Google Cloud Global Loadbalancer Outage - brian-armstrong https://status.cloud.google.com/incident/cloud-networking/18012 <comment><AUTHOR> Why can't Google just use UTC timestamps? Or at least include them alongside their "US/Pacific" timestamps.

I don't want to remember if "US/Pacific" currently has daylight savings or not.

Its a very strange decision especially considering that GCP has numerous regions outside of "US/Pacific".

<comment><USER2> Just another case of their idiotic culture leaking into their products. An early "design" decision led to all their production kit being set to US/Pacific, triggering frequent DST bugs, and last I heard (many years ago) it was still the case.

Coordinating a tz change over a network of that size is probably infeasible, so may as well push the pain on to customers

<comment><USER3> "Idiotic culture" is a bit harsh.

<comment><USER2> You clearly haven't spent much time with App Engine

</comment></comment></comment></comment><comment><USER4> The global load balancer is one of the best offerings from GCP but we are always concerned about the single point of failure it causes.

Unfortunately this isn't the first time it's broken and it's starting to look like a bad choice. We use a CDN in front so were able to switch traffic around but it seems it's better to do the load balancing ourselves too instead of using GLB.

<comment><USER5> Any load balancer is always a single point of failure. This is why lots of folks go multi-cloud.

You should also be looking at multi-CDN.

<comment><USER6> I have yet to read solid case studies of real multi-cloud at scale. E.g. Active-Active load-balanced between multiple providers. Plenty of companies use multiple clouds, but, it tends to be a line of business decision. Team A likes AWS, Team B like Azure etc.

<comment><USER7> It's fairly common. No need to call it multi cloud, companies have had multiple datacenters in multiple countries for a long time.

The only challenge is that you need global geographic load balancers and that means F5 and at least a million dollar.

Also, you will find out later that some dependencies were only running in a single location and services failed with the datacenter.

<comment><USER8> I think that's quite an exaggeration - there are quite a few DNS providers who can do intelligent DNS LB for you and don't care what your backend is (gcp/AWS/azure/onprem). Won't even cost you a million bucks.

</comment></comment></comment></comment></comment><comment><USER9> Grrr. So much for global redundancy.

What is going to be faster? Updating DNS records with TTL 3600 to point to a single data center or Google fixing their problem.

We host DNS at AWS, but servers in GCP. Should we use AWS's automatic DNS failover feature to cover for such a case?

<comment><USER10> AWS engineer here, I was lead for Route 53.

We generally use 60 second TTLs, and as low as 10 seconds is very common. There's a lot of myth out there about upstream DNS resolvers not honoring low TTLs, but we find that it's very reliable. We actually see faster convergence times with DNS failover than using BGP/IP Anycast. That's probably because DNS TTLs decrement concurrently on every resolver with the record, but BGP advertisements have to propagate serially network-by-network. The way DNS failover works is that the health checks are integrated directly with the Route 53 name servers. In fact every name server is checking the latest healthiness status every single time it gets a query. Those statuses are basically a bitset, being updated /all/ of the time. The system doesn't "care" or "know" how many health status change each time, it's not delta-based. That's made it very very reliable over the years. We use it ourselves for everything.

Of course the downside of low TTLs is more queries, and we charge by the query unless you ALIAS to an ELB, S3, or CloudFront (then the cost of the queries is on us).

<comment><USER9> Interesting, thank you. So a potential mitigation strategy could look like this:

\- Route 53 failover record * primary record: Google global load balancer IP * secondary record: Route 53 Geolocation set (really need that latency) \- Elastic Load balancer record per region * routes to mirror region GCP IP address (ELB's application load balancer seems to able to point to AWS external IPs) * optionally spin up mirror infrastructure in AWS

Seems brittle. Does Azure support global load balancing with external IPs?

Does anyone have such (or similar) setup actually in production? How did it work today?

<comment><USER11> I haven't been able to make an ELB target be an external IP. What did you mean by "ELB's application load balancer seems to able to point to AWS external IPs"?

<comment><USER9> [https://aws.amazon.com/elasticloadbalancing/details/#details](https://aws.amazon.com/elasticloadbalancing/details/#details)

IP addresses as Targets You can load balance any application hosted in AWS or on-premises using IP addresses of the application backends as targets. This allows load balancing to an application backend hosted on any IP address and any interface on an instance. You can also use IP addresses as targets to load balance applications hosted in on-premises locations (over a Direct Connect or VPN connection), peered VPCs and EC2-Classic (using ClassicLink). The ability to load balance across AWS and on-prem resources helps you migrate-to-cloud, burst-to-cloud or failover-to-cloud.

Looks like you need an active VPN connection to access external IPs.

<comment><USER12> That feature requires you to use a private IP address, so if you have a VPN or Direct Connect to another location you could load balance across locations. In the case of the global load balancers those will be public addresses though.

"The IP addresses that you register must be from the subnets of the VPC for the target group, the RFC 1918 range (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16), and the RFC 6598 range (126.96.36.199/10). You cannot register publicly routable IP addresses."

[1] [https://docs.aws.amazon.com/elasticloadbalancing/latest/netw...](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/target- group-register-targets.html)

</comment></comment></comment></comment></comment></comment><comment><USER13> Our services have just become available again, initial downtime starting at 20:25 GMT, uptime returning at 20:56 GMT

EDIT: App Engine and Kubernetes environments in our EU region appeared to go down, Compute Engine was okay.

</comment><comment><USER14> This has been causing issues for us for the last couple of hours. We migrated a web application over to GAE last month. It's been rock solid and this is the first issue we've had. Happy to know we can sit back and let them sort it out.

</comment><comment> EZ-E Still having issues as of 20:20 UTC - Firebase Database messages not beeing delivered to client. It's been a full hour so far. The delivery rate also had a minor drop earlier around 03:00AM to 05:00AM but no incident had been listed.

</comment><comment><USER15> I suspect this is what caused the technical difficulties with HQ Trivia.

</comment><comment><USER16> Could have sworn I was going crazy last night; was attempting to write a scraper to download attachments / tickets from pivotal tracker for a yearly accounting report. Everything was working fine, then suddenly not. At around 2am I gave up and just put it down to the 'gods' telling me to go to bed.

This was the first article I saw after I woke up, somewhat refreshed. /feeling-vindicated

<comment><USER17> Wow, 2 AM, some persistence. But as someone who's very sensitive to sleep deprivation (I get violently ill if I don't sleep well for more than 2 days in a row), I insist not making it a habit. Especially if you are in your 30s, it has bad after effects. PM for more info.

<comment><USER18> Can't PM with no contact info in your profile - email is not public - this is HackerNews.

</comment></comment></comment><comment><USER19> It's interesting and scary, mostly scary, that we now are almost at the point where Google going down equals the Internet going down.

<comment><USER20> To be honest, I hadn't even noticed. What popular sites went down?

<comment><USER19> If you check the other comments you'll see that Spotify, Snapchat, Discord etc. were all affected. We're not talking about "sites" but any application _or_ site built on Google's infrastructure, even partly.

<comment><USER21> Not "every application," just applications making use of the GLB or services built upon it.

</comment></comment></comment></comment><comment><USER22> Apparently snapchat, spotify and some game servers affected too.

<comment><USER23> Definitely noticed the issues on SnapChat.

</comment></comment><comment><USER24> Is there an easy way to see what cloud based resources sites are using? For instance, PushBullet is down now and this might explain why. Several other sites affected, too.

<comment><USER25> generally lookup the IPs (dig <hostname>) and then attempt a host/whois on that IP. For PushBullet it's hidden by CloudFlare so hard to see easily, you should try and find an exposed endpoint (which they haven't if they've done well).

<comment><USER26> My Chrome extension (IPvFoo) displays all the subresource IP addresses in a table:

[https://chrome.google.com/webstore/detail/ipvfoo/ecanpcehffn...](https://chrome.google.com/webstore/detail/ipvfoo/ecanpcehffngcegjmadlcijfolapggal)

(There's a right-click option to look up each address on bgp.he.net, but that doesn't happen automatically, for privacy.)

</comment></comment></comment><comment><USER27> I got a Could not connect to POP server 'pop.gmail.com:995' (SSL=ssl): SSL connect attempt failed because of handshake problems

</comment><comment><USER28> Is there a single cloud that can match uptime of a single top tier DC?

<comment><USER29> Uhm, no, because a cloud service spans over several data centers and features a lot more moving parts than just a solid data center.

Let's turn this around: could a typical data center + server uptime + service uptime equal that of a major cloud provider?

<comment><USER28> In my experience yes but too few data points.

</comment></comment></comment><comment><USER30> Yup, discord impacted for me

<comment><USER31> Yes, yes we are.

<comment><USER30> time to spread resources across clouds? or would that be too expensive?

<comment><USER25> this one appears to be just global LBs, so a load balancer in AWS/Azure that hits the actual backends over a VPN or something would have worked, but that's just this case

<comment><USER32> Even Google Cloud's non-global load balancers, which live within a single region, wouldn't have hit this particular outage.

<comment><USER33> jep we had non-global lb's in europe-west-3 and i could not sense any outage.

</comment></comment></comment></comment></comment></comment><comment><USER34> I sure wish we hosted on AWS today. Work sucked big time.

</comment><comment><USER35> Something no one has mentioned yet, could it be that the engineering force at Google is no longer what it used to be?

<comment><USER29> Because of one data point? Seriously?

<comment><USER36> I think OP was jovially referring to a similar comment regarding Amazon because of their recent Prime day outage.</comment></comment></comment>


Ask HN: Microsoft acquisition goes beyond GitHub (the platform) - <AUTHOR> …it also affects Atom! (the text editor)
Finding an alternative to GitHub is easy-peasy. An alternative to Atom may not be so easy.
Several years ago Oracle got hold of MySQL and Open Office. Two popular projects. Whilst MySQL kept on going Open Office got the brakes on. The latter was kept alive by the Libre Office fork.
Microsoft will now own two popular text editors, Atom and Visual Studio Code. Will it keep both of them? Will they be merged? Will any of them be discontinued?
VS Code is now freely available for commercial use. (I don't think it was always the case.) With the recent turn of events maybe VS Code will go back (?) to non-free whilst Atom remains free but with less features.
Who knows? <comment><USER2> _Microsoft will now own two popular text editors, Atom and Visual Studio Code._

Atom is an open collaboration between Facebook and Github. That hasn't changed. Microsoft could insist that Github withdraw from the project, but that's very unlikely. Regardless, Atom isn't going anywhere.</comment>


Hynix Announces $100 Mil. Investment to Upgrade Eugene, Oregon Facility (2003) - <AUTHOR> http://www.skhynix.com/eng/pr/pressReleaseView.do?seq=1074&offset= <comment><AUTHOR> The anti-dumping duties was imposed just after this I think.</comment>


Ask HN: Email Software for the Enterprise - <AUTHOR>

Email overload is a nightmare. Corporate email software (e.g. MS Exchange-Outlook) does a mediocre job of organizing large volumes of email. I have an idea for creating an email server-client suite that would automatically organize your email. But even if I create something that beats Exchange-Outlook hands down, most large companies probably won't buy their email software from a young startup. And a small company won't have much of an email overload problem.
My current plan is to sell to startups, and hope that some of these will grow to be large companies, and thus large customers. Once I have a few major customers, my startup will have the legitimacy to be able to sell software to the likes of GE. Any thoughts on this plan?
Has anyone here been successful in selling software to enterprise customers? If yes, how did you overcome the 'startup legitimacy' issue?
Is there anyone here who works in the IT department for a medium or large sized company, and has bought software from a startup? What would be your major concerns about buying software from a startup?
Thanks in advance for any feedback.
PS: I have already thought about creating email software for the consumer market, but my ideas about self-organizing email would work much better in the context of corporate email. <comment><USER2> I think your idea is doomed, even if you achieve technical nirvana in email delivery. Here's why:

1\. You will not beat MS in the exchange market. "Everyone" uses office, therefore everyone has the outlook client, it's a short hop to installing Exchange, and it can scale right up to enterprise size adequately enough that you'll never be able to touch it. You can see how IBM and Novell have both been destroyed in this market if you're interested in the battle you face.

EDIT: Corporations will not even talk to you, because honestly, email is a problem that is already solved for 99% of them. Additionally, if they're big, it is much easier for them to just go with the flow and use the common system - no one ever got fired for buying IBM, and no one ever got fired for using exchange. Look at Symantec, many people have them beat in the AV game, but they own the mid level market.

2\. On the startup end, you're competing with free software and hosted solutions. If startups aren't comfortable with gmail or similar, odds are they just stick with their domain host's offering and use the local client of their choice.

I suppose there could be a very real market for a hosted email service that gives the flexibility of gmail with the comfort of a paid, secure service. I think though that it would be very difficult to firstly find this market, and second present an offering that is tempting enough for them to switch.

Honestly, don't waste your time on this one... the work required just to meet the minimum expectations is so vast it isn't worth it.

<comment><AUTHOR> Thanks for your comments.

Companies like Zimbra and PostPath have achieved some success in competing with MS Exchange. Why do you think building an email server like Exchange is too much of a technical challenge?

Also, my idea is not to build yet another email delivery solution, you are right that problem is 99% solved. But an office worker receives literally thousands (counting mailing lists) of emails a day. Even with folders and rules, there is a lot of human effort required to sort through all this email. That seems like a real pain point to me.

<comment><USER2> I wasn't suggesting that it was a technical issue at all really. It would be a difficult task, but certainly not out of reach for many people I know, so I wouldn't suggest that it would be out of your reach either.

The problem would be selling it.

The issue with your second observation is that while it is true, the work is distributed, thus isn't a source of pain to the company - they entity you're trying to sell to.

There are plenty of GTD tools out there, but this doesn't have anything to do with email.</comment></comment></comment>


Static websites: discount hosting in the Cloud - <AUTHOR> http://cloudacademy.com/blog/static-websites/?utm_source=hn.com&utm_medium=social&utm_campaign=Blogpost

<comment><USER2> I recently started using www.netlify.com for this, $9 plan allows custom domain + ssl, and it can build your site for you from w/e tooling you use.

It's an interesting approach and one I'm hoping will play really nicely at scale with a cleanly separated static front end on top of an API hosted elsewhere.</comment>


YouTube Ditches Flash, and It Hardly Matters - <AUTHOR> https://www.eff.org/deeplinks/2015/01/new-drm-boss-same-old-boss <comment><USER2> One thing to note is that (last I heard) both Chrome and Firefox sandbox EME modules fairly tightly. Flash is a browser plugin, which means that it usually injects code into the browser itself, and runs with full privileges on your computer, just as much as your browser does. This is what makes Flash such fertile ground for exploits of all kinds, and also makes it bad for your privacy because it has direct access to your webcam, microphone, clipboard, supercookies, etc. — anything the browser can do, Flash can do without asking. If it asks, it's out of the kindness of its heart, not because the browser has any say.

Chrome and Firefox's sandboxes, meanwhile, are both open-source. You can inspect what powers the EME module might possibly have, and know that it can't gain any more. A vulnerability in the code is unlikely to be able to do anything other than pirate your download of _Game of Thrones_ — and that's assuming it even has general-purpose network access. Ideally, a vulnerability would be able to do nothing other than modify the video you see, but the remote site could achieve that by encoding a modified video in the first place.

As far as the general moral arguments about DRM go, it's true that the new boss is the same as the old boss. But the bulk of the EFF's argument against Flash in this blog post is about security, not about open content, and it's important to acknowledge that EME is a significant step forward. The new boss is sitting in a tightly locked cage.

<comment><USER3> Its more about freedom than security tho. Really if anything, EME is about security for vendors, not users. Really, not much to do with the fact that it's sandboxed. Its not like if proprietary, freedom-restricting software was suddenly ok because there's some kind of a sandbox around it.. as if the only issue with these was that they're poorly coded and supported.

<comment><USER4> No user is being forced into using this. I haven't really followed this argument from the beginning. Philosophically I despise DRM, but pragmatically as long as it isn't forced on users as _the only option_ , then I don't see any issue with an extension having that option being available.

<comment><USER5> It will be forced on the users, though. If it becomes widespread, the choices are to support DRM or be locked out of the web.

<comment><USER4> > If it becomes widespread, the choices are to support DRM or be locked out of > the web.

Or use a free and open source browser that doesn't implement it. If this is something people want to take a principled stance against, those browsers will doubtlessly continue to exist.

Unless you're referring the content access. That's a general trend with technology that likely won't be stopped. If you choose not to use certain technologies, it's unsurprising that you won't be granted access to certain things.

</comment></comment></comment></comment></comment><comment><USER6> And through all this effort to "protect their content", they still haven't managed to stop people from bypassing the DRM and giving the videos away for free in torrents.

I have a hard time seeing how implementing DRM provides any value to media companies, other than a false sense of security.

<comment><USER7> The purpose if DRM is _not_ to stop people from illegally copying. The purpose is to control and manipulate the _legal_ users and limit their freedoms they would otherwise legally.

Yes, DRM developers lie to us and _claim_ that this is about stopping infringement. But that's only a pretense. They know that it only impacts non- infringing users. But they like having more control and power over the non- infringing users.

See [http://www.defectivebydesign.org/faq#purpose](http://www.defectivebydesign.org/faq#purpose)

<comment><USER8> That is also the purpose of door locks btw, and I am assuming you have one of those on your door.

<comment><USER9> Wrong. DRM is a tool of the distributor against the user (remember: when you have a DVD, you don't own the content; you only have a license to view its content under certain rules. DRMs make sure you follow these rules).

The lock is a tool of the user against third-parties.

<comment><USER10> The analogous door lock on your computer is your firewall or USB autostart permissions or an encrypted hard drive.

</comment></comment></comment></comment></comment><comment><USER11> EFF's view is that we've been sold down the river with EME (Encrypted Media Extension).

Except ... that I seem to be able to access most online video content (certainly on YouTube, Vimeo, and other major sites) via youtube-dl.

And hugely prefer to do so. It's much more useful for me to be able to queue, speed up / slow down, pause, _resize_ and otherwise manipulate video _with consistent controls_ than to have the limited (and varied) interfaces various online video / multimedia sites offer.

I've got a video playing as I write this, well, paused, at 133% playback speed, in a small 250px x 190px window -- when I can give it my focus again I'll simply mouse over it and tap 'space' to resume playback. If I want to skip back a few seconds, or a minute, the left or down keyboard arrows do that for me. As they do for all video I play. I can also normalized audio levels (many are too low, this one's actually got a tendency to clip), and more.

<comment><USER12> If you are going to use unauthorized methods to gain content, there is many convenient ways to do so. Most are not effected by DRM.

The issue with DRM on video is one which lawful consumers of content has to deal with, and those who run programs which is infected by said DRM.

<comment><USER11> Um. Who elected you god and decided youtube-dl is "unauthorized"?

I was actually inquiring as to how such use is impacted by the decision. I've found few or none. Then again, there's little commercial content I've interest in regardless.

<comment><USER13> belorn probably figured the terms exclude it, I was curious and checked - seems so. Maybe they've authorized your method specifically somewhere though?

[http://www.youtube.com/t/terms](http://www.youtube.com/t/terms) You agree not to access Content through any technology or means other than the video playback pages of the Service itself, the Embeddable Player, or other explicitly authorized means YouTube may designate.

<comment><USER14> Yeah, well, I never confirmed the terms. "By using it, you agree …" is not a binding contract in Germany.

<comment><USER15> Nobody claimed it was a contract violation, or even illegal, just that it was not authorized by YouTube's TOS.

<comment><USER14> The first comment actually just said, that it was "unauthorized". By creating a website and making it available on the WWW, you implicitly authorize the user to use a browser to access the website. Which form of browser the user chooses is none of your business. All browsers are therefor always authorized, if you do not restrict the access yourself.

Of course some basic laws have been added since the birth of the web. You are not allowed to flood a site with requests and so on. But the principle that browsers and websites are separate entities still applies.

If you want full control over your users clients, create your own protocol and your own client. As long as you use open protocols on the web, you implicitly agree to the contracts of the www and have to live with the fact, that the user chooses his client.

<comment><USER12> In Sweden, there was a famous case in which this premise was tested. A cable channel gave out a public accessible web link to customers after payment, which then got naturally shared. The cable channel sued the person who shared the link, arguing that it was copyright infringement since it allowed unauthorized users to access the site (case called Canal Plus-fallet). The defense argued that since there was no restriction added to the site, that that meant it was public.

The court went with the side of the cable company, even if many commentates disagree. What effect a Swedish case can have on German law depend, but using European court case as guides is quite common in Swedish courts if there is no other prior cases. Same might apply for German courts.

<comment><USER14> That is unfortunate. I think from a technical point of view, my interpretation of the "laws of the web" are true. What courts decide is an other story.

It is part of the bigger problem, that courts do not understand every aspect of our complex society and have to listen to experts, which just defers to problem to the election of these experts. You do not want to give them the power either, because they are easier to lobby than justices.

I just hope, that a generation of justices and politician arises, that understands basic principles the web is built on. Like links, that give the web its name, and how they work, who can control them and so on.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> I distinctly remember being upset about DRM in the '00s, back when it was being used to place onerous restrictions on content that people had ostensibly "bought" (CDs, DVDs, AAC audio files, etc.). Now that it's being used to prevent people from saving streams... I hate to say this, but please remind me why I should be upset? I never had any illusion of "owning" a stream. Not only that, I would rather stream than own in most cases.

<comment><USER17> Because it's a lot harder to make a competing web browser now. You'll have to buy the secret binaries from one of the DRM providers, if they'd even be willing to sell.

<comment><USER2> Firefox, which is open source, both sandboxes the Adobe decryption module—giving the browser control over the world that the Adobe module sees—and fetches it at startup from Adobe's site. It seems almost impossible that you'd be unable to hit the same URL from your own browser and put it inside your own sandbox such that the module can't tell it's not running inside Firefox. You have the hard constraints that the module can't examine the outside world except through the sandbox, and the sandbox itself is open source.

Edited to add: Widevine, the (Google-owned) decryption module Chrome uses, has no license fees. [http://www.widevine.com/](http://www.widevine.com/)

<comment><USER18> As an actual example of the problem, there are millions of PowerPC Macs out in the world that run perfectly adequately with Linux and are capable of playing HD video. Is the opaque binary blob hardware-independent?

If it is then I can't even imagine what its purpose is supposed to be. If my "hardware" is a virtual machine that captures the video output to a file then the blob isn't even _doing_ anything. And if it's not hardware-independent then there are obviously going to be innumerable minority platforms that it doesn't support.

<comment><USER19> I think they have given up to prevent you from capturing the output. The binary blob does decryption and decoding in one step, which prevents you from replaying the compressed stream.

<comment><USER18> I don't understand how that is even supposed to be useful. The output is still digital HD video. The higher the quality of the video the fewer compression artifacts there are going to be and the less having to re-encode once will make any difference whatsoever. And it would only have to be re-encoded once regardless of how many times it's played back or copied subsequently. If they're hoping for some kind of VHS-style degradation of the video quality they obviously haven't actually tested it.

</comment></comment></comment></comment></comment></comment><comment><USER20> Somehow this reminds me of my long running rage against all things webapp and javascript. Companies have started using the browser as a substitute for an OS because it is easier to distribute working code to multiple platforms on a browser. So what do the drm people target now? The browser: aka operating system 2.0. And the thing that is scary is that people don't realize this and think "oh, its just W3C, its just a single program on my computer, they aren't really attacking general computation!" Spoilers: browsers act as virtual machines for probably 90% of all calculations that run on an average pc these days.

</comment><comment><USER21> Adobe got Flash (once one of their main products) wrong on the security side so many times that we can't even keep count anymore. Let alone the horribly bad performance of flash and the hack-slack way they added features. Why on earth would anyone want to trust this company to build another proprietary blob of their sub-par code into all browsers? They've proven to be incompetent in many attempts, let's not give them a 32nd chance.

</comment><comment><USER22> To be honest the W3C was between a rock and hard place here as all the other alternatives on the table were worse than this. If they had dug in we would have ended up with 2-3 proprietary DRM standards across the browsers or Flash would have lived on. Both are worse outcomes.

As for "the open web", nothing changes. Content that was DRM free will continue to be DRM free, content that wasn't DRM free will still remain DRM. If anything we are slightly better off as one more proprietary has bitten the dust.

As with a lot of things, the next steps aren't technical. Organizations like the EFF should be working with content providers to educate them on the benefits of being DRM free. A much harder task than firing off press releases.

<comment><USER23> > If they had dug in we would have ended up with 2-3 proprietary DRM standards > across the browsers or Flash would have lived on. Both are worse outcomes.

You're wrong about this. That is an excellent outcome. Large companies want the universal application that free software enjoys, but with none of the respect for the users it requires.

I have absolutely no problem with companies having huge problems locking users in. If we had 2 or 3 proprietary standards to implement DRM that things worse for users, that's a good thing.

"Why is this so hard to do?" The answer should be: "We refuse to make such abhorrent behavior easy", rather than: "It's not"

Making it easy for vendors to dick users over is a bad thing.

Making DRM easy to deploy damages the open web in a very bad way.

</comment></comment><comment><USER24> I think this article seems to act as though ditching flash just happened to coincide with adoption of this new EME thing. The issue is that no matter how much we kick and scream about user freedom, business interests are business interests. Economics are economics. There just isn't enough user demand for freedom to overcome the loss to businesses of losing control of their content. In order to win this, I think we may need to come to terms with this. Perhaps it means trying even harder to inform the public and increase demand for freedom, but maybe it means coming up with alternate ways to monetize, or alternate ways to produce which circumvent the need to monetize.

<comment><USER25> This is a misrepresentation of the problem here. You're restating the corporate arguments.

> There just isn't enough user demand for freedom to overcome the loss to > businesses of losing control of their content.

DRM doesn't prevent businesses losing control of their content. _Orange is the New Black_ has, AFAIK, only ever been distributed through EME, but it's all over the Pirate Bay, every single episode.

> maybe it means coming up with alternate ways to monetize

We have alternate ways to monetize. The simplest being _doing exactly what they are doing except not DRM-ing their content_ , which demonstrably has worked for multiple content distributors. There are others.

DRM isn't about controlling content or monetize that content. It's about maintaining an outdated business model because business executives don't understand the internet. Which would be fine, except that it's hurting the open web.

<comment><USER26> _Orange is the New Black has, AFAIK, only ever been distributed through EME_

This isn't even close to true. Netflix has a ton of non browser delivery mechanisms. It may only have been delivered with drm but that's a different thing and I don't know enough to know if that's true.

<comment><USER25> > This isn't even close to true. Netflix has a ton of non browser delivery > mechanisms. It may only have been delivered with drm but that's a different > thing and I don't know enough to know if that's true.

Maybe that's a bad example. But I'll put out this challenge: find me a reasonably popular TV show that's supposedly completely covered by DRM, and I'll find you a torrent for it. My point is that DRM does nothing to prevent piracy.

</comment></comment></comment></comment><comment><USER27> Interestingingly it seems Youtube is still using Flash in its pre-roll advertisements unless I'm missing something obvious. Those videos get the 'f' from flashblock and won't view unless it is enabled.

</comment><comment><USER28> It's a little weird that the EFF is using YouTube's move to HTML5 video by default to attack EME, considering that YT doesn't require EME...

(Yet, anyway.)

<comment><USER29> It's maybe to point out some of the irony of "Hey, let's accept another proprietary blob from Adobe" when it's not even needed anymore now.

</comment></comment><comment><USER30> I hear what the proponents of non-DRM browsers are saying, but for media streaming companies content is their bread and butter. I am not sure what the alternatives are.

Content providers will stick with technologies like Flash because HTML5 alone could not provide EME. Lack of such feature set HTML5 backwards because huge content providers would shy away from using web as the dominant platform of media delivery.

<comment><USER31> > I hear what the proponents of non-DRM browsers are saying, but for media > streaming companies content is their bread and butter. I am not sure what > the alternatives are.

And the DRM does absolutely nothing to stop anyone from doing whatever they want with it. DRM punishes paying customers at the expense of being a slight pain-in-the-ass for pirates. Plain and simple: they delivered content to my computer and I have a key to decrypt it - there's nothing stopping me from doing whatever I want with those bits but the time to break their silly DRM scheme.

Had Apple, Google, Netflix et al. the backbone enough to stand up to the media companies, we'd never have been inflicted with such stupidity. Now, Google's taking it upon themselves to start using their own DRM module with their own media - so much for the company that prided itself on Do No Evil.

<comment><USER2> How is that punishing a paying customer?

It's a quirk of classical information theory that you can't transmit a piece of data for a limited period of time. As an approximation, they apply a silly DRM scheme that takes time to break, and ask customers if they are willing to pay for time-limited access.

Unlike with DRM on music downloads or (worse) physical copies of software or games, there's no expectations mismatch here. If you sell a download, the average buyer expects to be able to copy that download, etc. If you stream a movie, the average buyer no more expects to be able to retain a copy than the average movie-ticket holder does. They didn't think they paid for a copy of those bits for all time.

There's nothing stopping someone who visits a movie theater from doing whatever they want with those photons, other than the time to build a sufficiently concealed camera, is there? And pirates do show up to movie premieres with concealed cameras... but would you argue that the security guards stopping you from carrying in a giant camcorder are "punishing paying customers" while not effectively deterring pirates?

<comment><USER32>
        How is that punishing a paying customer?

You must be young, forgetting about formats like WMV or WMA where you couldn't open the file without the proper license installed on your computer.That's what DRM is about.And of course you needed to log to a server regularly to renew the license, or you couldn't listen or watch the media anymore.

Just like games, pirates don't have issues with online license verification,since they play pirated games that got rid of them.

Obviously vendors did a nice job not only brainwashing the legislator but also the client.

<comment><USER2> I remember those formats clearly! Online streaming seems like a very different sort of thing, is my point. When you have a DRM-locked download, you expected to have an unlocked download. When you have a DRM-locked stream, did you expect to hold on to the stream in any form?

I think that we are remembering "DRM" from the days of DRM'd downloads, which was a terrible thing, and applying that memory here where it does not fit.

</comment></comment></comment></comment></comment><comment><USER33> AIUI, EME is basically a standard for interfacing DRM plugins, so instead of the one implementation (Flash) of it that was around before, we might end up with a wide variety of DRM modules? That certainly doesn't seem like a better situation than before, where basically all the RE efforts were focused on Flash's DRM.

<comment><USER34> Your assumption here about going from one DRM implementation to many is wildly off the mark.

There have been _several major_ video DRM solutions in _widespread use_ for many many years including Adobe's Access (in Flash, and other places) Microsoft's PlayReady (in Windows, X-box, Silverlight, etc.) and more recently Google bought WideVine for its DRM offerings and has spent the last 4 or 5 years building that into the Google Chrome and Android platforms.

Pretty much every major video streaming service was/is using a different DRM implementation. That's nothing new at all.

Your suggestion that somehow there's going to be a shift from one to a lot more DRM providers thanks to EME is uninformed and unfounded.

<comment><USER35> With NPAPI each site picked one plug-in that worked in multiple browsers. Another site could pick another single plug-in that also worked in multiple browsers. With EME, each browser supports some DRM(s) and there's no single DRM supported by all browsers, so sites need to support multiple DRMs to reach multiple browsers.

</comment></comment></comment><comment><USER36> I kind of miss flash. Security issues aside, Actionscript 3 and the graphics api felt a lot easier to use than js/canvas and was more performant.

It felt like adobe just rolled over once Steve Jobs declared flash dead. They even bundled mcafee antivirus with the flash download, it's like they just want it to be over.

<comment><USER37> Isn't it possible to create HTML5 apps with Flash Pro?

<comment><USER36> in actionscript? I haven't worked with it for a while but I don't think so. Even if it was possible I wouldn't want yet another layer of abstraction to compile to html.

it's not the graphical authoring environment that really matters. I just prefer the OOP style of AS3 to Javascript.

Open standards are great and all, but the result is that we've had to wait years just for html to catch up to where flash was.

</comment></comment></comment><comment><USER38> I notices Firefox sometimes starts busy looping on 2 cores while playing youtube (usually when "buffering"). IMO, they should really move the decoding threads into separate processes so they can be restarted easily (just like Flash was).

</comment><comment><USER39> Why don't the people with this point of view rail against proprietary fonts the way they do against video codecs? If we took the same approach to fonts then you'd only be allowed to use open source fonts and everything would look ugly. Instead we're allowed to deploy copy-protected fonts to render text nicely and no-one is unhappy.

If the ultimate issue is that people want to be able to steal video content with impunity, it all makes perfect sense. If the issue is technical or has to do with software freedom, I'm unconvinced. Not being able to open my old documents because Word 2025 isn't able to read Word 2004 documents is not the same thing as not being able to archive videos of _Galavant_ that I don't have the right to keep.

<comment><USER23> Oddly enough, fonts in particular have extreme benefits to open source models of development, the influence of actual research can be applied outright, and open fonts can be deployed rapidly.

I can't imagine a worse battleground to stake your argument on than this one, other than servers.

</comment></comment><comment><USER18> Why are they calling EME "locks"? It isn't locking anything. It's obfuscation. The most relevant physical analogy would be smog. They should call it what it is; digital smog.

<comment><USER40> It is a lock. You open it with a key. Just like a physical lock. And just like a physical lock, there are ways to force it open without the key. And just like a physical lock, forcing it open without a physical key is (usually) illegal.

<comment><USER41> Yes, but it's a lock where they have to provide the key too, and the only way to prevent you from manually opening the lock is obfuscating this process.

</comment></comment></comment><comment><USER42> The nice thing about youtube is it also encodes most videos in webm format so it still plays on XP with Firefox and some old phones

Other sites like vimeo only do mp4

</comment><comment><USER43> Can I uninstall Flash at this point? What do I really need it for?

<comment><USER44> Most Facebook games require Flash.

</comment></comment><comment><USER45> Security is what matters here, the DRM can be circumvented anyway.

</comment><comment><USER46> Well, hopefully using the Flash player remains an option.

</comment><comment><USER47> Yes, EFF, we're still not living in a content wonderland where Hollywood studios send their blockbusters to people's browsers in naked <video> tags. Shocking, I know.

<comment><USER48> Look, if they want to make a plugin that understands their DRM scheme or some standalone app that's basically just a scaled down browser with support for a <drm_video> tag, they can tilt at that windmill all fucking day for all I care.

But I still need a <video> tag that works like an <img> tag in that there's at least I format supported by all major broswer venders that works for that tag, that lets me easily save the video for offline viewing, and is completely unencumbered by patents or licensing issues, so anyone else can make a browser supporting it. If that means I have to use a tag called <supercalifragilisticexpialidocious> instead of <video>, I don't really care. I need that functionality. The web needs that functionality.

<comment><USER34> You have that functionality thanks to the <video> tag and H.264 and AAC in MP4. That seems to meet all of your requirements. Am I missing the problem? EME and DRM are not required to make that work in Firefox, IE, and Chrome.

<comment><USER48> H.264 requires a per user license fee paid to MPEG LA until 2027 when the patent runs out: [http://www.zdnet.com/article/a-closer-look-at-the-costs- and-...](http://www.zdnet.com/article/a-closer-look-at-the-costs-and-fine- print-of-h-264-licenses/)

AAC also requires a per unit license for anyone who manufacturers or developers of a codec: [http://www.vialicensing.com/licensing/aac- fees.aspx](http://www.vialicensing.com/licensing/aac-fees.aspx)

So no, neither of them meet the 3 requirements I laid out.

<comment><USER37> What does that have to do with EME?

<comment><USER48> I didn't bring up EME. I just want a video tag with mandated support for at least one totally unencumbered audio and video codec. The suggested codecs aren't unencumbered, and currently there isn't any mandated codec wrt <video>.</comment></comment></comment></comment></comment></comment>


Why Roaming Costs Are Unjustified - <AUTHOR> http://opensignal.com/blog/2013/03/18/why-roaming-costs-are-unjustified/

<comment><USER2> One of the idiotic complaints I've seen from users living near the border here in Vancouver (around the White Rock/Blaine area) is that they get "gouged" by the mobile phone carrier for roaming charges after picking up either Rogers, AT&T, or T-Mobile depending on where they are. And when the carrier forgives the bill, the users then complain that the company should do more to stop signals from over-powering the other, forgetting that these towers are built to keep that in mind.

I asked a friend of mine who used to live in the area what he did to prevent being charged for roaming and he basically told me that while he could manually set his phone phone to his carrier (Rogers), he chose not to because it was far easier to just move around the house and wait for the roaming to stop as he would prefer to let it switch when he does cross the border since it's only 2 KM away.

It's a bit ineffective as I keep my phone locked to my carrier's ID but how can people already aware of this problem not do the same? Roaming charges are garbage sometimes but there has to be a level of responsibility on the customer to keep an eye on these things if they're close enough to another (foreign) network.

<comment><USER3> Technology should 'just work' or err on the side of not inconveniencing people. There's no reason a design error (what do you mean the towers are built to keep that in mind?) should affect customers in their own homes. Not only do most people not want to fiddle with their phone's advanced settings, many people don't even know how.

I used to run into the same issue in san diego. I would be hiking 25 miles from the Mexican border (well north of downtown) and periodically get texts from at&t welcoming me to Mexico. I kept data roaming off so I would just temporarily lose my connection, but it's still a ridiculous text to get when I'm well within a major american urban area.

</comment></comment><comment><USER4> I wonder why there isn't more roaming competition. Roaming users actually have a choice of carriers: my AT&T phone will never connect to a non-AT&T network in the US. In other countries there are usually 3 or 4 networks different networks I can connect to. (My phone is SIM locked, but I'm roaming with an AT&T SIM.) Why doesn't one of those advertise to travelers and say "Use Carrier X, we're 90% cheaper". Is it because they can't convince AT&T to pass on the savings?</comment>


EdgeDB – The next generation object database - <AUTHOR> http://edgedb.com/ <comment><USER2> Somehow it seems similar to topic map engines. How do these relate?</comment>


NY's "Amazon Tax" Takes First Casualty: Overstock Affiliates - <AUTHOR> http://www.techcrunch.com/2008/05/14/nys-amazon-tax-takes-first-casualty-overstock-affiliates/

<comment><USER2> _switches LinkShare address to Chicago from NYC & reapplies_

</comment><comment><USER3> Hopefully as many online retailers as possible follow suit OR Amazon wins its suit. If that doesn't get NY to change its socialist ways, nothing will.

Edit: I do feel bad for the NY based affiliates who will be hurt in the short- term. Hopefully they RAGE at their respective government representatives.

<comment><USER4> So...by NY taxing people on stuff they are supposed to pay taxes on anyways, that makes them socialists? Interesting stance on the subject.

<comment><USER3> No, any marginal tax increase just makes them more socialist leaning than they already are. In addition to state and federal income taxes, NYC residents (where about half of New Yorkers live), have to pay local income taxes as well as property and sales taxes.

For many residents (not just rich people), taxes hover around 40%, which is beyond ridiculous. Heck, paying taxes over 20% is infuriating enough. People complain about jobs being outsourced and companies closing down...a great way to fix this is to lower taxes and get rid of all the pet projects, red tape and blatant inefficiencies that plague our government and leech on our workers' earned dollars.

Ok - I'm done ranting; big government needs to go away.

<comment><USER5> The whole idea of having a union of states was that the states can compete with each other, If New York makes it hard enough to do business there, business will be done elsewhere. (See: Delaware, Nevada, Wyoming)

What should be happening is that NY has just made it undesirable to do business there. There should soon be a list of companies that just won't sell there as it is too much hassle. This is probably the goal. In some politicians muddled thinking this will help local businesses... Protectionism is ugly, even when states do it.</comment></comment></comment></comment>


Validate my MVP HackerNews - <AUTHOR> Hello! A month ago I had an idea and went to reddit to validate it. I had positive feedback so I decided to go for it.Today I deployed my first MVP: REVELATTE.COM
Revelatte lets you create a rich message (Text, Images, Videos and Links) and set a revelation date. A link is generated and you can share it around the internet. The message is displayed only after the date set has passed, otherwise it will show a countdown.
Pitch: "A revelation is te best way to tell people you are expecting a new family member, getting out of the closet or revealing stuff people don't know about you. How about the secret location of your next underground rave? Revelatte helps business owners to reveal new products, special offers and keep their customers thrilled with new features."
The site is under development and will look better as soon as I finish coding the main functionalities. I'm trying to re-validate the idea now that the MVP is up and running. If it has traction, I'll develop more features and post it in Product Hunt. What do you guys think? Go ahead, try it and send me some feedback in this post or via mail: revelatte [at] gmail.
Thanks! <comment><USER2> If you want feedback on your new thing, you really need to do a proper "Show HN:" submission with a link to your new thing. This way it doesn't get penalized in the rankings as being a "text" submission, and it gets sorted under the 'show' link in the top menu. The rules for doing a "Show HN:" submission are here:

[https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

<comment><AUTHOR> Will try that! Thanks!</comment></comment>


CPU Jitter Based True Random Generator - <AUTHOR> http://www.chronox.de/jent/doc/CPU-Jitter-NPTRNG.html <comment><USER2> Isn't this basically another take on HAVEGE[1]? I'm not sure I'd call that a true random source.

[1] [https://www.irisa.fr/caps/projects/hipsor/;](https://www.irisa.fr/caps/projects/hipsor/;) see [http://www.issihosts.com/haveged/](http://www.issihosts.com/haveged/)

<comment><USER3> As I've said before: look out for side-channels!

The RF/electrical/other emissions from general-purpose CPU cores and their supporting circuitry tend to have major features with good correlations to execution timing and pipeline stalls, which they are not designed to treat as secret.

This is one reason why crypto implementations should be written using techniques that avoid table lookups or branches based on secret data: another is of course that the resulting timing variations may be visible on another core, over a network, etc.

Systems which treat the TSC (etc) as such secret data that they effectively seed a PRNG with it should therefore be treated with a very considerable degree of caution considering just how (literally) squeaky some cores/boards can be about leaking it. Further research is needed.

</comment></comment><comment><USER4> (Having read the beginning and skimmed the rest) my impression is that this is a useful but vulnerable technique. Useful in that it provides an entropy source not currently available. But vulnerable in that it could conceivably weakened considerably.

Perhaps what should be discussed in this context is not entropy but conditional entropy. Entropy really is relative to one's understanding of the underlying system being observed. For example, human height is nearly normally distributed and would provide some degree of entropy if it could be freely sampled from. But for a given person, knowledge of the parents' heights makes predicting the child's height a much easier task. The entropy of height given parents' heights is less than the entropy of height in general. H(Height|ParentsHeight) < H(Height)

In the case of this CPU jitter method, things it calls nondeterministic are, in fact, clearly deterministic---disparities between CPU and memory clockspeed come to mind. Effort at better modeling of the internals of a CPU may lead these "random" events to appear not-so-random-anymore. Suppose I build a statistical model of CPU jitter based on various properties observable from a non-privileged process in the OS. To the extent that my model predicts jitter better than random, an entropy source derived from CPU jitter is weaker. The conditional entropy _given_ the model could decrease substantially, to the point that it's no longer a good entropy source.

That said, none of that work seems to have been done yet. But I wouldn't consider this a bulletproof entropy source in the long run.

</comment><comment><USER5> Great article on LWN about this: [http://lwn.net/Articles/642166/](http://lwn.net/Articles/642166/)

</comment><comment><USER6> Wow, this is pretty thorough but I never saw it address the simple question, why not use rdrand?

Also:

> the CPU Jitter random number generator returns roughly 10 kBytes per second > on an Intel Core i7

OpenBSD requires at least 8 bytes of random data per TCP connection. Limiting a system to 1000 conn/sec (to say nothing of any other processing those connections may require) probably isn't going to fly.

As a comparison, I can read from /dev/random (and write to /dev/null) at over 300 MB/s.

<comment><USER7> > OpenBSD requires at least 8 bytes of random data per TCP connection. > Limiting a system to 1000 conn/sec (to say nothing of any other processing > those connections may require) probably isn't going to fly.

They can use the generated random values to seed a CSPRNG. I guess for containers or other virtual environments this has distinct advantages (at least that's one of the reasons given in the introduction).

> As a comparison, I can read from /dev/random (and write to /dev/null) at > over 300 MB/s.

You can read from /dev/random only if there is enough entropy in it, and it's rarely very much, I don't know how you got that 300MB/s figure.

<comment><USER8> He mentioned OpenBSD. On OpenBSD /dev/random is a CSPRNG.

<comment><USER7> I think I need to sleep.

</comment></comment></comment></comment><comment><USER9> Someone please ELI5 this?

<comment><USER10> Basically thread scheduling is an imperfect art. So when you tell a thread to sleep for 4ms, it may sleep for 1-16ms depending on other threads work load, resource contention, etc.

This is a huge problem if you work in very precise time sensitive data (I do ISO17025 flow calibration systems), and when you start needing >100 data points per second, of dynamic IO you will run into millisecond timing issue standard time shared OS's will introduce. The solution to this is Real-Time OS's (not Real-Time webdevelopment) that handle scheduling differently, and prioritize IO tasks even higher. But most of these suck.

:.:.:

This random noise (from the scheduler) is a pretty good source of entropy (and the only assumption is your Unix box has other processes, that are using resources). Because your process, generally has no clue that hundreds of other processes are inflight and also being executed at the same time.

So their interference, is effectively magic data from nowhere.

Dan Kaminsky did a talk at Defcon last year where he mentioned the need for this type of CSRNG [1]

I even tooled up a very basic (and flawed) implementation a few months ago to play with the notion [2]

[1] [https://www.youtube.com/watch?v=xneBjc8z0DE](https://www.youtube.com/watch?v=xneBjc8z0DE)

[2] [https://github.com/valarauca/Simple- CSRNG](https://github.com/valarauca/Simple-CSRNG)

<comment><USER7> Is there a significant advantage? Either-way you just need to fill /dev/random enough for /urandom to be well seeded.

<comment><USER10> Yes.

Interprocess scheduling isn't currently a source of entropy for /dev/random or /dev/urandom.

Edit: I have random/urandom backwards. Still doesn't change my core point. Sorry for the confusion.

/dev/random is a PRNG, and predictable. You shouldn't use it for security applications but only for specific state/algorithm randomness.

/dev/urandom requires hardware noise/key events, etc. to generate its entropy. These become hard to find when your dealing with purely virtualized installations.

:.:.:

The key focus for this is webapps, or should be. Far to many use PRNG to give session cookies, and these are very very easy to hyjack especially if cookies can be issued whenever a user logs in/out. Its pretty trivial to generate 1,000 -> 5,000 session cookies (from login/logout) and attempt to find a PRNG pattern.

<comment><USER11>
      /dev/random is a PRNG, and predictable. You shouldn't use it for security applications but only for specific state/algorithm randomness.
      /dev/urandom requires hardware noise/key events, etc. to generate its entropy. These become hard to find when your dealing with purely virtualized installations.

This is not true, at least on Linux. /dev/random is actually closer to what you describe as /dev/urandom. It is a cryptographically strong randomness source that blocks depending on the state of its internal "entropy pool". /dev/urandom is also a cryptographically strong randomness source (seeded from /dev/random), but it does not block.

Here's a great blog post with more info: [http://www.2uo.de/myths-about- urandom/](http://www.2uo.de/myths-about-urandom/)

<comment><USER12> On the BSDs, there's no real distinction between the two, and the names are just there for compat.</comment></comment></comment></comment></comment></comment>


Telephony Fraud – Still going strong - <AUTHOR> http://www.simionovich.com/2017/01/08/telephony-fraud-still-going-strong/ <comment><USER2> VoIP fraud is very sophisticated and it's not just about toll fraud. The author uses a small snapshot and tries to suggest scenarios. However, that's like the one-shot case study that shows all clover have 4 leaves and are sometimes green. You need much more data (and investigation) to make any proper conclusions.

Often the multiple calls a denial of service - frequent numbers are often large companies being subject to a denial of service (the US embassy is a popular target) or they are test calls to verify a server works (i.e. call their own number and listen for audio) before pimping it out for toll fraud.

The PA ones could be a mix of that plus the more sinister DoS block on targets about to be attacked to prevent them calling for help.

There's a list of hack attempts over a much longer period available at [https://network-systems-solutions.ca/voipblocklist.php](https://network- systems-solutions.ca/voipblocklist.php) That gives a bit more meat for anyone interested in looking for patterns (or protecting their server I suppose)

<comment><USER3> Thanks for describing some actual fraud scenarios rather than the author's specious conjecture.

<comment><USER4> Well,

To be more accurate, I've shown a snippet describing only 48 hours of "suspected attacks" that were performed to a single server. The overall network contains 6 different honeypots around the world, which had been changing IP numbers once every 7 days for the past 2 years.

Just to give a rough idea, the overall number of attacks, that specific server received in the month of December was over 180,000 attacks, with about 60 distinct attack sources and about 8 different attack patterns. Analysing all the data is far beyond my current time capability, simply because I'm dealing with other subjects.

It is true that you can't deduce any type of specific reasoning from the displayed information, as the data set is very much limited. However, it shows that as much as Skype/Facebook/Whatsapp are popular, the popularity of VoIP hacking and hijacking still proves this is a booming market with much financial gain.

</comment></comment></comment><comment><USER5> I ran a VoIP server for an application. It received daily attack attempts in various formats. The only reason it never got abused was that I tightly bound it to the application logic, so essentially no call outside the application could be placed. You can secure it without doing that, but it's very easy to get it wrong - there's a lot of horror stories out there. I definitely would've been pwned if I didn't write direct application code into the server from the get-go. I only learned of the various attacks over time from inspecting the logs.

</comment><comment><USER6> Interesting, so if I've understood correctly the attackers are looking for open Asterisk servers and attempting to dial out.

What's the pay off? The numbers listed in the article are not premium rate. Are they just test numbers or is there another pay off?

<comment><USER7> Quite often those numbers will be another hacked service, which is set to forward the calls. Perhaps eventually to a premium service. This is done to better hide the origination.

Another common fraud is to provide cheap calls to a certain area/country. (often named black/grey routes).

Basically the telco or state regulators might have a very expensive price to call a certain country/network. You set up your own telephony service in country A, route incoming calls over the internet to country B where you set up a similar service that can terminate the calls in country B.

Your call the phone number in country A , that phone is just a bot/pbx, which routes the call over to country B, but using the cheap internet, instead of the expensive price your telco would charge you to do. Seen from the telco in both in country A and B, it's just two local calls.

What's even cheaper than doing this ? Hack an existing PBX tp do the same, to incur all costs to the PBX owner.

<comment><USER8> Sorry if I'm being naive, but what is keeping users from using Skype & co.?

<comment><USER7> Here are a few reasons:

1\. Calling user does not have a computer

2\. Called user does not have a computer

3\. Users are in a situation where they do not have a computer, only their cell phone, with a data plan that is too expensive to use skype, or without a data plan altogether.

4\. Users does not know about, are not able or trained to use skype.

5\. Internet is not available at the location of either of the users.

6\. Users are in a coverage area with only basic phone services, no data availability.

Throughout the world there are far, far more people having access to simple phone services than a computer and the internet.

The places I often see these kinds of frauds, are for minorities living/working in one country, that wants to talk to their families back home - often poor people with no access to a computer, nor the ability to operate one - but with a mobile phone, and a little bit of money to pay for a few calls - which is enough for someone else to make a buck by selling blakc/grey routes to these people.

</comment></comment></comment></comment><comment><USER9> I wonder if the author had considered more closely replicating a 'real call'? Most of the fraudsters use automated dialers that anticipate the 200OK as a successful call ... etc.

I did something like that, and was surprised to learn both the lack of media, and predictable media (white noise, or a particular pre-recording) were themselves indicative of 'artificial traffic' (and therefore, likely fraud).

<comment><USER4> Actually, the honeypot system is slightly smarter than that. Some of the honeypots are actually based up a SIPP UAS scenario, which will accept any traffic and will play back an audio file of 5 minutes. Those servers normally yield slightly different results, that normally look like a scan, then followed by a media test then followed by something that looks almost manual - and after the manual test, they go away, after realizing they hit a honey pot.

</comment></comment><comment><USER10> I see attempts to push fraudulent traffic constantly on my SIP servers, recently I've taken to putting recordings on for them or routing to a random 800 number.

Is calling Palestine Mobile Phones not possible over VOIP currently? I kinda want to let a few calls complete, cause that is often a destination fraudulent call attempts try to call. I see the prefix in my ratedeck, anyone know of a less expensive provider?

Israel,Palestine,97292,0.189,1,1 Israel,Palestine,97282,0.189,1,1 Israel,Palestine,97242,0.189,1,1 Israel,Palestine,97222,0.189,1,1 Israel,Palestine Mobile Other,97259,0.219,1,1 Israel,Palestine Mobile Other,97256,0.219,1,1

<comment><USER11> > or routing to a random 800 number

800 numbers aren't free - the recipient pays. It may even be illegal to forward your fraud traffic to them (but IANAL).

</comment></comment><comment><USER12> Looks like HN did some work on their site. For convenience here is a cached link from google:

[http://webcache.googleusercontent.com/search?q=cache:94_ZVFM...](http://webcache.googleusercontent.com/search?q=cache:94_ZVFMBF94J:www.simionovich.com/2017/01/08/telephony- fraud-still-going-strong/+&cd=1&hl=en&ct=clnk&gl=us)

<comment><USER4> Oh yaeh, that was a real surprise - also the various attacks on the server were very surprising as well - that kind'a caught me off guard.

</comment></comment><comment><USER13> A coffee shop just because it's Amsterdam? That's interesting prejudice right there. Everybody would be losing their shit if it was a black country and it mentioned something typical of there...

<comment><USER14> Dude, calm down, if you don't live in the Netherlands, coffee shop refers to a place like Starbucks that usually has free wifi, which makes sense in the context he's describing. That's what he meant. I moved here 3 months ago and I still accidentally ask people if they want to stop by a coffee shop when I meant I wanted to stop and get coffee.</comment></comment>


New Electric Motor That's Super Light and Powerful for Electric Airplanes - <AUTHOR> https://transportevolved.com/2016/07/08/siemens-showcases-brand-new-electric-motor-thats-super-light-super-powerful-and-perfect-for-electric-airplanes/ <comment><USER2> A lighter engine certainly doesn't hurt, but it's really the batteries that are an issue. The other item often overlooked on the battery front is that most batteries hate the cold. Take your iPhone out on a 20F day and see how long that 100% charge lasts! (Spoiler alert, likely a few minutes).

As you go up in the atmosphere things start to get really cold. Until the weight and temperature issues with batteries can be address electrical aviation will be mostly a concept on paper.

<comment><USER3> > As you go up in the atmosphere things start to get really cold.

Yes, but the air is also much much thinner. So it doesn't suck heat away nearly as quickly as it might at ground level. So the batteries should retain heat.

I don't see the energy-density math. Batteries in passenger planes would have to last far longer than the flight duration, at least 30minutes more to accommodate safety margins such as diversion to other landing sites. And a battery-powered plane must suffer from the fact that it hauls around dead batteries. A gas-powered plane gets lighter as it burns fuel. So, by my math, an electric passenger plane would require an energy density at least four or five times that of current battery tech. The motor isn't the issue.

<comment><USER4> I would assume a bunch of the battery usage would be from take off. You'd think they could design a system like a rocket launch with a "staged" plane launch, where the batteries used for take off would then be jettisoned to land safely back at the airport for re-use.

<comment><USER3> A while ago I read a proposal by airbus for an electric airliner. They speculated that batteries could be recharged on the way back down from altitude. If you want to recover energy, you;ll need those empty batteries.

</comment></comment></comment></comment><comment><USER5> You'd think that since the article is about how this motor is a new record in power density (or rather specific power), it would include the specific power in the article somewhere. You would be wrong, but it does include the information needed to calculate it. The SP260D motor they're talking about has a specific power of 260 kW / 50 kg = 5.2 kW/kg. It's not clear if this includes the weight of the batteries or not.

The article says the usual motor for the Walter Extra 330L is 315 horsepower, which is 234 kW. The "E" in the model number "330LE" apparently refers to the electric version.

To contextualize, motor specific power is actually really important for heavier-than-air flight. The reason Leonardo's helicopter designs wouldn't work is a lack of specific power in the (human) motors he had in mind, more than any aerodynamic reason. (Sufficiently high specific powers can overcome even remarkably poor aerodynamics.) The Wright brothers' main innovations were: a workable system for steering, and a motor with sufficiently high specific power.

The bit about the motor's end shield seems to be describing topological optimization, but the description of the process is somewhat ambiguous. It would be nice to see a picture of the end shield and maybe information about how it's made.

Maybe a less clueless, though even more information-scarce, article is [http://www.flyingmag.com/extra-unveils- electric-330le](http://www.flyingmag.com/extra-unveils-electric-330le)

Other commenters are pointing out that this won't work for long-distance flight. The Flying article I linked above says it will actually only last either 5 minutes or 15–20 minutes (it seems to contradict itself, but maybe I just don't understand it.) So it's adequate for aerobatics only. But it should be better at aerobatics than the standard engine was.

Further links from other comments: [https://news.ycombinator.com/item?id=12060954](https://news.ycombinator.com/item?id=12060954) [http://www.gizmag.com/siemens-world-record-electric-motor- ai...](http://www.gizmag.com/siemens-world-record-electric-motor- aircraft/37048/) [https://newshour.online/2016/07/04/world-record-electric- mot...](https://newshour.online/2016/07/04/world-record-electric-motor-makes- first-flight/)

<comment><USER6> Speaking of helicopters and specific power and weight and all that, it seems an article of faith that eventually an electromotive tail fan will be lighter than all equivalent reliability mechanical or pneumatic systems. I mean sooner or later as magnet strengths and VFD voltages approach infinity and VFD and motor mass approach zero, at some point the rube goldberg mechanics that make the tail rotor spin will be replaced by a near weightless power cable and electric motor.

You don't need a battery to spin a tail rotor... once the main disk stops spinning there isn't much point in keeping the tail rotor spinning.

A hybrid helicopter is an interesting concept, rather than zero torque the instant the engine dies and hope for good luck WRT autorotation technique, even merely giving the pilot 15 extra seconds of battery thrust would probably save some lives.

<comment><USER5> Pneumatic hoses are pretty light too, and pneumatic motors are usually a lot lighter and more reliable than electric motors of the same power. But maybe you're saying that this is merely a function of low voltages and weak permanent magnets, and we can expect electric motors to get a lot lighter? I guess that's possible; can you point me at some exemplary modern motors?

I tried to write a thing here about the physics of the situation — saturation flux densities and layer-wound armatures and resistivities and dielectric strengths and so on — but then I realized that I don't actually understand the physics of electric motors well enough to say anything coherent. How are electric motors increasing their specific powers — is it just by higher RPMs, or is it a matter of more poles and/or better materials and geometries? What are the limiting factors?

<comment><USER7> Drexler gets into electrostatic motor scaling in Nanosystems and presumably his thesis. I have no idea about the kind of designs made today, though.

</comment></comment></comment></comment><comment><USER8> This article has almost nothing about the actual motor in the title except this:

"every component from previous motors was examined and optimized to lighten this motor and improve efficiency. The end-shield for the motor, for example, was analyzed using a software package that divided the component into over 100,000 elements, each of which was individually further stress-analyzed and subject to iterative improvement loops. Eventually, the custom software spat out a filigree structure that weighs 4.9kg instead of the 10.5kg from the previous design."

The rest of the article is basically fluff with no info.

<comment><USER9> Even this paragraph is just a general description of what could potentially be a FEM analysis and some optimisation algorithm associated with that. Interesting result on the other hand.

</comment></comment><comment><USER10> Just penciling in the math that means a quad copter is pretty straight forward with this motor. 200kg for a "megawatt" of thrust. Now all we need are batteries that are 3x as power dense as the current best of class and you'll be able to hop from home to the office in your 'quad'.

<comment><USER11> Why would you use batteries? Fuel gets lighter as you use it, and the density is already there. Automate maintenance so you can use turbines.

<comment><USER12> My guess would be electric might be simpler and easier to maintain and with electric you can charge at home.

</comment></comment></comment><comment><USER13> I applaud Siemens for venturing outside their comfort (profit?) zone instead of just incrementally improving whatever they did for decades already (and did not sell for having a bad quarter), but they are really overdoing milking this little plane for publicity. An electric motor being lighter, per Watt, than an ICE, who would have guessed.

That being said, a hybrid setup could well be worth it, even with the abysmal specific energy density of real life batteries: keep just as much conventional engine as needed for cruise flight only and have some form of electrical assist for the few minutes of a flight that need more power than that. Battery density isn't a problem at all when you don't need endurance.

<comment><USER14> For a hybrid setup, regulations will likely require that both the conventional engine and the electrical system to be powerful enough on their own to still take off if the other system fails after V1.

Still, that's massive savings over the current twinjets, which require two engines, both powerful enough to take off after a failure of the other at V1.

<comment><USER13> Sounds reasonable. But in an unlikely best case scenario, the electric part might somehow be certified for single engine reliability, capable of everything except endurance. A wave of comparatively liberal cruise engine development might then catch up with a few decades of combustion engine refinement.

</comment></comment></comment><comment><USER15> Already discussed at [https://news.ycombinator.com/item?id=12060954](https://news.ycombinator.com/item?id=12060954) ... Some commenters had more info on the engine on this thread.

</comment><comment><USER16> I wouldn't think even older electric motors wouldn't work well enough in electric airplanes regarding weight and power? The weight of batteries is the biggest problem.

<comment><USER17> Have an on board diesel generator

<comment><USER18> LOL. Technically some heavy trucks and engines, are powered by electric motor with generator. Some of the biggest trucks and tanks were electric ;-)

[https://en.wikipedia.org/wiki/Diesel- electric_transmission](https://en.wikipedia.org/wiki/Diesel- electric_transmission)

</comment></comment></comment><comment><USER19> I thought it was the battery, not the engine, that prevented long-distance flight? For energy / kilogram, lithium batteries are around 200 while gasoline is around 13,200.

<comment><USER20> Yep - and as you use up fuel, your plane gets lighter, saving more fuel the longer you fly. With batteries, you have to carry the same weight for the duration of the flight. Which actually is a huge problem, because on most airplanes maximum take-off weight is higher than maximum landing weight.

<comment><USER21> I have the stupidest idea. As energyless state fuel is released in the air, just drop 'depleted' battery modules and have them collected.

<comment><USER22> Another stupid idea: use aircraft catapults[1] to reduce the onboard energy requirements. Takeoff seems to be the most energy demanding stage of the flight.

Obviously a drawback is that existing airfields' or airports' runways would have to be retrofitted, but if the fuel and maintenance savings were enough, it might make sense.

[1] used on aircraft carriers: [https://en.wikipedia.org/wiki/Aircraft_catapult](https://en.wikipedia.org/wiki/Aircraft_catapult)

<comment><USER23> You just need to carry energy into the airplane, with coils for example. No need for a catapult.

<comment><USER22> The catapult is a proven technology for aircraft though, with decades of development.

</comment></comment></comment></comment></comment></comment><comment><USER24> Solar powered recon UAV with near unlimited flight time could be an application

<comment><USER25> Just combine some lighter-than-air structure with a UAV to achieve really great energy efficiency , and put solar panels on it. It would probably be possible in no-wind conditions to stay at the same point while charging the batteries.

</comment></comment><comment><USER26> Nothing at all about reliability, which is going to be the biggest factor the aerospace industry will be considering about this. You can sacrifice reliability for _extreme_ power-to-weight ratio, as evidenced by things like Top Fuel dragsters and even the electric motors in RC planes are optimised more for power than longevity.

</comment><comment><USER27> better articles

WORLD-RECORD ELECTRIC MOTOR MAKES FIRST FLIGHT

[https://newshour.online/2016/07/04/world-record-electric- mot...](https://newshour.online/2016/07/04/world-record-electric-motor-makes- first-flight/)

Siemens' world-record electric aircraft motor punches above its weight

[http://www.gizmag.com/siemens-world-record-electric-motor- ai...](http://www.gizmag.com/siemens-world-record-electric-motor- aircraft/37048/)

</comment><comment><USER28> It seems that this motor's power-to-weight ratio advantage applies just as well to ground vehicles. Are there reasons why that isn't the case? I.e. is this approach somehow specific to heavier-than-air engines? (Also, speaking not necessarily to using _this specific motor_ , but rather applying Siemens' cited optimization techniques for ground applications.)

</comment><comment><USER29> The most recent episode of Fully Charged [1] looked at a 100% electric racing plane currently in development that uses two electric motors to drive two counter rotating propellers at the front of the aircraft.

[1] [https://www.youtube.com/watch?v=Xe1g1JrRRkY](https://www.youtube.com/watch?v=Xe1g1JrRRkY)

<comment><USER27> the use case for this aircraft is to fly 20 minutes maximum so current battery technology power to weight is enough.

</comment></comment><comment><USER30> This should be interesting for solar-powered remote-controlled aircraft, where battery weight is less of a concern.

</comment><comment><USER31> To what size of aircraft can a motor like this scale? Or perhaps more importantly, motor + batteries? To put it another way, is this technology likely to scale to an aircraft transporting 4 or more people anytime soon?

<comment><USER12> Airbus are planning a 100 seater aircraft by around 2030.

</comment></comment><comment><USER32> It's all about the batteries. That's what's holding us back

<comment><USER33> Electric engines doesn't necessarily mean batteries. Consider micro- turbogenerators. [http://dukespace.lib.duke.edu/dspace/bitstream/handle/10161/...](http://dukespace.lib.duke.edu/dspace/bitstream/handle/10161/3792/Camacho_duke_0066N_10953.pdf) As others mentioned, fuel has the advantage of getting lighter over travel time. Also, electric motor planes should be wrapped with solar cells.

<comment><USER19> Solar cells add weight. As an energy source its hard to quantify them since they never run out, and weight the same the whole trip. Maybe more like batteries. Anyway energy/kilo is probably pretty bad. So for any finite trip, leave off the solar cells and use gasoline.

<comment><USER34> It's easy to quantify solar cells on an airplane, just look at power consumed by propulsion and compare to power generated by the cells. The result is that the power generated is pretty much useless and doesn't even justify the weight of the solar cells, unless you design a plane to be _extremely_ light and with nearly no payload, a la Solar Impulse.

Solar could be good for drones that stay almost permanently airborne and just need to carry some electronics, but it's pretty much useless for transportation. If you must use electricity there, you'd want to use batteries on the plane, and keep your solar panels on the ground.

<comment><USER30> But for the specific case you're discarding here - a solar-powered camera drone - doesn't this new motor provide a serious improvement?

Low-cost solar-powered drones could be a wonderful tool for aerial cameras.

<comment><USER34> I'm sure it'll help, but the fundamental problem with solar powered aircraft is that one pound of solar panel can lift barely more than one pound. That means saving weight on the motor can cut out a lot of solar panels, of course, but it also means you still need a ton of solar panels just to lift the structure of the aircraft and the payload.

I don't think we'll see cheap solar drones anytime soon. Current solar aircraft need to be gigantic and fly extremely slowly. Small drones typically want to be quadcopters, which are inherently inefficient, but have other nice properties. If you want a solar-powered small drone, make a stationary solar array, give the drone a swappable battery pack, and charge batteries with the stationary array while different batteries are powering the drone.

</comment></comment></comment></comment></comment></comment><comment><USER35> As we approach the 200th anniversary of Faraday's 1821 invention of the electric motor, I am impressed we are wringing out improvements.</comment>