MongoDB should not be part of a stable release - <AUTHOR> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=916107 <comment><USER2> > we will not distributing any SSPL-licensed software

Makes sense to me, attempts at limiting commercial use make software non-free.

</comment><comment><USER3> I just hope CockroachLabs doesn't come up with a dick move like the MongoDB SSPL license, it would really hurt me since I've been selling the thing and using it in all my new projects. I can't imagine the frustration of the Mongodb users right now.

<comment><USER4> But then Amazon can just release a cheaper replacement called InfestationDB.

<comment><USER3> I think in such case AWS would be implementing Spanner/F1 directly using Postgres protocol and I'm sure that like Google Spanner itself, it won't be cheap.

For the rest of us we can start using CockroachDB from day zero hoping to get big enough to someday need Enterprise features.

</comment></comment></comment><comment><USER5> Now AWS copied MongoDB API without fees anyway, maybe MongoDB can revert their license back?

<comment><USER6> They can still try to shake down GCP and Digital Ocean.

<comment><AUTHOR> Does DigitalOcean count though? I thought the SSPL was in regards to offering a database as a service vs offering an OS that you can host the database for yourself in like DigitalOcean does.

<comment><USER6> Digital Ocean is growing up. K8saaS today, probably DBaaS tomorrow.

<comment><USER7> Postgres based dbaas is in beta right now

</comment></comment></comment></comment></comment><comment><USER8> so, for the license experts out there, what's the difference between AGPLv3 and SSPLv1

<comment><AUTHOR> From:

[https://www.mongodb.com/licensing/server-side-public- license...](https://www.mongodb.com/licensing/server-side-public- license/faq#difference)

> What specifically is different between the GPL and the SSPL and what will it > be called?

> The new license will be called Server Side Public License (SSPL)

> The only substantive modification is section 13, which makes clear the > condition to offering MongoDB as a service. A company that offers a publicly > available MongoDB as a service must open source the software it uses to > offer such service, including the management software, user interfaces, > application program interfaces, automation software, monitoring software, > backup software, storage software and hosting software, all such that a user > could run an instance of the service using the source code made available.

> Section 13 of the SSPL reads as follows:

> "If you make the functionality of the Program or a modified version > available to third parties as a service, you must make the Service Source > Code available via network download to everyone at no charge, under the > terms of this License. Making the functionality of the Program or modified > version available to third parties as a service includes, without > limitation, enabling third parties to interact with the functionality of the > Program or modified version remotely through a computer network, offering a > service the value of which entirely or primarily derives from the value of > the Program or modified version, or offering a service that accomplishes for > users the primary purpose of the Software or modified version.

> "Service Source Code" means the Corresponding Source for the Program or the > modified version, and the Corresponding Source for all programs that you use > to make the Program or modified version available as a service, including, > without limitation, management software, user interfaces, application > program interfaces, automation software, monitoring software, backup > software, storage software and hosting software, all such that a user could > run an instance of the service using the Service Source Code you make > available."

So the license is closest to GPL than anything.

<comment><USER9> > So the license is closest to GPL than anything.

That's not close to GPL at all. GPL is "if you use our software and modify it and distribute the modifications, you must do it as open source". AGPL is "same as GPL only you must also publish modifications if you're just using it". SSPL is "if you touch our software you must open-source your whole data center". The message here is clearly "don't ever touch our software unless you're already 100% open source shop". GPL never went this far, and for a good reason - nobody in commerce would touch GPLed software with a ten-foot pole if that was the case. People are wary of GPL, but SSPL is taking it to insane length, clearly construed to disable, not enable, it's use.

<comment><USER10> SSPL is basically trying to say we are open source unless you make money, in which case pay us or you need to be open source(not the kind of open source we are, the actual kind). And at the end of the day it just means that they aren't open source anymore, they are a proprietary shop who lets hobbyist see their source code.

</comment></comment></comment></comment><comment><USER11> If you're using MongoDB nothing is stable /s

</comment><comment><USER12> Discussion about the SSPL and the DFSG: [https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=915537](https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=915537)

</comment><comment><USER13> I understand why distributions are dumping projects due to licensing changes but haven't seen any (incl Debian/Fedora) to ever dump a project for severely violating basic security[1]. kudos though to Debian for displaying a giant warning in case you wish to continue running minissdpd[2].

[1] I would like to be proven wrong though!

[2] [https://unix.stackexchange.com/questions/155154/i-stopped- mi...](https://unix.stackexchange.com/questions/155154/i-stopped-minissdpd- will-something-bad-happen)

<comment><USER14> Maybe you should use openbsd instead of debian if that is your primary concern.</comment></comment>


Google to default to SSL version for logged in users - <AUTHOR> http://googleblog.blogspot.com/2011/10/making-search-more-secure.html <comment><USER2> Too bad Google is also preventing the rest of the web from also being secure as any AdSense-supported website can't have ads and SSL at the same time.

[https://www.google.com/adsense/support/bin/answer.py?hl=en&#...</a>

<comment><USER3> That's what I came here to say as well. The failure to provide an SSL version of AdSense is one of the biggest impediments to the implementation of SSL-only sites on the net currently. Until they fix that, they are not entirely serious about this.

</comment></comment><comment><USER4> This is a big deal. There are entire businesses built on this default (e.g. Compete.com's competitive keyword sniffing, or to some extent DDG's role as 'the good guy').

Seems like this will mean hugely asymmetrical information about search queries -- Google will still see all Google queries, but nobody else will.

This might also prevent even toolbars from seeing this stuff (remember when Google and Bing went tete-a-tete over that issue?).

<comment><USER5> Adwords customers still get the data: "If you choose to click on an ad appearing on our search results page, your browser will continue to send the relevant query over the network to enable advertisers to measure the effectiveness of their campaigns and to improve the ads and offers they present to you."

<comment><USER6> They'll still get the paid keyword data, but it's going to be more difficult to figure out what keywords you need to pay for when you don't have a good picture of your organic traffic.

<comment><USER7> Yeah, i guess this could be a play to get more people to run more speculative campaigns to test the waters instead of letting organic do it.

</comment></comment></comment></comment><comment><USER8> Just to clarify what this means to web masters - expect to see a decline in some of your highest volume keywords, and a jump in keyword reports for "(not provided)" (i.e. search traffic remains the same, but a greater portion of visits is grouped in "keyword unknown" or similar)

<comment><USER9> If you're taken from one https to another https location, doesn't referrer still get passed? So possibly what it means is that you need to implement SSL. Google's choice here will hopefully motivate change around the web.

<comment><USER10> > If you're taken from one https to another https location, > doesn't referrer > still get passed?

It depends. For Gecko, that's a configuration option (defaulting to "send cross-site" at the moment, but subject to change in general).

And as others have pointed out, sites using AdSense can't very well "implement SSL".

</comment></comment></comment><comment><USER11> IIRC, (most?) browsers will still send the referrer (sorry, "referer") if you're going HTTPS->HTTPS, so if your your site is using SSL, you'll still get to see the referral data, wouldn't you? Whereas HTTPS->HTTP won't send referrer data and businesses would lose valuable information.

Perhaps this provides an incentive for sites to start serving HTTPS-Only, or at least showing Google only the SSL version (e.g. showing rel='canonical' with the HTTPS link). On the other hand, Google is still disincentivizing use of SSL through AdSense, which I believe is still HTTP-Only.

Even with the AdSense disincentive, it could still help. Knowing your referrer keywords is much more important to businesses than AdSense, and it's a very good thing for a site that wants my money to be served by HTTPS-Only, since you can MITM a site easier if there are _any_ HTTP-Only pages on said site.

Sites relying heavily on AdSense, OTOH, would be more likely to be ad- supported rather than product sales-supported, and thus would have less need to be fully secured, since you're less likely to enter sensitive information there (excepting, of course, people who stubbornly reuse the same password everywhere).

I'd like to see this lead to a push of vendors who both sell a product _and_ use AdSense to demand Google support SSL for AdSense, since they would need both referrer data _and_ AdSense to survive. Once Google cracks and adds SSL support to AdWords, smaller sites will be more inclined to offer there content as HTTPS-Only.

It's a step in the right direction, at least.

<comment><USER12> _> the referrer (sorry, "referer")_

It isn't even an americanism, its a straight-up misspelling.

Every time I have to type it I die a little inside.

[http://en.wikipedia.org/wiki/HTTP_referrer#Origin_of_the_ter...](http://en.wikipedia.org/wiki/HTTP_referrer#Origin_of_the_term_referer)

<comment><USER13> English is a living language. If that's how people start spelling the word, then that is how the word _is_ spelled.

I know, you get far more entertainment for your buck complaining, but even so, who cares?

Side note: many things commonly refered to as "americanisms" cannot be _accurately_ described as such. See color/colour. Pedants beware.

<comment><USER14> This isn't a bunch of schoolchildren inventing new words or some literary movement to change the spelling of a class of words. This is one mistake by a dude who wrote something years ago that now everyone has to duplicate. It is a terrible example of "living language".

<comment><USER15> Is it? When I'm writing about somebody who refers another person somewhere, I use "referrer." When I write about HTTP headers, I use "referer," even outside of code (i.e. in chat or prose). They're distinct concepts that now have distinct (but homophonic) words.

</comment></comment></comment></comment></comment><comment><USER16> I think this is the most interesting part: "websites you visit from our organic search listings will still know that you came from Google, but won't know the exact query."

I wonder if Google Analytics will still list the queries. (They mention that Google Webmasters' Tools will give the top 1000 queries, but not individual results.)

<comment><USER17> Not for signed in users: [http://analytics.blogspot.com/2011/10/making-search- more-sec...](http://analytics.blogspot.com/2011/10/making-search-more-secure- accessing.html)

      To help you better identify the signed in user organic
      search visits, we created the token "(not provided)"
      within Organic Search Traffic Keyword reporting. You
      will continue to see referrals without any change; only
      the queries for signed in user visits will be affected.
      Note that "cpc" paid search data is not affected.

This will make it much more difficult to measure organic search marketing efforts, but for Google, this should encourage more investment in paid marketing campaigns to measure keyword effectiveness.

<comment><USER18> ...so I no longer get to see which queries brought users to our site? (we get a lot of organic search results, not from spam, but reasonably) Ouch.

</comment></comment></comment><comment><USER19> This is nice, because I hate all the spam sites that take your Google query and put it in the text of the page somewhere. Before long, the spam page attracts hits for that query because the page now contains that exact text. By hiding your search from the site that you're visiting, they can't do this anymore.

I've always disabled cross-site referers because it's none of anyone's business how I got to their site. This seems to be the way the winds are blowing now.

<comment><USER20> It occurs to me that I haven't landed on a page that did that for a long time. Maybe I just don't notice anymore, or I'm better at not clicking through to them, but perhaps google has mostly killed that trick.

</comment></comment><comment><USER21> This sets a good precedent. It will provide more thrust towards making SSL the default communication mode.

</comment><comment><USER22> Correct me if I am wrong, but this could have pretty big implications for people tracking query terms on anything that has been self created (for SEO purposes etc). Other analytics packages (self-rolled/3rd party) won't have near the amount of data that Google Analytics will correct?

<comment><USER12> Referer headers are still sent when you go from one SSL page to another. So, the greatest impact of this development will actually be to force the rest of the web to use SSL, because they need it for analytics.

<comment><USER23> My reading of it has them blocking referrers even if the target page is https. See: [http://searchengineland.com/google-to-begin-encrypting- searc...](http://searchengineland.com/google-to-begin-encrypting-searches- outbound-clicks-by-default-97435)

<comment><USER24> Your use of "them" is a bit unclear.

The browser decides when to send a referrer, not Google. You can, for instance, tell your browser never to send them, or to send a specific one.

<comment><USER25> Google could wipe the referrer, though.

<comment><USER24> They can create a bounce page, but they have no control over what referrer actually gets sent. The browser, not the website, sends the referrer.

<https://secure.wikimedia.org/wikipedia/en/wiki/HTTP_referrer>

In HTML5 you can apparently request that a referrer not be sent, but that's a request, not a command.

</comment></comment></comment></comment></comment></comment><comment><USER26> What this also does, and they won't mention this, is get their cookies through your firewall filter because they are encrypted and cannot be read except direct by your browser.

This is why I use https for gmail and http for search. But I guess I have to use browser based filtering now.

<comment><AUTHOR> Which cookies in particular? Tracking cookies?

If so, why not use one of the opt out plugins, rather than search over http?

</comment></comment><comment><USER27> > If you choose to click on an ad appearing on our search results page, your > browser will continue to send the relevant query over the network to enable > advertisers to measure the effectiveness of their campaigns and to improve > the ads and offers they present to you.

What's interesting to me is they have a double standard: if you pay for placement, you'll get keyword data. If it's organic placement, you won't get keyword data.

I have no opinion, just thought it was interesting.

</comment><comment><USER28> Grateful for this. This will help protect my friends and family who have no idea what they are doing or what information gets sent over the wire/air.

</comment><comment><USER29> I predicted this change in February... [http://tompitts.org/external-search- keyword-data-living-on-b...](http://tompitts.org/external-search-keyword-data- living-on-borrowed-time/)

It will also stop other search engines like Bing from utilizing keyword referral data in their search algorithms.

</comment><comment><USER30> Unless I'm missing something this doesn't apply if you enter a search in the browser's search bar, only if you visit google.com

Of course you can manually change the search bar settings in most browsers to use encrypted.google.com.

<comment><AUTHOR> if you are using the default search in chrome, I am sure that google will update it to be the encrypted by default. If you manually change to the unencrypted version, it'll likely stay that way. Pure conjecture, but really likely, in my opinion.

</comment></comment><comment><USER31> first wikipedia: [http://en.wikipedia.org/wiki/Wikipedia:Wikipedia_Signpost/20...](http://en.wikipedia.org/wiki/Wikipedia:Wikipedia_Signpost/2011-10-10/Technology_report), now google.

</comment><comment><USER32> Can HN do this too?

<comment><USER11> HN is already set up for SSL; the changeover happened around two months ago[1].

If your concern is that you should be forced to the HTTPS site, even if you mistype or bookmark the wrong version, etc., then you could try the EFF's HTTPS-Everywhere extension (Firefox only. I'm told Chrome's extension framework is fundamentally incompatible right now).[2] If you've noticed a lot of comments have linked to, for example, Wikipedia using a "secure.wikimedia.org/wikipedia" type URL, this extension is very likely how they got that way.

Out of the box, there is no ruleset preconfigured in HTTPS-Everywhere for HN, but the top comment[3] on the HN SSL announcement/discovery post gives a rule for it to configure it to always force HN to SSL.

[1] - <https://news.ycombinator.com/item?id=3126309>

[2] - <https://www.eff.org/https-everywhere/>

[3] - <https://news.ycombinator.com/item?id=2909103>

<comment><USER32> Ah, thanks. I missed that, and haven't checked in 2 months.

I actually have HTTPS Everywhere, but it didn't find it for the reasons you mention.

If anyone at HN is reading, the certificate doesn't work if you visit via news.ycombinator.org (vs .com). It would probably be better to just make that a redirect to .com, rather than what appears to be an alias.

</comment></comment></comment><comment><USER33> I wonder if this data will be available in the $100k+ a year Google Analytics Premium product they announced a couple weeks ago. [http://analytics.blogspot.com/2011/09/introducing-google- ana...](http://analytics.blogspot.com/2011/09/introducing-google-analytics- premium.html)

</comment><comment><USER34> May be google make an incentive for users to sign-in for increasing Google+ usage.

May be they are pushing Adwords channel by saying: "look you can arrange your campaigns in keyword level."

It's interesting to see this decision while they are improving Google Analytics very much lately. Maybe they will monetize by subscription model.

</comment><comment><USER35> One more step along the way of making google the all knowing entity and slamming the door shut on everybody else that would like to go the same way.

Now if they would please allow adsense ads on ssl served pages elsewhere it would actually make some sense.

</comment><comment><USER36> Google used to redirect the clicks, not aggressively before. But now since it is going to be a default behavior, i think google is aggressively using user clicks as the variable for their ranking.

</comment><comment><USER7> Going from secure to non secure currently doesn't even give an indication that Google is sending the traffic, am I missing something?

<comment><USER7> Actually it seems <https://encrypted.google.com> does this, simply acting as https to http normally would. Where as <https://google.com> refers you through a http intermediate and simple sends across an empty query string.

</comment></comment><comment><USER37> HTTPS = more overhead than HTTP, so this is going to increase network traffic everywhere that uses Google that has people logged in for Gmail, which is just about everywhere to some extent. It will be minor, but could still have a detrimental effect.

<comment><USER38> > _HTTPS = more overhead than HTTP_

Is that true? Most encryption schemes include compression (since compression removes redundancy, and redundancy is where cryptanalysts attack).

<comment><USER39> And I guess if you use chrome(ium), you're already using an encrypted channel with SPDY anyway.

</comment></comment></comment><comment><USER40> I wonder if this is at all due to duckduckgo, and some of the issues they have championed (and generated news around).

<comment><USER41> I very much doubt it. Facebook, Twitter, and a number of other major web properties have been making moves toward more HTTPS usage. As of this month, for example, Facebook is requiring all FB app developers to have an SSL certificate for their app URLs. There are much better reasons for the switch than a niche site unknown outside of the techie community.

</comment></comment><comment><USER42> That security has significant price tag attached to it: Losing search query information would degrade usability on receiving web sites.

Currently my web site highlights keywords that user was searching for on Google. It will be impossible anymore for users who logged in to Google.

Is it possible to opt out from SSL search on Google?

<comment><USER43> I hate sites that highlight search keywords. I am sorry that this broke your feature, but overall glad that no site will be able to do it anymore.

<comment><USER42> Do you hate using Google search results too?

Search keywords in these results are highlighted.

If your goal is to hide your intent from web sites you visit - you can just turn off URL Referrer in your browser.

<comment><USER44> It's a rare search that takes me to a page that mentions what I'm searching for exactly once.

Search result pages and destination pages serve completely different purposes, and you can't apply the same UI to both. If you ran a restaurant, you might decide to laminate the menus, but I hope you wouldn't laminate the entrees, too.

<comment><USER42> If it doesn't make sense to highlight search keywords that web masters wouldn't do that would they?

Highlighting "salmon" menu entries on web site could make sense for the user who is searching for "salmon", wouldn't it?

But let's be more specific: I run a job board (PostJobFree) and recruiters frequently find resumes on Goolge in queries like this:

[http://www.google.com/search?q=intitle%3Aresume+sharepoint+C...](http://www.google.com/search?q=intitle%3Aresume+sharepoint+C%23+memphis)

If you open first result - you can see how these keywords are highlighted. I'm pretty sure that this highlighting is a convenient feature for recruiters who want to quickly scan resume.

<comment><USER45> Ugh, you really need some basic formatting. I can't even see where one job ends and another one starts. And the contextless highlight doesn't make that any better.</comment></comment></comment></comment></comment></comment>


Any demand for experienced java freelancers? - <AUTHOR>

I recently started looking to do some java freelance work to make some cash on the side. I like to think I'm a pretty experienced dev. However, on freelance sites, it always seems like a race to the bottom. Where can I find jobs that require someone with an experienced/large skillset? <comment><USER2> There's definitely demand, and you should be able to get decent wedge if you're any good at it. The reason why there's a race to the bottom on freelance sites is precisely because there's demand: a large number of people who are just in it for the money, rather than a love of programming, choose java because it's popular.

To get your day rate up, though, you're going to have to build up your own network, so that you're not competing against everyone else on the freelance sites. Check out Brennan Dunn's books/blog/email list. [1][2]

If you're good and get the right connections, you should be able to get up towards that $100/hr mark. To get beyond that, you really need to be able to point to a bank account and say, "because of me, there's more money there." See patio11 [3]. At that point, language is far less relevant - and in fact, I'd hazard a guess that Java is a particularly difficult language to do that with (because it tends to be more backend rather than front-end, but that's an unsubstantiated gut feel.)

[1] <http://doubleyourfreelancingrate.com/> [2] <http://brennandunn.com/> [3] [https://training.kalzumeus.com/newsletters/archive/consultin...](https://training.kalzumeus.com/newsletters/archive/consulting_1)

</comment><comment><USER3> Odesk (and others) are depressing; freelancers here (north EU) cannot even live of the money generally paid on them. So the friends who are working on there usually try to avoid the hourly paid projects and do 3-4 at a time to boost to $75/day which, with the considered risks and utilization of freelancers is kind of the minimum. Even for jobs without any/much bidders (vague things I'm good at like a Haskell, Erlang and Prolog) the price point is pulled down to a point where it's not worth it.

For Java (which I have 15 years fulltime experience with including backend and frontend frameworks)/C# and iOS/Android the freelance sites are infested with $5/hour workers from the east who will not finish anything, write crazy unreadable code and most of them also do 3+ jobs at the same time, making sure you get the lowest grade. Exceptions are there, but I have done outsourcing for many years and the 'start you off with a senior to get you in and then replace with a junior who cannot do anything' is more normal and the reason we stopped doing it all together.

I am trying to use danielstudds advice here as well, but find it hard. All promises of 'premium freelance' sites never worked (while my gut says it still should by the way; site with rigorous intake with a minimum level of acceptance (if you have no talent at all then go fix that elsewhere first), having a panel of experts in different development areas who interview and assess you every 3 months and set your level(s) and price goals).

And i'm a social animal but I unfortunately hang out most with coders who 'already made it' (and don't care about work and have no connections anymore of that kind) or academic researchers (I would go for a position like that the rest of my life, but my credentials aren't good enough to say that I want to sit on a mountain working on formal methods and programming languages) or artists.

Good luck to fellow searchers.

</comment><comment><USER4> This thread interests me as well. Java is the acquire currency language currently - it would be nice to leverage an advanced knowledge level for something beyond the 25$ an hour rate you see on odesk or freelancer.

</comment><comment><USER5> Hi,

Please contact me at firstname.lastname@example.com. We might have sth for you.

</comment><comment><USER6> What is it that distinguishes a "Java freelancer" from other programmers? Java is just another programming language. Why do you limit yourself to Java? And what does that tell us about you?

Good programming does not have a lot to do with the particular programming language involved, IMHO.

<comment><USER7> I'm inclined to disagree with this comment: The OP is simply saying that they have a developed skill-set and expertise with Java. This goes a very long way about saying who they are. I can assume they have good working knowledge of the Java language in addition to some great tool sets. Lastly having a specialty is never a bad thing.</comment></comment>


Google's meetings with UK Government over driverless cars revealed - <AUTHOR> http://www.telegraph.co.uk/technology/google/12046720/Googles-meetings-with-UK-Government-over-driverless-cars-revealed.html <comment><USER3> ./drive_yourself --side-of-the-road=left

Let's hope there weren't any assumptions baked in as to which side of the road you have to drive on. Google is absolutely right to start testing in all modes of driving, the UK (and the other countries where you drive on the left side of the road) are a major concern for auto manufacturers targeting those markets because of the need to switch over the steering wheel and pedal box. This causes all kinds of headaches (for instance, the steering housing turns the other way, you can't just flip that) and I imagine that if taken for granted that 'it will work' software will contain all kinds of subtle issues that might lead to trouble.

<comment><USER4> I'm interested to see how self driving cars handle single roads with passing places - there are a fair amount of these here in Scotland and non-locals sometimes cause chaos when they don't quite understand the rules and conventions. NB I'm pretty sure self driving cars _will_ handle them OK - <USER2> interested to see how they will do it.

<comment><USER5> There's lots of 'randomness' from the historical nature of our roads that I suspect it would be hard for a self driving car to deal with. Mostly I suspect they'd end up being overcautious where real drivers need to be a bit more aggressive to actually progress.

That's definitely the case in London for example (possibly one of the most stressful places to drive), where you could easily be stuck at a junction for an extremely long time unless you inch out and kind of force the other drivers to give way.

Other issues that I thought about the other day whilst driving around Leicester is poor road markings. The Leicestershire region in particular have let their markings go to pot (I've noticed this in other places in the UK too) to the point where even I as a human driver struggle to know where the lanes are. What would a self driving car do in that situation?

Then there are the 1 car wide country lanes that are national speed limit but actually have two-way traffic. I wouldn't want a self-driving car thinking it's OK to go 60 mph down one of those roads even though that's the allowed speed limit. And could it safely mount the verge or plan to be in one of the few sidings that allow it to pass other cars?

I reeeally hope the self-driving cars can be taught to deal with the complexities of the UK road system, I desperately want this to work. Although I like driving, it's mostly tedious in the UK now due to congestion and the big-brother speed camera network. The government expects us to act like robots when we drive, so actually getting a robot to drive would be perfect.

<comment><USER6> I would expect these cars would simply have override-mode for the most complex situations.

<comment><USER3> Then they would not be 'self driving cars'. A whole pile of the possible applications for self driving cars hinge on the ability of the car to operate independently. If a licensed operator needs to be present then a very large number of the self driving car advantages instantly evaporate.

<comment><USER4> Particularly the question of having a drink and getting your self driving car to take you home afterwards...

</comment></comment></comment></comment></comment></comment><comment><USER7> I wonder how driver-less cars will fair here in London, while I would prefer a computer over many humans. To drive in London (which is tame compared to some European and Eastern cities). To drive you do need a certain amount of aggression; for instance, if you wait for a gap when turning onto a main road you could be waiting a long time. There's a thin line between being assertive and being a d..k.

</comment><comment><USER8> If a vehicle is approved in the UK I'm assuming it would have to be geo-fenced to stop me going into the rest of Europe. Either because it wasn't approved or because it didn't know how to cope with country specific road conditions, e.g. Priorité a droite in France.

<comment><USER9> If I'm not mistaken, UK has "priority to the right" even though they drive on the left side.

<comment><USER10> Not quite sure what you mean but roundabouts work by giving way to your right plus a bit of a mexican standoff if you all arrive at a mini one at the sametime.

Other than that I can't think of anything special about the right. Or left for that matter. You should only overtake on the right but that's not a law it's just in the highway code. But you can only find room to undertake on a motorway anyway.

<comment><USER11> There's no Wikipedia page for "Priorité a Droite", but it's an internationally known, if mysterious, aspect of the rules of the road in France. It doesn't have a counterpart in the UK as far as I know.

Here's an unreliable source: "The overriding rule of the road in France is Priorité a droite which basically means that you must give way to traffic coming from your right. It is an archaic law that dates back to the times of the horse and cart and for some unknown reason has never been repealed. It is true to say however that the French have spent thousands of millions of Euros to indicate that it does not apply in most circumstances. We have tried to explain some of the mysteries surrounding this law, but the old driving proverb is very apt here. "if in doubt put both feet out" i.e. Slow down or stop."

From [http://www.vendee-guide.co.uk/priority-a-droite.htm](http://www.vendee- guide.co.uk/priority-a-droite.htm)

(That's not good advice, obviously, as if it was the only principle you knew it would lead to hopelessly tentative driving.)

A slightly more comprehensive source: [http://www.france- pub.com/forum/2012/04/14/la-priorite-a-dro...](http://www.france- pub.com/forum/2012/04/14/la-priorite-a-droite%E2%80%8E-priority-to-the-right/)

<comment><USER12> I believe that Priorité a Droite was actually formally phased out in France about a decade ago, but I cant find a source.

<comment><USER13> It exists in Norway, there are two roadsigns for it, one is [https://upload.wikimedia.org/wikipedia/commons/thumb/9/9f/No...](https://upload.wikimedia.org/wikipedia/commons/thumb/9/9f/Norwegian- road-sign-206.0.svg/120px-Norwegian-road-sign-206.0.svg.png) and the "stop doing it now" is the same with a black line accross it.

<comment><USER14> The sign [https://upload.wikimedia.org/wikipedia/commons/thumb/9/9f/No...](https://upload.wikimedia.org/wikipedia/commons/thumb/9/9f/Norwegian- road-sign-206.0.svg/120px-Norwegian-road-sign-206.0.svg.png) means that you are on a priority road and that you should not give priority to traffic coming from the right!

The black line through the sign means that you are no longer on a priority road and now need to give priority.

<comment><USER13> same same drive with a snowplow and they stop for you

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> I think this is to test the car on UK roads</comment>


Airmash – a game that refused to die - <AUTHOR> https://www.janwillemboer.nl/blog/posts/2019-11-airmash-history/ <comment><USER2> Since Airmash was released on HN, this is as good as any place to put out a message for the original developer -- we love your work! Is there any chance we could continue it more officially in your stead?

There have been a ton of ideas floating around in-game since almost forever. I think by now most of them appear at [https://github.com/airmash-refugees/game- ideas/issues](https://github.com/airmash-refugees/game-ideas/issues) .

The biggest issue is that no free frontend exists, and even if it did, some aspects of reimplementing both backend and frontend have interesting problems, such as in the functions to calculate trajectories and the data they use. There is no way to replicate the original Airmash without preserving almost exactly this code. It would be amazing to receive your blessing at least to borrow these aspects.

\-- (every Airmash addict ever, especially those racking up hours almost every day even after the official server died)

<comment><USER3> I second this call!

</comment></comment><comment><USER4> For anyone who wants to play, Airmash lives on at [https://airmash.online](https://airmash.online) and [https://starma.sh](https://starma.sh)

It's been a great community effort in keeping it alive, thank you to everyone who has contributed!

<comment><USER5> Nice seeing this here!

Also: [https://starma.sh](https://starma.sh) for the Starmash version :)

<comment><USER6> Hey bombita, /dev/null over here. :)

<comment><USER5> Hey dev! I had fun playing for a while today, and I saw several players of old playing! And even enjoyed a CTF match =) It was a very nice and nostalgic day!

</comment></comment></comment></comment><comment><USER7> HN hug of death!

Archive link: [https://web.archive.org/web/20191130223010/https://www.janwi...](https://web.archive.org/web/20191130223010/https://www.janwillemboer.nl/blog/posts/2019-11-airmash- history/)

<comment><AUTHOR> I totally admit I wasn't prepared for this. Mirror here: [https://github.com/spatiebot/airmash- history/blob/master/REA...](https://github.com/spatiebot/airmash- history/blob/master/README.md)

<comment> your-nanny thank you for writing this history up. I am a regular but never really got involved in the effort to revive (except to announce it's return 10 months ago on HN)--I didn't really know the story.

</comment></comment></comment><comment><USER8> Oh boy, this was an addiction. Just the right mix of classic - Subspace/Continuum - gameplay with the ease of access of a browser game. It felt good to play a game I was half decent at, too. Wrote a Python API, started a Discord server and then life got in the way. Good times, though!

Edit: It's a little dead these days, but- [https://discord.gg/cPVDwRa](https://discord.gg/cPVDwRa)

</comment><comment><USER9> The original Show HN was [https://news.ycombinator.com/item?id=15892066](https://news.ycombinator.com/item?id=15892066)

</comment><comment><USER10> this reminds me of subspace. another game that refused to die and was maintained by players. except this happened before waaaaay before git was a thing, around 1998.

[https://en.wikipedia.org/wiki/SubSpace_(video_game)](https://en.wikipedia.org/wiki/SubSpace_\(video_game\))

I played this game for 8+ hours per day in middle school and high school and it was a major reason for me not getting into any good schools. It was worth it.

<comment><USER11> Subspace was so awesome, and playing airmash had a very familiar feel to it.

</comment></comment><comment><USER12> I assumed the game's author got a contract and was busy working on a new game. That he was never heard from again makes me sad. I truly hope he lives a happy life. If you read this: Thank you for this great game!

</comment><comment><AUTHOR> Site down, there is a mirror here: [https://github.com/spatiebot/airmash- history/blob/master/REA...](https://github.com/spatiebot/airmash- history/blob/master/README.md)

<comment><USER13> [https://web.archive.org/web/20191130205446/https://www.janwi...](https://web.archive.org/web/20191130205446/https://www.janwillemboer.nl/blog/posts/2019-11-airmash- history/) works as well.

</comment></comment><comment><USER14> Can someone explain the appeal of the game? Seems like a pretty basic air shooter, not sure why it became a cult classic.

<comment><USER8> Easy to learn, hard to master, as simple as opening a browser tab to get it up and running. It was a perfect storm of tight gameplay and low barrier to entry. I also suspect many people hadn't come across a game like this before- I can't even name a multiplayer top down shooter like this save for Continuum.

<comment><USER5> I guess for many of the players of old, it was because of the community, that was comprised mainly of HN folks. So, the chat was very nice and interesting.

</comment></comment></comment><comment><USER15> Oh, Airmash, fun as ever. It was our go-to office game for months after initial HN release. When it disappeared, I ended up switching to surviv.io (another thing I _think_ was announced on HN). Now with Airmash back, I don't know what to play anymore :(.

</comment><comment><USER16> yutru here; I ran into Raste earlier on EU CTF and was wondering how that happened... now I know : )

Thanks for making this post Jan, I hope it brings some of the old timers out of hiatus and back into the game for a second inning. Had some great memories with them, like watching aimbot and bug, two players who knew one another from their Subspace days back in their teens, come together once again after all these years apart to carry the red flag to victory; detect and xyz aggressively spamming south entrance of blue base in preds giving me hell on defense; the whole bot-based shenanigans with blankspace dude; Dr.Pepper posting absolutely ginormous guides on how to play on our reddit then getting angry in the comments; sniper and his kid doing a father-son combo sweep of the map; that one epic 5-hour game last February when spy had to infitrate blue team to act as a decoy to finally end the ordeal and many, many more... the whole thing was a riot and a half. The past couple of years was roller- coaster ride personally but Airmash and the often lovely, sometimes crazy, players were the one constant in my life the entire time. You guys are fantastic.

Thanks to yourself, Bombita, Steamroller, gadgetoid and Nuppet for not only keeping the game alive in (nine|five)sigma's absence but even chaperoning it to a better place.

Shout out to Rockzone for being the first one to mentor me in the ways of Airmash. Miss you buddy. Also miss (North|South|Undead) Korea who taught me base defense... notice me sempai! Shout out to xplay and secvtor, my good friends who are still playing; please don't quit guys, the game will truly be dead for me then : ) Shout out to Moz (I see you working on Notable now, all the best mate :)), Apathy, Praise kek, Maximus, Azimuth, Banmeplz, Fallen, Memer, Benderovec and Marshan, you guys were good players and great company, hope you can swing by sometime. Last but not least, shout out to aimbot who spent an hour of his valuable time teaching me two things: 1. don't oversteer and 2. be orthogonal to missile path to evade. After two years of play I'm still nowhere as good as you'd expect me to be but my k/d has more than doubled from 0.8 to 2 and I'm doing better than ever.

Here's to many more years... pew pew!

<comment><USER2> Happy birthday Vijay!

</comment></comment><comment><USER17> I love airmash. I am so glad it didnt die. A great community and a good game.

</comment><comment><USER18> Love Airmash. I started playing it again on Thanksgiving day after being away from it for over a year and it's been a blast!

</comment><comment><USER19> I remember when Airmash was posted as a Show HN. It was fun and far more performant then it had any right to be.

</comment><comment><USER20> Link is literally exhausted.

</comment><comment><USER21> Great story ..

Is there any more web games communities like this game?

</comment><comment><USER22> Detect, xplay, Moz, xyz, praise kek, yutru, those were the days

<comment> your-nanny Detect and xplay and yutru are there now. Still devastating the restof us paeons.</comment></comment>


Indonesia prepares to stop cooperation with Australia - <AUTHOR> http://www.smh.com.au/federal-politics/political-news/indonesian-police-and-immigration-departments-prepare-to-stop-cooperation-with-australia-20131120-2xttu.html

<comment><USER2> Indonesia has spied on Australian politicians. So no moral high ground to be taken here.

Issue is how far up it went and the public airing. It's embarrassing to Indonesia.

Australia should of smoothed it over like USA did with Germany, if they wanted to avoid these headlines.

Other than that, every country is actively doing this.

</comment><comment><USER3> Nothing more than a bit of political posturing.</comment>


The miracle of reading and writing Chinese characters - <AUTHOR> http://languagelog.ldc.upenn.edu/nll/?p=31781 <comment><USER5> Brian Spooner's comment on the article is interesting, too:

"...In Iran I was always fascinated and puzzled by seeing Persians read Persian much faster than I could read English. [...] Our answer was that literate Persians (and Urdu-writers) think, see and act much less in terms of individual letters (than we do, and than we are taught to do as we learn to read and write). They see and write pen-strokes, each of which may contain 1, 2, three or even four letters, possibly (though rarely) more. The letters are written differently according to where they come in the pen-stroke and the pen-strokes are written differently according to what comes before or after them. Readers read pen-strokes (the number of which is very large), not letters. They read faster because they are scanning by series of pen-stokes. We also tend to read English by scanning words rather than reading letters, but the Persian reader is much more efficient and faster at then. The general approach and relationship to writing is different from ours. Its practice is different. And its result is different. There is much more to be said about this. But enough for this comment."

I don't know anything about Persian, but I now feel the need to go learn more.

<comment><USER6> It would be interesting to see if the same system could be implemented for English. Say, make a text renderer that groups common sequences of 2-to-4 letters into one distinct (but still immediately legible) glyph; the set of available glyphs would remain constant. With practice, readers' brains might learn the glyphs as a "shortcut" to take in these sets of letters- almost like a very basic compression scheme programmed into your reading-comprehension neurons.

<comment><USER7> I'm pretty sure I read, write, and type words as glyphs.

When I read the word 'word', I don't read 'w'-'o'-'r'-'d'.... 'word'!

Alternatively, when skiing in Japan, having only learned katakana on the plane-ride, it was less than a week before I reflexively processed 'スキー' as 'ski' instead of sounding out su-ki in my head.

<comment><USER8> Yep having taken Japanese in college, after a while you don't read letters, you read words. Basically we recognize what a word is based on the shape of the word.

</comment></comment></comment></comment><comment><USER9> Writing is a technology invented to help practically disseminate information over time and space. It's a good invention -- arguably one of our best -- regardless of the minutiae of alphabets vs. syllabaries vs. ideographs, etc. However, one shouldn't confound it with the thought patterns of speech and the mechanisms required to produce and process language.

Chinese is no different to English (or any other language) in that respect. Do you visualise the shape of the word "bee" when asked to think how to spell it? I doubt it. The act of writing is completely removed from the linguistic process.

<comment><USER10> Chinese is different, regarding homographs. Written English forces a lot of disambiguation of a purely abstract kind (English homograph collisions don't usually reflect associations, just random collisions) else you can't cope with the homographs. Ideogram collisions or overlaps are far more meaningful, generally non-co-incidental. (Terrific for poetry.)

Examining all this, some while ago, a Chinese professional philosopher and I concluded that this had indeed had some real influence on the two cultures and thinking. This point isn't about visualization per se, but instead the fact that ideograms combine concepts, not sounds. Thanks to its extreme borrowing and therefore an abundance of synonyms, English is no doubt the most extreme example of a language with random homonym and homograph collisions, forcing both listener and reader to make constant choices between abstract (unassociated) options. That's not generally how the human mind works, brains are association engines. So it's a good bet that the fact that English is the language of science and technology (for now) is not entirely coincidental.

This is no bar to progress for China today, however, to the extent that the hànzì alphabet is adopted for text.

<comment><USER11> > So it's a good bet that the fact that English is the language of science and > technology (for now) is not entirely coincidental.

I have to disagree on this. For me it seems that the world politics was the major, if not only, reason why English took over French and German in these fields (too).

<comment><USER10> I can't interpret this. Do you mean the supremacy of the english navy due to the improvements in iron forging that gave the english iron cannons first around the time of the Spanish Armada? That world politics?

It's true that Germany had better rates of literacy 500 years ago.

<comment><USER12> No, it is because the British Empire spanned a quarter of the globe and the Americans won World War II. No other language has had the advantage of being the language of two world superpowers with such vast geopolitical influence spanning over 200 years and huge expanses of the globe. French was the language of international diplomacy, but the French language never had the unparalleled reach that English had (and still has to this day).

In terms of technology, the Industrial Revolution and American scientific achievements were important drivers too. German was the language of science, but when the vast number of new findings are published in English (due to the sheer volume of American/British scientific output), its decline was inevitable.

<comment><USER10> Those iron cannons, together with a wealth of Elizabethan technical innovations, are a VERY large reason why Britain spanned the globe. The advantage of world-dominance didn't precede innovation, it resulted from it. Better weapons, better tactics, better hull designs for ships, better mining techniques and on and on and on.

The U.S. won WWII with no small amount of accumulated Western technology and technological advance. What WWII did do was allow the US (and Russia, but not Britain) to simply seize every German patent in existence without compensation, afterward. If you research Germany technological history you might have a chance to overturn my hypothesis. But the industrial revolution didn't begin there. In any case you'd have to do a lot more homework than you have so far. Japan was a latecomer, and can't count as a counterexample.

English as the primary language of technology and science long predates WWII. The exception might be chemistry (German.)

</comment></comment></comment></comment></comment></comment><comment><USER13> This is strange for me - and now I need to ask my Japanese acquaintances the same questions!

I'm able to visualize the Chinese characters I know just fine, and I'm by no means fluent. I speak Japanese instead of Chinese, but I don't think that would make a difference when visualizing the characters since most of them are one in the same.

I can visualize「雑」(from: 複雑) because of my familiarity. I struggle with 「爆」, a character I just recently learned, because I am not familiar with it. I would have thought that natives of Chinese or Japanese would have no difficulties with visualizing the characters! So it is interesting for me to hear anecdata that they struggle with it.

E:

Reading Xophmeister's reply it actually makes sense to me. For myself, Chinese characters are much more artistic and it is like visualizing a familiar painting or drawing. For a native, they are closer to a tool used for writing, like how English is for myself. For English, I can only visualize words with eight or nine characters or so. It's a weird practice to try and visualize the word "adenohypophysis" \- it is difficult. So I can imagine any non-trivial Chinese character would be difficult to visualize for native speakers.

E2:

Replaced "Kanji" with "Chinese characters" in a few places it slipped through.

<comment><USER14> Kanji -> Hanzi would work.

<comment><USER13> I've been told this more times than I can remember and I always forget about it. Here's hoping this time is different. Thank you for the reminder.

It really gets tiresome to type "Chinese characters" all the time, and I try to avoid referring to them as "kanji" when used in a Chinese context.

Cheers!

<comment><USER15> To me "kanji" is an English word but "hanzi" isn't. I never saw any problem using "kanji" in a Chinese context, since "kanji" seems to be a Japanese sounding of the word "hanzi". But unfortunately some pedants (or one pedant with many usernames) complained when I used "kanji" so nowadays I stick to "Unihan" when writing in a technical context.

<comment><USER16> Chinese people generally don't like the usage of Japanese terms when referencing their language, mostly due to WWII and historical reasons.

Usage of Chinese characters in Japanese language - <USER2>

Usage of Chinese characters in Chinese language - <USER3>

<comment><USER17> AFAIK the historical reasons are well-placed. Japanese Kanji is essentially a spin-off system, since altered, wherein many of the characters that exist in both Chinese (eg. in the Tang Dynasty) and Japanese now have completely different modern meanings. In addition, grammars in both places have since changed (Japanese possibly never really had one, deferring to Middle Chinese in early use, and only slowly adopting characters elsewhere, interspersing other writing systems to provide grammatical structure). Therefore it makes little sense to conflate the two when discussing language, though the evolution of Japanese character use can provide some insight in to Middle Chinese and earlier periods, particularly in subjects such as Nara Period and Silk Road Buddhism. (I am less knowledgeable about Japanese than Chinese, and claim no particular expertise in either, though I do translate old Chinese texts to English for fun and have visited Japan)

</comment></comment></comment></comment></comment></comment><comment><USER18> Writing is primarily a _motor_ skill, not a visual one. You don't need to visualize a keyboard to be able to touch-type, either. Muscle memory is a form of procedural memory very much distinct from any visualization ability.

<comment><USER19> Honest question: do you have any experience with Sino-Japanese writing? (I practice ShoDo, while not really have any Japanese language proficiency - <USER4> suspect that there is a big difference between writing in a phonetic alphabet and in anything like Chinese or Japanese).

<comment><USER20> The main difference between using an alphabet and a non-phonetic writing system is that with the latter, knowing the pronunciation does not really help you remember how to write a word. Since hanzi also tend to have more strokes than alphabetic handwriting, the sequences of hand movements you have to produce in one go are quite long. The way to cope is essentially lots of handwriting practice to really burn in each character.

</comment></comment></comment><comment><USER21> Well, often they can't write these characters at all [1] (this video is for Japanese, but the situation must be similar with Chinese)

[1] [https://www.youtube.com/watch?v=sJNxPRBvRQg](https://www.youtube.com/watch?v=sJNxPRBvRQg)

I can recognize more than a thousand of characters (thanks to Anki) but visualising/writing them is another matter entirely, and I would probably fail to write a large fraction of them. Just like with alphabetic characters, I memorize the "shape" of the character rather than its sequence of strokes. Only when the character is indistinct, or similar to other characters do I bother to remember which radicals it consists of.

For example the character for "dream" (夢) has a very distinctive shape that is easy to recognize, so I wouldn't be able to write it because I never learned how.

Now take the character 緑 (green). It looks similar to 線 (line), but lacks the radical 白 (white). Because green is not white, you see (not actually, it's just a memorization technique). But it also looks similar to 録 (recording). That's because the character for "green" has radical 糸 (thread), just like "line" character. Threads can be green, and they are also lines. But "recording" uses radical 金 (metal) in its place, because recorders are made from metal. So the only things I remember about 緑 is that it has 糸 and doesn't have 白. And thus, I still won't be able to write it.

<comment><USER22> I expect that the problem would be less pronounced in China, given that the Japanese can revert to kana if they forget the kanji, whereas the Chinese have no other choice but to remember the characters.

That said, I've heard of, and even seen once or twice, Chinese people forgetting how to write common words like "sneeze" (喷嚏). So it does happen.

</comment></comment><comment><USER23> As a student of Japanese and having previously thought I might have Aphantasia this was interesting to me.

But I'm still not convinced that we understand Aphantasia completely. I think there's a whole spectrum of different conditions in visualisation and everyone has different skills and abilities. Here's mine:

\- I can currently recall just under 1000 Kanji

\- The learning system I am using (wanikani) doesn't require me to, but from previous study I can write a few hundred

\- I can easily recognize people's faces from memory ("never forget a face")

\- But if you asked me to draw a face from memory I'd have a very hard time

\- I can visualize geometric figures in my mind's eye and move them around

\- As a long time software developer I can effortlessly deconstruct a complex system into base abstractions, hold these in memory, and manipulate/recall the constructs in my head

\- I get a very abstracted visualisation when reading fiction. Lengthy overwrought descriptions bore me and I throw away most of it anyway, so I tend to favour Charles Bukowski over Dan Brown

\- My imagination is similiar, I can set up basic scenes but I can't "see" the detail in any way like looking at a photograph

\- My art skills are decent but I'm not working off any kind of internal image. I think of the main points I want to express but I don't know exactly how they'll look until I commit them to paper/pixel

\- Sometimes when I'm really tired I have very short (under one second) open eye hallucinations where I do visualize random things in extreme detail, indistinguishable from reality.

\- I have visual dreams that feel as accurate as reality

\- I have sporadic occasions when I (start to) lucid dream. Before I'm lucid, everything in the dream is vivid, but once I become aware then all the detail of the dream unravels and I wake up shortly after

</comment><comment><USER24> Writing characters is a bit like thinking of a song. Harder to jump into the middle, easier to start from a beginning point and work your way through it.

</comment><comment><USER25> It's called "muscle" memory. This is no different than how pianists play piano from memory. They don't actually recall every individual keys but it's the connections between keys that matter.

Ask people to write Chinese words or play pieces of music from arbitrary starting points and you will see their struggle. This is because you're breaking up the sequence into individual parts, which is not people learn things.

To put it in an Anglo-Saxon perspective, when someone asks you whether the letter n is before r you may likely recite the alphabet from start to finish. So you know the answer but to get it you have to rely on some more"muscle" memory.

I am also sure this happens when people try to spell certain words. They can't visualize exactly the word but once they start writing or typing it they get into the flow.

</comment><comment><USER26> The question seems ill-formed to me. I don't know anything about Chinese characters, but I _am_ one of those aphantasic people described in the post. There is no impact on recall or access to information AFAIK, it's just that you can't generate "fake" input to your visual system. Or whatever system is used by people who can visualize things.

So - I have no trouble remembering faces. I could very easily describe accurate visual details of any number of places I've visited or seen. I just don't know how / am not able to turn that into something I can "see" that is in any way analogous to actually vision.

</comment><comment><USER27> Why are people in general so confused by proprioceptive memory? I'd be completely nonfunctional as a programmer if I had to "visualize" things in fewer dimensions than my brain stores them.

</comment><comment><USER28> Huh? I found this article kind of tone deaf.

Writing uses motor memory, there is no need for visualization or rehearsal once mastery has been achieved.

It's no harder to write Chinese than english or any other alphabetic language.

</comment><comment><USER29> I like pulling apart the different Chinese characters into the radicals.

</comment><comment><USER30> I have very poor visualization but have been able to learn to read and write over 2,000 characters as an adult. It's all motor skill and thinking in metaphors (for _me_).</comment>


The most popular curl download – by a malware - <AUTHOR> http://daniel.haxx.se/blog/2015/11/16/the-most-popular-curl-download-by-a-malware/ <comment><USER2> But why does the malware need curl in the first place? It seems perfectly capable of downloading things without. And it's running on windows where it's guarenteed to have a http library available anyways.

<comment><USER3> Where in the post did it say it was running on windows? It was stated that the User Agent string wasn't identifiable, nor did it send any identifiable headers.

edit: thanks for the clarification, I totally missed the file name

<comment><USER4> It's downloading a curl release based on mingw32, aka gnu for windows.

</comment></comment></comment><comment><USER5> I guess substituting the existing file served at that URL with a curl that when called by the particular malware in question (I guess you could detect this fairly easily) warns the user graphically of the infection would be considered going too far.

<comment><USER6> I'm not even sure you could reliably detect that - the article says they didn't have any special/identifying headers. But yeah you're right if they could detect then supplying an exe that warned the user would still feel sorta weird IMO, and how many users are likely to trust a random popup or notification seemingly from out of the blue?

<comment><USER7> There are "indicators of compromise" listed at the end of the slides. So you could use that. But that's not curl's job... disabling some old versions by changing the url is more than enough in my opinion.

</comment></comment></comment><comment><USER8> As somebody else mentioned - this is a great honeypot opportunity! By serving malicious builds based on referer and user-agent, they might be able to gather really interesting data.

<comment><USER9> > As somebody else mentioned - this is a great honeypot opportunity! By > serving malicious builds based on referer and user-agent, they might be able > to gather really interesting data.

They said the malware used no referer header and changing user-agent. If the user-agent were useful to segment these downloads from others, they most likely would have refused downloads based on that, because by renaming the file like they did, they're breaking build scripts for lots of downstream projects.

There's also the ethical issue of breaking into others machines, even if it's "for a good cause".

<comment><USER10> Daniel mentions in the comments [1] that this is a binary build and implies that it's not meant to be hotlinked to.

[1]: [http://daniel.haxx.se/blog/2015/11/16/the-most-popular- curl-...](http://daniel.haxx.se/blog/2015/11/16/the-most-popular-curl- download-by-a-malware/comment-page-1/#comment-17535)

</comment></comment></comment><comment><USER11> Google cache (OP URL not loading for me at all):

[http://webcache.googleusercontent.com/search?q=cache:y8oR2pT...](http://webcache.googleusercontent.com/search?q=cache:y8oR2pTNdzUJ:daniel.haxx.se/blog/2015/11/16/the- most-popular-curl-download-by-a-malware/+&cd=1&hl=en&ct=clnk&gl=uk)

</comment><comment><USER12> Why aren't curl binary downloads (and other binaries for that matter) served over HTTPS? HTTP seems like a fantastic man-in-the-middle opportunity.

<comment> mh- they display an MD5 of the file right next to the download link, but that page is also served over plain HTTP.

<comment><USER13> The word "MD5" does not appear anywhere on curl download page [http://curl.haxx.se/download.html](http://curl.haxx.se/download.html)

<comment> mh- I somehow ended up getting sent to a mirror page when I went to download, which does have it.

[http://www.magicermine.com/demos/curl/curl/curl.html](http://www.magicermine.com/demos/curl/curl/curl.html)

</comment></comment></comment></comment><comment><USER14> Wouldn't the obvious solution be to throw a captcha in-front of the download?

Or am I missing the fact that this exact download path needs to be directly accessible by package managers or something?

<comment><USER15> Automated downloads don't have to be malicious. I'm sure there are tons of legitimate scripts out there that fetch curl via those URLs.

<comment><USER14> The fact the article states they've already changed the url for downloading the file, suggested to me that it wasn't intended to be automatically downloaded (I realise that automation does not imply malicious).

</comment></comment></comment><comment><USER16> Is curl block able for outbound requests?

</comment><comment><USER17> P2P-sharing would be a really great solution to this from the malware developer's point of view. I don't harbor any ill-will towards malware devs, especially not when they're going after windoze machines :^)

But yeah, the curl website could really come up with a lot of data, so it seems like a very immature solution to what is really a critical component of the app to just blindly reach out for some predefined url. It'd be way smarter to run a CC machine somewhere and start pairing some peers. curl is somewhat small, right?

I think they'll probably just keep renaming the file for now, and updating the URL. It'll just be cat and mouse, and newer versions ship with it, so there's really no point for the curl maintainers to be wasting too much time on it since it's a limited-time issue that will more than likely sort itself out later.

<comment><USER18> Yeah! Them people that don't share our hobbies and choices can get fucked, right? I mean transitioning to linux is so easy and relearning a new ecosystem so painless. Them scam victims deserve whats coming for them!

I also agree that malware devs are dumb. Instead of using that curl download in a way they know works, they could just add a p2p module to their malware, open up a few ports on infected machines and hide all that from av. Easy right? I mean them archive urls change all the time! And updating that via the cc is just too unelegant!</comment></comment>


The top pirated movies: available for legal digital streaming/rental/purchase? - <AUTHOR> http://piracydata.org/

<comment><USER2> how is this actually being calculated, as for what i see is not entirely correct.

Digital Rental Digital Purchase is not globally available for those movies listed, is this US based only? is the download data for that ranking based only in the countries where the movies are available for rental or buy only?</comment>


Cybercrime Cost $126B, Affected 689M People in 2015 - <AUTHOR> http://www.ibtimes.com/cybercrime-cost-126-billion-affected-689-million-people-2015-2447435 <comment><USER2> Direct link to the study (if you can call it that): [https://www.symantec.com/content/dam/symantec/docs/reports/2...](https://www.symantec.com/content/dam/symantec/docs/reports/2016-norton- cyber-security-insights-report.pdf)

</comment><comment><USER3> Not sure if Norton has the incentives to produce an unbiased estimate. And calling this a study might be overkill, it looks more like a brochure.</comment>


IPhone, Gizmodo, and moral clarity about crime - <AUTHOR> http://www.csmonitor.com/Commentary/Opinion/2010/0504/iPhone-Gizmodo-and-moral-clarity-about-crime <comment><USER2> I think "moral clarity" over this kind of thing was lost decades ago, when it became common for companies to buy/borrow/find prototypes, and rarely prosecuted. It's common knowledge among chip-design companies that as soon as your prototype board hits the fab (unless you're someone like IBM or Intel with your own fabs), it's going to be in your competitor's hands: NVidia and ATI operate on the assumption that as soon as a chip's sent to Taiwan, it's going to their competitor too. Nobody is ever prosecuted for that, either, on the side of the seller or on the side of the buyer.

Yes, technically selling found property is a crime, but morally, this looks more like a trade-secret dispute between businesses than a normal stolen- property dispute, i.e. the harms suffered are not primarily the loss of the device, but of the secret information. And I think people are pretty jaded when it comes to inter-business trade-secret/corporate-espionage sorts of disputes, because it happens all the time and nobody important ever goes to jail for it, even though there's a lot of wink-wink in which executives are aware of it.

The main difference here seems that it was made public instead of kept secret, and the people doing it were amateurs. If Gizmodo were a consulting firm instead of tabloid, paid $5k to see the prototype for a bit, took a bunch of photos and information, quietly returned it or didn't, and then quietly sold that info to one of Apple's competitors, we probably would never have heard of it. (There's a whole little cottage industry doing teardowns of "found" hardware.) I wouldn't be surprised if Jobs himself has purchased such information at some point in his long business career--- taking care to maintain plausible deniability of course.

<comment><USER3> Your argument seems to be: everybody is doing it, so it's not morally wrong.

Would you feel the same way if it was your intellectual property that was stolen? What if you spent the last year of your life in stealth mode, working 120 hour weeks and Gizmodo published your business plan on the web for everyone to see?

<comment><USER2> It's more like: this isn't morally wrong in the sense that stealing someone's iPhone is wrong, but morally wrong in the sense that corporate espionage is wrong, which is a whole different and fairly complex beast.

Mostly, I don't think it's any _worse_ when Gizmodo publishes it on the web for all to see than when the tech companies buy and teardown "found" prototypes. If people want a wholesale clampdown on that sort of thing, applied evenly, that might be worth considering.

</comment></comment></comment><comment><USER4> I wonder... if Gizmodo had informed Apple of the contact, might Apple have given them an exclusive deal further down the line for doing the right thing? Were I Jobs, I certainly would (though I'm not); people who will look out for you & yours are valuable to keep. That kind of better relations may have been worth more than the phone scoop, and certainly better than the horrendous PR snafu (it would've been the other way around, most likely: Apple fans praising Gizmodo).

<comment><USER5> Interesting sidebar to this: Apple had completely cut Gizmodo out of prerelease iPad access. In fact, the snub came literally as Gizmodo editor Brian Lam was already on a plane to meet with Apple on it:

[http://www.businessinsider.com/apple-screws-top-gadget- blogs...](http://www.businessinsider.com/apple-screws-top-gadget-blogs-no- early-ipad-review-units-2010-4)

While I'm not certain Gizmodo wouldn't have still bought the unit given the way Nick Denton has talked up checkbook journalism the last few years, I do think that the fact that Apple had already cut off all access gave them little incentive _not_ to publish. After all, tech blogging is pretty much an access- reliant venue.

Their great miscalculation there is clearly that they weren't expecting Apple to play legal hardball to the extent that they have.

</comment></comment><comment><USER6> Moral clarity about crime? I didn't see anything clearing my morals in the article. Yes, it was illegal (and probably should be so too) to sell/buy stolen prototype, but illegal and (morally) wrong are completely different things in my book. I my mind, the scales are tipping on the "morally good" side in this case, but I also think that Gizmondo should accept the quite predictable consequences.

</comment><comment><USER7> The only thing that bothers me is the method of executing the search on Mr. Chen. In this case, it's not like he has ever been hiding anything, so did they need to bust in his door, execute a search warrant, and seize his computers?

It seems to me that the facts of this case are all public, and if they want to prosecute him, they could have done so without resorting to thuggish tactics.

<comment><USER8> In general, I disapprove of the increasing militarization of police tactics. Far too many search warrants are executed by SWAT teams wielding tasers and guns, and result in the deaths of innocent people.

However. Think about it for a minute. Just how should the police generally execute a search warrant? If the suspect doesn't answer the door, should they leave a polite note and come back several hours later once the suspect has had a chance to smash the computers with a hammer, set fire to the paper evidence, and flee to Barbados?

<comment><USER9> Shouldn't it depend on the crime and the alleged criminal. Chen had already returned the property to Apple so should have been given some credit for that gesture during the search. Also, the crime was for buying stolen property at worst, I don't think that should have involved knocking down doors

<comment><USER10> At worst, the crime is economic espionage (more likely by Chen's employers rather than him as an individual). This carries a sentence of up to a decade a fine of up to $5m (although if this were the case here, the actual penalty might only be a tenth of that).

</comment></comment></comment></comment><comment><USER11> "if David were to steal Goliath's slingshot. . ."

I just don't even know where to begin.

</comment><comment><USER12> > Finally, there's the misguided idea, long espoused by many in the tech > community, that "information wants to be free." But whether it's in the form > of proprietary trade secrets embodied by Apple's latest iPhone or > intellectual property subject to seemingly endless illegal downloading and > file sharing every second of every day, information is not free.

> It takes a lot of time and energy and money to write books, compose music, > create movies, and design and market electronic devices like iPhones. Such > information deserves legal protection, even when it's been lost in a bar.

weird how he twists this to support an entirely different conclusion at the end. also i don't think the real issue here is whether or not there was theft. it seems pretty clear there was. the question is has the response to it been proportionate and "by the book", or has steve pulled strings?

</comment><comment><USER13> This author doesn't seem to have researched his piece very well. Take the shield law argument. He says:

 _The problem for Gizmodo is that the shield law has a specific exemption when the police are looking for evidence that the journalists (in this case, the Gizmodo editor) themselves committed crimes, as seems to be the case here._

But almost every investigative reporter breaks a law when doing their job. Woodward and Bernstein received documents that were unquestionably stolen. That's receiving stolen property (not to mention violation of a bunch of laws regarding state secrets)

The argument against Gizmodo is whether the story "served the public good" as established by the precedent. NOT if they committed a crime themselves.

<comment><USER14> He's actually wrong: The California law has no such exemption, the federal one does though.

</comment></comment><comment><USER15> >By making an admittedly weak effort to return the iPhone to Apple, Hogan – in the eyes of the law – committed theft.

That's the thing though. Gizmodo did in fact return the iPhone to Apple without complaint, in a timely manner. Posting the information to the Internet is an unorthodox way of asking Apple if they want their property returned, but it ultimately has the same result.

If any crime was committed by Gizmodo, it is theft of trade secrets, not theft of the device.

<comment><USER16> let's say someone steals your car. I buy it from them, then brag about it on the internet. I then realize I've drawn the attention of law enforcement and I "return" it to you in a "timely" manner. Is it theft? I mean, my bragging about riding around town in your car is an unorthodox way of asking you if you want it back.

<comment><USER17> The thing is, in this case, Gizmodo didn't really know if it was stolen - there was no way for them to know if it was a legitimate device or a knockoff from China. After they posted it Apple confirmed it really was their device and they returned it immediately.

<comment><USER18> Are they in the habit of paying $5,000 for things that they think are likely Chinese knockoffs?

<comment><USER9> They probably are in a habit of paying money for devices which look interesting and aren't easily available in the US market. So if somebody comes to them with a next gen mp3 player from China and they like it from the looks they probably gonna pay good money for it.

</comment></comment></comment></comment></comment><comment><USER19> Could Gizmodo have avoided legal jeopardy if they had used that $5000 to secure an exclusive instead of using it to buy the device?

<comment><USER20> Most likely, yes. Openly offering to purchase unreleased prototypes etc. is pretty common in "tech/gadget" media, and does not constitute theft on the buyer's side, which obviously is the case when in a _concealed_ fashion fencing/trading something that you clearly know is someone else's property. This is de facto international law.

<comment><USER21> Unfortunately, Gizmodo's letter to Apple doesn't say they paid for an exclusive. Gizmodo says they bought the iPhone:

"We didn't know it was stolen when we bought it."

</comment></comment></comment><comment><USER22> Who has the story about our software engineer? Talk about hangover after birthday party...

</comment><comment><USER23> This article makes a bunch of assumptions. The most important assumption is that they guy who found the phone didn't make a reasonable effort to return it.

Just because the phone says "Apple" on the back, doesn't mean Apple owns it. My phone says that too, but I wouldn't want it sent to Apple if I lost it. Also, my understanding was that the phone was bricked remotely. Not much you can do to find the owner of a phone that doesn't turn on.

It would seem to me that this assumption must be proven true _before_ police can take action against Chen, since unless this assumption is true, there is no cause to invade his office.

I don't know what the facts are, but the they need to be set straight in this matter before we declare anyone guilty.

<comment><USER10> It doesn't just say Apple on the back. It's disguised with a removable case to look like a previous model, has stickers on it with serial numbers, and the Gizmodo staffers evaluating it are expert commentators on the gadget industry.

Now you could say that the Hogan fellow who found it is naive, and it's apparent that a lot of people were not aware of finders' legal responsibilities in California; ignorance is not a legal defense, but that means only that an attorney can't offer it as a reason to have a case dismissed. A jury and judge might well regard his crime as a petty one and find him guilty only of a misdemeanor.

But where Chen (and indirectly, his employers) are concerned, they really should know better because the size and practices of the industry they report on is _exactly_ what brings a sufficiently large audience to sell advertising.</comment></comment>


EBay acquires UK startup Shutl - <AUTHOR> http://techcrunch.com/2013/10/22/ebay-acquires-uk-startup-shutl-to-change-the-ecommerce-game-with-one-hour-delivery/

<comment><USER2> Although it's a shame they weren't acquired by a larger UK tech business, it's still very exciting news. It's not often that one of the startups to come out of Silicon Roundabout exits. They've done us proud.

Well done to all the Shutl team!</comment>