Ask HN: Why are we still using passwords? - <AUTHOR>

IANASecurity Expert, but there are several on HN. Hopefully this will start an interesting discussion.
1) Why are we still using passwords to authenticate people online? And by "we", I mean most big public websites. Google, Facebook, Twitter, Gawker. It seems like some sort of key-based, public/private algorithm would be better than the current mess. Is this correct or am I forgetting something?
2) What would the optimal solution look like, assuming the browsers supported everything necessary? <comment><USER2> 1) Why are we still using passwords to authenticate people online? And by "we", I mean most big public websites. Google, Facebook, Twitter, Gawker. It seems like some sort of key-based, public/private algorithm would be better than the current mess. Is this correct or am I forgetting something?

Public key crypto still requires a private key - which is basically a password that is too long and obscure to be remembered by a human. And therefore has to be stored in a text file on your computer (a security risk in itself; I'd presume most people don't currently do this with their passwords). And good luck logging in to Facebook from a friend's computer.

<comment><USER3> There is a major difference - a password is known by the host. Of course they salt and hash and use bcrypt to secure their storage of it, but ultimately, a password is a shared secret between you and the site.

A private key is fundamentally different - it is _private_. You never send it to anyone, ever. So it's safe to use just one, because nobody else will ever see it.

As you alluded to, the problem then becomes managing that key securely, and also generating & distributing keys for non-technically inclined users.

<comment><USER2> That's true, you don't share a private key with an authenticator, so it's unlike a password in that sense - but it's still what-you-know authentication, and any what-you-know authentication that a user can't actually know/remember is impractical.

<comment><USER4> A private key (or client cert) is generally more of a "something you have" than a "something you know" credential.

(unless you memorized your key - it's something you have, not something you know)

<comment><USER2> Well, it's data. I guess it does reduce to "what you have" given that it's not memorable, but as we all know, "what you have" is less convenient than "what you know".

</comment></comment></comment></comment></comment><comment><USER5> The password is the simplest and most straightforward method of authenticating a user. Yes, you could go with a physical key (Near Field, USB, card, etc), thumbprint, eye-scan, or voice but all of those have their failings as well. How many stations have thumbprint scanners? My laptop does but I'm the only one I know and it is more a PITA. How many have cameras for facial recognition or eye scanning? Not mine. How would you access the site when you don't have your physical key on you? Couldn't your voice be just as easily hacked?

There is no better security for common use than the password... and it is just as effective as anything else with the added benefit of being universally applied if it is a decent one.

</comment><comment><USER6> I'm not a security expert at all, but what's the point of a public key supposed to be if all you want to do is authenticate yourself?

Why would you want to use (e.g.) an RSA key for authentication, forcing you to carry around a data fob or something from computer to computer, instead of using a password or passphrase that you can actually remember? Ordinary users would flip out if you asked them to do that. If you really want a super strong key, you can simply use passphrases that don't suck, or you can always use a password manager like KeePass that encrypts your weak passphrases with a strong master key.

<comment><AUTHOR> The point of RSA authentication is you can give everyone your public key, and they can authenticate you without knowing your secret. Then, in case of something similar to the Gawker breach, the attacker has only the username and public key of the user, but not the private key, so they can't use it to get into any other site.

Strong passphrases is also not enough, unless the passwords are unique across sites. Some HN users may use unique passwords, but normals don't. I don't do it with 100% regularity.

<comment><USER6> What you're suggesting is that a user give a site their public key, receive some site-supplied data encrypted with their key, and be forced to decrypt it to log into the site? I guess that sounds fine, but it's no more or less secure than using a unique password, and again, now you need to carry your private key around everywhere that you want to log into anything, unless you plan on memorizing that sucker.

I suspect the real result of such a scheme is that everyone's private keys to everything would be sitting around unencrypted on USB drives and written on pieces of paper, so it would be even easier to steal their identities.

I think the solution is still -- use a password manager, and then it's easy to keep track of unique passwords across sites.

<comment><USER7> > If you only give someone a public key, > how can they authenticate you based > > on that? You must be giving them some > piece of private data, or else > anyone > could authenticate as you.

That's not quite the way it works. There is no shared secret required. With my public key you can create an authentication challenge that allows you to validate my identity without ever seeing my private key (or, for that matter, you can send me a message that only I can read).

<comment><USER6> Yeah, I figured out what he was getting at a moment after posting, so I edited my post with my core objection, which is just that there's really no benefit I can see to doing that instead of using memorizable passwords.

</comment></comment></comment></comment></comment><comment><USER8> What's happening in the field of biometrics? Is it ever likely that I'll be asked to speak my name out loud and that'll work as reliably (from the user's perspective) as a password?

I've always thought, perhaps irrationally, that the problem with biometrics is false positives: i.e. letting in someone who isn't you. I misttype my passwords all the time, and I think users would be OK with a "Sorry, can you say that again?"-type message on occasion.

Basically, am I in "where's my flying car" territory?

</comment><comment><USER9> One way would be the same thing you do with "forgot my password" links. You enter your email address, a link with a random activation key gets mailed to you, click on the link in your email client and get logged back in. The activation key would have a limited valid span, say 30 mins, so even if anyone got hold of it it would be useless.

The disadvantages are a) your email can be hacked and b) it's a bit inconvenient for the user. Also you'd need SSL to protect the key, which would be in the URL.

<comment><AUTHOR> This is my de-facto password management scheme right now. I call it "log in via email" (as opposed to log in via facebook or google).

</comment></comment><comment><USER10> There is stuff like RSA secure id. they ask for a password, but then also for authentication number... where you have a device that shows you the authentication number. it changes the number every 60 seconds.

<http://www.rsa.com/node.aspx?id=1156>

I'm not sure this would ever be practical for consumers, but it's a clever idea. i've used it to get on vpns at big companies.

</comment><comment><USER11> The problem with passwords is that ideally they are long random strings and different for every site. But humans are not good at remembering such passwords, so they tend pick shorter passwords and to re-use them on lots of sites.

But computers are good at remembering lots of long random strings, so why have we not developed a standard for site log-ons which the browser chooses the passwords and stores it securely for the user?

</comment><comment><USER10> I know this isn't exactly your point... but I think we're finally seeing passwords go away... and using facebook, etc. as universal logins.

<comment><USER12> I personally dont like universal logins not because I'm averse to them but because of how difficult they are to use at the moment. Everytime I tried to use open ID its the worst experience in the world.

Also, I hate fb so I deactivated my account. So that clearly means that I wont be using fb for anything. So, universal logins need a lot of work.

<comment><USER13> The OpenID concept is completely foreign and inaccessible to me, let alone my mother. Log in by giving it a URL? What?</comment></comment></comment>


Georgia Tech Online Masters with Udacity - <AUTHOR> I wanted to gage what people thought about this program and whether or not it is worth it? I am extremely interested in it. <comment><USER2> You really need to be able to articulate why you want to do it and then determine if it's really the best way to achieve that goal.

For example, if you want to make more money, I would not do it. Period. However, if you want to be a part time lecturer in computer science, it's more or less required. Different strokes for different folks.

<comment><AUTHOR> Part time lecture isn't very appealing; however, I do want to push my understanding of computer science and hopefully my passion will translate to a few extra zeros in a paycheck.

<comment><USER2> You will probably not get more money as a result of doing this. Know that going into it.

<comment><AUTHOR> Yet, I am not directly going for that. Mainly it is to learn more.

</comment></comment></comment></comment><comment><USER3> Georgia Tech is a great school, but I don't think there's been many graduates of this program yet since it's only about four years old.

</comment><comment><USER4> you may try the courses available in Udacity</comment>


A REALLY innovative way to write (domain-specific) code - <AUTHOR> http://www.youtube.com/watch?v=ziIdjrR_MRs

<comment><USER2> Cool video, but the headline is a bit misleading.

</comment><comment><USER3> Interesting.

Why not include the "labelled cups" in the UI? Perhaps everything would have to be redone with RFID, but once done, the balls could be mapped simply by touching a new cup. I'm imagining clear marbles, or perhaps ping-pong balls, with potentiated tri-color LEDs indicating their current state. ...Or we could do it the easy way, and just fill the cups with paint.

Also, I imagine their next project to be using a large one of those "elastic pegboard" things (normally used to teach elementary Maths), along with several differently colored rubber bands, to simulate a piano roll.</comment>


Ask HN: Working with a lot more experience co-workers, recommendations - <AUTHOR>

Hi,
I have over 5 years of experience working in mobile and software development (backend mostly in Rails). In my previous work I felt extremely confident because it was a small team with little CS experience and most of my solutions were basically the best even when I knew maybe that wasn't true.
After a year I decided to go looking for another job opportunity and landed a job and now I feel kind of lost  all my colleagues have a lot more experience and even when I'm trying to catch up with everything, trying to learn and use better ruby programing patterns, learning Redis and Ember, I feel behind. My confidence have drop a lot and even I have hard time proposing ideas or making an opinion because I feel insecure about what I know.
Does anyone have an opinion or a recommendation? <comment><USER2> How long have you been there ?

If you are at a new place, and you don't have a clear view of the overall architecture, which parts are in good shape, which are not, etc, it is natural to be less confident in proposing a solution, particularly if people have been there for a long time.

However, it should not stop you of asking open ended question like "Why did module X have been developed with Y instead of Z ?" You'll probably learn quite a bit on the historical, political or time constraint reasons. And you could stumble upon a good suggestion because no one had the idea or will to change the status quo.

The advantage of being new is that you can assess the code base or practice with a "fresh" look. I don't think that anyone is expecting you to have the best idea on every proposal, you should maybe relax a little bit on the image you want to project. You can't be "the expert" in two months. Try to focus on a very narrow part of the project where you feel you have a related experience or can contribute something meaningful.

<comment><AUTHOR> Two months. Yes, you're right my main concern shouldn't be the image that I'm projecting. Thanks for writing.

</comment></comment><comment><USER3> Pair program as much as you can in this situation. You'll pick up a lot, and gain confidence to suggest improvements by starting with one-on-one interactions with your pair.

Then find a new partner, ideally someone less strong than your first partner where you feel even more confidence offering suggestions.

Repeat this process until you feel comfortable pairing with anyone on this team. Then you know you've made it.

<comment><AUTHOR> I like your suggestion a lot

</comment></comment><comment><USER4> You are in the best position possible. You'll be gaining new experience quickly. In your previous position, you most likely were not growing/learning much if at all.

Most successful entrepreneurs will tell you they always want to be surrounded by people smarter than them. Congratulations, you are in that position.

<comment><AUTHOR> That is true

</comment></comment><comment><USER5> I'm in the same boat, buddy. _feels_

<comment><AUTHOR> How have you handling it so far?. I'm turning 2 months today. I been reading and documenting a lot on free time but still not enough.

<comment><USER5> Well, I guess mostly by revising work I've done in the past. Reviewing it and thinking about how it could be improved if I were to apply methods that my coworkers would use.

I know it could be difficult for you, but consider just asking them for advice on the systems you're building/proposing. If you think they're likely to turn down the ideas you have, you may as well pre-empt that and get down to the business of figuring out a compromise. It may not make you look like some rockstar programmer, but at least you'll be learning something as quickly as possible. Also, depending on how down to earth your employers are, appearing humble before your superiors/more experienced colleagues and wanting of knowledge will only cast a good light on you.

<comment><AUTHOR> Thanks, this makes sense.</comment></comment></comment></comment>


Ask HN: Use Kickstarter for Academic Research? - <AUTHOR>

Might it be more efficient  than grant writing and less fraught with potential conflicts of interest than partnering with corporate and governmental institutions? <comment><USER2> Microryza, <https://microryza.com> we're different in that we don't follow the Kickstarter model of tangible rewards.

</comment><comment><USER3> Petridish was targeting crowd-funding for research

<http://www.petridish.org/>

</comment><comment><USER4> For most research it's unlikely enough people care about it in order to fund it.

</comment><comment><USER5> I like the idea. How can we hold them accountable, assuring the research that was intended to be done, actually gets done?

<comment><AUTHOR> I suspect that it would be no less reliant upon academic integrity as any other mechanism.</comment></comment>


Ask HN: Does microdosing psilocybin help you code? How? - <AUTHOR> <comment><USER2> Tim Ferris has written about it a few times

[https://tim.blog/2015/03/21/james- fadiman/](https://tim.blog/2015/03/21/james-fadiman/)

[https://tim.blog/2015/09/14/are-psychedelic-drugs-the- next-m...](https://tim.blog/2015/09/14/are-psychedelic-drugs-the-next-medical- breakthrough/)

<comment><AUTHOR> yes and paul stamets on a joe rogan podcast says SV coders are massively using microdosing of LSD as a competitive advantage, that's why I wanted to ask here, as I'm sure someone can chime in on either being around this happening or is doing it.

</comment></comment><comment><USER3> Anything but proper diet and exercise. Inject it all directly into your bloodstream =)

</comment><comment><USER4> Seems awfully niche. Maybe r/Nootropics would be a better place to ask.

Schedule 1 drugs should be avoided, even where legal. You can probably get better results from something like Modafinil anyway.

<comment><USER5> Yeah because pot is the same thing as heroin.

I can't believe that we still trust the DEA when they perpetuate complete falsehoods like "pot has no medical applications... except for all these doctors saying otherwise and all these patients that switched to it and are much better"

<comment><USER4> Fair enough on schedule 1's flaws.

I meant that it hasn't really been properly tested by enough people. And there are things like ecstasy which have some fatal strands because production isn't regulated. The legal drugs will at least have much, much higher quality control and safety checks.

Other drugs may give you Parkinson's or something 20 years later but it's just not tested at all on something like psilocybin.

</comment></comment></comment><comment><USER6> Might help when you need some creativity. Although Edison's method of nodding off and waking up might do the trick. For production code... I'm not sure.

/IANA./

</comment><comment><USER7> getting logic into your brain like you have sum or multiplication of digits, helps.and the way to do this is by coding. other things beside logic may help but less. for example internet,books,food,beverages,music,drugs...

at some point it will be like drawing, in N dimensions.</comment>


Signs you're following a fake Twitter account - <AUTHOR> https://nixintel.info/osint/signs-youre-following-a-fake-twitter-account/ <comment><USER2> The bot panic is IMHO overblown.

This comment is however NOT a defense of bots. I think bot detection and deletion of bot accounts would be a good thing.

But the concern seems out of proportion.

Society is full of disingenuous message amplification systems: a large subset of advertising (TV, magazine, billboards, direct marketing, etc), biased news media, spam, and now twitter bots.

Twitter bots are a bit worse than the others because we can no longer tell what opinions are actually popular and which ones are manipulated... via Twitter. But the ability to make such judgements via Twitter has only been with us since 2006. The basic problem is not a novel one.

The bot problem cuts both ways because people will overly compensate. I've been accused of being a bot, signalling to everyone that it's perfectly OK to ignore the content of my argument. I fear many other right-leaning people are getting the same treatment. This treatment further divides society (actual bots do too, which I am NOT defending; I'm just showing that the issue cuts both ways). Other commenters in this thread have been flagged and their comments are dead apparently because (if you believe surrounding comments) they are seen as a bot.

The day that Twitter becomes a voting platform, or voting platforms allow bots... that is the day that I will panic about bots.

All that being said, carry on. Let's squash the bot problem. Let's also fix advertising. Let's also fix news media bias. And spam.

<comment><USER3> You say that the problem is overblown but then go on to talk about the dangerous effects the problem has on discourse. Not only are the bots spewing out propaganda, but as you say they destroy the trust we have in each other which further builds the mindset of "Anything I believe in is true and anything else must be bots". In my mind this makes the bot problem very bad.

The problem is made even worse when you have non bot accounts that spam out low effort bad faith posts like "If climate change is real then explain x". It takes 2 seconds to post that but 10 minutes to properly reply. And when you look in to the post history of these accounts you can see they have been given the same answer repeatedly but ignore it because their objective is not to have a discussion or to learn, their objective is to waste peoples time and create doubt.

<comment><USER4> Or maybe they've never gotten what they feel to be an acceptable or compelling answer.

<comment><USER3> There never will be an acceptable or compelling answer to these people though. They refuse to accept new information or anything that is different to the talking point they have latched on to. Its especially true for bad news, we all _want_ climate change to be a hoax, its much more convenient to believe this than to accept reality.

</comment></comment></comment></comment><comment><USER5> > His two front teeth (red box) are different shapes and sizes.

Which would be entirely normal for a guy from Manchester. My two front teeth are different shapes and sizes too. We don't really do "cosmetic dentistry" here in the UK, certainly not to the extent it's practised in the US.

<comment><USER6> And my ears are asymmetrical. It does show up in photos from front on (though perhaps not to the extent in this article).

<comment><USER7> > And my ears are asymmetrical. It does show up in photos from front on > (though perhaps not to the extent in this article).

Yeah, I was surprised the article made such a big deal about that. My ears are also a little asymmetrical, and Stephen Colbert's [1] are very obviously so.

[1] A famous American comedian with a nightly talk show.

</comment></comment></comment><comment><USER8> The biggest sign mentioned in the article is the insane number of tweets since the inception of the account - surely this must set off some alerts on Twitter's backend?

I know that this is an extremely difficult problem to solve and that they probably ban accounts in waves but with something as obvious as this you'd think that the ban could/should come more swiftly...

<comment><USER9> I think it could be a relatively easy problem to solve: give any user the option to verify their identity.

In this way, as verified accounts increase, the unverified accounts become more obvious and I imagine we will start to view them with more scrutiny.

It would allow anonymity to remain, just make it so those accounts are more obviously anonymous or pseudonymous.

<comment><USER10> Verify how

<comment><USER11> You should try signing up on Nextdoor. This isn't a hard problem, nor would anyone be forced to verify themselves if they don't want to.

<comment><USER9> I don't know if Nextdoor's method of mailing a card to someone's mailbox would work for Twitter, but I like your example of a social network that has taken verification much more seriously.

</comment></comment></comment></comment></comment><comment><USER12> There is a general problem with platforms and fake entities of various kinds posing as friendly, relatable individuals. This problem surfaces far less deeply than you have to dig to find a well-crafted fake portrait.

Is that really a crafty artistic person turning out handmade items on Etsy, or is it a front for a factory in China with dozens of pseudonymous identities on Etsy? They take on multiple fake identities in order to appear to be humans handcrafting their items in small batches. If one identity gets their cover blown, it is shut down and replaced.

Is your AirBnB host with a woman's first name really renting out some family- owned cottages, or is "she" a BPO messaging contact center who won't talk to you on the phone? AirBnB's UI makes you sift through tens of pages of reviews to glean hints. And that usually happens after you have suspicions due to a foulup with a rental.

I haven't yet tried one of those "sharing economy" car rentals. But I suspect they, too, have attracted aggregators posing behind multiple fake identities to escape bad reputations if need be.

Social media and all kinds of other platforms need to look for and mitigate damage to their brands from fake identities. These fakes are made, in part, to game the platforms, and, in doing so, reduce their value.

<comment><USER13> > Is that really a crafty artistic person turning out handmade items on Etsy, > or is it a front for a factory in China with dozens of pseudonymous > identities on Etsy?

Ran into this when my fiancé was browsing Etsy to get an idea of how to price some of her stained glass work. There was a particular listing that was ridiculously cheap, which raised my eyebrows. I looked at their sales history, and they had sold tens of thousands of this item. Clearly factory production in China.

<comment><USER14> It's been a problem for Etsy for 10 years. Rather than keep trying to stamp it out, they instead tried to find a way to roll those people into their platform.

</comment></comment></comment><comment><USER15> Got out of Twitter after seven years using it like a breaking news website from few vetted sources: bots, venom, ads and shameless plugs just made the experience more and more unsufferable, so good riddance. Also unfollowed any contact on LinkedIn, the amount of motivational fluff and plain gibberish just astounding, something like facebook for professionals. Am I happier? Nope, but the void will be somehow filled by something more productive or just interesting.

<comment><USER6> I am incredibly close to getting rid of my twitter account. Already most of my meaningful interactions have moved to private group chats on Slack (etc).

<comment><USER16> I unfollowed all accounts, deleted all my tweets and just login periodically to see what's trending or to follow a hashtag associated with a sporting event I'm interested in. And since I do that from home, I have the twitter app on my iPad but not my phone.

Nice way to keep it but throttle it.

</comment></comment></comment><comment> non-entity Easiest way I've found to spot bots on Twitter is username patterns where both the handle and display name are similar or the same with 1 or 2 words (often a first and last name) and a random number. For example _JohnDoe127474_. For a more realistic example: I just went to the first trending semi-poltical topic and this was the first bottish account I found (the tweet itself is pretty benign):

[https://twitter.com/Elsie43733196/status/1235724530716377088...](https://twitter.com/Elsie43733196/status/1235724530716377088?s=19)

<comment><USER17> Congrats, you've found someone who accepted the autogenerated username!

<comment><USER18> Is someone who accepts to automated username likely to be contributing anything of value? Human or bot, block and move on seems the best strategy.

</comment></comment></comment><comment><USER19> I use This Person Does Not Exist for my shitposting avatar, but I'm certainly not botting. I just can't have my spicy tweets related to my main account because people will cancel me.

</comment><comment><USER20> >His two front teeth (red box) are different shapes and sizes. The teeth on the right side of his mouth have not been rendered properly at all. An analysis of Max's facial features suggests he has more in common with an AI- generated fake than with a real person.

Or a real person who didn't have braces?

<comment><USER21> It's actually a very interesting contrast with what "fake" used to mean in digital media. You see models with flawless skin, perfect teeth, digitally sculpted curves, and the original photo didn't look that flawless.

Now somebody has asymmetric ears like I do, and that's a hint they're fake?

</comment></comment><comment><USER22> I think its interesting that Twitter has the capability to automatically and instantly tag tweets or accounts as being written by third party apps

Yet they choose not to

<comment><USER23> Yes, I am perplexed by this. I have noted an insane number of bots commenting positively on Donald Trump's twitter account. It's obvious they're bots because of the username, lack of other activity, spelling and grammatical mistakes (due to phrases being directly translated from Russian).

P.S. Whenever I mention the above on here, I am subject to a barrage of down votes. Almost as if bots are searching HN comments and trying to down vote anything that is negative towards Trump. If this gets down voted heavily, it'll confirm my suspicions yet again...

<comment><USER24> I've seen that in some comments I made on another story. Not sure whether it's Russians or Russian bots or just HN-reading Trump fans.

<comment><USER24> Downvoted already. On further reflection, I think it must be the last category since it would be a challenge for a Russian [bot] account to get the karma to be able to downvote.

<comment><USER23> You'd be surprised. I can imagine they've got a bit of link submission karma, which allows them to downvote.

For what it's worth, I'm upvoting you!

</comment></comment></comment></comment></comment><comment><USER25> The part where the article tries to "prove" that the photo was not of a real person feels like phrenology more than anything. Real people can have asynmetric ears and teeth, and most photographers deliberately try to frame photos in a specific way so some random headshot having the same composition of generated photos isn't much proof. Honestly it looks like this type of psychotic paranoia over "bots" does more harm than actual bots themselves.

</comment><comment><USER26> This is worrying. I already get called a bot or a shill on the regular, and now you can be called a bot for having crooked teeth or "asymmetric ears"? Now I can look forward to internet sleuths scanning my profile picture for imperfections.

<comment><USER27> Now it just takes a 2nd picture of yourself to prove them wrong, so I wouldn't worry about that (yet?).

</comment></comment><comment><USER28> Systems like TPDNE can generate random fake people but can they generate multiple different images of the same fake person? If that is not the case then the existence of different photos should prove a person is real.

<comment><USER29> This was directly addressed in the article and no they cannot.

<comment><USER28> > TPDNE only creates a single image of a person

That doesn't state that it can't, only that it doesn't. Also, I am wondering about other GANs/image generation systems and not just TPDNE specifically.

</comment></comment></comment><comment><USER9> Seems like the only reason Twitter created verified users was because they got sued by Tony LaRussa for his account being impersonated.

What I'm wondering is when there will be a class-action lawsuit on behalf of all the everyday people who have had their accounts impersonated?

I hope it doesn't have to happen that way, I hope Twitter gives everyone the option to verify their profile, and yet I haven't seen much progress on this front since 2016 when I started looking at it.

</comment><comment><USER30> I feel like the article went way too much over aspects like TPDNE and the non- existent lawyer, which - while being useful to know - are somewhat poor indicators of fake profiles especially in a tech circle. I personally know a few people who use TPDNE profile pictures and many who use fake names, although none do both (a wise thing in this day and age). The rest was quite lacking.

</comment><comment><USER31> I've been writing about this for years but it's insane to me that Twitter is not stopping this. They are contributing both to group psychosis and the destruction of democracy through the spread of disinformation.

<comment><USER32> They have conflicting incentives, it's the same problem all social networks have. Bot accounts qualitatively detract from the real user experience, but substantially inflate quantitative activity metrics, if artificially.

Policing bot accounts improves the quality of the site, but hands Elliot Management and others more ammunition that social isn't growing to expectations. Unfortunately these sites continue to pick to optimize the latter rather than the former.

<comment><USER33> > _but hands Elliot Management and others more ammunition that social isn 't > growing to expectations._

If the growth is largely from bots, then perhaps Elliot Management is right even if you disagree with the business dealings.

<comment><USER32> There's a good argument to be made that Elliot Management is right simply based on absence of stock growth over the past few years. Facebook has grown 200% while Twitter has had incredibly modest gains. That much of Twitter's little growth might be bot-related just compounds the validity of their argument.

Twitter can't even fall back on being a public good, as it is has supposedly been a large vector for foreign political interference, and they haven't taken nearly the drastic manual moderation steps that Facebook has to combat this (hiring 15k manual content reviewers [1]). Facebook received huge pushback from investors over this decision, but it looks pretty savvy in retrospect.

[1] [https://www.theverge.com/2019/2/25/18229714/cognizant- facebo...](https://www.theverge.com/2019/2/25/18229714/cognizant-facebook- content-moderator-interviews-trauma-working-conditions-arizona)

</comment></comment></comment></comment><comment><USER34> The analysis of the generated profile images is all well and good, but a much better indicator of a bot account[0] is the incessant tweeting about certain issues with little to no commentary or context.

0: a bot account or a friend not worth continuing to follow

</comment><comment><USER35> Today I had someone reply to a comment of mine saying that I'm a bot and to report me.

Am I not in on a joke? Or am I doing something bot like? Or do people use this to exploit mindless masses to abuse the reporting system?

</comment><comment><USER36> I scrubbed my personal info on Twitter due to aggressive people and the potential of doxing me. No birthday, no bio, no profile picture. Twitter won't even let me follow anyone until I confirm my birthday.

</comment><comment><USER37> Another sign is if they accidentally repeat themselves. It shows it could be a bot account

</comment><comment><USER38> Hopefully this is not too off-topic, but - I like that the article focuses on a bot spamming far-left propaganda. I have tried to encourage my far-right relatives to stop knee-jerk sharing political articles and memes and to diversify their news sources, but for some reason they think that anyone who is worried about fake news, bots, or manipulating elections must be a Satan- worshipping communist. I assume this is because the media has tried their absolute hardest to use these facts to slander Trump.

How can we get people to stop focusing so much on the politics and see this as kind of data integrity or trust issue? Showing that "it's not your tribe's fault" is more emotional than rational but people may actually respond to that.

</comment><comment><USER39> I have a much easier rule set for fake Twitter account detection:

Are they saying something I want to hear? Yes? Fake.

That's the complete ruleset. I do not follow anyone on Twitter as a result.

</comment><comment><USER40> Twitter does absolutely nothing to exterminate old fake accounts. Probably because the last time they did so and saw how many real accounts there were, Twitter's stocks plummetted down

<comment><USER41> I think it was in a video with to mscott where woman from twitter talked about this, yes false positives are a big problem when detecting fakes. But Twitter is working hard to keep bad bots / fake accounts away. There was no last time, right now people are working on banning fakes. It a 24/7 game.

</comment></comment><comment><USER42> Many people use fake avatars, names and locations. Those are not good indicators for bots.

Presumably it is more obvious by the stuff being posted.

However, the whole question is mostly irrelevant. If you don't care what an account tweets about, don't follow it.

The big issue with the whole bot manipulation narrative is that while it is easy to create fake accounts, it is not easy to also get followers for those accounts. Without followers (with voting rights, not some other bots you bought on the dark net), the bot accounts are irrelevant.

</comment><comment><USER43> Why would I follow someone with only 73 followers in the first place?

I wish twitter can let me choose to filter out any information from accounts with less than 10000 followers, with exception of my own followings.

<comment><USER44> Why would you limit yourself to hearing only people who have large followings?

<comment><USER43> Because there are already too much info on Twitter. No?

<comment><USER44> There is, but popularity doesn't seem like a good filter to determine the value of a given feed.

</comment></comment></comment></comment><comment><USER45> This article is full of shit. At least until when I stopped reading there were discussing about physical features that don't matter one bit for Twitter accounts.

</comment><comment><USER46> Most of this article is talking about fake photos, not fake Twitter accounts. He goes on to say that if you use your Twitter account for politics, then you are fake.

The only thing I agree with is 766 posts in a week is extreme and is an indicator of bot-like activity.

<comment><USER47> _Only_ tweeting politics is a flag too; real humans have more than one interest.

Another indicator that's non-obvious is posting time distribution. Humans can't post 24h a day. But on the other hand if they're all in a 8h window, that person is posting from work - are these posts their job?

<comment><USER48> It's a flag, but not necessarily a sure indicator. For example, I have a separate twitter account I only use for political discussions, so that the replies I get don't overwhelm the other things I'm interested in.

</comment></comment></comment><comment><USER49> Twitter has become so low quality that I don't even bother looking at it anymore. The interactions tend to be extremely negative, the ads are annoying and irrelevant, and most of the people who get famous tend to be celebs or narcissistic pseudo-intellectuals who just repeat whatever the populist opinions are for their audience. I've found/met some interesting people though Twitter before, but these days I find it's not worth the noise to find that signal.

Twitter seems to want to resist any changes that would make the metrics look bad, but those changes are necessary to make the platform good. For example, they could offer a paid tier with more options to block/filter low quality content. They should also make a decision to either allow all bots, or ban them outright, and also make it easy for end users to tell whether an account is a bot or not. They should scrap the blue check marks and just offer a "twitter gold" badge for anyone willing to pay $5 a month. I don't really care if Twitter has checked anyone's identity, I just want to know if the person tweeting is a human or not.

<comment><USER50> > more options to block/filter low quality content

Over and above what you can already do with curating your followers, blocking people, muting people, muting hashtags, etc.? That's quite the range of options for buffing up the quality content of your timeline, no?</comment></comment>


Pirate Coelho - <AUTHOR> http://paulocoelhoblog.com/pirate-coelho/

<comment><AUTHOR> I was fascinated to discover that one of the most popular authors with over a 100 million sales is promoting 'piracy' on his blog!

(See also what he had to say at <http://www.p2p-blog.com/item-466.html>)

</comment><comment><USER2> If he has this attitude, I'm surprised he doesn't follow the lead of the Luther Blissett/Wu Ming gang, and just make a Creative Commons release of the books part of the deal with the publisher. (cf <http://www.wumingfoundation.com/english/about_our_books.htm>)

<comment><USER3> I love CC, but I think is more a matter of 'negotiation' between the writer and the publisher. Let me explain...

There's an Argentinian journalist/writer, Hernan Casciari, who became popular after he won the Deutsche Welle Best Blog in 2005 [1]. It was a fictional blog about a 'fat woman' he was impersonting. The idea of the blog, was also sold to make theatre and a TV series. Casciari success was in part thanks to the Internet, and he always had this clear. The day a publisher came to his door inclusive. He came to an agreement with a spanish publisher [2] that allows him to publish the books for free in his blog the same day it's available in the store shelfs. For instance, recently he made available his last book [3].

I don't actually know if he's using CC or other special license for his work, but if the author has the will to share his work freely and make a business out of it, it's possible.

[1][en] <http://www.dw-world.de/dw/article/0,2144,1783798,00.html> [2][es] <http://randomhousemondadori.es/> [3][es] [http://orsai.es/2009/09/el_pibe_que_arruinaba_las_fotos_1.ph...](http://orsai.es/2009/09/el_pibe_que_arruinaba_las_fotos_1.php)

<comment><USER4> If you release it CC then by the afternoon a bookshop with a instant book printing system could be selling the book in competition to your publisher.

This does probably hinge on what is meant in CC license (CC-BY-NC presumably would be applied) by "non-commercial". I know under copyright law giving away for free can still be commercial as it can harm commercial activity of licensees/owners; but I've read elsewhere that CC allows cost of production to be recouped and still allow the sale to be allowed as NC.</comment></comment></comment>


CMDR-DOS: Commodore DOS on FAT32 - <AUTHOR> https://www.pagetable.com/?p=1421 <comment><USER2> The Commander X16 is the brain-child of 8-bit-guy[1] on YouTube who does tons of fairly good retro videos. He's roped other people in to get it built though.

\---

[1] [https://www.youtube.com/user/adric22](https://www.youtube.com/user/adric22)

</comment><comment><USER3> Commodores never die, they just keep evolving.

</comment><comment><USER4> I love Michael Steil. His presentations are incredible.</comment>


TSA 'Viper' team makes appearance in Emeryville (Amtrak) - <AUTHOR> http://abclocal.go.com/kgo/story?section=news/local/east_bay&id=8957075

<comment><USER2> Security theater. Performance paid by taxpayers.</comment>


I can see your local web servers - <AUTHOR> http://http.jameshfisher.com/2019/05/26/i-can-see-your-local-web-servers/ <comment><USER2> Other approach is to create a useful extension like:

      https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/

disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait and log all the referers and ip addresses. It's a bit stealthier too, but needs users to visit their local web servers. But you'll also get the full URL.

Nobody will report you or care about the report and users are banned from fixing the extension code locally even if they're able to review it themselves. Bad reviews with some actual text fade away quickly, so if someone warns your other users, it will be pushed out to page 2 after a while by other useful one word or just empty reviews and it will work out.

<comment><USER3> Is there any way to get the source code of extensions from the Mozilla web site? I think some years ago you could look at the code in your browser from a link in the version history but I don't see any links at all now.

<comment><USER2> Right click "Add to Firefox" button and use "save as..". This will get you an xpi file which you can unzip and inspect.

Many addons will use some packing method, bundle all kinds of stuff into their content scripts (jQuery, etc.). It can be hard to review.

Some addons are quite horryfying (you see stuff like `<span ...>${someText}</span>`) (missing escaping, etc.). I'm quite sure there are some content scripts out there, that have XSS issues, that can be triggered from the page itself. This is great on pages like github, where there's quanta of user controlled content.

So if you want a suggestion for a clever attack:

1] make an extension for facebook or twitter or github that reorganizes the wall somewhat and make a `mistake` like assigning some user controlled content via innerHTML. This will probably pass review.

2] Suggest your addon to your target.

3] Post your payload as a message/tweet/whatever to your target. Now you have extension assisted XSS.

Pretty easy to add XSS to any page, with plausible deinability.

</comment></comment></comment><comment><USER4> If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]:

      * 127       * block    ### block access to IPv4 localhost 127.x.x.x
      * localhost * block
      * [::1]     * block    ### block access to IPv6 localhost
      * 192.168   * block    ### block access to LAN 192.168.x.x

In principle, you can use this without any other blocking, i.e. with the rule:

      * * * allow

and hence without disabling javascript on any sites.

[0] [https://github.com/ghacksuserjs/ghacks- user.js/wiki/4.2.3-uM...](https://github.com/ghacksuserjs/ghacks- user.js/wiki/4.2.3-uMatrix)

Edit: as pointed out by DarkWiiPlayer below, if you want to be able to access the localhost websites from the same browser, you need:

      localhost localhost * allow

and similarly for the LAN. In full:

      127       127       * allow
      localhost localhost * allow
      [::1]     [::1]     * allow
      192.168   192.168   * allow

<comment><USER5> Add all the RFC1918 unroutable private networks.

[https://en.wikipedia.org/wiki/Private_network](https://en.wikipedia.org/wiki/Private_network)

        10.0.0.0 – 10.255.255.255 (10.0.0.0/8)
        172.16.0.0 – 172.31.255.255 (172.16.0.0/12)
        192.168.0.0 - 192.168.255.255 (192.168.0.0/16)
        127.0.0.0 - 127.255.255.255 (127.0.0.0/8)

[https://tools.ietf.org/html/rfc1918](https://tools.ietf.org/html/rfc1918)

Possibly also 184.108.40.206/10 for carriers.

[https://tools.ietf.org/html/rfc6598#page-8](https://tools.ietf.org/html/rfc6598#page-8)

<comment><USER6> Possibly also the IPv6 ULAs:

[https://en.wikipedia.org/wiki/Unique_local_address](https://en.wikipedia.org/wiki/Unique_local_address)

Not sure if those can be expressed in uMatrix as a prefix rule.

</comment></comment></comment><comment><USER7> "If you see any results like 192.168.0.4:3000 is available!, you should tell your colleague to secure whatever she has running on that port"

Someone's going to access this page at $BIGCORP with an overly trigger-happy IDS and get a fun morning meeting with IT to un-quarantine their machine.

<comment><USER8> edit: I am a dolt. Thank you :)

I got this address as well, do you have anything running on .4?

It's just weird because I have .1 router, .2 AP, .3 pi-hole

then .10 is when I start my static IPs

and .100 is where my dhcp starts

nmap says that host is down as well

<comment><USER9> That just the example in the description, not the scan results.

</comment></comment></comment><comment><USER10> Judging by "ReferenceError: webkitRTCPeerConnection is not defined" message in my browser it probably uses WebRTC to get your local IP subnet. I installed an add-on to block WebRTC after I watched a presentation on this tool [1][2] and I recommend you also do this, unless you actively use WebRTC (and don't want the hassle of toggling a switch).

Unfortunately the protocol is vulnerable by design. :(

[1] [https://portswigger.net/daily-swig/new-tool-enables-dns- rebi...](https://portswigger.net/daily-swig/new-tool-enables-dns-rebinding- tunnel-attacks-without-reconnaissance)

[2] [https://www.blackhat.com/asia-19/arsenal/schedule/#redtunnel...](https://www.blackhat.com/asia-19/arsenal/schedule/#redtunnel- explore-internal-networks-via-dns-rebinding-tunnel-14332)

<comment><USER11> The only thing blocking WebRTC gets you is that it hides which subnet you are on, right? As in, an attacker can still just enumerate all of the common ones (10.0.0.0/24, 192.168.0.1/24, and like 5 others) and get the same results as with WebRTC enabled. So blocking it really just slightly increases the obscurity, but not really the security.

<comment><USER10> Sure, but it helps and it is cheap. I also don't use a common subnet and enjoy uMatrix. Obscurity is a viable strategy as part of a layered defence. ;)

<comment><USER11> True.

My main problem is that blocking WebRTC blocks some very interesting methods to "re-decentralize" the web, which are only viable if most people don't have it disabled.

<comment><USER12> This is a classic conflict that I've observed a lot. Similarly, widespread SSL pinning and app sandboxing makes it difficult to reverse engineer opaque outgoing traffic. It might be more secure, but you also cannot easily inspect what data a sandboxed, cert-pinning service is sending to the outside world.

I think it's probably something like "security, privacy, anonymity... pick two."

</comment></comment></comment></comment></comment><comment><USER13> I started a local webserver listening on localhost:80 just to see what happens, but this thing seems to not detect it. It shows me "Scanning localhost ... localhost complete."

Edit: My guess is that this thing can only detect servers that send a CORS header that permits cross domain access.

It could probably do way better detection if it did not do xhr requests but added script/css/whatever elements to its own page pointing to localhost and detects if those error out.

<comment><USER14> CORS is a security mechanism for browsers to prevent leaking user information (e.g. cookies) when doing cross domain requests from a browser. CORS does not prevent accessing the server at all. You can always curl a CORS protected server but you won't be able to make a requests including the user's cookies from a disallowed domain.

<comment><USER15> Hmmm...

I can see the request in server logs, but it seems CORS is preventing the response.

I may be missing something.

<comment><USER16> They way this is set up it's enumerating systems and ports on internal networks, not actually _accessing_ those systems and ports. The CORS header (or lack thereof) in the HTTP response of the _requested_ item is what dictates whether it can be accessed, so what happens is the request first sends a HEAD request to get the headers for the endpoint, and then if CORS is set up and allowed for cross-domain access is allows the connection (or if it's a request to the same domain and CORS for the current page isn't too restrictive, it allows the initial request without a HEAD request).

What you see in the browser developer tools if you open them up is that a bunch of requests are being made, but are being denied because they are failing CORS checks.

Where data is being leaked (in context of security) is that there's a difference in how the responses are handled. Either it's allowed (because the remote side CORS is too loose) in which case the page will show s message that the specific host/port combi is available, or it will get no response and time out, in which case they skip checking that host any more and assume there's nothing at that IP (which is when they print the "unreachable" message), or it continues on with the next port. If at the end there's been no success and no timeout, it prints the "complete" message, and that means there's probably something at that IP.

An important thing to note is that CORS is not like a firewall, and it doesn't actually stop all traffic from happening, so that can sometimes be used to get additional information that's not necessarily meant to be exposed. That said, what the page is showing is that the specific way CORS functions (that is, asking the remote side if they accesible), and the fact that Javascript runs locally on your browser, means that there's some interesting ways those interact which can cause security concerns.

A as idea of how this could be used to more nefarious ends, if it found listening and accessible servers on localhost or the local network, it could then try to identify them based on the headers/content returned, and try to do something with that.

Given that you could possibly even compile some network vulnerability scanner/exploiter to WASM and use it for only the subset of vulnerabilities it could accomplish through plain HTTP requests (a lot of work, it's probably easier to just write your own shim and crib their exploit library), this could be very easily weaponized.

<comment><USER17> That all makes sense, but the OP said that the scan _didn't_ identify their HTTP server. I wonder why.

<comment><USER16> Well, "Scanning localhost ... localhost complete." which they report means it found the sever, but did not allow access (CORS restricted). This is normal, as the default behavior unless modified by a CORS header is that cross-origin resource sharing is disallowed, and that includes same host but separate port. I believe edit is correct, in that this demonstration is for finding poorly configured local services that have a CORS header that is too open (perhaps because there are multiple services meant to interact with each other).

</comment></comment></comment></comment></comment></comment><comment><USER18> I'm interested in this because I don't fully understand the consequences here. I'd like to gain a deeper understanding through some concrete examples.

With the PHP CLI, I can run:

        php -S localhost:8000

With Python3, I can run:

        python -m http.server 8000 --bind localhost

The demo fails for me in both cases, even though a request to localhost:8000 is sent. (EDIT: The server log in the terminal window does show that the request arrived at the local server).

My question is: What is the risk of running one of these servers and then visiting some random web page?

<comment><USER19> > My question is: What is the risk of running one of these servers and then > visiting some random web page?

It depends on what you're exposing on those ports. If it's something sensitive, stop. Any web page can run javascript and as such, any web page has access to every port and service that your machine has access to ... because at that point, the web page is a program running on your machine with full network access.

However, this entire "vulnerability" makes no sense to me. Even if I'm running something on my machine or local network, I am _not_ going to rely on the firewall as a security mechanism. That is profoundly stupid and is well known to be profoundly stupid. So all those servers, including the ones I am creating and running, will have their own security mechanisms. So you can ping my server? So what?

<comment><USER20> If it's got CORS enabled you can do a hell of a lot more than ping your server.

<comment><USER19> Wait, what? I think you means the opposite. If it's got CORS enabled, then you can't do anything unless the request is originating from the relevant domain.

Anyway, do not rely on firewalls (and CORS is a firewall) as the _sole_ security measure. Do not create unauthenticated endpoints unless you want everybody to use them.

<comment><USER20> To elaborate, I meant a permissive CORS policy, which is what I see most often.

</comment></comment></comment></comment></comment><comment><USER21> I only ever run my local dev server on port 80, and use a hosts file to assign custom (fake) domain names to each of the sites I want to run.

I mentioned as much here a few years ago when I first came across this idea of assigning (and remembering) random unique port numbers to every one of your apps in development, and was surprised to hear that it's such a common practice. It seems sub-optimal for a lot of reasons, beyond the obvious one noted in the article.

The big one for me is that none of my apps need to know anything about how to handle port numbers URLs. They know their own domain name via a config setting that can be flipped on the live server. It's the same pattern (with no colons or numbers to worry about) so there are no edge cases to test.

<comment><USER22> Unless I'm missing something, this only works if you are running one site at a time, or you have a single web server bound to port 80 that supports virtual hosts. You also need application and/or configuration support to get this working properly. And even then, if you run any software with an embedded web server you are usually out of luck unless you want to fiddle with a reverse proxy configuration.

For these reasons I, at least, simply run applications on different ports. The problem isn't the port, it's the web browser allowing cross domain requests to local networks by default (another reply here suggested it is WebRTC specifically that is flawed).

<comment><USER21> IIS handles all this out of the box for me. I just bind the host name to the site in question. It sounds like maybe this isn't something that other web servers do, which is surprising. The whole point of the operation is to seamlessly run 30 odd websites on one dev machine without needing to fiddle with port numbers or anything else.

<comment><USER23> In the *nix world and with the move to containerization, most applications now assume they are the only thing running on the web server, and therefore demand custom config/settings. Node apps for example are their own server.

</comment></comment></comment></comment><comment><USER24> The page doesn't do a great job at explaining the mechanism (which from a quick glance seems to involve WebRTC).

This is a better resource on this topic, which involves DNS rebinding: [https://medium.com/@brannondorsey/attacking-private- networks...](https://medium.com/@brannondorsey/attacking-private-networks- from-the-internet-with-dns-rebinding-ea7098a2d325)

DNS-rebinding also gets around the cross origin request issue, which some comments here mention.

</comment><comment><USER25> I used to scan the company network for Selenium servers and remotely open "inappropriate" pages. Always nice to see a coworker wonder why a browser window with images of Pooh opened up.

<comment><USER26> I hope you're not in China!

</comment></comment><comment><USER27> Makes you wonder what other apps are accepting local HTTP connections (e.g. vendor bloatware [1]).

[1] [https://support.lenovo.com/th/th/product_security/len_4326](https://support.lenovo.com/th/th/product_security/len_4326)

</comment><comment><USER28> When will software engineers finally understand that issues like these aren't problems with some random service you run on your computer, but with the (lack of) security model behind modern web browsing?

<comment> kyle-rb Modern web browsing provides for this with same-origin policy. Same-origin policy can be negated by the server if it sets an overly lax CORS directive.

So this is something that's secure by default, but can be broken if the "random service you run on your computer" decides to break it. I don't think that's an issue with the browser's security model.

<comment><USER28> Same-origin policy is _not_ a security model. It's a ridiculous quarter century old hack. If you pause to think about it, domain names are a horrible way to delineate security boundaries on the web.

<comment> kyle-rb I disagree about domain names, but I don't think that's even relevant to this discussion.

Do you have some kind of security model in mind that would work better than same-origin policy in this case? I.e. cross-origin requests are still allowed to happen somehow, but users are still protected against random services intentionally disabling your security measures?

<comment><USER28> It is bloody obvious that when people spin something up on their local machines the do not intend to make those pages available to every website they visit. This _by itself_ suggests that there should be a dedicated security context for such applications and that the restriction on information exchange should be based on that context. Not on some random thing the application does (like authentication, CSRF or sending CORS headers).

Scenarios like that should be the foundation of a sensible security model, not an afterthought achieved by applying layers and layers of security ducktape in every single instance.

<comment><USER29> >an afterthought achieved by applying layers and layers of security ducktape

This is where you're missing the fundamental nature of the issue in this article. The sensible security model is there by default. An additional layer is added to make a resource available cross-origin, and the article merely serves to remind people that making a resource available cross-origin is still making it available cross-origin when the origin is localhost.

</comment></comment></comment></comment></comment></comment><comment><USER30> I can see the list of XHR requests made, and I have half a dozen local web servers running, and there are a bunch of other web servers running on my network. I have a bad habit of spinning up a server on an ESP32 whenever I want to remote control something physical.

... Strangely, despite the XHR's hitting ports and IPs I know are running unsecured web servers, the site sees nothing. Lots of "unreachable".

Firefox 67.0, Arch Linux (5.0.10).

<comment><USER31> The requests should fail unless the servers you are running allow CORS as per the headers.

<comment><USER30> There's half a dozen that are.

<comment><USER32> Do you have any locked down policy on them though? I assume this would only work if you gave blanket access.

I noticed in my tests it found one on port 3000 with blanket access, but didn't see one on port 9999 with restricted access( policy => allow from *.mydomains )

<comment><USER30> Yes. I'm terrible and have them set to allow all domains, and all methods.

<comment><USER15> Maybe your browsers are up-to-date?

</comment></comment></comment></comment></comment></comment><comment><USER33> Anyone using uBlock origin can add these custom rules to protect localhost:

      * localhost * block
      localhost localhost * allow

This should block any non-localhost from accessing localhost.

(note: only protects you superficially, based on DNS. what we'd want is protection based on IP. otherwise you're still exposed to anyone setting their own DNS to 127.0.0.1. but it's something...)

</comment><comment><USER34> Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that has prevented them from blocking this?

<comment><USER35> There are a fair number of applications that expose a UI with a local web server. I use the Ubiquiti Controller, but it's also quite common in the world of Plex, etc. It's also a path used for local OIDC, such as with the gcloud CLI.

<comment><USER34> > expose a UI with a local web server

I'm not talking about UIs hosted on local web servers being able to send requests to themselves, I'm talking about UIs hosted on REMOTE web servers being able to send requests to local ones. It seems far worse than a random cross-origin request to me and for the life of me I can't imagine uses cases.

<comment><USER36> That's not really how the internet works.

What is a local webserver? Running on your machine? Running on your LAN? Running on your corporate intranet? How should a browser differentiate between these things?

What qualifies as a remote server? Did you know, some very large enterprise environments squat on public IP's for private intranet internally due to address space exhaustion (IPv4 anyway)? Just because something appears to be on a public address doesn't mean it actually is.

<comment><USER34> This makes no sense. I'm just talking about localhost, I don't care where the physical computer is. It makes no difference if you're an enterprise with software running on a private or public or whatever IP. Whatever the case, I still don't see why you should be able to use JS to access a localhost address.

<comment><USER36> But what if your webserver is bound to 0.0.0.0:80? Which IP ranges do you block? Just the lo interface? Well, that wouldn't prevent this exploit as the webserver would be listening on all of your IP addresses.

<comment><USER34> What? Nobody cares what the listener is listening to. Nobody even cares if a listener even exists. It's completely irrelevant. You just block the outgoing request if it's sent to a localhost address from a non-localhost address. What's so complicated about this?

<comment><USER36> If you're suggesting that anything not originating on an enumerated list of IP's for localhost cannot request an url for something that resolves to an entry in an enumerated list of IP's for localhost, that would be possible, but is not really representative of the entire surface area of the effect demonstrated in the article.

It's also entirely possible you have some development api running on a particular port on localhost, and some app running in a container or VM that wants to make calls to it.

<comment><USER34> > is not really representative of the entire surface area of the effect > demonstrated in the article

So let's let perfect be the enemy of good? What's the logic here? Let's leave a huge security hole because we can't achieve perfection in all scenarios?

> It's also entirely possible you have some development api running on a > particular port on localhost, and some app running in a container or VM that > wants to make calls to it.

The VM should be on localhost or you should jump through a few hoops to whitelist it somehow. I see no reason why this should be allowed by default.

<comment><USER36> > So let's let perfect be the enemy of good? What's the logic here? Let's > leave a huge security hole because we can't achieve perfection in all > scenarios?

The logic here is don't hastily start implementing changes to how http requests currently work without a well established plan for doing so. I think there would be a good deal of corner cases you need to account for to successfully implement this feature.

Anyway, this problem seems pretty obvious, and I'm sure this discussion has been had elsewhere already.

<comment><USER34> > The logic here is don't hastily start implementing changes to how http > requests currently work without a well established plan for doing so.

As if the point of this thread was to push browser vendors to hastily implement this without thinking it through? Are you just trying to find something to have an argument over? I'm tired of this.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER37> Can anyone explain what kinds of attacks are possible here? A malicious script on this website can identify that a service is running on a particular endpoint (IP + port), and depending on the server's CORS policy, the script may be able to submit HTTP requests to that service... am I getting it right? I can see how that might be dangerous if the service responds to simple GET requests with sensitive information, or has a well-documented REST API and no authentication. Is this the scope of the vulnerability, or is there more to it?

I tried this with a few different services running on my machine (a one-liner WEBrick server in Ruby, Syncthing, a plain-text accounting program calling beancount, etc. etc.) and the script didn't detect any. I take it that means that these services all don't allow CORS?

<comment><USER38> This comes to mind recently [https://securityaffairs.co/wordpress/84803/hacking/dell- supp...](https://securityaffairs.co/wordpress/84803/hacking/dell- supportassist-flaw.html)

</comment></comment><comment><USER39> I wrote some code a while back to find and detect other devices on your network, although it no longer seems to work on safari: [http://joevennix.com/lan- js/examples/dashboard.html](http://joevennix.com/lan- js/examples/dashboard.html)

The fingerprinting db it used can be found in the repo: [https://github.com/joevennix/lan- js/blob/master/src/db.js](https://github.com/joevennix/lan- js/blob/master/src/db.js)

</comment><comment><USER40> Can anyone share what measures we can take as web developers to secure local development environment?

<comment><USER41> Custom DNS server with DNS rebind protection. E.g. if you're running OpenWRT you're fine[1].

Also just don't test on localhost. You can use a proper domain (or claim one in .test TLD[1] if you're fine with selfsigned certs) and point it to localhost.

If you're going to use any redirect flow like OAuth/OpenID you're going to need this for testing eventually anyway.

[1] [https://openwrt.org/docs/guide-user/base- system/dhcp](https://openwrt.org/docs/guide-user/base-system/dhcp)

[2] [https://en.wikipedia.org/wiki/.test](https://en.wikipedia.org/wiki/.test)

<comment><USER42> What do you recommend if you're running a local server? Eg, I've developed programs before with the assumption that the user will be running it either for their local machine, or perhaps for their local network.

Think self hosted Wiki/etc. I was never sure _(and thusly have yet to properly implement it)_ what would be secure, but also a good UX. A normal auth + self signed https would be simplest I imagine, but I'm not clear if browsers widely accept that. I recall Sandstorm having issues with this area, and required a domain to fully run properly. Which seems.. complex for a minimal install requirement.

Thoughts?

<comment><USER41> I actually wanted to do something similar one time and I figured there's one way to do it:

1) Get a domain name for the project, e.g. mycoolwiki.tld

2) In the installer/setup provision for the user a random subdomain, e.g. d2c8116f19d0.mycoolwiki.tld

3) Use Let's Encrypt DNS method to provision cert

4) Redirect d2c8116f19d0.mycoolwiki.tld to LAN IP

It's not ideal because you need some external infrastructure and it assumes no DNS rebind protection.

However, if your webapp has a client and server, that is communicates via API only, you can actually do a lot better:

4) Setup local server to accept CORS requests from d2c8116f19d0.mycoolwiki.net only

5) Host client at d2c8116f19d0.mycoolwiki.tld

Additionally,

6) Make the client a PWA with offline support

and/or

6) Offer browser extension to use local copy of the client when user visits ∗.mycoolwiki.tld

Though for my use case I actually wanted to have ∗.mycoolwiki.tld/ipfs/<hash> be backed by IPFS and offer generic extension that both verifies that the IPFS gateway is playing nice and (if configured) redirect to local gateway.

Also offering Electron client instead of browser would work as well and saves you getting the cert.

</comment></comment></comment></comment><comment><USER43> I was surprised to notice that this page correctly found my _local_ network IP address, and was thus able to query correct network range. I have disabled WebRTC [0] now in Firefox (media.peerconnection.enabled is now false), but the page still tries the same range. Is there any other way they can get my local network IP?

[0] [https://stackoverflow.com/a/26850789](https://stackoverflow.com/a/26850789)

</comment><comment><USER44> Some time ago, I made something using a similar technique to redirect to router configuration pages. Used WebRTC to get local IPv4, then spawned a worker and timed it, if it came back fast, I assumed it was there, and redirected the user, otherwise I tried a different common "router" address. I was unaware of dns rebinding at the time.

</comment><comment><USER29> Here's the tl;dr

      app.use(cors());

defaults to Access-Control-Allow-Origin: *

If you know how CORS works, you already know that even if the resource is on localhost, it's open to any web page, including not on localhost. You won't find anything enlightening here.

If you don't know how CORS works but you're using the Express middleware for it anyway, read the documentation: [https://expressjs.com/en/resources/middleware/cors.html#conf...](https://expressjs.com/en/resources/middleware/cors.html#configuration- options)

</comment><comment><USER45> My favorite is retrieving [http://wpad/wpad.dat](http://wpad/wpad.dat) with ajax.

[https://bugs.chromium.org/p/chromium/issues/detail?id=123166](https://bugs.chromium.org/p/chromium/issues/detail?id=123166)

</comment><comment><USER46> Also if you are a front end developer and are on an insecure WiFi (coworking space or public WiFi) make sure you only bind to localhost.

Otherwise other people on the network can see your frontend code which you are probably compiling with sourcemaps, which will give the attacker almost the complete source code of your SPA.)

<comment><USER47> But frontend applications expose mangled javascript which can be reverse engineered anyway

<comment><USER46> It can be done, but it is usually uglified. No need to give the plain source to outsiders.

</comment></comment></comment><comment><USER48> His demo did not work so his message does not really get across. Maybe there ware ways to exploit it but if so he failed. I got a CORS rejection.

<comment><USER49> The demo may not have worked for you, but it does work and works for many other people. Just because your particular browser is secured does not mean the author failed.

</comment></comment><comment><USER50> This just reminds me why I use Vagrant and only run a local webserver while I'm actually doing development work on it.

</comment><comment><USER51> Funny enough, the site is reporting port 3000 to be running a web server. It is not - according do nmap and my knowledge.

Any ideas on this?

<comment><USER52> If like me you saw the bright red text "If you see any results like localhost:3000 is available!" as meaning :3000 was actually available, it's just an example. The yellow box above seems to be where the results would actually be.

<comment><USER51> I must admit, it was exactly this. I read the text without using my brain properly.

Please accept my sincere apologies.

<comment><USER52> I did exactly the same thing and spent too long running various things to find out what on Earth was using the port! Only reason I had a good guess at what it may have been.

</comment></comment></comment></comment><comment><USER53> O only get: "Scanning localhost ... unreachable.", and there are at least 3 web servers active on the network.

<comment><USER54> Do you have WebRTC disabled? I disable it in Firefox and it breaks this test.

<comment><USER53> No, default Chrome settings.

</comment></comment></comment><comment><USER55> Firejail allows for the creation of sandboxed interfaces, which include the ability to block local network access.

</comment><comment><USER56> In the source code, he is attempting to serve images from [http://localhost:4000/](http://localhost:4000/)

It looks like a mistake because the image URLs are unlikely to exist on YOUR localhost at port 4000 when you load the page.

</comment><comment><USER57> So does this mean that if I'm running a local dev machine with un-bundled source code on my company computer:

Any person that joins the wifi network and goes to a website that sniff's this out will have access to my computers local server?

<comment><USER58> Depends what server software you're running and how it's configured. The specific configuration element you want to look for is usually called the "bind address". If it's set to something other than "127.0.0.1" then it will probably accept external connections.

If you know the port number your server is running on, you can also open up command prompt / terminal and check with "netstat -an". Look at the local address column and make sure your web server is listening on 127.0.0.1.

<comment><USER57> Appreciate the insight. Looks like I see:

tcp4 // 0 // 0 // * . 8080 // * . * // LISTEN

Local address being (*.8080)

</comment></comment></comment><comment><USER59> > It is not sufficient security to only bind to 127.0.0.1 (the "loopback > interface")

What would be a better, more secure thing to do when you have multiple web servers on one machine behind a SSL-terminating reverse proxy?

<comment><USER60> The thing to do is not run a web browser on that machine. Run the servers in a VM.

<comment><USER61> But this seems to be able to see servers accessible to the local machine, so if my Dev server in a VM is accessible from my browser, it's accessible to any webpage in my browser?

<comment><USER60> The reverse proxy is accessible from your browser and is properly configured to not accept random requests from any webpage (See: CORS). The others are not directly accessible, but only through the reverse proxy server. Does that make sense?

<comment><USER61> not really, no. i still don't see what the reverse proxy or the VM are bringing to the table here. If i'm understanding the necessary CORS config here, it's to simply not send any access-control-allow-origin header, which does not require a VM or reverse proxy, most HTTP services do that by default.

simply being accessed through a reverse proxy instead of directly doesn't add any additional security

<comment><USER60> Actually, you are right.

</comment></comment></comment></comment></comment></comment><comment><USER62> I covered how he is doing this here: [https://tryhackme.com/room/xss#6](https://tryhackme.com/room/xss#6) (Look at all the tasks first)

</comment><comment><USER63> Does this not work on mobile? I'm not seeing any of my web services show up on my server when opening this page in iOS Safari.

EDIT: In fact the status of local network scan doesn't come up at all.

</comment><comment><USER64> I had supposed to see my servers exposed but... [https://imgur.com/a/hjBaYbG](https://imgur.com/a/hjBaYbG)

</comment><comment><USER65> On my machine the requests seem to go out but the browser blocks the responses... Which seems weird, I've have expected the opposite (the browser blocking outgoing).

</comment><comment><USER66> Would this have implications for people who use Cryptomator, which uses loopback connections to a local WebDAV drive in order to encrypt/decrypt files?

</comment><comment><USER67> I have use that extension quite long time but i remove it immediately after see this news!

</comment><comment><USER68> I wonder if you could use the websocket API to scan for other (non-http) open ports.

</comment><comment><USER69> And why?

</comment><comment><USER70> Nope, you can't

        Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost/. (Reason: CORS header 'Access-Control-Allow-Origin' missing)

Anyway

        TypeError: /(192\.168\.[0-9]+\.)[0-9]+/.exec(...) is null i-can-see-your-local-web-servers:169:41

<comment><USER71> The Cross-Origin check be circumvented via DNS Rebinding: When you request mypage.com, my DNS returns the ip of my webserver. On all subsequent requests, it will return 127.0.0.1. Now localhost is on the same origin as my page.

<comment><USER70> It doesn't matter, you should be in control of a DNS the user relies on and you should have your server send

        Access-Control-Allow-Origin: mypage.com

or

        Access-Control-Allow-Origin: *

which is not a default anywhere AFAIK and is domain based, not IP based

And your server should be enabled to respond to mypage.com host header

<comment><USER71> Based on m12k's suggested interpretation of your comment:

> you should be in control of a DNS the user relies on

You always are when a users visits your domain – you control the DNS of your domain.

> Access-Control-Allow-Origin: *

You don't need access-control headers, because you stay on the same domain.

> Your server should be enabled to respond to mypage.com host header

Most servers listening on localhost ignore the host header.

<comment><USER70> > You always are when a users visits your domain – you control the DNS of your > domain.

I meant you need to control the poisoned DNS

If I use 126.96.36.199 as DNS you can only work on the domains you already control, which is kinda useless

> You don't need access-control headers, because you stay on the same domain.

No, you don't

My localhost server only respond to localhost and 127.0.0.1 host header

Not to mypage.com

Nginx does taht too by default

[https://github.com/nginx/nginx/blob/master/conf/nginx.conf#L...](https://github.com/nginx/nginx/blob/master/conf/nginx.conf#L37)

But even if you did, you still haven't resolved the issue: you can't make a call to a different domain without access-control headers, unless it's the __same __domain

you can't load mypage.com and then fetch from www.mypage.com, even if you resolve www.mypage.com to 127.0.0.1 the browser won't let you do it

<comment><USER72> > But even if you did, you still haven't resolved the issue: you can't make a > call to a different domain without access-control headers, unless it's the > same domain

> you can't load mypage.com and then fetch from www.mypage.com, even if you > resolve www.mypage.com to 127.0.0.1 the browser won't let you do it

In this part you're confusing what a rebinding attack is: by serving a DNS response with a short TTL an attacker is able to associate two different IPs to the same query, thus it'd be mypage.com and mypage.com (not www.mypage.com).. bypassing the same origin restrictions of the browsers.

[https://capec.mitre.org/data/definitions/275.html](https://capec.mitre.org/data/definitions/275.html)

<comment><USER70> > In this part you're confusing what a rebinding attack is: by serving a DNS > response with a short TTL an attacker is able to associate two different IPs

But it doesn't really work.

I query my DNS, on my home router, not your DNS.

And the DNS on my home router query the ISP's DNS, which caches requests.

I bet you can't go below few minutes resolution.

I had this problem when validating the Letsencrypt DNS challenge, I had to let certbot run for almost 20 minutes before my home router picked up the new value.

When I'm at work, I use the company's DNS, which ignores non standard TTLs and caches the first answer forever (well... almost) and disallow external domains that resolve to reserved IP addresses.

<comment><USER73> Wait, doesn't the certbot DNS challenge query the nameservers of the domain being checked, not your local DNS resolver, otherwise my fast DNS challenges should fail?

<comment><USER70> Not by default [1], but you can set it to what you prefer.

But in my case my network is configured to always reach the in house DNS first, to keep latency low

[1] [https://github.com/letsencrypt/boulder/blob/8167abd5e3c7a142...](https://github.com/letsencrypt/boulder/blob/8167abd5e3c7a1427b1cfb459f50b18b44e45d5b/bdns/dns.go#L244)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER74> I use NoScript, you can't see shit.

<comment><USER75> You can't see shit neither

<comment><USER76> yes, he can, he will see the modern equivalent of "This site is best viewed in Internet Explorer". Which in 2019 becomes "Please enable Javascript to view this page"

<comment><USER77> Honestly, such notices are shockingly unusual - most of the time (at least for the sites I encounter) they don't bother with <noscript>, you just get a broken and/or blank page.

I mostly use the web for reading blogs and articles, so the loss of dynamic sites isn't troublesome, but it's certainly not for most users.

(Edit: Some numerical context I have enabled Javascript for 194 sites over the last five years, whereas I encounter several new sites daily.)

<comment><USER76> I also browse with noscript all the time and I get them quite often. Mostly on product landing pages and Show HN demos.

<comment><USER77> Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.

<comment><USER78> > Hmm, I wonder if it's confirmation bias on my end, or just a difference in > what pages we each view.

Yes.

Joking aside, I will add that I've been a NoScript/FlashBlock user for quite some time (more than a decade? I honestly can't remember), and while I run into some things that are frustrating (just had to disable NoScript for a tab to order plane tickets), it is refreshingly uncommon.

Yes, you can browse with default deny to JS and Flash.

</comment></comment></comment></comment></comment></comment></comment><comment><USER79> I only run on local on ports: 8080, 9090, 9191, 8081, 8082 and 8083. So scanning only on 3000 is a bit narrow...

<comment><USER80> It's not scanning only port 3000:

        const portsToTry = [
          80, 81, 88,
          3000, 3001, 3030, 3031, 3333,
          4000, 4001, 4040, 4041, 4444,
          5000, 5001, 5050, 5051, 5555,
          6000, 6001, 6060, 6061, 6666,
          7000, 7001, 7070, 7071, 7777,
          8000, 8001, 8080, 8081, 8888,
          9000, 9001, 9090, 9091, 9999,
        ];

view-source:[http://http.jameshfisher.com/2019/05/26/i-can-see-your- local...](http://http.jameshfisher.com/2019/05/26/i-can-see-your-local-web- servers/) :125</comment></comment>


Air Force Network Admins Found Out About Drone Virus Through News Story - <AUTHOR> http://tech.slashdot.org/story/11/10/11/2311215/air-force-network-admins-found-out-about-drone-virus-through-news-story

<comment><USER2> Direct link to article, bypassing aggregator: [http://www.wired.com/dangerroom/2011/10/drone-virus-kept- qui...](http://www.wired.com/dangerroom/2011/10/drone-virus-kept-quiet/)</comment>


Steve Reeves: Software engineers need to take hard look at their profession - <AUTHOR> http://www.nzherald.co.nz/opinion/news/article.cfm?c_id=466&objectid=10593105&pnum=0

<comment><USER2> Decision makers need to come to terms with the hard realities of software development. Software development is not a field comprised of well-defined problems and stable environments. You simply can not bring scientific or mathematical rigor to a field where A) software can encompass any conceivable idea or concept that exists in the entirety of human knowledge, and B) specifications for every single project are different, and can almost never be firmly agreed upon before work begins even with the foremost world experts involved.

Imagine trying to develop engineering practices if there were infinite different realities each with their own bizarrely unique laws of physics. What about building a medical knowledge database if every generation of humans was built from a completely new DNA sequence.

Without some groundbreaking advancements like true AI there is not much hope of the situation for huge projects improving across the board. I believe large projects can succeed with the right leadership, but not adhering to the same formal set of procedures across the board.</comment>


Ask HN: MacBook Pro 13 or 15 inches? - <AUTHOR> I'm a programmer, computer science student and hobby photographer. I'm going to buy a new notebook and my choice is going to be between these 2 devices:
1. MacBook Pro Retina 15 inches base model (16gb ram, 2.2 quadcore i7) 2. MacBook Pro Retina 13 inches, middle model with 256gb of disk with 16gb of ram (instead of 8) and 3.1 dual core i7
The price is exactly the same, so the choice depends mostly on the screen and the processor.
1. I want it to be a long term investment (provided it doens't break) so performances should remain decent for several years 2. What I do, mostly, is web browsing, NodeJS development in my spare time and C/Python at college. Plus, not very often, I work on RAW files from my nikon, but nothing big
I tried both and I don't think the 13 inches screen is going to be a problem for me, I'm more worried about the 3.1ghz dual core i7 vs the 2.2 quad core i7 of the 15 inches. Do you think there's such a great difference between these two processor? In particular considering that the notebook should last as long as possible.
Regarding the 15 inches, do you think it's too big/heavy to use comfortably on the go / small college desks?
I'm at the point where I think I'm going to flip a coin to get a decision so any advice is very welcomed
Thanks <comment><USER2> I've been running the same 13" MBP for five years. Dual-core processor has been fine for me doing programming, photo editing in Adobe Lightroom, and music production with Avid Pro Tools.

I had a 15" Powerbook before that. I went with 13" to make it more portable, and have been happy with that decision. But I also kind of miss the larger screen. I hook it up to a 27" display at home though, so no big deal.

For your intended purposes, I think you'd be fine either way. Pick your favorite size. :-)

</comment><comment><USER3> I'd go with the 15", which is similar to the model I'm typing this on. The 2.2 GHz quad-core i7 is plenty fast, and the extra cores will often provide a speedup. You'll also get a discrete GPU, which is worthwhile.

The size and portability of the 15" is fine as far as I'm concerned - I doubt there's a practical difference really. Certainly it will fit fine even on a small desk.</comment>


Code like you're Notch - <AUTHOR> http://www.mrspeaker.net/2011/09/15/code-like-youre-notch/

<comment><USER2> I WAY prefer this post to the previous post about watching Notch code.

</comment><comment><USER3> I wish I had the level of focus he describes.

<comment><USER4> The internet is a distraction. Case in point, why am I replying to a comment on HN when I could be coding?!

<comment><USER5> Because if you're like me, you're sitting in class incredibly bored. ;)</comment></comment></comment>


Conservation Hypocrisy: Should We Reintroduce Lions to Europe? - <AUTHOR> https://ecologyforthemasses.com/2019/08/01/living-among-beasts-sharing-the-burden-of-conservation/ <comment><USER2> Lions went extinct in Europe much earlier than the article suggests, not least because Turkey is not in Europe (except a very tiny bit).

But this still raises an interesting issue: Europe has been completely "tamed" with true wilderness and primal forests essentially all gone, and most large predators driven to extinction.

Today the very limited attempts to re-introduce wolves and bears to Western Europe are met with huge resistance from the farming industry and hunting associations.

Yet we seem to think that other should protect elephants, lions, tigers, etc. which are more dangerous and/or can cause more damage.

While I agree that elephants, lions, etc should be protected, we should really follow our own advice at home and work to protect and re-introduce our own fauna.

</comment><comment><USER3> Locally we have been dealing with the resurgence of wild turkeys. There's been some whining about it, even though turkeys are not especially dangerous, just a little inconvenient.</comment>


Mars rover is frozen in place following software error - <AUTHOR> https://www.extremetech.com/extreme/305205-mars-rover-is-frozen-in-place-following-software-error <comment><USER2> NASA is now reporting the problem as fixed: [https://mars.nasa.gov/msl/mission- updates/8589/sols-2653-265...](https://mars.nasa.gov/msl/mission- updates/8589/sols-2653-2655-attitude-adjustment/)

(Press article at [https://www.space.com/mars-rover-curiosity-attitude- glitch.h...](https://www.space.com/mars-rover-curiosity-attitude-glitch.html))

</comment><comment><USER3> A better title would be: Mars rover stops moving because it lost track of its orientation. This is uncommon, but well within the realm of "normal" contingencies. And in fact it has already been fixed.

<comment><USER4> : The Curiosity Story

</comment></comment><comment><USER5> Having worked on autonomous robot software, I'm willing to bet this is software taking the blame for a hardware issue :-)

<comment><USER6> Having worked on autonomous robot hardware i beg to differ

<comment><USER7> Ah yes, the programmers blame the engineers, and the engineers blame the programmers

<comment><USER8> When Einstein worked on nuclear bomb the saying was: If he fails French will say he's American, Americans will say he's German, and Germans will say he's Jew. If he succeed Germans will say he's German, Americans will say he's American, and French will say he belongs to the world.

<comment><USER9> His comment was about the theory of relativity rather than the bomb:

[https://en.wikiquote.org/wiki/Albert_Einstein#1910s](https://en.wikiquote.org/wiki/Albert_Einstein#1910s)

</comment></comment></comment></comment></comment><comment><USER10> A developer I know at JPL has been quite stressed about this operation. Unfortunately I can't speak to details of the software changes.

<comment><USER11> That is the nature of the job, because the payoff when things work is so rewarding.

Good luck, Curiosity developers, engineers, and scientists -- we are all rooting for you.

</comment></comment><comment><USER12> Would appreciate any technical info from someone who knows more about this, the article is not targeted to a technical audience.

<comment><USER2> Here is a description of the problem from a UC Davis geobiologist who is using the rover to study habitability.

[https://mars.nasa.gov/msl/mission- updates/8587/sols-2649-265...](https://mars.nasa.gov/msl/mission- updates/8587/sols-2649-2652-curiosity-loses-its-attitude/)

</comment></comment><comment><USER13> > Thanks to Curiosity, we have a better idea of where water existed (and may > still exist) on Mars, as well as where we might be able to find evidence of > ancient life.

I don't understand why everyone is so excited about finding life on Mars.

Life on Mars means life may be relatively common on water-bearing planets, which means the Filter is more likely to ahead of us than behind.

[https://www.youtube.com/watch?v=sNhhvQGsMEc](https://www.youtube.com/watch?v=sNhhvQGsMEc)

<comment><USER14> there's no reason the Great Filter couldn't be both ahead and behind us.

\- Life on planets with fossil fuels available advances to an industrial phase and dies off either from nuclear war or global warming

\- Life on planets without fossil fuels never advances to even the iron age.

<comment><USER13> You're right that fossil fuels are contingent. They exist because of a big evolutionary coincidence that might not be repeated on other worlds.

It's possible, though, that aliens might not need fossil fuels to get to space. If they had more efficient photosynthesis, for example (ours is <5% efficient), living plants could have the energy content of gasoline. They might eat gasoline. All their fuel usage would be carbon neutral (CO2 pulled out of the atmosphere). They would be way ahead of us.

Or it's possible that we're the most advanced because fossil fuels are necessary and nobody else got them.

<comment> Brave-Steak Wait, can you elaborate on that? Cursory glance at google suggests there can be sufficient other sources of hydrocarbons aside from dinosaurs being wiped out by a meteor.

<comment><USER15> Plants evolved lignin well before fungus figured out how to break it down. That gap in time is when most of our coal was formed.

</comment></comment></comment></comment></comment><comment><USER16> This seems to be no big deal. Stuff like this is how learn to do real world robotics.

<comment><USER17> Sure, but your heart is probably still going to skip a few beats when you realize a software glitch has halted a $2.5 _billion_ device.

<comment><USER11> Viewed another way, a successful bugfix brings a $2.5B instrument back to life.

<comment><USER16> And it demonstrates that the design allowed bug fixes while the rover is on another planet. I view this as big success for the engineering. They did a great job. It's more important to have the ability to fix bugs than avoiding bugs.

<comment><USER18> Assuming your bug fix mechanism is bug free...

<comment><USER16> True. That's where a lot of the quality effort should go. Also keep this part as simple as possible.

</comment></comment></comment></comment></comment></comment><comment><USER19> Can't we just send a few humans already? The wouldn't be able to stay there for years, but it'd be a few orders of magnitude more efficient.

</comment><comment><USER20> What a shitty title. The entire article doesn't even contain the word software.</comment>