D-Link Home Routers Open to Remote Takeover Will Remain Unpatched - <AUTHOR> https://threatpost.com/d-link-home-routers-unpatched/148941/ <comment><USER3> This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models.

This applies to every "connected device:" printers, cell phones, home routers, refrigerators, thermostats -- you name it. Michael DeGusta did a great infographic demonstrating this for Android phones in 2011 [1, 2]. Sadly, this hasn't materially changed in the eight years since. Just this year, Google added new terms to the Android license requiring security patches, but even then only for "popular devices." [3] Imagine those dynamics in the secondary and tertiary markets of printers and refrigerators.

As an industry, we've been to this rodeo before. The advancements we've made in operating system and core applications security over the last 20 years have more about patching speed and agility than shipping fewer bugs. However, those areas have backing and control from Apple and Microsoft, managing the end to end ecosystem. There is not a similarly equipped manufacturer of embedded operating systems with the scale to provide post-sale/post-deployment patching infrastructure.

Since this is Hacker News, I'll point out the enormous opportunity to anyone who can address that problem. Can you provide an "enterprise class embedded OS" to device manufacturers and address post-deployment updates? Can you provide infrastructure device manufacturers can use to manage post-deployment updates themselves? Do you have a better approach to it? There's a burgeoning multi-billion dollar market waiting for a few leaders to take it over.

1 - [https://theunderstatement.com/post/11982112928/android- orpha...](https://theunderstatement.com/post/11982112928/android-orphans- visualizing-a-sad-history-of)

2 - img link is broken in his post, the graphic itself: [http://media.theunderstatement.com/016a_android_orphans.png](http://media.theunderstatement.com/016a_android_orphans.png)

3 - [https://www.theverge.com/2018/10/24/18019356/android- securit...](https://www.theverge.com/2018/10/24/18019356/android-security- update-mandate-google-contract)

<comment><USER4> Until consumers are willing to spend on subscription services to keep devices up-to-date, new hardware is the de facto method of paying for software development work.

Of course, in reality, this CVE seems almost un-exploitable in the wild, anyway. How will an exploiter get to the login page in the first place? They'd have to know your network password and be in your physical vicinity, or your ISP would have to send traffic to your router's login page from the Internet.

So they'd have to physically drive around looking for these three specific D-Link routers.

And then what would they get out of a successful exploit? Access to your network's traffic and unprotected file shares (most people don't even have any file shares), and even that level of access will be rather useless for getting important information like bank credentials (protected by HTTPS).

Am I wrong about any of this?

A lot of non-technical people use old Android phones, old printers, etc, and never experience any serious security breach. Some of them do experience a security breach, but it's far more likely to happen in a social exploit (phishing, whaling, etc) or institutional breach (your reused password being breached from a database hack of a popular website). In a lot of ways, ignorance is bliss.

<comment><USER5> _Until consumers are willing to spend on subscription services..._

You cannot shift a Gresham's Law race-to-the-bottom dynamic by insisting on consumer (or producer) willpower. You've got to enforce a floor.

In other consumer (and industrial) products, this has tended to happen through the combined mechanisms of strict liability, certification, and independent inspection (in specific cases).

Where manufacturers, or as seems more likely given the industry concentration around sales points, _retailers_ , are liable for the consequences of unfit- for-purpose devices and services, a reasonable set of minimum requirements (including life-of-product and update requirements) can be specified, _then_ you might see a shift to some mix of time-of-sale plus subscription service pricing and payment models.

More likely you'll see devices bundled with services (which sometimes happens), though preferably in a far more user-friendly basis than is presently the case (e.g., cable service set-top boxes).

There's actually a long history of leased-equipment business in the IT sector, most notably as pioneered by IBM in the 1950s and 1960s.

<comment><USER6> As soon as warranty/support expires, the device must be free for DRM/reverse- engineering __. This will incentivize manufacturers to offer longer support.

 __Edit: Rather they should actually provide the spec, drivers etc

<comment><USER7> There are a lot of routers using GPL code that have open source firmware available (ddwrt,openwrt,tomato,etc.) I think once support for a device ends it should be mandated that the company release the source code for future development.

There is a worrying increase in the amount of IoT devices that will remain forever unpatched due to the (cheap overseas) manufacturers never updating them or ending support for them.

<comment><USER8> Make that one year before ending support, so there is both time to prepare and incentive to open source early.

</comment></comment></comment></comment></comment></comment><comment><USER9> Until there is some legally required amount of time to provide security updates for connected devices, I would expect the "buy a new one if you want to be protected" response to continue indefinitely.

<comment><USER10> What do you expect from companies that sell kit at $50/£50/€50?

You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase.

Then again, I buy stuff that can be flashed with OpenWRT ...

<comment><USER11> If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. It doesn't matter if it's a Prius or a Ferrari. These vendors are selling defective devices and it is fixable via software patch. Just because they stopped selling them doesn't mean they shouldn't have to fix it.

<comment> core-questions > If a car spontaneously combusts we hold the auto manufacturable liable for > correcting that defect.

This is a bit of a spurious comparison. Nobody is dying from an unpatched router. Why should a company be on the hook for a device, particularly if it's out of warranty? If you expect more than that, you need to be buying something with a contract stating you're going to get more than that.

<comment><USER12> It's not just "one unpatched router". It could be millions. Or millions or _billions_ or IOT devices in the future that are unpatched.

That does have the potential to create some damage if anyone takes control of them. Maybe even kill some people, if say they DDoS the V2I network for self- driving cars in the future, or a hospital network over which remote surgeries are performed, etc.

I feel like this argument that "you get what you pay for" is pretty lazy. Usually, or ideally, consumer regulations are about _setting standards_ and _raising the bar_.

So that means that if there were strong laws for stuff like this, then the minimum router price may become $70 instead of $50 - but everyone would be reasonably protected for the large majority a device's lifecycle (only a small portion of the customers should be affected by leftover bugs when support ends, like say <5%, as others will have moved on to new products by then).

<comment><USER13> Without agreeing with this point it's a perfectly reasonable one to make. Why is it dead? Seems to be quite a bit of this sort of thing of late, new ML tools?

</comment></comment></comment></comment></comment></comment><comment><USER14> I'll think twice before buying D-link again. They've just tarnished their brand irrevocably for me, even though my router is not affected - I had to turn it over and compare version numbers to be certain, and I don't want to have to track exploits and check version numbers to have peace of mind.

What manufacturer can I buy next time with a good security record?

<comment><USER15> One where you can wipe the original firmware and install OpenWRT.

<comment><USER16> There may be other answers here, but this is really the only guaranteed one.

OpenWRT really is the greatest.

</comment></comment></comment><comment><USER5> The affected routers _may_ be supported by OpenWRT, a free software wireless router project, or similar projects (dd-wrt, Tomato). Looking the OpenWRT Table of Hardware ([https://openwrt.org/toh/start?dataflt%5BBrand*~%5D=D-Link](https://openwrt.org/toh/start?dataflt%5BBrand*~%5D=D-Link)), I find:

DIR-655: OpenWRT: not listed.

DIR-866L: OpenWRT: not listed. dd-wrt: [https://wiki.dd- wrt.com/wiki/index.php/D-Link_DIR-868L](https://wiki.dd- wrt.com/wiki/index.php/D-Link_DIR-868L)

DIR-652: not listed

DHP-1565: Present: [https://openwrt.org/toh/d-link/dhp-1565](https://openwrt.org/toh/d-link/dhp-1565)

Buying well-supported hardware and flashing with OpenWRT (or similar) is strongly recommended.

OpenWRT: [https://www.openwrt.org/](https://www.openwrt.org/)

Tomato: [http://www.polarcloud.com/tomato](http://www.polarcloud.com/tomato)

dd-wrt: [https://dd-wrt.com](https://dd-wrt.com)

<comment><USER17> Most DIR-XXX routers are actually Realtek (Lexra), which developers of OpenWRT refuse to support due to the unweildy microarchitecture of the SoC.

<comment><USER5> Thanks. I thought I'd at least look. Saw some indication that a few of the devices were pretty specifically _not_ supported based on discussions.

</comment></comment></comment><comment><USER18> > D-Link last week told Fortinet's FortiGuard Labs, which first discovered the > issue in September, that all four of them are end-of-life and no longer sold > or supported by the vendor (however, the models are still available as new > via third-party sellers).

OK, let's say I am someone who actually knows "end-of-lifed" is a thing, and a thing you don't want...

How would I check to see if a certain router was end-of-lifed before buying it?

If I can figure that out, and I know it's not end-of-lifed, is there any way for me to see how much time is left in it's life before it's end-of-lifed, how would I check to make sure a router I was buying woudln't become end-of-lifed tomorrow, or next week, but has, say, a year or two of supported life left at least.

Obviously, what D-Link is counting on is that most customers won't know that this is even a thing, wont' know what questions to ask, won't realize their router is end-of-lifed, won't realize their router is vulnerable, won't realize it if their router gets hacked, and it wont' effect their likelyhood of buying another D-link router or telling others to. It's not that they think this kind of support is going to be considered acceptable to their customers -- it's that they think their customers won't even _be able to figure out_ what kind of support or security they are getting, mostly won't even realize this is even a question to ask.

And they're probably right.

<comment><USER19> _How would I check to see if a certain router was end-of-lifed before buying it?_

You should be able to Google "$MODEL_NUMBER support", although D-Link's Web site is pretty bad and doesn't say tha the product is EOL (although since the last firmware update is from 2013 you could guess).

</comment></comment><comment><USER20> Schneier has recently argued that there is a missing market for IOT security in the sense that devices manufacturers have no incentive to patch impose external costs on society, and that this might be hard to fix without regulation.

[https://www.eweek.com/security/ibm-s-schneier-it-s-time- to-r...](https://www.eweek.com/security/ibm-s-schneier-it-s-time-to-regulate- iot-to-improve-cyber-security)

<comment><USER21> Also - his recent book "Click Here to Kill Everybody" discusses the problem of IoT security in depth (ie. that the lack of it will risk increasingly dire consequences). One of his solutions is regulatory: a new federal agency for consumer cybersecurity. One of the particular things he would want mandated is that IoT devices be patchable, at a minimum.

</comment></comment><comment><USER22> I have a D-Link DIR-655 (which is on this list) as my home router. Ironically, I was going to replace it a few months ago, but the speed is still fast enough for my network.

A few posts mentioned installing a different (open source) firmware. But, both OpenWrt and DD-Wrt aren't compatible. Am I missing another option?

As an aside, can anyone recommend a wifi router that runs either OpenWrt or DD-Wrt well, for $100-$150?

<comment><USER23> You aren't missing another option. The 655 is based on an exotic architecture (Ubicom32) that never had the specs released for it to develop 3rd party firmware. Its why I trashed my 655 years ago.

<comment><USER17> Revision C1 is a standard QCA chip.

</comment></comment></comment><comment><USER24> For national security sake all routers should be required to support open firmwares.

<comment><USER25> Open source software on routers is a little complicated.

FCC requires home router manufacturers to prevent users from modifying transmit settings (primarily to prevent interference with weather systems - which 5G is also going to mess with). While the router manufacturers themselves might not provide features to modify the parameters, allowing third-party open source firmware opens them upto liability, because third- party firmware -- almost all of which are open source, can provide users with features that allow changing the transmit parameters. This is because the radio operation is controlled by the OS (most of these have linux on them), and the parameters are to be included in the same firmware blob as the OS.

FCC is not the problem here either. FCC saw the quick-fix that some manufacturers took, like TP-Link, which is to block any third-party firmware. So they required TP-Link to reverse their decision to prevent installation of third-party firmware. Then what's the solution?

The best way to prevent allowing consumers to change the transmit settings, while allowing open source firmware meant for the rest of the board (where all of the security issues arise), will require having different flash chips - <USER2> for most of the firmware, and a separate on for the storage radio parameters. This route is what Linksys is taking.

Personally, I doubt this is a good enough solution. Board designs today use a single SoC that does everything. So I'm not sure how they think storing the transmit settings on a different flash chip will prevent the firmware from using different parameters. Any design that is more complex than the two flash chip solution will require a lot of reworking of designs, because most board designs basically consist of a few components: the SoC, the flash and RAM. Nothing else.

Apart from the re-working of existing designs, there's another problem. The problem is the BOM constraints router makers face, since they are always in a race to the bottom price-wise. Adding additional chips, introduces cost and complexity, which they don't want to go through.

<comment><USER26> The FCC is certainly the problem in this case. If someone modifies the product to break the law the person is at fault not the manufacturer. That someone could do modify their radio to do bad things shouldn't stop me from modifying mine to do good things.

<comment><USER27> Would you also say that Uber doesn't violate taxi laws or AirBNB doesn't violate zoning laws, and it's just the Uber drivers and AirBNB hosts who are using the products to violate the law? What's your responsibility when you hand someone a loaded gun and it goes off?

<comment><USER28> > What's your responsibility when you hand someone a loaded gun and it goes > off?

Zero, as long as the person:

(1) Knew it was loaded

(2) Voluntarily accepted to receive the gun.

<comment><USER29> > Zero, as long as the person:

In this analogy the gun going off broke a law. So you voluntarily handed somebody a loaded gun - who then committed a crime with that gun.

Obviously context matter - but you can bet the police will be asking why you gave that gun to them.

</comment></comment></comment></comment></comment></comment><comment><USER30> I think there is a simple solution: if the seller doesn't support it, then they have to open source it.

Own (key word) an old RPG that won't run because the publisher decided the servers were no longer profitable?

RPG gets opened sourced.

Have a John Deer remote operated tractor that John Deer won't fix a bug that allows attackers to operate remotely?

John Deer's tractor software gets open sourced.

No support? No legal IP protection.

<comment><USER31> Then the problem gets moved to encryption keys, which aren't part of the "open source".

All the code's there - you just don't have the right to change it!

<comment><USER30> I don't mean that the code is merely published.

Full access to the device you own, signing keys and all.

</comment></comment></comment><comment><USER32> This is precisely why I chose to install DD-WRT on all my routers. Not only does it give me more fine grain control over all my admin privileges, I know I don't have to rely on some company making the cost-benefit decision over if it's worth patching security bugs.

<comment><USER33> DD-WRT doesn't necessarily provide more security, typically models will get one release and then not get any more updates.

<comment><USER34> I've found OpenWRT to be better in this case, support does get dropped eventually but it's usually longer term even if less polished.

</comment></comment></comment><comment><USER35> We don't have cable or a phone line, so I recently bought a D-Link router with a 4G SIM card slot and a massive yearly data plan that corresponds to the approx. amount of data I use yearly at home as a light non-streaming user (400gb at approx. $1 per gb).

I'm open to hardware suggestions that are/more open source capable or robust in the first place, but my use case was really niche and the shop(s) had nearly nothing suitable except this one model.

<comment><USER19> Mikrotik has an interesting outdoor LTE router (although I couldn't find anywhere reputable to buy it in the US). You could also get a USB or MiniPCIe modem and put it in whatever Linux box you want.

<comment><USER35> I would love to build my own that also does proxy server.

</comment></comment></comment><comment><USER36> Since I have an ESX box with multiple NICs running 24x7 at home, I've been using both, pfSense [1] and OPNSense [2] on a VM for years, with excellent performance, stability and top notch features.

Combine that with 2 UniFi APs, multiple SSIDs each landing on separate VLANs, all converging on the router VM as separate "interfaces", so you can very selectively do policy-based routing per MAC address, and whitelist/blacklist IoT devices from accessing the Internet or specific sites. It gives you a huge amount of control that is very hard to do otherwise.

[1] [https://www.pfsense.org/](https://www.pfsense.org/) [2] [https://opnsense.org/](https://opnsense.org/)

<comment><USER37> I had come into possession of a bunch of thin clients with USB 3.0 and gigabit ethernet about a year ago, and as a result I installed PFSense, which is my router in my house.

It has been great...I'm definitely never going back to a crappy commercial router ever again.

</comment></comment><comment><USER38> Isn't planned obsolesce illegal in some places? Ending security updates is the very definition of planned obsolesce for an internet-connected device.

</comment><comment><USER39> I do not own a DLink router but do own a consumer-grade Gateway from Netgear. Is there any mechanism I can use to check for published vulnerabilities against my hardware?

</comment><comment><USER40> My last couple of WiFi routers were bought because they could run OpenWRT... I feel like stories like this support that position.

At least if there was a security issue OpenWRT couldn't patch, I have the source code to do so myself.

And I haven't bought D-Link kit in a very long time. Their record on a variety of things (reliability, support, ...) means you get better value (in the low- mid market segment at least) from the Chinese vendors e.g. TP-Link.

</comment><comment><USER41> Two of these were discontinued in 2018 [1]. I'd be pretty pissed off if I bought a router that a vendor was still listing as current, and the next year told that it was EOL and would get no more updates.

[1] [https://www.tomsguide.com/news/d-link-wont-fix-serious- secur...](https://www.tomsguide.com/news/d-link-wont-fix-serious-security- flaw-on-four-wi-fi-routers)

</comment><comment><USER42> > D-Link last week told Fortinet's FortiGuard Labs, which first discovered the > issue in September, that all four of them are end-of-life and no longer sold > or supported by the vendor

First released in 2011, EOL in 2018. Can't say I blame 'em, EOL is EOL, but it's also the new planned obsolescence. (Better buy a new router every 7 years or the hackerman'll get ya!)

<comment><USER43> Apple Time Capsules [0] released in 2011 received an update last June 2019 [1] despite being also discontinued in 2018.

[0]: [https://en.wikipedia.org/wiki/AirPort_Time_Capsule](https://en.wikipedia.org/wiki/AirPort_Time_Capsule)

[1]: [https://support.apple.com/kb/DL2008?locale=en_US](https://support.apple.com/kb/DL2008?locale=en_US)

</comment></comment><comment><USER44> Correct me if I'm wrong, but in order to perform this attack you need to be connected to the router's LAN in order to access the admin page, right? So you would need to gain access to the WiFi or attach a computer to the router via Ethernet. This cannot be exploited over the internet, unless perhaps the user enables the admin page via WAN.

<comment><USER31> Sadly, wrong.

Assuming 192.168.1.1 is your router, you can craft a webpage on the public internet to exploit that IP address, without javascript.

With js, it's trivial.. But you have to deal with CORS being set up. Question then becomes - is CORS set up right? If not, pwn3d.

</comment></comment><comment><USER45> For what home routers cost, they could probably ship a new one to everyone who complains about the bug for less than it costs to patch all of them. Especially since the set of people who will actually apply a patch is only slightly larger than the set who will complain about a bug.

</comment><comment><USER46> Whoever patches them will be the one who maintains control over them. What organizations are best positioned to do that? I suggest the intelligence agencies of Russia, Israel, and the US. Whether any of them will take the opportunity is anyone's guess.

Of course, the underlying problem here is that users depend on vendors for patching, and their incentives are misaligned. Free software like DD-WRT removes that dependency and thus the incentive misalignment problem. To the extent that educational, legal, and technical measures prevent users from exercising the freedoms of free software in practice, these problems will get worse and worse

</comment><comment><USER23> I used a DIR-655 router up until 4 or 5 years ago. I threw it out because there was no new firmware for it, and neither OpenWRT nor DD-WRT supported it. I replaced it with something that did. Looks like I made the right call.

</comment><comment><USER47> A friend is using my old DIR-655. I would like to warn them, but I need to understand this better first.

Am I correct that this allows administrator access to the router, but requires connecting to the router's network (either via having the WiFi password or having physical access)?

IIRC, the DIR-655 is also stuck on WPA2, which was broken, so the WiFi password doesn't offer any protection either. In which case, anyone within range of the access point could access the admin panel.

On one hand, this sucks because aside from these vulnerabilities, the DIR-655 works fine. On the other hand, I think I bought it over a decade ago.

</comment><comment><USER48> What is the best wifi-router out now for home hackers? I'd like to do a pi- hole type setup but without the pi-hole and I also need a stronger wifi signal than on the box my ISP gives me.

<comment><USER49> Probably some low tier mikrotik. It's not for dummies though, it requires to know a bit of networking.

<comment><USER12> Mikrotik has had quite a bit of security issues, too.

[https://www.techrepublic.com/article/unpatched- vulnerability...](https://www.techrepublic.com/article/unpatched- vulnerability-in-mikrotik-routeros-enables-easily-exploitable-denial-of- service-attack/)

<comment><USER49> But they patch stuff, and afaik everyone gets the update.

</comment></comment></comment></comment><comment><USER50> And that's why you should flash your router with an open source firmware, such as [https://dd-wrt.com/](https://dd-wrt.com/)

</comment><comment><USER51> For an overview of D-Link devices I created the following page a few years ago:

[https://dlink-report.shodan.io/](https://dlink-report.shodan.io/)

</comment><comment><USER52> We need brickerbot to come back [https://en.wikipedia.org/wiki/BrickerBot](https://en.wikipedia.org/wiki/BrickerBot)

</comment><comment><USER53> It's times like this i'm glad my home router is a x86 mini PC running Arch Linux + iptables + Unifi (Complete with DNS MITM forcing all DNS out of my apartment over TLS)

<comment><USER54> How high-touch is this kind of setup? I have a separate access point and I am using a consumer-grade "wireless router" for DHCP. (and other things?)

I'm more of an app developer that does DevOps stuff when I have to. Is this something I can get done in a day or so? Is a Raspberry Pi enough, or do I need something more powerful?

<comment><USER55> If you want a less touchy solution (not completely plug and play though!) I can't recommend Ubiquiti products enough. I run an EdgeRouter X and Unifi AP at home. Not big enterprise gear but way more enterprisey than whatever you'll find on the shelf at Best Buy. Updates are released regularly and once you get your initial configuration done they just chug along, no random 'internet is down, need to reboot something' issues that (used to?) plague mass consumer designed gear.

<comment><USER56> Cheaper and older alternative is the Ubiquity Unifi Security Gateway + 8 port switch + UAC AP-PRO if you don't want the Edgerouter X cost. Less customizeable but if you're buying an EdgeRouter you know what you want.

<comment><USER13> how does power consumption compare with a setup like this vs some consumer all-in-one thing?

<comment><USER57> to be honest, most routers like this have very low power usage. I think an edgerouter X has a power consumption of something like 5W under load.

</comment></comment></comment></comment></comment></comment><comment><USER58> the more i think about it the more i notice that a lot of 'security' is actually used to verify or 'add value' to the data that gets mined meaning 'verified' traffic holds more value than non verified traffic so that might explain a reason why security protocols on routers and other common devices are not as secure as they could be. you could note that this is also a form of 'security against you' meaning a 'proof' for a court.

i don't know what the answer is to this simply because of all the variables i consider, especially the emergence of drones. how will this be secured to a degree that few can interfere with package deliveries, the abuse of surveillance and what space around a property is actually protected. as example you can drive by in a vehicle collect AP information and the average geek can obtain access so it will be with drones.

if you really want to get interesting, think about the things drones can do, such as compromise crime scenes with planted evidence.

</comment><comment><USER59> Another issue that could be avoided by using free software. Ideally D-Link would ship with free software so that the community can keep their gear working well. In practice something like OpenWRT may need to be installed by users, and depending on the hardware, support could be difficult.

If you're looking to be more careful in the future, I suggest only buying routers with OpenWRT support.

</comment><comment><USER60> I tell everyone who will listen don't buy consumer networking gear. Buy from Ubiquity or get the enterprise routers/APs from your favorite brand. They are much more likely to be updated and don't really cost much more. Sure, it takes some know how to set up, but they can call me if they take my recommendations.

<comment><USER61> Eero is a much better alternative for the average person. Solid features, INCREDIBLY easy to setup, nice app, helpful support, etc. Big fan.

<comment><USER62> They got bought out by Amazon now though, which may worry some people

</comment></comment></comment><comment><USER63> Linksys routers still ship with Samba 1.0 which has literally been deprecated for like 20 years now. These companies literally don't give a crap what they ship, I can only imagine that the firmware is made by someone who stood next to a building where a talk about internet security was held....a month earlier.

</comment><comment> rajesh-s We live in a society where people upgrade their phones every 6 months but do not think about the routers for years.

I wonder if there's any company that's trying to encourage people to upgrade their routers often.

</comment><comment><USER64> My experience only, of course, but every D-Link product I've owned has been a nightmare, from config on. I've been sticking with ASUS for a while now and so far all is well...

</comment><comment><USER65> Are attacks on home networks really an issue? I mean what percent of home networks have actually seen an intrusion? Does anyone know?

</comment><comment><USER35> Hey could anyone clarify if this is still an issue if I only use my router as a gateway and not as the wireless (WiFi) device?

</comment><comment><USER66> Sounds like exactly the kind of bug that lets you hack/install dd-wrt on them.

</comment><comment><USER67> This is unacceptable. Companies that do this stuff should be boycotted.

</comment><comment><USER68> Maybe we need some class-action lawsuits. This is very bad behavior.

</comment><comment> ga-vu DIR-655 has been EOLed in 2012... what do you people expect. Of course they won't release firmware updates forever.

</comment><comment><USER69> Sick

</comment><comment><USER70> D-Link SIRT :: For Accurate and Up-to-Date information please go to: [https://bit.ly/2nNawAc](https://bit.ly/2nNawAc)

<comment><USER71> The irony of using a shortened link in a comment on cyber security.

<comment><USER72> Non-shortened link: [https://supportannouncement.us.dlink.com/announcement/public...](https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10124)

<comment><USER73> "D-Link takes the issues of network security and user privacy very seriously. " ... "These products have entered End of Service Life. There is no support or development for these devices. We recommend replacing the device with an new device that is actively supported."

<comment><USER74> Reminds of an old post by Troy Hunt: [https://www.troyhunt.com/we-take- security-seriously-otherwis...](https://www.troyhunt.com/we-take-security- seriously-otherwise/)

</comment></comment></comment></comment></comment><comment><USER43> I'm aware of the "but what if the router is connected to an ICU bed? A patient's life depends on it!" straw man but let's be honest, it would only be the ICU's admin fault.

Having sorted this out, let me clearly state that the only ethical solution is to brick these devices offline.

<comment><USER57> i hope an intensive care unit doesn't really on a bottom of the barrel consumer device for their network reliability.

<comment><USER43> I wasn't arguing that someone might or should, I was just expecting someone to make the argument.

And there you go: [https://news.ycombinator.com/item?id=21195759](https://news.ycombinator.com/item?id=21195759)</comment></comment></comment>


DC 4 airplane engineering question - <AUTHOR> the wheelbase is very short relative to the fuselage https://en.wikipedia.org/wiki/Douglas_DC-4#/media/File:Pacific_Western_Airlines_DC-4.jpg<p>the 4 engines weigh a combined 7,000 pounds..it would seem like even with the weight of the engines, it's not enough to prevent the plane from tipping backwards. If a really fat passenger sat in the back of the pane, it would tip <comment><USER2> Best to ask here: [http://aviation.stackexchange.com/](http://aviation.stackexchange.com/)

</comment><comment><USER3> It depends on the weight distribution of the remaining mechanical parts. I say we get a dc4 and pile weight into the back until it tips.</comment>


Ask HN: Final year project in CS - <AUTHOR> Hey I need to choose the topic of my final year project of BSc Software Engineering. My uni obviously gives whole bunch of topics to choose from, but none of them are interesting to me. They are super boring (build a website for some uni department, etc.) - BOOORING!
I would love to do something outstanding, something what I could show of with to my future employers.
I am interested in big data, AI. I was thinking of doing something with drones, or some social media data analysis, or something with computer vision.
Any advice? <comment><USER2> Building a website for the archeology department is a real engineering project. It requires domain knowledge, requirements gathering, specification, working with stakeholders, iterative design, deployment, and consciousness of maintainability.

"Something with drones" is not a Software Engineering project. Writing a poem about drones is enough. On the other hand, if you can show future employers that you solved AI or Big Data as a senior project, the road ahead will be paved with yellow bricks.

The critical thing is to show your ability to execute and part of a portfolio is to provide a familiar context in which to discuss engineering decisions as engineering decisions.

Don't get me wrong, some students will have really cool ideas for their senior project. Many of them will have been thinking about it for a long time. A few of them will just be the sort of person who comes up with cool ideas. It's a bit late to try and become either type.

Good luck.

<comment><AUTHOR> I think I see the point you are making here and I partly agree with your comment.

<comment><USER2> I'll make my point another way. Trust that [at least some of] your instructors know something about what a reasonably successful final project for a student looks like and that there is an interest in setting students up for success.

If there is a lesson from HN, it is that execution matters more than creativity. [http://sivers.org/multiply](http://sivers.org/multiply)

</comment></comment></comment><comment><USER3> Pick an open source project that you like, fix a couple of bugs to show you're serious then talk with the project maintainer(s) and tell them you want to do something that takes 150 hours or so.

The reason for doing something open source is that you can point to it when a future employer asks. If you choose a "brand name" project, you can get a lot of kudos for being associated with something like that.

<comment><AUTHOR> My question is how it can become my final year project? I know I can do it in the meantime.

<comment><USER4> One way is just go into the community of the open source project you're interested in and ask for projects ideas.

Also searching for "project name" AND "project ideas" could sometimes lead to good results. for example [1].But of course before choosing a project in such way , it's better to understand a bit more about complexity and scope.

[1][https://cwiki.apache.org/confluence/display/ISIS/ProjectIdea...](https://cwiki.apache.org/confluence/display/ISIS/ProjectIdeasForStudents)

</comment></comment></comment><comment><USER5> Major projects take a lot more effort than you might expect. I would try and have lot's of small milestones that actually do something useful. The idea is even if you don't get everything working you still have something significant to fall back on.

</comment><comment><USER6> Build the website for some uni department.

Do a good job. With all the time you save, you can focus on doing things with drones or AI or whatever you want. Then inevitably when the scope of those projects goes out of control you won't have the stress hanging over you of it being for school and will be able to explore the domain with a light heart!

<comment><USER7> I wouldn't do the website as a matter of principle.

I helped build a website for a department when I was in college. I was paid a reasonable hourly rate in exchange for my services. In this case, the OP would be paying the university money in exchange for the privilege of building them a website. That's insane.

<comment><USER8> This attitude is common amongst my peers. I don't understand it all.

In general any time you do something for CS it's either trivial or if you had some qualification to back you up you could get paid; you're not paying for the privilege of designing their website you're paying for the support, guidance and ultimately assessment of your skills.

There is a problem of larger scope which is that education at a school level has been poor or non-existent as side effect of this is many people self-teach and then start university with skills way beyond their peers, web design is a good example of this because it's a relatively open platform that's easy and fun to get into, the result is that most universities must start from no assumed knowledge in the field.

It's only because you were able to teach yourself webdesign that you feel that the task is beneath you. If you really want to address this problem you need education to be better across the field so that university level can address significant tasks rather than filling in the basics for the first 2-3 years. This is starting to be addressed in the UK by the likes of the Raspberry Pi foundation and at a government level by mandated CS education in primary school but without incentives for teachers to take up the subject I don't know how effective it will be.

<comment><AUTHOR> definitely agree with you, I think I'm the case you are talking about. I came to uni with a bigger experience and knowledge than other guys, I don't blame them. But I don't want to put myself on their level that's why I'd like to propose my own topic and show my skills there

</comment></comment></comment></comment><comment><USER9> My senior project was a Super Nintendo emulator. It worked out well because 1) there's a decent amount of documentation out there on sites like romhacking.net, 2) there's usually at least one open-source emulator that you can use to figure out tricky bits (we used bsnes to help us understand how to render graphics when the documentation was vague or incorrect), and 3) emulators are super-easy to demo and verifying if you got it right is easy due to existing code you can run to test.

</comment><comment><USER10> Consider doing some language processing using the excellent NLTK library: [http://www.nltk.org/](http://www.nltk.org/)

It wasn't on the lists of "wants", but implementing the Raft consensus protocol could be neat too. It was designed to be understandable and implementable. The video is here: [https://www.youtube.com/watch?v=YbZ3zDzDnrw](https://www.youtube.com/watch?v=YbZ3zDzDnrw). The research paper is here: [https://ramcloud.stanford.edu/wiki/download/attachments/1137...](https://ramcloud.stanford.edu/wiki/download/attachments/11370504/raft.pdf)

<comment><AUTHOR> looks ambitious, I'll have a look at it in a bit

<comment><USER10> For the NLTK idea, I think you can get a long way by adapting one of the examples from the (free) book: [http://www.nltk.org/book_1ed/](http://www.nltk.org/book_1ed/)

Raft is conceptually deep, but code wise isn't actually that hard to do. However, it gives you a beautiful introduction to consensus algorithms which appear in many distributed systems.

</comment></comment></comment><comment><USER11> A word of caution - projects in topics like AI and big data sometimes end up being much larger than you thought at first. I would suggest that you find something achievable within the time you have. Besides teaching technical skills, capstone projects teach project management skills. I think you will find that future employers will be much more impressed with a well executed project than a technically impressive project that never got off the runway.

That doesn't mean you cant explore these topics... just find something that you are passionate about, and aggressively scope it down for the first pass. If you succeed, you can always make it larger!

<comment><AUTHOR> thanks, definitely good piece of advice. I know AI projects might be too big, but as you said maybe I could do something small, well executed what later on could be improved.

</comment></comment><comment><USER12> Have you tried talking directly to researches with similar interests to you about potential ideas? They'll often have stuff in the back of their minds that they wouldn't want to put out as a general proposal to undergrads...

<comment><AUTHOR> this is something I need to do. before that I want to have some of the ideas lined up in my head

<comment><USER13> Go to the website of departments, research groups, and professors at your university and get a broad understanding of what they are up to. Maybe read (the abstract of or the entirety) of one of their recent papers or check out their public outreach work/press releases. This will help you build an understanding of who's doing what at your university, their current progress/steps, etc. Contact and talk to those professors/research groups that are doing work that you are interested in -- they might have some ideas for undergrad projects.

</comment></comment></comment><comment><USER14> Be sure to check with your CS department that you can work on your own idea.

I know at my university, if I wanted to work on my own project, I had to submit a proposal several months in advance. In addition to that, I needed to have an outside stakeholder who wanted to "sponsor" the project.

1\. The idea needs to be technically challenging.

2\. The idea must be small enough in size to complete in the allotted time frame.

3\. An outside stakeholder must "sponsor" the project to mimic the real world of working with others such as a project manager.

<comment><USER15> Also be sure to find out who will actually own your project once it's done! It'd be a shame to build something you'd like to continue working on after graduation only to have it be owned by your school instead of you.

<comment><USER16> +1

</comment></comment></comment><comment><USER17> The choice of supervisor is pretty important, I was lucky and found one who held weekly meetings with all her students and who kept us all on track. She even pushed me to publish an academic paper (and a free trip to Italy to present it).

Mine was computer vision based, so you're welcome to take a look: [https://github.com/SoftlySplinter/kyffin-digital- analysis](https://github.com/SoftlySplinter/kyffin-digital-analysis)

<comment><AUTHOR> that looks cool. good job!

</comment></comment><comment><USER18> Less big data, more ML: you could build a rudimentary shazam, for either audio or images. Use small samples (~1sec clips, or 10~20% image crops) to match against an existing corpus. Bonus if the audio is distorted &/ the image is skewed/rotated a slight amount.

Not as fun: write a k-lambda [1] interpreter in x64 or ARM. More fun: write it in Python or Go. Not fun at all: write it in Verilog/VHDL.

Big data: I hope you like football! Just kidding, there are other datasets, too. You could simply create a responsive website for exploring the dataset. Or do some interesting analysis. Up to you. [2], [3]

[1] [http://www.shenlanguage.org/learn- shen/shendoc.htm#The%20Pri...](http://www.shenlanguage.org/learn- shen/shendoc.htm#The%20Primitive%20Functions%20of%20K%20Lambda)

[2] [large!] [http://aragorn.org/data/sports/NFL/seasons/metadata_since_19...](http://aragorn.org/data/sports/NFL/seasons/metadata_since_1980/uncleaned_nfl_game_metadata_since_1980.csv)

[3] [http://www.wired.com/2012/09/nfl- momentum/](http://www.wired.com/2012/09/nfl-momentum/)

<comment><AUTHOR> cool stuff, thanks!

</comment></comment><comment><USER16> 1\. Think about how much time & budget you have first. You want to make sure you can finish your project and can get it done with the resources you have.

2.1 If you're interested in "big data/analytics", why not look into Cloudera & Datameer, and talk to some people at the World Bank & the Inter-American Development Bank to see what problems you could solve for them?

2.2 Regarding AI, email/tweet some of the people at Deepmind & Vicarious (you can google for employee names) to see what they can suggest.

2.3 Regarding computer vision, try emailing Blaise Aguera or Johnny Lee to see what they consider "interesting" (or just google some of their work).

3\. Finally, AND THIS IS THE MOST IMPORTANT STEP: think about why you're doing this. Do you just want to get it over with so you can move onto something else? If so, pick a project that's relatively simple but difficult (running a marathon is simple but difficult). Otherwise, if you want something meaningful, choose something that will be fun. Choose a question that YOU want answered and that peaks your interest. Curiousity+fun will make the work feel like no work at all. GOOD LUCK!

<comment><AUTHOR> thank you for the great advice!

</comment></comment><comment><USER19> Look at the research that the faculty of your CS department is involved with, find something there that interests you and approach whoever is heading up that research and ask them to be your supervisor. See if there is some piece that you can contribute without having to understand the totality of the research.

</comment><comment><USER20> I'm working on an open-source analytics project, since you're interested in big data you might want to take a look at it. [https://github.com/buremba/rakam](https://github.com/buremba/rakam)

</comment><comment><USER21> Talk to your supervisor about your idea, draft a basic plan of the project timeline and the technology/knowledge that are required, See if you really can do it.

A big pitfall of FYP is that aiming too high but actually struggled along the way

</comment><comment><USER22> The problem with AI, if you don't have visual/immediately verifiable results, you fail. You could make great progress and have a partial solution needing polishing, and it won't be good enough if your professor is not a smart man.

A website or some graphics tool kit, well, it might not be done, but the partial solution could be seen and you get good grades. I say go for the easy stuff, take your good grades and graduate. I believe that If you were really serious and had the chops you would have had a bunch of problems that interest you and you won't be asking us.

</comment><comment><USER23> My only advice is slightly tangential to the question:

Do not lose track of how much your project contributes to your final grade (if you care about grades). It is so so easy to spend 99% of your time doing the fun project which counts towards 20% of your degree, leaving 1% of your time to study for the remaining 80%...

That said, having a decent project to show is at least if not more useful in getting a job out the other side (if that's what you want).

Good luck, would be interested to see what you end up picking.

</comment><comment><USER24> Look for a local charity or nonprofit that might need some work done. Having real stakeholders, requirements, etc, is a great way to simulate what a real project will be like.

</comment><comment><USER25> BIG IDEA: What we are not seeing yet is all this data being converted into something meaningful that front line customer service analysts can use when managing customers.

\- See more at: [http://www.information-age.com/technology/information- manage...](http://www.information-age.com/technology/information- management/123458489/why-moving-information-missing-link-big-data- chain#sthash.UjdqsnEc.dpuf)

</comment><comment><USER26> Hi, this is exactly what i was facing. The projects provides were boring. Nothing exciting so i picked my own project.

I build a chess playing lego robot. What do take in mind is that you dont overeach. You have a set amount of time. Make sure the project you pick is achievable. I over aimed and took me a bit longer to finish.

But building a complete solution for a website is not an easy task. It takes a lot of planning and knowledge to complete it.

</comment><comment><USER27> One thing that I am most likely to do is to re-build or replace older and less functional pieces of software used by the educational institution.

It's win win, there is almost always some form of old software that needs updating, new features, or just needs to be completely new, and many educational institutions will jump at "free" work.

</comment><comment><USER28> Start with an open source project that you love and can work on (technically). Talk to the developers, read the project website and work on a feature that will constitute the duration of the final year project. That way, you will be contributing to something that will help others and also get your project done!

</comment><comment><USER29> For my senior project, I was able to find a company with work in the open source space, and got a job out of it from making notable contributions to their OSS offerings. Github issues and explore are good places to start. Try and get in touch with the project leaders.

</comment><comment><USER30> You need to focus on why you're doing this - It's for your degree.

And since it's only your BSc just do the easiest project that's not boring and get it out of the way.

Build the cool stuff later. A few years from now no one will care about your GPA, let alone your final year project.

<comment><USER31> _> It's for your degree._

I'd wager that this - the notion that school is for a degree, abstract from challenging oneself to learn anything is a healthy contributor the apparent glut of 'uderemployed' graduates.

 _> A few years from now no one will care about your GPA, let alone your final year project._

Perhaps, but they'll certainly have more to gain from someone who cares about doing quality work and is willing to challenge themselves.

Further, it's not an entirely safe assumption that you'll even be capable doing 'the cool stuff later', particularly without having tried.

</comment></comment><comment><USER32> Well, one thing I always wanted to do was controlling house lighting by doing face recognition.

<comment><AUTHOR> sounds cool! tell me more about it...

<comment><USER32> The idea is to be able to count how many people are currently in the room, so that you can keep the light on. If you get bored you can also add on a simple AI to predict the number of people in the room based on hour of day and day of week.

Currently I control plenty of lights at home that are LED by using a big transistor and an arduino connected to a server running a java server program.

I would recommend doing something simple like gluing a servo to a switch to begin with.

For facial recognition, go with something off the shelf to get things up and running. And if you want to expand the scope, try to write your own simple engine instead. [https://www.openshift.com/blogs/day-12-opencv-face- detection...](https://www.openshift.com/blogs/day-12-opencv-face-detection- for-java-developers)

</comment></comment></comment><comment><USER33> I remember feeling the same thing - I could just "build a website" but I wanted to prove that I had actually learned something over the last three years.

So what did I do? I re-implemented Git in PHP (read-only). It was, to put it mildly, difficult, and stressful, but I actually managed to pull it off (mostly).

I didn't just choose at random, obviously. I wanted to add file version support to an open-source project, and after some basic research, settled on Git. The catch was that the open-source project ran in a pure-PHP environment (no modules beyond those commonly found on shared hosting). So I had to find a way of reading Git repositories in PHP without resorting to exec() etc. Hence, read-only Git in pure PHP. Throw in WebDAV or SSH and you can actually push / pull to those repositories with front-end clients like SparkleShare, which was a good candidate for future work.

I nearly went crazy, of course. I had little-to-no understanding of DVCS concepts, graphs, and so on (big O analysis is still difficult to be honest). However, by writing the project, I got much more direct experience of graph theory than I ever would studying a text book. This has turned out to be incredibly useful in my day-job as a developer.

The take-away I'm trying to get to is: pick something completely (or slightly) unrelated to computer science concepts like big data, AI, etc. and find something you're interested in. Then ask the question "How do I apply X to this?".

(These examples are purely off the top of my head, and may actually be ridiculous in practice. YMMV)

"How can I use big data techniques to analyse my web server's access logs?" "How can I use AI/Machine Learning to detect shellshock attacks on my server?" "How can I use computer vision techniques to render a map of the local area using drones?" "How can I use big data, AI, machine learning, and computer vision techniques to analyse the proportion of cat pictures and videos posted to social media?"

What I want to re-iterate though is that I started with "I want to add file versioning support to this software" and ended up discussing graph theory, diffs, patches, open-source etiquette posts by ESR, big-endian and little- endian integers (Git uses both in it's file formats), binary fanout tables, the SHA-1 algorithm, content-addressable filesystems, and all sorts of other crazy stuff I hadn't even anticipated when I started.

My supervisor liked it - I wanted to sleep for a month straight.

</comment><comment><USER34> Build a drone using ArduPilot - on top of 3DRobotics hardware. Write an AI that combines input from Twitter sentiment analysis and OpenCV to autonomously fly around the world looking for sad tweeters - drop a burrito on them.

Check, check, and check.

</comment><comment><USER35> Waw, me too have the same problem. I am interested to make final year project about education and technology (not really interested to pure "computer science" field like design algorithm, etc.), anyone has a good idea?

</comment><comment><USER36> Build a voting system based on the crypto protocol.

</comment><comment><USER37> Build a sports analysis application

<comment><AUTHOR> what the app would be doing?

</comment></comment><comment><USER38> contribute to my PHP Vulnerability analyzer. make it better.

mobman.bitbucket.org

<comment><USER3> I wrote a PHP vulnerability scanner once. It was pretty simple:

if (isPHP)

      echo "VULNERABLE!"</comment></comment>


How We Broke Democracy - <AUTHOR> https://medium.com/@tobiasrose/empathy-to-democracy-b7f04ab57eee#.shi7llrdi <comment><USER2> I must admit to wondering what was so bad about just collecting all the feeds from whoever you friended/followed/subscribed to, in order by time of publication, without algorithmic filtering.

<comment><AUTHOR> I concur - quit Facebook 6 years ago and that was one of the reasons for me.

Apparently though this approach is contributing less to "engagement" of users - cue Twitter and its loyal user base vs majority seemingly not caring much. As per the article: that unpleasant feeling when confronted with different opinions/worldviews maybe really doesn't "sell" as well. Zuckerberg does a better job creating shareholder value (maybe) but I'm still a much bigger fan of Dorsey and his service.

I like to challenge myself and follow all kinds of people, even though those tweets often do annoy me - a practice in _tolerance_ \- why not?</comment></comment>


Ethereum Developers Launch White Hat Counter-Attack on the DAO - <AUTHOR> http://www.coindesk.com/ethereum-developers-draining-dao/ <comment><USER2> More evidence that nothing is ever fully out of human hands.

The promises of Ethereum are gone. If you write a smart contract and want to rely 100% on the code to be the source of truth, and a large enough piece of the community doesn't like what your contract is doing, they may fork and revert/rewrite history.

And forget it if your smart contract isn't perfect. The good and bad will be fighting to exploit it from both sides.

RIP.</comment>


Hospitals see significant drop in premature births during lockdown - <AUTHOR> https://www.nytimes.com/2020/07/19/health/coronavirus-premature-birth.html <comment><USER2> Adding my uneducated guess:

\- there's some evidence that healthcare in general can benefit from deliberate less intervention by patients and medical staff [0]

\- maternity intervention is notorious for intervention (historically for good reasons) yet, today, so much extra can be profited by just pre-planning interventions that are distorting incentives [1]

\- pandemic has raised the stakes of leaving home, particularly visiting hospitals so people think twice before deciding to go for intervention - patients preserveer more. That includes expecting mothers.

[0] this an opinion [https://www.theguardian.com/commentisfree/2014/jul/19/patien...](https://www.theguardian.com/commentisfree/2014/jul/19/patients- hospital-care-over-intervention)

[1] [https://www.wilsoncenter.org/event/too-much-too-soon- address...](https://www.wilsoncenter.org/event/too-much-too-soon-addressing- over-intervention-maternity-care)

<comment><USER3> This seems plausible if induced labours were not excluded from the data sets.

<comment><USER2> this question will sound as uneducated as the speculation above: aren't induced labours only 1 scenario of (possibly) superfluous intervention?

Also, I couldn't find reference in the article where they describe that data as being excluded..

</comment></comment></comment><comment><USER4> I was on pre term labour watch last year and spent 12 weeks on bed rest in hospital. While the drs never knew the reason for why I was at risk (body showed early labour signs) I felt it was likely stress related. Spending 3 months in bed with all my meals provided and my basic needs met enabled me to relax and get to term. Old school treatment but it proved to work. I'd say stress correlates directly to pre term births.

</comment><comment><USER5> Uneducated guess: I've read a few studies linking air pollution to pregnancy disorders. Maybe the effects are even stronger than previously thought.

<comment><USER6> I think the article already provides a more likely educated guess:

"By staying home, some pregnant women may have experienced less stress from work and commuting, gotten more sleep and received more support from their families, the researchers said."

I am not saying air pollution should be dismissed as a factor, but the elephant in the room is that the stress levels experienced in a _lot_ of workplaces are not compatible with pregnancy.

It is also unfair to expect someone to just be 'equally performing' in the workplace during pregnancy.

From an evolutionary standpoint high stress levels are created by threats, if there are threats you are better off (from an evolutionary standpoint) suffering a miscarriage or early pregnancy since you would more likely be alive to try another pregnancy later when the external conditions present no threats.

<comment><USER7> Being in a global pandemic is arguably much more stressful than work. I'm much more stressed than I would be in an office. Could be the particular variety of stress, but that's post-hoc rationalisation.

A good piece of general evidence I once heard against this is: premature births & miscarriages did not increase in London during The Blitz (I think they may have even reduced). There's a big narrative around stress and all of its wild short-term health implications, but I'm not convinced it translates into reality. It's not easy to measure.

<comment><USER8> Most likely, pregnant women who aren't working can rest more. They can sit when the want, go to the restroom when the want, etc. These are things that take a cumulative toll when working / add a cumulative benefit when not.

<comment><USER7> It sounds appealing as an explanation, but so does the general stress argument. I'm skeptical of concrete explanations in general.

<comment><USER9> The stress of fearing a pandemic is perhaps quite different from the everyday stresses of work. We may find them both severe - even the fear much worse; but it's still conceivable the everyday stresses are worse specifically to the extent they influence birth weight. Perhaps everyday stress is more immediate; perhaps it's more physical; or perhaps it's more social - or perhaps we're grasping at straws and it's something else entirely.

In any case; just because a pandemic is stressful doesn't _necessarily_ mean that stress that matters _here_ isn't lower. All those various strains don't affect us in the same way.

<comment><USER7> It could also be that they are sleeping more, which people will try and shoehorn into: "that's a form of stress!" Stress is a buzzword, I'm wary of manhandling the theory too much as counterpoints come up, especially if it involves playing with semantics.

<comment><USER9> Exactly; stress isn't one clearly defined thing, and the forms do matter: therefore the focus on overall stress isn't that useful.

<comment><USER7> It's worse than that: "it's stress" is a lexical tautology. _By definition_ anything that causes a miscarriage was a stressor.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> My labor and delivery nurse MIL speculates it is because of the increase in fevers associated with Covid. More young moms coming in with fevers and testing positive with Covid.

<comment><USER11> Fevers cause _fewer_ preterm births? Can you explain how that works?

<comment><USER10> Parents are losing their babies sooner due to fevers.</comment></comment></comment>


Social Problems in Computer Science - <AUTHOR> http://geekfeminism.org/2010/10/03/social-problems-in-computer-science/

<comment><USER2> From the last time this was submitted:

<http://news.ycombinator.com/item?id=1553164>

<http://news.ycombinator.com/item?id=1644035> <\- This one has comments</comment>


Platforms Are Not Publishers - <AUTHOR> https://www.theatlantic.com/technology/archive/2018/08/the-messy-democratizing-beauty-of-the-internet/567194/?single_page=true <comment><USER2>
        > The internet connects more than 3 billion people
        > and enables a grand diversity among them to speak,
        > if not yet to be heard. "Republics," said the late
        > Columbia University professor James Carey, "require
        > conversation, often cacophonous conversation, for
        > they should be noisy places." That sound you hear,
        > which sometimes grates, is the racket of society
        > negotiating its norms and standards, its future.
        > It is the messy sound of democracy.

Nope, you have trolls and extremist groups gleefully spraying toxic garbage over everything, until decent, mature people abandon the site. Sane people don't post on Youtube. Some sane people post on Twitter, etc... but they eventually give up. If graffiti on a toilet stall is the standard for online "democracy," we'll never solve any problems, and only the worst people among us will actually benefit from freedom of expression.

Any site today that doesn't have iron-clad moderation (like this one!) devolves into an inhumane freak show.

<comment><USER3> (disclaimer: this is not an ad-hominem)

charlesism, you are blatantly promoting an agenda of censorship. One should not behave well due to the threat of punishment but by virtue of virtue.

You appear to stand against everything of value in the West. There are corporations and special interest groups trying to influence the narrative in reddit and even here in order to further reduce online freedoms and to establish the official list of forbidden thoughts.

Furthermore, The Atlantic has a long number of articles promoting globalism and the destruction of nation-states. A true free market of ideas requires anonymity. Who is going to help you when rampant corruption emerges in organizations such as the United Nations (a known harbor for individuals involved in child traffic scandals)? Remember the gamergate fiasco?

People all over the world are angry, and it is not their fault entirely - overpopulation and resource depletion need to be dealt with. But why doesn't anyone seem care about raising the bar on education, not just in terms of skill sets but also morality and long-term thinking?

<comment><USER2>
       > you are blatantly promoting an agenda of censorship.

Private censorship? You bet!

       > You appear to stand against everything of value in the West

Come back to earth, please.

       > The Atlantic has a long number of articles promoting globalism
       > and the destruction of nation-states.

Good, I support that.

       > People all over the world are angry, and it is not their fault entirely

I've lived long enough to see how all this came to pass. People are angry at the wrong people and the wrong things.

<comment><USER4> I'm curious, how does globalism benefit everyone, at all scales economically, equally?

<comment><USER2> Each state of the USA is large enough to be its own country. It doesn't work equally well for all states, but there is a high degree of freedom of movement, and free trade between states. If every state were indeed its own country, it seems unlikely there would only have been one war between them since 1861.

</comment></comment></comment></comment></comment><comment><USER5> I agree with the headline, but the hard part is defining what a platform is. I don't think we should just accept anyone who raises their hand and says "hey I'm a platform, guys!"

Maybe one distinguishing feature of a platform vs a publisher is curation. Verizon does not choose which phone calls I get--it routes them all. My DNS provider does not choose which requests to resolve; it resolves them all. Heck, the interstate highway carries any vehicle that meets standard specs for safety. Those are platforms.

If Twitter, Facebook, Youtube, etc simply and directly routed content without curation, they would have a stronger claim on being a platform. Instead, they use filtered timelines and "suggested content" to make decisions about what people see. That's more akin to what the Washington Post does, than Verizon.

Social media platforms will claim they use algorithms instead of human judgment to route content, so it's unbiased. Does anybody still buy that?? The many ways in which "smart" algorithms can be biased have been well covered. If nothing else, they are biased in favor of content that generates the fiercest emotions, in the name of "engagement."

And why do they do that?

I would suggest another distinguishing feature of a platform vs a publisher is the business model. Platforms are fee-for-service. You pay your ISP a fee, and it delivers the service. You pay a gas tax, and the government provides your roads.

Publishers have an advertising business model. This creates an incentive for them to manipulate you in ways that increase advertising. Your ISP does not care if you use their service... in fact, they get better profit margins if you don't! But Facebook, Twitter, and Youtube do care, and they take active steps (see: curation) to manipulate you into doing so.

</comment><comment><USER6> I don't think you get to make the "internet is a public square" argument while also advocating for banning opinions from the same. I can stand in Times Square saying Romaine Lettuce is the best lettuce of all time and people might think I'm stupid (or might not) but I get to say that all I want provided I'm not being a nuisance. Disclaimer: this is NOT a defense for incitement to violence.

Let's roll with the physical-digital analogy for a second here: When I go to the convenience store to buy a muffin in the morning, right next to the register the clerk usually has the daily paper sitting on the countertop and I can buy a copy if I think the headline it's worth reading. Or perhaps I can hear the news playing overhead on some TV in a store as I walk around looking for items. Social media currently works like if my muffin was sitting between a copy of the Times and a coupon catalog when I went to the store to go look for it. I am able to look at what I want in pieces when I go to the store, and the cluttered mess of content in the timeline is a conscious choice to keep people looking at ads and reading sensational headlines.

But here's where I keep doubting myself from playing the defense of absolute free speech in this situation: I read an article here on HN recently and commented that these situations always seem to play out through media orgs. Infowars, CNN, even The Atlantic are all companies vying to get some of that sweet sweet user interaction through gaming the platforms. They are frequently condensing their content into auto-playing videos on user timelines, publishing sensational titles in the post text linking to their articles, etc. I can hardly name instances where this was about a user with no media presence. It's almost like media orgs leverage their huge presence to push their own survival.

</comment><comment><USER7> I've never understood why people try to classify Google, Facebook, and Twitter as publishers xor platforms. It seems to me that they do both in varying degrees (especially Google).

<comment><USER8> Publishers have editorial control, platforms do not.

That's why you can be one or the other, but not both.

<comment><USER7> But Google, for example, produces original content on YouTube and YouTube is also a platform for other people doing the same. They are both.

<comment><USER8> Editorial control is about capability of checking and filtering others' content, not your own.

Platforms can also use their own products (ISPs themselves use internet or Amazon also uses AWS).

Platforms are shielded by CDA exactly because they do not care about the content that goes through it. The moment you demonstrate that you have the capability and intent to filter, you will get responsible for doing so.

So no, they still are not both. By editorializing others' content, the CDA protections are void.

<comment><USER7> With their YouTube Originals channel and all the other channels they fund, Google is clearly a publisher. You wouldn't claim they have no editorial control over YouTube Originals, right?

<comment><USER8> Editorial control over Youtube, not just Youtube Originals. Again, similarly just because some ISPs uses their own internet connection and can manage filter the traffic for internal use, does not mean they are responsible for filtering every connection they provide to customers. Or telcos, they also run some phone subscriptions, but are not responsible for every phone subscription in their network. Because they are platform, even as a user of their own platform they have certain control over their own use.

<comment><USER7> So I think we are back to where we started. Sometimes Google is a publisher and sometimes Google is a platform.

<comment><USER8> We are back to where we started only in the sense, that some people still do not understand that these two are mutually exclusive. Once you cross the Rubicon from the platform to the publisher, there is no way back and CDA no longer applies.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> > To call these platforms publishers—as The Atlantic's Adrienne LaFrance > recently did—is to presume that their task is merely to produce content.

No, publishers don't, as an essential feature, produce (in an original sense) content, they distribute it (which involves reproducing it, but that's different than producing it.) Some publishers do also control content creation, though many primarily it entirely acquire content from third-party creators.

The entire article and it's rejection of the idea that internet platforms are publishers rests on this bizarre error (it's not bizarre as a misunderstanding in the public, but it is bizarre how it can get published in a professionally edited media outlet, where presumably before publication at least one person basically aware of what publishers are had to have read and signed off on it.)

</comment><comment><USER10> If you're making a profit off of the content you're hosting, then as far as I'm concerned, you should be held responsible for that content.</comment>


Ask HN: Reliable vps? - <AUTHOR>

Looking for a cheap and realiable vps service.  Not looking for linode or a cloud provider as they are too expensive <comment><USER2> Any of the following will be suitable:

<http://www.hostigation.com> <http://www.buyvm.com> <http://www.ramnode.com> <http://www.prometeus.net> <http://www.edis.at> <http://www.severdragon.com> <http://www.ipxcore.com> <http://www.bluevm.com>

All of the above offer VPS's for really low prices.. Most of those have packages for under $3 per month.

Check out LowEndBox (<http://www.lowendbox.com>) and LowEndTalk (<http://www.lowendtalk.com>) for more cheap VPS services as most of the main cheap VPS providers can be found on there :).

<comment><AUTHOR> I have tried a few from low end box before. They aren't very reliable.

<comment><USER2> Who have you tried? I've been with many providers who advertise at Low End Box and most have been fine.

Edis, BuyVM, Hostigation, Prometeus and RamNode are some of the most respected and reliable providers there.

</comment></comment></comment><comment><USER3> I personally use NameCheap (<http://www.namecheap.com/>) and can say that they have a reasonably good interface and great support for a low-mid range price from what I've seen shopping around. However, there have been more sites like DigitalOcean (<https://www.digitalocean.com/>) that offer cloud services which, in the lower tiers, are a great value for smaller projects. If you're looking for something that scales and with more support behind it, I'd probably stick with the more expensive ones just to minimize the potential stress and hassle.

Just some thoughts to be taken as you please :)

</comment><comment><USER4> My vote goes to:

1\. IntoVPS

2\. Linode

I put Linode because they donated a year of 512MB to run FontPrep on, so kudos to them. (<http://fontprep.com>)</comment>


Bing censoring Chinese language search results for users in the US - <AUTHOR> http://www.theguardian.com/technology/2014/feb/11/bing-censors-chinese-language-search-results

<comment><USER2> Does it mean DuckDuckGo is affected by this censorship, too?</comment>


Baidu's Andrew Ng Leaves to explore a new chapter in artificial intelligence - <AUTHOR> https://www.wsj.com/articles/baidu-chief-scientist-andrew-ng-exits-chinese-internet-giant-1490161675 <comment><AUTHOR> "Baidu's chief scientist, Andrew Ng, said he was leaving the company to explore a new chapter in artificial intelligence. His departure comes two months after the firm hired a new president."</comment>


30 Time-Proven Methods to Build and Attract High-Quality Backlinks [Infographic] - <AUTHOR> https://clever-solution.com/blog/30-time-proven-methods-to-build-attract-high-quality-backlinks-infographic <comment><AUTHOR> Good read about linkbuilding strategies</comment>