Final Removal of Trust in WoSign and StartCom Certificates - <AUTHOR> https://groups.google.com/a/chromium.org/forum/#!topic/net-dev/FKXe-76GO8Y <comment><USER2> Speaking of removing trust bits; the ever-delayed Symantec saga continues with no clear decision.

What concerns me is:

\- the lack of public communication, as shown here (tl;dr: private meetings): [https://groups.google.com/forum/#!topic/mozilla.dev.security...](https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/k3PaF0UoE0I)

\- the contrast between symantec and the mozilla security groups path forward [as well as how its communicated] ([https://groups.google.com/d/msg/mozilla.dev.security.policy/...](https://groups.google.com/d/msg/mozilla.dev.security.policy/C45hQChFLyc/4HyG0iaMBAAJ), [https://www.symantec.com/connect/blogs/symantec-s- response-g...](https://www.symantec.com/connect/blogs/symantec-s-response- google-s-subca-proposal))

<comment><USER3> I don't think you're being fair toward Mozilla. They had a meeting with Symantec and reported on it; there were no details because Symantec is going to soon publish everything. They probably had the meeting only because Gerv was in the area. Mozilla have been transparent the whole time.

Google's approach is clearly different to that of Mozilla, but IIRC they have never pledged transparency. They're a commercial entity and they're doing what they think is right and/or is in their interests.

<comment><USER2> I can understand how my comment might have come off as somewhat judgmental (to either side) but that was not my intention. The idea was to [without derailing the thread too much] give people interested in certificate issues a relatively quick summary on what has happened and my concern about it.

</comment></comment></comment><comment><USER4> And meanwhile, Let's Encrypt is on track to offer wildcards at the start of next year ([https://letsencrypt.org/2017/07/06/wildcard-certificates- com...](https://letsencrypt.org/2017/07/06/wildcard-certificates-coming- jan-2018.html)), so one of the last reasons to need a non-LE cert is going away.

I used StartCom for years, but LE made it completely obsolete for me. And StartCom seems to have been willing to throw it all away with the WoSign acquisition.

<comment><USER5> Lets Encrypt seems like a good solution for the https cert side of things.

Wish there was an equivalent thing for signing executables. eg for the binaries of our software releases.

We'd been using StartCom signing certs (for Win binaries) up until this clusterf __k. ;)

<comment><USER6> There's always GPG signing.

<comment><USER7> Does that provide the same integration into Windows that Authenticode does? Plus timestamp, dualsign, and cross-sign?

<comment><USER6> >Does that provide the same integration into Windows that Authenticode does?

Nope

</comment></comment></comment></comment></comment><comment><USER8> I'm still really bummed about StartCom's suicide/implosion. They had by far the most sane and reasonable pricing model I've ever seen, and one I really wish someone else would do. They basically only charged for non-automatic authentication, not for what you _did_ with that authentication, and then let each level of authentication feed into higher levels. So Level 1 machine auth (similar in spirit to LE) was entirely free, you could verify an email, domain, or whatever and then produce certs for that. If you wished you could pay money (~$60 for 2 years IIRC) to have an actual human look at your documentation and give you a call, then give you a Level 2 with your legal name. You could then use that for an unlimited number of S/MIME certs for email accounts, domains, software signing and so forth. Having gotten personal verification to level 2, you could then pay to have an organization certified. Etc.

Their UI wasn't the best, but it was functional and the overall system made a lot of sense. They didn't put an artificial price on some bits with a marginal cost of nada. It's a real shame all that got flushed, because that model of business filled a hole that has no general world solution right now (in principle authentication of their citizens should be a core role and offering of modern government, but I'm not holding my breath there).

<comment><USER3> You're forgetting that they had a charge for revocation, which was also automated. Even after Heartbleed, they refused to revoke the potentially compromised certificates without being paid. They also advertised their certificates as 100% free, even though they clearly weren't (because of the revocation charges). The certificates were not free for commercial purposes either.

IMO, just like one of those schemes where you don't pay to get in, but you have to pay to get out.

It's a shame, because they could have achieved a market share similar to Let's Encrypt, if only they had played their cards slightly differently.

<comment><USER8> > _You 're forgetting that they had a charge for revocation, which was also > automated._

I did not forget that, I was just talking about the authentication and certificate issuance side. But though it didn't fall under the umbrella of authentication it is something that actually cost real money at that point. You misunderstood the situation and how revocation functioned in a way that's extremely important (since it's finally getting fixed but the improvements could use more widespread deployment). The original certificate revocation mechanisms, CRL and OCSP, are and always have been completely broken in terms of fundamental scaling and failure modes. Scott Helme just did an excellent summary on the situation and upcoming developments [1] which I strongly encourage you to read, but in essence due to the way they work _seriously_ offering CRL/OCSP (as in, in a way that won't instantly die when someone breaths on it hard) services and adding certs to them requires significant distributed infrastructure, which has not always been cheap. They were bad approaches even with that though due to other practical failure modes that were beyond a CA's control anyway. Both stink to the point that many (most? all?) operating systems/applications/browsers just soft fail by default or even ignore them entirely. "Revocation" for the wider web has largely been a mirage.

StartCom did in fact have an explainer about this at one point, and their position was reasonable. Other CAs hid the cost in large part by charging a ridiculous amount for every cert issuance, despite many people never actually needing revocation services. StartCom let you have as many certs as you wanted after authentication for free, but if you lost one in such a way that you needed to make use of CRL/OCSP then you were charged. Users could pay that price, or alternatively invest in other ways to mitigate at their discretion rather then just getting charged no matter what.

If StartCom had survived until now, or if someone else adopted their model, then I'd expect at this point they'd make use of modern techniques like OCSP Must-Staple/Expect-Staple, CAA, CT, etc. by default, and in turn that problem would be solved at no cost.

> _IMO, just like one of those schemes where you don 't pay to get in, but you > have to pay to get out._

This is completely ridiculous. Nothing inherently made anyone lose private keys. Even Heartbleed didn't defeat someone using an HSM for example. Nor would everyone who lost a private key need try to publicly revoke (to the extent that would even work). Given the cost tradeoffs this was one particular standards design failure that has been and remains wrong to make into some general insurance vs letting individuals have the freedom to deal with it as needed and/or having the standard itself fixed.

\----

1: [https://scotthelme.co.uk/revocation-is- broken/](https://scotthelme.co.uk/revocation-is-broken/)

<comment><USER3> Whether revocation works has nothing to with my point about StartCom, which is that they weren't honest about what was free and what wasn't. I know this because I was annoyed with it at the time and actively looked at how they presented themselves.

On the topic of revocation, you're missing a couple of aspects:

\- First, both end users and CAs are required to revoke certificates that are compromised; it's not an option. It's a fundamental part of a CA's operation.

\- Second, CAs provide revocation services like OCSP for revoked and non- revoked certificates alike. So, certainly the costs for running OCSP are comparable in both cases. You could argue that CRLs cost a bit more, but largely only because of the bandwidth cost (as CRL is just a file).

<comment><USER8> > _which is that they weren 't honest about what was free and what wasn't._

You have repeatedly stated this, and it is objectively false. The StartSSL site did not forbid archiving, and thus is available [1] going back to 2004 on the Wayback Machine. This includes both the HTML FAQ page and the policy PDFs of the time. This isn't some EULA boilerplate, actual clear policies and procedures for a CA you're interested in using for your infrastructure is something that is absolutely your responsibility to read.

When discussing Revocation (clearly titled) in the FAQ and Policy & Practice statements, even very old versions stated that a fee could be charged, and that revocation was considered a separate issue for free usage due to growth of the CRL. Later (since at least mid-2010, which is 2 years before Heartbleed was even introduced and 4 years before public disclosure) made this even more explicit, put it right in the FAQ, and put a clear price on it. From the FAQ, 2010 [2], _the first sentence_ :

>>" _72) Revocations carry a handling fee of currently US$ 24.90. [...] Extended Validation certificates are exempt from the revocation handling fee._ "

Please explain how they "weren't honest about what was free and what wasn't." Did you "actively look at how they presented themselves" but fail to so much as glance at the FAQ or Policies documents in doing so? None of this was remotely hidden, it was literally listed twice on the front page, both in the major navigation on the top and as one of just 10 sidebar items.

> _First, both end users and CAs are required to revoke certificates that are > compromised_

Please back up your arguments on this. WRT to end users, under what authority at all are they "required" to do jack shit? Failing to do so in SOME industries and jurisdictions MIGHT involve negligence, but even that would depend on what other measures are taken. Please link any specific legislative or regulatory authority requirements to the contrary.

As far as CAs themselves, the authority would be the CA/B (enforced by virtue of browser/OS inclusion requirements, so the real ultimate "authority" there would be Apple/Google/Microsoft/Mozilla/OSS major distros & projects). At the time when StartCom established its initial policy, v1 of the CA/B baseline requirements [3] had not even been adopted yet (BR v1 adoption was Nov 2011, effective date was July 2012). Even then, 13.1.1 merely stated that:

>> _" 13.1.1 REVOCATION REQUEST: The CA SHALL provide a process for Subscribers to request revocation of their own Certificates. The process MUST be described in the CA's Certificate Policy or Certification Practice Statement. The CA SHALL maintain a continuous 24x7 ability to accept and respond to revocation requests and related inquiries."_

There were reporting requirements, and a 13.1.5 covers circumstances under which a CA must revoke within 24 hours. The most recent version, BR 1.4.5 (1.4.6 & 1.4.7 are in review), moves revocation to section 4.9 and includes additional details and sections (including, note, that there is no maximum latency on CRLs stipulated so a dishonest CA could make them "free" but run it off a toaster that takes 20 minutes per request).

However in none of this is it required that the CA make the process available for arbitrary usage at no cost. If a subscriber refuses to pay and the CA discovers a cert falls under one or more SHALL REVOKE parts of "Reasons for Revoking a Subscriber Certificate", then they have to revoke anyway and the cost may be unrecoverable, but they are free to treat it as a debt and go after the purchaser on their own for that money (or ban them from further use of their services). StartCom had a written laid out policy and procedure, and it was available continuously on their site. What requirement did they fail at?

> _Second, CAs provide revocation services like OCSP for revoked and non- > revoked certificates alike. So, certainly the costs for running OCSP are > comparable in both cases. You could argue that CRLs cost a bit more, but > largely only because of the bandwidth cost (as CRL is just a file)._

Note again (and I pointed at this in my original reply): even now, BR contains no requirements on specific availability or latency beyond the original requirement (13.2.3 v1.0, 4.10.2 v1.4.5) that:

>>" _The CA SHALL operate and maintain its CRL and OCSP capability with resources sufficient to provide a response time of ten seconds or less under normal operating conditions._ "

Ten seconds! Under _normal operating conditions_ (DDOS survivability, ha!). Meeting requirements on the cheap is not the same as doing it right (to the extent that's even possible). And you are far to blasé about the growth of CRL in a situation where an unlimited number of 1 or 2 year length certs can be issued free of charge. One of the most principle rules of service scaling is that if you make something available that has a minor cost available at no cost, there is always a risk that users will fully take advantage of that.

One of the best parts about the new BRs is that they've started the process of allowing CAs to replace base OCSP requirements with use of Stapling (although oddly only for "high traffic" sites, whatever that means). That should be generalized/accelerated and both CRLs and base OCSP done away with entirely ASAP. But even given previous and existing rules I find your assertions that StartCom was dishonest or failed to meet requirements unconvincing right now.

\----

1: [http://web.archive.org/web/*/www.startssl.com](http://web.archive.org/web/*/www.startssl.com)

2: [http://web.archive.org/web/20100704102024/http://www.startss...](http://web.archive.org/web/20100704102024/http://www.startssl.com:80/?app=25#72)

3: [https://cabforum.org/baseline-requirements- documents/](https://cabforum.org/baseline-requirements-documents/)

<comment><USER3> I've already explained in one of my earlier posts in this very thread: In my opinion, it was dishonest to advertise certificates as "100% free" when they charged for revocation.

Just because the revocation charges were documented somewhere on the web site doesn't make it right. A large percentage of certificates is revoked. Revocation is a normal and expected part of certificate lifecycle. Thus they should have been crystal clear upfront saying "we charge for revocation" in the same sentence where they said "we don't charge for issuance". They could have mentioned it on the same page, but they didn't do that either (I just checked their "free" certificate page from a random point in time.) So ask yourself why they didn't put such an important fact where most people would see it.

</comment></comment></comment></comment></comment></comment><comment><USER9> They are trying to crawl back:

[https://bugzilla.mozilla.org/show_bug.cgi?id=1311824](https://bugzilla.mozilla.org/show_bug.cgi?id=1311824)

</comment><comment><USER10> Is there a tool that we can use to tell if we have these certs?

<comment><USER11>
        echo | openssl s_client -connect somewhere.net:443 -servername somewhere.net | grep -qE "(WoSign)|(StartCom)"

<comment><USER3> That's a bit simplistic. For example, you at the very least want to have a "-servername" there to account for SNI-only hosts. You'll then need to worry about prefixed and non-prefixed hosts (e.g., www.example.com and example.com). Then, what do you do if your web site relies on a third-party sites that uses WoSign? Yes, now you have to parse the HTML response, extract all links, and check those too.

Then there's also a question of servers other than HTTP, so you need to throw in a port scanner in there. And a tool to actively follow protocols, to discover MX hosts, maybe even look at SRV records, and so on.

</comment></comment></comment><comment><USER12> I fully encourage you folks to prune your trusted CAs. I personally whitelist only some CAs. I keep a separate root for visiting Chinese websites like Baidu Wenku.

<comment><USER13> it is frankly astonishing how many browsers/OS platforms ship by default trusting all of the major mainland chinese root CAs.

<comment><USER14> It's astonishing because somehow the Chinese deserve to be treated differently from everyone else?

<comment><USER13> Because the Chinese government has a well documented track record of attempting to MITM SSL, and if your system trust the root CA... game over.

[https://www.google.com/search?q=china+ssl+mitm&ie=utf-8&oe=u...](https://www.google.com/search?q=china+ssl+mitm&ie=utf-8&oe=utf-8)

</comment></comment></comment></comment><comment><USER13> Should have happened eight months ago. I can understand the careful and deliberative process behind the "CA death penalty" from a major browser, but this was such an egregious case that I think faster action was warranted.

</comment><comment><USER15> And yet, on my brand new Android Nougat phone, I have these StartCom and WoSign CAs. I just disabled them, but I doubt many users will.

<comment><USER16> Thanks, just did this on my Pixel.

</comment></comment><comment><USER17> I had hopped that they would do that much earlier. WoSign and StartCom acting in a shady way has been known for quite a long time.

<comment><USER18> Where can one learn what CAs are acting in a shady way? Are there other CAs on a similar course?

<comment><USER17> I would say that Comodo is quite shady, sadly it seems that cloudflare sites use it so getting rid of it would be quite difficult.

They make multiple low quality and mostly useless applications - one could even call them scamware: [https://en.wikipedia.org/wiki/Comodo_Group#Consumer_Security...](https://en.wikipedia.org/wiki/Comodo_Group#Consumer_Security_Products). They also forked Chromium and Firefox and made their own rebranded browsers which offer nothing of value.

They have multiple clearly fake comments on their certificate pages: [https://ssl.comodo.com/comodo-ssl- certificate.php](https://ssl.comodo.com/comodo-ssl-certificate.php) and [https://ssl.comodo.com/wildcard-ssl- certificates.php](https://ssl.comodo.com/wildcard-ssl-certificates.php)

And finally they tried to trademark the name of LE: [https://en.wikipedia.org/wiki/Comodo_Group#Let.27s_Encrypt_t...](https://en.wikipedia.org/wiki/Comodo_Group#Let.27s_Encrypt_trademark_registration_application)

</comment></comment></comment><comment><USER19> question for the knowledgeable: I've used AWS's ACM for my certs so far, are there any big reasons why I should be using LE instead?

<comment><USER3> No. Quite the opposite, AWS automates certificate issuance for you. You'd have to automate the process yourself if you switched to LE.

Of course, AWS only issues certificates when you're using their stuff. For everything else, use LE :)

<comment><USER20> Nitpick: You can only use ACM with ELBs/ALBs/Cloudfront Distributions.</comment></comment></comment>


Show HN: Instantly create a secure URL to your Mac - <AUTHOR> https://emporter.app <comment><USER2> I have no idea what this product does.

> Instantly create a secure URL to your Mac

OK so like a URL to... what? Screenshare? Access the HDD like dropbox? Do something else?

> Make changes in real time. Get feedback immediately. Effortless live > previews.

Of what? About what? Of what?

> Nice cartoon picture of dog

/closes tab

 __Edit __: reading the rest of the page it 's still unclear what it does, or even why I'd want it. I guess I'm not the target audience?

<comment><AUTHOR> Thanks for the feedback!

I was indeed trying to explain something technical (i.e. a tunneling service) in a non-technical way in an attempt to be friendly towards designers, but it seems like I still have some work to do on the product page.

<comment><USER3> Try describing the process, that's usually what I look for at least when I'm looking at products/services/apps (I'm a designer). Briefly walk through how you can create a folder, throw files in, forward a domain/port, and then it's public. The best product pages I've seen offer a short brief like your current site does, but then also offers the very detailed technical bits behind a "read more" button or accordion. Best of both worlds that way I think.

<comment><AUTHOR> Thanks for your suggestion! I was hoping to perhaps put together a short video to show it off in action (it really is quite simple).

That said, it might actually be easier for me to use the "accordion" approach, as you suggested, My video editing skills are pretty limited and this is currently a side project of mine that's completely bootstrapped.

</comment></comment></comment></comment><comment><USER4> Am I the only one bothered by these apps/saas that hide their pricing?

>> No Subscription Required

>> The core version of Emporter is free.

>>

>> Subscriptions are offered to provide faster speeds, custom URL names, multiple sessions, and super good vibes.

<comment><USER5> From their mac store page

> Subscriptions provide faster speeds, customized URL names and multiple > sessions.

• Monthly Subscription: 3 day free trial, then €5.99 a month • Yearly Subscription: 7 day free trial, then €59.99 a year (15% off!)

A bit expensive for what localtunnel provides for free, no?

<comment><USER6> How can the free trials be different lengths depending on what paid package you choose?

<comment><USER7> Good question. This obviously isn't well thought out. Why not just do the annual trial for 7 days? Would they seriously not let you sign up for monthly plan after because of that?

<comment><AUTHOR> Thanks for your feedback... why not indeed? I've updated it within product page (and In-App Purchases). It'll probably take a little bit for the description in the App Store to update, though.

</comment></comment></comment></comment></comment><comment><USER8> If you don't want to install any third-party apps, you can do much the same by spinning up an AWS box and using SSH remote port forwarding

       ssh -NT -R 0:localhost:80 email@example.com

I also do an extra step and put an nginx proxy in front to translate hostnames into correct port numbers, but that's optional.

<comment><USER9> Same, with Apache. We leave our reverse proxy up 24/7\. Relevant Apache config:

        RewriteEngine on

        RewriteCond %{HTTP:Upgrade} =websocket [NC]
        RewriteCond %{HTTP_HOST} ^([^\.]*).*$ [NC]
        RewriteRule /(.*) ws://localhost:%1/$1 [P,L]

        RewriteCond %{HTTP:Upgrade} !=websocket [NC]
        RewriteCond %{HTTP_HOST} ^([^\.]*).*$ [NC]
        RewriteRule /(.*) http://localhost:%1/$1 [P,L]

        RewriteCond %{HTTP_HOST} ^([^\.]*).*$ [NC]
        RewriteRule ^ - [E=TUNNEL_PORT:$1]
        ProxyPassInterpolateEnv On
        ProxyPassReverse "/" "http://localhost:${TUNNEL_PORT}/" interpolate

This reverse proxies something like [https://12345.example.com](https://12345.example.com) to [http://localhost:12345](http://localhost:12345), which is forwarded back to the dev machine (typically port 80 or 3000). When a local server is spun up, our tooling automatically sets up the remote port forwarding and appropriately configures the local instance based on an environment variable. For a pre-seed startup, this results in considerable cost savings w.r.t. ngrok's pricing.

</comment></comment><comment><USER10> Highly doubtful that I would ever buy any software sold on a monthly subscription basis. The best parts of my life have been a result of avoiding being tied to monthly fees. Without them, you are free to travel and move about at will.

Monthly fees are a ball and chain thought up by corporations to create modern slaves. Psychological and, to some extent, physical captivity.

<comment><USER11> The problem is not really subscriptions, it's being able to enter and leave a subscription without hassle, something that is increasingly difficult these days. If you're paying for an ongoing service, then it makes sense to pay a monthly fee. But if you're paying for an app and don't expect significant long-term upgrades, then yes, a one-time purchase makes sense.

In theory, iOS implements this well by allowing you to unsubscribe with one click. In practice, it's a terrible UX. Just try finding the subscriptions page in Settings and you'll see what I mean.

</comment></comment><comment><USER12> How is it different from ngrok [1]?

[1]: [https://ngrok.com/](https://ngrok.com/)

<comment><USER13> From a cursory glance, I would say one thing is that there's a GUI for it. Some people are afraid of opening a terminal.

<comment><AUTHOR> Totally. I was thinking about designers when writing the interface and product page.

</comment></comment></comment><comment><USER14> * How is that different from ngrok ([https://ngrok.com/](https://ngrok.com/))? * If you target Mac developers, the first thing is to provide a Homebrew recipe IMHO

<comment><USER15> Yeah, I'm not sure why I'd use this over ngrok? Maybe if you're non technical, but this is aimed at web designers... Seems like they have the wrong target user to me.

</comment></comment><comment><USER16> Just a note that a lot of enterprises will likely block this app for security issues - my workplace is fairly open (file sharing services are allowed) but blocks ngrok.

<comment><AUTHOR> Hey, thanks for your feedback.

One of the biggest reasons that I decided to distribute on the Mac App Store was to establish trust. If I embraced its limitations (i.e. sandboxing), it'd help me build a product that was more secure and have some sort of proof that it was.

Also, the company (me) behind the app is based in France, which has some of the toughest privacy laws. The privacy policy, although in English, is compliant with French law. The short version is that Emporter doesn't collect user data, or perhaps most importantly, user content.

I have quite a lot I want to discuss about this via the company blog, which ironically is part of the reason I decided to post a "Show HN". I wanted contextualize the product a little bit before inviting this kind of discussion.

</comment></comment><comment><USER17> The hidden pricing is a tab-closer for me. I'm just not going to play that game when it is not even clear what the app does.

<comment><AUTHOR> Thanks for your feedback! I can definitely see why that's a deal breaker. Admittedly, I just thought people would be stoked that it was free to use and download it.

<comment><USER17> But here's the thing: if I _really_ like it, and you have any business sense whatsoever, then I'm going to want a subscription. But if I don't know up front what that subscription is going to cost, then I'm not going to bother to download an app, figure out how it works, get really into it, and then find out that the functionality I'm going to want long-term is $895/year.

It also makes me think you're not telling me for a reason. I guess I've purchased too much "enterprise" software over the years. :-)

<comment><AUTHOR> I've updated the main page to include pricing. Thanks again.

</comment></comment></comment></comment><comment><USER18> I'm building my first web app right now, and understood what this did just by reading the title of the post. Many people building web apps will understand what you mean. It can't hurt to compare it against existing tech that does similar things though.

</comment><comment><USER19> If you don't need extremely high speed, this is really easy to do with a Tor onion service. Granted the client needs to be a Tor browser, but there are benefits to not having to deal with these third party services.

</comment><comment><USER20> Love this app!

</comment><comment><USER21> Username is new, is this really a show hn or an ad

<comment><USER22> There's no rule that says that people new to HN can't do a Show HN.

<comment><AUTHOR> I admit, I'm usually a lurker :)

I have a few other things that I'm looking forward to sharing, though. I just started with this because it will hopefully contextualize some of the other content.

</comment></comment></comment><comment><USER23> Looks really cool, however the Mac store requirement is no a go...

<comment><USER24> Why is the Mac store a no go?

<comment><USER25> iirc its the 30% cut they take from developers, some folks are really against it and vow to boycott. I'm sure there's plenty of other reasons but thats the first that comes to mind

<comment><USER26> If the developer looked at the trade offs between using the Mac App Store and decided to use it anyway, why should the customer care?

I would think just the opposite, I would be more inclined to use the App Store that already has my payment information on file than pay an unknown developer directly.

</comment></comment></comment></comment><comment><USER27> What's the reasoning behind adding saliva to the dog's tongue on the principal image of the landing page?

It is so jarring and out of place that it's basically all I see there.

</comment><comment><USER28> I have exactly one application installed from the Mac Store and that's ironically Microsoft Remote Desktop viewer. This will not be my second one.

<comment><USER29> Thanks for that deep insight.</comment></comment>


Do Evil with ESP8266: Slow Down the WiFi - <AUTHOR> https://yoursunny.com/t/2016/WiFi-flood/ <comment><USER2> This reminds me of an old practical joke gone wrong.

Back around 1990 we had a college lab full of PC XT clones on an early Novell network on 'thinnet' (shared coax cable instead of star topology twisted pair to a switch). Some of the games floating around relied on the original PC's 4.77 MHz clock and ran too quickly on our 'turbo' 10 MHz machines so there was a slowdown utility that generated regular interrupts looping over a NOP to allow the games to run.

I thought it would be a great prank to put this slowdown utility on the boot floppies and AUTOEXEC.BAT of half the machines in the room and watch my classmates scratch their heads over some slow computers. Instead, it messed with the CSMA/CD (collision handling) on the network cards and essentially brought that portion of the network down. I showed up to a very angry network admin who had spent hours troubleshooting network cards and cable before finally finding one of the affected boot floppies. Fortunately (for me) he blamed another group and I escaped the full brunt of his wrath.

Shared medium, wired or wireless, always offers some extra fun.

<comment><USER3> pranks that surprise people, ok.

pranks that waste somebody's time, not ok.

I never want my time wasted, and I know that I can be fooled, there is no real challenge to wasting my time.

<comment><USER4> It's been 25 years, forgive the poor soul.

<comment><USER3> ha ha, good one! :)

but my personal peeve is actually a little different: regardless of whether I'm part of a unique group or it works this way for everybody, the different parts of my brain remember the prank differently and at different rates of speed, so even after the prank is revealed/resolved, the part of my brain that flinches keeps remembering the lie, not the truth. Like, my gf recently April fools' pranked me that my favorite restaurant was going to close soon. Now, every time I pass the place or think of it it, I immediately think "and I've got to go there soon before it closes" even though immediately after that I think "oh, no, that was a prank" I still have the surge of emotion. In terms of the prank, I get it, my reaction was funny. But in terms of time wasted, it's worse because it's Attention Deficit time, and I know I continue to find it sooo irritating well beyond the momentary pleasure she got out of it.

</comment></comment></comment></comment><comment><USER5> Welcome to unlicensed frequencies. You can also buy any number of legitimate narrowband continuous transmitters (e.g. an analog video transmitter) and effectively destroy one of the available channels.

<comment><USER6> And not-so-legitimate devices.

I've got a cheap Chinese 2.4GHz analog video transmitter in a box somewhere which is _way_ overpowered (600mW from memory, instead of the legal max of 25mW) it completely knocks out all my 2.4GHz wifi when I switch it on (and I strongly suspect all my neighbour's wifi as well). I've got much a less overpowered 5GHz which my 5GHz wifi doesn't seem to care about.

</comment></comment><comment><USER7> Ugh. If you guys keep posting about nefarious uses with the ESP8266, they're gonna take our toys away!

</comment><comment><USER8> Could you use the ESP8266 to generate deauth frames?

<comment><USER9> [https://github.com/quantum-x/esp8266-deauth](https://github.com/quantum-x/esp8266-deauth) (Among others..)

</comment></comment><comment><USER10> I completely believe the author's test results.

However...

> _One class of network packets is broadcast packet_ [...] _a major difference > from regular unicast packets_ [...] _the access point is no longer able to > choose a speed according to the channel quality between the access point and > the single recipient_

What's that last part? Why not?

 _WiFi standards mandate the access point to transmit the broadcast packet at the lowest speed_

Oh, I see. Wait, no I don't. The author implies that 802.11 is IP aware. Dubious to me, but ok, I'll google that... Aaaand, sorry, none of the titles of the top hits convinced me.

I think that 802.11 is analogous to ethernet. That is, it's link-level and TCP just happens to work over it. I don't think the AP changes transmit speed to all connected clients just because somebody sends UDP packets to 255.255.255.255... Especially since not every client has to have an IP address to be connected to the wifi!

If the author had some C code which contained 'FF:FF:FF:FF:FF:FF', I would have accepted the whole thing without a second thought. :)

> _Since each channel refers to a single wireless frequency, this would affect > all WiFi networks on the same channel, even if the stations are connected to > other access points._

Probably the author meant "have some performance impact" instead of "affect" there. Affect makes it sound like the same broadcast-related phenomenon (still dubious to me) is occurring between other APs.

In short, I believe that the author has caused the little device to slow down "the wifi", but I'm gonna have to see some packet dumps to believe the explanation of 'why'.

(Probably that tight loop generates X packets per second, enough to saturate the channel, and the slowdown is just due to an ordinary flood.)

<comment><USER11> > I think that 802.11 is analogous to ethernet. That is, it's link-level and > TCP just happens to work over it. I don't think the AP changes transmit > speed to all connected clients just because somebody sends UDP packets to > 255.255.255.255... Especially since not every client has to have an IP > address to be connected to the wifi!

> If the author had some C code which contained 'FF:FF:FF:FF:FF:FF', I would > have accepted the whole thing without a second thought. :)

Guess what any IP stack does (with broadcast enabled), when you send UDP packets to 255.255.255.255 (or all subnet address bits set to 1)?

It sets destination MAC address to FF:FF:FF:FF:FF:FF of course!

<comment><USER12> These packets won't be retransmitted or decoded by anyone for any purpose. They're on the incorrect BSSID. Think of a BSSID like a VLAN on an ethernet segment.

All this script will do is broadcast packets that jam the medium forcing folks to back off when they see the medium busy.

There are nastier ways to be nasty.

If you configure yourself to listen promiscuously, keep a list of all BSSIDs, you can send broadcast deauths with source MAC and BSSID on each.

If you see a data frame, you spoof the AP and send a deauth to the client, and spoof the client and send a deauth + disassoc to the AP.

Windows laptops are quite persistent - they'll reassociate and try to continue within about 30-50ms.

Apple OSX clients are pretty easy to kill. They'll get the !))) wifi sign if you're deauthing them every 100ms or so, and then they'll give up.

Depending on how fast your channel change code is, you can keep track of multiple channels and effectively perform 'shoot down' across multiple spectrum channels.

Some people might call this evil, but if an enterprise/retail deployment has someone deploying 'fake guest' wifi to steal user credentials or credit cards it is pretty important to shoot down the rogue access point.

<comment><USER11> > These packets won't be retransmitted or decoded by anyone for any purpose. > They're on the incorrect BSSID. Think of a BSSID like a VLAN on an ethernet > segment.

Sure. I was just saying sending packets to IP broadcast will cause IP stack to set ethernet frame dest MAC to broadcast address.

The end result of that broadcast spamming is simple shared medium flood.

</comment></comment></comment></comment><comment><USER13> > [T]he impact of adding a second evil ESP8266 is much greater than the first > one. One possible cause is the exponentially increased probability of having > the channel jammed due to simultaneous transmissions on the same channel.

The reason is that TCP connections increase their speed linearly (aka the the first derivative of packet transfer is increasing) until they experience packet loss. If many packets are lost, or if the network is congested, the speed will not increase

</comment><comment><USER14> How illegal is this?

<comment><USER15> Very. [https://en.wikipedia.org/wiki/Radio_jamming](https://en.wikipedia.org/wiki/Radio_jamming)

<comment><USER16> It's more of a grey area than that, FCC Part 15 devices must accept all forms of interference. There is no real recourse. Provided that the device is transmitting within 2.4 or 5.8 GHz band channel size limits and EIRP, it's not illegal to crap up the half duplex medium of Part 15 wifi bands.

Say you live in a wood framed apartment building and your neighbor to the left has a 2.4 GHz wifi AP running a 20 MHz channel on channel 1, your neighbor to the right has another similarly configured AP on channel 6, and your neighbor directly below you has an AP on channel 11. The other neighbors diagonally to you are on channels 3 and 7. The 2.4 GHz spectrum in your apartment is totally shit because you're seeing everyone else's AP at -68 or thereabouts, because it's a wood framed building and they're so close to you, the spectrum is totally crapped up and noisy but it's not "jamming". This script has the same effect on real world data transfer speeds as the effect in a totally normal major urban area "2.4 GHz is shit here because I live in a 65 unit building and every single suite has their own wifi AP".

What this small script is doing has basically the same effect on a particular section of 20/40 MHz wide radio spectrum as if you were to install any ordinary $70 wifi AP in WPA2-PSK mode, put it on your choice of channel, and leave a pair of laptops associated to it running bidirectional iperf tests on a 1-minute cron job continually between each other. Totally legit. It's just making the channel in question "noisy" RF-wise, because wifi radios are a "listen before transmit" (CSMA) half duplex medium.

Where it gets into a grey area is stuff like this:

[http://www.cnn.com/2014/10/03/travel/marriott-fcc-wi-fi- fine...](http://www.cnn.com/2014/10/03/travel/marriott-fcc-wi-fi-fine/)

[http://money.cnn.com/2015/01/27/technology/fcc-wifi- hotel/](http://money.cnn.com/2015/01/27/technology/fcc-wifi-hotel/)

operating a noisy 2.4 or 5.8 GHz shitty thing on your own AP is totally legal. Connecting to other peoples' networks or gear at a layer 2 ethernet level and issuing deauth frames is not, and the FCC can come down on you for it. The difference is that the first (being noisy) is at basically OSI layer 1, you're shitting on the radio spectrum the same way as if you had a non-ethernet- speaking RF noisy baby monitor, but not talking to anybody else's devices by their MAC address, the second is actually an active form of layer 2 ethernet fabric attack (that happens to be conducted via 802.11abgn(ac))

<comment><USER17> There is nothing _grey_ about it. Read it here: [https://www.fcc.gov/general/jammer- enforcement](https://www.fcc.gov/general/jammer-enforcement)

      Federal law prohibits the operation, marketing, or sale of any type
      of jamming equipment, including devices that interfere with cellular
      and Personal Communication Services (PCS), police radar, Global
      Positioning Systems (GPS), and wireless networking services (Wi-Fi).

If you use the device in this story to jam Wi-Fi you're a felon and the FCC will seize your equipment, bury you in fines and/or put you in prison. The "accepting interference" requirement does not immunize anyone from prosecution for jamming. Unlicensed != unregulated, and the FCC is perfectly capable of distinguishing between legitimate Part 15 operation and jamming.

<comment><USER16> What the hotel used was not a RF-shitting noise source/jammer of any sort, it was other properly certified/permitted Part 15 legal 802.11 wifi equipment equipped with "rogue access point containment" software features that perform deauth attacks in the 802.11 air protocol. Example:

[https://www.google.com/search?client=ubuntu&channel=fs&q=cis...](https://www.google.com/search?client=ubuntu&channel=fs&q=cisco+rogue+access+point+detection&ie=utf-8&oe=utf-8)

</comment></comment></comment></comment></comment><comment> Fry-kun Wait, I thought wifi had frequency hopping built-in..?

<comment><USER11> You were thinking about Bluetooth, it does adaptive frequency hopping.

Commonly used wifi doesn't frequency hop in the conventional sense.</comment></comment>


Internet fridges: the zombie idea that will never, ever happen - <AUTHOR> http://www.theguardian.com/technology/2014/jan/07/internet-fridge-lg-ces-2014 <comment><USER2> Reminds me of some other quotes from the past.

"There is practically no chance communications space satellites will be used to provide better telephone, telegraph, television or radio service inside the United States."—T.A.M. Craven, Federal Communications Commission commissioner (1961)

"Everyone's always asking me when Apple will come out with a cell phone. My answer is, 'Probably never.'"—David Pogue, The New York Times, 2006</comment>


Yahoo Has Hit Rock Bottom And Is In "Absolute Disarray" - <AUTHOR> http://techcrunch.com/2010/12/17/yahoo-disaraay/ <comment><USER2> Where does Arrington get off, calling for the head of Yahoo's CEO without once disclosing that he's owned by a major competitor?

That said, I don't have much issue with the content.</comment>


H5Validate - The HTML5 Form Validation Plugin for jQuery - <AUTHOR> http://www.ericleads.com/h5validate/ <comment><USER2> This looks interesting!</comment>


Facebook CTO Bret Taylor Departs - <AUTHOR> http://allthingsd.com/20120615/exclusive-facebook-cto-bret-taylor-departs-for-start-ups-unknown/

<comment><USER2> Nobody seems to be mentioning that Kevin Gibbs, Bret's new co-founder, has also been the driving force behind Google App Engine for the last five years.

</comment><comment><USER3> His Facebook announcement: <https://www.facebook.com/btaylor/posts/10100299350436123></comment>


WHO says coronavirus death rate is 3.4% globally - <AUTHOR> https://www.cnbc.com/2020/03/03/who-says-coronavirus-death-rate-is-3point4percent-globally-higher-than-previously-thought.html <comment><USER2> _"Globally, about 3.4% of reported COVID-19 cases have died," WHO Director- General Tedros Adhanom Ghebreyesus said during a press briefing at the agency's headquarters in Geneva._

It seems likely that the number of reported cases grossly underestimates the number of actual cases though, given that many of the infected have fairly mild symptoms. Which would translate into a lower actual mortality rate.

</comment><comment><USER3> Numbers as of 10:30pm EST

3198 deaths / 93123 confirmed cases = 3.4%

</comment><comment><USER4> What is it if you exclude the elderly and very young?</comment>


Visitor from another solar system accelerated away from the Sun - <AUTHOR> https://arstechnica.com/science/2018/06/visitor-from-another-solar-system-may-have-been-a-comet/ <comment><USER2> "System's dominant species not recommended for contact at its current state of development"

</comment><comment><USER3> [https://www.google.com/search?q=rama+come+in+threes&oq=rama+...](https://www.google.com/search?q=rama+come+in+threes&oq=rama+come+in+threes&aqs=chrome..69i57.4403j0j7&sourceid=chrome- mobile&ie=UTF-8)</comment>


Letter from Transnistria - <AUTHOR> http://calvertjournal.com/articles/show/4781/letter-from-transnistria-tiraspol-independence-day <comment><USER2> No idea why this is near the top of hackernews, but I've been there. One time when I was there, there was a huge billboard in front of the old ministry of culture with the (then) presidents of Abkhazia, South Ossetia and Transnistria smiling together. The local gag at the time was that this was the "Commonwealth of Unrecognized States" \- meanwhile Putin was meeting the Commonwealth of Independent States in Chisnau. [1]

Far be it from me to attempt to summarize a nation in a few sentences, but one would be remiss without following up that article by saying the obvious.... Transnistria is a place run by gangsters. The hammer and sickle are printed on their money to appeal to the old folks who long for the days of Soviet protection, meanwhile everything is for sale - including people. This is a hub for the trafficking of everything.

I don't say this out of love for the state it broke away from, Moldova, the poorest country in Europe, the last communist country in Europe, which has all of the same problems at a different scale.

p.s. no need for endless paperwork - fifteen euros to the border guards will secure your entry no matter where you come from.

[1] [http://imgur.com/8wf688Y](http://imgur.com/8wf688Y)

 __edited to change: I wrote "fifty" euros when I meant "fifteen" \- I probably overpaid, but not by that much!!

<comment><USER3> >edited to change: I wrote "fifty" euros when I meant "fifteen" \- I probably overpaid, but not by that much!!

You sure overpaid. It costs something like 50 UAH (in 2013 rate) if you pay on exit and you would not even miss your bus.

<comment><USER4> Tha UAH is much weaker now than in 2013, but even 100 UAH would be really cheap. That's crazy.

<comment><USER3> That would buy a "border guard" few beers. Why would he want more for not causing some person a trouble on their way?

The other story if you would have some drugs or make some legit reason to arrest you and demand ransom, but nothing you would not be able to pay anyway.

</comment></comment></comment></comment><comment><USER5> A Vice article on it:

[http://www.vice.com/en_uk/read/atlas-hoods-weapons- smuggling...](http://www.vice.com/en_uk/read/atlas-hoods-weapons-smuggling- youth-cults-in-the-country-that-doesnt-exist)

It is basically a Russian foothold closer to Western Europe. The only reason that regime exists is because the Russian army is there.

It is a hub of human, weapons and drug trafficking and a nice place to hide if you want deal in shady things like that. Moldovan police can't go there and Russian police doesn't care.

Another article:

[http://www.investigatii.md/eng/index.php?art=221](http://www.investigatii.md/eng/index.php?art=221)

<comment><USER6> Some Romaniams I follow refer to Transnistria as "basically a Russian military base," and are of the opinion that the Russians are so entrenched that's likely never to change....

[Shades of the Crimean peninsula...]

<comment><USER7> Transnistria-Moldova might look like Crimea-Ukraine today but in the early 90s it looked more like Kosovo-Serbia and the Russians that intervened at the time were probably correct to do so.

<comment><USER8> You're wrong, the Russians intervened when the rebel forces where losing ground against constitutional forces of R. of Moldova. And while doing so they invented stories of a "genocide". Basically, if you follow the Donbass events, the propaganda is the same.

<comment><USER7> Russia has had 20 years to annex Transnistria if they wanted it, not remotely the same as Crimea IMHO.

The "constitutional forces of the R. of Moldova" were not a professional army but a mixture of police and hastily armed militia that included ultranationalist elements who were encouraging expulsion/cleansing of non- Moldovans. There were real fears that these "constitutional forces" would do the same sorts of things as the Serbian "constitutional forces" were doing to Yugoslavian separatists.

<comment><USER9> Disclaimer- as a Pole I'm biased against Russia.

IMHO Russia mostly wants influence on politics in all neighboring states. It only invaded Crimea and put army in Donbas in Ukraine when other ways to exert influence failed (Ukrainians did 2 revolutions, against all economic odds; it was clear Russian influence will end).

Russia doesn't invade Belarus, because it already has control.

Russia only invaded Georgia when they got dangerously close to "solve" the South Ossetia problem (another matter is how Georgians wanted to solve it).

It's also present in Russian diplomatic language - "close abroad" is the term, and Russian diplomats say they have right to participate in the politics of the near abroad. Frozen conflicts are a good way to ensure these border states won't join EU/NATO which are still seen as enemy in Russia.

<comment><USER7> I don't disagree with any of this, I will just point out that "Russia does lots of bad things" does not imply "Russia only does bad things". I happen to believe, in this one small instance, Russia action may have minimized loss of life.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Guys, I live there all my life, in Tiraspol, and I don't agree with you.

Here's no gangsters, no communism. Of course it is not as developed as Chisinau, but far better place to live than the rest of Moldova and Ukraine.

Pensions are much higher than in Moldova, lots of people from Chisinau when they get old buy here appartment and move over.

Questions are welcome. Can make proofs if needed

<comment><USER11> "Pensions are much higher than in Moldova, lots of people from Chisinau when they get old buy here appartment and move over."

Oh, it sounds so better economically! What do you have to say about the fact that Transnitria did not paid anything for the gas it consumed for over twenty five years now (and was left on Moldova's bill note)? Or for a lot of other things for that mater? Now about the immigration, are you serious? There is so much effort directed at keeping the outsiders out, so much scrutiny over anyone (even on locals), you understand why the claim that someone can just come not only for a few hours but indefinitely is just surreal?

<comment><USER10> I wont argue regarding gas, don't know much about it, but this situation somehow solved as far as Im aware; it never pops up on official discussions.

As about immigration - you can trust me, those are not abstract words as I know about this not from press but from my living. Prices on appartments are high due to lots of people from moldova buy appartments here.. and this is due to low utility fees (water, gas, electricity) comparing to right coast.. Of course most of people in region try to immigrate to Europe and Russia, but still there is a bunch of them immigrating to Transnistria, amount may seem small but for our region it's enough to keep appartment prices high enough

</comment></comment></comment><comment><USER12> Transnistria was one of the strangest places I ever visited. It still lives in their old Soviet times and you can find statues of Lenin everywhere. Other than that there is not much to do in this country.

To illustrate the state of this country, you can take a look on results of election in 2001: Igor Smirnov won, collecting 103,6% of votes.

<comment><USER3> It sure is strange, look something out of this space-time, really. I'v been there in 2013 (cycling from Odessa to Chisinau).

Lenin, communist symbols, Sheriff symbols, billboards advertising 3G and suddenly every sign written in Russian. Locals are scared to accept hryvnyas as payment - think it's tax office check or something. Ended up paying the price in soviet-looking monopoly money and tipping in hryvnyas.

Talks about Russian military are something overestimating. Few bored "peacemakers" on Bandery bridge and locals that serve in Russian military because that's no work anywhere.

<comment><USER13> Interesting the amount of HN users have been to that little shithole (including me!). I did Chisinau to Odessa and back in marshrutki, in 2014, around the time of Yumorina.

One point is that not _everything_ is written in Russian; some is actually Romanian written in Cyrillic characters.

I secretly took some pictures of the border control with my DSLR, and when they were puzzled at my passport my then gf had the brilliant idea of taking more, like, in the open. They forced us to delete them. Tried undelete tools later to no avail, unfortunately.

</comment></comment></comment><comment><USER14> There's an excellent SF novella, Walter Jon Williams' _The Green Leopard Plague_ , where Transnistrian corruption happens to be a major plot device. The other characters derisively call the Transnistrian government "Trashcanistanis." This story was my first encounter with Transnistria, and it seemed weird enough to be fictional, but later I found out it was real.

</comment><comment><USER15> See also [http://www.idlewords.com/2009/06/transnistria.htm](http://www.idlewords.com/2009/06/transnistria.htm)

</comment><comment><USER16> I was there in 2003 and I can confirm that when people realize that you're a foreigner they just stare at you like you come from an over planet !

It was an interesting experience, people are really nice and are remarkable hosts (if you don't mind being stared at ;-).</comment>


Are Avocados and Almonds Vegan? - <AUTHOR> https://www.cnn.com/2019/05/10/health/avocado-almond-vegan-partner/index.html <comment><USER2> Non-vegans are always trying to do this smug "checkmate vegans" bullshit. It's incredibly tiresome.

There's this bizarre, illogical trope that doing _some_ good is pointless if you can't be absolutely, impeccably perfect in every way. Again, it's just obvious bullshit from people who don't even really believe what they're saying, they're just playing a stupid gotcha game.

<comment><USER3> Vegans _own_ smug and 'ethical checkmate' inanity - the 'eco' ethos of food goes hand in hand with this, they are the same thing; don't blame outsiders.

I have never in real life heard of anyone contemplating nuts and avocados as 'vegan' or not, but I hear all the time from my vegan-leaning friends about GMO's, palm oil, and everything else.

Most of us just want a croissant made with butter and would like for it to work out in some reasonable way for everyone including the cow.

<comment><USER4> >Vegans own smug and 'ethical checkmate' inanity

I maintain that the Vegan Police from Scott Pilgrim are one of the finest satirical concepts I've ever seen in fiction.

<comment><USER5> You do realize they exist online, right? ;) People are usually way nicer in person.

</comment></comment></comment></comment><comment><USER6> I hate these stupid arguments. The entire point is to muddy the definition of a word so much as to render it worthless for political reasons. It's like how assault rifle was a well understood term in the 70s and 80s, but today groups quibble over technical minutiae in an effort to invalidate the term.

As with most labels, the word vegan has a fluid, rough definition which varies slightly over time and person-to-person. If someone tells me they are a vegan, I know they are trying to tell me that they avoid foods that use animal parts or their byproducts. It's not some fucking contract they entered into prohibiting them from eating whatever foods society decides to impose the vegan label on via mental gymnastics. If they are cool with eating the butter made from Betsy, my happy cow, then whatever, let them eat the butter.

FWIW, I'm a carnivore and object to the consumption of almonds because of their harmful impact to the environment. That might make me a hypocrite to someone because I'm totally okay with eating a banana or something. But I don't care, I'm free to decide my own arbitrary moral compass for whatever reason I choose.

I guess I'm aggravated by society's needless pedantry over language. Not every word needs a rigid legal or technical definition that should be adhered to. And the people guilty of this are largely doing so because they don't agree with you and are attempting to make you look stupid to justify their position.

</comment><comment><USER7> Even the most ridiculous of militant vegans (and they get pretty ridiculous) would consider things like almonds, avocados or figs vegan. Stop with the perfectionism and the nitpicking. It's bad for the movement and bad for the animals/environment.

"Veganism is a way of living which seeks to exclude, _as far as is possible and practicable_ , all forms of exploitation of, and cruelty to, animals for food, clothing or any other purpose."[1]

1\. [https://www.vegansociety.com/go-vegan/definition- veganism](https://www.vegansociety.com/go-vegan/definition-veganism)

<comment><USER8> > Commercial farming of those vegetables, at least in some parts of the world, > often involves migratory beekeeping.

> Vegans avoid animal products. For strict vegans this means avoiding honey > because of the exploitation of bees. That seems to imply that vegans should > also avoid vegetables like avocados that involve exploiting bees in their > production.

It seems like there are some vegans who consider it. If exploiting bees for honey is non-vegan, why would exploiting bees for other purposes be acceptable?

<comment><USER7> because if you look far enough down the rabbit hole, nothing is vegan. Hence "as far as is possible and practicable".

If you are vegan except honey, good for you. If you decide that doesn't fit your worldview/morals, then good for you. If all you care about is meeting some other persons very specific standard of veganism, then you are probably doing it for the wrong reasons to begin with.

<comment><USER8> I think a real vegan would not be spying on innocent rabbits in their holes.

<comment><USER7> yea we should really start considering the privacy of the animals. It's a hot topic with humans, so might as well include everyone.

</comment></comment></comment></comment></comment><comment><USER9> Here's the definition of veganism by the Vegan Society: "Veganism is a way of living which seeks to exclude, as far as is possible and practicable, all forms of exploitation of, and cruelty to, animals for food, clothing or any other purpose."

</comment><comment><USER10> As a non-vegan, it really irks me when other non-vegans try to "checkmate" vegans with situations like this. It's a personal choice to not partake in the factory meat/animal products industry and the measurable harm that comes to life forms from it. True, you can show that vegetables and other byproducts can be derived from human labor cost, but when the rubber meets the road, and you make an individual choice on what products to consume, it's valid to judge these ethical concerns and decide what best fits into your personal values set. I think it helps that I come from the Hardcore Punk scene where many of my friends are vegan.

</comment><comment><USER5> Clickbait title! Nothing on this planet would be vegan if we look closely at harm caused by any behavior or habit or use. It's about reducing harm and least harm. If people understood that part of veganism and then moved further to understand it better, there wouldn't be so much hatred or so many clickbait titles.

Pointing out the truth and informing people about the consequences of their choices can be done without silly titles that make many people roll their eyes.

</comment><comment><USER11> Not sure about the vegan part but I've just discovered that avocados require lots of water during production and as such are not very natural-resource- friendly.

[https://old.danwatch.dk/en/undersogelseskapitel/how-much- wat...](https://old.danwatch.dk/en/undersogelseskapitel/how-much-water-does- it-take-to-grow-an-avocado/)

<comment><USER12> For comparison: [https://foodtank.com/news/2013/12/why-meat-eats- resources/](https://foodtank.com/news/2013/12/why-meat-eats-resources/)

Beef is ~1800 gal/lb ~= 15,021 liters / kg, vs 283 liters / kg for avocados, as per your link...

There was a pile of scaremongering press about this a couple years ago, which somehow always left out meat production comparisons... You get most of the benefit by eating low on the food chain. Additionally cutting out important sources of vegetable fat + protein seems a bit dangerous to me.

<comment> village-idiot I think it's very misleading to actually make this comparison, because it ignores the different types of water: green (rain) and blue (treated and irrigated).

Beef in particular consumes a lot of water, but a lot of it is green, which is much more environmentally friendly than blue water.

<comment><USER12> Here's a site (with terrible UX...) from comparing liters/kg for various foods, broken down into green/blue/grey:

[https://waterfootprint.org/en/resources/interactive- tools/pr...](https://waterfootprint.org/en/resources/interactive- tools/product-gallery/)

Beef lists there also at 15,415 liters/kg, with a 4% 'blue' (filtered/treated) component, which works out to 616.6 liters/kg - still double the total water kg/liter for the avocados (which, themselves, will have a green/blue/grey breakdown).

(It's also not obvious to me that one should consider 'green' water as a completely free resource. Plants bred for fast growth with constant replacement will consume more water, which in turn won't find its way into aquifers.)

<comment> village-idiot And this is a much more nuanced breakdown. Double the blue water vs. the orders of magnitude that's typically presented. Personally I believe that the health benefits of meat is well worth doubling the per kg blue water cost of my food.

On the discussion of green water, that depends on location and animal husbandry technique. It does appear that some places we let pasture raised cattle roam can help with the replenishment of soil layers and also sequester carbon to boot. Managed intensive rotational grazing in particular is very promising.

I think we desperately need to be having a discussion about better animal husbandry and land management (see: Brazil). But whenever I hear that all we need to do is "just" do one thing, my bullshit detector goes wild, and the idea that we can fix global warming by reducing meat consumption falls well into that category for me.

<comment><USER12> To be sure - the beef is using twice as much blue water as the TOTAL for avocados. My guess (looking at the listed breakdowns for other vegetables) is that the direct blue water comparison would be somewhere between 4x and 8x.

It's certainly the case that there's no magic bullet - no one here (that I've noticed) has claimed that reducing meat consumption will 'fix' global warming. Conversely, people tend to become vegans for a range of reasons, in which environmental impact is just one facet... Many times a problem will require a range of solutions, and sometimes a solution helps with a range of problems.

</comment></comment></comment></comment></comment></comment><comment><USER13> The absurd logical conclusion is to stop eating and die.

We all want it to be better. Vegans are trying. People are trying. What good does this discourse serve?

<comment><USER14> _The absurd logical conclusion is to stop eating and die._

That's a thing.[0] Not literally starvation, but the "earth would be better without us" part.

0 - [https://en.wikipedia.org/wiki/Voluntary_Human_Extinction_Mov...](https://en.wikipedia.org/wiki/Voluntary_Human_Extinction_Movement)

<comment><USER5> I rage against this many a times. It's one of the most absurd and illogical things that some people have come up with.

To your point though, it doesn't directly relate to the GP's point. Voluntary Human Extinction Movement requires breeding to reduce and stop and make humans extinct. It doesn't require those who are living to just kill themselves.

</comment></comment></comment><comment><USER15> It's fun to reduce complex, varied and nuanced ethical stances into as few as possible boxes and give them cool names like sufficientarianism, and that way, we can all pick a clan and then argue about true scotsman all day long.

I'm curious, what ethical box would I fit in if I'm more worried about maximising my sustained access to high quality avocados and honey? So that it is the balance optimum between being healthy and safe to eat, produced sustainably, delicious, varied in flavors, and available for me to buy year round?

</comment><comment><USER16> My first impression was "D'uh", but then, from the article:

> Vegans avoid animal products. For strict vegans this means avoiding honey > because of the exploitation of bees. That seems to imply that vegans should > also avoid vegetables like avocados that involve exploiting bees in their > production.

I'm not vegan, so I don't know how deep they are involved in "not animal exploitation" even is not obvius nor direct

</comment><comment><USER17> There should be a word for "overly concerned and judgmental about what other people do in their private life"

<comment><USER4> >There should be a word for "overly concerned and judgmental about what other people do in their private life"

How about "vegan"?

<comment><USER7> haven't heard that joke before...

</comment></comment></comment><comment><USER18> I think you can make a case that there are vegans, and there are Vegans. Much like you can be libertarian without being a Libertarian, or enjoy the search for truth without ever worrying if what you have learned is The Truth.

I strive to be vegan, though sometimes I am unsuccessful. I also strive not to lie, though sometimes my friend wants to know if this whatever looks good on him or her.

I strive to be a person who eats only plant and plant-derived food, for several personal reasons (including some ethical!), though I don't really care about whether a bee was transported from one field to another to pollinate something. If that makes me not a Vegan, then I don't care. But I still try to eat plant-based foods.

But I also don't call myself a vegan or even an aspiring-vegan. I am almost certainly a vegetarian since I don't eat any meat, though I don't call myself a vegetarian.

Personally, I am satisfied letting the person who wants to or is trying to be vegan decide for themselves whether they are comfortable eating avocados or whatever.

People would be happier in life if they weren't so concerned about absolutes, I think. Just try to be who you want to be. If you want to try to be the best capital-V Vegan as defined by someone else's standards (and adopt them as your own or w/e) that you can be, then maybe don't eat avocados.

</comment><comment><USER19> If they aren't because of the "exploitation" of bees in migratory beekeeping, then ethical vegans probably need to also consider the use of manure as fertilizer, where or comes from, and what crops it is used on in assessing acceptable vegan food.

<comment><USER5> Check out "veganic farming" or "stock free farming". That addresses the point you're referring to, though it's not practical in many places yet.

</comment></comment><comment><USER20> Yes, they are. EOD.

<comment><USER21> I agree, it's just mind boggling to think otherwise. It may or may not be ecologically responsible, but consuming the indirect fruits of bee pollination labor, is distinct from consuming their direct resource of honey, which could be viewed as a "body part" of the larger organism.

By this quiz rationale, your average vegetable wouldn't be vegan because it may rely on animal fertilizer...

<comment><USER4> >By this quiz rationale, your average vegetable wouldn't be vegan because it may rely on animal fertilizer...

Heck, this could be extended to the use of oxygen to breathe. It's another byproduct of a plant process that has animal waste (CO2) as an input.

</comment></comment></comment><comment><USER22> I tired of zealots.

What you eat is a personal choice.

If the whole world ate dogs routinely, I would choose carrots.

Some would say "Ah, stupid carrot eater doesn't know the root bacteria he's killing is also sentient!" Dogs, bacteria: all under the living tree.

See, eat anything and shut up you stupid carrot eating zealot.

Then there's the Corgi burger macs for $2.5 and the corporate lunches where I ask for any menu exception and get the carrot soup entree for $25.

Never mind the free range German Shepherd steaks or bulldog sausage, that shit is everywhere.

But taste is not everything my friends,

sometimes it takes real cognitive effort to be aware of factory farming, government subsidies, nutritional health, environmental downstream effects and other considerations before you open your big mouth.

A little impulse control goes a long way.

That said, I still wear my 7 year old dog leather shoes from China and don't subscribe to any CarrotPower YouTuber channels.

What's up, doc?

</comment><comment><USER23> Is it be exploitation or do the bees get to see, smell, and taste more of the world?

</comment><comment><USER24> Is ice cold?

<comment><USER25> This comment was flagged to death but honestly, while posed silly, it's a similar argument as most. Many others here are saying vegan is a "fluid" term or something along those lines, and one might say that "cold" is similarly relative. There are some worse comments in this thread.

</comment></comment><comment><USER26> > vegetables like avocados

Avocados are a fruit...

<comment><USER27> "Vegetable" isn't a botanical word, but it's culinary. The term "fruit" is both botanical and culinary. A fruit can be considered a vegetable or a culinary "fruit".

<comment><USER28> Yes, but that's not relevant here. Culinarily, they are not a fruit either.

<comment><USER27> I never said they're a culinary fruit... check my last sentence again.

</comment></comment></comment></comment><comment><USER29> This isn't going to bother anyone, since vegans have made peace with killing thousands of insects every time a field is harvested.</comment>


Ask HN: What are your favorite NYC meetups for finding collaborators? - <AUTHOR>

Hi HN,
I've been working on a software project for a while and finally have it at a point where I think there's something worth showing to people to work on with. I've been trying to follow advice similar to this: https://news.ycombinator.com/item?id=8096810 to build something I can show to others ("Turn the concept into a project. Work on any bits and pieces of the project that you can. Go to meetups, bring your idea to a hackathon, and maybe do a Show HN when you've got something tangible.") - I don't think I'm ready for a Show HN, but I would like to go meet possible collaborators at local NYC meetups. Since we here in NYC are currently swimming in meetups / startup events, I was wondering which ones people would recommend. I found some old suggestions on HN, but they are mostly defunct now.
Thanks! <comment><USER2> The more specific the group's focus is the better, in my experience. So I'd need to know more about what kind of project this is before recommending.</comment>


Canonical asks desktop users to "pay what you think Ubuntu is worth" - <AUTHOR> http://arstechnica.com/business/2012/10/canonical-asks-desktop-users-to-pay-what-you-think-ubuntu-is-worth/ <comment><USER2> Holy freakin' hell that is an awful headline. This is a DONATION, nothing more. Canonical is not asking people to pay, it is asking people to donate if they are so inclined. The press releases states that Ubuntu is and always will be free.

Use Ubuntu and want to give some money for it? Great. Donate. Now there is a way where previously there was none.

Use Ubuntu and don't want to give money? Great. Don't donate.

Don't use Ubuntu? Carry on.

<comment><USER3> I don't use Ubuntu and I am carrying on.

But... that download page [http://www.ubuntu.com/download/desktop/questions?distro=desk...](http://www.ubuntu.com/download/desktop/questions?distro=desktop&bits=32&release=lts)

A) makes it a pain to drag everything to $0 (8 sliders to drag) B) makes it seem like you're getting a t-shirt too C) makes me feel bad for downloading it for free. D) is any of that money going to the Linux Foundation? It's not clear - if not, shame on them.

<comment><USER4> The linux foundation is responsible for a very small portion of Ubuntu, and is probably one of the most funded parts. When I donate to Canocial to support ubuntu, I expect that money to go to where it will be most useful to making a good product.

</comment></comment></comment><comment><USER5> Presenting this screen before you can actually get the OS does not make much sense for new users. They won't know if "hardware support on more PCs" or "performance optimisations" will be any important for them. It'd be more sensible for this to show up as a built-in screen after you've used Ubuntu for a few months.

<comment><USER6> "Paying before you can actually get the OS does not make much sense for new users."

It does make sense for Windows and OS X users :)

<comment><USER7> Windows and OSX users aren't asked to itemize their 'contributions' into various buckets.

</comment></comment></comment><comment><USER8> I saw this yesterday when I was experimenting switching from Linux Mint to Ubuntu on one of my laptops (multi-monitor problem that forums hinted were fixed in latest Ubuntu).

What confused me about that page was this:

"Pay what you think it's worth" is a question based on past experience... you either have no experience and think the value is zero or you already have experience and think it's worth $x.

But then all of the options were very clearly angled towards the future and answering a different question "Where would you like us to invest?".

It baffled me as without downloading and using Ubuntu I couldn't give you an indication of what it is worth to me right now, and I couldn't say which part I felt needed investment in the future. Even if I were a regular user of Ubuntu and was upgrading from one LTS to another, how would I know which bit now needs investment until after I'd seen what has changed?

I also could not see any indication that were I to have slid a slider one way, that this guarantees that is where my money will go. In the UK, organisations that take donations are bound to only use such funds for the purpose in which they've been taken, less reasonable administration costs.

Canonical being based in the UK, does that mean that they are creating different accounts per-slider and ring-fencing the funds solely for that use? I doubted it.

I did the only thing I felt was rational and downloaded without a contribution.

To me a more logical thing would be to ask for a contribution after I knew there was value there.

In my case that means to let me install it, see whether it solves my multi- monitor problem, and then suggest I contribute.

Or it could mean that in the support forums or interfaces if a solution removes pain, ask me for money right then... I'll happily give it.

At those points I know the value and know where I want to see future investment. But at download time? Nah, I know nothing.

If you're going to ask for something at the moment of download then a simple tip jar would do the trick. The question of "Where should we invest in the future?" should only be asked after someone is using Ubuntu.

<comment><USER9> I agree that the page is a bit poor in communicating why you should pay, and cumbersome to use. OTOH, the paypal order page does indicate how much money you put towards each of the goals, so I suppose it is possible they abide with the UK laws.

Personally I would be happy to have a monthly subscription to simply keep Ubuntu improving, even without any additional value on top of what they already provide. I realize this could be done by simply donating monthly. However, in a subscription model they could probably set up a two-way communication channel between them and paying customers, to both help refine their goals and estimate how well they're being met, in a more continuous manner than random donations at download time.

</comment></comment><comment><USER10> Not a bad idea. The areas where I have the biggest problems with Ubuntu is hardware support and new updates just breaking my system. It's so bad that I REALLY want to just go to Debian Stable as my primary OS. I just can't handle that much downtime to switch over at home and the office.

I'm a developer. I don't give a shit about a fancy desktop. I just want my hardware to work good with the O.S. and for updates not to wreck my system. Why? Because I just want to write code, run what services and daemons I need, and read shit on the internet.

It's really fn frustrating. I've been using Ubuntu for 4 years solid now when I ditched Windows. I'd be willing to donate to the two areas I highlighted, but if shit didn't get better....

<comment><USER11> I used Debian stable as my primary OS for a couple of years. While I was just fine without the fancy desktop, at the time Firefox was stuck on version 3.0 even though 3.6 was available.

I don't know what the situation is like now, since I haven't used linux on my laptop for a couple years, but if I were to go back, I would want something like Debian stable, but with an updated browser.

<comment><USER12> There's now the backports service, <http://backports.debian.org/> where you can get newer versions of packages recompiled for stable.

<comment><USER13> And using this service of course partially defeats the point of using Debian stable at all, at least for the packages that you install from backports.

<comment><USER14> I can imagine it being more useful for things that are easily fixable/less critical.

I was running a testing desktop, and X updated in a way that broke the proprietary nVidia drivers (nVidia's fault -- not Debian's.) That was quite annoying to suddenly have to fix. Those types of issues (though rare, even in testing) would be nice to avoid.

</comment></comment></comment></comment></comment><comment><USER15> I would like to pay the folks that manage the wonderful apt software repository. Not one red cent to the Unity team, though. I don't like where they are taking Linux.

<comment><USER16> The repository maintainers seem pretty shy, but I'm pretty sure that the original author behind apt is this guy: <https://github.com/jgunthorpe>, and you could send him a few dollars using gittip: <https://www.gittip.com/>

<comment><USER17> As jgunthorpe is not located in the U.S., receiving those dollars would involve a manual process and extra fees: <https://www.gittip.com/about/>

</comment></comment></comment><comment><USER18> I'd like to, but I think if anything I'd donate to Debian first.

<comment><USER19> Can you explain the reasoning behind that?

<comment><USER20> To many people, Ubuntu represents nothing but a shiny front end build on top of the years of hard work spent on building Debian, the universal OS.

These people (we) are willing to use Ubuntu, since it is pretty much the same thing, but they (we) will never go out and actively support the Ubuntu project as we believe that Debian is more deserving of our support.

<comment><USER21> I think I (sorta) understand your reasoning, but it doesn't make much sense to me. When I write some application that makes it easier for my clients to do some previously complex tasks and I ask them to tip me, I don't expect them to tell me that the previous system or database did most of what made my work possible.

These "donations" aren't just there to thank developers for past works, but also to equip the distro so that it can improve and continue to push the envelope _its way_.

Ubuntu's users chose to download and install Ubuntu, not Debian, probably because they like whatever Ubuntu does that you find so insignificant and that other distros aren't doing. I suspect that you too are running Ubuntu, not Debian, for the same reasons.

When Ubuntu asks for money, that's because Ubuntu needs it to keep doing those insignificant Ubuntu stuff, that made you choose to install it, not Debian. So, don't bring up Debian.

When Linux Mint started their own distro, they didn't go all the way down to Debian. Ubuntu probably did something worthwhile, that Mint would rather not do themselves. But people who installed Mint didn't install Ubuntu, so when Mint asks for donations, it's for Mint stuff. Let's not bring up Ubuntu.

This is written on Debian's donation page (<http://www.debian.org/donations>):

 _While all donations are welcome, it is especially hoped that any businesses that make money through Debian (CD manufacturers, support companies, or even businesses that rely on Debian for day to day operations) will contribute a percentage of their profit to help make Debian the best OS it can be._

Get it? _help make Debian the best OS it can be_. Let's not bring up GNU or Linux.

<comment><USER22> Mint did go 'all the way down to debian' - there is a Linux Mint Debian Edition.

</comment></comment></comment></comment></comment><comment><USER21> Every couple of months, I recharge my Themeforest account (html templates), as well as my Moniker's (domain names). I pay and they credit my account, which makes it easier to buy goods, without the hassle of a payment process. The thing is, while I put in $50, I probably only use $10 at a time and my account can stay credited for months. I'd be ready to bet that by the time my credits have all been spent, the money I originally paid for them has accumulated some interest for these vendors. This revenue model is rather common.

If Ubuntu sold vouchers that allowed me to buy software at a slight discount, rather than connecting to Paypal each time, I'd pay for it. The best part is that it has the numbers and the products to make it work for them as well.

</comment><comment><USER23> So, the tricky question is - what if we can't afford that? Does that mean that, ethically, I should no longer use the product if I want to honor Canonical's request?

<comment><USER24> I'm not sure what you mean by "can't afford that."

If you think Ubuntu provides you with $X in value but you literally do not have $X to your name, well, I'm not sure how it could be providing $X to you, then.

You could be totally broke and feel like Ubuntu has the potential to provide you with $X in value (by helping you get a job, for example). You could just donate when the value is realized, not before.

Maybe you didn't mean that you literally don't have $X, but instead meant that you might not feel like it's worth paying $X for what you get out of it. In that case your choice of X was simply too high.

I don't really like the phrase "Pay what you think it's worth" for two reasons.

One of my issues with it is that it's easy to think of it as a fixed impersonal price rather than something that varies from person to person at any given time.

The other issue is that, as a developer, I do NOT want users paying what my products are worth to them. I want them to pay less than that, so they get something out of the deal. I want people to be better off for having acquired my software, I do not want to extract 100% of the value they get out of it in exchange.

<comment><USER25> >If you think Ubuntu provides you with $X in value but you literally do not have $X to your name, well, I'm not sure how it could be providing $X to you, then.

I'm not sure I follow your reasoning.

Imagine I have disposable income of $0 and I currently use Ubuntu. By your reasoning, Ubuntu is worthless to me. However, let's say that if you offered me $1 to stop using Ubuntu, I would say say "no". We can safely conclude that Ubuntu is worth more than $1 to me, even though I don't have $1 to pay for it.

Ability to pay doesn't always equal value created. If I like take walks in a national park, I obviously derive value from that resource, but I don't pay anything for it and it doesn't allow me to generate any additional income.

<comment><USER26> You certainly do pay for national parks. If you're a citizen, you pay for it in income taxes and any money paid to local businesses while shopping that they then owe in taxes. If you're not a citizen, you're still indirectly paying through taxes paid to businesses while you are on vacation. National parks are not all funded by the entrance fee, they're government-subsidized.

To answer the question, no it is not unethical to use free software for free when you cannot afford to donate. Canonical is not expecting you to pay for it, merely making it clearer that you are _able_ to pay for it if you wish. This comes on the heels of the outcry over Amazon search being built-in, with people asking if Ubuntu is hurting for cash, why is it not easier to give them money?

<comment><USER25> >You certainly do pay for national parks. If you're a citizen, you pay for it in income taxes and any money paid to local businesses while shopping that they then owe in taxes. If you're not a citizen, you're still indirectly paying through taxes paid to businesses while you are on vacation. National parks are not all funded by the entrance fee, they're government-subsidized.

Yes, but if you're a citizen you "pay" for it in a legally obligated way, so that payment tells an observer nothing about your preferences.

I spoke imprecisely, but my point was that there are resources which are free at the point of use which still have value to the user. Perhaps a national park was a bad example, I should just have said "the countryside".

</comment></comment></comment></comment></comment><comment><USER27> We called for this when they announced they'd be putting affiliate links in search results, so I'm happy to see it.

I just want to see the affiliate links go away now :)

</comment><comment><USER28> So, I use Ubuntu as my daily driver. But, I am deeply conflicted about this. Primarily because I have heard/read that Ubuntu does not spend its money on developers (expecially core, kernel, fs) and rides on Debian and Red Hat. Secondly, until fairly recently, parts of Launchpad were closed source. Third - there are other groups like Postgres, Openssh, etc which need funding more desperately.

What will the donation amount of be used for? More marketing - which I understand is equally necessary, but unworthy for me right now - vs things like hiring and paying developers?

<comment><USER29> You can select which areas of development your payment goes to.

[http://cdn.arstechnica.net/wp-content/uploads/2012/10/how- mu...](http://cdn.arstechnica.net/wp-content/uploads/2012/10/how-much-is- Ubuntu-worth.png)

<comment><USER28> I see that - but it would be nice if they covered which groups exactly would be funded by each item. For example, I am all for the hardware support aspect of Ubuntu - I would personally want to fund superior multi-display support and suspend/resume.

Who are the developers in Ubuntu working on it ? In fact, ARE THERE any developers working on it. I would really appreciate some increased transparency here - because as I see it, there are lots of contenders for my money: including LinuxMint, which IMHO needs money more desperately.

<comment><USER30> Yes, there are... in fact, the unity developers are working in better multi- display support

</comment></comment></comment></comment><comment><USER31> _"Tip to Canonical - they help make it happen"_

That's why the packages end in .cpg: "Canonical PackaGe"?

<comment><USER13> Are you insinuating that Ubuntu is just a Debian with a different name slapped on it? If that is the case, then you must not have used Ubuntu at all.

As a Ubuntu user, I like the Ubuntu Software Center and being able to install Skype and Dropbox through it and not having to scour the web for packages compatible with my system. I like some Unity features such as the dash and the HUD, because they greatly simplify discoverability of features that I do not use on a daily basis. I like the fact that Canonical certifies Ubuntu on a variety of hardware and I can therefore purchase my next laptop or server with the knowledge that my preferred OS will work fine on it.

I could go on, but I don't think there is any need - it's pretty clear that Canonical makes a lot of things happen apart from building .deb packages.

<comment><USER31> Canonical adds all the fun stuff and Debian adds all the boring stuff. But, you can't have the fun stuff without the boring stuff, and it's easy to argue that Ubuntu would not exist without Debian. Letting the user kick a few bucks back to the Debian Foundation wouldn't be the most horrible thing ever.

(I do use Ubnutu, BTW, but regret the decision on a regular basis. I especially like waiting 15 seconds to get a shell prompt because it's checking for package updates to display while I'm logging in. The 15 seconds after each typo'd command is also enjoyable. "Did you mean to install the package sl?" No. No I did not. Ever. </rant>)

<comment><USER32>
        unset -f command_not_found_handle

</comment></comment></comment></comment><comment><USER33> How do I contribute while discouraging Unity? Doubtless they will interpret "Make the desktop more amazing" as an encouragement rather than the opposite.

<comment><USER34> I'd say that if enough people change the the ratio of their donation so that "Make The Desktop More Amazing" gets $0 while "Better Support For Flavours Like Kubuntu, Xubuntu, Lubuntu" gets the most of the donation, this might help Canonical get the picture.

</comment></comment><comment><USER35> How about Canonical pays me for the hours I've spent debugging problems like scripts shipped with bugs or complete changes to the foundations of the operating system which just appear by surprise?

I really like it when motd just randomly became some convoluted set of scripts.

<comment><USER36> Or when their fancy "Display some dots on the screen instead of kernel output on bootup" thing (Plymouth) only gets properly disabled by GDM and will otherwise continue to draw glowing dots across your window manager and applications. At least, that's what I found when I tried to run XDM + xmonad on my ARM netbook. Eventually had to go in and hack the XDM startup script so it too would properly shut off Plymouth before trying to run.

</comment></comment><comment><USER37> I'd pay for a light laptop with XUbuntu (xfce) and 3 years of support so that everything just works.

</comment><comment><USER38> This made me want to find the donate button on Slackware's page.

</comment><comment><USER39> The donation request doesn't show up if you download Kubuntu. The last I heard Canonical doesn't pay anyone to work specifically on Kubuntu anymore (although Kubuntu users obviously benefit from a great many things Canonical does for Ubuntu). One of the donation categories does include Kubuntu though... Strange.

</comment><comment><USER40> I'm not sure about the installer demographics or user base of Ubuntu Server, but assuming that users who install the Server edition would be more Linux- savvy than newbie desktop users and be able to appreciate how much value Ubuntu brings them, wouldn't it make sense to show this screen there as well?

</comment><comment><USER41> It would be interesting if they upload donation statistics on what people want Ubuntu to do.

</comment><comment><USER42> "Over the most recent 12-month period, Ubuntu accounted for 1.1 billion hits to Wikimedia, with the next-most popular Linux desktop distribution—Red Hat's Fedora—accounting for 36.7 million."

That's a much wider gap than I expected.

</comment><comment><USER43> If I were interested in using an X based Unix, I'd probably do this and donate a few bucks. I like what Shuttleworth is doing, even as I don't want to use a Linux distro.

<comment><USER36> If you're interested in an X-based Unix, Ubuntu probably isn't the right thing to look at in the future, since I hear Wayland is supposed to be here Real Soon Now.

<comment><USER43> I guess I was sort of trying to draw the distinction between OS X and anything else. Would've been faster to just say that. The less X in my life the happier I am.

</comment></comment></comment><comment><USER44> I'd rather donate to individual projects than the guys packaging stuff and making unity.

Oh wait, that's what I do.

</comment><comment><USER45> It sounds like OSS panhandling.</comment>


Reviewing common API Editors - <AUTHOR> https://medium.com/@orliesaurus/a-review-of-all-most-common-api-editors-6a720dc4f4e6

<comment><USER2> Apiarry is great. Almost all of their technology is open source, which is ironic because they almost shot themselves in the foot by releasing their core product source. See API Blueprint. [1].

Api blueprint is a great project with a nice ecosystem and tooling around it. You can write the "blueprint" in your editor, serve a mock server, and run regression tests against it, all open source on your own computer. It's easy to setup.

This enables a workflow of "API driven development," where the first milestone is an API blueprint, and then backend engineers can work in parallel with frontend engineers. It can significantly cut development time, especially if you're staffing freelancers. You know the system components will work together because the frontend builds against a mock server, and the backend tests against it.

[1] [http://apiblueprint.org/](http://apiblueprint.org/)

</comment><comment><USER3> Awesome - what about using API Editors (or similar tools) as a way to browse or explore an API?

I've seen a lot of companies roll their own API "Explorers" too: [https://dev.twitter.com/rest/tools/console](https://dev.twitter.com/rest/tools/console) [https://developers.facebook.com/tools/](https://developers.facebook.com/tools/) [http://products.wolframalpha.com/api/explorer.html](http://products.wolframalpha.com/api/explorer.html)

As well as generic Rest API Explorers: [http://www.getpostman.com/](http://www.getpostman.com/)

<comment><USER4> I regularly use interactive API documentation to test APIs. It's just so much easier than using cURL or writing a script.

Most startups can't afford to spend the time and engineering resource reinventing the wheel for API documentation, especially with the "explorer" or interactive test consoles that have become so popular.

<comment><USER5> As someone who wrote one recently, it's not so hard to build the interactive testing portion as the live editing functionality. I built an API documentation site over a week's period with interactive consoles and examples. (We use WADL as opposed to Swagger or others due to legacy reasons)

Live editing of API functionality? Much more complicated.

<comment><AUTHOR> whats it called? is it public?

<comment><USER6> Check out Apigee SmartDocs: [https://blog.apigee.com/detail/apigee_smartdocs_introducing_...](https://blog.apigee.com/detail/apigee_smartdocs_introducing_smarter_api_documentation)

(top level readers: sorry about the double-post)

<comment><USER4> Why the apigee links? We want to see what this guy built over a week.

<comment><USER6> I was assuming you or others wanted something you could actually use today.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> ReadMe founder here. Thanks for including us! Your analysis of ReadMe in the areas you covered was spot-on; API flexibility is definitely a weak spot for us currently. We left it intentionally slim on features during launch to see how people used it. Over the next few weeks, we'll be rolling out huge improvements to the API stuff. (Side note: You wouldn't believe how different every single API is. It's crazy.)

One thing you missed was the ability/ease of non-reference guides. No matter how good your API reference is, it's like handing someone a dictionary and telling them to learn English. Topical guides, tutorials, and more are insanely important.

(I'll be at Mashape tonight – see you there?)

<comment><AUTHOR> Thanks for leaving your feedback and comments. See you here, drinks on us.

<comment><USER8> Mashape is at 500 Montgomery Street in San Francisco, if you HN guys want to join us for drinks tonight ;-)

</comment></comment></comment><comment><USER9> Apiary is quite slick and easy to pick up, but I really wish they included some kind of version control with their editor. We have a team working on our API but it makes it harder to collaborate when we can't go back to a previous version or see the revision history. Github integration is a no-go because we have to give access to all repos.

</comment><comment><USER10> Aglio is a pretty slick and simple html render tool for use with Api Blueprint: [https://github.com/danielgtaylor/aglio](https://github.com/danielgtaylor/aglio)</comment>


MagicJack dials wrong number in legal attack on Boing Boing - <AUTHOR> http://www.boingboing.net/2010/02/23/magicjack-dials-wron.html <comment><USER2> I'm thinking of getting a TK6000 from NetTalk. Anyone heard anything bad about those? BTW, I've heard attacks that the company is a hack, but then the company responded and said it was publicly traded on the stock market and had board members with deep industry ties. I also heard attacks that the sound quality was not good, but then the company said that this was not true and that one has a trial period to decide for themselves. But even still -- at $99 -- you really can't go wrong to try this out, I thought. So, I'm thinking of getting this in a few short days unless someone can warn me that it will do something very bad. The MagicJack EULA, plus the viciousness of the founder, are a really big turnoff for me.

<comment><USER3> They are prolly the best alternative and REALLY make a point to support customers as much as possible, a good forum as well.... www.nettalk.com

</comment></comment><comment><USER4> What a horrible headline. This has nothing to do with wrong numbers. How about something like

 _Boing Boing prevails in MagicJack's suit_</comment>