Alexa and Siri Can Hear Hidden Commands - <AUTHOR> https://www.nytimes.com/2018/05/10/technology/alexa-siri-hidden-command-audio-attacks.html <comment><USER2> Isn't there an inaudible tone that you can use to disable the assistant? I recall reading somewhere that Amazon used it in their commercials for Alexa so that everyone's Echos weren't lighting up during the commercials. I know when a commercial for the Echo comes on and the voices repeat "Alexa, do X" the Echo I have near the TV speaker doesn't light up.

<comment><USER3> If I recall correctly, the adverts omit a certain frequency range from the assistant's invocation phrase which human's won't notice is missing

Edit: Yep, omit / reduce tones in the 3000 - 6000 Hz range [https://www.reddit.com/r/amazonecho/comments/5oer2u/i_may_ha...](https://www.reddit.com/r/amazonecho/comments/5oer2u/i_may_have_found_how_amazon_prevents_the_echo/)

<comment><USER4> Which makes WAY more sense than a range outside of human hearing that OP implicated ("inaudible").

Expecting TV's to play tones outside the range people can hear is ridiculous.

<comment><USER5> TV channels already contain inaudible-sound identifiers. Nielsen has people put listeners in their homes, and uses the identifiers to track which channels are getting played.

<comment><USER6> You can't count on a TV being able to reproduce sounds below about 100Hz or above about 16kHz. The position of the speakers on the back of the TV means you're likely to get a lot of weird phase effects and many TVs have quite heavy audio DSP to compensate for the inadequacy of their speakers. Any hidden signals will need to be in-band and low bit rate with a high level of redundancy.

<comment><USER7> You can even less expect all the compression in the system that's designed to leave out everything people can't hear, to leave in this signal people can't hear.

</comment></comment></comment></comment></comment></comment><comment><USER8> The interesting thing is that Google Assistant has teh same problem, it's right there in the subtitle. It's interesting that it was omitted from the main title.

Rather than journalistic oversight I think this verifies what people have commented many times: that the fact that GA does not have a personalized name makes it to refer to it. SO much so that a very distant third product is included rather than GA.

<comment><USER9> Usually the attack requires the source code (or weightings of the neural network), I'd be surprised if they are able to actually attack these systems.

<comment><USER10> Does it really? As far as I was aware, it is still possible to perform a black box attack without knowing the weights of a network. Using specially crafted input, it's even possible to "steal" weights from a network!

<comment><USER11> [https://www.usenix.org/conference/usenixsecurity16/technical...](https://www.usenix.org/conference/usenixsecurity16/technical- sessions/presentation/carlini)

"We evaluate these attacks under two different threat models. In the black-box model, an attacker uses the speech recognition system as an opaque oracle. We show that the adversary can produce difficult to understand commands that are effective against existing systems in the black-box model.

Under the white-box model, the attacker has full knowledge of the internals of the speech recognition system and uses it to create attack commands that we demonstrate through user testing are not understandable by humans."

</comment></comment></comment></comment><comment><USER12> I can't recommend highly enough that everyone at least turn on the audible sound when their assistants are listening. At a minimum you should know the kinds of things that end up triggering the device. There's a really wide area of detection and it's interesting to see where that is.

I would also recommending changing your default word at a minimum. Then again, I might also recommend ditching the device entirely but I happen to have one in my kitchen that I like OK sometimes.

<comment><USER13> I want to get rid of my alexa, but my wife uses it as a kitchen timer.

We literally dont use it for anything else.

Might get one of those philips light sets since our living room is weird... Tbh, id rather not use alexa..

<comment><USER14> The clock / timer functions of Alexa/Google Home are super useful, but nothing else seems compelling to me.

Someone could clearly make an offline device that did voice recognition clock and timer, but does anyone?

<comment><USER15> Or you could spend $3 and get a kitchen timer that you can slap to start, and beeps when it's done!

<comment><USER16> Alexa has named timers, which means you can time multiple things (a common occurrence in cookery).

It is also voice activated, which means it can be done when your hands are full (another common occurrence in cookery).

<comment><USER17> It looks like nice product request that someone here can make with knowledge in the area. Perhaps a kickstarter.

</comment></comment></comment></comment></comment></comment><comment><USER18> The real problem is that Alexa and Siri increase your attack surface area to include every speaker in your home--including any cheapo Bluetooth or internet-connected speakers that could get hacked to produce these human- inaudible sounds.

(To be fair, I recall this specific point coming up in an HR thread about Alexa being able to open your door for Amazon deliveries, but I thought it was worth reiterating here.)

</comment><comment><USER19> Hidden audio is simply too easy. Hidden audio is the knife that kills desire for any financial services access through a voice assistant - for those smart enough to not follow the horde.

<comment><USER20> for me it kills all desire to have a voice assistant. I am already in the camp of taping over the camera's in my computers now will I need to worry about the microphone or what comes from the speakers?

so the question is, shouldn't they be able to detect the wavelength of what they are processing to weed out some of the more obvious tricks? with voice recognition could it also not be limited to a voice it is trained to know?

<comment><USER21> I don't bother taping over stuff. If you think about it, there are probably 10+ microphones in your room (Samsung TVs, phones, laptops, tablets, etc.)

I run 3rd party roms, Linux on all my dev/tv machines, disable Cortana on my gaming laptop, and hope there isn't something listening in all that trusted, untrusted and oss code I'm running.

I told my roommate I'd move out if he ever got an Alexa or Google home device. I do want to run Jarvis, or one of the OSS alternatives. Many of them send your data to Google/Amazon as well if you enable using their Speech-to-Text services, but they also have options for using local OSS decoders as well (and typically enable those by default).

Our phones are so powerful today there is no reason to send your speech to the cloud (someone else's computer). It should just be done locally; and tech should be improved so accuracy is improved locally without needing the larger datasets that Google/Amazon/Apple use.

More devs need to use the OSS assistance instead, and maybe that will push other engineers to no go the easy route and opt to protect their privacy instead.

<comment><USER22> You should bother taping over cameras you're not using though. It's way too easy to hijack them and keep the light from turning on when you do.

<comment><USER23> Do you really put tape on your phone?

<comment><USER22> I use my phone's camera, so no.

</comment></comment></comment></comment></comment></comment><comment><USER24> iOS now has a "text to siri" feature that can disable spoken interfacing but retain the "smart" capabilities of the digital assistant.

Not that digital assistants are worth the risk they bring. Until now I can't get Siri to do anything useful that isn't very artificially and carefully phrased.

<comment><USER13> I got an iphone from work and I was shocked at how little Siri could do.

Given all the hype from my friends and the commercials, I expected something outstanding.

Nope, significantly worse than google's assistant.

That was the start of my complete disappointment in apple as I continued to use an iphone and wonder- Why is anyone buying this?

<comment><USER25> The same reason people buy Coach bags etc... status and brand.

<comment><USER26> Why do people keep repeating this tired and offensive myth? I bought my iphone for the hardware and software capabilities that I judged to be the best for my use cases. And I am not the only one that actually had a non-trite reason, I am sure.

<comment><USER13> Is this a myth? What does apple have better than android in 2018?

<comment><USER26> As far as what Apple iphone does better? Privacy, os updates, integration with my Mac, App store apps, and a bunch of other things. But that all is completely besides the point. Even if there were nothing at all iPhones do better, it's a bit absurd to go from 'well apple is not better than android' to 'people therefore only buy apple because they are shallow'

<comment><USER13> Has it been a while since you used an alternative?

All of those seem like expected features in any OS/phone.

<comment><USER10> What other phone does this?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> Just out of curiosity, what's the frequency range that a typical mic can pick up the signal from? The article did not specially mention about the range instead it said inaudible.

And here is another article I found that mentions the normal 20-20kHz frequency response range: [http://blog.shure.com/mic-basics-frequency- response/](http://blog.shure.com/mic-basics-frequency-response/)

Isn't that mostly overlap with the human ear capability? I understand each person is different, etc. But just curious the specifics.

<comment><USER28> Yes, typical mics tend to pick up the typical human frequency range, though cheaper mics may have some really poor characteristics at the edges. Usually in the speech range they'll be pretty solid.

However, there's a lot of play within the space. One difference is that microphones do a very direct recording of the sound waves, but what we hear is actually very distorted compared to the "real" sound by the nature of our ear. One of the big differences is that if there is a very loud 4000Hz sound, we can't hear a soft 4005Hz sound near it very well, but the microphone "hears" it just fine. So for instance, you could put out a loud sound for a user, but embed a very quiet command in frequencies the human couldn't hear, but if the listening model doesn't account for that (and there are reasons it wouldn't necessarily _want_ to, because it _wants_ to hear commands even in the presence of significant background noise), you could get commands in to a system. See [https://en.wikipedia.org/wiki/Psychoacoustics](https://en.wikipedia.org/wiki/Psychoacoustics) for discussion about how our ears fail to pick up the "real audio" signal, and how much we've exploited that in music compression.

Now, that was a very brute force example. It sounds to me like what this article is talking about are called "adversarial examples" ([https://blog.acolyer.org/2017/02/28/when-dnns-go-wrong- adver...](https://blog.acolyer.org/2017/02/28/when-dnns-go-wrong-adversarial- examples-and-what-we-can-learn-from-them/) ). Voice recognition doesn't listen the same way we do, it doesn't necessarily take a holistic view of the signal, but is looking for specific frequency patterns and changes and turning that into phonemes, into words, etc. (There's a lot of ways of doing this and I don't specifically know what Alexa and Siri are doing, so that's a really vague overview.) If you know what they are looking for, you can use filters to very, very selectively remove the patterns from a bit of music or something that Alexa might trigger on, and then insert just the bare minimum skeleton of the sounds that it is really recognizing. A human won't be able to hear the difference (most likely; depends on how badly the original is mangled but even if it is audible it is almost certainly not audible without an A/B test and very good ears), but the probably-neural-nets monitoring for sounds will end up superstimulated and interpret the adversarial example as words.

While the adversarial examples work best with tuning to the target network, widely-shared networks like Alexa or Siri mean that such tuning is practical where attacking some custom-trained model used by one person isn't, _and_ experiments have shown that adversarial examples travel between separately- trained nets and even non-neural-net models to a much, much greater degree than what at least my own intuition would have suggested before hand. (See previous link and look for the discussion of "Practical black-box attacks against deep learning systems using adversarial examples". It is extremely counter-intuitive to me how easy this is.)

<comment><USER29> hmm... the big idea that MP3 figured out was you can document all these "if there is a very loud 4000Hz sound, we can't hear a soft 4005Hz sound near it very well" psychoacoustic phenomena and just throw away all that extra "can't hear it very well" information, resulting in a vastly-smaller filesize that still sounds reasonable (yeah yeah it's not FLAC and the purist needs their gold-plated Monster cables, lets not go there, that's not the point)

So this attack is kinda a "reverse-MP3" that adds those lossy bits back in, but shaped with an attack payload. Or at least it adds enough pieces of the attack payload that the neural net pattern recognition triggers, while the humans say "Doesn't sound like anything to me".

Is that a close-enough explain-like-im-a-freshman?

<comment><USER28> I primarily brought up psychoacoustics as an example of the way we don't hear the way microphones do. While you could abuse them, it would be more obvious. In this case what we're getting is the audio equivalent of adversarial examples; see the link I gave for some visual examples. What's interesting there is that they are basically invisible to us, but surprisingly robust.

(As another sort of philosophical sidebar, this either proves, or provides very strong evidence, that whatever it is our brains are doing, it is not what deep learning nets are doing, nor anything else vulnerable to such trivial adversarial examples. I've seen adversarial examples against another technique that do seem to work against humans as well, but it requires such a distortion to the image that "I can't tell if that's a dog or a toaster" actually makes sense; it's not just some sort of attack against human vision or something, it's a fancy morphed thing halfway between the two that would probably confuse anything and anybody.)

<comment><USER29> ah, thanks for the clarification! (and the interesting philosophical sidebar!)

</comment></comment></comment></comment></comment><comment><USER30> I can't get Siri to turn on the flashlight or lock my phone.

What can Siri do that's dangerous?

<comment><USER31> Well, it can read your schedule, tell you your location and then there is the homekit stuff. It could potentially disable certain security features you might have installed at your house, it could possible perform a very expensive modification to your HVAC configuration, in an extreme case that could maybe be fatal (disable heating in the winter at an older person's home or something like that.) It can also read your messages which are used for MFA in some situations. My wife and I have our accounts hooked together and I can ask Siri where she is and it uses find my friends, it can also kick off find my iPhone which shows my wife's presumed location on a map.

I think it can do Apple Pay actions too.

Degrees of dangerous. I don't have a homepod but presumably it couldn't do anything with Apple pay or your messages. Having Alexa or Siri control home automation stuff seems like something you might want to think about a little, leaving the lights on all day and burning some energy is a very different thing than re-configuring your HVAC or a security camera.

</comment></comment><comment><USER32> I hadn't thought of this, it's quite concerning. I don't see how they can safeguard against this without reducing the effectiveness of the voice recognition.

A secret command to "paste clipboard into new email, send to [address]" is a shiny new attack vector without any apparent straight forward way to plug the security hole.

<comment><USER33> The obvious plug would be to not allow such a ridiculously unsafe command without requiring you to unlock your device, much like my iPhone does today.

<comment><USER32> Sure, but your phone is sometimes already unlocked because you used it 30 seconds ago and it now sits on the table. Or it's playing music, or your kid has it etc. I don't think I was thinking about a phone anyway, more the dedicated devices that sit there listening all the time.

<comment><USER34> So lock your phone every time you set it down. Never leave it unlocked.

I used to have my iPhone lock 5min after I pressed the sleep button. Now that TouchID makes it very easy to unlock, I have it locking immediately.

When I let my friend's 4yo use my iPad, I triple tap the home button and press "Guided Access", which can prevent the user from accessing other apps until I disable it. (I do this because I'm worried about what he may accidentally search on the web, not because I'm worried he'll steal my data!)

</comment></comment></comment></comment><comment><USER35> Am I the only one that wants a nice cherry mechanical keyboard that transcribes typed commands to inaudible voice commands?

<comment><USER36> Why use the voice commands, then? Why not just type?

<comment><USER37> The only thing I can think of is to either not be heard by others nearby or to mess with people who have these devices. 1 can be done by just typing to something that can actually natively store what you want and 2 is just for fun I guess.

</comment></comment></comment><comment><USER38> DolphinAttack: Inaudible Voice commands: [https://youtu.be/21HjF4A3WE4](https://youtu.be/21HjF4A3WE4)

<comment><USER39> Can't they just limit the activation frequency? Seems easy enough

<comment><USER40> I don't know anything about it, but based on the name, I'll venture a guess.

The audio system has an A/D converter which samples audio at a specific rate -- say 48 KHz. Aliasing occurs when the input to the D/A convert is above 1/2 the sample rate. A 24001 Hz signal is indistinguishable from a 23999 Hz signal. A 25000 Hz signal is indistinguishible from a 23000 Hz signal, etc.

To eliminate these types of problems, there will be an analog lowpass filter before the sampling circuit. There is a gradual rolloff of signal sensitivity. Aliasing still occurs, but the energy of the aliased signals is significantly reduced.

My guess is you take a voice command, even if it constrained to be say 200 Hz to 2KHz, then invert the spectrum and shift it to the 46-48 KHz range. When this high frequency is played back, due to aliasing, the software after the A/D converter sees it as a 0-2KHz signal, though greatly attenuated. To overcome that, the source audio can be tremendously loud. Humans can't hear it, so it remains stealthy.

<comment><USER41> That's clever but that's so many dB down with any sane anti-aliasing filter that it would require quite the sound source.

Based on flipping through the pages of the paper ([https://arxiv.org/pdf/1708.09537.pdf](https://arxiv.org/pdf/1708.09537.pdf)), it looks like they're taking advantage of the non-linearity in the response at high frequencies to effectively demodulate a lower-frequency signal that was mixed up to ~22 KHz.

Which, if that's what they're doing, is totally awesome!

</comment></comment></comment></comment><comment><USER42> This kind of thing has been on HN before...the new thing here is that the command is embedded in a human-audible sound clip.

</comment><comment><USER43> Can't this just be fixed so that Alexa, Siri, etc. will only accept your voice pattern?

<comment><USER7> While that's really difficult it would also mean you'd have to train the assistant before you'd be able to use it, which is a big hurdle most customers probably don't want.

</comment></comment><comment><USER44> It is beyond me why people would want to put a live mic in their home. Every dystopian story, real or fiction, features some element of constant observation, and here we go, happily placing these devices in our homes. Insane

</comment><comment><USER45> > This month, some of those Berkeley researchers published a research paper > that went further

Pet peeve, I really wish that this was a link.

Was I just blind? Is the actual paper linked anywhere in the article?

<comment><USER11> It's obliquely linked at "More recently, Mr. Carlini and his colleagues at Berkeley have [LINK: incorporated commands] into audio recognized by Mozilla's DeepSpeech voice-to-text translation software, an open-source platform." [https://nicholas.carlini.com/code/audio_adversarial_examples...](https://nicholas.carlini.com/code/audio_adversarial_examples/)

It's probably this paper: [https://nicholas.carlini.com/papers/2018_dls_audioadvex.pdf](https://nicholas.carlini.com/papers/2018_dls_audioadvex.pdf)

discussed in January when it went up on Arxiv: [https://news.ycombinator.com/item?id=16220376](https://news.ycombinator.com/item?id=16220376)

<comment><USER45> Thanks, I guess I was just blind :)

</comment></comment></comment><comment><USER46> Replaced our Echos with Google homes. Curious if they are also vulnerabile?

</comment><comment><USER47> > In the wrong hands, the technology could be used to unlock doors, wire money > or buy stuff online — simply with music playing over the radio.

Why hide it in radio content? Couldn't they just play it out loud when I am not home?

</comment><comment><USER10> > Amazon said that it doesn't disclose specific security measures, but it has > taken steps to ensure its Echo smart speaker is secure.

So, security by obscurity?

<comment><USER48> > So, security by obscurity?

Obscurity is a perfectly valid layer in a security system. It's just not sufficient as the primary security mechanism.

</comment></comment><comment><USER49> Serious off-topic question:

Are there docs for Siri so that i can learn what it can/can't do?

I have tried skipping songs, playing a genre, set random play, and similar in iTunes — generally a failure, often initiates an unwanted phone call.

On the phone I can successfully call the intended contact about 50% of the time, possibly because I have ~250 contacts.

I suspect that if i knew the right words to interact with the API I could have a more enjoyable Siri experience.

Alternatively, is there a way to disable it completely — as in long hold on headphones button does not initiate.

<comment><USER50> This doesn't address your question but might be interesting. As someone who has used Android forever and never tried Siri, those anecdotes are mind blowing to me. For me with Google Assistant, media commands work about 80% and successful call initiation is about 90%. And I haven't looked for documentation either. YMMV of course.

<comment><USER51> Sometimes it works great. Sometimes I can't get Siri to do anything right. Anecdotally I've found that Google's voice assistant is quite a lot better. Unfortunately I am unwilling to accept the rest of Google's terms and conditions so I am stuck with Siri for the foreseeable future.

<comment><USER52> And what are those specific "terms and conditions"?

It's funny hoe Google is somehow perceived as evil while Apple or Amazon not.

If I have to trust someone with mt data (and we all do), I will choose Google over anyone else.

<comment><USER53> I disagree that Amazon is not considered evil.

But really I don't think anyone deeply believes that these companies are good or evil in the personal human sense, rather it's a question of incentives and interests.

Google makes money by selling me to advertisers. I understand the business value but I'm personally not comfortable with it.

Amazon makes money by selling me other people's stuff. I'm comfortable with the business, but sometimes I'm concerned that what's good for Amazon isn't what's good for the people who make the stuff I like.

Apple makes money by selling me stuff that they make. This is the business model that I like best, because when they make stuff I don't like I don't buy it, and when they make stuff I love I'm happy to give them my money in exchange.

Buying from the maker is the best win-win virtuous cycle, in my opinion.</comment></comment></comment></comment></comment>


Cabin releases 2nd-gen fleet of sleeper bus from SF to LA and back - <AUTHOR> https://www.ridecabin.com/product <comment><USER3> The concept has just one niche I can see (besides people who are scared of flying)... getting into downtown SF before 8am without the chance of your flight being delayed due to fog. If you absolutely need to be at a meeting at 8am, currently you're flying in the night before, grabbing an Uber from SFO to a hotel generally close to your morning meeting, hoping you'll get a good night sleep and then dealing with the morning commute. You're paying at least $300 in addition to the flight.

Of course the above scenario is just the tip of why I'm so excited about self driving RVs. Hop in at 8pm in your home town, work, watch TV until you're ready to go to bed, wake up at your normal 6am, shower, get dressed, and step outside in front of the office at 7:45am. The RV departs, maybe driving itself "home", while you work. At the end of the day, catch an Uber to the airport for a quick flight home... to be met at the airport by your RV, which whisks you home. You're gone for under 24 hours from home, and were able to put in an 8+ hour day. Or, you take the RV all the way home, arriving at home by 8am. I'd buy one in a heartbeat if the price was around $0.20/mile. I might even consider using such an RV during a week long trip to the bay - using the RV as my hotel... having it drive out to Tracy each evening and parking in a Wal- Mart parking lot. Which in a strange way will alleviate Bay Area housing shortage - when you're living in an RV, do you care how far away it's parked from work if it's self driving?

<comment><USER4> >>having it drive out to Tracy each evening and parking in a Wal-Mart parking lot.

Do American supermarkets not have any time limits on parking? In the UK every single supermarket will have a 2-3 hour time limit on parking with anywhere between £70-100 fine for parking there for longer.

<comment><USER5> So truck drivers don't overnight at UK supermarkets? What do they do when they can't park at a truck stop and they're out of legal driving hours for the day?

I'm driving a semi truck. I'm parked in a Kroger parking lot in Fort Worth TX (in an out of the way corner), having slept here overnight. Kroger is unusual, I mostly use Walmart when I can't find "legitimate" parking, because the lots are generally bigger, near interstates, and easier to navigate a truck and 53 foot trailer through.

I tried a nearby truck stop first, but there were no spaces.

Two nights before I slept on an interstate on ramp on Alabama. There were ten to fifteen other trucks on that same ramp, and when I left the next morning most of the subsequent ramps were full of trucks.

Which is to say, I'm a frequent Walmart parker, by necessity.

I've never seen a specific time limit at a Walmart lot. Sometimes I see no truck parking signs at Walmart, or no overnight signs (and sometimes i park there anyway, especially if there are other trucks there).

I have seen time limit signs at some rest areas, for six or eight hours. Yet truckers are required to stop for at least ten hours between working days. I ignore those signs.

And by the way, depending on the part of the country, those rest area off and on ramps are usually also packed with trucks.

I've only been told to move once, waking me from sleep, when I accidentally parked in a paid reserved space at a truck stop. (Yep, they have those, more and more.)

<comment><USER4> >> So truck drivers don't overnight at UK supermarkets? What do they do when they can't park at a truck stop and they're out of legal driving hours for the day?

Don't know, but certainly not that. Even the huge supermarkets with their spacious(for the UK) car parks are way too narrow for a large truck - <USER2> delivery entrance is usually elsewhere, you couldn't even make a turn with one in here - as an example, that's probably the largest supermarket with the largest amount of parking anywhere in my area - look at how small these intersections are, no way you would fit a truck here.

[https://firstname.lastname@example.com,-1.6641004,3a,75y,333...](https://firstname.lastname@example.com,-1.6641004,3a,75y,333.5h,84.4t/data=!3m7!1e1!3m5!1sDkB4pf3qqasxAl_G5HKPzQ!2e0!6s%2F%2Fgeo0.ggpht.com%2Fcbk%3Fpanoid%3DDkB4pf3qqasxAl_G5HKPzQ%26output%3Dthumbnail%26cb_client%3Dmaps_sv.tactile.gps%26thumb%3D2%26w%3D203%26h%3D100%26yaw%3D238.5766%26pitch%3D0%26thumbfov%3D100!7i13312!8i6656)

</comment></comment></comment></comment><comment><USER6> I'm a little confused.

* They operate a single service once a week on a round trip from SF to LA that departs SF 11pm Friday and departs LA 11pm Sunday? And they have no published timetable beyond Dec 2020?

* The bus has twenty total berths and each one costs about $100? Five of the berths feature the "Cloud Bump Cancellation System" thing that's being talked up on the ridecabin.com/product page?

* So do they have one total bus?

* They are selling about $4k per week of bus tickets? Does that cover the operating expenses of their very nice looking booking system and the regulatory obligations associated with being a bus company?

* What happens if something happens to that one bus -- does everyone get some other kind of bus ticket or what? The terms of transport seems to say ( [https://www.ridecabin.com/termsoftransportationservices](https://www.ridecabin.com/termsoftransportationservices) ) that they'll try to buy you a bus ticket if their bus isn't working. So ... if the bus is broken down you probably don't know until 11pm and then, how long does it take to get an alternate bus ticket? Where do those backup buses leave from and what timetables do they typically use and how do you get there?

<comment><USER6> Does the same driver do the Friday trip south and the Sunday trip north? Do they get paid for their time on Saturday too? Does Cabin buy them a hotel for Sat/Sun? (Ha, do they park the bus somewhere and sleep on it?) Is it the same person every week or do they have a bunch of drivers? Is this a full time job for the driver or, what else do they do during the week / how do they get health insurance and pay rent?

</comment></comment><comment><USER7> I'd be satisfied with executive-class buses like they have in Mexico. Comfortable seats and useful timetables.

I'm a veteran of overnight train service between Chicago and Pittsburgh. One thing I noticed is that cheap flights are still a huge waste of time. If you fly out Friday night, you spend all evening in airports, risk getting bumped off an overbooked flight, and arrive tired at a hotel you have to pay for as well. On the way back you need an early enough flight that you aren't dead at work on Monday.

On the overnight train you hang with friends near the station, hop on the train and go to sleep, waking up fresh on Saturday morning. You have the whole weekend to do whatever and you hop on the train at the end of Sunday. Monday morning you arrive fresh, probably 20 minutes early for work.

<comment><USER8> I've taken similar train rides as you describe, albeit all over Europe.

Trains are a delightful way to travel - and as well, get some good work done. Some of my happiest code was written while castles and rivers and villages scrolled by on the window ..

In my opinion the 'long slow travel .. while sleeping/working' method of getting around is far more preferable to the 'jet age tin-can' mode, no matter how far and fast. I'd happily take a train anywhere in the world, were such a thing feasible ..

<comment><USER9> I agree with your sentiment entirely! One thing to point out - the 'long slow travel while working' mode is still possible even with tin cans. To wit:

I just had one of my most focused, productive (and enjoyable!) coding sessions of my life on a Zurich -> SFO flight. It was a day flight, 12 hours long. I was lucky enough to have a bulkhead seat in economy and conditions were perfect - it was dark (enough), I had absolute focus, unlimited coffee that got refilled automatically ;) snacks, meals, zero phone calls/distractions, and good-enough WiFi. I've never felt 12 hours vanish so quickly (and code appear so fluidly ;)

<comment><USER8> Nice! Yeah .. I've found as I've aged, I really need scenery somewhere, scrolling by in the background, if I try to travel-work. I guess I get claustrophobic without it ..

</comment></comment></comment></comment><comment><USER10> Meanwhile, in austria: [https://www.priestmangoode.com/project/new-intercity- and-nig...](https://www.priestmangoode.com/project/new-intercity-and- nightjet/)

<comment><USER8> Love these trains ..

</comment></comment><comment><USER11> The Amtrak Coast Starlight departs LA Union Station around 10AM, getting in to San Jose around 8PM.

I wish there was a train service that departed Los Angeles around 9PM, got in to San Jose at 7AM, and then expressed to San Francisco for arrival by 8.

<comment><USER12> The bus is only about $20 cheaper though. For $20 I'll take the train.

</comment></comment><comment><USER13> There is only 600 km between the two cities (I'm french distance between SF and LA was unknown to me before :) ), a normal train (200 km/h, with TGV it would be 2h and some) would take a bit much than 3 hours; with google map I only see fields, desert and mountains for nearly 550 km, why sleep in a bus ?

<comment><USER14> Because there is literally no train service between SF and LA—you have to go out of your way to transfer. The train stations are far outside of the city where you want to be. And our trains are SLOW. Less than 100km/h. It takes 8+ hours on a train.

<comment><USER13> There is a lot of way to accelerate an existing line: pendulation, remove curves, add more railways along the existing line, remove stops, on a straight railway any train can go at more than 200km/h. As for the transfer, underground/raised metro lines from the centre to the railway station in the suburbs ? Most of the new TGV station are now done outside city centre in France (for the same reason than here, surface is expensive near city centre).

<comment><USER14> Infrastructure projects in America are fucked for a variety of reasons that other posters in this thread discuss. Basically each of those options end up being super expensive, subject to unending legal challenges, and exist in a regulatory environment that does NOT support changing the status quo.

</comment></comment></comment></comment><comment><USER15> I love the idea and if it were available on the 7 hour drive I do on the regular I'd use it but some of this marketing copy is extraordinary!

> Whenever the vehicle experiences an event that will create vertical > acceleration for our resting guests (the feeling of "bumpiness")

aka whenever the vehicle goes over a bump?

<comment><USER16> Silicon Valleying to the max. Another event that may create vertical acceleration is being sucked into the sky by aliens. The question is what happens to the unresting guest when such event takes place?

<comment><USER15> Somewhere buried in their T&C is surely a disclaimer that their patented reduction of vertical acceleration technology is limited two mitigating the accelerative force that would move the captive primate (you) two inches.

</comment></comment></comment><comment><USER17> I tried a sleeper bus in China and to be frank I was scared to death the whole ride. Now traffic in the US is safer but by no means perfect. It just takes one idiot to take out a bus full of sleeping passengers. I don't think I could sleep.

<comment><USER18> Whether you're sleeping or awake, can you do anything about an accident while you're riding in the bus?

<comment><USER19> Sleep with your feet forward so you don't break your neck in a crash. (Advice given to Sara Hickman she she started touring as a musician).

</comment></comment></comment><comment><USER20> Can they order a whole bunch more and find a place to park them in SF near a gym? Then they can charge $1000 per month per spot.

</comment><comment><USER21> Their 1st gen service offered quite a bit of luggage and equipment transport for free (bike or surfboard) so it was super interesting to me. You could get on Friday night and go to sleep wake up refreshed in Santa Monica, surf, get a hotel or what not. Party until Sunday night and then sleep and be in the office by 8am. No Uber rides needed necessarily and less wasted time getting to the airport on time etc.

</comment><comment><USER22> Sleeper buses are huge in India. The railways are choked because they are run by the government. For overnight travels outside your city, sleeper buses are the most convenient options for the vast majority of the people - cheaper than flight, and more accesible/cleaner than the train.

There are multiple private operators which provide this service. Personally, I dont have too hard a time sleeping in one. It also offers more privacy than a typical sitting bus or if you are a couple you can book two beds.

There have been a couple of accidents though and people have died. Not too sure if the accident rate is more than normal sitting buses - sleeper buses arent perceived more 'risky' in India as compared to the siting ones.

</comment><comment><USER23> It's not a bus. It's a second-generation groundcraft.

</comment><comment><USER24> > During our one-year pilot, road turbulence was a frequent guest complaint. > Cabin G2 introduces our proprietary bump-canceling technology, Cabin Cloud. > Beneath select cabins, a suite of sensors, electric motors and control > algorithms instantly respond to road imperfections by moving a guest's bed > up or down to control the vibration. The technology transforms a bump that > would take a passenger out of the deepest sleep, into a bump that they > hardly notice.

This reads like parody (road turbulence?!). I haven't done it in a while, but isn't I-5 between LA and SF is a pretty normal interstate in terms of ride quality? They make it sound like an off road experience. I could see emphasizing a quiet ride, but just about any vehicle should be a smooth one.

<comment><USER25> Yeah, I-5 is smooth as hell and getting smoother by the day. But I believe buses feel bumps in the pavement to bridge transitions

<comment><USER26> A bus would likely have to stay in the right lane, which is still pretty torn up by truck traffic in big stretches.

<comment><USER27> I've seen buses in the high speed lane and if they keep up with the flow of traffic I don't mind.

<comment><USER5> I've seen signs that say no trucks in the left lane, buses ok. Buses can usually accelerate better than trucks. And trucking companies often govern their trucks. My company governs us to 65mph.

</comment></comment></comment></comment></comment><comment><USER28> "1.6x smoother than a maglev bullet train"? There aren't even any "maglev bullet" trains in service. (Unless they're referring to the Shanghai Transrapid, which is bumpy as hell but takes only about 10 minutes.)

<comment><USER29> What do you mean? The Japanese bullet train is maglev, and frankly I was under the assumption that almost all "bullet" trains need to use maglev to get those kinds of speeds.

[https://www.jrailpass.com/blog/maglev-bullet- train](https://www.jrailpass.com/blog/maglev-bullet-train)

<comment><USER30> From your own link:

"In 2009, the Maglev system was approved and entered commercial construction. The linear Chuo Shinkansen line is planned to link Tokyo and Nagoya by the year 2027."

<comment><USER29> Oh, gotcha. Thanks!

</comment></comment></comment></comment><comment><USER31> Before the era of ride sharing, many people dismissed inter-city transports like this one as impractical. But now, with Uber/Lyft, it's not at all unreasonable to take a luxurious sleeper between SF and LA and get where you need to be quite easily. Not having to deal with a TSA strip searches, no multi-tools, 23" or smaller carryons, and now "pay extra to carry on, pay extra to reserve a seat". Buses and trains are sounding better and better, and this tech savvy system sounds really good, especially once they can bring the price down to a competitive level.

</comment><comment><USER32> I think this mouse scroll capturing behavior beats Powerpoint

</comment><comment><USER33> I love how pointless some of their Apple-style Marketing blurb is.

"1.6x smoother than a Maglev train" (which I highly doubt because they don't have connection to the ground and 'fly' above the guard rail but whatever)

How many Californians have ever been on a Maglev (such as the Shanghai Transrapid). How does anyone know what 1.6x smoother means compared to something uncomparable

</comment><comment><USER34> Wow, it's almost like there's demand for a high-speed, non-driving land route between LA and SF. If only we had a fixed route land vehicle that could provide a smooth, direct route that had enough space for people to do things like sleep, rest, and use the bathroom.

Maybe I'll call this idea 'a high-speed train' and propose that California build one between LA and SF... oh wait.

<comment><USER35> I'm all for high speed rail, but why is it so expensive and why does it take so long to build?

China has been able to build out a high speed network fairly quickly. Why is it that? Is it just because they're cutting corners?

<comment><USER36> Because China can tell you "hey you don't live here anymore" and plow right through neighborhoods and farms. Our property rights in the US are pretty absolute.

<comment><USER37> Two words "eminent domain". The government, both federal and state (depending on the state) can absolutely obtain your land with zero recourse. They'll pay you for it, but you don't get a choice.

<comment><USER38> > _with zero recourse_

What? There is absolutely recourse, such as "sue them and at a minimum tie the project up in lawsuits for years". Or "be furious and rally with lots of other furious land owners/interested citizens and vote the bums out" because focused single interests, even as minorities, often can exert a great deal of political influence in a democracy. Or even illegally resisting through various means, which might not affect this area of California specifically but is a real threat in some parts of the US.

Eminent domain has an important place and has be used well, as well as abused. But whether justified or not its use, particularly in modern, is frequently fraught with controversy and political/legal battles.

<comment><USER39> It's just political suicide to use eminent domain these days, but if the political climate changes, maybe it'll be used again.

The power as written is pretty powerful and has only gotten more powerful and broad every time it's challenged in court. Since it's hard to argue that building a high speed rail isn't "public use", the only thing you'd be suing over would be the "just compensation" part.

I believe in that case, the government can take and use first, and you can lawsuit afterwards over how much money you think it's worth which really doesn't stall anything.

If the government can use eminent domain successfully take over land to give to private developers to build a mall, or even take it just to increase city revenues, it sure as hell can use it to build a train.

</comment></comment></comment></comment></comment></comment><comment><USER40> Japan has had something not quite as nice for 30 years. It runs ever night and is pretty cheap. Lots of public baths so you can shower when you arrive.

Tokyo - Kyoto/Osaka

</comment><comment><USER41> While this is a cool concept (especially the suspended, likely over-engineered sleeping platforms), I can't see sense in the business model with this type of pricing. Cabin charges $120 each way for an 8 hour _bus_ ($240 round trip), while you can get a round-trip flight for less than half that with any of the major carriers ($107 for LAX - SFO, $91 for LAX-OAK RT).

As someone that regularly travels between LA and SF, I would rather fly Delta at half the cost and a fraction of the time. Time is money, and it doesn't make sense to charge more for an 8 hour bus than an hour-ish flight, especially when the majority of travelers would rather get from point A->B as fast as possible.

<comment><USER42> I'm not sufficiently familiar with the geography of SF or LA – how does the door-to-door time and cost compare when you account for the fact that most trips don't actually start and end at an airport? I'd much rather catch a sleeper bus/train in the city centre in the evening, sleep for 7–8 hours (something I'd be doing anyway) and wake up in another city centre the next morning with a full day ahead of me than deal with the hassle of travelling to an airport, going through security, killing time at the gate, and travelling back to the city centre at my destination.

<comment><USER14> Most trips don't actually start and end at the bus depot either.

<comment><USER42> Exactly, that's why I'm wondering about the door-to-door times for a typical trip, and I don't know enough about American cities to give a qualified answer myself.

My expectation would be that they're more central and less time-consuming than most airports. Then again, my experience with bus stations so far has also been that they're even less inviting places than most airports and not usually as well connected either.

<comment><USER43> In the case of LA specifically there are several airports scattered around the area. Also 3 in the Bay. So flying gives you some choice of start-end destinations. I assume not all the combos are common routes.

</comment></comment></comment></comment></comment><comment><USER44> It's twice the price of a flight, and with planes you can pick between 3 major airports in SFBA and 5 in LA, which are probably closer to the locations you're really going between.

<comment><USER45> Not for the times involved, right? If you want to leave late on Friday and leave late on Sunday to maximize the day time you're spending then it's comparable.

<comment><USER46> And massively cheap if you factor in the saving from a night of accommodation.

</comment></comment></comment><comment><USER47> I asked a friend of mine who lives in Ventura how he gets to Stanford and he told me that he takes the train -- and avoids most of So. Cal and the bay area.

</comment><comment><USER48> Honest question, are men allowed? I assume so because I didn't see anywhere that they aren't, but I didn't see a single male in the marketing images, and it has a feminine-looking brand, so now I'm slightly unsure.

I'm assuming it's just their target demographic is young single (white?) professional women, but the homogeneity of the marketing images honestly tripped me up a bit.

Edit: on further examination I do see an image with a guy in a red track suit outside of one of their busses, I missed that the first time.

Still, to be honest I think I'd be intimidated to book a trip and be the only male on the bus. Role reversal, I guess :/

</comment><comment><USER49> Seems expensive, a flight could be cheaper?

</comment><comment><USER50> I'm 6'6". Will I fit?

</comment><comment><USER51> Only seems to be one day a week it runs per direction?

<comment><USER52> They appear to be initially targeting the customer who wants to take a weekend trip to LA from SF or vice versa. That's a high volume route, which also makes it super competitive for air travel. It seems a round trip flight costs on the order of a one way Cabin bus ride, so I assume they are targeting customers who have chosen not to fly for personal reasons.

<comment><USER53> Flights in Canada are very expensive. If they could perfect the experience and expand the market I could see this working well. They could sell "Travel Across Canada" all while you sleep. Wake up in a new location each day. All of Canada in a week. No going to the air port and all that mess just meet back at the bus at a certain hour.

<comment><USER46> A landcruise. I like it.

A european company did something like this: Busabout. They ran a circuitous route (or two) around W. Europe. You'd buy a 30d pass and hop on/off wherever you wanted. You could continue, back-track, whatever you wanted.

Doubt they had sleepers.

Kinda like the Eurail passes I guess.

<comment><USER54> The DR did it as well: Terrabus. But no overnight trips.

</comment></comment></comment></comment></comment><comment><USER55> I'm thinking a Wework on wheels. We're not a bus company we're a tech company!

<comment><USER56> Yeah, this part is what got me:

> "... Over the course of hundreds of trips, our software has mapped an > optimal way to drive for your comfort. Combining this unique dataset with > real-time tracking of vehicle stability, speed and location, Cabin Drive > instructs each driver how to safely drive for optimal ride quality based on > route and road conditions."

<comment><USER57> > optimal way to drive

Isn't it basically just a straight interstate shot for the vast majority of the trip between SF and LA?

<comment><USER58> I think if you were focused on driving smoothly as to not wake sleeping passengers you could do a lot with software. It would be pretty easy to use an accelerometer to map road conditions and tell drivers that bumps are coming up and to slow down, or to switch lanes to avoid this pot hole, even while driving the same route.

</comment></comment></comment></comment><comment><USER59> Awesome news

</comment><comment><USER60> The Achilles heel of this entire concept is that a sleep deprived, tired driver earning minimum wage is driving you through the night. Doesn't matter how luxurious the interior is.

</comment><comment><USER61> The claim that their bus is 1.6x smoother than a train is impossible, and indicative of marketing taking priority over honest metrics.

How is 1.6x smoother impossible? Imagine a maglev train has bumps with a peak amplitude of 2 cm. Then 1.6x of that is 3.2 cm. So to be 1.6x smoother they would need their cabin to reduce bumps to -1.2 cm, which is impossible.

The truth is often the inverse of this, such as, "maglev trains are 1.6x bumpier than our bus." That means that your bus is 62.5% as bumpy as a maglev train, but this doesn't sound as good to the marketing folks. For any positive metric it is impossible to be more than 100% less than something. Cabin either have people with poor numeracy skills, or they willfully used inaccurate wording to make their bus sound better. It makes me trust the rest of their marketing spiel 1.6x less.

<comment><USER62> They may have licensed the Bose Ride system, which is sold to commercial truck drivers to smooth out bumps.

[https://www.youtube.com/watch?v=T_G9GCpWAcM](https://www.youtube.com/watch?v=T_G9GCpWAcM)

Edit: Looks like Bose has sold it to Clearmotion:

[https://www.clearmotion.com/active-suspension- seat](https://www.clearmotion.com/active-suspension-seat)

<comment><USER57> The website refers to the cancellation technology as "their proprietary technology" so I'm not sure if it's licensed.</comment></comment></comment>


[Warning] Google Reader no longer reads RSS feeds unless force refreshed - <AUTHOR>

So apparently in the midst of changing Google Reader for Google+, they stopped Google's auto-checker for RSS feeds. Now, it appears that Google Reader only checks RSS feeds when a user force refreshes them (Bug Reports [1], [2], [3]).
For popular feeds, this isn't a big change since so many users are refreshing the feed that all items get caught by Google Reader (which archives the feed). However, if the feed is less popular, some items might pass through the feed between force refreshes, which means Google Reader never sees the item.
These are common for forum post, craigslist search, and custom reddit stream feeds. So if you have a reddit feed for your own subscriptions, be warned that Google Reader will now likely miss many items that pass through the feed. This also apparently affects academic aggregate feeds since they are update continuously but only refreshed by a few people during the day.
To clarify: It previously wasn't a problem because when you didn't have the Google Reader window open, it would just auto-check the feeds for you and archive the new items so they would show up unread for the next time you opened Google Reader. However, this new behavior means that Google Reader only checks/archives feeds when you have the window open and refresh the feeds. So if you close Google Reader and go to bed, you'll effectively miss all of the items that pass through the feed overnight (if no other user refreshes the same feed).
[1] - http://www.google.com/support/forum/p/reader/thread?tid=2863171aa7229dab&hl=en [2] - http://www.google.com/support/forum/p/reader/thread?tid=1840691c4a4f3004&hl=en [3] - http://www.google.com/support/forum/p/reader/thread?tid=1ebb324fc70aa1f8&hl=en <comment><AUTHOR> My company pays for Google Apps, but they are saying that Google Reader isn't covered. Anyone know how to confirm if this a bug or new intended behavior.</comment>


Ask HN: How does a software engineer become an executive at a big company? - <AUTHOR>

<comment><USER2> Stop being a software engineer and start focusing on solving business and people problems. My experience has been that if you're good ( at both software and business) the company will try to move you in the 'leadership' direction as opposed to push you into a Sr. dev role.

Companies need more executives that understand technology, because there is a huge technology war going on in old tired industries right now and even the not so bright see technology as the future. Software really is eating the world.

</comment><comment><USER3> They don't. At one particular tech company, I examined all 100+ VP's. Only one had a software engineering background and no longer works there. Merely talking about engineering will get you labelled as a serf in any big company.

</comment><comment><USER4> Focus on office politics and not on actually doing anything useful.

</comment><comment><USER5> More generally: From my (limited) experience 90% of the executives studied law or economics and simply worked for the company long enough to out live all competitors. At one the "Big four" companies I worked for the managing director had a degree in strict sciences, and worked his/her way up by specialising in security in the financial sector.

Three psychological factors before they got to the highest echelons: they were efficient, they knew the business VERY well, and they liked taking risk (many did extreme sport like freediving etc.).

</comment><comment><USER6> Learn how to build relationships, fix business problems and spot opportunities</comment>


Ask HN: What could be better in your industry? - <AUTHOR> As a business, while it might be too expensive to have custom software solution built for your exact needs. But it's completely doable if it's built as a service, as in business similar to you with same needs also use it. Then cost is spread out. So let your brain have freedom and think beyond your budget. Assume you have a magic wand and it can solve any of your business pains, just like that.
We're a group software developers who build custom software for businesses and instead of charging one customer $50k we charge monthly fee, ex: $300, to 1000 businesses.
Whatever you have in mind let it out here in comments or PM me. Doesn't matter if it's your business or you work in business and know it's a problem. Doesn't matter if you think it can be solved with a software or not.
Few questions to get you going:
- What is something that you do repeatedly and could be automated?
- What is that eats up most of your time in day?
- What is currently grinding on you?
- What software do you use that you wish was better and you think it sucks?
- What app do you wish existed for your type of business? or what app do you wish some tech company would make for you guys?
- Excel... what stuff do you do in excel manually. How much time do you spend on it.
- could there be an app/software that would allow you track something better, let your team collaborate better, alert you whenever xyz happens, let's you automate customer support, calculate quotes..
These're questions as much as for you as for us.
There are problems which you're aware of and there are some which are so standard that you may not even realize it's one. Don't hesitate, think of anything that either take times, unreliable, ambiguous, tedious, repetitive ...
Try at least 3, quantity of quality.
So your industry, title, problems, and background on the problems. <comment><USER2> Tech Sales Rep

Shitty leads, shitty data, shitty managers, backstabbing, lies, deception, unrealistic expectations, questionable value-add, little stability.

Glad I left. If it's not on a shelf or not from someone I trust (Amazon, my cousin, etc), I don't buy it.

<comment><AUTHOR> this is enterprise or small b2b?

<comment><USER2> Both but less so at enterprise level. Oracle, 5 years, 2.5 years in each department (one selling PaaS to small consulting shops and one selling tape to the government)</comment></comment></comment>


Just want to join the discussions - <AUTHOR>

<comment><USER2> ok</comment>


Ask HN: Please validate my business idea. - <AUTHOR> Concept:

  - You upload a photo along with a little slug line.
  - We convert it to artwork (example here:  http://bit.ly/1ZsJhXd ),
  - We print out a large high quality poster and ship it to you in a mail tube.
  - Price is USD 15 + shipping. Delivery anywhere in the world.
 This is more to achieve a steady monthly income to pay the rent than become a big business. My Questions:

  - 1. Should i do a mobile app or a website?
  - 2. Can this business generate USD 10,000 per month in gross revenue? (That's selling about 600 posters a month)
  - 3. Is the pricing right?
 (My earlier post did not gather enough feedback. Much sorry for repeat) <comment><USER2> Duplicate: [https://news.ycombinator.com/item?id=10893151](https://news.ycombinator.com/item?id=10893151)

Please don't post the same thing repeatedly.

</comment><comment><USER3> how will you market it? to me a 1 off product like this is hard to make money. I would start with a marketing channel and build out a test ad or whatever and go back wards from there.

</comment><comment><USER4> What distinguishes this from existing poster creation companies?</comment>


Changes to our SSL Certificates - <AUTHOR> http://googleonlinesecurity.blogspot.co.uk/2013/05/changes-to-our-ssl-certificates.html

<comment><USER2> If you have any root CA on your system using 1024 bit certificates, you will not be more secure...</comment>


Mike Pence's Comic Strips While in Law School - <AUTHOR> http://hyperallergic.com/339631/vice-president-elect-mike-pence-made-strange-comic-strips-while-in-law-school/ <comment><USER2> Wait a second. Are these reprinted with permission?

Also, if that qualifies as sexism, we need a new word for sexism.</comment>


OCaml love, by gina - <AUTHOR> http://www.gina.codes/2016/02/14/dear-ocaml-i-love-you.html <comment><USER2> I thought this post was worst reading. Many posts about liking (or disliking) a PL aren't because they aren't very informative.</comment>


Internet Vulnerability Takes Down Google - <AUTHOR> https://blog.thousandeyes.com/internet-vulnerability-takes-down-google/ <comment><USER2> It should be clarified the vulnerability was not on Google's end. It's the sort of thing we're used to by now: misconfigured/malicious BGP routes.

<comment><USER3> If google advertised several /24 for these ip networks instead of /19, this would have not happenned.

<comment><USER4> And if everyone advertised /24s instead of larger aggregate networks, routers would have to store about 12 million routes. Better yet, why not just advertise a /32 for every IP address?

Most routers would crash and the internet would stop long before we ever got to 12 million routes.

<comment><USER3> Some /24 are more critical than other. There is a price to security and for sure advertising only /24 is probably not viable.

The article mentionned that some networks within the /19, in this incident, were critical. So yes, I believe that every businesses should advertise /24 for their highly critical infra. They can advertise /19, /20 and so on for the less important networks. No need to use /24 for everything.

<comment><USER4> A valid point that I thought you might have meant after re-reading your post a couple of times.

Sorry for the quick-fire snark.

</comment></comment></comment></comment></comment><comment><USER5> nitpick but this caught my eye:

TransTelecom (AS 20485) in Russia, China Telecom (AS 4809) in China and MainOne (AS 37282), a small ISP in Nigeria.

I don't know what qualifies as big ISP but I am certain MainOne with a 14,000 kilometre submarine fibre optic cable may not be one to be classified as a small one.

From wikipedia:

The Main One Cable is a submarine communications cable stretching from Portugal to South Africa with landings along the route in various west African countries.

</comment><comment><USER6> "... countries with a long history of Internet surveillance."

Pot, meet kettle. Seriously, how is this even worth a mention? The US _invented_ wholesale internet surveillance.

<comment><USER7> This sort of false equivalency is unhelpful. It requires a great lack of judgment to believe the U.S. is comparable to the regime overseeing Xianjing on domestic internet surveillance.

<comment><USER8> It seems naive to believe that the US isn't comparable to China when it comes to surveillance considering the actions taken and information that has come out, particulary since 9/11

[https://www.aclu.org/issues/national-security/privacy-and- su...](https://www.aclu.org/issues/national-security/privacy-and- surveillance/nsa-surveillance)

[https://theintercept.com/2018/06/25/att-internet-nsa-spy- hub...](https://theintercept.com/2018/06/25/att-internet-nsa-spy-hubs/)

[http://thefreethoughtproject.com/national-id- hr4760-biometri...](http://thefreethoughtproject.com/national-id- hr4760-biometrics/)

[https://www.theverge.com/2018/1/26/16932350/ice- immigration-...](https://www.theverge.com/2018/1/26/16932350/ice-immigration- customs-license-plate-recognition-contract-vigilant-solutions)

[https://theintercept.com/2018/01/19/voice-recognition- techno...](https://theintercept.com/2018/01/19/voice-recognition-technology- nsa/)

[https://www.zdnet.com/article/us-cell-carriers-selling- acces...](https://www.zdnet.com/article/us-cell-carriers-selling-access-to- real-time-location-data/)

[https://theintercept.com/2018/06/25/att-internet-nsa-spy- hub...](https://theintercept.com/2018/06/25/att-internet-nsa-spy-hubs/)

[https://freedom.press/news/revealed-justice-depts-secret- rul...](https://freedom.press/news/revealed-justice-depts-secret-rules- targeting-journalists-fisa-court-orders/)

[https://www.eff.org/nsa-spying](https://www.eff.org/nsa-spying)

[https://www.eff.org/cases/first-unitarian-church-los- angeles...](https://www.eff.org/cases/first-unitarian-church-los-angeles-v- nsa)

[https://www.eff.org/cases/jewel](https://www.eff.org/cases/jewel)

[https://www.eff.org/cases/hepting](https://www.eff.org/cases/hepting)

[https://www.eff.org/cases/smith-v-obama](https://www.eff.org/cases/smith-v- obama)

[https://apnews.com/d69a8e6db867477795f4152d0511bbf9](https://apnews.com/d69a8e6db867477795f4152d0511bbf9)

[https://www.washingtonpost.com/news/posteverything/wp/2018/0...](https://www.washingtonpost.com/news/posteverything/wp/2018/01/25/how- to-fight-mass-surveillance-even-though-congress-just-reauthorized- it/?utm_term=.ced1b673b9fa)

[https://www.reuters.com/article/us-usa-security-records- fact...](https://www.reuters.com/article/us-usa-security-records- factbox/factbox-history-of-mass-surveillance-in-the-united-states- idUSBRE95617O20130607)

edit: Why the downvotes with no response despite my comment being entirely relevant? If anyone would like to explain/counter I would be curious to hear their reasoning

<comment><USER9> I assume the "US is comparable to China" assertion rubbed a few people the wrong way. This link collection shows the gravity of the situation in the US, and that US is drifting towards totalitarianism, without having reached that stage by a long shot. The surveillance scope is quantitatively different in the two countries, given the expressed totalitarian nature of the Chinese regime.

<comment><USER10> Something I ask myself all the time: how will I be able to tell when we've reached actual totalitarianism in the West? It won't be Chinese style totalitarianism, and I'm pretty sure they won't helpfully dress up in jackboots and announce things have reached peak totalitarianism. Would we notice at all?

</comment></comment></comment></comment></comment><comment><USER11> _" However, this also put valuable Google traffic in the hands of ISPs in countries with a long history of Internet surveillance."_

Curious what Google traffic might still be unencrypted now.

<comment><USER12> who, America?

<comment><USER13> Hush, we don't talk about that.

</comment></comment></comment><comment> whitexn--g28h Why do ISPs peer with China Telekom? BGP is built on trust, if a peer isn't trustworthy why not drop them?

<comment><USER14> These routes can spill over many different paths. There is no central authority that would be able to drop them from the whole internet. Even if one Tier 1 ISP dropped them then their routes would just flow through another one. And good luck getting all of them to agree on that unless there's some massive, _persistent_ abuse.

<comment><USER15> China and Nigeria are the types of state actors that might provide that sort of persistent abuse.

Two billion people living in an autocracy ... if Google still believed in Don't Be Evil, this would not be acceptable.

<comment><USER16> That's just a corporate motto, not an actual belief. It was, is, and always be a meaningless PR phrase as empty as any other.

It just goes to show the power of branding and how much people attach to it.

<comment><USER17> I think a lot of people at Google do take that seriously. Don't be so cynical.

<comment><USER16> Most people aren't evil, so that's not really special. Taking the statement seriously is the power of branding at work designed to drive employees.

</comment></comment></comment></comment></comment></comment><comment><USER18> From someone who does full understand BGP, I have a question

Somewhere, a BGP route was misconfigured to send data somewhere else. What would happen if a BGP route was terminating at China, and the bad actor who made it happen, decided that they are not going to fix it and just leave it.

How would the rest of the BGP network deal with it?

<comment><USER19> While investigating the alarms, a network engineer at each major network will decide to stop taking routes from the Chinese network making the advertisements, and everything will sort itself out... as far as that network is concerned.

</comment></comment><comment><USER20> Just wanted to say that I find those visualisations pretty pleasant to see.

<comment><USER21> Agreed, this was a very good advertisement for their service.

</comment></comment><comment><USER22> After glancing at the headlines, I actually did a double take. I was like "whaa? Taboola creeping into my HN"

Given the audience, it wasn't the PR managers finest hour this week. What happens in BGP land is discussed publically on the NÀNOG mailing list, and they are the friendliest crowd ever.

I've read them go out of their way to solve issues that just needed Goodwill to do in a couple of minutes, keeping the back channels open even between companies whose rivalry would dictate that they'd talk to each other only via their law firms.

1K@@ will probably be laughed at in the list

</comment><comment><USER23> This could explain why there's so little information coming out from Google as to what caused the outage. China Telekom is state-owned and thus pointing a finger at them could stir the relations with the Chinese government, regardless whether this was a bug or an intended act.

<comment><USER24> The official line[1] is that it was very likely accidental and not malicious.

[1][https://arstechnica.com/information- technology/2018/11/major...](https://arstechnica.com/information- technology/2018/11/major-bgp-mishap-takes-down-google-as-traffic-improperly- travels-to-china/)

<comment><USER25> Except it's repeatedly BGP leak accident from China Telecom.

<comment><USER26> From the article, it wasn't China Telecom who made the initial misconfiguration - it was a small ISP in Nigeria. China Telecom just accepted their BGP update and rebroadcast it.

<comment><USER27> So China telecom would have been able to fix it real fast? Hmm

</comment></comment></comment></comment></comment><comment><USER28> I get that they need a cool sounding title but they could have just said "BGP hijacking" and saved a click for everyone who knows what that is. We've seen this before and we'll see this again.

<comment><USER29> They don't want to save you a click.

</comment></comment><comment><USER30> Does anyone know if there was any relation of this attack and the Facebook outage that happened yesterday as well? Seems weird that both FB and Google have trouble on the same day.

<comment><USER31> No idea if there is correlation but something is definitely not being discussed.

</comment></comment><comment><USER32> Ironic that the company reporting this has security problems themselves. I was trying to download their cloud research pdf via google and spammers have gotten hold of them with hundreds of thousands of fake links: [https://www.google.com/search?q=site%3Athousandeyes.com+file...](https://www.google.com/search?q=site%3Athousandeyes.com+filetype%3Apdf+cloud)

</comment><comment><USER33> This went by on HN a few days ago:

"Strange snafu misroutes domestic US Internet traffic through China Telecom"

> China Telecom, the large international communications carrier with close > ties to the Chinese government, misdirected big chunks of Internet traffic > through a roundabout path that threatened the security and integrity of data > passing between various providers' backbones for two and a half years, a > security expert said Monday. It remained unclear if the highly circuitous > paths were intentional hijackings of the Internet's Border Gateway Protocol > or were caused by accidental mishandling.

[https://arstechnica.com/information- technology/2018/11/stran...](https://arstechnica.com/information- technology/2018/11/strange-snafu-misroutes-domestic-us-internet-traffic- through-china-telecom/)

[https://news.ycombinator.com/item?id=18403999](https://news.ycombinator.com/item?id=18403999)

</comment><comment><USER34> Ugh... that headline is abysmal.

It's just a BGP hijack. Get over it.

<comment><USER21> No, it's actually quite accurate. BGP hijacks are a vulnerability in the very core fabric of the internet. Just because we've seen a lot of BGP hijacks recently, does not in any way, shape, or form downgrade their severity.

<comment><USER35> If it can be done once, I guess it can be done multiple times. I don't know nearly enough about this to understand how BGP hijacks work or why they are possible. Can anyone point me to a simple explanation for a layman?

<comment><USER36> BGP is a gossip protocol. BGP roughly works like this:

As BGP nodes come online, they establish connections with "nearby" existing BGP nodes, saying what version and how frequently they'll check in, and what their AS number is (a unique identifier)

Once communications have been established, then they can start to report any network routes they know about.

"I'm AS 123456, and I am the originator for 18.104.22.168/0" (i.e. they're responsible for it), "Also, I can reach 188.8.131.52/8 with a cost of 6" (A fair number of hops away on the network).

Any neighbouring BGP peers update their routing table:

"AS 123456 is responsible for 188.8.131.52/8, and I can reach it with a cost of 1, and I can also reach 126.96.36.199/8 with a cost of 7 via AS 123456". If there's a cheaper route to a network address, no changes will happen.

Routing changes can propagate quite quickly across the internet. The routing protocol is nice and lightweight, and updates are happening with reasonable frequency, as network connections come and go.

The idea is that should damage occur to the network fabric, the network will automatically update and route around it, without need for any intervention.

It's entirely built on trust, though. You have to trust that AS 123456 is indeed actually responsible for 18.104.22.168/8.

If you get two parties indicating responsibility for a network range, it's possible to end up with routing loops etc, as things get in to a mess.

What is legitimate behaviour, though, is for, say, AS 123456 to be the originator for 220.127.116.11/8, and another AS be the originator for 188.8.131.52/24 (i.e just 254 addresses under that space). That's not an unusual situation, and it won't cause routing issues, because more specific is taken as a priority over less specific, rough analogy: "In general mail for General Electric, should be sent here, but if it's for the electronics product division, send it straight to them"

There have been different attempts to put filtering in place, provide authentication "Yes, AS 123456 is allowed to be responsible for 126.96.36.199/0" and the like, but nothing has really taken off.

<comment><USER35> Sounds like a bad actor could easily attract as much traffic as they wanted by claiming to have the shortest route to all sorts of places.

With different data snooping/data protection policies in various countries, it would also be useful if you could order your traffic to avoid certain countries.

<comment><USER36> Absolutely. ISPs, backbone providers etc can all manually filter out updates from specific ASs, and in theory habitual bad actors will have that happen to them. Filters will get put in place even as a temporary measure during incidents sometimes, depending on how responsive / capable the NOC is.

</comment></comment></comment></comment></comment></comment><comment><USER37> Why isn't there a "premium" commercial Internet, similar to DOD NIPRnet, for b2b stuff and for communications to vetted infrastructure? A random business on the Internet (eyeball, not servers) cares a lot more about routes to AWS and Google than to a bunch of other eyeballs, particularly in foreign countries.

You would still want full connectivity, but when things went wrong I could lose connectivity to a Nigerian ISP without critical business risk, but losing access to Google sucks. You could largely accomplish this by prefixing the hell out of everything except the "special" connection, and ensuring DDoS and other security filtering could drop the entire normal network if needed without affecting internal or special.

<comment><USER38> If the extremely slippery slope of this idea is not immediately obvious to you, then I don't even know what to say.

As succinctly as I can put it, this is exactly the opposite sentiment of Net Neutrality.

<comment><USER39> Internet2 basically provides this service for US research organizations.

</comment></comment></comment><comment><USER40> Why not change the title to something like "internet vulnerability blocked access to Google"?

</comment><comment><AUTHOR> An WSJ article about that: [https://www.wsj.com/articles/google-internet- traffic-is-brie...](https://www.wsj.com/articles/google-internet-traffic-is- briefly-misdirected-through-russia-china-1542068392)

</comment><comment><USER41> Such thing relatively easy to avoid [https://www.youtube.com/watch?v=CSLpWBrHy10](https://www.youtube.com/watch?v=CSLpWBrHy10) Also problems like that are significantly more rare for IPv6.

</comment><comment><USER42> Can anyone explain to me what exactly it means that BGP routes "leaked"?

<comment><USER43> By default, Cisco and Juniper routers (and likely others too, those are just the ones I can speak of) will advertise all bgp learned routes to all bgp peers unless you specify a route map/export policy.

Leaking a route would imply you're advertising the route to a peer that you've otherwise not intended to, either due to a misconfiguration or by not configuring things at all.

</comment></comment><comment><USER44> Relevant: [https://youtu.be/VVJldn_MmMY?t=924](https://youtu.be/VVJldn_MmMY?t=924)

</comment><comment><USER45> Now that's how you do content marketing! Great original research and I definitely know Thousand Eye has great BGP tools :-P

</comment><comment><USER46> Could this be a not so subtle middle finger from China to the US? (considering the recent political turmoil)

</comment><comment><USER47> Is this related to the GCP issues people were posting about this last weekend?

</comment><comment><USER48> How much private information were foreign entities able to collect from this?

</comment><comment><USER49> Given its prominence in the article 'BGP' should be defined.

</comment><comment><USER50> Or is this just an advert?

<comment><USER51> It's a legitimate incident that Google didn't explain all that well beyond "it wasn't us": [https://status.cloud.google.com/incident/cloud- networking/18...](https://status.cloud.google.com/incident/cloud- networking/18018)

OP showing off their tools contributes to the article, so I don't mind

</comment></comment><comment><USER52> China is punishing Google for not making the censored search engine?

<comment><USER53> Despite the routes terminating at China's firewall I don't think it's a good guess to say this was necessarily a Chinese attack. It seems like the interference of the Chinese firewall was simply a side-effect of the new path the network traffic was going. If you were perpetrating this attack it seems more advantageous to re-route the traffic and allow it continue working rather than discoverably interfering with the traffic. Plus if you were going to try to block the route, there's probably a better way of doing it.

<comment><USER54> China's firewall has a long history of accidental enforcement of censorship outside its jurisdiction, leaked DNS and BGP poison are the most common problem.

</comment></comment></comment><comment><USER55> Sooo... paint me stupid but I find the title completely misleading and another, very, VERY annoying thing caught my eye - after reading the text, I caught myself repeating the word "thousandeyes" and it annoyed me to no end. Then I re-read the text and I found that you can kick that word out of every 2nd paragraph and the text would still have merit.

Is this yet another marketing ploy where you post something with purposely- misleading title in order to attract traffic? I don't like the fact that word "thousandeyes" got stuck in my head, nor do I like the fact that I got clickbaited. This one is going to my list of "just like every other site since 2015, don't click".

<comment><USER56> The talk about that clickbait made me click and see whats all the fuss about

<comment><USER57> Haha. I just refuse to click on anything like that. Much like with Flash, if they want me to look they'll have to use something proper.

</comment></comment></comment><comment><USER58> Reminder that China has some big investment in Nigeria, they even built and operates a railway there.

<comment><USER59> I've been around the world to see some amazing/strange investments by China. Whole office buildings in Malaysia, South Africa, Costa Rica, etc that sit empty because a state-backed investor is speculating that this area will someday be more valuable.

No where was this more obvious than Malaysia which is their neighbor... but still crazy to see giant brand new office parks that look abandoned.

To your point, it doesn't at all surprise me about Nigeria because I saw it in ZA.

China seems to have a world wide plan for the next century.

<comment><USER60> > China seems to have a world wide plan for the next century.

If their government doesn't collapse first.

<comment><USER35> Xi's apparent desire to become president for life is certainly a liability, but other than that, China comes across as being quite stable.</comment></comment></comment></comment>


Show HN: I made a 'scrollytelling' visual explanation for the Permutation Test - <AUTHOR> https://www.jwilber.me/permutationtest/ <comment><USER2> This is a great demonstration! As someone with an interest in the idea of statistics, but absolutely zero formal training, this solidified a lot of the terms I have heard and kind of get, but didn't put together until now.

I would love to see more of these types of explanations for other statistics concepts!

Side note: I did find a typo in your explanation:

>To determine the outcome of our test, we compare our p-value to a significance level. This should be determined a prioir

That should be spelled "a priori"

<comment><AUTHOR> Thanks for the kind comment, I'm glad it was helpful. I recommend you check out explorabl.es - they have a ton of informative interactives, covering a wide range of disciplines. And thanks for the typo notification!

</comment></comment><comment><USER3> This was really interesting! I like your writing style.</comment>


Free Machine Learning Library for .NET - <AUTHOR> http://accord-framework.net/ <comment><USER2> Minor trivia - Just in case you find the woman in the test image is seemingly looking at you in a provocative manner, it is because the original source image is from a Playboy photo, published in 1972. Its usage as a test image has stirred controversy for a number of years:

[https://en.wikipedia.org/wiki/Lenna](https://en.wikipedia.org/wiki/Lenna)

[http://tech.velmont.net/the-lena-standard-test-image-full- ve...](http://tech.velmont.net/the-lena-standard-test-image-full-version/) NSFW

<comment><USER3> I think the only mature, sensible response to the Lenna "controversy" was that of Deanna Needell and Rachel Ward, who published an image-processing paper using a test image of Fabio instead.

</comment></comment><comment><USER4> They have an excellent tutorial [0] that shows using Accord.NET to implement a well known paper called "A tutorial on Principal Components Analysis" [1]. I highly recommend reading them both for anyone who doesn't know much about that field because they give a very good idea of how stuff like facial recognition, image compression, ...etc work.

[0]: [http://arxiv.org/abs/1210.7463](http://arxiv.org/abs/1210.7463) [1]: [http://www.cs.otago.ac.nz/cosc453/student_tutorials/principa...](http://www.cs.otago.ac.nz/cosc453/student_tutorials/principal_components.pdf)

</comment><comment> gene-h Does it work with mono?

<comment><USER4> Yes, it does.

Source and build instructions: [https://github.com/accord- net/framework](https://github.com/accord-net/framework)</comment></comment>


The Case for Startups to Put Customer Experience at Their Core - <AUTHOR> http://firstround.com/review/the-case-for-startups-to-put-cx-at-their-core/ <comment><AUTHOR> > Service is the product.</comment>


Hulu Bets on New Cable Style Streaming Service - <AUTHOR> http://www.wsj.com/articles/hulu-is-developing-a-cable-style-online-tv-service-1462150982 <comment><USER2> Collection of news articles on this topic from other sources, most without the WSJ paywall: [https://news.google.com/news/story?ncl=dznrpQoNz_mFaqMxOGCJj...](https://news.google.com/news/story?ncl=dznrpQoNz_mFaqMxOGCJjoMTJgw0M)</comment>


Using Giant Mirrors to Light Up Dark Valleys - <AUTHOR> http://www.theatlantic.com/photo/2013/10/using-giant-mirrors-to-light-up-dark-valleys/100613/?utm_source=atlfb&single_page=true <comment><USER2> I love heliostats. Like pneumatic tubes, there is something old and new about them at the same time and they hint of mystery. We are fools for not using the free daylight indoors when it rains down on us from the heavens. It is better for your health too.

If anybody has a good book recommendation on heliostats I would be delighted to have it.</comment>