Venom – A security vulnerability in virtual floppy drive code - <AUTHOR> http://venom.crowdstrike.com/ <comment><USER2> A simpler, less breathless description from the Red Hat BZ[1]

 _An out-of-bounds memory access flaw was found in the way QEMU 's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the hosting QEMU process._

If you're using RHEL, then SELinux further confines the qemu process so although you can run arbitrary code in there (which is very bad) you cannot access any files on the host filesystem except ones which qemu has open. Also libvirt runs qemu as a separate user, and further confines it with some cgroups rules. Depending on the version of RHEL, seccomp may be involved too, which limits the type of syscalls that qemu can make.

Applying the qemu fix is still highly recommended of course.

[1] [https://bugzilla.redhat.com/show_bug.cgi?id=1218611](https://bugzilla.redhat.com/show_bug.cgi?id=1218611)

<comment><USER3> >Floppy Disk Controller (FDC)

Why isn't legacy junk like this disabled by default? How many people need a floppy disk controller?

There's something scary about how legacy compatible a lot of FOSS projects are. It just raises the attack surface and leads to stuff like this.

<comment><USER4> The article says that even if you turned off the option, Xen and QEMU have a bug which doesn't actually do that.

Arguing about defaults requires a step back to policy level, which is something for which many projects have trouble finding time and attention.

<comment><USER3> >The article says that even if you turned off the option, Xen and QEMU have a bug which doesn't actually do that.

Incompetence on top of incompetence doesn't invalidate my argument. Minimizing your attack surface should be the norm, unfortunately here on HN it just leads to downvotes.

<comment><USER2> RHEL cuts tons of devices compared to upstream qemu. Go and grab the source RPM and see the number of '\--disable-XXX' options and the additional patches we add to remove devices. We publish a whitelist of devices we allow [which unfortunately I cannot find now, but it's in the RHEL docs online], and anything else is cut.

</comment></comment></comment></comment></comment><comment><USER5> I don't like this trend of "marketing vulnerabilities" with a cute name and a startup-looking landing page. That entire page says nothing about the actual issue, the nice looking graphic just shows how this exploit (and really any exploit like this?) can give attackers access to things outside of a VM. Duh.

<comment><USER6> Why don't you like this trend? I don't see the harm.

Also, the FAQ explains a lot; including the details of how the vulnerability works.

<comment><USER7> It means that folks with little to no technical experience (read: authors of WiReD articles) will latch onto the new buzzword and start regurgitating it left and right, eventually tricking other technologically-illiterate people to latch onto it and start pelting me with questions like "OMG DID YOU HEAR ABOUT VENOM???!!!" and "OMG U BUTTR PASH UR SURVURZ OMGOMGLOL!!!!111one" instead of letting me do my job. All because the publishers want to satisfy their attention-seeking desires ("LOOK AT ME I FOUND A SECURITY BUG AND GAVE IT A HIP COOL BUZZWORD I'M SO SPECIAL!!!!").

I personally don't like the trend for the same reason why I dislike terminology like "ninja" or "rockstar" or "badass" or "devops". It cheapens computer science/engineering into resembling something a bunch of hip middle schoolers yammer on about alongside their video games and their skateboards instead of the multi-billion-dollar professional field it actually is.

</comment></comment></comment><comment><USER8> "You've been smoking something really mind altering, and I think you should share it.

x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit."

The rest of the rant is here:

[http://www.electricmonk.nl/log/2007/10/25/virtualization- sec...](http://www.electricmonk.nl/log/2007/10/25/virtualization-security/)

<comment><USER9> From the same article:

> Theo de Raadt's problem is that he views security the way cryptography > experts view cyphers: as an absolute. But security isn't like math. It's not > absolute. There are right and wrong ways of doing security.

Not an absolute but there is a right and wrong way to "do security?"

To be fair Boender is attacking the naive maxim that "virtualization is secure." It's just another layer if you isolate processes inside of virtualized run-time environments. Makes sense... it's not snake oil.

However there is no need for "right" and "wrong" in these discussions. The security of any given system exists in a continuum and it will only be a matter of time before the next vulnerability is discovered. I get the sense that all we can do is limit the damage that can be done by any particular system.

It seems that virtualization is just one path towards providing those limits just as chroot and other attempts have been.

I'm most interested in seeing how jitsu and unikernels can turn the tables... not only can a process be wrapped in a virtualization layer but it is short lived and only runs when it is requested. It puts the onus on us to set up the summoner properly and provide safe-guards... but it's just another layer of complexity for attackers to manage.

<comment><USER10> > I'm most interested in seeing how jitsu and unikernels can turn the tables

The useful aspect about the MirageOS unikernels is that they use the pure Xen PV interface, which has almost no dependency on qemu. No floppy or block/net emulation, timers through the direct Xen shared_info page, and generally as "native" to x86 as Xen permits.

<comment><USER11> >timers through the direct Xen shared_info page

HVM has support PV timers (and interrupt controllers, and spinlocks) for quite some time now

>generally as "native" to x86 as Xen permits.

I really don't know if I agree with this. With hardware extensions basic CPU performance is going to be significantly better on HVM instances (No longer having to bounce to the hypervisor every time you make a system call since you once again have three CPU protection rings with ring -1), and that's before getting into SR-IOV, etc.

Unikernels are sweet and all, but without PVH, PV will outperform modern "PVHVM" implementations, and with PVH you're still running in a partial HVM shell.

<comment><USER11> Can't edit this anymore apparently, but correction: PV will _not_ outperform modern "PVHVM"

</comment></comment></comment></comment></comment><comment><USER12> The missing reset of the fifo is in one of the handlers defined at [http://git.qemu.org/?p=qemu.git;a=blob;f=hw/block/fdc.c;hb=2...](http://git.qemu.org/?p=qemu.git;a=blob;f=hw/block/fdc.c;hb=24a5c62cfe3cbe3fb4722f79661b9900a2579316#l1918)

fdctrl_stop_transfer() might be one of the incriminated functions.

<comment><USER13> I like how I had to read 100 comments on Hacker News to learn this information. Vulnerability disclosure just isn't what it used to be.

<comment><USER14> The diff is literaly linked in the article.

<comment><USER13> The original site, and my comment, are from 9 days ago. The linked diff is from 7 days ago.

</comment></comment></comment></comment><comment><AUTHOR> From Q&A:

"Q: How is this different from previous VM escape vulnerabilities?

A: Most VM escape vulnerabilities discovered in the past were only exploitable in non-default configurations or in configurations that wouldn't be used in secured environments. Other VM escape vulnerabilities only applied to a single virtualization platform, or didn't directly allow for arbitrary code execution."

Edit: Xen advisory: [http://xenbits.xen.org/xsa/advisory-133.html](http://xenbits.xen.org/xsa/advisory-133.html)

</comment><comment><USER15> The specific vulnerability and the fix:

[https://github.com/qemu/qemu/commit/e907746266721f305d67bc07...](https://github.com/qemu/qemu/commit/e907746266721f305d67bc0718795fedee2e824c)

</comment><comment><USER16> Seriously every vulnerability will have it's own cool name and a website now? Even this? Not a single vendor has classified this as even critical. Yes like all security vulnerabilities it should be taken seriously, but when every clown out there goes all heart bleed on you for every security vulnerability they find because it's the smart marketing move today you stop taking them seriously which in the end is counter productive to this whole "raising awareness" BS they are trying to do....;

<comment><USER17> A VM escape vulnerability is pretty serious as vulnerabilities go!

<comment><USER16> I don't disagree, however with no actual exploit (in the wild or POC according to RH), no confirmation of the ability to execute code on the actual host, so yes important but doesn't really justify the whole name and landing page ordeal.

Not because it's not important, but because it just desensitizes the whole impact of vulnerabilities the caliber of Heartbleed or Shellshock which did affect a large chunk of the servers and machines connected to the internet at the time.

Now they claim it's bigger than heartbleed, but with no exploit, and no clear statement on what actual in use implementations are affected, Amazon already have came out saying that VENOM has never affected their implementation of Xen, if Digital Ocean and Rackspace come out with the same statement it just makes this whole "bigger than HB stance" is silly.

And as far as the corporate/enterprise world goes, well VMware, CISCO, and MSFT hypervisors have a much bigger share out there and their hypervisors are not affected so again no much of a bite there.

</comment></comment></comment><comment><USER18> VirtualBox is affected in a different/partial way. Summary: Patch to 4.3.28, released today.

The vulnerability is not mentioned explicitly in the change log. It only shows up as one of 32 bullet points "Floppy: several fixes". The actual changes are recorded only as "2015-05-08 12:58 Changeset in vbox [55753] by vboxsync: FDC: Fixed DRIVE SPECIFICATION command".

The fixed file from the QEMU project is:

[http://git.qemu.org/?p=qemu.git;a=blob;f=hw/block/fdc.c;h=f7...](http://git.qemu.org/?p=qemu.git;a=blob;f=hw/block/fdc.c;h=f72a39216347e722496797555db9f208b0c5b4b2)

VirtualBox's equivalent file is:

[https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Devic...](https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Devices/Storage/DevFdc.cpp)

There were some changes related to command buffers five days ago by Frank, but they only address FD_CMD_DRIVE_SPECIFICATION_COMMAND (in a slightly different way than QEMU's developers did it). The VirtualBox source code diffs are at:

[https://www.virtualbox.org/changeset/55753/vbox](https://www.virtualbox.org/changeset/55753/vbox)

Compare to the QEMU diffs at:

[http://git.qemu.org/?p=qemu.git;a=commitdiff;h=e907746266721...](http://git.qemu.org/?p=qemu.git;a=commitdiff;h=e907746266721f305d67bc0718795fedee2e824c)

The vulnerability does not affect the current VirtualBox FD_CMD_READ_ID or the versions of the file going way. Maybe because it might have been forked as far back as 2003? Crowdstrike did point out that the vulnerability was present from 2004. But the vulnerability manifests in two bugs, one of which appears to affect VirtualBox and the other not.

</comment><comment><USER19> I think this serves as a good example of minimising one's attack surface.

The exploit is in the floppy disk controller, of a _virtual_ machine, in an era when almost no physical machine includes a floppy disk drive, and those entering the field might never have seen a floppy disk other than the "File -> Save" icon; plus the exploit can be triggered even when the FDC is disabled.

Certainly a sobering thought for those using large, feature-filled applications 'just in case' some feature might be needed in the future.

<comment><USER20> Yeah, it's bizarre how, in 2015, virtual machines often have floppy disk and CD-ROM drives and serial and parallel ports by default.

<comment><USER21> To be fair, serial ports are actually really important and while we frequently don't have physical serial ports anymore, tons of devices still use serial emulation because it is such a simple technology to understand and the hard parts of the protocols are done in userland rather than drivers.

For managing virtual machines, it's more surprising that we give VMs VGA devices rather than just using serial: when using VGA emulation, you cannot trivially write code that reads text on the VM's screen, but if you configure the VM to use a serial console, you can trivially write a program which controls the VM. In a libvirt-managed qemu environment when the OS has its serial console enabled, you can run "virsh console MyVM" and instantly start executing commands and parsing their output. You can also have the OS write its log to serial so that if the OS crashes you can still read the full log. When all else fails, serial still works. Additionally, a virtual VGA device has an infinitely larger attack surface than a serial device.

When doing unattended windows installs, a lot of people use floppy drives to store the Autounattend.xml file. Floppy disk images are the most trivial and smallest images for automation tools to create. They're additionally useful for placing a linux bootloader on to boot a linux install CD with command line parameters.

Most people still use CD-ROM images to install operating systems, and it's basically required for windows. Virtual machine management software also tends to use the cd drive to install guest tools since it's the easiest way to let the guest see large files from outside the VM - nearly every OS can read CDs.

<comment><USER20> > To be fair, serial ports are actually really important and while we > frequently don't have physical serial ports anymore, tons of devices still > use serial emulation because it is such a simple technology to understand > and the hard parts of the protocols are done in userland rather than > drivers.

To be sure! But it's not always necessary.

> When doing unattended windows installs, a lot of people use floppy drives to > store the Autounattend.xml file.

> Most people still use CD-ROM images to install operating systems,

Also both true, but they shouldn't be available unless you need them.

<comment><USER21> Not always necessary, but I think it's useful, if not important, to have by default in any infrastructure which uses long-term VMs and doesn't just replace "immutable" VMs every time a setting is changed. You always want some path to get data into the VM without networking or VGA, otherwise you have a big problem when something goes wrong with the network and you need to fix things in VMs which you don't want to reboot. This is a corner I'm sure enough sysadmins have found themselves in.

For extra-security-conscious deployments, most hypervisors let you remove most hardware, and qemu gives you enough flexibility to define nearly every device on the VM's motherboard at the command line rather than taking a pre- configured motherboard setup. The default settings in most hypervisors give you lots of unneeded hardware, but this hardware is really convenient for any user who is just trying to get a VM up.

I realize that, from a "secure defaults" perspective, the CD-rom and unused serial port increase your attack surface, but I also think this trade is worth it in most scenarios, but it's a tough line to draw.

</comment></comment></comment></comment></comment><comment><USER22> Nowadays security research looks like a lot of extra work. Having to do the research and also think about a logo, website design, choice of colors, pretty diagrams, a cool name, social media interaction, market research to make sure all that isn't too similar to previous bugs. Eww!

</comment><comment><USER23> Amazon states that AWS is not vulnerable, no details but presumably they patched before the public disclosure.

[https://aws.amazon.com/security/security- bulletins/XSA_Secur...](https://aws.amazon.com/security/security- bulletins/XSA_Security_Advisory_CVE_2015_3456/)

<comment><USER24> We're all equal, but some are more equal than others.

This is the endgame of your so-called "responsible disclosure". Those with profit loss exposure win, and the peasants get it whenever the PR company is done making the logo and infographics.

<comment><USER25> How is it bad that large providers have an opportunity to patch before the vulnerability is released to the wild?

Maybe next you'll insist that everyone's prevented from patching for a week after disclosure so that smaller companies that don't have the resources to react immediately are not unfairly left behind?

<comment><USER24> I'm not insisting anything. I'm just saying that lack of immediate and full disclosure is essentially crony capitalism where there are the Big Important Companies That Must Be Protected and then there is everybody else, including small startups and private individuals.

It is fundamentally unfair, and sets up a non-level playing field.

(inb4 "critical infrastructure")

<comment><USER26> I think it is even simpler than that: The big companies that have thousands of customers doing millions of dollars of business on hundreds of thousands of machines need more time to patch because their is much more money / business to be lost. Not giving large companies time to patch would do more harm than good in the end.

It is fundamentally unfair, and is perfectly reasonable.

</comment></comment></comment></comment></comment><comment><USER27> Given the complexity of QEMU and its pace of development, there is likely an endless supply of such bugs for punching through the QEMU emulation layer. The problem is that most of the time, the QEMU process is running in dom0, giving an attacker an opportunity to hijack the hypervisor. Xen offers a more general solution for this: running QEMU in a stub domain. The main problem with that solution right now is that Xen forked QEMU such that the stub domain only supports running QEMU 0.10 or such - the up-to-date version of QEMU (known in Xen as qemu-upstream) is somewhere around 2.2, but it runs the emulation layer as a process in dom0, which exposes the system as a whole to "VENOM" and related attacks on QEMU.

<comment><USER28> I know there are people at Xen working on getting upstream qemu working in a stub domain. Hopefully there will be some more urgency now...

</comment></comment><comment><USER29> There's no need for the floppy device code to be running in the VMM. Researchers have pointed this out for a long time:

Eurosys 2012: [http://dl.acm.org/citation.cfm?id=2168851](http://dl.acm.org/citation.cfm?id=2168851)

</comment><comment><USER30> Can someone help me understand something? If a VM has no attached floppy drive, is it still vulnerable? The site says that disabling a virtual floppy drive is not enough, but if there's no floppy drive at all is that still a problem?

"For many of the affected virtualization products, a virtual floppy drive is added to new virtual machines by default. And on Xen and QEMU, even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers."

Edit: This comment seems to indicate that even lacking a virtual floppy drive, the floppy drive controller is still present and thus the system is vulnerable: [https://news.ycombinator.com/item?id=9539191](https://news.ycombinator.com/item?id=9539191)

<comment><USER31> This is up to the VM provider. I haven't seen a list yet except that this doesn't affect VirtualBox (if no floppy is mounted, the exploit is not possible).

One would expect though that there is no issue if a floppy drive is not attached, and hope that there is not a separate security hole to mount a floppy from sandboxed code (unlikely).

</comment></comment><comment><USER24> Backronyms are lame, whether they are USA-PATRIOT or VENOM.

Why does it need to be an acronym? Just name it.

</comment><comment><USER32> I'm happy to report that we've completely patched our BigV cloud platform in four hours _without needing customers to reboot_ [http://forum.bytemark.co.uk/t/venom-new-vulnerability- affect...](http://forum.bytemark.co.uk/t/venom-new-vulnerability-affecting- bigv-and-legacy-vms-cve-2015-3456/2255/6?u=joshr)

</comment><comment><USER33> Cloudways provide three cloud infrastructure providers to host applications. We asked our point of contact with Amazon AWS, Google Compute Engine and DigitalOcean and here is what they respond.

DigitalOcean (DO): Being Patched. (The DO staff are busy in rolling out security updates. The patch will automatically be applied on DO servers inside Cloudways Platform.)

Amazon Web Service: Officially confirmed to be Safe.

Google Compute Engine: Officially confirmed to be Safe. (A Google representative informed Cloudways, "Google Cloud Platform was never vulnerable to this flaw. We do not use the vulnerable software.")

[http://www.cloudways.com/blog/venom- vulnerability/](http://www.cloudways.com/blog/venom-vulnerability/)

</comment><comment><USER34> Is VirtualBox affected? It is not mentionned

<comment><USER35> Other articles mention virtualbox is affected: [http://www.zdnet.com/article/venom-security-flaw-millions- of...](http://www.zdnet.com/article/venom-security-flaw-millions-of-virtual- machines-datacenters/)

Oracle, which develops VirtualBox, said in an emailed statement that the company was "aware" of the problem, and fixed the code, adding that it will release a maintenance update soon.

"We will release a VirtualBox 4.3 maintenance release very soon. Apart from this, only a limited amount of users should be affected as the floppy device emulation is disabled for most of the standard virtual machine configurations," said software lead Frank Mehnert.

</comment></comment><comment><USER36> Venom... really... ugh

<comment><USER37> Where's G.I. Joe when we need him?

</comment></comment><comment><USER38> This is serious, but not that bad. First you need to actually get code running on the VM in the first place.

</comment><comment><USER39> Since the vulnerability is in floppy drive emulator code, it isn't clear to me whether all deployments are vulnerable or only hosts that have floppy drive devices defined in their guests are vulnerable. Can someone please clarify?

<comment><USER40> From the FAQ:

> For many of the affected virtualization products, a virtual floppy drive is > added to new virtual machines by default. And on Xen and QEMU, even if the > administrator explicitly disables the virtual floppy drive, an unrelated bug > causes the vulnerable FDC code to remain active and exploitable by > attackers.

So I guess for KVM you're safe if you don't have a virtual floppy drive, unclear whether it's KVM default though. For the others, you're still vulnerable by an unrelated bug.

</comment></comment><comment><USER41> Code reuse is great, unless it is Qemu?

<comment><USER42> Or OpenSSL, or bash...

If there's a solution to this problem, I don't know what it is. Trying to replace an underfunded monoculture with severely underfunded diverse implementations may not even work and may actually reduce security.

</comment></comment><comment><USER43> So much marketing. It's sort of hard to take these companies seriously.

Couldn't you just disable the floppy device in the vm?

<comment><USER20> If you'd read the OP before commenting, you'd know the answer. (No.)

</comment></comment><comment><USER44> Getting really tired of these slick vuln websites....

</comment><comment><USER45> [...] _security vulnerability in the virtual floppy drive code_ [...] _For many of the affected virtualization products, a virtual floppy drive is added to new virtual machines by default._

That is a pretty simple mitigation. Make sure there are no (unnecessary) virtual floppy devices defined in your VMs.

I checked my VMs (Ubuntu/KVM) and, as expected, none of them have a virtual floppy - they are not added by default on that platform.

<comment><USER46> You didn't read much of the page :)

To quote:

"For many of the affected virtualization products, a virtual floppy drive is added to new virtual machines by default. And on Xen and QEMU, even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers."

</comment></comment><comment><USER47> > How do I protect myself from the VENOM vulnerability?

> If you administer a system running Xen, KVM, or the native QEMU client, > review and apply the latest patches developed to address this vulnerability.

> If you have a vendor service or device using one of the affected > hypervisors, contact the vendor's support team to see if their staff has > applied the latest VENOM patches.

Or you could, you know, search for "qemu disable floppy" in google, read a bit and apply this flag to the VM:

qemu -global isa-fdc.driveA=

or -nodefaults to only enable the devices you want to enable...

[https://lists.gnu.org/archive/html/qemu- devel/2013-02/msg004...](https://lists.gnu.org/archive/html/qemu- devel/2013-02/msg00434.html)

<comment><USER48> "And on Xen and QEMU, even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers."

<comment><USER47> Yeah, sorry, I wrote whatever came to my mind before reading everything...</comment></comment></comment>


How can I get a job in Japan? - <AUTHOR>

Hi!
I study marketing in Mexico and I'll be done with college in 2 years. For the most part I've worked  doing marketing for tech-startups (I think it's amazing how much I learned on startups than on big companies). My goal is  to get a job doing marketing in Japan (not teaching english nor spanish) in two years.
I'm half japanese so I have the citizenship but I'm still learning the language.
So what should I do these two years to achieve my goal? <comment><USER2> I think that investing in your language ability would be the wisest thing to do. All of the marketing people who I have worked with are extremely proficient in speaking, listening, reading, and writing. If you need a bar to shoot for, make 1-kyu on the JLPT (<http://www.jlpt.jp/e/>) a _minimum_. The Jetro BJT (<http://www.jetro.go.jp/en/bjt/>) would be a better goal since it is a bit more difficult than JLPT 1-kyu, but Jetro no longer administers the test and I have not heard how the new test is.

<comment><AUTHOR> wow, thank you very much!</comment></comment>


Donate to HN: XKCD meeting personal experience giving birth to an idea ... - <AUTHOR> http://xkcd.com/642/

<comment><AUTHOR> This is in the UK - social circumstances and conventions regarding walking vs driving are different from those in the USA (and others) so please bear that in mind as you read ...

</comment><comment>==

I was driving to work this morning, and noticed a young lady walking along, obviously going somewhere. There didn't seem anywhere obvious to be going that was really close - I figured she had about a five minute walk ahead of her, at least.

And it was blatting down.

She was getting quite wet, and I thought - if that were me, I'd like to be offered a ride.

But I couldn't stop and offer one, because no doubt I'd get a look that asked what rock I'd crawled out from under, and what kind of a pervert I really was, and did I really think she was stupid enough to get into a car with someone she didn't know, even if she was getting half-drowned and would prefer to ride.

But I figured she didn't know me, so even if she thought I was demented, and even if she refused point blank, nothing would be lost. So I stopped and offered a ride to a perfect stranger who was getting very wet. Those who know me will know that it's the sort of thing I would do.

What I didn't realise was quite how much vitriol could be inserted into what might otherwise be a polite declining of a simple offer to help.

I won't do that again.

Shame, really.

</comment><comment>==

So here's the idea. A web site where people can register, then if they accept or offer a ride they can send a photo of the other person. Then when the ride is complete, send a "transaction closed" message.

Then both parties have a stake in making sure the ride ends safely and happily. If someone were registered with the site I'd offer them a ride. I can think of ways to make the security issues work, and suddenly hitch-hiking might come back into vogue, even if only among geeks.

Hmm. Business opportunity?

<comment><USER2> I would have also turned you down (pregnant woman, suddenly paranoid for the safety of my pending sproglet).

However, I would have done so with kind words and a smile - and I would have spent the rest of the day thinking what a nice chap you are. :)

Not that it helps you at all, I guess.

</comment></comment><comment><USER3> Jeez people, if your thoughts are as bad as depicted here, see doctor and get some paxil, seriously. Otherwise just open your mouth and say anything, nothing bad will happen if a stranger isn't a chatty mood.

<comment><AUTHOR> My personal experience suggests otherwise. I've been harrassed in real-life by someone to whom I made an inoffensive and passing remark. For some reason they then followed me spouting obscenities.

I suggest you simply haven't (yet!) had a bad experience, and I think you're possibly unqualified to suggest they never happen.

<comment><USER3> You're right, I've never had anything like that happen to me. But am also quite sure, what you describe is extremely rare, no? Sort of like getting hit by lightning?</comment></comment></comment>


How to Party Like It's 1999: Emulation for Everyone - <AUTHOR> http://journal.code4lib.org/articles/11386 <comment><USER2> Slightly tangential: I've been wishing for years that a cottage industry would form around building quality systems for playing old games. Maybe a 486 100mhz with 16mb of RAM, or a Pentium 133 with 32mb and a decent video card so Quake would run well (Diamond Monster 3D 2 maybe?). Proper Soundblaster, 3.5 and 5.25in floppies, 4x CDROM, and a correctly configured autoexec.bat and config.sys. Hell, an external 28.8 or 56k modem too.

Dosbox and the like are great, but the sound is never right. Soundblaster 16/Pro/etc had a very distinct sound that none of the emulated stuff even approaches. Miss it mostly when playing Doom/Doom 2. The music is never right.

<comment><USER3> The OPL2 and 3 chips were all-digital, so it's possible to verify that the bitstreams from the original chips matches the outputs of an emulator of the chip...but the original hardware also included some specific ADCs with some kind of buffer feedback loop, and I think that's where the real difference in the sound comes in (like the overly-harsh drum sounds from most of the emulators).

I'm working on a side-project right now to build a USB-connected YMF262+YAC512 board for the reasons you've mentioned. I've actually got a 600MHz K6-3 with 128MB of RAM, Geforce4 ti4400 and SB16 that I use as a retro computer, but if I can have the same, proper audio output on my regular machines, that would be even better.

<comment><USER4> Relying on ancient hardware is not a good idea for the long term: it'll eventually fail.

It should be possible to revive some of this old hardware and characterize the sound, using specific inputs and recording the outputs, and creating a filter which can then be included in emulators to recreate the original sound.

</comment></comment></comment><comment><USER5> Prince! Libraries!

FYI, the journal this post is from is a seasoned group of coders & librarians. It's annual and regional conferences always include hands-on programming workshops that I've found useful as a medical and web librarian. Love the multidisciplinary community of Code4Lib. The Open Paren podcast is close to this community ([http://openparen.club](http://openparen.club)).

</comment><comment><USER6> Seems weird they only tangentially mention archive.org in a reference: check out the 4am collection of cracked Apple II software running in an in-browser emulator, with full descriptions of how over 680 disks were de-copy-protected. And that's just one archivist, on one system: they have scores!

</comment><comment><USER7> I'm sorry, I can't help it: "Salmon Rushdie archives"? Literally laughed out loud.</comment>


Oregon vowed not to become CA – and passed sweeping housing crisis legislation - <AUTHOR> https://www.latimes.com/california/story/2019-07-19/oregon-lessons-california-housing-crisis <comment><USER2> My prediction: this will accelerate a housing crisis.

The cap on rent increases and the other restrictions on landlords will make it a lot less likely that rentals will be offered.

The lack of protection for single family dwellings will make those areas a lot less attractive.

If you want to get more of something, regulating it and increasing the cost of it, and increasing the regulatory uncertainty is a surefire way to do the opposite.</comment>


We solved invoicing at our startup. We built our own web app for that - <AUTHOR> https://www.indiehackers.com/post/how-we-solved-time-tracking-and-invoicing-at-karma-we-built-our-own-slack-bot-for-that-d758419c50 <comment><USER2> Thanks for the interesting product you have here, I'm sure it took awhile to build. May I ask, is this for business use or for consultants to report hours?

<comment><AUTHOR> I think it's for the teams on Slack, those could be consultants and the business teams as well.</comment></comment>


Theremin's Bug: How the Soviet Union Spied on the US Embassy for Seven Years - <AUTHOR> https://hackaday.com/2015/12/08/theremins-bug/ <comment><USER2> A sweet and short read about the Thing. [https://en.wikipedia.org/wiki/The_Thing_(listening_device)](https://en.wikipedia.org/wiki/The_Thing_\(listening_device\)) There's an article in wiki as well, but reading stuff with personal touch is a lot nicer

<comment><USER3> This is also an excellent story about it: [https://thecorrespondent.com/3789/operation-easy-chair-or- ho...](https://thecorrespondent.com/3789/operation-easy-chair-or-how-a-little- company-in-holland-helped-the-cia-bug-the-russians)

</comment></comment><comment><USER4> > In 1938, with the Nazi threat growing stronger, Theremin returned to Russia. > He expected to send for his wife a few weeks after his arrival. > Unfortunately, that wasn't to be the case. Léon and Lavinia never saw each > other again.

I was always under the impression he was abducted from his home in NY and sent back. At least, that was the story told in _Theramin, An Electronic Odyssey_ [0].

[0] - [https://www.youtube.com/watch?v=fAOpVAHwLic](https://www.youtube.com/watch?v=fAOpVAHwLic)

</comment><comment><USER5> If this kind of technical creativity (way outside of the box) was possible in Russia under the Soviet yoke, then what kind of things are they capable of creating today?

Perhaps a whole bunch of electronic warfare devices like those used against AEGIS and the USS Donald Cook? And what about the fact that NASA and the US space program are so dependent on Russian rocket engines? Or the Russian jet that can hover or reverse in mid flight?

We know that the Russian system of higher education is very rigourous and places a lot of emphasis on mathematics Could this be the root of it? Or is it something else in the culture of Russia?

One of the biggest mistakes of the USA after the Cold War was to stop taking Russia seriously and to stop watching what Russians were doing. The west accepted the views put forward by Ukrainians about Russia, instead of going direct to the source. Now we know that neo-nazi forces within Ukraine were spreading misinformation about Russia in order to benefit Ukrainian oligarchs.

It is time to move beyond this. More of us need to learn Russian fluently and analyze Russia based on direct knowledge of the country and people. Russia isa powerful nation and it has a rich and vibrant culture. There is a lot to learn there, not just about technology but also about how to approach and solve impossible problems.

</comment><comment><USER6> I remember reading about this back in school in the library; I found it very sophisticated that it was specifically designed with no power source, and thus almost impossible to detect. A very, very clever design.

And also a wonderful illustration of political machinations, in that the olive branch extended to you often has a covert team watching exactly how your fingers grasp it.

</comment><comment><USER7> Wow I'd heard this story before but I never knew that the bug had no power source. Thats pretty slick.

<comment><USER8> Pedantic, I know, but the projected beam was it's power source. It had no _built-in_ power source, which is pretty cool, all the same.

</comment></comment><comment><USER9> Check the comment by BrightBlueJim. I too have thought that the common description of "The Thing" was incomplete. To make it work well enough to be practical it would of required some non-linear element.

Current bug detectors explicitly detect non-linear elements. A hilarious practical joke involves adding diodes to the concrete mix for a high security facility. Back in the cold war the Russians actually did this to the Americans in Moscow.

</comment><comment><USER10> I wonder if the microwave based "acoustic attacks" in cuba were simply their attempt at powering such a bug.

</comment><comment><USER11> The Thing is on display at the NSA museum in Maryland. Very interesting museum for crypto history.

</comment><comment><USER12> snoopy RFID</comment>


Historical Laundry Conundrum – Finding a Home for Shirts - <AUTHOR> http://ascii.textfiles.com/archives/4939 <comment><USER2> One of my favorite Python people recently collected all of her swag t-shirts and made quilt out them. The end result was beautiful and functional.

<comment><USER3> here's a link to her tweet, it's very awesome: [https://twitter.com/roguelynn/status/704137673527590914](https://twitter.com/roguelynn/status/704137673527590914)

between that and one of my friends making tshirt pillows, I finally have something to do with all of mine that I don't wear but couldn't bring myself to give away quite yet.

<comment><USER4> that's me! thank you for the compliment! <3

</comment></comment></comment><comment><USER5> Seems like a sensible approach. I gave a pretty big pair of plastic bags of tech T-shirts (some/many never worn) to charity over the holidays. I still have far more than I will ever wear (much less need). I guess one could imagine someone wanting to make a museum display of old tech T-shirts at some point but the reality is that physical storage is expensive.

</comment><comment><USER6> You can frame t-shirts, and turn into wall art:

[http://sometimes-homemade.com/how-to-frame-t-shirts/](http://sometimes- homemade.com/how-to-frame-t-shirts/)

I could imagine Google or Facebook or some other company with plenty of money doing this on a spare wall at a new HQ. It's geek heritage.

</comment><comment><USER7> Ouch, each time I look at this site my eyes hurt.</comment>


Ask HN: Has anyone developed a web API for sound samples? - <AUTHOR>

I'd like to try my hand at creating a web-based real-time collaborative music platform, but one of the biggest hurdles is putting together a library of solid instrument samples for the user to trigger. I really wish there was a simple API for selectively downloading specific instrument libraries from a third-party provider to the client, much like Google's WebFonts API provides a simple way of selectively loading fonts straight from Google.<p>Does such an API exist? If not, I feel like this would be an incredibly useful product that many music-oriented web developers could benefit from. There's even a good chance I'd pay for it! <comment><USER2> I agree with you - just recently I spent WAY too long trying to find a good free sound sample for a notification chime and integrate it into a cross- browser audio object. Not sure if you are thinking of the implementation-end as well (aka javascript/HTML5/flash player of some variety) that can consume the api or just the api itself.

What would have been the ideal solution for me would have been a JS script I could have included then simply instantiated with a sound (like 'bell chime') and exposes simple javascript controls like goTo, play, stop, pause etc and worked seamlessly cross-browser with HTML5 and flash fallback. I know sound players like this exist (minues he included sound bytes) but they all have the overhead of the UI for player controls.

<comment><USER3> Consider SoundManager2 (<http://www.schillmania.com/projects/soundmanager2/>). It allows controlling sounds via HTML5 or Flash via a JavaScript API without any UI overhead.

</comment></comment><comment><USER3> If you build this, you may want to look at Google's Web Audio API ([http://chromium.googlecode.com/svn/trunk/samples/audio/index...](http://chromium.googlecode.com/svn/trunk/samples/audio/index.html))

</comment><comment><USER4> Can you expand a little further on your pain point?

<comment><AUTHOR> Certainly... if I wanted to create an app where a user could play a virtual "instrument" via the computer keyboard, I would want to trigger a specific audio sample (e.g. a piano note or a drum hit) when the user presses a key. There are already several libraries out there (SoundManager2 comes to mind) that allow for fairly simple cross-browser audio output, but the problem is procuring the audio samples themselves. I could go to the trouble of scouring the internet for solid sound samples, uploading all of them to my server, and setting up all of the note/sample mappings... however, much like Google has made it unnecessary for every web developer to upload all the custom fonts they want to their server, I'd like an API that allows me to browse and include instrument sample packs without having to first track down the samples, upload them, and manually map everything.

The goal is to make client-side samplers as painless as possible, lowering the barrier to real-time music generation on the web... kind of like a modern alternative to simple MIDI instruments.

I could see this being useful not only for virtual web instruments, but also for any website that wants to utilize some form of dynamic musical feedback.

EDIT:

I could see this being implemented in a lightweight or a heavy-duty fashion:

1) Lightweight: API merely provides note-mapped URLs to the audio samples, up to the developer to decide how to pull in each sample and store/output it.

2) Heavy-duty: API takes care of storage and output. Creates an instrument object with a play method that takes a note value (MIDI value?) as input. This is more in line with what ecaroth suggested.</comment></comment>


Open-Sourcing our GDPR Compliance Preparation For Articles 30, 32, and 35 - <AUTHOR> https://blog.everlaw.com/2018/03/05/gdpr-compliance-preparation-articles-30-32-35/ <comment><USER2> I found one of the toughest things about GDPR is determining what is or isn't personal data, when dealing with less common types of data.

R6DB for example, a video game stats website, decided to shut down [1] due to unknown territory over whether or not player account IDs and statistics they were scraping from official APIs, are "personal data". (They have now reversed their decision to shut down I believe)

As soon as you leave the classic Website tracking/Product usage categories, the definitions get murkier. If I shoot a GDPR data request to eg. Blizzard, do they have to give me any game/stats history they have on me?

[1] [https://medium.com/@r6db/r6db-is-shutting-down- db1b59b031ac](https://medium.com/@r6db/r6db-is-shutting-down-db1b59b031ac)

<comment><USER3> I'm surprised no one has brought this up (yet). GDPR is super expensive to remain compliant, simply because of the broadness of the terms used, leading to undefined scope of liability.

As one other HNer previously mentioned, the cheapest way to stay compliant with GDPR is to completely block access to EU customers. In fact, this is what I did with my business. I redirect to a generic text file (not even a HTML that could trigger a GDPR clause by itself) explaining my stance.

Don't worry about false equivalence that many will raise "So, you don't care about our data HUH?". The intentions behind GDPR may be good. But, the roadmap seems completely stupid. Many think blocking EU customers is an arrogant move. No, it's not. Not everyone has the finance and time to comply with GDPR. A typical re-implementation of our web application will cost us weeks if not months, for example. That could be time spent building features customers want, not fighting some vague elitist law (comply with us or else you're doomed!). If enough business owners block access to EU customers, then, EU will lose a lot of business and that will trigger them to hopefully do something about the vagueness of GDPR. I don't even live in EU, for instance, yet this re-implementation will cost me tens of thousands of dollars (translating my time) that the EU isn't going to pay me for their vagueness.

I've had enough of GDPR. I know many EU HNers will not agree, but please consider putting yourself in a solo founder's shoes.

<comment><USER4> If you are a solo founder without any business presence in the EU, or clients in the EU, you have nothing to worry about. Blocking EU site visitors is unnecessary, and GDPR covers this in clear language.

What about reimplementing will cost you tens of thousands? That implies you either have a heavy use of personal data without a legitimate interest or have significantly misunderstood the requirements laid out in GDPR.

<comment><USER5> Let's say I operate a website where you can sign up with an email address, and I'll send you recipes. The recipes call out specific brands of ingredients. The vendors who sell those brands pay me for this service. I and my server are in the USA. Additionally:

1\. My food vendors operate (a) all only in the EU; or (b) mostly worldwide, but one operates only in the EU; or (c) all worldwide; or (d) all only in the USA, but an independent third party imports many of their products into the EU.

2\. My recipes are for (a) only French food; or (b) all kinds of food.

3\. My email includes descriptions of the restaurants that originated the recipes. These restaurants are (a) all in France; or (b) about half in France, half in New Orleans; or (c) all in New Orleans. (New Orleans is an American city with strong French influence on its culture, and a francophone minority.)

4\. The recipes are distributed in (a) French only; or (b) English and French; or (c) English only.

5\. I advertise my site (a) with a run-of-network ad that shows mostly in the USA, but also on a French newspaper; (b) on a small blog whose American operator doesn't track its audience, but that I've heard is popular in France; (c) not at all, relying on word of mouth.

So I've set out 4×2×3×3×3 = 216 cases. In which of them am I subject to the GDPR? What factors or combinations of factors are determining? If I asked this question of two lawyers, how closely would you expect their answers to agree? What confidence would they express that their answers would agree with the regulator?

I think the people who think GDPR compliance is easy are saying to themselves, "If I behave in accordance with these general principles as I understand them, then the regulator will see me for the good person that I am and I'll be okay". That may be true, but it's not law.

<comment><USER2> You have EU customer emails. You're subject to gdpr in all of them. None of the factors you suggested matter. Store your emails properly, have unsubscribe links, answer data requests.

You just gave one of the most straightforward cases...

<comment><USER5> The post above said:

> If you are a solo founder without any business presence in the EU, or > clients in the EU, you have nothing to worry about. Blocking EU site > visitors is unnecessary, and GDPR covers this in clear language.

Do you think this statement is correct or incorrect? If you think it's incorrect, then why are you interpreting the "clear language" of the GDPR differently from its poster? (I personally think the statement is either incorrect or too vague to assess.)

If you think the statement is correct--I presume, because you think that as soon as an EU visitor signs up, you have a "client" or "business presence" in the EU--then what meaning does that poster's statement convey? Does it mean anything more than "blocking EU visitors is unnecessary, as long as you have zero EU visitors", a true and entirely meaningless statement?

Or are you saying that the email address makes this different from just a visitor? Even if my server is a typical default configuration that logs time and IP for each visit? Even if my ad network logs tracking cookies? Even if a data broker exists somewhere who could map that information to a real name? Even if I buy that data?

And, for clarity: What about the case where the website (1) calls out only products with authorized distributors only in the USA, (2) has recipes for all kinds of food, (3) describes restaurants only in the USA, (4) is in English only, and (5) isn't advertised makes it subject to the GDPR? The EU says in an example that:

> Your company is service provider based outside the EU. It provides services > to customers outside the EU. Its clients can use its services when they > travel to other countries, including within the EU. Provided your company > doesn't specifically target its services at individuals in the EU, it is not > subject to the rules of the GDPR.

[https://ec.europa.eu/info/law/law-topic/data- protection/refo...](https://ec.europa.eu/info/law/law-topic/data- protection/reform/rules-business-and-organisations/application-regulation/who- does-data-protection-law-apply_en)

Do you agree with this guidance? If yes, what factor constitutes the specific targeting? Or does the "travel" language mean we exclude only non-EU residents who temporarily visit the EU? Also EU residents who sign up while in the USA, but then return home? But not EU residents who sign up while in the EU?

How sure are you that your answer is correct? I get that you're sure that it's morally right, and complying is always the conservative choice; but what probability would you assign that an EU court would reach your same conclusion, that all 216 cases are subject to the GPDR?

And since any suggestion that the GDPR is less than perfect attracts angry reactions: I am not asking whether it's a good idea to comply with the general spirit of the GDPR for all visitors worldwide, and I think the answer to that question is yes. I'm asking what the law says. I think the rule of law is important, and I'd venture that most people who have lived in countries with and without it would agree.

<comment><USER2> It is correct and it is clear. If you have customers in the EU, gdpr matters. If you don't, it doesn't. And either way, you should strive to follow it, because GDPR's rules really are a set of common sense things you should have been doing all along:

\- Store your stuff properly (encrypt sensitive data)

\- Allow users to download their data

\- Allow users to delete their data

\- Have a clear privacy policy

\- Offer ways to opt out of marketing

<comment><USER5> I said explicitly that I'm not trying to debate what's morally right, or good for business (since I agree that good privacy practices are both of those). I'm asking what is the law.

> If you have customers in the EU, gdpr matters. If you don't, it doesn't.

Either this is false, or you've adopted an unusual definition of the word "customer". The email recipients don't give me money, but even I agree that e.g. if I promote my site with advertisements only on EU sites, and know or should know that most of my recipients are EU residents in the EU, then it's relatively clear that I'm subject to the GDPR.

Lawyers care about precision of language, because people's lives are at stake. It's not useful to discuss legal matters without that precision.

I guess you're certain enough that all my previous examples are subject to the GDPR that you don't think it's worth discussing why, since you didn't answer any of my questions. How about:

I. I run the website that (1) calls out only products with authorized distributors only in the USA, (2) has recipes for all kinds of food, (3) describes restaurants only in the USA, (4) is in English only, and (5) is advertised on American newspaper websites; but I take no specific measures to exclude EU visitors? I think you think I'm subject to the GDPR.

II. Same as II., but I block EU IP addresses?

III. Same as II., but I ask the remaining people if they're subject to the GDPR, and block them if they say yes?

IV. Same as III., but I require a credit card with an American billing address?

V. Same as IV., but I require evidence of legal American residence (e.g., a scan of a US passport of visa)?

Are you able to answer these questions? Or does it just not bother you that you can't, because compliance with the GDPR serves a purpose you agree with?

What do you understand by the phrase "rule of law"? Do you think it's important? Hungary is an EU country. Its prime minister has described George Soros, the founder of the Open Society Foundation, as an "enemy of the state". If you ran an organization publicly associated with the OSF in Hungary, then how would a notice of a GDPR investigation from your government make you feel? Wouldn't you feel better if the rules gave the regulator less room to maneuver?

<comment><USER6> Here's what I would do: Nothing. You're in the USA. Your site is in the USA. Don't worry about it. If you receive any undesired correspondence about the GDPR, treat it like you would any other junk mail.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Thanks for posting. This does not look all that different from PCI compliance, though the scope of data involved is larger and as others have observed there's some ambiguity about coverage that will need to be worked out in practice.

Editorially speaking I'm glad to see this emerge even though it means more work for me personally. If anything some of the fines seem too low. (I'm looking at you, Equifax.)

<comment><USER8> Speaking of which, how would the Equifax breach have been affected by GDPR ? My understanding is that they had legitimate reason to request and store that data, and GDPR is not some magic tool that prevents breaches.

<comment><USER7> I'm just a beginner on the GDPR but here's a few things I got out just of the Everlaw link.

1.) Protect the data with methods corresponding the risk level (Articles 32 and 35)

2.) Enable users to erase, correct, or transfer data at will (Article 15)

3.) Enable users to consent to use of their data in the first place (Article 15)

So yes, it seems it would have been quite applicable.

<comment><USER9> Also:

4.) Notify the supervisory authority of any data breach within 72 hours (Article 33)

5.) Notify the subject of any data breach without undue delay (Article 34)

And the broader issue of remedies and penalties in Chapter 8.

</comment></comment></comment></comment><comment><USER10> TL;DR: It's a spreadsheet to help you list out what personal data you keep in your organization, who has access to it, how it's secured, how long you plan on keeping it and what you intend to do with it.

MORE: I'm not trying to be dismissive, it's great! And whether or not you're going full-on trying to get GDPR compliant or not, it's _really_ hard to think of a scenario where taking the time to think and document your data handling and security isn't a net positive for the security posture of your application.

When you dig into the GDPR [1] you find that a lot of it is like this: common sense stuff that you'd hope everyone was doing already, but apparently aren't.

\- Tell People what you're going to do with their data

\- Don't do other stuff with it than what you told them

\- Keep it secure

\- Don't give it to other companies that might do things with it you didn't tell people about

\- If you lose control of it in a data breach: tell them

\- If they ask you for their data, give it to them

\- If they ask you to delete their data, delete it

1 - [https://blog.varonis.com/gdpr-requirements-list-in-plain- eng...](https://blog.varonis.com/gdpr-requirements-list-in-plain-english/)

<comment><USER11> It's the implementation that is difficult. For example, if someone wants their data deleted I need to go delete all of the email correspondence, I need to delete them from applications like Google Analytics. If I follow them on Twitter or interacted with the on Twitter I need to delete those posts. Oh and then there are backup archives that I now need to scrub. The point being is a lot of data is not well assembled and cleaned for deletion which is why data analytics on your existing data is so hard in the first place!

<comment><USER12> And the difficulty can rise exponentially if you have a giant stack that wasn't designed with GDPR in mind (though it may be totally benign in its risk towards data subjects) and which cannot be easily disentangled to comply with some of these requirements.

<comment><USER13> Opinion on the matter:

"The GDPR however does make a small concession to companies in this case: the steps they need to take in this direction are limited to the available technology and the cost of its implementation. Organizations must take reasonable measures to ensure processors are aware of the request, but will not be at fault if the data is not completely erased by third parties."

[https://www.endpointprotector.com/blog/gdpr-essentials- the-r...](https://www.endpointprotector.com/blog/gdpr-essentials-the-right-to- erasure-who-can-request-it-and-how-is-it-applied/)

<comment><USER12> The vaguery there is the problem. I know how I would decide if it were up to me, but if a supervisory authority comes calling, that's just my argument, and they almost certainly have a preset opinion about what is reasonable.

</comment></comment></comment></comment></comment><comment><USER14> > _We are sharing this with anyone who wants to use it! Why?_

[Their answer amounts to "because".]

Because they've gotten all the internal value out of it, and now with the deadline here, they can get maximum value out of it by "open-sourcing". Sorry to be so cynical, I'm so sick of this style of embedded advertisement.

That said, I do rather like the simple format of their template. Although their handling of "security" is too thin to be useful in any way, I will otherwise integrate their templates into our current documentary processes, which are awful by comparison.

</comment><comment><USER15> Let's say you're a small bootstrapped Indi Hacker style SaaS.

You have a few hundred customers and maybe 10 of those are in Europe.

Would that company need to worry about complying? How much should they worry?

<comment><USER16> Regardless of the size of organization, GDPR applies. In particular, note the section "Right of Access":

* [https://en.wikipedia.org/wiki/General_Data_Protection_Regula...](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Right_of_access)

Which requires the organization to supply information about use of personal information. This will have an operational overhead regardless of scope of Personal Information used.

For a worse-case (hopefully impossible) variant of what this request looks like: [https://www.linkedin.com/pulse/nightmare-letter-subject- acce...](https://www.linkedin.com/pulse/nightmare-letter-subject-access- request-under-gdpr-karbaliotis/)

Oh please somebody correct me if I'm wrong. Otherwise that's a silly amount of operational overhead for bootstrapping. Even for systems designed from the start to not use personal data: The org would still need to handle a rather detailed and costly administrative request.

<comment><USER15> Wow that article is scary. Even worse would be "remove all my data from all your backups".

</comment></comment></comment><comment><USER17> Very happy to see this made public, the focus on data life-cycle management is a good one and it is actionable which makes it even better.

</comment><comment><USER18> Before _" Who owns and controls the personal data we collect?"_, there has to be _" What personal data do we keep, in actual reality?"_

That is, personal data discovery.

Emails, archives, cloud storages… it can be hard to be sure when relying on just human introspection or wishful thinking. Especially for larger organizations.

Automated discovery tools help -- we built pii-tools.com, an AI–assisted tool to locate personal information across corporate assets. If you're having trouble filling in spreadsheets like this with actual data, get in touch (contact in profile).</comment>


State of Ad-Blocking on OzBargain - <AUTHOR> http://scott.yang.id.au/2015/10/adblocking-on-ozbargain.html <comment><USER2> Interesting that the % of desktop users blocking ads is so high, while the penetration on mobile is very low still. How would it translate in crude numbers though? If mobile visitors are 80% of the total, like for some news sites, that 6% is much more relevant than shown here...

</comment><comment><USER3> [http://i.imgur.com/9KMDCE5.png](http://i.imgur.com/9KMDCE5.png) to compare ozbargin with and without adblock

<comment><USER4> Given how horrible that ad is, it should be a surprise to no-one that it is deemed inacceptable.</comment></comment>


Git for Mercurial users - <AUTHOR> https://bitbucket.org/sjl/dotfiles/src/7d16f9d89280c9ae0096fdbc94410a9b881bfe20/gitconfig?fileviewer=file-view-default#gitconfig-10 <comment><USER2> Some of that is so angry! :-) I understand though. Being a big mercurial fan myself, I tried the same approach when forced to use git at work. It was good for learning git, but after a while I just switched to hg-git and I am much more at peace. Ran into a little snag yesterday when a co-worker wanted to pull on of my local (hg) commits into his git repo. Not sure if there's a way to do that.

</comment><comment><USER3> Wouldn't this be considered an anti-pattern? Similar to switching to emacs just to make it work exactly like vim? Just use vim, or in this case, just use mercurial?

<comment><AUTHOR> There's spacemacs and evil. I don't see a problem.</comment></comment>


Trump administration reportedly wants to extend NSA phone surveillance program - <AUTHOR> https://www.cnet.com/news/trump-administration-reportedly-wants-to-extend-nsa-phone-surveillance-program/ <comment><USER2> NSA no longer cares about phone surveillance because they have something better.</comment>


Get ready for mass business failures : Texas Startup Blog - <AUTHOR> http://www.texasstartupblog.com/2008/10/08/get-ready-for-mass-business-failures/ <comment><USER2> Loved this:

FTA:

 _In the 1970s the average size home was 1,400 square feet, today the average is over 2,300 square feet. Are we that much bigger?_

Sadly, _yes_.

<http://www.cdc.gov/nccdphp/dnpa/obesity/trend/maps/index.htm>

<comment><USER3> LOL - I knew when I wrote that someone would pull up obesity data... :)

</comment></comment><comment><USER3> Lovely, I am not really that negative a guy... But this post may lead you to believe I am...

<comment><USER4> I don't think you sound negative, but I'm not really keen on your use of the word "we" everywhere.

I don't run my business that way, I didn't buy a house I couldn't afford, and I never encouraged anyone else to do those things.

</comment></comment><comment><USER5> "Who is to blame? We are - i.e. you and me"

This guy is so quick to judge, so quick to place blame on such a complicated issue. What a massive over-simplification on such a dynamic and complicated issue.

<comment><USER6> No kidding.

And just who exactly is he calling WE? I've worked like crazy to pay off my credit cards/loans and keep them paid off. I bought a house I could afford (<1/3 of income) with a large down payment (> 20%). I've saved on my own as well as in my partially matched 401k. I have a 6 month emergency fund. Sure, this all means that I don't have a car and take public transportation- and my computer/stereo/tv/etc aren't brand new. But have those TINY sacrifices been worth it? Absolutely!

I am not we.

So explain to me why I should bail them out? Whey you've got things you can't afford, or you're a bank leveraged at 30 or 50 to 1, you are risking it all! When you lose it all, it's not exactly a shock to those of us that have been extra conservative with our money.

<comment><USER3> We as in US citizens. George Soros has done a great job of living within his means and obviously so have you, but WE as in at least 43% of Americans haven't. Also, YOU (i.e. WE) keep electing these freaks in Congress and in the White House. Why do we have a 10 trillion dollar debt? Why do we think we can keep borrowing year after year?

<comment><USER6> "I am not we" was just my playful way of saying: overgeneralizing gets this article nowhere.

The idea that 57% of us should (or even CAN) bail out the rest of "us" is distasteful, not to mention unfair. Those of you that buy things you can't afford should lose the things. You aren't entitled to a house, you BUY it. You aren't entitled to a wage, you EARN it.

However, I completely agree with you about the deficit, "we" can't keep it up. I am personally exercising my abilities through votes/calls/etc.

<comment><USER5> Do you guys realize that you are both falling into the same fallacious talk as as the author of the blog post. "Bailing out the rest of us" whether you are for it or against it is such a naive statement. You guys are both overlooking not only the highly complicated ways in which this entire situation is affecting all of us... how the bank failures can and is directly leading to layoffs of people that have never in their lives overextended themselves financially, but also the fact that there is absolutely no straightforward path to bailing out anybody in this situation. Even if someone wanted to, nobody could bail out "the rest of us" so your bickering is moot. The only thing we can do is watch as this tidal wave washes over us all and play it safe until it passes. None of us are out of reach of this event.

</comment></comment></comment></comment></comment><comment><USER4> "Who is to blame? We are - i.e. you and me."

Don't blame me. My business pays its bills and payroll out of the money we make every month.

</comment><comment><USER7> Get ready for mass predictions of the future based on conjecture.

<comment><USER3> I was only referring to the practice by banks of freezing credit lines for small companies. This WILL create a snowball effect forcing companies to close their doors. We have to figure out a way to inject confidence in the credit system...

<comment><USER8> You are right, some will have to close down.

In all fairness, they should have seen this coming and they should have had more cash on hand. Many businesses anticipated the downturn and started building cash reserves a year or two ago.

<comment><USER9> > In all fairness, they should have seen this coming and they should have had > more cash on hand.

That may be true for existing business but that is a pretty harsh sentiment to apply to a business just starting out. It's pretty hard to save when you are just starting to grow revenues or when you are even earlier in your business cycle.

<comment><USER3> Of course it is easy to build cash reserves if you are an established company, but an early stage services company would be hard pressed to work without short term credit.

A world without short term credit looks a lot like the third world. I prefer living here (at least I used to).

</comment></comment></comment></comment></comment><comment><USER10> Alex Muse is a moron.

No, seriously.

<comment><USER3> Thanks. Of course morons everywhere are offended. <http://en.wikipedia.org/wiki/Moron_>(psychology)</comment></comment>


Viral Marketing is a Myth - <AUTHOR> http://sloanreview.mit.edu/improvisations/2013/01/31/is-viral-marketing-a-myth/#.URJhmx1EF8E <comment><USER2> Stated as a fact in the title. Stated as a question in the article. Discuss.</comment>


Teen boy builds Brest cancer diagnosis system - <AUTHOR> http://www.marketwatch.com/story/this-teen-boy-seeks-venture-capital-for-ai-to-fight-breast-cancer-2016-08-25 <comment><USER2> You can flag my comments all you want, but it doesn't change the facts. There isn't ANY link to evidence that this thing works.

The Valley turned a con artist named Elizabeth Holmes-Madoff into a paper billionaire by not checking to see whether her woo actually worked. Before we turn this kid into Wile E. Coyote, SuperGenius, maybe someone would like to present a shred of due diligence?

</comment><comment><USER3> So..17 year old boy builds device to look at boobies!</comment>


Angry Unix Programmer - <AUTHOR> http://pages.cs.wisc.edu/~psilord/blog/ <comment><USER2> JWZ wants his HTML style sheet back. Ow, my eyes....

<comment><USER3> Green on black is a classic color choice of hackers. On a CRT it lets you use smaller fonts than you can reasonably use with white on black.

<comment><USER2> I was on a VT100 when you were in diapers, sonny boy. And I'm sick and tired of green on black. We can do better now. Now get off my lawn!

</comment></comment></comment><comment><USER4> More like Smug Lisp Weenie. <http://www.c2.com/cgi/wiki?SmugLispWeenie>

</comment><comment><USER5> This cat wrote a tutorial for IOLib: [http://pages.cs.wisc.edu/~psilord/blog/data/iolib- tutorial/t...](http://pages.cs.wisc.edu/~psilord/blog/data/iolib- tutorial/tutorial.html)

Kickass! I feel bad I haven't heard of him before.</comment>


http + web.arc: an alternative combo for web development - <AUTHOR> http://www.arclanguage.org/item?id=11337

<comment><USER2> Is there a reason this site looks oddly similar to Hacker News?

<comment><USER3> Yes, "This site is about Arc, a new dialect of Lisp..." Paul Graham & Robert Morris</comment></comment>


How Berea College Makes Tuition Free with its Endowment - <AUTHOR> https://www.theatlantic.com/education/archive/2018/10/how-berea-college-makes-tuition-free-with-its-endowment/572644/?single_page=true <comment><USER2> Berea is great - both the college itself, and the community around it.

There's a local community high school with ties to the college; students there who are keen can attend classes at the college, for both high school and college credit. It seems like a great way for kids to "test drive" college in general, and more smoothly transition to independence.

And, the community high school looks straight out of The Jetsons: [http://marrillia.com/wp-content/uploads/2017/03/berea- commun...](http://marrillia.com/wp-content/uploads/2017/03/berea-community- school-1.jpg)

<comment><USER3> Yeah, my wife and I went to the spoonbread festival a few weeks ago it was a lot of fun.

The college does a lot of cool things in the area. A lot of the classes in the area for crafts and such are nice.

</comment></comment><comment><USER4> Beware friendly Berea-- of the temptation to change your tuition free-stance, even a little bit. It's a slippery slope.

Rice University was founded in 1912 with an endowment and grants and the stipulation in its very charter saying "no tuition", but then the administrators moved to change the charter (to eliminate the racist "white" requirement) and as part of that also, guess what, moved to start charging (1965) rather than depending on the endowment.

The tuition has grown steadily since, from 0 to a third the price of comparable private schools in the 90s (and comparable price to public universities) to now be a pretty full-freight $50k/year.

This, combined with the steadily increasing tuition across all universities -- (inflation eased in 1982 but colleges kept increasing rates discovering the market would allow them to charge more) -- has cynically angered me for some time.

Unlike a business, the tax-sheltered endowments fuel a bit more cynicism than just a raw price increase. There was a joke at Princeton back in the 90s that if the board of directors ever allowed the university to spend down the endowment, they could fund ever-increasing tuition for all students for the next thousand years. Is perpetuity truly needed/healthy?

An education is supposed to free a person, not put them in bondage/slavery.

An endowment should free and empower the students (and thus our civilization) as they start their lives, not the administrators and faculty and institution.

Beware, you educators and administrators who put chains on your students to feather your nest and attempt to increase your prestige!

Beware you administrators who create unnecessary buildings with dozens of spaces empty 90% of the time all to woo professors or create your own mini- legacy. And then claim the university is meeting glowing "sustainability" and energy efficiency objectives! (You may get to stay in your office but the degree of walking for students ever-increases and now shuttles are needed!)

Beware you ranking agencies who weight how much a university spends per student as a factor in how good the university is!

Beware you congresspeople who make it easier for universities to charge more by creating huge student loan programs that allow students to go into great debt and subtly mis-direct their ambitions and outcomes towards those which allow them to service their debt!

OK, rant out. Thanks for passing along the article. There has been some progress at the above named institutions to provide tuition for lower-income families. I don't consider it adequate to address all my points.

<comment><USER5> > There was a joke at Princeton back in the 90s that if the board of directors > ever allowed the university to spend down the endowment, they could fund > ever-increasing tuition for all students for the next thousand years.

Back of envelope: Princeton endowment ~22B. Enrollment ~8200. Current tuition ~$45K/yr. 22 * 10^9/(8200 * 45000) = 59.6.

So in ~60 years, without even adding in inflation or the "ever-increasing tuition" or allowing more students as population increases, they'd empty the endowment.

<comment><USER6> Princeton's current 2018 size is $25.9B. In 2001 it was $8.4B, so a annual growth rate of over 6% per year.

So Princeton would have to spend 1.6% of their endowment every year to offer free tuition to their students. Assuming their rate of return on the endowment (including alumni contributions) can grow faster than the cost of tuition growth, they can provide free tuition for their students indefinitely.

<comment><USER5> Princeton tuition was 26K in 2001. It is now 45K. That's 3% growth in tuition, cutting into your estimate.

The current growth is already being spent to fund the university to the tune of ~4-6% [1].

So, if you take that source away, tuition would likely have to pick up the slack.

Care to rerun your numbers adding this all in?

[1] [https://www.princeton.edu/news/2013/10/18/princeton- endowmen...](https://www.princeton.edu/news/2013/10/18/princeton-endowment- earns-117-percent-return-10-year-average-grows)

</comment></comment></comment></comment><comment><USER7> My grandfather went there in the late 20s-early 30s, graduating with degrees in economics and woodworking IIRC. As I recall he described education there as very much a group effort - working together was a bonding and binding experience.

</comment><comment><USER8> The Cooper Union in NYC used to do something similar for over a century until they were forced to stop in 2014 due to a combination of many financial factors, including the financial crisis of 2008.

You can read the entire story of it here: [https://en.wikipedia.org//wiki/Cooper_Union_financial_crisis...](https://en.wikipedia.org//wiki/Cooper_Union_financial_crisis_and_tuition_protests)

</comment><comment><USER9> Sounds like a great thing.

There's another college, located pretty closely, that also offers no tuition. (It's College of the Ozarks, in Missouri.)

I wish there were more schools like these.

</comment><comment><USER10> Berea Computer Science alumn here. Ask me anything.

I grew up in Appalachia (pronounced "app-uh-lai-cha" by us), and have to say Berea was a godsend. I was lucky to start as desktop support and move on to a network engineer later. The labor program is probably the only reason why I became a somewhat competent programmer out of college, since I was writing "production" code before having my first real full time job. You can read more about the labor program here[1]

The college is very particular about your time there, since it's free and all, so your first year you're not allowed to have a car on campus, enter the opposite sex's dorm rooms, and (in some cases) you're tasked with a job that you may or may not like. Some of this may or may not have changed in the past 10 years. Most people hear this and think, "that's crazy," as I did at the time, but as I've grown older -- I've grown to appreciate it.

Another interesting thing is how forward thinking the community is in the town of Berea. Kentucky isn't the friendliest for being a moderate or liberal, but (I would say) Berea is probably the friendliest community I've ever been apart of. It's a place where you can having engaging discussions and make friends at local establishments (BC&T[2] being my favorite).

With regards to the article, the endowment, and replicating the model -- it would be hard. The college runs itself efficiently while maintaining a high quality of education and student services. Replicating this model elsewhere would mean cutting many staff, removing the luxuries that many people enjoy and most likely lowering salaries. Lower salaries work in Berea because the cost of living is so low; however, that's not the case in many areas and no one is going to volunteer themselves for a salary cut.

The labor program has a lot of infrastructure around it (payroll, staff, processing incoming students) that would be hard to replicate. I think existing universities would have to run a program within or alongside their work-study programs and grow it overtime.

1 - [https://www.berea.edu/labor-program-office/a-guide-to-the- la...](https://www.berea.edu/labor-program-office/a-guide-to-the-labor- program/)

2 - [https://www.tripadvisor.com/Restaurant_Review-g39187-d222579...](https://www.tripadvisor.com/Restaurant_Review-g39187-d2225795-Reviews- Berea_Coffee_Tea-Berea_Kentucky.html) ( Seems that they don't have a website )

<comment><USER11> > I grew up in Appalachia (pronounced "app-uh-lai-cha" by us)

Isn't that the usual pronunciation of it? How else do people pronounce it?

<comment><USER12> App-ah-lay-shia, as I've always heard it up on the far northern end.

</comment></comment></comment><comment><USER13> Does anyone see the student debt as a positive thing? Curious.

<comment><USER14> Bankers.

</comment></comment><comment><USER15> Or you could, you know, get the _government_ to pay for it, through _taxes_.

<comment><USER16> The last thing US education needs is further tuition inflation because now the government going to pay for everyone's $60k/year liberal arts degree.

I think there's a place for government-funded higher-ed, but it has to be for schools that can keep costs under control (most likely state and community schools) as opposed to what seems to be a cry for unlimited education spending everywhere that will only accelerate ballooning costs.

We should commend the private efforts like Berea does. That is a much better model than putting the cost burden on everyone.

<comment><USER17> I think we can commend private efforts like Berea, but also hold the government accountable in its spending. Tax collection and government spending are two different things: mismanagement of tax revenue only related to tax collection in that the latter allows for the former in that there becomes something to mismanage. If we want to stop collection because of mismanagement, then the government shouldn't have bailed out the banks in 2008. If you don't want to pay for someone else's liberal arts degrees, then you petition ask the government to only sponsor scholarships and grants for careers that are in demand / the state or nation as a whole lacks.

</comment></comment></comment><comment><USER14> The wealthy today are continually looking for ways to destroy civilization and actively leave behind a worse legacy for humanity. At least in the US.

Pour billions into educational endowments, then on top of that charge students enough to make them indentured slaves for decades.

Pour money into hospitals, then manipulate the politics around the health insurance industry to ensure people are financially ruined when they get sick.

Where are the Carnegies, leaving behind libraries free to all, or parks open to everyone? Carnegie was an ass to his employees when he was building his fortune, but at least then he saw some obligation to leave something behind to improve society.

The powerful and wealthy today, as a whole, seem to have lost all interest in moving society forward.</comment>


Ask HN: Examples of well-designed highly-configurable user account UIs? - <AUTHOR> I am currently creating a notification aggregation service where users have a bunch of configuration options which determine which notifications they will receive. I am struggling to keep the UI clean and intuitive as I have to cram so much in.
Does anyone know any examples of highly-configurable user accounts in some website where the UI is still simple and intuitive? Free or paid, I can sub for a month to check them out. Thanks. <comment><USER2> \- Your Android/iOS phone.

\- Github account : [https://github.com/settings/profile](https://github.com/settings/profile)

\- Twitter : [https://twitter.com/settings/account](https://twitter.com/settings/account)

</comment><comment><USER3> By the way look at refactoring ui, they have a lot of tips for what to do about information overload when it comes to design</comment>


A Visual Defragmenter for the Commodore 64 - <AUTHOR> https://www.pagetable.com/?p=978 <comment><USER2> The best part is how this will make your disc _slower_ to use afterwards. The blocks are normally stored out of order, so that the time it takes to send the data to the computer is about the same as the time it takes for the next block to show up under the drive's read head.

<comment><USER3> Ah the times when disc interleaving was something you could tune and see the difference in speed gain. Least early PC's that was a factor and [https://en.wikipedia.org/wiki/SpinRite](https://en.wikipedia.org/wiki/SpinRite) was born and loved by all back then.

<comment><USER4> Reading that Wikipedia article... I'm surprised SpinRite is still around.

It is my understanding that modern magnetic media really hides what's going on at the platter level. This is not like the old days with MFM or RLL hard drives (before IDE). It is my understanding the modern disk controllers maintain their own mappings, and can in fact remap bad sectors on their own. I didn't think any of this information was available at the operating system level to the extent that it can be usefully modified outside the drive's own logic.

<comment><USER5> Modern drives do a bit of remapping, but still keep a near 1:1 mapping of physical to logical sectors.

It surprises me, because the drive has much more knowledge of typical access patterns combined with the hardware characteristics, so could easily do things like store two copies of some data so that whichever is closest to the read head can be read. I guess manufacturers just aren't interested in speed optimizations anymore now that SSD's exist.

</comment></comment></comment></comment><comment><USER6> Love the idea, and that it fits in 49 lines of BASIC.

But isn't this slowing things down by shoving all the data out toward track zero? I thought that for head movement efficiency and speed the ideal was to put everything as close to track 18 as possible.

</comment><comment><USER7> What surprised me is that Commodore 64 had really "fragmentable" filesystem

> Every file is stored as a linked list. Every block holds the track/sector > tuple of the next block in its first two bytes, followed by 254 data bytes.

On ZX Spectrum, TR-DOS, one of available disk OSes, didn't support file fragmentation at all: files occupied consecutive sectors, and new files could be written only to free space at the end of floppy. Once file is deleted, it continued to occupy space. Instead of defragmentation, there was "MOVE" command that packed files together by moving towards start of the disk to fill freed space.

[https://www.worldofspectrum.org/pub/sinclair/hardware- info/B...](https://www.worldofspectrum.org/pub/sinclair/hardware- info/Beta128DiskInterface_Manual.txt) (section 9.3)

(I don't know, however, how ZX Spectrum +3 filesystem works (another disk system for ZX Spectrum) ([http://www.worldofspectrum.org/ZXSpectrum128+3Manual/](http://www.worldofspectrum.org/ZXSpectrum128+3Manual/))

<comment><USER8> It surprised me too, especially as it means you now have a rather inconvenient 254 data bytes per sector.

(The BBC Micro's ordinary disc filing system also stored contiguous files. I'd always assumed that this would be pretty standard for 8-bit systems... it simplifies reading and writing of files, and reduces the amount of metadata that needs storing.)

<comment><USER9> CP/M, without a doubt the most popular OS for Z80 based systems with disk drives, and the main inspiration for MS-DOS, was an exception:

"Files in CP/M can be thought of as a sequence of up to 65536 records of 128 bytes each, numbered from 0 through 65535, thus allowing a maximum of 8 megabytes per file. Note, however, that although the records may be considered logically contiguous, they may not be physically contiguous in the disk data area. Internally, all files are divided into 16K byte segments called logical extents, so that counters are easily maintained as 8-bit values. The division into extents is discussed in the paragraphs that follow: however, they are not particularly significant for the programmer, because each extent is automatically accessed in both sequential and random access modes".

([http://www.gaby.de/cpm/manuals/archive/cpm22htm/ch5.htm](http://www.gaby.de/cpm/manuals/archive/cpm22htm/ch5.htm))

</comment></comment></comment><comment><USER10> The code is horrifying/georgeous/ingenious/insane [https://www.pagetable.com/docs/defrag1541/defrag1541_source....](https://www.pagetable.com/docs/defrag1541/defrag1541_source.png)

<comment><USER11> They are not using basic keyword abbreviations, so the code could be even worse than this listing.

</comment></comment><comment><USER12> This is actually better, coming 30-some years late. C64 == wine?

If I possibly can, I'm going to dust off ye olde 1541, plug it into the somewhat less dusty C64, boot it all, find a working "diskette" and see if I can't run this.

Why? For the sweet satisfaction.

</comment><comment><USER13> This is really reminiscent of an old PC program called COMPRESS, which was a defragmenter and not a compression utility, despite the name. Neat stuff.</comment>


Show HN: ip2unix – Turn IP sockets into Unix domain sockets - <AUTHOR> https://github.com/nixcloud/ip2unix <comment><USER2> This is very clever. Last time i ran benchmarks (several years ago), UNIX domain sockets were twice as fast as IP sockets so that's another reason to use them.

<comment><USER3> Isn't a TCP socket fastpathed on loopback ranges anyway?

<comment><AUTHOR> There was a patch[1] a few years ago, but apparently it didn't make it into mainline. At least looking in net/ipv4/tcp.c I haven't found any traces related to that.

However, I could have sworn that I've seen a similar patch in recent years, but either my memories are serving me wrong or I simply can't find it anymore.

Nevertheless, I didn't benchmark whether this is the case, nor was performance the main goal for writing ip2unix. So if performance is a concern, maybe benchmark with your specific workload?

[https://www.spinics.net/lists/netdev/msg210741.html](https://www.spinics.net/lists/netdev/msg210741.html)

<comment><USER3> Interesting. Thanks

</comment></comment></comment></comment><comment><USER4> I do not see an advantage over socat, which can listen on _TCP_-sockets (among 20 other "socket" inputs) and forward them into unix-sockets. Please tell me? :-/

<comment><AUTHOR> As others have mentioned, socat acts more like a router between different socket types/protocols but it doesn't change the behaviour of the program in question.

So for example if you have a service listening to TCP port 1234, you could do something like this:

socat UNIX-LISTEN:foo.sock TCP:localhost:1234

Now the service will _still_ listen to port 1234 and you now have _another_ socket that redirects to the other. This not only comes with a bit of overhead, but port 1234 is still reachable.

While using packet filtering on that port might lower the attack surface a bit, this won't prevent other (possibly compromised) services/users on the system to access port 1234.

Sure you could also filter based on uid, but IMHO it's better if that port isn't accessible in the first place.

</comment></comment><comment><USER5> Very nice!

// "LD_PRELOAD" should've been in the submission title to avoid the "socat" questions

<comment><AUTHOR> Thanks a lot for the suggestion. While I can't change the title here on HN, the README now mentions LD_PRELOAD in the first paragraph and I also added a small FAQ[1] section about socat.

[1]: [https://github.com/nixcloud/ip2unix/tree/d7d297ed68cdadc65dc...](https://github.com/nixcloud/ip2unix/tree/d7d297ed68cdadc65dc684ddccc0b32cc5f3b1cc#frequently- asked-questions)

</comment></comment><comment><USER6> This is really cool. I run a lot of different services on my home server and don't trust them to the internet. Everything is accessed via a reverse proxy with authentication that I trust.

While listening on localhost is some level of security it still means that lateral movement is possible if one of the services is compromised. It also means that if I give give someone else a user account or similarly run any less trusted code then they can access all of the services without authentication.

I'm going to look into this an apply this so that these services aren't accessible by other users.

</comment><comment><USER7> very interesting. A docker integration would be fun too (something like "docker run -p /tmp/socket:8080 ...") :)

<comment><AUTHOR> I'm not very familiar with Docker, but wouldn't something like "docker run some_image ip2unix -r /tmp/socket:8080 ..." work?

<comment><USER7> You could but it means: \- you need to add ip2unix in your images, which is not always convenient \- you still need to expose the socket outside the container (which is doable with volumes, but permissions can be a mess, especially if you use user namespaces)

</comment></comment></comment><comment><USER8> So how do I access a unix socket in my browser? Be nice if "unix://file/path.html" worked.

<comment><AUTHOR> You could map different ports to specific socket file names and use a dummy address, eg. like this:

ip2unix -r out,addr=127.1.1.1,path=foo-%p.sock firefox --new-instance

Whenever you then head over to something like [http://127.1.1.1:9000/](http://127.1.1.1:9000/), the browser will try to connect to foo-9000.sock.

</comment></comment><comment><USER9> Do any programs get confused when they call getsockname() and the result is an AF_UNIX they weren't expecting?

<comment><AUTHOR> If programs call getsockname() the result is _not_ a sockaddr_un, but instead sockaddr_in(6) is used from the original call to bind(). If the socket was implicitly bound, a random[1] address is generated.

Things are a bit trickier if it gets to getpeername(), since we want to have somewhat stable addresses. This is done by querying SO_PEERCRED and encoding[2] the pid for IPv4 or pid, uid and gid for IPv6 into the address.

In summary: Programs shouldn't get confused, but if they do, it's certainly a bug in ip2unix. Feel free to open an issue :-)

[1]: [https://github.com/nixcloud/ip2unix/blob/d7d297ed68cdadc65dc...](https://github.com/nixcloud/ip2unix/blob/d7d297ed68cdadc65dc684ddccc0b32cc5f3b1cc/src/sockaddr.cc#L133-L152)

[2]: [https://github.com/nixcloud/ip2unix/blob/d7d297ed68cdadc65dc...](https://github.com/nixcloud/ip2unix/blob/d7d297ed68cdadc65dc684ddccc0b32cc5f3b1cc/src/sockaddr.cc#L110-L131)

</comment></comment><comment><USER10> This is kinda awesome... Only request is a ptrace version, that will work on all binaries.

<comment><AUTHOR> [https://github.com/nixcloud/ip2unix/commit/00dddf228a70ad230...](https://github.com/nixcloud/ip2unix/commit/00dddf228a70ad2309879eef202698ed33a6e1b6)

That's what I had in mind someday™. Unfortunately, this has to wait for version 4.x maybe :-/

</comment></comment><comment><USER11> Now that's cool. Functional and simple to use.

</comment><comment><USER12> is there a benefit over socat?

<comment><USER13> It is faster because socat creates additional copies/context switches when forwarding data. This tool changes the bind syscall so it becomes a unix socket in the first place.</comment></comment>


Show HN: A live stream of Hacker News comments without context - <AUTHOR> https://cdn.rawgit.com/shstkvch/HN-Firehose/6016374dc79a748f13587bddc65690c04d8b3350/index.html <comment><AUTHOR> HN's comments section is filled with arcane information, strange links and great insights (and sometimes really weird stuff.) Often the comments are more interesting than the links they're in response to.

I knocked this little page up tonight to try and add a bit of randomness to my HN experience, to see comments I might not normally see. I thought I'd share in case anyone else feels the same way!

Built using the HN Firebase API: [https://github.com/HackerNews/API](https://github.com/HackerNews/API)</comment>