Forbes Site, After Begging You Turn Off Adblocker, Serves Up Malware 'Ads' - <AUTHOR> https://www.techdirt.com/articles/20160111/05574633295/forbes-site-after-begging-you-turn-off-adblocker-serves-up-steaming-pile-malware-ads.shtml <comment><USER4> Blogspam of the story discussed in [https://news.ycombinator.com/item?id=10870892](https://news.ycombinator.com/item?id=10870892)

</comment><comment><USER5> My process

1\. Click Forbes link 2\. Get blank page where ad should be and "Continue to site" link 3\. Click continue 4\. Get request to turn off ad blocker 5\. Laugh that I can't remember that Forbes blocks ad blockers 6\. Google the headline 7\. Read the story someplace else

Hope that helps.

<comment><USER6> I really want a plug that will let me mark sites like Forbes and then decorate any links to it indicating I've already decided I don't want to go there. This way Forbes doesn't even get a +1 visit from me. I've had this thought several times over the last few months so last night I started work on a Chrome plugin that takes a regex pattern and css styles, finds the pattern in the markup and then applies the css to the first visible element containing the pattern. I'm hoping it will be useful for more than just reminding myself to not click links.

<comment><USER7> > _I really want a plug that will let me mark sites like Forbes and then > decorate any links to it indicating I 've already decided I don't want to go > there. This way Forbes doesn't even get a +1 visit from me._

Host file.

forbes.com 127.0.0.1

At home I have a giant list of sites I've blocked for this.

#Requests I turn off uBlock. Doing them the courtesy of not giving them any traffic instead.

<comment><USER8> The thing is that actually is a curtesy. If you have your adblocker off, they gain nothing from having you read their article and have to pay for the bandwidth. They don't want your traffic.

<comment><USER7> Yes - and that's the point. I wasn't being sarcastic in my comment of being courteous. I have three options. Ignore their plea, disable my adblock for them, or don't visit at all. They expect me to choose option 2. Out of the other two options, I choose the more courteous one.

All it is doing is slowing their death. News which doesn't get consumed will die out.

I'm of the opinion that ad-based business models on the internet will not work much longer. I'm of the opinion that only three business models will survive the next decade:

1) Collecting and selling user data in bulk (Massive sites that have access to said data)

2) Paywalls (Most sites)

3) Donations (minority, tight knit communities)

Will the web be worse off for it? Potentially. But I see ads as _extremely_ harmful to people and not something to be tolerated regardless of the reason. From the subtle control over peoples' psyche, serving malware, or even being straight up scams... I don't see advertisements as moral and think the world would be better off without them.

</comment></comment></comment></comment></comment><comment><USER9> IMO, this is the biggest issue facing ad providers today.

I get the anti-ad blocker complaints - there are a lot of sites that depend entirely upon advertising revenue for their continued existence. And this isn't just crappy blogmills - even a company like the New York Times doesn't make enough money from subscriptions alone to continue operating without advertising of some sort.

Maybe there's a different model out there but as far as I'm aware no-one has found it yet, and in the mean time I'm quite prepared to tolerate advertising on web sites in return for the content I get. I'll even tolerate a pre-roll ad or a full-screen takeover before I get to a page every now and then - <USER2> there's a line. The mild end of it (for me) is ads clearly intended to make you click by accident, and the severe end of it is malware like this. And in my experience it's on the rise.

By all means implore your users to turn off their ad blockers. But clean house first and make sure you know what you're serving. The real problem is that it's borderline impossible for anyone to do so, given how many reseller networks exist out there these days. I often see people say that sites should arrange and sell their own advertising - but the reality is there's no money in it. Selling yourself out to the Google ad behemoth is often the only way out.

<comment><USER10> "Maybe there's a different model out there but as far as I'm aware no-one has found it yet"

Sure they have. Sites just need to host the ads natively instead of outsourcing that responsibility. But they don't want to do that, because they don't want to take on that responsibility.

<comment><USER11> This is how my site works and it works well. In theory I might be able to make a bit more via an ad network, but I like treating my site like a magazine and have highly relevant and high-quality ads.

<comment><USER12> I just looked at [http://officesnapshots.com/](http://officesnapshots.com/) and I agree -- that's what advertising _should_ be. Congrats.

Two questions: how much time do you spend selling/negotiating with advertisers? And you say you could earn more from a network: have you researched at all exactly how much more?

Naively, it seems that maybe advertisers would pay you _more_ because 100% of the visitors to your site are relevant to their products (but admittedly I'm out of my realm of expertise).

<comment><USER11> Thanks for the kind words!

It is difficult to say how much time I spend on that side of things since it has been built up over time and have pretty high advertiser loyalty - <USER3> guess, but maybe 5-20% depending on the time of year. Most of my time is spent acquiring, editing, and categorizing content as well as adding new features to the site.

I haven't really done much research into the various networks, but I do get sales pitches from time to time. My first question is always wondering which advertisers using the network are relevant to my readers (almost always the answer is none). Plus at this point I have a direct relationship with marketing departments, so there isn't really a need for a middleman.

Edit: for people here interested in tech offices, here's the best link: [http://officesnapshots.com/offices/?fwp_industry=technology](http://officesnapshots.com/offices/?fwp_industry=technology)

<comment><USER13> This is more or less the old print model - take a topic, create quality content, take money from very specific relevant advertisers.

It's such an obvious model that it's amazing the ad industry hasn't understood how well it works. Instead they persist in using crappy non-functional trackers and ad blocker blockers and all kinds of other bullshit techniques - because apparently they'd rather game readers than provide something good and useful.

Postscript: a minor bug. I'm using OS X Chrome, and the ad bar keeps twitching when I reach the end and try to scroll down further.

<comment><USER11> Yeah, I basically think about the site as being a magazine with enhanced features. Unfortunately news sites like CNN don't have a narrow audience and therefore use technology to slice and dice the visitors into narrow groups.

Is that scroll bug on all pages with the ad sidebar? Do you run any script blockers?

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> I'm willing to compromise on web advertising, but not while this is possible. I don't understand why on Earth ad networks, and more importantly content publishers, allow arbitrary Javascript and Flash through their networks and onto their websites. You as a content publisher are not allowed to compromise your users' security, full stop. You are responsible for any compromises that come through your website. Until content publishers get that through their thick fucking skulls, I will continue to use an ad blocker and strongly recommend them to everyone I know. I would rather all ad-supported businesses fail than allow this malware to continue be distributed.

</comment><comment><USER15> Google is largely responsible for the situation we're now in. As the largest provider of ads on the web, they regularly turn a blind eye to malware advertising served by their network.

They simply do not take malware seriously. They continually let it exist on their ad network. As a publisher that uses Adsense I find this extremely frustrating. As example: I've spent quite a bit of time attempting to block ads that lead to the "ask.com toolbar." These are always deceptive. They confuse my visitors and then I hear about it.

Additionally ads where the only text is "Download Now" or "Read Your Private Messages" are clearly deceptive. And yet they're allowed.

There are so many _easy_ ways Google could improve the situation. And yet, they don't. This is a serious problem, and it is only going to get worse until Google responds appropriately.

<comment><USER16> The problem isn't Google or DoubleClick; it's a structural problem with the ad industry.

Most sites that serve ads can't sell all their inventory directly, so they fill their remaining impressions with ad networks, who sell bulk inventory space. Those ad networks have the same economic limitations from selling all their inventory, so they need to sell _their_ remaining impressions to another network. And so on down the line.

All it takes is for one ad network to get a little loose with their serving policy for a malware provider to make an in. And I can't think of a way for an upstream ad network (or even DoubleClick) to ban malware, without tracking down that errant provider. You can't blacklist a domain, because usually the ad network hosts the ad itself. And like it or not, ads have to run Javascript or Flash.

It's a crappy situation to be in, but it's not any one actor's fault (except for the malware advertiser), and the fix isn't easy or else someone would have thought of it.

<comment><USER14> > And like it or not, ads have to run Javascript or Flash.

They certainly don't need to run whatever arbitrary scripts the advertiser wants. The advertising network can provide whatever functionality the advertiser needs, there's no reason to leave this obvious hole open. The idea that I can pay someone some cash to put whatever arbitrary JS I want directly into Forbes's website is utterly ludicrous.

</comment></comment></comment><comment><USER17> Because it may not be obvious, this article is from early January. A number of different sites reported on these incidents back when they happened. Here are a few examples:

[http://www.engadget.com/2016/01/08/you-say-advertising-i- say...](http://www.engadget.com/2016/01/08/you-say-advertising-i-say-block- that-malware/)

[http://www.extremetech.com/internet/220696-forbes-forces- rea...](http://www.extremetech.com/internet/220696-forbes-forces-readers-to- turn-off-ad-blockers-promptly-serves-malware)

[http://www.networkworld.com/article/3021113/security/forbes-...](http://www.networkworld.com/article/3021113/security/forbes- malware-ad-blocker-advertisements.html)

<comment><USER18> Was wondering if it was happening again or what the deal was. Just a months old article popping up again for some reason.

</comment></comment><comment><USER19> My $0.02

Publishers should look to Stack Overflow and be inspired to run ads of high quality and relevance[0].

Throw out the ad networks, tracking, and reject rich media ads. Instead focus on high value ads that align well with your readership and manually verify the quality of these ads. If publishers do this I am willing to turn of my ad blocker.

0: [https://blog.stackoverflow.com/2016/02/why-stack-overflow- do...](https://blog.stackoverflow.com/2016/02/why-stack-overflow-doesnt-care- about-ad-blockers/)

<comment><USER20> Publishers want to make more money than Stack Overflow. That's basically why.

</comment></comment><comment><USER21> This is why I use an adblocker blocker blocker ([https://github.com/reek/anti- adblock-killer/](https://github.com/reek/anti-adblock-killer/)).

<comment><USER22> Seems to me this functionality could be wrapped up in a web proxy. The proxy can pretend to allow all the ads, and simply drop them on the way to clients. Of course this doesn't deal with the issue of ads soaking up a bunch of bandwidth.

I get tired of installing ad blockers on every machine/device in the house, and on some machines use multiple different browsers -- I'm suffering from blocker installation fatigue.

<comment><USER23> > I get tired of installing ad blockers on every machine/device in the house, > and on some machines use multiple different browsers -- I'm suffering from > blocker installation fatigue.

If you run dnsmasq, you can block [1] a lot of ads for your entire house at once through DNS.

1: [https://www.debian- administration.org/article/535/Blocking_a...](https://www.debian- administration.org/article/535/Blocking_ad_servers_with_dnsmasq)

<comment> w-ll There's also Pi Hole, which you setup on a raspberry pi. Which is nice because you can leave it on all day. Where as at night when I shut down my desktop but might be using my phone or a tablet.

[https://pi-hole.net/](https://pi-hole.net/)

<comment><USER24> This looks awesome, but is there a way to bypass this from the browser? Occasionally, I give in and disable ad block if I really want to see something.

</comment></comment></comment></comment></comment><comment><USER25> Pretty sure they didn't actually serve malware and that news sites just made the click-bait title for clicks.

[http://www.ghettoforensics.com/2016/03/of-malware-and- adware...](http://www.ghettoforensics.com/2016/03/of-malware-and-adware-why- forbes-was.html#more)

<comment><USER26> I understand everyone's frustration around this issue, I hate site that block adblocker users as well. However, this article is an example of unethical journalism.

TL;DR

Article says "Well, how about they start treating their ad inventory with at least a percentage of the care with which they treat their content?"

The researcher who discovered the issue says "Forbes almost immediately reached out and we started a dialog. We shared logs, events, and descriptions of the ad."

In contrast, when the researcher reached out the correct the Engadget article that started this and quoted him, he got no response.

</comment></comment><comment><USER27> I remember thinking this was suspicious. I remember about three months ago I added a bunch of known malware sites to my hostfile so that I wouldn't give them traffic, and I couldn't get to Forbes.

Funny, too, because I don't even use Ad-block.

</comment><comment><USER28> Those sites that serve up malware scripts and call them ads, perhaps ad- blockers should rebrand and start calling themselves malware-blockers?

</comment><comment><USER29> Wow, the language, "hold their content hostage". I hate ads probably more than most[1], but still, if Forbes doesn't want to give up their articles without fair compensation, that's their prerogative. They're not taking hostages.

\--

[1] [https://news.ycombinator.com/item?id=10939083](https://news.ycombinator.com/item?id=10939083)

<comment><USER30> Uh...'fair compensation' is not installing malware. I don't think that's ever fair.

<comment><USER29> I didn't say it was. I thought that was implied when I said I hated ads. But the language of holding your own writings "hostage" because you don't want to give them up without some kind of compensation is just absurd.

I wish Forbes just was honest and went full paywall. I wish everyone did this.

</comment></comment></comment><comment><USER31> I noticed there are a lot more sites that can detect Ad Blockers. They hassle you about disabling the blocker.

Why not just make the ad inline into the content of the page. It would speed up the site as you would not have to make all the extra connections to these ad networks via thirdparty javascript.

<comment><USER32> Ad networks don't want to trust publishers to accurately report page hits with inline images, they also would presumably like to be able to track users and serve up "tailored" ads, which they can't really do if they don't get any information on the user before serving the ad.

</comment></comment><comment><USER33> I'm not sure why one of these big sites haven't been hit with a class action lawsuit... the website is responsible for the content it delivers... period. Especially when they force users to disable their ad blockers.

It seems to me, that someone who got an $xxx ransomware, or paid the nerd herd to remove malware from their computers could be the base of a class action lawsuit... That's what it will take to get this crap to change is to actually hold one of these larger media sites responsible.

<comment><USER34> Agreed. If Forbes is serving malware to visitors who have complied with its instruction to turn off their adblockers, and if those visitors suffer damages due to malware served through Forbes, you'd think there's the basis for at least individual suits against Forbes, maybe class action.

One argument is that Forbes has a duty of care and the ability to prevent serving damaging malware to its compliant invitees (visitors). They're in breach of that duty, so maybe damages for negligence?

</comment></comment><comment><USER35> So what's wrong with image-only ads? Why do we have to let advertisers inject their own JS into a web page?

</comment><comment><USER36> What bothers me in the ad blocker debate is that publishers want me to turn it off so I can see the ads.

Not _click_ on them, just see them. Even though I _never_ click on any ads, they still consider it valuable to subliminally influence me into wanting stuff I don't want.

To me, this is even shittier than forcing me to click on an ad before giving me the content. But to also serve me malware... is beyond shitty, it's dangerous.

Content is cheap these days. There's too much of it out there, high quality and free. In fact, I wouldn't mind if there were less content produced on the Internet.

I know that the content that is really valuable will still stay and all the bullshit that needs ads to stay afloat will disappear.

Forbes with malware? No, thanks.

For me the rule of thumb is this - if you need me to turn off my ad blocker, then I don't need your content.

</comment><comment><USER37> I use Steven Blacks hosts script[1] and every time I see Forbes paywall, I just leave. If the article is _that_ important, some other outlet will cover the news.

[1] - [https://github.com/StevenBlack/hosts](https://github.com/StevenBlack/hosts)

<comment><USER38> I knew about someonewhocares, but this is appears to aggregate that plus several others. Thank you for the tip!

</comment></comment><comment> http-teapot I run both AdBlock and Ghostery. I experienced the same interstitial as every one, was particularly interested in the article headline, disabled AdBlock, reloaded the page, still blocked, disabled Ghostery, reload the page, worked.

Ghostery disabled, it initially reported that about 60 trackers loaded in the page which then quickly turned to 97 to then reach more than 110 trackers.

I highly recommend installing Ghostery.

[https://twitter.com/teapot/status/707016161234276352](https://twitter.com/teapot/status/707016161234276352) [https://twitter.com/teapot/status/707016382286680066](https://twitter.com/teapot/status/707016382286680066)

<comment><USER39> Why use a blocker by a company that sells user statistics?[1] Seriously wondering, since uBlock provides virtually the same and more.

[1] [https://en.wikipedia.org/wiki/Ghostery#Business_model](https://en.wikipedia.org/wiki/Ghostery#Business_model)

<comment> http-teapot I'll give uBlock a try!

I am aware of Ghostery's business model and I am not against businesses selling metrics and/or ads in general. I think there should be consequences for companies that do not have the best interests for the users.

</comment></comment></comment><comment><USER40> Forbes' "Please turn off your adblocker" interstitial is a great reminder not to read Forbes' clickbait bullshit pseudo-journalism.

<comment><USER26> as opposed to this article's clickbait bullshit pseudo-journalism?

[https://news.ycombinator.com/item?id=11455718](https://news.ycombinator.com/item?id=11455718)

</comment></comment><comment><USER41> Yesterday I tried to read a Forbes article on my mobile. It presented me with the banner asking me to turn ad-blocker off (which I haven't installed). I reloaded the page and was faced with pop-ups claiming I had won free Amazon products.

<comment><USER14> If you're interested in mobile ad blocking (if you're concerned about the security of your mobile device, you should be), uBlock Origin works very well in Firefox for Android. I strongly recommend you install it before your device is compromised.

<comment><USER39> Or on iOS Purify, which was made by the developer of uBlock, Chris Aljoudi:

[https://www.purify-app.com/](https://www.purify-app.com/)

</comment></comment></comment><comment><USER42> Apart from the security aspects (and Forbes' responsibility therein), I'd like to say something about an argument I hear often in this context: That without payment via advertising, the "quality content"-writers won't have a reason to produce more quality content and it will dry up (or something; the actual consequences are often left to the imagination).

Consider clickbait.

Consider listicles, blogspam, the "you'll never guess X these celebrities Y", reposts of photos of cool-seeming-yet-utterly-impractical things to do with food/furniture/clothing/lifestyle/health/etc. At some point you probably helped clean out a friends' Windows laptop, tried to Google whether some process or application is useful or safe to remove--yeah those sites. I can't list all the types and categories, there's hundreds.

The _only_ reason trash like this even _exists_ , the only way this unfathomable high-volume fire-hose of vapidity is made possible, is because of these advertising networks.

 _This_ is what the vast majority of all those advertising dollars buys us.

Who is more likely to stop producing content if advertising revenue disappears? The high-volume low-effort clickbait-linkspam writers, or the "quality content" writers that actually care about the things they write about?

I'm convinced that if the online advertising industry were to collapse some day (I can hope, but I doubt it'll happen), it will be a net-positive for ALL the content online. Not just because an Internet without advertisement is just so much nicer, but also because the clickbait writers will be the first to stop producing "content", because unlike the quality writers that care, there will be exactly _zero_ reason for them to continue producing informational landfill.

</comment><comment><USER43> I block all ads globally. Until this "different model" becomes prevalent I'm not budging. The argument that there are websites that can't operate without ads is valid, but there is no websites that __actually__ need ads that would be willing to wall users of ad blockers. Sites like YouTube could never implement such a wall without significant loss of revenue.

</comment><comment><USER44> Forbes is truly terrible at this. I tried to read something there, had to disable my ad blocker and ghostery. After refreshing, ghostery counted 40+ trackers on the site.

[https://www.ghostery.com/](https://www.ghostery.com/) \- I recommend it

</comment><comment><USER45> How is this not a violation of the CFAA? Why isn't Forbes being held responsible and prosecuted? So if I go and access one file whose name is not public on Forbes' website, I'm looking at least at 5-10 years in jail but Forbes can infect millions and they get off scott free. The problem isn't ad blockers, the problem is the ad networks. They are criminal and should be held responsible. They should be shut down like any other spam network. They should be made to pay. And anyone who uses these criminal networks to infect computers is an accomplice and should be treated so.

At the very least, the people who are anti ad blockers will hopefully shut the fuck up now because they're wrong and it's not a matter of opinion.

</comment><comment><USER46> The other day on Forbes site I clicked political article title in "relevant articles" section just to be directed to penis enlargement web-site w/ popups & malware. Interestingly the political article was definitely relevant not to the article I read, but to my region. Checked back and found that this "relevant" section is actually some 3rd party content exchange widget that masks malware links under popular keywords and titles relevant to a reader region where all titles lead to a malware web-sites.

</comment><comment><USER47> If Forbes set a minimum price for their ad backfill inventory (the shitty ad inventory they fill with low quality ads), could it economically not make sense to the networks to fill that space with malware ads?

<comment><USER48> Unfortunately I think you have it backwards.

Malware ads are being displayed because they are winning the auctions. That's because - on a CPM basis - malware authors are probably the ones who will always be able to pay the most. A successfully infected machine is worth a good chunk of change.

Ad networks are uniquely suited to malware delivery. Have an exploit which only works for OS X users? Don't bid on the windows users.

</comment></comment><comment><USER49> You don't want me as a reader and I don't want to read your ads, including the ad about turning off my ad blocker. But the search engine I use sent me to your site and it doesn't let me filter out sites with ads. I wish it did. Obviously Google is never going to do it since they're the ones selling ads. I had hopes for duckduckgo but they're showing more and more ads. What I'm saying is, we need a search engine that excludes sites with ads.

</comment><comment><USER50> Apart from this, i have given up on Forbes because they keep almost all content in multiple pages with no option to load in a single page(at least on mobile).

</comment><comment><USER51> Maybe we need to hold websites accountable for the ads that are served through them. Maybe once they are sued a few times, they will take this seriously.

</comment><comment><USER52> Wasn't there a report like this about Forbes and malware a few months ago? Have they responded in press? (Hopefully on Medium so I can read it.)

<comment><USER14> As far as I've seen, content publishers' response to being caught distributing malware is to say "It's the ad network's fault! We'll work with them to clean it up." They never name the ad network and no changes will be implemented. The only way to protect yourself is to install an ad blocker.

<comment><USER53>
      C: Excuse me?  Are you the produce manager?
      M: Yes, that's me.
      C: Oh, good.  Yesterday, I bought a banana here.
         When I got it home, I discovered there was a bomb in it.
      M: I'm only the produce manager.  I don't deal with bombs.
      C: But the bomb was *in* the banana.
      M: How was it?
      C: How was what?
      M: The banana.  Not bruised or overripe or anything?
      C: No, the banana was fine.  It was a perfectly normal banana.
         ...with a bomb in it.
      M: Ah, good.  Another satisfied customer.
      C: I am *not* satisfied!  I could have been killed!
      M: Were you?
      C: Obviously not!
      M: So what's the problem?
      C: There was a bomb in my banana!
      M: Well, we just sell the bananas as we get them, from the banana-modifying company.
      C: Why can't you just get your bananas direct from the plantation?
         Why can't I get an unaltered, unmodified banana--without any bombs in it?
      M: Excuse me, sir or madam, but this is a *business*.
         How do you expect us to pay our employees with a store full of unmodified bananas?
      C: [facepalm]

</comment></comment></comment><comment><USER54> You know, this is why my dad's computer is riddled with malware every single time I go over to his place. No new apps were installed, he doesn't even know how. But he does browse the web.

First thing I'm doing when I get over there is install the most restrictive ad blocker I can find.

</comment><comment><USER55> Business opportunity:

Browser extension that gets all the articles, post-processes to strip the ads and serves the content when user asks for the same article url. I'd pay $9.99 for it. If the publishers won't get on board a unified subscription service, let's just go around them.

<comment><USER56> Pretty flagrant copyright violation. However something _like_ this idea is what Brendan Eich is currently working on with Brave.

</comment></comment><comment><USER57> Simple fix: [https://github.com/Mechazawa/FuckFuckAdblock](https://github.com/Mechazawa/FuckFuckAdblock) I don't know why more people use this. It simply blocks sites from taking you hostage

</comment><comment><USER58> I'll just take this opportunity to plug the Forbes™ Splash Screen Bypass Chrome extension.

It's not my extension, and I don't know the nitty gritty details of how it works, but I do know it stops that horrible Forbes splash screen from popping up.

</comment><comment><USER59> This is why I block all ads, all the time. No exception. There are no "good" ads.

<comment><USER60> Same. Ads aren't good for anybody's health.

</comment></comment><comment> slipstream- And that's why I use a nice helpful userscript that aims to work around these things: [https://github.com/adsbypasser/adsbypasser](https://github.com/adsbypasser/adsbypasser)

</comment><comment><USER61> This article is true, but it's from January. Why is it at the top of the heap now?

</comment><comment><USER62> Seems simple enough, sue Forbes.

</comment><comment><USER63> So far pi-hole[1] network based ad-blocker has proven to be the best use of the Raspberry Pi i bought and didn't know what to do with it.

[1] [https://pi-hole.net/](https://pi-hole.net/)

<comment><USER64> Seems interesting. What is the performance/latency penalty?

<comment><USER65> Performance seems fine (on a Pi 2). I am going to have to add some URLs to the whitelist though, as it has recently started affecting the ability to log into Xbox Live.

</comment></comment></comment><comment><USER66> if you're interested in escalating the adblock arms race, i've been using IsraBlock[0][1] and it seems to work well

[0] [https://chrome.google.com/webstore/detail/israblock/kekndmao...](https://chrome.google.com/webstore/detail/israblock/kekndmaoonpjhjhobkcegfaaikgnccbo?hl=en)

[1] [https://addons.mozilla.org/en- US/firefox/addon/israblock/?sr...](https://addons.mozilla.org/en- US/firefox/addon/israblock/?src=cb-dl-recentlyadded)

</comment><comment><USER67> [https://twitter.com/wilkieii/status/684270238158958593](https://twitter.com/wilkieii/status/684270238158958593)

</comment><comment><USER68> Sue them, file a class action and I am sure, they will learn.

</comment><comment><USER69> Forbes is dealing with ad networks that aren't trustworthy.

The ad networks that are most profitable are going to have some terrible deal flow that includes malware and viruses.

</comment><comment><USER70> Why isn't this producing litigation? Users can sue Forbes. Forbes can sue their ad supplier. There's a strong argument for negligence here.

</comment><comment><USER71> There needs to be a user-side ad validation layer, something that displays any ad that meets industry security, load time, and tracking standards.

</comment><comment><USER72> I saw the title and thought "What, _again?_ " But the article is three months old; it's about the original incident.

</comment><comment><USER73> And that's why I never go to forbes anymore. It's a bad user experience. Now they can add greedy and not secure to the list.

<comment><USER74> Treat yourself and switch to never going there for the indifferent to poor quality of the content. Whenever I hit the adwall I'm just grateful for the reminder that I don't have to waste my time on that

</comment></comment><comment><USER75> If I really, really need to read an article on Forbes, I put the link in Pocket. Strips away all the advertising and everything.

</comment><comment><USER76> I stopped writing my column on security for Forbes after they started to refuse entry based on Ad Blocker use.

</comment><comment><USER77> What is the reason a server-side solution is rarely used? What are the opportunities to develop such thing?

</comment><comment><USER78> They're dead to me. Dead.

</comment><comment><USER79> I'm glad I stopped going to Forbes when they put up the adblock blocker

</comment><comment><USER80> I stopped visiting Forbes site. I will not turn off my Adblocker.

</comment><comment><USER81> Lower your shields so we can fire our nuclear torpedos at you!

</comment><comment><USER82> I have stopped going to Forbes at all for this very reason.

</comment><comment><USER83> Between that and the pop ups that try to trick you into calling fake Windows customer services, why are they still asking themselves why people block ads?

</comment><comment><USER84> Forbes should just turn off that steaming pile of a web site. Either that or turn off all the ads since it is only damaging their reputation.</comment>


Vulkan Developers Day Draws Top Talent to Nvidia 's Silicon Valley Campus - <AUTHOR> http://blogs.nvidia.com/blog/2016/01/19/vulkan-developers-day/ <comment><AUTHOR> Carmack likes what he sees so far:

[https://twitter.com/ID_AA_Carmack/status/689248999845437441](https://twitter.com/ID_AA_Carmack/status/689248999845437441)

</comment><comment><AUTHOR> More links:

[http://vrworld.com/2016/01/21/nvidia-vulkan-developers- day/](http://vrworld.com/2016/01/21/nvidia-vulkan-developers-day/)

</comment><comment><AUTHOR> If anyone was there I'd love to hear your impressions.</comment>


Why Paid News Online Will Not Work - <AUTHOR> http://www.thechromesource.com/why-paid-news-online-will-not-work/ <comment><USER2> Paid news better work, cause the the blogosphere is the closet thing to an alternative.... and the best of it is just trying to squeeze ad impressions off whatever the MSM is reporting.

</comment><comment><USER3> I think paid "speciality" news will work. The WSJ will be fine. I do worry, with all these papers going out business, who will actually pay for investigative journalism. It really doesn't seem to happen on the 24 hour news channels (CNN/Fox/MSNBC). They just hire pundits for the demo they are serving.

One problem is that if nobody on the web knows you're a dog then nobody knows if you were a newspaper or tv network. You have to have video, written words, and pictures.

</comment><comment><USER4> I find the authors argument weak. WSJ.com has advertisements behind its pay- wall in addition to the subscription rate it currently charges subscribers. Additionally, pretty much all online news sites collect demographics that feed the ads that are displayed for the user. Ads are not targeted for the general audience like that in the print format.

In the case of wsj it would seem they are offering more generalized content in order to reach a wider audience to compensate for a potential niche audience saturation.

I think paid is definitely the future for news sites. Ad revenue brings in no where near the amount of revenue a paid subscription can generate per user. The question remains is there a hybrid model that can do both in a similar way that the airlines have pricing tiers on their seats to fill the planes (not everyone will pay for a first class/business seat, but that class generates way more money than all of coach). WSJ is doing selective free content and has a free registration that allows you to see a surprising amount of content, but what you get is not predictable (meaning when/if/what subscriber content will eventually be visible to the free registrant).

I would like to see a mainstream newspaper test a strategy where if you want the current news you need to pay, but over time (as less paying subscribers are interested), it is released into the free space to monetize potential ad revenue.

</comment><comment><USER5> I wonder whether news sites could continue to give away the news for free (with ads) but charge for extras (links to / copies of source material, ability to comment on stories, remind you which stories you've read in the same way that Google reminds you what web searches you've done, ...)?</comment>


Uber is finally in Las Vegas - <AUTHOR> https://newsroom.uber.com/vegas/2015/09/las-vegas-were-here/ <comment><USER2> I would be curious as to how the rates compare to a rental.

When we goto LV for vacation, we rent a car - a month ago when we went, it was roughly $130 for 6 days via Enterprise rental - got a very nice Toyota Camry.

Tip valet $2 when I pick it up and the lines are never very long to get in or out of valet at any of the hotels. Spent maybe $30 on valet tips across all 6 days? If they were super busy, I'd tip on the drop off as well (gatta feel bad for these guys and gals working in the heat under an awning)

Curious also what priority Uber drivers will be given at hotels compared to taxi's - theres usually a special line for taxi's and they get called up when someone needs one. Otherwise, you pull into the hotel guest entrance and either your staying there or parking in valet - it's not really a place a driver can loiter and wait for a fare.

(Obviously, there is much more to LV then the strip, but I could imagine pickup and drop off from hotels is gonna be a huge chunk of any drivers profits)

</comment><comment><USER3> They could just finish the monorail to the airport. That would fix a huge problem. It's always a 30 minute wait during CES, for example. I imagine Uber will have surge pricing doing major events.</comment>


Why Don't We Build a Telescope Without Mirrors or Lenses? - <AUTHOR> https://www.forbes.com/sites/startswithabang/2017/09/30/ask-ethan-why-dont-we-build-a-telescope-without-mirrors-or-lenses/#8b8ad985f30b <comment> gene-h This is a very bad article. NASA has investigated how a lensless mirrorless telescope could actually be made using photonic integrated circuits[0]. There are even mass benefits too.

[0][https://www.nasa.gov/content/low-mass-planar-photonic- imagin...](https://www.nasa.gov/content/low-mass-planar-photonic-imaging- sensor-1)

<comment><USER2> Still has lenslets, but really fricking cool! Thanks for the link.

</comment></comment><comment><USER2> If this sounded like a bad idea to you, and you wondered what new tech made this possible - there is no new tech mentioned and you can safely skip the article.

It's basically just a list of reasons why this does not work at all.

</comment><comment><USER3> I thought they were going to talk about diffractive optic telescopes which require neither lenses or mirrors. See more here [https://str.llnl.gov/str/March03/pdfs/03_03.2.pdf](https://str.llnl.gov/str/March03/pdfs/03_03.2.pdf). Someone did not do their research! The aragoscope is mentioned in the Spacetime episode mentioned elsewhere here.

<comment><USER4> There is also a sensor stack for different wavelengths that is actually realized, not a pipe dream like the article makes it seem: [https://en.wikipedia.org/wiki/Foveon_X3_sensor](https://en.wikipedia.org/wiki/Foveon_X3_sensor)

</comment></comment><comment><USER5> Like this one?

[http://www.lofar.org/about-lofar/general- information/introdu...](http://www.lofar.org/about-lofar/general- information/introduction)

<comment><USER6> Aaaah, LOFAR, also known among the students of Groningen from 2005 as _" the reason why I can download at 15MiB per second for 10 Euros per month"_.

(They implemented the data infrastructure before the sensors were active, so there was a _lot_ of bandwidth to spare. No idea how things are now)

</comment></comment><comment><USER7> Because it's really hard to arrange for gravitational lenses in the directions and distances you want to observe?

</comment><comment><USER8> This PBS Space Time episode [1] covers quite a few possible designs for space telescopes without heavy lenses or mirrors.

[1] [https://m.youtube.com/watch?v=BIASPc89Sgk](https://m.youtube.com/watch?v=BIASPc89Sgk)

</comment><comment><USER9> How about phased arrays? [http://m.caltech.edu/news/ultra-thin-camera-creates- images-w...](http://m.caltech.edu/news/ultra-thin-camera-creates-images- without-lenses-78731)

</comment><comment><USER10> It's not:

        	Why Don't We Build a Telescope Without Mirrors or Lenses?

It's:

        	Why We Don't Build a Telescope Without Mirrors or Lenses.</comment>


A Note from LastPass - <AUTHOR> http://blog.lastpass.com/2014/07/a-note-from-lastpass.html <comment><USER2> I can't imagine how I'd survive without Lastpass. One of it's added benefits is seeing just how many different services you don't use any more still have your details.

I did a purge a few months back and I'm down from 150 sites to about 70. It was depressing how many sites I had to email to ask them to delete my account.

<comment><USER3> Been there too and fully agreed.

That said, if you ever need something less centralized than lastpass, try KeepassX: [https://www.keepassx.org/](https://www.keepassx.org/)

<comment><USER4> I'd recommend KeePass over KeePassX if you're in Windows-land or don't mind running KeePass 2.0 which runs under .NET and Mono. KeePassX's last stable release was in 2010 and hasn't had any patches since then. Its 2.x branch has been in alpha for years.

<comment><USER3> I don't know what you're talking about.

[https://github.com/keepassx/keepassx/commits/master](https://github.com/keepassx/keepassx/commits/master) \- Last commit 3 weeks ago.

[https://www.keepassx.org/news/2014/04/433](https://www.keepassx.org/news/2014/04/433) \- Last alpha released in April.

<comment><USER4> Exactly what I said. There hasn't been a stable release since 2010. And the next version has been in alpha for years. You linking to the current alpha build and alpha source on master doesn't refute that.

</comment></comment></comment></comment></comment><comment><USER5> I think this is the research they're referring to:

[http://devd.me/papers/pwdmgr-usenix14.pdf](http://devd.me/papers/pwdmgr- usenix14.pdf)

(Note that this is a USENIX paper, which makes the "we let them publish it" comment sort of weird).

The bookmarklet attack isn't subtle; page 8 explains how they were able to set up a malicious site that could obtain Lastpass (say) Dropbox credentials.

<comment><USER6> It's not a 'we let them publish' it's a we respected their wishes in that we would hold off on talking about it until they published.

</comment></comment><comment><USER7> I love LastPass, and this response is one of the reasons why. There will always be issues in security, there is nothing out there that will ever be perfect. The question is how you respond when things are discovered.

The one caveat I have is that I do wish they open sourced. Overall I prefer that when it comes to security.

But LastPass has always responded well when issues come up.

<comment><USER8> Open source is no panacea when it comes to security. OpenSSL's Heart Bleed vulnerability comes to mind.

You also have to have qualified and dedicated people regularly reading and testing the code. I'd rather LastPass hired more security experts who we could be sure were testing the code.

</comment></comment><comment><USER9> While I do appreciate this disclosure, I'm not sure doing so a year later warrants much applause. While I agree this is a vulnerability that only effect a small subset of users (<1%), this actual number of users could be large depending on the size of their customer base (likely tens of thousands).

<comment><USER6> If we stole the thunder from security researchers by announcing about things they've found before they can we'd risk that they'd consider holding back. I feel it's the right move to encourage the researchers and respect their wishes.

</comment></comment><comment><USER10> lastpass is awesome, and i like their disclosure policy. nothing worse than trying to cover things up.</comment>


Mesh Spreadsheet: JavaScript code editor that feels like a spreadsheet - <AUTHOR> https://github.com/chrispsn/mesh <comment><USER2> Whoops - this one was discussed two months ago:

[https://news.ycombinator.com/item?id=21113176](https://news.ycombinator.com/item?id=21113176)

Also 2017: [https://news.ycombinator.com/item?id=14821186](https://news.ycombinator.com/item?id=14821186)</comment>


Guy Kawasaki: My iPhone Review - <AUTHOR> http://blog.guykawasaki.com/2007/06/my-iphone-revie.html <comment><USER2> What is the rationale behind limiting the iPhone to one carrier?

I used to think there is too much hype around the iPhone, but lately I wonder if maybe it really is a big deal for Apple: suppose the success of iTunes depends to a large part on iPods. More and more phones become decent enough MP3 players to make iPods superfluous. Hence the whole iTunes business could be at stake with the iPhone?

<comment><USER3> Apple had to pair with a carrier and offer exclusive rights in order to get back in return what they wanted. The ability to control the plan purchasing via iTunes, selling the iPhone out of Apple stores, sell songs directly via iTunes, etc. Carriers still hold the key so it was really the only way Apple could do these things.

And yeah, the end result is that the user is the one who suffers..

</comment></comment><comment><USER4> I saw this earlier today, but I didn't really like the article. Its not an iPhone review, its an AT&T; Review.

<comment><USER5> The title is somewhat misleading but, I'm not sure I agree with your assessment that this is not an iPhone review. Consider the fact that when you purchase an iPhone you instantly become married to AT&T; (in Guy's personal opinion.... AT&T;'s not so great customer service as well) for 2 years. Not to mention having to pay the monthly service fees to AT&T; to keep the iPhone up and running.</comment></comment>


React Desktop – React UI Components for OS X El Capitan and Windows 10 - <AUTHOR> https://github.com/gabrielbull/react-desktop <comment><USER2> Looks like a pretty good emulation so far. I feel it would be even more interesting, however, if it were using actual native elements instead of recreating look-and-feel through CSS.

With the separation of react and react-dom, this is more of a possibility than in the past. I know it would be a Herculean effort, but it would certainly be an incredibly interesting option for me and I'm sure many others! Still, definitely starring this repo.

</comment><comment><USER3> This is really good!

</comment><comment><USER4> Nice find :)</comment>


Nasa Instruments Image Fireball over Bering Sea - <AUTHOR> https://www.jpl.nasa.gov/news/news.php?release=2019-046 <comment><AUTHOR> See also discussion from 4 days ago: [https://news.ycombinator.com/item?id=19421697](https://news.ycombinator.com/item?id=19421697)</comment>


IPv10 - <AUTHOR> https://tools.ietf.org/html/draft-omar-ipv10-06.html <comment><USER2> In case folks haven't been involved in the IETF RFC process before, even though this is hosted on IETF.org this is just a ID (Internet Draft). They can be submitted by literally anyone. The tool to do so is here: [https://datatracker.ietf.org/submit/](https://datatracker.ietf.org/submit/)

Lots of crazy things get submitted, and never looked at again. In order for drafts to stay alive they need to be updated with comments every 6 months. Sometimes they lead to things, and sometimes they don't. Usually some IETF working group has to be interested for a draft to go from a draft to an actual RFC.

You can see the status of this draft here: [https://datatracker.ietf.org/submit/status/89166/](https://datatracker.ietf.org/submit/status/89166/)

You can find a list of current drafts here: [https://www.ietf.org/download/id- abstract.txt](https://www.ietf.org/download/id-abstract.txt)

Given the lack of comments on the draft, and the fact its not actually attached to an IETF working group, its fairly safe to say that this isn't actually going to become a real protocol anytime soon.

<comment><USER3> Slight correction, you have provided the link to the submission processing status, here's the link to the draft itself:

[https://datatracker.ietf.org/doc/draft-omar- ipv10/](https://datatracker.ietf.org/doc/draft-omar-ipv10/)

</comment></comment><comment><USER4> Excerpt :

        - That means, if the received IPv10 packet contains an IPv4
          address in the destination address field, the router
          should use the IPv4 routing table to make a routing
          decision, and if the received IPv10 packet contains an IPv6
          address in the destination address field, the router should
          use the IPv6 routing table to make a routing decision.

        - All Internet connected hosts must be IPv10 hosts to be
          able to communicate regardless the used IP version,
          and the IPv10 deployment process can be accomplished
          by ALL technology companies developing OSs for hosts
          networking and security devices.

Earlier in the RFC ( reasoning on IPv6 support ) :

        ... also, not all enterprises
        devices support IPv6 and also many people are afraid of the service
        outage that can be caused due to this migration.

If migrating to IPv10 requires the migration of the same infrastructure, what's the point of having it?

<comment><USER5> Also from the same author: Satellite Internet [0]

[0] [https://tools.ietf.org/html/draft-omar- si-00](https://tools.ietf.org/html/draft-omar-si-00)

<comment><USER6> I'm lost for words. How does somebody get to the point of submitting a draft to the IETF, seemingly believing this is a new idea in 2017? Surely this must be trolling?

        "Each satellite holds routers connected to other routers on other satellites using fiber optic cables"

You'd need 265,000 km (164,600 miles) of fibre to loop around the geostationary arc!

<comment><USER7> Crank-o'meter goes to eleven!

But yeah, if it's this easy to submit drafts to IETF, how come they haven't drowned in spam already?

<comment><USER8> He has a lot of other proposals as well: [http://khaledroutingprotocol.blogspot.ca/2017/03/khaled- rout...](http://khaledroutingprotocol.blogspot.ca/2017/03/khaled-routing- protocol-krp.html)

</comment></comment></comment></comment></comment><comment><USER9> This is guy is something different (not that it would make his ideas worth any less, more on that later).

Some of his recent efforts:

Satellite Internet [0] (kudos whatidonteven) - I don't think he thought this one through. What is wrong with the current approach? Should we really erect wires in outer space?

He is currently kind of harassing the IETF via mailing lists about IPv10, threatening "If the ideas explained on these drafts will be used, discussed or published by the ietf, legal actions will be taken." [1] - not really how the IETF works.

The version number as "ingenious" 4+6 is annoying, IMO. That's not how version numbers work?

His drawing on his his very own routing protocol - KRP - are also something [2]. Although the quality of his drawings has nothing to do with his ideas per se, it seems he rushed it together in an afternoon.

I don't want to say that he is overestimating his own intelligence, rather that he is _underestimating_ the efforts, hard work and intelligence of everyone else working in this field mostly _professionally_. His proposals can not easily be judged, because they dismiss almost everything that others have done previously. Why should so many smart people have missed these (obvious/simple) solutions? We are where we are for a reason. You need a good chain of arguments to "dismiss" the current state of the art.

[0] [https://tools.ietf.org/html/draft-omar- si-00](https://tools.ietf.org/html/draft-omar-si-00)

[1] [http://ietf.10.n7.nabble.com/RE-IPv10-KRP-and-RRP-IDs- Remova...](http://ietf.10.n7.nabble.com/RE-IPv10-KRP-and-RRP-IDs-Removal- td534031.html#a534090)

[2] [http://khaledroutingprotocol.blogspot.co.at/](http://khaledroutingprotocol.blogspot.co.at/)

<comment><USER10> His address is also interesting:

       The Road
       6th of October City, Giza
       Egypt

<comment><USER11> Well, 6th of October City is a place. ([https://goo.gl/maps/z141gu8cMYB2](https://goo.gl/maps/z141gu8cMYB2))

</comment></comment></comment><comment><USER12> Not sure I understand why this is necessary...

The IPv6 address space covers the IPv4 address space already: [https://en.wikipedia.org/wiki/IPv6_address#Representation](https://en.wikipedia.org/wiki/IPv6_address#Representation)

> During the transition of the Internet from IPv4 to IPv6, it is typical to > operate in a mixed addressing environment. For such use cases, a special > notation has been introduced, which expresses IPv4-mapped and > IPv4-compatible IPv6 addresses by writing the least-significant 32 bits of > an address in the familiar IPv4 dot-decimal notation, whereas all preceding > ones are written in IPv6 format. For example, the IPv4-mapped IPv6 address > ::ffff:c000:0280 is written as ::ffff:192.0.2.128, thus expressing clearly > the original IPv4 address that was mapped to IPv6.

That needs some sort of gateway to work, but I'm assuming that that is the kind of thing your ISP would do for you.

And if you have to convert each IPv4 only host to an IPv10 host to use it, why not convert it to dual stack IPv4/IPv6 instead?

<comment><USER13> Because ipv6 was designed with not much thought to migration and interworking with ipv4

<comment><USER14> And migrating is all cost no benefit. And the problems ipv6 was intended to solve have long since been addressed better by other means (eg NAT).

<comment><USER15> NAT doesn't solve the issues with IPv4, it merely delayed them. IPv6 is still the future, but everyone from ISP's to switch and router manufacturers have been dragging their feet on a real push to get us off IPv4. Hell, there are still modern switch platforms out there with full Layer 3 IPv4 support but IPv6 is curiously omitted - you've got to buy a bigger switch to get support for modern protocols (or an implementation that isn't totally gimped).

<comment><USER13> NAT does give you some valuable security features though

<comment><USER15> NAT is still ultimately a kludge for security, a stateful firewall is a much better solution and doesn't interfere with the assumption that an IP address represents a device and not an entire corporate/home network.

</comment></comment></comment></comment></comment></comment><comment><USER16> [https://twitter.com/The_Road_Series/status/86814034617735577...](https://twitter.com/The_Road_Series/status/868140346177355777)

This doesn't look good.

<comment><USER17> Wow, is this some kind of joke? This is the guy who created this new protocol? Hopefully, it's as good as dead now.

<comment><USER6> Look at his other draft proposals - he seems serious but seems to have no idea what's actually involved in designing or specifying a real protocol...

</comment></comment></comment><comment><USER18> I have a better solution to the IPv4 problem. It will just take Google to put "Websites that provide IPv6 traffic routing will be prioritized on search results" in their search ranking rules – Bam! Problem solved. It seems to have worked with SSL.

<comment><USER15> Wake me when AWS, Azure or GCP have proper IPv6 support.

<comment><USER19> How do you define "proper IPv6 support"? AWS certainly has considerable support for IPv6 today:

[https://aws.amazon.com/blogs/aws/aws-ipv6-update-global- supp...](https://aws.amazon.com/blogs/aws/aws-ipv6-update-global-support- spanning-15-regions-multiple-aws-services/)

<comment><USER15> Wow, I never heard about this until now - it's about damned time! Now if Google and MS could step up to the plate we'd have a large chunk of services in a position ready to enable IPv6 support.

</comment></comment></comment></comment><comment><USER20> Mildly off-topic, but I've always wondered about having a non-fixed length address scheme: if there are 64 bits in the address, let the first 8 bits (64/8 = 8) be 1 and the 9th bit be 0. This way we encode the length of the address. After that, every bit is available for use (all 64 - 9 = 55 bits).

Suddenly want to increase the domain from 2^55 to something much higher? Use a 15-byte address where the first 15 bits are 1s and the 16th bit is 0. The rest of the (15*8 - 16 = 104) bits are available.

You get the point - we can arbitrarily increase the size without giving up flexibility.

What's the drawback if we use something like this? Routing troubles? Speed?

Alternative method: the addresses can be as many bits as required, but every bit index that's a multiple of 8 must be 1. The last byte is signified by a byte having 0 at index 0. Basically:

        [1]1010110 [1]0001111 [0]1101011
                               ^ last byte

<comment><USER21> Your method is essentially how UTF-8 works. I think the problem is implementing that efficiently in hardware, which is needed for routers.

<comment><USER22> Not quite, UTF-8 encodes the length of the sequence in the first byte, instead of marking the end, this makes more sense because it is easier to detect broken input. 1110xxxx 10xxxxxx 0xxxxxxx obviously has a byte missing and is broken, but [1]xxxxxxx [0]xxxxxxx could have any number of bytes missing an would just yield the wrong value.

</comment></comment></comment><comment><USER23> had to double check the date to see if it's not an April 1st. it isn't.

wow.

</comment><comment><USER24> I guess all it takes to push a draft is hubris. The clear fact it hasn't received editorial feedback from a single native speaker is an indication how popular this is. (not to shame non-native speakers!)

</comment><comment><USER25> Shit, i've been overlooked entirely...

</comment><comment><USER26> Real IPv6 deployment is held up because of the 50-100 biggest ISPs in North America and Europe. Get them to start taking this seriously and everything else falls into line over night.

The IETF barking out other suggestions is just a distraction.

<comment><USER6> Don't worry, this is just a random submission from someone who also came up with the 'new' idea of accessing the Internet through satellites this year... (Posted above - [https://tools.ietf.org/html/draft-omar- si-00](https://tools.ietf.org/html/draft-omar-si-00))

It's not going to be seriously considered (it doesn't make sense anyway - upgrading to this protocol would be the same effort as upgrading to IPv6 - it's entirely pointless).

<comment><USER27> Just to be clear: the satellites in his network are _plugged in_. That's novel AF.

<comment><USER28> I think the funniest part is that fiber optics are irrelevant in space, you'd be better off just pointing a laser at another satellite and just using space as the medium.

</comment></comment></comment></comment><comment><USER29> > The first version of the Internet Protocol is IPv4.

Version numbers are great!

<comment><USER30> I actually like their conservative approach with version numbers.

For what it's worth, in IPv4 time there were some experiments with a new IP variant, those got the version 5. You won't find these anywhere in today's networks, but just to be sure, the next official version got number 6.

The opposite is what we see in some programs and libraries: First, they publish version 1.2.2. Then version 1.2.3. But ooops, 1.2.3 had an issue. Well, let's just release a new tarball and label it 1.2.3 as well. Hopefully nobody noticed this. How big are the chances that somebody downloaded the broken package during the past 2 hours? (I guess using another number for the fixed release, such as 1.2.4, would have been too expensive. Or so.)

<comment><USER31> Libraries at least should have mechanisms to release 1.2.4 & yank 1.2.3 from whichever package repos they're on. Package repos generally won't allow pushing an update to a version without version bump

<comment><USER32> That's a horrible idea. What if I can't upgrade to 1.2.4?

<comment><USER33> It should always be possible to upgrade a patch level. How else would you get security updates?

<comment><USER32> I wait for it to be validated by the client and then apply the patch according to the established controls and protocols if the risk assessment team gives a green light.

</comment></comment></comment></comment></comment></comment><comment><USER34> Protocol names should be 128-bit wide to allow for future expansion in available protocols.

</comment><comment><USER35> Efforts to get ipv6 rolled out faster and easier are imho good. Though, not sure if this actually helps.

I am not a fan of using hardware/mac addresses in ip addresses, in my opinion its a big security/privacy issue. Tracking, hardware details leaking etc.

And somehow i think ipv10 will make the migration for some parties even less of a priority or less urge to 'finish' it. I think if they really want to 'promote' and accelerate IPv6 rollout... Facebook and Instagram should have ipv6 days only. E.g. one day in the week or month, you can only connect with facebook/instagram over ipv6; then you'll see how fast endusers will want to be on ipv6 (and once all endusers are dual stacked.. parties can slowly start disabling ipv4 all together). And then i assume the ipv4 only parties will make a bit of a hurry getting their ipv6 in order.

<comment><USER36> You think they would willingly miss out on an entire day of revenue?

<comment><USER35> No, that not. monies are too important for many. But if they would consider such, hypothetical, i think it would be a great motivator for ipv6 adoption.

</comment></comment></comment><comment><USER37> One area where I am not keen to see IPv6 spreading is SMTP traffic. IP reputation while not perfect is still a useful layer of lipstick on the SMTP pig.

One area where I am keen to see IPv6 spreading is IoT. I don't know if we can ever secure those things, but it will certainly make scanning the IP address space for vulnerable devices impractical.

<comment><USER38> _> IP reputation while not perfect is still a useful layer of lipstick on the SMTP pig._

just use the prefix for reputation. You can assume that each user will have received a /48\. Yes. There are some ISPs out there handing out /64's or even a /128, so it might be somewhat too broad, but blacklisting a the whole /48 and then white-listing on (rare) demand is probably the way to go.

<comment><USER39> If you assume the user has a /48 when they really have a /64, you're off by a factor of 65536. For address blocks allocated to business customers, a nontrivial percentage (say 10%) may be operating mail servers. Which means that one misbehaving customer will cause you to block thousands of honest ones. That's a lot of white listing to do.

</comment></comment></comment><comment><USER40> As a side note, I was very confused about IPv6 addresses popping up in my server logs when I knew it only had IPv4 provisioned. Turns out CloudFlare had automatically published AAAA records for my domain and was v6-to-v4 proxying my inbound HTTP/HTTPS traffic. For free! Just another reason to love CloudFlare.

<comment><USER41> That's... cute. But not breaking anything, so, huh. Not bad.

<comment><USER42> essentially because of X-Forwarded-For

They have an even crazier feature that rewrites IPv6 source addresses as random but unique IPv4 addresses for software that can't deal with that: [https://blog.cloudflare.com/eliminating-the-last-reasons- to-...](https://blog.cloudflare.com/eliminating-the-last-reasons-to-not- enable-ipv6/)

<comment><USER43> That feature isn't as nuts as you think.

Clearly the IPv6 space doesn't compress 1-1 into the IPv4 space but this gives you way to work with the top 64 bits of the IPv6 address and then feed it into your anti-abuse system. If your abuse system works probabilistically then this isn't too problematic as this becomes just another signal. And IPv4-based systems already deal with multiple people behind the same IP because of NAT.

<comment><USER44> You have users who can already access a site using IPv4, but want to use IPv6, and you have an anti-abuse system that lacks support, so you decided to invent a new kind of NAT, rather than require the customer to just fix their anti- abuse system, which they'd need to do on other platforms anyway?

The feature isn't nuts, but the rationale seems so.

<comment><USER43> How could we 'require a customer to just fix their anti-abuse system'?

</comment></comment></comment></comment></comment></comment><comment><USER45> Why V10. Because 4+6?

<comment><USER46> Yes:

"IPv10 allows hosts from two IP versions (IPv4 and IPv6) to be able to communicate, and this can be accomplished by having an IPv10 packet containing a mixture of IPv4 and IPv6 addresses in the same IP packet header."

<comment><USER47> engineers have an obscure way of naming things.

<comment><USER48> Sound more like an in-joke. Cf. GNU (GNU's Not Unix) or YACC (Yet-Another Compiler Compiler).

<comment><USER49> Or YAML, originally "Yet Another Markup Language", now "YAML Ain't Markup Language".

</comment></comment></comment></comment></comment><comment><USER50> The ASCII Graphics in RFPs are getting more advanced these days

</comment><comment><USER51> Some previous HN discussion about this happened within the following comment thread: [https://news.ycombinator.com/item?id=14419867](https://news.ycombinator.com/item?id=14419867)

</comment><comment><USER52> I have GigaBit internet from AT&T. Speeds have been terrible and pings were like 130ms. I disabled IPv6 on my laptop and things improved. I disabled IPv6 on my router and it improved even more.

Do we really need IPv10?

<comment><USER53> You're making a good case for something other than IPv6. And since we're running out of IPv4 addresses, we will need to switch to something else, eventually.

</comment></comment><comment><USER54> Anyone remember IPv7? Yeah, it was a thing:

[https://www.rfc-editor.org/rfc/rfc1475.txt](https://www.rfc- editor.org/rfc/rfc1475.txt)

</comment><comment><USER55> few cents from me about this /o\ [http://blog.donatas.net/blog/2017/09/10/ipv10/](http://blog.donatas.net/blog/2017/09/10/ipv10/)

</comment><comment><USER56> I am not sure about the base idea, but isn't the ipv10 (i.e. protocol number 10) going to cause problems?

Aren't hosts expected to choose the highest protocol number they understand? So basically this forever kills (protocol) ipv6 and replaces it with ipv6+ipv4, which is never going to fly (because the "underlying" ipv4 is sunsetting and hopefully gone within a decade)...

</comment><comment><USER57> IPv10 = IPv4 + IPv6?

</comment><comment><USER58> Why not IPv16 and fix the problem for ever?

<comment><USER59> Will it fix it? This seems like a scaling issue we're going to have to deal with forever.

<comment><USER60> You may be underestimating how many IPv6 addresses there are! 2^128 is huge. Like, if we assigned one trillion new addresses every second since the birth of the universe, we'd still have enough left over to do the same in another 800 million parallel universes. Truly astronomical numbers.

Obviously not all of these addresses will be used; in practice we aren't going to run out any time soon.

<comment><USER61> Of course this assumes we don't assign half of the address space to Apple, Facebook, Google and their friends, or something silly like that, like it was done with IPv4 (with the equivalent "friends" at the time).

<comment><USER51> I read in one of the IPv6 RFCs (don't recall which one at the moment), that initially only 1/8 of the possible address space will be allocated. If for some reason that space is filled up, there's still another 7/8 which can be allocated with a more conservative policy.</comment></comment></comment></comment></comment>


Creating Animations with UIKit and Core Animation - <AUTHOR> https://ordinarycoding.com/articles/creating-animations-with-uikit-ca/ <comment><USER2> You are a programmer ?

<comment><AUTHOR> Yes, 5 years professional experience so far.

<comment><USER2> I'm thinking of working on open source projects. Are you suggesting a project?

<comment><AUTHOR> What technology are you interested in?

<comment><USER2> Js-php-vue-laravel-html-css-nodejs

<comment><AUTHOR> I am sorry but sadly I do not have experience in this stack so cannot really recommend any project</comment></comment></comment></comment></comment></comment>


Show HN: Tour Spring Gardens - <AUTHOR> https://www.springgardens.scot <comment><AUTHOR> With the coronavirus lockdown, people are staying at home. Many of us are thinking about how we'd prefer a different house.

However, in person viewings are not allowed in many countries, including where I live, Scotland. But from experience, physical house viewings are really useful for getting the feel for a house. For example, when looking just at individual photographs on a website, it is sometimes hard to understand how the rooms all fit together.

So to scratch this itch, I put together a fully panoramic, click through, tour of my house. This was substantially inspired by functionality on a famous mapping website.

It took several weeks of evenings and weekends to polish, but I am quite proud of the result. I think the tour is really slick, and gives a good feel for the house.

I suspect few of you are looking to buy a house in Scotland. Moreover, people care about technology on this site, so let's talk about the tech.

At the very start, I found this requires a 360 camera. I tried stitching panoramas together from individual photographs, but that did not have good results. Then, once the images are converted into the right format, we need a panorama viewer. We settled upon Marzipano, which is a brilliant, as are a few other contenders. Marzipano also has a decent tour generation tool.

This is where the customization, polish, and value added began. For example, I wanted a clickable mini map, which would moreover show both your position and orientation. So I integrated Leaflet with the Marzipano tour, in both directions. I also added the ability to zoom into places such as cupboards, which is more appropriate than navigating full scene change.

Separately, I think there's the open question of whether this could be commercialized. Can money be made from creating tours like this for other house sellers, as a service? Perhaps. Estate agency fees can be quite high. However, it would require some more up front work to the make the whole thing, end-to-end, a much faster process. For example, cross referencing the scenes together, and setting the orientation information, was quite time consuming.</comment>


Building a Time Capsule – Guidelines for Preserving Materials [pdf] - <AUTHOR> http://www.mnhs.org/preserve/conservation/reports/timecapsule.pdf <comment><USER2> [http://carlos.bueno.org/2010/09/paper- internet.html](http://carlos.bueno.org/2010/09/paper-internet.html)

</comment><comment><USER3> How do victorian items-in-glass with wax seal stack up?</comment>


CarWoo's (YC S09) Tommy McClung Addressing the Founder's Conference - <AUTHOR> http://carwoo.com/blog/tommy-mcclungs-address-at-the-founders-conference/

<comment><USER2> Thanks to Tommy for a great and entertaining presentation.

<comment><USER3> Thanks for having me. Lots of fun.</comment></comment>


United accidentally strands New Zealand man at SFO without wallet or passport - <AUTHOR> http://m.sfgate.com/news/article/United-accidentally-strands-New-Zealand-man-at-11171106.php <comment><USER2> Just keep your wallet on you? If its getting to Costanza level and is painful to sit on, clean it out. Some people at my work leave their wallets & keys at their desk/etc and run into trouble during fire alarms and other situations, an actual fire and they'd be screwed.

* i understand purses are a different story.</comment>


Collect mail from different email accounts on Android - <AUTHOR>

I need an Android mail client that can collect mail from different accounts and most importantly get push notifications from them. I got tired of installing a million apps only to discover that my battery dies super fast... <comment><USER2> k9mail seems to fit the bill for what you want: [https://github.com/k9mail/k-9/wiki/What- is-K-9-Mail](https://github.com/k9mail/k-9/wiki/What-is-K-9-Mail)</comment>


Comcast tells government that its data caps aren't actually "data caps" - <AUTHOR> http://arstechnica.com/business/2014/08/comcast-tells-government-that-its-data-caps-arent-actually-data-caps/ <comment><USER2> Seems like Comcast just takes issue with the term "cap" since from their perspective they don't "cap" at all, they just charge for overage.

The term data cap when there isn't a cap (i.e. you don't get cut off when exceeding) isn't really ideal. But it is the common term now.

It might just be better to call it Unlimited Vs. Pay As You Go data. Comcast's model is clearly what I'd call Pay As You Go or Pay Per Data.

But all of this argument over wording choice is unhelpful and won't really change the world no matter how it turns out. What does matter is choice, cost, and the ability to compare different ISP's relative data costs (i.e. no hidden cap/data fees).

</comment><comment><USER3> I liked this line, from Comcast's filing with the N.Y. regulator: "Exceeding the cap could subject a household to alterations to its Internet access."

Pray that they don't alter it any further.

</comment><comment><USER4> Comcast & Friends are slowly but surely changing the internet from an open platform to one that serves the interests of their shareholders. If they continue to have this sort of success, there may eventually be little left to recognize it by.</comment>


Ask HN: Where would you move to? - <AUTHOR>

I'm 28 and I've been working nearly three years in my first job (that I got after finishing college). Mainly coding in C++ (cross platform). I'm living in Ireland and feeling the urge to move elsewhere... Where would people recommend? I'm looking for a change, but some place with a good software vibe :) <comment><USER2> Uh, more info needed.

What do you like to do? Party? Go to the theater? Hike? Surf?

Lots of places with good software vibes, so then you go to secondary factors: cost of living, family and amenities.

<comment><AUTHOR> You're right. So I'm 28, no family, no commitments and no debt :) I like a lively spot alright. I'm a native English speaker, used to have decent French (which I could pick up again easily enough) and am willing to learn another if need be. I like the idea of the States or Canada though. I know America is tough to get into but I could probably take a chance applying for a position with my current MNC.

Edit: Basically I've never lived outside Ireland. I want to experience somewhere else tbh.</comment></comment>


Ask HN: Accounting software for one-man shop - <AUTHOR>

I'm employed full-time, but I also have some 1099 income from side projects. I'm looking for a simple, straight-forward tool to allow me to better track expenses and estimate taxes (so there are no ugly surprises in January).  Any recommendations? <comment><USER2> I use and like <https://outright.com>. Another option is <http://lessaccounting.com>.

</comment><comment><USER3> [http://savedelete.com/9-best-free-accounting-software-for- yo...](http://savedelete.com/9-best-free-accounting-software-for-your- business.html)</comment>