WireGuard is now in Linus' tree - <AUTHOR> https://lists.zx2c4.com/pipermail/wireguard/2020-January/004906.html <comment><USER2> As someone who regularly deals with IPSec in conservative network environments, Wireguard can't gain broad adoption soon enough, in my opinion.

Now that it's merged into Linus's tree, any word on it getting an official release and the "this isn't production ready, so no CVEs" disclaimer going away?

EDIT:

Further back in the thread, Donenfeld says "Please note that until Linux 5.6 is released, this snapshot is a snapshot rather than a secure final release.", so perhaps real soon now?

[https://lists.zx2c4.com/pipermail/wireguard/2020-January/004...](https://lists.zx2c4.com/pipermail/wireguard/2020-January/004905.html)

This is definitely big news!

<comment><USER3> If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain:

[https://www.patreon.com/zx2c4](https://www.patreon.com/zx2c4)

<comment><USER4> I do rely on Wireguard for some personal projects and I can spare a few bucks. However the reality is I can't get to $15/month the minimum tier. I rely on thousands of opensource projects. Upstreaming should help my arguments for adoption at work; they wouldn't think twice.

<comment><USER5> You can support on Patreon for less than the minimum tier. It is just the cut- off over which the rewards (such as stickers here) are given. Support for just $1! He'll still get it!

<comment><USER4> Thank you, they could make this clearer.

<comment><USER6> I didn't know this either. I guess that's why many projects have a fake $1 tier with just "the pleasure of knowing you contributed" or something like that as the "reward" for that tier. To let people know that that's still an option.

<comment><USER7> I agree, I would have signed up for a $1 tier or perhaps $2 but $15 is far too high for the minimum tier. I support the Zig author for $1/mo and hope others would do the same for my open source projects in the future.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'm using WireGuard daily on Linux and iPhone. It's hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

<comment><USER9> I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via [https://github.com/trailofbits/algo](https://github.com/trailofbits/algo)

It's fast. It's easy. You never have to think about it. It just works.

<comment><USER10> > using a free digital ocean droplet

I can't seem to find any "free" option on their pricing page. Could you elucidate?

<comment><USER11> An engineering approximation to free?

<comment><USER12> Assuming a spherical VPS in a vacuum...

</comment></comment></comment></comment></comment><comment><USER13> Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private network service.

<comment><USER14> That's really interesting. So you essentially implemented a Virtual Private Cloud(VPC) on top of the "PHY" network of your hosts?

Does that mean that all your nodes have to be accessible to the public internet?

<comment><USER13> In my case yes and yes, but mostly because I spread out over two cloud providers.

<comment><USER15> But it only needs to be accessible on the port WireGuard uses for communications, and WireGuard also has a nice property where it acts passively for non-wireguard packets.

So someone on the internet doesn't necessarily know the node is reachable from the internet if they try and scan it for example.

Edit: IIRC only one end of the connection needs a stable endpoint as well. IIRC WireGuard supports mobility (changing IP addresses) for one end of the connection.

<comment><USER16> afaik, both ends can move, they just send packets to the latest IP they received a valid packet from.

</comment></comment></comment></comment></comment><comment><USER17> WireGuard is absolutely fabulous. I route all my traffic from a couple servers at home to a small GCP instance (don't want IP to be public) and I added my laptop to this WireGuard network (although technically a peer) and I can ssh into it remotely.

I'm serving a 1,000,000+ page views a month through WireGuard and can't say anything less about it it.

<comment><USER18> Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.

<comment><USER19> Check out [https://tailscale.com/](https://tailscale.com/) a mesh VPN built on top of wireguard.

<comment><USER20> I just learned about tailscale today on twitter. Here's the tweet from the founder [https://twitter.com/davidcrawshaw/status/1222203472461926401...](https://twitter.com/davidcrawshaw/status/1222203472461926401?s=20)

Looks really promising

<comment><USER21> It does look very nice. It's a shame that it depends on third parties for authentication, and that they have gems like this in their documentation:

> No app-level integration or reconfiguration is required, because security is > built into the network itself. If you configure your network to require > Tailscale, every one of your internal services will be subject to multi- > factor authentication.

Which is simply not true. I've had 2FA for my Cisco AnyConnect VPN for years. That does not mean my applications I access through the VPN are now magically subject to MFA.

Maybe in time this may end up being viable for me, and maybe it already is for other people. For now, I'd rather my VPN didn't depend on Google, Microsoft, Okta, etc.

<comment><USER22> > That does not mean my applications I access through the VPN are now > magically subject to MFA.

Why not? Doesn't the VPN authenticate you via VPN before you can access the apps?

<comment><USER21> Network authentication is not the same as application authentication.

If I plug a cable into your LAN, I am not subject to MFA to login to a server on your LAN.

If you have a lock on the network port that requires me to type in a PIN code and stick in a key to unlock, and expose the port, that then results in MFA to connect to your network. Your applications behind your network remain without MFA.

MFA VPN is essentially the same thing as the above, but for remote access to the LAN. Applications should still be properly secured.

I suppose it could be argued that this provides a client-side agent to authenticate the end user as well (mumble mumble 802.1x), and if so, then it's arguable whether or not you need another layer of authentication on the application, or if this qualifies as SSO to authenticate you to _everything_ you have access to in the network (so passwordless login to servers, desktops, webapps, etc)

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> I've been nothing but happy with WireGuard. Connecting from my iPhone to my home and it works great, it's fast and reliable. I'm never waiting to connect. Switching between WiFi, mobile, and sleeping go unnoticed.

<comment><USER24> Your home has publicly accessible^1 IP address

Or you are using a third party-controlled server with direct internet access to make home IP accessible

1\. No ISP firewall blocking _unsolicited_ incoming traffic

Do you configure WG to use persistent keepalives

<comment><USER25> In the US for home connections (cable, fiber, DSL) everybody gets an accessible IP address pretty much -- the worst is that some ports are blocked like port 80 or 25. Phones don't get a dedicated IPv4.

<comment><USER26> For most people it's dynamic. Mine is dynamic with the PPPoE fibre session.

<comment><USER27> I have a rpi set up with a minutely cron job to update my domain name to point to home. Works pretty well. At the worst you lose connection for a minute but usually the IP address only changes when the home connection fails which can take more than a minute to reset anyway.

<comment> core-questions Isn't this what the DynDNS protocol and various daemons are for? Why write your own? :P

<comment><USER28> Its not exactly "write your own" I have a single line in my crontab that just uses curl to post to a url and the remote server takes the IP address it got the request from and sets the dns to that.

<comment><USER29> Though usually on firmware like openwrt the request going out is tied to a particular interface going up (and down) as it should be, so its somewhat more robust and 'correct' than crontab would be.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> Does anyone know anything about Wireguard-p2p? It's a tool for automatic management of endpoints and NAT-traversal for wireguard. It was announced on FOSDEM 2018[0]. Main repo[1] is stale, unfortunately.

Some tool that would augment WG with more features a-la Tinc would be awesome.

[0] [https://archive.fosdem.org/2018/schedule/event/bulletinboard...](https://archive.fosdem.org/2018/schedule/event/bulletinboard_dht/) [1] [https://github.com/manuels/wireguard-p2p](https://github.com/manuels/wireguard-p2p)

</comment><comment><USER31> WireGuard is cool and we really like it at our company (a bunch of infosec consultants). The management of it for an even small number (20) of users is a no-go. OpenVPN is ultra reliable and provides legit 2FA options when set up well. I look forward to legit management tools and improvements. For personal use it has been great. Much simpler than OpenVPN for a few (3) users.

<comment><USER32> The way you're managing WireGuard today is like directly configuring KAME IPSEC. The Linux WireGuard implementation is low-level and, from a systems perspective, unopinionated, which is as it should be.

Getting a secure transport integrated safely into the kernel shouldn't be rocket surgery, but it is. That part is done. Getting IdP-managed WireGuard is not rocket surgery, and lots of teams will presumably do it. Those teams, by the way, stand to make a lot more money than Jason will off WireGuard, which is a very good reason to donate.

Nobody who can reasonably avoid it should be using OpenVPN anymore. I get that it's burrowed far into some organizations and am not OpenVPN-shaming anyone. But WireGuard is leagues beyond OpenVPN in terms of nuts-and-bolts protocol and implementation security.

<comment><USER33> I'm a big fan of Wireguard, and am using it in a few places, but OpenVPN still has its place - namely if you need a VPN tunnel from behind a firewall that only allows outgoing connections to small number of TCP ports, and no UDP ports.

<comment><USER34> You're not wrong. OpenVPN can be useful in that case, but in general you shouldn't use TCP as the underlying protocol for other TCP traffic, if you can avoid it. The better solution in this case would be to open a UDP port in the firewall.

<comment><USER33> My entire point was that in this case, I can not avoid it, it is my only option. Beggars can't be choosers and all that.

</comment></comment></comment></comment></comment><comment><USER35> If you're wondering what it is:

WireGuard® is an extremely simple yet fast and modern VPN that utilizes state- of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable.

[https://www.wireguard.com/](https://www.wireguard.com/)

<comment><USER36> What does it mean to be "in Linus' tree" if it's already on Linux and everywhere else? Like it will be built in somehow?

<comment><USER21> Right now, it is not part of the Linux kernel. It is just some random external software that you have you download and compile yourself against the source headers of the kernel you're currently running.

It got merged into the net-next tree, which meant it has been approved by the maintainer of the Linux kernel net branch to be included into the kernel. Linus has now pulled it from net-next into his own tree, which means it'll be included in the next release of the Linux kernel.

As far as that means as an end user, it means that you no longer need to recompile your wireguard module every time there's a kernel update, as now it will be handled by your distro.

That said, given that Wireguard is packaged nicely already for most distros, the end effect for you is really pretty little, as you're probably unaware of all of this complexity that's going on right now, as it mostly just works.

<comment><USER37> > As far as that means as an end user, it means that you no longer need to > recompile your wireguard module every time there's a kernel update, as now > it will be handled by your distro.

That's not the important point.

The point being, when merged as part of the kernel officially, you know it will get more support and eyes for stability and development power as the kernel wouldn't want to ship anything that's at some unstable state.

So you can expect long term usage and maybe RedHat might pick it up as its official VPN solution instead of libreswan some day.

<comment><USER38> >you know it will get more support and eyes for stability and development power as the kernel wouldn't want to ship anything that's at some unstable state.

This is a rather idealistic view on kernel development.

But it is true that when wireguard is "ready" this could very well result in a bit more support as larger orgs will be more willing to start using wireguard.

</comment></comment></comment></comment></comment><comment><USER39> Super cool. WG is a such a great tunnel tool. They've told me not to use in production but I've been ignoring that advice for months. My first test was using in as a replacement everywhere I still has stunnel. Then right after it was proved I started using this hammer for everything.

AND! This part is critical: all of my interactions with the team and the community around it have been positive.

Brilliant!

</comment><comment><USER40> This is great news, and I'm looking forward to giving it a try once it's released as part of the kernel.

I've been using tinc[1] for several years now, and it's been very simple to configure and use. Similarly to WG, it can tunnel over UDP, but also over TCP, supports router or switch modes, NAT traversal, etc. It's a great project, but not very popular and I'm concerned about its maintenance and security issues moving forward.

To someone who's used both projects: can WG today be a drop-in replacement for tinc?

[1]: [https://tinc-vpn.org/](https://tinc-vpn.org/)

<comment><USER30> As far as I understand, the killer feature of Tinc is automatic mesh routing. You can add a node to one instance and the information spreads through the network, wireguard doesn't do that.

Also, I heard maintainers were contemplating replacing the protocol with Wireguard.

[https://www.tinc- vpn.org/pipermail/tinc/2017-February/004755...](https://www.tinc- vpn.org/pipermail/tinc/2017-February/004755.html)

<comment><USER41> IPsec also supports this - give certs signed by a mutually tusted CA to all nodes and they can all communicate host-to-host in a full mesh without needing to reconfigure when adding a host etc.

<comment><USER42> Can you please elaborate? As far as I see it, IPsec is encrypting traffic. IKE is for setup of security associations. What part of IPsec would do routing, and in this case: potentially multi-hop mesh routing?

<comment><USER41> IKE obviously does the key management part, it's part of IPsec in this picture.

There is no separate mesh routing in this scenario, everyone just uses normal internet routing and addressing.

</comment></comment></comment></comment></comment><comment><USER43> I use WireGuard on OpenBSD and Linux and it is just simply beautiful.

THANK YOU Jason for writing it and to everyone else who has contributed code, testing, money, whatever.

I believe WireGuard will become the most widely used VPN above IPsec and OpenVPN. There will still be use cases for them (especially IPsec) but both will lose marketshare dramatically.

<comment><USER44> WireGuard is nice but needs 2FA support. Until then it can't be used in various corporate road warrior scenarios.

Also until Cisco, Juniper, etc add WireGuard support and enough devices are deployed with it, IPsec will remain the corporate tool of choice when connecting between different organisations. Within the same org, where you have greater control of the equipment used, WireGuard is a bit more feasible.

<comment><USER45> What you're describing (authentication/2FA) should be handled by a client application. VPN client software should handle authentication/authorization with the corporate VPN server. Once it's authenticated, it can exchange/generate the public-private keys used for the WireGuard tunnel. The VPN client then installs those keys and starts the tunnel. After that, it's up to the client and server VPN software to handle session timeouts, reconnections, host machine security policies, etc etc. None of that is the job of WireGuard itself.

<comment><USER44> That's still just one factor on the tunnel itself, which is the problem. If the keypair is discovered somehow, attackers could connect to your network without 2FA. Or am I missing something?

So what software can I use now to make 2FA work with WireGuard that's simple to use - as simple as OpenVPN (cert+user/pass is trivial in OpenVPN and supported in their clients).

</comment></comment></comment></comment><comment><USER46> This is awesome news. I've been using my self written access server deployed as a docker container at my home for ages now with no problems at all. Wg is a pleasure to use and their apps for iOS and desktop are great. The QR code feature in the mobile app is really good.

I can't wait for better adoption amongst businesses for corporate VPNs.

[https://github.com/Place1/wg-access-server](https://github.com/Place1/wg- access-server)

</comment><comment><USER47> Glad to see it finally officially accepted. I've been using it on all my devices for over a year now and it's been rock solid. The ease of setup and initial connection speed alone blow any of the alternatives (that I'm aware of, at least) out of the water. Long may it continue!

<comment> m-p-3 The only place where it falls shorts is that it doesn't go through as easily as SSL/IPSec on restrictive networks like corporate firewalls, but maybe that will go away when it becomes more common (and hopefully adopted in enterprises).

<comment><USER26> I've honestly not had a lot of issues with that up until now. Real world it doesn't seem to be blocked by a whole lot of things, except where you only have port 80 and 443 anyway. I've actually seen it work in a lot of places I wouldn't have expected it to, like hotel wifi.

<comment><USER48> I've seen the same, likely because the DPI boxes haven't yet caught up.

</comment></comment></comment></comment><comment><USER49> Wrote a little post some time ago on how to set it up on linux and use it on android. Super simple.

[https://blog.oxplot.com/wireguard-vpn-on- android/](https://blog.oxplot.com/wireguard-vpn-on-android/)

<comment><USER50> Nice! Any idea what the minimum system requirements are? I'm wondering how cheaply I could run this.

<comment><USER26> Basically nothing for wireguard itself. I've run it on some seriously underpowered hardware and it seems to have basically no performance impact to speak of. I probably have it set up on around 30 machines presently and have used it in production environments.

</comment></comment></comment><comment><USER51> Just yesterday I was looking at tinc [1] and wireguard was mentioned briefly. I'd like a way to access my home computers via ssh to keep them updated via ansible, even if they are on different networks (parents' laptops, my laptop, my raspberry servers, etc).

Does anyone with more knowledge care to comment on security issues with tinc vs wireguard?

Too bad that you need to use an external droplet for discovering the hosts with this one :(

1 - [http://tinc-vpn.org/](http://tinc-vpn.org/)

<comment><USER52> I cannot comment on tinc, but I use WireGuard to do the same thing as you, and it works brilliantly. It was "easy" to set up and use.

I wrote up what I did for my Raspberry PI server that I have at home [0].

The only other component that may be necessary is Dynamic DNS if you have a dynamic home IP address, or at the very least a way to find out your home IP at any time.

[0]: [https://qasimk.gitbooks.io/piserver-book/content/personal- vp...](https://qasimk.gitbooks.io/piserver-book/content/personal-vpn- wireguard.html)

</comment></comment><comment><USER53> That's good news.

I have been using wireguard via telegram and discord. Bot generates a config, whip it up and send generated QR code/file/instructions. It changes the DNS to the proxy pihole so whenever I connect to vpn, most ads stop bothering me.

It's been great because I can easily give access to others via the bot too. They only need to scan the QR code or download the file, import it in the official app and it works. :D

</comment><comment><USER54> Is the Windows client offering better now? I'm still using the old alternative Tunsafe client on Windows because it is more stable than the official client on my laptop (got several bugs with sleep/resume/hibernation/long lived session).

Well... I just tried to install the latest official Windows client and got an error about Wintun missing when activating a tunnel :/

<comment><AUTHOR> I thought the Wintun driver was bundled with the WireGuard installation but if you need to install it separately I believe you can do it from [https://www.wintun.net/](https://www.wintun.net/)

Hope it helps. The Windows client is very stable now.

<comment><USER54> Thank you for your help. Unfortunately, the files available on wintun.net can't be used.

</comment></comment></comment><comment><USER55> So,curious here: I'v been reading about how the focus these days is to move networking code to userspace because you can squeeze out more PPS performance,does the fact that WC makes use of kernel code heavily give it a performance disadvantage?

<comment><USER56> I don't know what PPS is, but that is an inaccurate sentiment. Running as a kernel module allows you to achieve higher throughout and lower latency.

<comment><USER57> You're correct. I don't know why you're downvoted. Anything you can do to get performance with kernel bypass techniques can be done inside the kernel as well.

<comment><USER56> ¯\\_(ツ)_/¯ It's alright. You sometimes get downvoted by the early two people who are offended that I'd dare comment without knowing what PPS is (or something equally offensive).

</comment></comment></comment></comment><comment><USER58> Since a couple of years I've been running iked [0] on my VPSed OpenBSD. It took me around 5 minutes to setup and it "just works" since then with my iPhone and MacOS clients out of the box, not requiring any additional software.

But since WG is getting so high praise here, I'm now interested what are WG advantages and what does WG have to justify the effort to move away from iked and install/setup the client software everywhere?

I'm certainly going to find out and test it myself, but would really appreciate just a quick answer/explanation

[0] [https://man.openbsd.org/iked.8](https://man.openbsd.org/iked.8)

<comment><USER42> For me it's just easier to get my head around having a new network interface presented rather than this pile of security associations and transform configurations. I can just re-use my firewalling and routing knowledge and do not have to put my mind into IPsec mode to manage this. That aside, I think it's still quite a lot easier to use IPsec tooling when you want something that plays along with certificate based multi-level trust models.

</comment></comment><comment><USER59> Wireguard is really, really awesome. I've been using it for a bit now and it almost completely Just Works™. I've only had two issues, one of which is known and the other of which I think is probably my fault somehow.

The first is that for some reason I sometimes need to ping machine B from A in order to get to C via B (in my case B sits in a VPS, while A is a laptop and C is a desktop).

The other is that I would love to be able to connect directly over the LAN from A to C and vice versa, only going via B when A is mobile. I'm pretty sure that I could fix this with more IPv6 addresses and routing tables, but so far no joy.

</comment><comment><USER60> I just started looking into WireGuard and was disappointed to find out that pfSense has no support for it. I don't like messing around with packages outside of the pfSense repo, even if it's kinda supported in FreeBSD.

<comment><USER61> I run Wireguard on a freebsd server behind pfsense. Works well once you have a nat setup. What is stopping you from going that route?

<comment><USER60> That's the direction I was headed, yeah. I do like the convenience of managing it all from the firewall web interface, however.

</comment></comment></comment><comment><USER62> Anyone aware of a VPN provider that offers WireGuard and supports more than 5 simultaneous connections? I've been using Mullvad but the 5 connections limit is starting to feel really restrictive.

<comment><USER63> I set up a home router that I can connect to through Wireguard from all my devices, and it forwards all traffic to Mullvad. Bonus: I use PiHole on the same instance so all my devices get transparent ad- and tracker blocking

</comment></comment><comment><USER64> Very glad to see WireGuard getting more adoption. I've been using it while mobile and traveling and it's been absolutely rock solid.

OpenWrt router back at home, multiple Android devices and Fedora machines connecting back that just work seamlessly between different networks. It's been such a treat to use and watch and help it mature.

Just need more popular VPN providers to start supporting it -- NordVPN and PIA have provided "support" for it, and Nord allows using it as "NordLynx" on their Linux app.

<comment><USER65> Mullvad supports WireGuard tunnels, been using it for a couple of months now, pretty solid in any device, in all the regions I tried.

<comment><USER64> I found the speeds to be lacking quite a bit and it was never completely reliable with both the WireGuard app and the official Android app, which also doesn't support split tunneling or allowing specific apps to bypass the interface. I will revisit when my subscription with current provider expires.

</comment></comment></comment><comment><USER66> Great news! Definitely going to be changing the landscape of VPN.

</comment><comment><USER67> Good news (rare) in Jan 2020 ;-)

Using WireGuard to establish a mesh network seems good to start with but it does not scale well (even with the help of subspace web UI). Nebula (from Slack) seems to be a better option which is simple, secure and scales well so far, docs are not that well at this stage but usable.

My main use case of WireGuard is to secure network traffic on Laptop/Workstations, replacing old-school complicated IPsec (strongSwan) and OpenVPN, can't be happier with its simplicity, user experience (seamless switching networks like strongSwan client for Android, per network on-demand, etc) and performance, battery life on mobile devices, etc. Anyway, non of the traditional VPN solutions (including WireGuard) work inside the Chinese GFW when travelling to China Mainland (won't go there until the 2019-nCoV is under control or a vaccine is available). So I am exploring V2ray (TLS + WebSocket + Web) and Trojan at this stage (working ones to my knowledge).

Gravitational folks even implemented a WireGuard based overlay network plugin for k8s, super excited to replace flannel with wormhole (I have to admit it is a bad name) in use cases where encryption is required for overlay networking, which flannel does not offer.

Many thanks to the WireGuard development team for the good work! Jason and many others, wow, I see the name of a long-time-no-see frined Herbert Xu (crypto subsystem maintainer).

<comment><USER67> Forgot to mention a potential problem with WireGuard, server keeps the list of clients' virtual IPs (AllowedIPs used for routing/ACLs), not ideal for VPN service providers in terms of privacy.

It's not a problem for overlay network (e.g. Nebula) though, as it is considered a `requirement`.

</comment></comment><comment><USER68> Apologies if I've missed it, but which kernel version will be first to ship with Wireguard? Looks like 5.5-rc7 is already out, so will Wireguard be included in 5.6?

</comment><comment><USER69> If there was ever a use case for a raspberry pi, this is it!

</comment><comment><USER70> Nord VPN has added a Wireguard protocol-based option in their apps now. I'm not sure what to make of that.

</comment><comment><USER71> This is really great news! Soon we can finally start to deploy our global WG/IPv6 based management VPN.

</comment><comment><USER72> Does anyone know of a way to add Wireguard to Gnome NetworkManager gui ?

<comment><USER73> [https://aur.archlinux.org/packages/networkmanager- wireguard-...](https://aur.archlinux.org/packages/networkmanager-wireguard- git/) for archlinux, for other distros, you should probably look at the upstream source linked there

</comment></comment><comment><USER74> This is fantastic!

</comment><comment><USER75> heartbroken: doesn't work in mainland China

<comment><USER76> Care to explain?

Unless underlying protocols (OSI layer) OR government policies don't stop WG from working, there should be no other variable to technically stop WG from working.

</comment></comment><comment><USER77> glad to see wireguard improving!

</comment><comment><USER78> Is this like WireShark?

<comment><USER79> Not at all. Wireshark is for monitoring and analysis of network+hardware stuff, and WireGuard is for VPN stuff.

</comment></comment><comment><USER80> Congratulations to Jason, super cool!

\- pHreak

</comment><comment><USER81> Pedantic: Linus's

<comment><USER82> More pedantic: _Linus '_ is correct because _Linus_ is a proper noun.

<comment><USER81> As far as I understand it, that's not the general rule.

This is hardly a authoritative citation, but it cites a number of authority and comports with my understanding as someone whose name ends in `s`:

"Nearly all authorities agree that if you want to make a possessive out of a singular noun like Kansas that ends in an s, you need to add 's at the end. Just call it "Ross's Rule.""

[https://www.legalwritingpro.com/articles/feeling- possessive/](https://www.legalwritingpro.com/articles/feeling-possessive/)

<comment><USER83> Depends on your region and the name in question. e.g. macquarie ([https://www.macquariedictionary.com.au/resources/view/resour...](https://www.macquariedictionary.com.au/resources/view/resource/6/)) say:

> Personal names ending in s are these days often given the regular apostrophe > s, whatever their number of syllables or their sound:

>

> Burns's poetry

> Dickens's novels

>

> Those who have occasion to refer to classical or biblical names of several > syllables may still prefer the apostrophe alone, as with:

>

> Jesus' teachings

> Moses' law

> Euripides' plays</comment></comment></comment></comment>


"How News Feed Works" Nothing New, but It's Important - <AUTHOR> http://firedoglake.com/2015/03/26/facebook-to-use-metadata-from-chats-to-alter-news-feed/

<comment><USER2> I wish I could get a reverse chronological list of news of everyone I am connected to on Facebook that I haven't unfollowed.</comment>


Is it true that a good programmer uses fewer "if" conditions than an amateur? - <AUTHOR> https://www.quora.com/Is-it-true-that-a-good-programmer-uses-fewer-if-conditions-than-an-amateur/answer/Dima-Korolev?share=1 <comment><USER2> A "goto" is not a branch (as noted in the article) but it rather a jump. From what I've seen it's not the level of experience that determine the number of "if"s in a person's code but rather seems to be an intuitive minimization of logic as a whole.

For those that wish to learn, I've used Gray's code and Karnaugh maps to minimize really complicated logic. And computer scientists are often amazed that an electronics engineering technique could be applied to software.

<comment><USER3> A while ago someone posted an encyclopedia of kinematic mechanisms[1], and it made me wonder how many of them could be used as well-tested analogs of not yet implemented algorithms.

[1] [http://kmoddl.library.cornell.edu/model.php](http://kmoddl.library.cornell.edu/model.php)

</comment></comment><comment><USER4> An amateur is a person who thinks stuff like that is what makes good or bad code :)

<comment><AUTHOR> +1</comment></comment>


Ask HN: First steps to become a freelance photographer - <AUTHOR> Hallo, I am 23 years old. Photographie is my hobby since more than two years and I would like to earn some mone with it.<p>1. Start with family members ? 2. Website necessary ? Or use e.g. Instagram? 3. How to get the first client? 4. Pay for models to get some pictures for own website ? Or give them the right to use the pictures instead to pay ? 5. Get in touch with some photographer and help him/her to build up the set and watch how they are doing the job? 6. Get in touch .... and take shootings that the won´t shot (e.g client has low budget)? 7. How to charge (Per hour or per shooting) ? 8. What was your expirience at the beginning ? <comment><USER2> > hotographie is my hobby

I would suggest leave it at that. Low barrier for entry means fierce competition. However if you want to try you should incorporate all of these points, also make sure you pay for fake instagram followers/comments/likes if you want to even try to start there. (It's standard practice there)

</comment><comment><USER3> Have done on and off freelance portrait photography. Usually, a few years ago, it was as simple as posting on Craig's list and a portfolio on Flickr.

I started with $50/shoot but that translate to less than $15 per hour. But it is really hard to compete on Craig's List. After initial customers I was getting referrals and that's where I was able to charge a bit more.

No need of models for your portfolio, ask your friends if they want a free photo shoot.

</comment><comment><USER4> You don´t have to pay for models. I´m shooting potraits of friends or family members sometimes for my portfolio. It´s necessary to be prepared and to have some pictures that you can show to clients. When you get your first job you don´t have to charge to much (see it as an door opener) because the outcome is much more important -> if the clients are happy they will recommend you to other future clients. To get your first client, I would suggest to tell to your friends that if they hear that someone needs a photographer, that they should recommend you. Don´t forget to buy your firend a beer after the recommendation ;) I would invest more in good lenses than in a expensive camera. It doesn´t have to be a full-frame you can also shot nice pictures with an aps-c. You don´t have to own website (yes, it´s more professional) but you can also use just Instagram to show your pictures.

</comment><comment><USER5> Find people who will pay you. Nothing else matters.

Everything in your list is a way to avoid finding people who will pay you. They are all easier than getting paid. Getting paid is what separates a business from a hobby. Good luck.

<comment><USER6> > Find people who will pay you. Nothing else matters.

That's definitely the way to become a professional-photographer. If you're not getting paid you might be having fun, and you might be artistic, experimental and doing interesting things but you're enjoying a hobby.

When it comes to getting paid to shoot people, with a camera, there are a few routes. The obvious ones are shooting Weddings. I shot one wedding, and "never again". Bridezilla is a term you'll come to associate with very clearly if you're not unflappable.

My niche was photographing escorts, and grandchildren. Sometimes pets, but mostly half-naked ladies and children in the range 4-9. Needless to say I advertised upon different sites for these niches.

Escorts, hair-dressers, make-up artists, and similar professions will need regularly updated pictures. You don't have to charge a lot to become profitable, as usually they're pretty simple to do. You need to know poses, you need to know lighting, but you don't need much equipment (even amateur level stuff will do). Obviously you need spare bodies, lenses, batteries, cards, but you don't need them to be too expensive.

The kind of equipment I used started off was low-end Canon bodies and hign-end lenses. Over time my bodies became more advanced. Something like a 5D MK1 (x2) batteries (x4) CFCards (x8) and a small selection of lenses (24-70 f/2.8, 70-200 f/2.8, 50 f/1.8, 85 f/1.8) would set you back maybe £8000 which is an affordable price assuming you shot 4-8 people every weekend. You can start with smaller numbers of bodies/lenses, and expand over time (as I did).

Beyond the traditional options you could pimp yourself to pre-schools, toddler-swimming-sessions, OAP-homes, maternity-hospitals, and even cancer- wards.

If I had to start over doing this I'd probably look at underwater-bodies and toddler/child-swimming events. Parents love pictures of kids, and although phones are ubiquitous the results won't compare to a decent DSLR in the hands of an expert. Plus babies underwater look AWESOME!

</comment></comment><comment><USER7> Step 1: Get used to being hungry. Step 2: Enjoy all the free time you now have.

</comment><comment><USER8> I wouldn't start with family members, but that's just me. Are you in the US? Start by focusing on high school graduation photos and things like that; try to get in good with some colleges, universities, and schools and do their sports photography even if it doesn't pay that well it'll build your portfolio, and or allow free travel at times. Weddings can be lucrative as well but you absolutely need to make sure you're prepared with 2 bodies and a backup shooter. Don't be the dude shooting a wedding with a pop up flash. Additionally, two years in photography isn't a lot of time. It's a good start. But make sure your product is excellent to stand out from people who have been doing it for 30,40,50 years. You probably want to start around the $80-100 an hour mark.

Real estate photography if you focus on high end properties can be lucrative for the time return.

</comment><comment><USER9> I'd highly recommend perusing the [http://www.creativelive.com](http://www.creativelive.com) library. They have 100's of hours of videos on photography, and at least dozens on the business side of things, including "getting started." The videos cost money if you want to watch on demand, but you can just keep an eye on the "upcoming" schedule to watch them for free when they stream them live.

</comment><comment><USER10> Chasing fame on instagram is not going to get you freelance work, so focus on having a decent portfolio website instead. Take pictures everyday, and post some on Unsplash. See which photos people end up using. If it's interiors or landscapes, focus on that. Find your niche fast!

</comment><comment><USER11> I've done hobby photography for 10 years. I suggest finding an up and coming locale freelance photographer on Instagram that you like and asking them to grab coffee. Someone who's had a few dozen clients can easily answer the questions you've asked and any you haven't thought of yet. IMO you will get better answers from experience there vs on HN.</comment>


No suspicious package or device found after scare at Facebook in Menlo Park - <AUTHOR> https://abc7news.com/bomb-threat-forces-evacuation-of-facebook-building-in-menlo-park/4881556/ <comment><USER2> At the same time, somebody blocked off the main road with a truck. [https://i.imgur.com/IvmuPl3.jpg](https://i.imgur.com/IvmuPl3.jpg)

<comment><USER3> That's actually not funny. If those activities were coordinated its a chilling message.

<comment> King-Aaron Agree, that's pretty scary to see someone go to that extent of planning. This is our peers that are being targeted for violence over the general state of the technology industry.

</comment></comment></comment><comment><USER4> how many times has a "bomb threat" that's been called in, actually resolved into finding a bomb?

It seems odd to me that one would go to the trouble of making a bomb, placing it, then calling it in...

<comment><USER5> [https://en.wikipedia.org/wiki/Harvey%27s_Resort_Hotel_bombin...](https://en.wikipedia.org/wiki/Harvey%27s_Resort_Hotel_bombing)

<comment><USER6> Any that don't involve something along the lines of "give me money and it won't go off"?

<comment><USER7> Sam Melville?

[https://en.wikipedia.org/wiki/Sam_Melville#Bombings](https://en.wikipedia.org/wiki/Sam_Melville#Bombings)

The IRA also phoned about many of their bombs. The Omagh bombing is mostly notable because their phone-call didn't accurately identify where the bomb would detonate, and so got people killed.

Plenty of terrorist groups have recognized that killing innocent bystanders isn't good PR.

<comment><USER8> Also [https://en.wikipedia.org/wiki/Weather_Underground](https://en.wikipedia.org/wiki/Weather_Underground)

Is it terrorism if they take active steps to prevent terror?

Attacking the enemy and avoiding collateral damage is usually called making war.

</comment></comment></comment></comment></comment><comment><USER9> Nowadays Facebook has so many enemies, State and non-State actors, that it is even impossible to determine who is behind this, unless the ones behind it, are willing to tell us. There is even an interesting opportunity to falsely accuse. Who are we going to appoint as being responsible? This is an excellent opportunity to black mouth a political adversary. Who are we going to pick?</comment>


Rails 4.1.0 beta1 released - <AUTHOR> http://weblog.rubyonrails.org/2013/12/18/Rails-4-1-beta1/ <comment><USER2> Wow. These are STELLAR improvements! Check out the release notes here: [https://github.com/rails/rails/blob/master/guides/source/4_1...](https://github.com/rails/rails/blob/master/guides/source/4_1_release_notes.md)

So excited about all of it. Native enum is a blessing.

Took me a while to figure it out but here is the required line for your Gemfile:

        gem 'rails', '4.0.1.beta1'

        # This works too, but isn't required (thanks to cantoniodasilva's comment below)
        # gem 'rails', github: 'rails/rails', tag: 'v4.1.0.beta1'

Booya! Very excited to put it through the paces of this new app I am working on.

<comment><USER3> It's a shame these aren't actual database ENUMs, but rather ints (with the mapping in ruby land): [https://github.com/rails/rails/commit/db41eb8a6ea88b854bf5cd...](https://github.com/rails/rails/commit/db41eb8a6ea88b854bf5cd11070ea4245e1639c5)

Even a text column would be preferable IMO ... you wouldn't need to worry about remapping if a value got removed, it's more easily queryable, and it's certainly more legible if you're looking at raw data (say, via psql). Plus you probably won't really save much (any?) space with an (64-bit) int.

<comment><USER4> Considering the sad state of mysql enums with the pitfalls it have, it really isn't a shame.

I totally agree that a text column would have been preferable though.

<comment><USER5> Shouldn't the mapping to database be backend-dependent anyway? SQLite has more or less no feature, yet ORMs don't feel the need to restrict themselves to what sqlite can do.

(nota: oracle and mssql don't, afaik, have an enum type either)

(and in Postgres, enum is not a type, it's a type constructor. First you have to `CREATE TYPE yourtype AS ENUM ( values... )` then you can use `yourtype` in a table, you can't have a column of type `ENUM ( whatever )` because Postgres enums are disjoint and not structurally equivalent)

</comment></comment></comment></comment><comment><USER6>
      > This new release also follows our new policy of targeting a minor release every
      > six months. The idea being that the jump from minor to minor shouldn't try to
      > include everything under the sun. Just whatever is ready after the six month
      > mark.

EDIT: I have been misinformed. I didn't participate a lot in this release, and I missed some discussion. If you read my previous comment, I mentioned this was a policy change, which isn't technically true. Anyway, on to what is true:

People have always complained that upgrading Rails has been difficult, we want to make that better. Releasing often will help us make a smoother upgrade path, which should help with these issues.

<comment><USER7> Thanks for the work, looks exciting!

In addition to taking the pressure off of the rails team/community a bit, now you don't have to postpone til the next great feature can be included. I'm sure that devs knowing that what is left out now will probably be there in six months will help their planning and decision-making processes.

</comment></comment><comment><USER8> Love Spring. Will help every day development immensely.

Thank you for the ActionMailer previews. Working on an app with a bunch of mailers - things get wily fast, and a bunch of static files sit around to be tested for display.

I think the secrets.yml idea, while in development, is awesome and helpful for organization. However, I'd be a little concerned that a single file has everything secret-y in it. Maybe that's paranoia though. It'd be nice if this wasn't just a config thing that I could hand roll myself, and instead offered some sort of obscuration/security measure in and of itself.

<comment><USER9> Having all secrets in one place is IMO a good thing, as it's unlikely you will accidently put secrets somewhere else.

During deployment, you will only have to inject one file.

</comment></comment><comment><USER10> > _In fact, we 're already running beta1 in production for Basecamp, so you > know it's been taking a good beating. This helped us catch a couple of > performance regressions, and we've verified that everything is still spiffy > fast on Basecamp._

Wow. Well, having enough faith to run Basecamp off of it -- and the fact that 4.0 was a very smooth transition from 3.2 -- is enough reason to play around with this beta for a project.

Edit: nevermind, don't think I can handle this feature removal: [https://github.com/rails/rails/commit/c300dca9963bda78b8f358...](https://github.com/rails/rails/commit/c300dca9963bda78b8f358dbcb59cabcdc5e1dc9)

/s

<comment><USER6> I don't work at 37signals, but it's my understanding that Basecamp has often been running near HEAD Rails. Everyone on the team tries to keep some apps running on edge before a release to catch regressions.

</comment></comment><comment><USER11> wow, the action mailer preview thing is one of those things you're amazed didn't exist until now. i remember rigging this up manually a few times after getting sick of sending a million test emails to myself. great work rails team!

<comment><USER12> 37signals actually has a gem called mail_view that I've been using to preview mailers: [https://github.com/37signals/mail_view](https://github.com/37signals/mail_view)

Glad this made it into Rails itself.

And if you've ever wanted to put inline CSS into emails, roadie will help with that: [https://github.com/Mange/roadie](https://github.com/Mange/roadie)

<comment><USER13> Hat-tip to roadie. I am absolutely amazed at how well it works, and how much work it removes in producing HTML emails.

</comment></comment></comment><comment><USER14> Great new practical features. I can literally use every one of these, and many of them I've already been handling by rolling my own or using a gem.

Surprised to see enum support finally come to activerecord.

<comment><USER15> note that it's not "real" enum support

</comment></comment><comment><USER16> The only issues I have with this release is that they could of waited until after the holidays. I have a feeling we'll see a security patch right before xmas.

The second issue I have is `secrets` should be entirely removed from the framework. These settings should _NOT_ be stored at the file level, it should be handled by environment flags. I feel this is a fundamentally broken feature.

Spring is neat, was it just a port of Zeus into Rails?

<comment><USER17> If you don't store secrets in a file... how do you share them? When a new developer comes on board; when a new deploy machine is provisioned; etc.

Honest question, I've been trying to figure out the best way to do this.

Even without considering deploying secrets to a new machine, doesn't 'keep them in environment variables' usually mean store in a .bashrc or something, which is of course still a file?

<comment><USER18> The idea is to keep them out of version control. At least ~/.bashrc won't end up in a repository under normal circumstances. You have no idea what pieces of your code base may eventually be open-sourced.

For small teams, a good solution is to keep a GPG-encrypted file in Dropbox or another team file share. When you onboard a new developer, someone reencrypts the file with the new recipient. If you use Chef, the knife-briefcase plugin will handle this for you.

For large teams, there shouldn't be _any_ secrets that need to be disributed. In an ideal world, at least. Each user should get his/her own account on each server, his/her own AWS credentials, etc. At some point you'll run into sharing a secret among production servers (SSL certs, for example), but you should never need to share secrets among developers in a well-designed system. Individual accounts allows useful audit trails and limits the damage if a credential is leaked.

</comment></comment></comment><comment><USER19> Always great to see new rails releases. The message signing looks pretty useful.

I'm curious when people would use `Module#concerning` though?

<comment><AUTHOR> The original gem has some examples in the README [https://github.com/37signals/concerning#readme](https://github.com/37signals/concerning#readme)

</comment></comment><comment><USER20> > Removed deprecated threadsafe! from Rails Config.

What are the consequences of this change?

<comment><USER6> [http://tenderlovemaking.com/2012/06/18/removing-config- threa...](http://tenderlovemaking.com/2012/06/18/removing-config- threadsafe.html)

</comment></comment><comment><USER21> Does anyone have any links describing the new CSRF for JS GET requests? Also they misspelled CSRF in the blog post title :/

<comment><AUTHOR> Nice catch about the title, fixed!

In the release notes: [http://edgeguides.rubyonrails.org/4_1_release_notes.html#csr...](http://edgeguides.rubyonrails.org/4_1_release_notes.html#csrf- protection-from-remote-script-tags)

In the upgrading rails guide: [http://edgeguides.rubyonrails.org/upgrading_ruby_on_rails.ht...](http://edgeguides.rubyonrails.org/upgrading_ruby_on_rails.html#csrf- protection-from-remote-script-tags)

In the docs: [http://edgeapi.rubyonrails.org/classes/ActionController/Requ...](http://edgeapi.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html)

</comment></comment><comment><USER22> Anyone know a gem which will provide the secrets behaviour without waiting for this release?

<comment><USER23> figaro, with some extra benefits

</comment></comment><comment><USER24> That release looks awesome, congratulations to all involved.

</comment><comment><USER25> Thank you Rails team!!

</comment><comment><USER26> How different are these AR enums from, say, Simple enums?

</comment><comment><USER27> Genuinely surprised that AR is only now getting enums; DataMapper has had them forever.

</comment><comment><USER28> Thank you Rails team - lots of useful stuff here.

Really like the six-month release pace.

</comment><comment><USER29> Is there any good tutorial site or course where I can learn more about ROR? I have a pretty solid knowledge about programming(PHP, C, C++, Objective-C) and I am getting really excited about ROR lately.

<comment><USER30> [http://ruby.railstutorial.org/ruby-on-rails-tutorial- book](http://ruby.railstutorial.org/ruby-on-rails-tutorial-book)</comment></comment>


Intertwingularity (Ted Nelson) - <AUTHOR> https://en.wikipedia.org/wiki/Intertwingularity <comment><AUTHOR> Working at UCLA I have an affinity for Ted Nelson and the early life of the Internet. I am also deeply interested in his ideas related to the interrelations in human knowledge. Perhaps I am a lover of things not celebrated (I sometimes work off an early version of the GNU Hurd and an OpenVMS system) but I feel he has ideas that actually should be. O'Reilly had a great article recently that invoked Ted Nelson I enjoyed:

 _The Intertwingularity is near: When humans transcend print media_

[https://www.oreilly.com/ideas/the-intertwingularity-is- near-...](https://www.oreilly.com/ideas/the-intertwingularity-is-near-when- humans-transcend-print-media)</comment>


The first global civil war - <AUTHOR> http://falkvinge.net/2013/08/28/the-first-global-civil-war/

<comment><USER2> I can't help but think how naive the OP sounds, with statements like these:

> _40 years ago, two journalists showed the world that the president of the > most powerful nation used the Secret Services to wiretap his political > opponents. This investigative work granted them the Pulitzer Prize and led > to the resignation of the president._

First of all, winning the Pulitzer Prize doesn't validate journalism. It's a prize given by journalists to journalists, and despite what the OP thinks of today's investigative journalism, journalists are still giving each other Pulitzer Prizes for investigative work, so not sure why he uses it as some kind of metric.

Second, I'm not familiar with all the details of Watergate, but I don't remember it being a scandal involving the Secret Service.

Details, details, I know. But the OP approaches this issue with incredible wide-eyed naivete, with no real knowledge of what's happened in the past. I'd hate to think what kind of jaded essay he'd write if he really studied world history pre-2001.

<comment><USER3> His division between an entrenched 'class in power' and a utopian ideal consensus-seeking liberal 'digital generation' also seems like a bit of a fantasy, which he admits - "Despite the popularization of tools such as Twitter or smartphones, this divide was not resolved. Instead, it only gets worse."

Yet even accepting strong evidence that his world view is at least flawed, and more likely completely fanciful, this doesn't in any way stop him from persisting in vigorously applying it to everything that's happening around him.

Watergate was a clear case of a president implicated in patently illegal acts. In contrast, the NSA's activities were overseen by a court and a few self- confessed infractions aside were entirely legal. We can argue whether they should be legal, or whether the legal framework is constitutional etc, but everyone involved in the NSA's activities can honestly and truthfully claim they had very good reason to believe what they were doing was legal. I'm not supporting what they were doing in any way, but there's simply co comparison whatever between the Snowden case and Watergate.

Comparisons with Ellsberg and the Pentagon Papers are far more apt, but if it wasn't for the FBI's inept and illegal harassment and wiretapping of Ellsberg fatally tainting the prosecution's case, it's quite likely Ellsberg may have faced a prison sentence just as much as Snowden might. Certainly there's no particular reason to think that prosecution of Snowden is unprecedented. Furthermore the harassment of the press relating to Snowden's revelations has largely taken place outside the US. Within the US the press is publishing away with little to no legal restraint or obstruction and until a journalist in the US actually faces prosecution or restraint over the affair, rumblings about such being in the works are just noise.

<comment><USER4> We all know the British Intelligence lives to please the American Intelligence for all the funding they get. It just happens that British law offers more flexibility to the so they can pull this crap off. And this is one of their "selling points" as they like pt point out all the time.

Given this very close friendship and their ability to spy on American People since their not US agencies it is not far fetched to think the US is involved.

The only thing preventing the Intelligence Agencies from ruling the world is just a few laws that they are desperately attempting to change by bringing up the terrorist threat every time they get the chance.

</comment></comment></comment><comment><USER5> I wish Obama's Nobel Peace Prize would be retracted. He never deserved it, and he deserves it now less than ever. It would send a strong message that you can't just bullshit your way into the presidential office of the world's strongest nation, as a champion of civil liberties and peace, and then do the _exact opposite_.

I support his impeachment for the very same reason. In a way, I almost hope he intervenes in Syria despite a vote against in Congress (hopefully), if that means his impeachment will be inevitable - even though I care about him getting impeached over the NSA surveillance state a lot more than him getting impeached over Syria, but I know there's a lot smaller chance to impeach him over that, so I'll take whichever reason works best.

<comment><USER6> I'd like you to at least consider a far scarier possibility: Obama is not in fact in charge of the country.

This perspective really helps me understand the last, say, 20 years of US history. Your mileage may vary.

<comment><USER7> This should help you understand the past 230+ years of American history, because it's by design that the President is not "in charge" of the country. (And it's a pretty good design.)

</comment></comment></comment><comment><USER8> I think it is a bit too far into the right direction. But it seems to me that nowadays everybody outside of the halls of power seems to be unhappy with the lunatics who run the asylum.

</comment><comment><USER7> We are not at war. Jesus Christ. Have some historical perspective.

</comment><comment><USER9> This website looks like a bastion of sanity and rational debate.</comment>


Four lines of code for The New York Times' paywall - <AUTHOR> http://www.niemanlab.org/2011/03/that-was-quick-four-lines-of-code-is-all-it-takes-for-the-new-york-times-paywall-to-come-tumbling-down-2/ <comment><USER2> Am I the only one who assumes the NY Times considered the futility of trying to stop every single 2000-bit hack and is rather trying to change the way intelligent consumers of news and culture with disposable income approach the Times, and perhaps quality content generally, online.

I think they've done a fair job of trying to handhold users through the transition. I expect the success or failure of the paywall not to depend on the fact of the paywall itself (obviously), but on how easy and frictionless they'll make it to pay. If they can make it graceful enough, I will happily pay for content I know there are loopholes for accessing. If it's a clusterfuck, as with other DRM schemes, I'll either seek out the leaks or give up.

I'm hoping they've adopted something like this approach, a slightly more rigorous version of the NPR pledge model, and are relying on the goodwill and intelligence of their readership and not its stupidity.

<comment><USER3> I assumed they want to see how people will react (they are in essence A/B testing Canada vs the USA). And that they're oping that people will end up using the service more or less as intended.

It's an interesting experiment, I read more than 20 articles from NYTimes.com a month, but I don't need more than a few. If the blogosphere starts pointing to the BBC instead, I'll end up reading that.

I should probably mention that it's my code (if we can call it that) we're talking about. The traffic is killing my blog now, but I a few hours ago made it out of curiosity if I could hack that (it was 20 minutes all in).

</comment></comment><comment><USER4> The javascript: <http://toys.euri.ca/nyt.js> (which is really 3 lines).

The NYT does have a really hard problem to solve though. How do you securely police the "20 free articles a week" system if you can't trust cookies, can't put validation on the page itself, and ip addresses change all the time without requiring even a free account to read the content?

They are trying to come up with a modern pay solution to journalism and for that I give them props. It's not going to be an easy road though.

<comment><USER5> _How do you securely police the "20 free articles a week" system if you can't trust cookies, can't put validation on the page itself, and ip addresses change all the time without requiring even a free account to read the content?_

You assume that the number of people with the ability and desire to circumvent your defenses is a small fraction of your total audience, and ignore them.

<comment><USER6> In other words, exactly the same way you deal with AdBlock on your ad- supported website.

</comment></comment></comment><comment><USER7> I just realized that since the NYT paywall is copy protection, View Source on the NYT is now illegal.

<comment><USER8> _> ... is now illegal._

In a certain country, you may want to add.

Some people are arguing whether the country in question is more of a representative republic or of a democracy ((guess that's enough of snarkiness for one short post)).

<comment><USER9> It's actually a pretty long list of countries that have signed that treaty.

<comment><USER10> Yes, he forgot to add that the imperialistic country in question tries hard to push its draconian ideas about copyright to the rest of the world. Spread the hurt...

</comment></comment></comment></comment><comment><USER11> And if this fails, "referer: <http://google.com/search?q=totallyfake> " works just as well.

</comment><comment><USER12> It was clearly designed to be easy to hack, so they are not afraid of that. What they've really done is set a premium price on their content. Whether people pay it or not, everyone will now feel like the NYT is very high quality. That seems to be the intent.

</comment><comment><USER13> Has anybody done the math to figure out how many people they'll need to sign up for this thing in order to break even?

They seem to have spent $40M building it and dropped their stock price 3% on the first day it was live. That's a lot of $40 annual subscriptions just to cover the cost of putting it in place.

</comment><comment><USER14> They'd setup a method of preventing right-click save of images not that long ago, replacing the image's referencing URL with a small blank block. Easily overcome by viewing source, but still was the new start of their effort to protect the content a little more.

</comment><comment><USER15> Messy Javascript code, indeed. Nice work-around.

</comment><comment><USER16> Curious as to what this was.

<comment><USER17> I'm assuming you're referring to the site being non-responsive? Try searching Google for "cache:url" :)

<comment><USER3> Assuming it's my blog that we're referring to, I mirrored the relevant bits on the slice that hosts the static files: <http://toys.euri.ca/></comment></comment></comment>