The Nuclear Power Plant of the Future May Be Floating Near Russia - <AUTHOR> https://www.nytimes.com/2018/08/26/business/energy-environment/russia-floating-nuclear-power.html <comment><USER2> I took a broader look at Russia's nuclear power program here - [https://www.economist.com/europe/2018/08/02/the-world- relies...](https://www.economist.com/europe/2018/08/02/the-world-relies-on- russia-to-build-its-nuclear-power-plants)

<comment><USER3> I particularly enjoyed the Atoms For Peace subtitle, the name of one of Thom Yorke's side projects.

<comment><USER4> it's a reference to Eisenhower's famous 1953 speech

</comment></comment></comment><comment><USER5> _Russia is conducting an experiment with nuclear power, one that backers say is a leading-edge feat of engineering but that critics call reckless.

The country is unveiling a floating nuclear power plant._

Um, "unveiling" ??

We've have floating nuclear power in submarines, aircraft carriers, maybe other vessels for half a century.

<comment><USER6> Yes, the article notes that, _" The United States used a barge-based reactor to generate electricity for the Panama Canal Zone from 1968 until 1976, and Westinghouse, the American reactor builder, planned — but never built — two floating plants off the New Jersey coast at around that time"_

1968! The interesting story is why the NYT's is running this and running with it now [not trying to be tin-hat, maybe it was just a slow news day, but you can find links posted on HN going back almost 5 years about this project]

<comment><USER7> I dream of a time when there is a slow news day so they publish less content. Also dream of a day when you turn on a new station and breaking news is in fact breaking news.

<comment><USER8> When I lived in Norway, this was pretty much the norm. They would publish gossip about celebrities and politicians all day instead.

</comment></comment></comment></comment><comment><USER9> It's a good idea. Afaik, naval nuclear power has a pretty good track record.

Who knows if that will continue for commercial power generation?

But at least it solves the stupid "perpetual one-off design" space nuclear power seems to have been stuck in. (Although I believe I read that at least France standardized all their reactor buildings?)

<comment><USER10> American naval nuclear power has an excellent record. Russian, not so much. Skimming this list, I'm inclined to use the word "horrendous": [http://spb.org.ru/bellona/ehome/russia/nfl/nfl8.htm#O5](http://spb.org.ru/bellona/ehome/russia/nfl/nfl8.htm#O5)

</comment></comment><comment><USER11> Why not go one step further and make it fully submerged off the coast, to protect it from a bad weather?

<comment><USER12> From the article:

> A French company has designed a reactor called Flexblue that would not float > but rather be submerged on the ocean floor.

<comment><USER11> Thanks, missed that part somehow.

</comment></comment></comment><comment><USER13> During a power crisis caused by a high tension cable breakdown Auckland depended on ship borne power. I'm pretty sure it was GE gas turbines. There is a well understood model for mobile power, I don't see why this model can't work and guy lots of use cases. Nuclear why not?

The loss of competence in nuclear engineering worldwide worries me. Do we need to start sending engineering grads to Brazil? Britain outsourced it's coming plants to China didn't it?

</comment><comment><USER14> That's a lot of ship, plant, and staff for just 70MW. The Ford class of aircraft carriers generates about 700MW.

<comment><USER15> It's 2 x 70 MWe or about 300 MWt. A4W reactors on Nimitz class aircraft carriers produce about 2 x 550 MWt which translates to about 100 MWe and 2 x 104 MW shaft power for propulsion.

[https://en.wikipedia.org/wiki/Akademik_Lomonosov](https://en.wikipedia.org/wiki/Akademik_Lomonosov)

[https://en.wikipedia.org/wiki/A4W_reactor](https://en.wikipedia.org/wiki/A4W_reactor)

</comment></comment><comment><USER16> Its worth mentioning that new turbines for generating electricity are in development with higher output compared to the steam powered turbines. This will basically increase the electrical output of the nuclear plant with the same amount of fuel which will make NPPs even more viable in the future

</comment><comment><USER17> The nuclear power plant of the future can be found in a science museum. All dangers of a catastrophic accident aside, nuclear energy has become economically infeasible. Just recently, half-build powerplants have been abandoned in the US for pure financial reasons, and the other projects under constructions face severe cost problems too. And this is not counting for the still unsolved problem of disposing the nuclear waste. Meanwhile, solar and wind have become much cheaper than nuclear, and counting in the construction costs for new clean plants, even coal.

The idea of putting a nuclear power plant on a float is faszinating. It solves cooling, allows relocation of the power plant and in the case of disaster, it can be dumped into the ocean, which is somewhat better than contaminating occupied land, but still isn't acceptable.

Unless there is some significant breakthrough in operating costs and safety as well as a solution for the nuclear waste, nuclear isn't the future.

<comment><USER18> > unsolved problem of disposing the nuclear waste

I'm not sure what you mean by unsolved disposal. Nuclear waste from power plants is stored in secure facilities. It takes up a manageable amount of space, is low maintanance and isn't dangerous. Furthermore, future reactors will be able to reuse it; the current reactors only use up a small fraction of the fuel. So actually, you wouldn't even want to throw it away.

Also, nuclear fuel is advantageous logistically. A typical plant needs 1 train-load of fuel a year. That's a relatively small freight, you can ship that from anywhere around the world. On the other hand, for carbon-fuel powerplants, you need a train load of fuel per day.

I'd love to see the planet off non-renewable-fuels, but a big hurdle is that, unless we figure out storage, the renewable energy sources have to be supplemented with something for when it's night and there's no wind. I don't see a better option for that something than nuclear. Of course, an alternative would be for society to switch to an energy usage scheme that doesn't presume that power is uninterruptable. However, that would require profound changes to our everyday lives, and I don't think we're quite mature enough as a species to go through with something like that at scale.

<comment><USER17> What do you mean by "secure facilities"? Yes, currently the nuclear waste is in intermediate storage facilities. Which are buildings, with an useful life time of 50 years. Unless a nuclear technology for reusing or processing the waste appears, we are talking about safe storage for thousands of years.

<comment><USER19> I don't think nuclear waste is as big a problem as you might think it is: [https://what-if.xkcd.com/29/](https://what-if.xkcd.com/29/)

And on a side note, are solar and aeolic scalable enough to support (let's say) the entire US ?

How much of the country would physically need to be covered for that? Cause I've seen claims that it's just impossible

<comment><USER17> Nuclear waste won't kill anyone, as long as it is contained in the storage containers. We just don't have found a way to keep it guaranteed safe for centuries.

Solar alone could easily power the country. Covering large parts of Arizona would produce enough energy to power the whole world. Powering the US, especially distributing it across the states, makes that an easy job. And of course, there is wind. Probably it would be enough to cover all rooftops to power any state.

On Sunny days, Germany can power 30% of the grid by solar only, and that is in a country which is less suitable for solar than any place in the US except Oregon.

</comment></comment></comment></comment></comment><comment><USER20> >given the seeming importance of sobriety on such a vessel, have a drink at the bar.

if the journalists ever mentioned the "importance of sobriety on such a vessel" in the presence of the crew, i'm pretty sure it immediately became the next, right after "Za mirnyy atom!", popular drinking toast on that ship. "Nu! za osobuyu vazhnost trezvosti na yadernom reaktore." Amen.

These floating reactors aren't the future - you just don't want a potential Chernobyl delivered right to your city (just lookup the safety record of Russian nuclear submarines what these peaceful reactors are built after). These ships are a classic Russian solution (cheap, low tech simple/crude, without long-term thinking) to the typical Russian issue of lack of infrastructure at the time when climate change encourages and political situation pushes Russia to increase development in the North-East regions.

</comment><comment><USER21> There isn't a country on earth that would actually allow Russia to park an actual nuclear bomb off their coast. Even the ones aligned with Russia. Oh, how do you build a sarcophagus on a sunk nuclear reactor?

<comment><USER22> Uhm, you don't, because water is absolutely fantastic at blocking radiation - just several meters of it would block literally all radiation from a reactor gone critical. Not to mention that nuclear reactors are not bombs, not any more than coal fired power plant boilers are bombs.

<comment><USER15> It doesn't prevent radioactive elements leaking into the water though.

</comment></comment></comment><comment><USER23> > "Rosatom plans to serially produce such floating nuclear plants, and is > exploring various business plans, including retaining ownership of the > reactors while selling the electricity they generate."

No sane govt will allow a foreign power to literally be able to shutdown one of their cities on a whim.

I think what the Russian Govt realized is that instead of building nuclear power plants, its going to be more profitable to hold the electric grid of some country hostage, just like the hard profit they make holding Europe hostage with their gas pipelines.

EDIT:

There a lot more issues I have with their idea but that was the one most striking to me.

\- How are going to supply electricity during a hurricane ? Most cites are located on the path to some hurricane / cyclone / tornado.

\- Coastlines near cities are expensive real estate (not to mention anyone with property there allowing a literal power nuclear plant blocking their view ) - it takes important real estate from ports that are much more useful for docking ships, etc. Its possible to build a separate port far away from the city; but then you have to pay the extra cost of building some extra infrastructure to deal with the ship, at that point its just easier to build your own power plant.

\- "Rosatom, in a statement, insisted its plant was 'invulnerable to tsunamis.'"

Really ?? why are they trying to sell dumb electricity when they have the much more valuable technology of invincible ships. How many tsunamis has one of their ships survived exactly ?

<comment><USER24> Well the Australian government(s) aren't sane then. We've been privatizing our power plants for decades, and iirc some owned by Government owned Chinese enterprises.

EDIT: For what it's worth. I don't have a problem with foreign ownership of the powerplants. But I do have a problem with privatization in a market without much competition.

<comment><USER23> ownership is different from actually having ops capabilities,

I do not think there is a button somewhere is Beijing that China can use to just turn off Australian power plant on Australian soil.

The most China can do to sell the asset and temporary depress its price.

<comment><USER25> The Australian market is routinely manipulated by pretending to turn off equipment until the price rises sufficiently to pretend to turn the equipment on just in time for the high price market.

So yes, there is "a button somewhere" that a private owner can use to just turn off Australian power plants on Australian soil.

<comment><USER26> That's interesting, the US has an almost entirely privatized energy generation market and doesn't routinely have that problem.

I've read a bit about Australia's energy problems over the years, I'm unaware of how they regulate pricing though. The US has very strict rules in place for its private utilities.

Private + tight controls has resulted in the US having close to the cheapest power in the developed world. Roughly 1/3 the cost of Germany's or Australia's electricity. Privatization doesn't explain Australia's numerous disastrous energy choices and policies.

<comment><USER27> Incorrect.

"Tapes Show Enron Arranged Plant Shutdown"

 _In the midst of the California energy troubles in early 2001, when power plants were under a federal order to deliver a full output of electricity, the Enron Corporation arranged to take a plant off-line on the same day that California was hit by rolling blackouts, according to audiotapes of company traders released here on Thursday._

 _The tapes and memorandums were made public by a small public utility north of Seattle that is fighting Enron over a power contract. They also showed that Enron, as early as 1998, was creating artificial energy shortages and running up prices in Canada in advance of California 's larger experiment with deregulation...._

[https://outline.com/f2N42r](https://outline.com/f2N42r) (nytimes)

Also:

Enron defrauded California out of billions during energy ...

[https://www.wsws.org/en/articles/2002/05/enro-m10.html](https://www.wsws.org/en/articles/2002/05/enro-m10.html)

[https://en.wikipedia.org/wiki/California_electricity_crisis](https://en.wikipedia.org/wiki/California_electricity_crisis)

</comment></comment></comment></comment></comment></comment><comment><USER28> Clever way to distribute nuclear weapons capabilities?

<comment><USER29> No. Reactors don't fail or explode anything like atomic bombs. The only way this could house a nuclear weapon is by having a hidden missile silo somewhere in it and they already have nuclear missile subs for discreetly placing nuclear weapons close to their target.

<comment><USER30> An atomic bomb is not the only form a nuclear weapon. Reactor fuel (or related contaminated material) can be used to create a dirty bomb, which in some ways is more destructive. Not in the initial blast, but in rendering the contaminated area uninhabitable for decades or centuries.

<comment><USER31> Aren't dirty bombs considered a Hollywood trope, and not a weapon of any actual utility (except scaring people with the thought of it)? See e.g. [https://en.m.wikipedia.org/wiki/Dirty_bomb](https://en.m.wikipedia.org/wiki/Dirty_bomb).

<comment><USER32> dirty bombs can function as a denial of access ordinance... when isotopes or persistent toxin are scattered spattered over an area the cleanup is prohibitively expensive , we than have a kiev/chornobl scenario...were this to happen on wall street or silicon valley, it would be a major setback, or we would have to requantify the acceptable titre of radionucliides in a "occupiable" region

<comment><USER33> When you have 2000 nukes you don't need dirty bombs for area denial the only ones who would be interested in dirty bombs would be non-state actors and those can't build one and the few non-state actors that could are most part not stupid enough to build one because they actually want to keep what ever little regional power they have.

Also reactor fuel is a terrible material for a dirty bomb because of its long half life time, you need materials which are much more active than that to be effective like those used in radioactive medicine and sensors those isotopes and are much more controlled than processed nuclear fuel and for a good reason.

</comment></comment></comment></comment></comment></comment><comment><USER34> Things like "nuclear" and "floating near Russia" don't inspire confidence.

</comment><comment><USER35> Can't believe somewhere in the world, someone is still harnessing nukes

<comment><USER12> John McCarthy has an interesting website over nuclear energy [0]. I can't vouch for how actually true it is, but it seems reasonably well argued. This was his comment over nuclear waste:

> Q. What about nuclear waste?

> A. The waste consists of the fission products. They are highly radioactive > at first, but the most radioactive isotopes decay the fastest. (That's what > being most radioactive amounts to). About one cubic meter of waste per year > is generated by a power plant. It needs to be kept away from people. After > 10 years, the fission products are 1,000 times less radioactive, and after > 500 years, the fission products will be less radioactive than the uranium > ore they are originally derived from. The cubic meter estimate assumes > reprocessing, unfortunately not being done in the U.S.

I'd always assumed 25,000 years for it to return to normal levels.

[0]: [http://www-formal.stanford.edu/jmc/progress/nuclear- faq.html](http://www-formal.stanford.edu/jmc/progress/nuclear-faq.html)

<comment><USER36> I'm very pro-nuclear, we almost certainly need it while we improve renewables. However, 25,000 years or 500 years... it's pretty much the same problem for us as a species. 500 years is significantly longer than the US has been a country, and represents a period of time measured in many many generations. 500 years of storage is a _hard_ problem, and from the perspective of us, our kids, their kids, and their kids and a dozen generations after it might as well be a thousand, ten thousand, or 25,000 years. 500 years is longer than any of us will be alive and far longer than we can hope to predict the course of society and technology.

<comment><USER12> I agree, it's a bit ridiculous talking in these terms. Primarily I just want to have my facts reasonably straight if I'm going to have a debate.

Shakespeare was born approximately 500 years ago, Cambridge University was founded 800 years ago where as 25,000 years ago was in the depths of the last ice age (11,000) and Wooly mammoths still existed (4,000). I can visualise the first couple in my head, not the last two.

Given the fairly drastic things that are happening to the great barrier reef (50% loss in 2 years and it's about 6-8,000 years old [0]) I question more and more, how much of a risk nuclear is worth taking until solar and wind can take over.

> 500 years of storage is a hard problem, and from the perspective of us, our > kids, their kids, and their kids and a dozen generations after

I agree, we're passing on another problem, but it is a solvable problem. Humans are capable of building structures that stay intact for more than 500 years. With climate change, there's so many factors involved we've no real idea if it is even solvable.

[0]: [https://en.wikipedia.org/wiki/Great_Barrier_Reef#Geology_and...](https://en.wikipedia.org/wiki/Great_Barrier_Reef#Geology_and_geography)

<comment><USER36> I couldn't agree more, and moreover the odds of us giving the future something other than our waste probably depends to some extent on embracing nuclear power. If not, what we're going to pass on might be light on radioactivity, but heavy on a ruined climate and mass extinctions. I grant that in a perfect world we wouldn't burn coal or use nuclear power, but in this most imperfect world we need to stop using fossil fuels and ramp up nuclear to ease us into renewables over the next century.

</comment></comment></comment></comment></comment><comment><USER37> I am starting to get sick of environmentalists complaining, doing nothing to solve the issues their so "passionate" about, and then harassing / criticising any solution that gets proposed.

</comment><comment><USER38> > Inside, the floating reactor is a warren of tight corridors, steep > staircases, pipes, wires and warning signs in Cyrillic letters.

What? So Russians would have warning signs in English?

Indeed, the article overall sounds like anti-Russia propaganda. What's going on with the NY Times about Russia and China? Just grasping for clickbait?

<comment><USER39> Cyrillic is the writing system Russian uses, English is one of the many using the Latin system.

I'm not seeing an anti-Russian slant here. The criticism is tame for an article on nuclear power, and they'd likely have the same concerns if this was a US project.

<comment><USER38> OK, I wasn't clear enough. The language is darkly evocative, of sloppiness and danger. I mean, "warren of tight corridors". And "steep staircases", which are very typical for ships, by the way. And "pipes, wires", which again is pretty typical, even for your average trendy restaurant. And "Cyrillic letters"? I'm not sure what to make of that. It rather states the obvious.

<comment><USER40> >I'm not sure what to make of that

They're just trying to paint a picture for the reader.

<comment><USER38> That, we agree about.</comment></comment></comment></comment></comment>


A Rocket to Nowhere - <AUTHOR> http://www.idlewords.com/2005/08/a_rocket_to_nowhere.htm

<comment><USER2> and me thinking he was talking about that rocket docker thing</comment>


ARC Gotcha – Unexpectedly Short Lifetimes - <AUTHOR> http://weblog.bignerdranch.com/?p=296

<comment><USER2> >What could be releasing objects automatically? ARC – that's its job. From ARC's point of view, the UIColor created with -colorWithRed:... was used to access the CGColor, and then is no longer needed.

So why not use the following? (My ObjC is very rusty)

[[self.view layer] setBackgroundColor: [UIColor colorWithRed: 0.2 green: 0.3 blue: 0.4 alpha: 1.0].CGColor ]</comment>


The birth of AJAX – an amazing story - <AUTHOR> http://techtracer.com/2007/03/12/the-birth-of-ajax-an-amazing-story/

<comment><USER2> Crappy revisionist article, XMLHttpRequest was in Mozilla since at least 2000 (see <https://bugzilla.mozilla.org/show_bug.cgi?id=22942> ).. the notion that nobody used it until Gmail in 2004 is just dumb.

Perhaps Gmail was the first polished & popular example, but the techniques the AJAX retronym refers to were already in widespread use by then.

</comment><comment><USER3> Horribly written.</comment>


Left: Distractionless Plaintext Editor - <AUTHOR> https://100r.co/site/left.html <comment><AUTHOR> Since it's not linked on the page, here's the repo: [https://github.com/hundredrabbits/Left](https://github.com/hundredrabbits/Left)</comment>


Show HN: React Milkshake, a complete ReactJS boilerplate with authentication - <AUTHOR> https://www.reactmilkshake.com/ <comment><USER2> Without any code samples there is too much left answered for a 29.00 template.

</comment><comment><USER3> Can it be used for open source projects?

Also sample project would be nice where one can inspect generated code.

</comment><comment><USER4> How about SSR, and how routing is setup?</comment>


Ask HN: Is ok if I have a few subscribers in the waitlist but a 29% week growth? - <AUTHOR>

Hi everyone!
Three weeks ago I put online a landing page for my app and start looking for early traction, I'm testing different traction channels to see which one performs better, organically.
Right now I have 58 subscribers in the waitlist, it isn't much but it started with 31 subscribers on the first week, the next week it growth at 29% and the week after that it growth 45%.
Is this ok or do I have a problem?, How could I get better results? <comment><USER2> There are so many factors in play here, it is hard to answer your question.

What are you expecting, what are your goals? Paid or free app? Who signed up for the list. Are they targeted? What % of them do you think will download? Do you have other ways to get people to download your app instead of the waiting list? What are you doing to build a relationship with the list to entice them to download. Is the app any good? Is it exciting? Does it solve a new problem? Do you need a wait list at all?

As a quick answer I suggest forget about the wait list and make your app awesome! Then drive people to download the app, not join the list.

Build a list once you have the app, to remind people how great/useful it is with helpful articles etc. So they keep using it.

P.S. the percentages you mention are meaningless on such small numbers. Forget about % growth until you have a few 1000 in the list.

<comment><AUTHOR> Wow, Your answer made me question a lot of things and I realized others. Thanks!

</comment></comment><comment><USER3> It depends on the app...if it is a game for teens, a dating app, or a social network you need much bigger numbers. If it is a financial planning app for billionaires under 30, you have the whole market already on your waiting list.

<comment><AUTHOR> It's this app [http://sellow.me](http://sellow.me) so, what you think?

<comment><USER4> Where did you post the link such that you were getting people to sign up on your landing page?

<comment><AUTHOR> I post it here, reddit, quora and warriorforum.

<comment><USER3> You should try betali.st as well

<comment><AUTHOR> Yes, I submit a few weeks ago the site, is pending to approval. I think I should pay for the approval and see how things go.

<comment><USER3> I paid to expedite ($79 or so) and it was worth it. Also did startuplister for $25 and got a total of 450 sign ups for MorphMail.

<comment><AUTHOR> Thanks for sharing this information , it looks that sites like Betalist are the best choice for my app right now.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Looks a lot like [https://offerupnow.com/](https://offerupnow.com/)

<comment><AUTHOR> It doesn't, we do things very different.

<comment><USER5> On a quick once over it did for me anyway ;). I'll have to take a closer look later. Goodluck regardless and hope you didn't take offense to that.

<comment><AUTHOR> No offense at all :)

</comment></comment></comment></comment><comment><USER6> byoung2 makes an important point about the product and therefore the market.

My additional question is how long you can sustain your growth - ie, will you keep growing at 29% or just keep adding 20 new people per week. One is good traction, the other incremental.

<comment><AUTHOR> Right now I'm focus on getting organic growth our analytics show us that the landing isn't converting well and the feedback from visitors indicate us that our message is neither clear nor persuasive. Whit this indicators we are now working on some changes that could get as a result, a higher conversion on the landing. That, I think is the first of our problem, then wi'll focus again in the strategy to keep growing.</comment></comment>


The Modern Java Ecosystem (for the Sinatra or web.py lover) - <AUTHOR> http://arantaday.com/the-modern-java-ecosystem

<comment><USER2> I'd like to add a few things here.

Jersey is an implementation of JAX-RS. It has 3 major pieces: jersey-core, jersey-client, jersey-server. (The name should be obvious what they are for).

If you're writing JAX-RS services, you can return a few different formats: XML, JSON, ATOM. All you need to do is to annotate the method with the following annotation:

      // will return XML or JSON depending on the request from the client.

      @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })

This is a big win if you need to support both.

      - Object to XML conversion is done by JAXB.
      - Object to JSON conversion is done by Jackson via JAXB.

Jersey is part of JavaEE 6 standard (part of your Application Server if it supports it).

What's lacking from JavaEE 6 is an MVC framework which is targeted for JavaEE 7.

Another key feature is JAX-WS (the plain old SOAP WebService). The nice thing about JavaEE 6 is that the minimum differences in the programming style between JAX-RS and JAX-WS.

JAX-RS operates according to resources (e.g.: give me all students, give me student with id=1, delete student with id=1, etc). So some of the examples would be:

      // Rough pseudo-code, omitting a few JAX-RS annotation

      public class StudentResource{

      @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })

      public <List> all(){}

      @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })

      public Student get(long id){}
      }

JAX-WS operates according to services (e.g.: initiateInvoiceWorkflow, performPayment, etc).

      public interface AccountingService{

        @WebMethod(operationName="initiateInvoiceWorkflow" ...)

        Invoice initiateInvoiceWorkFlow();

      }

      // have your implementation...

So in theory, you can have something that's called StudentRepository where you can use that repository with both JAX-RS (REST) and JAX-WS (WebService) implementation easily (I've done this and it's quite straightforward) if your "Enterprise client" forces you to do so.

The important bit here is testing. You can easily test both JAX-RS and JAX-WS implementation in both unit-test or integration-test. You can easily do unit- test because you don't need to deploy them to the server: they're just normal Java classes. You can do integration test by deploying them to the server and generates the client implementation (in which I'll cover next).

The client-side implementation of JAX-RS is also similar to that of JAX-WS programming style.

In JAX-WS, you grab a WSDL, throw it to a generator tool that comes with JDK to generate the model (Invoice, Student, etc) and the proxy client-side to call the server-side. Very very straightforward, 5 minute job.

In JAX-RS, you'd use jersey-client to perform HTTP call as follow:

      // url  => is a string that points to JAX-RS end-point e.g.: student/1
      // header => json? xml? atom?
      // type => (typeof Student) (well... it's Java).
      Student student = Client.create().resource(url).accept(header).get(type);

Keep in mind that in the client-side, your Student class must have roughly the same structure and must be annotated using JAXB XML annotation (the client- side also relies on JAXB -> Jackson -> Java object conversion for the case of JSON, or just JAXB -> JAva object for the case of XML).

So no hacking using XPath or something like that (I work in Ruby once in a while and when I read some of the 3rd-party libraries/gems that implement client-side API against popular service provider, most of the implementations do brute force using XPath querying node element and stuff).

PS: Excuse me for the poor formatting, where can I learn to format my comment?

UPDATE: fix the format.

Oh and one more thing: JAX-RS (Jersey) is just an implementation on top of Servlet. So all of your previous knowledge regarding to Servlet (Context, deployment, URL, Filter) will be definitely useful.

<comment><AUTHOR> Thanks for the clarification and expansion! I was worried about dumping too many details on people while trying to convince them that Java can be easy too ;-)

But you're absolutely right on most of these points.

All the formatting tricks are here: <http://news.ycombinator.com/formatdoc>

<comment><USER3> Loved the original article and the expansion in this post made it even better. Would you guys recommend any good books that cover JEE6 web services thoroughly? I'm an experienced java guy but have not dealt much with web services.

<comment><USER2> None. I usually rely on the source code + javadocs. I might be biased but I find that most Java source code and documentations tend to be easier to read due to common practices employed by newer projects.

I can only give you pointers to JavaEE 6 books (overall).

Beginning GF3 is an OK introduction to JavaEE 6: [http://www.amazon.com/Beginning-GlassFish-Experts-Voice- Tech...](http://www.amazon.com/Beginning-GlassFish-Experts-Voice- Technology/dp/143022889X/ref=sr_1_2?ie=UTF8&qid=1322951777&sr=8-2)

Oracle Tutorial (formerly SUN tutorial) for JavaEE 6 is another OK one (reviews were meh, but you've got limited choice so...) <http://docs.oracle.com/javaee/6/tutorial/doc/>

I saw Amazon has the print edition and another one to be in stock by mid 2012 (Advanced Java EE 6...)

Here's another book covering Java EE6 (intro):

[http://www.amazon.com/Java-EE-GlassFish-Application- Server/d...](http://www.amazon.com/Java-EE-GlassFish-Application- Server/dp/1849510369/ref=sr_1_6?ie=UTF8&qid=1322951777&sr=8-6)

Seems to cover Servlet more than Apress book (first book).

You probably would need to know JPA 2.0 (ORM) as well.

And some more "best practices/real world-ish" tutorials:

[http://www.amazon.com/World-Night-Hacks-Dissecting- Business/...](http://www.amazon.com/World-Night-Hacks-Dissecting- Business/dp/1447672313/ref=pd_sim_b_4)

Good luck.

[http://www.amazon.com/Pro-JPA-Mastering-Persistence- Technolo...](http://www.amazon.com/Pro-JPA-Mastering-Persistence- Technology/dp/1430219564/ref=sr_1_1?s=books&ie=UTF8&qid=1322952208&sr=1-1)

</comment></comment></comment></comment><comment><USER4> For those looking for something more like Sinatra in Java, check out webbit: <https://github.com/joewalnes/webbit>

Here's an example of a simple Websocket chat server: <https://gist.github.com/1421652>

_Disclaimer: It's an open source project that I have some commits to_

<comment><USER5> Webbit looks much more like embedded Jetty and plain servlets than Sinatra. If you really want something like Sinatra in you Java project, wire in Scala and try Scalatra.

</comment></comment><comment> andrewl-hn We use JAX-RS as a primary web framework in our current project and honestly I can't get happier! We use Guava for low-level basic stuff and Google GSON for JSON serialization. It seems to be on par with Jackson from ease-of-use point of view:

MyType myVar = gson.fromJson(jsonString);

JPA on a back, some basic IoC in the middle (nothing fancy). Mockito and jUnit for tests.

All in all it's just a bunch of small layered classes with some bits of annotations and no xml. Well, one web.xml file with single servlet declaration for JAX-RS :)

With good IDE (they all are great this days), Maven for dependencies, well- known practices and modern APIs Java isn't that scary or cumbersome anymore. It's just a nice small language. A bit verbose without closures and type inference but still Ok.

I should note, though, that we generally use our Java layer as a service provider. We keep main bits of logic on a client side in JavaScript and call Java either for transactions and data, or in cases when something is hard to do on a client. It's just easier that way.

<comment><USER2> Be careful with GSON. It by-passes your getter and setter.

That alone creates a bit of mismatch because JAXB (which is used by JAX-RS) uses getter/setter by default unless you specified it otherwise.

And sometime you do have some logic in your getter/setter for validation or other purposes.

I got bitten by this before while it seems like a small thing it's actually a bit problematic.

If you're using JPA2, take a look at Spring-Data (formerly Hades). Spring-Data helps you to reduce JPA boilerplate code.

The way Spring-Data works is by using a convention: specify your NamedQuery and a Java interface with method name == NamedQuery name. Then magic suddenly happens.

</comment></comment><comment><USER6> I'm not a big fan of the heavy use of annotations. When an annotation does something other than what I expected it becomes a pain in the butt to figure out why. Also, back in the day, jersey and guice didn't get along because their use of annotations on the same methods conflicted because they both wanted to drive the bus so to speak.

This has been resolved, but it left a bad taste in my mouth because there isn't a good solution other than waiting for them to fix it.

<comment><USER7> Annotations are a huge and important part of Java.

<comment><USER6> and I pointed out the headaches they caused me. I'm not really sure what point you are trying to make.

<comment><USER7> Conflicts in any piece of software are a pain in the butt. That is part of software development though.

You say you aren't a big fan of 'heavy use of annotations' but you don't qualify what 'heavy' is so I am guessing that it is pretty much all annotations.

How do you make your determination of what annotations are 'ok' and what annotations aren't? Or do you say something like 'oh, I won't use that annotation because it might blow up on me at some later date'? What is your mental process there? Is @GET good or is @POST bad? What about @Inject or @JsonProperty?

The 'annotations leave a bad taste in my mouth' statement seems kind of odd to me. Generally, a language feature isn't something that I'm careful about avoiding. I could see making a statement like "I tried to use software product XYZ and it was so full of bugs that I switched to software product ABC."

But annotations aren't a software product, they are a language feature that products can take advantage of. It just happens to be that two products you were using had conflicting annotations. No big deal, you still have choices as you can just swap out products. That in itself doesn't make the functionality that annotations provide taste bad.

I've met people who have had this view of annotations as being some magical creature. They didn't understand them or how they worked at all. They stuck it in their heads that 'annotations are bad', so we aren't going to use them and aren't going to even bother learning how they might help us. Everything was very black and white. I found this behavior really odd because everything in software development is grey.

<comment><USER6> "You say you aren't a big fan of 'heavy use of annotations' but you don't qualify what 'heavy' is so I am guessing that it is pretty much all annotations."

The problem is that guice is using these annotations to wire things together, but so was jax-rs. It's been over a year so I don't remember the exact problem I was having, but the short version is that annotations don't compose well and when two different frameworks require you to place annotations on the same class/method, and then they conflict with one another, it because very hard to fix.

This aligns with my feelings: [http://www.nofluffjuststuff.com/blog/brian_gilstrap/2010/02/...](http://www.nofluffjuststuff.com/blog/brian_gilstrap/2010/02/java_annotations_have_become_pixie_dust)

<comment><USER7> That is a great blog posting.

However, I don't know why the author would even suggest that annotations are innocent looking. They aren't any more 'innocent' than an if statement. Something like: 'if (myMethod())' could easily be a long running database query or call out to a fibonacci solver. Should we all be afraid of using if statements too?

I'm sorry, but there is really nothing 'magical' about annotations. It is simply a marker on a class, property or method that other code can read from and do things with. Prior to annotations, apps were processing Javadoc (@see early versions of GWT), which was an even more terrible idea since you didn't know if it was Javadoc or an annotation.

The summary is that a) software engineering is not easy and it does involve knowing what you are doing in order for things to not appear 'magical'. b) If you are going to put an annotation on something, then you should know what code is going to read that annotation and what effects it might have. That said, that isn't the fault of the annotation language feature.

<comment><USER6> My argument is that annotations don't compose well, interact in complex ways that are hard to reason about and debug, and that this is worse than non annotation based methods used in other languages.

Your response seems to be that one needs to understand the complex interactions of annotations before using them, therefore annotations are fine.

That's a non sequitur.

<comment><USER7> I disagree with your argument. To you, they are all of those things. To me, they are great and none of those things. That is all I'm saying.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> For web, Play Framework and Japid template are very good.

For distributed clustering, Hazelcast is amazingly good.

For massively scalable network services, Netty does a fantastic job.

<comment><USER7> I'd never heard of Japid before. Thanks for pointing it out.

That said, using a backtick character like that seems like a really error prone approach. Definitely not my cup of tea.

<comment><USER8> That's what I thought as well when I first saw the backtick, but after using it for a while I found it to be perfect.

It's rarely used in any other context (besides Lisp). It's really unobtrude, making the rest of the code standing out. It's at an easy to remember place at the keyboard. The parser is good enough to catch any quote or backquote mistakes. It's really an non-issue and you forget about it after a while.

A sample,

        <ul>
        `    for (a : list)
                 <li>$a
        `
        </ul>

</comment></comment></comment><comment><USER9> This is very cool. I am tied to Java b/c of Lucene and the Hadoop ecosystem as well. Some more things I would like to see:

-Templating. Something like SimpleTemplate Engine in Bottlepy. <http://bottlepy.org/docs/dev/stpl.html>

-How do I get rid of Tomcat at least for development. I would like to run java -jar MyApp.jar -Dport=8080 and get a live running webapp in my dev environment.

<comment><USER10> You can do "java -jar MyApp.jar -Dport=8080" with both Tomcat and Jetty using what they call "embedded mode". I like the Jetty embedded mode much more because it starts up so much faster. The Tomcat embedded mode does have the benefit of an easier to understand API, but it's not worth the speed trade-off for me.

Here's examples of both:

<http://www.benmccann.com/dev-blog/embedded-jetty/>

<http://www.benmccann.com/dev-blog/embedded-tomcat/>

I put together an example and uploaded it to GitHub. I'd love feedback on it:

<https://github.com/benmccann/sprightly>

P.S. Closure templates are cool because they can be used both client-side and server-side. I'm not aware of other templating languages that have this feature. I haven't used it much yet, but want to experiment with it more when I get time.

<comment><USER11> The list of technologies is really intimidating for outsiders. Its not like "Oh, XYZ, thats just Django templating language". When I see Struts and Hibernate, I know those things as gigantic opaque stuff that will take a long time to learn...

</comment></comment></comment><comment><USER12> >Javascript (which is basically just a Lisp with infix syntax ;-))

No, it's not.

<comment><USER13> To elaborate, JavaScript doesn't support macros, which allow arbitrarily powerful semantic abstraction. And JavaScript does not have a regular syntax, so even if it did have macros, you would have to special-case each type of syntax (curly braces, statements, post-++ operators within lines) and handle them specifically. First-class functions and closures do not a Lisp make.

</comment></comment><comment><USER14> In general, the code is still impressively verbose. OTOH, it's incredibly short for Java code. I suspect that line/feature added count will increase more quickly than it would with Python or Ruby and it will quickly become a nightmare scenario indistinguishable from a more traditional Java web approach.

<comment><AUTHOR> How would these be any shorter in Python or Ruby?

      @GET
      public Collection<Integer> listStudentIds() {
        return STUDENTS.keySet();
      }

or

      @DELETE
      @Path("{uid: [0-9]+}")
      public boolean deleteStudent(@PathParam("uid") int uid) {
        final Student deletedStudent = STUDENTS.remove(uid);

        if (deletedStudent == null) {
          throw new WebApplicationException(Response.Status.NOT_FOUND);
        } else {
          return true;
        }
      }

I'll grant that Java programs often become more verbose than their Python/Ruby counterparts - but I would argue that trait can be held to a minimum with the proper libraries and coding style.

<comment><USER15> In Ruby, everything evaluates to true except false and nil. Also, the last statement executed is your return value. Therefore your first function could be written as

      def delete_student(uid)
        STUDENTS.remove(uid) || raise WebApplicationException.new(Response.Status.NOT_FOUND)
      end

<comment><AUTHOR> I love it!

And that is the reason I still write in Python or Lisp when I don't need something (Hadoop, Lucene, etc) from the JVM ;-)

<comment><USER16> If you need something from the JVM and want to write Lisp, use Clojure. Checkout Hadoop extensions in Clojure at <https://github.com/jblomo/oddjob> .

</comment></comment></comment></comment></comment><comment><USER17> For me, the modern Java ecosystem is more about a sweet combination of groovy at the edges with a minimalist Java core. it seems to be the best combo of static and dynamic typing and capture a lot of the best of both worlds without buying into too much religion or "enterprise" type complexity.

</comment><comment><USER11> But Play 2.0 is moving away from Java Servlets, IIRC... how do the modern solutions compare in that regard?

<comment><USER18> Play 1.x is NOT based on Java Servlets. No version of Play ever was, never will be. From the BDFL himself:

[http://iam.guillaume.bort.fr/post/558830013/why-there-is- no-...](http://iam.guillaume.bort.fr/post/558830013/why-there-is-no-servlets- in-play)</comment></comment>


The Purpose of Life Is to Be a Nobody - <AUTHOR> https://medium.com/personal-growth/the-purpose-of-life-is-to-be-a-nobody-72ceeb078373 <comment><USER2> Don't waste your time reading this article - if any of this was true, you could do as much good or evil (or anything you felt like) without repercussion. The reality is that our actions may not have broad global meaning but they can have huge local actions. This reminds me of a story about starfish [0].

This author has some other issues - the "I write to reduce noise" part is nonsense as if you really wanted to reduce the noise, you wouldn't write at all (or talk). And he can't even bother to get his idioms correct (e.g. "modes of dust" should be "motes of dust".)

So ... each of you is in fact special at least in some small way. And you can go out an do some good that at least impacts one person. At least go out today and make a stranger smile - that person might need a bit of cheer.

[0] [https://eventsforchange.wordpress.com/2011/06/05/the- starfis...](https://eventsforchange.wordpress.com/2011/06/05/the-starfish- story-one-step-towards-changing-the-world/)

<comment><USER3> And yet in four billion years when the sun expands and engulfs the inner planets, nothing will matter, nor will have mattered. We ARE a insignificant in the universe; I don't see how that's untrue.

<comment><USER4> I don't see how it's relevant. Things that will happen in 4 billion years have no bearing on my actions today.

<comment><USER5> Our experience is that many discoveries have changed the world and created a different future than that which we otherwise might have experienced. They would have had to be inevitable for them not to matter and that's certainly contentious though true in some cases. Given they have made a difference how does an extended time scale necessarily negate their influence? Your assertion might turn out to be true or not.

</comment></comment></comment></comment><comment><USER6> _> If you gain your worth from being a CEO and the fact that you wield a degree of power in the context of a business, rather than, say, from intrinsic values, then you will eventually find yourself in a position of conflict._

As with so many writings with the themes of minimalism / zen / detachment / spiritual enlightenment / etc, the authors have a childish view of CEOs. Yes, there are lumbering corporations with middle managers climbing to CEO to satisfy "vanity". However, for HN audience, I don't think that's the type of CEO that's interesting to us.

 _> The sooner we realize that, the sooner we can focus on the things we can change. And there's a lot we can change._

And sometimes to execute those changes, _we have to be the CEO_ instead of being a cog in a wheel (aka "nobody") in somebody else's company. You sometimes have to be the owner/CEO of 10-person startup to be an agent of change.

<comment><USER7> I don't think the author necessarily means being a CEO is an unworthy line of work. What he wants us to understand from this is that it's futile deriving one's worth from the fact that he's the CEO and that he has the ability to boss other people around, but instead he must seek worthiness from the fact that he has the potential to bring about significant change in this world; more than most people could, because like you said, he is not just some "cog in the wheel", but someone who is in charge of many like-minded people who belive in him.

</comment></comment><comment><USER8> I used to be able to avoid this nonsense by walking past the self help and new age aisles in the bookshop, but now it gets repackaged as clickbait on the front page of HN.

Yes we have all experienced losing ourselves in an overwhelming sense of our finitude compared to the unfathomable megacycles of human civilisation and the universe.

But you can't live like this. It cultivates disconnection from the world. Meditation can give you the same benefits without the mumbo jumbo, and you can develop it into a daily practice.

<comment><USER9> What type of meditation?

<comment><USER10> Read anything by Mouni Sadhu as a good start, avoid anything 'western' like 'meditating to music' etc and all that 'guided meditation' nonsense. The branch of Yoga dealing with the mind is Raja Yoga and I can recommended [http://www.yogebooks.com/english/atkinson/1906-09rajayoga.pd...](http://www.yogebooks.com/english/atkinson/1906-09rajayoga.pdf) it might take you several lifetimes to get through it all, but it's worth it!

</comment></comment></comment><comment><USER11> > We're brought up to think that we're special, and we like believing it.

It must be an American thing. In my country (Poland), children are usually not brought up this way, and if someone would try it, it might raise some eyebrows as bad parenting.

<comment><USER12> Yes, this mode of parenting is rampant in the U.S., unfortunately.</comment></comment>


Roomba's Next Big Step Is Selling Maps of Your Home to the Highest Bidder - <AUTHOR> http://gizmodo.com/roombas-next-big-step-is-selling-maps-of-your-home-to-t-1797187829 <comment><USER2> This smells like cheap and irresponsible journalism. For one, the CEO is quoted as saying "There's an entire ecosystem of things and services that the smart home can deliver once you have a rich map of the home _that the user has allowed to be shared."_ Further evidence is given in the form of part of the TOS where you essentially agree that if iRobot goes under, the buyer will get all the data. Obviously.

That's one blatant ignoring of the CEO's full statement, and one unfounded misinterpretation of the terms of service. Hardly justification for both the title and the premise of the article.

<comment><USER3> That's the problem with journalism today though. With ad based revenue platforms, a view is a view. The content itself doesn't matter, only a headline that makes views does.

I really want to see a subscription system that rewards quality over just views.

<comment><USER4> Get the New York Times? No seriously, there are long form publications that provide what you want with the model you want. I like Gizmodo. They do some interesting pieces once in a while. But I don't see myself paying $5/month for it.

I am not a fan of advertising as a model for the web. It sucks in terms of UX, and it sucks in terms of motivations for the content providers. This is how we get WikiHow and W3School, and Wikipedia clones. Problem is that it's a model that's simply more profitable than anything else we've tried so far. And you can shame people into paying or try to coax them all you want, but it just won't make as much money.

<comment><USER2> This is one of the reasons I gladly pay for a LWN subscription. I'd love to see more journalism like that, where insiders are paid a small fee to write articles about subjects they're already experts on.

But then again, my interests are much less in world events or pop culture, and much more in science and engineering, where expertise is more easily measured.

</comment></comment></comment></comment><comment><USER5> Roombas do not (currently) remember your home's layout between cleaning sessions.

I have a top-end Roomba bought last year. Every time it runs, it starts by finding a wall and then carefully learning the spacial layout of my home. It then efficiently cleans the entire area, not going over any spot more than once if it can avoid it. Then it goes back to it's home and _forgets everything in learned forever_.

You can sell the layout to my home to anyone you like Roomba, just for god's sake, have your damn robot _remember_ that layout between cleaning sessions.

<comment><USER6> If you dropped it off in a different room (or house) while it was turned off, how would it know where it was next time it was turned it on?

<comment><USER7> Try to follow the route and switch to mapping mode if it doesn't match?

Honestly I don't know why the Roombas don't just trace the perimeter. The semi-random probing they do seems inefficient to me. But then I don't know anything about the algorithm they're using, so maybe I'm missing something.

<comment><USER8> I have a top-end Roomba 980 like the GP is referring to. They don't use random exploration. When you start a cleaning cycle, it begins working in a back and forth cleaning pattern of parallel lines. When it runs out of room to perform the back and forth lines, it moves to a place where there's a "hole" in its map. That may just be a corner behind a chair, or it could be a doorway to a different room. It basically repeats this process until it has filled in all the holes and built a full map of the room, level, or whatever area you're letting it vacuum.

The algorithm definitely isn't perfect. It might clean half of the room where it starts, then wander around and clean most of the house before making its way back to finish that room. Still it seems to work well overall. What really fascinates me is how the algorithm and SLAM mapping gives it very familiar behavioral patterns. For example when it's coming back into a room that it's already visited, it might drive just inside the room, pause, "look" side to side (panning the camera to find landmarks it recognizes), then continue on.

<comment><USER9> > cameras

wow I didn't know these have cameras.

I wonder if they'll sell/subpoena the video data as well as the floor plans. I wonder how well secured it is and what the extent of punishment for poorly interpreted imagery will be.

<comment><USER8> It's only the top few models. It's using some kind of image analysis to recognize landmarks and help it navigate.

The video would have to be processed onboard, because wifi isn't require for the Roomba to work. I'll have to look at my router's logs for the Roomba, it should be pretty obvious if it's doing any amount of video uploading.

</comment></comment></comment></comment></comment></comment><comment><USER10> But Amazon is _definitely_ not doing anything sketchy with that always- connected camera and microphone sitting in your living room.

<comment><USER11> Seems like an especially left field whataboutism. Why can't we be concerned about both?

<comment><USER10> The article specifically mentions Echo. My point was that the prevailing sentiment on HN seems (to me) that Echo is a good, useful product, not an evil spying device.

<comment><USER11> Really? Because almost every thread I've about it has a discussion on the creepy factor associated.

</comment></comment></comment></comment><comment><USER12> Other submissions: 1\. [https://news.ycombinator.com/item?id=14842679](https://news.ycombinator.com/item?id=14842679)

[http://gizmodo.com/roombas-next-big-step-is-selling-maps- of-...](http://gizmodo.com/roombas-next-big-step-is-selling-maps-of-your-home- to-t-1797187829/amp)

 _Roomba 's Next Big Step Is Selling Maps of Your Home to the Highest Bidder_

2\. [https://news.ycombinator.com/item?id=14842705](https://news.ycombinator.com/item?id=14842705) (this thread)

[http://gizmodo.com/roombas-next-big-step-is-selling-maps- of-...](http://gizmodo.com/roombas-next-big-step-is-selling-maps-of-your-home- to-t-1797187829)

 _Roomba 's Next Big Step Is Selling Maps of Your Home to the Highest Bidder_

3\. [https://news.ycombinator.com/item?id=14842822](https://news.ycombinator.com/item?id=14842822)

[https://www.theverge.com/2017/7/24/16021610/irobot-roomba- ho...](https://www.theverge.com/2017/7/24/16021610/irobot-roomba-homa-map- data-sale)

 _Roombas have been busy mapping our homes, and now that data could be up for sale_

Other sources: [https://www.reuters.com/article/us-irobot-strategy- idUSKBN1A...](https://www.reuters.com/article/us-irobot-strategy- idUSKBN1A91A5)

 _Roomba vacuum maker iRobot betting big on the 'smart' home_

(Techmeme headline for the above: _Roomba vacuum maker iRobot hopes to sell its users ' floor plan data, seeking deals with Amazon, Apple, and Alphabet_ (I couldn't submit this Reuters source to HN).

Edit: formatting

<comment><USER13> As a blind cat burglar, this is really helpful.

On a side note, anyone know of any other appliance manufacturers selling mapping data for customer's walls. Specifically locations of room safes? Just curious.

<comment><USER14> I'm sure it will be of great interest when the company that sold me my internet connected garage door opener starts selling my open times.

</comment></comment></comment><comment><USER15> Are we safe from no one trying to sell us to companies?

I guess everything that's remotely network capable these days should be kept off the internet until it proves that it needs to - how do you ensure that it's not sending extra data back home without manually intercepting and inspecting all it's network traffic when it does connect?

<comment><USER16> "until it proves that it needs to"

The "need" is arbitrarily added to all kinds of things already. If the thing makes money collecting data, it will be required to operate.

</comment></comment><comment><USER17> I have a Roomba and in no way does it have any capability to connect to any type of network, Internet or otherwise. Is this only on the high end models? I've never used the app because mine doesn't offer it, does the app require sign-in so they can know who you are?

But I mean... of all the privacy invading pieces of tech I can think of, a representation of the floorplan of my house might be the least concerning. Considering I'm typing this within range of at least a dozen potentially always-on microphones and cameras, and have no idea where my keystrokes are _actually_ going.

<comment><USER8> All current Roomba models [1] have wifi and app support. The app requires an account because it's the type where even when you're at home on the same network as the Roomba, the app doesn't actually talk directly to the Roomba, but goes out through iRobot's servers. Not sure about other models, but on the 980 that I have, the app is necessary to use the full functionality.

[1]: [http://www.irobot.com/For-the- Home/Vacuuming/Roomba.aspx#Com...](http://www.irobot.com/For-the- Home/Vacuuming/Roomba.aspx#Comparison-Chart)

<comment><USER18> > the app doesn't actually talk directly to the Roomba, but goes out through > iRobot's servers

That alone is reason enough not to buy one.

</comment></comment></comment><comment> d-sc As much as I don't care for my data being sold like this, a lot of it is out there already. Public tax records contain many differnt bits of information about your house: room count, square footage, age, etc. Additionally, private companies typically track this information for entire apartment complexes including actual room layouts.

Source: work in real estate industry. Apartment floor plans are typically used to determine competitive pricing.

</comment><comment><USER19> In my neighborhood, most of the houses were built from a fixed number of designs sourced from an architecture firm. Wouldn't the floor plans be the IP of the architect?

<comment><USER20> Good question. IANAL, but i would imagine the floor plan is public record. If, someone were to build a new building using a previous designed floor plan, I can see how that could be an issue. But that's not even whats going on here. they aren't using the ACTUAL plans that the architect drafted - they're making their own map, which is akin to taking photos of the space. Like how record companies can own a recording but not a song. Where you get it from matters.

But, not a lawyer. Curious what others make of it.

<comment><USER7> Public records might have the structural drawings of your house is recent. They probably won't have full layouts because the codes don't care. Depending on where you live and how diligent they have been about digitizing the records, though, there may not even be structural drawings on file.

Source: Annoyed when I realized my house (re)built in 2009 has no architectural drawings.

</comment></comment></comment><comment><USER21> Nonesense, obviously the money is in selling recorded conversations to the highest bidder. Identifying spending patterns via image recognition of pets and babies would be up there also.

</comment><comment><USER22> > This smells like cheap and irresponsible journalism

Maybe, but it is still true and something most users probably won't pay attention to but probably should.

"This is all part of the larger quest for a few major companies to hoover up every bit of data about you that they can. Now, they want to know all about your living space"

</comment><comment><USER23> Does anyone know if Neato has this in their terms?

TBH, if I could access a map of my home from Neato, and sketch problem areas I want it to remap, that would be very valuable for me. Or if I could sketch boundaries in software for it to ignore vs. using tape, that would be way better.

</comment><comment><USER24> My home is my office, and it's constantly changing. Furniture gets moved every week, and there's always...stuff laying everywhere. I don't imagine a map of my home being very useful.

</comment><comment><USER25> I find the "random" cleaning to give the best results though. E.g going all over the place vs mapping.

</comment><comment><USER26> "Don't leave money of the table." "Maximise shareholder value!"

Thanks, capitalism!

<comment><USER14> Capitalism is supposed to be an equitable trade for BOTH sides of the transaction. I am also quite certain a socialist government would be happy to have this information.

<comment><USER27> As opposed to all those capitalist governments that are trying their best to preserve the privacy of their citizens?

And good job on defending what capitalism is _supposed_ to be, rather than what it _is_.

<comment><USER28> Because East German citizens had so much privacy.

<comment><USER27> So, when you say 'socialism', you of course don't mean all the social democracies where taxes are used for welfare (literally a small dose of 'from each according to their abilities, to each according to their needs')?

And when you say capitalism, you of course don't mean China or Russia, with their terrible human rights records, despite their economies being very capitalistic? You mean the USA, right? But all the spying and surveillance it does (along with many other countries - the UK comes to mind) doesn't matter, because _East Germany_ was worse.

No, those aren't _true_ capitalist countries. What you mean is some Randian utopia of Free Markets and Free People that will totally exist, as soon as you find a perfect, incorruptible government to maintain it.

Or perhaps surveillance, repression, and social policies are somewhat orthogonal.

</comment></comment></comment></comment></comment><comment><USER3> Here's a question (ignoring the fact the CEO said it's opt-in): what danger does this actually pose?</comment>


No-SQL injection in Mongo PHP - <AUTHOR> http://www.php.net/manual/en/mongo.security.php <comment><USER2> This is not the only NoSQL-injection issue. Extra fun bonus warning: nobody knows what the quoting domains are for all the NoSQL's. Be extraordinarily careful with your keys.

<comment><USER3> Any query language can be injected if you don't sanitize your input. Any object persistence layer that doesn't sanitize parameters is vulnerable to this kind of attack.

<comment><USER4> You are advocating a semi-reasonable solution to a common mistake, possibly because you can't conceive of not making the mistake. The better solution is to follow the advice in <http://cr.yp.to/qmail/guarantee.html> of using APIs that avoid parsing user input. Then no possibility of problems exists at all.

This is explained in item #5 of <http://cr.yp.to/qmail/guarantee.html> \- _Don't parse._

Note that this is definitely true in this case. MongoDB's API is based on the passing of data structures where you have well-defined places to put user input directly. The problem emerges because PHP decides to attempt to _parse_ that user input in a way that it had no real need to, with bad results. Without that parsing, there would have been no need to sanitize data because there would be no possibility of ever having had bad data in the first place.

<comment><USER5> A light bulb went off for me when I saw SQL injection attacks described as "subverting the structure of the query". The problem isn't sneaking bad data into your query, the problem is that the data injected into the string alters the parse tree in the dbms. This distinction isn't immediately obvious if you've moved to a parametrized query solution, because there's still a lot left to parse - it's just that the part that gets parsed is now a compile-time constant.

<comment><USER2> For whatever it's worth, even in parameterized SQL queries, the query structure isn't always entirely fixed. There are injectable parameterized query constructs, and some of them are fairly common.

<comment><USER5> I haven't heard of this before. Can you link to an example?

<comment><USER2> On-the-fly table selection is a simple example, but there are more subtle examples that happen even more often.

<comment><USER5> Unless I'm misunderstanding you, changing the table doesn't affect the shape of the parse tree. (and I'm not trying to be pedantic - I'm genuinely curious about this).

<comment><USER4> The issue isn't how you parse the query. The issue is how you choose to execute it.

I'm not sure what tptacek is thinking, but here is an important case where you really want the execution path to change.

Tables often have a very uneven distribution of data. This can mean that the right query plan will depend on the data provided. Consider the following query:

      SELECT ...
      FROM lease l
        JOIN property p
          ON p.id = l.property_id
        JOIN management_company c
          ON c.id = p.management_company_id
      WHERE l.created >= ?
        AND l.created < ?
        AND c.name = ?;

Pretty straightforward query, right? Now here is the question, should the query plan start by filtering leases on date then flow forward to finally filter on the management company, or by getting the right management company and then flow backwards to filter on dates.

It turns out that there is no right answer. You want to start with whichever restriction eliminates the most records, quickest. If the date range is wide, we want to start with the management company. If the date range is narrow, we want to start with that.

So let us simplify our life:

      SELECT ...
      FROM lease l
        JOIN property p
          ON p.id = l.property_id
        JOIN management_company c
          ON c.id = p.management_company_id
      WHERE l.created >= '2011-02-01'
        AND l.created < '2011-03-01'
        AND c.name = ?;

There is still no right answer! Let's suppose some company, call it 'AIMCO', has a huge number of properties with a lot of lease volume while other companies generally have 1-5. Then it is better to filter on dates first for 'AIMCO', and better to filter on the company first for anything else. Getting the order wrong gives an order of magnitude performance difference. (This is a real life example. I really did have a bug that basically read, "Make this report run for AIMCO." And this was exactly the problem.)

Most databases will pick one query plan and go with it. But Oracle allows you to turn on Adaptive Cursor Sharing. With this it will analyze the data, see that AIMCO should get special treatment, and actually execute a different query plan if you passed in 'AIMCO' than if you passed in something else.

So now you have a data dependent query plan.

<comment><USER5> Ok, so your example consists of switching between semantically equivalent queries in the application layer to compensate for weaknesses in the DBMS execution planner. I get that CPU time is a valuable resource and you don't want to open yourself up to DOSing and all, but this isn't really anything like SQL injections. The attacker still can't subvert the structure of the query - changing the structure of the query was the solution to the problem.

<comment><USER4> _Ok, so your example consists of switching between semantically equivalent queries in the application layer to compensate for weaknesses in the DBMS execution planner._

Not quite. My example consists of the DBMS execution planner deciding that it will switch between different semantically equivalent query plans depending on the parametrized data passed. This switch should not be noticed in the application layer.

Back to the main thread, I suspect that you are interpreting tptacek as saying something he didn't. You seem to be looking for a potential security flaw. But he didn't ever say that there was one. He only said that the query structure can vary with the parameters passed to a parametrized query. I just described one way that this can happen.

<comment><USER2> Yeah these are great comments and all but I'm just saying that, last time I checked, you can't bind a table name as a parameter in the MySQL protocol; if your table names change at runtime based on input, you're back to concatenated queries.

<comment><USER3> > you're back to concatenated queries.

Wouldn't it be safer to use a _switch_ statement?

<comment><USER5> In theory, it should be possible to enumerate your SQL queries ahead of time rather than ever generating one on the fly. In practice, that could be a huge pain of the O(2^n) variety, depending on the application type.

<comment><USER3> I assume the choice of table names or query templates in the case mentioned (make a report for atypical client C run faster) would be limited to a handful of possible query templates.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> > which PHP will magically turn into an associative array

I think I found the issue.

<comment><USER7> Rails does the same thing and it's insanely useful, you just need to know what you're doing and ensuring you're protecting against this.

<comment><USER8> Which means a) You're going to forget it at least once. b) For every developer mindful of this, there will be hundreds not knowing about it.

If you ever put "you just need" into a sentence about security you've already lost.

<comment><USER9> The default Rails way of using Activerecord will automatically sainitize inputs for you. Not turning it into an associative array doesn't add anything to security.

User input need to be sanitized always. Rails make it easy and is the default way.

<comment><USER10> There's nothing stopping you from passing unsanitized params to the database. I.e. where("name LIKE '%#{params[:name]}%'") instead of where("name like ?", "%#{params[:name]}%"). While the 2nd option is definitely the recommended way to do it, there's nothing stopping you from doing it the wrong way, and I bet many do.

<comment><USER6> The thing is, it's _easier to do it the right way_. It requires a special, deliberate effort to do it wrong. That seems like a reasonable implementation of a "magic" feature. PHP, as usual, gets it exactly backwards. It's easier to do it wrong, and requires a special, deliberate effort to do it the secure way.

<comment><USER10> Yeah maybe. Depends on the person I think. I actually find it easier to assemble a SQL string myself. If you're new to rails / AR and you're not familiar with SQL then you'll look up and figure out how to assemble the SQL via the ORM methods. If you're new to rails but an old hand at SQL, just building the string is super easy and takes you 2 seconds without looking up any documentation. Of course assembling the string AND sanitizing it requires a heck of a lot more effort.

Regardless, it's not a knock on rails. Just saying it's not necessarily a magic bullet to secure apps (and I don't believe rails nor PHP needs to be).

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> <http://www.php.net/manual/en/book.filter.php>

Lots of built-in options, the only reason this should be an issue is if you're not validating inputs at all, or hacking your own as ronnoch noted.

<comment><USER12> Which is quite possible unless you have a compiler forcing you to validate. I make silly mistakes all the time in Python.

<comment><USER13> Not to pick on your comment specifically, but I've seen a couple of comments that imply this is the kind of mistake that one would make in a moment of absent-mindedness, and I disagree. Nobody with any semblance of a clue is writing (new) apps that access user input from PHP super globals directly. If you are _ever_ using $_GET in your app-specific code you are doing it __horribly wrong __, not making a silly mistake.

That being said, there are legions of clueless devs out there who will do this, and that _is_ unfortunate.

<comment><USER12> I agree with the clueless argument, but I also think there are mountains of bugs that exist simply because one made a mistake and a dynamically typed languages can't really do much for them there.

</comment></comment></comment></comment><comment><USER14> I might be missing something here, having never used MongoDB, but what does this have to do with it? How else can this attack vector be used?

<comment><USER15> There's a very good example here:

[http://www.idontplaydarts.com/2010/07/mongodb-is- vulnerable-...](http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable- to-sql-injection-in-php-at-least/)

</comment></comment><comment><USER16> Non existing problem with Redis (not possible at protocol level), for what it is worth.

<comment><USER17> It's not exactly a protocol issue for mongo, though. If it weren't for Rails/PHP (and more) converting magical strings into objects of another type, it wouldn't be possible in Mongo either.

This would be the equivalent of some helper wrapper on top of a redis driver that turned strings with a special format into, say, an MGET command that returned more than a developer meant for it to.

redis is safer because it doesn't have the complex query-over-document functionality that mongo does, but it's not inherently immune.

<comment><USER16> The new Redis protocol (the only one used at this point) is inherently immune, with SORT we have complex queries. But the point is, the way we send every different argument to the server as a single entity with prefixed length, makes the attack impossible.</comment></comment></comment>


Boring Crypto [pdf] - <AUTHOR> http://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf <comment><USER2> Perfect example of exactly the phenomenon he's talking about, just from today! Read the whole thread to see the boring vs. exciting debate fleshed out.

[https://www.ietf.org/mail- archive/web/tls/current/msg17870.h...](https://www.ietf.org/mail- archive/web/tls/current/msg17870.html)

(h/t Filippo Valsorda).

Also: if I can take a stab at reframing this: I don't think this is properly seen as a discussion between "boring" and "exciting". Curve25519, Poly1305, and Salsa20 aren't boring! Salsa20 is the first popular native stream cipher since RC4.

What this is really about is standards crypto vs soundly engineered crypto.

Virtually all of Bernstein's problems, going all the way back through his career, stem from the way standards bodies mangle cryptography.

<comment><USER3> If we're using the word "boring" as a euphemism for "well engineered, less likely to cause a fire", Salsa20 is slightly less boring than ChaCha20, but far more boring than RC4. [https://github.com/CodesInChaos/SalsaBias](https://github.com/CodesInChaos/SalsaBias) :)

I hope we see TLS 1.3 some time soon.

> Virtually all of Bernstein's problems, going all the way back through his > career, stem from the way standards bodies mangle cryptography.

The more I read about his career, the clearer this becomes. It almost makes me wish we could abolish standards committees.

<comment><USER4> > _It almost makes me wish we could abolish standards committees._

I have for some time let myself believe that standards committees are a politically correct way to ensure incompatibility.

My boss/supervisor from an earlier life was a regular in IETF IPSec working group. (This would have been in 2004-2005.) He commented, on several occasions, that the reason IPSec was such a travesty of a spec was because the working group was infested(!) by employees from all the big players. Each of whom made absolutely sure that their bastardised version of IPSec was allowed (and therefore declared compatible) by the spec, no matter now insane, inane or outright nonsensical it was. I still remember with horror the kinds of contortions we had to make our code do to support L2TP IPSec with native clients on multiple OS's. (Think: kernel patches that would cause maintainers to claw their eyes out.)

He also quipped that IKEv2 was supposed to fix most of the problems encountered with IKEv1, but thanks to the special interests involved, he didn't expect it to come out any time soon, and even then he had no idea how badly it would be watered down when it did. The RFC for IKEv2 eventually came out in 2010.[0] I haven't had much of a look, to be honest.

Apart from Cisco and Juniper, is anyone even really using IPSec for real these days?

0: [https://tools.ietf.org/html/rfc5996](https://tools.ietf.org/html/rfc5996)

<comment><USER2> The IPSEC working group also boasts the hilarious threads where William Simpson and Perry Metzger ran Phil Rogaway --- Phil Rogaway! --- off the list for trying, early and without success, to fix some of the more basic crypto mistakes they were plowing ahead with.

A decade later, Eric Hughes (I think? One of the early cypherpunks) made news by suggesting that NSA had deliberately sabotaged IPSEC, implanting crypto vulnerabilities derived (IIRC) from IV handling mistakes. If you go back and look at the threads, it's pretty clear that wasn't NSA: the personalities involved aren't hard to track down. It was just garden variety bikeshedding.

The problem definitely _isn 't_ that standards groups attract noisy morons. William Simpson is very well regarded as a systems person. The problem is that it puts specialists in one field, specialists from others, and generalists in a room together, and puts them all on the same tier, and says "let the most persuasive person win".

<comment><USER4> > _working group also boasts the hilarious threads where William Simpson and > Perry Metzger ran Phil Rogaway --- Phil Rogaway! --- off the list for > trying, early and without success, to fix some of the more basic crypto > mistakes_

I did not know that, thank you for pointing it out.

On the other hand, I think I even read through the other material:

> _A decade later, Eric Hughes (I think? One of the early cypherpunks) made > news [...]_

I got the link from somewhere, possibly on SILC, and remember the ensuing discussion. There was a lot of bickering, and one of the comments has remained with me. Can't remember the exact words, but the context was _" if this was NSA, they sure knew how to appear juvenile."_

</comment></comment></comment></comment></comment><comment><USER5> Overall, pretty layman slide deck (for DJB anyway) and some good notes. Was just talking about RC4/BEAST with someone yesterday.

Related slides from Peter Schwabe, documenting the `gfverify` component djb mentioned near the end, to verify Curve25519: [http://ecc2015.math.u-bordeaux1.fr/documents/schwabe.pdf](http://ecc2015.math.u-bordeaux1.fr/documents/schwabe.pdf)

Another interesting paper just from there for performance minded people, "Sandy2x: The Fastest Curve25519 Implementation Ever" \- [http://csrc.nist.gov/groups/ST/ecc- workshop-2015/presentatio...](http://csrc.nist.gov/groups/ST/ecc- workshop-2015/presentations/session6-chou-tung.pdf)

</comment><comment> vezzy-fnord On a tangential note, the phrase "May you live in interesting times" actually has no precise Chinese equivalent or origin despite it being famous as such: [https://en.wikipedia.org/wiki/May_you_live_in_interesting_ti...](https://en.wikipedia.org/wiki/May_you_live_in_interesting_times)

</comment><comment><USER6> The entire premise of TLS suffers from the massiveness of the problem it's trying to solve.

There are billions of users running 100's of varieties of web browsers with varying levels of support and backward compatibility requirements trying to connect to millions of "secure" websites using a third party trust scheme involving 100's of certificate authorities across a profoundly untrusted network.

The litany of attacks listed in djb's preso covers only the pure crypto based vulnerabilities. He doesn't even go into the fundamentally broken model of HTTP->HTTPS transition, the problem of any cert authority's ability to create absolutely any certificate without any central control, the social problem of browser users not really understanding the complex error messages and vagaries of the browser UI's indicating various levels of trust, the complexities of cert and key management for small and mid sized site operators and so on and so forth.

Browser vendors' reaction to every problem seems to be to add yet another flag or HTTP header in the protocol negotiation phase and yet another acronym for site operators and users to get used to. I for one am not optimistic that we'll ever get to the level of "boring security" (not just boring crypto) that djb would like.

</comment><comment><USER7> So he's advocating a particular block cipher (X25519)?

(The online format made this hard to read.)

<comment><USER8> Curve25519 does elliptic curve Diffie Hellman key exchange, not a cipher. The related Ed25519 does elliptic curve digital signatures. Both are used in modern crypto protocols like nacl and libsodium and both are being standardized for TLS. Newer versions of openssh use them with ssh.

His cipher which is recommended together with those is chacha20. It is used with poly1305 MAC. It is a stream cipher, not a block cipher, and it is used with AEAD API. They too are already used in ssh and are being standardized for TLS. Chrome already uses them for TLS when talking to Google services if the client does not have hardware AES.

[https://en.wikipedia.org/wiki/Curve25519](https://en.wikipedia.org/wiki/Curve25519)

[https://en.wikipedia.org/wiki/Salsa20](https://en.wikipedia.org/wiki/Salsa20)

<comment><USER9> We decided to use this cipher suite in our own product for some of the same reasons he mentions. Yet a lot of the general developer community is always like "Wut!?!?!? you didn't use AES!?!?"

We've considered swapping it out or adding alternatives multiple times, especially when we were told that not being NIST/FIPS can lock you out of some enterprise markets. "Nobody ever got fired for using FIPS compliant crypto." But each time we've decided that the added complexity (and therefore attack surface, bugs, overhead, etc.) isn't worth it, especially since we have yet to find an actual concrete customer who turned us down because we're not FIPS.

I'm very happy to see Google and OpenSSH implementing this stuff. It will really help with credibility among the non-crypto-savvy. "No, it's not FIPS, but Google and Apple use it."

Side node: I worked once as a consultant with a government lab. Had to use FIPS. When vulnerabilities would come around, we'd have to scramble to harden our firewall because _we couldn 't upgrade to fixed versions_ because there was no FIPS-compliant fix yet. In some cases we had to run vulnerable. We also had to lag way behind on using smart card auth because the full stack wasn't FIPS yet on all Linux distributions. We were hacked once and none of the smart card auth'd systems got compromised, but much of the network did because it wasn't hardware access controlled yet... because of FIPS. If the conspiracy theories are right and FIPS (and NIST) are out to weaken crypto, it's working... but mostly for government and government-linked customers. Anyone who ignores FIPS and cargo-cult "best practices" is likely to be more secure.

<comment><USER10> Don't attribute to malice what is more readily explained by incompetence. Most infosec people are glorified paper pushers, especially in regulated environments.

What ends up happening is that "compliance" becomes synonymous with "security". This manifests itself in numerous ways, like spending millions on log systems like splint that nobody can access.

</comment></comment></comment></comment><comment><USER3> Yay, new djb slide deck.

(I actually enjoy reading the work he and his colleagues produce.)

</comment><comment><USER11> Why portrait format? It is obviously meant for a presentation, since there are overlays. Does djb turn his beamer over?

<comment><USER12> To show both the current and the previous slide, I believe. Here's the horizontal format, complete with fancy scrolling animations:

[http://cr.yp.to/talks/2015.10.05/slides- djb-20151005-4x3.pdf](http://cr.yp.to/talks/2015.10.05/slides- djb-20151005-4x3.pdf)</comment></comment>


Formal announcement of Wikipedia's SOPA/PIPA blackout - <AUTHOR> http://wikimediafoundation.org/wiki/Press_releases/English_Wikipedia_to_go_dark

<comment><USER2> Frustratingly I read that and it doesn't mention what SOAP is or why the site needed to be blacked out.

It goes on to explain action is needed and that wikipedia is supporting the blackout, but I've not really learned anything at all :(

It really needs to be more direct without fluff. Put the rest of that stuff further down the page.

<comment><USER3> let me wikipedia that for you... <http://en.wikipedia.org/wiki/Stop_Online_Piracy_Act>

</comment></comment><comment><USER4> As of right now 9 out of 30 items on the front page are about SOPA/PIPA. While I understand people are quite riled up, perhaps voters would be willing to willing to raise the bar a bit in terms of what qualifies as newsworthy?</comment>


MDN Database Disclosure - <AUTHOR> https://blog.mozilla.org/security/2014/08/01/mdn-database-disclosure/ <comment><USER2> I have been wondering who leaked my address after I started getting the "E.N.L.A.R.G.E...Y.O.U.R....." spam exactly about a month ago.

Initially I thought that it might have been my fault for entering the email address where I shouldn't have. I am disappointed that such processes are even architecturally possible at Mozilla where internal data is exposed externally.

Also, this has raised a question. Almost everybody knows that passwords must be hashed and salted. But I haven't see anywhere encrypted email addresses. Are there any strongly negative consequences to encrypting sensitive personal data in databases?

<comment><USER3> I don't think encrypting an email address would create any issues. In fact, if I was to provide a service, I'd save the hash email address for easy authentication (ie hash the email given during a login and compare with the hash you have) and one encrypted version of the email address so I can use it if needed (to inform the user or whatever).

I started getting a lot of spam about one month ago too and even emailed LastPass a bit angry. But this Mozilla incident could well be the cause of the spam...

<comment><USER4> The encrypted e-mail address has to be read somehow, so it's just as likely that an attacker gets the decryption key as the database itself (unless you use e.g. a hardware security module). That's probably good enough for e-mail addresses, but as you likely know, not acceptable for passwords.

</comment></comment></comment><comment><USER5> Can someone explain the meaning of "data sanitization process of the site database had been failing"

Isn't that another way of saying SQL injection ?

<comment><USER6> I wondered about this too. At a guess, perhaps they were doing a straight database dump from a production system which had sensitive information as well as public data. They would then run a script to delete the sensitive columns before posting the dump.

This seems likely to have been broken at the design stage: systems should fail safe. The first-order fix might be to check the return value of the sanitizer script and refuse to upload if it failed. But a better solution would be to write a system which makes it much less likely to leak private data. For example by copying only whitelisted columns (so if new sensitive columns are added to the system they are not dumped by default). Or storing sensitive data in separate tables or even a separate database (this will take more work if levels of sensitivity change over time).

I've speculated here about the details to illustrate the point about systems design. Unfortunately, too often the glue code for these sorts of things is written with little or no error checking, so when something is wrong the system just proceeds through unknown or unvalidated states as we see here. It doesn't help that the default language for cron and a lot of "supervisory" jobs tends to be Bash (or Dash) these days, where error checking is turned off by default.

<comment><USER7> Yep, naive bash scripts don't stop on failure and your non-sanitized file will happily get uploaded.

Does anyone know why Mozilla was posting database dumps(sanitized or otherwise) onto public servers?

<comment><USER8> It was requested in [https://bugzilla.mozilla.org/show_bug.cgi?id=932869](https://bugzilla.mozilla.org/show_bug.cgi?id=932869)

</comment></comment></comment></comment><comment><USER9> I don't understand why they had to do this, couldn't they just use a schema dump with random data? They are already setting the passwords to null and names to a random number in their sanitization script...

</comment><comment><USER10> Emails were just sent out to users, full text: [https://gist.github.com/simonsarris/829ba1c0669c404f0da5](https://gist.github.com/simonsarris/829ba1c0669c404f0da5)

</comment><comment><USER11> In Dezember 2013, Mozilla MDN switched to their self developed Kuma wiki software (from a hosted wiki solution). An open source wiki software written in Python and using the Django framework. [https://developer.mozilla.org/en- US/docs/MDN/Kuma](https://developer.mozilla.org/en-US/docs/MDN/Kuma) , [https://news.ycombinator.com/item?id=6876636](https://news.ycombinator.com/item?id=6876636)

<comment><USER12> We launched Kuma on August 3, 2012. That post is about the MDN redesign we launched in 2013.

</comment></comment><comment><USER13> The email that was just sent out to MDN users seems to differ from this post. The email says:

> Your email address (but not password) was posted on that server for that 30 > day time period.

There is no other mention of the word password or hash (encrypted or otherwise). However, the post says

> in the accidental disclosure of MDN email addresses of about 76,000 users > and encrypted passwords of about 4,000 users on a publicly accessible > server.

<comment><USER12> The emails are customized for each type of affected user.

</comment></comment><comment><USER14> tldr: an automated data sanitization process failed, emails and salted hashed passwords were disclosed. no server was hacked.

</comment><comment><USER15> There is much that could be done to improve this announcement:

1- What does "encrypted, salted passwords" mean? MD5 with a static salt? Holy shit, that's a problem. bcrypt? Less so. I have no context to know how concerned I should be, or any indication of how incompetent, or awesome, Mozilla's existing processes and defenses are. Fail.

2- They talk about a "data sanitization process" failing, but then talk about a "database dump file" being publicly accessible. Say what? This could mean anything from "an input validation error allow wrong passwords to work" to "we do a regular database dump, and store that on a public HTTP directory for some cron job to grab." Without explanation, I assume the worst. Fail.

3- "While we have not been able to detect malicious activity on that server..." Again, without the context of what happens, this statement is worthless. If you leaked the database of your users, I won't expect any malicious activity. An adversary wouldn't attack Mozilla. They would crack the passwords of the users and attempt to hijack their accounts on other sites that matter, like, banking or ecommerce sites. At best Mozilla knows this and just wanted to include some proof-point that at least they have logs/basic monitoring of stuff in place, and wanted to save face. At worse, Mozilla truly believes that someone not actively attacking them somehow means that nothing bad will happen from this loss, which is stupid. And Mozilla's Security usually isn't stupid. Fail.

4-" In addition to notifying users and recommending short term fixes, we're also taking a look at the processes and principles that are in place that may be made better to reduce the likelihood of something like this happening again." This is a completely unsatisfactory statement. If you just discovered the problem this afternoon, like, "oh shit, why is the a .sql dump in our HTTP readable /backups/ folder?" then saying "hey, we discovered a problem, we think we have stopped it, and we are looking into our processes" is a reasonable response. However when you have "just concluded an investigation" you should, I don't know, tell us your conclusions maybe? What happened? Why did it happen? What changed in your existing system that allowed it to happen? Or has this short coming always existed? If so, who is defining/vetting your processes? What are you doing so this issue doesn't happen again? What other thing are you doing to watch the thing that's going to make sure it doesn't happen again? Instead, we get a generic statement. Fail.

While not as completely opaque as some "oh no, we got pwn3d" posts, this blog post has completely failed to do the 3 things any post of this kind should do: 1) educate me about what happened 2) help me understand the risk Mozilla's actions have exposed me to, and 3) give me confidence by demonstrating clear actions you are taking so this won't happen again.

Yes attacks happen, but when a company or organization is up front, honest, and over communicates, it does wonders to calm the situation.

Mozilla, I expect more from you.

<comment><USER14> A process failed, and the DB dump that is published to help contributors improve the MDN site got out unsanitized. The sanitization/publication process will be redesigned to include stricter controls. For now, it is shut down.

MDN has been using persona for a while now, meaning that most accounts don't have passwords in the database. But older accounts still had the SHA256 salted hash that Django creates.

We traced back as much as we could. Access logs, netflow data, etc... We found that the tar.gz containing the DB dump had been downloaded only a small number of times. Mostly by known contributors. But we can't rule out that someone with malicious intentions got access to it.

<comment><USER16> Who exactly are these "known contributors", and why did they have access to this data? Why did they not report the problem earlier?

And if it was downloaded "mostly" by "known contributors", who was involved with the rest of the detected downloads?

<comment><USER8> [https://bugzilla.mozilla.org/show_bug.cgi?id=932869](https://bugzilla.mozilla.org/show_bug.cgi?id=932869) was the request for a sanitized DB for folks wanting to develop MDN itself. We could identify most of the handful of IPs that downloaded the file during the time period where it was unsanitized to individuals (i.e. IPs inside Mozilla offices, etc.). However because some IPs were unknown, or public, or potential NAT addresses Mozilla decided it was best to disclose the issue.

<comment><USER16> If some of the accesses were by people or systems within Mozilla, can you please address why a month went by before the problem was noticed?

If there was enough need to justify putting forth the effort required to export a sanitized version of these data for developers to use, then why didn't these users notice that something was wrong much sooner? And if they did notice, why weren't the appropriate parties within Mozilla notified sooner?

Could you please provide more specific details about these IP addresses that couldn't be accounted for, too? Perhaps a list of them, for instance? At least then affected users will be able to make their own call regarding their level of risk due to this incident.

<comment><USER8> Sorry, I can't provide a list.

<comment><USER16> Why not?

<comment><USER17> Because our privacy policies state that we won't disclose personally identifiable information about users, and IP addresses can be personally identifiable.

Unfortunately security incidents happen, but we won't violate the commitments we have made to our users; in this case, if we revealed the IP addresses we would have another, deliberate information leak on our hands.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Can we please start making people go to jail when this happens? I am so tired of having personal information so often.</comment>


Ask HN: Please recommend the best pre-built itx or laptop (details inside) - <AUTHOR> please recommend the best detailed analysis/review of the best pre-built itx computer with at least 16g ram, 25-50+ ssd, no other key requirements, in 2017
a comparative review comparing to other best itx computer options would be best
--
or a detailed analysis/review of a laptop that has very very low heat, the analysis/review should say what temp the laptop is at regularly (heat negatively affects performance it seems) <comment><USER2> I'd suggest you take a look at Intel NUCs, even the i3 model can take 16GB of RAM</comment>