardian.com/world/2015/oct/27/cisa- cybersecur...](http://www.theguardian.com/world/2015/oct/27/cisa- cybersecurity-bill-senate-vote)

<comment><USER3> That kind of makes sense, because the bill cleared its cloture vote with overwhelming support, and if you follow the amendments from the beginning, pretty much everyone seems to have had their fingers in it. There's nothing anyone could have done to change the outcome.

<comment><USER4> But it's much easier to tell a reporter, "I voted against CISA" than it is to explain cloture.

<comment><USER5> Then why didn't any candidate except Sanders vote against it?

<comment><USER6> Paul for example is running for President. He has to be at the debate if he even wants to pretend to still be in the running. Could he be in both places in the same day? I don't know, I guess you'd have to find out how plausible that is in terms of debate preparation.

<comment><USER4> I didn't realize the Republican Debate was tonight. Either way, they will get another chance to cast a vote on the conference report.

</comment></comment></comment></comment></comment></comment><comment><USER7> The tech world badly needs the equivalent of the NRA. We need to routinely be grading politician voting records [1] on privacy focused bills. If a politician votes against privacy, then they should be forced to fear a highly contested re-election.

If it works for guns and the tea-party, then why can't it work for tech?

[1] [https://www.nrapvf.org/grades/](https://www.nrapvf.org/grades/)

<comment><USER8> The EFF is already the most reliable org fighting for our digital arms. As far as comparison to the NRA, I suggest GOA[1] is a better model. The NRA is only a fair weather friend of the 2nd.

[1] [http://www.gunowners.org/114hrat.htm](http://www.gunowners.org/114hrat.htm)

<comment><USER9> The EFF is probably as good as it gets for digital privacy issues, unless it becomes a widespread concern for millenials.[1] When you're a small minority like digital privacy activists are, using the legal system instead of the ballot box is your proper recourse, by design. Money would help, somewhat, too, but I'm not sure the tech companies with deep pockets actually support the digital privacy agenda in more than a tepid way.

[1] Which I doubt. Eventually, you'll have millenial senators. But I am guessing they will still care more about terrorism, chinese hacking, etc, than electronic privacy.

<comment><USER10> Somewhat perversely, Chinese hacking largely _is_ a privacy issue, just not individual privacy. The reason why Chinese hackers in particular are of concern is (1) they seem to engage in substantially higher levels of corporate espionage and (2) are outside of jurisdictions where such things can be appropriately disincentivised / punished [Although there are some signs China might start playing ball as they develop more domestic proprietary information].

There's a data science hurdle -- can e.g. the Russian mob filter though mass hacked email and facebook accounts to find blackmail material that has reasonably good returns with minimal personal time investment -- before the two become one and the same. If we end the decade before we have public conversations about (modulo details) an email from yourself saying 'send money here or we will forward this email to your employer/spouse', I would be surprised. Until then, people only have privacy because there's no economic incentive to shatter it. There are no rules. Yet.

</comment></comment></comment></comment><comment><USER11> EFF isn't getting it: powerful and rich people want this bill to pass for increased government surveillance, control, financial contracts, and bribes. It's probably that simple. They didn't make a mistake any more than they accidentally give the Pentagon or defence contractors ridiculous sums of money for useless stuff that just keeps people employed in their districts, their stock portfolios in the black, and their campaign funds full. This is part of systematic corruption. They just don't give a shit, they have incentives not to, and agencies promise them an exemption which they believe. (Wait, there's the mistake.)

Aside from huge voter push, the only thing that could change it would be similar money and power pushing in the opposite direction. Not talk, not lawyers, not faxes: one or more groups paying for and demanding curtailing of mass surveillance with ability to disrupt contracts, bills, or the politician's careers. Right now, only the pro-surveillance people are in that position. So, they're winning and will keep winning until people get how the system really works and make it work for them.

<comment><USER12> Goes way beyond that...

On the NSA/spying...

The (mass surveillance) by the NSA and abuse by law enforcement is just more part and parcel of state suppression of dissent against corporate interests. They're worried that the more people are going to wake up and corporate centers like the US and canada may be among those who also awaken. See this vid with Zbigniew Brzezinski, former United States National Security Advisor.

[https://www.youtube.com/watch?v=n7ZyJw_cHJY](https://www.youtube.com/watch?v=n7ZyJw_cHJY)

Brezinski at a press conference

[https://www.youtube.com/watch?v=VWTIZBCQ79g](https://www.youtube.com/watch?v=VWTIZBCQ79g)

</comment></comment><comment><USER13> Here is my problem with EFF: They are raising a stink and not providing any cited evidence. In Wikipedia terms-- [citation needed]. Take any article published by them and count how many links deep you have to get to any actual information and not just general opinion. I still haven't found anything that goes through the bill and explains what the problem is citing the text of the bill.

This is an actual opening sentence from some material the EFF published: "Although grassroots activism has dealt it a blow, the Senate Intelligence Committee's terrible bill, the Cyber Intelligence Sharing Act(CISA) keeps shambling along like the zombie it is." It's hard for me to get behind an organization that writes like this.

What I dislike about all the crazy right-wing emails I get is it's all inflated scare mongering and no actual sourcing. The EFF's publications are getting way too similar and it saddens me.

Now, on the flip side, I have yet to see the authors of this bill really put out much material that relates the bill in simpler terms. For that, I am also saddened.

<comment><USER14> [https://www.eff.org/deeplinks/2015/03/senate-intelligence- co...](https://www.eff.org/deeplinks/2015/03/senate-intelligence-committee- advances-terrible-cybersecurity-bill-surveillance)

TL;DR: More surveillance under the guise of "Cybersecurity"

</comment></comment><comment><USER15> Enormous multi-national corporations should not function as an extension of our Government. This is the separation of church and state debate all over again.

<comment><USER16> I think you've got it backwards. For the last 200 years, the government has mostly functioned as an extension of wealthy people/corporations. Heck, the revolutionaries of the Boston Tea Party were upset that legally imported British tea was cheaper than the colonists' smuggled Dutch tea. The USA was founded by merchants trying to avoid competition.

<comment><USER15> Well yeah, the US government has a mandate to protect commerce.

</comment></comment></comment><comment><USER17> What is the bigger picture here, what is really happening?

Europe also wants to regulate internet traffic, at the same time an internet law is passed and both us and europe want a broader commerce union with TIPP.

Are all these tools implemented to eventually censor people who will disagree with all that is coming with this new union? something like china does with everything that is against the party? what are they trying to do to our society with these baby steps?

</comment><comment><USER2> Does the final version produced by the conference committee require revotes in the House and Senate again before heading to the President for signature?

The gap between US lawmakers and the EU is only widening when it comes to Privacy matters. This vote only lends more credence to the EU's decision earlier this month to scrap Safe Harbor [1].

[1] [https://www.schneier.com/blog/archives/2015/10/european_cour...](https://www.schneier.com/blog/archives/2015/10/european_court_.html)

<comment><USER18> > Does the final version produced by the conference committee require revotes > in the House and Senate again before heading to the President for signature?

Yes. The House and Senate must actually pass the same bill, not merely similar bills.

<comment><USER2> Thanks! So there is more time to voice concerns with elected representatives.

</comment></comment></comment><comment><USER19> What impact did Facebook's lobbying have on this?

<comment><USER20> Wonder if TPPA and CISA are related somehow.

</comment></comment><comment><USER21> The final bill passed with a resounding 74-21 ([https://www.govtrack.us/congress/votes/114-2015/s291](https://www.govtrack.us/congress/votes/114-2015/s291)). Here's the list of people who voted for it:

D Bennet, Michael CO

D Blumenthal, Richard CT

D Boxer, Barbara CA

D Cantwell, Maria WA

D Carper, Thomas DE

D Casey, Bob PA

D Donnelly, Joe IN

D Durbin, Richard IL

D Feinstein, Dianne CA

D Gillibrand, Kirsten NY

D Heinrich, Martin NM

D Heitkamp, Heidi ND

D Hirono, Mazie HI

D Kaine, Timothy VA

D Klobuchar, Amy MN

D Manchin, Joe WV

D McCaskill, Claire MO

D Mikulski, Barbara MD

D Murphy, Christopher CT

D Murray, Patty WA

D Nelson, Bill FL

D Peters, Gary MI

D Reed, John RI

D Reid, Harry NV

D Schatz, Brian HI

D Schumer, Chuck NY

D Shaheen, Jeanne NH

D Stabenow, Debbie MI

D Warner, Mark VA

D Whitehouse, Sheldon RI

I King, Angus ME

R Alexander, Lamar TN

R Ayotte, Kelly NH

R Barrasso, John WY

R Blunt, Roy MO

R Boozman, John AR

R Burr, Richard NC

R Capito, Shelley WV

R Cassidy, Bill LA

R Coats, Daniel IN

R Cochran, Thad MS

R Collins, Susan ME

R Corker, Bob TN

R Cornyn, John TX

R Cotton, Tom AR

R Enzi, Michael WY

R Ernst, Joni IA

R Fischer, Deb NE

R Flake, Jeff AZ

R Gardner, Cory CO

R Grassley, Chuck IA

R Hatch, Orrin UT

R Hoeven, John ND

R Inhofe, Jim OK

R Isakson, John GA

R Johnson, Ron WI

R Kirk, Mark IL

R Lankford, James OK

R McCain, John AZ

R McConnell, Mitch KY

R Moran, Jerry KS

R Murkowski, Lisa AK

R Perdue, David GA

R Portman, Rob OH

R Roberts, Pat KS

R Rounds, Mike SD

R Sasse, Benjamin NE

R Scott, Tim SC

R Sessions, Jeff AL

R Shelby, Richard AL

R Thune, John SD

R Tillis, Thom NC

R Toomey, Pat PA

R Wicker, Roger MS

<comment><USER22> both senators from both WA and CA, which are the tech-heavy stastes. No good!

<comment><USER23> Those senators vote on tech issues as they are instructed by tech companies. If they voted this way, I think its reasonable to assume that tech companies lobbied for it.

</comment></comment></comment><comment><USER24> That's 1 more call for consumers not to use US companies for IT/Web related matters.

<comment><USER25> Considering the US is also tapping every cable leading out of the country, where do you suggest folks take their business?

<comment><USER26> I think OP means non-Americans should not patronize American businesses. Unfortunately though, much of the Internet's transit traffic passes through the US.

</comment></comment></comment><comment><USER27> and this is why people should cheer when Democrats and Republicans cannot agree on how to run the government instead of buying into the line that divisiveness is bad.

because when they get along we lose.

</comment><comment><USER28> We need to raise hell on all of those politicians including the White House months from now, when there will inevitably be another breach where tens of millions of people's data is hacked and their beloved CISA didn't stop it.

Shame them into admitting it's not only a useless, but harmful law, and force them to repeal it.</comment>


What you need to know to keep your online accounts safe - <AUTHOR> http://www.stavros.io/tutorials/online-security/? <comment><USER2> Didn't see a lot of practical advice. For example: they say there aren't really defenses against keyloggers but that is not true. One defense to protect a web password is to inject characters into the key logger that are ignored by the browser. One method of doing this is to click in the password text box, type one character of your password then click on the background of the page and type a bunch of gibberish then repeat. The keylogger will be filled with random gibberish instead of your password.

<comment><USER3> Most keyloggers include the window title (and the really advanced ones take screenshots as well), so this countermeasure is easily defeated.

<comment><USER2> I'm not sure if you understood what I was saying because the window title would remain the same (i.e. the browser). You would just be clicking inside and outside of a textbox within the same browser.

As for taking a screenshot - that wouldn't help either with something meaningful like a password. Not to mention that doing screenshots totally changes the dynamic of a "key logger" and exponentially raises the amount of storage needed and makes it even more difficult to glean useful data from it.

I think you're trying to stretch to make this countermeasure "easily defeated" when it really isn't.

</comment></comment></comment><comment><USER4> Well all the _best practices_ in the article, are ok, in 2006.

Nowadays there are many more treats, entry points (hint: browser setup and plugins), and more authentication methods than "passwords".

We have even evidences of major upstream compromises.

In resume: for me the article is a little bit short in scope.

<comment><USER3> This is meant for casual users. For power users, the advice would be "never use a computer again because you can trust NOTHING EVER".

<comment><USER4> OK.

But that you cannot defend yourself of NSA, until you're in an enemy country or something like, does not mean, that you cannot protect yourself against all the rest of the world.

Using a master password, implies the clipboard (on average). Does anybody trust desktop browsing over linux, assuming that clipboard usage on Xorg is in some way _safe_? it's convenient, but not safe.

If I try to tell best-practices to a user of mine, I try to group all my experience and knowledge, before compile to user slang.

Even if for casual users, short in scope (for my personal taste).

And maybe too many prose, a more direct style maybe better to stamp on the user mind a list of best practices.

<comment><USER3> What are your best practices?

<comment><USER4> 0) Do not publish your best practices

1) ...

:-)

If you want a more serious response, at least, talk to the user about attacks that remains exposed, and keywords to the solution, if I resume too much.

<comment><USER3> Well, that certainly is better advice than mine! :P

</comment></comment></comment></comment></comment></comment><comment><USER5> Yeah, those 20-character long random strings are great until you have to type them into your iPhone. And type them again. And again. And again. With your browser window open on your desktop/laptop so you can read them from LastPass/1Password/Keepass.

<comment><USER6> That's why I use QR codes. And offline QR code generation.

</comment></comment><comment><USER7> Silent Circle's website is full of grammar errors and typos. The how-it-works videos don't tell you how it works and the videos are awfully cheesy.</comment>


2008 Git User's Survey - <AUTHOR> http://www.survs.com/survey?id=M3PIVU72&channel=2WXE4BVTW8

<comment><USER2> Question #1 should be: Do you have an hour?

<comment><USER3> That's quite an exaggeration. It only takes fifteen or twenty minutes, unless you write short essays whenever a textarea appears.

</comment></comment><comment><USER4> In case people were wondering, you can submit when ever you wish. I got through as much as I could afford to and left the rest blank. It still takes it.

</comment><comment><USER5> You can always skip some questions, which IIRC is stated upfront. Or if you don't mind it leaving a cookie you can submit partially filled survey, and return to it and fill the rest of it later (which was stated in the message after filling and submitting the survey).

</comment><comment><USER6> If you're thinking, 'Boy, to finish this I'm gonna need a cup of coffee, but those Git people will surely appreciate my finishing all 65 questions', stop right there.

"Your session has expired because you were inactive for more than an hour. You may return to your account."

<comment><USER5> This supposedly got corrected. Session cookie expiration is now 3 hours, and page uses JavaScript to keep cookie fresh, so it shouldn't timeout if you keep it open.

And you can always submit it, and go back to it later to fill the rest.

</comment></comment><comment><USER7> Same. I'm willing to spend five minutes not thirty.

If there are that many questions then they don't know what they are asking for and have no clue what to do with the data.

</comment><comment><USER8> Way too frickin' long. Got to 27, and saw a grand old table. Yeah, like I'm filling that one out.</comment>


What are some problems waiting to be solved? - <AUTHOR> I've been thinking about this question a whole lot and have discovered I live in an extremely sheltered world. In my world I really have no problems. I have a great job, wife, food on the table etc. Just wondering, are there any problems left to be solved besides the huge problems like world hunger and world peace? <comment><USER2> Most adults have to spend half their waking hours doing work they don't like. If they lose their job they starve, lose their homes and medical care.

It's getting very hard to live in great cities like SF and NYC on a middle class income. People waste hundreds of hours a year commuting.

Most computers are pwned most of the time. Anything you connect to the internet can be read by determined bad actors.

Burning fossil fuels will probably cause a climate disaster that will put great cities underwater and create food shortages.

Chemicals in our environment are subtly affecting human brains, and catastrophically affecting certain animals like bees and frogs.

Most items in your grocery store are bad for you.

Politics is getting more extreme and divisive. Few politicians even talk about what policies would be best for the people.

One might have thought that everyone having access to all the world's information through pocket supercomputers would make the world smarter. But clickbait journalism, advertising and gamification are filling people's minds with crap and destroying their ability to focus.

Solving 1% of any of these would be a great achievement.

</comment><comment><USER3> How to deal with plastic waste?

How do we deal with waste in general?

Antibiotic resistance, antibiotics are losing their effectiveness.

Information overload, how can we sort the gems from a pile of coal - metaphorically speaking.

100 years from now, no one will be able to read digital data without its original physical format being available. How difficult is it to read a floppy drive now?

Ditto for encrypted data, everyone wants to encrypt their data now but what happens when historians want to understand our current times?

Replacement for petroleum, it's limited yet it's used all over the place in society.

There's so many more but that's enough for now.

</comment><comment><USER4> Here's two good, basic ones:

Access to clean, safe drinking water -- including purifying non-potable water at a variety of scales; and delivery, storage; +1 for overpopulated, or money- poor, or resource-poor, or remote areas.

Access to proper sanitation, including safely handling and treating sewage, much like the point above.

Both of these are unsolved in many places that have cell phones, electricity, refrigeration. While it may seem paradoxical, those comforts were easier to solve than water and sewage.

</comment><comment><USER5> The world hunger problem is mostly solved [0] and the world is mostly peaceful [1].

[0] [https://ourworldindata.org/hunger-and- undernourishment/](https://ourworldindata.org/hunger-and-undernourishment/)

[1] [https://ourworldindata.org/war-and-peace- after-1945/](https://ourworldindata.org/war-and-peace-after-1945/)

</comment><comment><USER6> ReactOS is trying to make a Windows type OS and needs developers and donations.

HakuOS is a BEOS clone.

AROS is and AmigaOS clone.

OSFree is an OS/2 clone.

Nobody has solved how to make a free or open source operating system that uses apps and drivers from the original.

Having FOSS alternatives to those OSes is just as important that *BSD Unix, Linux, and MacOS are alternatives to Unix that can run Unix apps due to the API.

There are always problems to be solved like getting everyone solar panels on their house to fight climate change and cut down on their electric bill.

Ask SpaceX why one of their rockets blew up recently. Someone needs to solve that problem too.</comment>


Andrew 'Weev' Auernheimer Faces Jail - <AUTHOR> http://www.businessinsider.com/andrew-weev-auernheimer-att-ipad-hacker-sentencing-2013-3 <comment><USER2> I wonder how he would be treated if he had picked up a stack of paper printouts an AT&T employee had left on a park bench and taken it to a news outlet in order to showcase AT&T's recklessness with customer information? Would Aaron Swartz's case have been handled the same way if he'd gone into a library and photocopied a whole heap of journal articles? The powers that be seem terrified that someone might use technology in a way which they can't control. Apart from the disgusting human rights abuse that these cases illustrate, I worry about the future when people like judges and prosecutors think it's at all fair or reasonable to put people in jail for freely accessing information.

</comment><comment><USER3> It blows my mind that someone could get 10 years for idempotent operations on what was essentially a public API. Put in any other context than "scary computer hacking", it would be obvious to most people that the insecure system was at least as much to blame as this kid.

<comment><USER4> Firstly, the laws around this sort of thing are _very_ stupid. But with that said...I'm not wholly sympathetic here.

The disclosure was _totally botched_. The IRC logs that came out during the case showed that Andrew and Dan (Spitler) talked about shorting AT&T stock (they ended up not doing this, but it's not the sort of thing you talk about), and going directly to news organisations, bypassing AT&T. They also considered (perhaps jokingly, but again, not something you joke about) selling the e-mail addresses to spammers.

Andrew also initially told Gawker he'd disclosed to AT&T, when in fact he hadn't (Ars has a good summary here[1]).

I am definitely not saying that a ten year sentence is warranted, or that any sort of custodial sentence is appropriate. In fact, I doubt he'll be given 10 years, more like 2-4 (since his fellow defendant, who plead guilty, got 12-18 months). But I do think the disclosure was handled really, really badly. I've found and disclosed very similar vulnerabilities - I would not leak the entire database out. That's just crazy.

Again, it's the old black/grey/white hat argument again. But to go public without _even informing_ AT&T doesn't endear him to me.

[1]: [http://arstechnica.com/apple/2011/01/goatse-security- trolls-...](http://arstechnica.com/apple/2011/01/goatse-security-trolls-were- after-max-lols-in-att-ipad-hack/)

<comment><USER5> I totally agree with you. They don't hand out 10 years for nothing. It is a little harsh though.

<comment><USER6> _They don't hand out 10 years for nothing._

LOL. If you mean literally nothing than no. But the war on poverty, war on drugs, and 3-strikes means the US justice system is handing out long sentences for black and hispanic males 3x the rate of white criminals.

</comment></comment></comment></comment><comment><USER7> Every piece I read about him made me like him less.

But despite my deep feelings of antipathy the charges that are brought against him can NEVER warrant 10 years of prison.

That's ridiculous.

<comment><USER4> In many countries simply _accessing a public server without consent_ is illegal. Here in the UK the Computer Misuse Act contains the following gem:

> _It is an offense to make a computer perform a function and for that > function to be deemed unauthorised by the owner of that computer_

This is fantastically broad. I believe it's similar in the US. It's led to convictions for things like directory traversal, XSS testing, and even people looking for vulnerabilities with good intentions. If you're doing stuff like this, _be aware of the risk_. Some companies are very good about it (Facebook, Google, etc). Others take a far dimmer, litigious view (AT&T?).

These are not laws that are taught in a civics class. I think it's important that until the laws can be changed (and they definitely _should_ be changed) that people in this field know the risks, and weigh them up accordingly.

I agree with you that Andrew's approach is quite...antagonistic. I wouldn't, for example, go on the record saying I think "a sane society would lynch [...] Carmen Ortiz". Personally, I'm not in favour of public lynchings. This isn't going to endear you to the court, or to those who could help change the law for the better.

<comment><USER8> > _In many countries simply accessing a public server without consent is > illegal_

1) Set up a public server

2) Wait for google bot to show up

3) Press charges against google

4) Sue in civil court

5) Profit.

<comment><USER9> And in some countries you can only sue on the basis of an actual loss so as you haven't lost anything you have nothing to sue for...

<comment><USER10> There was a case where a search spider deleted all content from a database by following delete links. Would that count?

</comment></comment></comment></comment></comment><comment><USER11> This sucks. weev is an asshole and troll, but he's also a friend, and he hasn't done anything a lot of other people don't do routinely. I hope he gets a suspended sentence, but I think the 50/50 is he'll get ~3 years in total, served at least 1.5y in a federal prison.

</comment><comment><USER12> "In 2010, Auernheimer and a compatriot, Daniel Spitler, discovered that visiting an unsecured AT&T Web server and entering a number associated with the customer's wireless account allowed him to obtain that customer's email address.

By altering the number and repeatedly querying the server, Auernheimer and Spitler were able to obtain hundreds of thousands of email addresses, which they then released to Gawker."

===

Amazing that something as simple as that landed him 10 years. This is something even I have done with some servers for telecoms in my country. And trust me, I'm no hacker. I just know basic HTTP GET request parameters, and what asshole doesn't know about those?

The laws in the US are terrible.

<comment><USER13> Testing car door handles in a full parking lot is amazingly simple too. Does that mean it's okay to look through any unlocked cars' glove compartments to collect personal information of the owners?

Auernheimer crossed a line. The punishment seems excessive, but then again I don't know all the details of what he tried to do with the data.

The fact that he obtusely refuses to recognize that he crossed a line doesn't exactly make me feel sorry for him.

<comment><USER14> If you have a lot full of unlocked cars, perhaps you should bear some of the blame too?

When Sony was hacked and user data was leaked, they received quite a bit of blame. At least they had some semblance of security. AT&T was wide open.

<comment><USER15> "But your honor! SHE WAS ASKING FOR IT! You can see how she dresses."

<comment><USER14> You've missed my point. If you were in a parking lot and found your car to be unlocked, this might alarm you. You might try someone else's door to see if it's similarly unlocked, and just to be sure it's not a fluke, you might try another.

I'm not even going to try to adapt that to your rape scenario. I feel like there should be an equivalent of Godwin's law that I could appeal to in this context.

<comment><USER13> You paint far too innocent a picture of what happened. If we're going to use analogy, can't we make an effort to have it be accurate?

Let's roll with your scenario -- Do you systematically go through all the cars in the lot? Do you collect personal information from those cars, like names on the insurance? Do you get busted making on-the-record comments about exploiting the use of that data for your own personal gain?

Seriously, weev was hardly being a good samaritan. He was doing something he shouldn't have been doing, made some stupid/incriminating comments in a public forum, then didn't handle the data properly. Worst of all, he's facing serious jail time and is too obnoxious to even admit that what he did might have been inappropriate.

Personally, I'm all for living in a world where you can leave your car door unlocked and not be blamed when someone opens the door. Call it a Godwin-esque move if you want, but I'm just not into blaming victims.

</comment></comment></comment></comment></comment></comment><comment><USER16> It seems to that the real villain is AT&T, for making this private data entrusted to its care freely available to the public. What criminal and civil liabilities will it face?

<comment><USER13> That's disingenuous. "Freely available" implies that AT&T desired to give this data away or advertised it knowingly. Clearly they didn't.

What Auernheimer did, with intent, was to bypass AT&T's intended use of the system.

What AT&T did was incompetent or perhaps even negligent by a reasonable notion of corporate coding standards. You'd need to dig a bit more to learn how systemic the incompetence/negligence was before attempting to sign appropriate blame, though. Maybe some contractor got into the system and made the change that made that exploit possible the day before and deployed it without following AT&T release guidelines. I dunno. Knowing that kind of info matters, though.

Let's not twist the facts of what happened in order to justify different outcomes.

<comment><USER16> Disagreed. The facts are indeed that AT&T made this freely available... my definition of making something available is that it is readily available for the taking, whether I desired to give it away or not. If I leave my front door open due to negligence, I probably don't desire to be burglarized, but it is true to say that I have made my house contents freely available. If my house contents include a laptop full of people's private data, then I think it's reasonable I should face some penalties.

As to your other point, AT&T is responsible for the actions of its contractors as well as for its full-time employees.

<comment><USER13> For anyone with a little knowledge about locks and basic tools, no conventional door lock prevents entry. So by your logic, nearly all house contents are freely available.

Regarding AT&T, it's not a question of responsibility - it's a question of a level of fault that is negligent. At some level, it's your responsibility because you gave AT&T your data, right? At some level, it's your responsibility because you have an email address, right?

Without a detailed assessment of many factors, just throwing out there that AT&T is negligent seems to be fairly irresponsible.

<comment><USER16> Nah. If I give any website my email address, I have a reasonable expectation it won't be published on that website in a public manner ripe for harvesting. Unless of course the Ts&Cs I'm signing explicitly say it will (somewhere prominent, preferably in bold red with flashing letters).

</comment></comment></comment></comment></comment><comment><USER17> Here is a very good lecture on the state of cyber crime law. I recommend it to everyone in this community. Things are crazier than you are probably aware.

<https://www.youtube.com/watch?v=q0Z_z4EHq6M>

</comment><comment><USER18> This website just showed a full page advertisement, then kicked me back to their home page when I clicked the continue button. Monumentally useless.

</comment><comment><USER19> i love weev and i had a blast trolling with him back in the day but he's nothing like swartz. the biggest split being that swartz had good intentions whereas weev was having fun.

i don't think he should be imprisoned for exploring at&t's god awful security but i also don't think he should be worshipped.

</comment><comment><USER20> What exactly was he found guilty of?

<comment><USER21> "Andrew Auernheimer, 26, of Fayetteville, Arkansas, was found guilty in federal court in New Jersey of one count of identity fraud and one count of conspiracy to access a computer without authorization." [1]

Those were the charges. Ridiculous in my opinion.

[1] [http://www.wired.com/threatlevel/2012/11/att-hacker-found- gu...](http://www.wired.com/threatlevel/2012/11/att-hacker-found-guilty/)

<comment><USER20> What is AT&T guilty of? Is it now legal to publish personal information without any authentication?

<comment><USER21> I just listed the charges, I didn't say I agreed with them. And I didn't say anything about AT&T.

It seems clear that AT&T failed to protect their customer's personal details. Whether that makes them criminally liable depends on US law, about which I know almost nothing. This [1] article seems to imply that it is fairly weak compared to European data protection laws, so it may be that AT&T did nothing wrong in a strict legal sense.

While its tempting to think that he was just made an example of for embarrassing a corporation, he did write a script to harvest 120,000 email addresses from the AT&T server. I'd say that constitutes criminal intent, even if he had no intention of using the addresses for a criminal purpose.

There are two problems here: 1. absent or weak data protection laws, and 2. disproportionate sentencing guidelines (up 10 years) for what in this case is basically a victimless crime.

[1] [http://www.nytimes.com/2013/02/03/technology/consumer- data-p...](http://www.nytimes.com/2013/02/03/technology/consumer-data- protection-laws-an-ocean-apart.html?_r=0)

<comment><USER22> "While its tempting to think that he was just made an example of for embarrassing a corporation, he did write a script to harvest 120,000 email addresses from the AT&T server. I'd say that constitutes criminal intent, even if he had no intention of using the addresses for a criminal purpose."

Criminal intent...to do what exactly? Email people? Was he planning to send them spam?

Why are we punishing someone who writes a script? Do we really want to live in a society where programming your own computer is a crime?

<comment><USER21> _"Criminal intent...to do what exactly?"_

Intent to commit a criminal act: "conspiracy to access a computer without authorization". If he'd just accessed a few accounts then that could be attributed to user error or a technical fault, if anyone ever even noticed. Put what he did shows persistent intent to do something which is illegal in the US, even if he wasn't aware of the illegality.

Look, I agree with you. Jailing this guy is manifestly absurd, stupid, and cruel. I was just trying to explain who other people, who may hold differing opinions to you and I and happen to write the law, might see things. Doesn't mean I agree.

<comment><USER23> That's circular reasoning. We started with, "he accessed a computer". Then we asked, "what was his criminal intent in accessing that computer?" You can't answer, "to access that computer."

 _If_ he had sold the data to the Russians, _that_ would have been the criminal intent we're seeking.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Yeah this is ludicrous. AFAICT, AT&T effectively published this information to the web, this guy just pointed out where it was.

Not a crime.

<comment><USER25> Didn't he try to extort money out of them after spidering all the information?

<comment><USER26> He talked about it, but I don't think that actually happened. The chat log was used against him at the trial anyway.

<comment><USER4> He was charged with conspiracy, so it's relevant that it was discussed. Conspiracy usually requires discussion of the intended crime, and then at least one party to commit an act that furthers that crime. It doesn't actually require the crime itself to be committed.

</comment></comment></comment></comment><comment><USER27> When everyone is a criminal all the time, with selective enforcement, it makes it easier to tax and control. When political winds shift, you can eliminate anybody you want, because you just make an excel spreadsheet of political enemies and then forward it by email to law enforcement for increased survallence, and whamo, felony convictions, how much you want? 1 year? 5 years? 10 years?

The government is just trying to maintain its power over the people, when federal reserve realizes there is no other alternative except to default on the US treasury, there is going to be a lot of unrest, and the internet will be a focus point of governmental rebellion, it's important everyone who accesses the internet is a felon. Especially the coders, like this one, who will be making the rebellion possible.

You got to put the fear in them. We may be the ones, like our founding fathers, who have to write up a new constitution, bill of rights, and spawn a new nation to break away from the defective one. Like the good men of old time broke away from Britain. The battlefield this time around will not be on the shores of Boston, the battlefield will be software, servers, clicks, and smart phones.

As with all battlefields, the side who wins is the one who prepares the most. This is why we are cracking down on website clicking by programmers, rather than cracking down on governmental corruption.

<comment><USER28> I guess you must live in China. Here where I live, the government is made up of ordinary people who are also subject to the law, and we can vote to change the law whenever and however we want.

<comment><USER29> Just out of curiosity, where do you live?

<comment><USER28> The UK, but my answer would equally well apply to the US or the majority of democratic nations. There's not a Big Conspiracy. There's just lots of people, often stupid and ill-informed, but nevertheless people voting for what we want.

<comment><USER22> "There's just lots of people, often stupid and ill-informed, but nevertheless people voting for what we want."

How exactly do you think uninformed people are voting for what they want? The USA is a country where people are _surprised_ by what is illegal.

<comment><USER28> Firstly, it is possible to go out and inform people. Best to get off HN and out of the house, because only a tiny number of pretty intelligent people use HN and all of us have similar backgrounds and beliefs.

Secondly, although I think HN-readers would make great voters on subjects we care about, eg. how the Internet should be regulated, yet I'm sure _we'd_ be mostly stupid and ill-informed about things that we don't know or care about, eg. farming regulations, or sickness benefits for elderly mentally-ill patients, or a thousand other specialized subjects.

<comment><USER22> "yet I'm sure we'd be mostly stupid and ill-informed about things that we don't know or care about"

That is not the issue. The issue is whether or not we are _expected_ to follow laws that we know nothing about, particularly since ignorance of the law is not considered a valid defense in this country. If you are not running a farm, you are not expected to adhere to farming regulations and you could not violate those regulations. On the other hand, if you _use_ a computer -- and the majority of US citizens do -- you _are_ expected to abide by computer laws.

Right now, there are a lot of laws that _everyone_ is expected to follow but that few people are aware of. Most Virginia residents had no idea that opposite-sex cohabitation was illegal when that law was repealed -- millions of people in that state could have faced prosecution for a law they were never aware of (and in the 90s a woman was threatened with prosecution as part of an attempt to shut down her business). Typically, the police are unaware of these laws and so most people will never be arrested even if they are in violation. On the other hand, when the government _wants_ to prosecute someone (e.g. Alexander Shulgin), all they need to do is look hard enough to find a law the person violated. Sometimes the government seeks nothing more than to set a precedent (Aaron Swartz) that would allow them to prosecute others. That is where the real danger lies: the government is limited not by the lack of criminal laws but by its own inefficiency in searching the legal code.

Most people are entirely unaware of this situation and believe that as long as they are not harming anyone they are safe. It is hard to raise awareness, because most people do not see anyone being prosecuted in this way, and even when they see it they usually have a hard time feeling sympathy for the defendant (e.g. Lori Drew). After all, who can feel sorry for someone who collects this sort of artwork:

[http://www.japanator.com/man-arrested-for-manga- collection-t...](http://www.japanator.com/man-arrested-for-manga-collection- the-comic-book-legal-defense-fund-will-take-the-case--8753.phtml)</comment></comment></comment></comment></comment></comment></comment>


Happiness proportional to income? One redditor's thoughts - <AUTHOR> http://www.reddit.com/r/AskReddit/comments/f3bca/youre_in_your_twenties_youve_been_offered_100/c1d0fph

<comment><USER2> I don't think he would appreciate being 26 years old and making $100 a week again. I think perhaps his feeling of emptiness is not due to his possessions, but due to a lack of passion: he probably needs a more interesting job. I would definitely rather have money then not have money, if the rest of the variables (health, relationships, job fulfillment) are the same.</comment>


The "Growth Mindset" theory – and the harmful lessons it imparts - <AUTHOR> http://www.salon.com/2015/08/16/the_education_fad_thats_hurting_our_kids_what_you_need_to_know_about_growth_mindset_theory_and_the_harmful_lessons_it_imparts/

<comment><USER2> Perhaps a nitpick, but:

 _' Social psychologists use the term "fundamental attribution error" to mean paying so much attention to personality and attitudes that we overlook how profoundly the social environment affects what we do and who we are.'_

"Fundamental attribution error" refers to our tendency to underweight environment _when considering the actions of others._

</comment><comment><USER3> Let me state first that I practice the Growth Mindset with my kids. But this is such a small part of what it takes to motivate people to maximize their ability to learn and grow.

The article seems to imply the all or none nature of the latest fad (my word) in education.</comment>